Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

WPB-6717 brig: Support connecting to Elasticsearch over TLS #3989

Merged
merged 45 commits into from
Apr 25, 2024
Merged

WPB-6717 brig: Support connecting to Elasticsearch over TLS #3989

merged 45 commits into from
Apr 25, 2024

Conversation

akshaymankar
Copy link
Member

@akshaymankar akshaymankar commented Apr 9, 2024 •
edited
Loading

https://wearezeta.atlassian.net/browse/WPB-6716

Checklist

  • Add a new entry in an appropriate subdirectory of changelog.d
  • Read and follow the PR guidelines

@zebot zebot added the ok-to-test Approved for running tests in CI, overrides not-ok-to-test if both labels exist label Apr 9, 2024
@battermann battermann changed the title brig: Support connecting to Elasticsearch over TLS WPB-6717 brig: Support connecting to Elasticsearch over TLS Apr 11, 2024
@akshaymankar akshaymankar force-pushed the es-tls branch 2 times, most recently from 55a5627 to adee27c Compare April 24, 2024 08:32
@akshaymankar akshaymankar marked this pull request as ready for review April 24, 2024 10:21
fisx
fisx approved these changes Apr 24, 2024
View reviewed changes
charts/brig/templates/tests/brig-integration.yaml Outdated Show resolved Hide resolved
services/brig/src/Brig/App.hs Outdated Show resolved Hide resolved
services/brig/test/integration/Run.hs Outdated Show resolved Hide resolved
akshaymankar and others added 21 commits April 24, 2024 14:49
@akshaymankar
dockerephemeral: Run ES with TLS
f635aa8 
Reuse federation certs for ES as they are still valid for localhost usage.
Maybe we can create separate certs, to be decided later.
@akshaymankar
[WIP] brig: Support talking to ES over TLS
97cdcfc
@akshaymankar
WIP: Support ES TLS in brig-index
7cf35bd
@battermann @akshaymankar
simplify ES settings, use http mgr with tls
fb4760c
@battermann @akshaymankar
fix db reset local index
fbf67bf
@battermann @akshaymankar
make tests run again
ed517a0
@battermann @akshaymankar
tmp fix CI tests
756ee60
@battermann @akshaymankar
simplified brig chart
fee937a
@battermann @akshaymankar
wip: verify cert in local env
9ecfbd5
@battermann @akshaymankar
use localhost
f0e352b
@battermann @akshaymankar
use tls locally for additional index
da2f1e0
@battermann @akshaymankar
introduce scheme for es
f9860dd
@battermann @akshaymankar
refactor selfsigned.sh and create ca for es
411f918
@battermann @akshaymankar
putting stuff together
5709eb8
@akshaymankar
fix comment
97e1460
@akshaymankar
Add missing repo
2711179
@akshaymankar
helm_vars/wire-server: Add TLS CA certs to configs
77719c1
@akshaymankar
hack/bin/integration-setup-federation.sh: Don't skip-deps
fdf2409 
We have a new repo (bedag) which is not updated by `update.sh`, so helmfile
cannot use `--skip-deps`
@akshaymankar
helm charts: Fix silly mistakes
99f3ddc
@akshaymankar
Explicitly add bedag repo because helmfile doesn't work without --ski…
0a40653 
…p-deps
@akshaymankar
charts/elasticsearch-ephemeral: Actually enable TLS when requested
497cd5f
@akshaymankar
charts/elasticsearch-ephemeral: Use right env vars
1be6180
@akshaymankar
typo
b64ea0e
@akshaymankar
brig-index: Rename tls-ca-certificate-file CLI option to cassandra-ca…
f71c785 
…-cert

This will disambiguagte CA cert for cassandra and ES
@akshaymankar
charts/elasticsearch-index: A little bit of consistency in camel casing
017d590
@akshaymankar
docs: Document config-options to configure TLS for TLS
c8788a2
@akshaymankar
changelog
2c4865e
@akshaymankar
brig-index: Allow overriding ca certs when running reindex
5647bd8
@akshaymankar
charts/integration: Expect ES to always to over TLS
caabcaf
@akshaymankar
Makefile: Set ES CA cert
b8dafd5
@akshaymankar
charts/integration: Typo
6f96d8c
@akshaymankar
charts/integration: Mount ES CA for dynamic brigs
5728d08
@akshaymankar
charts/brig: Mount ES CA in integration tests
f9fbc80
@akshaymankar
Typo
212c2eb
@akshaymankar
Fix brig-index create tests
289bc6c
@akshaymankar
HasCallStack
8ffbccf
@akshaymankar
Explicitly turn off TLS verification when requested
5636d49
@akshaymankar
Fix index migration test
ba95275
@akshaymankar
brig-integration: Use TLS when it can be used
40f7d84
@akshaymankar
charts/brig: Ensure ES cert is mounted
e8c8c44
@akshaymankar
charts/es-index: better var name
5e5ce41
@akshaymankar
Typo
863f5eb
@akshaymankar
Brig: Enable TLS verification by default
138a66a 
Was a mistake in the same PR earlier
@akshaymankar
brig-integration: Reinstate TLS verification by default
9fd55a7
@akshaymankar
brig-integration: Use TLS correctly when proxying to ES
02d343c
@akshaymankar akshaymankar merged commit f5ffe5e into develop Apr 25, 2024
8 checks passed
@akshaymankar akshaymankar deleted the es-tls branch April 25, 2024 09:40
@elland elland mentioned this pull request Apr 25, 2024
Merged
@echoes-hq echoes-hq bot added echoes: technical-roadmap/throughput More specific category, to highlight task aiming at improving the development velocity and effici... echoes: technical-roadmap/security More specific category, to highlight task that tackle security requirements. labels Jun 27, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@fisx fisx fisx approved these changes

Assignees
No one assigned
Labels
echoes: technical-roadmap/security More specific category, to highlight task that tackle security requirements. echoes: technical-roadmap/throughput More specific category, to highlight task aiming at improving the development velocity and effici... ok-to-test Approved for running tests in CI, overrides not-ok-to-test if both labels exist
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@akshaymankar @fisx @zebot @battermann