Perhaps I can redirect myself out of this long nightmare

This commit is contained in:
aetter 2021-06-10 15:09:17 -07:00
parent d80ce75e1c
commit 51017f3bcc
26 changed files with 60 additions and 22 deletions

View File

@ -7,6 +7,7 @@ has_toc: false
redirect_from:
- /docs/opensearch-dashboards/
- /opensearch-dashboards/
- /dashboards/
---
# OpenSearch Dashboards

View File

@ -3,6 +3,8 @@ layout: default
title: Install OpenSearch Dashboards
nav_order: 1
has_children: true
redirect_from:
- /dashboards/install/
---
# Install and configure OpenSearch Dashboards

View File

@ -3,6 +3,8 @@ layout: default
title: About Index Management
nav_order: 1
has_children: false
redirect_from:
- /im-plugin/
---
# About Index Management

View File

@ -3,6 +3,8 @@ layout: default
title: Anomaly detection
nav_order: 46
has_children: true
redirect_from:
- /monitoring-plugins/ad/
---
# Anomaly detection

View File

@ -27,7 +27,7 @@ If these roles don't meet your needs, mix and match individual anomaly detection
Use backend roles to configure fine-grained access to individual detectors based on roles. For example, users of different departments in an organization can view detectors owned by their own department.
First, make sure your users have the appropriate [backend roles]({{site.url}}{{site.baseurl}}/security-plugin/access-control/). Backend roles usually come from an [LDAP server]({{site.url}}{{site.baseurl}}/security-plugin/configuration/ldap/) or [SAML provider]({{site.url}}{{site.baseurl}}/security-plugin/configuration/saml/), but if you use the internal user database, you can use the REST API to [add them manually]({{site.url}}{{site.baseurl}}/security-plugin/access-control/api#create-user).
First, make sure your users have the appropriate [backend roles]({{site.url}}{{site.baseurl}}/security-plugin/access-control/index/). Backend roles usually come from an [LDAP server]({{site.url}}{{site.baseurl}}/security-plugin/configuration/ldap/) or [SAML provider]({{site.url}}{{site.baseurl}}/security-plugin/configuration/saml/), but if you use the internal user database, you can use the REST API to [add them manually]({{site.url}}{{site.baseurl}}/security-plugin/access-control/api#create-user).
Next, enable the following setting:

View File

@ -3,6 +3,8 @@ layout: default
title: Alerting
nav_order: 34
has_children: true
redirect_from:
- /monitoring-plugins/alerting/
---
# Alerting

View File

@ -36,7 +36,7 @@ After making the change, the monitor now runs with the same permissions as `psan
Out of the box, the alerting plugin has no concept of ownership. For example, if you have the `cluster:admin/opensearch/alerting/monitor/write` permission, you can edit *all* monitors, regardless of whether you created them. If a small number of trusted users manage your monitors and destinations, this lack of ownership generally isn't a problem. A larger organization might need to segment access by backend role.
First, make sure that your users have the appropriate [backend roles]({{site.url}}{{site.baseurl}}/security-plugin/access-control/). Backend roles usually come from an [LDAP server]({{site.url}}{{site.baseurl}}/security-plugin/configuration/ldap/) or [SAML provider]({{site.url}}{{site.baseurl}}/security-plugin/configuration/saml/). However, if you use the internal user database, you can use the REST API to [add them manually]({{site.url}}{{site.baseurl}}/security-plugin/access-control/api#create-user).
First, make sure that your users have the appropriate [backend roles]({{site.url}}{{site.baseurl}}/security-plugin/access-control/index/). Backend roles usually come from an [LDAP server]({{site.url}}{{site.baseurl}}/security-plugin/configuration/ldap/) or [SAML provider]({{site.url}}{{site.baseurl}}/security-plugin/configuration/saml/). However, if you use the internal user database, you can use the REST API to [add them manually]({{site.url}}{{site.baseurl}}/security-plugin/access-control/api#create-user).
Next, enable the following setting:

View File

@ -3,6 +3,8 @@ layout: default
title: Performance Analyzer
nav_order: 58
has_children: true
redirect_from:
- /monitoring-plugins/pa/
---
# Performance Analyzer

View File

@ -4,6 +4,8 @@ title: Trace analytics
nav_order: 48
has_children: true
has_toc: false
redirect_from:
- /monitoring-plugins/trace/
---
# Trace Analytics

View File

@ -335,4 +335,4 @@ If you are using the security plugin, the previous request to `_cat/nodes?v` mig
sudo ./securityadmin.sh -cd {{site.url}}{{site.baseurl}}/securityconfig/ -icl -nhnv -cacert /etc/opensearch/root-ca.pem -cert /etc/opensearch/kirk.pem -key /etc/opensearch/kirk-key.pem -h <private-ip>
```
For full guidance around configuration options, see [Security configuration]({{site.url}}{{site.baseurl}}/security-plugin/configuration).
For full guidance around configuration options, see [Security configuration]({{site.url}}{{site.baseurl}}/security-plugin/configuration/index/).

View File

@ -4,6 +4,8 @@ title: About OpenSearch
nav_order: 1
has_children: false
has_toc: false
redirect_from:
- /opensearch/
---
# Introduction to OpenSearch

View File

@ -108,7 +108,7 @@ networks:
opensearch-net:
```
Then make your changes to `opensearch.yml`. For a full list of settings, see [Security]({{site.url}}{{site.baseurl}}/security-plugin/configuration/). This example adds (extremely) verbose audit logging:
Then make your changes to `opensearch.yml`. For a full list of settings, see [Security]({{site.url}}{{site.baseurl}}/security-plugin/configuration/index/). This example adds (extremely) verbose audit logging:
```yml
plugins.security.ssl.transport.pemcert_filepath: node.pem

View File

@ -183,7 +183,7 @@ services:
- ./custom-opensearch_dashboards.yml:/usr/share/opensearch-dashboards/config/opensearch_dashboards.yml
```
You can also configure `docker-compose.yml` and `opensearch.yml` [to take your own certificates]({{site.url}}{{site.baseurl}}/opensearch/install/docker-security/) for use with the [Security]({{site.url}}{{site.baseurl}}/security-plugin/configuration/) plugin.
You can also configure `docker-compose.yml` and `opensearch.yml` [to take your own certificates]({{site.url}}{{site.baseurl}}/opensearch/install/docker-security/) for use with the [Security]({{site.url}}{{site.baseurl}}/security-plugin/configuration/index/) plugin.
### (Optional) Set up Performance Analyzer

View File

@ -2,7 +2,9 @@
layout: default
title: Install OpenSearch
nav_order: 2
redirect_from: /docs/install/
redirect_from:
- /docs/install/
- /opensearch/install/
has_children: true
---

View File

@ -3,6 +3,8 @@ layout: default
title: Query DSL
nav_order: 27
has_children: true
redirect_from:
- /opensearch/query-dsl/
---
# Query DSL

View File

@ -3,6 +3,8 @@ layout: default
title: REST API reference
nav_order: 99
has_children: true
redirect_from:
- /opensearch/rest-api/
---
# REST API reference

View File

@ -3,7 +3,9 @@ layout: default
title: Asynchronous search
nav_order: 51
has_children: true
redirect_from: /docs/async/
redirect_from:
- /docs/async/
- /search-plugins/async/
---
# Asynchronous search

View File

@ -25,7 +25,7 @@ If these roles dont meet your needs, mix and match individual asynchronous se
Use backend roles to configure fine-grained access to asynchronous searches based on roles. For example, users of different departments in an organization can view asynchronous searches owned by their own department.
First, make sure your users have the appropriate [backend roles]({{site.url}}{{site.baseurl}}/security-plugin/access-control/). Backend roles usually come from an [LDAP server]({{site.url}}{{site.baseurl}}/security-plugin/configuration/ldap/) or [SAML provider]({{site.url}}{{site.baseurl}}/security-plugin/configuration/saml/). However, if you use the internal user database, you can use the REST API to [add them manually]({{site.url}}{{site.baseurl}}/security-plugin/access-control/api#create-user).
First, make sure your users have the appropriate [backend roles]({{site.url}}{{site.baseurl}}/security-plugin/access-control/index/). Backend roles usually come from an [LDAP server]({{site.url}}{{site.baseurl}}/security-plugin/configuration/ldap/) or [SAML provider]({{site.url}}{{site.baseurl}}/security-plugin/configuration/saml/). However, if you use the internal user database, you can use the REST API to [add them manually]({{site.url}}{{site.baseurl}}/security-plugin/access-control/api#create-user).
Now when users view asynchronous search resources in OpenSearch Dashboards (or make REST API calls), they only see asynchronous searches submitted by users who have a subset of the backend role.
For example, consider two users: `judy` and `elon`.

View File

@ -4,7 +4,9 @@ title: k-NN
nav_order: 50
has_children: true
has_toc: false
redirect_from: /docs/knn/
redirect_from:
- /docs/knn/
- /search-plugins/knn/
---
# k-NN

View File

@ -4,7 +4,9 @@ title: Piped processing language
nav_order: 42
has_children: true
has_toc: false
redirect_from: /docs/ppl/
redirect_from:
- /docs/ppl/
- /search-plugins/ppl/
---
# Piped Processing Language

View File

@ -4,7 +4,9 @@ title: SQL
nav_order: 38
has_children: true
has_toc: false
redirect_from: /docs/sql/
redirect_from:
- /docs/sql/
- /search-plugins/sql/
---
# SQL

View File

@ -4,12 +4,14 @@ title: Access Control
nav_order: 10
has_children: true
has_toc: false
redirect_from: /docs/security/access-control/
redirect_from:
- /docs/security/access-control/
- /security-plugin/access-control/
---
# Access control
After you [configure the security plugin]({{site.url}}{{site.baseurl}}/security-plugin/configuration/) to use your own certificates and preferred authentication backend, you can start adding users, creating roles, and mapping roles to users.
After you [configure the security plugin]({{site.url}}{{site.baseurl}}/security-plugin/configuration/index/) to use your own certificates and preferred authentication backend, you can start adding users, creating roles, and mapping roles to users.
This section of the documentation covers what a user is allowed to see and do after successfully authenticating.

View File

@ -4,7 +4,9 @@ title: Audit Logs
nav_order: 90
has_children: true
has_toc: false
redirect_from: /docs/security/audit-logs/
redirect_from:
- /docs/security/audit-logs/
- /security-plugin/audit-logs/
---
# Audit logs

View File

@ -4,19 +4,21 @@ title: Configuration
nav_order: 5
has_children: true
has_toc: false
redirect_from: /docs/security/configuration/
redirect_from:
- /docs/security/configuration/
- /security-plugin/configuration/
---
# Security configuration
The plugin includes demo certificates so that you can get up and running quickly, but before using OpenSearch in a production environment, you must configure it manually:
1. [Replace the demo certificates]({{site.url}}{{site.baseurl}}/opensearch/install/docker-security/)
1. [Reconfigure opensearch.yml to use your certificates]({{site.url}}{{site.baseurl}}/security-plugin/configuration/tls/)
1. [Replace the demo certificates]({{site.url}}{{site.baseurl}}/opensearch/install/docker-security)
1. [Reconfigure opensearch.yml to use your certificates]({{site.url}}{{site.baseurl}}/security-plugin/configuration/tls)
1. [Reconfigure config.yml to use your authentication backend]({{site.url}}{{site.baseurl}}/security-plugin/configuration/configuration/) (if you don't plan to use the internal user database)
1. [Modify the configuration YAML files]({{site.url}}{{site.baseurl}}/security-plugin/configuration/yaml/)
1. [Apply changes using securityadmin.sh]({{site.url}}{{site.baseurl}}/security-plugin/configuration/security-admin/)
1. [Modify the configuration YAML files]({{site.url}}{{site.baseurl}}/security-plugin/configuration/yaml)
1. [Apply changes using securityadmin.sh]({{site.url}}{{site.baseurl}}/security-plugin/configuration/security-admin)
1. Start OpenSearch.
1. [Add users, roles, role mappings, and tenants]({{site.url}}{{site.baseurl}}/security-plugin/access-control/)
1. [Add users, roles, role mappings, and tenants]({{site.url}}{{site.baseurl}}/security-plugin/access-control/index/)
If you don't want to use the plugin, see [Disable security]({{site.url}}{{site.baseurl}}/security-plugin/configuration/disable/).
If you don't want to use the plugin, see [Disable security]({{site.url}}{{site.baseurl}}/security-plugin/configuration/disable).

View File

@ -4,7 +4,9 @@ title: About the security plugin
nav_order: 1
has_children: false
has_toc: false
redirect_from: /docs/security/
redirect_from:
- /docs/security/
- /security-plugin/
---
# About the security plugin

View File

@ -3,6 +3,7 @@ layout: default
title: Common issues
nav_order: 1
has_toc: false
redirect_from: /troubleshoot/
---
# Common issues