From 8545c452fe0d0f13c3fc6b24baaa69d6514655a7 Mon Sep 17 00:00:00 2001 From: Navid Sassan Date: Tue, 27 Oct 2026 16:11:59 +0100 Subject: [PATCH 1/2] fix(roles/repo_opensearch): deploy the key of the selected series and store it as .asc get_url kept the key the controller downloaded first, so mixing 2.x and 3.x hosts failed with "Bad GPG signature". Ubuntu 26.04 ignores an armored key named .pgp. Document that the 2.x key is rejected on RHEL 10 and Debian 13 (SHA-1 binding signature, verified on Rocky 10.2 and Debian 13). --- CHANGELOG.md | 2 ++ COMPATIBILITY.md | 2 +- roles/repo_opensearch/README.md | 12 +++++++--- roles/repo_opensearch/tasks/Debian.yml | 22 ++++++++++++++----- roles/repo_opensearch/tasks/RedHat.yml | 11 ++++++---- .../apt/sources.list.d/opensearch-org.list.j2 | 6 ++--- 6 files changed, 38 insertions(+), 17 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 54f7b52f7..af2936b20 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -156,6 +156,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed +* **role:repo_opensearch**: A host switched from OpenSearch 2.x to 3.x gets the signing key of 3.x, instead of the key the controller downloaded first, which made `dnf` fail with `repomd.xml GPG signature verification error: Bad GPG signature`. +* **role:repo_opensearch**: The repository works on Ubuntu 26.04, where `apt` ignored the signing key because of its file name. * **role:apache_httpd**: A vHost with `state: 'absent'` can be removed without a `template`, instead of aborting with `'dict object' has no attribute 'template'`. * **role:exoscale_vm**: The role works again after Exoscale switched off its CloudStack API, and no longer needs the `exo` CLI, the `cs` Python library or `exoscale_vm__account` on the Ansible controller. * **role:network**: `network_state` applies on hosts whose active connection profile, such as `cloud-init eth0` or `System eth0`, still stores DNS servers, instead of aborting with `ipv6.dns: this property is not allowed for 'method=disabled'`. DNS servers that `dns-resolver` does not list are removed from that profile. diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md index 76a988669..abe2793ab 100644 --- a/COMPATIBILITY.md +++ b/COMPATIBILITY.md @@ -149,7 +149,7 @@ Which Ansible role is proven to run on which OS? | repo_mongodb | x | x | x | x | x | x | x | x | | | repo_monitoring_plugins | x | x | x | x | x | x | x | x | SLES 15, SLES 16 | | repo_mydumper | x | x | x | x | x | x | x | x | | -| repo_opensearch | x | x | x | (x) | (x) | x | x | (x) | | +| repo_opensearch | x | x | x | x | x | x | x | x | OpenSearch 2.x not on Deb 13 and RHEL 10 | | repo_openvpn | - | - | x | x | x | - | - | - | | | repo_postgresql | | | x | x | x | | | | | | repo_proxysql | (x) | (x) | x | x | (x) | (x) | (x) | (x) | | diff --git a/roles/repo_opensearch/README.md b/roles/repo_opensearch/README.md index f0f8a7643..0e3e36ec4 100644 --- a/roles/repo_opensearch/README.md +++ b/roles/repo_opensearch/README.md @@ -1,16 +1,22 @@ # Ansible Role linuxfabrik.lfops.repo_opensearch -This role deploys the [Opensearch Package Repository](https://opensearch.org/docs/latest/opensearch/install/rpm/). +This role deploys the [OpenSearch Package Repository](https://docs.opensearch.org/latest/install-and-configure/install-opensearch/rpm/) for OpenSearch 2.x or 3.x. *Available since LFOps `2.0.0`.* +## Known Limitations + +* OpenSearch 2.x cannot be installed on RHEL 10 and Debian 13. The OpenSearch 2.x signing key (`opensearch.pgp`) binds its user ID with a SHA-1 signature, which the default crypto policy of these releases rejects. On RHEL 10, `dnf` fails with `Policy rejects 39D319879310D3FC: No binding signature at time ...` and `Error: GPG check FAILED`. On Debian 13, `apt update` fails with `SHA1 is not considered secure since 2026-02-01T00:00:00Z` and `The repository ... is not signed`. Use OpenSearch 3.x there, whose key (`opensearch-release.pgp`) is not affected. This role does not weaken the crypto policy. +* On RHEL 9, `dnf` imports the OpenSearch 2.x key and installs the packages, but a manual `rpmkeys --import` of the same key fails with `Hash algorithm SHA1 not available`. + + ## Tags `repo_opensearch` -* Deploys the Opensearch Package Repository. +* Deploys the OpenSearch Package Repository. * Triggers: none. @@ -18,7 +24,7 @@ This role deploys the [Opensearch Package Repository](https://opensearch.org/doc `repo_opensearch__version__host_var` / `repo_opensearch__version__group_var` -* The version of the Opensearch repository which should be installed. One of `'2.x'` or `'3.x'`. For the usage in `host_vars` / `group_vars` (can only be used in one group at a time). +* The version of the OpenSearch repository which should be installed. One of `'2.x'` or `'3.x'`. For the usage in `host_vars` / `group_vars` (can only be used in one group at a time). * Type: String. Example: diff --git a/roles/repo_opensearch/tasks/Debian.yml b/roles/repo_opensearch/tasks/Debian.yml index b72d185d3..ee7af63fe 100644 --- a/roles/repo_opensearch/tasks/Debian.yml +++ b/roles/repo_opensearch/tasks/Debian.yml @@ -1,10 +1,15 @@ - block: - # https://www.opensearch.com/docs/v6.0/tutorial/install-opensearch-on-debian/ - - name: 'curl {{ __repo_opensearch__gpgkey_url[repo_opensearch__version__combined_var] }} --output /tmp/ansible.opensearch.pgp' + # https://docs.opensearch.org/latest/install-and-configure/install-opensearch/debian/ + # The key is ASCII-armored, so it needs the `.asc` extension. Ubuntu 26.04 ignores an + # ASCII-armored key named `.pgp` ("unsupported filetype"). + # One file per series, since 2.x and 3.x are signed with different keys. get_url does + # not download a file that already exists, so a shared name would deploy the key of the + # series fetched first on this controller. + - name: 'curl {{ __repo_opensearch__gpgkey_url[repo_opensearch__version__combined_var] }} --output /tmp/ansible.opensearch-{{ repo_opensearch__version__combined_var }}.asc' ansible.builtin.get_url: url: '{{ __repo_opensearch__gpgkey_url[repo_opensearch__version__combined_var] }}' - dest: '/tmp/ansible.opensearch.pgp' + dest: '/tmp/ansible.opensearch-{{ repo_opensearch__version__combined_var }}.asc' mode: 0o644 retries: 3 # ride out a brief outage of the download source delay: 10 @@ -15,14 +20,19 @@ changed_when: false # not an actual config change on the server check_mode: false # run task even if `--check` is specified - - name: 'copy /tmp/ansible.opensearch.pgp to remote host' + - name: 'copy /tmp/ansible.opensearch-{{ repo_opensearch__version__combined_var }}.asc to remote host' ansible.builtin.copy: - src: '/tmp/ansible.opensearch.pgp' - dest: '/etc/apt/keyrings/opensearch.pgp' + src: '/tmp/ansible.opensearch-{{ repo_opensearch__version__combined_var }}.asc' + dest: '/etc/apt/keyrings/opensearch.asc' owner: 'root' group: 'root' mode: 0o644 + - name: 'rm -f /etc/apt/keyrings/opensearch.pgp # the key was deployed under this name before' + ansible.builtin.file: + path: '/etc/apt/keyrings/opensearch.pgp' + state: 'absent' + - name: 'deploy the repo file (mirror: {{ repo_opensearch__mirror_url | default("") }})' ansible.builtin.template: backup: true diff --git a/roles/repo_opensearch/tasks/RedHat.yml b/roles/repo_opensearch/tasks/RedHat.yml index 9c62f6482..4f904eab0 100644 --- a/roles/repo_opensearch/tasks/RedHat.yml +++ b/roles/repo_opensearch/tasks/RedHat.yml @@ -1,9 +1,12 @@ - block: - - name: 'curl {{ __repo_opensearch__gpgkey_url[repo_opensearch__version__combined_var] }} --output /tmp/ansible.RPM-GPG-KEY-opensearch' + # One file per series, since 2.x and 3.x are signed with different keys. get_url does + # not download a file that already exists, so a shared name would deploy the key of the + # series fetched first on this controller. + - name: 'curl {{ __repo_opensearch__gpgkey_url[repo_opensearch__version__combined_var] }} --output /tmp/ansible.RPM-GPG-KEY-opensearch-{{ repo_opensearch__version__combined_var }}' ansible.builtin.get_url: url: '{{ __repo_opensearch__gpgkey_url[repo_opensearch__version__combined_var] }}' - dest: '/tmp/ansible.RPM-GPG-KEY-opensearch' + dest: '/tmp/ansible.RPM-GPG-KEY-opensearch-{{ repo_opensearch__version__combined_var }}' mode: 0o644 retries: 3 # ride out a brief outage of the download source delay: 10 @@ -14,9 +17,9 @@ changed_when: false # not an actual config change on the server check_mode: false # run task even if `--check` is specified - - name: 'copy /tmp/ansible.RPM-PGP-KEY-opensearch to remote host' + - name: 'copy /tmp/ansible.RPM-GPG-KEY-opensearch-{{ repo_opensearch__version__combined_var }} to remote host' ansible.builtin.copy: - src: '/tmp/ansible.RPM-GPG-KEY-opensearch' + src: '/tmp/ansible.RPM-GPG-KEY-opensearch-{{ repo_opensearch__version__combined_var }}' dest: '/etc/pki/rpm-gpg/RPM-GPG-KEY-opensearch' mode: 0o644 diff --git a/roles/repo_opensearch/templates/etc/apt/sources.list.d/opensearch-org.list.j2 b/roles/repo_opensearch/templates/etc/apt/sources.list.d/opensearch-org.list.j2 index 2fb0f7c40..24d42db76 100644 --- a/roles/repo_opensearch/templates/etc/apt/sources.list.d/opensearch-org.list.j2 +++ b/roles/repo_opensearch/templates/etc/apt/sources.list.d/opensearch-org.list.j2 @@ -1,8 +1,8 @@ # {{ ansible_managed }} -# 2025011601 +# 2026102701 {% if repo_opensearch__mirror_url is defined and repo_opensearch__mirror_url | length %} -deb [signed-by=/etc/apt/keyrings/opensearch.pgp] {{ repo_opensearch__mirror_url }}/opensearch/{{ repo_opensearch__version__combined_var }}/apt stable main +deb [signed-by=/etc/apt/keyrings/opensearch.asc] {{ repo_opensearch__mirror_url }}/opensearch/{{ repo_opensearch__version__combined_var }}/apt stable main {% else %} -deb [signed-by=/etc/apt/keyrings/opensearch.pgp] https://artifacts.opensearch.org/releases/bundle/opensearch/{{ repo_opensearch__version__combined_var }}/apt stable main +deb [signed-by=/etc/apt/keyrings/opensearch.asc] https://artifacts.opensearch.org/releases/bundle/opensearch/{{ repo_opensearch__version__combined_var }}/apt stable main {% endif %} From ab382f345dc7d18d74e9a9e80125987e46c7add4 Mon Sep 17 00:00:00 2001 From: Navid Sassan Date: Tue, 27 Oct 2026 16:12:00 +0100 Subject: [PATCH 2/2] feat(roles/opensearch)!: support OpenSearch 3.x, drop 1.x The 3.x template is based on opensearch 3.9.0, the 2.x template is synced to 2.19.7 and the sysconfig template is based on 3.9.0. The transport layer uses node-transport.key instead of node-http.key. The README describes the upgrade from 2.x, including the jvm.options.rpmnew step. BREAKING CHANGE: OpenSearch 1.x is no longer supported. --- CHANGELOG.md | 4 ++ COMPATIBILITY.md | 2 +- roles/opensearch/README.md | 24 +++++++- .../etc/opensearch/2.x-opensearch.yml.j2 | 13 +++- ...pensearch.yml.j2 => 3.x-opensearch.yml.j2} | 61 ++++++++++++++++--- .../templates/etc/sysconfig/opensearch.j2 | 13 ++-- roles/opensearch/vars/main.yml | 2 +- 7 files changed, 101 insertions(+), 18 deletions(-) rename roles/opensearch/templates/etc/opensearch/{1.x-opensearch.yml.j2 => 3.x-opensearch.yml.j2} (66%) diff --git a/CHANGELOG.md b/CHANGELOG.md index af2936b20..1e00d8f00 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,6 +12,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Breaking Changes +* **role:opensearch**: OpenSearch 1.x is no longer supported, and the run aborts on a host that runs it. Upgrade such hosts to OpenSearch 2.19 first, following the [OpenSearch upgrade documentation](https://docs.opensearch.org/latest/install-and-configure/upgrade-opensearch/index/). OpenSearch 2.x cannot be installed on RHEL 10 and Debian 13, whose crypto policy rejects the SHA-1 signature in the OpenSearch 2.x signing key; use OpenSearch 3.x there. * **role:chrony**: Without `chrony__ntp_pools` or `chrony__ntp_servers` in the inventory, chronyd synchronises with `ntp.linuxfabrik.ch` instead of `ntp.metas.ch`. Allow outgoing NTP to `ntp.linuxfabrik.ch` (195.15.242.254) where a firewall only lets the METAS servers through, or set `chrony__ntp_servers: ['ntp.metas.ch']`. * **role:exoscale_vm**: The role scales an existing instance and grows its disk when `exoscale_vm__service_offering` or `exoscale_vm__disk_size` differ from it, and aborts on a running instance instead of stopping it, unless `exoscale_vm__force: true` is set. Before running the role against existing instances, set both variables to their current values, or set `exoscale_vm__force: true` in a maintenance window. `exoscale_vm__state` only accepts `absent`, `present`, `restarted`, `started` and `stopped`. * **role:php**: PHP no longer tracks file uploads in the session (`session.upload_progress.enabled = Off`), a confirmed way into the remote code execution CVE-2026-109619 ([GHSA-6wmf-4rv5-p3rp](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)) that the advisory recommends closing even on patched PHP, and the PHP-FPM pools enforce this against `.user.ini` files. Upload progress bars that depend on it stop working. Set `php__ini_session_upload_progress_enabled__host_var: 'On'` to restore the feature. @@ -53,6 +54,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Added +* **role:opensearch**: Supports OpenSearch 3.x. The role README describes the upgrade from 2.x. * **role:chrony**: chronyd can serve as a public NTP server, for example in the NTP Pool, with response rate limiting (`chrony__ratelimit`) and room for many clients (`chrony__clientloglimit`). * **role:exoscale_vm**: Security group rules support every protocol Exoscale offers, ICMP with `icmp_type` and `icmp_code`, private networks can be detached with `state: 'absent'`, and an existing instance is attached to a security group added later. * **role:collabora**: Add support for Collabora Online Enterprise 25.04.14. @@ -102,6 +104,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Changed +* **role:opensearch**: `/etc/sysconfig/opensearch` adds the native library path of the Neural Search plugin, as the OpenSearch package does. * **role:postfix**: On hosts without an IPv6 default route, Postfix uses IPv4 only, so it no longer logs `Network is unreachable` for the IPv6 address of the next hop on part of the deliveries. * **role:nextcloud**: The `support` app is enabled by default, as Nextcloud ships it, so an Enterprise instance keeps its subscription record current. * **role:postgresql_server**: A changed `pg_hba.conf` or `postgresql_server__conf_password_encryption` reloads PostgreSQL instead of restarting it, so open connections are kept; the first run after the update still restarts it once. @@ -158,6 +161,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 * **role:repo_opensearch**: A host switched from OpenSearch 2.x to 3.x gets the signing key of 3.x, instead of the key the controller downloaded first, which made `dnf` fail with `repomd.xml GPG signature verification error: Bad GPG signature`. * **role:repo_opensearch**: The repository works on Ubuntu 26.04, where `apt` ignored the signing key because of its file name. +* **role:opensearch**: The transport layer uses the key of the transport certificate (`node-transport.key`) instead of the one of the HTTP certificate, so cluster nodes whose two certificates have different keys can talk to each other. * **role:apache_httpd**: A vHost with `state: 'absent'` can be removed without a `template`, instead of aborting with `'dict object' has no attribute 'template'`. * **role:exoscale_vm**: The role works again after Exoscale switched off its CloudStack API, and no longer needs the `exo` CLI, the `cs` Python library or `exoscale_vm__account` on the Ansible controller. * **role:network**: `network_state` applies on hosts whose active connection profile, such as `cloud-init eth0` or `System eth0`, still stores DNS servers, instead of aborting with `ipv6.dns: this property is not allowed for 'method=disabled'`. DNS servers that `dns-resolver` does not list are removed from that profile. diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md index abe2793ab..e7d5e46de 100644 --- a/COMPATIBILITY.md +++ b/COMPATIBILITY.md @@ -119,7 +119,7 @@ Which Ansible role is proven to run on which OS? | nfs_server | (x) | (x) | x | (x) | (x) | (x) | (x) | (x) | | | nodejs | (x) | (x) | x | x | (x) | (x) | (x) | (x) | | | open_vm_tools | | | x | x | (x) | | | | | -| opensearch | | | x | x | (x) | | | | | +| opensearch | | | x | x | x | | | | OpenSearch 2.x not on RHEL 10 | | openvpn_server | - | - | x | x | x | - | - | - | | | php | x | x | x | x | x | (x) | (x) | (x) | | | podman_containers | | | (x) | x | (x) | | | | | diff --git a/roles/opensearch/README.md b/roles/opensearch/README.md index cd758b27a..f869fbf9f 100644 --- a/roles/opensearch/README.md +++ b/roles/opensearch/README.md @@ -6,8 +6,10 @@ Note that this role does NOT let you specify a particular OpenSearch version. It Supported versions: -* 1.x * 2.x +* 3.x + +OpenSearch 2.x cannot be installed on RHEL 10 and Debian 13, see the Known Limitations of [linuxfabrik.lfops.repo_opensearch](https://github.com/Linuxfabrik/lfops/tree/main/roles/repo_opensearch). Hints for configuring TLS: @@ -27,7 +29,7 @@ Any [LFOps playbook](https://github.com/Linuxfabrik/lfops/blob/main/playbooks/RE ## Single-Node Setup -For a single-node setup, no special configuration is needed beyond the mandatory variables. When `opensearch__discovery_seed_hosts` is not set, OpenSearch 2.x automatically runs in single-node mode (`discovery.type: single-node`). After installation, verify that OpenSearch is running and set the default replica count to 0, otherwise the cluster health stays `yellow` (see Post-Installation Steps below). +For a single-node setup, no special configuration is needed beyond the mandatory variables. When `opensearch__discovery_seed_hosts` is not set, the role configures OpenSearch in single-node mode (`discovery.type: single-node`). After installation, verify that OpenSearch is running and set the default replica count to 0, otherwise the cluster health stays `yellow` (see Post-Installation Steps below). ## Cluster Setup @@ -192,6 +194,17 @@ ansible-playbook --inventory inventory linuxfabrik.lfops.opensearch --tags opens ``` +## Upgrading from OpenSearch 2.x to 3.x + +The role installs OpenSearch, but does not upgrade an installed one to the next major version. Upgrade a cluster one node at a time: + +1. Upgrade the node to the latest OpenSearch 2.19 release first. OpenSearch 3.x only joins a cluster with 2.19 nodes and cannot read indices created by OpenSearch 1.x; reindex those before the upgrade. +2. Set `repo_opensearch__version__host_var: '3.x'` (or the `__group_var`) and adjust `opensearch__version__host_var` / `opensearch__version__group_var` if set, then deploy the repository with `--tags repo_opensearch`. +3. Upgrade the package, for example with `dnf upgrade opensearch`. +4. Replace `/etc/opensearch/jvm.options` with the file shipped by the package: `mv /etc/opensearch/jvm.options.rpmnew /etc/opensearch/jvm.options`. The 2.x file enables the Java Security Manager, which the JDK of OpenSearch 3.x refuses (see Troubleshooting). +5. Run the playbook, which deploys the 3.x configuration and starts OpenSearch. + + ## Post-Installation Steps After setting up a single node or cluster, verify that OpenSearch is running: @@ -379,7 +392,7 @@ Only optional if `opensearch__plugins_security_disabled` is `true`. `opensearch__plugins_security_disabled` -* Enables or disables the OpenSearch [security plugin](https://opensearch.org/docs/1.3/security-plugin/index/), which offers encryption, authentication, access control as well as audit logging and compliance. +* Enables or disables the OpenSearch [security plugin](https://docs.opensearch.org/latest/security/), which offers encryption, authentication, access control as well as audit logging and compliance. * Type: Bool. * Default: `false` @@ -588,6 +601,11 @@ opensearch__generate_certs_nodes: **The run aborts with `OpenSearch X.x is not supported by this role`** * The enabled repositories offer an OpenSearch major version this role has no configuration template for. Either pin the host to a supported version, or add the matching `roles/opensearch/templates/etc/opensearch/.x-opensearch.yml.j2` template and list the major in `roles/opensearch/vars/main.yml`. +* On a host that still runs OpenSearch 1.x, upgrade to OpenSearch 2.19 by hand first, see the [OpenSearch upgrade documentation](https://docs.opensearch.org/latest/install-and-configure/upgrade-opensearch/index/). + +**OpenSearch fails to start after an upgrade to 3.x with `A command line option has attempted to allow or enable the Security Manager`** + +* `/etc/opensearch/jvm.options` is still the file of OpenSearch 2.x. Replace it with the one of the package, see "Upgrading from OpenSearch 2.x to 3.x". ## License diff --git a/roles/opensearch/templates/etc/opensearch/2.x-opensearch.yml.j2 b/roles/opensearch/templates/etc/opensearch/2.x-opensearch.yml.j2 index a87b322d1..0d1de5e79 100644 --- a/roles/opensearch/templates/etc/opensearch/2.x-opensearch.yml.j2 +++ b/roles/opensearch/templates/etc/opensearch/2.x-opensearch.yml.j2 @@ -1,6 +1,7 @@ # {{ ansible_managed }} -# 2026070801 +# 2026102701 # 2.x +{# Based on opensearch 2.19.7 #} # ======================== OpenSearch Configuration ========================= # # NOTE: OpenSearch comes with reasonable defaults for most settings. @@ -140,6 +141,14 @@ cluster.initial_cluster_manager_nodes: {{ opensearch__cluster_initial_cluster_ma # Once there is no observed impact on performance, this feature flag can be removed. # #opensearch.experimental.optimization.datetime_formatter_caching.enabled: false +# +# Gates the functionality of enabling Opensearch to use pluggable caches with respective store names via setting. +# +#opensearch.experimental.feature.pluggable.caching.enabled: false +# +# Gates the functionality of star tree index, which improves the performance of search aggregations. +# +#opensearch.experimental.feature.composite_index.star_tree.enabled: false action.auto_create_index: {{ opensearch__action_auto_create_index__combined_var | default(true) | string | lower }} plugins.security.disabled: {{ opensearch__plugins_security_disabled | default(true) | string | lower }} @@ -159,6 +168,6 @@ plugins.security.ssl.http.pemkey_filepath: 'node-http.key' plugins.security.ssl.http.pemtrustedcas_filepath: 'root-ca.pem' plugins.security.ssl.transport.enforce_hostname_verification: {{ opensearch__plugins_security_transport_enforce_hostname_verification | d(false) | string | lower }} plugins.security.ssl.transport.pemcert_filepath: 'node-transport.pem' -plugins.security.ssl.transport.pemkey_filepath: 'node-http.key' +plugins.security.ssl.transport.pemkey_filepath: 'node-transport.key' plugins.security.ssl.transport.pemtrustedcas_filepath: 'root-ca.pem' plugins.security.ssl.transport.resolve_hostname: {{ opensearch__plugins_security_transport_resolve_hostname | d(true) | string | lower }} diff --git a/roles/opensearch/templates/etc/opensearch/1.x-opensearch.yml.j2 b/roles/opensearch/templates/etc/opensearch/3.x-opensearch.yml.j2 similarity index 66% rename from roles/opensearch/templates/etc/opensearch/1.x-opensearch.yml.j2 rename to roles/opensearch/templates/etc/opensearch/3.x-opensearch.yml.j2 index adc894e45..c8a640ef1 100644 --- a/roles/opensearch/templates/etc/opensearch/1.x-opensearch.yml.j2 +++ b/roles/opensearch/templates/etc/opensearch/3.x-opensearch.yml.j2 @@ -1,6 +1,7 @@ # {{ ansible_managed }} -# 2026070801 -# 1.x +# 2026102701 +# 3.x +{# Based on opensearch 3.9.0 #} # ======================== OpenSearch Configuration ========================= # # NOTE: OpenSearch comes with reasonable defaults for most settings. @@ -79,13 +80,15 @@ network.host: {{ opensearch__network_host }} #discovery.seed_hosts: ["host1", "host2"] {% if opensearch__discovery_seed_hosts is defined and opensearch__discovery_seed_hosts | length %} discovery.seed_hosts: {{ opensearch__discovery_seed_hosts | ansible.builtin.to_yaml }} +{% else %} +discovery.type: single-node {% endif %} # -# Bootstrap the cluster using an initial set of master-eligible nodes: +# Bootstrap the cluster using an initial set of cluster-manager-eligible nodes: # -#cluster.initial_master_nodes: ["node-1", "node-2"] +#cluster.initial_cluster_manager_nodes: ["node-1", "node-2"] {% if opensearch__cluster_initial_cluster_manager_nodes is defined and opensearch__cluster_initial_cluster_manager_nodes | length %} -cluster.initial_master_nodes: {{ opensearch__cluster_initial_cluster_manager_nodes | ansible.builtin.to_yaml }} +cluster.initial_cluster_manager_nodes: {{ opensearch__cluster_initial_cluster_manager_nodes | ansible.builtin.to_yaml }} {% endif %} # # For more information, consult the discovery and cluster formation module documentation. @@ -94,7 +97,7 @@ cluster.initial_master_nodes: {{ opensearch__cluster_initial_cluster_manager_nod # # Block initial recovery after a full cluster restart until N nodes are started: # -#gateway.recover_after_nodes: 3 +#gateway.recover_after_data_nodes: 3 # # For more information, consult the gateway module documentation. # @@ -103,6 +106,50 @@ cluster.initial_master_nodes: {{ opensearch__cluster_initial_cluster_manager_nod # Require explicit names when deleting indices: # #action.destructive_requires_name: true +# +# ---------------------------------- Remote Store ----------------------------------- +# Controls whether cluster imposes index creation only with remote store enabled +# cluster.remote_store.enabled: true +# +# Repository to use for segment upload while enforcing remote store for an index +# node.attr.remote_store.segment.repository: my-repo-1 +# +# Repository to use for translog upload while enforcing remote store for an index +# node.attr.remote_store.translog.repository: my-repo-1 +# +# ---------------------------------- Experimental Features ----------------------------------- +# Gates the visibility of the experimental segment replication features until they are production ready. +# +#opensearch.experimental.feature.segment_replication_experimental.enabled: false +# +# Gates the functionality of a new parameter to the snapshot restore API +# that allows for creation of a new index type that searches a snapshot +# directly in a remote repository without restoring all index data to disk +# ahead of time. +# +#opensearch.experimental.feature.searchable_snapshot.enabled: false +# +# +# Gates the functionality of enabling extensions to work with OpenSearch. +# This feature enables applications to extend features of OpenSearch outside of +# the core. +# +#opensearch.experimental.feature.extensions.enabled: false +# +# +# Gates the optimization of datetime formatters caching along with change in default datetime formatter +# Once there is no observed impact on performance, this feature flag can be removed. +# +#opensearch.experimental.optimization.datetime_formatter_caching.enabled: false +# +# Path to the spill directory used by the analytics-backend-datafusion plugin. When +# unset (default), spill is disabled and queries that exceed +# datafusion.memory_pool_limit_bytes will fail with a "DiskManager is disabled" error. +# Set this to a directory on a dedicated filesystem to enable spill — the directory +# should not contend with the data path. NodeScope, Final — DataFusion's DiskManager +# is built once at runtime startup. +# +#datafusion.spill_directory: action.auto_create_index: {{ opensearch__action_auto_create_index__combined_var | default(true) | string | lower }} plugins.security.disabled: {{ opensearch__plugins_security_disabled | default(true) | string | lower }} @@ -122,6 +169,6 @@ plugins.security.ssl.http.pemkey_filepath: 'node-http.key' plugins.security.ssl.http.pemtrustedcas_filepath: 'root-ca.pem' plugins.security.ssl.transport.enforce_hostname_verification: {{ opensearch__plugins_security_transport_enforce_hostname_verification | d(false) | string | lower }} plugins.security.ssl.transport.pemcert_filepath: 'node-transport.pem' -plugins.security.ssl.transport.pemkey_filepath: 'node-http.key' +plugins.security.ssl.transport.pemkey_filepath: 'node-transport.key' plugins.security.ssl.transport.pemtrustedcas_filepath: 'root-ca.pem' plugins.security.ssl.transport.resolve_hostname: {{ opensearch__plugins_security_transport_resolve_hostname | d(true) | string | lower }} diff --git a/roles/opensearch/templates/etc/sysconfig/opensearch.j2 b/roles/opensearch/templates/etc/sysconfig/opensearch.j2 index 65d271ab7..898f0903a 100644 --- a/roles/opensearch/templates/etc/sysconfig/opensearch.j2 +++ b/roles/opensearch/templates/etc/sysconfig/opensearch.j2 @@ -1,5 +1,6 @@ # {{ ansible_managed }} -# 2024110601 +# 2026102701 +{# Based on opensearch 3.9.0 #} ################################ # OpenSearch @@ -8,9 +9,6 @@ # OpenSearch home directory OPENSEARCH_HOME=/usr/share/opensearch -# k-NN Lib Path -LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/share/opensearch/plugins/opensearch-knn/lib - # OpenSearch Java path #OPENSEARCH_JAVA_HOME=/usr/lib/jvm/java-11-amazon-corretto @@ -57,3 +55,10 @@ OPENSEARCH_SD_NOTIFY=true # When using Systemd, this setting is ignored and the 'vm.max_map_count' # property is set at boot time in /usr/lib/sysctl.d/opensearch.conf #MAX_MAP_COUNT=262144 + +################################ +# Plugin properties +################################ + +# k-NN / Neural Sparse Native Lib Path +LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/share/opensearch/plugins/opensearch-knn/lib:/usr/share/opensearch/plugins/opensearch-neural-search/lib diff --git a/roles/opensearch/vars/main.yml b/roles/opensearch/vars/main.yml index 2a2fbc5e7..4c0ab63d8 100644 --- a/roles/opensearch/vars/main.yml +++ b/roles/opensearch/vars/main.yml @@ -3,5 +3,5 @@ # matched against this list so an unsupported one aborts with a clear message instead # of a missing-file error. Extend it whenever a template for a new major is added. __opensearch__supported_versions: - - '1.x' - '2.x' + - '3.x'