Conversation
…nfigured addresses Both OpenSearchConnection classes, in external/opensearch and external/opensearch-java, registered the Basic credentials of opensearch.<type>.user and opensearch.<type>.password for any host, port and realm (AuthScope.ANY and new AuthScope(null, -1)). In the opensearch module the sniffer is on by default, so the credentials were also offered to every node address it learned from the cluster. An address without a scheme is contacted over plain http, and nothing was logged when the credentials went out that way, nor when opensearch.disable.tls.validation turned off certificate and host name checks. The credentials are now registered for the host and port of each configured address only. A node the sniffer finds under another host or port no longer receives them; such nodes have to be listed in the addresses, or sniffing disabled, if the cluster requires authentication on them. A WARN says so when sniffing is enabled together with credentials. When credentials are configured, a WARN is logged at client creation listing the addresses which use plain http, loopback addresses excepted so that local setups stay quiet. A WARN is also logged whenever opensearch.disable.tls.validation is on. The default scheme for an address without one stays http. Switching it to https would break every existing setup which gives a bare host name for a cluster served over http, including the shipped example configuration, so the warning is used instead. The docs and the example configurations now describe the scoping and recommend https:// addresses with credentials.
dpol1
reviewed
Sep 23, 2026
dpol1
left a comment
dpol1
left a comment
Member
There was a problem hiding this comment.
Scoping looks right. One thing on sniffing with https addresses, inline.
| + "The credentials are only sent to the configured addresses: " | ||
| + "requests to a node the sniffer finds under another host or " | ||
| + "port are sent without them and fail if the cluster requires " | ||
| + "authentication. List every node in opensearch.{}.addresses " |
Member
There was a problem hiding this comment.
this doesn't work with https addresses: the sniffer registers the nodes it finds as Scheme.HTTP, so after the first sniff every request goes over http. shall we pass Scheme.HTTPS to OpenSearchNodesSniffer when the addresses are https?
| | opensearch.addresses | - | OpenSearch server address(es). | ||
| | opensearch.user | - | Username for authentication (optional). | ||
| | opensearch.addresses | - | OpenSearch server address(es). An address without a scheme is contacted over plain http, on port 9200 if none is given; use `https://` when credentials are configured. | ||
| | opensearch.user | - | Username for Basic authentication (optional). The credentials are only sent to the hosts and ports listed in the addresses, not to nodes discovered by sniffing under another address; list those nodes in the addresses or disable `opensearch.<type>.sniff`, which is on by default. A warning is logged when sniffing is enabled together with credentials, and if an address other than a loopback one uses plain http. |
Member
There was a problem hiding this comment.
opensearch.<type>.sniff isn't in the table, can you add a row?
…arch.<type>.sniff
…configured addresses
dpol1
approved these changes
Sep 23, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #2103.
In both
opensearchandopensearch-java, the Basic credentials were registered for any host. They are now registered only for the host and port of each configured address, so nodes found by the sniffer no longer receive them.Also logs a warning when:
opensearch.disable.tls.validationis onThe default scheme stays
http, because switching to https would break existing setups.Release note: with sniffing on (the default), requests to nodes that report an address other than the configured ones are sent without credentials. On a secured cluster, list every node in
opensearch.<type>.addressesor disable sniffing.