As it stands today, the OpenSearch operator and the human admin user share the same username. This is not ideal from a security or auditing standpoint, so let's:
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T362105 EPIC: OpenSearch on K8s (formerly Mutualized opensearch cluster) - FY25/26 WE4.2.6 | |||
| In Progress | bking | T408586 ☂️ OpenSearch on K8s: Ensure platform is ready for production ☂️ | |||
| Stalled | None | T357753 Build next iteration of IPoid using OpenSearch/ElasticSearch as backend | |||
| Resolved | kostajh | T408238 Create Airflow job that loads Spur data | |||
| Open | bking | T408012 Roll out OpenSearch cluster in `opensearch-ipoid-test` and `opensearch-ipoid` namespaces in dse-k8s-eqiad | |||
| Resolved | bking | T408919 OpenSearch on K8s: Create separate user for the OpenSearch operator |
This Slack thread contains some useful links about how the operator connects to the cluster, where it gets the creds, etc.
At a high level, I think we can achieve our goal by:
I think I'd prefer to have the operator user auth via mTLS since that doesn't require keeping track of secrets in private puppet. I'll study the linked code and discuss this with further with my colleagues.
Change #1201104 had a related patch set uploaded (by Bking; author: Bking):
[operations/deployment-charts@master] WIP: opensearch-cluster: Add operator user
Change #1202769 had a related patch set uploaded (by Bking; author: Bking):
[operations/deployment-charts@master] opensearch-cluster: create separate user for operator and admin
Change #1202769 merged by Bking:
[operations/deployment-charts@master] opensearch-cluster: create separate user for operator and admin
I've redeployed opensearch-test and opensearch-ipoid-test clusters after merging the above changes, and I can confirm that both the`operator` and opensearch user are created correctly. I've also confirmed that I can create indices with the opensearch user:
curl -H "Content-type: Application/json" -u ${OS} -XPUT https://opensearch-test.discovery.wmnet:30443/enwikibooks -d @mapping.json
and retrieve them: curl -XGET -u ${OS} https://opensearch-test.discovery.wmnet:30443/enwikibooks?pretty
As such, I'm closing out this ticket.
Change #1201104 abandoned by Bking:
[operations/deployment-charts@master] WIP: opensearch-cluster: Add operator user
Reason:
superseded by 1202769