feat: Add Opensearch image #1215

labrenbe · 2025-07-23T09:58:07Z

Description

Build the OpenSearch image version 3.1.0 from source.

This includes

Security Plugin built from source
SBOM generated for OpenSearch and the security plugin
Source tars
repository-s3 and opensearch-performance-analyzer plugins

Tested with operator smoke test and helm setup.

Possible future improvements:

Build the repository-s3 and opensearch-performance-analyzer plugins from source

Part of stackabletech/opensearch-operator#15

Definition of Done Checklist

Note

Not all of these items are applicable to all PRs, the author should update this template to only leave the boxes in that are relevant.

Please make sure all these things are done and tick the boxes

Changes are OpenShift compatible
All added packages (via microdnf or otherwise) have a comment on why they are added
Things not downloaded from Red Hat repositories should be mirrored in the Stackable repository and downloaded from there
All packages should have (if available) signatures/hashes verified
Add an entry to the CHANGELOG.md file
Integration tests ran successfully

TIP: Running integration tests with a new product image

The image can be built and uploaded to the kind cluster with the following commands:

bake --product <product> --image-version <stackable-image-version>
kind load docker-image <image-tagged-with-the-major-version> --name=<name-of-your-test-cluster>

See the output of bake to retrieve the image tag for <image-tagged-with-the-major-version>.

…pository-s3

feat: SBOMs for opensearch

siegfriedweber

The following files are missing:

.github/ISSUE_TEMPLATE/update-product-opensearch.md
.github/workflows/build_opensearch.yaml
opensearch/README.md with a short description of the content of the image (e.g. installed plugins)

This image must be added to the following files:

.github/ISSUE_TEMPLATE/early-pre-release.md
.github/workflows/preflight.yaml
.scripts/enumerate-product-versions.py
.scripts/update_feature_tracker_db.sh
README.md (badge)

siegfriedweber · 2025-07-23T13:54:17Z

CHANGELOG.md

@@ -65,6 +65,7 @@ All notable changes to this project will be documented in this file.
 - hadoop: backport HADOOP-19352, HADOOP-19335, HADOOP-19465, HADOOP-19456 and HADOOP-19225 to fix vulnerabilities in Hadoop `3.4.1` ([#1184])
 - hadoop: Backport HADOOP-18583 to make OpenSSL 3.x work with the native hadoop libraries ([#1209]).
 - spark: backport [SPARK-51311] Promote bcprov-jdk18on to compile scope ([#1212]).
+- opensearch: Add Opensearch as new product with version `3.1.0` ([#1215]).


Please move this entry to the "Unreleased" section, as well as the pull request reference.

siegfriedweber · 2025-07-23T15:26:21Z

jdk-base/Dockerfile

@@ -0,0 +1,59 @@
+# syntax=docker/dockerfile:1.10.0@sha256:865e5dd094beca432e8c0a1d5e1c465db5f998dca4e439981029b3b81fb39ed5


Suggested change

# syntax=docker/dockerfile:1.10.0@sha256:865e5dd094beca432e8c0a1d5e1c465db5f998dca4e439981029b3b81fb39ed5

# syntax=docker/dockerfile:1.16.0@sha256:e2dd261f92e4b763d789984f6eab84be66ab4f5f08052316d8eb8f173593acf7

siegfriedweber · 2025-07-23T15:29:47Z

conf.py

Add the following line to open_shift_projects:

"opensearch": {"id": "6880fe690db664aa303d3a28"},

siegfriedweber · 2025-07-23T15:52:21Z

opensearch/versions.py

+        "java-devel": "24",
+        "jdk-base": "24",


According to https://docs.opensearch.org/docs/latest/install-and-configure/install-opensearch/index/#java-compatibility, it is only confirmed to be compatible with Java 11, 17 or 21.

Fixed in 841b3a0#diff-9fe134b6fa2b847439ee0e20eceef8a336719be11e549f70bbd44ea66046e6e6. opensearch-performance-analyzer also just supports Java 21.

siegfriedweber · 2025-07-24T08:40:06Z

opensearch/Dockerfile

@@ -0,0 +1,145 @@
+


Suggested change

# syntax=docker/dockerfile:1.16.0@sha256:e2dd261f92e4b763d789984f6eab84be66ab4f5f08052316d8eb8f173593acf7

# check=error=true

siegfriedweber · 2025-07-24T08:51:22Z

opensearch/Dockerfile

+LABEL name="${NAME}"
+LABEL version="${PRODUCT}"
+LABEL release="${RELEASE}"
+LABEL summary="The Stackable image for OpenSearch"
+LABEL description="${DESCRIPTION}"


Other images have maintainer and vendor labels. Aren't they necessary here?

siegfriedweber · 2025-07-24T08:58:44Z

opensearch/Dockerfile

+ENV HOME=${HOME}
+ENV OPENSEARCH_HOME=${OPENSEARCH_HOME}
+ENV PATH="${PATH}:/${OPENSEARCH_HOME}:${OPENSEARCH_HOME}/bin"
+ENV OPENSEARCH_CONTAINER=true


Where is the environment variable OPENSEARCH_CONTAINER used? A comment would be good.

siegfriedweber · 2025-07-24T09:18:07Z

opensearch/Dockerfile

+
+# All files and folders owned by root group to support running as arbitrary users.
+# This is best practice as all container users will belong to the root group (0).
+chown -R ${STACKABLE_USER_UID}:0 ${HOME}


Why don't you use the check-permissions-ownership.sh script? This layer is okay for now but if somebody else add things with other uids/gids, it could grow.

siegfriedweber · 2025-07-24T09:19:55Z

opensearch/security-plugin/Dockerfile

@@ -0,0 +1,26 @@
+FROM stackable/image/java-devel AS security-plugin-builder


Suggested change

FROM stackable/image/java-devel AS security-plugin-builder

# syntax=docker/dockerfile:1.16.0@sha256:e2dd261f92e4b763d789984f6eab84be66ab4f5f08052316d8eb8f173593acf7

# check=error=true

FROM stackable/image/java-devel AS security-plugin-builder

siegfriedweber and others added 12 commits February 7, 2025 12:20

feat(opensearch): Add OpenSearch image

3431f6d

feat(opensearch): Change JDK to version 17

212a573

feat(jdk-base): Create a jdk-base image for OpenSearch

be90d10

feat(opensearch): Upgrade to version 2.19.0

9969c13

feat(opensearch): Upgrade to version 2.19.1 and install the plugin re…

bc4abee

…pository-s3

Merge branch 'main' into feat/opensearch

f3216f5

Merge remote-tracking branch 'origin/main' into feat/opensearch

4ad9e03

Merge remote-tracking branch 'origin/main' into feat/opensearch

710e0c2

wip: build from source

19b06dc

feat: SBOMs for OpenSearch and opensearch-security-plugin (#1211)

9ee4c40

feat: SBOMs for opensearch

fix file structure in image and make multi-arch compatible

aff059e

install performance analyzer plugin

2f15213

labrenbe requested a review from siegfriedweber July 23, 2025 09:58

labrenbe self-assigned this Jul 23, 2025

labrenbe added this to Stackable Engineering Jul 23, 2025

labrenbe moved this to Development: Waiting for Review in Stackable Engineering Jul 23, 2025

labrenbe added 5 commits July 23, 2025 14:48

remove legacy apply-patches file

d04f5fd

add changelog entry

61d50cf

Merge remote-tracking branch 'origin/main' into feat/opensearch

ceb2125

Merge branch 'main' into feat/opensearch

2f9d0ab

Merge branch 'main' into feat/opensearch

8248558

siegfriedweber moved this from Development: Waiting for Review to Development: In Review in Stackable Engineering Jul 23, 2025

This was referenced Jul 23, 2025

OpenSearch operator MVP stackabletech/opensearch-operator#1

Open

Create and use the product image stackabletech/opensearch-operator#15

Open

Techassi changed the title ~~feat: Opensearch~~ feat: Add Opensearch image Jul 24, 2025

siegfriedweber requested changes Jul 24, 2025

View reviewed changes

build plugins from source and stop building snapshots

841b3a0

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

feat: Add Opensearch image #1215

feat: Add Opensearch image #1215

Uh oh!

labrenbe commented Jul 23, 2025 •

edited by siegfriedweber

Loading

Uh oh!

siegfriedweber left a comment

Uh oh!

siegfriedweber Jul 23, 2025

Uh oh!

siegfriedweber Jul 23, 2025

Uh oh!

siegfriedweber Jul 23, 2025

Uh oh!

siegfriedweber Jul 23, 2025

Uh oh!

labrenbe Jul 25, 2025

Uh oh!

siegfriedweber Jul 24, 2025

Uh oh!

siegfriedweber Jul 24, 2025

Uh oh!

siegfriedweber Jul 24, 2025

Uh oh!

siegfriedweber Jul 24, 2025

Uh oh!

siegfriedweber Jul 24, 2025

Uh oh!

Uh oh!

		@@ -0,0 +1,59 @@
		# syntax=docker/dockerfile:1.10.0@sha256:865e5dd094beca432e8c0a1d5e1c465db5f998dca4e439981029b3b81fb39ed5

	# syntax=docker/dockerfile:1.10.0@sha256:865e5dd094beca432e8c0a1d5e1c465db5f998dca4e439981029b3b81fb39ed5
	# syntax=docker/dockerfile:1.16.0@sha256:e2dd261f92e4b763d789984f6eab84be66ab4f5f08052316d8eb8f173593acf7


	# syntax=docker/dockerfile:1.16.0@sha256:e2dd261f92e4b763d789984f6eab84be66ab4f5f08052316d8eb8f173593acf7
	# check=error=true

		@@ -0,0 +1,26 @@
		FROM stackable/image/java-devel AS security-plugin-builder

Uh oh!

feat: Add Opensearch image #1215

Are you sure you want to change the base?

feat: Add Opensearch image #1215

Uh oh!

Conversation

labrenbe commented Jul 23, 2025 • edited by siegfriedweber Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Definition of Done Checklist

Uh oh!

siegfriedweber left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

labrenbe commented Jul 23, 2025 •

edited by siegfriedweber

Loading