You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/en/setup/backend/storages/elasticsearch.md
+37-6Lines changed: 37 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,7 +11,7 @@ In order to activate OpenSearch as storage, set the storage provider to **elasti
11
11
12
12
We support and tested the following versions of OpenSearch:
13
13
14
-
- 1.1.0, 1.3.10
14
+
- 1.3.10
15
15
- 2.4.0, 2.8.0, 3.0.0
16
16
17
17
## Elasticsearch
@@ -51,6 +51,8 @@ storage:
51
51
protocol: ${SW_STORAGE_ES_HTTP_PROTOCOL:"http"}
52
52
trustStorePath: ${SW_STORAGE_ES_SSL_JKS_PATH:""}
53
53
trustStorePass: ${SW_STORAGE_ES_SSL_JKS_PASS:""}
54
+
keyStorePath: ${SW_STORAGE_ES_SSL_KEY_STORE_PATH:""} # Path to client certificate keystore for mutual TLS (OpenSearch/Elasticsearch client cert auth). Supports PKCS12 (.p12, .pfx) and JKS (.jks) formats.
55
+
keyStorePass: ${SW_STORAGE_ES_SSL_KEY_STORE_PASS:""} # Password for the client certificate keystore. Can be managed via secretsManagementFile.
54
56
user: ${SW_ES_USER:""}
55
57
password: ${SW_ES_PASSWORD:""}
56
58
secretsManagementFile: ${SW_ES_SECRETS_MANAGEMENT_FILE:""} # Secrets management file in the properties format includes the username, password, which are managed by 3rd party tool.
### ElasticSearch With Https SSL Encrypting communications.
88
+
### ElasticSearch/OpenSearch With HTTPS SSL Encrypting Communications
89
+
90
+
#### Basic HTTPS with Server Certificate Verification
87
91
88
92
Example:
89
93
@@ -103,6 +107,32 @@ storage:
103
107
- File at `trustStorePath` is being monitored. Once it is changed, the ElasticSearch client will reconnect.
104
108
-`trustStorePass` could be changed in the runtime through [**Secrets Management File Of ElasticSearch Authentication**](#secrets-management-file-of-elasticsearch-authentication).
105
109
110
+
#### Mutual TLS (mTLS) with Client Certificate Authentication
111
+
112
+
For enhanced security, you can configure mutual TLS where the client presents a certificate to the server. This is commonly used with OpenSearch security plugin's client certificate authentication.
-`keyStorePath` points to the client certificate keystore file. Supports both PKCS12 (`.p12`, `.pfx`) and JKS (`.jks`) formats.
131
+
-`keyStorePass` is the password for the client keystore. Use empty string `""` for keystores without password.
132
+
- Both `trustStorePath` and `keyStorePath` files are being monitored. Once they are changed, the ElasticSearch client will reconnect.
133
+
-`trustStorePass` and `keyStorePass` could be changed in the runtime through [**Secrets Management File Of ElasticSearch Authentication**](#secrets-management-file-of-elasticsearch-authentication).
134
+
- When `keyStorePath` is configured, `keyStorePass` must also be provided (can be empty string for no password).
135
+
106
136
### Daily Index Step
107
137
Daily index step(`storage/elasticsearch/dayStep`, default 1) represents the index creation period. In this period, metrics for several days (dayStep value) are saved.
108
138
@@ -121,17 +151,18 @@ NOTE: TTL deletion would be affected by these steps. You should set an extra day
121
151
122
152
### Secrets Management File Of ElasticSearch Authentication
123
153
The value of `secretsManagementFile` should point to the secrets management file absolute path.
124
-
The file includes the username, password, and JKS password of the ElasticSearch server in the properties format.
154
+
The file includes the username, password, JKS password, and keystore password of the ElasticSearch server in the properties format.
125
155
```properties
126
156
user=xxx
127
157
password=yyy
128
158
trustStorePass=zzz
159
+
keyStorePass=aaa
129
160
```
130
161
131
-
The major difference between using `user, password, trustStorePass` configs in the `application.yaml` file is that the **Secrets Management File** is being watched by the OAP server.
162
+
The major difference between using `user, password, trustStorePass, keyStorePass` configs in the `application.yaml` file is that the **Secrets Management File** is being watched by the OAP server.
132
163
Once it is changed manually or through a 3rd party tool, such as [Vault](https://github.com/hashicorp/vault),
133
-
the storage provider will use the new username, password, and JKS password to establish the connection and close the old one. If the information exists in the file,
134
-
the `user/password` will be overridden.
164
+
the storage provider will use the new username, password, JKS password, and keystore password to establish the connection and close the old one. If the information exists in the file,
165
+
the `user/password/trustStorePass/keyStorePass` will be overridden.
Copy file name to clipboardExpand all lines: oap-server/server-library/library-client/src/main/java/org/apache/skywalking/oap/server/library/client/elasticsearch/ElasticSearchClient.java
+19-2Lines changed: 19 additions & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -76,6 +76,11 @@ public class ElasticSearchClient implements Client, HealthCheckable {
76
76
@Setter
77
77
privatevolatileStringtrustStorePass;
78
78
79
+
privatefinalStringkeyStorePath;
80
+
81
+
@Setter
82
+
privatevolatileStringkeyStorePass;
83
+
79
84
@Setter
80
85
privatevolatileStringuser;
81
86
@@ -107,6 +112,8 @@ public ElasticSearchClient(ModuleManager moduleManager,
107
112
Stringprotocol,
108
113
StringtrustStorePath,
109
114
StringtrustStorePass,
115
+
StringkeyStorePath,
116
+
StringkeyStorePass,
110
117
Stringuser,
111
118
Stringpassword,
112
119
Function<String, String> indexNameConverter,
@@ -119,6 +126,8 @@ public ElasticSearchClient(ModuleManager moduleManager,
119
126
this.protocol = protocol;
120
127
this.trustStorePath = trustStorePath;
121
128
this.trustStorePass = trustStorePass;
129
+
this.keyStorePath = keyStorePath;
130
+
this.keyStorePass = keyStorePass;
122
131
this.user = user;
123
132
this.password = password;
124
133
this.indexNameConverter = indexNameConverter;
@@ -152,9 +161,17 @@ public void connect() {
152
161
153
162
if (!Strings.isNullOrEmpty(trustStorePath)) {
154
163
cb.trustStorePath(trustStorePath);
164
+
// Always set trustStorePass if trustStorePath is set (even if empty string)
165
+
if (trustStorePass != null) {
166
+
cb.trustStorePass(trustStorePass);
167
+
}
155
168
}
156
-
if (!Strings.isNullOrEmpty(trustStorePass)) {
157
-
cb.trustStorePass(trustStorePass);
169
+
if (!Strings.isNullOrEmpty(keyStorePath)) {
170
+
cb.keyStorePath(keyStorePath);
171
+
// Always set keyStorePass if keyStorePath is set (even if empty string)
Copy file name to clipboardExpand all lines: oap-server/server-library/library-client/src/test/java/org/apache/skywalking/library/elasticsearch/bulk/ElasticSearchIT.java
+6-6Lines changed: 6 additions & 6 deletions
Original file line number
Diff line number
Diff line change
@@ -112,7 +112,7 @@ public void indexOperate(final ElasticsearchContainer server,
0 commit comments