[apps] Add managed OpenSearch service - #1953

In `@packages/apps/opensearch/Chart.yaml`:
- Around line 1-7: Update the Chart.yaml metadata so the appVersion reflects the
chart's default supported OpenSearch release: change the appVersion value from
"2.18" to "2.11.1" to match the chart's default version mapping (the
Chart.yaml's appVersion field and the chart's version reference).

In `@packages/apps/opensearch/files/versions.yaml`:
- Around line 1-5: Add a new maintenance script
packages/apps/opensearch/hack/update-versions.sh (modeled after the other apps'
hack/update-versions.sh) that queries the OpenSearch releases/tags (GitHub API
or official index), extracts semver tags, groups by major version, picks the
latest patch/release for each major, and writes the mapping into
files/versions.yaml in the same YAML format ("v3": "3.0.0", ...); make the
script executable, ensure it safely updates files/versions.yaml (atomic write),
includes minimal error handling and an option to run locally/CI, and add/mention
the script in repository docs or CI tasks consistent with the other
packages/apps maintenance scripts.

In `@packages/apps/opensearch/README.md`:
- Around line 96-123: Fix markdownlint warnings by normalizing pipe spacing in
the "Parameters" and "Resource Presets" tables (ensure single space around each
cell separator and consistent header divider formatting) and replace bare URLs
in the "Support" section with markdown links or reference-style links so they
are not bare; update the README.md tables shown under the Parameters and
Resource Presets headings and the Support section URLs (lines referenced in the
review) to use properly spaced table pipes and wrapped/link-formatted URLs.
- Around line 94-100: Rename the README section heading from "## Configuration
Parameters" to exactly "## Parameters" so the docs generator recognizes it;
locate the heading string "## Configuration Parameters" in the file and replace
it with "## Parameters" (or update the generator if you prefer, but the quick
fix is to change the heading text).

In `@packages/apps/opensearch/templates/security.yaml`:
- Around line 100-117: Add the missing standard labels to the credentials
Secret: update the Secret metadata for the resource named "{{ .Release.Name
}}-credentials" to include labels "app.kubernetes.io/name" and
"app.kubernetes.io/instance" (matching the values used on the other secrets,
e.g., the chart name and release instance), so the Secret's metadata.labels
mirror those on admin-credentials and security-config; keep the existing
metadata.name and type unchanged.

In
`@packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-deployment.yaml`:
- Around line 86-89: The imagePullSecrets block is mis-indented: the template
uses toYaml .Values.manager.imagePullSecrets | nindent 6 which places the keys
at the wrong column under spec; change the indentation to nindent 8 so
imagePullSecrets and its entries align correctly under spec. Locate the
imagePullSecrets conditional around the manager chart (references:
imagePullSecrets, .Values.manager.imagePullSecrets, nindent) and replace nindent
6 with nindent 8 to fix alignment.
- Around line 75-77: The extraEnv block in the Helm template uses incorrect
indentation: change the nindent call for .Values.manager.extraEnv from nindent 8
to nindent 10 so its rendered env entries align with the other environment
variables in the opensearch-operator-controller-manager-deployment template
(look for the block referencing .Values.manager.extraEnv and the surrounding env
var lines around the existing env entries).

In
`@packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-manager-config-cm.yaml`:
- Around line 1-17: This change adds a vendored Helm template
(opensearch-operator-manager-config-cm.yaml) that creates a ConfigMap containing
ControllerManagerConfig (key controller_manager_config.yaml with apiVersion
controller-runtime.sigs.k8s.io/v1alpha1), which must not be edited in place;
revert this file from the vendored charts and instead apply the customization
through the umbrella chart or a post-render step: remove the added template from
the vendored chart, then provide the same ConfigMap content via your umbrella
chart’s values/overlays (or a kustomize/post-renderer patch) so the resulting
release contains the ConfigMap named by the template expression using include
"opensearch-operator.fullname" without modifying upstream chart files.

In
`@packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-metrics-reader-cr.yaml`:
- Line 4: The metadata.name template uses unquoted Helm templating which
triggers yamllint; wrap the entire templated expression in quotes so the value
remains a single YAML string — update the metadata.name that uses include
"opensearch-operator.fullname" and .Release.Namespace (the line with
metadata.name: {{ include "opensearch-operator.fullname" . }}-{{
.Release.Namespace }}-metrics-reader) to be a quoted string containing the
combined template.

In
`@packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-proxy-rolebinding.yaml`:
- Around line 1-27: The template currently emits a RoleBinding when
.Values.useRoleBindings is true which cannot grant cluster-scoped permissions
needed for tokenreviews/subjectaccessreviews; change the logic in
opensearch-operator-proxy-rolebinding.yaml so it always creates a
ClusterRoleBinding (i.e., remove or override the .Values.useRoleBindings branch
and ensure kind: ClusterRoleBinding and apiVersion: rbac.authorization.k8s.io/v1
are used), keeping the existing roleRef (name using include
"opensearch-operator.fullname") and subjects (service account from include
"opensearch-operator.serviceAccountName" and .Release.Namespace) unchanged.
Ensure no code path emits kind: RoleBinding for the proxy binding.

In `@packages/system/opensearch-operator/Makefile`:
- Around line 6-10: The Makefile update target currently runs helm pull without
pinning a chart version; modify the helm pull invocation in the update target so
it includes a --version 2.8.0 flag (i.e., update the helm pull
opensearch-operator/opensearch-operator command in the update recipe) to ensure
reproducible builds.

In `@packages/system/opensearch-operator/values.yaml`:
- Around line 1-4: Replace the empty-string value used for
opensearch-operator.manager.watchNamespace with a null/omitted value to match
upstream idiom: update the YAML so that watchNamespace is either written as
watchNamespace: (no value) or watchNamespace: null under the opensearch-operator
→ manager section so Helm treats it as unset and the chart produces cluster-wide
watching.

In `@packages/apps/opensearch/Makefile`:
- Around line 1-11: The Makefile's update target references a missing script
("hack/update-versions.sh") and uses a plain "make" invocation; add the missing
hack/update-versions.sh script (matching behavior from other app packages) into
this package so the update target can run, and change the recursive invocation
in the update target from "make generate" to use "$(MAKE) generate" to propagate
make flags and jobserver settings; ensure the Makefile targets "generate" and
"update" remain as-is and the new script is executable and implements the same
version-update logic used by the other app packages.

In `@packages/apps/opensearch/templates/opensearch.yaml`:
- Around line 61-72: Add validation to values.schema.json to ensure at least one
node role is enabled by requiring nodeRoles.master, nodeRoles.data,
nodeRoles.ingest or nodeRoles.ml to be true; implement this by adding an anyOf
(or oneOf) clause that includes four subschemas each asserting
nodeRoles.<master|data|ingest|ml> : { "const": true } (or equivalent
boolean-true check), so the schema fails if all four flags are false, and update
the chart README to document the requirement if you prefer a documented
constraint instead of schema enforcement.

In `@packages/apps/opensearch/values.schema.json`:
- Around line 91-100: The schema for nodeRoles currently sets "default": {}
while also declaring required keys ["data","ingest","master","ml"], causing a
conflict; update the nodeRoles entry (the "nodeRoles" object in the JSON schema)
by either removing the "required" array for nodeRoles or supplying a complete
default object that includes keys data, ingest, master, and ml with appropriate
boolean/default values so the default satisfies the required properties.
- Around line 22-30: The dashboards schema declares "default": {} but also lists
required properties ["enabled","replicas","resourcesPreset"], causing validation
failure; fix by either removing the required array from the dashboards object
(so nested properties rely on their own defaults) or by replacing the empty
default with a complete default object that includes enabled, replicas and
resourcesPreset values; update the "dashboards" schema (the dashboards object in
values.schema.json) accordingly and ensure nested property defaults remain
intact.

In
`@packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-metrics-service-svc.yaml`:
- Around line 1-13: Move the custom Service resource (the controller-manager
metrics Service named via {{ include "opensearch-operator.fullname" .
}}-controller-manager-metrics-service) out of the vendored subchart and into the
parent umbrella chart's templates directory; delete the duplicate file from the
subchart so there’s no conflicting resource, keep the same metadata (labels:
control-plane: controller-manager), spec (ports port: 8443 targetPort: https,
selector: control-plane: controller-manager), and retain the same Helm fullname
include reference so names remain stable, and update chart dependencies or
values if the parent needs to reference any subchart values used by this
template.

In
`@packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-manager-rolebinding.yaml`:
- Around line 1-27: The RoleBinding branch controlled by .Values.useRoleBindings
incorrectly attempts to grant cluster-scoped permissions (the manager-role
ClusterRole includes namespace resource rules) which RoleBinding cannot
authorize; update the template so either (a) remove the RoleBinding branch and
always emit a ClusterRoleBinding for the manager-role, or (b) keep the
.Values.useRoleBindings conditional but ensure that the ClusterRole
(manager-role) does not contain cluster-scoped namespace rules when rendering a
RoleBinding—move namespace-related rules to only be rendered when emitting the
ClusterRoleBinding branch (the template block generating ClusterRoleBinding and
the manager-role rules must include namespace resource permissions, while the
RoleBinding branch must only reference namespaced resources or be removed).

In `@packages/system/opensearch-operator/templates/sysctl-daemonset.yaml`:
- Around line 35-40: Update the initContainer persistence logic around the
sysctl change (the block containing "sysctl -w vm.max_map_count=262144" and the
check of /host-etc/sysctl.conf) so it atomically ensures a single non-commented
setting: check for a non-commented key using a stricter pattern (e.g. grep -qE
'^\s*vm.max_map_count=' /host-etc/sysctl.conf 2>/dev/null) and if present use
sed -i to replace the value (sed -i
's/^\s*vm.max_map_count=.*/vm.max_map_count=262144/') else append the line; keep
the existing writable check (if [ -w /host-etc/sysctl.conf ]) and
suppress/handle grep errors to avoid appending duplicates on failures.

In `@packages/system/opensearch-rd/cozyrds/opensearch.yaml`:
- Around line 10-11: The dashboards and nodeRoles schemas declare required
properties but set default to an empty object, causing validation failures when
an empty object is provided; update the defaults so they include the required
keys (for dashboards include enabled, replicas, resourcesPreset and a default
resources object as appropriate) or alternatively remove the required arrays
from dashboards and nodeRoles; specifically modify the openAPISchema entries for
"dashboards" and "nodeRoles" so the "default" for dashboards is an object
containing enabled:false (or current default), replicas:1,
resourcesPreset:"medium" (and resources:{} if needed) and the "default" for
nodeRoles is an object with data:true, ingest:true, master:true, ml:false
(matching the properties), or drop the "required" fields from each schema.

In `@packages/apps/opensearch/hack/update-versions.sh`:
- Around line 36-49: The script currently only warns when a major version has no
stable tag (inside the for loop using SUPPORTED_MAJOR_VERSIONS, TAGS, LATEST and
appending to VERSIONS_FILE), which yields an incomplete versions.yaml; change
the else branch to print a clear error to stderr and exit non‑zero (e.g., echo
"ERROR: No stable release found for major version ${MAJOR}" >&2; exit 1) so the
script fails fast; additionally, to avoid producing a partial VERSIONS_FILE,
build the output into a temporary file first and only move/rename it to
VERSIONS_FILE after the loop completes successfully.

In `@packages/apps/opensearch/templates/opensearch.yaml`:
- Around line 7-14: The template is creating a first-party OpenSearchCluster CR
(OpenSearchCluster in templates/opensearch.yaml) instead of acting as an
umbrella chart wrapping a vendored upstream operator; vendor the upstream
OpenSearch Operator chart into charts/opensearch-operator/, add it as a
dependency in Chart.yaml (name/version/repository entry), remove or stop
committing the operator CR as a direct upstream resource, and instead keep this
chart as the umbrella by placing only configuration templates/values that supply
the operator with the cluster spec (e.g., move the spec currently in
templates/opensearch.yaml into values and let the vendored operator chart render
the OpenSearchCluster using those values or create a minimal template that
references .Values to instantiate the CR via the operator); ensure metadata.name
and spec.general.serviceName still use {{ .Release.Name }} and that the operator
is installed from charts/opensearch-operator rather than defining operator
resources here.
- Around line 87-99: The WorkloadMonitor CRD is setting spec.version to the Helm
chart version ({{ .Chart.Version }}) instead of the OpenSearch application
version; update the template so the WorkloadMonitor resource (kind:
WorkloadMonitor) sets spec.version to the application value by replacing the
current use of .Chart.Version with .Values.version (i.e., set version: {{
.Values.version }}) so spec.version reflects the deployed OpenSearch version.

In `@packages/apps/opensearch/templates/security.yaml`:
- Around line 1-7: The template currently generates a new $password whenever
$existingAdminCreds is missing even if $existingSecurityConfig exists, which
risks password drift; update the conditional logic around
$existingAdminCreds/$existingSecurityConfig so that if $existingSecurityConfig
exists but $existingAdminCreds is absent you first attempt a fallback lookup for
the user-facing credentials Secret (the Secret that contains the live user
password used by clients) and reuse its password if found, and only if no
recoverable password can be found then fail fast with an explicit error/log
rather than silently generating a new random $password; reference the symbols
$existingSecurityConfig, $existingAdminCreds, $password and the
"*-admin-credentials" and "security-config" Secret names when making the change.

In `@packages/apps/opensearch/values.schema.json`:
- Around line 79-92: The "images" schema declares "required": ["opensearch"] but
sets "default": {}, causing a schema conflict; fix by either removing the
"required" array from the images object or by setting a complete default object
that includes the opensearch property (e.g., a default string for the
"opensearch" property) so the default satisfies the required constraint; update
the images object's "default" or its "required" entry accordingly, referencing
the images object and the opensearch property in the schema.

In
`@packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-metrics-reader-cr.yaml`:
- Around line 1-9: This ClusterRole manifest under the vendored chart (defines
kind: ClusterRole with metadata name using {{ include
"opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-metrics-reader and
rule nonResourceURLs: [/metrics]) must not be edited in-place; move this
resource into your umbrella/wrapper chart's templates directory, create a
corresponding values entry (e.g., enableMetricsReader: true) and wiring (via
values/labels) so the wrapper chart renders the ClusterRole with the same
name/template include and namespace, and remove/ignore the vendored copy; ensure
the wrapper template retains the same metadata name expression and verb/rules so
behavior is identical.

Verify each finding against the current code and only fix it if needed.


In `@packages/core/platform/sources/opensearch-application.yaml`:
- Around line 12-22: The YAML uses 4-space indentation for list items under keys
like variants, dependsOn, libraries, and components (e.g., the "variants" block
with "name: default" and "components: opensearch"); change these list-item
indentations to the 2-space style used in the other source file so list entries
(e.g., - name: default, - cozystack.networking, - name: cozy-lib, - name:
opensearch) are indented with 2 spaces consistently throughout the file.

Verify each finding against the current code and only fix it if needed.


In
`@packages/system/opensearch-operator/charts/opensearch-operator/templates/opensearch-operator-controller-manager-deployment.yaml`:
- Around line 80-85: The closing brace spacing for the securityContext nindent
call is inconsistent: change the `{{- toYaml .Values.securityContext | nindent
8}}` invocation so it matches the other blocks (use a space before the closing
braces like the `nodeSelector` and `tolerations` lines), i.e., update the
`securityContext` template line referencing `.Values.securityContext` to use
`nindent 8 }}` for consistent formatting.
- Around line 1-94: This change directly edits a vendored upstream Helm chart
(the Deployment template that defines containers kube-rbac-proxy and
operator-controller-manager) which violates the guideline; revert direct
modifications in this vendored chart and instead implement the indentation/fix
changes via a proper chart patch or a post-render hook (or Helm chart overlay)
that targets the opensearch-operator-controller-manager Deployment template
(matching metadata name from the template and container names kube-rbac-proxy /
operator-controller-manager) so the upstream chart can be re-vendored cleanly in
future.