[opensearch-logs] adding audit user for audit logs, job for alias and dashboard pattern creation

system/opensearch-logs/templates/config/_install-dashboard-pattern.sh.tpl

@@ -1,29 +1,52 @@
 #!/bin/bash
+export BASIC_AUTH_HEADER=${ADMIN_USER}:${ADMIN_PASSWORD}
 
-# 0. Check for index policy
-for i in $(curl -s -u ${ADMIN_USER}:${ADMIN_PASSWORD} "${CLUSTER_HOST}/_cat/indices?v"|awk '{ print $3 }'|awk -F- '{ print $1 }'|sort|uniq|grep -v "\."|grep -v "index")
+#  Creating aliases for all indexes, because logstash-* is also selecting datastreams besides the logstash-2024... indexes.
+for i in $(curl -s -u ${BASIC_AUTH_HEADER} "${CLUSTER_HOST}/_cat/indices?v"|awk '{ print $3 }'|grep -v "^\."|sort|sed 's/-[0-9].*\.[0-9].*\.[0-9].*$//'|uniq|grep -v index|grep -v "alerts-other"|grep -v deployments|grep -v maillog|grep -v ss4o|grep -v sample)
   do
+    #Creating an alias for all standard indexes, which are not datastreams to mitigate the issue with indexes, where for example storage-* is selecting the index and also the datastream, which shows up in dashboards as duplicate entries
     echo "using index $i from Opensearch-Logs"
-    echo "setting OpenSearch dashboard index mapping for index $i"
-    curl --header "content-type: application/JSON" --fail -XGET -u ${ADMIN_USER}:${ADMIN_PASSWORD} "${DASHBOARD_HOST}/api/saved_objects/index-pattern/${i}-*"
-    if [ $? -eq 0 ]; then
-       echo "index ${i} already exists in Opensearch dashboard"
+    export ALIAS_EXISTS=`curl -s -i -u ${BASIC_AUTH_HEADER} "${CLUSTER_HOST}/_cat/aliases/${i}"|grep "content-length"|awk -F: '{ print $2 }'|tr -d '[:space:]'`
+    echo "Creating for updating alias $i, because alias setting is only valid for indexes, which were created before the alias creation timestamp"
+    curl -s -XPOST --header "content-type: application/JSON" -u  ${BASIC_AUTH_HEADER} "${CLUSTER_HOST}/_aliases" -H "osd-xsrf: true" -d "{ \"actions\": [ { \"add\": { \"index\": \"${i}-2*\", \"alias\": \"${i}\" } } ] }"
+    echo "Deleting old index pattern based on index-* format"
+    export DASHBOARD_PATTERN=`curl -s --header "content-type: application/JSON" --fail -XGET -u ${BASIC_AUTH_HEADER} "${DASHBOARD_HOST}/api/saved_objects/index-pattern/${i}-*"|grep "content-length"|awk -F: '{ print $2 }'|tr -d '[:space:]'`
+    if [[ "$DASHBOARD_PATTERN" -gt 0 ]]
+    then
+      echo "Old dashboard pattern exists for for index ${i}, it will be removed"
+      curl -s -XDELETE -u ${BASIC_AUTH_HEADER} "${DASHBOARD_HOST}/api/saved_objects/index-pattern/${i}-*"
+    else
+     echo "No old dashboard pattern for index $i"
+    fi
+done
+
+# Dashboard index pattern for all available aliases, which are not datastreams
+for i in $(curl -u ${BASIC_AUTH_HEADER} "${CLUSTER_HOST}/_cat/aliases?v"|grep -v "\-ds"|grep -v "^\."|awk '{ print $1 }'|uniq)
+  do
+    echo "using alias $i from Opensearch-Logs"
+    echo "Setting OpenSearch dashboard index mapping for alias $i"
+    curl -s --header "content-type: application/JSON" --fail -XGET -u ${BASIC_AUTH_HEADER} "${DASHBOARD_HOST}/api/saved_objects/index-pattern/${i}"
+    if [ $? -eq 0 ]
+    then
+      echo "index pattern for alias ${i} already exists in Opensearch dashboard, nothing to do"
     else
-      echo "INFO: creating index-pattern in Dashboards for $i logs"
-      curl -XPOST --header "content-type: application/JSON" -u ${ADMIN_USER}:${ADMIN_PASSWORD} "${DASHBOARD_HOST}/api/saved_objects/index-pattern/${i}-*" -H "osd-xsrf: true" -d "{ \"attributes\": { \"title\": \"${i}-*\", \"timeFieldName\": \"@timestamp\" } }"
+      echo "INFO: creating index-pattern in Dashboards for datastream alias $i"
+      curl -s -XPOST --header "content-type: application/JSON" -u ${BASIC_AUTH_HEADER} "${DASHBOARD_HOST}/api/saved_objects/index-pattern/${i}" -H "osd-xsrf: true" -d "{ \"attributes\": { \"title\": \"${i}\", \"timeFieldName\": \"@timestamp\" } }"
     fi
 done
 
+
 # Dashboard index pattern for all available datastreams
-for i in $(curl -s -u ${ADMIN_USER}:${ADMIN_PASSWORD} "${CLUSTER_HOST}/_cat/aliases?v"|grep "\-ds"|awk '{ print $1 }'|uniq)
+for i in $(curl -s -u ${BASIC_AUTH_HEADER} "${CLUSTER_HOST}/_cat/aliases?v"|grep "\-ds"|awk '{ print $1 }'|uniq)
   do
     echo "using datastream $i from Opensearch-Logs"
     echo "setting OpenSearch dashboard index mapping for index $i"
-    curl --header "content-type: application/JSON" --fail -XGET -u ${ADMIN_USER}:${ADMIN_PASSWORD} "${DASHBOARD_HOST}/api/saved_objects/index-pattern/${i}"
-    if [ $? -eq 0 ]; then
+    curl -s --header "content-type: application/JSON" --fail -XGET -u ${BASIC_AUTH_HEADER} "${DASHBOARD_HOST}/api/saved_objects/index-pattern/${i}"
+    if [ $? -eq 0 ]
+    then
         echo "index ${i} already exists in Opensearch dashboard"
     else
       echo "INFO: creating index-pattern in Dashboards for datastream alias $i"
-      curl -XPOST --header "content-type: application/JSON" -u ${ADMIN_USER}:${ADMIN_PASSWORD} "${DASHBOARD_HOST}/api/saved_objects/index-pattern/${i}" -H "osd-xsrf: true" -d "{ \"attributes\": { \"title\": \"${i}\", \"timeFieldName\": \"@timestamp\" } }"
+      curl -s -XPOST --header "content-type: application/JSON" -u ${BASIC_AUTH_HEADER} "${DASHBOARD_HOST}/api/saved_objects/index-pattern/${i}" -H "osd-xsrf: true" -d "{ \"attributes\": { \"title\": \"${i}\", \"timeFieldName\": \"@timestamp\" } }"
     fi
 done

system/opensearch-logs/templates/config/_internal_users.yml.tpl

@@ -38,6 +38,12 @@ otel:
   backend_roles:
   - "otel"
 
+audit:
+  hash: "{{ .Values.users.audit.nohash }}"
+  reserved: true
+  backend_roles:
+  - "audit"
+
 otellogs:
   hash: "{{ .Values.users.otellogs.nohash }}"
   reserved: true

system/opensearch-logs/templates/config/_roles.yml.tpl

@@ -249,6 +249,26 @@ compute:
     - "indices:admin/create"
     - "indices:data/write/bulk*"
     - "indices:data/write/index"
+audit:
+  reserved: false
+  cluster_permissions:
+  - "cluster_monitor"
+  - "cluster_composite_ops"
+  - "cluster:admin/ingest/pipeline/put"
+  - "cluster:admin/ingest/pipeline/get"
+  - "indices:admin/template/get"
+  - "cluster_manage_index_templates"
+  - "cluster:admin/opensearch/ml/predict"
+  index_permissions:
+  - index_patterns:
+    - "audit-*"
+    allowed_actions:
+    - "indices:admin/template/get"
+    - "indices:admin/template/put"
+    - "indices:admin/mapping/put"
+    - "indices:admin/create"
+    - "indices:data/write/bulk*"
+    - "indices:data/write/index"
 otel:
   reserved: false
   cluster_permissions:

system/opensearch-logs/templates/config/_roles_mapping.yml.tpl

@@ -32,6 +32,11 @@ greenhouse:
   users:
   - "greenhouse"
 
+audit:
+  reserved: false
+  users:
+  - "audit"
+
 jump:
   reserved: false
   users:

system/opensearch-logs/templates/cron-install-dashboard-pattern-job.yaml

@@ -0,0 +1,47 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: "install-dashboard-pattern"
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+    app.kubernetes.io/instance: {{ .Release.Name | quote }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    ccloud/service: logs
+    ccloud/support-group: observability
+spec:
+  schedule: "30 0,6,8,12,18 * * *"
+  jobTemplate:
+    spec:
+      backoffLimit: 3
+      template:
+        spec:
+          restartPolicy: Never
+          containers:
+          - name: install-dashboard-pattern 
+            image: "{{ .Values.global.registry }}/unified-kubernetes-toolbox:latest"
+            command: ["/bin/bash", "/scripts/install-dashboard-pattern.sh"]
+            env:
+              - name: ADMIN_USER
+                valueFrom:
+                  secretKeyRef:
+                    name: cron-secrets
+                    key: ADMIN_USER
+              - name: ADMIN_PASSWORD
+                valueFrom:
+                  secretKeyRef:
+                    name: cron-secrets
+                    key: ADMIN_PASSWORD
+              - name: CLUSTER_HOST
+                value: "https://opensearch-logs-client.{{ .Values.global.clusterType }}.{{ .Values.global.region }}.{{ .Values.global.tld }}:{{ .Values.httpPort }}"
+              - name: DASHBOARD_HOST
+                value: "https://logs.{{ .Values.global.region }}.{{ .Values.global.tld }}"
+            volumeMounts:
+            - mountPath: /scripts/install-dashboard-pattern.sh
+              name: security-config
+              subPath: install-dashboard-pattern.sh
+          volumes:
+          - name: security-config
+            secret:
+              defaultMode: 420
+              secretName: security-config