Repository navigation
feat(roles/opensearch)!: support OpenSearch 3.x, drop 1.x - #508
Merged
Merged
Conversation
… store it as .asc get_url kept the key the controller downloaded first, so mixing 2.x and 3.x hosts failed with "Bad GPG signature". Ubuntu 26.04 ignores an armored key named .pgp. Document that the 2.x key is rejected on RHEL 10 and Debian 13 (SHA-1 binding signature, verified on Rocky 10.2 and Debian 13).
The 3.x template is based on opensearch 3.9.0, the 2.x template is synced to 2.19.7 and the sysconfig template is based on 3.9.0. The transport layer uses node-transport.key instead of node-http.key. The README describes the upgrade from 2.x, including the jvm.options.rpmnew step. BREAKING CHANGE: OpenSearch 1.x is no longer supported.
This was referenced Oct 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Drops OpenSearch 1.x and supports 2.x and 3.x in
repo_opensearchandopensearch.opensearch
3.x-opensearch.yml.j2based on 3.9.0 with the LFOps lines of the previous template; the 1.x template is removed and the role aborts on a 1.x host.node-http.key, nownode-transport.key.jvm.options.rpmnewstep (the kept 2.xjvm.optionsstops 3.x from starting).repo_opensearch
/tmppath andget_urlnever refreshed it, so the second host or a switch from 2.x to 3.x got the wrong key (Bad GPG signature). The file name now carries the series..pgp, which Ubuntu 26.04 ignores; now.asc, the old file is removed.Policy rejects ... No binding signature) and Debian 13 (SHA1 is not considered secure since 2026-02-01), works on Rocky 8/9, Debian 12 and Ubuntu 22.04/24.04/26.04. Documented, the role does not change the crypto policy.Tests: the real playbook in ubi-init containers on Rocky 8 and 9 with 2.19.7 and 3.9.0 (security plugin with own CA, internal users, heap), Rocky 10 with 3.9.0 (needs a test-only systemd sandbox drop-in under rootless podman), in-place upgrade 2.19.7 -> 3.9.0 on Rocky 9,
repo_opensearchon Debian 13 and Ubuntu 26.04. Not tested: multi-node cluster (transport key), the role on Debian/Ubuntu,opensearch:generate_certs. No Molecule scenario exists.