From 597bea4f23124f1fa39e14cb882cf3300636dae7 Mon Sep 17 00:00:00 2001 From: Ramakrishna Sakhamuru Date: Tue, 23 Jun 2026 19:24:42 +0530 Subject: [PATCH 1/2] Separated opensearch installation for test server --- ansible/provision/server_initial_setup.yml | 2 +- .../tasks/install_opensearch_test_server.yml | 62 ++++++++++ .../templates/opensearch1.3_test_server.yml | 117 ++++++++++++++++++ .../templates/os1.3_test_server.jvm.options | 86 +++++++++++++ 4 files changed, 266 insertions(+), 1 deletion(-) create mode 100644 ansible/provision/tasks/install_opensearch_test_server.yml create mode 100644 ansible/provision/templates/opensearch1.3_test_server.yml create mode 100644 ansible/provision/templates/os1.3_test_server.jvm.options diff --git a/ansible/provision/server_initial_setup.yml b/ansible/provision/server_initial_setup.yml index 86bcd81..8fc19d0 100644 --- a/ansible/provision/server_initial_setup.yml +++ b/ansible/provision/server_initial_setup.yml @@ -52,7 +52,7 @@ var: ansible_facts - name: Install opensearch - include_tasks: tasks/install_opensearch.yml + include_tasks: tasks/install_opensearch_test_server.yml when: install_index | bool - name: Summarise actions diff --git a/ansible/provision/tasks/install_opensearch_test_server.yml b/ansible/provision/tasks/install_opensearch_test_server.yml new file mode 100644 index 0000000..7b0041c --- /dev/null +++ b/ansible/provision/tasks/install_opensearch_test_server.yml @@ -0,0 +1,62 @@ +- name: Check if OpenSearch is installed + shell: "dpkg -l | grep opensearch" + register: os_check + ignore_errors: yes + +- name: Import the OpenSearch GPG key + become: yes + ansible.builtin.shell: + # Check signing key URL when upgrading OpenSearch major version https://docs.opensearch.org/1.3/install-and-configure/install-opensearch/debian/ + cmd: "curl -o- https://artifacts.opensearch.org/publickeys/opensearch.pgp | sudo gpg --dearmor --batch --yes -o /usr/share/keyrings/opensearch-keyring" + creates: /usr/share/keyrings/opensearch-keyring + when: os_check.rc != 0 + +- name: Add the OpenSearch repository + become: yes + ansible.builtin.apt_repository: + repo: "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch/1.x/apt stable main" + filename: opensearch-1.x + state: present + when: os_check.rc != 0 + +- name: Update the apt cache + become: yes + ansible.builtin.apt: + update_cache: yes + when: os_check.rc != 0 + +- name: Install OpenSearch 1.3.20 + become: yes + ansible.builtin.apt: + name: opensearch=1.3.20 + state: present + allow_downgrade: yes + when: os_check.rc != 0 + +- name: Replace OpenSearch configuration file + become: yes + ansible.builtin.template: + src: opensearch1.3_test_server.yml + dest: /etc/opensearch/opensearch.yml + owner: opensearch + group: opensearch + mode: '0640' + when: os_check.rc != 0 + +- name: Replace OpenSearch JVM options file + become: yes + ansible.builtin.template: + src: os1.3_test_server.jvm.options + dest: /etc/opensearch/jvm.options + owner: opensearch + group: opensearch + mode: '0640' + when: os_check.rc != 0 + +- name: Restart Opensearch and configure to start on boot + become: yes + ansible.builtin.systemd: + name: opensearch + enabled: yes + state: restarted + when: os_check.rc != 0 \ No newline at end of file diff --git a/ansible/provision/templates/opensearch1.3_test_server.yml b/ansible/provision/templates/opensearch1.3_test_server.yml new file mode 100644 index 0000000..04e67a0 --- /dev/null +++ b/ansible/provision/templates/opensearch1.3_test_server.yml @@ -0,0 +1,117 @@ +# ======================== OpenSearch Configuration ========================= +# +# NOTE: OpenSearch comes with reasonable defaults for most settings. +# Before you set out to tweak and tune the configuration, make sure you +# understand what are you trying to accomplish and the consequences. +# +# The primary way of configuring a node is via this file. This template lists +# the most important settings you may want to configure for a production cluster. +# +# Please consult the documentation for further information on configuration options: +# https://www.opensearch.org +# +# ---------------------------------- Cluster ----------------------------------- +# +# Use a descriptive name for your cluster: +# +cluster.name: doaj-${HOSTNAME} +# +# +# ------------------------------------ Node ------------------------------------ +# +# Use a descriptive name for the node: +# +node.name: ${HOSTNAME} +# +# +# Add custom attributes to the node: +# +#node.attr.rack: r1 +# +# ----------------------------------- Paths ------------------------------------ +# +# Path to directory where to store the data (separate multiple locations by comma): +# +path.data: /var/lib/opensearch +# +# Path to log files: +# +path.logs: /var/log/opensearch +# +# ----------------------------------- Memory ----------------------------------- +# +# Lock the memory on startup: +# +bootstrap.memory_lock: true +# +# Make sure that the heap size is set to about half the memory available +# on the system and that the owner of the process is allowed to use this +# limit. +# +# OpenSearch performs poorly when the system is swapping the memory. +# +# ---------------------------------- Network ----------------------------------- +# +# Set the bind address to a specific IP (IPv4 or IPv6): +# +#network.host: 192.168.0.1 +# +# Set a custom port for HTTP: +# +#http.port: 9200 +# +# For more information, consult the network module documentation. +# +# --------------------------------- Discovery ---------------------------------- +# +# Pass an initial list of hosts to perform discovery when this node is started: +# The default list of hosts is ["127.0.0.1", "[::1]"] +# +#discovery.seed_hosts: ["host1", "host2"] +# +# Bootstrap the cluster using an initial set of master-eligible nodes: +# +#cluster.initial_master_nodes: ["node-1", "node-2"] +# +# For more information, consult the discovery and cluster formation module documentation. +# +# ---------------------------------- Gateway ----------------------------------- +# +# Block initial recovery after a full cluster restart until N nodes are started: +# +#gateway.recover_after_nodes: 3 +# +# For more information, consult the gateway module documentation. +# +# ---------------------------------- Various ----------------------------------- +# +# Require explicit names when deleting indices: +# +#action.destructive_requires_name: true + +# To keep equivalence with ES OSS as deployed +plugins.security.disabled: true + +######## Start OpenSearch Security Demo Configuration ######## +# WARNING: revise all the lines below before you go into production +# plugins.security.ssl.transport.pemcert_filepath: esnode.pem +# plugins.security.ssl.transport.pemkey_filepath: esnode-key.pem +# plugins.security.ssl.transport.pemtrustedcas_filepath: root-ca.pem +# plugins.security.ssl.transport.enforce_hostname_verification: false +# plugins.security.ssl.http.enabled: true +# plugins.security.ssl.http.pemcert_filepath: esnode.pem +# plugins.security.ssl.http.pemkey_filepath: esnode-key.pem +# plugins.security.ssl.http.pemtrustedcas_filepath: root-ca.pem +# plugins.security.allow_unsafe_democertificates: true +# plugins.security.allow_default_init_securityindex: true +# plugins.security.authcz.admin_dn: +# - CN=kirk,OU=client,O=client,L=test, C=de + +# plugins.security.audit.type: internal_opensearch +# plugins.security.enable_snapshot_restore_privilege: true +# plugins.security.check_snapshot_restore_write_privileges: true +# plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_access"] +# plugins.security.system_indices.enabled: true +# plugins.security.system_indices.indices: [".plugins-ml-model", ".plugins-ml-task", ".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opensearch-notifications-*", ".opensearch-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"] +# node.max_local_storage_nodes: 3 +######## End OpenSearch Security Demo Configuration ######## diff --git a/ansible/provision/templates/os1.3_test_server.jvm.options b/ansible/provision/templates/os1.3_test_server.jvm.options new file mode 100644 index 0000000..43b9d46 --- /dev/null +++ b/ansible/provision/templates/os1.3_test_server.jvm.options @@ -0,0 +1,86 @@ +## JVM configuration + +################################################################ +## IMPORTANT: JVM heap size +################################################################ +## +## You should always set the min and max JVM heap +## size to the same value. For example, to set +## the heap to 4 GB, set: +## +## -Xms4g +## -Xmx4g +## +## See https://opensearch.org/docs/opensearch/install/important-settings/ +## for more information +## +################################################################ + +# Xms represents the initial size of total heap space +# Xmx represents the maximum size of total heap space + +-Xms4g +-Xmx4g + +################################################################ +## Expert settings +################################################################ +## +## All settings below this section are considered +## expert settings. Don't tamper with them unless +## you understand what you are doing +## +################################################################ + +## GC configuration +8-10:-XX:+UseConcMarkSweepGC +8-10:-XX:CMSInitiatingOccupancyFraction=75 +8-10:-XX:+UseCMSInitiatingOccupancyOnly + +## G1GC Configuration +# NOTE: G1 GC is only supported on JDK version 10 or later +# to use G1GC, uncomment the next two lines and update the version on the +# following three lines to your version of the JDK +# 10:-XX:-UseConcMarkSweepGC +# 10:-XX:-UseCMSInitiatingOccupancyOnly +11-:-XX:+UseG1GC +11-:-XX:G1ReservePercent=25 +11-:-XX:InitiatingHeapOccupancyPercent=30 + +## JVM temporary directory +-Djava.io.tmpdir=${OPENSEARCH_TMPDIR} + +## heap dumps + +# generate a heap dump when an allocation from the Java heap fails +# heap dumps are created in the working directory of the JVM +-XX:+HeapDumpOnOutOfMemoryError + +# specify an alternative path for heap dumps; ensure the directory exists and +# has sufficient space +-XX:HeapDumpPath=/var/lib/opensearch + +# specify an alternative path for JVM fatal error logs +-XX:ErrorFile=/var/log/opensearch/hs_err_pid%p.log + +## JDK 8 GC logging +8:-XX:+PrintGCDetails +8:-XX:+PrintGCDateStamps +8:-XX:+PrintTenuringDistribution +8:-XX:+PrintGCApplicationStoppedTime +8:-Xloggc:/var/log/opensearch/gc.log +8:-XX:+UseGCLogFileRotation +8:-XX:NumberOfGCLogFiles=32 +8:-XX:GCLogFileSize=64m + +# JDK 9+ GC logging +9-:-Xlog:gc*,gc+age=trace,safepoint:file=/var/log/opensearch/gc.log:utctime,pid,tags:filecount=32,filesize=64m + +# Explicitly allow security manager (https://bugs.openjdk.java.net/browse/JDK-8270380) +18-:-Djava.security.manager=allow + +## OpenSearch Performance Analyzer +-Dclk.tck=100 +-Djdk.attach.allowAttachSelf=true +-Djava.security.policy=file:///etc/opensearch/opensearch-performance-analyzer/opensearch_security.policy +--add-opens=jdk.attach/sun.tools.attach=ALL-UNNAMED From 7aafa8e78be26626687d9ba559231ca2d8393ca5 Mon Sep 17 00:00:00 2001 From: Ramakrishna Sakhamuru Date: Sat, 4 Jul 2026 21:34:00 +0530 Subject: [PATCH 2/2] Fixed installing opensearch depending on environment --- ansible/provision/server_initial_setup.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/ansible/provision/server_initial_setup.yml b/ansible/provision/server_initial_setup.yml index 8fc19d0..cf5174b 100644 --- a/ansible/provision/server_initial_setup.yml +++ b/ansible/provision/server_initial_setup.yml @@ -53,7 +53,11 @@ - name: Install opensearch include_tasks: tasks/install_opensearch_test_server.yml - when: install_index | bool + when: install_index | bool and deploy_env == "test" + + - name: Install opensearch + include_tasks: tasks/install_opensearch.yml + when: install_index | bool and deploy_env != "test" - name: Summarise actions debug: