Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add TLS configuration settings/endpoints for auxiliary transports #5152

Draft
wants to merge 22 commits into
base: main
Choose a base branch
from

Conversation

finnegancarroll
Copy link
Contributor

Description

Add settings for configuring TLS resources for optional auxiliary client/server transports in OpenSearch core which are supplied and registered by plugins.

Auxiliary transport settings/keys/certificates are distinct from http settings as:

  • Aux transports may not be http based
  • Users may want security settings for their aux transports separate from http

Added settings mirror existing http configuration options with exception:

  • Aux transports are disabled by default since they are optional

Issues Resolved

#5104

Do these changes introduce new permission(s) to be displayed in the static dropdown on the front-end? If so, please open a draft PR in the security dashboards plugin and link the draft PR here

Testing

[Please provide details of testing done: unit testing, integration testing and manual testing]

Check List

  • New functionality includes testing
  • New functionality has been documented
  • New Roles/Permissions have a corresponding security dashboards plugin PR
  • API changes companion pull request created
  • Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Replace hard coded setting prefixes with static constants.

Signed-off-by: Finn Carroll <carrofin@amazon.com>
…used in plugin.

Signed-off-by: Finn Carroll <carrofin@amazon.com>
…TTP_CRL_FILE.

Signed-off-by: Finn Carroll <carrofin@amazon.com>
Signed-off-by: Finn Carroll <carrofin@amazon.com>
Signed-off-by: Finn Carroll <carrofin@amazon.com>
Signed-off-by: Finn Carroll <carrofin@amazon.com>
Signed-off-by: Finn Carroll <carrofin@amazon.com>
Signed-off-by: Finn Carroll <carrofin@amazon.com>
Signed-off-by: Finn Carroll <carrofin@amazon.com>
Signed-off-by: Finn Carroll <carrofin@amazon.com>
Signed-off-by: Finn Carroll <carrofin@amazon.com>
Signed-off-by: Finn Carroll <carrofin@amazon.com>
Signed-off-by: Finn Carroll <carrofin@amazon.com>
…nfigDefine(SECURITY_SSL_HTTP_ENABLED) are the same test. Removing dup.

Signed-off-by: Finn Carroll <carrofin@amazon.com>
…generic helper. Add aux and node-to-node transports.

Signed-off-by: Finn Carroll <carrofin@amazon.com>
…h generic transport helper. Add aux transport case.

Signed-off-by: Finn Carroll <carrofin@amazon.com>
…ing name instead of value.

Signed-off-by: Finn Carroll <carrofin@amazon.com>
…h generic helper. Add aux transport case.

Signed-off-by: Finn Carroll <carrofin@amazon.com>
Signed-off-by: Finn Carroll <carrofin@amazon.com>
Signed-off-by: Finn Carroll <carrofin@amazon.com>
… easier application to each CertType. Add aux transport cases.

Signed-off-by: Finn Carroll <carrofin@amazon.com>
Signed-off-by: Finn Carroll <carrofin@amazon.com>
Copy link

codecov bot commented Mar 5, 2025

Codecov Report

Attention: Patch coverage is 70.51282% with 23 lines in your changes missing coverage. Please review.

Project coverage is 71.68%. Comparing base (305df57) to head (04ba906).
Report is 3 commits behind head on main.

Files with missing lines Patch % Lines
...rg/opensearch/security/ssl/SslSettingsManager.java 79.62% 4 Missing and 7 partials ⚠️
.../opensearch/security/ssl/config/SslParameters.java 21.42% 11 Missing ⚠️
...ensearch/security/ssl/util/SSLConfigConstants.java 83.33% 0 Missing and 1 partial ⚠️
Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##             main    #5152      +/-   ##
==========================================
+ Coverage   71.64%   71.68%   +0.04%     
==========================================
  Files         335      335              
  Lines       22748    22803      +55     
  Branches     3599     3607       +8     
==========================================
+ Hits        16297    16346      +49     
- Misses       4651     4655       +4     
- Partials     1800     1802       +2     
Files with missing lines Coverage Δ
...arch/security/ssl/OpenSearchSecuritySSLPlugin.java 87.24% <100.00%> (ø)
...a/org/opensearch/security/ssl/config/CertType.java 100.00% <100.00%> (ø)
...opensearch/security/ssl/util/SSLRequestHelper.java 66.98% <100.00%> (ø)
...ensearch/security/ssl/util/SSLConfigConstants.java 80.76% <83.33%> (+1.60%) ⬆️
...rg/opensearch/security/ssl/SslSettingsManager.java 74.66% <79.62%> (+1.58%) ⬆️
.../opensearch/security/ssl/config/SslParameters.java 53.84% <21.42%> (-3.10%) ⬇️

... and 7 files with indirect coverage changes

🚀 New features to boost your workflow:
  • Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant