opensearch: move to yum/apt repos

systemd-tmpfiles is needed otherwise opensearch
postinst on Debian/Ubuntu fails

Change-Id: I5aeb5796f8de7697a1c4a7404fe292ef9eb522ee

5 files changed, 119 insertions, 55 deletions

diff --git a/docker/base/Dockerfile.j2 b/docker/base/Dockerfile.j2
index bb62bc4ea..37396012f 100644
--- a/docker/base/Dockerfile.j2
+++ b/docker/base/Dockerfile.j2
@@ -57,6 +57,7 @@ COPY dnf.conf /etc/dnf/dnf.conf
     'grafana.repo',
     'influxdb.repo',
     'mariadb.repo',
+    'opensearch.repo',
     'proxysql.repo',
     'rabbitmq_rabbitmq-server.repo',
     'td.repo',
@@ -157,6 +158,8 @@ RUN rm -f /etc/rpm/macros.image-language-conf \
     'centos9-storage',
     'epel',
     'influxdb',
+    'opensearch-2.x',
+    'opensearch-dashboards-2.x',
 ] %}
 
 {% if base_arch == 'aarch64' %}
@@ -302,6 +305,7 @@ COPY apt_preferences /etc/apt/preferences.d/kolla-custom
    {'name': 'grafana', 'url': 'https://rpm.grafana.com/gpg.key'},
    {'name': 'influxdb', 'url': 'https://repos.influxdata.com/influxdata-archive_compat.key'},
    {'name': 'mariadb', 'url': 'https://downloads.mariadb.com/MariaDB/mariadb-keyring-2019.gpg', 'type': 'gpg'},
+   {'name': 'opensearch', 'url': 'https://artifacts.opensearch.org/publickeys/opensearch.pgp'},
    {'name': 'proxysql', 'url': 'https://repo.proxysql.com/ProxySQL/proxysql-2.4.x/repo_pub_key'},
    {'name': 'treasuredata', 'url': 'https://packages.treasuredata.com/GPG-KEY-td-agent'},
 ] %}
diff --git a/docker/base/opensearch.repo b/docker/base/opensearch.repo
new file mode 100644
index 000000000..19f91c3bc
--- /dev/null
+++ b/docker/base/opensearch.repo
@@ -0,0 +1,19 @@
+[opensearch-2.x]
+name=OpenSearch 2.x
+baseurl=https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/yum
+enabled=0
+repo_gpgcheck=1
+gpgcheck=1
+gpgkey=https://artifacts.opensearch.org/publickeys/opensearch.pgp
+autorefresh=1
+type=rpm-md
+
+[opensearch-dashboards-2.x]
+name=OpenSearch Dashboards 2.x
+baseurl=https://artifacts.opensearch.org/releases/bundle/opensearch-dashboards/2.x/yum
+enabled=0
+repo_gpgcheck=1
+gpgcheck=1
+gpgkey=https://artifacts.opensearch.org/publickeys/opensearch.pgp
+autorefresh=1
+type=rpm-md
diff --git a/docker/opensearch/opensearch-dashboards/Dockerfile.j2 b/docker/opensearch/opensearch-dashboards/Dockerfile.j2
index f95c9ee0c..60693ebc0 100644
--- a/docker/opensearch/opensearch-dashboards/Dockerfile.j2
+++ b/docker/opensearch/opensearch-dashboards/Dockerfile.j2
@@ -8,25 +8,21 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 {% import "macros.j2" as macros with context %}
 
 {{ macros.configure_user(name='opensearch', shell='/bin/bash', homedir='/usr/share/opensearch') }}
+{{ macros.enable_extra_repos(['opensearch-dashboards']) }}
 
-{% block opensearch_version %}
+{% set opensearch_dashboards_packages = ['opensearch-dashboards'] %}
 
-    {% if base_arch == 'x86_64' %}
-        {% set arch_os='x64' %}
-    {% elif base_arch == 'aarch64' %}
-        {% set arch_os='arm64' %}
-    {% endif %}
+{% if base_package_type == 'rpm' %}
+{# TODO: OpenSearch will move from SHA1 in 2.8 release, remove this once 2.8 is out #}
+RUN update-crypto-policies --set DEFAULT:SHA1
+{% endif %}
 
-ARG opensearch_version=2.5.0
-ARG opensearch_dashboards_url=https://artifacts.opensearch.org/releases/bundle/opensearch-dashboards/${opensearch_version}/opensearch-dashboards-${opensearch_version}-linux-{{ arch_os }}.tar.gz
-{% endblock %}
-
-ARG OPENSEARCH_DASHBOARDS_HOME=/usr/share/opensearch-dashboards
-
-RUN mkdir -p $OPENSEARCH_DASHBOARDS_HOME && \
-    curl -o /tmp/opensearch-dashboards.tgz ${opensearch_dashboards_url} && \
-    tar -xzpf /tmp/opensearch-dashboards.tgz -C $OPENSEARCH_DASHBOARDS_HOME --strip-components=1 && \
-    rm /tmp/opensearch-dashboards.tgz
+{# TODO: ugly hack to get past opensearch postinst, remove once #}
+{# https://github.com/opensearch-project/opensearch-build/pull/3435 gets merged #}
+{# and packages get rebuilt #}
+RUN touch /usr/bin/systemd-tmpfiles && chmod a+rx /usr/bin/systemd-tmpfiles \
+    && {{ macros.install_packages(opensearch_dashboards_packages | customizable("packages"), chain=True) }} \
+    && rm -f /usr/bin/systemd-tmpfiles
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
 RUN chmod 755 /usr/local/bin/kolla_extend_start
diff --git a/docker/opensearch/opensearch/Dockerfile.j2 b/docker/opensearch/opensearch/Dockerfile.j2
index 928124c46..587f86d65 100644
--- a/docker/opensearch/opensearch/Dockerfile.j2
+++ b/docker/opensearch/opensearch/Dockerfile.j2
@@ -8,25 +8,22 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 {% import "macros.j2" as macros with context %}
 
 {{ macros.configure_user(name='opensearch', shell='/bin/bash', homedir='/usr/share/opensearch') }}
-
-{% block opensearch_version %}
-
-    {% if base_arch == 'x86_64' %}
-        {% set arch_os='x64' %}
-    {% elif base_arch == 'aarch64' %}
-        {% set arch_os='arm64' %}
-    {% endif %}
-
-ARG opensearch_version=2.5.0
-ARG opensearch_url=https://artifacts.opensearch.org/releases/bundle/opensearch/${opensearch_version}/opensearch-${opensearch_version}-linux-{{ arch_os }}.tar.gz
-{% endblock %}
-
-ARG OPENSEARCH_HOME=/usr/share/opensearch
-
-RUN curl -o /tmp/opensearch.tgz ${opensearch_url} && \
-    tar -xzpf /tmp/opensearch.tgz -C $OPENSEARCH_HOME --strip-components=1 && \
-    rm /tmp/opensearch.tgz && \
-    mkdir -p $OPENSEARCH_HOME/data && chown -R opensearch:opensearch $OPENSEARCH_HOME/data
+{{ macros.enable_extra_repos(['opensearch']) }}
+
+    {% set opensearch_packages = [
+        'opensearch'
+    ] %}
+
+{% if base_package_type == 'rpm' %}
+{# TODO: OpenSearch will move from SHA1 in 2.8 release, remove this when 2.8 is out #}
+RUN update-crypto-policies --set DEFAULT:SHA1
+{% endif %}
+
+{# TODO: ugly hack to get past opensearch postinst, remove once #}
+{# https://github.com/opensearch-project/opensearch-build/pull/3435 gets merged #}
+{# and packages get rebuilt #}
+RUN touch /usr/bin/systemd-tmpfiles && chmod a+rx /usr/bin/systemd-tmpfiles \
+    && {{ macros.install_packages(opensearch_packages | customizable("packages"), chain=True) }}
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
 RUN chmod 755 /usr/local/bin/kolla_extend_start
diff --git a/kolla/template/repos.yaml b/kolla/template/repos.yaml
index 84f8bbd8b..9cdcf8749 100644
--- a/kolla/template/repos.yaml
+++ b/kolla/template/repos.yaml
@@ -9,6 +9,8 @@ centos:
   hacluster: "highavailability"
   influxdb: "influxdb"
   mariadb: "mariadb"
+  opensearch: "opensearch-2.x"
+  opensearch-dashboards: "opensearch-dashboards-2.x"
   openvswitch: "centos-nfv-openvswitch"
   opstools: "centos-opstools"
   proxysql: "proxysql"
@@ -25,6 +27,8 @@ centos-aarch64:
   hacluster: "highavailability"
   influxdb: "influxdb"
   mariadb: "mariadb"
+  opensearch: "opensearch-2.x"
+  opensearch-dashboards: "opensearch-dashboards-2.x"
   openvswitch: "centos-nfv-openvswitch"
   opstools: "centos-opstools"
   proxysql: "proxysql"
@@ -52,6 +56,21 @@ debian:
     suite: "bullseye"
     component: "main"
     gpg_key: "mariadb.gpg"
+  opensearch:
+    url: "https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt/"
+    suite: "stable"
+    component: "main"
+    gpg_key: "opensearch.asc"
+  opensearch-dashboards:
+    url: "https://artifacts.opensearch.org/releases/bundle/opensearch-dashboards/2.x/apt/"
+    suite: "stable"
+    component: "main"
+    gpg_key: "opensearch.asc"
+  proxysql:
+    url: "https://repo.proxysql.com/ProxySQL/proxysql-2.4.x/bullseye/"
+    suite: "./"
+    component: ""
+    gpg_key: "proxysql.asc"
   rabbitmq:
     url: "https://dl.cloudsmith.io/public/rabbitmq/rabbitmq-server/deb/debian"
     suite: "bullseye"
@@ -62,11 +81,6 @@ debian:
     suite: "bullseye"
     component: "contrib"
     gpg_key: "treasuredata.asc"
-  proxysql:
-    url: "https://repo.proxysql.com/ProxySQL/proxysql-2.4.x/bullseye/"
-    suite: "./"
-    component: ""
-    gpg_key: "proxysql.asc"
 
 debian-aarch64:
   erlang:
@@ -89,6 +103,21 @@ debian-aarch64:
     suite: "bullseye"
     component: "main"
     gpg_key: "mariadb.gpg"
+  opensearch:
+    url: "https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt/"
+    suite: "stable"
+    component: "main"
+    gpg_key: "opensearch.asc"
+  opensearch-dashboards:
+    url: "https://artifacts.opensearch.org/releases/bundle/opensearch-dashboards/2.x/apt/"
+    suite: "stable"
+    component: "main"
+    gpg_key: "opensearch.asc"
+  proxysql:
+    url: "https://repo.proxysql.com/ProxySQL/proxysql-2.4.x/bullseye/"
+    suite: "./"
+    component: ""
+    gpg_key: "proxysql.asc"
   rabbitmq:
     url: "https://dl.cloudsmith.io/public/rabbitmq/rabbitmq-server/deb/debian"
     suite: "bullseye"
@@ -99,11 +128,6 @@ debian-aarch64:
     suite: "bullseye"
     component: "contrib"
     gpg_key: "treasuredata.asc"
-  proxysql:
-    url: "https://repo.proxysql.com/ProxySQL/proxysql-2.4.x/bullseye/"
-    suite: "./"
-    component: ""
-    gpg_key: "proxysql.asc"
 
 rocky:
   ceph: "centos-ceph-quincy"
@@ -115,6 +139,8 @@ rocky:
   hacluster: "highavailability"
   influxdb: "influxdb"
   mariadb: "mariadb"
+  opensearch: "opensearch-2.x"
+  opensearch-dashboards: "opensearch-dashboards-2.x"
   openvswitch: "centos-nfv-openvswitch"
   opstools: "centos-opstools"
   proxysql: "proxysql"
@@ -131,6 +157,8 @@ rocky-aarch64:
   influxdb: "influxdb"
   hacluster: "highavailability"
   mariadb: "mariadb"
+  opensearch: "opensearch-2.x"
+  opensearch-dashboards: "opensearch-dashboards-2.x"
   openvswitch: "centos-nfv-openvswitch"
   opstools: "centos-opstools"
   proxysql: "proxysql"
@@ -158,6 +186,21 @@ ubuntu:
     suite: "jammy"
     component: "main"
     gpg_key: "mariadb.gpg"
+  opensearch:
+    url: "https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt/"
+    suite: "stable"
+    component: "main"
+    gpg_key: "opensearch.asc"
+  opensearch-dashboards:
+    url: "https://artifacts.opensearch.org/releases/bundle/opensearch-dashboards/2.x/apt/"
+    suite: "stable"
+    component: "main"
+    gpg_key: "opensearch.asc"
+  proxysql:
+    url: "https://repo.proxysql.com/ProxySQL/proxysql-2.4.x/jammy/"
+    suite: "./"
+    component: ""
+    gpg_key: "proxysql.asc"
   rabbitmq:
     url: "https://dl.cloudsmith.io/public/rabbitmq/rabbitmq-server/deb/ubuntu"
     suite: "jammy"
@@ -168,11 +211,6 @@ ubuntu:
     suite: "jammy"
     component: "contrib"
     gpg_key: "treasuredata.asc"
-  proxysql:
-    url: "https://repo.proxysql.com/ProxySQL/proxysql-2.4.x/jammy/"
-    suite: "./"
-    component: ""
-    gpg_key: "proxysql.asc"
 
 ubuntu-aarch64:
   erlang:
@@ -195,6 +233,21 @@ ubuntu-aarch64:
     suite: "jammy"
     component: "main"
     gpg_key: "mariadb.gpg"
+  opensearch:
+    url: "https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt/"
+    suite: "stable"
+    component: "main"
+    gpg_key: "opensearch.asc"
+  opensearch-dashboards:
+    url: "https://artifacts.opensearch.org/releases/bundle/opensearch-dashboards/2.x/apt/"
+    suite: "stable"
+    component: "main"
+    gpg_key: "opensearch.asc"
+  proxysql:
+    url: "https://repo.proxysql.com/ProxySQL/proxysql-2.4.x/jammy/"
+    suite: "./"
+    component: ""
+    gpg_key: "proxysql.asc"
   rabbitmq:
     url: "https://dl.cloudsmith.io/public/rabbitmq/rabbitmq-server/deb/ubuntu"
     suite: "jammy"
@@ -205,8 +258,3 @@ ubuntu-aarch64:
     suite: "jammy"
     component: "contrib"
     gpg_key: "treasuredata.asc"
-  proxysql:
-    url: "https://repo.proxysql.com/ProxySQL/proxysql-2.4.x/jammy/"
-    suite: "./"
-    component: ""
-    gpg_key: "proxysql.asc"