User Guide

Opensearch

Namespaced resource that describes the final configuration and serves as the source of truth for a specific deployed Opensearch service.

The resource name becomes part of the names of the Kubernetes objects the operator creates (d8ms-osch-<name>-...), so it must follow the Kubernetes Service naming rules (lowercase letters, digits and -, starting with a letter) and be at most 49 characters long. A name that does not fit is rejected when the resource is created.

OpensearchClass Name

The name of the class to which the resource will be linked. Deploying the service is impossible without a created OpensearchClass.

spec:
  opensearchClassName: default

Instance

Section that describes the resources of the service being created. Must pass validation according to the sizingPolicies of the corresponding class:

spec:
  instance:
    cpu:
   cores: 2
   coreFraction: "100%"
    memory:
   size: "4Gi"
    persistentVolumeClaim:
   size: "10Gi"
   # storageClassName: local-path

TLS

Server-side TLS settings. The mode is specified by the mode field:

• CertManager — certificate is issued and managed by cert-manager (default).
• CustomCertificate — a user-provided TLS certificate from a Secret is used.

spec:
  tls:
    mode: CertManager
    certManager:
   clusterIssuerName: my-issuer

Observability

Instance monitoring mode:

• Enabled — full monitoring with alerts (default).
• Disabled — monitoring disabled.
• EnabledWithoutAlerts — monitoring without alerts.

spec:
  observability: Enabled

Status

The service status is reflected in the Opensearch resource. The Conditions structure shows the current state of the service.

Significant types:

• ConfigurationValid — shows whether the configuration passed all validations of the associated OpensearchClass.
• LastValidConfigurationApplied — shows whether the last valid configuration was successfully applied.
• ScaledToLastValidConfiguration — shows whether the number of running replicas matches the specified configuration.
• Available — shows whether the Opensearch instance is running and accepting connections.

conditions:
  - lastTransitionTime: '2026-06-01T12:00:00Z'
    observedGeneration: 1
    status: 'True'
    type: Available
  - lastTransitionTime: '2026-06-01T11:58:00Z'
    observedGeneration: 1
    status: 'True'
    type: ConfigurationValid
  - lastTransitionTime: '2026-06-01T11:59:00Z'
    observedGeneration: 1
    status: 'True'
    type: LastValidConfigurationApplied
  - lastTransitionTime: '2026-06-01T12:00:00Z'
    observedGeneration: 1
    status: 'True'
    type: ScaledToLastValidConfiguration

A False status indicates a problem or incomplete state synchronization. In such cases, reason and message with a description will be specified:

  - lastTransitionTime: '2026-06-01T11:59:00Z'
    message: Not all the instances are running, still waiting for 1 to become ready
    observedGeneration: 1
    reason: ScalingInProgress
    status: 'False'
    type: ScaledToLastValidConfiguration

Usage Examples

Basic Usage (HTTP)

1. Create a namespace:

   kubectl create ns opensearch-ns

2. Create an Opensearch resource:

   kubectl apply -f opensearch.yaml -n opensearch-ns

   apiVersion: managed-services.deckhouse.io/v1alpha1
   kind: Opensearch
   metadata:
     name: my-opensearch
   spec:
     opensearchClassName: default
     instance:
       cpu:
         cores: 2
         coreFraction: "100%"
       memory:
         size: "4Gi"
       persistentVolumeClaim:
         size: "10Gi"

3. Wait until all conditions become True:

   kubectl get opensearch my-opensearch -n opensearch-ns -o wide -w

4. Get the admin password. The operator automatically generates a password and stores it in a Secret named d8ms-osch-<instance-name>-admin-creds:

   kubectl get secret d8ms-osch-my-opensearch-admin-creds -n opensearch-ns \
     -o jsonpath='{.data.password}' | base64 -d && echo

5. Verify the service is available. Without TLS the security plugin is disabled and Opensearch is accessible via HTTP without authentication:

   kubectl port-forward -n opensearch-ns svc/d8ms-osch-my-opensearch 9200:9200

   In another terminal:

   curl http://localhost:9200/_cluster/health?pretty

   Expected result: "status": "green" or "yellow" (single-node).

Deployment with TLS (cert-manager)

1. Create a namespace:

   kubectl create ns opensearch-tls

2. Create an Opensearch resource with TLS:

   kubectl apply -f opensearch-tls.yaml -n opensearch-tls

   apiVersion: managed-services.deckhouse.io/v1alpha1
   kind: Opensearch
   metadata:
     name: my-opensearch
   spec:
     opensearchClassName: default
     instance:
       cpu:
         cores: 2
         coreFraction: "100%"
       memory:
         size: "4Gi"
       persistentVolumeClaim:
         size: "10Gi"
     tls:
       mode: CertManager
       certManager:
         clusterIssuerName: letsencrypt

3. Wait until all conditions become True:

   kubectl get opensearch my-opensearch -n opensearch-tls -o wide -w

4. Get the password and verify availability via HTTPS:

   ADMIN_PASS=$(kubectl get secret d8ms-osch-my-opensearch-admin-creds -n opensearch-tls \
     -o jsonpath='{.data.password}' | base64 -d)
   kubectl port-forward -n opensearch-tls svc/d8ms-osch-my-opensearch 9200:9200

   In another terminal:

   curl -k -u admin:$ADMIN_PASS https://localhost:9200/_cluster/health?pretty