fix(opensearch): single-node discovery, fsGroup, encrypt secrets, drop obsidian

- discovery.type: single-node (bypasses vm.max_map_count bootstrap check) - fsGroup: 1000 (fixes AccessDeniedException on PVC data dir) - control-plane tolerations (schedulable on CP nodes) - secrets moved to opensearch-secrets.enc.yaml (SOPS-encrypted) - remove orphaned obsidian-git-ssh-secret.enc.yaml
2026-09-12 23:18:33 +09:00
parent 78e7aa8302
commit 48bcf39a64
4 changed files with 56 additions and 59 deletions
@@ -6,3 +6,4 @@ kind: Kustomization
 resources:
  - memory-db.yaml
  - opensearch.yaml
+  - opensearch-secrets.enc.yaml
@@ -0,0 +1,47 @@
+apiVersion: ENC[AES256_GCM,data:xSU=,iv:t2LYU13AWsBqRTzsbljhR3uM8AUMwX8AJZ1Q9s/46gY=,tag:QfClc6Cr7gjiDTjgTdq+1g==,type:str]
+kind: ENC[AES256_GCM,data:sjgfLQYH,iv:QCyzSrxg3HsRJfBLvwlFdMcUo88kbJzZAeXNrJ2YSrs=,tag:yZKDAS4hpzyEQQ6gvtyhTw==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:rfqGzVlF0d0tHHT4o0uvArR3,iv:7qeXDnvy/zqIxWXgAH6FD7SR/s2PGmtzuTNUVnI9NbY=,tag:MJG4Ev8Piv+i3kNy+d9KbA==,type:str]
+    namespace: ENC[AES256_GCM,data:MfEXmFbQ,iv:1PzndXHLkHTaqdulcB75dp0w9MYSS7OmcokopABKkYI=,tag:qGzDyDVzP5VfQO/sq4TriA==,type:str]
+type: ENC[AES256_GCM,data:bsY8OgFB,iv:cpVq3oMyyKF5AEfQ7Y3ZPJGyLcLyXMYlzmb7Y6nQI5E=,tag:DlmO76zIFYwFnAGxaMwB0A==,type:str]
+stringData:
+    admin-password: ENC[AES256_GCM,data:aVO1QkWOxPtto6j5xK3lNfz+UmE=,iv:1o1QMqVqRBgNgH26rOswGyAxb3lc8OkXsYFA7BiFjJ8=,tag:g4y+Rg/aFhwF2l/qe5lJLQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzWEp2ODAxZ3poc3JGdExK
+            ZmkwdnlLcm9GZ0FhbENHOGE1L3BLR3N5SzJnClRuTnNCMjk3ajdaS1BvaEM3cEJY
+            QzBoRUF2RFlFdllDWTRvR05GSS84VjQKLS0tIEV4VHU1ZnhlMzRZVDBUbFRwMXV5
+            YnJMWUtob0g4SEFqM2ljYkNoZFdINWsKE2oxq4IIZZzbjN02a2DUVn89rG83djb8
+            1YIgsMcc4Iuln/OijoY4VCx+zMh40ldn7IdNWwPGDMTq3sZNimQmPw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+    lastmodified: "2026-09-12T14:17:13Z"
+    mac: ENC[AES256_GCM,data:7yAla8UGOqzgQ/DfH5NslwNkS/EvIpLf5zFr0Dqmk7li4yRd17rT1Syw4E4vnRCUteNLn/jISN/R55Vbt1d/K2GrjIlTSIi92ULlb2J3Uhwx9htyQuSDD7JbV9IZRjdC+Mf912k/TGqlezNRdYT/hRON8q+c+9hrLQ/1eKdcZ6s=,iv:H3X/KEaO23bJlMrHdCCjejcqiBvrYSq9Jxoy/Vr+H/4=,tag:NqxtbwoWWpn/WUMb+S4h1A==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2
+---
+apiVersion: ENC[AES256_GCM,data:XCk=,iv:Gd3Y7b8a4bVOe64bCQ7Ei8nJHH6xc9Zrji6Rtd0fw/k=,tag:Va6SUiTEDOSXCQ6jcIwfVQ==,type:str]
+kind: ENC[AES256_GCM,data:+njd1eMI,iv:g0snsmlEoV8c1FYPFso27H5xKEXsigouQH6JOrznY+w=,tag:MlZY20Dvd2WX8xwaYXsaxw==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:HUJjyVhvJPe4Hebp2azXZKl6z1D7L/Jg/eWw1g==,iv:UnLftsqTxqRnvGfkhqDgRoElYk1jMVk4YqPl5Wb5M48=,tag:GPSSLMw9aLJd/3gYRsyI3g==,type:str]
+    namespace: ENC[AES256_GCM,data:N7i+rOc2,iv:MvFxdJRNsENNCl/q1zURiN++iFJHYWqxt55CiKE2haM=,tag:JMlOQuwHqeILTrCZ/PdVxg==,type:str]
+type: ENC[AES256_GCM,data:tgPKouoR,iv:CMtRUgOeZ17x2oHYR2ae9Kpz9e0+BG3CtEFKLhIPqS8=,tag:ljFNeCAeS23L/L92+OkRhg==,type:str]
+stringData:
+    password: ENC[AES256_GCM,data:dGER+nQ=,iv:cytyAcsiLibNGfPfDMuoW6ouZsZgqRVL1bVBjm2f2SU=,tag:IzoK0isBHpTN8LGVjoIjfw==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzWEp2ODAxZ3poc3JGdExK
+            ZmkwdnlLcm9GZ0FhbENHOGE1L3BLR3N5SzJnClRuTnNCMjk3ajdaS1BvaEM3cEJY
+            QzBoRUF2RFlFdllDWTRvR05GSS84VjQKLS0tIEV4VHU1ZnhlMzRZVDBUbFRwMXV5
+            YnJMWUtob0g4SEFqM2ljYkNoZFdINWsKE2oxq4IIZZzbjN02a2DUVn89rG83djb8
+            1YIgsMcc4Iuln/OijoY4VCx+zMh40ldn7IdNWwPGDMTq3sZNimQmPw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+    lastmodified: "2026-09-12T14:17:13Z"
+    mac: ENC[AES256_GCM,data:7yAla8UGOqzgQ/DfH5NslwNkS/EvIpLf5zFr0Dqmk7li4yRd17rT1Syw4E4vnRCUteNLn/jISN/R55Vbt1d/K2GrjIlTSIi92ULlb2J3Uhwx9htyQuSDD7JbV9IZRjdC+Mf912k/TGqlezNRdYT/hRON8q+c+9hrLQ/1eKdcZ6s=,iv:H3X/KEaO23bJlMrHdCCjejcqiBvrYSq9Jxoy/Vr+H/4=,tag:NqxtbwoWWpn/WUMb+S4h1A==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2
@@ -65,8 +65,7 @@ data:
    # Cluster settings
    cluster.name: poimen-memory
    node.name: ${HOSTNAME}
-    cluster.initial_master_nodes: opensearch-0
-    discovery.seed_hosts: opensearch-0.opensearch.poimen.svc.cluster.local
+    discovery.type: single-node
    
    # Network
    network.host: 0.0.0.0
@@ -127,16 +126,12 @@ spec:
    spec:
      serviceAccountName: opensearch
      hostNetwork: false
-      
-      initContainers:
-        - name: sysctl
-          image: busybox:1.28
-          command:
-            - sysctl
-            - -w
-            - vm.max_map_count=262144
-          securityContext:
-            privileged: true
+      securityContext:
+        fsGroup: 1000
+      tolerations:
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: NoSchedule
      
      containers:
        - name: opensearch
@@ -400,18 +395,6 @@ spec:

 ---

-# Secret: OpenSearch Dashboards password
-apiVersion: v1
-kind: Secret
-metadata:
-  name: opensearch-dashboards-secret
-  namespace: poimen
-type: Opaque
-stringData:
-  password: "admin"  # ⚠️  Change in production
-
---
-
 # ServiceAccount for OpenSearch Dashboards
 apiVersion: v1
 kind: ServiceAccount
@@ -419,14 +402,4 @@ metadata:
  name: opensearch-dashboards
  namespace: poimen

---
-
-# Secret for OpenSearch Admin Password
-apiVersion: v1
-kind: Secret
-metadata:
-  name: opensearch-secrets
-  namespace: poimen
-type: Opaque
-stringData:
-  admin-password: "OpenSearch@Admin123!"
+# Secrets moved to opensearch-secrets.enc.yaml (SOPS-encrypted)