Initial Working Commit, all opensearch ang grafana is working, grafana plots cpanel and opensearch getting all the log from cpanel, only access_log, syslog and auditd log are parsed

blackbox-sync-cronjob.yaml

@@ -0,0 +1,149 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: blackbox-target-sync
+  namespace: monitoring
+
+spec:
+  schedule: "*/15 * * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 5
+  startingDeadlineSeconds: 300
+
+  jobTemplate:
+    spec:
+      backoffLimit: 2
+      activeDeadlineSeconds: 300
+
+      template:
+        metadata:
+          labels:
+            app.kubernetes.io/name: blackbox-target-sync
+
+        spec:
+          serviceAccountName: blackbox-sync
+          restartPolicy: Never
+
+          containers:
+            - name: sync
+              image: alpine/k8s:1.36.0
+              imagePullPolicy: IfNotPresent
+
+              env:
+                - name: WHM_TOKEN
+                  valueFrom:
+                    secretKeyRef:
+                      name: whm-api-token
+                      key: token
+
+                - name: WHM_HOST
+                  valueFrom:
+                    secretKeyRef:
+                      name: whm-api-token
+                      key: host
+
+              command:
+                - /bin/sh
+                - -ec
+
+              args:
+                - |
+                  echo "Installing required packages..."
+                  apk add --no-cache curl jq ca-certificates >/dev/null
+
+                  API_URL="https://${WHM_HOST}:2087/json-api/listaccts?api.version=1"
+
+                  echo "Requesting account list from WHM host: ${WHM_HOST}"
+
+                  RESPONSE="$(
+                    curl \
+                      --silent \
+                      --show-error \
+                      --fail-with-body \
+                      --connect-timeout 10 \
+                      --max-time 60 \
+                      --header "Authorization: whm root:${WHM_TOKEN}" \
+                      "${API_URL}"
+                  )"
+
+                  API_RESULT="$(
+                    printf '%s' "${RESPONSE}" |
+                    jq -r '.metadata.result // 0'
+                  )"
+
+                  if [ "${API_RESULT}" != "1" ]; then
+                    echo "ERROR: WHM API returned an unsuccessful result."
+                    printf '%s' "${RESPONSE}" | jq .
+                    exit 1
+                  fi
+
+                  printf '%s' "${RESPONSE}" |
+                    jq -r '
+                      .data.acct[]?
+                      | .domain
+                      | select(type == "string")
+                      | select(length > 0)
+                    ' |
+                    sed 's/^[[:space:]]*//;s/[[:space:]]*$//' |
+                    grep -E '^[A-Za-z0-9.-]+\.[A-Za-z]{2,}$' |
+                    tr '[:upper:]' '[:lower:]' |
+                    sort -u \
+                    > /tmp/domains.txt
+
+                  DOMAIN_COUNT="$(
+                    wc -l < /tmp/domains.txt |
+                    tr -d ' '
+                  )"
+
+                  echo "Found ${DOMAIN_COUNT} unique main domains."
+
+                  if [ "${DOMAIN_COUNT}" -eq 0 ]; then
+                    echo "ERROR: WHM returned zero valid domains."
+                    echo "Refusing to overwrite the existing ConfigMap."
+                    exit 1
+                  fi
+
+                  jq -R -s '
+                    split("\n")
+                    | map(select(length > 0))
+                    | map("https://" + .)
+                    | [
+                        {
+                          targets: .,
+                          labels: {
+                            environment: "production",
+                            source: "whm-listaccts"
+                          }
+                        }
+                      ]
+                  ' /tmp/domains.txt > /tmp/targets.json
+
+                  echo "Generated target file:"
+                  jq . /tmp/targets.json
+
+                  TARGET_COUNT="$(
+                    jq 'map(.targets | length) | add // 0' /tmp/targets.json
+                  )"
+
+                  if [ "${TARGET_COUNT}" -eq 0 ]; then
+                    echo "ERROR: Generated target file contains zero targets."
+                    exit 1
+                  fi
+
+                  kubectl create configmap blackbox-targets \
+                    --namespace monitoring \
+                    --from-file=targets.json=/tmp/targets.json \
+                    --dry-run=client \
+                    --output=yaml |
+                    kubectl apply --filename=-
+
+                  echo "Successfully synchronized ${TARGET_COUNT} Blackbox targets."
+
+              resources:
+                requests:
+                  cpu: 25m
+                  memory: 32Mi
+                limits:
+                  cpu: 200m
+                  memory: 128Mi

blackbox-sync-rbac.yaml

@@ -0,0 +1,38 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: blackbox-sync
+  namespace: monitoring
+
+---
+apiVersion:  rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: blackbox-sync
+  namespace: monitoring
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - get
+  - create
+  - update
+  - patch
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: blackbox-sync
+  namespace: monitoring
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: blackbox-sync
+subjects:
+- kind: ServiceAccount
+  name: blackbox-sync
+  namespace: monitoring

grafana-ingress.yaml

@@ -0,0 +1,17 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: grafana-ingress
+  namespace: monitoring
+spec:
+  ingressClassName: nginx
+  rules:
+  - http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: kps-grafana
+            port:
+              number: 80

opensearch-pki/admin-ext.cnf

@@ -0,0 +1,5 @@
+basicConstraints = critical,CA:FALSE
+keyUsage = critical,digitalSignature,keyEncipherment
+extendedKeyUsage = clientAuth
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid,issuer

opensearch-pki/admin-key.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDpuQJM11LzgbEh
+nCmvinx2JGiIYRe807tmm7rnRYY5r0ixz9JBV9HNfXyJc9ez2g3zrTASmtEESFDd
++GGoocg6gpOzg4oYHLdICR685r9mDEY1tdZysQmI+/pXp3kd7g4ok4R8JQIcrvx8
+kbFLzR6ugda8R4lSRzTthLlfmFGGqLXunHg6Vrw/nqsUxvFGgESD+YLJ/q4x3Oxo
+10BsSaNZiV2lI9QYceCWA4EJ24TGebQH1rClnSVwpCRovufwzu9fUNH7NBBZlHW1
+VsiZzO1OfP3oq5vMwyygOtHANLDpH+Blf6XsPtDaE8MqsK5+jw5zmTV9JtsM983v
+ACij6Jz3AgMBAAECggEAIeePuNvnkaF3s5t2xJs/UNgZPedvzRmd7tWaeGAyh32w
++vJd2tLFgZy5iyr92H5CVd4CwkApIAjpijm02QSXCj3U9U6YosTPpaiFB/wlOcWA
+DdyR/lNGQdPjzgFiZYAaF7LGnke0Fbsgr2VnJcrcr43wO6HY/tGLkQUW6xIqiXD6
+8u4RCLp48dq8cE89VfsBFyuVJTBigN8WJxE+7XMEsCCID37idFyTgoZhTShasBAF
+yZUvlREmk/KgCEK3icyycs6C7CxXE7dq7kbMiYRk38GOkKjfjIsLSPVApfTIiibb
+GYmQ+2KLXRZ/9myT9g9tjGLww+wJs49nVXsTFqsduQKBgQD2kz6TLNZ2Vt15oNwM
+8AbwZoq4f37U7BO12znR4J0w8PSLhCMHrYmPZM6QRtVgzJgKxXjSSXfQA+oVvrCa
+rFixSh5gAIEYGRA2XeY3uKgGIeOqqCGvijfGs2z324b3Y14mr9//H4SI6IvwENjg
+CSp4RYnA9r11Ivc8u/iGUB99JQKBgQDyqACJuFezvN8TKHmr1oFS+rR/QAmJlk9y
+OG62c0dbdlzArdzMOPTC2b/IkktgGBM2PEgiNeOWEzbXCPtuWPKIhhrx3dpG9avy
+tswf4g/BHx+hjTCLeKA+o0AkZWhRsRKOGmwgDkFNa29mZYWPNy4KwRJOLxdOY+Z6
+Le308qcM6wKBgEFi7I4Urs503Ihbat8Xa4+mcZTZYmXOMK/h8aRBPw3yZ7bzlGJ9
+12OqJMjHr9/agVsh4JdLGjWURCf+CFEL8P0anZFxsMoWI2F3ZwxRsGTn6bqgmUY2
+jfHoNLZJhbHmrNnve6Po1LmFiU5g+VH3vEZmklAUXktIuW1mn1Hmv2LtAoGAXZNO
+Cc4N/CE0wVWVfh/NZWuK2ZufUfCmGH0MrM1N0kaVxDQH9rVsJgwEuls4OAlwtzSN
++KthZYlpV4l+NHKWrPFSSL1uJHku4v19QDpUKvxOnWUuOEq/OQiJfr+geAhaCHTG
+B6KXqjxpDErQM4dq+Pi1j3L3gOJjifBWWGSO6RsCgYEAufMFodKc5PCYKHPTWqBA
+9Aq9WqDEGN/ngY3hUZ8Sdi3vQyGvmGWbcg+mmvfyNF/FBbjRXzdI3CuVnu73lM3X
+aLon1Qhl9K1XQIkIN4BOMsFOoAC85RGsYkzEUeAprGWuHdEzNcSsuGlVnLyk6apx
+79uhr7J+w2Pe4je+mSgwupU=
+-----END PRIVATE KEY-----

opensearch-pki/admin.csr

@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICxjCCAa4CAQAwgYAxCzAJBgNVBAYTAkJEMQ4wDAYDVQQIDAVEaGFrYTEOMAwG
+A1UEBwwFRGhha2ExEjAQBgNVBAoMCUJyaWxsaWFudDEiMCAGA1UECwwZT3BlblNl
+YXJjaCBBZG1pbmlzdHJhdG9yczEZMBcGA1UEAwwQb3BlbnNlYXJjaC1hZG1pbjCC
+ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOm5AkzXUvOBsSGcKa+KfHYk
+aIhhF7zTu2abuudFhjmvSLHP0kFX0c19fIlz17PaDfOtMBKa0QRIUN34YaihyDqC
+k7ODihgct0gJHrzmv2YMRjW11nKxCYj7+leneR3uDiiThHwlAhyu/HyRsUvNHq6B
+1rxHiVJHNO2EuV+YUYaote6ceDpWvD+eqxTG8UaARIP5gsn+rjHc7GjXQGxJo1mJ
+XaUj1Bhx4JYDgQnbhMZ5tAfWsKWdJXCkJGi+5/DO719Q0fs0EFmUdbVWyJnM7U58
+/eirm8zDLKA60cA0sOkf4GV/pew+0NoTwyqwrn6PDnOZNX0m2wz3ze8AKKPonPcC
+AwEAAaAAMA0GCSqGSIb3DQEBCwUAA4IBAQCTTUuzZYPGSwdY8QHG0uhp3A1tWYJI
+Dr91bxL400A555lKfc7Jkr/Dp370DSQvZdsPDYatglT48n78qst14icwc6LOT+GR
+l9ytPRL+XmJawzC8eDdSZCtNkiyV1BT39hVWIErpqRGxqwQ54N0lMxgZjQVPPKzQ
+JmgpSQUoqBG1gj+ID9A2Uz19Z37ZYr09k3vfvKY+7frBqKFHoL2BINeaS/ZWjWTp
+EMayeCtSCaKufebMiOzyw7XJHmcpynukVCrBgElRG/U9Gp9Q/Qm64GEwjC+URn2Q
+brYVWeeVhrpGuIc8choJttW14B3lUtzZM4abEU9ib0MDAaPTu6onvfXM
+-----END CERTIFICATE REQUEST-----

opensearch-pki/admin.pem

@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIFCjCCAvKgAwIBAgIUIycsqd4quogxjw1E4Kjx3wBtbWwwDQYJKoZIhvcNAQEL
+BQAwgYUxCzAJBgNVBAYTAkJEMQ4wDAYDVQQIDAVEaGFrYTEOMAwGA1UEBwwFRGhh
+a2ExEjAQBgNVBAoMCUJyaWxsaWFudDEbMBkGA1UECwwST3BlblNlYXJjaCBSb290
+IENBMSUwIwYDVQQDDBxCcmlsbGlhbnQgT3BlblNlYXJjaCBSb290IENBMB4XDTI2
+MDcyMzE1MDc0M1oXDTI4MTAyNTE1MDc0M1owgYAxCzAJBgNVBAYTAkJEMQ4wDAYD
+VQQIDAVEaGFrYTEOMAwGA1UEBwwFRGhha2ExEjAQBgNVBAoMCUJyaWxsaWFudDEi
+MCAGA1UECwwZT3BlblNlYXJjaCBBZG1pbmlzdHJhdG9yczEZMBcGA1UEAwwQb3Bl
+bnNlYXJjaC1hZG1pbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOm5
+AkzXUvOBsSGcKa+KfHYkaIhhF7zTu2abuudFhjmvSLHP0kFX0c19fIlz17PaDfOt
+MBKa0QRIUN34YaihyDqCk7ODihgct0gJHrzmv2YMRjW11nKxCYj7+leneR3uDiiT
+hHwlAhyu/HyRsUvNHq6B1rxHiVJHNO2EuV+YUYaote6ceDpWvD+eqxTG8UaARIP5
+gsn+rjHc7GjXQGxJo1mJXaUj1Bhx4JYDgQnbhMZ5tAfWsKWdJXCkJGi+5/DO719Q
+0fs0EFmUdbVWyJnM7U58/eirm8zDLKA60cA0sOkf4GV/pew+0NoTwyqwrn6PDnOZ
+NX0m2wz3ze8AKKPonPcCAwEAAaN1MHMwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8E
+BAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwIwHQYDVR0OBBYEFOGZPf44A2ZKwCAO
+OlsIRbruZGBdMB8GA1UdIwQYMBaAFHbanj6FGMUfwlC0K+jcO5M9GwApMA0GCSqG
+SIb3DQEBCwUAA4ICAQBYscZvYPyaudP9KyXMsPd+2Ym8gXUdbjhjBnh7pAyM5Nvr
+LEAWGuSIQbw9MDEA1InbFoz8cA8AQTEdfymBM0WTnJGjospcQaBV5M7UvabVDxMT
+CDny3mOwJ32eJcZFbVjcHQkq0k7DLrtKdMCWxZXGuXzIdvpp2xO5cG6WcyFeQ0VL
+RuyyAdFnlMuRcMK2shHzk+yUHaTookLKX+Zf0aePhnuL00c0iihJl9yXoKFsQDzc
+tYhW6gAeTUzU+QNQXFSgcNvhJh0NUUPyijs6TYfm/Nv7Kw14HcbWntAU9V61b/76
+WG3HINzq0KtBqwmT8rk5bTrlesegvC1TyJ6n9Le7uN8dccmbHzHOLaMBWqkhxmll
+5cYpCfPPdoWnAlkZprkcQvrNgqzLfspspwTZA3nyuyEVnJa77Ff5TvVh0ZWvAh2F
+T6+VzMx8CSVyeg1B75T5dSDnZ/6wll32NhfvLj7E8tFFRAXwOhtbpBMKVTzRhanW
+vDqekFE+3VgLhy3/nrNFMT+z7QZrAIEyAhWdn9qtmXK2be6smOg12BP2n7vlpHBo
+DMHvdi0f6m79VPduC66HS6m08ochfThxH4pCRM4f6vGa5uAls4E+uoyGxrIlf44b
+AXlxOtQ2NJznooo6sL4qsWu/UfZAMuYJa7ZV8X3GgZZK9vkrKorEkvUKmvpJoA==
+-----END CERTIFICATE-----

opensearch-pki/data-prepper-ingress.cnf

@@ -0,0 +1,22 @@
+[req]
+prompt = no
+distinguished_name = subject
+req_extensions = server_extensions
+
+[subject]
+C = BD
+ST = Dhaka
+L = Dhaka
+O = Brilliant
+OU = Observability
+CN = 118.67.213.76
+
+[server_extensions]
+basicConstraints = critical,CA:FALSE
+keyUsage = critical,digitalSignature,keyEncipherment
+extendedKeyUsage = serverAuth
+subjectAltName = @alternative_names
+
+[alternative_names]
+IP.1 = 118.67.213.76
+IP.2 = 10.40.50.22

opensearch-pki/data-prepper-ingress.crt

@@ -0,0 +1,32 @@
+-----BEGIN CERTIFICATE-----
+MIIFkzCCA3ugAwIBAgIUIycsqd4quogxjw1E4Kjx3wBtbXQwDQYJKoZIhvcNAQEL
+BQAwgYUxCzAJBgNVBAYTAkJEMQ4wDAYDVQQIDAVEaGFrYTEOMAwGA1UEBwwFRGhh
+a2ExEjAQBgNVBAoMCUJyaWxsaWFudDEbMBkGA1UECwwST3BlblNlYXJjaCBSb290
+IENBMSUwIwYDVQQDDBxCcmlsbGlhbnQgT3BlblNlYXJjaCBSb290IENBMB4XDTI2
+MDgwNjA1MzAxMloXDTI3MDgwNjA1MzAxMlowcTELMAkGA1UEBhMCQkQxDjAMBgNV
+BAgMBURoYWthMQ4wDAYDVQQHDAVEaGFrYTESMBAGA1UECgwJQnJpbGxpYW50MRYw
+FAYDVQQLDA1PYnNlcnZhYmlsaXR5MRYwFAYDVQQDDA0xMTguNjcuMjEzLjc2MIIB
+ojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAvpQ1+fi+GWFbDUP/f1k0x4GT
+Hgotk06uskS58neorpKY72LcOfyuowHzrERDhwI8j9/CiA4bYtO3YfVi8P7pdJ1L
+I4J4hMcUqpOTI5PS1QFZRIq91YChr3pUNDfyplRd+ezaicYDeHI4IaMJHQ+EzWQ6
+Tpj2fa7/Ams8mzvpkJIpTwTh4MywHqzU1r3jrpv5dUAhTmRXbgjZVXoUaLlHg0Rw
+5KALnxDEC1sLzOwRKVDZlGg9xVqCdgKvPdf0FJErA8PwdZ1iT6wG7hEIodVHX2tK
+UeNyFqIIaC9G5TMy8aRSlSPifW9tcqdntKYYLiccxsFgmKMLO9Vf+Cqljp/80Nl0
+I6jzpWwG7/gVxiGzn0+09SbgTtKV3BxXjkBW7YDsWPLd9bx1M+Up1xEaUfED2NkP
+OE6WxKGPwH24gFPG8nUchG0n90zeQ9Kbpw1EG3GGaQAMXG1y1osSllSFoMf2oewR
+nsyFl8ihuB4PMUHrfz1na50RHsADZWkcJxg7odJbAgMBAAGjgY0wgYowDAYDVR0T
+AQH/BAIwADAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwFQYD
+VR0RBA4wDIcEdkPVTIcECigyFjAdBgNVHQ4EFgQU1qhGuAGNRxXyc3SJYsTvIgHa
+h5QwHwYDVR0jBBgwFoAUdtqePoUYxR/CULQr6Nw7kz0bACkwDQYJKoZIhvcNAQEL
+BQADggIBAHrUPveLumsyfFQLDanvNsH5shWw+kA5J+jlFImIcZdWgwcJrC8FQ13R
+MfBj/2zl82ULyOR/IhjK/+a62pVerA28BZFnXUf6VLq1A+zmDTJsYHUnPUl0TA0l
+xp8/aWwywJMaMV+6cP27eVhPeRRcG89hx36reGAHxhUPcdCceTF6qmTFK6kBg4KC
+EFU+xEACnkOHcqOpPrNPeU87JxZys1HdF23r4ihfkvlT/FhwlXARe2ehdohFu3gX
+PDTgFmWg/w5eVZnh0DOPwLm7mXDSOY+e5Q4BSbwZHJq+v0l3D8jbKt9fg+5P5tQG
+FgC3ZCMwwxCxJzFMZe+Ubm/MfISf0f5n8A51CBtuDgm/I3XG0PQY9VcTRXJUGuaP
+Fx6oqeEv/ZPiSKwZtKLdPe6D5vvJ8VkBcy/Icjxt8MkPuhqOAucD7cwdueL/BaIw
+cXb6rpfDRlYoSNRfbkZEvP1EVHxvsrS6xpf/VzCM2Rtz3GPuBnWmChPxOSlBZIot
+kNCo3KwYrpXZleAkrE38afEoNBYFbi2dyIz8klujTzryP9EdAOh9Km5H6kb7ml1m
+6Likyb7MBpXCjottsgT7bTVVQNuquL2SRwybGIIywpkXKngoHeZaAgCDk52MtqxE
+1i7Brrsw2B2jMR6fSyMf4lBLN6Yb8FlCvY5t4m6s4IUhqUyUQhI+
+-----END CERTIFICATE-----

opensearch-pki/data-prepper-ingress.csr

@@ -0,0 +1,24 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIEETCCAnkCAQAwcTELMAkGA1UEBhMCQkQxDjAMBgNVBAgMBURoYWthMQ4wDAYD
+VQQHDAVEaGFrYTESMBAGA1UECgwJQnJpbGxpYW50MRYwFAYDVQQLDA1PYnNlcnZh
+YmlsaXR5MRYwFAYDVQQDDA0xMTguNjcuMjEzLjc2MIIBojANBgkqhkiG9w0BAQEF
+AAOCAY8AMIIBigKCAYEAvpQ1+fi+GWFbDUP/f1k0x4GTHgotk06uskS58neorpKY
+72LcOfyuowHzrERDhwI8j9/CiA4bYtO3YfVi8P7pdJ1LI4J4hMcUqpOTI5PS1QFZ
+RIq91YChr3pUNDfyplRd+ezaicYDeHI4IaMJHQ+EzWQ6Tpj2fa7/Ams8mzvpkJIp
+TwTh4MywHqzU1r3jrpv5dUAhTmRXbgjZVXoUaLlHg0Rw5KALnxDEC1sLzOwRKVDZ
+lGg9xVqCdgKvPdf0FJErA8PwdZ1iT6wG7hEIodVHX2tKUeNyFqIIaC9G5TMy8aRS
+lSPifW9tcqdntKYYLiccxsFgmKMLO9Vf+Cqljp/80Nl0I6jzpWwG7/gVxiGzn0+0
+9SbgTtKV3BxXjkBW7YDsWPLd9bx1M+Up1xEaUfED2NkPOE6WxKGPwH24gFPG8nUc
+hG0n90zeQ9Kbpw1EG3GGaQAMXG1y1osSllSFoMf2oewRnsyFl8ihuB4PMUHrfz1n
+a50RHsADZWkcJxg7odJbAgMBAAGgWzBZBgkqhkiG9w0BCQ4xTDBKMAwGA1UdEwEB
+/wQCMAAwDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMBUGA1Ud
+EQQOMAyHBHZD1UyHBAooMhYwDQYJKoZIhvcNAQELBQADggGBALIadeINuzDeYMGD
+NzIWjMZ09SIlFwf69Nlc5XjkhnUiaAZ28iVkMSwJKGeuHakVLKeGseZAIODjq+dM
+wk3pMdmreYlxIxsaVa+yZ2S9cYBLX19PBjnwEZn4VjW7NNeklwrnm1o1X3z72mdl
+Zl9Fx61AMLHYIuwO2NwDg7VykhI0CHwLGtI91+6Jj5MVpfZtv7v0O8wKb2FdewcN
+C0gPtsduVyYjur0U9BuJ+8iDlUpJmdhn0TxVfafOGHzeBYLzC3oaOcWRmOdABay2
+AOMVvTiznkZfuTHSGBpRskBUtimoQ89eDlUkz2aZSQ2oMHOhk92hBA3jNPipaM7D
+nb+Izo1742/3jUNnAjph6s7eyUVk2fvxrS+7jiLUiET5aEgy3is6P6q4tDJgMdbX
+81zzoBdORG2rDlSQf7Rf0cddIsqz6W5e/ppqE3zDoRlOI42DAiAxK21TdqqGiP3s
+g0YvNRrTTltV4y90GABbPDGTt2FyjzChJtUQBw/oDBxkimTSlA==
+-----END CERTIFICATE REQUEST-----

opensearch-pki/data-prepper-ingress.key

@@ -0,0 +1,40 @@
+-----BEGIN PRIVATE KEY-----
+MIIG/gIBADANBgkqhkiG9w0BAQEFAASCBugwggbkAgEAAoIBgQC+lDX5+L4ZYVsN
+Q/9/WTTHgZMeCi2TTq6yRLnyd6iukpjvYtw5/K6jAfOsREOHAjyP38KIDhti07dh
+9WLw/ul0nUsjgniExxSqk5Mjk9LVAVlEir3VgKGvelQ0N/KmVF357NqJxgN4cjgh
+owkdD4TNZDpOmPZ9rv8CazybO+mQkilPBOHgzLAerNTWveOum/l1QCFOZFduCNlV
+ehRouUeDRHDkoAufEMQLWwvM7BEpUNmUaD3FWoJ2Aq891/QUkSsDw/B1nWJPrAbu
+EQih1Udfa0pR43IWoghoL0blMzLxpFKVI+J9b21yp2e0phguJxzGwWCYows71V/4
+KqWOn/zQ2XQjqPOlbAbv+BXGIbOfT7T1JuBO0pXcHFeOQFbtgOxY8t31vHUz5SnX
+ERpR8QPY2Q84TpbEoY/AfbiAU8bydRyEbSf3TN5D0punDUQbcYZpAAxcbXLWixKW
+VIWgx/ah7BGezIWXyKG4Hg8xQet/PWdrnREewANlaRwnGDuh0lsCAwEAAQKCAYAD
+se6fUMn+xqXJSrmNcov/bO0OoWE41fG1KyKf0jTHDbiWtkf8J9YK+w1fwwMRfw2a
+4dptC45PCuPSARFQsuCROOuCs2jldNFbF/lmWzC0neNpMiIeyEZaQfjtT5hjeTHz
+7Tpffs4FFnyCynJxdHeSs+Vy2KxkIMcjo4iinzVsGX62NYCw/HGoZpl0gGywWf3V
+iXob1v41op5JdfsnUfr8+eVmdA6a9Zbs0XBtIgvtzSTVfR/qz6fFOfrD1t1jTgfg
+OT7jOpCu8HxoofZaeLXAzcNvS7eZL5Yv5PqnApTelk2SEQZXiww+5apcKDDuZ46y
+7ljUcjiX7QRdsRlCLlHTJn5Jy5sAynifB8XYCDfTy/rvmYYnTDU/PLLg8aqSk8UK
+yk+gLCWzoewextfjZTtn4/gFmvGpRryy/KB2u4LjH8cqRHDRHtorII4+XDZOVIuO
+dcHpl96OrJOWZsdK+TPfIx/G3BLpH+MqPaCu/IZFPli7lTYyGpb8Y1S4+ktnTkEC
+gcEA7Bkz1hLm0gtoz9YLKMtEFoK+6yUbrTHVdL/rUtkBmPX1lM0OdfQ8bXzZ16gJ
+lyN0UeNVq6vB36Q4CKC+t0eHyaRrCOtJ8foljI9jQhHWrAE6ls/2Fjl/KjcA8J5/
+SLKp+fc4FjPcEMh0oX0nqB91eZC8WzfB4XqOnE/6bTNmNIX5R+zChlk7un3kaviI
+f5Q1f3a6MvD0nkkV1QNVOUH8H71safaNbHxY6Vf+d3guLHB7M1bWcDIprVfx2hVM
+1MXTAoHBAM6kvMvXDu57rb3afUBHe5e2iDuqadbu2RDiFbs0EnzX9+x5qtCrlisx
+0ohmEHwNpLtOG44QU/D0Y0sdDSGSNd+nt6ceec5Ha/cS1GbnVDeTgFznWc2/H6vc
+2nLPmydsSaU5e3efDcPTbEVd9Fx/VGQ+ZvZHmb7OxBWspPP4kEuAALV2X3xM9jeo
+QC71+a+0pGL1gH8WYpN/DAEKvIrhz/9Lm2ei17FQyu5P0XmcoDls5NjKCNr814Hg
+DTojF09EWQKBwQDr2ZFKvL8P/I3LcQrcyZFO23VU+VDYhvuxETdHH7jU0H9vEhjs
+A/uJdDs5j4dlD+nXE741K/MUMbw4AjwCYtZmvHSgCEtqCnUQIP0Ktz83vFKG7V/r
+e6xow2GQ/QQx3yilqCzDITMpINZBrAC9lg+ITOmcRerMD93+kHaeN8ZVmbAYBY+d
+He7osXJI2dWhfLCkkDoZQVNb+65viFDOTfhKzLNMdxt30BARqfFt7wRRKFwqQQke
+Mz4nB792F+kUdDkCgcEAyrVdotR/iEB5ChGn5oN44TWk5GriUn6RHve5e5+0NxWg
+1i/v+a0orYy9SyJcL2Uu4LLZYv3vaiJCuS9xbyo/gPvEs8K4mDsF1SR6icuJmM8w
+D3K/bI59IhmPjSrMt9qJT/RYgtrbJOtkfZOSH56kiYWReSx5zGyGfACU++MsoXOa
+vme1eXkB201IUQjoe41H6O+Nsp2h67CodOk0VUT4xiZD92EOF5n6x9Yy1gpoPozs
+3SErmK6JNZU1RH+h4RdZAoHAEUvuI4pUW7mS6eQT8iWwkJ2kEj57lQYVMA2gG5jN
+LIHRs8dvg3PyK20V1hkBJgzBpf3Dl3Io/H3bpuSSJNpp7Ign9SsI3B5YNBcm0AJo
+Z7offqq4G8JYNdVwDsOLuB1zd9BiMpLPgcg2CB5y99QGIzsYhPqMrUNgfCDJR/ad
+sqTPSGBlqNgymPZSKhVSsOZHDGTfcJuxwfZrEPJIZnM5FPFiPQmBMkWKncqL/SEQ
+f8nxX2u4RpIOiAQJPMVU6GD1
+-----END PRIVATE KEY-----

opensearch-pki/node-0-ext.cnf

@@ -0,0 +1,18 @@
+basicConstraints = critical,CA:FALSE
+keyUsage = critical,digitalSignature,keyEncipherment
+extendedKeyUsage = serverAuth,clientAuth
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid,issuer
+
+subjectAltName = @alt_names
+
+[alt_names]
+DNS.1 = brilliant-opensearch-cluster-master-0
+DNS.2 = brilliant-opensearch-cluster-master-0.brilliant-opensearch-cluster-master-headless
+DNS.3 = brilliant-opensearch-cluster-master-0.brilliant-opensearch-cluster-master-headless.observability
+DNS.4 = brilliant-opensearch-cluster-master-0.brilliant-opensearch-cluster-master-headless.observability.svc
+DNS.5 = brilliant-opensearch-cluster-master-0.brilliant-opensearch-cluster-master-headless.observability.svc.cluster.local
+DNS.6 = brilliant-opensearch-cluster-master
+DNS.7 = brilliant-opensearch-cluster-master.observability
+DNS.8 = brilliant-opensearch-cluster-master.observability.svc
+DNS.9 = brilliant-opensearch-cluster-master.observability.svc.cluster.local

opensearch-pki/node-0-key.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC1hKpNGQvjDpA6
+l8OUjNpAaQXxG2+9huRW7B/LwR8yF0ZQEFppAxLuGT6oV402XDV+lThEw+2zBfcf
+ExFOa4EDM6kC4gd6KAA8KV+K0slZjqn08tRywfdMkvESMBa8QDjHLLlrANHE+NvP
+nXxuajHtlJMD7LaHGWd8BJQqwjLv6pKtj+Z2b93nWcRKG0k5X6agHXpuzfWeg0b8
+ELClEhQjivcAMD/O2B3bXJpaRb2c5+XLYd0a0uTn1/yDvXD2gq/oY3lJUcsyE3J2
+czlZoR/OWbLVYqhnxzkr4hmwE8NQkuinHTgHuALC53omLKU8bEXhFeWnk4ZqQhEx
+K3MYv8XNAgMBAAECggEABbNzTyqV4f1ncD+rUoi9+L8+WDKUEYV2uc1+uNKJnUl3
+2YnknQm4rXu407wJi7HdCEBoMlizqCdsJIYKdBu87eclzBkMl7yWjU0rWrErcRb2
++uIpjqp4OZJ1OddYJMog6Q3cNk0h9CgbbJY1/e3Ilaf7RL30LvgQSlKGfh/3+Or9
+MIBei1LDCTE5GQQQpWGYXJNNg2SAzGsWvZXNgfKFy0eeOEC1KwLNqicL2tQR+zdl
+/T1sxVzu3CNZIIUAmgUx9sWjpbmSu33/5k1PKu7IuJp4mzM4BL58VVjE57jS7NgB
+QN4b/6NoFexQFuwdA+eeWyMOM3AfvJPGsT6SAipMYQKBgQDuuXWyyQpJJ+mhvOIz
+lFfoFTWzU5nBzc++IJ9dDM+LGNiRUiyTfGHt7Q3Q98QmH1t3KejwwvCyglixXq6J
+kxLeq38Y7rK51MOHt1x3CEgVxV9ocwY0RRICW2xptbf6Uo9Yb+nfjjHyCeOa88Rw
+yqojb/V6MLRUEIV7RDm2g3sblQKBgQDCp2tetPymH8tjZyUPqSVgfuyooaYFWeXt
+WWfndpe4njv5U3BShMtsNy88kbxRuSieT3Wa8nlSuXbYPbWW4Aq0WJf1o3noEJD0
+3bMz4ZWcNRsj6T5+gSsRcMNY8GamQDBTSfomofouPavF64ftd4ZnQBKdJubC/c2X
+VSK/2YKzWQKBgQCVQVEsUfPjX1f8bosC8rmveitUDm3wtQww9FaPJ+ZPMl6dJUKH
+h9n2lyLvRynVJ//Y1lQ0y70P7t0jMG5xx4mhvJm/beZCt5r0rJjcN0pSik+nj1sO
+rSygWqbCxQHdOWc0ROx1gIMLsFEk3UoxtxR/CY3yMqdcc+Pw+OwYh8YdrQKBgQC/
+aFnQWzBFOuaI7Jgo+i7i4GxetfXHNUs/RbdCh/9Rb2eSGFZPDn3p/6nXaYdA5U3n
+vkLrBpv+mJkgsi2qGszr4mIrDYGGjSO9ZXQeBClV3XK+sVDenK15DOVKw7psqJnc
+jNYKvyR/6+zJRn33KJ1lUj/7gJFSFLjhorn05TH8oQKBgB8LgPFdS/WtyjrOKBu8
+4whBFfEdw16yY5TGCLpBch1GkWxApguKt2NiUsMe07RwWZBwSYClupDUCbTUhxBJ
+SeIqCXChmgmScEvX6LGGIyE9MFQz3lnvnguHNJ/JpMFFSouM+fGh8yv7XBicBAGK
+z+zivp+dDfEKc5UwO1sv/UT3
+-----END PRIVATE KEY-----

opensearch-pki/node-0.csr

@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICvzCCAacCAQAwejELMAkGA1UEBhMCQkQxDjAMBgNVBAgMBURoYWthMQ4wDAYD
+VQQHDAVEaGFrYTESMBAGA1UECgwJQnJpbGxpYW50MRkwFwYDVQQLDBBPcGVuU2Vh
+cmNoIE5vZGVzMRwwGgYDVQQDDBNvcGVuc2VhcmNoLW1hc3Rlci0wMIIBIjANBgkq
+hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtYSqTRkL4w6QOpfDlIzaQGkF8RtvvYbk
+Vuwfy8EfMhdGUBBaaQMS7hk+qFeNNlw1fpU4RMPtswX3HxMRTmuBAzOpAuIHeigA
+PClfitLJWY6p9PLUcsH3TJLxEjAWvEA4xyy5awDRxPjbz518bmox7ZSTA+y2hxln
+fASUKsIy7+qSrY/mdm/d51nEShtJOV+moB16bs31noNG/BCwpRIUI4r3ADA/ztgd
+21yaWkW9nOfly2HdGtLk59f8g71w9oKv6GN5SVHLMhNydnM5WaEfzlmy1WKoZ8c5
+K+IZsBPDUJLopx04B7gCwud6JiylPGxF4RXlp5OGakIRMStzGL/FzQIDAQABoAAw
+DQYJKoZIhvcNAQELBQADggEBAJwG1VOeIqHJcl8r7djm/D7b3t+yzeJ1Xb3PD3MM
+yR65BQN6ZPVCIz4Co7qEu3Y5x8gDCqNyEXPpZdqQZ5gOXr7TBo57Uu/5jSO7ufIE
+n5FcCKG1RSCaXUTDkR/U3+5GR7legz9gBBbYS/muk+V6F068WtqgSfkDI4vTM7Jk
+8EHFT0zo5XbNz6uxfdgAErH5599+tuZ2xvdJU9U54/501fDR1/y9edJSLos37poN
+TGOocieska/3r3J47kc7MJij4jimHjqjv0kA5BLDk4BjnmFey0H7V+L82/d5bWa+
+V1djH1y1zT3gBrsWx64L93rcsWHlba/Z8vI9/En3sWYVv5s=
+-----END CERTIFICATE REQUEST-----

opensearch-pki/node-0.pem

@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIIHrTCCBZWgAwIBAgIUIycsqd4quogxjw1E4Kjx3wBtbW4wDQYJKoZIhvcNAQEL
+BQAwgYUxCzAJBgNVBAYTAkJEMQ4wDAYDVQQIDAVEaGFrYTEOMAwGA1UEBwwFRGhh
+a2ExEjAQBgNVBAoMCUJyaWxsaWFudDEbMBkGA1UECwwST3BlblNlYXJjaCBSb290
+IENBMSUwIwYDVQQDDBxCcmlsbGlhbnQgT3BlblNlYXJjaCBSb290IENBMB4XDTI2
+MDcyMzE1MTMyN1oXDTI4MTAyNTE1MTMyN1owejELMAkGA1UEBhMCQkQxDjAMBgNV
+BAgMBURoYWthMQ4wDAYDVQQHDAVEaGFrYTESMBAGA1UECgwJQnJpbGxpYW50MRkw
+FwYDVQQLDBBPcGVuU2VhcmNoIE5vZGVzMRwwGgYDVQQDDBNvcGVuc2VhcmNoLW1h
+c3Rlci0wMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtYSqTRkL4w6Q
+OpfDlIzaQGkF8RtvvYbkVuwfy8EfMhdGUBBaaQMS7hk+qFeNNlw1fpU4RMPtswX3
+HxMRTmuBAzOpAuIHeigAPClfitLJWY6p9PLUcsH3TJLxEjAWvEA4xyy5awDRxPjb
+z518bmox7ZSTA+y2hxlnfASUKsIy7+qSrY/mdm/d51nEShtJOV+moB16bs31noNG
+/BCwpRIUI4r3ADA/ztgd21yaWkW9nOfly2HdGtLk59f8g71w9oKv6GN5SVHLMhNy
+dnM5WaEfzlmy1WKoZ8c5K+IZsBPDUJLopx04B7gCwud6JiylPGxF4RXlp5OGakIR
+MStzGL/FzQIDAQABo4IDHTCCAxkwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMC
+BaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB0GA1UdDgQWBBSdvcR3
+55GXQPSccLe6w2/LiNCH0jAfBgNVHSMEGDAWgBR22p4+hRjFH8JQtCvo3DuTPRsA
+KTCCApgGA1UdEQSCAo8wggKLgiVicmlsbGlhbnQtb3BlbnNlYXJjaC1jbHVzdGVy
+LW1hc3Rlci0wglJicmlsbGlhbnQtb3BlbnNlYXJjaC1jbHVzdGVyLW1hc3Rlci0w
+LmJyaWxsaWFudC1vcGVuc2VhcmNoLWNsdXN0ZXItbWFzdGVyLWhlYWRsZXNzgmBi
+cmlsbGlhbnQtb3BlbnNlYXJjaC1jbHVzdGVyLW1hc3Rlci0wLmJyaWxsaWFudC1v
+cGVuc2VhcmNoLWNsdXN0ZXItbWFzdGVyLWhlYWRsZXNzLm9ic2VydmFiaWxpdHmC
+ZGJyaWxsaWFudC1vcGVuc2VhcmNoLWNsdXN0ZXItbWFzdGVyLTAuYnJpbGxpYW50
+LW9wZW5zZWFyY2gtY2x1c3Rlci1tYXN0ZXItaGVhZGxlc3Mub2JzZXJ2YWJpbGl0
+eS5zdmOCcmJyaWxsaWFudC1vcGVuc2VhcmNoLWNsdXN0ZXItbWFzdGVyLTAuYnJp
+bGxpYW50LW9wZW5zZWFyY2gtY2x1c3Rlci1tYXN0ZXItaGVhZGxlc3Mub2JzZXJ2
+YWJpbGl0eS5zdmMuY2x1c3Rlci5sb2NhbIIjYnJpbGxpYW50LW9wZW5zZWFyY2gt
+Y2x1c3Rlci1tYXN0ZXKCMWJyaWxsaWFudC1vcGVuc2VhcmNoLWNsdXN0ZXItbWFz
+dGVyLm9ic2VydmFiaWxpdHmCNWJyaWxsaWFudC1vcGVuc2VhcmNoLWNsdXN0ZXIt
+bWFzdGVyLm9ic2VydmFiaWxpdHkuc3ZjgkNicmlsbGlhbnQtb3BlbnNlYXJjaC1j
+bHVzdGVyLW1hc3Rlci5vYnNlcnZhYmlsaXR5LnN2Yy5jbHVzdGVyLmxvY2FsMA0G
+CSqGSIb3DQEBCwUAA4ICAQBMsT5B+BsVzdkp4djKCWJuKkMybbttYolVyzZmqz7F
+lOoPG/3pU1LxjH+UK1YTHNfZaFoTjQ/OXT/NFrf/rHCfcBqdbcV5VrY9JiEDHWus
+b4dxFE7WBZU54+25WX9vuG0VTxsgH08EC/MWp8CGjwXJhqjiQvI4ihFjwuVtt1R5
+oLXfXKoA0C165GPVcVftkqVqJ/ece9/mxcaJenAv8wGoF9VpamJMf/r+x1/LOXNt
+vi5RcNdfLSyh97MDhMbEB2KldOYc/a4zJKyrHl6ijZpP7Y7RPQq1OlC4gYQe/7xi
+Nd/TvZrIy448OXW79Ee+3Hmg0xbzdYmjPp5qlXPshwFXkkyNlAgVuSpFO0ogfjON
+yH7qVDNamHP5VA++Iu415V1aT/+EFab7oeH3j3ZIrO1YymB/NSOS/QvsdEApz4eI
+UjluqVt87h7wVnNzRZ1RFX98bXmA5+4TTbdr2FMzro0/5Om+So9hJq7ZasNAkDPj
+qo1IYYf7ATzND8KLTBUF9x9yuWFNvY648n72sG26zh3ZsgizWdzM+67zaWAJOrQk
+fjmgA2NYqFjMbQ9MCXw0LjKROQLVhshWNQxD2awyC9L+bNaqE32QI+xH8nwmjQzL
+hiltYas4yXSc2lhqDbK+V2rUGbK5pcM+z1rd5Q7/hTrsTiJub9nlcCtai/ZBFzO+
+Hw==
+-----END CERTIFICATE-----

opensearch-pki/node-1-ext.cnf

@@ -0,0 +1,18 @@
+basicConstraints = critical,CA:FALSE
+keyUsage = critical,digitalSignature,keyEncipherment
+extendedKeyUsage = serverAuth,clientAuth
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid,issuer
+
+subjectAltName = @alt_names
+
+[alt_names]
+DNS.1 = brilliant-opensearch-cluster-master-1
+DNS.2 = brilliant-opensearch-cluster-master-1.brilliant-opensearch-cluster-master-headless
+DNS.3 = brilliant-opensearch-cluster-master-1.brilliant-opensearch-cluster-master-headless.observability
+DNS.4 = brilliant-opensearch-cluster-master-1.brilliant-opensearch-cluster-master-headless.observability.svc
+DNS.5 = brilliant-opensearch-cluster-master-1.brilliant-opensearch-cluster-master-headless.observability.svc.cluster.local
+DNS.6 = brilliant-opensearch-cluster-master
+DNS.7 = brilliant-opensearch-cluster-master.observability
+DNS.8 = brilliant-opensearch-cluster-master.observability.svc
+DNS.9 = brilliant-opensearch-cluster-master.observability.svc.cluster.local

opensearch-pki/node-1-key.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDkLJN5RVttlBx7
+bPhLlc18VtS0TF+xdjCaWnL6ES89j0fGxK9sPdzzKi2wXzP9FANUtOjCW2hS5RrI
+IvVAgTNeAjI785KKHLEwAZSlBf5xqp7i9JmrR8S1JsP0uwsZ+3pxpuLO0OlUSo0H
+zdjvp0jOG03MvFN0w8Rg7Xe/uag6Ob4CxV3eBwav2d5p2O7fgozeDynPwHPrOX/8
+p1HIkJE6yh/rZ2JRjkVuxd9Z3G2luEEyH7c+G8Uo8E+sD9PbnmZwj9l5xSTnrMt/
+RmrK7rrU1X07SK0CXCkInARP50l3nhpiOGL340wevxsK3mG1dXn5S4prw70ttvk9
+mJOJQ60hAgMBAAECggEAIb5l4N1c9AufWrF21tbEmMrOkgtpa3krHuiZcFnyPoxd
+9QtJVhyf/GYUc6zgp2C6TWCju3qBJyEyoL5qvqtcyV5Rx4Px+/LaUVsqfG0yf+TX
+soCx6R6n/JJLEHpI3gLOzNf9WtCScSDFUo4isu5uWey3yLthLDd3Z043E2eFdXal
+BRPFolFtzG8wpqKty+Omh9cUrAHU087qKw0rbWUHd7RSPDRMyn1v7uOdIvPCn57o
+CZe0srB5Ko3akAyaAQUXPwnTZyUyuIu/JZkakvN015qxbqnV86U9JLCR01YxGNya
+8tzdAzOkWvc+vomVlLj6l4ilz8CkgIfant/ZlCiVMQKBgQD/3PkpTX7Zs96Co8Gj
+SnJ+p8oaSLEclGEq4DECoRWjpaoSvgBtYUs38ZJpouXzdKEfgzxykaIdt4XEpAoj
+z5AztQ1cy99j20RkdhiMzJARsZOp6vfoFBqLWJEcufDpuqv+D7EOKwF74bSrFYtf
+zy8Qa4UEXjIFYIqD9X5AdUY9SwKBgQDkS8/v8JinmXxwbwy36mSe3bBkSUqyXquW
+q6QY/dckL7Pqgkf5TWPY3Vu2n80E7pfu2a851XAmJeY8DrNUMNjV9vb1haCbY7f3
+2igNODbwsL2E4e0fA7m5UW/X85JO28B1TBa1DK4N+iwYiQUjHqByoGQEuMUPJX26
+hMno5TvXwwKBgQDlzKSn+Oc+RjNJqCQpMZslsDNvaexQm9+tb4/1KZJS2V6n2Khv
+lNvG0hvK7riS8SQpNmhbCfvNrt/g3egRg8Gi/zCSMLVhbTS++eZQxwV6LsBN8zBW
+639vucsTPtlmQvdohtVhwTRi/DOVGROFqII/wCHG64cHl06w+BM9d1bvgwKBgQC3
+BmSNS0lHTJDsHsuGgv7qMnbg37Vn7OgJok+rzY32r9vAzXPgVYAP8988OT8HjjT2
+Q0Tsy8Xef5HmYi6493RPjXAOBHRvP3HU3ewwNPou2rMF3o7Yx4bVIInXCqooWJsi
+Lr8hpSnBgOhrPyaEMmCVpSqqcmthqj/zEdRBx83DOwKBgQCdLt1VnHGVjgQzortX
+rqcmBu4mKrZaKtll3yNKC36Hw8h3SqYRnUNVf+jOPO33sRGrr4VBLKoxC44Ictoh
+W6Z8/FfBX2H05363GRE16dF8Vya3woLQPjSs/iAgXGzl5yRPYaMk6VQxB6ps+F8q
+YZr6z10sXAtBlK3yMEKXUBWm/w==
+-----END PRIVATE KEY-----

opensearch-pki/node-1.csr

@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICvzCCAacCAQAwejELMAkGA1UEBhMCQkQxDjAMBgNVBAgMBURoYWthMQ4wDAYD
+VQQHDAVEaGFrYTESMBAGA1UECgwJQnJpbGxpYW50MRkwFwYDVQQLDBBPcGVuU2Vh
+cmNoIE5vZGVzMRwwGgYDVQQDDBNvcGVuc2VhcmNoLW1hc3Rlci0xMIIBIjANBgkq
+hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5CyTeUVbbZQce2z4S5XNfFbUtExfsXYw
+mlpy+hEvPY9HxsSvbD3c8yotsF8z/RQDVLTowltoUuUayCL1QIEzXgIyO/OSihyx
+MAGUpQX+caqe4vSZq0fEtSbD9LsLGft6cabiztDpVEqNB83Y76dIzhtNzLxTdMPE
+YO13v7moOjm+AsVd3gcGr9neadju34KM3g8pz8Bz6zl//KdRyJCROsof62diUY5F
+bsXfWdxtpbhBMh+3PhvFKPBPrA/T255mcI/ZecUk56zLf0Zqyu661NV9O0itAlwp
+CJwET+dJd54aYjhi9+NMHr8bCt5htXV5+UuKa8O9Lbb5PZiTiUOtIQIDAQABoAAw
+DQYJKoZIhvcNAQELBQADggEBAD6DHvkPsuxGPB27iUZp0d1TH5ZzVMJY9cqw827b
+3gJZQBV7xD/OpgpVz5Zoc3sfqWRqHdkjz4Md1gtyVRYW7N6XaMHX6ukDLVUODOd5
+9jJof4Vr4hkTkyH+wf69gmF1gS5XtEhaMCwlBqvqQyQkfeIiGewNwVghsKIyIvQx
+VzSFECSf6ycdhDveGo7Ius2uCUhLeN2WPA1GVwevGplEHdmvAe4/KLU9+S5TovXJ
+dN8BUWmmFO2q135rxkEfkFdTm/VqCEw0poc7HuXygUQBnNFSg6Az0HVJ893K9Nnw
+hhgRfeIiBKBSalWd+xXWBy19q7rprNx0gQGYU1EVPQ9VNdg=
+-----END CERTIFICATE REQUEST-----

opensearch-pki/node-1.pem

@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIIHrTCCBZWgAwIBAgIUIycsqd4quogxjw1E4Kjx3wBtbXAwDQYJKoZIhvcNAQEL
+BQAwgYUxCzAJBgNVBAYTAkJEMQ4wDAYDVQQIDAVEaGFrYTEOMAwGA1UEBwwFRGhh
+a2ExEjAQBgNVBAoMCUJyaWxsaWFudDEbMBkGA1UECwwST3BlblNlYXJjaCBSb290
+IENBMSUwIwYDVQQDDBxCcmlsbGlhbnQgT3BlblNlYXJjaCBSb290IENBMB4XDTI2
+MDcyMzE1MjQwMFoXDTI4MTAyNTE1MjQwMFowejELMAkGA1UEBhMCQkQxDjAMBgNV
+BAgMBURoYWthMQ4wDAYDVQQHDAVEaGFrYTESMBAGA1UECgwJQnJpbGxpYW50MRkw
+FwYDVQQLDBBPcGVuU2VhcmNoIE5vZGVzMRwwGgYDVQQDDBNvcGVuc2VhcmNoLW1h
+c3Rlci0xMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5CyTeUVbbZQc
+e2z4S5XNfFbUtExfsXYwmlpy+hEvPY9HxsSvbD3c8yotsF8z/RQDVLTowltoUuUa
+yCL1QIEzXgIyO/OSihyxMAGUpQX+caqe4vSZq0fEtSbD9LsLGft6cabiztDpVEqN
+B83Y76dIzhtNzLxTdMPEYO13v7moOjm+AsVd3gcGr9neadju34KM3g8pz8Bz6zl/
+/KdRyJCROsof62diUY5FbsXfWdxtpbhBMh+3PhvFKPBPrA/T255mcI/ZecUk56zL
+f0Zqyu661NV9O0itAlwpCJwET+dJd54aYjhi9+NMHr8bCt5htXV5+UuKa8O9Lbb5
+PZiTiUOtIQIDAQABo4IDHTCCAxkwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMC
+BaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB0GA1UdDgQWBBQ7vPOO
+QnYjKf4JFQQOKj7ze3j3dzAfBgNVHSMEGDAWgBR22p4+hRjFH8JQtCvo3DuTPRsA
+KTCCApgGA1UdEQSCAo8wggKLgiVicmlsbGlhbnQtb3BlbnNlYXJjaC1jbHVzdGVy
+LW1hc3Rlci0xglJicmlsbGlhbnQtb3BlbnNlYXJjaC1jbHVzdGVyLW1hc3Rlci0x
+LmJyaWxsaWFudC1vcGVuc2VhcmNoLWNsdXN0ZXItbWFzdGVyLWhlYWRsZXNzgmBi
+cmlsbGlhbnQtb3BlbnNlYXJjaC1jbHVzdGVyLW1hc3Rlci0xLmJyaWxsaWFudC1v
+cGVuc2VhcmNoLWNsdXN0ZXItbWFzdGVyLWhlYWRsZXNzLm9ic2VydmFiaWxpdHmC
+ZGJyaWxsaWFudC1vcGVuc2VhcmNoLWNsdXN0ZXItbWFzdGVyLTEuYnJpbGxpYW50
+LW9wZW5zZWFyY2gtY2x1c3Rlci1tYXN0ZXItaGVhZGxlc3Mub2JzZXJ2YWJpbGl0
+eS5zdmOCcmJyaWxsaWFudC1vcGVuc2VhcmNoLWNsdXN0ZXItbWFzdGVyLTEuYnJp
+bGxpYW50LW9wZW5zZWFyY2gtY2x1c3Rlci1tYXN0ZXItaGVhZGxlc3Mub2JzZXJ2
+YWJpbGl0eS5zdmMuY2x1c3Rlci5sb2NhbIIjYnJpbGxpYW50LW9wZW5zZWFyY2gt
+Y2x1c3Rlci1tYXN0ZXKCMWJyaWxsaWFudC1vcGVuc2VhcmNoLWNsdXN0ZXItbWFz
+dGVyLm9ic2VydmFiaWxpdHmCNWJyaWxsaWFudC1vcGVuc2VhcmNoLWNsdXN0ZXIt
+bWFzdGVyLm9ic2VydmFiaWxpdHkuc3ZjgkNicmlsbGlhbnQtb3BlbnNlYXJjaC1j
+bHVzdGVyLW1hc3Rlci5vYnNlcnZhYmlsaXR5LnN2Yy5jbHVzdGVyLmxvY2FsMA0G
+CSqGSIb3DQEBCwUAA4ICAQBAjBl519DTvYLVwJfePqkprL7FPaNQZVi1gHKLQazB
+ISifukf29ZKDXg3D3MWJ+T8VAzZgBEAAQ/3G8+u7FT8Tn22I1Kff4KbGCLpP69tS
+GbHYTL3V61f9MNGKkyiThuHmO/8HJ1VAsKjfz7pP0p9TBHDpnacFIcQLaApGbibx
+hQkt79qeh3vaZT/HgWYizsqAk8I2z47KEEBUdtN1Vrbb/DA5owz8w3cO4G1neTKl
+AVYKNSjCUbExPCtivnrJsAL/rdIfsLtDJCtA4TEmouR+Kc2d5dlkV4KgsyAQ34FX
+So421ZxBOvf427bI7G+OF3IufrY47LAaJrypcwfU6+QIWMrC+Zy6UsmjMy523E67
+WRP/VoA+JezrNWhTuBB7T3tozCVQeJgg2Hr2EC7EUnvTYgN25no2iYqIz6tcUVWH
+HEv/9FPQeqB3gzGs2gYy7QEYiqwQI8jlMlADgKkkXcliTZHIaJTWppo/YAQwOVjR
+moiaEDxPqDfvKDFMv9sAeAutd/LITyHLuNWDWMRebwKGvhfRcvXI3O8zNBm1ccE5
+uSvdNmfH2xvhHTkWduJesQ8pRH9B997hM6t6IqnUl7Kj5xPaCHXA2g4azahqTjwL
+A4ZivTb8MSp8ZKKP1xjdv+3iv/sBnhUFXWKZ4fce6cioJ+0kDCgOJwy2aRSdk3MR
+sA==
+-----END CERTIFICATE-----

opensearch-pki/node-2-ext.cnf

@@ -0,0 +1,18 @@
+basicConstraints = critical,CA:FALSE
+keyUsage = critical,digitalSignature,keyEncipherment
+extendedKeyUsage = serverAuth,clientAuth
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid,issuer
+
+subjectAltName = @alt_names
+
+[alt_names]
+DNS.1 = brilliant-opensearch-cluster-master-2
+DNS.2 = brilliant-opensearch-cluster-master-2.brilliant-opensearch-cluster-master-headless
+DNS.3 = brilliant-opensearch-cluster-master-2.brilliant-opensearch-cluster-master-headless.observability
+DNS.4 = brilliant-opensearch-cluster-master-2.brilliant-opensearch-cluster-master-headless.observability.svc
+DNS.5 = brilliant-opensearch-cluster-master-2.brilliant-opensearch-cluster-master-headless.observability.svc.cluster.local
+DNS.6 = brilliant-opensearch-cluster-master
+DNS.7 = brilliant-opensearch-cluster-master.observability
+DNS.8 = brilliant-opensearch-cluster-master.observability.svc
+DNS.9 = brilliant-opensearch-cluster-master.observability.svc.cluster.local

opensearch-pki/node-2-key.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDDSJ915jXaFcjA
+PEq21Fq81pvb6gUQ6UEJiMCqAqSyOV+zoYj2QEIp81XGnXzS9ArsGyVZDSlRpb32
+jRIIKMeEOt7mvTrm2pHQMR9m8i401rjGGcVb5Ekb+USB3TurfuQiIjELSML6Unm6
+rxtnH8fFpTtLgL5OhEgWyt2Fxh/HcyohLHILVlQIKeDk2r8MlF8ip1xnYGkBbckg
+SP/9f6+FavvZLkgcmX5qLx4BNoVZFJae2n/vHjXIQOKsjTwXI/H3nQGwlHzph//l
+a/srbEjokeDEl6MUxMn4vOAi/XDSsQ612o414ZiXpiY8W3lNCpDv2goILpCwKVxn
+9nZv3GW/AgMBAAECggEATWDJTn4ZeICJOyKouCkMiya+OzVPLJRAIPb+4F6Lw9LY
+COVIz8pGbTjuE/TzMONiMIvREKgWZzO1QaxEKNd/tvVcvTDd1ftlK4lLWA8+H9G1
+BUnQ2chq75qleo+exSVSX/QMWtxJ5cYoVcBsqz/8eGQwSoqI3bOsnNtlS0xl6zEU
+2QV+XSZqXiYuK0Z5Tpugf5Kz77eDArbjn3TSkAVuCm1e502ps55qi35huwxtAXQB
+STDUOvg3l+whRuZDJl4d9/iMZoprricgNbRlWDjTXo2FYoeb/3XUjYHkhQlRI7I2
+rB4/emOQHFGcUiitLRVlMljDjel3F2TzRlxSCi/DAQKBgQD1gs/0EYfwrd5lFWuT
+Y+a8rHaDIL9PckAGSU+tw2qXK3gbZf01O8wy6s7oiWkYbeVuFNiXs7IKnmZ3VHfo
+BcSTorK0VeFKuHhvhpYWzZpQ976ms9eN0KRKNwVYgVJ9Q54aLlOI5KxWpSvHy5AZ
+FssDemnhr2CVRXP3XKsZmngz9wKBgQDLoHe0/5hek2N+yvjTb7AqyjsRFuGV6NS8
+yIl4CPLi4aTdaC8ryYkDyg2Vl4ZdzBnWY1eU1T8whmfQlBroXqYlzayV65bIRL/s
+1T9OZWjN6T7C+hEDsCffd61B2Gwc6g19dS6TgcJ7hU9hZn4X6eFdHcJHMljlKwYM
+cdMWa7FaeQKBgQDsuPf4NtsjlxIj11aFpEL70zLmVrIAUYIoTZHVUuI45oIFsP5H
+0OOgiMV+c9fw5S3eSZ1aELrwADF+h+ShxMX5MFwtA82aNWpy5otba12LCoY6yJdj
+tzRiFtFBuFgoTgVo6xhCm3MMjHA9Uisb9d1D+kmTgX2YEIKzlRepNUcHmwKBgQDJ
+DqrkFrOWPqWxHizOaKtjtMbZuuQHJxxXQxMpaHyatP4ad7KL47Tb/vemyzSrDMo+
+O1zQ4jZAbZW4B2UCJ+KZ1Rkh9rqtB+URrgWSHON83V9RGaUPJTJZnkt+hnlJm3iy
+dbAFicxENn8IxzCd4Brb3HRl5DqOHQsd4o3wx2kY0QKBgD43hyhhTKJDboatnQjl
+Roz30FSw75OLqAAGzQPKZKu4ATQbYdDK5x7Eowd82Bva37Ben55cW1NmRTocIWEb
+0JW62v/SS4CVtoIFGcK8VJUi4QBG59Ooe7DTGjHNFFa4YC/7XmCuqHnLVZXVvbZ+
+LveR7AwSzKLprENs0AIuZmbi
+-----END PRIVATE KEY-----

opensearch-pki/node-2.csr

@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICvzCCAacCAQAwejELMAkGA1UEBhMCQkQxDjAMBgNVBAgMBURoYWthMQ4wDAYD
+VQQHDAVEaGFrYTESMBAGA1UECgwJQnJpbGxpYW50MRkwFwYDVQQLDBBPcGVuU2Vh
+cmNoIE5vZGVzMRwwGgYDVQQDDBNvcGVuc2VhcmNoLW1hc3Rlci0yMIIBIjANBgkq
+hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw0ifdeY12hXIwDxKttRavNab2+oFEOlB
+CYjAqgKksjlfs6GI9kBCKfNVxp180vQK7BslWQ0pUaW99o0SCCjHhDre5r065tqR
+0DEfZvIuNNa4xhnFW+RJG/lEgd07q37kIiIxC0jC+lJ5uq8bZx/HxaU7S4C+ToRI
+FsrdhcYfx3MqISxyC1ZUCCng5Nq/DJRfIqdcZ2BpAW3JIEj//X+vhWr72S5IHJl+
+ai8eATaFWRSWntp/7x41yEDirI08FyPx950BsJR86Yf/5Wv7K2xI6JHgxJejFMTJ
++LzgIv1w0rEOtdqONeGYl6YmPFt5TQqQ79oKCC6QsClcZ/Z2b9xlvwIDAQABoAAw
+DQYJKoZIhvcNAQELBQADggEBAL6ugt6wF24mHLL+uplIZH21iePI+cKtHDE+OiYO
+oINHMGblJahOOMQMFzydnVSJ8Nn5iDr3cuuTTWe8OS1EbZpcjU6WenwrORZe7buF
+40RhSKpDWrk1TXxOZs6lbdawT+VKXxCbcnRniEYiy5tSXePrXTf3U1qmMBnAINht
+oplRjUGgMpzssjjce3wVgH9KHszQyG2WAZYQH2td6RX16m0dD2HAqxbAd/nbb6h9
+GeijI//QYnbQ9AXllHopLdedZ1UnxoqZ4nBu7iRTONE5pjhkmoJ/7z/qm6dLEonP
+MWg8v8BDdQdOZwYXo9C2hraxY18esP9SO5OBbox4DHYs3YM=
+-----END CERTIFICATE REQUEST-----

opensearch-pki/node-2.pem

@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIIHrTCCBZWgAwIBAgIUIycsqd4quogxjw1E4Kjx3wBtbXEwDQYJKoZIhvcNAQEL
+BQAwgYUxCzAJBgNVBAYTAkJEMQ4wDAYDVQQIDAVEaGFrYTEOMAwGA1UEBwwFRGhh
+a2ExEjAQBgNVBAoMCUJyaWxsaWFudDEbMBkGA1UECwwST3BlblNlYXJjaCBSb290
+IENBMSUwIwYDVQQDDBxCcmlsbGlhbnQgT3BlblNlYXJjaCBSb290IENBMB4XDTI2
+MDcyMzE1MjQyOFoXDTI4MTAyNTE1MjQyOFowejELMAkGA1UEBhMCQkQxDjAMBgNV
+BAgMBURoYWthMQ4wDAYDVQQHDAVEaGFrYTESMBAGA1UECgwJQnJpbGxpYW50MRkw
+FwYDVQQLDBBPcGVuU2VhcmNoIE5vZGVzMRwwGgYDVQQDDBNvcGVuc2VhcmNoLW1h
+c3Rlci0yMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw0ifdeY12hXI
+wDxKttRavNab2+oFEOlBCYjAqgKksjlfs6GI9kBCKfNVxp180vQK7BslWQ0pUaW9
+9o0SCCjHhDre5r065tqR0DEfZvIuNNa4xhnFW+RJG/lEgd07q37kIiIxC0jC+lJ5
+uq8bZx/HxaU7S4C+ToRIFsrdhcYfx3MqISxyC1ZUCCng5Nq/DJRfIqdcZ2BpAW3J
+IEj//X+vhWr72S5IHJl+ai8eATaFWRSWntp/7x41yEDirI08FyPx950BsJR86Yf/
+5Wv7K2xI6JHgxJejFMTJ+LzgIv1w0rEOtdqONeGYl6YmPFt5TQqQ79oKCC6QsClc
+Z/Z2b9xlvwIDAQABo4IDHTCCAxkwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMC
+BaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB0GA1UdDgQWBBQtMiz7
+U9H5vkGsf6u49GZUJCulfjAfBgNVHSMEGDAWgBR22p4+hRjFH8JQtCvo3DuTPRsA
+KTCCApgGA1UdEQSCAo8wggKLgiVicmlsbGlhbnQtb3BlbnNlYXJjaC1jbHVzdGVy
+LW1hc3Rlci0yglJicmlsbGlhbnQtb3BlbnNlYXJjaC1jbHVzdGVyLW1hc3Rlci0y
+LmJyaWxsaWFudC1vcGVuc2VhcmNoLWNsdXN0ZXItbWFzdGVyLWhlYWRsZXNzgmBi
+cmlsbGlhbnQtb3BlbnNlYXJjaC1jbHVzdGVyLW1hc3Rlci0yLmJyaWxsaWFudC1v
+cGVuc2VhcmNoLWNsdXN0ZXItbWFzdGVyLWhlYWRsZXNzLm9ic2VydmFiaWxpdHmC
+ZGJyaWxsaWFudC1vcGVuc2VhcmNoLWNsdXN0ZXItbWFzdGVyLTIuYnJpbGxpYW50
+LW9wZW5zZWFyY2gtY2x1c3Rlci1tYXN0ZXItaGVhZGxlc3Mub2JzZXJ2YWJpbGl0
+eS5zdmOCcmJyaWxsaWFudC1vcGVuc2VhcmNoLWNsdXN0ZXItbWFzdGVyLTIuYnJp
+bGxpYW50LW9wZW5zZWFyY2gtY2x1c3Rlci1tYXN0ZXItaGVhZGxlc3Mub2JzZXJ2
+YWJpbGl0eS5zdmMuY2x1c3Rlci5sb2NhbIIjYnJpbGxpYW50LW9wZW5zZWFyY2gt
+Y2x1c3Rlci1tYXN0ZXKCMWJyaWxsaWFudC1vcGVuc2VhcmNoLWNsdXN0ZXItbWFz
+dGVyLm9ic2VydmFiaWxpdHmCNWJyaWxsaWFudC1vcGVuc2VhcmNoLWNsdXN0ZXIt
+bWFzdGVyLm9ic2VydmFiaWxpdHkuc3ZjgkNicmlsbGlhbnQtb3BlbnNlYXJjaC1j
+bHVzdGVyLW1hc3Rlci5vYnNlcnZhYmlsaXR5LnN2Yy5jbHVzdGVyLmxvY2FsMA0G
+CSqGSIb3DQEBCwUAA4ICAQCr6NEyDLYSfeIa7D+z2zVU5eoprpR/O6CO5koZXBRQ
+pRE537ocKYNSDk1aTwemBZa7llaJO6X1wHHOM41o2tzo3Q1vx1LVnv8PJHRQ4WqU
+mpOcR0WZNkwEjQgjR0xnjulfVYqD2mVJal6R0xiJLcptyaIexA+IkqYFmIPSgpDG
+Tlhkk/jGyB4SJubUEa1lLlDpQBgAGnNSdTBojRFG1a/IAjprhrAplOWI3PtMzWVW
+hMbrA/zTzTUT8J1ZtL5zAjIUEGANcjfVjzzP7kxihYnW8oXF5msbZ5GJoX3BLd92
+zFoi4frgIuy7CZP/HRpSMaWEz4t9rkhGpUrxn90V3nx+/zB63EhZmN6lQgjPZJLz
+EMy72g8RuDVu6tqg+879I6JFVOcPjqXn+bhCSI3FdQL7YsmnTyFZ4Oi0lu1fDj6/
+YzrNj9GSJoxuhbjO/Skbyp4ZKh1Q+hX0K+Kt9Tt0A37Tl443J8RS+k4X0J4L782y
+659e+TwdSd+RoVyKRS0aUU/kWzeVGEq3HLFNwQgqBiozohi/3ENPkvN+gcG/P69/
+KBGHW48BFyUcRA7vx0t9Z821Yy5POdQTI3B6xbjWYY3bZ5ZYFgvjuI8S/+sYoUUO
+7L1o/+OJc8Vmc0cgA7AM5ZlCzqr0mfYKsDUySQOqFlYstoEms8kZYz2MI5Qdx95u
+cg==
+-----END CERTIFICATE-----

opensearch-pki/root-ca-key.pem

@@ -0,0 +1,54 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIJrTBXBgkqhkiG9w0BBQ0wSjApBgkqhkiG9w0BBQwwHAQITN+TSAIaNdYCAggA
+MAwGCCqGSIb3DQIJBQAwHQYJYIZIAWUDBAEqBBA27GFAbFOaDHtVqrPhpnRDBIIJ
+UP0NPwrPgb4XXQmQK5uV5oOQAuvQTqNMd7nWNWP1At4WrkCudNcVdCpkxlSyodUy
+s/JQ1LBZl5nHYXaud5DikvdvlTXOmKXbwGoMrdy8GzXX/6LS+7ws9GkUcgUrTD/6
+ygifoXyWBvBkmg6lomchphJmd2vsfkvvzQXfz7lXR3UbmSQ8d/vjNpNq5nk34VNy
+eI176d6EK/OnRwpOPs+7j9ns9bLnFZ5nnrmZ+u41XxWT8UWeWg4O/UvtspDyXx39
+47N05p/uZ4aBP2MwH6vB2md8usVzR9U+lDzMVW7CeOo4lAhUSoAGgT8HfeCwYVLr
+1zpZeA3a+6QbBnu2X/WeslNsJidbCPv8GoMnHKNlzucPN/K756OoyHWVacNbjD2d
+Bxm2G9hj8rNQmDeLZ5+pyoSnrAI0Yv0rqfyXx8Wl8S1OkP1+Qms6qh+ixR/2ES8M
+0944RQicufCKXqCs+BYAEV30B7+dCrasJW2F5LR5NTgBdEn/CFCirl8lta0F8oGm
+blD1Kq9ZbjdqG1vOYr8j1bpvboUbMz2MziUqs7F9W9X0ucaCqKJ2K+4fAbZNPU81
+c/DiifTUzSlUxvEwmoxA6GYDKluIIAHnYCC8rWeQAalVRxs3k9mgeC9U23yKSk5i
+2P12WqyCzM87qs4e0xiMhweRo6AyfHz1h/13AKLId5LYK81mpyz7Ri7NQa467k6t
+WMGWRv2j/L1TiFrOtdHHPO1WuMqM/RuWw4DfCSlthlHnMszRI9X1wg8Kkq4SrKz8
+A1T8PW2P1I9cGffjIUYouO15zneztk3cY0X7uLmA4f63Ppg0TvYgNEmMiF9Dbe0T
+c8cotMPQJKIyIK4sSN1mpG9cbusESjqrwl4iCOoG1qkVMPVk4PAM3F2So58VP9CL
+VDY8l17arzOkga3FlF6cz6VDP1DamUTJPfqvjXa9vLXg29eyLntzh03MSt1vinmU
+6HHdC4dyeQCbzW0DwuENuOKtbNp4rrJ3J28JRdhAzAN6GaNcdXmH66hPQ4jeR/6/
+29XL+m8SVNScgM9+2QTbEjCqu05NU6dXtCyc4i4WsGyuvz/2cYF+72zi7YHGfVEp
+Xuf6g8Ke2i4cgMsq7mMQ+cNsN337mp3NJq9TsDNa615tIoW0YgP+sIyA2ytKxwll
+iCkMZBQrgUIK7qIkaxT5TgcSWAsHUB645/dMO4amgYB2cxRLYEfo0VKiirqMhAK2
+4nWC655QV4zE/cCpYWhv48n0JrnBt2h8XGHBlpl5BKp8g78FNlYIfR2xcgHbBUIW
+0stOpFCy9Kv1OK+J2hS2uTtktWiwMEVBsCPUhDWoa7xQiUzU622uIHaOWswT/mHA
+cRy8HHOAEzGJq15Ah95YN8Iq6C2FBEjl/lILu9vw9fumVPjmT/pGHadKoUS4yGfL
+pRft6dUzlkYYIc2A+zFpCEeaS/RTuGrVN3v7mazOScJ/ZC19k0Ssyd+pMDmsWmp0
+v/B77WylCuij1hRRVuq6GAQr/MVUDeOmGWzHIk6BFqwOw44qzfdPl4a8kjvSEI5L
+va5Jxx9/7vkGIQOLivkqFd+YyQ6ruVPnNCVYlFu0QOQ8zTdj0wM9SdfDw9L7qJXJ
+WOtdbrxIij6ISMnNn4+aElIbMeThmzUEwqukkCvzE4TSOxUSIfcIF3KLHIwCpX1K
+zR4oOhUToXgPYqHqmjoGpI3Y0ATTZS+Cw1QUVkAOVDpASB0DA+0wpstwTRoWoAUx
+egRB2MexxukL1eji/9lqCAtxjV0JZ6bKvkrzpMhZIkXdputKaUFjijbXS5IZcYuJ
+bsllePINHd/1qXZ0eloVPXHOSMiKNyRR/ZAn6TECZusCn9sZxZ9YIPiTElSyANxZ
++9d/8DDj4IWyCxnxfaj671VdDJnqbyoe8NCPYLclzBaHEKWvlvgL6/iGrPSZ7vfV
+xrYX0XBLc8aGnk8aBqzPt69bG+8PtQs7Dm9nmU/9K3wQ2EXGmj/cQjxr53oodtgk
+bX8YHWwAfBc9v6edyQU3jZQ+YQq8M0Bo6ZDP2OoV9363eiEhsdb8O7dotS5ZqGLm
+PnvHlaEwgKARrhqoELcediLd+5PuTCXjGPoF8d75TRCW92DN+47DVk3oyrgNHC1P
+OmH93eBL0wxfojEMRnLYnmwWRf+w6a5m8rF+qgf6yAj+nP1KbYU8FsJeWSqPfQ4v
+3ArCECh/ipe/jk1rsoRXWAlIar0G+ihxm6h/89Emc84BNzUX0mKB/+A+cp0/MyLi
+MJrlMW8LiY5y6W24orNrZB5sOSIGDNsfi1bTV8cMD0xb0DsDqiN4LbCC2GvHwStH
+bGVU5OLavIeGx3iQq7JkYw/sfziG9Vk+GSwUwDtVoiG01GgVzw+9xWSdeCLnDYJ3
+18PlhgHr7fxfE62cfWyRSvcruv/b/s1EjCbyCeXbAmNqcN+Mpt59osVCIAGMP2Ns
+wvJsUypZfWTaecdIisD3Qbk2N0A2jyfWGNBjSK5ljsLsStPSwi+7/cB3oeTZ03Ra
+M/JhMg/FnMoTEeRFtMSIVkuCHQTw3gTamNg1TEaTeLMBiSzbJVLzRBLPfwolO4rf
+GJP7b1tc19hbiN8DZg53lj6HY+Vt7rHZPVPbng7j5BzHkpjEmbjuPSHBKh5Ch8Sz
+GmR8ET7/9JCfQdh1xC5lap588p3f7jJTMXzHCaszNUF8NGj1rXauGG+06iikF/yx
+dFR8KwfRDq01zHEMY3h6Aa7fy1W5uBXG7pBLDOTDqIs36t7Qupk1L83Wqaq85cFe
+S8bNMwyCXmXmQN5GipSsFjj9NVCPAER5bj2zd1B31aWaUxO2rcH6IwTP6NjQN/lY
+iBU+RKnSOa8KpZkoMyZccZwb1Bqc1tZmCh2qt2r037tipKs1YPLdCVwhac63nFTu
+HXTYMVg6lLDShSdyZNheEuHWgZgRUyrSMJ+ta3BeqwINIyBAZnDQ+1bWJT+wPJer
+YsZEMVrXNt3vK40Vg8kX6pJNUl5Z+4tZzbNDPgpgUNpvDKCDHm4fc5urs4cm5ASc
+SJz75f3zWTIwIQ36YE7S50rZn9iE3a1kUhngTt3vglVs0N70o5WQscZPrGbyWZpQ
+b7Sp4SEVvL8LQz+iWowsUmvXP78/UU63BcnxSIxVpB5QQTQ9aLEoe90B7vczX1Ew
++n+nCvFsColQFbNccaziiLnw+ybagIx6Z1/EZvFSQi5Y
+-----END ENCRYPTED PRIVATE KEY-----

opensearch-pki/root-ca.pem

@@ -0,0 +1,34 @@
+-----BEGIN CERTIFICATE-----
+MIIF7TCCA9WgAwIBAgIUL/aO+ga/XcysjAXlhuXovwLKZBcwDQYJKoZIhvcNAQEL
+BQAwgYUxCzAJBgNVBAYTAkJEMQ4wDAYDVQQIDAVEaGFrYTEOMAwGA1UEBwwFRGhh
+a2ExEjAQBgNVBAoMCUJyaWxsaWFudDEbMBkGA1UECwwST3BlblNlYXJjaCBSb290
+IENBMSUwIwYDVQQDDBxCcmlsbGlhbnQgT3BlblNlYXJjaCBSb290IENBMB4XDTI2
+MDcyMzE1MDExOVoXDTM2MDcyMDE1MDExOVowgYUxCzAJBgNVBAYTAkJEMQ4wDAYD
+VQQIDAVEaGFrYTEOMAwGA1UEBwwFRGhha2ExEjAQBgNVBAoMCUJyaWxsaWFudDEb
+MBkGA1UECwwST3BlblNlYXJjaCBSb290IENBMSUwIwYDVQQDDBxCcmlsbGlhbnQg
+T3BlblNlYXJjaCBSb290IENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKC
+AgEAuyDbdZ1Arqgz+YwJCTqiqDKnS3CDhGzCq+HyX3wrPgWBodPkhrBWwd748f7j
+XYX3Pv+PKAtg5Fb7qkfYPVIGAOeCbQldFRgfWtKav2GqpvlyIJs/NenOg1YCr2uU
+l17RqO6MAHkzwZMMQCWRW2QbS/pyV4TwzvCqI4ueZs8Rx2wplDIuaOUwI0ES0o3u
+Vt2G1YBMiE9CUL9bAiXmd4Q4xkSEDTo9V5IY7ggGb1SSLVSlzD2GdIZ0cwVQ6/70
+u+CQOkM9exHETvxjFNfxk26bTYUBf6pMKeiH7Ll/nr6EUUsMnCIDyTkg+vmkS9ej
+Rf5GD0CM+ryuWPbDyG8+sp8xwSufG2t7dPfQI53wVssPJJI9oIlgIIYy22AT2Z8G
+J/gYnf01NKDHRWWASaPi0KOgTFWjDnqjoxCAGf5FTTIHwAB5l1/+1vElI26463gx
+pVq98W+xSqPCLZMolZQ9MY0n5Gxh/f8d+DOoPUOIWk2jYwoKRFArbNSS6y2JukKv
+Ico2sxaHjfHkt7jt0drDKr5+zR9nwTX8U7xAiiSbESzCz9iouOPHG10Qmw9zUTM2
+1w2f2iPEjolZAV1AhU7w1V4pssriX2/59CGWXOUDqcgwc0uhxv4gXTgupBxg+aNr
+Yrmfp6wmz7s7yfnXwOlUiTCEmAscAzcd2gBhl/7WiraQdUsCAwEAAaNTMFEwHQYD
+VR0OBBYEFHbanj6FGMUfwlC0K+jcO5M9GwApMB8GA1UdIwQYMBaAFHbanj6FGMUf
+wlC0K+jcO5M9GwApMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggIB
+AAeUUUALNNE436PL/eyzWG7niOvwW81wRGUtgDRriclEZ8t+s3PoL9tbo+3PcuzH
+jLlPP+beKckTLFJTfYYCwgGVfGHEq5z5uIKweb20oFHH7zOCK1wURAIIOfqrrw20
+cqcsu4g+sD6ytnYV7f5ODEOdMizcUtkljLJ5byrKIONWakI0iwLKyqOAiFyERclb
+0tg8hL4zvDKUFzuRrqxqKJZw3VQe/3RVPV0gDKQozTD43ygAGFVUcrLutvN+eylA
+T7X0kMereUTJwSzD5ozxFEqdh9K4vde06kpnIzPKkDjsEf+3yoVxUqDbBxewj/Z8
+hw8fOyAX/cWe/fXfYWOWtiNXbARQwJoQiKoyZptn4joExKYPvC84F+H4Fgfzbuqd
+sg/dvJ0qrWFiIYyfAE/M4c7U0CRulgYDMranKHPxqNYUOmiG38OLKL9E2ioWM6Pv
+zO6v5oRNik1E7pkEELIAOs4wSc/tn91M5NkiJ82EsDCfZTnEUOBwulG6Rmo/aatj
+BYBDhz4vxf7Fc4mwXGW5VWsT3wfUrA+gywUj9vQjM5zJ12l9x5OCwzM12nAgRgWE
+Hxd8yLXd4OkMdZEcUrF9ykR0bTgp2Zz0/yOGmJmZbxtMtyFi5LrkzTIhubMKYvnw
+qk+mgZRcLqpVrTRa3bhgDW2kIjEOb9Hpz4nLgyhQZB0P
+-----END CERTIFICATE-----

opensearch-pki/root-ca.srl

@@ -0,0 +1 @@
+23272CA9DE2ABA88318F0D44E0A8F1DF006D6D74

values-blackbox.yaml

@@ -0,0 +1,16 @@
+config:
+  modules:
+    http_2xx:
+      prober: http
+      timeout: 5s
+      http:
+        valid_http_versions: ["HTTP/1.1", "HTTP/2.0"]
+        method: GET
+        preferred_ip_protocol: "ip4"
+    http_2xx_insecure_tls:               # for any domain running self-signed/expired certs you still want uptime-checked
+      prober: http
+      timeout: 5s
+      http:
+        method: GET
+        tls_config:
+          insecure_skip_verify: true

values-kube-prometheus-stack.yaml

@@ -0,0 +1,77 @@
+grafana:
+  enabled: true
+  adminPassword: "Enp129s0f0-0bS#rb!L!tyN#vv"
+  persistence:
+    enabled: true
+    size: 10Gi
+  service:
+    type: ClusterIP
+
+
+
+prometheus:
+  prometheusSpec:
+    retention: 30d
+    retentionSize: "45GB"
+    resources:
+      requests: { cpu: 500m, memory: 1Gi }
+      limits: { cpu: "2", memory: 4Gi }
+    storageSpec:
+      volumeClaimTemplate:
+        spec:
+          accessModes: ["ReadWriteOnce"]
+          resources: { requests: { storage: 50Gi } }
+    
+    configMaps:
+      - blackbox-targets
+
+    additionalScrapeConfigs:
+      - job_name: 'cpanel-node'
+        static_configs:
+          - targets: ['bwebhosting.brilliant.com.bd:9100']
+            labels: { role: 'cpanel-host' }
+      - job_name: 'cpanel-apache'
+        static_configs:
+          - targets: ['bwebhosting.brilliant.com.bd:9117']
+      - job_name: 'cpanel-mariadb'
+        static_configs:
+          - targets: ['bwebhosting.brilliant.com.bd:9104']
+      - job_name: 'cpanel-process'
+        static_configs:
+          - targets: ['bwebhosting.brilliant.com.bd:9256']
+      - job_name: 'cpanel-whm'
+        static_configs: 
+          - targets: ['bwebhosting.brilliant.com.bd:9124']
+      - job_name: 'bind-dns'
+        static_configs:
+        - targets: ['dns1.intercloud-bd.net:9119','dns2.intercloud-bd.net:9119','dns3.intercloud-bd.net:9119']
+      - job_name: 'blackbox-http'
+        metrics_path: /probe
+        params: { module: [http_2xx] }
+        file_sd_configs:
+          - files:
+              - /etc/prometheus/configmaps/blackbox-targets/targets.json
+        relabel_configs:
+          - source_labels: [__address__]
+            target_label: __param_target
+          - source_labels: [__param_target]
+            target_label: instance
+          - target_label: __address__
+            replacement: blackbox-exporter-prometheus-blackbox-exporter.monitoring.svc.cluster.local:9115
+      
+alertmanager:
+  alertmanagerSpec:
+    storage:
+      volumeClaimTemplate:
+        spec:
+          accessModes: ["ReadWriteOnce"]
+          resources: { requests: { storage: 5Gi } }
+  config:
+    route:
+      receiver: 'default'
+      group_by: ['alertname', 'role']
+      group_wait: 30s
+      repeat_interval: 4h
+    receivers:
+      - name: default
+        

values-opensearch.yaml

@@ -0,0 +1,592 @@
+---
+clusterName: "brilliant-opensearch-cluster"
+nodeGroup: "master"
+
+# If discovery.type in the opensearch configuration is set to "single-node",
+# this should be set to "true"
+# If "true", replicas will be forced to 1
+singleNode: false
+
+# The service that non master groups will try to connect to when joining the cluster
+# This should be set to clusterName + "-" + nodeGroup for your master group
+masterService: "opensearch-cluster-master"
+
+# OpenSearch roles that will be applied to this nodeGroup
+# These will be set as environment variable "node.roles". E.g. node.roles=master,ingest,data,remote_cluster_client
+roles:
+  - master
+  - ingest
+  - data
+  - remote_cluster_client
+
+replicas: 3
+
+# if not set, falls back to parsing .Values.imageTag, then .Chart.appVersion.
+majorVersion: ""
+
+global:
+  # Set if you want to change the default docker registry, e.g. a private one.
+  dockerRegistry: ""
+
+# Allows you to add any config files in {{ .Values.opensearchHome }}/config
+opensearchHome: /usr/share/opensearch
+
+# such as opensearch.yml and log4j2.properties
+config:
+  # Values must be YAML literal style scalar / YAML multiline string.
+  # <filename>: |
+  #   <formatted-value(s)>
+  # log4j2.properties: |
+  #   status = error
+  #
+  #   appender.console.type = Console
+  #   appender.console.name = console
+  #   appender.console.layout.type = PatternLayout
+  #   appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n
+  #
+  #   rootLogger.level = info
+  #   rootLogger.appenderRef.console.ref = console
+  opensearch.yml: |
+    cluster.name: brilliant-opensearch-cluster
+
+    # Bind to all interfaces because we don't know what IP address Docker will assign to us.
+    network.host: 0.0.0.0
+
+    # Setting network.host to a non-loopback address enables the annoying bootstrap checks. "Single-node" mode disables them again.
+    # Implicitly done if ".singleNode" is set to "true".
+    # discovery.type: single-node
+
+    # Start OpenSearch Security Demo Configuration
+    # WARNING: revise all the lines below before you go into production
+    # plugins:
+    #   security:
+    #     ssl:
+    #       transport:
+    #         pemcert_filepath: esnode.pem
+    #         pemkey_filepath: esnode-key.pem
+    #         pemtrustedcas_filepath: root-ca.pem
+    #         enforce_hostname_verification: false
+    #       http:
+    #         enabled: true
+    #         pemcert_filepath: esnode.pem
+    #         pemkey_filepath: esnode-key.pem
+    #         pemtrustedcas_filepath: root-ca.pem
+    #     allow_unsafe_democertificates: true
+    #     allow_default_init_securityindex: true
+    #     authcz:
+    #       admin_dn:
+    #         - CN=kirk,OU=client,O=client,L=test,C=de
+    #     audit.type: internal_opensearch
+    #     enable_snapshot_restore_privilege: true
+    #     check_snapshot_restore_write_privileges: true
+    #     restapi:
+    #       roles_enabled: ["all_access", "security_rest_api_access"]
+    #     system_indices:
+    #       enabled: true
+    #       indices:
+    #         [
+    #           ".opendistro-alerting-config",
+    #           ".opendistro-alerting-alert*",
+    #           ".opendistro-anomaly-results*",
+    #           ".opendistro-anomaly-detector*",
+    #           ".opendistro-anomaly-checkpoints",
+    #           ".opendistro-anomaly-detection-state",
+    #           ".opendistro-reports-*",
+    #           ".opendistro-notifications-*",
+    #           ".opendistro-notebooks",
+    #           ".opendistro-asynchronous-search-response*",
+    #         ]
+    ######## End OpenSearch Security Demo Configuration ########
+  # log4j2.properties:
+
+# Extra environment variables to append to this nodeGroup
+# This will be appended to the current 'env:' key. You can use any of the kubernetes env
+# syntax here
+extraEnvs: []
+#  - name: MY_ENVIRONMENT_VAR
+#    value: the_value_goes_here
+# Chart version 2.18.0 and App Version OpenSearch 2.12.0 onwards a custom strong password needs to be provided in order to setup demo admin user.
+# Cluster will not spin-up without this unless demo config install is disabled.
+#  - name: OPENSEARCH_INITIAL_ADMIN_PASSWORD
+#    value: <strong-password>
+
+# Allows you to load environment variables from kubernetes secret or config map
+envFrom: []
+# - secretRef:
+#     name: env-secret
+# - configMapRef:
+#     name: config-map
+
+# A list of secrets and their paths to mount inside the pod
+# This is useful for mounting certificates for security and for mounting
+# the X-Pack license
+secretMounts: []
+
+hostAliases: []
+# - ip: "127.0.0.1"
+#   hostnames:
+#   - "foo.local"
+#   - "bar.local"
+
+image:
+  repository: "opensearchproject/opensearch"
+  # override image tag, which is .Chart.AppVersion by default
+  tag: "3"
+  pullPolicy: "IfNotPresent"
+
+podAnnotations: {}
+  # iam.amazonaws.com/role: es-cluster
+
+# OpenSearch Statefulset annotations
+openSearchAnnotations: {}
+
+# additionals labels
+labels: {}
+
+opensearchJavaOpts: "-Xmx512M -Xms512M"
+
+resources:
+  requests:
+    cpu: "2"
+    memory: "6Gi"
+  limits:
+    cpu: "4"
+    memory: "8Gi"
+
+initResources: {}
+#  limits:
+#     cpu: "25m"
+#     memory: "128Mi"
+#  requests:
+#     cpu: "25m"
+#     memory: "128Mi"
+
+sidecarResources: {}
+#   limits:
+#     cpu: "25m"
+#     memory: "128Mi"
+#   requests:
+#     cpu: "25m"
+#     memory: "128Mi"
+
+networkHost: "0.0.0.0"
+
+rbac:
+  create: false
+  serviceAccountAnnotations: {}
+  serviceAccountName: ""
+  # Controls whether or not the Service Account token is automatically mounted to /var/run/secrets/kubernetes.io/serviceaccount
+  automountServiceAccountToken: false
+
+podSecurityPolicy:
+  create: false
+  name: ""
+  spec:
+    privileged: true
+    fsGroup:
+      rule: RunAsAny
+    runAsUser:
+      rule: RunAsAny
+    seLinux:
+      rule: RunAsAny
+    supplementalGroups:
+      rule: RunAsAny
+    volumes:
+      - secret
+      - configMap
+      - persistentVolumeClaim
+      - emptyDir
+
+persistence:
+  enabled: true
+  # Set to false to disable the `fsgroup-volume` initContainer that will update permissions on the persistent disk.
+  enableInitChown: true
+  # override image, which is busybox by default
+  # image: busybox
+  # override image tag, which is latest by default
+  # imageTag:
+  labels:
+    # Add default labels for the volumeClaimTemplate of the StatefulSet
+    enabled: false
+    # Add custom labels for the volumeClaimTemplate of the StatefulSet
+    additionalLabels: {}
+  # OpenSearch Persistent Volume Storage Class
+  # If defined, storageClassName: <storageClass>
+  # If set to "-", storageClassName: "", which disables dynamic provisioning
+  # If undefined (the default) or set to null, no storageClassName spec is
+  #   set, choosing the default provisioner.  (gp2 on AWS, standard on
+  #   GKE, AWS & OpenStack)
+  #
+  storageClass: "longhorn"
+  accessModes:
+    - ReadWriteOnce
+  size: 120Gi
+  annotations: {}
+
+extraVolumes: []
+  # - name: extras
+  #   emptyDir: {}
+
+extraVolumeMounts: []
+  # - name: extras
+  #   mountPath: /usr/share/extras
+  #   readOnly: true
+
+extraContainers: []
+  # - name: do-something
+  #   image: busybox
+  #   command: ['do', 'something']
+
+extraInitContainers: []
+  # - name: do-somethings
+  #   image: busybox
+  #   command: ['do', 'something']
+
+# This is the PriorityClass settings as defined in
+# https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
+priorityClassName: ""
+
+# By default this will make sure two pods don't end up on the same node
+# Changing this to a region would allow you to spread pods across regions
+antiAffinityTopologyKey: "kubernetes.io/hostname"
+
+# Hard means that by default pods will only be scheduled if there are enough nodes for them
+# and that they will never end up on the same node. Setting this to soft will do this "best effort".
+# Setting this to custom will use what is passed into customAntiAffinity.
+antiAffinity: "hard"
+
+# Allows passing in custom anti-affinity settings as defined in
+# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity
+# Using this parameter requires setting antiAffinity to custom.
+customAntiAffinity: {}
+
+# This is the node affinity settings as defined in
+# https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#node-affinity-beta-feature
+nodeAffinity: 
+  requiredDuringSchedulingIgnoredDuringExecution:
+    nodeSelectorTerms:
+    - matchExpressions:
+      - key: k3s.io/hostname
+        operator: NotIn
+        values:
+        - k8s-cp-01
+
+
+# This is the pod affinity settings as defined in
+# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity
+podAffinity: {}
+
+# This is the pod topology spread constraints
+# https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
+topologySpreadConstraints: []
+
+# The default is to deploy all pods serially. By setting this to parallel all pods are started at
+# the same time when bootstrapping the cluster
+podManagementPolicy: "Parallel"
+
+# The environment variables injected by service links are not used, but can lead to slow OpenSearch boot times when
+# there are many services in the current namespace.
+# If you experience slow pod startups you probably want to set this to `false`.
+enableServiceLinks: true
+
+protocol: https
+httpPort: 9200
+transportPort: 9300
+metricsPort: 9600
+httpHostPort: ""
+transportHostPort: ""
+
+
+service:
+  labels: {}
+  labelsHeadless: {}
+  headless:
+    annotations: {}
+  type: ClusterIP
+  # The IP family and IP families options are to set the behaviour in a dual-stack environment
+  # Omitting these values will let the service fall back to whatever the CNI dictates the defaults
+  # should be
+  #
+  # ipFamilyPolicy: SingleStack
+  # ipFamilies:
+  # - IPv4
+  nodePort: ""
+  annotations: {}
+  httpPortName: http
+  transportPortName: transport
+  metricsPortName: metrics
+  loadBalancerIP: ""
+  loadBalancerSourceRanges: []
+  externalTrafficPolicy: ""
+
+updateStrategy: RollingUpdate
+
+# This is the max unavailable setting for the pod disruption budget
+# The default value of 1 will make sure that kubernetes won't allow more than 1
+# of your pods to be unavailable during maintenance
+maxUnavailable: 1
+
+podSecurityContext:
+  fsGroup: 1000
+  runAsUser: 1000
+
+securityContext:
+  capabilities:
+    drop:
+      - ALL
+  # readOnlyRootFilesystem: true
+  runAsNonRoot: true
+  runAsUser: 1000
+
+securityConfig:
+  enabled: true
+  path: "/usr/share/opensearch/config/opensearch-security"
+  actionGroupsSecret:
+  configSecret:
+  internalUsersSecret:
+  rolesSecret:
+  rolesMappingSecret:
+  tenantsSecret:
+  # The following option simplifies securityConfig by using a single secret and
+  # specifying the config files as keys in the secret instead of creating
+  # different secrets for for each config file.
+  # Note that this is an alternative to the individual secret configuration
+  # above and shouldn't be used if the above secrets are used.
+  config:
+    # There are multiple ways to define the configuration here:
+    # * If you define anything under data, the chart will automatically create
+    #   a secret and mount it. This is best option to choose if you want to override all the
+    #   existing yml files at once.
+    # * If you define securityConfigSecret, the chart will assume this secret is
+    #   created externally and mount it. This is best option to choose if your intention is to
+    #   only update a single yml file.
+    # * It is an error to define both data and securityConfigSecret.
+    securityConfigSecret: ""
+    dataComplete: true
+    data: {}
+      # config.yml: |-
+      # internal_users.yml: |-
+      # roles.yml: |-
+      # roles_mapping.yml: |-
+      # action_groups.yml: |-
+      # tenants.yml: |-
+
+# How long to wait for opensearch to stop gracefully
+terminationGracePeriod: 120
+
+sysctlVmMaxMapCount: 262144
+
+startupProbe:
+  tcpSocket:
+    port: 9200
+  initialDelaySeconds: 5
+  periodSeconds: 10
+  timeoutSeconds: 3
+  failureThreshold: 30
+
+livenessProbe: {}
+  # periodSeconds: 20
+  # timeoutSeconds: 5
+  # failureThreshold: 10
+  # successThreshold: 1
+  # initialDelaySeconds: 10
+  # tcpSocket:
+  #   port: 9200
+
+readinessProbe:
+  tcpSocket:
+    port: 9200
+  periodSeconds: 5
+  timeoutSeconds: 3
+  failureThreshold: 3
+
+## Use an alternate scheduler.
+## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
+##
+schedulerName: ""
+
+imagePullSecrets: []
+nodeSelector: {}
+tolerations:
+- key: "dedicated"
+  operator: "Equal"
+  value: "storage"
+  effect: "NoSchedule"
+
+# Enabling this will publically expose your OpenSearch instance.
+# Only enable this if you have security enabled on your cluster
+ingress:
+  enabled: false
+  # For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName
+  # See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress
+  # ingressClassName: nginx
+
+  annotations: {}
+    # kubernetes.io/ingress.class: nginx
+    # kubernetes.io/tls-acme: "true"
+  ingressLabels: {}
+  path: /
+  hosts:
+    - chart-example.local
+  tls: []
+  #  - secretName: chart-example-tls
+  #    hosts:
+  #      - chart-example.local
+
+nameOverride: ""
+fullnameOverride: ""
+
+masterTerminationFix: false
+
+opensearchLifecycle: {}
+  # preStop:
+  #   exec:
+  #     command: ["/bin/sh", "-c", "echo Hello from the preStart handler > /usr/share/message"]
+  # postStart:
+  #   exec:
+  #     command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"]
+
+lifecycle: {}
+  # preStop:
+  #   exec:
+  #     command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"]
+  # postStart:
+  #   exec:
+  #     command:
+  #       - bash
+  #       - -c
+  #       - |
+  #         #!/bin/bash
+  #         # Add a template to adjust number of shards/replicas1
+  #         TEMPLATE_NAME=my_template
+  #         INDEX_PATTERN="logstash-*"
+  #         SHARD_COUNT=8
+  #         REPLICA_COUNT=1
+  #         ES_URL=http://localhost:9200
+  #         while [[ "$(curl -s -o /dev/null -w '%{http_code}\n' $ES_URL)" != "200" ]]; do sleep 1; done
+  #         curl -XPUT "$ES_URL/_template/$TEMPLATE_NAME" -H 'Content-Type: application/json' -d'{"index_patterns":['\""$INDEX_PATTERN"\"'],"settings":{"number_of_shards":'$SHARD_COUNT',"number_of_replicas":'$REPLICA_COUNT'}}'
+
+keystore: []
+# To add secrets to the keystore:
+#  - secretName: opensearch-encryption-key
+
+networkPolicy:
+  create: false
+  ## Enable creation of NetworkPolicy resources. Only Ingress traffic is filtered for now.
+  ## In order for a Pod to access OpenSearch, it needs to have the following label:
+  ## {{ template "uname" . }}-client: "true"
+  ## Example for default configuration to access HTTP port:
+  ## opensearch-master-http-client: "true"
+  ## Example for default configuration to access transport port:
+  ## opensearch-master-transport-client: "true"
+
+  http:
+    enabled: false
+
+# Deprecated
+# please use the above podSecurityContext.fsGroup instead
+fsGroup: ""
+
+## Set optimal sysctl's through securityContext. This requires privilege. Can be disabled if
+## the system has already been preconfigured. (Ex: https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html)
+## Also see: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/
+sysctl:
+  enabled: false
+
+## Set optimal sysctl's through privileged initContainer.
+sysctlInit:
+  enabled: false
+  # override image, which is busybox by default
+  # image: busybox
+  # override image tag, which is latest by default
+  # imageTag:
+
+## Enable to add 3rd Party / Custom plugins not offered in the default OpenSearch image.
+plugins:
+  enabled: false
+  installList: []
+  # - example-fake-plugin
+  removeList: []
+  # - example-fake-plugin
+
+# -- Array of extra K8s manifests to deploy
+extraObjects: []
+  # - apiVersion: secrets-store.csi.x-k8s.io/v1
+  #   kind: SecretProviderClass
+  #   metadata:
+  #     name: argocd-secrets-store
+  #   spec:
+  #     provider: aws
+  #     parameters:
+  #       objects: |
+  #         - objectName: "argocd"
+  #           objectType: "secretsmanager"
+  #           jmesPath:
+  #               - path: "client_id"
+  #                 objectAlias: "client_id"
+  #               - path: "client_secret"
+  #                 objectAlias: "client_secret"
+  #     secretObjects:
+  #     - data:
+  #       - key: client_id
+  #         objectName: client_id
+  #       - key: client_secret
+  #         objectName: client_secret
+  #       secretName: argocd-secrets-store
+  #       type: Opaque
+  #       labels:
+  #         app.kubernetes.io/part-of: argocd
+  # - |
+  #    apiVersion: policy/v1
+  #    kind: PodDisruptionBudget
+  #    metadata:
+  #      name: {{ template "opensearch.uname" . }}
+  #      labels:
+  #        {{- include "opensearch.labels" . | nindent 4 }}
+  #    spec:
+  #      minAvailable: 1
+  #      selector:
+  #        matchLabels:
+  #          {{- include "opensearch.selectorLabels" . | nindent 6 }}
+
+# ServiceMonitor Configuration for Prometheus
+# Enabling this option will create a ServiceMonitor resource that allows Prometheus to scrape metrics from the OpenSearch service.
+# This only creates the serviceMonitor, to actually have metrics Make sure to install the prometheus-exporter plugin needed for
+# serving metrics over the `.Values.plugins` value:
+# plugins:
+#   enabled: true
+#   installList:
+#     - https://github.com/aiven/prometheus-exporter-plugin-for-opensearch/releases/download/x.x.x.x/prometheus-exporter-x.x.x.x.zip
+serviceMonitor:
+  # Set to true to enable the ServiceMonitor resource
+  enabled: false
+
+  # HTTP path where metrics are exposed.
+  # Ensure this matches your OpenSearch service configuration.
+  path: /_prometheus/metrics
+
+  # Scheme to use for scraping.
+  scheme: http
+
+  # Frequency at which Prometheus will scrape metrics.
+  # Adjust based on your needs.
+  interval: 10s
+
+  # additional labels to be added to the ServiceMonitor
+  # labels:
+  #  k8s.example.com/prometheus: kube-prometheus
+  labels: {}
+
+  # additional tlsConfig to be added to the ServiceMonitor
+  tlsConfig: {}
+
+  # Basic Auth configuration for the service monitor
+  # You can either use existingSecret, which expects a secret to be already present with data.username and data.password
+  # or set the credentials over the helm values, making helm create a secret for you
+  # basicAuth:
+  #   enaled: true
+  #   existingSecret: my-secret
+  #   username:  my-username
+  #   password: my-password
+  basicAuth:
+    enabled: false