forked from wazuh/wazuh-docker
Add Wazuh dashboard ad manager entrypoint configuration
This commit is contained in:
Victor Carlos Erenu
@@ -14,6 +14,7 @@ RUN URL_VAR="wazuh_indexer_url_${TARGETARCH}_rpm" && \
|
||||
dnf install curl-minimal openssl xz tar findutils shadow-utils -y &&\
|
||||
curl -o /wazuh-indexer.rpm "${indexer_url}" && \
|
||||
dnf install /wazuh-indexer.rpm -y && \
|
||||
rm -rf /wazuh-indexer.rpm && \
|
||||
dnf clean all && \
|
||||
bash config.sh
|
||||
|
||||
@@ -69,4 +70,4 @@ EXPOSE 9200
|
||||
|
||||
ENTRYPOINT ["/entrypoint.sh"]
|
||||
# Dummy overridable parameter parsed by entrypoint
|
||||
CMD ["opensearchwrapper"]
|
||||
CMD ["opensearch"]
|
||||
@@ -22,7 +22,7 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config
|
||||
## Variables
|
||||
CERT_TOOL=wazuh-certs-tool.sh
|
||||
CERT_CONFIG_FILE=config.yml
|
||||
CERT_TOOL_VERSION="${WAZUH_VERSION%.*}"
|
||||
CERT_TOOL_VERSION=5.0 #"${WAZUH_VERSION%.*}"
|
||||
PACKAGES_URL=https://packages.wazuh.com/$CERT_TOOL_VERSION/
|
||||
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/$CERT_TOOL_VERSION/
|
||||
|
||||
|
||||
@@ -1,93 +1,77 @@
|
||||
#!/usr/bin/env bash
|
||||
# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
|
||||
set -e
|
||||
#!/bin/bash
|
||||
|
||||
umask 0002
|
||||
# Copyright OpenSearch Contributors
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
export USER=wazuh-indexer
|
||||
export INSTALLATION_DIR=/usr/share/wazuh-indexer
|
||||
export OPENSEARCH_PATH_CONF=${INSTALLATION_DIR}/config
|
||||
export JAVA_HOME=${INSTALLATION_DIR}/jdk
|
||||
export DISCOVERY=$(grep -oP "(?<=discovery.type: ).*" ${OPENSEARCH_PATH_CONF}/opensearch.yml)
|
||||
export CACERT=$(grep -oP "(?<=plugins.security.ssl.transport.pemtrustedcas_filepath: ).*" ${OPENSEARCH_PATH_CONF}/opensearch.yml)
|
||||
export CERT="${OPENSEARCH_PATH_CONF}/certs/admin.pem"
|
||||
export KEY="${OPENSEARCH_PATH_CONF}/certs/admin-key.pem"
|
||||
# This script specify the entrypoint startup actions for opensearch
|
||||
# It will start both opensearch and performance analyzer plugin cli
|
||||
# If either process failed, the entire docker container will be removed
|
||||
# in favor of a newly started container
|
||||
|
||||
# Export OpenSearch Home
|
||||
export OPENSEARCH_HOME=/usr/share/wazuh-indexer
|
||||
export OPENSEARCH_PATH_CONF=$OPENSEARCH_HOME/config
|
||||
export PATH=$OPENSEARCH_HOME/bin:$PATH
|
||||
|
||||
|
||||
# The virtual file /proc/self/cgroup should list the current cgroup
|
||||
# membership. For each hierarchy, you can follow the cgroup path from
|
||||
# this file to the cgroup filesystem (usually /sys/fs/cgroup/) and
|
||||
# introspect the statistics for the cgroup for the given
|
||||
# hierarchy. Alas, Docker breaks this by mounting the container
|
||||
# statistics at the root while leaving the cgroup paths as the actual
|
||||
# paths. Therefore, OpenSearch provides a mechanism to override
|
||||
# reading the cgroup path from /proc/self/cgroup and instead uses the
|
||||
# cgroup path defined the JVM system property
|
||||
# opensearch.cgroups.hierarchy.override. Therefore, we set this value here so
|
||||
# that cgroup statistics are available for the container this process
|
||||
# will run in.
|
||||
export OPENSEARCH_JAVA_OPTS="-Dopensearch.cgroups.hierarchy.override=/ $OPENSEARCH_JAVA_OPTS"
|
||||
|
||||
# Start up the opensearch and performance analyzer agent processes.
|
||||
# When either of them halts, this script exits, or we receive a SIGTERM or SIGINT signal then we want to kill both these processes.
|
||||
function runOpensearch {
|
||||
# Files created by OpenSearch should always be group writable too
|
||||
umask 0002
|
||||
|
||||
if [[ "$(id -u)" == "0" ]]; then
|
||||
echo "Wazuh indexer cannot run as root. Please start your container as another user."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Parse Docker env vars to customize Wazuh indexer / OpenSearch configuration
|
||||
#
|
||||
# e.g. Setting the env var cluster.name=testcluster
|
||||
# will cause Wazuh indexer to be invoked with -Ecluster.name=testcluster
|
||||
opensearch_opts=()
|
||||
while IFS='=' read -r envvar_key envvar_value
|
||||
do
|
||||
# OpenSearch settings need to have at least two dot separated lowercase
|
||||
# words, e.g. `cluster.name`, except for `processors` which we handle
|
||||
# specially
|
||||
if [[ "$envvar_key" =~ ^[a-z0-9_]+\.[a-z0-9_]+ || "$envvar_key" == "processors" ]]; then
|
||||
if [[ ! -z $envvar_value ]]; then
|
||||
opensearch_opt="-E${envvar_key}=${envvar_value}"
|
||||
opensearch_opts+=("${opensearch_opt}")
|
||||
fi
|
||||
fi
|
||||
done < <(env)
|
||||
|
||||
# Start opensearch
|
||||
exec "$@" "${opensearch_opts[@]}"
|
||||
|
||||
run_as_other_user_if_needed() {
|
||||
if [[ "$(id -u)" == "0" ]]; then
|
||||
# If running as root, drop to specified UID and run command
|
||||
exec chroot --userspec=1000:0 / "${@}"
|
||||
else
|
||||
# Either we are running in Openshift with random uid and are a member of the root group
|
||||
# or with a custom --user
|
||||
exec "${@}"
|
||||
fi
|
||||
}
|
||||
|
||||
# Allow user specify custom CMD, maybe bin/opensearch itself
|
||||
# for example to directly specify `-E` style parameters for opensearch on k8s
|
||||
# or simply to run /bin/bash to check the image
|
||||
if [[ "$1" != "opensearchwrapper" ]]; then
|
||||
if [[ "$(id -u)" == "0" && $(basename "$1") == "opensearch" ]]; then
|
||||
# Rewrite CMD args to replace $1 with `opensearch` explicitly,
|
||||
# Without this, user could specify `opensearch -E x.y=z` but
|
||||
# `bin/opensearch -E x.y=z` would not work.
|
||||
set -- "opensearch" "${@:2}"
|
||||
# Use chroot to switch to UID 1000 / GID 0
|
||||
exec chroot --userspec=1000:0 / "$@"
|
||||
else
|
||||
# User probably wants to run something else, like /bin/bash, with another uid forced (Openshift?)
|
||||
# Prepend "opensearch" command if no argument was provided or if the first
|
||||
# argument looks like a flag (i.e. starts with a dash).
|
||||
if [ $# -eq 0 ] || [ "${1:0:1}" = '-' ]; then
|
||||
set -- opensearch "$@"
|
||||
fi
|
||||
|
||||
if [ "$1" = "opensearch" ]; then
|
||||
# If the first argument is opensearch, then run the setup script.
|
||||
runOpensearch "$@"
|
||||
else
|
||||
# Otherwise, just exec the command.
|
||||
exec "$@"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Allow environment variables to be set by creating a file with the
|
||||
# contents, and setting an environment variable with the suffix _FILE to
|
||||
# point to it. This can be used to provide secrets to a container, without
|
||||
# the values being specified explicitly when running the container.
|
||||
#
|
||||
# This is also sourced in opensearch-env, and is only needed here
|
||||
# as well because we use INDEXER_PASSWORD below. Sourcing this script
|
||||
# is idempotent.
|
||||
source /usr/share/wazuh-indexer/bin/opensearch-env-from-file
|
||||
|
||||
if [[ -f bin/opensearch-users ]]; then
|
||||
# Check for the INDEXER_PASSWORD environment variable to set the
|
||||
# bootstrap password for Security.
|
||||
#
|
||||
# This is only required for the first node in a cluster with Security
|
||||
# enabled, but we have no way of knowing which node we are yet. We'll just
|
||||
# honor the variable if it's present.
|
||||
if [[ -n "$INDEXER_PASSWORD" ]]; then
|
||||
[[ -f /usr/share/wazuh-indexer/opensearch.keystore ]] || (run_as_other_user_if_needed opensearch-keystore create)
|
||||
if ! (run_as_other_user_if_needed opensearch-keystore has-passwd --silent) ; then
|
||||
# keystore is unencrypted
|
||||
if ! (run_as_other_user_if_needed opensearch-keystore list | grep -q '^bootstrap.password$'); then
|
||||
(run_as_other_user_if_needed echo "$INDEXER_PASSWORD" | opensearch-keystore add -x 'bootstrap.password')
|
||||
fi
|
||||
else
|
||||
# keystore requires password
|
||||
if ! (run_as_other_user_if_needed echo "$KEYSTORE_PASSWORD" \
|
||||
| opensearch-keystore list | grep -q '^bootstrap.password$') ; then
|
||||
COMMANDS="$(printf "%s\n%s" "$KEYSTORE_PASSWORD" "$INDEXER_PASSWORD")"
|
||||
(run_as_other_user_if_needed echo "$COMMANDS" | opensearch-keystore add -x 'bootstrap.password')
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ "$(id -u)" == "0" ]]; then
|
||||
# If requested and running as root, mutate the ownership of bind-mounts
|
||||
if [[ -n "$TAKE_FILE_OWNERSHIP" ]]; then
|
||||
chown -R 1000:0 /usr/share/wazuh-indexer/{data,logs}
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
#if [[ "$DISCOVERY" == "single-node" ]] && [[ ! -f "/var/lib/wazuh-indexer/.flag" ]]; then
|
||||
# run securityadmin.sh for single node with CACERT, CERT and KEY parameter
|
||||
# nohup /securityadmin.sh &
|
||||
# touch "/var/lib/wazuh-indexer/.flag"
|
||||
#fi
|
||||
|
||||
run_as_other_user_if_needed /usr/share/wazuh-indexer/bin/opensearch <<<"$KEYSTORE_PASSWORD"
|
||||
fi
|
||||
Reference in New Issue
Block a user