OpenSearch security plug-in

The OpenSearch security plug-in, enabled by default, enhances the security and access control capabilities when working with OpenSearch Dashboards. The OpenSearch security plug-in supports configuration through a REST API or directly from within the OpenSearch pod.

Configure via REST API

About this task

To configure the plug-in remotely, access the OpenSearch REST API from outside the cluster using administrator credentials.

Procedure

Get the OpenSearch URL and administrator credentials.

# Get the OpenSearch URL
OPENSEARCH_URL="https://$(oc get route opensearch-route -o jsonpath='{.spec.host}')"

# Get admin credentials
OPENSEARCH_SECRET=opensearch-admin-user
OPENSEARCH_USERNAME=$(oc get "secret/$OPENSEARCH_SECRET" -o json | jq -r '.data | keys[0]')
OPENSEARCH_PASSWORD=$(oc extract "secret/$OPENSEARCH_SECRET" --keys="$OPENSEARCH_USERNAME" --to=- 2>/dev/null)
ADMIN="${OPENSEARCH_USERNAME}:${OPENSEARCH_PASSWORD}"

Retrieve the current security plug-in configuration.
```
curl --insecure -u "$ADMIN" -X GET \
  "${OPENSEARCH_URL}/_plugins/_security/api/securityconfig?pretty"
```
Note: The --insecure flag is required if your certificates are self-signed.

Configure directly in the OpenSearch pod

About this task

You can also configure the security plug-in from inside the opensearch-all-000 pod. The default configuration files are located at:

/workdir/opensearch/config/opensearch-security/

Procedure

Convert the TLS key to PKCS8 format (required only once).

openssl pkcs8 -topk8 -inform PEM -outform PEM \
  -in /workdir/opensearch/config/certificate/http/default/tls.key \
  -out /tmp/tls8.key -nocrypt

Apply the updated configuration.

bash /workdir/opensearch/plugins/opensearch-security/tools/securityadmin.sh \
  -cd /workdir/opensearch/config/opensearch-security \
  -icl -nhnv \
  -cacert /workdir/opensearch/config/certificate/http/default/ca.crt \
  -cert /workdir/opensearch/config/certificate/http/default/tls.crt \
  -key /tmp/tls8.key

OpenSearch documentation

About this task

See this OpenSearch documentation page to learn how to configure the security plug-in: Access control for the API External link opens a new window or tab .