opensearch-plugin script does not work in wazuh-indexer 4.9.0 container

[ejedev]

In our deployment we had a script to install the repository-s3 plugin on our indexer nodes on container start. This worked in 4.8.2 and below. Upon upgrading to 4.9.0, we receive the following error: ./bin/opensearch-env: line 104: /etc/sysconfig/wazuh-indexer: No such file or directory

To confirm this wasn't our environment specifically, I created a fresh install on my local machine with the following commands:

git clone https://github.com/wazuh/wazuh-docker.git -b v4.9.0
cd wazuh-docker/single-node
docker-compose -f generate-indexer-certs.yml run --rm generator
docker compose up

Then I entered the container and tried to run the command:

$ docker exec -it single-node-wazuh.indexer-1 bash

bash-5.2$ /usr/share/wazuh-indexer/bin/opensearch-plugin install --batch repository-s3
/usr/share/wazuh-indexer/bin/opensearch-env: line 104: /etc/sysconfig/wazuh-indexer: No such file or directory

I also tried from inside the main directory to see if it was path related.

bash-5.2$ cd /usr/share/wazuh-indexer/
bash-5.2$ ./bin/opensearch-plugin install --batch repository-s3
./bin/opensearch-env: line 104: /etc/sysconfig/wazuh-indexer: No such file or directory

The workaround I found is running the entrypoint.sh script and passing in something other than opensearchwrapper

https://github.com/wazuh/wazuh-docker/blob/v4.9.0/build-docker-images/wazuh-indexer/config/entrypoint.sh#L30-L42

bash-5.2$ /entrypoint.sh /usr/share/wazuh-indexer/bin/opensearch-plugin install --batch repository-s3
-> Installing repository-s3
-> Downloading repository-s3 from opensearch

That seems to work as the needed env variables are set at the beginning of the script:

https://github.com/wazuh/wazuh-docker/blob/v4.9.0/build-docker-images/wazuh-indexer/config/entrypoint.sh#L7-L14

[t0x01]

Hey, @ejedev

You can build your own wazuh-indexer image with the repository-s3 plugin already installed. This way you wouldn't need to install it every time you start a new container.

I've created a PR a while ago for version 4.7, pretty sure you can do the same for a new version.

P.S. I'm not a part of the wazuh team, and the PR mentioned wasn't accepted yet, bear that in mind, if you'll choose to use it. I can only say that in my case it seems to be working well without any problems.