You need to enable JavaScript to run this app.
优惠活动
大模型
产品
解决方案
定价
更多

如何将OpenSearch securityConfigSecret中的管理员密码哈希单独配置

avatar
数据老陈
2026-6-21
问题描述

我正在使用opensearch-operator部署OpenSearch集群，需配置自定义权限角色并以OIDC作为认证后端，同时希望单独定义管理员用户的密码。目前通过securityConfigSecret使用如下Secret提供所有配置：

apiVersion: v1
kind: Secret
metadata:
  name: opensearch-security-config
  namespace: {{ .Values.namespace }}
type: Opaque
stringData:
  internal_users.yml: |-
    _meta:
      type: "internalusers"
      config_version: 2
    admin:
      hash: <MY-CUSTOM-PW-HASH>
      reserved: true
      backend_roles:
      - "admin"
      description: "Internal admin user"
  config.yml: |-
    _meta:
      type: "config"
      config_version: 2
    config:
      dynamic:
        http:
          anonymous_auth_enabled: false
        authc:
          basic_internal_auth_domain:
            description: "Authenticate via HTTP Basic against internal users database"
            http_enabled: true
            transport_enabled: true
            order: "1"
            http_authenticator:
              type: basic
              challenge: true
            authentication_backend:
              type: intern
          oidc_auth_domain:
            description: "Authenticate via OpenID Connect"
            http_enabled: true
            transport_enabled: true
            order: 0
            http_authenticator:
              type: openid
              challenge: false
              config:
                subject_key: username
                roles_key: roles
                openid_connect_url: <My-OIDC-AUTH-PROVIDER>
            authentication_backend:
              type: noop
        authz: {}
  roles_mapping.yml: |-
    _meta:
      type: "rolesmapping"
      config_version: 2
    all_access:
      reserved: false
      backend_roles:
      - "admin"
      - "opensearch_admin"
      description: "Maps admin role and opensearch_admin to all_access"
    alerts_management:
      reserved: false
      backend_roles:
      - "opensearch_alerts_mgmt"
      description: "Maps opensearch_alerts_mgmt role to alerts_management"
    read_only:
      reserved: false
      backend_roles:
      - "opensearch_readonly"
      - "opensearch_alerts_mgmt"
      description: "Maps opensearch_readonly role to read_only"
  roles.yml: |-
    _meta:
      type: "roles"
      config_version: 2
    alerts_management:
      reserved: false
      cluster_permissions:
        - "cluster:admin/opensearch/securityanalytics/*"
        - "cluster:admin/opendistro/alerting/*"
    read_only:
      reserved: false
      cluster_permissions:
        - "cluster_composite_ops_ro"
        - "cluster_monitor"
        - "cluster:admin/opensearch/observability/get"
        - "cluster:admin/opensearch/ppl"
        - "cluster:admin/opensearch/ql/datasources/read"
      index_permissions:
        - index_patterns:
            - "*"
          allowed_actions:
            - "read"
            - "search"
            - "get"
            - "indices_monitor"
            - "indices:admin/mappings/get"
      tenant_permissions:
        - tenant_patterns:
            - "*"
          allowed_actions:
            - "kibana_all_read"

但管理员用户的密码哈希属于敏感值，其余配置为非敏感内容，希望将非敏感配置存入GitHub，同时单独注入密码哈希。

解决方案

方法1：拆分配置为敏感/非敏感两个Secret（推荐）

大部分新版本的opensearch-operator支持单独指定内部用户配置的Secret，无需将所有配置打包在一起：

  1. 创建非敏感配置的Secret（可提交到GitHub）
    这个Secret只包含config.yml、roles.yml、roles_mapping.yml三个文件：

    apiVersion: v1
kind: Secret
metadata:
  name: opensearch-security-non-sensitive
  namespace: {{ .Values.namespace }}
type: Opaque
stringData:
  config.yml: |-
    _meta:
      type: "config"
      config_version: 2
    config:
      dynamic:
        http:
          anonymous_auth_enabled: false
        authc:
          basic_internal_auth_domain:
            description: "Authenticate via HTTP Basic against internal users database"
            http_enabled: true
            transport_enabled: true
            order: "1"
            http_authenticator:
              type: basic
              challenge: true
            authentication_backend:
              type: intern
          oidc_auth_domain:
            description: "Authenticate via OpenID Connect"
            http_enabled: true
            transport_enabled: true
            order: 0
            http_authenticator:
              type: openid
              challenge: false
              config:
                subject_key: username
                roles_key: roles
                openid_connect_url: <My-OIDC-AUTH-PROVIDER>
          authentication_backend:
            type: noop
        authz: {}
  roles_mapping.yml: |-
    _meta:
      type: "rolesmapping"
      config_version: 2
    all_access:
      reserved: false
      backend_roles:
      - "admin"
      - "opensearch_admin"
      description: "Maps admin role and opensearch_admin to all_access"
    alerts_management:
      reserved: false
      backend_roles:
      - "opensearch_alerts_mgmt"
      description: "Maps opensearch_alerts_mgmt role to alerts_management"
    read_only:
      reserved: false
      backend_roles:
      - "opensearch_readonly"
      - "opensearch_alerts_mgmt"
      description: "Maps opensearch_readonly role to read_only"
  roles.yml: |-
    _meta:
      type: "roles"
      config_version: 2
    alerts_management:
      reserved: false
      cluster_permissions:
        - "cluster:admin/opensearch/securityanalytics/*"
        - "cluster:admin/opendistro/alerting/*"
    read_only:
      reserved: false
      cluster_permissions:
        - "cluster_composite_ops_ro"
        - "cluster_monitor"
        - "cluster:admin/opensearch/observability/get"
        - "cluster:admin/opensearch/ppl"
        - "cluster:admin/opensearch/ql/datasources/read"
      index_permissions:
        - index_patterns:
            - "*"
          allowed_actions:
            - "read"
            - "search"
            - "get"
            - "indices_monitor"
            - "indices:admin/mappings/get"
      tenant_permissions:
        - tenant_patterns:
            - "*"
          allowed_actions:
            - "kibana_all_read"

  2. 创建敏感的内部用户Secret（不提交到GitHub）
    仅包含internal_users.yml，存储管理员密码哈希：

    apiVersion: v1
kind: Secret
metadata:
  name: opensearch-admin-user
  namespace: {{ .Values.namespace }}
type: Opaque
stringData:
  internal_users.yml: |-
    _meta:
      type: "internalusers"
      config_version: 2
    admin:
      hash: <MY-CUSTOM-PW-HASH>
      reserved: true
      backend_roles:
      - "admin"
      description: "Internal admin user"

  3. 修改OpenSearchCluster CR配置
    同时指定两个Secret：

    apiVersion: opensearch.opster.io/v1
kind: OpenSearchCluster
metadata:
  name: my-cluster
spec:
  # 其他集群配置...
  security:
    configSecret: opensearch-security-non-sensitive
    internalUsersSecret: opensearch-admin-user

方法2：用Helm模板分离敏感值

如果使用Helm部署，可将敏感的密码哈希作为Helm参数传入，非敏感配置直接存入模板：

  1. 在Helm templates中创建非敏感配置的Secret模板
    把config.yml、roles.yml、roles_mapping.yml作为模板文件，直接提交到GitHub。

  2. 创建内部用户的Secret模板
    从Helm values中读取密码哈希：

    apiVersion: v1
kind: Secret
metadata:
  name: opensearch-admin-user
  namespace: {{ .Values.namespace }}
type: Opaque
stringData:
  internal_users.yml: |-
    _meta:
      type: "internalusers"
      config_version: 2
    admin:
      hash: {{ .Values.adminPasswordHash }}
      reserved: true
      backend_roles:
      - "admin"
      description: "Internal admin user"

  3. 部署时传入敏感值
    不提交包含adminPasswordHash的values文件，部署时通过命令行传入：

    helm install my-opensearch ./charts/opensearch --set adminPasswordHash=<MY-CUSTOM-PW-HASH>

方法3：用Kustomize生成敏感Secret

使用Kustomize管理部署，将非敏感配置用ConfigMap存储，敏感配置通过本地文件或环境变量生成Secret：

  1. 定义Kustomize配置
    kustomization.yaml（可提交到GitHub）：

    apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
configMapGenerator:
- name: opensearch-security-config
  files:
  - config.yml
  - roles.yml
  - roles_mapping.yml
secretGenerator:
- name: opensearch-admin-user
  files:
  - internal_users.yml
  type: Opaque
resources:
- opensearch-cluster.yml

  2. 本地存放敏感的internal_users.yml
    这个文件不提交到GitHub，内容仅包含管理员密码哈希。

  3. 构建并部署

    kustomize build . | kubectl apply -f -

内容的提问来源于stack exchange，提问作者Akila Induranga

相关产品推荐
方舟 Agent Plan

超全模态模型 × Harness 升级，最新支持 Deepseek-V4.1-Flash、GLM-5.3 系列、Doubao-Seedream-5.0-pro、Kimi-K3 (部分)， 限时 9.9 元起

产品介绍相关文档
相关产品推荐
方舟 Agent Plan

超全模态模型 × Harness 升级，最新支持 Deepseek-V4.1-Flash、GLM-5.3 系列、Doubao-Seedream-5.0-pro、Kimi-K3 (部分)， 限时 9.9 元起

产品介绍相关文档
火山引擎 最新活动
全面开放
Doubao-Seedance-2.5全新模型升级

模型再升级,30秒超长叙事, 模态参考扩容

HOT
方舟Codingplan

模型自由，工具不限，最新支持 Deepseek-V4 系列、GLM-5.3 系列

HOT
方舟Agent plan

超全模态模型 × Harness 升级，最新支持 Deepseek-V4.1-Flash、GLM-5.3 系列

HOT
新用户特惠专场

大模型19元起，Al应用9.9元畅享，新人首购爆款尽享优惠

最近更新时间：2026.06.21 01:42:31