OpenSearch - Features
Topologies
OpenSearch cluster is available as:
3 nodes cluster - not recommended for Production use
5 or more nodes cluster - recommended for Production use
3 nodes topology
In the 3 servers topology, all server are playing the master role, two of them are also used as data nodes. Each index are by default replicated on those two data nodes.
At least 5 nodes topology
With 5 to more servers, three node are used as masters only nodes and don't host any data. Depending of the Area, master nodes are dispatched across 2 or 3 Availability Zones. The remaining nodes host only data and are spread over two Availability Zones.
Resiliency
In an Area with 3 Availability Zones, the cluster is resilient against one AZ failure.
In an Area with 2 Availability Zones, the cluster might fail if the Availability Zone containing two masters is not available.
Features
This section lists which feature / capabilities are available to users, and how to request / perform them :
Self Service | Customer can perform action autonomously using ITCare. |
On Request | Customer can request for the action to be done by cegedim.cloud support team. |
| Features | Self-service | On request | Comments |
|---|---|---|---|
SSH access | SSH access is disabled and reserved to cegedim.cloud administrators. | ||
Change configuration file | On request via ticket. |
Security
Authentication
Authentication uses OpenSearch internal security system.
It can be configured on request to accept Active Directory as an authentication backend.
Authorizations
Authorizations is done using RBAC.
It can be configured on request to accept Active Directory as a backend role provider.
Secured Transport
TLS/SSL is activated by default for the incoming and internal network flows.
Passwords
This section explains how the password management is handled:
| Password | Stored by cegedim.cloud | Stored by customer | Enforced | Comment |
|---|---|---|---|---|
admin account |
| |||
ANY other account |
| |||
kibana account | Used by the dashboard server to connect to the cluster | |||
support account | Used by cegedim.cloud support team (it has limited access and cannot read index datas) | |||
centreon account | Used by cegedim.cloud monitoring system (it has only access to monitoring information) | |||
prometheus account | Used by cegedim.cloud metering system (it has only access to monitoring information) |
Last updated