@@ -6,10 +6,30 @@ ARG SECURE_INTEGRATION
66ENV SECURE_INTEGRATION=$SECURE_INTEGRATION
77ARG OPENSEARCH_INITIAL_ADMIN_PASSWORD
88
9- # Some opensearch secuirty settings are only present since 2.8.0 and causes older versions to brake if the setting is present
10- # https://apple.stackexchange.com/a/123408/11374
9+ # Handle plugin dependencies when removing opensearch-security
10+ # OpenSearch 3.x introduced plugin dependencies that prevent direct removal of opensearch-security.
11+ # Plugin dependency evolution:
12+ # 3.0.0: No dependencies - remove opensearch-security directly
13+ # 3.1.0-3.2.0: opensearch-anomaly-detection extends opensearch-security
14+ # 3.3.2: opensearch-skills extends opensearch-ml, which extends opensearch-security
15+ # 3.4.0+: opensearch-flow-framework also extends opensearch-security
16+ # We must remove plugins in dependency order (dependents first, then their dependencies).
17+ ARG OPENSEARCH_VERSION
1118RUN if [ "$SECURE_INTEGRATION" != "true" ] ; then \
12- $opensearch_path/bin/opensearch-plugin remove opensearch-security; \
19+ function version { echo "$@" | awk -F. '{ printf("%d%03d%03d%03d\n", $1,$2,$3,$4); }'; }; \
20+ if [ $(version ${OPENSEARCH_VERSION:-0.0.0}) -ge $(version "3.4.0") ] || [ "$OPENSEARCH_VERSION" = "latest" ]; then \
21+ $opensearch_path/bin/opensearch-plugin remove opensearch-flow-framework; \
22+ $opensearch_path/bin/opensearch-plugin remove opensearch-skills; \
23+ $opensearch_path/bin/opensearch-plugin remove opensearch-ml; \
24+ $opensearch_path/bin/opensearch-plugin remove opensearch-anomaly-detection; \
25+ elif [ $(version ${OPENSEARCH_VERSION:-0.0.0}) -ge $(version "3.3.2") ]; then \
26+ $opensearch_path/bin/opensearch-plugin remove opensearch-skills; \
27+ $opensearch_path/bin/opensearch-plugin remove opensearch-ml; \
28+ $opensearch_path/bin/opensearch-plugin remove opensearch-anomaly-detection; \
29+ elif [ $(version ${OPENSEARCH_VERSION:-0.0.0}) -ge $(version "3.1.0") ]; then \
30+ $opensearch_path/bin/opensearch-plugin remove opensearch-anomaly-detection; \
31+ fi; \
32+ $opensearch_path/bin/opensearch-plugin remove opensearch-security; \
1333 else \
1434 $opensearch_path/opensearch-onetime-setup.sh; \
1535 echo "plugins.security.nodes_dn_dynamic_config_enabled: true" | tee -a $opensearch_path/config/opensearch.yml > /dev/null; \
@@ -24,4 +44,4 @@ RUN if [ "$SECURE_INTEGRATION" != "true" ] ; then \
2444HEALTHCHECK --start-period=20s --interval=30s \
2545 CMD curl -sf --retry 5 --max-time 5 --retry-delay 5 --retry-max-time 30 --retry-all-errors \
2646 $(if $SECURE_INTEGRATION; then echo "--cert config/kirk.pem --key config/kirk-key.pem -k https://"; fi)"localhost:9200" \
27- || bash -c 'kill -s 15 -1 && (sleep 10; kill -s 9 -1)'
47+ || bash -c 'kill -s 15 -1 && (sleep 10; kill -s 9 -1)'
0 commit comments