Verified Commit 8de8f3a5 authored by Marek Veselý's avatar Marek Veselý
Browse files

index, permissions

parent 064f6352

running_exercise/lib/opensearch_client.py

+18 −19
Original line number Diff line number Diff line
@@ -17,10 +17,9 @@ def create_opensearch_exercise(team_ids): 
    """

    For each team:



    1. Create an index template for a data stream.

    2. Create the data stream.

    1. Create an index.

    3. Create an OpenSearch user.

    4. Create a role for the user with write permissions to the data stream.

    4. Create a role for the user with write permissions to the index.

    5. Map the user to the role.

    6. Save the credentials of the user and return them later.
@@ -32,19 +31,14 @@ def create_opensearch_exercise(team_ids): 
    credentials = []



    for team_id in team_ids:

        data_stream_name = f"team-{team_id}--data-stream"

        

        index_template_name = f"team-{team_id}--index-template"

        index_template_body = {

            "index_patterns": [data_stream_name],

            "data_stream": {},

        }

        index_name = f"team-{team_id}--index"



        username = f"team-{team_id}"

        # TODO: Generate a strong password for each user

        password = f"v&ery6#7st*ong78288732-pass889329word-aVUfg9"

        credentials.append({

            "team_id": team_id,

            "index_name": index_name,

            "username": username,

            "password": password,

        })
@@ -54,14 +48,24 @@ def create_opensearch_exercise(team_ids): 


        role_name = f"team-{team_id}--role"

        role_body = {

            "cluster_permissions": [

                "cluster:monitor/main",

                "cluster:admin/ingest/pipeline/get",

                "cluster:admin/ingest/pipeline/put"

            ],

            "index_permissions": [

                {

                    "index_patterns": [data_stream_name],

                    "allowed_actions": ["write"],

                    "index_patterns": [

                        f"{index_name}"

                    ],

                    "allowed_actions": [

                        "indices_all",

                    ]

                }

            ]

        }





        role_mapping_body = {

            "users": [username],

        }
@@ -69,13 +73,8 @@ def create_opensearch_exercise(team_ids): 
        print(f"=== {team_id} ===")



        try:

            # https://docs.opensearch.org/docs/latest/im-plugin/data-streams/#step-1-create-an-index-template

            index_template = client.indices.put_index_template(name=index_template_name, body=index_template_body)

            print(f"✓ Index template")



            # https://docs.opensearch.org/docs/latest/im-plugin/data-streams/#step-2-create-a-data-stream

            data_stream = client.indices.create_data_stream(name=data_stream_name)

            print(f"✓ Data stream")

            index = client.indices.create(index=index_name)

            print(f"✓ Index")



            # https://docs.opensearch.org/docs/latest/security/access-control/users-roles/#defining-users

            # https://docs.opensearch.org/docs/latest/security/access-control/api/#create-user