Connecting to an OpenSearch cluster

1. Configure all the cluster security groups to allow incoming traffic on ports 443 (Dashboards) and 9200 (OpenSearch) from the security group where the VM is located. To do this, create the following rules for incoming traffic in these security groups:

   • Port range: 443, 9200
   • Protocol: TCP
   • Source: Security group
   • Security group: If your cluster and VM are in the same security group, select Current (Self). Otherwise, specify the VM security group.

   A separate rule is created for each port.

2. Configure all the security groups where your VM is located to allow connections to the VM and traffic between the VM and cluster hosts.

   For example, you can set the following rules for a VM:

   • For incoming traffic:

     • Port range: 22, 443, 9200
     • Protocol: TCP
     • Source: CIDR
     • CIDR blocks: 0.0.0.0/0

     A separate rule is created for each port.

   • For outgoing traffic:

     • Port range: 0-65535
     • Protocol: Any (Any)
     • Destination name: CIDR
     • CIDR blocks: 0.0.0.0/0

     This rule allows all outgoing traffic, thus enabling you not only to connect to the cluster but also to install the certificates and utilities your VM needs for the connection.

mkdir $HOME\.opensearch; curl --output $HOME\.opensearch\root.crt https://storage.yandexcloud.net/cloud-certs/CA.pem

The certificate will be saved to the $HOME\.opensearch\root.crt file.

Corporate policies and antivirus software can block the download of certificates. For more information, see FAQ.

1. Create a Linux VM in the same virtual network as the cluster.

2. Connect to the virtual machine over SSH.

3. Install the dependencies:

   sudo apt update && \
   sudo apt install --yes nginx ssl-cert
   

4. Copy the downloaded SSL certificate to the /etc/nginx/ directory:

   sudo cp ~/.opensearch/root.crt /etc/nginx/root.crt
   

5. Edit the NGINX default configuration file, for example, like this:

   /etc/nginx/sites-available/default

   upstream os-dashboards-nodes {
      server <FQDN_of_host_1_with_DASHBOARDS_role>:443;
      ...
      server <FQDN_of_host_N_with_DASHBOARDS_role>:443;
   }
   
   server {
      listen 443 ssl;
   
      ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
      ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
   
      server_name _;
   
      location / {
   
          proxy_pass https://os-dashboards-nodes;
   
          proxy_ssl_trusted_certificate /etc/nginx/root.crt;
          proxy_ssl_session_reuse on;
      }
   }
   

   Warning

   This configuration file example uses a self-signed snakeoil certificate from the ssl-cert package. It is not safe to use this certificate in a real cluster. Instead of the self-signed certificate, specify the path to your public and private SSL certificate keys in the ssl_certificate and ssl_certificate_key directives.

6. Restart NGINX:

   sudo systemctl restart nginx
   

7. Add the certificate specified in the ssl_certificate directive to the browser's trusted root certificate store (instructions for Mozilla Firefox).

8. In your browser, go to https://<VM_public_IP_address>.

9. Enter the username and password for the admin user.