Unable to upgrade os from 1.x to 3.x

Security
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):

Describe the issue: Unable to upgrade os from 1.x to 3.x, because it says .opendistro_security format is not supported in os3.x. Since its created with Lucene8.x format which is not compatible with Os3.x, if I remove the .opendistro_security in 1.x , I’m getting “OpenSearch Security not initialized.”

Configuration:

Relevant Logs or Screenshots:

2

Hey @ved144kumar ,

What version in 1.x are you using and what 3.x are you planning to upgrade to?

Leeroy.

3

Hi @Leeroy ,
Thanks for the response.
I’m currently using 1.3.20, and intend to upgrade it to OS 3.2.0

4

Hi @ved144kumar ,

In order to go from 1.x to 3.x you will first need to go to 2.x.

I tested this and got it working, I first setup 1.3.20, then upgraded to 2.19.2.

Then I backed up the security indices, deleted them and restored them. This will recreate the versions on 2.19.2. Which afterwards the upgrade will run successfully giving the version is no longer restricting.

You can backup and restore using the following with security admin -

Backup

"/usr/share/opensearch/plugins/opensearch-security/tools/securityadmin.sh" -backup "/usr/share/opensearch/config/opensearch-security" -icl -key "/usr/share/opensearch/config/kirk-key.pem" -cert "/usr/share/opensearch/config/kirk.pem" -cacert "/usr/share/opensearch/config/root-ca.pem" -nhnv

Restore

"/usr/share/opensearch/plugins/opensearch-security/tools/securityadmin.sh" -cd "/usr/share/opensearch/config/opensearch-security" -icl -key "/usr/share/opensearch/config/kirk-key.pem" -cert "/usr/share/opensearch/config/kirk.pem" -cacert "/usr/share/opensearch/config/root-ca.pem" -nhnv

Then after upgrading you can run the following to confirm versions of the new indices -

curl -XGET --cert ./kirk.pem --key ./kirk-key.pem --cacert ./root-ca.pem "https://localhost:9200/.opendistro_security/_settings?human"
{".opendistro_security":{"settings":{"index":{"replication":{"type":"DOCUMENT"},"creation_date_string":"2025-10-06T11:14:00.019Z","number_of_shards":"1","auto_expand_replicas":"0-all","provided_name":".opendistro_security","creation_date":"1759749240019","number_of_replicas":"1","uuid":"ZDKyfhKCTfaKuqIdhxfOtA","version":{"upgraded":"137237827","created_string":"2.19.2","upgraded_string":"3.2.0","created":"136408027"}}}}}

You can see the created_string is updated from backup, delete, and restore in 2.19.2, which was 1.3.20. Which enabled the upgrade to 3.2.0.

Leeroy.

5

Thanks @Leeroy , I tried the same and it worked.
Thanks for the assitance

6

Hi @Leeroy ,
Is there a documentation regarding this, since this seems like an auto migration step which can happen from 1 to 2, and 2 to 3.
Do we really require to reindex the security settings.
If it is , can you share documentation where this is mentioned.

Thanks