commit 0362f9566728831bc26a9f01834dccbd7e58aecf Author: Mosiur Rahman Date: Thu Aug 13 07:30:18 2026 +0000 Initial Working Commit, all opensearch ang grafana is working, grafana plots cpanel and opensearch getting all the log from cpanel, only access_log, syslog and auditd log are parsed diff --git a/blackbox-sync-cronjob.yaml b/blackbox-sync-cronjob.yaml new file mode 100644 index 0000000..ff59011 --- /dev/null +++ b/blackbox-sync-cronjob.yaml @@ -0,0 +1,149 @@ +apiVersion: batch/v1 +kind: CronJob +metadata: + name: blackbox-target-sync + namespace: monitoring + +spec: + schedule: "*/15 * * * *" + concurrencyPolicy: Forbid + successfulJobsHistoryLimit: 3 + failedJobsHistoryLimit: 5 + startingDeadlineSeconds: 300 + + jobTemplate: + spec: + backoffLimit: 2 + activeDeadlineSeconds: 300 + + template: + metadata: + labels: + app.kubernetes.io/name: blackbox-target-sync + + spec: + serviceAccountName: blackbox-sync + restartPolicy: Never + + containers: + - name: sync + image: alpine/k8s:1.36.0 + imagePullPolicy: IfNotPresent + + env: + - name: WHM_TOKEN + valueFrom: + secretKeyRef: + name: whm-api-token + key: token + + - name: WHM_HOST + valueFrom: + secretKeyRef: + name: whm-api-token + key: host + + command: + - /bin/sh + - -ec + + args: + - | + echo "Installing required packages..." + apk add --no-cache curl jq ca-certificates >/dev/null + + API_URL="https://${WHM_HOST}:2087/json-api/listaccts?api.version=1" + + echo "Requesting account list from WHM host: ${WHM_HOST}" + + RESPONSE="$( + curl \ + --silent \ + --show-error \ + --fail-with-body \ + --connect-timeout 10 \ + --max-time 60 \ + --header "Authorization: whm root:${WHM_TOKEN}" \ + "${API_URL}" + )" + + API_RESULT="$( + printf '%s' "${RESPONSE}" | + jq -r '.metadata.result // 0' + )" + + if [ "${API_RESULT}" != "1" ]; then + echo "ERROR: WHM API returned an unsuccessful result." + printf '%s' "${RESPONSE}" | jq . + exit 1 + fi + + printf '%s' "${RESPONSE}" | + jq -r ' + .data.acct[]? + | .domain + | select(type == "string") + | select(length > 0) + ' | + sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | + grep -E '^[A-Za-z0-9.-]+\.[A-Za-z]{2,}$' | + tr '[:upper:]' '[:lower:]' | + sort -u \ + > /tmp/domains.txt + + DOMAIN_COUNT="$( + wc -l < /tmp/domains.txt | + tr -d ' ' + )" + + echo "Found ${DOMAIN_COUNT} unique main domains." + + if [ "${DOMAIN_COUNT}" -eq 0 ]; then + echo "ERROR: WHM returned zero valid domains." + echo "Refusing to overwrite the existing ConfigMap." + exit 1 + fi + + jq -R -s ' + split("\n") + | map(select(length > 0)) + | map("https://" + .) + | [ + { + targets: ., + labels: { + environment: "production", + source: "whm-listaccts" + } + } + ] + ' /tmp/domains.txt > /tmp/targets.json + + echo "Generated target file:" + jq . /tmp/targets.json + + TARGET_COUNT="$( + jq 'map(.targets | length) | add // 0' /tmp/targets.json + )" + + if [ "${TARGET_COUNT}" -eq 0 ]; then + echo "ERROR: Generated target file contains zero targets." + exit 1 + fi + + kubectl create configmap blackbox-targets \ + --namespace monitoring \ + --from-file=targets.json=/tmp/targets.json \ + --dry-run=client \ + --output=yaml | + kubectl apply --filename=- + + echo "Successfully synchronized ${TARGET_COUNT} Blackbox targets." + + resources: + requests: + cpu: 25m + memory: 32Mi + limits: + cpu: 200m + memory: 128Mi diff --git a/blackbox-sync-rbac.yaml b/blackbox-sync-rbac.yaml new file mode 100644 index 0000000..60cadb9 --- /dev/null +++ b/blackbox-sync-rbac.yaml @@ -0,0 +1,38 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: blackbox-sync + namespace: monitoring + +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: blackbox-sync + namespace: monitoring +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - create + - update + - patch + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: blackbox-sync + namespace: monitoring +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: blackbox-sync +subjects: +- kind: ServiceAccount + name: blackbox-sync + namespace: monitoring \ No newline at end of file diff --git a/grafana-ingress.yaml b/grafana-ingress.yaml new file mode 100644 index 0000000..97f8fa5 --- /dev/null +++ b/grafana-ingress.yaml @@ -0,0 +1,17 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: grafana-ingress + namespace: monitoring +spec: + ingressClassName: nginx + rules: + - http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: kps-grafana + port: + number: 80 diff --git a/helm-charts-observability b/helm-charts-observability new file mode 160000 index 0000000..db3e0fb --- /dev/null +++ b/helm-charts-observability @@ -0,0 +1 @@ +Subproject commit db3e0fb4a39aca283d73c0dbefa21b9b57b19243 diff --git a/opensearch-pki/admin-ext.cnf b/opensearch-pki/admin-ext.cnf new file mode 100644 index 0000000..eefc2bb --- /dev/null +++ b/opensearch-pki/admin-ext.cnf @@ -0,0 +1,5 @@ +basicConstraints = critical,CA:FALSE +keyUsage = critical,digitalSignature,keyEncipherment +extendedKeyUsage = clientAuth +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid,issuer diff --git a/opensearch-pki/admin-key.pem b/opensearch-pki/admin-key.pem new file mode 100644 index 0000000..393d34a --- /dev/null +++ b/opensearch-pki/admin-key.pem @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDpuQJM11LzgbEh +nCmvinx2JGiIYRe807tmm7rnRYY5r0ixz9JBV9HNfXyJc9ez2g3zrTASmtEESFDd ++GGoocg6gpOzg4oYHLdICR685r9mDEY1tdZysQmI+/pXp3kd7g4ok4R8JQIcrvx8 +kbFLzR6ugda8R4lSRzTthLlfmFGGqLXunHg6Vrw/nqsUxvFGgESD+YLJ/q4x3Oxo +10BsSaNZiV2lI9QYceCWA4EJ24TGebQH1rClnSVwpCRovufwzu9fUNH7NBBZlHW1 +VsiZzO1OfP3oq5vMwyygOtHANLDpH+Blf6XsPtDaE8MqsK5+jw5zmTV9JtsM983v +ACij6Jz3AgMBAAECggEAIeePuNvnkaF3s5t2xJs/UNgZPedvzRmd7tWaeGAyh32w ++vJd2tLFgZy5iyr92H5CVd4CwkApIAjpijm02QSXCj3U9U6YosTPpaiFB/wlOcWA +DdyR/lNGQdPjzgFiZYAaF7LGnke0Fbsgr2VnJcrcr43wO6HY/tGLkQUW6xIqiXD6 +8u4RCLp48dq8cE89VfsBFyuVJTBigN8WJxE+7XMEsCCID37idFyTgoZhTShasBAF +yZUvlREmk/KgCEK3icyycs6C7CxXE7dq7kbMiYRk38GOkKjfjIsLSPVApfTIiibb +GYmQ+2KLXRZ/9myT9g9tjGLww+wJs49nVXsTFqsduQKBgQD2kz6TLNZ2Vt15oNwM +8AbwZoq4f37U7BO12znR4J0w8PSLhCMHrYmPZM6QRtVgzJgKxXjSSXfQA+oVvrCa +rFixSh5gAIEYGRA2XeY3uKgGIeOqqCGvijfGs2z324b3Y14mr9//H4SI6IvwENjg +CSp4RYnA9r11Ivc8u/iGUB99JQKBgQDyqACJuFezvN8TKHmr1oFS+rR/QAmJlk9y +OG62c0dbdlzArdzMOPTC2b/IkktgGBM2PEgiNeOWEzbXCPtuWPKIhhrx3dpG9avy +tswf4g/BHx+hjTCLeKA+o0AkZWhRsRKOGmwgDkFNa29mZYWPNy4KwRJOLxdOY+Z6 +Le308qcM6wKBgEFi7I4Urs503Ihbat8Xa4+mcZTZYmXOMK/h8aRBPw3yZ7bzlGJ9 +12OqJMjHr9/agVsh4JdLGjWURCf+CFEL8P0anZFxsMoWI2F3ZwxRsGTn6bqgmUY2 +jfHoNLZJhbHmrNnve6Po1LmFiU5g+VH3vEZmklAUXktIuW1mn1Hmv2LtAoGAXZNO +Cc4N/CE0wVWVfh/NZWuK2ZufUfCmGH0MrM1N0kaVxDQH9rVsJgwEuls4OAlwtzSN ++KthZYlpV4l+NHKWrPFSSL1uJHku4v19QDpUKvxOnWUuOEq/OQiJfr+geAhaCHTG +B6KXqjxpDErQM4dq+Pi1j3L3gOJjifBWWGSO6RsCgYEAufMFodKc5PCYKHPTWqBA +9Aq9WqDEGN/ngY3hUZ8Sdi3vQyGvmGWbcg+mmvfyNF/FBbjRXzdI3CuVnu73lM3X +aLon1Qhl9K1XQIkIN4BOMsFOoAC85RGsYkzEUeAprGWuHdEzNcSsuGlVnLyk6apx +79uhr7J+w2Pe4je+mSgwupU= +-----END PRIVATE KEY----- diff --git a/opensearch-pki/admin.csr b/opensearch-pki/admin.csr new file mode 100644 index 0000000..9111e77 --- /dev/null +++ b/opensearch-pki/admin.csr @@ -0,0 +1,17 @@ +-----BEGIN CERTIFICATE REQUEST----- +MIICxjCCAa4CAQAwgYAxCzAJBgNVBAYTAkJEMQ4wDAYDVQQIDAVEaGFrYTEOMAwG +A1UEBwwFRGhha2ExEjAQBgNVBAoMCUJyaWxsaWFudDEiMCAGA1UECwwZT3BlblNl +YXJjaCBBZG1pbmlzdHJhdG9yczEZMBcGA1UEAwwQb3BlbnNlYXJjaC1hZG1pbjCC +ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOm5AkzXUvOBsSGcKa+KfHYk +aIhhF7zTu2abuudFhjmvSLHP0kFX0c19fIlz17PaDfOtMBKa0QRIUN34YaihyDqC +k7ODihgct0gJHrzmv2YMRjW11nKxCYj7+leneR3uDiiThHwlAhyu/HyRsUvNHq6B +1rxHiVJHNO2EuV+YUYaote6ceDpWvD+eqxTG8UaARIP5gsn+rjHc7GjXQGxJo1mJ +XaUj1Bhx4JYDgQnbhMZ5tAfWsKWdJXCkJGi+5/DO719Q0fs0EFmUdbVWyJnM7U58 +/eirm8zDLKA60cA0sOkf4GV/pew+0NoTwyqwrn6PDnOZNX0m2wz3ze8AKKPonPcC +AwEAAaAAMA0GCSqGSIb3DQEBCwUAA4IBAQCTTUuzZYPGSwdY8QHG0uhp3A1tWYJI +Dr91bxL400A555lKfc7Jkr/Dp370DSQvZdsPDYatglT48n78qst14icwc6LOT+GR +l9ytPRL+XmJawzC8eDdSZCtNkiyV1BT39hVWIErpqRGxqwQ54N0lMxgZjQVPPKzQ +JmgpSQUoqBG1gj+ID9A2Uz19Z37ZYr09k3vfvKY+7frBqKFHoL2BINeaS/ZWjWTp +EMayeCtSCaKufebMiOzyw7XJHmcpynukVCrBgElRG/U9Gp9Q/Qm64GEwjC+URn2Q +brYVWeeVhrpGuIc8choJttW14B3lUtzZM4abEU9ib0MDAaPTu6onvfXM +-----END CERTIFICATE REQUEST----- diff --git a/opensearch-pki/admin.pem b/opensearch-pki/admin.pem new file mode 100644 index 0000000..94f761b --- /dev/null +++ b/opensearch-pki/admin.pem @@ -0,0 +1,29 @@ +-----BEGIN CERTIFICATE----- +MIIFCjCCAvKgAwIBAgIUIycsqd4quogxjw1E4Kjx3wBtbWwwDQYJKoZIhvcNAQEL +BQAwgYUxCzAJBgNVBAYTAkJEMQ4wDAYDVQQIDAVEaGFrYTEOMAwGA1UEBwwFRGhh +a2ExEjAQBgNVBAoMCUJyaWxsaWFudDEbMBkGA1UECwwST3BlblNlYXJjaCBSb290 +IENBMSUwIwYDVQQDDBxCcmlsbGlhbnQgT3BlblNlYXJjaCBSb290IENBMB4XDTI2 +MDcyMzE1MDc0M1oXDTI4MTAyNTE1MDc0M1owgYAxCzAJBgNVBAYTAkJEMQ4wDAYD +VQQIDAVEaGFrYTEOMAwGA1UEBwwFRGhha2ExEjAQBgNVBAoMCUJyaWxsaWFudDEi +MCAGA1UECwwZT3BlblNlYXJjaCBBZG1pbmlzdHJhdG9yczEZMBcGA1UEAwwQb3Bl +bnNlYXJjaC1hZG1pbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOm5 +AkzXUvOBsSGcKa+KfHYkaIhhF7zTu2abuudFhjmvSLHP0kFX0c19fIlz17PaDfOt +MBKa0QRIUN34YaihyDqCk7ODihgct0gJHrzmv2YMRjW11nKxCYj7+leneR3uDiiT +hHwlAhyu/HyRsUvNHq6B1rxHiVJHNO2EuV+YUYaote6ceDpWvD+eqxTG8UaARIP5 +gsn+rjHc7GjXQGxJo1mJXaUj1Bhx4JYDgQnbhMZ5tAfWsKWdJXCkJGi+5/DO719Q +0fs0EFmUdbVWyJnM7U58/eirm8zDLKA60cA0sOkf4GV/pew+0NoTwyqwrn6PDnOZ +NX0m2wz3ze8AKKPonPcCAwEAAaN1MHMwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8E +BAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwIwHQYDVR0OBBYEFOGZPf44A2ZKwCAO +OlsIRbruZGBdMB8GA1UdIwQYMBaAFHbanj6FGMUfwlC0K+jcO5M9GwApMA0GCSqG +SIb3DQEBCwUAA4ICAQBYscZvYPyaudP9KyXMsPd+2Ym8gXUdbjhjBnh7pAyM5Nvr +LEAWGuSIQbw9MDEA1InbFoz8cA8AQTEdfymBM0WTnJGjospcQaBV5M7UvabVDxMT +CDny3mOwJ32eJcZFbVjcHQkq0k7DLrtKdMCWxZXGuXzIdvpp2xO5cG6WcyFeQ0VL +RuyyAdFnlMuRcMK2shHzk+yUHaTookLKX+Zf0aePhnuL00c0iihJl9yXoKFsQDzc +tYhW6gAeTUzU+QNQXFSgcNvhJh0NUUPyijs6TYfm/Nv7Kw14HcbWntAU9V61b/76 +WG3HINzq0KtBqwmT8rk5bTrlesegvC1TyJ6n9Le7uN8dccmbHzHOLaMBWqkhxmll +5cYpCfPPdoWnAlkZprkcQvrNgqzLfspspwTZA3nyuyEVnJa77Ff5TvVh0ZWvAh2F +T6+VzMx8CSVyeg1B75T5dSDnZ/6wll32NhfvLj7E8tFFRAXwOhtbpBMKVTzRhanW +vDqekFE+3VgLhy3/nrNFMT+z7QZrAIEyAhWdn9qtmXK2be6smOg12BP2n7vlpHBo +DMHvdi0f6m79VPduC66HS6m08ochfThxH4pCRM4f6vGa5uAls4E+uoyGxrIlf44b +AXlxOtQ2NJznooo6sL4qsWu/UfZAMuYJa7ZV8X3GgZZK9vkrKorEkvUKmvpJoA== +-----END CERTIFICATE----- diff --git a/opensearch-pki/data-prepper-ingress.cnf b/opensearch-pki/data-prepper-ingress.cnf new file mode 100644 index 0000000..a06b11b --- /dev/null +++ b/opensearch-pki/data-prepper-ingress.cnf @@ -0,0 +1,22 @@ +[req] +prompt = no +distinguished_name = subject +req_extensions = server_extensions + +[subject] +C = BD +ST = Dhaka +L = Dhaka +O = Brilliant +OU = Observability +CN = 118.67.213.76 + +[server_extensions] +basicConstraints = critical,CA:FALSE +keyUsage = critical,digitalSignature,keyEncipherment +extendedKeyUsage = serverAuth +subjectAltName = @alternative_names + +[alternative_names] +IP.1 = 118.67.213.76 +IP.2 = 10.40.50.22 diff --git a/opensearch-pki/data-prepper-ingress.crt b/opensearch-pki/data-prepper-ingress.crt new file mode 100644 index 0000000..5d0987d --- /dev/null +++ b/opensearch-pki/data-prepper-ingress.crt @@ -0,0 +1,32 @@ +-----BEGIN CERTIFICATE----- +MIIFkzCCA3ugAwIBAgIUIycsqd4quogxjw1E4Kjx3wBtbXQwDQYJKoZIhvcNAQEL +BQAwgYUxCzAJBgNVBAYTAkJEMQ4wDAYDVQQIDAVEaGFrYTEOMAwGA1UEBwwFRGhh +a2ExEjAQBgNVBAoMCUJyaWxsaWFudDEbMBkGA1UECwwST3BlblNlYXJjaCBSb290 +IENBMSUwIwYDVQQDDBxCcmlsbGlhbnQgT3BlblNlYXJjaCBSb290IENBMB4XDTI2 +MDgwNjA1MzAxMloXDTI3MDgwNjA1MzAxMlowcTELMAkGA1UEBhMCQkQxDjAMBgNV +BAgMBURoYWthMQ4wDAYDVQQHDAVEaGFrYTESMBAGA1UECgwJQnJpbGxpYW50MRYw +FAYDVQQLDA1PYnNlcnZhYmlsaXR5MRYwFAYDVQQDDA0xMTguNjcuMjEzLjc2MIIB +ojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAvpQ1+fi+GWFbDUP/f1k0x4GT +Hgotk06uskS58neorpKY72LcOfyuowHzrERDhwI8j9/CiA4bYtO3YfVi8P7pdJ1L +I4J4hMcUqpOTI5PS1QFZRIq91YChr3pUNDfyplRd+ezaicYDeHI4IaMJHQ+EzWQ6 +Tpj2fa7/Ams8mzvpkJIpTwTh4MywHqzU1r3jrpv5dUAhTmRXbgjZVXoUaLlHg0Rw +5KALnxDEC1sLzOwRKVDZlGg9xVqCdgKvPdf0FJErA8PwdZ1iT6wG7hEIodVHX2tK +UeNyFqIIaC9G5TMy8aRSlSPifW9tcqdntKYYLiccxsFgmKMLO9Vf+Cqljp/80Nl0 +I6jzpWwG7/gVxiGzn0+09SbgTtKV3BxXjkBW7YDsWPLd9bx1M+Up1xEaUfED2NkP +OE6WxKGPwH24gFPG8nUchG0n90zeQ9Kbpw1EG3GGaQAMXG1y1osSllSFoMf2oewR +nsyFl8ihuB4PMUHrfz1na50RHsADZWkcJxg7odJbAgMBAAGjgY0wgYowDAYDVR0T +AQH/BAIwADAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwFQYD +VR0RBA4wDIcEdkPVTIcECigyFjAdBgNVHQ4EFgQU1qhGuAGNRxXyc3SJYsTvIgHa +h5QwHwYDVR0jBBgwFoAUdtqePoUYxR/CULQr6Nw7kz0bACkwDQYJKoZIhvcNAQEL +BQADggIBAHrUPveLumsyfFQLDanvNsH5shWw+kA5J+jlFImIcZdWgwcJrC8FQ13R +MfBj/2zl82ULyOR/IhjK/+a62pVerA28BZFnXUf6VLq1A+zmDTJsYHUnPUl0TA0l +xp8/aWwywJMaMV+6cP27eVhPeRRcG89hx36reGAHxhUPcdCceTF6qmTFK6kBg4KC +EFU+xEACnkOHcqOpPrNPeU87JxZys1HdF23r4ihfkvlT/FhwlXARe2ehdohFu3gX +PDTgFmWg/w5eVZnh0DOPwLm7mXDSOY+e5Q4BSbwZHJq+v0l3D8jbKt9fg+5P5tQG +FgC3ZCMwwxCxJzFMZe+Ubm/MfISf0f5n8A51CBtuDgm/I3XG0PQY9VcTRXJUGuaP +Fx6oqeEv/ZPiSKwZtKLdPe6D5vvJ8VkBcy/Icjxt8MkPuhqOAucD7cwdueL/BaIw +cXb6rpfDRlYoSNRfbkZEvP1EVHxvsrS6xpf/VzCM2Rtz3GPuBnWmChPxOSlBZIot +kNCo3KwYrpXZleAkrE38afEoNBYFbi2dyIz8klujTzryP9EdAOh9Km5H6kb7ml1m +6Likyb7MBpXCjottsgT7bTVVQNuquL2SRwybGIIywpkXKngoHeZaAgCDk52MtqxE +1i7Brrsw2B2jMR6fSyMf4lBLN6Yb8FlCvY5t4m6s4IUhqUyUQhI+ +-----END CERTIFICATE----- diff --git a/opensearch-pki/data-prepper-ingress.csr b/opensearch-pki/data-prepper-ingress.csr new file mode 100644 index 0000000..e106a40 --- /dev/null +++ b/opensearch-pki/data-prepper-ingress.csr @@ -0,0 +1,24 @@ +-----BEGIN CERTIFICATE REQUEST----- +MIIEETCCAnkCAQAwcTELMAkGA1UEBhMCQkQxDjAMBgNVBAgMBURoYWthMQ4wDAYD +VQQHDAVEaGFrYTESMBAGA1UECgwJQnJpbGxpYW50MRYwFAYDVQQLDA1PYnNlcnZh +YmlsaXR5MRYwFAYDVQQDDA0xMTguNjcuMjEzLjc2MIIBojANBgkqhkiG9w0BAQEF +AAOCAY8AMIIBigKCAYEAvpQ1+fi+GWFbDUP/f1k0x4GTHgotk06uskS58neorpKY +72LcOfyuowHzrERDhwI8j9/CiA4bYtO3YfVi8P7pdJ1LI4J4hMcUqpOTI5PS1QFZ +RIq91YChr3pUNDfyplRd+ezaicYDeHI4IaMJHQ+EzWQ6Tpj2fa7/Ams8mzvpkJIp +TwTh4MywHqzU1r3jrpv5dUAhTmRXbgjZVXoUaLlHg0Rw5KALnxDEC1sLzOwRKVDZ +lGg9xVqCdgKvPdf0FJErA8PwdZ1iT6wG7hEIodVHX2tKUeNyFqIIaC9G5TMy8aRS +lSPifW9tcqdntKYYLiccxsFgmKMLO9Vf+Cqljp/80Nl0I6jzpWwG7/gVxiGzn0+0 +9SbgTtKV3BxXjkBW7YDsWPLd9bx1M+Up1xEaUfED2NkPOE6WxKGPwH24gFPG8nUc +hG0n90zeQ9Kbpw1EG3GGaQAMXG1y1osSllSFoMf2oewRnsyFl8ihuB4PMUHrfz1n +a50RHsADZWkcJxg7odJbAgMBAAGgWzBZBgkqhkiG9w0BCQ4xTDBKMAwGA1UdEwEB +/wQCMAAwDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMBUGA1Ud +EQQOMAyHBHZD1UyHBAooMhYwDQYJKoZIhvcNAQELBQADggGBALIadeINuzDeYMGD +NzIWjMZ09SIlFwf69Nlc5XjkhnUiaAZ28iVkMSwJKGeuHakVLKeGseZAIODjq+dM +wk3pMdmreYlxIxsaVa+yZ2S9cYBLX19PBjnwEZn4VjW7NNeklwrnm1o1X3z72mdl +Zl9Fx61AMLHYIuwO2NwDg7VykhI0CHwLGtI91+6Jj5MVpfZtv7v0O8wKb2FdewcN +C0gPtsduVyYjur0U9BuJ+8iDlUpJmdhn0TxVfafOGHzeBYLzC3oaOcWRmOdABay2 +AOMVvTiznkZfuTHSGBpRskBUtimoQ89eDlUkz2aZSQ2oMHOhk92hBA3jNPipaM7D +nb+Izo1742/3jUNnAjph6s7eyUVk2fvxrS+7jiLUiET5aEgy3is6P6q4tDJgMdbX +81zzoBdORG2rDlSQf7Rf0cddIsqz6W5e/ppqE3zDoRlOI42DAiAxK21TdqqGiP3s +g0YvNRrTTltV4y90GABbPDGTt2FyjzChJtUQBw/oDBxkimTSlA== +-----END CERTIFICATE REQUEST----- diff --git a/opensearch-pki/data-prepper-ingress.key b/opensearch-pki/data-prepper-ingress.key new file mode 100644 index 0000000..833468f --- /dev/null +++ b/opensearch-pki/data-prepper-ingress.key @@ -0,0 +1,40 @@ +-----BEGIN PRIVATE KEY----- +MIIG/gIBADANBgkqhkiG9w0BAQEFAASCBugwggbkAgEAAoIBgQC+lDX5+L4ZYVsN +Q/9/WTTHgZMeCi2TTq6yRLnyd6iukpjvYtw5/K6jAfOsREOHAjyP38KIDhti07dh +9WLw/ul0nUsjgniExxSqk5Mjk9LVAVlEir3VgKGvelQ0N/KmVF357NqJxgN4cjgh +owkdD4TNZDpOmPZ9rv8CazybO+mQkilPBOHgzLAerNTWveOum/l1QCFOZFduCNlV +ehRouUeDRHDkoAufEMQLWwvM7BEpUNmUaD3FWoJ2Aq891/QUkSsDw/B1nWJPrAbu +EQih1Udfa0pR43IWoghoL0blMzLxpFKVI+J9b21yp2e0phguJxzGwWCYows71V/4 +KqWOn/zQ2XQjqPOlbAbv+BXGIbOfT7T1JuBO0pXcHFeOQFbtgOxY8t31vHUz5SnX +ERpR8QPY2Q84TpbEoY/AfbiAU8bydRyEbSf3TN5D0punDUQbcYZpAAxcbXLWixKW +VIWgx/ah7BGezIWXyKG4Hg8xQet/PWdrnREewANlaRwnGDuh0lsCAwEAAQKCAYAD +se6fUMn+xqXJSrmNcov/bO0OoWE41fG1KyKf0jTHDbiWtkf8J9YK+w1fwwMRfw2a +4dptC45PCuPSARFQsuCROOuCs2jldNFbF/lmWzC0neNpMiIeyEZaQfjtT5hjeTHz +7Tpffs4FFnyCynJxdHeSs+Vy2KxkIMcjo4iinzVsGX62NYCw/HGoZpl0gGywWf3V +iXob1v41op5JdfsnUfr8+eVmdA6a9Zbs0XBtIgvtzSTVfR/qz6fFOfrD1t1jTgfg +OT7jOpCu8HxoofZaeLXAzcNvS7eZL5Yv5PqnApTelk2SEQZXiww+5apcKDDuZ46y +7ljUcjiX7QRdsRlCLlHTJn5Jy5sAynifB8XYCDfTy/rvmYYnTDU/PLLg8aqSk8UK +yk+gLCWzoewextfjZTtn4/gFmvGpRryy/KB2u4LjH8cqRHDRHtorII4+XDZOVIuO +dcHpl96OrJOWZsdK+TPfIx/G3BLpH+MqPaCu/IZFPli7lTYyGpb8Y1S4+ktnTkEC +gcEA7Bkz1hLm0gtoz9YLKMtEFoK+6yUbrTHVdL/rUtkBmPX1lM0OdfQ8bXzZ16gJ +lyN0UeNVq6vB36Q4CKC+t0eHyaRrCOtJ8foljI9jQhHWrAE6ls/2Fjl/KjcA8J5/ +SLKp+fc4FjPcEMh0oX0nqB91eZC8WzfB4XqOnE/6bTNmNIX5R+zChlk7un3kaviI +f5Q1f3a6MvD0nkkV1QNVOUH8H71safaNbHxY6Vf+d3guLHB7M1bWcDIprVfx2hVM +1MXTAoHBAM6kvMvXDu57rb3afUBHe5e2iDuqadbu2RDiFbs0EnzX9+x5qtCrlisx +0ohmEHwNpLtOG44QU/D0Y0sdDSGSNd+nt6ceec5Ha/cS1GbnVDeTgFznWc2/H6vc +2nLPmydsSaU5e3efDcPTbEVd9Fx/VGQ+ZvZHmb7OxBWspPP4kEuAALV2X3xM9jeo +QC71+a+0pGL1gH8WYpN/DAEKvIrhz/9Lm2ei17FQyu5P0XmcoDls5NjKCNr814Hg +DTojF09EWQKBwQDr2ZFKvL8P/I3LcQrcyZFO23VU+VDYhvuxETdHH7jU0H9vEhjs +A/uJdDs5j4dlD+nXE741K/MUMbw4AjwCYtZmvHSgCEtqCnUQIP0Ktz83vFKG7V/r +e6xow2GQ/QQx3yilqCzDITMpINZBrAC9lg+ITOmcRerMD93+kHaeN8ZVmbAYBY+d +He7osXJI2dWhfLCkkDoZQVNb+65viFDOTfhKzLNMdxt30BARqfFt7wRRKFwqQQke +Mz4nB792F+kUdDkCgcEAyrVdotR/iEB5ChGn5oN44TWk5GriUn6RHve5e5+0NxWg +1i/v+a0orYy9SyJcL2Uu4LLZYv3vaiJCuS9xbyo/gPvEs8K4mDsF1SR6icuJmM8w +D3K/bI59IhmPjSrMt9qJT/RYgtrbJOtkfZOSH56kiYWReSx5zGyGfACU++MsoXOa +vme1eXkB201IUQjoe41H6O+Nsp2h67CodOk0VUT4xiZD92EOF5n6x9Yy1gpoPozs +3SErmK6JNZU1RH+h4RdZAoHAEUvuI4pUW7mS6eQT8iWwkJ2kEj57lQYVMA2gG5jN +LIHRs8dvg3PyK20V1hkBJgzBpf3Dl3Io/H3bpuSSJNpp7Ign9SsI3B5YNBcm0AJo +Z7offqq4G8JYNdVwDsOLuB1zd9BiMpLPgcg2CB5y99QGIzsYhPqMrUNgfCDJR/ad +sqTPSGBlqNgymPZSKhVSsOZHDGTfcJuxwfZrEPJIZnM5FPFiPQmBMkWKncqL/SEQ +f8nxX2u4RpIOiAQJPMVU6GD1 +-----END PRIVATE KEY----- diff --git a/opensearch-pki/node-0-ext.cnf b/opensearch-pki/node-0-ext.cnf new file mode 100644 index 0000000..4cefc16 --- /dev/null +++ b/opensearch-pki/node-0-ext.cnf @@ -0,0 +1,18 @@ +basicConstraints = critical,CA:FALSE +keyUsage = critical,digitalSignature,keyEncipherment +extendedKeyUsage = serverAuth,clientAuth +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid,issuer + +subjectAltName = @alt_names + +[alt_names] +DNS.1 = brilliant-opensearch-cluster-master-0 +DNS.2 = brilliant-opensearch-cluster-master-0.brilliant-opensearch-cluster-master-headless +DNS.3 = brilliant-opensearch-cluster-master-0.brilliant-opensearch-cluster-master-headless.observability +DNS.4 = brilliant-opensearch-cluster-master-0.brilliant-opensearch-cluster-master-headless.observability.svc +DNS.5 = brilliant-opensearch-cluster-master-0.brilliant-opensearch-cluster-master-headless.observability.svc.cluster.local +DNS.6 = brilliant-opensearch-cluster-master +DNS.7 = brilliant-opensearch-cluster-master.observability +DNS.8 = brilliant-opensearch-cluster-master.observability.svc +DNS.9 = brilliant-opensearch-cluster-master.observability.svc.cluster.local diff --git a/opensearch-pki/node-0-key.pem b/opensearch-pki/node-0-key.pem new file mode 100644 index 0000000..fd1dd71 --- /dev/null +++ b/opensearch-pki/node-0-key.pem @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC1hKpNGQvjDpA6 +l8OUjNpAaQXxG2+9huRW7B/LwR8yF0ZQEFppAxLuGT6oV402XDV+lThEw+2zBfcf +ExFOa4EDM6kC4gd6KAA8KV+K0slZjqn08tRywfdMkvESMBa8QDjHLLlrANHE+NvP +nXxuajHtlJMD7LaHGWd8BJQqwjLv6pKtj+Z2b93nWcRKG0k5X6agHXpuzfWeg0b8 +ELClEhQjivcAMD/O2B3bXJpaRb2c5+XLYd0a0uTn1/yDvXD2gq/oY3lJUcsyE3J2 +czlZoR/OWbLVYqhnxzkr4hmwE8NQkuinHTgHuALC53omLKU8bEXhFeWnk4ZqQhEx +K3MYv8XNAgMBAAECggEABbNzTyqV4f1ncD+rUoi9+L8+WDKUEYV2uc1+uNKJnUl3 +2YnknQm4rXu407wJi7HdCEBoMlizqCdsJIYKdBu87eclzBkMl7yWjU0rWrErcRb2 ++uIpjqp4OZJ1OddYJMog6Q3cNk0h9CgbbJY1/e3Ilaf7RL30LvgQSlKGfh/3+Or9 +MIBei1LDCTE5GQQQpWGYXJNNg2SAzGsWvZXNgfKFy0eeOEC1KwLNqicL2tQR+zdl +/T1sxVzu3CNZIIUAmgUx9sWjpbmSu33/5k1PKu7IuJp4mzM4BL58VVjE57jS7NgB +QN4b/6NoFexQFuwdA+eeWyMOM3AfvJPGsT6SAipMYQKBgQDuuXWyyQpJJ+mhvOIz +lFfoFTWzU5nBzc++IJ9dDM+LGNiRUiyTfGHt7Q3Q98QmH1t3KejwwvCyglixXq6J +kxLeq38Y7rK51MOHt1x3CEgVxV9ocwY0RRICW2xptbf6Uo9Yb+nfjjHyCeOa88Rw +yqojb/V6MLRUEIV7RDm2g3sblQKBgQDCp2tetPymH8tjZyUPqSVgfuyooaYFWeXt +WWfndpe4njv5U3BShMtsNy88kbxRuSieT3Wa8nlSuXbYPbWW4Aq0WJf1o3noEJD0 +3bMz4ZWcNRsj6T5+gSsRcMNY8GamQDBTSfomofouPavF64ftd4ZnQBKdJubC/c2X +VSK/2YKzWQKBgQCVQVEsUfPjX1f8bosC8rmveitUDm3wtQww9FaPJ+ZPMl6dJUKH +h9n2lyLvRynVJ//Y1lQ0y70P7t0jMG5xx4mhvJm/beZCt5r0rJjcN0pSik+nj1sO +rSygWqbCxQHdOWc0ROx1gIMLsFEk3UoxtxR/CY3yMqdcc+Pw+OwYh8YdrQKBgQC/ +aFnQWzBFOuaI7Jgo+i7i4GxetfXHNUs/RbdCh/9Rb2eSGFZPDn3p/6nXaYdA5U3n +vkLrBpv+mJkgsi2qGszr4mIrDYGGjSO9ZXQeBClV3XK+sVDenK15DOVKw7psqJnc +jNYKvyR/6+zJRn33KJ1lUj/7gJFSFLjhorn05TH8oQKBgB8LgPFdS/WtyjrOKBu8 +4whBFfEdw16yY5TGCLpBch1GkWxApguKt2NiUsMe07RwWZBwSYClupDUCbTUhxBJ +SeIqCXChmgmScEvX6LGGIyE9MFQz3lnvnguHNJ/JpMFFSouM+fGh8yv7XBicBAGK +z+zivp+dDfEKc5UwO1sv/UT3 +-----END PRIVATE KEY----- diff --git a/opensearch-pki/node-0.csr b/opensearch-pki/node-0.csr new file mode 100644 index 0000000..2424b31 --- /dev/null +++ b/opensearch-pki/node-0.csr @@ -0,0 +1,17 @@ +-----BEGIN CERTIFICATE REQUEST----- +MIICvzCCAacCAQAwejELMAkGA1UEBhMCQkQxDjAMBgNVBAgMBURoYWthMQ4wDAYD +VQQHDAVEaGFrYTESMBAGA1UECgwJQnJpbGxpYW50MRkwFwYDVQQLDBBPcGVuU2Vh +cmNoIE5vZGVzMRwwGgYDVQQDDBNvcGVuc2VhcmNoLW1hc3Rlci0wMIIBIjANBgkq +hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtYSqTRkL4w6QOpfDlIzaQGkF8RtvvYbk +Vuwfy8EfMhdGUBBaaQMS7hk+qFeNNlw1fpU4RMPtswX3HxMRTmuBAzOpAuIHeigA +PClfitLJWY6p9PLUcsH3TJLxEjAWvEA4xyy5awDRxPjbz518bmox7ZSTA+y2hxln +fASUKsIy7+qSrY/mdm/d51nEShtJOV+moB16bs31noNG/BCwpRIUI4r3ADA/ztgd +21yaWkW9nOfly2HdGtLk59f8g71w9oKv6GN5SVHLMhNydnM5WaEfzlmy1WKoZ8c5 +K+IZsBPDUJLopx04B7gCwud6JiylPGxF4RXlp5OGakIRMStzGL/FzQIDAQABoAAw +DQYJKoZIhvcNAQELBQADggEBAJwG1VOeIqHJcl8r7djm/D7b3t+yzeJ1Xb3PD3MM +yR65BQN6ZPVCIz4Co7qEu3Y5x8gDCqNyEXPpZdqQZ5gOXr7TBo57Uu/5jSO7ufIE +n5FcCKG1RSCaXUTDkR/U3+5GR7legz9gBBbYS/muk+V6F068WtqgSfkDI4vTM7Jk +8EHFT0zo5XbNz6uxfdgAErH5599+tuZ2xvdJU9U54/501fDR1/y9edJSLos37poN +TGOocieska/3r3J47kc7MJij4jimHjqjv0kA5BLDk4BjnmFey0H7V+L82/d5bWa+ +V1djH1y1zT3gBrsWx64L93rcsWHlba/Z8vI9/En3sWYVv5s= +-----END CERTIFICATE REQUEST----- diff --git a/opensearch-pki/node-0.pem b/opensearch-pki/node-0.pem new file mode 100644 index 0000000..099e485 --- /dev/null +++ b/opensearch-pki/node-0.pem @@ -0,0 +1,44 @@ +-----BEGIN CERTIFICATE----- +MIIHrTCCBZWgAwIBAgIUIycsqd4quogxjw1E4Kjx3wBtbW4wDQYJKoZIhvcNAQEL +BQAwgYUxCzAJBgNVBAYTAkJEMQ4wDAYDVQQIDAVEaGFrYTEOMAwGA1UEBwwFRGhh +a2ExEjAQBgNVBAoMCUJyaWxsaWFudDEbMBkGA1UECwwST3BlblNlYXJjaCBSb290 +IENBMSUwIwYDVQQDDBxCcmlsbGlhbnQgT3BlblNlYXJjaCBSb290IENBMB4XDTI2 +MDcyMzE1MTMyN1oXDTI4MTAyNTE1MTMyN1owejELMAkGA1UEBhMCQkQxDjAMBgNV +BAgMBURoYWthMQ4wDAYDVQQHDAVEaGFrYTESMBAGA1UECgwJQnJpbGxpYW50MRkw +FwYDVQQLDBBPcGVuU2VhcmNoIE5vZGVzMRwwGgYDVQQDDBNvcGVuc2VhcmNoLW1h +c3Rlci0wMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtYSqTRkL4w6Q +OpfDlIzaQGkF8RtvvYbkVuwfy8EfMhdGUBBaaQMS7hk+qFeNNlw1fpU4RMPtswX3 +HxMRTmuBAzOpAuIHeigAPClfitLJWY6p9PLUcsH3TJLxEjAWvEA4xyy5awDRxPjb +z518bmox7ZSTA+y2hxlnfASUKsIy7+qSrY/mdm/d51nEShtJOV+moB16bs31noNG +/BCwpRIUI4r3ADA/ztgd21yaWkW9nOfly2HdGtLk59f8g71w9oKv6GN5SVHLMhNy +dnM5WaEfzlmy1WKoZ8c5K+IZsBPDUJLopx04B7gCwud6JiylPGxF4RXlp5OGakIR +MStzGL/FzQIDAQABo4IDHTCCAxkwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMC +BaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB0GA1UdDgQWBBSdvcR3 +55GXQPSccLe6w2/LiNCH0jAfBgNVHSMEGDAWgBR22p4+hRjFH8JQtCvo3DuTPRsA +KTCCApgGA1UdEQSCAo8wggKLgiVicmlsbGlhbnQtb3BlbnNlYXJjaC1jbHVzdGVy +LW1hc3Rlci0wglJicmlsbGlhbnQtb3BlbnNlYXJjaC1jbHVzdGVyLW1hc3Rlci0w +LmJyaWxsaWFudC1vcGVuc2VhcmNoLWNsdXN0ZXItbWFzdGVyLWhlYWRsZXNzgmBi +cmlsbGlhbnQtb3BlbnNlYXJjaC1jbHVzdGVyLW1hc3Rlci0wLmJyaWxsaWFudC1v +cGVuc2VhcmNoLWNsdXN0ZXItbWFzdGVyLWhlYWRsZXNzLm9ic2VydmFiaWxpdHmC +ZGJyaWxsaWFudC1vcGVuc2VhcmNoLWNsdXN0ZXItbWFzdGVyLTAuYnJpbGxpYW50 +LW9wZW5zZWFyY2gtY2x1c3Rlci1tYXN0ZXItaGVhZGxlc3Mub2JzZXJ2YWJpbGl0 +eS5zdmOCcmJyaWxsaWFudC1vcGVuc2VhcmNoLWNsdXN0ZXItbWFzdGVyLTAuYnJp +bGxpYW50LW9wZW5zZWFyY2gtY2x1c3Rlci1tYXN0ZXItaGVhZGxlc3Mub2JzZXJ2 +YWJpbGl0eS5zdmMuY2x1c3Rlci5sb2NhbIIjYnJpbGxpYW50LW9wZW5zZWFyY2gt +Y2x1c3Rlci1tYXN0ZXKCMWJyaWxsaWFudC1vcGVuc2VhcmNoLWNsdXN0ZXItbWFz +dGVyLm9ic2VydmFiaWxpdHmCNWJyaWxsaWFudC1vcGVuc2VhcmNoLWNsdXN0ZXIt +bWFzdGVyLm9ic2VydmFiaWxpdHkuc3ZjgkNicmlsbGlhbnQtb3BlbnNlYXJjaC1j +bHVzdGVyLW1hc3Rlci5vYnNlcnZhYmlsaXR5LnN2Yy5jbHVzdGVyLmxvY2FsMA0G +CSqGSIb3DQEBCwUAA4ICAQBMsT5B+BsVzdkp4djKCWJuKkMybbttYolVyzZmqz7F +lOoPG/3pU1LxjH+UK1YTHNfZaFoTjQ/OXT/NFrf/rHCfcBqdbcV5VrY9JiEDHWus +b4dxFE7WBZU54+25WX9vuG0VTxsgH08EC/MWp8CGjwXJhqjiQvI4ihFjwuVtt1R5 +oLXfXKoA0C165GPVcVftkqVqJ/ece9/mxcaJenAv8wGoF9VpamJMf/r+x1/LOXNt +vi5RcNdfLSyh97MDhMbEB2KldOYc/a4zJKyrHl6ijZpP7Y7RPQq1OlC4gYQe/7xi +Nd/TvZrIy448OXW79Ee+3Hmg0xbzdYmjPp5qlXPshwFXkkyNlAgVuSpFO0ogfjON +yH7qVDNamHP5VA++Iu415V1aT/+EFab7oeH3j3ZIrO1YymB/NSOS/QvsdEApz4eI +UjluqVt87h7wVnNzRZ1RFX98bXmA5+4TTbdr2FMzro0/5Om+So9hJq7ZasNAkDPj +qo1IYYf7ATzND8KLTBUF9x9yuWFNvY648n72sG26zh3ZsgizWdzM+67zaWAJOrQk +fjmgA2NYqFjMbQ9MCXw0LjKROQLVhshWNQxD2awyC9L+bNaqE32QI+xH8nwmjQzL +hiltYas4yXSc2lhqDbK+V2rUGbK5pcM+z1rd5Q7/hTrsTiJub9nlcCtai/ZBFzO+ +Hw== +-----END CERTIFICATE----- diff --git a/opensearch-pki/node-1-ext.cnf b/opensearch-pki/node-1-ext.cnf new file mode 100644 index 0000000..66bfba4 --- /dev/null +++ b/opensearch-pki/node-1-ext.cnf @@ -0,0 +1,18 @@ +basicConstraints = critical,CA:FALSE +keyUsage = critical,digitalSignature,keyEncipherment +extendedKeyUsage = serverAuth,clientAuth +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid,issuer + +subjectAltName = @alt_names + +[alt_names] +DNS.1 = brilliant-opensearch-cluster-master-1 +DNS.2 = brilliant-opensearch-cluster-master-1.brilliant-opensearch-cluster-master-headless +DNS.3 = brilliant-opensearch-cluster-master-1.brilliant-opensearch-cluster-master-headless.observability +DNS.4 = brilliant-opensearch-cluster-master-1.brilliant-opensearch-cluster-master-headless.observability.svc +DNS.5 = brilliant-opensearch-cluster-master-1.brilliant-opensearch-cluster-master-headless.observability.svc.cluster.local +DNS.6 = brilliant-opensearch-cluster-master +DNS.7 = brilliant-opensearch-cluster-master.observability +DNS.8 = brilliant-opensearch-cluster-master.observability.svc +DNS.9 = brilliant-opensearch-cluster-master.observability.svc.cluster.local diff --git a/opensearch-pki/node-1-key.pem b/opensearch-pki/node-1-key.pem new file mode 100644 index 0000000..820d584 --- /dev/null +++ b/opensearch-pki/node-1-key.pem @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDkLJN5RVttlBx7 +bPhLlc18VtS0TF+xdjCaWnL6ES89j0fGxK9sPdzzKi2wXzP9FANUtOjCW2hS5RrI +IvVAgTNeAjI785KKHLEwAZSlBf5xqp7i9JmrR8S1JsP0uwsZ+3pxpuLO0OlUSo0H +zdjvp0jOG03MvFN0w8Rg7Xe/uag6Ob4CxV3eBwav2d5p2O7fgozeDynPwHPrOX/8 +p1HIkJE6yh/rZ2JRjkVuxd9Z3G2luEEyH7c+G8Uo8E+sD9PbnmZwj9l5xSTnrMt/ +RmrK7rrU1X07SK0CXCkInARP50l3nhpiOGL340wevxsK3mG1dXn5S4prw70ttvk9 +mJOJQ60hAgMBAAECggEAIb5l4N1c9AufWrF21tbEmMrOkgtpa3krHuiZcFnyPoxd +9QtJVhyf/GYUc6zgp2C6TWCju3qBJyEyoL5qvqtcyV5Rx4Px+/LaUVsqfG0yf+TX +soCx6R6n/JJLEHpI3gLOzNf9WtCScSDFUo4isu5uWey3yLthLDd3Z043E2eFdXal +BRPFolFtzG8wpqKty+Omh9cUrAHU087qKw0rbWUHd7RSPDRMyn1v7uOdIvPCn57o +CZe0srB5Ko3akAyaAQUXPwnTZyUyuIu/JZkakvN015qxbqnV86U9JLCR01YxGNya +8tzdAzOkWvc+vomVlLj6l4ilz8CkgIfant/ZlCiVMQKBgQD/3PkpTX7Zs96Co8Gj +SnJ+p8oaSLEclGEq4DECoRWjpaoSvgBtYUs38ZJpouXzdKEfgzxykaIdt4XEpAoj +z5AztQ1cy99j20RkdhiMzJARsZOp6vfoFBqLWJEcufDpuqv+D7EOKwF74bSrFYtf +zy8Qa4UEXjIFYIqD9X5AdUY9SwKBgQDkS8/v8JinmXxwbwy36mSe3bBkSUqyXquW +q6QY/dckL7Pqgkf5TWPY3Vu2n80E7pfu2a851XAmJeY8DrNUMNjV9vb1haCbY7f3 +2igNODbwsL2E4e0fA7m5UW/X85JO28B1TBa1DK4N+iwYiQUjHqByoGQEuMUPJX26 +hMno5TvXwwKBgQDlzKSn+Oc+RjNJqCQpMZslsDNvaexQm9+tb4/1KZJS2V6n2Khv +lNvG0hvK7riS8SQpNmhbCfvNrt/g3egRg8Gi/zCSMLVhbTS++eZQxwV6LsBN8zBW +639vucsTPtlmQvdohtVhwTRi/DOVGROFqII/wCHG64cHl06w+BM9d1bvgwKBgQC3 +BmSNS0lHTJDsHsuGgv7qMnbg37Vn7OgJok+rzY32r9vAzXPgVYAP8988OT8HjjT2 +Q0Tsy8Xef5HmYi6493RPjXAOBHRvP3HU3ewwNPou2rMF3o7Yx4bVIInXCqooWJsi +Lr8hpSnBgOhrPyaEMmCVpSqqcmthqj/zEdRBx83DOwKBgQCdLt1VnHGVjgQzortX +rqcmBu4mKrZaKtll3yNKC36Hw8h3SqYRnUNVf+jOPO33sRGrr4VBLKoxC44Ictoh +W6Z8/FfBX2H05363GRE16dF8Vya3woLQPjSs/iAgXGzl5yRPYaMk6VQxB6ps+F8q +YZr6z10sXAtBlK3yMEKXUBWm/w== +-----END PRIVATE KEY----- diff --git a/opensearch-pki/node-1.csr b/opensearch-pki/node-1.csr new file mode 100644 index 0000000..8652057 --- /dev/null +++ b/opensearch-pki/node-1.csr @@ -0,0 +1,17 @@ +-----BEGIN CERTIFICATE REQUEST----- +MIICvzCCAacCAQAwejELMAkGA1UEBhMCQkQxDjAMBgNVBAgMBURoYWthMQ4wDAYD +VQQHDAVEaGFrYTESMBAGA1UECgwJQnJpbGxpYW50MRkwFwYDVQQLDBBPcGVuU2Vh +cmNoIE5vZGVzMRwwGgYDVQQDDBNvcGVuc2VhcmNoLW1hc3Rlci0xMIIBIjANBgkq +hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5CyTeUVbbZQce2z4S5XNfFbUtExfsXYw +mlpy+hEvPY9HxsSvbD3c8yotsF8z/RQDVLTowltoUuUayCL1QIEzXgIyO/OSihyx +MAGUpQX+caqe4vSZq0fEtSbD9LsLGft6cabiztDpVEqNB83Y76dIzhtNzLxTdMPE +YO13v7moOjm+AsVd3gcGr9neadju34KM3g8pz8Bz6zl//KdRyJCROsof62diUY5F +bsXfWdxtpbhBMh+3PhvFKPBPrA/T255mcI/ZecUk56zLf0Zqyu661NV9O0itAlwp +CJwET+dJd54aYjhi9+NMHr8bCt5htXV5+UuKa8O9Lbb5PZiTiUOtIQIDAQABoAAw +DQYJKoZIhvcNAQELBQADggEBAD6DHvkPsuxGPB27iUZp0d1TH5ZzVMJY9cqw827b +3gJZQBV7xD/OpgpVz5Zoc3sfqWRqHdkjz4Md1gtyVRYW7N6XaMHX6ukDLVUODOd5 +9jJof4Vr4hkTkyH+wf69gmF1gS5XtEhaMCwlBqvqQyQkfeIiGewNwVghsKIyIvQx +VzSFECSf6ycdhDveGo7Ius2uCUhLeN2WPA1GVwevGplEHdmvAe4/KLU9+S5TovXJ +dN8BUWmmFO2q135rxkEfkFdTm/VqCEw0poc7HuXygUQBnNFSg6Az0HVJ893K9Nnw +hhgRfeIiBKBSalWd+xXWBy19q7rprNx0gQGYU1EVPQ9VNdg= +-----END CERTIFICATE REQUEST----- diff --git a/opensearch-pki/node-1.pem b/opensearch-pki/node-1.pem new file mode 100644 index 0000000..fc3df6b --- /dev/null +++ b/opensearch-pki/node-1.pem @@ -0,0 +1,44 @@ +-----BEGIN CERTIFICATE----- +MIIHrTCCBZWgAwIBAgIUIycsqd4quogxjw1E4Kjx3wBtbXAwDQYJKoZIhvcNAQEL +BQAwgYUxCzAJBgNVBAYTAkJEMQ4wDAYDVQQIDAVEaGFrYTEOMAwGA1UEBwwFRGhh +a2ExEjAQBgNVBAoMCUJyaWxsaWFudDEbMBkGA1UECwwST3BlblNlYXJjaCBSb290 +IENBMSUwIwYDVQQDDBxCcmlsbGlhbnQgT3BlblNlYXJjaCBSb290IENBMB4XDTI2 +MDcyMzE1MjQwMFoXDTI4MTAyNTE1MjQwMFowejELMAkGA1UEBhMCQkQxDjAMBgNV +BAgMBURoYWthMQ4wDAYDVQQHDAVEaGFrYTESMBAGA1UECgwJQnJpbGxpYW50MRkw +FwYDVQQLDBBPcGVuU2VhcmNoIE5vZGVzMRwwGgYDVQQDDBNvcGVuc2VhcmNoLW1h +c3Rlci0xMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5CyTeUVbbZQc +e2z4S5XNfFbUtExfsXYwmlpy+hEvPY9HxsSvbD3c8yotsF8z/RQDVLTowltoUuUa +yCL1QIEzXgIyO/OSihyxMAGUpQX+caqe4vSZq0fEtSbD9LsLGft6cabiztDpVEqN +B83Y76dIzhtNzLxTdMPEYO13v7moOjm+AsVd3gcGr9neadju34KM3g8pz8Bz6zl/ +/KdRyJCROsof62diUY5FbsXfWdxtpbhBMh+3PhvFKPBPrA/T255mcI/ZecUk56zL +f0Zqyu661NV9O0itAlwpCJwET+dJd54aYjhi9+NMHr8bCt5htXV5+UuKa8O9Lbb5 +PZiTiUOtIQIDAQABo4IDHTCCAxkwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMC +BaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB0GA1UdDgQWBBQ7vPOO +QnYjKf4JFQQOKj7ze3j3dzAfBgNVHSMEGDAWgBR22p4+hRjFH8JQtCvo3DuTPRsA +KTCCApgGA1UdEQSCAo8wggKLgiVicmlsbGlhbnQtb3BlbnNlYXJjaC1jbHVzdGVy +LW1hc3Rlci0xglJicmlsbGlhbnQtb3BlbnNlYXJjaC1jbHVzdGVyLW1hc3Rlci0x +LmJyaWxsaWFudC1vcGVuc2VhcmNoLWNsdXN0ZXItbWFzdGVyLWhlYWRsZXNzgmBi +cmlsbGlhbnQtb3BlbnNlYXJjaC1jbHVzdGVyLW1hc3Rlci0xLmJyaWxsaWFudC1v +cGVuc2VhcmNoLWNsdXN0ZXItbWFzdGVyLWhlYWRsZXNzLm9ic2VydmFiaWxpdHmC +ZGJyaWxsaWFudC1vcGVuc2VhcmNoLWNsdXN0ZXItbWFzdGVyLTEuYnJpbGxpYW50 +LW9wZW5zZWFyY2gtY2x1c3Rlci1tYXN0ZXItaGVhZGxlc3Mub2JzZXJ2YWJpbGl0 +eS5zdmOCcmJyaWxsaWFudC1vcGVuc2VhcmNoLWNsdXN0ZXItbWFzdGVyLTEuYnJp +bGxpYW50LW9wZW5zZWFyY2gtY2x1c3Rlci1tYXN0ZXItaGVhZGxlc3Mub2JzZXJ2 +YWJpbGl0eS5zdmMuY2x1c3Rlci5sb2NhbIIjYnJpbGxpYW50LW9wZW5zZWFyY2gt +Y2x1c3Rlci1tYXN0ZXKCMWJyaWxsaWFudC1vcGVuc2VhcmNoLWNsdXN0ZXItbWFz +dGVyLm9ic2VydmFiaWxpdHmCNWJyaWxsaWFudC1vcGVuc2VhcmNoLWNsdXN0ZXIt +bWFzdGVyLm9ic2VydmFiaWxpdHkuc3ZjgkNicmlsbGlhbnQtb3BlbnNlYXJjaC1j +bHVzdGVyLW1hc3Rlci5vYnNlcnZhYmlsaXR5LnN2Yy5jbHVzdGVyLmxvY2FsMA0G +CSqGSIb3DQEBCwUAA4ICAQBAjBl519DTvYLVwJfePqkprL7FPaNQZVi1gHKLQazB +ISifukf29ZKDXg3D3MWJ+T8VAzZgBEAAQ/3G8+u7FT8Tn22I1Kff4KbGCLpP69tS +GbHYTL3V61f9MNGKkyiThuHmO/8HJ1VAsKjfz7pP0p9TBHDpnacFIcQLaApGbibx +hQkt79qeh3vaZT/HgWYizsqAk8I2z47KEEBUdtN1Vrbb/DA5owz8w3cO4G1neTKl +AVYKNSjCUbExPCtivnrJsAL/rdIfsLtDJCtA4TEmouR+Kc2d5dlkV4KgsyAQ34FX +So421ZxBOvf427bI7G+OF3IufrY47LAaJrypcwfU6+QIWMrC+Zy6UsmjMy523E67 +WRP/VoA+JezrNWhTuBB7T3tozCVQeJgg2Hr2EC7EUnvTYgN25no2iYqIz6tcUVWH +HEv/9FPQeqB3gzGs2gYy7QEYiqwQI8jlMlADgKkkXcliTZHIaJTWppo/YAQwOVjR +moiaEDxPqDfvKDFMv9sAeAutd/LITyHLuNWDWMRebwKGvhfRcvXI3O8zNBm1ccE5 +uSvdNmfH2xvhHTkWduJesQ8pRH9B997hM6t6IqnUl7Kj5xPaCHXA2g4azahqTjwL +A4ZivTb8MSp8ZKKP1xjdv+3iv/sBnhUFXWKZ4fce6cioJ+0kDCgOJwy2aRSdk3MR +sA== +-----END CERTIFICATE----- diff --git a/opensearch-pki/node-2-ext.cnf b/opensearch-pki/node-2-ext.cnf new file mode 100644 index 0000000..a9fc051 --- /dev/null +++ b/opensearch-pki/node-2-ext.cnf @@ -0,0 +1,18 @@ +basicConstraints = critical,CA:FALSE +keyUsage = critical,digitalSignature,keyEncipherment +extendedKeyUsage = serverAuth,clientAuth +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid,issuer + +subjectAltName = @alt_names + +[alt_names] +DNS.1 = brilliant-opensearch-cluster-master-2 +DNS.2 = brilliant-opensearch-cluster-master-2.brilliant-opensearch-cluster-master-headless +DNS.3 = brilliant-opensearch-cluster-master-2.brilliant-opensearch-cluster-master-headless.observability +DNS.4 = brilliant-opensearch-cluster-master-2.brilliant-opensearch-cluster-master-headless.observability.svc +DNS.5 = brilliant-opensearch-cluster-master-2.brilliant-opensearch-cluster-master-headless.observability.svc.cluster.local +DNS.6 = brilliant-opensearch-cluster-master +DNS.7 = brilliant-opensearch-cluster-master.observability +DNS.8 = brilliant-opensearch-cluster-master.observability.svc +DNS.9 = brilliant-opensearch-cluster-master.observability.svc.cluster.local diff --git a/opensearch-pki/node-2-key.pem b/opensearch-pki/node-2-key.pem new file mode 100644 index 0000000..bcdbcd6 --- /dev/null +++ b/opensearch-pki/node-2-key.pem @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDDSJ915jXaFcjA +PEq21Fq81pvb6gUQ6UEJiMCqAqSyOV+zoYj2QEIp81XGnXzS9ArsGyVZDSlRpb32 +jRIIKMeEOt7mvTrm2pHQMR9m8i401rjGGcVb5Ekb+USB3TurfuQiIjELSML6Unm6 +rxtnH8fFpTtLgL5OhEgWyt2Fxh/HcyohLHILVlQIKeDk2r8MlF8ip1xnYGkBbckg +SP/9f6+FavvZLkgcmX5qLx4BNoVZFJae2n/vHjXIQOKsjTwXI/H3nQGwlHzph//l +a/srbEjokeDEl6MUxMn4vOAi/XDSsQ612o414ZiXpiY8W3lNCpDv2goILpCwKVxn +9nZv3GW/AgMBAAECggEATWDJTn4ZeICJOyKouCkMiya+OzVPLJRAIPb+4F6Lw9LY +COVIz8pGbTjuE/TzMONiMIvREKgWZzO1QaxEKNd/tvVcvTDd1ftlK4lLWA8+H9G1 +BUnQ2chq75qleo+exSVSX/QMWtxJ5cYoVcBsqz/8eGQwSoqI3bOsnNtlS0xl6zEU +2QV+XSZqXiYuK0Z5Tpugf5Kz77eDArbjn3TSkAVuCm1e502ps55qi35huwxtAXQB +STDUOvg3l+whRuZDJl4d9/iMZoprricgNbRlWDjTXo2FYoeb/3XUjYHkhQlRI7I2 +rB4/emOQHFGcUiitLRVlMljDjel3F2TzRlxSCi/DAQKBgQD1gs/0EYfwrd5lFWuT +Y+a8rHaDIL9PckAGSU+tw2qXK3gbZf01O8wy6s7oiWkYbeVuFNiXs7IKnmZ3VHfo +BcSTorK0VeFKuHhvhpYWzZpQ976ms9eN0KRKNwVYgVJ9Q54aLlOI5KxWpSvHy5AZ +FssDemnhr2CVRXP3XKsZmngz9wKBgQDLoHe0/5hek2N+yvjTb7AqyjsRFuGV6NS8 +yIl4CPLi4aTdaC8ryYkDyg2Vl4ZdzBnWY1eU1T8whmfQlBroXqYlzayV65bIRL/s +1T9OZWjN6T7C+hEDsCffd61B2Gwc6g19dS6TgcJ7hU9hZn4X6eFdHcJHMljlKwYM +cdMWa7FaeQKBgQDsuPf4NtsjlxIj11aFpEL70zLmVrIAUYIoTZHVUuI45oIFsP5H +0OOgiMV+c9fw5S3eSZ1aELrwADF+h+ShxMX5MFwtA82aNWpy5otba12LCoY6yJdj +tzRiFtFBuFgoTgVo6xhCm3MMjHA9Uisb9d1D+kmTgX2YEIKzlRepNUcHmwKBgQDJ +DqrkFrOWPqWxHizOaKtjtMbZuuQHJxxXQxMpaHyatP4ad7KL47Tb/vemyzSrDMo+ +O1zQ4jZAbZW4B2UCJ+KZ1Rkh9rqtB+URrgWSHON83V9RGaUPJTJZnkt+hnlJm3iy +dbAFicxENn8IxzCd4Brb3HRl5DqOHQsd4o3wx2kY0QKBgD43hyhhTKJDboatnQjl +Roz30FSw75OLqAAGzQPKZKu4ATQbYdDK5x7Eowd82Bva37Ben55cW1NmRTocIWEb +0JW62v/SS4CVtoIFGcK8VJUi4QBG59Ooe7DTGjHNFFa4YC/7XmCuqHnLVZXVvbZ+ +LveR7AwSzKLprENs0AIuZmbi +-----END PRIVATE KEY----- diff --git a/opensearch-pki/node-2.csr b/opensearch-pki/node-2.csr new file mode 100644 index 0000000..882f07e --- /dev/null +++ b/opensearch-pki/node-2.csr @@ -0,0 +1,17 @@ +-----BEGIN CERTIFICATE REQUEST----- +MIICvzCCAacCAQAwejELMAkGA1UEBhMCQkQxDjAMBgNVBAgMBURoYWthMQ4wDAYD +VQQHDAVEaGFrYTESMBAGA1UECgwJQnJpbGxpYW50MRkwFwYDVQQLDBBPcGVuU2Vh +cmNoIE5vZGVzMRwwGgYDVQQDDBNvcGVuc2VhcmNoLW1hc3Rlci0yMIIBIjANBgkq +hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw0ifdeY12hXIwDxKttRavNab2+oFEOlB +CYjAqgKksjlfs6GI9kBCKfNVxp180vQK7BslWQ0pUaW99o0SCCjHhDre5r065tqR +0DEfZvIuNNa4xhnFW+RJG/lEgd07q37kIiIxC0jC+lJ5uq8bZx/HxaU7S4C+ToRI +FsrdhcYfx3MqISxyC1ZUCCng5Nq/DJRfIqdcZ2BpAW3JIEj//X+vhWr72S5IHJl+ +ai8eATaFWRSWntp/7x41yEDirI08FyPx950BsJR86Yf/5Wv7K2xI6JHgxJejFMTJ ++LzgIv1w0rEOtdqONeGYl6YmPFt5TQqQ79oKCC6QsClcZ/Z2b9xlvwIDAQABoAAw +DQYJKoZIhvcNAQELBQADggEBAL6ugt6wF24mHLL+uplIZH21iePI+cKtHDE+OiYO +oINHMGblJahOOMQMFzydnVSJ8Nn5iDr3cuuTTWe8OS1EbZpcjU6WenwrORZe7buF +40RhSKpDWrk1TXxOZs6lbdawT+VKXxCbcnRniEYiy5tSXePrXTf3U1qmMBnAINht +oplRjUGgMpzssjjce3wVgH9KHszQyG2WAZYQH2td6RX16m0dD2HAqxbAd/nbb6h9 +GeijI//QYnbQ9AXllHopLdedZ1UnxoqZ4nBu7iRTONE5pjhkmoJ/7z/qm6dLEonP +MWg8v8BDdQdOZwYXo9C2hraxY18esP9SO5OBbox4DHYs3YM= +-----END CERTIFICATE REQUEST----- diff --git a/opensearch-pki/node-2.pem b/opensearch-pki/node-2.pem new file mode 100644 index 0000000..26edced --- /dev/null +++ b/opensearch-pki/node-2.pem @@ -0,0 +1,44 @@ +-----BEGIN CERTIFICATE----- +MIIHrTCCBZWgAwIBAgIUIycsqd4quogxjw1E4Kjx3wBtbXEwDQYJKoZIhvcNAQEL +BQAwgYUxCzAJBgNVBAYTAkJEMQ4wDAYDVQQIDAVEaGFrYTEOMAwGA1UEBwwFRGhh +a2ExEjAQBgNVBAoMCUJyaWxsaWFudDEbMBkGA1UECwwST3BlblNlYXJjaCBSb290 +IENBMSUwIwYDVQQDDBxCcmlsbGlhbnQgT3BlblNlYXJjaCBSb290IENBMB4XDTI2 +MDcyMzE1MjQyOFoXDTI4MTAyNTE1MjQyOFowejELMAkGA1UEBhMCQkQxDjAMBgNV +BAgMBURoYWthMQ4wDAYDVQQHDAVEaGFrYTESMBAGA1UECgwJQnJpbGxpYW50MRkw +FwYDVQQLDBBPcGVuU2VhcmNoIE5vZGVzMRwwGgYDVQQDDBNvcGVuc2VhcmNoLW1h +c3Rlci0yMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw0ifdeY12hXI +wDxKttRavNab2+oFEOlBCYjAqgKksjlfs6GI9kBCKfNVxp180vQK7BslWQ0pUaW9 +9o0SCCjHhDre5r065tqR0DEfZvIuNNa4xhnFW+RJG/lEgd07q37kIiIxC0jC+lJ5 +uq8bZx/HxaU7S4C+ToRIFsrdhcYfx3MqISxyC1ZUCCng5Nq/DJRfIqdcZ2BpAW3J +IEj//X+vhWr72S5IHJl+ai8eATaFWRSWntp/7x41yEDirI08FyPx950BsJR86Yf/ +5Wv7K2xI6JHgxJejFMTJ+LzgIv1w0rEOtdqONeGYl6YmPFt5TQqQ79oKCC6QsClc +Z/Z2b9xlvwIDAQABo4IDHTCCAxkwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMC +BaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB0GA1UdDgQWBBQtMiz7 +U9H5vkGsf6u49GZUJCulfjAfBgNVHSMEGDAWgBR22p4+hRjFH8JQtCvo3DuTPRsA +KTCCApgGA1UdEQSCAo8wggKLgiVicmlsbGlhbnQtb3BlbnNlYXJjaC1jbHVzdGVy +LW1hc3Rlci0yglJicmlsbGlhbnQtb3BlbnNlYXJjaC1jbHVzdGVyLW1hc3Rlci0y +LmJyaWxsaWFudC1vcGVuc2VhcmNoLWNsdXN0ZXItbWFzdGVyLWhlYWRsZXNzgmBi +cmlsbGlhbnQtb3BlbnNlYXJjaC1jbHVzdGVyLW1hc3Rlci0yLmJyaWxsaWFudC1v +cGVuc2VhcmNoLWNsdXN0ZXItbWFzdGVyLWhlYWRsZXNzLm9ic2VydmFiaWxpdHmC +ZGJyaWxsaWFudC1vcGVuc2VhcmNoLWNsdXN0ZXItbWFzdGVyLTIuYnJpbGxpYW50 +LW9wZW5zZWFyY2gtY2x1c3Rlci1tYXN0ZXItaGVhZGxlc3Mub2JzZXJ2YWJpbGl0 +eS5zdmOCcmJyaWxsaWFudC1vcGVuc2VhcmNoLWNsdXN0ZXItbWFzdGVyLTIuYnJp +bGxpYW50LW9wZW5zZWFyY2gtY2x1c3Rlci1tYXN0ZXItaGVhZGxlc3Mub2JzZXJ2 +YWJpbGl0eS5zdmMuY2x1c3Rlci5sb2NhbIIjYnJpbGxpYW50LW9wZW5zZWFyY2gt +Y2x1c3Rlci1tYXN0ZXKCMWJyaWxsaWFudC1vcGVuc2VhcmNoLWNsdXN0ZXItbWFz +dGVyLm9ic2VydmFiaWxpdHmCNWJyaWxsaWFudC1vcGVuc2VhcmNoLWNsdXN0ZXIt +bWFzdGVyLm9ic2VydmFiaWxpdHkuc3ZjgkNicmlsbGlhbnQtb3BlbnNlYXJjaC1j +bHVzdGVyLW1hc3Rlci5vYnNlcnZhYmlsaXR5LnN2Yy5jbHVzdGVyLmxvY2FsMA0G +CSqGSIb3DQEBCwUAA4ICAQCr6NEyDLYSfeIa7D+z2zVU5eoprpR/O6CO5koZXBRQ +pRE537ocKYNSDk1aTwemBZa7llaJO6X1wHHOM41o2tzo3Q1vx1LVnv8PJHRQ4WqU +mpOcR0WZNkwEjQgjR0xnjulfVYqD2mVJal6R0xiJLcptyaIexA+IkqYFmIPSgpDG +Tlhkk/jGyB4SJubUEa1lLlDpQBgAGnNSdTBojRFG1a/IAjprhrAplOWI3PtMzWVW +hMbrA/zTzTUT8J1ZtL5zAjIUEGANcjfVjzzP7kxihYnW8oXF5msbZ5GJoX3BLd92 +zFoi4frgIuy7CZP/HRpSMaWEz4t9rkhGpUrxn90V3nx+/zB63EhZmN6lQgjPZJLz +EMy72g8RuDVu6tqg+879I6JFVOcPjqXn+bhCSI3FdQL7YsmnTyFZ4Oi0lu1fDj6/ +YzrNj9GSJoxuhbjO/Skbyp4ZKh1Q+hX0K+Kt9Tt0A37Tl443J8RS+k4X0J4L782y +659e+TwdSd+RoVyKRS0aUU/kWzeVGEq3HLFNwQgqBiozohi/3ENPkvN+gcG/P69/ +KBGHW48BFyUcRA7vx0t9Z821Yy5POdQTI3B6xbjWYY3bZ5ZYFgvjuI8S/+sYoUUO +7L1o/+OJc8Vmc0cgA7AM5ZlCzqr0mfYKsDUySQOqFlYstoEms8kZYz2MI5Qdx95u +cg== +-----END CERTIFICATE----- diff --git a/opensearch-pki/privkey.pem b/opensearch-pki/privkey.pem new file mode 100644 index 0000000..e69de29 diff --git a/opensearch-pki/root-ca-key.pem b/opensearch-pki/root-ca-key.pem new file mode 100644 index 0000000..5f3cce9 --- /dev/null +++ b/opensearch-pki/root-ca-key.pem @@ -0,0 +1,54 @@ +-----BEGIN ENCRYPTED PRIVATE KEY----- +MIIJrTBXBgkqhkiG9w0BBQ0wSjApBgkqhkiG9w0BBQwwHAQITN+TSAIaNdYCAggA +MAwGCCqGSIb3DQIJBQAwHQYJYIZIAWUDBAEqBBA27GFAbFOaDHtVqrPhpnRDBIIJ +UP0NPwrPgb4XXQmQK5uV5oOQAuvQTqNMd7nWNWP1At4WrkCudNcVdCpkxlSyodUy +s/JQ1LBZl5nHYXaud5DikvdvlTXOmKXbwGoMrdy8GzXX/6LS+7ws9GkUcgUrTD/6 +ygifoXyWBvBkmg6lomchphJmd2vsfkvvzQXfz7lXR3UbmSQ8d/vjNpNq5nk34VNy +eI176d6EK/OnRwpOPs+7j9ns9bLnFZ5nnrmZ+u41XxWT8UWeWg4O/UvtspDyXx39 +47N05p/uZ4aBP2MwH6vB2md8usVzR9U+lDzMVW7CeOo4lAhUSoAGgT8HfeCwYVLr +1zpZeA3a+6QbBnu2X/WeslNsJidbCPv8GoMnHKNlzucPN/K756OoyHWVacNbjD2d +Bxm2G9hj8rNQmDeLZ5+pyoSnrAI0Yv0rqfyXx8Wl8S1OkP1+Qms6qh+ixR/2ES8M +0944RQicufCKXqCs+BYAEV30B7+dCrasJW2F5LR5NTgBdEn/CFCirl8lta0F8oGm +blD1Kq9ZbjdqG1vOYr8j1bpvboUbMz2MziUqs7F9W9X0ucaCqKJ2K+4fAbZNPU81 +c/DiifTUzSlUxvEwmoxA6GYDKluIIAHnYCC8rWeQAalVRxs3k9mgeC9U23yKSk5i +2P12WqyCzM87qs4e0xiMhweRo6AyfHz1h/13AKLId5LYK81mpyz7Ri7NQa467k6t +WMGWRv2j/L1TiFrOtdHHPO1WuMqM/RuWw4DfCSlthlHnMszRI9X1wg8Kkq4SrKz8 +A1T8PW2P1I9cGffjIUYouO15zneztk3cY0X7uLmA4f63Ppg0TvYgNEmMiF9Dbe0T +c8cotMPQJKIyIK4sSN1mpG9cbusESjqrwl4iCOoG1qkVMPVk4PAM3F2So58VP9CL +VDY8l17arzOkga3FlF6cz6VDP1DamUTJPfqvjXa9vLXg29eyLntzh03MSt1vinmU +6HHdC4dyeQCbzW0DwuENuOKtbNp4rrJ3J28JRdhAzAN6GaNcdXmH66hPQ4jeR/6/ +29XL+m8SVNScgM9+2QTbEjCqu05NU6dXtCyc4i4WsGyuvz/2cYF+72zi7YHGfVEp +Xuf6g8Ke2i4cgMsq7mMQ+cNsN337mp3NJq9TsDNa615tIoW0YgP+sIyA2ytKxwll +iCkMZBQrgUIK7qIkaxT5TgcSWAsHUB645/dMO4amgYB2cxRLYEfo0VKiirqMhAK2 +4nWC655QV4zE/cCpYWhv48n0JrnBt2h8XGHBlpl5BKp8g78FNlYIfR2xcgHbBUIW +0stOpFCy9Kv1OK+J2hS2uTtktWiwMEVBsCPUhDWoa7xQiUzU622uIHaOWswT/mHA +cRy8HHOAEzGJq15Ah95YN8Iq6C2FBEjl/lILu9vw9fumVPjmT/pGHadKoUS4yGfL +pRft6dUzlkYYIc2A+zFpCEeaS/RTuGrVN3v7mazOScJ/ZC19k0Ssyd+pMDmsWmp0 +v/B77WylCuij1hRRVuq6GAQr/MVUDeOmGWzHIk6BFqwOw44qzfdPl4a8kjvSEI5L +va5Jxx9/7vkGIQOLivkqFd+YyQ6ruVPnNCVYlFu0QOQ8zTdj0wM9SdfDw9L7qJXJ +WOtdbrxIij6ISMnNn4+aElIbMeThmzUEwqukkCvzE4TSOxUSIfcIF3KLHIwCpX1K +zR4oOhUToXgPYqHqmjoGpI3Y0ATTZS+Cw1QUVkAOVDpASB0DA+0wpstwTRoWoAUx +egRB2MexxukL1eji/9lqCAtxjV0JZ6bKvkrzpMhZIkXdputKaUFjijbXS5IZcYuJ +bsllePINHd/1qXZ0eloVPXHOSMiKNyRR/ZAn6TECZusCn9sZxZ9YIPiTElSyANxZ ++9d/8DDj4IWyCxnxfaj671VdDJnqbyoe8NCPYLclzBaHEKWvlvgL6/iGrPSZ7vfV +xrYX0XBLc8aGnk8aBqzPt69bG+8PtQs7Dm9nmU/9K3wQ2EXGmj/cQjxr53oodtgk +bX8YHWwAfBc9v6edyQU3jZQ+YQq8M0Bo6ZDP2OoV9363eiEhsdb8O7dotS5ZqGLm +PnvHlaEwgKARrhqoELcediLd+5PuTCXjGPoF8d75TRCW92DN+47DVk3oyrgNHC1P +OmH93eBL0wxfojEMRnLYnmwWRf+w6a5m8rF+qgf6yAj+nP1KbYU8FsJeWSqPfQ4v +3ArCECh/ipe/jk1rsoRXWAlIar0G+ihxm6h/89Emc84BNzUX0mKB/+A+cp0/MyLi +MJrlMW8LiY5y6W24orNrZB5sOSIGDNsfi1bTV8cMD0xb0DsDqiN4LbCC2GvHwStH +bGVU5OLavIeGx3iQq7JkYw/sfziG9Vk+GSwUwDtVoiG01GgVzw+9xWSdeCLnDYJ3 +18PlhgHr7fxfE62cfWyRSvcruv/b/s1EjCbyCeXbAmNqcN+Mpt59osVCIAGMP2Ns +wvJsUypZfWTaecdIisD3Qbk2N0A2jyfWGNBjSK5ljsLsStPSwi+7/cB3oeTZ03Ra +M/JhMg/FnMoTEeRFtMSIVkuCHQTw3gTamNg1TEaTeLMBiSzbJVLzRBLPfwolO4rf +GJP7b1tc19hbiN8DZg53lj6HY+Vt7rHZPVPbng7j5BzHkpjEmbjuPSHBKh5Ch8Sz +GmR8ET7/9JCfQdh1xC5lap588p3f7jJTMXzHCaszNUF8NGj1rXauGG+06iikF/yx +dFR8KwfRDq01zHEMY3h6Aa7fy1W5uBXG7pBLDOTDqIs36t7Qupk1L83Wqaq85cFe +S8bNMwyCXmXmQN5GipSsFjj9NVCPAER5bj2zd1B31aWaUxO2rcH6IwTP6NjQN/lY +iBU+RKnSOa8KpZkoMyZccZwb1Bqc1tZmCh2qt2r037tipKs1YPLdCVwhac63nFTu +HXTYMVg6lLDShSdyZNheEuHWgZgRUyrSMJ+ta3BeqwINIyBAZnDQ+1bWJT+wPJer +YsZEMVrXNt3vK40Vg8kX6pJNUl5Z+4tZzbNDPgpgUNpvDKCDHm4fc5urs4cm5ASc +SJz75f3zWTIwIQ36YE7S50rZn9iE3a1kUhngTt3vglVs0N70o5WQscZPrGbyWZpQ +b7Sp4SEVvL8LQz+iWowsUmvXP78/UU63BcnxSIxVpB5QQTQ9aLEoe90B7vczX1Ew ++n+nCvFsColQFbNccaziiLnw+ybagIx6Z1/EZvFSQi5Y +-----END ENCRYPTED PRIVATE KEY----- diff --git a/opensearch-pki/root-ca.pem b/opensearch-pki/root-ca.pem new file mode 100644 index 0000000..3903ead --- /dev/null +++ b/opensearch-pki/root-ca.pem @@ -0,0 +1,34 @@ +-----BEGIN CERTIFICATE----- +MIIF7TCCA9WgAwIBAgIUL/aO+ga/XcysjAXlhuXovwLKZBcwDQYJKoZIhvcNAQEL +BQAwgYUxCzAJBgNVBAYTAkJEMQ4wDAYDVQQIDAVEaGFrYTEOMAwGA1UEBwwFRGhh +a2ExEjAQBgNVBAoMCUJyaWxsaWFudDEbMBkGA1UECwwST3BlblNlYXJjaCBSb290 +IENBMSUwIwYDVQQDDBxCcmlsbGlhbnQgT3BlblNlYXJjaCBSb290IENBMB4XDTI2 +MDcyMzE1MDExOVoXDTM2MDcyMDE1MDExOVowgYUxCzAJBgNVBAYTAkJEMQ4wDAYD +VQQIDAVEaGFrYTEOMAwGA1UEBwwFRGhha2ExEjAQBgNVBAoMCUJyaWxsaWFudDEb +MBkGA1UECwwST3BlblNlYXJjaCBSb290IENBMSUwIwYDVQQDDBxCcmlsbGlhbnQg +T3BlblNlYXJjaCBSb290IENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKC +AgEAuyDbdZ1Arqgz+YwJCTqiqDKnS3CDhGzCq+HyX3wrPgWBodPkhrBWwd748f7j +XYX3Pv+PKAtg5Fb7qkfYPVIGAOeCbQldFRgfWtKav2GqpvlyIJs/NenOg1YCr2uU +l17RqO6MAHkzwZMMQCWRW2QbS/pyV4TwzvCqI4ueZs8Rx2wplDIuaOUwI0ES0o3u +Vt2G1YBMiE9CUL9bAiXmd4Q4xkSEDTo9V5IY7ggGb1SSLVSlzD2GdIZ0cwVQ6/70 +u+CQOkM9exHETvxjFNfxk26bTYUBf6pMKeiH7Ll/nr6EUUsMnCIDyTkg+vmkS9ej +Rf5GD0CM+ryuWPbDyG8+sp8xwSufG2t7dPfQI53wVssPJJI9oIlgIIYy22AT2Z8G +J/gYnf01NKDHRWWASaPi0KOgTFWjDnqjoxCAGf5FTTIHwAB5l1/+1vElI26463gx +pVq98W+xSqPCLZMolZQ9MY0n5Gxh/f8d+DOoPUOIWk2jYwoKRFArbNSS6y2JukKv +Ico2sxaHjfHkt7jt0drDKr5+zR9nwTX8U7xAiiSbESzCz9iouOPHG10Qmw9zUTM2 +1w2f2iPEjolZAV1AhU7w1V4pssriX2/59CGWXOUDqcgwc0uhxv4gXTgupBxg+aNr +Yrmfp6wmz7s7yfnXwOlUiTCEmAscAzcd2gBhl/7WiraQdUsCAwEAAaNTMFEwHQYD +VR0OBBYEFHbanj6FGMUfwlC0K+jcO5M9GwApMB8GA1UdIwQYMBaAFHbanj6FGMUf +wlC0K+jcO5M9GwApMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggIB +AAeUUUALNNE436PL/eyzWG7niOvwW81wRGUtgDRriclEZ8t+s3PoL9tbo+3PcuzH +jLlPP+beKckTLFJTfYYCwgGVfGHEq5z5uIKweb20oFHH7zOCK1wURAIIOfqrrw20 +cqcsu4g+sD6ytnYV7f5ODEOdMizcUtkljLJ5byrKIONWakI0iwLKyqOAiFyERclb +0tg8hL4zvDKUFzuRrqxqKJZw3VQe/3RVPV0gDKQozTD43ygAGFVUcrLutvN+eylA +T7X0kMereUTJwSzD5ozxFEqdh9K4vde06kpnIzPKkDjsEf+3yoVxUqDbBxewj/Z8 +hw8fOyAX/cWe/fXfYWOWtiNXbARQwJoQiKoyZptn4joExKYPvC84F+H4Fgfzbuqd +sg/dvJ0qrWFiIYyfAE/M4c7U0CRulgYDMranKHPxqNYUOmiG38OLKL9E2ioWM6Pv +zO6v5oRNik1E7pkEELIAOs4wSc/tn91M5NkiJ82EsDCfZTnEUOBwulG6Rmo/aatj +BYBDhz4vxf7Fc4mwXGW5VWsT3wfUrA+gywUj9vQjM5zJ12l9x5OCwzM12nAgRgWE +Hxd8yLXd4OkMdZEcUrF9ykR0bTgp2Zz0/yOGmJmZbxtMtyFi5LrkzTIhubMKYvnw +qk+mgZRcLqpVrTRa3bhgDW2kIjEOb9Hpz4nLgyhQZB0P +-----END CERTIFICATE----- diff --git a/opensearch-pki/root-ca.srl b/opensearch-pki/root-ca.srl new file mode 100644 index 0000000..20ce188 --- /dev/null +++ b/opensearch-pki/root-ca.srl @@ -0,0 +1 @@ +23272CA9DE2ABA88318F0D44E0A8F1DF006D6D74 diff --git a/values-blackbox.yaml b/values-blackbox.yaml new file mode 100644 index 0000000..2eb1d0a --- /dev/null +++ b/values-blackbox.yaml @@ -0,0 +1,16 @@ +config: + modules: + http_2xx: + prober: http + timeout: 5s + http: + valid_http_versions: ["HTTP/1.1", "HTTP/2.0"] + method: GET + preferred_ip_protocol: "ip4" + http_2xx_insecure_tls: # for any domain running self-signed/expired certs you still want uptime-checked + prober: http + timeout: 5s + http: + method: GET + tls_config: + insecure_skip_verify: true \ No newline at end of file diff --git a/values-kube-prometheus-stack.yaml b/values-kube-prometheus-stack.yaml new file mode 100644 index 0000000..3f75ae4 --- /dev/null +++ b/values-kube-prometheus-stack.yaml @@ -0,0 +1,77 @@ +grafana: + enabled: true + adminPassword: "Enp129s0f0-0bS#rb!L!tyN#vv" + persistence: + enabled: true + size: 10Gi + service: + type: ClusterIP + + + +prometheus: + prometheusSpec: + retention: 30d + retentionSize: "45GB" + resources: + requests: { cpu: 500m, memory: 1Gi } + limits: { cpu: "2", memory: 4Gi } + storageSpec: + volumeClaimTemplate: + spec: + accessModes: ["ReadWriteOnce"] + resources: { requests: { storage: 50Gi } } + + configMaps: + - blackbox-targets + + additionalScrapeConfigs: + - job_name: 'cpanel-node' + static_configs: + - targets: ['bwebhosting.brilliant.com.bd:9100'] + labels: { role: 'cpanel-host' } + - job_name: 'cpanel-apache' + static_configs: + - targets: ['bwebhosting.brilliant.com.bd:9117'] + - job_name: 'cpanel-mariadb' + static_configs: + - targets: ['bwebhosting.brilliant.com.bd:9104'] + - job_name: 'cpanel-process' + static_configs: + - targets: ['bwebhosting.brilliant.com.bd:9256'] + - job_name: 'cpanel-whm' + static_configs: + - targets: ['bwebhosting.brilliant.com.bd:9124'] + - job_name: 'bind-dns' + static_configs: + - targets: ['dns1.intercloud-bd.net:9119','dns2.intercloud-bd.net:9119','dns3.intercloud-bd.net:9119'] + - job_name: 'blackbox-http' + metrics_path: /probe + params: { module: [http_2xx] } + file_sd_configs: + - files: + - /etc/prometheus/configmaps/blackbox-targets/targets.json + relabel_configs: + - source_labels: [__address__] + target_label: __param_target + - source_labels: [__param_target] + target_label: instance + - target_label: __address__ + replacement: blackbox-exporter-prometheus-blackbox-exporter.monitoring.svc.cluster.local:9115 + +alertmanager: + alertmanagerSpec: + storage: + volumeClaimTemplate: + spec: + accessModes: ["ReadWriteOnce"] + resources: { requests: { storage: 5Gi } } + config: + route: + receiver: 'default' + group_by: ['alertname', 'role'] + group_wait: 30s + repeat_interval: 4h + receivers: + - name: default + \ No newline at end of file diff --git a/values-opensearch.yaml b/values-opensearch.yaml new file mode 100644 index 0000000..12a2737 --- /dev/null +++ b/values-opensearch.yaml @@ -0,0 +1,592 @@ +--- +clusterName: "brilliant-opensearch-cluster" +nodeGroup: "master" + +# If discovery.type in the opensearch configuration is set to "single-node", +# this should be set to "true" +# If "true", replicas will be forced to 1 +singleNode: false + +# The service that non master groups will try to connect to when joining the cluster +# This should be set to clusterName + "-" + nodeGroup for your master group +masterService: "opensearch-cluster-master" + +# OpenSearch roles that will be applied to this nodeGroup +# These will be set as environment variable "node.roles". E.g. node.roles=master,ingest,data,remote_cluster_client +roles: + - master + - ingest + - data + - remote_cluster_client + +replicas: 3 + +# if not set, falls back to parsing .Values.imageTag, then .Chart.appVersion. +majorVersion: "" + +global: + # Set if you want to change the default docker registry, e.g. a private one. + dockerRegistry: "" + +# Allows you to add any config files in {{ .Values.opensearchHome }}/config +opensearchHome: /usr/share/opensearch + +# such as opensearch.yml and log4j2.properties +config: + # Values must be YAML literal style scalar / YAML multiline string. + # : | + # + # log4j2.properties: | + # status = error + # + # appender.console.type = Console + # appender.console.name = console + # appender.console.layout.type = PatternLayout + # appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n + # + # rootLogger.level = info + # rootLogger.appenderRef.console.ref = console + opensearch.yml: | + cluster.name: brilliant-opensearch-cluster + + # Bind to all interfaces because we don't know what IP address Docker will assign to us. + network.host: 0.0.0.0 + + # Setting network.host to a non-loopback address enables the annoying bootstrap checks. "Single-node" mode disables them again. + # Implicitly done if ".singleNode" is set to "true". + # discovery.type: single-node + + # Start OpenSearch Security Demo Configuration + # WARNING: revise all the lines below before you go into production + # plugins: + # security: + # ssl: + # transport: + # pemcert_filepath: esnode.pem + # pemkey_filepath: esnode-key.pem + # pemtrustedcas_filepath: root-ca.pem + # enforce_hostname_verification: false + # http: + # enabled: true + # pemcert_filepath: esnode.pem + # pemkey_filepath: esnode-key.pem + # pemtrustedcas_filepath: root-ca.pem + # allow_unsafe_democertificates: true + # allow_default_init_securityindex: true + # authcz: + # admin_dn: + # - CN=kirk,OU=client,O=client,L=test,C=de + # audit.type: internal_opensearch + # enable_snapshot_restore_privilege: true + # check_snapshot_restore_write_privileges: true + # restapi: + # roles_enabled: ["all_access", "security_rest_api_access"] + # system_indices: + # enabled: true + # indices: + # [ + # ".opendistro-alerting-config", + # ".opendistro-alerting-alert*", + # ".opendistro-anomaly-results*", + # ".opendistro-anomaly-detector*", + # ".opendistro-anomaly-checkpoints", + # ".opendistro-anomaly-detection-state", + # ".opendistro-reports-*", + # ".opendistro-notifications-*", + # ".opendistro-notebooks", + # ".opendistro-asynchronous-search-response*", + # ] + ######## End OpenSearch Security Demo Configuration ######## + # log4j2.properties: + +# Extra environment variables to append to this nodeGroup +# This will be appended to the current 'env:' key. You can use any of the kubernetes env +# syntax here +extraEnvs: [] +# - name: MY_ENVIRONMENT_VAR +# value: the_value_goes_here +# Chart version 2.18.0 and App Version OpenSearch 2.12.0 onwards a custom strong password needs to be provided in order to setup demo admin user. +# Cluster will not spin-up without this unless demo config install is disabled. +# - name: OPENSEARCH_INITIAL_ADMIN_PASSWORD +# value: + +# Allows you to load environment variables from kubernetes secret or config map +envFrom: [] +# - secretRef: +# name: env-secret +# - configMapRef: +# name: config-map + +# A list of secrets and their paths to mount inside the pod +# This is useful for mounting certificates for security and for mounting +# the X-Pack license +secretMounts: [] + +hostAliases: [] +# - ip: "127.0.0.1" +# hostnames: +# - "foo.local" +# - "bar.local" + +image: + repository: "opensearchproject/opensearch" + # override image tag, which is .Chart.AppVersion by default + tag: "3" + pullPolicy: "IfNotPresent" + +podAnnotations: {} + # iam.amazonaws.com/role: es-cluster + +# OpenSearch Statefulset annotations +openSearchAnnotations: {} + +# additionals labels +labels: {} + +opensearchJavaOpts: "-Xmx512M -Xms512M" + +resources: + requests: + cpu: "2" + memory: "6Gi" + limits: + cpu: "4" + memory: "8Gi" + +initResources: {} +# limits: +# cpu: "25m" +# memory: "128Mi" +# requests: +# cpu: "25m" +# memory: "128Mi" + +sidecarResources: {} +# limits: +# cpu: "25m" +# memory: "128Mi" +# requests: +# cpu: "25m" +# memory: "128Mi" + +networkHost: "0.0.0.0" + +rbac: + create: false + serviceAccountAnnotations: {} + serviceAccountName: "" + # Controls whether or not the Service Account token is automatically mounted to /var/run/secrets/kubernetes.io/serviceaccount + automountServiceAccountToken: false + +podSecurityPolicy: + create: false + name: "" + spec: + privileged: true + fsGroup: + rule: RunAsAny + runAsUser: + rule: RunAsAny + seLinux: + rule: RunAsAny + supplementalGroups: + rule: RunAsAny + volumes: + - secret + - configMap + - persistentVolumeClaim + - emptyDir + +persistence: + enabled: true + # Set to false to disable the `fsgroup-volume` initContainer that will update permissions on the persistent disk. + enableInitChown: true + # override image, which is busybox by default + # image: busybox + # override image tag, which is latest by default + # imageTag: + labels: + # Add default labels for the volumeClaimTemplate of the StatefulSet + enabled: false + # Add custom labels for the volumeClaimTemplate of the StatefulSet + additionalLabels: {} + # OpenSearch Persistent Volume Storage Class + # If defined, storageClassName: + # If set to "-", storageClassName: "", which disables dynamic provisioning + # If undefined (the default) or set to null, no storageClassName spec is + # set, choosing the default provisioner. (gp2 on AWS, standard on + # GKE, AWS & OpenStack) + # + storageClass: "longhorn" + accessModes: + - ReadWriteOnce + size: 120Gi + annotations: {} + +extraVolumes: [] + # - name: extras + # emptyDir: {} + +extraVolumeMounts: [] + # - name: extras + # mountPath: /usr/share/extras + # readOnly: true + +extraContainers: [] + # - name: do-something + # image: busybox + # command: ['do', 'something'] + +extraInitContainers: [] + # - name: do-somethings + # image: busybox + # command: ['do', 'something'] + +# This is the PriorityClass settings as defined in +# https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass +priorityClassName: "" + +# By default this will make sure two pods don't end up on the same node +# Changing this to a region would allow you to spread pods across regions +antiAffinityTopologyKey: "kubernetes.io/hostname" + +# Hard means that by default pods will only be scheduled if there are enough nodes for them +# and that they will never end up on the same node. Setting this to soft will do this "best effort". +# Setting this to custom will use what is passed into customAntiAffinity. +antiAffinity: "hard" + +# Allows passing in custom anti-affinity settings as defined in +# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity +# Using this parameter requires setting antiAffinity to custom. +customAntiAffinity: {} + +# This is the node affinity settings as defined in +# https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#node-affinity-beta-feature +nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: k3s.io/hostname + operator: NotIn + values: + - k8s-cp-01 + + +# This is the pod affinity settings as defined in +# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity +podAffinity: {} + +# This is the pod topology spread constraints +# https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ +topologySpreadConstraints: [] + +# The default is to deploy all pods serially. By setting this to parallel all pods are started at +# the same time when bootstrapping the cluster +podManagementPolicy: "Parallel" + +# The environment variables injected by service links are not used, but can lead to slow OpenSearch boot times when +# there are many services in the current namespace. +# If you experience slow pod startups you probably want to set this to `false`. +enableServiceLinks: true + +protocol: https +httpPort: 9200 +transportPort: 9300 +metricsPort: 9600 +httpHostPort: "" +transportHostPort: "" + + +service: + labels: {} + labelsHeadless: {} + headless: + annotations: {} + type: ClusterIP + # The IP family and IP families options are to set the behaviour in a dual-stack environment + # Omitting these values will let the service fall back to whatever the CNI dictates the defaults + # should be + # + # ipFamilyPolicy: SingleStack + # ipFamilies: + # - IPv4 + nodePort: "" + annotations: {} + httpPortName: http + transportPortName: transport + metricsPortName: metrics + loadBalancerIP: "" + loadBalancerSourceRanges: [] + externalTrafficPolicy: "" + +updateStrategy: RollingUpdate + +# This is the max unavailable setting for the pod disruption budget +# The default value of 1 will make sure that kubernetes won't allow more than 1 +# of your pods to be unavailable during maintenance +maxUnavailable: 1 + +podSecurityContext: + fsGroup: 1000 + runAsUser: 1000 + +securityContext: + capabilities: + drop: + - ALL + # readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1000 + +securityConfig: + enabled: true + path: "/usr/share/opensearch/config/opensearch-security" + actionGroupsSecret: + configSecret: + internalUsersSecret: + rolesSecret: + rolesMappingSecret: + tenantsSecret: + # The following option simplifies securityConfig by using a single secret and + # specifying the config files as keys in the secret instead of creating + # different secrets for for each config file. + # Note that this is an alternative to the individual secret configuration + # above and shouldn't be used if the above secrets are used. + config: + # There are multiple ways to define the configuration here: + # * If you define anything under data, the chart will automatically create + # a secret and mount it. This is best option to choose if you want to override all the + # existing yml files at once. + # * If you define securityConfigSecret, the chart will assume this secret is + # created externally and mount it. This is best option to choose if your intention is to + # only update a single yml file. + # * It is an error to define both data and securityConfigSecret. + securityConfigSecret: "" + dataComplete: true + data: {} + # config.yml: |- + # internal_users.yml: |- + # roles.yml: |- + # roles_mapping.yml: |- + # action_groups.yml: |- + # tenants.yml: |- + +# How long to wait for opensearch to stop gracefully +terminationGracePeriod: 120 + +sysctlVmMaxMapCount: 262144 + +startupProbe: + tcpSocket: + port: 9200 + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 3 + failureThreshold: 30 + +livenessProbe: {} + # periodSeconds: 20 + # timeoutSeconds: 5 + # failureThreshold: 10 + # successThreshold: 1 + # initialDelaySeconds: 10 + # tcpSocket: + # port: 9200 + +readinessProbe: + tcpSocket: + port: 9200 + periodSeconds: 5 + timeoutSeconds: 3 + failureThreshold: 3 + +## Use an alternate scheduler. +## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ +## +schedulerName: "" + +imagePullSecrets: [] +nodeSelector: {} +tolerations: +- key: "dedicated" + operator: "Equal" + value: "storage" + effect: "NoSchedule" + +# Enabling this will publically expose your OpenSearch instance. +# Only enable this if you have security enabled on your cluster +ingress: + enabled: false + # For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName + # See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress + # ingressClassName: nginx + + annotations: {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + ingressLabels: {} + path: / + hosts: + - chart-example.local + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + +nameOverride: "" +fullnameOverride: "" + +masterTerminationFix: false + +opensearchLifecycle: {} + # preStop: + # exec: + # command: ["/bin/sh", "-c", "echo Hello from the preStart handler > /usr/share/message"] + # postStart: + # exec: + # command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"] + +lifecycle: {} + # preStop: + # exec: + # command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"] + # postStart: + # exec: + # command: + # - bash + # - -c + # - | + # #!/bin/bash + # # Add a template to adjust number of shards/replicas1 + # TEMPLATE_NAME=my_template + # INDEX_PATTERN="logstash-*" + # SHARD_COUNT=8 + # REPLICA_COUNT=1 + # ES_URL=http://localhost:9200 + # while [[ "$(curl -s -o /dev/null -w '%{http_code}\n' $ES_URL)" != "200" ]]; do sleep 1; done + # curl -XPUT "$ES_URL/_template/$TEMPLATE_NAME" -H 'Content-Type: application/json' -d'{"index_patterns":['\""$INDEX_PATTERN"\"'],"settings":{"number_of_shards":'$SHARD_COUNT',"number_of_replicas":'$REPLICA_COUNT'}}' + +keystore: [] +# To add secrets to the keystore: +# - secretName: opensearch-encryption-key + +networkPolicy: + create: false + ## Enable creation of NetworkPolicy resources. Only Ingress traffic is filtered for now. + ## In order for a Pod to access OpenSearch, it needs to have the following label: + ## {{ template "uname" . }}-client: "true" + ## Example for default configuration to access HTTP port: + ## opensearch-master-http-client: "true" + ## Example for default configuration to access transport port: + ## opensearch-master-transport-client: "true" + + http: + enabled: false + +# Deprecated +# please use the above podSecurityContext.fsGroup instead +fsGroup: "" + +## Set optimal sysctl's through securityContext. This requires privilege. Can be disabled if +## the system has already been preconfigured. (Ex: https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html) +## Also see: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ +sysctl: + enabled: false + +## Set optimal sysctl's through privileged initContainer. +sysctlInit: + enabled: false + # override image, which is busybox by default + # image: busybox + # override image tag, which is latest by default + # imageTag: + +## Enable to add 3rd Party / Custom plugins not offered in the default OpenSearch image. +plugins: + enabled: false + installList: [] + # - example-fake-plugin + removeList: [] + # - example-fake-plugin + +# -- Array of extra K8s manifests to deploy +extraObjects: [] + # - apiVersion: secrets-store.csi.x-k8s.io/v1 + # kind: SecretProviderClass + # metadata: + # name: argocd-secrets-store + # spec: + # provider: aws + # parameters: + # objects: | + # - objectName: "argocd" + # objectType: "secretsmanager" + # jmesPath: + # - path: "client_id" + # objectAlias: "client_id" + # - path: "client_secret" + # objectAlias: "client_secret" + # secretObjects: + # - data: + # - key: client_id + # objectName: client_id + # - key: client_secret + # objectName: client_secret + # secretName: argocd-secrets-store + # type: Opaque + # labels: + # app.kubernetes.io/part-of: argocd + # - | + # apiVersion: policy/v1 + # kind: PodDisruptionBudget + # metadata: + # name: {{ template "opensearch.uname" . }} + # labels: + # {{- include "opensearch.labels" . | nindent 4 }} + # spec: + # minAvailable: 1 + # selector: + # matchLabels: + # {{- include "opensearch.selectorLabels" . | nindent 6 }} + +# ServiceMonitor Configuration for Prometheus +# Enabling this option will create a ServiceMonitor resource that allows Prometheus to scrape metrics from the OpenSearch service. +# This only creates the serviceMonitor, to actually have metrics Make sure to install the prometheus-exporter plugin needed for +# serving metrics over the `.Values.plugins` value: +# plugins: +# enabled: true +# installList: +# - https://github.com/aiven/prometheus-exporter-plugin-for-opensearch/releases/download/x.x.x.x/prometheus-exporter-x.x.x.x.zip +serviceMonitor: + # Set to true to enable the ServiceMonitor resource + enabled: false + + # HTTP path where metrics are exposed. + # Ensure this matches your OpenSearch service configuration. + path: /_prometheus/metrics + + # Scheme to use for scraping. + scheme: http + + # Frequency at which Prometheus will scrape metrics. + # Adjust based on your needs. + interval: 10s + + # additional labels to be added to the ServiceMonitor + # labels: + # k8s.example.com/prometheus: kube-prometheus + labels: {} + + # additional tlsConfig to be added to the ServiceMonitor + tlsConfig: {} + + # Basic Auth configuration for the service monitor + # You can either use existingSecret, which expects a secret to be already present with data.username and data.password + # or set the credentials over the helm values, making helm create a secret for you + # basicAuth: + # enaled: true + # existingSecret: my-secret + # username: my-username + # password: my-password + basicAuth: + enabled: false \ No newline at end of file