### Minimum Security Configuration Example

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md

Provide a minimal configuration for a security file when not using default files. This ensures a basic setup is present.

```yaml
tenants.yml: |-
  _meta:
    type: "tenants"
    config_version: 2
```

--------------------------------

### Install Bootstrap Pod Plugins

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md

Specify plugins for the bootstrap pod under `bootstrap.pluginsList`. This is useful for initial setup tasks.

```yaml
bootstrap:
  pluginsList: ["repository-s3"]
```

--------------------------------

### Install Opensearch Operator with Helm

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md

Add the Opensearch Operator Helm repository and install the operator. Ensure you have Helm installed and configured.

```bash
helm repo add opensearch-operator https://opensearch-project.github.io/opensearch-k8s-operator/
```

```bash
helm install opensearch-operator opensearch-operator/opensearch-operator
```

--------------------------------

### Install OpenSearch Dashboards Plugins

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md

Configure `dashboards.pluginsList` to install plugins for OpenSearch Dashboards. Ensure `dashboards.enable` is set to true.

```yaml
dashboards:
  enable: true
  version: 2.4.1
  pluginsList:
    - sample-plugin-name
```

--------------------------------

### Install OpenSearch Plugins

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md

Add plugins to the `general.pluginsList` to install them for OpenSearch nodes. You can specify plugin names or URLs to plugin zip files.

```yaml
general:
  version: 2.3.0
  httpPort: 9200
  vendor: opensearch
  serviceName: my-cluster
  pluginsList:
    [
      "repository-s3",
      "https://github.com/opensearch-project/opensearch-prometheus-exporter/releases/download/1.3.0.0/prometheus-exporter-1.3.0.0.zip",
    ]
```

--------------------------------

### Add Init Container for NodePool Plugin Installation and Configuration Copy

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md

For node pools, add an init container to install plugins and copy configuration files to writable volumes, ensuring proper setup when readOnlyRootFilesystem is enabled.

```yaml
nodePools:
  initContainers:
    - name: init-copier
      image: opensearchproject/opensearch:2.17.1
      volumeMounts:
        - name: rw-config
          mountPath: /config-tmp
        - name: rw-plugins
          mountPath: /plugins-tmp
      command: [
        "bash", 
        "-c", 
        "bin/opensearch-plugin -v install --batch repository-s3 && cp -r /usr/share/opensearch/plugins/* /plugins-tmp && cp -r /usr/share/opensearch/config/* /config-tmp"
      ]

```

--------------------------------

### Install OpenSearchCluster Helm Chart

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/cluster-chart.md

Use this command to install the OpenSearchCluster Helm chart. Replace `[RELEASE_NAME]` with your desired release name.

```bash
helm install [RELEASE_NAME] opensearch-operator/opensearch-cluster
```

--------------------------------

### Verify Cert-Manager Installation

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/webhooks.md

Check if cert-manager is installed by listing its pods.

```bash
kubectl get pods -n cert-manager
```

--------------------------------

### Install Repository S3 Plugin

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md

To configure S3 snapshot repositories, the `repository-s3` plugin must be installed. Add it to the `pluginsList` in your cluster specification.

```yaml
spec:
  general:
    pluginsList: ["repository-s3"]
```

--------------------------------

### Install OpenSearch Operator Chart

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/charts/opensearch-operator/README.md

Installs the OpenSearch Operator Helm chart to your Kubernetes cluster. Replace `[RELEASE_NAME]` with your desired release name.

```shell
helm install [RELEASE_NAME] opensearch-operator/opensearch-operator
```

--------------------------------

### Install OpenSearch Operator using Helm

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/README.md

Installs the OpenSearch Operator on your Kubernetes cluster using Helm. Ensure you have added the repository first.

```bash
helm install opensearch-operator opensearch-operator/opensearch-operator
```

--------------------------------

### Install with Namespace-Scoped RBAC

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/charts/opensearch-operator/README.md

Installs the OpenSearch Operator with namespace-scoped RBAC enabled. This restricts the operator's permissions to a specific namespace. Replace `<your-namespace>` with the target namespace.

```shell
helm install opensearch-operator opensearch-operator/opensearch-operator \
  --set useRoleBindings=true \
  --set manager.watchNamespace=<your-namespace>
```

--------------------------------

### Add Init Container for Bootstrap Configuration Copy

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md

Include an init container in the 'bootstrap' section to copy necessary configuration files to writable volumes before the main container starts, when using readOnlyRootFilesystem.

```yaml
bootstrap:
  initContainers:
    - name: init-copier
      image: opensearchproject/opensearch:2.17.1
      volumeMounts:
        - name: rw-config
          mountPath: /config-tmp
        - name: rw-plugins
          mountPath: /plugins-tmp
      command: [
        "bash", 
        "-c", 
        "cp -r /usr/share/opensearch/plugins/* /plugins-tmp && cp -r /usr/share/opensearch/config/* /config-tmp"
      ]

```

--------------------------------

### Future Rolling Restart Configuration Options

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/designs/rolling-restart-improvements.md

Example of potential future configuration options for customizing rolling restart behavior, including policy selection, quorum thresholds, and concurrency limits.

```yaml
spec:
  rollingRestart:
    policy: "role-aware"  # or "legacy"
    masterQuorumThreshold: 0.5  # Custom quorum threshold
    maxConcurrentRestarts: 1    # Limit concurrent restarts
```

--------------------------------

### Add New Test File in Go

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/opensearch-operator/functionaltests/operatortests/docs/integrity_test.md

Example of how to structure a new test file in Go for OpenSearch operator integrity tests. This includes setting up test data managers and cluster operations, importing test data, performing an operation, and validating data integrity.

```go
package operatortests

import (
    . "github.com/onsi/ginkgo/v2"
    . "github.com/onsi/gomega"
)

var _ = Describe("DataIntegrityMyOperation", func() {
    var (
        clusterName = "test-cluster"
        namespace   = "default"
        dataManager *TestDataManager
        operations  *ClusterOperations
        testData    map[string]map[string]interface{}
    )

    BeforeEach(func() {
        dataManager, operations = setupDataIntegrityTest(clusterName, namespace)
    })

    It("should maintain data integrity during my operation", func() {
        // Import test data
        testData, err := dataManager.ImportTestData(getDefaultTestData())
        Expect(err).NotTo(HaveOccurred())

        // Perform your operation
        // ...

        // Verify data integrity
        err = dataManager.ValidateDataIntegrity(testData)
        Expect(err).NotTo(HaveOccurred())
    })
})
```

--------------------------------

### Install Operator with Helm

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/developing.md

Deploy the operator to a remote Kubernetes cluster using Helm. This command installs the operator, specifying the image repository, tag, and pull policy.

```bash
helm install opensearch-operator ../charts/opensearch-operator --set manager.image.repository=controller --set manager.image.tag=latest --set manager.image.pullPolicy=IfNotPresent
```

--------------------------------

### Configure S3 Snapshot Repositories

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md

Define snapshot repositories for S3 using `spec.general.snapshotRepositories`. Ensure the necessary cloud provider plugins are installed and appropriate IAM roles are configured.

```yaml
spec:
  general:
    snapshotRepositories:
      - name: my_s3_repository_1
        type: s3
        settings:
          bucket: opensearch-s3-snapshot
          region: us-east-1
          base_path: os-snapshot
      - name: my_s3_repository_3
        type: s3
        settings:
          bucket: opensearch-s3-snapshot
          region: us-east-1
          base_path: os-snapshot_1
```

--------------------------------

### Describe Resource for State Information

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/migration-guide.md

Use 'kubectl describe' to get detailed information about a resource, particularly its state, to diagnose issues preventing migration.

```bash
kubectl describe opensearchusers.opensearch.opster.io <name>
```

--------------------------------

### Example AWS IAM Role for S3 Snapshots

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md

This JSON defines an example AWS IAM policy granting necessary permissions for OpenSearch to publish snapshots to an S3 bucket.

```json
{
  "Statement": [
    {
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketLocation",
        "s3:ListBucketMultipartUploads",
        "s3:ListBucketVersions"
      ],
      "Effect": "Allow",
      "Resource": ["arn:aws:s3:::opensearch-s3-snapshot"]
    },
    {
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject",
        "s3:AbortMultipartUpload",
        "s3:ListMultipartUploadParts"
      ],
      "Effect": "Allow",
      "Resource": ["arn:aws:s3:::opensearch-s3-snapshot/*"]
    }
  ],
  "Version": "2012-10-17"
}
```

--------------------------------

### Add Node Pool and Validate Data in Go

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/opensearch-operator/functionaltests/operatortests/docs/integrity_framework.md

Provides an example of adding a new node pool to an OpenSearch cluster, waiting for it to become ready, reconnecting the data manager, and then validating data integrity. This tests the system's behavior when expanding its infrastructure.

```go
newNodePool := opensearchv1.NodePool{
    Component: "data-nodes",
    Replicas:  2,
    DiskSize:  "30Gi",
    Resources: corev1.ResourceRequirements{
        Limits: corev1.ResourceList{
            corev1.ResourceCPU:    resource.MustParse("500m"),
            corev1.ResourceMemory: resource.MustParse("2Gi"),
        },
        Requests: corev1.ResourceList{
            corev1.ResourceCPU:    resource.MustParse("500m"),
            corev1.ResourceMemory: resource.MustParse("2Gi"),
        },
    },
    Roles: []string{"data"},
}

err := operations.AddNodePool("my-cluster", newNodePool)
Expect(err).NotTo(HaveOccurred())

err = operations.WaitForNodePoolReady("my-cluster", "data-nodes", 2, time.Minute*10)
Expect(err).NotTo(HaveOccurred())

err = dataManager.Reconnect()
Expect(err).NotTo(HaveOccurred())

err = dataManager.ValidateDataIntegrity(testData)
Expect(err).NotTo(HaveOccurred())
```

--------------------------------

### Add OpenSearch Operator Helm Repository

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/README.md

Adds the OpenSearch Operator Helm repository to your local Helm configuration. This is the first step before installing the operator.

```bash
helm repo add opensearch-operator https://opensearch-project.github.io/opensearch-k8s-operator/
```

--------------------------------

### Enable OpenSearch Monitoring Plugin

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md

Configure monitoring by adding these fields to your cluster spec. The operator installs the Prometheus exporter plugin and generates a ServiceMonitor object. Ensure internet connectivity or provide a custom plugin URL.

```yaml
apiVersion: opensearch.org/v1
kind: OpenSearchCluster
metadata:
  name: my-first-cluster
  namespace: default
spec:
  general:
    version: <YOUR_CLUSTER_VERSION>
    monitoring:
      enable: true # Enable or disable the monitoring plugin
      labels: # The labels add for ServiceMonitor
        someLabelKey: someLabelValue
      scrapeInterval: 30s # The scrape interval for Prometheus
      monitoringUserSecret: monitoring-user-secret # Optional, name of a secret with username/password for prometheus to acces the plugin metrics endpoint with, defaults to the admin user
      pluginUrl: https://github.com/opensearch-project/opensearch-prometheus-exporter/releases/download/<YOUR_CLUSTER_VERSION>.0/prometheus-exporter-<YOUR_CLUSTER_VERSION>.0.zip # Optional, custom URL for the monitoring plugin
      tlsConfig: # Optional, use this to override the tlsConfig of the generated ServiceMonitor, only the following provided options can be set currently
        serverName: "testserver.test.local"
        insecureSkipVerify: true # The operator currently does not allow configuring the ServiceMonitor with certificates, so this needs to be set
  # ...

```

--------------------------------

### Deploy OpenSearch Cluster using Custom Object

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md

Define an OpenSearchCluster custom resource to deploy a new OpenSearch cluster. This example configures a cluster with dashboards enabled and specifies resource requests and limits for nodes.

```yaml
apiVersion: opensearch.org/v1
kind: OpenSearchCluster
metadata:
  name: my-first-cluster
  namespace: default
spec:
  general:
    serviceName: my-first-cluster
    version: "3"
  dashboards:
    enable: true
    version: "3"
    replicas: 1
    resources:
      requests:
        memory: "512Mi"
        cpu: "200m"
      limits:
        memory: "512Mi"
        cpu: "200m"
  nodePools:
    - component: nodes
      replicas: 3
      diskSize: "5Gi"
      nodeSelector:
      resources:
        requests:
          memory: "2Gi"
          cpu: "500m"
        limits:
          memory: "2Gi"
          cpu: "500m"
      roles:
        - "cluster_manager"
        - "data"
```

--------------------------------

### Check Resource Readiness

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/migration-guide.md

Verify that OpenSearch clusters and other resources are in a ready state before migration. Clusters should be 'RUNNING' and other resources should be 'CREATED'.

```bash
kubectl get opensearchclusters.opensearch.opster.io <name> -o jsonpath='{.status.phase}'
# Should be "RUNNING"
```

```bash
kubectl get opensearchusers.opensearch.opster.io <name> -o jsonpath='{.status.state}'
# Should be "CREATED"
```

--------------------------------

### Basic Data Import and Validation in Go

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/opensearch-operator/functionaltests/operatortests/docs/integrity_framework.md

Demonstrates how to initialize the TestDataManager, define test indices with documents, import the data, and then validate its integrity. Ensure the k8sClient is properly initialized before use.

```go
dataManager, err := NewTestDataManager(k8sClient, "my-cluster", "default")
Expect(err).NotTo(HaveOccurred())

// Define test data
testIndices := []TestIndex{
    {
        Name: "my-index",
        Documents: []map[string]interface{}{
            {"id": "1", "field1": "value1"},
            {"id": "2", "field1": "value2"},
        },
    },
}

// Import data
testData, err := dataManager.ImportTestData(testIndices)
Expect(err).NotTo(HaveOccurred())

// Validate data
err = dataManager.ValidateDataIntegrity(testData)
Expect(err).NotTo(HaveOccurred())
```

--------------------------------

### Check CRD Installation

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/migration-guide.md

Ensure that both the old and new Custom Resource Definitions (CRDs) for OpenSearch are installed in the cluster.

```bash
kubectl get crd | grep opensearch
```

--------------------------------

### Apply New Resources

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/migration-guide.md

Apply new OpenSearch cluster configurations using `kubectl apply` with your updated YAML file.

```bash
kubectl apply -f your-cluster.yaml
```

--------------------------------

### Get Dashboards Application URL (Ingress)

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/charts/opensearch-cluster/templates/NOTES.txt

Use this command when Ingress is enabled to get the Dashboards application URL.

```yaml
{{- if .Values.cluster.ingress.dashboards.enabled }}
{{- range $host := .Values.cluster.ingress.dashboards.hosts }}
  {{- range .paths }}
  http{{ if $.Values.cluster.ingress.dashboards.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
  {{- end }}
{{- end }}
{{- end }}
```

--------------------------------

### Get Opensearch Application URL (Ingress)

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/charts/opensearch-cluster/templates/NOTES.txt

Use this command when Ingress is enabled to get the Opensearch application URL.

```yaml
{{- if .Values.cluster.ingress.opensearch.enabled }}
{{- range $host := .Values.cluster.ingress.opensearch.hosts }}
  {{- range .paths }}
  http{{ if $.Values.cluster.ingress.opensearch.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
  {{- end }}
{{- end }}
{{- end }}
```

--------------------------------

### Get Dashboards Application URL (NodePort)

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/charts/opensearch-cluster/templates/NOTES.txt

Use these commands when Dashboards service type is NodePort to get the application URL.

```shell
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "opensearch-cluster.fullname" . }})
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
echo http://$NODE_IP:$NODE_PORT
```

--------------------------------

### Customize Probe Timeouts and Thresholds

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md

Configure liveness, startup, and readiness probe settings per node pool to adjust timeouts and thresholds. This helps prevent premature pod restarts if nodes take longer to initialize.

```yaml
apiVersion: opensearch.org/v1
kind: OpenSearchCluster
---
spec:
  nodePools:
    - component: masters
      replicas: 3
      diskSize: "30Gi"
      probes:
        liveness:
          initialDelaySeconds: 10
          periodSeconds: 20
          timeoutSeconds: 5
          successThreshold: 1
          failureThreshold: 10
        startup:
          initialDelaySeconds: 10
          periodSeconds: 20
          timeoutSeconds: 5
          successThreshold: 1
          failureThreshold: 10
        readiness:
          initialDelaySeconds: 60
          periodSeconds: 30
          timeoutSeconds: 30
          successThreshold: 1
          failureThreshold: 5
```

--------------------------------

### Customize Startup and Readiness Probe Commands

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md

Override the default curl commands used for startup and readiness probes with custom commands. This allows for more specific health checks tailored to your environment.

```yaml
apiVersion: opensearch.org/v1
kind: OpenSearchCluster
...
spec:
  nodePools:
    - component: masters
      ...
      probes:
        startup:
          command:
            - echo
            - "Hello, World!"
        readiness:
          command:
            - echo
            - "Hello, World!"
```

--------------------------------

### Monitor Cluster Readiness for Migration

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/migration-guide.md

Continuously monitor an OpenSearch cluster's status to ensure it reaches the 'RUNNING' phase before migration can proceed.

```bash
kubectl get opensearchclusters.opensearch.opster.io <name> -w
```

--------------------------------

### Create Opensearch Tenant with Kubernetes

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md

Define an OpensearchTenant custom resource to manage tenants. The operator will not modify existing tenants. Provide a description for the tenant.

```yaml
apiVersion: opensearch.org/v1
kind: OpensearchTenant
metadata:
  name: sample-tenant
  namespace: default
spec:
  opensearchCluster:
    name: my-first-cluster
  description: Sample tenant
```

--------------------------------

### Enable and Configure OpenSearch Dashboards

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md

Enable the deployment and management of OpenSearch Dashboards by setting `spec.dashboards.enable` to `true`. Specify the desired `version` and `replicas`.

```yaml
# ...
spec:
  dashboards:
    enable: true # Set this to true to enable the Dashboards deployment
    version: 2.3.0 # The Dashboards version to deploy. This should match the configured opensearch version
    replicas: 1 # The number of replicas to deploy
```

--------------------------------

### Get Dashboards Application URL (LoadBalancer)

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/charts/opensearch-cluster/templates/NOTES.txt

Use these commands when Dashboards service type is LoadBalancer to get the application URL. Note that it may take a few minutes for the LoadBalancer IP to be available.

```shell
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "opensearch-cluster.fullname" . }} --template "{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}")
echo http://$SERVICE_IP:{{ .Values.service.port }}
```

--------------------------------

### Check Certificate Status

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/webhooks.md

Verify the status of certificates managed by cert-manager and get detailed information about a specific certificate.

```bash
kubectl get certificate -n <operator-namespace>
```

```bash
kubectl describe certificate -n <operator-namespace> <certificate-name>
```

--------------------------------

### Get Opensearch Application URL (Port-forward)

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/charts/opensearch-cluster/templates/NOTES.txt

Use these commands when Ingress is disabled to access Opensearch via port-forwarding.

```shell
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "opensearch.org/opensearch-cluster={{ .Values.cluster.name | default (include "opensearch-cluster.name" .) }}" -o jsonpath="{.items[0].metadata.name}")
export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 9200:$CONTAINER_PORT
curl https://127.0.0.1:9200 -k
```

--------------------------------

### Check Webhook Configuration

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/migration-guide.md

Verify the configuration of validating webhooks to ensure they are correctly set up for OpenSearch resources.

```bash
kubectl get validatingwebhookconfigurations | grep opensearch
```

--------------------------------

### Check if Migration Controller is Running

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/migration-guide.md

Verify that the OpenSearch operator pod, which includes the migration controller, is running.

```bash
kubectl get pods -n opensearch-operator-system | grep opensearch-operator
```

--------------------------------

### Get Dashboards Application URL (ClusterIP)

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/charts/opensearch-cluster/templates/NOTES.txt

Use these commands when Dashboards service type is ClusterIP to access the application via port-forwarding.

```shell
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "opensearch.cluster.dashboards={{ include "opensearch-cluster.name" . }}" -o jsonpath="{.items[0].metadata.name}")
export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
Visit http://127.0.0.1:8080 to use your application
```

--------------------------------

### Uninstall OpenSearchCluster Helm Chart

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/cluster-chart.md

Use this command to uninstall a previously installed OpenSearchCluster Helm release. Replace `[RELEASE_NAME]` with the name of your release.

```bash
helm uninstall [RELEASE_NAME]
```

--------------------------------

### Git Commit with Signoff

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/CONTRIBUTING.md

Example of how to use the '-s' or '--signoff' flag with git commit to automatically add the DCO 'Signed-off-by' line.

```bash
git commit -s -m "Your commit message here"
```

--------------------------------

### Configure HostPath Volume

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md

Use this to mount a file or directory from the host node's filesystem into OpenSearch pods. Specify the `hostPath` field with the required `path` parameter. The `type` field is optional and defines the expected type of the path.

```yaml
spec:
  general:
    additionalVolumes:
      - name: hostpath-data
        path: /host/data
        hostPath:
          path: /var/lib/opensearch
          type: DirectoryOrCreate
```

--------------------------------

### Import Docker Image for k3d

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/developing.md

Import a locally built Docker image into a k3d cluster. This is a prerequisite for deploying the operator to a remote cluster using k3d.

```bash
k3d image import controller:latest
```

--------------------------------

### Configure Pod Affinity for OpenSearch Dashboards

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md

Define pod affinity for OpenSearch Dashboards. This example uses 'preferredDuringSchedulingIgnoredDuringExecution' to prefer spreading dashboard pods across availability zones.

```yaml
spec:
  dashboards:
    enable: true
    affinity:
      podAffinity:
        preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchLabels:
                  app: opensearch-dashboards
              topologyKey: kubernetes.io/zone
```

--------------------------------

### Upgrade OpenSearch Cluster and Validate Data in Go

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/opensearch-operator/functionaltests/operatortests/docs/integrity_framework.md

Illustrates the process of upgrading an OpenSearch cluster to a new version, waiting for the upgrade to finish, reconnecting the data manager, and verifying data integrity. This is crucial for ensuring data safety during version changes.

```go
// Upgrade cluster
err := operations.UpgradeCluster("my-cluster", "3.4.0", "3.4.0")
Expect(err).NotTo(HaveOccurred())

// Wait for upgrade
err = operations.WaitForUpgradeComplete("my-cluster", 
    "docker.io/opensearchproject/opensearch:3.4.0", time.Minute*15)
Expect(err).NotTo(HaveOccurred())

// Reconnect and validate
err = dataManager.Reconnect()
Expect(err).NotTo(HaveOccurred())

err = dataManager.ValidateDataIntegrity(testData)
Expect(err).NotTo(HaveOccurred())
```

--------------------------------

### Custom OpenSearch and Dashboards Paths

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md

Override default installation directories for OpenSearch and OpenSearch Dashboards if using custom container images. These paths are used for all volume mounts and init container commands.

```yaml
spec:
  general:
    opensearchHome: "/opt/opensearch"
  dashboards:
    opensearchDashboardsHome: "/opt/opensearch-dashboards"
```

--------------------------------

### Combine NFS Volume with Snapshot Repository Configuration

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md

Configure an NFS volume and simultaneously set it as a snapshot repository location for OpenSearch.

```yaml
spec:
  general:
    additionalVolumes:
      - name: nfs-backups
        path: /mnt/backups/opensearch
        nfs:
          server: 192.168.1.233
          path: /export/backups/opensearch
    snapshotRepositories:
      - name: nfs-repository
        type: fs
        settings:
          location: /mnt/backups/opensearch
```

--------------------------------

### Configure Pod Anti-Affinity for OpenSearch Node Pools

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md

Override default pod anti-affinity rules for OpenSearch node pools. This example uses 'requiredDuringSchedulingIgnoredDuringExecution' to ensure pods are spread across nodes.

```yaml
spec:
  nodePools:
    - component: masters
      replicas: 3
      diskSize: "30Gi"
      roles:
        - "master"
        - "data"
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  opensearch.org/opensearch-cluster: my-cluster
              topologyKey: kubernetes.io/hostname
```

--------------------------------

### Check ValidatingWebhookConfiguration

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/webhooks.md

Examine the configuration of the validating webhook to ensure it's correctly set up.

```bash
kubectl get validatingwebhookconfiguration <webhook-config-name> -o yaml
```

--------------------------------

### Set Custom Admin Password with Security Plugin Disabled

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md

When the security plugin is disabled, provide the admin credentials via `adminCredentialsSecret`. The operator sets the `OPENSEARCH_INITIAL_ADMIN_PASSWORD` environment variable for initial setup.

```yaml
spec:
  security:
    disable: true
    config:
      adminCredentialsSecret:
        name: admin-credentials-secret
```

--------------------------------

### Delete Old Resource (Before Migration)

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/migration-guide.md

Attempting to delete an old resource (`opensearch.opster.io/v1`) before its corresponding new resource exists will be blocked by the migration controller.

```bash
kubectl delete opensearchclusters.opensearch.opster.io my-cluster
```

--------------------------------

### Configure Writable Volumes for ReadOnlyRootFilesystem

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md

Define emptyDir volumes in the 'general' section to provide writable paths for OpenSearch when readOnlyRootFilesystem is enabled.

```yaml
general:
  additionalVolumes:
  - emptyDir: {}
    name: rw-tmp
    path: /tmp
  - emptyDir: {}
    name: rw-config
    path: /usr/share/opensearch/config
  - emptyDir: {}
    name: rw-plugins
    path: /usr/share/opensearch/plugins
  - emptyDir: {}
    name: rw-logs
    path: /usr/share/opensearch/logs

```

--------------------------------

### Configure Host Aliases for Pods

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md

Add entries to the `/etc/hosts` file for Opensearch, Bootstrap, and Dashboard pods using `hostAliases`. This is useful for custom DNS resolution within pods.

```yaml
spec:
  general:
    hostAliases:
    - hostnames:
      - example.com
      ip: 127.0.0.1
  dashboards:
    hostAliases:
    - hostnames:
      - example.com
      ip: 127.0.0.1
  bootstrap:
    hostAliases:
    - hostnames:
      - example.com
      ip: 127.0.0.1
```

--------------------------------

### Configure emptyDir for Temporary Storage

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md

Use the `emptyDir` option for temporary storage, suitable for testing or data that is otherwise persisted. Note that this can lead to data loss.

```yaml
nodePools:
  - component: masters
    replicas: 3
    diskSize: "30Gi"
    roles:
      - "data"
      - "master"
    persistence:
      emptyDir: {} # This configures emptyDir
```

--------------------------------

### Configure Operator Logging and Namespace Watching

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md

Set the operator's log level and specify namespaces to watch. Defaults to watching all namespaces if not specified.

```yaml
manager:
  # Log level of the operator. Possible values: debug, info, warn, error
  loglevel: info

  # If specified, the operator will be restricted to watch objects only in the desired namespace. Defaults is to watch all namespaces.
  # To watch multiple namespaces, either separate their name via commas or define it as a list.
  # Examples:
  # watchNamespaces: 'ns1,ns2'
  # watchNamespace: [ns1, ns2]
  watchNamespace: 

  # Configure extra environment variables for the operator. You can also pull them from secrets or configmaps
  extraEnv: []
  #  - name: MY_ENV
  #    value: somevalue
```

--------------------------------

### Configure Pod and Container Security Contexts

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md

Set security contexts for Opensearch and Dashboard pods, including `podSecurityContext` for the pod and `securityContext` for containers. This allows defining privilege and access control settings.

```yaml
spec:
  general:
    podSecurityContext:
      runAsUser: 1000
      runAsGroup: 1000
      runAsNonRoot: true
    securityContext:
      allowPrivilegeEscalation: false
      privileged: false
  dashboards:
    podSecurityContext:
      fsGroup: 1000
      runAsNonRoot: true
    securityContext:
      capabilities:
        drop:
          - ALL
      privileged: false
```

--------------------------------

### Link Opensearch Users and Roles with Kubernetes

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md

Create an OpensearchUserRoleBinding to associate users, backend roles, and Opensearch roles. Each user in the binding will be granted all specified roles.

```yaml
apiVersion: opensearch.org/v1
kind: OpensearchUserRoleBinding
metadata:
  name: sample-urb
  namespace: default
spec:
  opensearchCluster:
    name: my-first-cluster
  users:
    - sample-user
  backendRoles:
    - sample-backend-role
  roles:
    - sample-role
```

--------------------------------

### Add Specific Keys to OpenSearch Keystore with Mappings

Source: https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md

Load specific keys from a secret and optionally rename them for the OpenSearch keystore using `keyMappings`. Only specified keys are loaded.

```yaml
general:
  # ...
  keystore:
    - secret:
        name: many-secret-values
      keyMappings:
        # Only read "sensitive-value" from the secret, keep its name.
        sensitive-value: sensitive-value
    - secret:
        name: credentials
      keyMappings:
        # Renames key accessKey in secret to s3.client.default.access_key in keystore
        accessKey: s3.client.default.access_key
        password: s3.client.default.secret_key
```