Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Extend indexer-init.sh to accept arguments #2590

Conversation

AlexRuiz7
Copy link
Member

@AlexRuiz7 AlexRuiz7 commented Nov 9, 2023

Related issue
https://github.com/wazuh/internal-devel-requests/issues/425

Description

This PR extends the indexer-init.sh script to accept arguments. The children scripts (indexer-security-init.sh and indexer-ism-init.sh) receive only the arguments that they accept / need.

This fixes the problem described in https://github.com/wazuh/internal-devel-requests/issues/425#issuecomment-1804171066.

Moreover, now the indexer-ism-init.sh script is only executed if the indexer-security-init.sh exits correctly (code 0). This is a requirement which was not handled before.

Logs example

Here we can see how the arguments are sent to the correct script:

bash indexer-init.sh -a 30d -d 1000 -i 192.168.56.10 -s 5 -p SecretPassword -P 1 192.168.56.10 --port 5601 -h
Executing Wazuh indexer security init script...
--port 5601 -h
Executing Wazuh indexer ISM init script...
-a 30d -d 1000 -i 192.168.56.10 -s 5 -p SecretPassword -P 1 -h

Test cases

  1. Invalid arguments in indexer-security-init.sh

    Details

    bash /usr/share/wazuh-indexer/bin/indexer-init.sh -ho null
    Executing Wazuh indexer security init script...
    The given information does not match with an IP address or a DNS.
    

  2. Invalid arguments in indexer-ism-init.sh

    In this case, the indexer-security-init.sh succeeds and the indexer-ism-init.sh fails, as expected.

  3. Show help option

    Details

    bash /usr/share/wazuh-indexer/bin/indexer-init.sh -h
    Executing Wazuh indexer security init script...
    
    Usage: /usr/share/wazuh-indexer/bin/indexer-security-init.sh [OPTIONS]
    
        -ho, --host <host>    [Optional] Target IP or DNS to configure security.
        --port <port>         [Optional] wazuh-indexer security port.
        --options <options>   [Optional] Custom securityadmin options.
        -h, --help            Show this help.
    
    Executing Wazuh indexer ISM init script...
    
    NAME
            indexer-ism-init.sh - Manages the Index State Management plugin for Wazuh indexer index rollovers policies.
    
    SYNOPSIS
            indexer-ism-init.sh [OPTIONS]
    
    DESCRIPTION
            -a,  --min-index-age <index-age>
                    Set the minimum index age. By default 7d.
    
            -d, --min-doc-count <doc-count>
                    Set the minimum document count. By default 200000000.
    
            -h,  --help
                    Shows help.
    
            -i, --indexer-hostname <hostname>
                    Specifies the Wazuh indexer hostname or IP.
    
            -p, --indexer-password <password>
                    Specifies the Wazuh indexer admin user password.
    
            -P, --priority <priority>
                    Specifies the policy's priority.
    
            -s, --min-shard-size <shard-size>
                    Set the minimum shard size in GB. By default 25.
    
            -v, --verbose
                    Set verbose mode. Prints more information.
    
  4. Valid arguments and successful execution

    Details

    bash /usr/share/wazuh-indexer/bin/indexer-init.sh -ho 192.168.56.10 -a 30d -d 1000 -i 192.168.56.10 -s 5 -p admin -P 1
    Executing Wazuh indexer security init script...
    **************************************************************************
    ** This tool will be deprecated in the next major release of OpenSearch **
    ** https://github.com/opensearch-project/security/issues/1755           **
    **************************************************************************
    Security Admin v7
    Will connect to 192.168.56.10:9200 ... done
    Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
    OpenSearch Version: 2.10.0
    Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
    Clustername: wazuh-indexer-cluster
    Clusterstate: GREEN
    Number of nodes: 2
    Number of data nodes: 2
    .opendistro_security index already exists, so we do not need to create one.
    Populate config from /etc/wazuh-indexer/opensearch-security/
    Will update '/config' with /etc/wazuh-indexer/opensearch-security/config.yml 
       SUCC: Configuration for 'config' created or updated
    Will update '/roles' with /etc/wazuh-indexer/opensearch-security/roles.yml 
       SUCC: Configuration for 'roles' created or updated
    Will update '/rolesmapping' with /etc/wazuh-indexer/opensearch-security/roles_mapping.yml 
       SUCC: Configuration for 'rolesmapping' created or updated
    Will update '/internalusers' with /etc/wazuh-indexer/opensearch-security/internal_users.yml 
       SUCC: Configuration for 'internalusers' created or updated
    Will update '/actiongroups' with /etc/wazuh-indexer/opensearch-security/action_groups.yml 
       SUCC: Configuration for 'actiongroups' created or updated
    Will update '/tenants' with /etc/wazuh-indexer/opensearch-security/tenants.yml 
       SUCC: Configuration for 'tenants' created or updated
    Will update '/nodesdn' with /etc/wazuh-indexer/opensearch-security/nodes_dn.yml 
       SUCC: Configuration for 'nodesdn' created or updated
    Will update '/whitelist' with /etc/wazuh-indexer/opensearch-security/whitelist.yml 
       SUCC: Configuration for 'whitelist' created or updated
    Will update '/audit' with /etc/wazuh-indexer/opensearch-security/audit.yml 
       SUCC: Configuration for 'audit' created or updated
    Will update '/allowlist' with /etc/wazuh-indexer/opensearch-security/allowlist.yml 
       SUCC: Configuration for 'allowlist' created or updated
    SUCC: Expected 10 config types for node {"updated_config_types":["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"],"updated_config_size":10,"message":null} is 10 (["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"]) due to: null
    SUCC: Expected 10 config types for node {"updated_config_types":["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"],"updated_config_size":10,"message":null} is 10 (["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"]) due to: null
    Done with success
    Executing Wazuh indexer ISM init script...
    wazuh-alerts template uploaded
    wazuh-archives template uploaded
    rollover_policy policy already exists
    Indexer ISM initialization finished successfully
    

Tests

  • Build the package in any supported platform
    • Linux
    • Windows
    • macOS
    • Solaris
    • AIX
    • HP-UX
  • Package installation
  • Package upgrade
  • Package downgrade
  • Package remove
  • Package install/remove/install
  • Change added to CHANGELOG.md
  • Tests for Linux RPM
    • Build the package for x86_64
    • Build the package for i386
    • Build the package for armhf
    • Build the package for aarch64
    • %files section is correctly updated if necessary
  • Tests for Linux deb
    • Build the package for x86_64
    • Build the package for i386
    • Build the package for armhf
    • Build the package for aarch64
    • Package install/remove/install
    • Package install/purge/install
    • Check file permissions after installing the package
  • Tests for macOS
    • Test the package from macOS Sierra to Mojave
  • Tests for Solaris
    • Test the package on Solaris 10
    • Test the package on Solaris 11
    • Check file permissions on Solaris 11 template
  • Tests for IBM AIX
    • %files section is correctly updated if necessary
    • Check the changes from IBM AIX 5 to 7

The arguments are sent the script that needs them
@AlexRuiz7 AlexRuiz7 requested a review from c-bordon November 9, 2023 18:40
@AlexRuiz7 AlexRuiz7 self-assigned this Nov 9, 2023
@AlexRuiz7 AlexRuiz7 changed the title Extend indexer-init.sh to accept arguments Extend indexer-init.sh to accept arguments Nov 9, 2023
Copy link
Member

@c-bordon c-bordon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@c-bordon c-bordon merged commit 4791f92 into 4.8.0 Nov 9, 2023
@c-bordon c-bordon deleted the enhancement/internal-425-extend-indexer-init-script-to-accept-arguments branch November 9, 2023 18:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants