Run cert provisioning even for explicitly configured datanodes (#26332)

* Run cert provisioning even for explicitly configured datanodes

* added changelog

---------

Co-authored-by: Matthias Oesterheld <33032967+moesterheld@users.noreply.github.com>

Author: todvora

changelog/unreleased/pr-26332.toml

@@ -0,0 +1,3 @@
+type = "f"
+message = "Run cert provisioning even for explicitly configured datanodes."
+pulls = ["26332"]

graylog2-server/src/main/java/org/graylog2/configuration/IndexerDiscoveryCertProvisioning.java

@@ -19,6 +19,9 @@
 import jakarta.inject.Inject;
 import org.graylog2.bootstrap.preflight.GraylogCertificateProvisioner;
 
+import java.net.URI;
+import java.util.List;
+
 public class IndexerDiscoveryCertProvisioning implements IndexerDiscoveryListener {
 
     private final GraylogCertificateProvisioner graylogCertificateProvisioner;
@@ -33,6 +36,14 @@ public void beforeIndexerDiscovery() {
 
     }
 
+    @Override
+    public void onExplicitlyConfiguredNodes(List<URI> hosts) {
+        // the user has some explicitly configured nodes. They might still need fresh certificates.
+        // the downside here is that there is no loop, no waiting, like in the onDiscoveryRetry method.
+        // Any node needing fresh cert has to trigger a CSR before the server starts and checks CSRs here.
+        graylogCertificateProvisioner.runProvisioning();
+    }
+
     @Override
     public void onDiscoveryRetry() {
         // let's try to provision certificates, maybe there are datanodes waiting for these

graylog2-server/src/main/java/org/graylog2/configuration/IndexerDiscoveryListener.java

@@ -16,7 +16,11 @@
  */
 package org.graylog2.configuration;
 
+import java.net.URI;
+import java.util.List;
+
 public interface IndexerDiscoveryListener {
+    void onExplicitlyConfiguredNodes(List<URI> hosts);
     /**
      * Triggered before we start with indexer discovery. Won't be triggered if there are any indexers
      * explicitly defined in the configuration.

graylog2-server/src/main/java/org/graylog2/configuration/IndexerDiscoveryProvider.java

@@ -91,6 +91,7 @@ private List<URI> doGet() {
         // configured hosts, just use these and don't try any detection
         if (hosts != null && !hosts.isEmpty()) {
             LOG.info("Indexer hosts are set in configuration, using {} provided hosts", hosts.size()); // do not log hosts, may contain uname+pass
+            indexerDiscoveryListeners.forEach(listener -> listener.onExplicitlyConfiguredNodes(hosts));
             return hosts;
         }
 

graylog2-server/src/main/java/org/graylog2/configuration/IndexerDiscoverySecurityAutoconfig.java

@@ -26,6 +26,8 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import java.net.URI;
+import java.util.List;
 import java.util.Optional;
 
 public class IndexerDiscoverySecurityAutoconfig implements IndexerDiscoveryListener {
@@ -63,6 +65,11 @@ private Optional<RenewalPolicy> getRenewalPolicy() {
         return Optional.ofNullable(this.clusterConfigService.get(RenewalPolicy.class));
     }
 
+    @Override
+    public void onExplicitlyConfiguredNodes(List<URI> hosts) {
+
+    }
+
     @Override
     public void beforeIndexerDiscovery() {
         if (configuration.selfsignedStartupEnabled()) {

graylog2-server/src/test/java/org/graylog2/configuration/IndexerDiscoveryProviderTest.java

@@ -102,6 +102,27 @@ void testAutomaticDiscoveryOneUnconfigured() {
     }
 
 
+    @Test
+    void testCertProvisioningTriggeredForExplicitlyConfiguredNodes() {
+        final GraylogCertificateProvisioner provisioner = Mockito.mock(GraylogCertificateProvisioner.class);
+        final IndexerDiscoveryCertProvisioning listener = new IndexerDiscoveryCertProvisioning(provisioner);
+
+        final IndexerDiscoveryProvider provider = new IndexerDiscoveryProvider(
+                List.of(URI.create("http://datanode:9200")),
+                1,
+                Duration.seconds(1),
+                preflightConfig(null),
+                nodes(),
+                Collections.singleton(listener)
+        );
+
+        provider.get();
+
+        // Even with explicitly configured hosts a DataNode may still need a fresh certificate,
+        // so provisioning must run exactly once on this path.
+        Mockito.verify(provisioner, Mockito.times(1)).runProvisioning();
+    }
+
     @Test
     void testPreconfiguredIndexers() {
         final IndexerDiscoveryProvider provider = new IndexerDiscoveryProvider(
@@ -157,6 +178,10 @@ void testProvisioningWillBeTriggered() {
         final GraylogCertificateProvisioner provisioner = Mockito.mock(GraylogCertificateProvisioner.class);
         final org.graylog2.configuration.IndexerDiscoveryListener indexerDiscoveryListener = new IndexerDiscoveryListener() {
 
+            @Override
+            public void onExplicitlyConfiguredNodes(List<URI> hosts) {
+            }
+
             @Override
             public void beforeIndexerDiscovery() {