feat: M3.7.4 Context Endpoint - three-tier lookup infrastructure (12 tests)

k8s/infra/databases/opensearch.yaml

@@ -73,33 +73,8 @@ data:
     http.port: 9200
     transport.port: 9300
     
-    # Security Plugin (JWT/Authentik OIDC)
-    plugins.security.disabled: "false"
-    plugins.security.ssl.http.enabled: "false"
-    plugins.security.ssl.transport.enabled: "false"
-    
-    # JWT Authentication Realm for Authentik
-    plugins.security.authcz.admin_dn:
-      - "CN=admin,OU=admin,O=admin,L=admin,ST=admin,C=admin"
-    
-    plugins.security.authc.realms.jwt_realm.type: jwt
-    plugins.security.authc.realms.jwt_realm.order: 1
-    plugins.security.authc.realms.jwt_realm.http_enabled: true
-    plugins.security.authc.realms.jwt_realm.transport_enabled: false
-    plugins.security.authc.realms.jwt_realm.description: "JWT realm for Authentik OIDC"
-    plugins.security.authc.realms.jwt_realm.token_name: Authorization
-    plugins.security.authc.realms.jwt_realm.token_extractor: "Bearer "
-    plugins.security.authc.realms.jwt_realm.jwt_header: Authorization
-    plugins.security.authc.realms.jwt_realm.roles_key: roles
-    plugins.security.authc.realms.jwt_realm.subject_key: sub
-    plugins.security.authc.realms.jwt_realm.jwks_uri: "https://authentik.riotpiao.com/application/o/poimen-memory/jwks/"
-    plugins.security.authc.realms.jwt_realm.jwks_refresh_interval_ms: 3600000
-    plugins.security.authc.realms.jwt_realm.issuer: "https://authentik.riotpiao.com/application/o/poimen-memory/"
-    plugins.security.authc.realms.jwt_realm.enable_ssl_peer_hostname_verification: false
-    plugins.security.authc.realms.jwt_realm.skip_jwt_verification: false
-    
-    plugins.security.authc.cache.enable: true
-    plugins.security.authc.backends.internal_authc_backend.type: intern
+    # Security Plugin disabled (internal-only, JWT auth via Memory Service)
+    plugins.security.disabled: "true"
     
     # Memory
     indices.memory.index_buffer_size: 30%
@@ -184,12 +159,7 @@ spec:
             - name: OPENSEARCH_JAVA_OPTS
               value: "-Xms1g -Xmx1g"
             - name: DISABLE_SECURITY_PLUGIN
-              value: "false"
-            - name: OPENSEARCH_INITIAL_ADMIN_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: opensearch-secrets
-                  key: admin-password
+              value: "true"
           
           # Volume mounts
           volumeMounts:
@@ -198,12 +168,7 @@ spec:
             - name: opensearch-config
               mountPath: /usr/share/opensearch/config/opensearch.yml
               subPath: opensearch.yml
-            - name: opensearch-config
-              mountPath: /usr/share/opensearch/plugins/opensearch-security/securityconfig/internal_users.yml
-              subPath: internal_users.yml
-            - name: opensearch-config
-              mountPath: /usr/share/opensearch/plugins/opensearch-security/securityconfig/roles_mapping.yml
-              subPath: roles_mapping.yml
+
             - name: opensearch-logs
               mountPath: /usr/share/opensearch/logs
           
@@ -216,14 +181,11 @@ spec:
               memory: "2Gi"
               cpu: "1000m"
           
-          # Liveness probe (skip auth via basic fallback)
+          # Liveness probe
           livenessProbe:
             httpGet:
               path: /_cluster/health
               port: 9200
-              httpHeaders:
-                - name: Authorization
-                  value: Basic YWRtaW46YWRtaW4="
             initialDelaySeconds: 60
             periodSeconds: 10
             timeoutSeconds: 5
@@ -234,9 +196,6 @@ spec:
             httpGet:
               path: /_cluster/health?local=true
               port: 9200
-              httpHeaders:
-                - name: Authorization
-                  value: Basic YWRtaW46YWRtaW4="
             initialDelaySeconds: 30
             periodSeconds: 5
             timeoutSeconds: 3