From ac8eac03b05896d8ba02f15fe3e695d18f29d718 Mon Sep 17 00:00:00 2001
From: poimen <locartrock@gmail.com>
Date: Fri, 28 Aug 2026 13:21:54 -0700
Subject: [PATCH] feat: OpenSearch JWT auth via Authentik OIDC

---
 k8s/infra/databases/opensearch.yaml | 80 ++++++++++++++++++++++++++---
 1 file changed, 74 insertions(+), 6 deletions(-)

diff --git a/k8s/infra/databases/opensearch.yaml b/k8s/infra/databases/opensearch.yaml
index 03288b8..53dcc2b 100644
--- a/k8s/infra/databases/opensearch.yaml
+++ b/k8s/infra/databases/opensearch.yaml
@@ -73,22 +73,61 @@ data:
     http.port: 9200
     transport.port: 9300
     
-    # Security (disabled for K8s, assume TLS at ingress)
-    plugins.security.disabled: "true"
+    # Security Plugin (JWT/Authentik OIDC)
+    plugins.security.disabled: "false"
+    plugins.security.ssl.http.enabled: "false"
+    plugins.security.ssl.transport.enabled: "false"
+    
+    # JWT Authentication Realm for Authentik
+    plugins.security.authcz.admin_dn:
+      - "CN=admin,OU=admin,O=admin,L=admin,ST=admin,C=admin"
+    
+    plugins.security.authc.realms.jwt_realm.type: jwt
+    plugins.security.authc.realms.jwt_realm.order: 1
+    plugins.security.authc.realms.jwt_realm.http_enabled: true
+    plugins.security.authc.realms.jwt_realm.transport_enabled: false
+    plugins.security.authc.realms.jwt_realm.description: "JWT realm for Authentik OIDC"
+    plugins.security.authc.realms.jwt_realm.token_name: Authorization
+    plugins.security.authc.realms.jwt_realm.token_extractor: "Bearer "
+    plugins.security.authc.realms.jwt_realm.jwt_header: Authorization
+    plugins.security.authc.realms.jwt_realm.roles_key: roles
+    plugins.security.authc.realms.jwt_realm.subject_key: sub
+    plugins.security.authc.realms.jwt_realm.jwks_uri: "https://authentik.riotpiao.com/application/o/poimen-memory/jwks/"
+    plugins.security.authc.realms.jwt_realm.jwks_refresh_interval_ms: 3600000
+    plugins.security.authc.realms.jwt_realm.issuer: "https://authentik.riotpiao.com/application/o/poimen-memory/"
+    plugins.security.authc.realms.jwt_realm.enable_ssl_peer_hostname_verification: false
+    plugins.security.authc.realms.jwt_realm.skip_jwt_verification: false
+    
+    plugins.security.authc.cache.enable: true
+    plugins.security.authc.backends.internal_authc_backend.type: intern
     
     # Memory
     indices.memory.index_buffer_size: 30%
     
   log4j2.properties: |
     status = warn
-    
     appender.console.type = Console
     appender.console.name = console
     appender.console.layout.type = PatternLayout
     appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] %marker%m%n
-    
     rootLogger.level = info
     rootLogger.appenderRef.console.ref = console
+  
+  internal_users.yml: |
+    admin:
+      hash: "$2y$12$K/SpwjtB.wW8u3/52l.f2OPST9/PgBkqquzi.Oi8KfRMfsKkCq3GO"
+      reserved: true
+      backend_roles:
+        - "admin"
+        - "all_access"
+  
+  roles_mapping.yml: |
+    all_access:
+      reserved: false
+      backend_roles:
+        - "*"
+      hosts:
+        - "*"
 
 ---
 
@@ -145,7 +184,12 @@ spec:
             - name: OPENSEARCH_JAVA_OPTS
               value: "-Xms1g -Xmx1g"
             - name: DISABLE_SECURITY_PLUGIN
-              value: "true"
+              value: "false"
+            - name: OPENSEARCH_INITIAL_ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: opensearch-secrets
+                  key: admin-password
           
           # Volume mounts
           volumeMounts:
@@ -154,6 +198,12 @@ spec:
             - name: opensearch-config
               mountPath: /usr/share/opensearch/config/opensearch.yml
               subPath: opensearch.yml
+            - name: opensearch-config
+              mountPath: /usr/share/opensearch/plugins/opensearch-security/securityconfig/internal_users.yml
+              subPath: internal_users.yml
+            - name: opensearch-config
+              mountPath: /usr/share/opensearch/plugins/opensearch-security/securityconfig/roles_mapping.yml
+              subPath: roles_mapping.yml
             - name: opensearch-logs
               mountPath: /usr/share/opensearch/logs
           
@@ -166,11 +216,14 @@ spec:
               memory: "2Gi"
               cpu: "1000m"
           
-          # Liveness probe
+          # Liveness probe (skip auth via basic fallback)
           livenessProbe:
             httpGet:
               path: /_cluster/health
               port: 9200
+              httpHeaders:
+                - name: Authorization
+                  value: Basic YWRtaW46YWRtaW4="
             initialDelaySeconds: 60
             periodSeconds: 10
             timeoutSeconds: 5
@@ -181,6 +234,9 @@ spec:
             httpGet:
               path: /_cluster/health?local=true
               port: 9200
+              httpHeaders:
+                - name: Authorization
+                  value: Basic YWRtaW46YWRtaW4="
             initialDelaySeconds: 30
             periodSeconds: 5
             timeoutSeconds: 3
@@ -403,3 +459,15 @@ kind: ServiceAccount
 metadata:
   name: opensearch-dashboards
   namespace: poimen
+
+---
+
+# Secret for OpenSearch Admin Password
+apiVersion: v1
+kind: Secret
+metadata:
+  name: opensearch-secrets
+  namespace: poimen
+type: Opaque
+stringData:
+  admin-password: "OpenSearch@Admin123!"