Skip to content

Conversation

@cwperks
Copy link
Owner

@cwperks cwperks commented Jul 26, 2025

Description

This PR updates the demo installer to always install the demo certs into the config/ folder even if the following settings are already present in opensearch.yml

/**
  * plugins.security.ssl.transport.pemcert_filepath: esnode.pem
  * plugins.security.ssl.transport.pemkey_filepath: esnode-key.pem
  * plugins.security.ssl.transport.pemtrustedcas_filepath: root-ca.pem
  * plugins.security.ssl.http.pemcert_filepath: esnode.pem
  * plugins.security.ssl.http.pemkey_filepath: esnode-key.pem
  * plugins.security.ssl.http.pemtrustedcas_filepath: root-ca.pem
  */

By ensuring that the files are always copied, it resolves an issue seen in the helm-charts repo where the values are already present in opensearch.yml but the certs are not written to the config/ folder in the event that the opensearch process dies on one of the pods and is replaced. The reason for that is that it goes through the installation script and aborts saying that security is already configured.

Issues Resolved

Resolves: opensearch-project#5044

Helm Charts: opensearch-project/helm-charts#680

Check List

  • New functionality includes testing
  • New functionality has been documented
  • New Roles/Permissions have a corresponding security dashboards plugin PR
  • API changes companion pull request created
  • Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Craig Perkins <cwperx@amazon.com>
cwperks added 2 commits July 28, 2025 16:06
Signed-off-by: Craig Perkins <cwperx@amazon.com>
Signed-off-by: Craig Perkins <cwperx@amazon.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] OpenSearch security plugin unable to load after a pod is killed due to opensearch.yaml configuration.

1 participant