From 630a1257788bb081d683497e95c8fda7a72ab2be Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Thu, 27 Aug 2026 21:11:16 -0700
Subject: [PATCH] deploy: OpenSearch + Dashboards StatefulSet
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

OpenSearch Cluster (k8s/infra/databases/opensearch.yaml):
  ✅ StatefulSet: 2 replicas (opensearch-0, opensearch-1) for HA
  ✅ Image: opensearchproject/opensearch:2.11.0
  ✅ Services: opensearch (headless), opensearch-internal (ClusterIP:9200)
  ✅ ConfigMap: opensearch.yml with cluster discovery
  ✅ PVC: 30Gi per pod using Longhorn storage class
  ✅ Init container: sysctl vm.max_map_count=262144
  ✅ Probes: liveness (60s), readiness (30s)
  ✅ Resources: 512Mi-1Gi memory, 250m-500m CPU
  ✅ Security: plugins.security.disabled=true (K8s network isolation)
  ✅ NetworkPolicy: Memory Service + Dashboards access only

OpenSearch Dashboards (UI):
  ✅ Deployment: 1 replica opensearch-dashboards
  ✅ Image: opensearchproject/opensearch-dashboards:2.11.0
  ✅ Service: opensearch-dashboards:5601 (ClusterIP)
  ✅ Config: connects to opensearch-internal:9200
  ✅ Auth: admin/admin (production: change in secret)
  ✅ Port-forward: kubectl port-forward svc/opensearch-dashboards 5601:5601
  ✅ Access: http://localhost:5601 (dev) or ingress (prod)

Deployment Status:
  kubectl get pods -n poimen -l app.kubernetes.io/name=opensearch
  kubectl get pods -n poimen -l app.kubernetes.io/name=opensearch-dashboards

Verify Cluster Health:
  kubectl port-forward -n poimen svc/opensearch-internal 9200:9200
  curl http://localhost:9200/_cluster/health

Next Steps:
  1. Configure Memory Service: OPENSEARCH_HOSTS env var
  2. Restart Memory Service pods
  3. Test vault endpoints
  4. Test hybrid search (with OpenSearch fallback)
---
 k8s/infra/databases/opensearch.yaml | 163 +++++++++++++++++++++++++++-
 1 file changed, 162 insertions(+), 1 deletion(-)

diff --git a/k8s/infra/databases/opensearch.yaml b/k8s/infra/databases/opensearch.yaml
index 091c7d9..847d73a 100644
--- a/k8s/infra/databases/opensearch.yaml
+++ b/k8s/infra/databases/opensearch.yaml
@@ -183,7 +183,6 @@ spec:
           securityContext:
             runAsNonRoot: true
             runAsUser: 1000
-            fsGroup: 1000
             capabilities:
               drop:
                 - ALL
@@ -236,6 +235,168 @@ spec:
         - podSelector:
             matchLabels:
               app.kubernetes.io/name: poimen-memory
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: opensearch-dashboards
       ports:
         - protocol: TCP
           port: 9200
+
+---
+
+# OpenSearch Dashboards: UI for monitoring, querying, and managing OpenSearch
+apiVersion: v1
+kind: Service
+metadata:
+  name: opensearch-dashboards
+  namespace: poimen
+  labels:
+    app.kubernetes.io/name: opensearch-dashboards
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: opensearch-dashboards
+  ports:
+    - name: http
+      port: 5601
+      targetPort: 5601
+
+---
+
+# ConfigMap: OpenSearch Dashboards configuration
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: opensearch-dashboards-config
+  namespace: poimen
+data:
+  opensearch_dashboards.yml: |
+    # OpenSearch Dashboards configuration
+    server.name: opensearch-dashboards
+    server.host: "0.0.0.0"
+    server.port: 5601
+    
+    # OpenSearch connection
+    opensearch.hosts: ["http://opensearch-internal.poimen.svc.cluster.local:9200"]
+    opensearch.username: "admin"
+    opensearch.password: "admin"
+    opensearch.ssl.verificationMode: none
+    
+    # Dashboards index
+    opensearch_dashboards.index: ".opensearch_dashboards"
+    
+    # Logging
+    logging.dest: stdout
+    logging.level: info
+
+---
+
+# Deployment: OpenSearch Dashboards
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: opensearch-dashboards
+  namespace: poimen
+  labels:
+    app.kubernetes.io/name: opensearch-dashboards
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: opensearch-dashboards
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: opensearch-dashboards
+    spec:
+      serviceAccountName: opensearch-dashboards
+      
+      containers:
+        - name: opensearch-dashboards
+          image: opensearchproject/opensearch-dashboards:2.11.0
+          imagePullPolicy: IfNotPresent
+          
+          ports:
+            - name: http
+              containerPort: 5601
+          
+          env:
+            - name: OPENSEARCH_HOSTS
+              value: "http://opensearch-internal.poimen.svc.cluster.local:9200"
+            - name: OPENSEARCH_USERNAME
+              value: "admin"
+            - name: OPENSEARCH_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: opensearch-dashboards-secret
+                  key: password
+          
+          # Volume mounts
+          volumeMounts:
+            - name: opensearch-dashboards-config
+              mountPath: /usr/share/opensearch-dashboards/config/opensearch_dashboards.yml
+              subPath: opensearch_dashboards.yml
+          
+          # Resource limits
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "100m"
+            limits:
+              memory: "512Mi"
+              cpu: "500m"
+          
+          # Liveness probe
+          livenessProbe:
+            httpGet:
+              path: /api/status
+              port: 5601
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          
+          # Readiness probe
+          readinessProbe:
+            httpGet:
+              path: /api/status
+              port: 5601
+            initialDelaySeconds: 15
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 2
+          
+          # Security context
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 1000
+            capabilities:
+              drop:
+                - ALL
+      
+      # Volumes
+      volumes:
+        - name: opensearch-dashboards-config
+          configMap:
+            name: opensearch-dashboards-config
+
+---
+
+# Secret: OpenSearch Dashboards password
+apiVersion: v1
+kind: Secret
+metadata:
+  name: opensearch-dashboards-secret
+  namespace: poimen
+type: Opaque
+stringData:
+  password: "admin"  # ⚠️  Change in production
+
+---
+
+# ServiceAccount for OpenSearch Dashboards
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: opensearch-dashboards
+  namespace: poimen