The module lifecycle stage: Preview

The module has requirements for installation

Opensearch

Namespaced resource that describes the final configuration and serves as the source of truth for a specific deployed Opensearch service.

OpensearchClass Name

The name of the class to which the resource will be linked. Deploying the service is impossible without a created OpensearchClass.

spec:
  opensearchClassName: default

Instance

Section that describes the resources of the service being created. Must pass validation according to the sizingPolicies of the corresponding class:

spec:
  instance:
    cpu:
      cores: 2
      coreFraction: "100%"
    memory:
      size: "4Gi"
    persistentVolumeClaim:
      size: "10Gi"
      # storageClassName: local-path

TLS

Server-side TLS settings. The mode is specified by the mode field:

  • CertManager — certificate is issued and managed by cert-manager (default).
  • CustomCertificate — a user-provided TLS certificate from a Secret is used.
spec:
  tls:
    mode: CertManager
    certManager:
      clusterIssuerName: my-issuer

Observability

Instance monitoring mode:

  • Enabled — full monitoring with alerts (default).
  • Disabled — monitoring disabled.
  • EnabledWithoutAlerts — monitoring without alerts.
spec:
  observability: Enabled

Status

The service status is reflected in the Opensearch resource. The Conditions structure shows the current state of the service.

Significant types:

  • ConfigurationValid — shows whether the configuration passed all validations of the associated OpensearchClass.
  • LastValidConfigurationApplied — shows whether the last valid configuration was successfully applied.
  • ScaledToLastValidConfiguration — shows whether the number of running replicas matches the specified configuration.
  • Available — shows whether the Opensearch instance is running and accepting connections.
conditions:
  - lastTransitionTime: '2026-06-01T12:00:00Z'
    observedGeneration: 1
    status: 'True'
    type: Available
  - lastTransitionTime: '2026-06-01T11:58:00Z'
    observedGeneration: 1
    status: 'True'
    type: ConfigurationValid
  - lastTransitionTime: '2026-06-01T11:59:00Z'
    observedGeneration: 1
    status: 'True'
    type: LastValidConfigurationApplied
  - lastTransitionTime: '2026-06-01T12:00:00Z'
    observedGeneration: 1
    status: 'True'
    type: ScaledToLastValidConfiguration

A False status indicates a problem or incomplete state synchronization. In such cases, reason and message with a description will be specified:

  - lastTransitionTime: '2026-06-01T11:59:00Z'
    message: Not all the instances are running, still waiting for 1 to become ready
    observedGeneration: 1
    reason: ScalingInProgress
    status: 'False'
    type: ScaledToLastValidConfiguration

Usage Examples

Basic Usage (HTTP)

  1. Create a namespace:
kubectl create ns opensearch-ns
  1. Create an Opensearch resource:
kubectl apply -f opensearch.yaml -n opensearch-ns
apiVersion: managed-services.deckhouse.io/v1alpha1
kind: Opensearch
metadata:
  name: my-opensearch
spec:
  opensearchClassName: default
  instance:
    cpu:
      cores: 2
      coreFraction: "100%"
    memory:
      size: "4Gi"
    persistentVolumeClaim:
      size: "10Gi"
  1. Wait until all conditions become True:
kubectl get opensearch my-opensearch -n opensearch-ns -o wide -w
  1. Get the admin password. The operator automatically generates a password and stores it in a Secret named d8ms-osch-<instance-name>-admin-creds:
kubectl get secret d8ms-osch-my-opensearch-admin-creds -n opensearch-ns \
  -o jsonpath='{.data.password}' | base64 -d && echo
  1. Verify the service is available. Without TLS the security plugin is disabled and Opensearch is accessible via HTTP without authentication:
kubectl port-forward -n opensearch-ns svc/d8ms-osch-my-opensearch 9200:9200

In another terminal:

curl http://localhost:9200/_cluster/health?pretty

Expected result: "status": "green" or "yellow" (single-node).

Deployment with TLS (cert-manager)

  1. Create a namespace:
kubectl create ns opensearch-tls
  1. Create an Opensearch resource with TLS:
kubectl apply -f opensearch-tls.yaml -n opensearch-tls
apiVersion: managed-services.deckhouse.io/v1alpha1
kind: Opensearch
metadata:
  name: my-opensearch
spec:
  opensearchClassName: default
  instance:
    cpu:
      cores: 2
      coreFraction: "100%"
    memory:
      size: "4Gi"
    persistentVolumeClaim:
      size: "10Gi"
  tls:
    mode: CertManager
    certManager:
      clusterIssuerName: letsencrypt
  1. Wait until all conditions become True:
kubectl get opensearch my-opensearch -n opensearch-tls -o wide -w
  1. Get the password and verify availability via HTTPS:
ADMIN_PASS=$(kubectl get secret d8ms-osch-my-opensearch-admin-creds -n opensearch-tls \
  -o jsonpath='{.data.password}' | base64 -d)
kubectl port-forward -n opensearch-tls svc/d8ms-osch-my-opensearch 9200:9200

In another terminal:

curl -k -u admin:$ADMIN_PASS https://localhost:9200/_cluster/health?pretty