apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
  name: opensearch
  namespace: logging
spec:
  interval: 24h
  url: https://opensearch-project.github.io/helm-charts/
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: opensearch
  namespace: logging
spec:
  interval: 30m
  chart:
    spec:
      chart: opensearch
      version: "3.9.0"
      sourceRef:
        kind: HelmRepository
        name: opensearch
  values:
    singleNode: true
    replicas: 1
    opensearchJavaOpts: "-Xms3g -Xmx3g"
    resources:
      requests:
        cpu: "1"
        memory: 5Gi
      limits:
        memory: 6Gi
    persistence:
      enabled: true
      storageClass: local-nvme
      accessModes: ["ReadWriteOnce"]
      size: 800Gi
    sysctlInit:
      enabled: false

    # No demo configuration: our own certificates and users
    extraEnvs:
      - name: DISABLE_INSTALL_DEMO_CONFIG
        value: "true"
    secretMounts:
      - name: node-tls
        secretName: opensearch-node-tls
        path: /usr/share/opensearch/config/certs
      - name: admin-tls
        secretName: opensearch-admin-tls
        path: /usr/share/opensearch/config/admin-certs
    securityConfig:
      enabled: true
      internalUsersSecret: opensearch-security
      rolesSecret: opensearch-security
      rolesMappingSecret: opensearch-security

    config:
      opensearch.yml: |
        cluster.name: opensearch-cluster
        network.host: 0.0.0.0
        plugins.security.ssl.transport.pemcert_filepath: certs/tls.crt
        plugins.security.ssl.transport.pemkey_filepath: certs/tls.key
        plugins.security.ssl.transport.pemtrustedcas_filepath: certs/ca.crt
        plugins.security.ssl.transport.enforce_hostname_verification: false
        plugins.security.ssl.http.enabled: true
        plugins.security.ssl.http.pemcert_filepath: certs/tls.crt
        plugins.security.ssl.http.pemkey_filepath: certs/tls.key
        plugins.security.ssl.http.pemtrustedcas_filepath: certs/ca.crt
        plugins.security.allow_default_init_securityindex: true
        # One node: a replica can never be placed. Back to 1 if a second data node is added.
        cluster.default_number_of_replicas: 0
        plugins.index_state_management.history.number_of_replicas: 0
        plugins.security.authcz.admin_dn:
          - "CN=admin"
        plugins.security.nodes_dn:
          - "CN=opensearch-cluster-master.logging.svc"
        plugins.security.audit.type: internal_opensearch
        plugins.security.restapi.roles_enabled:
          - "all_access"
          - "security_rest_api_access"