[siegfriedweber]

Description

Remove support for node certificates without domain components

Closes #145

Test steps

Between all steps, check the operator and product logs.

1. Install SDP 26.3:

   $ stackablectl release install 26.3 \
         --include commons \
         --include secret \
         --include listener \
         --include opensearch
   

2. Create an OpenSearch cluster with the LTS version 3.1.0:

   $ curl https://raw.githubusercontent.com/stackabletech/opensearch-operator/refs/tags/26.3.0/docs/modules/opensearch/examples/getting_started/initial-opensearch-security-config.yaml | \
         kubectl apply --filename -
   
   $ curl https://raw.githubusercontent.com/stackabletech/opensearch-operator/refs/tags/26.3.0/docs/modules/opensearch/examples/getting_started/opensearch.yaml | \
         sed 's/productVersion: 3\.4\.0/productVersion: 3\.1\.0/' | \
         kubectl apply --filename -
   

3. Check the certificates:

   $ for p in 0 1 2; do
         kubectl exec simple-opensearch-nodes-default-$p -- \
         openssl x509 -in /stackable/opensearch/config/tls/internal/tls.crt -noout -subject
     done
   subject=CN=generated certificate for pod
   subject=CN=generated certificate for pod
   subject=CN=generated certificate for pod
   

4. Check the cluster nodes:

   $ OPENSEARCH_CREDENTIALS=admin:AJVFsGJBbpT6mChn
   $ kubectl exec simple-opensearch-nodes-default-0 -- \
       curl --insecure --user $OPENSEARCH_CREDENTIALS \
       'https://localhost:9200/_cat/nodes?v&h=ip,name,master'
   ip         name                              master
   10.42.0.18 simple-opensearch-nodes-default-1 *
   10.42.0.20 simple-opensearch-nodes-default-2 -
   10.42.0.19 simple-opensearch-nodes-default-0 -
   

5. Upgrade the cluster to SDP 26.7:

   $ stackablectl release upgrade 26.7
   Upgraded to release "26.7"
   

6. Check the certificates:

   $ for p in 0 1 2; do
         kubectl exec simple-opensearch-nodes-default-$p -- \
         openssl x509 -in /stackable/opensearch/config/tls/internal/tls.crt -noout -subject
     done
   subject=CN=generated certificate for pod, DC=simple-opensearch-nodes-default-0, DC=simple-opensearch-nodes-default-headless, DC=default, DC=svc, DC=cluster, DC=local
   subject=CN=generated certificate for pod, DC=simple-opensearch-nodes-default-1, DC=simple-opensearch-nodes-default-headless, DC=default, DC=svc, DC=cluster, DC=local
   subject=CN=generated certificate for pod, DC=simple-opensearch-nodes-default-2, DC=simple-opensearch-nodes-default-headless, DC=default, DC=svc, DC=cluster, DC=local
   

7. Check the cluster nodes:

   $ kubectl exec simple-opensearch-nodes-default-0 -- \
       curl --insecure --user $OPENSEARCH_CREDENTIALS \
       'https://localhost:9200/_cat/nodes?v&h=ip,name,master'
   ip         name                              master
   10.42.0.28 simple-opensearch-nodes-default-1 *
   10.42.0.27 simple-opensearch-nodes-default-2 -
   10.42.0.29 simple-opensearch-nodes-default-0 -
   

8. Upgrade the opensearch-operator to 0.0.0-pr202 and delete the StatefulSet due to a wrong label on a PVC (fixed in SDP 26.11):

   $ stackablectl operator uninstall opensearch
   $ stackablectl operator install opensearch=0.0.0-pr202
   Installed opensearch=0.0.0-pr202 operator
   $ kubectl delete --cascade=orphan statefulsets.apps simple-opensearch-nodes-default
   

9. Check the cluster nodes:

   $ kubectl exec simple-opensearch-nodes-default-0 -- \
       curl --insecure --user $OPENSEARCH_CREDENTIALS \
       'https://localhost:9200/_cat/nodes?v&h=ip,name,master'
   ip         name                              master
   10.42.0.33 simple-opensearch-nodes-default-1 -
   10.42.0.32 simple-opensearch-nodes-default-2 *
   10.42.0.34 simple-opensearch-nodes-default-0 -
   

Definition of Done Checklist

• Not all of these items are applicable to all PRs, the author should update this template to only leave the boxes in that are relevant
• Please make sure all these things are done and tick the boxes

Author

• Changes are OpenShift compatible
• Helm chart can be installed and deployed operator works
• Integration tests passed:

  --- PASS: kuttl/harness/smoke_opensearch-3.8.0_opensearch_home-_stackable_opensearch_server-use-tls-true (308.94s)
  

• Links to generated (nightly) docs added:
  https://docs.stackable.tech/home/nightly/opensearch/usage-guide/upgrade/
• Release note snippet added:
  Remove support for node certificates without domain components #202 (comment)

Reviewer

• Code contains useful comments
• Code contains useful logging statements
• (Integration-)Test cases added
• Documentation added or updated. Follows the style guide.
• Changelog updated
• Cargo.toml only contains references to git tags (not specific commits or branches)

Acceptance

• Feature Tracker has been updated
• Proper release label has been added
• Links to generated (nightly) docs added
• Release note snippet added
• Add type/deprecation label & add to the deprecation schedule
• Add type/experimental label & add to the experimental features tracker

[siegfriedweber]

Release notes

Upgrade from 26.7

OpenSearch

Upgrading OpenSearch to SDP 26.11 requires the nodes StatefulSets to be recreated manually, see the upgrade guide.