search

voxpupuli / puppet-opensearch

Puppet module to manage OpenSearch
Apache License 2.0
4 stars 4 forks source link

Add an option to remove default pki #42

Open frantz45 opened 1 year ago

frantz45 commented 1 year ago

There is no option to remove demo certificate files. So if you set plugins.security.allow_unsafe_democertificates to false, the opensearch service won't start (even if these certificates are not used in the configuration). (It may only concern deployment with RPM) Files that should be removed from /etc/opensearch:

smortex commented 1 year ago

There seems to be work in progress to rework the mess of these "demo" certs: https://github.com/opensearch-project/opensearch-build/issues/1649

I think it is better for us to wait for the fix in upsteam before integrating this in the module rather that hacking something now and having to break it one more time in the future.

You can have these files laying around but not being referenced in your configuration file and OS will behave as expected. Not ideal, but I guess this is a compromise for the current time.

smortex commented 5 months ago

RFC upstream: https://github.com/opensearch-project/security/issues/4344

Feel free to follow and comment there.