Fixup opensearch when using advanced security options (#1613) (#1614)

[PR #1613/6919bac1 backport][stable-4] Fixup opensearch when using advanced security options This is a backport of PR #1613 as merged into main (6919bac). Fix #1560 Reviewed-by: Markus Bergholz <[email protected]>
ansible-collections · Dec 7, 2022 · 1f42ae9 · 1f42ae9
1 parent 4a6c9af
commit 1f42ae9
Show file tree

Hide file tree

Showing 3 changed files with 34 additions and 2 deletions.
diff --git a/changelogs/fragments/1613-opensearch.yml b/changelogs/fragments/1613-opensearch.yml
@@ -0,0 +1,2 @@
+bugfixes:
+  - opensearch - Fix cluster creation when using advanced security options (https://github.com/ansible-collections/community.aws/pull/1613).
diff --git a/plugins/modules/opensearch.py b/plugins/modules/opensearch.py
@@ -947,6 +947,7 @@ def set_advanced_security_options(
             ] = advanced_security_opts.get("internal_user_database_enabled")
         master_user_opts = advanced_security_opts.get("master_user_options")
         if master_user_opts is not None:
+            advanced_security_config.setdefault("MasterUserOptions", {})
             if master_user_opts.get("master_user_arn") is not None:
                 advanced_security_config["MasterUserOptions"][
                     "MasterUserARN"

diff --git a/tests/integration/targets/opensearch/tasks/test_opensearch.yml b/tests/integration/targets/opensearch/tasks/test_opensearch.yml
@@ -3,7 +3,7 @@
     - name: test without specifying required module options
       opensearch:
         engine_version: "Elasticsearch_7.1"
-      ignore_errors: yes
+      ignore_errors: true
       register: result
 
     - name: assert domain_name is a required module option
@@ -959,7 +959,7 @@
         wait_timeout: "{{ 60 * 60 }}"
       register: opensearch_domain
       until: opensearch_domain is not failed
-      ignore_errors: yes
+      ignore_errors: true
       retries: 10
       # After enabling at rest encryption, there is a period during which the API fails, so retry.
       delay: 30
@@ -996,13 +996,22 @@
           - "opensearch_domain.domain_endpoint_options.tls_security_policy == 'Policy-Min-TLS-1-2-2019-07'"
           - opensearch_domain is changed
 
+- name: Set common facts for advanced security tests
+  set_fact:
+    test_master_user_name: my_custom_admin_username
+    test_master_user_password: "{{ lookup('ansible.builtin.password', '/dev/null chars=ascii_lowercase,digits length=16') }}"
+
 - name: Configure advanced security
   block:
     - name: Enable advanced security, check mode
       opensearch:
         domain_name: "es-{{ tiny_prefix }}-vpc"
         advanced_security_options:
           enabled: true
+          internal_user_database_enabled: false
+          master_user_options:
+            master_user_name: "{{ test_master_user_name }}"
+            master_user_password: "{{ test_master_user_password }}"
         wait: true
       check_mode: true
       register: opensearch_domain
@@ -1019,19 +1028,31 @@
         domain_name: "es-{{ tiny_prefix }}-vpc"
         advanced_security_options:
           enabled: true
+          internal_user_database_enabled: false
+          master_user_options:
+            master_user_name: "{{ test_master_user_name }}"
+            master_user_password: "{{ test_master_user_password }}"
         wait: true
         wait_timeout: "{{ 60 * 60 }}"
       register: opensearch_domain
     - assert:
         that:
           - "opensearch_domain.advanced_security_options.enabled == True"
+          - "opensearch_domain.advanced_security_options.internal_user_database_enabled == False"
+          - "opensearch_domain.advanced_security_options.master_user_options is defined"
+          - "opensearch_domain.advanced_security_options.master_user_options.master_user_name is test_master_user_name"
+          - "opensearch_domain.advanced_security_options.master_user_options.master_user_password is test_master_user_password"
           - opensearch_domain is changed
 
     - name: Enable advanced security, check mode again
       opensearch:
         domain_name: "es-{{ tiny_prefix }}-vpc"
         advanced_security_options:
           enabled: true
+          internal_user_database_enabled: false
+          master_user_options:
+            master_user_name: "{{ test_master_user_name }}"
+            master_user_password: "{{ test_master_user_password }}"
         wait: true
       check_mode: true
       register: opensearch_domain
@@ -1044,11 +1065,19 @@
         domain_name: "es-{{ tiny_prefix }}-vpc"
         advanced_security_options:
           enabled: true
+          internal_user_database_enabled: false
+          master_user_options:
+            master_user_name: "{{ test_master_user_name }}"
+            master_user_password: "{{ test_master_user_password }}"
         wait: true
       register: opensearch_domain
     - assert:
         that:
           - "opensearch_domain.advanced_security_options.enabled == True"
+          - "opensearch_domain.advanced_security_options.internal_user_database_enabled == False"
+          - "opensearch_domain.advanced_security_options.master_user_options is defined"
+          - "opensearch_domain.advanced_security_options.master_user_options.master_user_name is test_master_user_name"
+          - "opensearch_domain.advanced_security_options.master_user_options.master_user_password is test_master_user_password"
           - opensearch_domain is not changed
 
 - name: Configure warm and cold storage