474 lines
12 KiB
YAML
474 lines
12 KiB
YAML
---
|
|
# OpenSearch StatefulSet for lexical (BM25) search
|
|
# Deployed alongside pgvector for hybrid semantic+lexical search
|
|
# JWT realm configured for Authentik integration
|
|
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: poimen
|
|
labels:
|
|
pod-security.kubernetes.io/enforce: baseline
|
|
pod-security.kubernetes.io/audit: baseline
|
|
pod-security.kubernetes.io/warn: baseline
|
|
---
|
|
|
|
# OpenSearch Service (Headless for StatefulSet discovery)
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: opensearch
|
|
namespace: poimen
|
|
labels:
|
|
app.kubernetes.io/name: opensearch
|
|
spec:
|
|
clusterIP: None # Headless
|
|
selector:
|
|
app.kubernetes.io/name: opensearch
|
|
ports:
|
|
- name: http
|
|
port: 9200
|
|
targetPort: 9200
|
|
- name: transport
|
|
port: 9300
|
|
targetPort: 9300
|
|
|
|
---
|
|
|
|
# OpenSearch Service (Internal for queries from Memory Service)
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: opensearch-internal
|
|
namespace: poimen
|
|
labels:
|
|
app.kubernetes.io/name: opensearch
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
app.kubernetes.io/name: opensearch
|
|
ports:
|
|
- name: http
|
|
port: 9200
|
|
targetPort: 9200
|
|
|
|
---
|
|
|
|
# ConfigMap: OpenSearch configuration with JWT realm
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: opensearch-config
|
|
namespace: poimen
|
|
data:
|
|
opensearch.yml: |
|
|
# Cluster settings
|
|
cluster.name: poimen-memory
|
|
node.name: ${HOSTNAME}
|
|
cluster.initial_master_nodes: opensearch-0
|
|
discovery.seed_hosts: opensearch-0.opensearch.poimen.svc.cluster.local
|
|
|
|
# Network
|
|
network.host: 0.0.0.0
|
|
http.port: 9200
|
|
transport.port: 9300
|
|
|
|
# Security Plugin (JWT/Authentik OIDC)
|
|
plugins.security.disabled: "false"
|
|
plugins.security.ssl.http.enabled: "false"
|
|
plugins.security.ssl.transport.enabled: "false"
|
|
|
|
# JWT Authentication Realm for Authentik
|
|
plugins.security.authcz.admin_dn:
|
|
- "CN=admin,OU=admin,O=admin,L=admin,ST=admin,C=admin"
|
|
|
|
plugins.security.authc.realms.jwt_realm.type: jwt
|
|
plugins.security.authc.realms.jwt_realm.order: 1
|
|
plugins.security.authc.realms.jwt_realm.http_enabled: true
|
|
plugins.security.authc.realms.jwt_realm.transport_enabled: false
|
|
plugins.security.authc.realms.jwt_realm.description: "JWT realm for Authentik OIDC"
|
|
plugins.security.authc.realms.jwt_realm.token_name: Authorization
|
|
plugins.security.authc.realms.jwt_realm.token_extractor: "Bearer "
|
|
plugins.security.authc.realms.jwt_realm.jwt_header: Authorization
|
|
plugins.security.authc.realms.jwt_realm.roles_key: roles
|
|
plugins.security.authc.realms.jwt_realm.subject_key: sub
|
|
plugins.security.authc.realms.jwt_realm.jwks_uri: "https://authentik.riotpiao.com/application/o/poimen-memory/jwks/"
|
|
plugins.security.authc.realms.jwt_realm.jwks_refresh_interval_ms: 3600000
|
|
plugins.security.authc.realms.jwt_realm.issuer: "https://authentik.riotpiao.com/application/o/poimen-memory/"
|
|
plugins.security.authc.realms.jwt_realm.enable_ssl_peer_hostname_verification: false
|
|
plugins.security.authc.realms.jwt_realm.skip_jwt_verification: false
|
|
|
|
plugins.security.authc.cache.enable: true
|
|
plugins.security.authc.backends.internal_authc_backend.type: intern
|
|
|
|
# Memory
|
|
indices.memory.index_buffer_size: 30%
|
|
|
|
log4j2.properties: |
|
|
status = warn
|
|
appender.console.type = Console
|
|
appender.console.name = console
|
|
appender.console.layout.type = PatternLayout
|
|
appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] %marker%m%n
|
|
rootLogger.level = info
|
|
rootLogger.appenderRef.console.ref = console
|
|
|
|
internal_users.yml: |
|
|
admin:
|
|
hash: "$2y$12$K/SpwjtB.wW8u3/52l.f2OPST9/PgBkqquzi.Oi8KfRMfsKkCq3GO"
|
|
reserved: true
|
|
backend_roles:
|
|
- "admin"
|
|
- "all_access"
|
|
|
|
roles_mapping.yml: |
|
|
all_access:
|
|
reserved: false
|
|
backend_roles:
|
|
- "*"
|
|
hosts:
|
|
- "*"
|
|
|
|
---
|
|
|
|
# StatefulSet: OpenSearch (2 replicas for HA cluster)
|
|
apiVersion: apps/v1
|
|
kind: StatefulSet
|
|
metadata:
|
|
name: opensearch
|
|
namespace: poimen
|
|
labels:
|
|
app.kubernetes.io/name: opensearch
|
|
spec:
|
|
serviceName: opensearch
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: opensearch
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: opensearch
|
|
spec:
|
|
serviceAccountName: opensearch
|
|
hostNetwork: false
|
|
|
|
initContainers:
|
|
- name: sysctl
|
|
image: busybox:1.28
|
|
command:
|
|
- sysctl
|
|
- -w
|
|
- vm.max_map_count=262144
|
|
securityContext:
|
|
privileged: true
|
|
|
|
containers:
|
|
- name: opensearch
|
|
image: opensearchproject/opensearch:2.11.0
|
|
imagePullPolicy: IfNotPresent
|
|
|
|
ports:
|
|
- name: http
|
|
containerPort: 9200
|
|
- name: transport
|
|
containerPort: 9300
|
|
|
|
env:
|
|
- name: HOSTNAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.name
|
|
- name: CLUSTER_NAME
|
|
value: "poimen-memory"
|
|
- name: OPENSEARCH_JAVA_OPTS
|
|
value: "-Xms1g -Xmx1g"
|
|
- name: DISABLE_SECURITY_PLUGIN
|
|
value: "false"
|
|
- name: OPENSEARCH_INITIAL_ADMIN_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opensearch-secrets
|
|
key: admin-password
|
|
|
|
# Volume mounts
|
|
volumeMounts:
|
|
- name: opensearch-data
|
|
mountPath: /usr/share/opensearch/data
|
|
- name: opensearch-config
|
|
mountPath: /usr/share/opensearch/config/opensearch.yml
|
|
subPath: opensearch.yml
|
|
- name: opensearch-config
|
|
mountPath: /usr/share/opensearch/plugins/opensearch-security/securityconfig/internal_users.yml
|
|
subPath: internal_users.yml
|
|
- name: opensearch-config
|
|
mountPath: /usr/share/opensearch/plugins/opensearch-security/securityconfig/roles_mapping.yml
|
|
subPath: roles_mapping.yml
|
|
- name: opensearch-logs
|
|
mountPath: /usr/share/opensearch/logs
|
|
|
|
# Resource limits
|
|
resources:
|
|
requests:
|
|
memory: "1Gi"
|
|
cpu: "500m"
|
|
limits:
|
|
memory: "2Gi"
|
|
cpu: "1000m"
|
|
|
|
# Liveness probe (skip auth via basic fallback)
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /_cluster/health
|
|
port: 9200
|
|
httpHeaders:
|
|
- name: Authorization
|
|
value: Basic YWRtaW46YWRtaW4="
|
|
initialDelaySeconds: 60
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
|
|
# Readiness probe
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /_cluster/health?local=true
|
|
port: 9200
|
|
httpHeaders:
|
|
- name: Authorization
|
|
value: Basic YWRtaW46YWRtaW4="
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 5
|
|
timeoutSeconds: 3
|
|
failureThreshold: 2
|
|
|
|
# Security context
|
|
securityContext:
|
|
runAsUser: 1000
|
|
|
|
# Volumes
|
|
volumes:
|
|
- name: opensearch-config
|
|
configMap:
|
|
name: opensearch-config
|
|
- name: opensearch-logs
|
|
emptyDir: {}
|
|
|
|
# PVC template for data persistence
|
|
volumeClaimTemplates:
|
|
- metadata:
|
|
name: opensearch-data
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
storageClassName: longhorn
|
|
resources:
|
|
requests:
|
|
storage: 30Gi
|
|
|
|
---
|
|
|
|
# ServiceAccount for OpenSearch
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: opensearch
|
|
namespace: poimen
|
|
|
|
---
|
|
|
|
# NetworkPolicy: Only Memory Service can access OpenSearch
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: opensearch-access
|
|
namespace: poimen
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: opensearch
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: poimen-memory
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: opensearch-dashboards
|
|
ports:
|
|
- protocol: TCP
|
|
port: 9200
|
|
|
|
---
|
|
|
|
# OpenSearch Dashboards: UI for monitoring, querying, and managing OpenSearch
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: opensearch-dashboards
|
|
namespace: poimen
|
|
labels:
|
|
app.kubernetes.io/name: opensearch-dashboards
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
app.kubernetes.io/name: opensearch-dashboards
|
|
ports:
|
|
- name: http
|
|
port: 5601
|
|
targetPort: 5601
|
|
|
|
---
|
|
|
|
# ConfigMap: OpenSearch Dashboards configuration
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: opensearch-dashboards-config
|
|
namespace: poimen
|
|
data:
|
|
opensearch_dashboards.yml: |
|
|
# OpenSearch Dashboards configuration
|
|
server.name: opensearch-dashboards
|
|
server.host: "0.0.0.0"
|
|
server.port: 5601
|
|
|
|
# OpenSearch connection
|
|
opensearch.hosts: ["http://opensearch-internal.poimen.svc.cluster.local:9200"]
|
|
opensearch.username: "admin"
|
|
opensearch.password: "admin"
|
|
opensearch.ssl.verificationMode: none
|
|
|
|
# Logging
|
|
logging.appenders.default.type: console
|
|
logging.appenders.default.layout.type: pattern
|
|
logging.appenders.default.layout.pattern: "[%date][%level][%logger] %message"
|
|
logging.root.appenders: [default]
|
|
logging.root.level: info
|
|
|
|
---
|
|
|
|
# Deployment: OpenSearch Dashboards
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: opensearch-dashboards
|
|
namespace: poimen
|
|
labels:
|
|
app.kubernetes.io/name: opensearch-dashboards
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: opensearch-dashboards
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: opensearch-dashboards
|
|
spec:
|
|
serviceAccountName: opensearch-dashboards
|
|
|
|
containers:
|
|
- name: opensearch-dashboards
|
|
image: opensearchproject/opensearch-dashboards:2.11.0
|
|
imagePullPolicy: IfNotPresent
|
|
|
|
ports:
|
|
- name: http
|
|
containerPort: 5601
|
|
|
|
env:
|
|
- name: OPENSEARCH_HOSTS
|
|
value: "http://opensearch-internal.poimen.svc.cluster.local:9200"
|
|
- name: OPENSEARCH_USERNAME
|
|
value: "admin"
|
|
- name: OPENSEARCH_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opensearch-dashboards-secret
|
|
key: password
|
|
|
|
# Volume mounts
|
|
volumeMounts:
|
|
- name: opensearch-dashboards-config
|
|
mountPath: /usr/share/opensearch-dashboards/config/opensearch_dashboards.yml
|
|
subPath: opensearch_dashboards.yml
|
|
|
|
# Resource limits
|
|
resources:
|
|
requests:
|
|
memory: "256Mi"
|
|
cpu: "100m"
|
|
limits:
|
|
memory: "512Mi"
|
|
cpu: "500m"
|
|
|
|
# Liveness probe
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: 5601
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
|
|
# Readiness probe
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: 5601
|
|
initialDelaySeconds: 15
|
|
periodSeconds: 5
|
|
timeoutSeconds: 3
|
|
failureThreshold: 2
|
|
|
|
# Security context
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
|
|
# Volumes
|
|
volumes:
|
|
- name: opensearch-dashboards-config
|
|
configMap:
|
|
name: opensearch-dashboards-config
|
|
|
|
---
|
|
|
|
# Secret: OpenSearch Dashboards password
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: opensearch-dashboards-secret
|
|
namespace: poimen
|
|
type: Opaque
|
|
stringData:
|
|
password: "admin" # ⚠️ Change in production
|
|
|
|
---
|
|
|
|
# ServiceAccount for OpenSearch Dashboards
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: opensearch-dashboards
|
|
namespace: poimen
|
|
|
|
---
|
|
|
|
# Secret for OpenSearch Admin Password
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: opensearch-secrets
|
|
namespace: poimen
|
|
type: Opaque
|
|
stringData:
|
|
admin-password: "OpenSearch@Admin123!"
|