Airlock supports self-hosted OpenSearch and Elasticsearch via the elastic protocol. Mutual TLS with client certificates is required.
Prerequisites
- Self-hosted OpenSearch or Elasticsearch (managed cloud services without client certificate support are not compatible).
- A host for Database Service.
- Access to
airctl.
Step 1. Join token and Database Service
airctl tokens add --type=db --format=text > /tmp/token
sudo airlock db configure create \
--token=/tmp/token \
--name=my-opensearch \
--proxy=airlock.example.com:443 \
--protocol=elastic \
--uri=opensearch.example.com:9200 \
--output file:///etc/airlock.yaml
sudo systemctl enable --now airlockStep 2. Airlock user
airctl users add --roles=access,db aliceStep 3. Role mapping in OpenSearch
Map the Airlock user to an OpenSearch role:
curl -u admin:password -X POST "https://opensearch.example.com:9200/_plugins/_security/api/rolesmapping/all_access" \
-H 'Content-Type: application/json' -d '{
"users": ["alice"]
}'For Elasticsearch, use the _security/role_mapping/ API with a rule on the username field.
Example for Elasticsearch:
curl -u elastic:password -X POST "https://opensearch.example.com:9200/_security/role_mapping/mapping1?pretty" \
-H 'Content-Type: application/json' -d '{
"roles": ["user"],
"enabled": true,
"rules": {
"field": { "username": "alice" }
}
}'Step 4. Mutual TLS
airctl auth sign --format=elasticsearch --host=opensearch.example.com --out=elastic --ttl=2160hConfigure the files elastic.cas, elastic.crt, elastic.key in the cluster configuration.
For OpenSearch in opensearch.yml:
plugins.security.ssl.http.enabled: true
plugins.security.ssl.http.pemcert_filepath: /path/to/elastic.crt
plugins.security.ssl.http.pemkey_filepath: /path/to/elastic.key
plugins.security.ssl.http.pemtrustedcas_filepath: /path/to/elastic.cas
plugins.security.ssl.http.clientauth_mode: REQUIREFor Elasticsearch 7.x+ with X-Pack in elasticsearch.yml:
xpack.security.http.ssl:
certificate_authorities: /path/to/elastic.cas
certificate: /path/to/elastic.crt
key: /path/to/elastic.key
enabled: true
client_authentication: required
verification_mode: certificate
xpack.security.authc.realms.pki.pki1:
order: 1
enabled: true
certificate_authorities: /path/to/elastic.casRestart the cluster.
Step 5. Connect
airsh login --proxy=airlock.example.com --user=alice
airsh db ls
airsh db connect my-opensearch --db-user=aliceTunnel for GUI clients:
airsh proxy db my-opensearch --db-user=alice --tunnelConnect your client (OpenSearch Dashboards, Elasticvue, etc.) to http://localhost:<port>.