[WPB-21366] De-duplicate configuration between brig and brig-index

Makefile

@@ -396,20 +396,14 @@ postgres-reset: c
 
 .PHONY: es-reset
 es-reset: c
-	./dist/brig-index reset \
-		--elasticsearch-index-prefix directory \
-		--elasticsearch-server https://localhost:9200 \
-	  --elasticsearch-ca-cert ./libs/wire-subsystems/test/resources/elasticsearch-ca.pem \
-		--elasticsearch-credentials ./libs/wire-subsystems/test/resources/elasticsearch-credentials.yaml > /dev/null
-	./dist/brig-index reset \
-		--elasticsearch-index-prefix directory2 \
-		--elasticsearch-server https://localhost:9200 \
-	  --elasticsearch-ca-cert ./libs/wire-subsystems/test/resources/elasticsearch-ca.pem \
-		--elasticsearch-credentials ./libs/wire-subsystems/test/resources/elasticsearch-credentials.yaml > /dev/null
+	./dist/brig-index \
+	  -c ./services/brig/brig.integration.yaml reset \
+		--elasticsearch-index-prefix directory > /dev/null
+	./dist/brig-index \
+	  -c ./services/brig/brig.integration.yaml reset \
+		--elasticsearch-index-prefix directory2 > /dev/null
 	./integration/scripts/integration-dynamic-backends-brig-index.sh \
-		--elasticsearch-server https://localhost:9200 \
-	  --elasticsearch-ca-cert ./libs/wire-subsystems/test/resources/elasticsearch-ca.pem \
-		--elasticsearch-credentials ./libs/wire-subsystems/test/resources/elasticsearch-credentials.yaml > /dev/null
+	  -c ./services/brig/brig.integration.yaml > /dev/null
 
 .PHONY: rabbitmq-reset
 rabbitmq-reset: rabbit-clean
@@ -427,20 +421,7 @@ db-migrate: c
 	./dist/gundeck-schema --keyspace gundeck_test2 --replication-factor 1 > /dev/null
 	./dist/spar-schema --keyspace spar_test2 --replication-factor 1 > /dev/null
 	./integration/scripts/integration-dynamic-backends-db-schemas.sh --replication-factor 1 > /dev/null
-	./dist/brig-index reset \
-		--elasticsearch-index-prefix directory \
-		--elasticsearch-server https://localhost:9200 \
-	  --elasticsearch-ca-cert ./libs/wire-subsystems/test/resources/elasticsearch-ca.pem \
-		--elasticsearch-credentials ./libs/wire-subsystems/test/resources/elasticsearch-credentials.yaml > /dev/null
-	./dist/brig-index reset \
-		--elasticsearch-index-prefix directory2 \
-		--elasticsearch-server https://localhost:9200 \
-	  --elasticsearch-ca-cert ./libs/wire-subsystems/test/resources/elasticsearch-ca.pem \
-		--elasticsearch-credentials ./libs/wire-subsystems/test/resources/elasticsearch-credentials.yaml > /dev/null
-	./integration/scripts/integration-dynamic-backends-brig-index.sh \
-		--elasticsearch-server https://localhost:9200 \
-	  --elasticsearch-ca-cert ./libs/wire-subsystems/test/resources/elasticsearch-ca.pem \
-		--elasticsearch-credentials ./libs/wire-subsystems/test/resources/elasticsearch-credentials.yaml > /dev/null
+	make es-reset
 
 #################################
 ## dependencies

changelog.d/5-internal/brig-index-config-dedup

@@ -0,0 +1 @@
+De-duplicate brig-index configuration by reading connection settings (elasticsearch, cassandra, galley) from brig.yaml via the -c flag, instead of requiring them as CLI arguments.

charts/elasticsearch-index/templates/_helpers.tpl

@@ -8,47 +8,12 @@
   {{- (semverCompare ">= 1.24-0" (include "kubeVersion" .)) -}}
 {{- end -}}
 
-{{- define "useCassandraTLS" -}}
-{{ or (hasKey .cassandra "tlsCa") (hasKey .cassandra "tlsCaSecretRef") }}
-{{- end -}}
-
-{{/* Return a Dict of TLS CA secret name and key
-This is used to switch between provided secret (e.g. by cert-manager) and
-created one (in case the CA is provided as PEM string.)
+{{/*
+NOTE: The following helpers are DEPRECATED.
+This chart now uses brig's ConfigMap and Secret for configuration.
+TLS settings should be configured via:
+  - elasticsearchTlsEnabled: true/false
+  - cassandraTlsEnabled: true/false
+  - secrets.elasticsearchCaSecretName: name of the secret (default: brig-elasticsearch-ca)
+  - secrets.cassandraCaSecretName: name of the secret (default: brig-cassandra)
 */}}
-
-{{- define "cassandraTlsSecretName" -}}
-{{- if .cassandra.tlsCaSecretRef -}}
-{{ .cassandra.tlsCaSecretRef.name }}
-{{- else }}
-{{- print "elasticsearch-index-migrate-cassandra-client-ca" -}}
-{{- end -}}
-{{- end -}}
-
-{{- define "cassandraTlsSecretKey" -}}
-{{- if .cassandra.tlsCaSecretRef -}}
-{{ .cassandra.tlsCaSecretRef.key }}
-{{- else }}
-{{- print "ca.pem" -}}
-{{- end -}}
-{{- end -}}
-
-{{- define "configureElasticsearchCa" -}}
-{{ or (hasKey .elasticsearch "tlsCa") (hasKey .elasticsearch "tlsCaSecretRef") }}
-{{- end -}}
-
-{{- define "elasticsearchTlsSecretName" -}}
-{{- if .elasticsearch.tlsCaSecretRef -}}
-{{ .elasticsearch.tlsCaSecretRef.name }}
-{{- else }}
-{{- printf "%s-ca" (include "fullname" .) -}}
-{{- end -}}
-{{- end -}}
-
-{{- define "elasticsearchTlsSecretKey" -}}
-{{- if .elasticsearch.tlsCaSecretRef -}}
-{{ .elasticsearch.tlsCaSecretRef.key }}
-{{- else }}
-{{- print "ca.pem" -}}
-{{- end -}}
-{{- end -}}

charts/elasticsearch-index/templates/create-index.yaml

@@ -21,98 +21,65 @@ spec:
         chart: "{{.Chart.Name}}-{{.Chart.Version}}"
     spec:
       restartPolicy: OnFailure
-      {{- if or (eq (include "configureElasticsearchCa" .Values) "true") (hasKey .Values.secrets "elasticsearch") }}
       volumes:
-        {{- if hasKey .Values.secrets "elasticsearch" }}
-        - name: elasticsearch-index-secrets
+        - name: brig-config
+          configMap:
+            name: brig
+        - name: brig-secrets
           secret:
-            secretName: elasticsearch-index
-        {{- end }}
-        {{- if eq (include "configureElasticsearchCa" .Values) "true" }}
+            secretName: brig
+        {{- if .Values.elasticsearchTlsEnabled }}
         - name: elasticsearch-ca
           secret:
-            secretName: {{ include "elasticsearchTlsSecretName" .Values }}
+            secretName: {{ .Values.secrets.elasticsearchCaSecretName }}
         {{- end }}
-      {{- end }}
       initContainers:
         # Creates index in elasticsearch only when it doesn't exist.
         # Does nothing if the index exists.
         - name: brig-index-create
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
-          {{- if or (eq (include "configureElasticsearchCa" .Values) "true") (hasKey .Values.secrets "elasticsearch") }}
           volumeMounts:
-            {{- if hasKey .Values.secrets "elasticsearch" }}
-            - name: "elasticsearch-index-secrets"
-              mountPath: "/etc/wire/elasticsearch-index/secrets"
-            {{- end }}
-
-            {{- if eq (include "configureElasticsearchCa" .Values) "true" }}
+            - name: brig-config
+              mountPath: /etc/wire/brig/conf
+            - name: brig-secrets
+              mountPath: /etc/wire/brig/secrets
+            {{- if .Values.elasticsearchTlsEnabled }}
             - name: elasticsearch-ca
-              mountPath: "/certs/elasticsearch"
+              mountPath: "/etc/wire/brig/elasticsearch-ca"
             {{- end }}
-          {{- end }}
           {{- if eq (include "includeSecurityContext" .) "true" }}
           securityContext:
             {{- toYaml .Values.podSecurityContext | nindent 12 }}
           {{- end }}
           args:
+            - --config-file
+            - /etc/wire/brig/conf/brig.yaml
             - create
-            - --elasticsearch-server
-            - "{{ .Values.elasticsearch.scheme }}://{{ required "missing elasticsearch-index.elasticsearch.host!" .Values.elasticsearch.host }}:{{ .Values.elasticsearch.port }}"
-            {{- if hasKey .Values.secrets "elasticsearch" }}
-            - --elasticsearch-credentials
-            - "/etc/wire/elasticsearch-index/secrets/elasticsearch-credentials.yaml"
-            {{- end }}
-            - --elasticsearch-index
-            - "{{ or (.Values.elasticsearch.additionalWriteIndex) (.Values.elasticsearch.index) }}"
-            - --elasticsearch-shards=5
-            - --elasticsearch-replicas=2
-            - --elasticsearch-refresh-interval=5
+            - --elasticsearch-shards={{ default 5 .Values.elasticsearch.shards }}
+            - --elasticsearch-replicas={{ default 2 .Values.elasticsearch.replicas }}
+            - --elasticsearch-refresh-interval={{ default 5 .Values.elasticsearch.refreshInterval }}
             {{- if .Values.elasticsearch.delete_template }}
             - --delete-template
             - "{{ .Values.elasticsearch.delete_template }}"
             {{- end }}
-            {{- if eq (include "configureElasticsearchCa" .Values) "true" }}
-            - --elasticsearch-ca-cert
-            - /certs/elasticsearch/{{- include "elasticsearchTlsSecretKey" .Values}}
-            {{- end }}
-            {{- if .Values.elasticsearch.insecureSkipTlsVerify }}
-            - --elasticsearch-insecure-skip-tls-verify
-            {{- end }}
       containers:
         - name: brig-index-update-mapping
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
           imagePullPolicy: {{ default "" .Values.imagePullPolicy | quote }}
-          {{- if or (eq (include "configureElasticsearchCa" .Values) "true") (hasKey .Values.secrets "elasticsearch") }}
           volumeMounts:
-            {{- if hasKey .Values.secrets "elasticsearch" }}
-            - name: "elasticsearch-index-secrets"
-              mountPath: "/etc/wire/elasticsearch-index/secrets"
-            {{- end }}
-
-            {{- if eq (include "configureElasticsearchCa" .Values) "true" }}
+            - name: brig-config
+              mountPath: /etc/wire/brig/conf
+            - name: brig-secrets
+              mountPath: /etc/wire/brig/secrets
+            {{- if .Values.elasticsearchTlsEnabled }}
             - name: elasticsearch-ca
-              mountPath: "/certs/elasticsearch"
+              mountPath: "/etc/wire/brig/elasticsearch-ca"
             {{- end }}
-          {{- end }}
           {{- if eq (include "includeSecurityContext" .) "true" }}
           securityContext:
             {{- toYaml .Values.podSecurityContext | nindent 12 }}
           {{- end }}
           args:
+            - --config-file
+            - /etc/wire/brig/conf/brig.yaml
             - update-mapping
-            - --elasticsearch-server
-            - "{{ .Values.elasticsearch.scheme }}://{{ required "missing elasticsearch-index.elasticsearch.host!" .Values.elasticsearch.host }}:{{ .Values.elasticsearch.port }}"
-            {{- if hasKey .Values.secrets "elasticsearch" }}
-            - --elasticsearch-credentials
-            - "/etc/wire/elasticsearch-index/secrets/elasticsearch-credentials.yaml"
-            {{- end }}
-            - --elasticsearch-index
-            - "{{ or (.Values.elasticsearch.additionalWriteIndex) (.Values.elasticsearch.index) }}"
-            {{- if eq (include "configureElasticsearchCa" .Values) "true" }}
-            - --elasticsearch-ca-cert
-            - /certs/elasticsearch/{{- include "elasticsearchTlsSecretKey" .Values}}
-            {{- end }}
-            {{- if .Values.elasticsearch.insecureSkipTlsVerify }}
-            - --elasticsearch-insecure-skip-tls-verify
-            {{- end }}

charts/elasticsearch-index/templates/migrate-data.yaml

@@ -27,62 +27,36 @@ spec:
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
           imagePullPolicy: {{ default "" .Values.imagePullPolicy | quote }}
           args:
+            - --config-file
+            - /etc/wire/brig/conf/brig.yaml
             - migrate-data
-            - --elasticsearch-server
-            - "{{ .Values.elasticsearch.scheme }}://{{ required "missing elasticsearch-index.elasticsearch.host!" .Values.elasticsearch.host }}:{{ .Values.elasticsearch.port }}"
-            {{- if hasKey .Values.secrets "elasticsearch" }}
-            - --elasticsearch-credentials
-            - "/etc/wire/elasticsearch-index/secrets/elasticsearch-credentials.yaml"
-            {{- end }}
-            - --elasticsearch-index
-            - "{{ or (.Values.elasticsearch.additionalWriteIndex) (.Values.elasticsearch.index) }}"
-            - --cassandra-host
-            - "{{ required "missing elasticsearch-index.cassandra.host!" .Values.cassandra.host }}"
-            - --cassandra-port
-            - "{{ required "missing elasticsearch-index.cassandra.port!" .Values.cassandra.port }}"
-            - --cassandra-keyspace
-            - "{{ required "missing elasticsearch-index.cassandra.keyspace!" .Values.cassandra.keyspace }}"
-            - --galley-host
-            - "{{ required "missing elasticsearch-index.galley.host!" .Values.galley.host }}"
-            - --galley-port
-            - "{{ required "missing elasticsearch-index.galley.port!" .Values.galley.port }}"
-            {{- if eq (include "useCassandraTLS" .Values) "true" }}
-            - --cassandra-ca-cert
-            - /certs/cassandra/{{- include "cassandraTlsSecretKey" .Values }}
-            {{- end }}
-            {{- if eq (include "configureElasticsearchCa" .Values) "true" }}
-            - --elasticsearch-ca-cert
-            - /certs/elasticsearch/{{- include "elasticsearchTlsSecretKey" .Values}}
-            {{- end }}
-            {{- if .Values.elasticsearch.insecureSkipTlsVerify }}
-            - --elasticsearch-insecure-skip-tls-verify
-            {{- end }}
           volumeMounts:
-          {{- if hasKey .Values.secrets "elasticsearch" }}
-            - name: "elasticsearch-index-secrets"
-              mountPath: "/etc/wire/elasticsearch-index/secrets"
+            - name: brig-config
+              mountPath: /etc/wire/brig/conf
+            - name: brig-secrets
+              mountPath: /etc/wire/brig/secrets
+          {{- if .Values.cassandraTlsEnabled }}
+            - name: cassandra-ca
+              mountPath: "/etc/wire/brig/cassandra"
           {{- end }}
-          {{- if eq (include "useCassandraTLS" .Values) "true" }}
-            - name: elasticsearch-index-migrate-cassandra-client-ca
-              mountPath: "/certs/cassandra"
-          {{- end }}
-          {{- if eq (include "configureElasticsearchCa" .Values) "true" }}
+          {{- if .Values.elasticsearchTlsEnabled }}
             - name: elasticsearch-ca
-              mountPath: "/certs/elasticsearch"
+              mountPath: "/etc/wire/brig/elasticsearch-ca"
           {{- end }}
       volumes:
-        {{- if hasKey .Values.secrets "elasticsearch" }}
-        - name: elasticsearch-index-secrets
+        - name: brig-config
+          configMap:
+            name: brig
+        - name: brig-secrets
           secret:
-            secretName: elasticsearch-index
-        {{- end }}
-        {{- if eq (include "useCassandraTLS" .Values) "true" }}
-        - name: elasticsearch-index-migrate-cassandra-client-ca
+            secretName: brig
+        {{- if .Values.cassandraTlsEnabled }}
+        - name: cassandra-ca
           secret:
-            secretName: {{ include "cassandraTlsSecretName" .Values }}
+            secretName: {{ .Values.secrets.cassandraCaSecretName }}
         {{- end }}
-        {{- if eq (include "configureElasticsearchCa" .Values) "true" }}
+        {{- if .Values.elasticsearchTlsEnabled }}
         - name: elasticsearch-ca
           secret:
-            secretName: {{ include "elasticsearchTlsSecretName" .Values }}
+            secretName: {{ .Values.secrets.elasticsearchCaSecretName }}
         {{- end }}