feat: support opensearch client cert auth

.github/workflows/skywalking.yaml

@@ -387,9 +387,6 @@ jobs:
           - name: Storage ES 8.9.0
             config: test/e2e-v2/cases/storage/es/e2e.yaml
             env: ES_VERSION=8.18.1
-          - name: Storage OpenSearch 1.1.0
-            config: test/e2e-v2/cases/storage/opensearch/e2e.yaml
-            env: OPENSEARCH_VERSION=1.1.0
           - name: Storage OpenSearch 1.3.10
             config: test/e2e-v2/cases/storage/opensearch/e2e.yaml
             env: OPENSEARCH_VERSION=1.3.10
@@ -1121,4 +1118,4 @@ jobs:
           [[ ${e2eJavaVersionResults} == 'success' ]] || [[ ${execute} != 'true' && ${e2eJavaVersionResults} == 'skipped' ]] || exit -7;
           [[ ${timeConsumingITResults} == 'success' ]] || [[ ${execute} != 'true' && ${timeConsumingITResults} == 'skipped' ]] || exit -8;
 
-          exit 0;
+          exit 0;

.licenserc.yaml

@@ -109,10 +109,10 @@ dependency:
       version: 2.13.4
       license: Apache-2.0
     - name: com.fasterxml.jackson.datatype:jackson-datatype-jsr310
-      version: 2.18.2
+      version: 2.20.1
       license: Apache-2.0
     - name: com.fasterxml.jackson.datatype:jackson-datatype-jdk8
-      version: 2.18.2
+      version: 2.20.1
       license: Apache-2.0
     - name: com.fasterxml.jackson.dataformat:jackson-dataformat-yaml
       version: 2.15.2
@@ -139,7 +139,7 @@ dependency:
       version: 1.2.1
       license: Apache-2.0
     - name: com.aayushatharva.brotli4j:service
-      version: 1.18.0
+      version: 1.20.0
       license: Apache-2.0
     - name: io.vertx:vertx-grpc
       version: 4.5.9

dist-material/release-docs/LICENSE

@@ -210,8 +210,8 @@ The following components are provided under the Apache-2.0 License. See project
 The text of each license is the standard Apache 2.0 license.
     https://mvnrepository.com/artifact/build.buf.protoc-gen-validate/pgv-java-stub/1.2.1 Apache-2.0
     https://mvnrepository.com/artifact/build.buf.protoc-gen-validate/protoc-gen-validate/1.2.1 Apache-2.0
-    https://mvnrepository.com/artifact/com.aayushatharva.brotli4j/brotli4j/1.18.0 Apache-2.0
-    https://mvnrepository.com/artifact/com.aayushatharva.brotli4j/service/1.18.0 Apache-2.0
+    https://mvnrepository.com/artifact/com.aayushatharva.brotli4j/brotli4j/1.20.0 Apache-2.0
+    https://mvnrepository.com/artifact/com.aayushatharva.brotli4j/service/1.20.0 Apache-2.0
     https://mvnrepository.com/artifact/com.alibaba.nacos/nacos-auth-plugin/2.3.2 Apache-2.0
     https://mvnrepository.com/artifact/com.alibaba.nacos/nacos-client/2.3.2 Apache-2.0
     https://mvnrepository.com/artifact/com.alibaba.nacos/nacos-encryption-plugin/2.3.2 Apache-2.0
@@ -222,8 +222,8 @@ The text of each license is the standard Apache 2.0 license.
     https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-databind/2.16.0 Apache-2.0
     https://mvnrepository.com/artifact/com.fasterxml.jackson.dataformat/jackson-dataformat-yaml/2.15.2 Apache-2.0
     https://mvnrepository.com/artifact/com.fasterxml.jackson.datatype/jackson-datatype-guava/2.12.0 Apache-2.0
-    https://mvnrepository.com/artifact/com.fasterxml.jackson.datatype/jackson-datatype-jdk8/2.18.2 Apache-2.0
-    https://mvnrepository.com/artifact/com.fasterxml.jackson.datatype/jackson-datatype-jsr310/2.18.2 Apache-2.0
+    https://mvnrepository.com/artifact/com.fasterxml.jackson.datatype/jackson-datatype-jdk8/2.20.1 Apache-2.0
+    https://mvnrepository.com/artifact/com.fasterxml.jackson.datatype/jackson-datatype-jsr310/2.20.1 Apache-2.0
     https://mvnrepository.com/artifact/com.fasterxml.jackson.module/jackson-module-kotlin/2.13.4 Apache-2.0
     https://mvnrepository.com/artifact/com.fasterxml/classmate/1.5.1 Apache-2.0
     https://mvnrepository.com/artifact/com.google.api.grpc/proto-google-common-protos/2.48.0 Apache-2.0
@@ -238,12 +238,12 @@ The text of each license is the standard Apache 2.0 license.
     https://mvnrepository.com/artifact/com.google.inject/guice/4.1.0 Apache-2.0
     https://mvnrepository.com/artifact/com.google.j2objc/j2objc-annotations/2.8 Apache-2.0
     https://mvnrepository.com/artifact/com.graphql-java/java-dataloader/3.2.1 Apache-2.0
-    https://mvnrepository.com/artifact/com.linecorp.armeria/armeria/1.32.0 Apache-2.0
-    https://mvnrepository.com/artifact/com.linecorp.armeria/armeria-graphql/1.32.0 Apache-2.0
-    https://mvnrepository.com/artifact/com.linecorp.armeria/armeria-graphql-protocol/1.32.0 Apache-2.0
-    https://mvnrepository.com/artifact/com.linecorp.armeria/armeria-grpc/1.32.0 Apache-2.0
-    https://mvnrepository.com/artifact/com.linecorp.armeria/armeria-grpc-protocol/1.32.0 Apache-2.0
-    https://mvnrepository.com/artifact/com.linecorp.armeria/armeria-protobuf/1.32.0 Apache-2.0
+    https://mvnrepository.com/artifact/com.linecorp.armeria/armeria/1.34.2 Apache-2.0
+    https://mvnrepository.com/artifact/com.linecorp.armeria/armeria-graphql/1.34.2 Apache-2.0
+    https://mvnrepository.com/artifact/com.linecorp.armeria/armeria-graphql-protocol/1.34.2 Apache-2.0
+    https://mvnrepository.com/artifact/com.linecorp.armeria/armeria-grpc/1.34.2 Apache-2.0
+    https://mvnrepository.com/artifact/com.linecorp.armeria/armeria-grpc-protocol/1.34.2 Apache-2.0
+    https://mvnrepository.com/artifact/com.linecorp.armeria/armeria-protobuf/1.34.2 Apache-2.0
     https://mvnrepository.com/artifact/com.orbitz.consul/consul-client/1.5.3 Apache-2.0
     https://mvnrepository.com/artifact/com.squareup.okhttp3/okhttp/3.14.9 Apache-2.0
     https://mvnrepository.com/artifact/com.squareup.okio/okio/1.17.2 Apache-2.0
@@ -300,6 +300,7 @@ The text of each license is the standard Apache 2.0 license.
     https://mvnrepository.com/artifact/io.grpc/grpc-services/1.70.0 Apache-2.0
     https://mvnrepository.com/artifact/io.grpc/grpc-stub/1.70.0 Apache-2.0
     https://mvnrepository.com/artifact/io.grpc/grpc-util/1.70.0 Apache-2.0
+    https://mvnrepository.com/artifact/io.micrometer/context-propagation/1.2.0 Apache-2.0
     https://mvnrepository.com/artifact/io.micrometer/micrometer-commons/1.14.4 Apache-2.0
     https://mvnrepository.com/artifact/io.micrometer/micrometer-core/1.14.4 Apache-2.0
     https://mvnrepository.com/artifact/io.micrometer/micrometer-observation/1.14.4 Apache-2.0
@@ -369,6 +370,7 @@ The text of each license is the standard Apache 2.0 license.
     https://mvnrepository.com/artifact/org.jetbrains.kotlinx/kotlinx-coroutines-jdk8/1.6.4 Apache-2.0
     https://mvnrepository.com/artifact/org.jetbrains.kotlinx/kotlinx-coroutines-reactive/1.6.4 Apache-2.0
     https://mvnrepository.com/artifact/org.jetbrains/annotations/13.0 Apache-2.0
+    https://mvnrepository.com/artifact/org.jspecify/jspecify/1.0.0 Apache-2.0
     https://mvnrepository.com/artifact/org.lz4/lz4-java/1.8.0 Apache-2.0
     https://mvnrepository.com/artifact/org.slf4j/jcl-over-slf4j/1.7.30 Apache-2.0
     https://mvnrepository.com/artifact/org.slf4j/log4j-over-slf4j/1.7.30 Apache-2.0
@@ -543,7 +545,7 @@ The text of each license is also included in licenses/LICENSE-[project].txt.
     https://npmjs.com/package/nanoid/v/3.3.8 3.3.8 MIT
     https://mvnrepository.com/artifact/org.checkerframework/checker-qual/3.33.0 MIT
     https://mvnrepository.com/artifact/org.codehaus.mojo/animal-sniffer-annotations/1.24 MIT
-    https://mvnrepository.com/artifact/org.curioswitch.curiostack/protobuf-jackson/2.7.0 MIT
+    https://mvnrepository.com/artifact/org.curioswitch.curiostack/protobuf-jackson/2.8.1 MIT
     https://mvnrepository.com/artifact/org.slf4j/slf4j-api/1.7.30 MIT
     https://npmjs.com/package/pinia/v/2.0.28 2.0.28 MIT
     https://npmjs.com/package/pinia/node_modules/vue-demi/v/0.13.11 0.13.11 MIT

docs/en/changes/changes.md

@@ -14,6 +14,7 @@
 * Add `LatestLabeledFunction` for meter.
 * MAL Labeled metrics support additional attributes.
 * Bump up netty to 4.2.9.Final.
+* Add support for OpenSearch/ElasticSearch client certificate authentication.
 
 #### UI
 * Fix the missing icon in new native trace view.

oap-server-bom/pom.xml

@@ -67,7 +67,7 @@
         <postgresql.version>42.4.4</postgresql.version>
         <jetcd.version>0.6.1</jetcd.version>
         <testcontainers.version>1.17.6</testcontainers.version>
-        <armeria.version>1.32.0</armeria.version>
+        <armeria.version>1.34.2</armeria.version>
         <awaitility.version>3.0.0</awaitility.version>
         <httpcore.version>4.4.16</httpcore.version>
         <httpasyncclient.version>4.1.5</httpasyncclient.version>

oap-server/server-library/library-client/src/main/java/org/apache/skywalking/oap/server/library/client/elasticsearch/ElasticSearchClient.java

@@ -76,6 +76,11 @@ public class ElasticSearchClient implements Client, HealthCheckable {
     @Setter
     private volatile String trustStorePass;
 
+    private final String keyStorePath;
+
+    @Setter
+    private volatile String keyStorePass;
+
     @Setter
     private volatile String user;
 
@@ -107,6 +112,8 @@ public ElasticSearchClient(ModuleManager moduleManager,
                                String protocol,
                                String trustStorePath,
                                String trustStorePass,
+                               String keyStorePath,
+                               String keyStorePass,
                                String user,
                                String password,
                                Function<String, String> indexNameConverter,
@@ -119,6 +126,8 @@ public ElasticSearchClient(ModuleManager moduleManager,
         this.protocol = protocol;
         this.trustStorePath = trustStorePath;
         this.trustStorePass = trustStorePass;
+        this.keyStorePath = keyStorePath;
+        this.keyStorePass = keyStorePass;
         this.user = user;
         this.password = password;
         this.indexNameConverter = indexNameConverter;
@@ -152,9 +161,17 @@ public void connect() {
 
         if (!Strings.isNullOrEmpty(trustStorePath)) {
             cb.trustStorePath(trustStorePath);
+            // Always set trustStorePass if trustStorePath is set (even if empty string)
+            if (trustStorePass != null) {
+                cb.trustStorePass(trustStorePass);
+            }
         }
-        if (!Strings.isNullOrEmpty(trustStorePass)) {
-            cb.trustStorePass(trustStorePass);
+        if (!Strings.isNullOrEmpty(keyStorePath)) {
+            cb.keyStorePath(keyStorePath);
+            // Always set keyStorePass if keyStorePath is set (even if empty string)
+            if (keyStorePass != null) {
+                cb.keyStorePass(keyStorePass);
+            }
         }
         if (!Strings.isNullOrEmpty(user)) {
             cb.username(user);

oap-server/server-library/library-client/src/test/java/org/apache/skywalking/library/elasticsearch/bulk/ElasticSearchIT.java

@@ -112,7 +112,7 @@ public void indexOperate(final ElasticsearchContainer server,
         final ElasticSearchClient client = new ElasticSearchClient(
             moduleManager,
             server.getHttpHostAddress(),
-            "http", "", "", "test", "test",
+            "http", "", "", "", "", "test", "test",
             indexNameConverter(namespace), 500, 6000,
             0, 15
         );
@@ -165,7 +165,7 @@ public void documentOperate(final ElasticsearchContainer server,
         final ElasticSearchClient client = new ElasticSearchClient(
             moduleManager,
             server.getHttpHostAddress(),
-            "http", "", "", "test", "test",
+            "http", "", "", "", "", "test", "test",
             indexNameConverter(namespace), 500, 6000,
             0, 15
         );
@@ -241,7 +241,7 @@ public void templateOperate(final ElasticsearchContainer server,
         final ElasticSearchClient client = new ElasticSearchClient(
             moduleManager,
             server.getHttpHostAddress(),
-            "http", "", "", "test", "test",
+            "http", "", "", "", "", "test", "test",
             indexNameConverter(namespace), 500, 6000,
             0, 15
         );
@@ -297,7 +297,7 @@ public void bulk(final ElasticsearchContainer server,
         final ElasticSearchClient client = new ElasticSearchClient(
             moduleManager,
             server.getHttpHostAddress(),
-            "http", "", "", "test", "test",
+            "http", "", "", "", "", "test", "test",
             indexNameConverter(namespace), 500, 6000,
             0, 15
         );
@@ -331,7 +331,7 @@ public void bulkPer_1KB(final ElasticsearchContainer server,
         final ElasticSearchClient client = new ElasticSearchClient(
             moduleManager,
             server.getHttpHostAddress(),
-            "http", "", "", "test", "test",
+            "http", "", "", "", "", "test", "test",
             indexNameConverter(namespace), 500, 6000,
             0, 15
         );
@@ -361,7 +361,7 @@ public void timeSeriesOperate(final ElasticsearchContainer server,
         final ElasticSearchClient client = new ElasticSearchClient(
             moduleManager,
             server.getHttpHostAddress(),
-            "http", "", "", "test", "test",
+            "http", "", "", "", "", "test", "test",
             indexNameConverter(namespace), 500, 6000,
             0, 15
         );