How to manage security

This guide covers enabling TLS encryption and changing the kibanaserver credentials for Charmed OpenSearch Dashboards.

Enable TLS encryption

First, make sure you have a TLS certificates charm set up.

This guide shows how to enable TLS using the self-signed-certificates charm as an example.

Caution

Self-signed certificates are not recommended for a production environment.

Check the X.509 certificates topic for an overview of the signed and self-signed certificate charms available.

To deploy the self-signed-certificates charm:

juju deploy self-signed-certificates --config ca-common-name="Tutorial CA"

Then, integrate it with the OpenSearch Dashboards charm:

juju integrate self-signed-certificates opensearch-dashboards

For further guidance on how to manage TLS certificates, see the TLS encryption page for the OpenSearch charm.

Change credentials

Dashboards have a “super-user” called kibanaserver, that is a built-in user set in the OpenSearch database.

For this reason, the credentials change doesn’t happen on the Dashboards side, rather on the OpenSearch side.

Running the following command on the leader unit changes the kibanaserver password:

juju run opensearch/leader set-password username=kibanaserver

The set-password action defaults to the admin user, so the username parameter is required to target kibanaserver.

The new credentials are populated for the Dashboards charm.