* jwt implementation, adding preflight + versionprobe
* adding JWT auth to anomaly detection client, some minor refactorings
* added missing license
* added provider, refactorings
* fixing small bugs
* set smaller default expiration
* using the correct OpenSearch distro for the erchitecture
* added config options
* small refactorings, fixing tests, adding dependencies for running tests from inside IntelliJ
* fixing import to correct Duration class
* removing unnecessary debug output
* fixing tests
* fixing tests
* adding JWT to Cluster test
* fixing path
* fixing path problems
* fix architecture logic for DatanodeContainerizedBackend
* fixing path problems
* fixing JWT settings in tests
* fixing JWT settings in tests
* fixing cluster test
* fixing cluster test
* fixing cluster test
* adding missing jwt token
* small refactoring to force thread-safety on creation
* the datanode uses mongodb - so the closing sequence needs to be adjusted
* moving config changes into config file, keep only change that has to be done by code
* adding breaking change info for JWT and clock synchronization.
* renaming config settings
* renaming config settings
* removed debug settings that are no longer in use
* renamed provider/annotation to be more precise
* lowering log level
* smaller refactorings/renamings
* keep config change in code until PR is merged, remove code in a follow-up PR
* moved changelog file to correct folder
* clock synchronsation
Co-authored-by: Dennis Oelkers <dennis@graylog.com>
* added jwt auth into changes after merge
* upped the timeout
* log curl connection information in DatanodeOpensearchWait
* replacing with jwt auth
* changing wait strategy
* fixing imports
* remove uname/pwd from opensearch rest base url
* propagate jwt token provider to http rest client callback, obtain fresh token every time
* inject IndexerJwtAuthTokenProvider in DatanodeConfigurationProvider
* remove rest uname/pwd from datanode configuration
---------
Co-authored-by: Tomas Dvorak <tomas.dvorak@graylog.com>
Co-authored-by: Dennis Oelkers <dennis@graylog.com>
* Insecure startup of OS in datanode only if explicitly configured
* Data node can be started without starting OS, just to be discovered by pre-flight mode
* Start datanode jersey only after ssl configuration resolved, listen to change events
* Adapted DatanodeSecuritySetupIT to work with https version of the datanode interface
* simplify hostnames in DatanodeSecuritySetupIT
* code cleanup
* added changelog
* code cleanup
* disable security plugin and perf analyzer in matrix tests opensearch
* Fixed datanode jersey service
* Fixed opensearch instance env
* Opensearch security setup refactored
* code cleanup
* removed commented out code from datanodes JerseyService
* add fqdn to the http cert in the DatanodeSecuritySetupIT
* configure truststore only if the security is enabled
* code cleanup
* reintroduced root certificate finder
* adjusted class and methods visibility of RootCertificateFinder
* first version adding gl CA
* adding custom trutstore
* fixed SSLContext
* fixed SSLContext for connectivity check
* fix comments
* fixed imports
* reverting altnames tmp change
* reverting altnames tmp change
* fixed preflightconfig, fixed hostname-verifier
* added credentials to target string, set hostname
* added credentials from target string
* only add TrustManager if https is requested
* fixing tests
* add another alt name
* change creation of restBaseUrl
* DatanodeSecuritySetupIT adaptation for stable hostname of the datanode
* trying to fix naming/binding for docker
* adding another alt name
* added s to http
* changing exception
* more debug output
* change test
* change test
* adding debug
* switch back to http
* more debugging
* more debugging
* added exception to retryer
* fixed boolean eval
* going to the next step on FAILED, too
* fixing if clause
* cleanup
* cleanup
* cleanup
* cleanup
* cleanup
* cleanup
* cleanup
* cleanup
* removed wrong credentials provider
* added name verifying
* fix alt name handling
* removed unneccessary hostname verifier
* reverted DefaultX509TrustManager
* removed link to DefaultX509TrustManager because it's used in different contexts, singleton for SSL related stuff so we don't instantiate it all the time
* full rollback DefaultX509TrustManager
* reverted change on logging
* revert VersionProbe, unnecessary changes
* DatanodeSecuritySetupIT fixed, separated bind address and hostname
* changed to lambda
* changed to lambda
* small refactorings in csrsigner
* added test for CustomCAX509TrustManager
* added binding for CaService into Preflight
* fixing bindings
* fixing bindings
---------
Co-authored-by: Tomas Dvorak <tomas.dvorak@graylog.com>
* Synchronize opensearch config to a user-defined directory (fixes#15223)
* fixed check naming
* fixed opensearch configuration location
* simplified Environment constructor
* point gc logs of datanodes opensearch to /tmp for now
* full dir sync for opensearch config
* Fixed full dir sync when removing non-empty dir
* simpified recursive directory deletion
