Is it possible to make OpenSearch Cluster to be exposed externally via 80 port?

OpenSearch
, ,
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):

  • kubernetes: v1.25.6
  • opensearch-operator: v2.5.1
  • opensearch & opensearch-dashboards: v2.7.0
    (from On-premise Harbor Repository)

Describe the issue:

image
image1107Ă—603 69.3 KB

With opensearch.ssl.verificationMode: none option in opensearchCluster.general.dashboards.additionalConfig , Service for test-opensearch-cluster-dashboards is successfully exposed externally via 80 port.

But I want also make opensearch-cluster to be exposed via 80 port for connecting with Filebeat, KafkaConnector, etc.

Is there any option for not allowing ssl.verification when it comes to the cluster of OpenSearch, instead of dashboard?

Configuration:

opensearchCluster:
  enabled: true
  general:
    httpPort: "9200"
    image: harbor-srep01.xxx.com/library/opensearchproject/opensearch:v2.7.0
    serviceName: "test-opensearch-cluster"
    drainDataNodes: true
    # https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md#security-context-for-pods-and-containers
    setVMMaxMapCount: true # In some cases, set general.setVMMaxMapCount to false as this feature also launches an init container with root
    podSecurityContext:
      runAsUser: 1000
      runAsGroup: 1000
    securityContext:
      allowPrivilegeEscalation: true
      privileged: true
  # https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md#deal-with-max-virtual-memory-areas-vmmax_map_count-errors
  # https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md#custom-init-helper
  initHelper:
    image: "harbor-srep01.xxx.com/nexus/docker-mig/library/busybox:1.31.1"
    imagePullPolicy: IfNotPresent
  dashboards:
    enable: true
    replicas: 1
    image: harbor-srep01.xxx.com/library/opensearchproject/opensearch-dashboards:v2.7.0
    resources:
      requests:
        memory: "1Gi"
        cpu: "500m"
      limits:
        memory: "1Gi"
        cpu: "500m"
    tls:
      enable: false
    opensearchCredentialsSecret:
      name: admin-credentials-secret
    additionalConfig:
      # https://opensearch.org/docs/latest/install-and-configure/install-dashboards/tls/
      opensearch.ssl.verificationMode: none
  nodePools:
    - component: master
      replicas: 3
      pdb:
        enable: false
        # enable: true
        # minAvailable: 1
      diskSize: "10Gi"
      persistence:
        pvc:
          storageClass: "sc-nfs-app-retain"
          accessModes:
           - ReadWriteOnce
      roles:
        - "cluster_manager"
        - "master"
      # https://github.com/opensearch-project/opensearch-k8s-operator/issues/669#issuecomment-1829833573
      # Suggestion: 1000m CPU & 2048Mi memory
      resources:
        requests:
          memory: "4Gi"
          cpu: "1"
        limits:
          memory: "4Gi"
          cpu: "2"
      env:
        - name: OPENSEARCH_INITIAL_ADMIN_PASSWORD
          value: "hcpOss12~!"
    - component: data
      replicas: 2
      diskSize: "100Gi"
      persistence:
        pvc:
          storageClass: "sc-nfs-app-retain"
          accessModes:
           - ReadWriteOnce
      roles:
        - "data"
        - "ingest"
        - "ml"
      resources:
        requests:
          memory: "8Gi"
          cpu: "2"
        limits:
          memory: "8Gi"
          cpu: "4"
      env:
        - name: OPENSEARCH_INITIAL_ADMIN_PASSWORD
          value: "hcpOss12~!"
  security:
    tls:
      transport:
        generate: true
        perNode: true
      # https://opensearch-project.github.io/opensearch-k8s-operator/docs/userguide/main.html#node-httprest-api
      http:
        generate: true
    config:
      adminCredentialsSecret: # these are the admin credentials for the Operator to use
         name: admin-credentials-secret
      securityConfigSecret:  # this is the whole security configuration for OpenSearch
         name: securityconfig-secret

Relevant Logs or Screenshots:

2

The above option is used to verify the certificate of the OpenSearch node by the OpenSearch Dashboards service.

The above option controls OpenSearch Dashboards’ frontend access through HTTP (port 80) or HTTPS (443)

Why do you want to connect through port 80 to the OpenSearch cluster?
I think the best way would be to set up an ingress.

3

@pablo Thanks for answering me.

The reason why I want connecting to the OpenSearch Cluster through port 80 is for indexing data using KafkaConnect or other client such as python codes.

I don’t want to care about security(ex. tis) but do ingest data from outside without any restriction just like OpenSearch Dashboard (verificationMode: none) service can command to the Cluster through port 80.

4

@yeonghyeonKo As per OpenSearch Operator documentation the HTTP endpoint is always secured in OpenSearch Operator

This is controlled by plugins.security.ssl.http.enabled: true in opensearch.yml and I couldn’t change it with an additional configuration option.

OpenSearch operates on port 9200 by default, but you can change that in general settings.

1 Like
5

As you commented, I use OpenSearch Operator for hosting the cluster and dashboard. According to the document, it recommends to generate a set of key+certificate outside and inject through a Secret (k8s api resource).

Anyway I will use an Ingress to port forward from 9200 to 80 (with a Secret including certificates). Thank you!