[Feature Request] Allow resolving environment variables while using opensearch-security plugin

[burzala]

Is your feature request related to a problem? Please describe

It looks like it is not possible to pass sensitive values to opensearch-security plugin configuration which is stored under <OPENSEARCH_CONFIG_HOME>/opensearch-security/config.yml

Let's say I have LDAP password configured like below

config:
  dynamic:
    authc:
      ldap:
        authentication_backend:
          type: ldap
          config:
            password: SomeSecretText

but I don't want to pass my SomeSecretText in plain text form since it's a sensitive value. Instead, I would like to use ${env.LDAP_PASSWORD} syntax to take it from the environment variable

Describe the solution you'd like

Generally, opensearch-security plugin supports environment variables but such option is not supported by the operator.

If we look at the existing parameters for securityadmin.sh script, we can see that below option is available:

 -rev,--resolve-env-vars                        Resolve/Substitute env
                                                vars in config with their
                                                value before uploading

However, the same is not used within the operator.

I did small experiment and it looks that building the image containing -rev parameter injected to the following places makes everything working as expected:

(a) opensearch-operator/pkg/reconcilers/securityconfig.go

BEFORE:

until $ADMIN -cacert %s -cert %s -key %s -cd %s -icl -nhnv -h %s -p %v || (( count++ >= 20 ));

AFTER:

until $ADMIN -rev -cacert %s -cert %s -key %s -cd %s -icl -nhnv -h %s -p %v || (( count++ >= 20 ));

(b) opensearch-operator/pkg/reconcilers/securityconfig_test.go

BEFORE:

until $ADMIN -cacert /certs/ca.crt -cert /certs/tls.crt -key /certs/tls.key -cd /usr/share/opensearch/config/opensearch-security -icl -nhnv -h no-securityconfig-tl    s-configured.no-securityconfig-tls-configured.svc.cluster.local -p 9200 || (( count++ >= 20 ));

AFTER:

until $ADMIN -rev -cacert /certs/ca.crt -cert /certs/tls.crt -key /certs/tls.key -cd /usr/share/opensearch/config/opensearch-security -icl -nhnv -h no-securityconfig-tl    s-configured.no-securityconfig-tls-configured.svc.cluster.local -p 9200 || (( count++ >= 20 ));

Would it be possible to have -rev option supported in the operator? (by default or by some operator setting)

Related component

Plugins

Describe alternatives you've considered

No response

Additional context

No response

[burzala]

I used the wrong place accidentally :( New item available here: opensearch-project/opensearch-k8s-operator#914