deploy: OpenSearch + Dashboards StatefulSet

OpenSearch Cluster (k8s/infra/databases/opensearch.yaml): ✅ StatefulSet: 2 replicas (opensearch-0, opensearch-1) for HA ✅ Image: opensearchproject/opensearch:2.11.0 ✅ Services: opensearch (headless), opensearch-internal (ClusterIP:9200) ✅ ConfigMap: opensearch.yml with cluster discovery ✅ PVC: 30Gi per pod using Longhorn storage class ✅ Init container: sysctl vm.max_map_count=262144 ✅ Probes: liveness (60s), readiness (30s) ✅ Resources: 512Mi-1Gi memory, 250m-500m CPU ✅ Security: plugins.security.disabled=true (K8s network isolation) ✅ NetworkPolicy: Memory Service + Dashboards access only OpenSearch Dashboards (UI): ✅ Deployment: 1 replica opensearch-dashboards ✅ Image: opensearchproject/opensearch-dashboards:2.11.0 ✅ Service: opensearch-dashboards:5601 (ClusterIP) ✅ Config: connects to opensearch-internal:9200 ✅ Auth: admin/admin (production: change in secret) ✅ Port-forward: kubectl port-forward svc/opensearch-dashboards 5601:5601 ✅ Access: http://localhost:5601 (dev) or ingress (prod) Deployment Status: kubectl get pods -n poimen -l app.kubernetes.io/name=opensearch kubectl get pods -n poimen -l app.kubernetes.io/name=opensearch-dashboards Verify Cluster Health: kubectl port-forward -n poimen svc/opensearch-internal 9200:9200 curl http://localhost:9200/_cluster/health Next Steps: 1. Configure Memory Service: OPENSEARCH_HOSTS env var 2. Restart Memory Service pods 3. Test vault endpoints 4. Test hybrid search (with OpenSearch fallback)
2026-08-27 21:11:16 -07:00
parent 277d719278
commit bfde20262e
1 changed files with 162 additions and 1 deletions
@@ -183,7 +183,6 @@ spec:
          securityContext:
            runAsNonRoot: true
            runAsUser: 1000
-            fsGroup: 1000
            capabilities:
              drop:
                - ALL
@@ -236,6 +235,168 @@ spec:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: poimen-memory
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: opensearch-dashboards
      ports:
        - protocol: TCP
          port: 9200
+
+---
+
+# OpenSearch Dashboards: UI for monitoring, querying, and managing OpenSearch
+apiVersion: v1
+kind: Service
+metadata:
+  name: opensearch-dashboards
+  namespace: poimen
+  labels:
+    app.kubernetes.io/name: opensearch-dashboards
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: opensearch-dashboards
+  ports:
+    - name: http
+      port: 5601
+      targetPort: 5601
+
+---
+
+# ConfigMap: OpenSearch Dashboards configuration
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: opensearch-dashboards-config
+  namespace: poimen
+data:
+  opensearch_dashboards.yml: |
+    # OpenSearch Dashboards configuration
+    server.name: opensearch-dashboards
+    server.host: "0.0.0.0"
+    server.port: 5601
+    
+    # OpenSearch connection
+    opensearch.hosts: ["http://opensearch-internal.poimen.svc.cluster.local:9200"]
+    opensearch.username: "admin"
+    opensearch.password: "admin"
+    opensearch.ssl.verificationMode: none
+    
+    # Dashboards index
+    opensearch_dashboards.index: ".opensearch_dashboards"
+    
+    # Logging
+    logging.dest: stdout
+    logging.level: info
+
+---
+
+# Deployment: OpenSearch Dashboards
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: opensearch-dashboards
+  namespace: poimen
+  labels:
+    app.kubernetes.io/name: opensearch-dashboards
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: opensearch-dashboards
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: opensearch-dashboards
+    spec:
+      serviceAccountName: opensearch-dashboards
+      
+      containers:
+        - name: opensearch-dashboards
+          image: opensearchproject/opensearch-dashboards:2.11.0
+          imagePullPolicy: IfNotPresent
+          
+          ports:
+            - name: http
+              containerPort: 5601
+          
+          env:
+            - name: OPENSEARCH_HOSTS
+              value: "http://opensearch-internal.poimen.svc.cluster.local:9200"
+            - name: OPENSEARCH_USERNAME
+              value: "admin"
+            - name: OPENSEARCH_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: opensearch-dashboards-secret
+                  key: password
+          
+          # Volume mounts
+          volumeMounts:
+            - name: opensearch-dashboards-config
+              mountPath: /usr/share/opensearch-dashboards/config/opensearch_dashboards.yml
+              subPath: opensearch_dashboards.yml
+          
+          # Resource limits
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "100m"
+            limits:
+              memory: "512Mi"
+              cpu: "500m"
+          
+          # Liveness probe
+          livenessProbe:
+            httpGet:
+              path: /api/status
+              port: 5601
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          
+          # Readiness probe
+          readinessProbe:
+            httpGet:
+              path: /api/status
+              port: 5601
+            initialDelaySeconds: 15
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 2
+          
+          # Security context
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 1000
+            capabilities:
+              drop:
+                - ALL
+      
+      # Volumes
+      volumes:
+        - name: opensearch-dashboards-config
+          configMap:
+            name: opensearch-dashboards-config
+
+---
+
+# Secret: OpenSearch Dashboards password
+apiVersion: v1
+kind: Secret
+metadata:
+  name: opensearch-dashboards-secret
+  namespace: poimen
+type: Opaque
+stringData:
+  password: "admin"  # ⚠️  Change in production
+
+---
+
+# ServiceAccount for OpenSearch Dashboards
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: opensearch-dashboards
+  namespace: poimen