[FEATURE] Add support for OpenSearch Serverless

[dblock]

Is your feature request related to a problem?

• OpenSearch serverless service identifier changes from es to aoss.
• Sigv4 requires a hash
• Info API doesn't exist
• What else?

What solution would you like?

Document support for OpenSearch Serverless in the compatibility matrix, add integration tests.

Do you have any additional context?

Coming from https://github.com/opensearch-project/opensearch-clients/issues/44

[shyim]

For a real integration test, we would need a real instance in GitHub Actions

[dblock]

I think we should add a way to run tests easily against an instance - adding it to CI is a different story. As an example in https://github.com/acm19/aws-request-signing-apache-interceptor there's make run_sample that's documented.

[marciuz]

I have been trying for about 24 hours to connect but I always get the message

PHP Fatal error:  Uncaught OpenSearch\Common\Exceptions\Forbidden403Exception: {"status":403,"request-id":"223ed502-478d-9ba6-b577-66eefcc5ff86","error":{"reason":"Customer authentication failed: ResultDetail: { Code=InvalidSignature, Message=Invalid signature, does not match, }","type":"AccessDenied"}}
 in [..]/vendor/opensearch-project/opensearch-php/src/OpenSearch/Connections/Connection.php:654 

something seems to be missing in the authentication, is that right?

[dblock]

1. Are you using HEAD on main?
2. If so, let's debug this. Does it work against Managed OpenSearch, and then Serverless? (both, neither, etc.)

[marciuz]

1. How can I do it?
2. I'm using a simple code from the example, and only on Serverless. The instance is set on public and the IAM user have this policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "aoss:*",
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "aoss:*",
            "Resource": "arn:aws:aoss:*:353384070638:collection/*"
        }
    ]
}

this is the code:

<?php

$client = (new \OpenSearch\ClientBuilder())
    ->setHosts(['https://__myhost__.eu-central-1.aoss.amazonaws.com'])
    ->setSigV4Region('eu-central-1')
    ->setSigV4Service('aoss')

    // I have my credential in .aws/credentials
    ->setSigV4CredentialProvider(true)

    // But I tested also like this... 
    ->setSigV4CredentialProvider([
      'key' => '__mykey__',
      'secret' => '__mysecret__',
    ])
    // ->setSSLVerification(true) // ... tested with and without it... 
    ->build();

But when I'm try a simple $client->search I receive always the error reported.

[dblock]

@marciuz support for custom signing service name was added in https://github.com/opensearch-project/opensearch-php/pull/117 and AFAIK hasn't been released, so setSigV4Service should be failing.

I can try to help. Let's get to a clear repro on a super simple sample that we know works. I happen to have one.

1. Fork https://github.com/dblock/opensearch-php-client-demo, check it out locally.
2. Change composer reference to opensearch-php main branch as described here.
3. Modify the code to accept a new environment variable called SERVICE that can be aoss but defaults to es.
4. See README for the various env variables required.
5. Run that against your serverless instance.
6. Make a pull request with your changes.
7. If it works, great, we just need a new release of opensearch-php.
8. If it doesn't work, I can help debug.

[shyim]

Should we maybe just release a new version? :)

[harshavamsi]

The changes in #117 probably do not work with serverless. I will raise a new PR that fixes things in a minute.

[marciuz]

Thanks, in any case I will test your solution and let you know.

Il giorno mar 7 feb 2023 alle ore 20:49 Harsha Vamsi Kalluri < @.***> ha scritto:

The changes in #117 https://github.com/opensearch-project/opensearch-php/pull/117 probably do not work with serverless. I will raise a new PR that fixes things in a minute.

— Reply to this email directly, view it on GitHub https://github.com/opensearch-project/opensearch-php/issues/113#issuecomment-1421353616, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAKKXEZ2XVRT3OV3H2K5OPLWWKRN7ANCNFSM6AAAAAATQFLXQE . You are receiving this because you were mentioned.Message ID: @.***>

[harshavamsi]

119 should fix things when merged. @shyim we should merge that and do a release.

[marciuz]

Excellent, I tested the #119 and works! Thank you for your work.

[shouze]

@harshavamsi I confirm on my side too, can't wait for a new release!

[harshavamsi]

Closing via #119