WPB-12109: Migrate Elasticsearch client to upstream bloodhound v1.0.0.0 and OpenSearch 1.3 - #5561
Open
blackheaven wants to merge 8 commits into
Open
blackheaven wants to merge 8 commits into
blackheaven wants to merge 8 commits into
Conversation
Replace our wireapp/bloodhound fork pin with upstream bitemyapp/bloodhound
v1.0.0.0 (rev-pinned in flake.nix) and port all call sites to its API:
- Drop the typed-API surface (MappingName/searchByType/putNamedMapping) in
favor of untyped /{index}/_doc and PUT /{index}/_mapping endpoints;
requires ES >= 7 (or >= 6.7 with untyped indices).
- Handle the new error model: runBH returns Either EsError, client functions
throw EsError; normalize via tryEsError in the polysemy interpreters.
Version-conflict (409) tolerance is preserved via error status checks.
- Version user documents with external_gte instead of strictly-greater
external: re-indexing with an equal version now overwrites (behavior
change, covered by a new mock-interpreter unit test).
- Adapt to upstream changes: abstract IndexName (mkIndexName/unIndexName),
Key-typed term fields, Maybe BooleanOperator, 3-field IndexSettings,
EsResult-based getDocument, new MonadBH class (Backend/dispatch).
- Bump dev chart elasticsearch-ephemeral to ES 7.17.26 (chart 0.0.43).
Replace ElasticSearch with OpenSearch 1.3.20 as the search backend across
charts, dev/demo deployment, and integration test setup:
- Rename charts elasticsearch-{ephemeral,index,external,curator} to
opensearch-*; ephemeral chart now runs opensearchproject/opensearch:1.3.20
with OpenSearch env names (OPENSEARCH_JAVA_OPTS, plugins.security.ssl.http.*
for TLS, DISABLE_SECURITY_PLUGIN when TLS is off).
- Replace the kibana chart with a native opensearch-dashboards chart
(opensearchproject/opensearch-dashboards:1); kibana-basic-auth secret
behavior unchanged. The Kibana index-pattern postStart import hook is
dropped (endpoint removed in OpenSearch Dashboards 1.x).
- dockerephemeral: drop the elasticsearch:6.8.23 service; OpenSearch is the
only search service, published on localhost:9200; nginx ES-proxy removed;
federation brig configs point directly at OpenSearch with basic-auth
credentials matching the mounted securityconfig.
- integration.yaml additionalElasticSearch repointed to the OpenSearch
endpoint; hack/helmfile + helm_vars release names, hosts, and cert-manager
Issuer renamed (official opensearch/opensearch release renamed to
opensearch-cluster to avoid a release-name collision).
- Brig's elasticsearch:* config keys and the Haskell client are unchanged.
Migration instructions in changelog.d/5-internal/opensearch-cutover.md.
zebot
added
the
ok-to-test
The opensearch-ephemeral Certificate template inherited encoding: PKCS1 from the old elasticsearch chart, which emits an SEC1 'EC PRIVATE KEY' block. OpenSearch 1.x (Java 11 + security plugin) only parses PKCS#8, so opensearch-ephemeral and opensearch-cluster-master (which mounts tls.key from the same secret) crash-looped with 'File does not contain valid private key' during CI integration setup, and the brig 'different ElasticSearch instance' migration test failed TLS verification against the demo cert served meanwhile.
Two cert-manager Certificates (the opensearch chart extraObjects and the opensearch-ephemeral chart) wrote the same secret opensearch-ephemeral-certificate, racing on who owns it. Once the ephemeral chart's PKCS8 fix re-issued it, the secret flipped to a cert with SAN opensearch-ephemeral and every TLS client of opensearch-cluster-master (notably the opensearch-index-create pre-install hook) failed hostname verification, failing the wire-server release with 'job opensearch-index-create failed: BackoffLimitExceeded'. Dedicate opensearch-cluster-certificate to the cluster chart (extraObjects Certificate + secretMounts). The shared CA is unaffected: caSecretName references keep pointing at opensearch-ephemeral-certificate, whose ca.crt is issued by the same Issuer.
…meral
The TLS branch of the ephemeral chart ran OpenSearch 1.x with the demo
securityconfig (admin/admin), while every consumer (brig integration
tests, helm_vars secrets, federation credential files) authenticates as
elastic/changeme. Dual-writing to the additional instance therefore
failed with 401 ('Create index - error: EsError {errorStatus = Just
401, ...}') in the brig integration tests.
Mount a chart-provided securityconfig secret (same content as
helm_vars/opensearch: basic auth, user elastic with the changeme hash,
index_manager -> all_access) and set DISABLE_INSTALL_DEMO_CONFIG=true
when TLS is enabled, mirroring the dockerephemeral compose setup.
blackheaven
force-pushed
the
gdifolco/WPB-12109-bloodhound-upstream
branch
from
September 24, 2026 21:58
2f38b8b to
4cb3475
Compare
The TLS branch enabled only HTTP SSL while the mounted securityconfig enables transport authentication, so the security plugin failed to initialize and the pod crash-looped. With no endpoints behind the service, clients saw 'connect: permission denied (EPERM)' — the brig 'different ElasticSearch instance' migration test failed, and the missing readiness probe let 'helm --wait' declare the release ready anyway. Configure transport SSL (certs/tls.crt, certs/tls.key, certs/ca.crt, hostname verification off), allow_default_init_securityindex and the internal audit type — matching the proven dockerephemeral compose config — and add TCP readiness/liveness probes so a broken OpenSearch fails the helmfile setup instead of the integration tests.
blackheaven
changed the title
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
https://wearezeta.atlassian.net/browse/WPB-12109
Checklist
changelog.d