From 48bcf39a64db54567413b7360716d8853735eeda Mon Sep 17 00:00:00 2001 From: rock Date: Sat, 12 Sep 2026 23:18:33 +0900 Subject: [PATCH] fix(opensearch): single-node discovery, fsGroup, encrypt secrets, drop obsidian - discovery.type: single-node (bypasses vm.max_map_count bootstrap check) - fsGroup: 1000 (fixes AccessDeniedException on PVC data dir) - control-plane tolerations (schedulable on CP nodes) - secrets moved to opensearch-secrets.enc.yaml (SOPS-encrypted) - remove orphaned obsidian-git-ssh-secret.enc.yaml --- k8s/app/obsidian-git-ssh-secret.enc.yaml | 24 ---------- k8s/infra/databases/kustomization.yaml | 1 + .../databases/opensearch-secrets.enc.yaml | 47 +++++++++++++++++++ k8s/infra/databases/opensearch.yaml | 43 ++++------------- 4 files changed, 56 insertions(+), 59 deletions(-) delete mode 100644 k8s/app/obsidian-git-ssh-secret.enc.yaml create mode 100644 k8s/infra/databases/opensearch-secrets.enc.yaml diff --git a/k8s/app/obsidian-git-ssh-secret.enc.yaml b/k8s/app/obsidian-git-ssh-secret.enc.yaml deleted file mode 100644 index bacd387..0000000 --- a/k8s/app/obsidian-git-ssh-secret.enc.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: ENC[AES256_GCM,data:gSI=,iv:nfXxHTEXSY6eDPOLfQWxQaX/Ge7s08QF6GqQ847cdKg=,tag:szUjeOolHuomGQQdrV7U4A==,type:str] -kind: ENC[AES256_GCM,data:HC8zcR8G,iv:wk4XliU5bPi32M0QV6OhJs3tSkirOczWJjR+1MgjxpM=,tag:jcD8R327PRv8x7wYh4Tdrg==,type:str] -metadata: - name: ENC[AES256_GCM,data:HouUGg1P3iPycnr5doLc9w==,iv:kzODDxNBix4e/kAGrF8io165crqPHewyuG8MCZhr3mM=,tag:hX9peWSY5LwM7/08S+QLuw==,type:str] - namespace: ENC[AES256_GCM,data:OCIDOqNz,iv:GhtxD5cXXTnl/7Po1rY3I+jacI9Kz4bXp+Nz2UVTOTE=,tag:F7TuNLkSluKm4TZZ1Q33VQ==,type:str] -type: ENC[AES256_GCM,data:ErqH5L3k,iv:JioZqat2ZYSO83vEnl1MY6YiCC3RttfEkGc2OumJHBY=,tag:K68wmCX8sMzcnGUz1aBpWA==,type:str] -stringData: - id_ed25519: ENC[AES256_GCM,data:YqrAUmZCvEDC2q8c4Ns+WxW2l+oC31arj1MPYwt6AkIv026kZk9ucywkOWT/Ww0VgiUWF/0t/gzkm7K5D5fSk5vP6PyWV5Zqvlo8Zqy1VBLc3V9gbQeCsA4i8+FO3zZ0k2l3HAefEqhJ4Bnj3dKDOTX4bsbE/H/4n8WCojYnOLdU4esqm5r4bOCnFv5wBkbkob6AwfqekdaBZfuPOqW2sstDSRN6km1UZafCYuMY0XQTxCKYM8Izt3px8sfBq37oA6syDpxNuEpAk0uYumHhSBHKRAnsDY61pjfCbR2xy/3IeEPr6EVf5HwV+2ElhtSB/Zfzin5GZvAgX3gu3HuFznHUYH5olLEEFvVtw8fWLh3avwwCsAlUsDKZoTV1t1bzGni1OPYK3ZfsAmQqI1lvdFlRj++e6L3vDBkVG5qowTelbSb6/TWMDpJw/CsX3bgeKEoFUt2vi9IxwdYO/onuExVrT23WeanoSmrnXRaBqr6xIV5yW5CCbBBRmRU7a6jkwtkhe8dHFTKejaqjBpzPdlZOvhzKBHlOy4eDGjeV7CkzrRw=,iv:bSGkeMli13DSDFAu1+4Kg5sqSJ8LbdpLfN5oIwzLyTM=,tag:9DYK17ET7rkfmmpwxjicog==,type:str] - known_hosts: ENC[AES256_GCM,data:FaWsLxkot5Zxh7mobbUGDFqKLOdmP5APg09nkDyqGHyDp0v0Pjc19jeizM+tq3b3aH59YGlPe/4xQf7ZXZRZjWQE+m/TcVujtLD4hfCc40wqZh1XtTtdC6Tf1p3JbqxP0uQVy1+EFVwPCimUsZfp7gtcT/Hmu1JAW9biGmvACO9+dDeHGzBH5ZRCw3+dEYmcLgGIRgzpOwJLfHr/hkvdlflhzmEHMliBIl+TpqQ38GFQmw0ia7UEJzj3ghoDj7HjrHqlBa7aBHJpaEBYVwq8cN7JaLnyO1Y4+LIU8ln/CEzeg9wxVJoMO8IBcQCCgXoC+ogEpNFVb+pdUfRl/3Ye97ZJFmdJoorvSHIR02e9n7E2G3Ox9iImwnwI76X3FokuY0zcGIkcIho6JN3/8k3Z4VLDl2qGflo7jK6QP1DEsGUGhGwPRVrpPNkMDxYQeBIqlwFzfRuF/gDZj3ZWadCYB7NwByVgTcZFqiMtQ74z6jYGMiPIpW2OCY4HGu9ecGPR02USEu39CjJUCWH9WbQZTjmK3n4yYy4X4WPMbc0IekSCC2ossBznMoFsu7q7L13arqC99j9ZOv8aJ7KgMpGpOVPoN2AURJTFhgMX8TD93AvbFNVNqA0t+Y+g0Hq5f/py8XPzj4b6l8A4QxK3Awj4gf5BbK2lNjL+Cgo2kgwPsPvNd4hvx3gbamDOPNf+lH6iGLF19QyoJPHlOD/k9hkcMRerAEOLZriTylgpj2joXOaeKVrk8qkAZBunQKNc3e0xXH1i5obqz871DbbOVvrfYhmSNG93IEDG3hvNPbIc2uXYIJBciXxEaNO2PEypaLDgnNczEoVyUn2MXTJ6XMr/fkKvVBTmDuFd7BWk1JM6gWKnKvdN2G7bBHz5D43jGmmv+Z4bcd4Z4ViO8yAMbB3kKMLxMZQiSsrOudcQM1rzip2HBYb7JhK3yQwTbqTXZo64hejYW6+KYZysSB+A4itITvQR1G50lKndLd1XXqRbfV00DSZmNPRt0dKcTRkEX2RdCOkh6Wddo7D41V4eDRoHY+rctirsDKE/IA875ooAxpj5CWsHjAzlVrSUUVB2D0IBdlCPaZ5LVSo8i8+9S4rakEdmwe5dceUTC9mNIuzFtUeAshW4J2U4UzIQGOVt0BolwWfWiO5QvuAMC7aH1kJOr9gUB69IwDASdd+PbyEvjCQigVXEeObcliJu9QZohcoQU09fI1ajmPC5x2g2Rbo8DPakQTdsHuzdNm/zMZ/yUhi7+5/jZmwI3kRdgA9EMmhl+T2qAwNbhBiW2Iim44R0ZFuWMv6SCX2Kl9KxH+HW7dS8H7FJbAG7w9kiivpHP0sBTRfSgN9ddR6veVRiZWXNJ38sNy88GXdwzRM90XJAwQ==,iv:mv3hoMwPcEmOBbsIRoKLUuEsUolotv1VtikLiItwuJg=,tag:7amQiuiaVwowLAQcNoq72A==,type:str] -sops: - age: - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBINTF2OGRmUWoxTmFEZUdv - SWJKRlFhaVkzbUtOaTVnbHFjd1UzR2RFdVFNClpFODhlQVJIQjhlOEJBL2pDVmJa - UjlZZmFHKzA4eDJEMk9KTDMyOGZ2VWcKLS0tIFRHREo1dXNRKzJVYkROQSt1WjFV - ZXZYVjAwSlZhT0ZMbG1qNDVUWnJyQ2cKfs4t6HsQG5Wiyp6QvFqvm4+/o4NAL3qu - 6L9vyhl2jufrbxmR+IsEBCxYS7rh6dCbxTUFap3MD2lYIGF9hRnGjQ== - -----END AGE ENCRYPTED FILE----- - recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla - lastmodified: "2026-08-28T23:27:09Z" - mac: ENC[AES256_GCM,data:wJC6YCHXq6I/bqUjfwFRvpULZ1Yt39PoWFKzzOAq6h/pHsUrWEgrkm+3+dLaPpz663b0B75BiCQjQb4igXWr38O5I+FKonRHsbsH+D+pO+dq++yNYG8T30KGaquVfnsm8ijWGWxOY9nULUXfKcYfqvsR9P7KCV7bdcWuZ5xzZ5o=,iv:w5f3h0hb2ooeNYK1QZactpmpT8mAYa94V8FBewP0MUY=,tag:qlgUutFanhjk1HIBJqmLQg==,type:str] - unencrypted_suffix: _unencrypted - version: 3.13.2 diff --git a/k8s/infra/databases/kustomization.yaml b/k8s/infra/databases/kustomization.yaml index 88f7371..6eee6dc 100644 --- a/k8s/infra/databases/kustomization.yaml +++ b/k8s/infra/databases/kustomization.yaml @@ -6,3 +6,4 @@ kind: Kustomization resources: - memory-db.yaml - opensearch.yaml + - opensearch-secrets.enc.yaml diff --git a/k8s/infra/databases/opensearch-secrets.enc.yaml b/k8s/infra/databases/opensearch-secrets.enc.yaml new file mode 100644 index 0000000..4f072db --- /dev/null +++ b/k8s/infra/databases/opensearch-secrets.enc.yaml @@ -0,0 +1,47 @@ +apiVersion: ENC[AES256_GCM,data:xSU=,iv:t2LYU13AWsBqRTzsbljhR3uM8AUMwX8AJZ1Q9s/46gY=,tag:QfClc6Cr7gjiDTjgTdq+1g==,type:str] +kind: ENC[AES256_GCM,data:sjgfLQYH,iv:QCyzSrxg3HsRJfBLvwlFdMcUo88kbJzZAeXNrJ2YSrs=,tag:yZKDAS4hpzyEQQ6gvtyhTw==,type:str] +metadata: + name: ENC[AES256_GCM,data:rfqGzVlF0d0tHHT4o0uvArR3,iv:7qeXDnvy/zqIxWXgAH6FD7SR/s2PGmtzuTNUVnI9NbY=,tag:MJG4Ev8Piv+i3kNy+d9KbA==,type:str] + namespace: ENC[AES256_GCM,data:MfEXmFbQ,iv:1PzndXHLkHTaqdulcB75dp0w9MYSS7OmcokopABKkYI=,tag:qGzDyDVzP5VfQO/sq4TriA==,type:str] +type: ENC[AES256_GCM,data:bsY8OgFB,iv:cpVq3oMyyKF5AEfQ7Y3ZPJGyLcLyXMYlzmb7Y6nQI5E=,tag:DlmO76zIFYwFnAGxaMwB0A==,type:str] +stringData: + admin-password: ENC[AES256_GCM,data:aVO1QkWOxPtto6j5xK3lNfz+UmE=,iv:1o1QMqVqRBgNgH26rOswGyAxb3lc8OkXsYFA7BiFjJ8=,tag:g4y+Rg/aFhwF2l/qe5lJLQ==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzWEp2ODAxZ3poc3JGdExK + ZmkwdnlLcm9GZ0FhbENHOGE1L3BLR3N5SzJnClRuTnNCMjk3ajdaS1BvaEM3cEJY + QzBoRUF2RFlFdllDWTRvR05GSS84VjQKLS0tIEV4VHU1ZnhlMzRZVDBUbFRwMXV5 + YnJMWUtob0g4SEFqM2ljYkNoZFdINWsKE2oxq4IIZZzbjN02a2DUVn89rG83djb8 + 1YIgsMcc4Iuln/OijoY4VCx+zMh40ldn7IdNWwPGDMTq3sZNimQmPw== + -----END AGE ENCRYPTED FILE----- + recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla + lastmodified: "2026-09-12T14:17:13Z" + mac: ENC[AES256_GCM,data:7yAla8UGOqzgQ/DfH5NslwNkS/EvIpLf5zFr0Dqmk7li4yRd17rT1Syw4E4vnRCUteNLn/jISN/R55Vbt1d/K2GrjIlTSIi92ULlb2J3Uhwx9htyQuSDD7JbV9IZRjdC+Mf912k/TGqlezNRdYT/hRON8q+c+9hrLQ/1eKdcZ6s=,iv:H3X/KEaO23bJlMrHdCCjejcqiBvrYSq9Jxoy/Vr+H/4=,tag:NqxtbwoWWpn/WUMb+S4h1A==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.2 +--- +apiVersion: ENC[AES256_GCM,data:XCk=,iv:Gd3Y7b8a4bVOe64bCQ7Ei8nJHH6xc9Zrji6Rtd0fw/k=,tag:Va6SUiTEDOSXCQ6jcIwfVQ==,type:str] +kind: ENC[AES256_GCM,data:+njd1eMI,iv:g0snsmlEoV8c1FYPFso27H5xKEXsigouQH6JOrznY+w=,tag:MlZY20Dvd2WX8xwaYXsaxw==,type:str] +metadata: + name: ENC[AES256_GCM,data:HUJjyVhvJPe4Hebp2azXZKl6z1D7L/Jg/eWw1g==,iv:UnLftsqTxqRnvGfkhqDgRoElYk1jMVk4YqPl5Wb5M48=,tag:GPSSLMw9aLJd/3gYRsyI3g==,type:str] + namespace: ENC[AES256_GCM,data:N7i+rOc2,iv:MvFxdJRNsENNCl/q1zURiN++iFJHYWqxt55CiKE2haM=,tag:JMlOQuwHqeILTrCZ/PdVxg==,type:str] +type: ENC[AES256_GCM,data:tgPKouoR,iv:CMtRUgOeZ17x2oHYR2ae9Kpz9e0+BG3CtEFKLhIPqS8=,tag:ljFNeCAeS23L/L92+OkRhg==,type:str] +stringData: + password: ENC[AES256_GCM,data:dGER+nQ=,iv:cytyAcsiLibNGfPfDMuoW6ouZsZgqRVL1bVBjm2f2SU=,tag:IzoK0isBHpTN8LGVjoIjfw==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzWEp2ODAxZ3poc3JGdExK + ZmkwdnlLcm9GZ0FhbENHOGE1L3BLR3N5SzJnClRuTnNCMjk3ajdaS1BvaEM3cEJY + QzBoRUF2RFlFdllDWTRvR05GSS84VjQKLS0tIEV4VHU1ZnhlMzRZVDBUbFRwMXV5 + YnJMWUtob0g4SEFqM2ljYkNoZFdINWsKE2oxq4IIZZzbjN02a2DUVn89rG83djb8 + 1YIgsMcc4Iuln/OijoY4VCx+zMh40ldn7IdNWwPGDMTq3sZNimQmPw== + -----END AGE ENCRYPTED FILE----- + recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla + lastmodified: "2026-09-12T14:17:13Z" + mac: ENC[AES256_GCM,data:7yAla8UGOqzgQ/DfH5NslwNkS/EvIpLf5zFr0Dqmk7li4yRd17rT1Syw4E4vnRCUteNLn/jISN/R55Vbt1d/K2GrjIlTSIi92ULlb2J3Uhwx9htyQuSDD7JbV9IZRjdC+Mf912k/TGqlezNRdYT/hRON8q+c+9hrLQ/1eKdcZ6s=,iv:H3X/KEaO23bJlMrHdCCjejcqiBvrYSq9Jxoy/Vr+H/4=,tag:NqxtbwoWWpn/WUMb+S4h1A==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.2 diff --git a/k8s/infra/databases/opensearch.yaml b/k8s/infra/databases/opensearch.yaml index 6cf0004..ac38fea 100644 --- a/k8s/infra/databases/opensearch.yaml +++ b/k8s/infra/databases/opensearch.yaml @@ -65,8 +65,7 @@ data: # Cluster settings cluster.name: poimen-memory node.name: ${HOSTNAME} - cluster.initial_master_nodes: opensearch-0 - discovery.seed_hosts: opensearch-0.opensearch.poimen.svc.cluster.local + discovery.type: single-node # Network network.host: 0.0.0.0 @@ -127,16 +126,12 @@ spec: spec: serviceAccountName: opensearch hostNetwork: false - - initContainers: - - name: sysctl - image: busybox:1.28 - command: - - sysctl - - -w - - vm.max_map_count=262144 - securityContext: - privileged: true + securityContext: + fsGroup: 1000 + tolerations: + - key: node-role.kubernetes.io/control-plane + operator: Exists + effect: NoSchedule containers: - name: opensearch @@ -400,18 +395,6 @@ spec: --- -# Secret: OpenSearch Dashboards password -apiVersion: v1 -kind: Secret -metadata: - name: opensearch-dashboards-secret - namespace: poimen -type: Opaque -stringData: - password: "admin" # ⚠️ Change in production - ---- - # ServiceAccount for OpenSearch Dashboards apiVersion: v1 kind: ServiceAccount @@ -419,14 +402,4 @@ metadata: name: opensearch-dashboards namespace: poimen ---- - -# Secret for OpenSearch Admin Password -apiVersion: v1 -kind: Secret -metadata: - name: opensearch-secrets - namespace: poimen -type: Opaque -stringData: - admin-password: "OpenSearch@Admin123!" +# Secrets moved to opensearch-secrets.enc.yaml (SOPS-encrypted)