Pre-configuring a OpenSearch cluster connection
You can connect to Managed Service for OpenSearch cluster hosts with the DATA role:
-
Over the internet, if you configured public access to the host group you need.
-
Over the internet using a special FQDN if you configured public access to the host group with the
DASHBOARDSrole. -
From Yandex Cloud VMs residing in the same virtual network.
Regardless of the connection method, Managed Service for OpenSearch only supports cluster host connections with an SSL certificate.
Configuring security groups
To connect to a cluster, security groups must include rules allowing traffic from certain ports, IP addresses, or from other security groups.
Settings of access policies depend on the connection method you select:
Configure all the cluster security groups to allow incoming traffic on ports 443 (Dashboards) and 9200 (OpenSearch) from any IP address. To do this, create the following rules for incoming traffic:
- Port range:
443and9200. - Protocol:
TCP. - Source:
Address range. - IPv4 CIDR:
0.0.0.0/0.
Create a separate rule for each port.
-
Configure all the cluster security groups to allow incoming traffic on ports 443 (
Dashboards) and 9200 (OpenSearch) from your VM’s security group. To do this, create the following rules for incoming traffic in these security groups:- Port range:
443and9200. - Protocol:
TCP. - Source:
Security group. - Security group: If your cluster and VM share the same security group, select
Current. Otherwise, specify the VM security group.
Create a separate rule for each port.
- Port range:
-
Configure all the security groups assigned to your VM to allow connections to the VM and traffic between the VM and cluster hosts.
For example, you can set the following rules for your VM:
-
For incoming traffic:
- Port range:
22,443,9200. - Protocol:
TCP. - Source:
Address range. - IPv4 CIDR:
0.0.0.0/0.
Create a separate rule for each port.
- Port range:
-
For outgoing traffic:
- Port range:
0-65535. - Protocol:
Any. - Destination name:
Address range. - IPv4 CIDR:
0.0.0.0/0.
This rule permits all outbound traffic, allowing you to install any necessary certificates and tools on your VM.
- Port range:
-
Note
You can specify more granular security group rules, such as allowing traffic only in specific subnets.
Make sure to configure the security groups correctly for all subnets where the cluster hosts will reside. With incomplete or incorrect security group settings, you may lose access to the cluster.
For more information about security groups, see Security groups.
Getting an SSL certificate
To use an encrypted connection, get an SSL certificate:
mkdir -p ~/.opensearch && \
wget "https://storage.yandexcloud.net/cloud-certs/CA.pem" \
--output-document ~/.opensearch/root.crt && \
chmod 0600 ~/.opensearch/root.crt
The certificate will be saved to the ~/.opensearch/root.crt file.
mkdir $HOME\.opensearch; curl.exe -o $HOME\.opensearch\root.crt https://storage.yandexcloud.net/cloud-certs/CA.pem
The certificate will be saved to the $HOME\.opensearch\root.crt file.
Your corporate security policies and antivirus software may block the certificate download. For more information, see FAQ.
What's next
- Get the FQDN of the host you want to connect to.
- Connect to the cluster from a Docker container.
- Integrate the cluster connection into your application code.
- Configure SAML authentication.