opensearch.yaml.j2

---
apiVersion: opensearch.stackable.tech/v1alpha1
kind: OpenSearchCluster
metadata:
  name: opensearch
spec:
  image:
{% if test_scenario['values']['opensearch'].find(",") > 0 %}
    custom: "{{ test_scenario['values']['opensearch'].split(',')[1] }}"
    productVersion: "{{ test_scenario['values']['opensearch'].split(',')[0] }}"
{% else %}
    productVersion: "{{ test_scenario['values']['opensearch'] }}"
{% endif %}
    pullPolicy: IfNotPresent
  nodes:
    roleGroups:
      cluster-manager:
        config:
          nodeRoles:
            - cluster_manager
          listenerClass: test-external-stable-$NAMESPACE
        replicas: 1
        podOverrides:
          spec:
            volumes:
              - name: tls
                ephemeral:
                  volumeClaimTemplate:
                    metadata:
                      annotations:
                        secrets.stackable.tech/scope: node,pod,service=opensearch,service=opensearch-nodes-cluster-manager-headless
      data1:
        config:
          nodeRoles:
            - data
          listenerClass: test-external-unstable-$NAMESPACE
        replicas: 1
        podOverrides:
          spec:
            volumes:
              - name: tls
                ephemeral:
                  volumeClaimTemplate:
                    metadata:
                      annotations:
                        secrets.stackable.tech/scope: node,pod,service=opensearch-nodes-data1-headless
      data2:
        config:
          nodeRoles:
            - data
          listenerClass: test-cluster-internal-$NAMESPACE
        replicas: 1
        podOverrides:
          spec:
            volumes:
              - name: tls
                ephemeral:
                  volumeClaimTemplate:
                    metadata:
                      annotations:
                        secrets.stackable.tech/scope: node,pod,service=opensearch-nodes-data2-headless
    envOverrides:
      # Only required for the official image
      # The official image (built with https://github.com/opensearch-project/opensearch-build)
      # installs a demo configuration if not disabled explicitly.
      DISABLE_INSTALL_DEMO_CONFIG: "true"
      OPENSEARCH_HOME: {{ test_scenario['values']['opensearch_home'] }}
    configOverrides:
      opensearch.yml:
        # Disable memory mapping in this test; If memory mapping were activated, the kernel setting
        # vm.max_map_count would have to be increased to 262144 on the node.
        node.store.allow_mmap: "false"
        # Disable the disk allocation decider in this test; Otherwise the test depends on the disk
        # usage of the node and if the relative watermark set in
        # `cluster.routing.allocation.disk.watermark.high` is reached then the security index could
        # not be created even if enough disk space would be available.
        cluster.routing.allocation.disk.threshold_enabled: "false"
        plugins.security.allow_default_init_securityindex: "true"
        plugins.security.ssl.transport.enabled: "true"
        plugins.security.ssl.transport.pemcert_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/tls.crt
        plugins.security.ssl.transport.pemkey_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/tls.key
        plugins.security.ssl.transport.pemtrustedcas_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/ca.crt
        plugins.security.ssl.http.enabled: "true"
        plugins.security.ssl.http.pemcert_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/tls.crt
        plugins.security.ssl.http.pemkey_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/tls.key
        plugins.security.ssl.http.pemtrustedcas_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/ca.crt
    podOverrides:
      spec:
        containers:
          - name: opensearch
            volumeMounts:
              - name: security-config
                mountPath: {{ test_scenario['values']['opensearch_home'] }}/config/opensearch-security
                readOnly: true
              - name: tls
                mountPath: {{ test_scenario['values']['opensearch_home'] }}/config/tls
                readOnly: true
        volumes:
          - name: security-config
            secret:
              secretName: opensearch-security-config
          - name: tls
            ephemeral:
              volumeClaimTemplate:
                metadata:
                  annotations:
                    secrets.stackable.tech/class: tls
                spec:
                  storageClassName: secrets.stackable.tech
                  accessModes:
                    - ReadWriteOnce
                  resources:
                    requests:
                      storage: "1"
---
apiVersion: v1
kind: Secret
metadata:
  name: opensearch-security-config
stringData:
  action_groups.yml: |
    ---
    _meta:
      type: actiongroups
      config_version: 2
  allowlist.yml: |
    ---
    _meta:
      type: allowlist
      config_version: 2

    config:
      enabled: false
  audit.yml: |
    ---
    _meta:
      type: audit
      config_version: 2

    config:
      enabled: false
  config.yml: |
    ---
    _meta:
      type: config
      config_version: 2

    config:
      dynamic:
        authc:
          basic_internal_auth_domain:
            description: Authenticate via HTTP Basic against internal users database
            http_enabled: true
            transport_enabled: true
            order: 1
            http_authenticator:
              type: basic
              challenge: true
            authentication_backend:
              type: intern
        authz: {}
  internal_users.yml: |
    ---
    # The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh

    _meta:
      type: internalusers
      config_version: 2

    admin:
      hash: $2y$10$xRtHZFJ9QhG9GcYhRpAGpufCZYsk//nxsuel5URh0GWEBgmiI4Q/e
      reserved: true
      backend_roles:
        - admin
      description: OpenSearch admin user

    kibanaserver:
      hash: $2y$10$vPgQ/6ilKDM5utawBqxoR.7euhVQ0qeGl8mPTeKhmFT475WUDrfQS
      reserved: true
      description: OpenSearch Dashboards user
  nodes_dn.yml: |
    ---
    _meta:
      type: nodesdn
      config_version: 2
  roles.yml: |
    ---
    _meta:
      type: roles
      config_version: 2
  roles_mapping.yml: |
    ---
    _meta:
      type: rolesmapping
      config_version: 2

    all_access:
      reserved: false
      backend_roles:
        - admin

    kibana_server:
      reserved: true
      users:
        - kibanaserver
  tenants.yml: |
    ---
    _meta:
      type: tenants
      config_version: 2