Configure OpenSearch (Hardened)

Configuration files

/usr/share/opensearch/config/opensearch.yml (network.host: 127.0.0.1; path.data/logs pinned)

Credential rotation

Before any network exposure, install the plugin (sudo -u opensearch /usr/share/opensearch/bin/opensearch-plugin install opensearch-security), generate your own certificates and admin credentials per the upstream security docs, then set network.host.

Monitoring & logging

• Logs: /var/log/opensearch; `journalctl -u opensearch -f`
• Health: curl -s http://127.0.0.1:9200/_cluster/health | jq .status → green (single node: yellow for replicated indices is normal) — wire this into your cloud's monitoring agent or an external probe.
• Cloud-native agents (CloudWatch agent, Google Cloud Ops Agent) install normally on this image if you want metrics/log shipping — none is pre-installed or phoning home by default.

Upgrades

Replace with the newest image version (monthly + event-driven rebuilds; Java CVE class handled at build). In-place minor bumps possible but image-replace is the supported path.

Backup & restore

Snapshot API to a repository (S3 plugin available) or volume snapshots with the service stopped.