[jaeger] Re-add anonymous Elasticsearch access support by domolitom · Pull Request #743 · jaegertracing/helm-charts

domolitom · 2026-02-16T15:46:31Z

What this PR does

Re-adds the storage.elasticsearch.anonymous option that was introduced in PR #442 (chart v0.67.1) but lost during the Jaeger v2 chart rewrite.

When storage.elasticsearch.anonymous: true, the elasticsearch.env helper skips injecting ES_USERNAME and ES_PASSWORD env vars into ES maintenance jobs (esIndexCleaner, esRollover, esLookback).

Which issue this PR fixes

fixes [Bug]: elasticsearch.env helper always injects default credentials, breaking AWS OpenSearch #742
regression of [Feature - Jaeger]: Ability to not provide ES_USERNAME #441 / [jaeger] Will allow anonymous login to ElasticSearch #442

Checklist

DCO signed
Commits are GPG signed
Chart Version bumped
Title of the PR starts with chart name ([jaeger])
README.md has been updated to match version/contain new values

Copilot

Pull request overview

Re-introduces support for anonymous (no basic auth) access when running Elasticsearch-related jobs in the Jaeger v2 Helm chart, addressing a regression that broke OpenSearch/AWS deployments that rely on network-level access instead of credentials.

Changes:

Adds a new storage.elasticsearch.anonymous value (default false) to control whether ES credentials env vars are rendered.
Updates the elasticsearch.env helper to skip ES_USERNAME/ES_PASSWORD when anonymous is enabled.
Bumps the chart version from 4.5.0 to 4.5.1.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
`charts/jaeger/values.yaml`	Introduces the new `storage.elasticsearch.anonymous` configuration value.
`charts/jaeger/templates/_helpers.tpl`	Implements the conditional rendering of ES credential env vars based on `anonymous`.
`charts/jaeger/Chart.yaml`	Bumps chart version to ship the behavior change.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

The `storage.elasticsearch.anonymous` option was added in PR jaegertracing#442 (chart v0.67.1) but was lost when the chart was rewritten for Jaeger v2. The elasticsearch.env helper unconditionally injects ES_USERNAME and ES_PASSWORD with defaults (elastic/changeme), which breaks AWS OpenSearch deployments that use VPC-level access without basic auth. AWS rejects the basic auth Authorization header with a 403 because it expects SigV4 format. Setting `storage.elasticsearch.anonymous: true` now skips injecting ES_USERNAME and ES_PASSWORD, restoring the behavior from jaegertracing#442. Signed-off-by: Oliver Domokos <domolitom@gmail.com>

Stevenpc3 · 2026-03-10T23:59:39Z

I do not think this is the correct solution. I also ran into this issue when I had to force elasticsearch to be anonymous and I was going to fix it.

I think a better solution is to remove the defaults from the helper. Then set the defaults as examples in the values.yaml and then you can override them to be "" as expected. The helper would just check if userName then set and separately if password then set.

There is no need to introduce a third variable.

There is already examples in the values.yaml here https://github.com/jaegertracing/helm-charts/blob/main/charts/jaeger/values.yaml#L271

Something like

{{/*
Elasticsearch related environment variables
*/}}
{{- define "elasticsearch.env" -}}
{{- if eq .Values.storage.type "elasticsearch" -}}
{{- $es := .Values.storage.elasticsearch | default dict -}}
{{- if $es.user -}}
- name: ES_USERNAME
  value: {{ $es.user | quote }}
{{- end }}
{{- if $es.password -}}
- name: ES_PASSWORD
  value: {{ $es.password | quote }}
{{- end }}
{{- $url := $es.url | default "http://elasticsearch-master:9200" -}}
- name: ES_SERVER_URLS
  value: {{ $url | quote }}
- name: ES_NODES
  value: {{ $url | quote }}
{{- /* Handle TLS insecurity */ -}}
{{- if and (($es).tls).enabled (($es).tls).insecure }}
- name: ES_TLS_SKIP_HOST_VERIFY
  value: "true"
{{- end }}
{{- end }}
{{- end -}}

This was untested, but it should work

Remove the `anonymous` flag and hardcoded default credentials from the elasticsearch.env helper. ES_USERNAME and ES_PASSWORD are now only injected when `storage.elasticsearch.user` and `storage.elasticsearch.password` are explicitly set. Omitting them gives anonymous access. Signed-off-by: Oliver Domokos <domolitom@gmail.com>

domolitom · 2026-03-11T12:43:34Z

Thanks for the suggestion! Implemented:

removed the anonymous flag and the hardcoded defaults from the helper. ES_USERNAME/ES_PASSWORD are now only set when user/password are explicitly provided.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-11T12:45:32Z

 {{- if eq .Values.storage.type "elasticsearch" -}}
 {{- $es := .Values.storage.elasticsearch | default dict -}}
-{{- $user := $es.user | default "elastic" -}}
-{{- $password := $es.password | default "changeme" -}}
-{{- $url := $es.url | default "http://elasticsearch-master:9200" -}}
+{{- if $es.user }}
+- name: ES_USERNAME
+  value: {{ $es.user | quote }}
+{{- end }}
+{{- if $es.password }}
+- name: ES_PASSWORD
+  value: {{ $es.password | quote }}
+{{- end }}
+{{ $url := $es.url | default "http://elasticsearch-master:9200" -}}


The PR description says it re-adds storage.elasticsearch.anonymous so credential env vars are omitted only when that flag is true, but the template no longer references an anonymous value at all and instead changes behavior to omit credentials whenever user/password are unset. This doesn’t implement the documented option and can be a breaking change for users who relied on the previous default credential injection. Consider reintroducing an explicit $es.anonymous guard (and keeping the prior defaults when not anonymous), or update the PR scope/docs to reflect the new behavior.

To solve this you can set the credentials to the default in the values.yaml instead. This will prevent and backwards compat issues... Though I highly doubt anyone uses the current default lol

Copilot · 2026-03-11T12:45:32Z

+{{- if $es.user }}
+- name: ES_USERNAME
+  value: {{ $es.user | quote }}
+{{- end }}
+{{- if $es.password }}
+- name: ES_PASSWORD
+  value: {{ $es.password | quote }}


ES_USERNAME and ES_PASSWORD are rendered independently. If a user sets only one of storage.elasticsearch.user or storage.elasticsearch.password, the job will get a partial basic-auth configuration and likely fail. It’s safer to render both together (or neither), and/or fail template rendering with a clear message when only one is set.

Suggested change

{{- if $es.user }}

- name: ES_USERNAME

value: {{ $es.user | quote }}

{{- end }}

{{- if $es.password }}

- name: ES_PASSWORD

value: {{ $es.password | quote }}

{{- if and $es.user $es.password }}

- name: ES_USERNAME

value: {{ $es.user | quote }}

- name: ES_PASSWORD

value: {{ $es.password | quote }}

{{- else if or $es.user $es.password }}

{{- fail "both storage.elasticsearch.user and storage.elasticsearch.password must be set or both omitted" }}

Eh, this might be true only because of how Jaeger creates basic auth, but I think it's beneficial to keep separate as you can create an anonymous user in elastcsearch that takes no password, but does require a user name

Agreed — keeping them independent makes sense since ES supports users without passwords. No changes needed here.

Copilot · 2026-03-11T12:45:33Z

+- name: ES_PASSWORD
+  value: {{ $es.password | quote }}
+{{- end }}
+{{ $url := $es.url | default "http://elasticsearch-master:9200" -}}


Whitespace trimming is inconsistent for the $url assignment ({{ $url := ... -}}) compared to the surrounding helper which consistently uses {{- ... -}}. Aligning this to {{- $url := ... -}} avoids emitting stray whitespace lines in the rendered YAML and matches the established style in this file.

Suggested change

{{ $url := $es.url | default "http://elasticsearch-master:9200" -}}

{{- $url := $es.url | default "http://elasticsearch-master:9200" -}}

@domolitom can you run a few tests that outputs the yaml with combinations of certain values set and not set in this section to ensure the resulting yaml whitespace is correct?

Thanks for catching the whitespace issue! I ran helm template with 7 combinations of storage.elasticsearch.* values against the es-index-cleaner-cronjob.yaml template to verify correctness.

I also fixed the whitespace trimming on the $url assignment line — the original {{ $url := ... -}} (no left trim) produced a stray blank line, but adding both trims {{- ... -}} collapsed lines when credentials were present. The fix uses {{- ... }} (left trim only, keep right newline). See commit 4ac06de.

Test results (env: section from rendered es-index-cleaner-cronjob.yaml):

Test 1: Both user + password

env: - name: ES_USERNAME value: "elastic" - name: ES_PASSWORD value: "changeme" - name: ES_SERVER_URLS value: "http://elasticsearch-master:9200" - name: ES_NODES value: "http://elasticsearch-master:9200"

Test 2: Only user (no password)

env: - name: ES_USERNAME value: "elastic" - name: ES_SERVER_URLS value: "http://elasticsearch-master:9200" - name: ES_NODES value: "http://elasticsearch-master:9200"

Test 3: Only password (no user)

env: - name: ES_PASSWORD value: "changeme" - name: ES_SERVER_URLS value: "http://elasticsearch-master:9200" - name: ES_NODES value: "http://elasticsearch-master:9200"

Test 4: Neither set (anonymous access)

env: - name: ES_SERVER_URLS value: "http://elasticsearch-master:9200" - name: ES_NODES value: "http://elasticsearch-master:9200"

Test 5: Custom URL + credentials

env: - name: ES_USERNAME value: "elastic" - name: ES_PASSWORD value: "changeme" - name: ES_SERVER_URLS value: "https://my-es:9200" - name: ES_NODES value: "https://my-es:9200"

Test 6: TLS insecure + credentials

env: - name: ES_USERNAME value: "elastic" - name: ES_PASSWORD value: "changeme" - name: ES_SERVER_URLS value: "http://elasticsearch-master:9200" - name: ES_NODES value: "http://elasticsearch-master:9200" - name: ES_TLS_SKIP_HOST_VERIFY value: "true"

Test 7: Anonymous + TLS insecure

env: - name: ES_SERVER_URLS value: "http://elasticsearch-master:9200" - name: ES_NODES value: "http://elasticsearch-master:9200" - name: ES_TLS_SKIP_HOST_VERIFY value: "true"

All 7 pass helm lint ✅

Align whitespace trimming on the $url variable assignment to prevent stray blank lines when credentials are omitted and avoid collapsing lines when credentials are present. Signed-off-by: Oliver Domokos <domolitom@gmail.com>

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Stevenpc3 · 2026-03-13T19:24:20Z

 name: jaeger
 type: application
-version: 4.5.0
+version: 4.5.1


Please set a user value and password value in the values.yaml to eliminate this concern. Simply uncomment the values here for user and password.

elasticsearch: tls: enabled: false secretName: "" mountPath: "" subPath: "" url: http://elasticsearch-master:9200 user: elastic <---------------------- update here password: changeme <---------------------- update here

This will ensure the same default values. If anyone wants anonymous they can comment them again or set them to "" in an override

@domolitom can you please add this to ensure the backwards compatibility is fine

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

 name: jaeger
 type: application
-version: 4.5.0
+version: 4.5.1


Stevenpc3 · 2026-03-20T14:16:12Z

@pavelnikolov @naseemkullah

Copilot AI review requested due to automatic review settings February 16, 2026 15:46

domolitom requested review from naseemkullah and pavelnikolov as code owners February 16, 2026 15:46

Copilot started reviewing on behalf of domolitom February 16, 2026 15:46 View session

domolitom changed the title ~~[jaeger] Re-add anonymous Elasticsearch access support~~ [jaeger-es-index-cleaner] Re-add anonymous Elasticsearch access support Feb 16, 2026

Copilot AI reviewed Feb 16, 2026

View reviewed changes

Comment thread charts/jaeger/templates/_helpers.tpl Outdated

Comment thread charts/jaeger/values.yaml Outdated

Comment thread charts/jaeger/Chart.yaml

domolitom force-pushed the fix/jaeger-es-anonymous-auth branch from 9ff9110 to 3b216b0 Compare February 16, 2026 15:53

domolitom requested a review from Copilot February 16, 2026 15:54

Copilot started reviewing on behalf of domolitom February 16, 2026 15:54 View session

Copilot AI reviewed Feb 16, 2026

View reviewed changes

domolitom force-pushed the fix/jaeger-es-anonymous-auth branch from 3b216b0 to f5bb751 Compare February 16, 2026 16:03

domolitom changed the title ~~[jaeger-es-index-cleaner] Re-add anonymous Elasticsearch access support~~ [jaeger] Re-add anonymous Elasticsearch access support Feb 16, 2026

domolitom mentioned this pull request Feb 16, 2026

[Bug]: elasticsearch.env helper always injects default credentials, breaking AWS OpenSearch #742

Open

Copilot AI review requested due to automatic review settings March 11, 2026 12:42

Copilot started reviewing on behalf of domolitom March 11, 2026 12:42 View session

Copilot AI reviewed Mar 11, 2026

View reviewed changes

[jaeger] Fix whitespace trimming in elasticsearch.env helper

4ac06de

Align whitespace trimming on the $url variable assignment to prevent stray blank lines when credentials are omitted and avoid collapsing lines when credentials are present. Signed-off-by: Oliver Domokos <domolitom@gmail.com>

domolitom requested review from Stevenpc3 and Copilot March 13, 2026 10:20

Copilot started reviewing on behalf of domolitom March 13, 2026 10:38 View session

Copilot AI reviewed Mar 13, 2026

View reviewed changes

domolitom requested a review from Copilot March 14, 2026 17:57

Copilot started reviewing on behalf of domolitom March 14, 2026 17:58 View session

Copilot AI reviewed Mar 14, 2026

View reviewed changes

Comment thread charts/jaeger/Chart.yaml

name: jaeger

type: application

version: 4.5.0

version: 4.5.1

	{{ $url := $es.url \| default "http://elasticsearch-master:9200" -}}
	{{- $url := $es.url \| default "http://elasticsearch-master:9200" -}}

Conversation

domolitom commented Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does

Which issue this PR fixes

Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Stevenpc3 commented Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

domolitom commented Mar 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Stevenpc3 Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Stevenpc3 Mar 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

domolitom Mar 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Stevenpc3 Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

domolitom Mar 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Stevenpc3 Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Stevenpc3 Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Stevenpc3 commented Mar 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

domolitom commented Feb 16, 2026 •

edited

Loading

Stevenpc3 commented Mar 10, 2026 •

edited

Loading

domolitom commented Mar 11, 2026 •

edited

Loading

Stevenpc3 Mar 11, 2026 •

edited

Loading

Stevenpc3 Mar 13, 2026 •

edited

Loading