Add support for AWS Elasticsearch Service

[kalroy]

Signed-off-by: Kallol Roy karoy@progress.com

🔩 Description: What code changed, and why?

External AWS ES Service backup fails with the error:

"Backup failed" backup_id=20210128145121 error="es-sidecar-service failed to create snapshot: rpc error: 
code = Unknown desc = failed to create snapshot repository chef-automate-es6-event-feed-service for snapshot \"20210128145121\" of service \"event-feed-service\": 
elasticsearch repository create request failed for repo \"chef-automate-es6-event-feed-service\"; 
request data: '{s3 map[base_path:automate-elasticsearch-data/chef-automate-es6-event-feed-service bucket:a2-nab-bucket compress:true]}': elastic: Error 403 (Forbidden)"

⛓️ Related Resources

4645

👍 Definition of Done

👟 How to Build and Test the Change

Assumptions about your AWS Elasticsearch configuration:

• Must use fine grained access control
• role arn must be provided. That role must be allowed to create snapshot repositories. This is done through the kibana interface.
• username and password must be provided. All other requests to elasticsearch will use this for basic auth

Example Automate Configuration:

[global.v1.external.elasticsearch]
enable = true
nodes = ["https://youresdomain.us-west-2.es.amazonaws.com"]

[global.v1.external.elasticsearch.ssl]
server_name = "youresdomain.us-west-2.es.amazonaws.com"
root_cert_file = "/etc/ssl/certs/ca-bundle.crt"
[global.v1.external.elasticsearch.auth]
scheme = "aws_es"

[global.v1.external.elasticsearch.auth.aws_es]
username = "youruser"
password = "yourpassword"

[global.v1.external.elasticsearch.backup]
enable = true
location = "s3"
[global.v1.external.elasticsearch.backup.s3]
bucket = "yourbucket"
[global.v1.external.elasticsearch.backup.s3.settings]
region = "us-west-2"
role_arn = "arn:aws:iam::111111111111:role/snapshot-role"

✅ Checklist

• I have read the CONTRIBUTING document.
• Tests added/updated?
• Docs added/updated?
• All commits have been signed-off for the Developer Certification of Origin.

📷 Screenshots, if applicable

Aha! Link: https://chef.aha.io/epics/SH-E-376

[netlify]

Deploy preview for chef-automate processing.

Building with commit cebf2b7

https://app.netlify.com/sites/chef-automate/deploys/6022dc9c061cba0007fdb7cb

[balkarsinghkang]

Backup worked successfully, but restore failed. Below are some of the error logs

s operations" backup_id=20210218183956 error="failed to import database dump from authz-service/pg_data/chef_authz_service.fc: error importing database "chef_authz_service": failed to import SQL file from "stdin", stderr: pg_restore: [archiver (db)] Error while PROCESSING TOC:\npg_restore: [archiver (db)] Error from TOC entry 3357; 0 0 COMMENT EXTENSION pgcrypto \npg_restore: [archiver (db)] could not execute query: ERROR: must be owner of extension pgcrypto\n Command was: COMMENT ON EXTENSION pgcrypto IS 'cryptographic functions';\n\n\n\npg_restore: [archiver (db)] Error from TOC entry 3358; 0 0 COMMENT EXTENSION "uuid-ossp" \npg_restore: [archiver (db)] could not execute query: ERROR: must be owner of extension uuid-ossp\n Command was: COMMENT ON EXTENSION "uuid-ossp" IS 'generate universally unique identifiers (UUIDs)';\n\n\n\nWARNING: errors ignored on restore: 2\n: exit status 1" restore_id=20210218190036
Feb 18 19:02:31 ip-10-100-101-171 hab[989]: deployment-service.default(O): time="2021-02-18T19:02:31Z" level=error msg="Failed to restore services" backup_id=20210218183956 error="failed to import database dump from authz-service/pg_data/chef_authz_service.fc: error importing database "chef_authz_service": failed to import SQL file from "stdin", stderr: pg_restore: [archiver (db)] Error while PROCESSING TOC:\npg_restore: [archiver (db)] Error from TOC entry 3357; 0 0 COMMENT EXTENSION pgcrypto \npg_restore: [archiver (db)] could not execute query: ERROR: must be owner of extension pgcrypto\n Command was: COMMENT ON EXTENSION pgcrypto IS 'cryptographic functions';\n\n\n\npg_restore: [archiver (db)] Error from TOC entry 3358; 0 0 COMMENT EXTENSION "uuid-ossp" \npg_restore: [archiver (db)] could not execute query: ERROR: must be owner of extension uuid-ossp\n Command was: COMMENT ON EXTENSION "uuid-ossp" IS 'generate universally unique identifiers (UUIDs)';\n\n\n\nWARNING: errors ignored on restore: 2\n: exit status 1" restore_id=20210218190036

[Kmaralla]

@kalroy Opened similar issue. Any help would be appreciated
#5851

[Kmaralla]

Any update on restore support in Aws Elasticsearch?