Use a Helm dependency for the search backend (OpenSearch)

.github/workflows/deploy.yml

@@ -95,6 +95,10 @@ jobs:
         docker image tag "opensearch-custom:latest" "$REMOTE_IMAGE_REF"
         docker push "$REMOTE_IMAGE_REF"
 
+    - name: Download Helm dependencies
+      run: |
+        helm dependency update ./target/helm/openshift/search-quarkus-io
+
     - name: Deploy Helm charts
       run: |
         helm upgrade --install search-quarkus-io ./target/helm/openshift/search-quarkus-io \

pom.xml

@@ -36,7 +36,11 @@
     <version.formatter.plugin>2.23.0</version.formatter.plugin>
     <version.impsort-maven-plugin>1.9.0</version.impsort-maven-plugin>
     <!-- This version needs to match the version in src/main/docker/opensearch-custom.Dockerfile -->
-    <version.opensearch>2.14</version.opensearch>
+    <version.opensearch>2.14.0</version.opensearch>
+    <!-- This version is DIFFERENT from the OpenSearch version;
+         it must be the version of the chart whose appVersion is ${version.opensearch} (see above).
+         See https://github.com/opensearch-project/helm-charts/blob/0c910008bbdaa66f200307864d3b9466c2864319/charts/opensearch/Chart.yaml#L24 -->
+    <version.opensearch.helm-chart>2.20.0</version.opensearch.helm-chart>
     <version.quarkus-web-bundler>1.4.0</version.quarkus-web-bundler>
   </properties>
   <dependencyManagement>
@@ -273,6 +277,7 @@
             <maven.revision>${revision}</maven.revision>
             <maven.project.testResourceDirectory>${project.basedir}/src/test/resources</maven.project.testResourceDirectory>
             <maven.version.opensearch>${version.opensearch}</maven.version.opensearch>
+            <maven.version.opensearch.helm-chart>${version.opensearch.helm-chart}</maven.version.opensearch.helm-chart>
           </systemProperties>
         </configuration>
       </plugin>

src/main/helm/values.staging.yaml

@@ -12,8 +12,7 @@ app:
       cpu: 400m
       memory: 500Mi
 opensearch:
-  envs:
-    OPENSEARCH_JAVA_OPTS: ' -Xms700m -Xmx700m '
+  opensearchJavaOpts: ' -Xms700m -Xmx700m '
   resources:
     limits:
       cpu: 1000m

src/main/helm/values.yaml

@@ -0,0 +1,64 @@
+opensearch:
+  # See https://github.com/opensearch-project/helm-charts/blob/main/charts/opensearch/values.yaml
+  # Openshift naming, labels and annotations
+  nameOverride: search-backend
+  podAnnotations:
+    alpha.image.policy.openshift.io/resolve-names: '*'
+#  labels:
+#  - app.kubernetes.io/part-of: 'part-of'
+  # Openshift security overrides
+  # We can't use UID 1000 on OpenShift, so we clear this preset.
+  # We also remove a chown further down.
+  fsGroup: null
+  podSecurityContext:
+    runAsUser: null
+  securityContext:
+    runAsUser: null
+    fsGroup: null
+  # We use a custom image to fix permission problems on OpenShift and install custom plugins.
+  # See src/docker.
+  image:
+    repository: opensearch-custom
+    #version: "SET_IN_QUARKUS_APPLICATION_PROPERTIES"
+  # OpenSearch configuration
+  config: null
+  #clusterName: "SET_IN_QUARKUS_APPLICATION_PROPERTIES"
+  singleNode: true
+  extraEnvs:
+  - name: bootstrap.memory_lock
+    value: 'false'
+  # This is necessary to avoid OpenSearch trying to install various things on startup,
+  # which leads to filesystem operations (chmod/chown) that won't work
+  # because only user 1000 has the relevant permissions,
+  # and we can't run with user 1000 on OpenShift.
+  # See also:
+  # - https://github.com/opensearch-project/opensearch-devops/issues/97
+  # - src/main/docker/opensearch-custom.Dockerfile
+  - name: DISABLE_PERFORMANCE_ANALYZER_AGENT_CLI
+    value: 'true'
+  - name: DISABLE_INSTALL_DEMO_CONFIG
+    value: 'true'
+  # Not exposed to the internet, no sensitive data
+  # => We don't bother with HTTPS and pesky self-signed certificates
+  # Setting this env variable is better than setting plugins.security.disabled
+  # because this skips installing the plugin altogether (see above)
+  - name: DISABLE_SECURITY_PLUGIN
+    value: 'true'
+  envFrom:
+  - configMapRef:
+      name: search-backend-config
+  - secretRef:
+      name: search-backend-secrets
+  # Resource requirements (overridden for staging, see values.staging.yaml)
+  opensearchJavaOpts: ' -Xms1g -Xmx1g '
+  resources:
+    limits:
+      cpu: 1000m
+      memory: 2Gi
+    requests:
+      cpu: 500m
+      memory: 1.9Gi
+  persistence:
+    size: 5Gi
+    # Disable chown: we can't do that, see security overrides further up.
+    enableInitChown: 'false'

src/main/resources/application.properties

@@ -81,7 +81,7 @@ quarkus.datasource.jdbc.min-size=0
 # Hibernate Search
 ########################
 # This version needs to match the version in src/main/docker/opensearch-custom.Dockerfile
-quarkus.hibernate-search-orm.elasticsearch.version=opensearch:2.14
+quarkus.hibernate-search-orm.elasticsearch.version=opensearch:${maven.version.opensearch}
 # Not using :latest here as a workaround until we get https://github.com/quarkusio/quarkus/pull/38896
 quarkus.elasticsearch.devservices.image-name=opensearch-custom:${maven.version.opensearch}
 # Limit parallelism of indexing, because OpenSearch can only handle so many documents in its buffers.
@@ -237,19 +237,21 @@ quarkus.openshift.add-version-to-label-selectors=false
 ########################
 # OpenShift - Backend config
 ########################
+quarkus.helm.dependencies.opensearch.alias=opensearch
+quarkus.helm.dependencies.opensearch.version=${maven.version.opensearch.helm-chart}
+quarkus.helm.dependencies.opensearch.repository=https://opensearch-project.github.io/helm-charts/
+# Wait for OpenSearch to be started before starting the app
+quarkus.helm.dependencies.opensearch.wait-for-service=chart-database:5432
+# Openshift naming, labels and annotations
+quarkus.helm.values."@.opensearch.labels".value-as-map."app.kubernetes.io/part-of"=${quarkus.application.name}
+quarkus.helm.values-schema.properties."@.opensearch.labels".type=object
+# OpenSearch configuration
+quarkus.helm.values."@.opensearch.clusterName".value=${quarkus.application.name}
 # We must use a unique tag for our image,
 # so that changes to the image can be rolled back in sync with the app.
 # It happens that the revision passed to maven is a convenient unique version,
 # but in theory we could use another unique string.
-quarkus.helm.values."opensearch-image".paths=(kind == StatefulSet).spec.template.spec.containers.image
-quarkus.helm.values."opensearch-image".value=opensearch-custom:${maven.revision}
-quarkus.helm.values."opensearch-image"[email protected]
-# Resource requirements (overridden for staging, see src/main/helm)
-quarkus.helm.values."@.opensearch.envs.OPENSEARCH_JAVA_OPTS".value=\ -Xms1g -Xmx1g
-quarkus.helm.values."@.opensearch.resources.limits.cpu".value=2000m
-quarkus.helm.values."@.opensearch.resources.requests.cpu".value=500m
-quarkus.helm.values."@.opensearch.resources.limits.memory".value=2Gi
-quarkus.helm.values."@.opensearch.resources.requests.memory".value=1.9Gi
+quarkus.helm.values."@.opensearch.image.version".value=${maven.revision}
 
 ########################
 # Web Bundler config