forked from wazuh/wazuh-docker
Add Wazuh indexer cluster configuration
This commit is contained in:
vcerenu
@@ -1,8 +1,8 @@
|
||||
FROM centos:7 AS builder
|
||||
FROM ubuntu:focal AS builder
|
||||
|
||||
ENV tini_bin="tini-amd64"
|
||||
|
||||
RUN yum install initscripts curl -y
|
||||
RUN apt-get update -y && apt-get install curl -y
|
||||
|
||||
RUN curl --retry 8 -S -L -O https://github.com/krallin/tini/releases/download/v0.19.0/${tini_bin}
|
||||
RUN curl --retry 8 -S -L -O https://github.com/krallin/tini/releases/download/v0.19.0/${tini_bin}.sha256sum
|
||||
@@ -19,8 +19,10 @@ RUN sha256sum -c ${tini_bin}.sha256sum && \
|
||||
#RUN chmod 0775 config config/jvm.options.d data logs
|
||||
#COPY config/opensearch.yml config/log4j2.properties config/
|
||||
#RUN chmod 0660 config/opensearch.yml config/log4j2.properties
|
||||
COPY config/config.sh .
|
||||
RUN bash config.sh
|
||||
COPY config/unattended_installer.tar.gz /
|
||||
COPY config/config2.sh .
|
||||
RUN tar -xzvf /unattended_installer.tar.gz
|
||||
RUN bash config2.sh
|
||||
|
||||
################################################################################
|
||||
# Build stage 1 (the actual OpenSearch image):
|
||||
@@ -28,15 +30,48 @@ RUN bash config.sh
|
||||
# Copy opensearch from stage 0
|
||||
# Add entrypoint
|
||||
################################################################################
|
||||
FROM alpine
|
||||
FROM ubuntu:focal
|
||||
|
||||
ENV USER="wazuh-indexer" \
|
||||
GROUP="wazuh-indexer" \
|
||||
NAME="wazuh-indexer" \
|
||||
INSTALL_DIR="/usr/share/wazuh-indexer"
|
||||
RUN addgroup --system --gid 1000 $GROUP && \
|
||||
adduser -u 1000 -G $GROUP -D -h $INSTALL_DIR $USER && \
|
||||
chmod 0775 $INSTALL_DIR
|
||||
#chown -R 1000:0 $INSTALL_DIR
|
||||
|
||||
RUN getent group $GROUP || groupadd -r -g 1000 $GROUP
|
||||
|
||||
RUN useradd --system \
|
||||
--uid 1000 \
|
||||
--no-create-home \
|
||||
--home-dir $INSTALL_DIR \
|
||||
--gid $GROUP \
|
||||
--shell /sbin/nologin \
|
||||
--comment "$USER user" \
|
||||
$USER
|
||||
|
||||
WORKDIR $INSTALL_DIR
|
||||
COPY --from=builder --chown=1000:0 /usr/share/wazuh-indexer /usr/share/wazuh-indexer
|
||||
COPY --from=builder --chown=0:0 /tini /tini
|
||||
|
||||
COPY config/entrypoint_OS.sh /
|
||||
|
||||
RUN chmod 700 /entrypoint_OS.sh
|
||||
|
||||
COPY --from=builder --chown=1000:1000 /debian/wazuh-indexer/usr/share/wazuh-indexer /usr/share/wazuh-indexer
|
||||
COPY --from=builder --chown=0:0 /tini /tini
|
||||
COPY --from=builder --chown=0:0 /debian/wazuh-indexer/etc/init.d/wazuh-indexer /etc/init.d/wazuh-indexer
|
||||
COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/systemd /usr/lib/systemd
|
||||
COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/sysctl.d /usr/lib/sysctl.d
|
||||
COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/tmpfiles.d /usr/lib/tmpfiles.d
|
||||
COPY --from=builder --chown=1000:10000 /debian/wazuh-indexer/etc/wazuh-indexer /etc/wazuh-indexer
|
||||
|
||||
RUN mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \
|
||||
mkdir -p /usr/share/wazuh-indexer/logs && chown 1000:1000 /usr/share/wazuh-indexer/logs && \
|
||||
mkdir -p /run/wazuh-indexer && chown 1000:1000 /run/wazuh-indexer && \
|
||||
mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer
|
||||
|
||||
# Services ports
|
||||
EXPOSE 9700
|
||||
|
||||
#ENTRYPOINT [ "/entrypoint.sh" ]
|
||||
|
||||
ENTRYPOINT ["/tini", "--", "/entrypoint_OS.sh"]
|
||||
# Dummy overridable parameter parsed by entrypoint
|
||||
CMD ["opensearchwrapper"]
|
||||
@@ -26,44 +26,46 @@ if ! id $USER &> /dev/null; then
|
||||
fi
|
||||
|
||||
# Create directories
|
||||
mkdir -p ${RPM_BUILD_ROOT}${INSTALL_DIR}
|
||||
mkdir -p ${RPM_BUILD_ROOT}/etc
|
||||
mkdir -p ${RPM_BUILD_ROOT}${LOG_DIR}
|
||||
mkdir -p ${RPM_BUILD_ROOT}${LIB_DIR}
|
||||
mkdir -p ${RPM_BUILD_ROOT}${SYS_DIR}
|
||||
mkdir -p ${INSTALL_DIR}
|
||||
mkdir -p /etc
|
||||
mkdir -p ${LOG_DIR}
|
||||
mkdir -p ${LIB_DIR}
|
||||
mkdir -p ${SYS_DIR}
|
||||
|
||||
# Download required sources
|
||||
curl -kOL https://s3.amazonaws.com/warehouse.wazuh.com/stack/indexer/wazuh-indexer-base-linux-x64.tar.gz
|
||||
tar -xzf wazuh-indexer-*.tar.gz && rm -f wazuh-indexer-*.tar.gz
|
||||
chown -R ${USER}:${GROUP} wazuh-indexer-*/*
|
||||
|
||||
# Copy base files into RPM_BUILD_ROOT directory
|
||||
mv wazuh-indexer-*/etc/ ${RPM_BUILD_ROOT}/etc/
|
||||
cp -r wazuh-indexer-*${SYS_DIR}/* ${RPM_BUILD_ROOT}${SYS_DIR}/
|
||||
rm -rf wazuh-indexer-*/etc
|
||||
rm -rf wazuh-indexer-*/usr
|
||||
cp -pr wazuh-indexer-*/* ${RPM_BUILD_ROOT}${INSTALL_DIR}/
|
||||
# Copy base files into directories
|
||||
cp -rf wazuh-indexer-*/etc/wazuh.indexer /etc/
|
||||
cp -rf wazuh-indexer-*/etc/init.d/* /etc/init.d/
|
||||
cp -rf wazuh-indexer-*/etc/sysconfig/* /etc/sysconfig/
|
||||
cp -rf wazuh-indexer-*${SYS_DIR}/* ${SYS_DIR}/
|
||||
#rm -rf wazuh-indexer-*/etc
|
||||
#rm -rf wazuh-indexer-*/usr
|
||||
cp -pr wazuh-indexer-*/* ${INSTALL_DIR}/
|
||||
|
||||
# Download demo certificates
|
||||
curl -kOL https://s3.amazonaws.com/warehouse.wazuh.com/stack/demo-certs.tar.gz
|
||||
tar xzf demo-certs.tar.gz && rm -f demo-certs.tar.gz
|
||||
chown -R ${USER}:${GROUP} certs
|
||||
mkdir -p ${RPM_BUILD_ROOT}${CONFIG_DIR}/certs/
|
||||
cp certs/admin.pem ${RPM_BUILD_ROOT}${CONFIG_DIR}/certs/
|
||||
cp certs/admin-key.pem ${RPM_BUILD_ROOT}${CONFIG_DIR}/certs/
|
||||
cp certs/demo-indexer.pem ${RPM_BUILD_ROOT}${CONFIG_DIR}/certs/
|
||||
cp certs/demo-indexer-key.pem ${RPM_BUILD_ROOT}${CONFIG_DIR}/certs/
|
||||
cp certs/root-ca.pem ${RPM_BUILD_ROOT}${CONFIG_DIR}/certs/
|
||||
mkdir -p ${CONFIG_DIR}/certs/
|
||||
cp certs/admin.pem ${CONFIG_DIR}/certs/
|
||||
cp certs/admin-key.pem ${CONFIG_DIR}/certs/
|
||||
cp certs/demo-indexer.pem ${CONFIG_DIR}/certs/
|
||||
cp certs/demo-indexer-key.pem ${CONFIG_DIR}/certs/
|
||||
cp certs/root-ca.pem ${CONFIG_DIR}/certs/
|
||||
|
||||
#cp ${REPO_DIR}/install_functions/wazuh-cert-tool.sh ${RPM_BUILD_ROOT}${INSTALL_DIR}/plugins/opensearch-security/tools/
|
||||
#cp ${REPO_DIR}/install_functions/wazuh-passwords-tool.sh ${RPM_BUILD_ROOT}${INSTALL_DIR}/plugins/opensearch-security/tools/
|
||||
#cp ${REPO_DIR}/config/opensearch/certificate/config_aio.yml ${RPM_BUILD_ROOT}${INSTALL_DIR}/plugins/opensearch-security/tools/config.yml
|
||||
#cp ${REPO_DIR}/install_functions/wazuh-cert-tool.sh ${INSTALL_DIR}/plugins/opensearch-security/tools/
|
||||
#cp ${REPO_DIR}/install_functions/wazuh-passwords-tool.sh ${INSTALL_DIR}/plugins/opensearch-security/tools/
|
||||
#cp ${REPO_DIR}/config/opensearch/certificate/config_aio.yml ${INSTALL_DIR}/plugins/opensearch-security/tools/config.yml
|
||||
|
||||
#cp ${REPO_DIR}/config/opensearch/roles/internal_users.yml ${RPM_BUILD_ROOT}${INSTALL_DIR}/plugins/opensearch-security/securityconfig/
|
||||
#cp ${REPO_DIR}/config/opensearch/roles/roles.yml ${RPM_BUILD_ROOT}${INSTALL_DIR}/plugins/opensearch-security/securityconfig/
|
||||
#cp ${REPO_DIR}/config/opensearch/roles/roles_mapping.yml ${RPM_BUILD_ROOT}${INSTALL_DIR}/plugins/opensearch-security/securityconfig/
|
||||
#cp ${REPO_DIR}/config/opensearch/roles/internal_users.yml ${INSTALL_DIR}/plugins/opensearch-security/securityconfig/
|
||||
#cp ${REPO_DIR}/config/opensearch/roles/roles.yml ${INSTALL_DIR}/plugins/opensearch-security/securityconfig/
|
||||
#cp ${REPO_DIR}/config/opensearch/roles/roles_mapping.yml ${INSTALL_DIR}/plugins/opensearch-security/securityconfig/
|
||||
|
||||
#chmod 0660 "/etc/sysconfig/${NAME}" && chown root:${GROUP} "/etc/sysconfig/${NAME}"
|
||||
chmod 0660 "/etc/sysconfig/${NAME}" && chown root:${GROUP} "/etc/sysconfig/${NAME}"
|
||||
chmod 400 ${CONFIG_DIR}/certs/admin.pem && chown ${USER}:${GROUP} ${CONFIG_DIR}/certs/admin.pem
|
||||
chmod 400 ${CONFIG_DIR}/certs/admin-key.pem && chown ${USER}:${GROUP} ${CONFIG_DIR}/certs/admin-key.pem
|
||||
chmod 400 ${CONFIG_DIR}/certs/demo-indexer.pem && chown ${USER}:${GROUP} ${CONFIG_DIR}/certs/demo-indexer.pem
|
||||
|
||||
@@ -0,0 +1,53 @@
|
||||
# This has to be exported to make some magic below work.
|
||||
export DH_OPTIONS
|
||||
|
||||
export NAME=wazuh-indexer
|
||||
export TARGET_DIR=${CURDIR}/debian/${NAME}
|
||||
|
||||
# Package build options
|
||||
export USER=${NAME}
|
||||
export GROUP=${NAME}
|
||||
export CONFIG_DIR=/etc/${NAME}
|
||||
export LOG_DIR=/var/log/${NAME}
|
||||
export LIB_DIR=/var/lib/${NAME}
|
||||
export PID_DIR=/run/${NAME}
|
||||
export INSTALLATION_DIR=/usr/share/${NAME}
|
||||
export BASE_DIR=${NAME}-*
|
||||
export INDEXER_FILE=wazuh-indexer-base-linux-x64.tar.gz
|
||||
export REPO_DIR=/unattended_installer
|
||||
|
||||
|
||||
rm -rf ${INSTALLATION_DIR}/
|
||||
|
||||
curl -o ${INDEXER_FILE} https://s3.amazonaws.com/warehouse.wazuh.com/indexer/${INDEXER_FILE}
|
||||
tar -zvxf ${INDEXER_FILE}
|
||||
|
||||
# copy to target
|
||||
mkdir -p ${TARGET_DIR}${INSTALLATION_DIR}
|
||||
mkdir -p ${TARGET_DIR}${CONFIG_DIR}
|
||||
mkdir -p ${TARGET_DIR}${LIB_DIR}
|
||||
mkdir -p ${TARGET_DIR}${LOG_DIR}
|
||||
mkdir -p ${TARGET_DIR}/etc/init.d
|
||||
mkdir -p ${TARGET_DIR}/etc/default
|
||||
mkdir -p ${TARGET_DIR}/usr/lib/tmpfiles.d
|
||||
mkdir -p ${TARGET_DIR}/usr/lib/sysctl.d
|
||||
mkdir -p ${TARGET_DIR}/usr/lib/systemd/system
|
||||
# Move configuration files for wazuh-indexer
|
||||
mv -f ${BASE_DIR}/etc/init.d/${NAME} ${TARGET_DIR}/etc/init.d/${NAME}
|
||||
mv -f ${BASE_DIR}/etc/wazuh-indexer/* ${TARGET_DIR}${CONFIG_DIR}
|
||||
mv -f ${BASE_DIR}/etc/sysconfig/${NAME} ${TARGET_DIR}/etc/default/
|
||||
mv -f ${BASE_DIR}/usr/lib/tmpfiles.d/* ${TARGET_DIR}/usr/lib/tmpfiles.d/
|
||||
mv -f ${BASE_DIR}/usr/lib/sysctl.d/* ${TARGET_DIR}/usr/lib/sysctl.d/
|
||||
mv -f ${BASE_DIR}/usr/lib/systemd/system/* ${TARGET_DIR}/usr/lib/systemd/system/
|
||||
rm -rf ${BASE_DIR}/etc
|
||||
rm -rf ${BASE_DIR}/usr
|
||||
# Copy installation files to final location
|
||||
cp -pr ${BASE_DIR}/* ${TARGET_DIR}${INSTALLATION_DIR}
|
||||
# Copy the security tools
|
||||
cp ${REPO_DIR}/install_functions/wazuh-cert-tool.sh ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/tools/
|
||||
cp ${REPO_DIR}/install_functions/wazuh-passwords-tool.sh ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/tools/
|
||||
cp ${REPO_DIR}/config/opensearch/certificate/config_aio.yml ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/tools/config.yml
|
||||
# Copy Wazuh's config files for the security plugin
|
||||
cp -pr ${REPO_DIR}/config/opensearch/roles/roles_mapping.yml ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/securityconfig/
|
||||
cp -pr ${REPO_DIR}/config/opensearch/roles/roles.yml ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/securityconfig/
|
||||
cp -pr ${REPO_DIR}/config/opensearch/roles/internal_users.yml ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/securityconfig/
|
||||
@@ -6,16 +6,18 @@
|
||||
##############################################################################
|
||||
|
||||
export USER=wazuh-indexer
|
||||
export OPENSEARCH_PATH_CONF=/etc/wazuh-indexer
|
||||
export INSTALLATION_DIR=/usr/share/wazuh-indexer
|
||||
export OPENSEARCH_PATH_CONF=/etc/wazuh-indexer
|
||||
export JAVA_HOME=${INSTALLATION_DIR}/jdk
|
||||
export FILE=${INSTALLATION_DIR}/start
|
||||
|
||||
sed -i '/path.logs:/d' /etc/wazuh-indexer/opensearch.yml
|
||||
|
||||
if [ -f $FILE ]
|
||||
then
|
||||
echo "second or more start"
|
||||
else
|
||||
if [ $NODE_TYPE == "worker" ]
|
||||
if [ "$NODE_TYPE" == "worker" ]
|
||||
then
|
||||
echo "node_type start"
|
||||
echo $NODE_TYPE
|
||||
@@ -31,24 +33,21 @@ if [ -f $FILE ]
|
||||
echo "node_type start"
|
||||
echo $NODE_TYPE
|
||||
echo "node_type end"
|
||||
service wazuh-indexer start
|
||||
sleep 5
|
||||
service wazuh-indexer status
|
||||
sleep 55
|
||||
/usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig -icl -p 9800 -cd /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig -nhnv -cacert /etc/wazuh-indexer/certs/root-ca.pem -cert /etc/wazuh-indexer/certs/admin.pem -key /etc/wazuh-indexer/certs/admin-key.pem -h $HOSTNAME
|
||||
runuser wazuh-indexer --shell="/bin/bash" --command="/usr/share/wazuh-indexer/bin/opensearch -p /run/wazuh-indexer/wazuh-indexer.pid -d"
|
||||
sleep 60
|
||||
bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig -icl -p 9800 -cd /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig -nhnv -cacert /etc/wazuh-indexer/certs/root-ca.pem -cert /etc/wazuh-indexer/certs/admin.pem -key /etc/wazuh-indexer/certs/admin-key.pem -h $HOSTNAME
|
||||
tail -100f /usr/share/wazuh-indexer/logs/wazuh-cluster.log
|
||||
touch $FILE
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
|
||||
sed -i '/path.logs:/d' /etc/wazuh-indexer/opensearch.yml
|
||||
#sed -i '/path.logs:/d' /etc/wazuh-indexer/opensearch.yml
|
||||
|
||||
service wazuh-indexer stop
|
||||
service wazuh-indexer start
|
||||
#CLK_TK=`getconf CLK_TCK` runuser ${USER} --shell="/bin/bash" --command="${INSTALLATION_DIR}/bin/opensearch"
|
||||
|
||||
if [ -f /var/log/wazuh-indexer/wazuh-cluster.log ]
|
||||
if [ -f /var/log/wazuh-indexer/wazuh-cluster.log ]
|
||||
then
|
||||
tail -f /var/log/wazuh-indexer/wazuh-cluster.log
|
||||
else
|
||||
|
||||
@@ -0,0 +1,89 @@
|
||||
#!/usr/bin/env bash
|
||||
set -e
|
||||
|
||||
# Files created by Elasticsearch should always be group writable too
|
||||
umask 0002
|
||||
|
||||
export USER=wazuh-indexer
|
||||
export INSTALLATION_DIR=/usr/share/wazuh-indexer
|
||||
export OPENSEARCH_PATH_CONF=/etc/wazuh-indexer
|
||||
export JAVA_HOME=${INSTALLATION_DIR}/jdk
|
||||
export FILE=${INSTALLATION_DIR}/start
|
||||
|
||||
run_as_other_user_if_needed() {
|
||||
if [[ "$(id -u)" == "0" ]]; then
|
||||
# If running as root, drop to specified UID and run command
|
||||
exec chroot --userspec=1000:0 / "${@}"
|
||||
else
|
||||
# Either we are running in Openshift with random uid and are a member of the root group
|
||||
# or with a custom --user
|
||||
exec "${@}"
|
||||
fi
|
||||
}
|
||||
|
||||
# Allow user specify custom CMD, maybe bin/opensearch itself
|
||||
# for example to directly specify `-E` style parameters for opensearch on k8s
|
||||
# or simply to run /bin/bash to check the image
|
||||
if [[ "$1" != "opensearchwrapper" ]]; then
|
||||
if [[ "$(id -u)" == "0" && $(basename "$1") == "opensearch" ]]; then
|
||||
# centos:7 chroot doesn't have the `--skip-chdir` option and
|
||||
# changes our CWD.
|
||||
# Rewrite CMD args to replace $1 with `opensearch` explicitly,
|
||||
# so that we are backwards compatible with the docs
|
||||
# from the previous Elasticsearch versions<6
|
||||
# and configuration option D:
|
||||
# https://www.elastic.co/guide/en/elasticsearch/reference/5.6/docker.html#_d_override_the_image_8217_s_default_ulink_url_https_docs_docker_com_engine_reference_run_cmd_default_command_or_options_cmd_ulink
|
||||
# Without this, user could specify `opensearch -E x.y=z` but
|
||||
# `bin/opensearch -E x.y=z` would not work.
|
||||
set -- "opensearch" "${@:2}"
|
||||
# Use chroot to switch to UID 1000 / GID 0
|
||||
exec chroot --userspec=1000:0 / "$@"
|
||||
else
|
||||
# User probably wants to run something else, like /bin/bash, with another uid forced (Openshift?)
|
||||
exec "$@"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Allow environment variables to be set by creating a file with the
|
||||
# contents, and setting an environment variable with the suffix _FILE to
|
||||
# point to it. This can be used to provide secrets to a container, without
|
||||
# the values being specified explicitly when running the container.
|
||||
#
|
||||
# This is also sourced in opensearch-env, and is only needed here
|
||||
# as well because we use ELASTIC_PASSWORD below. Sourcing this script
|
||||
# is idempotent.
|
||||
source /usr/share/wazuh-indexer/bin/opensearch-env-from-file
|
||||
|
||||
if [[ -f bin/opensearch-users ]]; then
|
||||
# Check for the ELASTIC_PASSWORD environment variable to set the
|
||||
# bootstrap password for Security.
|
||||
#
|
||||
# This is only required for the first node in a cluster with Security
|
||||
# enabled, but we have no way of knowing which node we are yet. We'll just
|
||||
# honor the variable if it's present.
|
||||
if [[ -n "$ELASTIC_PASSWORD" ]]; then
|
||||
[[ -f /usr/share/wazuh-indexer/config/opensearch.keystore ]] || (run_as_other_user_if_needed opensearch-keystore create)
|
||||
if ! (run_as_other_user_if_needed opensearch-keystore has-passwd --silent) ; then
|
||||
# keystore is unencrypted
|
||||
if ! (run_as_other_user_if_needed opensearch-keystore list | grep -q '^bootstrap.password$'); then
|
||||
(run_as_other_user_if_needed echo "$ELASTIC_PASSWORD" | opensearch-keystore add -x 'bootstrap.password')
|
||||
fi
|
||||
else
|
||||
# keystore requires password
|
||||
if ! (run_as_other_user_if_needed echo "$KEYSTORE_PASSWORD" \
|
||||
| opensearch-keystore list | grep -q '^bootstrap.password$') ; then
|
||||
COMMANDS="$(printf "%s\n%s" "$KEYSTORE_PASSWORD" "$ELASTIC_PASSWORD")"
|
||||
(run_as_other_user_if_needed echo "$COMMANDS" | opensearch-keystore add -x 'bootstrap.password')
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ "$(id -u)" == "0" ]]; then
|
||||
# If requested and running as root, mutate the ownership of bind-mounts
|
||||
if [[ -n "$TAKE_FILE_OWNERSHIP" ]]; then
|
||||
chown -R 1000:0 /usr/share/wazuh-indexer/{data,logs}
|
||||
fi
|
||||
fi
|
||||
|
||||
run_as_other_user_if_needed /usr/share/wazuh-indexer/bin/opensearch <<<"$KEYSTORE_PASSWORD"
|
||||
@@ -1,103 +0,0 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
# Files created by OpenDistroForElasticsearch should always be group writable too
|
||||
umask 0002
|
||||
|
||||
run_as_other_user_if_needed() {
|
||||
if [[ "$(id -u)" == "0" ]]; then
|
||||
# If running as root, drop to specified UID and run command
|
||||
exec chroot --userspec=1000 / "${@}"
|
||||
else
|
||||
# Either we are running in Openshift with random uid and are a member of the root group
|
||||
# or with a custom --user
|
||||
exec "${@}"
|
||||
fi
|
||||
}
|
||||
|
||||
# Allow user specify custom CMD, maybe bin/elasticsearch itself
|
||||
# for example to directly specify `-E` style parameters for elasticsearch on k8s
|
||||
# or simply to run /bin/bash to check the image
|
||||
if [[ "$1" != "eswrapper" ]]; then
|
||||
if [[ "$(id -u)" == "0" && $(basename "$1") == "elasticsearch" ]]; then
|
||||
# centos:7 chroot doesn't have the `--skip-chdir` option and
|
||||
# changes our CWD.
|
||||
# Rewrite CMD args to replace $1 with `elasticsearch` explicitly,
|
||||
# so that we are backwards compatible with the docs
|
||||
# from the previous Elasticsearch versions<6
|
||||
# and configuration option D:
|
||||
# https://www.elastic.co/guide/en/elasticsearch/reference/5.6/docker.html#_d_override_the_image_8217_s_default_ulink_url_https_docs_docker_com_engine_reference_run_cmd_default_command_or_options_cmd_ulink
|
||||
# Without this, user could specify `elasticsearch -E x.y=z` but
|
||||
# `bin/elasticsearch -E x.y=z` would not work.
|
||||
set -- "elasticsearch" "${@:2}"
|
||||
# Use chroot to switch to UID 1000
|
||||
exec chroot --userspec=1000 / "$@"
|
||||
else
|
||||
# User probably wants to run something else, like /bin/bash, with another uid forced (Openshift?)
|
||||
exec "$@"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Parse Docker env vars to customize Elasticsearch
|
||||
#
|
||||
# e.g. Setting the env var cluster.name=testcluster
|
||||
#
|
||||
# will cause Elasticsearch to be invoked with -Ecluster.name=testcluster
|
||||
#
|
||||
# see https://www.elastic.co/guide/en/elasticsearch/reference/current/settings.html#_setting_default_settings
|
||||
|
||||
declare -a es_opts
|
||||
|
||||
while IFS='=' read -r envvar_key envvar_value
|
||||
do
|
||||
# Elasticsearch settings need to have at least two dot separated lowercase
|
||||
# words, e.g. `cluster.name`, except for `processors` which we handle
|
||||
# specially
|
||||
if [[ "$envvar_key" =~ ^[a-z0-9_]+\.[a-z0-9_]+ || "$envvar_key" == "processors" ]]; then
|
||||
if [[ ! -z $envvar_value ]]; then
|
||||
es_opt="-E${envvar_key}=${envvar_value}"
|
||||
es_opts+=("${es_opt}")
|
||||
fi
|
||||
fi
|
||||
done < <(env)
|
||||
|
||||
# The virtual file /proc/self/cgroup should list the current cgroup
|
||||
# membership. For each hierarchy, you can follow the cgroup path from
|
||||
# this file to the cgroup filesystem (usually /sys/fs/cgroup/) and
|
||||
# introspect the statistics for the cgroup for the given
|
||||
# hierarchy. Alas, Docker breaks this by mounting the container
|
||||
# statistics at the root while leaving the cgroup paths as the actual
|
||||
# paths. Therefore, Elasticsearch provides a mechanism to override
|
||||
# reading the cgroup path from /proc/self/cgroup and instead uses the
|
||||
# cgroup path defined the JVM system property
|
||||
# es.cgroups.hierarchy.override. Therefore, we set this value here so
|
||||
# that cgroup statistics are available for the container this process
|
||||
# will run in.
|
||||
export ES_JAVA_OPTS="-Des.cgroups.hierarchy.override=/ $ES_JAVA_OPTS"
|
||||
|
||||
if [[ "$(id -u)" == "0" ]]; then
|
||||
# If requested and running as root, mutate the ownership of bind-mounts
|
||||
if [[ -n "$TAKE_FILE_OWNERSHIP" ]]; then
|
||||
chown -R 1000:0 /usr/share/elasticsearch/{data,logs}
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ -d "/usr/share/elasticsearch/plugins/opendistro_security" && "$DISABLE_INSTALL_DEMO_CONFIG" != "true" ]]; then
|
||||
# Install Demo certifactes for Security Plugin and update the elasticsearch.yml
|
||||
# file to use those certificates.
|
||||
/usr/share/elasticsearch/plugins/opendistro_security/tools/install_demo_configuration.sh -y -i -s
|
||||
fi
|
||||
|
||||
if [[ -d "/usr/share/elasticsearch/plugins/opendistro-performance-analyzer" ]]; then
|
||||
CLK_TCK=`/usr/bin/getconf CLK_TCK`
|
||||
ES_JAVA_OPTS="-Dclk.tck=$CLK_TCK -Djdk.attach.allowAttachSelf=true $ES_JAVA_OPTS"
|
||||
if [[ -d "/usr/share/elasticsearch/performance-analyzer-rca" ]]; then
|
||||
ES_JAVA_OPTS="-Djava.security.policy=file:///usr/share/elasticsearch/performance-analyzer-rca/pa_config/es_security.policy $ES_JAVA_OPTS"
|
||||
/usr/bin/supervisord -c /usr/share/elasticsearch/performance-analyzer-rca/pa_config/supervisord.conf
|
||||
else
|
||||
ES_JAVA_OPTS="-Djava.security.policy=file:///usr/share/elasticsearch/plugins/opendistro-performance-analyzer/pa_config/es_security.policy $ES_JAVA_OPTS"
|
||||
/usr/bin/supervisord -c /usr/share/elasticsearch/plugins/opendistro-performance-analyzer/pa_config/supervisord.conf
|
||||
fi
|
||||
fi
|
||||
|
||||
run_as_other_user_if_needed /usr/share/elasticsearch/bin/elasticsearch "${es_opts[@]}"
|
||||
@@ -1,33 +0,0 @@
|
||||
export NAME=wazuh-indexer
|
||||
export VERSION=4.3.0
|
||||
export RELEASE=1
|
||||
export USER=$NAME
|
||||
export GROUP=$NAME
|
||||
export CONFIG_DIR=/etc/$NAME
|
||||
export LOG_DIR=/var/log/$NAME
|
||||
export LIB_DIR=/var/lib/$NAME
|
||||
export SYS_DIR=/usr/lib
|
||||
export INSTALL_DIR=/usr/share/$NAME
|
||||
export REPO_DIR=/root/unattended_installer
|
||||
|
||||
mkdir -p ${INSTALL_DIR}
|
||||
mkdir -p /etc
|
||||
mkdir -p ${LOG_DIR}
|
||||
mkdir -p ${LIB_DIR}
|
||||
mkdir -p ${SYS_DIR}
|
||||
|
||||
curl -kOL https://artifacts.opensearch.org/releases/bundle/opensearch/1.2.4/opensearch-${1}-linux-x64.tar.gz
|
||||
tar zxf opensearch-${1}-linux-x64.tar.gz && rm -f opensearch-${1}.tar.gz
|
||||
chown -R ${USER}:${GROUP} opensearch-${1}/*
|
||||
mkdir -p /etc/wazuh-indexer && chown -R ${USER}:${GROUP} /etc/wazuh-indexer && cp opensearch-${1}/config/* /etc/wazuh-indexer/
|
||||
#etc/init.d directory not found
|
||||
#etc/sysconfig directory not found
|
||||
#usr directory not found
|
||||
cp -pr opensearch-*/LICENSE.txt ${RPM_BUILD_ROOT}${INSTALL_DIR}/
|
||||
cp -pr opensearch-*/NOTICE.txt ${RPM_BUILD_ROOT}${INSTALL_DIR}/
|
||||
cp -pr opensearch-*/jdk ${RPM_BUILD_ROOT}${INSTALL_DIR}/
|
||||
cp -pr opensearch-*/plugins ${RPM_BUILD_ROOT}${INSTALL_DIR}/
|
||||
cp -pr opensearch-*/performance-analyzer-rca ${RPM_BUILD_ROOT}${INSTALL_DIR}/
|
||||
cp -pr opensearch-*/modules ${RPM_BUILD_ROOT}${INSTALL_DIR}/
|
||||
cp -pr opensearch-*/lib ${RPM_BUILD_ROOT}${INSTALL_DIR}/
|
||||
cp -pr opensearch-*/bin ${RPM_BUILD_ROOT}${INSTALL_DIR}/
|
||||
Binary file not shown.
Reference in New Issue
Block a user