feat(opensearch): flip the credential plan to oidc-jwt (Phase-D cutover LIVE)

The cluster side is done on the fleet: the OpenSearch security plugin is ENABLED
and now returns 401 to unauthenticated callers, validating Keycloak JWTs natively
(jwt auth domain, required_audience offgrid-opensearch, the service account mapped
to all_access). Demo-box choice: the REST layer stays PLAIN HTTP
(plugins.security.ssl.http.enabled=false) so the console keeps
http://127.0.0.1:9200 over loopback and only adds a Bearer — no demo-cert trust
problem, which was the blocker that had this parked.

Flipping this one line makes every OpenSearch call authenticate, because they all
route through lib/opensearch-http.ts now (previous commit). Tests updated: the
opensearch plan is asserted as oidc-jwt with baoPath opensearch/client-secret;
marquez/opa/presidio still assert none (they cannot verify a KC JWT).

Author: alichherawalla

src/lib/service-credentials-lib.ts

@@ -86,11 +86,14 @@ const PLAN_MODES: Record<string, CredentialMode> = {
   // SeaweedFS S3 IAM is access/secret keys (SigV4) — no OIDC.
   seaweedfs: 's3',
   s3: 's3',
-  // No-auth images on the trusted LAN today. TODO(Phase-D): OpenSearch can enable its security plugin
-  // with native OIDC/JWT → flip to 'oidc-jwt' + a KC client; Marquez/OPA/Presidio stay edge-gated
-  // (Caddy forward_auth) or move behind a console proxy — none of them validate a KC JWT today, so
-  // they MUST remain 'none' until that lands or we'd send a credential they can't verify.
-  opensearch: 'none',
+  // Phase-D DONE for OpenSearch (2026-07-25): its security plugin is ENABLED on the fleet and it
+  // validates Keycloak JWTs natively (jwt auth domain, required_audience offgrid-opensearch, the
+  // service account mapped to all_access). The REST layer deliberately stays plain HTTP on this
+  // deployment, so the console sends a Bearer over loopback — no demo-cert trust problem. Every
+  // OpenSearch call routes through lib/opensearch-http.ts, which reads this plan.
+  opensearch: 'oidc-jwt',
+  // Marquez/OPA/Presidio stay edge-gated (Caddy forward_auth) or behind a console proxy — none of them
+  // validate a KC JWT today, so they MUST remain 'none' or we'd send a credential they can't verify.
   marquez: 'none',
   opa: 'none',
   presidio: 'none',

test/service-credentials-lib.test.ts

@@ -64,8 +64,17 @@ test('credentialPlan: seaweedfs/s3 are s3 (SigV4 access/secret keys)', () => {
   assert.deepEqual(credentialPlan('s3'), { mode: 's3', baoPath: 's3/s3-access-key' });
 });
 
-test('credentialPlan: no-auth images (opensearch/marquez/opa/presidio) are none', () => {
-  for (const svc of ['opensearch', 'marquez', 'opa', 'presidio']) {
+test('credentialPlan: opensearch is oidc-jwt (Phase-D cutover — its security plugin validates KC JWTs)', () => {
+  assert.deepEqual(credentialPlan('opensearch'), {
+    mode: 'oidc-jwt',
+    baoPath: 'opensearch/client-secret',
+  });
+});
+
+test('credentialPlan: the remaining no-auth images (marquez/opa/presidio) stay none', () => {
+  // These are edge-gated (Caddy forward_auth) / proxied — none validate a KC JWT, so sending one
+  // would be a credential they cannot verify.
+  for (const svc of ['marquez', 'opa', 'presidio']) {
     assert.deepEqual(credentialPlan(svc), { mode: 'none' }, svc);
   }
 });