How to migrate .opendistro_security from OpenSearch 1.x to 2.x with HTTP TLS disabled?

Security
1

Hi,

We are facing an issue while upgrading OpenSearch from 1.x to 2.x.

Our cluster was originally created on OpenSearch 1.x and later upgraded to 2.x without problems. However, when preparing for further upgrades, we found that the .opendistro_security index is still created with a 1.x version.

We understand that this index should ideally be recreated to be compatible with newer versions.

The recommended approach is to use securityadmin.sh, but it requires HTTPS/TLS on the REST layer.

Problem:
Our cluster runs with:

  • http.tls disabled (HTTP only on port 9200)

  • TLS is enabled only on the transport layer (port 9300)

We cannot enable TLS on HTTP because existing clients are not prepared for it.

When running securityadmin.sh, we get:

Unrecognized SSL message, plaintext connection?

We also tried to reinitialize or delete .opendistro_security via REST API, but:

  • the REST management API is restricted

  • permissions are insufficient to manage the security index

Questions:

  1. Is there a supported way to migrate or recreate .opendistro_security from 1.x to 2.x without enabling HTTP TLS?

  2. Can securityadmin.sh be safely used over plain HTTP in this scenario?

  3. Is there any recommended workaround for clusters that cannot enable TLS on the REST layer?

Any guidance or best practices would be greatly appreciated.

Thanks!

1 Like
2

@mrMigles As .opendistro_security is a protected index, admin user (although with full access) doesn’t have permission to modify it. You would need to enable TLS on http temporarily, while you recreate the security index (either using curl with admin certificates and key or using securityadmin.sh command with -dci parameter).

Once the index is recreated you can then remove the TLS on http later.

3

@mrMigles also note, that you only need to enable the TLS on http layer on one of the nodes, so that you can run the securityadmin.sh script against that node

4

@Anthony, thanks for answer.
Initiating TLS on HTTP requires generating certificates which must be signed the same CA as admin’s certificate for transport I suppose, what imposes some complications during usual Maintenance operation, but we will think about that.

Now we have think about more crazy option with fully security reinitialization via disabling security, removing index, enabling security. Fortunately, we have our own declarative approach that allows us to restore security configurations.