-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathdev-cluster.sh
162 lines (146 loc) · 7.58 KB
/
dev-cluster.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
#! /bin/bash
# This value determines how many worker nodes are created
node_count=4
# Create Docker network if it doesn't exist
create_network() {
docker network create --subnet=172.20.0.0/16 opensearch-dev-net || true
}
# Define the TLS certificates for the cluster
create_certs() {
# Create the root cert
openssl genrsa -out root-ca-key.pem 2048
openssl req -new -x509 -sha256 -key root-ca-key.pem -subj "/C=US/ST=OREGON/L=PORTLAND/O=OPENSEARCH/OU=DOCS/CN=ROOT" -out root-ca.pem -days 730
# Create the admin cert
openssl genrsa -out admin-key-temp.pem 2048
openssl pkcs8 -inform PEM -outform PEM -in admin-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out admin-key.pem
openssl req -new -key admin-key.pem -subj "/C=US/ST=OREGON/L=PORTLAND/O=OPENSEARCH/OU=DOCS/CN=A" -out admin.csr
openssl x509 -req -in admin.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out admin.pem -days 730
# Create OpenSearch node certs
for ((i=1; i <= $node_count; i++)); do
openssl genrsa -out os-node-0${i}-key-temp.pem 2048
openssl pkcs8 -inform PEM -outform PEM -in os-node-0${i}-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out os-node-0${i}-key.pem
openssl req -new -key os-node-0${i}-key.pem -subj "/C=US/ST=OREGON/L=PORTLAND/O=OPENSEARCH/OU=DOCS/CN=os-node-0${i}" -out os-node-0${i}.csr
echo "subjectAltName=DNS:os-node-0${i}" | tee -a os-node-0${i}.ext
echo "subjectAltName=IP:172.20.0.1${i}" | tee -a os-node-0${i}.ext
openssl x509 -req -in os-node-0${i}.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out os-node-0${i}.pem -days 730 -extfile os-node-0${i}.ext
done
# Create OpenSearch Dashboards certs
openssl genrsa -out os-dashboards-01-key-temp.pem 2048
openssl pkcs8 -inform PEM -outform PEM -in os-dashboards-01-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out os-dashboards-01-key.pem
openssl req -new -key os-dashboards-01-key.pem -subj "/C=US/ST=OREGON/L=PORTLAND/O=OPENSEARCH/OU=DOCS/CN=os-dashboards-01" -out os-dashboards-01.csr
echo 'subjectAltName=DNS:os-dashboards-01' | tee -a os-dashboards-01.ext
echo 'subjectAltName=IP:172.20.0.10' | tee -a os-dashboards-01.ext
openssl x509 -req -in os-dashboards-01.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out os-dashboards-01.pem -days 730 -extfile os-dashboards-01.ext
}
# Removes unneeded artifacts from TLS cert creation
clean_up_certs() {
rm *temp.pem *csr *ext
}
# Write config files
write_os_configs () {
for ((i=1; i <= $node_count; i++)); do
cat <<- EOF > opensearch-0${i}.yml
---
# Moved from the docker run commands
cluster.name: opensearch-dev-cluster
node.name: os-node-0${i}
cluster.initial_master_nodes: ["os-node-01","os-node-02","os-node-03","os-node-04"]
discovery.seed_hosts: ["os-node-01","os-node-02","os-node-03","os-node-04"]
bootstrap.memory_lock: true
path.repo: /usr/share/opensearch/snapshots
# Bind to all interfaces because we don't know what IP address Docker will assign to us.
network.host: 0.0.0.0
# Security plugin
plugins.security.ssl.transport.pemcert_filepath: /usr/share/opensearch/config/os-node-0${i}.pem
plugins.security.ssl.transport.pemkey_filepath: /usr/share/opensearch/config/os-node-0${i}-key.pem
plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/opensearch/config/root-ca.pem
plugins.security.ssl.http.enabled: true
plugins.security.ssl.http.pemcert_filepath: /usr/share/opensearch/config/os-node-0${i}.pem
plugins.security.ssl.http.pemkey_filepath: /usr/share/opensearch/config/os-node-0${i}-key.pem
plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/opensearch/config/root-ca.pem
plugins.security.allow_default_init_securityindex: true
plugins.security.authcz.admin_dn:
- 'CN=A,OU=DOCS,O=OPENSEARCH,L=PORTLAND,ST=OREGON,C=US'
plugins.security.nodes_dn:
- 'CN=os-node-01,OU=DOCS,O=OPENSEARCH,L=PORTLAND,ST=OREGON,C=US'
- 'CN=os-node-02,OU=DOCS,O=OPENSEARCH,L=PORTLAND,ST=OREGON,C=US'
- 'CN=os-node-03,OU=DOCS,O=OPENSEARCH,L=PORTLAND,ST=OREGON,C=US'
- 'CN=os-node-04,OU=DOCS,O=OPENSEARCH,L=PORTLAND,ST=OREGON,C=US'
plugins.security.audit.type: internal_opensearch
plugins.security.enable_snapshot_restore_privilege: true
plugins.security.check_snapshot_restore_write_privileges: true
plugins.security.restapi.roles_enabled: ["all_access","security_rest_api_access"]
EOF
done
}
# Write dashboard config file
write_osd_configs () {
cat <<-'EOF' > opensearch_dashboards.yml
---
server.host: "0.0.0.0"
server.name: "jeffh-dev"
opensearch.hosts: ["https://172.20.0.11:9200","https://172.20.0.12:9200","https://172.20.0.13:9200","https://172.20.0.14:9200"]
opensearch.ssl.verificationMode: full
opensearch.username: "kibanaserver"
opensearch.password: "kibanaserver"
opensearch.requestHeadersWhitelist: [ "authorization","securitytenant" ]
server.ssl.enabled: true
server.ssl.certificate: /usr/share/opensearch-dashboards/config/os-dashboards-01.pem
server.ssl.key: /usr/share/opensearch-dashboards/config/os-dashboards-01-key.pem
opensearch.ssl.certificateAuthorities: ["/usr/share/opensearch-dashboards/config/root-ca.pem"]
opensearch_security.multitenancy.enabled: true
opensearch_security.multitenancy.tenants.preferred: ["Private", "Global"]
opensearch_security.readonly_mode.roles: ["kibana_read_only"]
opensearch_security.cookie.secure: true
EOF
}
# Initialize the snapshot repo
# This solves a problem I was running into where a mounted volume
# was owned by root:root within the container. Rather than modifying
# the Dockerfile and building my own images, I'm just using a solution
# I found on stackoverflow: https://serverfault.com/a/984599
snapshot_repo_init() {
docker run --rm -v repo-01:/usr/share/opensearch/snapshots busybox \
/bin/sh -c 'chown -R 1000:1000 /usr/share/opensearch/snapshots'
}
# Launch each node
launch_nodes() {
for ((i=1; i <= $node_count; i++)); do
docker run -d \
-p 920${i}:9200 -p 960${i}:9600 \
-e "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m" \
--ulimit nofile=65536:65536 --ulimit memlock=-1:-1 \
-v data-0${i}:/usr/share/opensearch/data \
-v repo-01:/usr/share/opensearch/snapshots \
-v /home/ec2-user/backups/1.3/deploy/opensearch-0${i}.yml:/usr/share/opensearch/config/opensearch.yml \
-v /home/ec2-user/backups/1.3/deploy/root-ca.pem:/usr/share/opensearch/config/root-ca.pem \
-v /home/ec2-user/backups/1.3/deploy/admin.pem:/usr/share/opensearch/config/admin.pem \
-v /home/ec2-user/backups/1.3/deploy/admin-key.pem:/usr/share/opensearch/config/admin-key.pem \
-v /home/ec2-user/backups/1.3/deploy/os-node-0${i}.pem:/usr/share/opensearch/config/os-node-0${i}.pem \
-v /home/ec2-user/backups/1.3/deploy/os-node-0${i}-key.pem:/usr/share/opensearch/config/os-node-0${i}-key.pem \
--network opensearch-dev-net \
--ip 172.20.0.1${i} \
--name os-node-0${i} \
opensearchproject/opensearch:1.3.7
done
}
launch_node_dashboards() {
docker run -d \
-p 5601:5601 --expose 5601 \
-v /home/ec2-user/backups/1.3/deploy/opensearch_dashboards.yml:/usr/share/opensearch-dashboards/config/opensearch_dashboards.yml \
-v /home/ec2-user/backups/1.3/deploy/root-ca.pem:/usr/share/opensearch-dashboards/config/root-ca.pem \
-v /home/ec2-user/backups/1.3/deploy/os-dashboards-01.pem:/usr/share/opensearch-dashboards/config/os-dashboards-01.pem \
-v /home/ec2-user/backups/1.3/deploy/os-dashboards-01-key.pem:/usr/share/opensearch-dashboards/config/os-dashboards-01-key.pem \
--network opensearch-dev-net \
--ip 172.20.0.10 \
--name os-dashboards-01 \
opensearchproject/opensearch-dashboards:1.3.7
}
create_network
create_certs
clean_up_certs
write_os_configs
write_osd_configs
snapshot_repo_init
launch_nodes
launch_node_dashboards