Skip to content

Commit a45edb7

Browse files
siegfriedwebersiegfriedweber
committed
doc: Document the security plugin configuration
1 parent 7f21cef commit a45edb7

12 files changed

Lines changed: 457 additions & 172 deletions

‎docs/modules/opensearch/examples/getting_started/getting_started.sh‎

Lines changed: 28 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ esac
4747

4848
echo "Creating OpenSearch security plugin configuration"
4949
# tag::apply-security-config[]
50-
kubectl apply -f opensearch-security-config.yaml
50+
kubectl apply -f initial-opensearch-security-config.yaml
5151
# end::apply-security-config[]
5252

5353
echo "Creating OpenSearch cluster"
@@ -91,17 +91,40 @@ curl \
9191
--json '{"name": "Stackable"}' \
9292
"$OPENSEARCH_HOST/sample_index/_doc/1"
9393

94-
# Output:
95-
# {"_index":"sample_index","_id":"1","_version":1,"result":"created","_shards":{"total":2,"successful":1,"failed":0},"_seq_no":0,"_primary_term":1}
94+
# Formatted output:
95+
# {
96+
# "_index": "sample_index",
97+
# "_id": "1",
98+
# "_version": 1,
99+
# "result": "created",
100+
# "_shards": {
101+
# "total": 2,
102+
# "successful": 1,
103+
# "failed": 0
104+
# },
105+
# "_seq_no": 0,
106+
# "_primary_term": 1
107+
# }
108+
96109

97110
curl \
98111
--insecure \
99112
--user $CREDENTIALS \
100113
--request GET \
101114
"$OPENSEARCH_HOST/sample_index/_doc/1"
102115

103-
# Output:
104-
# {"_index":"sample_index","_id":"1","_version":1,"_seq_no":0,"_primary_term":1,"found":true,"_source":{"name": "Stackable"}}
116+
# Formatted output:
117+
# {
118+
# "_index": "sample_index",
119+
# "_id": "1",
120+
# "_version": 1,
121+
# "_seq_no": 0,
122+
# "_primary_term": 1,
123+
# "found": true,
124+
# "_source": {
125+
# "name": "Stackable"
126+
# }
127+
# }
105128
# end::rest-api[]
106129

107130
echo

‎docs/modules/opensearch/examples/getting_started/getting_started.sh.j2‎

Lines changed: 28 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ esac
4747

4848
echo "Creating OpenSearch security plugin configuration"
4949
# tag::apply-security-config[]
50-
kubectl apply -f opensearch-security-config.yaml
50+
kubectl apply -f initial-opensearch-security-config.yaml
5151
# end::apply-security-config[]
5252

5353
echo "Creating OpenSearch cluster"
@@ -91,17 +91,40 @@ curl \
9191
--json '{"name": "Stackable"}' \
9292
"$OPENSEARCH_HOST/sample_index/_doc/1"
9393

94-
# Output:
95-
# {"_index":"sample_index","_id":"1","_version":1,"result":"created","_shards":{"total":2,"successful":1,"failed":0},"_seq_no":0,"_primary_term":1}
94+
# Formatted output:
95+
# {
96+
# "_index": "sample_index",
97+
# "_id": "1",
98+
# "_version": 1,
99+
# "result": "created",
100+
# "_shards": {
101+
# "total": 2,
102+
# "successful": 1,
103+
# "failed": 0
104+
# },
105+
# "_seq_no": 0,
106+
# "_primary_term": 1
107+
# }
108+
96109

97110
curl \
98111
--insecure \
99112
--user $CREDENTIALS \
100113
--request GET \
101114
"$OPENSEARCH_HOST/sample_index/_doc/1"
102115

103-
# Output:
104-
# {"_index":"sample_index","_id":"1","_version":1,"_seq_no":0,"_primary_term":1,"found":true,"_source":{"name": "Stackable"}}
116+
# Formatted output:
117+
# {
118+
# "_index": "sample_index",
119+
# "_id": "1",
120+
# "_version": 1,
121+
# "_seq_no": 0,
122+
# "_primary_term": 1,
123+
# "found": true,
124+
# "_source": {
125+
# "name": "Stackable"
126+
# }
127+
# }
105128
# end::rest-api[]
106129

107130
echo

‎docs/modules/opensearch/examples/getting_started/initial-opensearch-security-config.yaml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
---
2+
apiVersion: v1
3+
kind: Secret
4+
metadata:
5+
name: initial-opensearch-security-config
6+
stringData:
7+
internal_users.yml: |
8+
---
9+
_meta:
10+
type: internalusers
11+
config_version: 2
12+
admin:
13+
hash: $2y$10$xRtHZFJ9QhG9GcYhRpAGpufCZYsk//nxsuel5URh0GWEBgmiI4Q/e
14+
reserved: true
15+
backend_roles:
16+
- admin
17+
description: OpenSearch admin user
18+
kibanaserver:
19+
hash: $2y$10$vPgQ/6ilKDM5utawBqxoR.7euhVQ0qeGl8mPTeKhmFT475WUDrfQS
20+
reserved: true
21+
description: OpenSearch Dashboards user
22+
roles_mapping.yml: |
23+
---
24+
_meta:
25+
type: rolesmapping
26+
config_version: 2
27+
all_access:
28+
reserved: false
29+
backend_roles:
30+
- admin
31+
kibana_server:
32+
reserved: true
33+
users:
34+
- kibanaserver

‎docs/modules/opensearch/examples/getting_started/opensearch-dashboards-values.yaml‎

Lines changed: 30 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -17,41 +17,41 @@ config:
1717
ssl:
1818
verificationMode: full
1919
certificateAuthorities:
20-
- /stackable/opensearch-dashboards/config/tls/ca.crt
20+
- /stackable/opensearch-dashboards/config/tls/ca.crt
2121
opensearch_security:
2222
cookie:
2323
secure: true
2424
extraEnvs:
25-
- name: OPENSEARCH_HOSTS
26-
valueFrom:
27-
configMapKeyRef:
28-
name: simple-opensearch
29-
key: OPENSEARCH_HOSTS
30-
- name: OPENSEARCH_PASSWORD
31-
valueFrom:
32-
secretKeyRef:
33-
name: opensearch-credentials
34-
key: kibanaserver
25+
- name: OPENSEARCH_HOSTS
26+
valueFrom:
27+
configMapKeyRef:
28+
name: simple-opensearch
29+
key: OPENSEARCH_HOSTS
30+
- name: OPENSEARCH_PASSWORD
31+
valueFrom:
32+
secretKeyRef:
33+
name: opensearch-credentials
34+
key: kibanaserver
3535
extraVolumes:
36-
- name: tls
37-
ephemeral:
38-
volumeClaimTemplate:
39-
metadata:
40-
annotations:
41-
secrets.stackable.tech/class: tls
42-
secrets.stackable.tech/scope: service=opensearch-dashboards
43-
spec:
44-
storageClassName: secrets.stackable.tech
45-
accessModes:
46-
- ReadWriteOnce
47-
resources:
48-
requests:
49-
storage: "1"
36+
- name: tls
37+
ephemeral:
38+
volumeClaimTemplate:
39+
metadata:
40+
annotations:
41+
secrets.stackable.tech/class: tls
42+
secrets.stackable.tech/scope: service=opensearch-dashboards
43+
spec:
44+
storageClassName: secrets.stackable.tech
45+
accessModes:
46+
- ReadWriteOnce
47+
resources:
48+
requests:
49+
storage: "1"
5050
extraVolumeMounts:
51-
- mountPath: /stackable/opensearch-dashboards/config/tls
52-
name: tls
53-
- mountPath: /stackable/opensearch-dashboards/config/opensearch_dashboards.yml
54-
name: config
55-
subPath: opensearch_dashboards.yml
51+
- mountPath: /stackable/opensearch-dashboards/config/tls
52+
name: tls
53+
- mountPath: /stackable/opensearch-dashboards/config/opensearch_dashboards.yml
54+
name: config
55+
subPath: opensearch_dashboards.yml
5656
podSecurityContext:
5757
fsGroup: 1000

‎docs/modules/opensearch/examples/getting_started/opensearch-dashboards-values.yaml.j2‎

Lines changed: 30 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -17,41 +17,41 @@ config:
1717
ssl:
1818
verificationMode: full
1919
certificateAuthorities:
20-
- /stackable/opensearch-dashboards/config/tls/ca.crt
20+
- /stackable/opensearch-dashboards/config/tls/ca.crt
2121
opensearch_security:
2222
cookie:
2323
secure: true
2424
extraEnvs:
25-
- name: OPENSEARCH_HOSTS
26-
valueFrom:
27-
configMapKeyRef:
28-
name: simple-opensearch
29-
key: OPENSEARCH_HOSTS
30-
- name: OPENSEARCH_PASSWORD
31-
valueFrom:
32-
secretKeyRef:
33-
name: opensearch-credentials
34-
key: kibanaserver
25+
- name: OPENSEARCH_HOSTS
26+
valueFrom:
27+
configMapKeyRef:
28+
name: simple-opensearch
29+
key: OPENSEARCH_HOSTS
30+
- name: OPENSEARCH_PASSWORD
31+
valueFrom:
32+
secretKeyRef:
33+
name: opensearch-credentials
34+
key: kibanaserver
3535
extraVolumes:
36-
- name: tls
37-
ephemeral:
38-
volumeClaimTemplate:
39-
metadata:
40-
annotations:
41-
secrets.stackable.tech/class: tls
42-
secrets.stackable.tech/scope: service=opensearch-dashboards
43-
spec:
44-
storageClassName: secrets.stackable.tech
45-
accessModes:
46-
- ReadWriteOnce
47-
resources:
48-
requests:
49-
storage: "1"
36+
- name: tls
37+
ephemeral:
38+
volumeClaimTemplate:
39+
metadata:
40+
annotations:
41+
secrets.stackable.tech/class: tls
42+
secrets.stackable.tech/scope: service=opensearch-dashboards
43+
spec:
44+
storageClassName: secrets.stackable.tech
45+
accessModes:
46+
- ReadWriteOnce
47+
resources:
48+
requests:
49+
storage: "1"
5050
extraVolumeMounts:
51-
- mountPath: /stackable/opensearch-dashboards/config/tls
52-
name: tls
53-
- mountPath: /stackable/opensearch-dashboards/config/opensearch_dashboards.yml
54-
name: config
55-
subPath: opensearch_dashboards.yml
51+
- mountPath: /stackable/opensearch-dashboards/config/tls
52+
name: tls
53+
- mountPath: /stackable/opensearch-dashboards/config/opensearch_dashboards.yml
54+
name: config
55+
subPath: opensearch_dashboards.yml
5656
podSecurityContext:
5757
fsGroup: 1000

‎docs/modules/opensearch/examples/getting_started/opensearch.yaml‎

Lines changed: 38 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,44 @@ metadata:
66
spec:
77
image:
88
productVersion: 3.4.0
9+
clusterConfig:
10+
security:
11+
settings:
12+
config:
13+
managedBy: operator
14+
content:
15+
value:
16+
_meta:
17+
type: config
18+
config_version: 2
19+
config:
20+
dynamic:
21+
authc:
22+
basic_internal_auth_domain:
23+
description: Authenticate via HTTP Basic against internal users database
24+
http_enabled: true
25+
transport_enabled: true
26+
order: 1
27+
http_authenticator:
28+
type: basic
29+
challenge: true
30+
authentication_backend:
31+
type: intern
32+
authz: {}
33+
internalUsers:
34+
managedBy: API
35+
content:
36+
valueFrom:
37+
secretKeyRef:
38+
name: initial-opensearch-security-config
39+
key: internal_users.yml
40+
rolesMapping:
41+
managedBy: API
42+
content:
43+
valueFrom:
44+
secretKeyRef:
45+
name: initial-opensearch-security-config
46+
key: roles_mapping.yml
947
nodes:
1048
roleConfig:
1149
discoveryServiceListenerClass: external-stable
@@ -14,18 +52,4 @@ spec:
1452
replicas: 3
1553
configOverrides:
1654
opensearch.yml:
17-
plugins.security.allow_default_init_securityindex: "true"
1855
plugins.security.restapi.roles_enabled: all_access
19-
podOverrides:
20-
spec:
21-
containers:
22-
- name: opensearch
23-
volumeMounts:
24-
- name: security-config
25-
mountPath: /stackable/opensearch/config/opensearch-security
26-
readOnly: true
27-
volumes:
28-
- name: security-config
29-
secret:
30-
secretName: opensearch-security-config
31-
defaultMode: 0o660

0 commit comments

Comments
 (0)