[jaeger] Re-add anonymous Elasticsearch access support

The `storage.elasticsearch.anonymous` option was added in PR #442
(chart v0.67.1) but was lost when the chart was rewritten for Jaeger v2.

The elasticsearch.env helper unconditionally injects ES_USERNAME and
ES_PASSWORD with defaults (elastic/changeme), which breaks AWS
OpenSearch deployments that use VPC-level access without basic auth.
AWS rejects the basic auth Authorization header with a 403 because
it expects SigV4 format.

Setting `storage.elasticsearch.anonymous: true` now skips injecting
ES_USERNAME and ES_PASSWORD, restoring the behavior from #442.

Signed-off-by: domolitom <domolitom@gmail.com>

Author: domolitom

charts/jaeger/Chart.yaml

@@ -3,7 +3,7 @@ appVersion: 2.15.1
 description: A Jaeger Helm chart for Kubernetes
 name: jaeger
 type: application
-version: 4.5.0
+version: 4.5.1
 # Artifact Hub annotations
 # The jaeger image is whitelisted from security scanning because the reported
 # CVEs are in the upstream Alpine base image (OpenSSL libcrypto3/libssl3) and

charts/jaeger/README.md

@@ -114,6 +114,7 @@ storage:
     tls:
       enabled: false
     url: http://elasticsearch-master:9200
+    anonymous: false # Set to true to skip injecting ES_USERNAME/ES_PASSWORD (e.g. for AWS OpenSearch with VPC-level access)
     # user: elastic
     # password: changeme
 ```

charts/jaeger/templates/_helpers.tpl

@@ -189,10 +189,12 @@ Elasticsearch related environment variables
   value: {{ $url | quote }}
 - name: ES_NODES
   value: {{ $url | quote }}
+{{- if not $es.anonymous }}
 - name: ES_USERNAME
   value: {{ $user | quote }}
 - name: ES_PASSWORD
   value: {{ $password | quote }}
+{{- end }}
 {{- /* Handle TLS insecurity */ -}}
 {{- if and (($es).tls).enabled (($es).tls).insecure }}
 - name: ES_TLS_SKIP_HOST_VERIFY

charts/jaeger/values.yaml

@@ -268,6 +268,7 @@ storage:
       mountPath: ""
       subPath: ""
     url: http://elasticsearch-master:9200
+    anonymous: false
     # user: elastic
     # password: changeme