I created a proof-of-concept OpenSearch 2 image in T373034. The time has come to create a working production image for the OpenSearch on K8s project ( T362105 ).
AC:
Potential sources of inspiration:
| Title | Reference | Author | Source Branch | Dest Branch | |
|---|---|---|---|---|---|
| Add curl, java security policy | repos/data-engineering/opensearch!6 | bking | curl | main | |
| Use the docker entrypoint script from Amazon's build repo; clean up | repos/data-engineering/opensearch!5 | bking | entrypoint | main | |
| use openjdk-17-jre as base image | repos/data-engineering/opensearch!4 | bking | use-openjdk-img | main | |
| blubber.yaml: changes to mimic upstream opensearch image | repos/data-engineering/opensearch!3 | bking | mimic-upstream | main | |
| Test CI...again | repos/data-engineering/opensearch!2 | bking | ci_test | main | |
| README cleanup, trigger CI | repos/data-engineering/opensearch!1 | bking | deb_java | main |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | bking | T399335 OpenSearch on K8s: build a new OpenSearch 2 Docker image | |||
| Resolved | bking | T400295 OpenSearch on K8s: build a new opensearch-operator image | |||
| Resolved | taavi | T393173 Publish Wikimedia trixie base Docker image | |||
| Resolved | MoritzMuehlenhoff | T391083 Prepare our custom installer and the base layer for Trixie | |||
| Resolved | MoritzMuehlenhoff | T392790 Use a forward port of Puppet 7 on Trixie hosts |
I've updated our OpenSearch docker image repo with a working image. There's still a bit left to do (see checkboxes above), but we're making progress.
bking opened https://gitlab.wikimedia.org/repos/data-engineering/opensearch/-/merge_requests/1
README cleanup, trigger CI
bking merged https://gitlab.wikimedia.org/repos/data-engineering/opensearch/-/merge_requests/1
README cleanup, trigger CI
bking opened https://gitlab.wikimedia.org/repos/data-engineering/opensearch/-/merge_requests/2
Test CI...again
bking merged https://gitlab.wikimedia.org/repos/data-engineering/opensearch/-/merge_requests/2
Test CI...again
bking opened https://gitlab.wikimedia.org/repos/data-engineering/opensearch/-/merge_requests/3
blubber.yaml: changes to mimic upstream opensearch image
bking merged https://gitlab.wikimedia.org/repos/data-engineering/opensearch/-/merge_requests/3
blubber.yaml: changes to mimic upstream opensearch image
Progress report:
I've been building the OpenSearch image using releng's java image because Debian's java packages are ill-behaved: they assume a manpage directory exists, and they won't install if it doesn't. I haven't been able to figure out how to work around this in Blubber.
However, that image is based on Bullseye and the systemd-standalone-tmpfiles package appears to have disappeared from our Bullseye repos sometime over the weekend. Unfortunately, this package is required for installing the opensearch package inside a container.
I've asked the Infrastructure Foundations team what happened to the package, but assuming it isn't becoming back, I'll need to either:
I'll start by talking to Releng.
You can use this image instead. https://docker-registry.wikimedia.org/openjdk-17-jre/tags/
That's based on bookworm, so you will still be able to install the systemd-standalone-tmpfiles package.
bking opened https://gitlab.wikimedia.org/repos/data-engineering/opensearch/-/merge_requests/4
use openjdk-17-jre as base image
bking merged https://gitlab.wikimedia.org/repos/data-engineering/opensearch/-/merge_requests/4
use openjdk-17-jre as base image
bking opened https://gitlab.wikimedia.org/repos/data-engineering/opensearch/-/merge_requests/5
Use the docker entrypoint script from Amazon's build repo; clean up
bking merged https://gitlab.wikimedia.org/repos/data-engineering/opensearch/-/merge_requests/5
Use the docker entrypoint script from Amazon's build repo; clean up
bking opened https://gitlab.wikimedia.org/repos/data-engineering/opensearch/-/merge_requests/6
Add curl, java security policy
bking merged https://gitlab.wikimedia.org/repos/data-engineering/opensearch/-/merge_requests/6
Add curl, java security policy
I've confirmed that our new opensearch image does work with the upstream cluster and operator charts . You can find the values files I used to deploy the operator and cluster here.
As we've satisfied the AC, I'm closing this ticket. Work to build an opensearch operator image continues in T400295...