kind: CustomResourceDefinition
spec:
  group: opensearch.stackable.tech
  names:
    kind: OpenSearchCluster
    plural: opensearchclusters
    singular: opensearchcluster
    categories: []
    shortNames:
      - opensearch
  scope: Namespaced
  versions:
    - name: v1alpha1
      schema:
        openAPIV3Schema:
          type: object
          title: OpenSearchCluster
          required:
            - spec
          properties:
            spec:
              type: object
              required:
                - image
                - nodes
              properties:
                image:
                  type: object
                  anyOf:
                    - required:
                        - custom
                        - productVersion
                    - required:
                        - productVersion
                  properties:
                    repo:
                      type: string
                      nullable: true
                      description: >-
                        The repository on the container image registry where the
                        container image is located, e.g.

                        `oci.example.com/namespace`.


                        If not specified, the operator will use the image
                        registry provided via the operator

                        environment options.
                    custom:
                      type: string
                      description: >-
                        Provide a custom container image.


                        Specify the full container image name, e.g.
                        `oci.example.tech/namespace/superset:1.4.1-my-tag`
                    pullPolicy:
                      enum:
                        - IfNotPresent
                        - Always
                        - Never
                      type: string
                      default: Always
                      description: "[Pull
                        policy](https://kubernetes.io/docs/concepts/containers/image\
                        s/#image-pull-policy) used when pulling the image."
                    pullSecrets:
                      type: array
                      items:
                        type: object
                        required:
                          - name
                        properties:
                          name:
                            type: string
                            description: "Name of the referent. This field is effectively required, but due
                              to backwards compatibility is allowed to be empty.
                              Instances of this type with an empty value here
                              are almost certainly wrong. More info:
                              https://kubernetes.io/docs/concepts/overview/work\
                              ing-with-objects/names/#names"
                        description: LocalObjectReference contains enough information to let you locate
                          the referenced object inside the same namespace.
                      nullable: true
                      description: "[Image pull
                        secrets](https://kubernetes.io/docs/concepts/containers\
                        /images/#specifying-imagepullsecrets-on-a-pod) to pull
                        images from a private registry."
                    productVersion:
                      type: string
                      description: Version of the product, e.g. `1.4.1`.
                    stackableVersion:
                      type: string
                      nullable: true
                      description: >-
                        Stackable version of the product, e.g. `23.4`, `23.4.1`
                        or `0.0.0-dev`.


                        If not specified, the operator will use its own version,
                        e.g. `23.4.1`. When using a nightly

                        operator or a PR version, it will use the nightly
                        `0.0.0-dev` image.
                  description: |-
                    Specify which image to use, the easiest way is to only configure the `productVersion`.
                    You can also configure a custom image registry to pull from, as well as completely custom
                    images.

                    Consult the [Product image selection documentation](https://docs.stackable.tech/home/26.7/concepts/product_image_selection)
                    for details.
                nodes:
                  type: object
                  required:
                    - roleGroups
                  properties:
                    config:
                      type: object
                      default: {}
                      properties:
                        logging:
                          type: object
                          default:
                            containers: {}
                            enableVectorAgent: null
                          properties:
                            containers:
                              type: object
                              properties:
                                vector:
                                  type: object
                                  anyOf:
                                    - required:
                                        - custom
                                    - {}
                                    - {}
                                  properties:
                                    file:
                                      type: object
                                      nullable: true
                                      properties:
                                        level:
                                          enum:
                                            - TRACE
                                            - DEBUG
                                            - INFO
                                            - WARN
                                            - ERROR
                                            - FATAL
                                            - NONE
                                            - null
                                          type: string
                                          nullable: true
                                          description: >-
                                            The log level threshold.

                                            Log events with a lower log level
                                            are discarded.
                                      description: Configuration for the file appender
                                    custom:
                                      type: object
                                      properties:
                                        configMap:
                                          type: string
                                          nullable: true
                                          description: ConfigMap containing the log configuration files
                                      description: Log configuration provided in a ConfigMap
                                    console:
                                      type: object
                                      nullable: true
                                      properties:
                                        level:
                                          enum:
                                            - TRACE
                                            - DEBUG
                                            - INFO
                                            - WARN
                                            - ERROR
                                            - FATAL
                                            - NONE
                                            - null
                                          type: string
                                          nullable: true
                                          description: >-
                                            The log level threshold.

                                            Log events with a lower log level
                                            are discarded.
                                      description: Configuration for the console appender
                                    loggers:
                                      type: object
                                      default: {}
                                      description: Configuration per logger
                                      additionalProperties:
                                        type: object
                                        properties:
                                          level:
                                            enum:
                                              - TRACE
                                              - DEBUG
                                              - INFO
                                              - WARN
                                              - ERROR
                                              - FATAL
                                              - NONE
                                              - null
                                            type: string
                                            nullable: true
                                            description: >-
                                              The log level threshold.

                                              Log events with a lower log level
                                              are discarded.
                                        description: Configuration of a logger
                                  description: Log configuration of the container
                                opensearch:
                                  type: object
                                  anyOf:
                                    - required:
                                        - custom
                                    - {}
                                    - {}
                                  properties:
                                    file:
                                      type: object
                                      nullable: true
                                      properties:
                                        level:
                                          enum:
                                            - TRACE
                                            - DEBUG
                                            - INFO
                                            - WARN
                                            - ERROR
                                            - FATAL
                                            - NONE
                                            - null
                                          type: string
                                          nullable: true
                                          description: >-
                                            The log level threshold.

                                            Log events with a lower log level
                                            are discarded.
                                      description: Configuration for the file appender
                                    custom:
                                      type: object
                                      properties:
                                        configMap:
                                          type: string
                                          nullable: true
                                          description: ConfigMap containing the log configuration files
                                      description: Log configuration provided in a ConfigMap
                                    console:
                                      type: object
                                      nullable: true
                                      properties:
                                        level:
                                          enum:
                                            - TRACE
                                            - DEBUG
                                            - INFO
                                            - WARN
                                            - ERROR
                                            - FATAL
                                            - NONE
                                            - null
                                          type: string
                                          nullable: true
                                          description: >-
                                            The log level threshold.

                                            Log events with a lower log level
                                            are discarded.
                                      description: Configuration for the console appender
                                    loggers:
                                      type: object
                                      default: {}
                                      description: Configuration per logger
                                      additionalProperties:
                                        type: object
                                        properties:
                                          level:
                                            enum:
                                              - TRACE
                                              - DEBUG
                                              - INFO
                                              - WARN
                                              - ERROR
                                              - FATAL
                                              - NONE
                                              - null
                                            type: string
                                            nullable: true
                                            description: >-
                                              The log level threshold.

                                              Log events with a lower log level
                                              are discarded.
                                        description: Configuration of a logger
                                  description: Log configuration of the container
                                init-keystore:
                                  type: object
                                  anyOf:
                                    - required:
                                        - custom
                                    - {}
                                    - {}
                                  properties:
                                    file:
                                      type: object
                                      nullable: true
                                      properties:
                                        level:
                                          enum:
                                            - TRACE
                                            - DEBUG
                                            - INFO
                                            - WARN
                                            - ERROR
                                            - FATAL
                                            - NONE
                                            - null
                                          type: string
                                          nullable: true
                                          description: >-
                                            The log level threshold.

                                            Log events with a lower log level
                                            are discarded.
                                      description: Configuration for the file appender
                                    custom:
                                      type: object
                                      properties:
                                        configMap:
                                          type: string
                                          nullable: true
                                          description: ConfigMap containing the log configuration files
                                      description: Log configuration provided in a ConfigMap
                                    console:
                                      type: object
                                      nullable: true
                                      properties:
                                        level:
                                          enum:
                                            - TRACE
                                            - DEBUG
                                            - INFO
                                            - WARN
                                            - ERROR
                                            - FATAL
                                            - NONE
                                            - null
                                          type: string
                                          nullable: true
                                          description: >-
                                            The log level threshold.

                                            Log events with a lower log level
                                            are discarded.
                                      description: Configuration for the console appender
                                    loggers:
                                      type: object
                                      default: {}
                                      description: Configuration per logger
                                      additionalProperties:
                                        type: object
                                        properties:
                                          level:
                                            enum:
                                              - TRACE
                                              - DEBUG
                                              - INFO
                                              - WARN
                                              - ERROR
                                              - FATAL
                                              - NONE
                                              - null
                                            type: string
                                            nullable: true
                                            description: >-
                                              The log level threshold.

                                              Log events with a lower log level
                                              are discarded.
                                        description: Configuration of a logger
                                  description: Log configuration of the container
                                update-security-config:
                                  type: object
                                  anyOf:
                                    - required:
                                        - custom
                                    - {}
                                    - {}
                                  properties:
                                    file:
                                      type: object
                                      nullable: true
                                      properties:
                                        level:
                                          enum:
                                            - TRACE
                                            - DEBUG
                                            - INFO
                                            - WARN
                                            - ERROR
                                            - FATAL
                                            - NONE
                                            - null
                                          type: string
                                          nullable: true
                                          description: >-
                                            The log level threshold.

                                            Log events with a lower log level
                                            are discarded.
                                      description: Configuration for the file appender
                                    custom:
                                      type: object
                                      properties:
                                        configMap:
                                          type: string
                                          nullable: true
                                          description: ConfigMap containing the log configuration files
                                      description: Log configuration provided in a ConfigMap
                                    console:
                                      type: object
                                      nullable: true
                                      properties:
                                        level:
                                          enum:
                                            - TRACE
                                            - DEBUG
                                            - INFO
                                            - WARN
                                            - ERROR
                                            - FATAL
                                            - NONE
                                            - null
                                          type: string
                                          nullable: true
                                          description: >-
                                            The log level threshold.

                                            Log events with a lower log level
                                            are discarded.
                                      description: Configuration for the console appender
                                    loggers:
                                      type: object
                                      default: {}
                                      description: Configuration per logger
                                      additionalProperties:
                                        type: object
                                        properties:
                                          level:
                                            enum:
                                              - TRACE
                                              - DEBUG
                                              - INFO
                                              - WARN
                                              - ERROR
                                              - FATAL
                                              - NONE
                                              - null
                                            type: string
                                            nullable: true
                                            description: >-
                                              The log level threshold.

                                              Log events with a lower log level
                                              are discarded.
                                        description: Configuration of a logger
                                  description: Log configuration of the container
                                create-admin-certificate:
                                  type: object
                                  anyOf:
                                    - required:
                                        - custom
                                    - {}
                                    - {}
                                  properties:
                                    file:
                                      type: object
                                      nullable: true
                                      properties:
                                        level:
                                          enum:
                                            - TRACE
                                            - DEBUG
                                            - INFO
                                            - WARN
                                            - ERROR
                                            - FATAL
                                            - NONE
                                            - null
                                          type: string
                                          nullable: true
                                          description: >-
                                            The log level threshold.

                                            Log events with a lower log level
                                            are discarded.
                                      description: Configuration for the file appender
                                    custom:
                                      type: object
                                      properties:
                                        configMap:
                                          type: string
                                          nullable: true
                                          description: ConfigMap containing the log configuration files
                                      description: Log configuration provided in a ConfigMap
                                    console:
                                      type: object
                                      nullable: true
                                      properties:
                                        level:
                                          enum:
                                            - TRACE
                                            - DEBUG
                                            - INFO
                                            - WARN
                                            - ERROR
                                            - FATAL
                                            - NONE
                                            - null
                                          type: string
                                          nullable: true
                                          description: >-
                                            The log level threshold.

                                            Log events with a lower log level
                                            are discarded.
                                      description: Configuration for the console appender
                                    loggers:
                                      type: object
                                      default: {}
                                      description: Configuration per logger
                                      additionalProperties:
                                        type: object
                                        properties:
                                          level:
                                            enum:
                                              - TRACE
                                              - DEBUG
                                              - INFO
                                              - WARN
                                              - ERROR
                                              - FATAL
                                              - NONE
                                              - null
                                            type: string
                                            nullable: true
                                            description: >-
                                              The log level threshold.

                                              Log events with a lower log level
                                              are discarded.
                                        description: Configuration of a logger
                                  description: Log configuration of the container
                              description: Log configuration per container.
                            enableVectorAgent:
                              type: boolean
                              nullable: true
                              description: Whether or not to deploy a container with the Vector log agent.
                          description: Logging configuration, learn more in the [logging concept
                            documentation](https://docs.stackable.tech/home/26.7/concepts/logging).
                        affinity:
                          type: object
                          default:
                            podAffinity: null
                            nodeAffinity: null
                            nodeSelector: null
                            podAntiAffinity: null
                          properties:
                            podAffinity:
                              type: object
                              nullable: true
                              description: Same as the `spec.affinity.podAffinity` field on the Pod, see the
                                [Kubernetes
                                docs](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node)
                              x-kubernetes-preserve-unknown-fields: true
                            nodeAffinity:
                              type: object
                              nullable: true
                              description: Same as the `spec.affinity.nodeAffinity` field on the Pod, see the
                                [Kubernetes
                                docs](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node)
                              x-kubernetes-preserve-unknown-fields: true
                            nodeSelector:
                              type: object
                              nullable: true
                              description: Simple key-value pairs forming a nodeSelector, see the [Kubernetes
                                docs](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node)
                              additionalProperties:
                                type: string
                            podAntiAffinity:
                              type: object
                              nullable: true
                              description: Same as the `spec.affinity.podAntiAffinity` field on the Pod, see
                                the [Kubernetes
                                docs](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node)
                              x-kubernetes-preserve-unknown-fields: true
                          description: |-
                            These configuration settings control
                            [Pod placement](https://docs.stackable.tech/home/26.7/concepts/operations/pod_placement).
                        nodeRoles:
                          type: array
                          items:
                            enum:
                              - cluster_manager
                              - coordinating_only
                              - data
                              - ingest
                              - remote_cluster_client
                              - warm
                              - search
                            type: string
                          nullable: true
                          description: |-
                            Roles of the OpenSearch node.

                            Consult the [node roles
                            documentation](https://docs.stackable.tech/home/26.7/opensearch/usage-guide/node-roles) for details.
                        resources:
                          type: object
                          default:
                            cpu:
                              max: null
                              min: null
                            memory:
                              limit: null
                              runtimeLimits: {}
                            storage:
                              data:
                                capacity: null
                          properties:
                            cpu:
                              type: object
                              default:
                                max: null
                                min: null
                              properties:
                                max:
                                  nullable: true
                                  description: >-
                                    The maximum amount of CPU cores that can be
                                    requested by Pods.

                                    Equivalent to the `limit` for Pod resource
                                    configuration.

                                    Cores are specified either as a decimal
                                    point number or as milli units.

                                    For example:`1.5` will be 1.5 cores, also
                                    written as `1500m`.
                                  x-kubernetes-int-or-string: true
                                min:
                                  nullable: true
                                  description: >-
                                    The minimal amount of CPU cores that Pods
                                    need to run.

                                    Equivalent to the `request` for Pod resource
                                    configuration.

                                    Cores are specified either as a decimal
                                    point number or as milli units.

                                    For example:`1.5` will be 1.5 cores, also
                                    written as `1500m`.
                                  x-kubernetes-int-or-string: true
                            memory:
                              type: object
                              properties:
                                limit:
                                  nullable: true
                                  description: |-
                                    The maximum amount of memory that should be available to the Pod.
                                    Specified as a byte [Quantity](https://kubernetes.io/docs/reference/kubernetes-api/common-definitions/quantity/),
                                    which means these suffixes are supported: E, P, T, G, M, k.
                                    You can also use the power-of-two equivalents: Ei, Pi, Ti, Gi, Mi, Ki.
                                    For example, the following represent roughly the same value:
                                    `128974848, 129e6, 129M,  128974848000m, 123Mi`
                                  x-kubernetes-int-or-string: true
                                runtimeLimits:
                                  type: object
                                  description: Additional options that can be specified.
                            storage:
                              type: object
                              properties:
                                data:
                                  type: object
                                  default:
                                    capacity: null
                                  properties:
                                    capacity:
                                      nullable: true
                                      description: >-
                                        Quantity is a fixed-point representation
                                        of a number. It provides convenient
                                        marshaling/unmarshaling in JSON and
                                        YAML, in addition to String() and
                                        AsInt64() accessors.


                                        The serialization format is:


                                        ``` <quantity>        ::=
                                        <signedNumber><suffix>

                                        	(Note that <suffix> may be empty, from the "" case in <decimalSI>.)

                                        <digit>           ::= 0 | 1 | ... | 9
                                        <digits>          ::= <digit> |
                                        <digit><digits> <number>          ::=
                                        <digits> | <digits>.<digits> | <digits>.
                                        | .<digits> <sign>            ::= "+" |
                                        "-" <signedNumber>    ::= <number> |
                                        <sign><number> <suffix>          ::=
                                        <binarySI> | <decimalExponent> |
                                        <decimalSI> <binarySI>        ::= Ki |
                                        Mi | Gi | Ti | Pi | Ei

                                        	(International System of units; See: http://physics.nist.gov/cuu/Units/binary.html)

                                        <decimalSI>       ::= m | "" | k | M | G
                                        | T | P | E

                                        	(Note that 1024 = 1Ki but 1000 = 1k; I didn't choose the capitalization.)

                                        <decimalExponent> ::= "e" <signedNumber>
                                        | "E" <signedNumber> ```


                                        No matter which of the three exponent
                                        forms is used, no quantity may represent
                                        a number greater than 2^63-1 in
                                        magnitude, nor may it have more than 3
                                        decimal places. Numbers larger or more
                                        precise will be capped or rounded up.
                                        (E.g.: 0.1m will rounded up to 1m.) This
                                        may be extended in the future if we
                                        require larger or smaller quantities.


                                        When a Quantity is parsed from a string,
                                        it will remember the type of suffix it
                                        had, and will use the same type again
                                        when it is serialized.


                                        Before serializing, Quantity will be put
                                        in "canonical form". This means that
                                        Exponent/suffix will be adjusted up or
                                        down (with a corresponding increase or
                                        decrease in Mantissa) such that:


                                        - No precision is lost - No fractional
                                        digits will be emitted - The exponent
                                        (or suffix) is as large as possible.


                                        The sign will be omitted unless the
                                        number is negative.


                                        Examples:


                                        - 1.5 will be serialized as "1500m" -
                                        1.5Gi will be serialized as "1536Mi"


                                        Note that the quantity will NEVER be
                                        internally represented by a floating
                                        point number. That is the whole point of
                                        this exercise.


                                        Non-canonical values will still parse as
                                        long as they are well formed, but will
                                        be re-emitted in their canonical form.
                                        (So always use canonical form, or don't
                                        diff.)


                                        This format is intended to make it
                                        difficult to use these numbers without
                                        writing some sort of special handling
                                        code in the hopes that that will cause
                                        implementors to also use a fixed point
                                        implementation.
                                      x-kubernetes-int-or-string: true
                                    selectors:
                                      type: object
                                      nullable: true
                                      properties:
                                        matchLabels:
                                          type: object
                                          description: matchLabels is a map of {key,value} pairs. A single {key,value} in
                                            the matchLabels map is equivalent to
                                            an element of matchExpressions,
                                            whose key field is "key", the
                                            operator is "In", and the values
                                            array contains only "value". The
                                            requirements are ANDed.
                                          additionalProperties:
                                            type: string
                                        matchExpressions:
                                          type: array
                                          items:
                                            type: object
                                            required:
                                              - key
                                              - operator
                                            properties:
                                              key:
                                                type: string
                                                description: key is the label key that the selector applies to.
                                              values:
                                                type: array
                                                items:
                                                  type: string
                                                description: values is an array of string values. If the operator is In or
                                                  NotIn, the values array must
                                                  be non-empty. If the operator
                                                  is Exists or DoesNotExist, the
                                                  values array must be empty.
                                                  This array is replaced during
                                                  a strategic merge patch.
                                              operator:
                                                type: string
                                                description: operator represents a key's relationship to a set of values. Valid
                                                  operators are In, NotIn,
                                                  Exists and DoesNotExist.
                                            description: A label selector requirement is a selector that contains values, a
                                              key, and an operator that relates
                                              the key and values.
                                          description: matchExpressions is a list of label selector requirements. The
                                            requirements are ANDed.
                                      description: A label selector is a label query over a set of resources. The
                                        result of matchLabels and
                                        matchExpressions are ANDed. An empty
                                        label selector matches all objects. A
                                        null label selector matches no objects.
                                    storageClass:
                                      type: string
                                      nullable: true
                          description: >-
                            Resource usage is configured here, this includes CPU
                            usage, memory usage and disk storage

                            usage, if this role needs any.
                        listenerClass:
                          type: string
                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                          nullable: true
                          maxLength: 253
                          minLength: 1
                          description: |-
                            This field controls which
                            [ListenerClass](https://docs.stackable.tech/home/nightly/listener-operator/listenerclass.html)
                            is used to expose the HTTP communication.
                        discoveryServiceExposed:
                          type: boolean
                          nullable: true
                          description: Determines whether this role group is exposed in the discovery
                            service.
                        gracefulShutdownTimeout:
                          type: string
                          nullable: true
                          description: >-
                            Time period Pods have to gracefully shut down, e.g.
                            `30m`, `1h` or `2d`. Consult the

                            operator documentation for details.
                        requestedSecretLifetime:
                          type: string
                          nullable: true
                          description: >-
                            Request secret (currently only autoTls certificates)
                            lifetime from the secret operator, e.g. `7d`, or
                            `30d`.

                            This can be shortened by the
                            `maxCertificateLifetime` setting on the SecretClass
                            issuing the TLS certificate.


                            Defaults to 1d.
                    roleConfig:
                      type: object
                      default:
                        podDisruptionBudget:
                          enabled: true
                          maxUnavailable: null
                        discoveryServiceListenerClass: cluster-internal
                      properties:
                        podDisruptionBudget:
                          type: object
                          default:
                            enabled: true
                            maxUnavailable: null
                          properties:
                            enabled:
                              type: boolean
                              default: true
                              description: >-
                                Whether a PodDisruptionBudget should be written
                                out for this role.

                                Disabling this enables you to specify your own -
                                custom - one.

                                Defaults to true.
                            maxUnavailable:
                              type: integer
                              format: uint16
                              maximum: 65535
                              minimum: 0
                              nullable: true
                              description: >-
                                The number of Pods that are allowed to be down
                                because of voluntary disruptions.

                                If you don't explicitly set this, the operator
                                will use a sane default based

                                upon knowledge about the individual product.
                          description: |-
                            This struct is used to configure:

                            1. If PodDisruptionBudgets are created by the operator
                            2. The allowed number of Pods to be unavailable (`maxUnavailable`)

                            Learn more in the
                            [allowed Pod disruptions documentation](https://docs.stackable.tech/home/26.7/concepts/operations/pod_disruptions).
                        discoveryServiceListenerClass:
                          type: string
                          default: cluster-internal
                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                          maxLength: 253
                          minLength: 1
                          description: The
                            [ListenerClass](https://docs.stackable.tech/home/nightly/listener-operator/listenerclass.html)
                            that is used for the discovery service.
                      description: This is a product-agnostic RoleConfig, which is sufficient for most
                        of the products.
                    roleGroups:
                      type: object
                      description: |-
                        The set of role groups for this role, keyed by their name.

                        A role group is a subset of the replicas of a role that share the same configuration,
                        allowing finer-grained control than the role level. This is useful to e.g. schedule groups
                        onto different classes of nodes or into different regions, or to run them with different
                        settings. Configuration set on a role group is merged on top of the role-level `config`,
                        with the more specific role group values taking precedence.

                        Every role needs at least one role group. A role with a single role group conventionally
                        names it `default`.

                        Read the
                        [roles and role groups concept documentation](https://docs.stackable.tech/home/26.7/concepts/roles-and-role-groups)
                        for more details.
                      additionalProperties:
                        type: object
                        properties:
                          config:
                            type: object
                            default: {}
                            properties:
                              logging:
                                type: object
                                default:
                                  containers: {}
                                  enableVectorAgent: null
                                properties:
                                  containers:
                                    type: object
                                    properties:
                                      vector:
                                        type: object
                                        anyOf:
                                          - required:
                                              - custom
                                          - {}
                                          - {}
                                        properties:
                                          file:
                                            type: object
                                            nullable: true
                                            properties:
                                              level:
                                                enum:
                                                  - TRACE
                                                  - DEBUG
                                                  - INFO
                                                  - WARN
                                                  - ERROR
                                                  - FATAL
                                                  - NONE
                                                  - null
                                                type: string
                                                nullable: true
                                                description: >-
                                                  The log level threshold.

                                                  Log events with a lower log
                                                  level are discarded.
                                            description: Configuration for the file appender
                                          custom:
                                            type: object
                                            properties:
                                              configMap:
                                                type: string
                                                nullable: true
                                                description: ConfigMap containing the log configuration files
                                            description: Log configuration provided in a ConfigMap
                                          console:
                                            type: object
                                            nullable: true
                                            properties:
                                              level:
                                                enum:
                                                  - TRACE
                                                  - DEBUG
                                                  - INFO
                                                  - WARN
                                                  - ERROR
                                                  - FATAL
                                                  - NONE
                                                  - null
                                                type: string
                                                nullable: true
                                                description: >-
                                                  The log level threshold.

                                                  Log events with a lower log
                                                  level are discarded.
                                            description: Configuration for the console appender
                                          loggers:
                                            type: object
                                            default: {}
                                            description: Configuration per logger
                                            additionalProperties:
                                              type: object
                                              properties:
                                                level:
                                                  enum:
                                                    - TRACE
                                                    - DEBUG
                                                    - INFO
                                                    - WARN
                                                    - ERROR
                                                    - FATAL
                                                    - NONE
                                                    - null
                                                  type: string
                                                  nullable: true
                                                  description: >-
                                                    The log level threshold.

                                                    Log events with a lower log
                                                    level are discarded.
                                              description: Configuration of a logger
                                        description: Log configuration of the container
                                      opensearch:
                                        type: object
                                        anyOf:
                                          - required:
                                              - custom
                                          - {}
                                          - {}
                                        properties:
                                          file:
                                            type: object
                                            nullable: true
                                            properties:
                                              level:
                                                enum:
                                                  - TRACE
                                                  - DEBUG
                                                  - INFO
                                                  - WARN
                                                  - ERROR
                                                  - FATAL
                                                  - NONE
                                                  - null
                                                type: string
                                                nullable: true
                                                description: >-
                                                  The log level threshold.

                                                  Log events with a lower log
                                                  level are discarded.
                                            description: Configuration for the file appender
                                          custom:
                                            type: object
                                            properties:
                                              configMap:
                                                type: string
                                                nullable: true
                                                description: ConfigMap containing the log configuration files
                                            description: Log configuration provided in a ConfigMap
                                          console:
                                            type: object
                                            nullable: true
                                            properties:
                                              level:
                                                enum:
                                                  - TRACE
                                                  - DEBUG
                                                  - INFO
                                                  - WARN
                                                  - ERROR
                                                  - FATAL
                                                  - NONE
                                                  - null
                                                type: string
                                                nullable: true
                                                description: >-
                                                  The log level threshold.

                                                  Log events with a lower log
                                                  level are discarded.
                                            description: Configuration for the console appender
                                          loggers:
                                            type: object
                                            default: {}
                                            description: Configuration per logger
                                            additionalProperties:
                                              type: object
                                              properties:
                                                level:
                                                  enum:
                                                    - TRACE
                                                    - DEBUG
                                                    - INFO
                                                    - WARN
                                                    - ERROR
                                                    - FATAL
                                                    - NONE
                                                    - null
                                                  type: string
                                                  nullable: true
                                                  description: >-
                                                    The log level threshold.

                                                    Log events with a lower log
                                                    level are discarded.
                                              description: Configuration of a logger
                                        description: Log configuration of the container
                                      init-keystore:
                                        type: object
                                        anyOf:
                                          - required:
                                              - custom
                                          - {}
                                          - {}
                                        properties:
                                          file:
                                            type: object
                                            nullable: true
                                            properties:
                                              level:
                                                enum:
                                                  - TRACE
                                                  - DEBUG
                                                  - INFO
                                                  - WARN
                                                  - ERROR
                                                  - FATAL
                                                  - NONE
                                                  - null
                                                type: string
                                                nullable: true
                                                description: >-
                                                  The log level threshold.

                                                  Log events with a lower log
                                                  level are discarded.
                                            description: Configuration for the file appender
                                          custom:
                                            type: object
                                            properties:
                                              configMap:
                                                type: string
                                                nullable: true
                                                description: ConfigMap containing the log configuration files
                                            description: Log configuration provided in a ConfigMap
                                          console:
                                            type: object
                                            nullable: true
                                            properties:
                                              level:
                                                enum:
                                                  - TRACE
                                                  - DEBUG
                                                  - INFO
                                                  - WARN
                                                  - ERROR
                                                  - FATAL
                                                  - NONE
                                                  - null
                                                type: string
                                                nullable: true
                                                description: >-
                                                  The log level threshold.

                                                  Log events with a lower log
                                                  level are discarded.
                                            description: Configuration for the console appender
                                          loggers:
                                            type: object
                                            default: {}
                                            description: Configuration per logger
                                            additionalProperties:
                                              type: object
                                              properties:
                                                level:
                                                  enum:
                                                    - TRACE
                                                    - DEBUG
                                                    - INFO
                                                    - WARN
                                                    - ERROR
                                                    - FATAL
                                                    - NONE
                                                    - null
                                                  type: string
                                                  nullable: true
                                                  description: >-
                                                    The log level threshold.

                                                    Log events with a lower log
                                                    level are discarded.
                                              description: Configuration of a logger
                                        description: Log configuration of the container
                                      update-security-config:
                                        type: object
                                        anyOf:
                                          - required:
                                              - custom
                                          - {}
                                          - {}
                                        properties:
                                          file:
                                            type: object
                                            nullable: true
                                            properties:
                                              level:
                                                enum:
                                                  - TRACE
                                                  - DEBUG
                                                  - INFO
                                                  - WARN
                                                  - ERROR
                                                  - FATAL
                                                  - NONE
                                                  - null
                                                type: string
                                                nullable: true
                                                description: >-
                                                  The log level threshold.

                                                  Log events with a lower log
                                                  level are discarded.
                                            description: Configuration for the file appender
                                          custom:
                                            type: object
                                            properties:
                                              configMap:
                                                type: string
                                                nullable: true
                                                description: ConfigMap containing the log configuration files
                                            description: Log configuration provided in a ConfigMap
                                          console:
                                            type: object
                                            nullable: true
                                            properties:
                                              level:
                                                enum:
                                                  - TRACE
                                                  - DEBUG
                                                  - INFO
                                                  - WARN
                                                  - ERROR
                                                  - FATAL
                                                  - NONE
                                                  - null
                                                type: string
                                                nullable: true
                                                description: >-
                                                  The log level threshold.

                                                  Log events with a lower log
                                                  level are discarded.
                                            description: Configuration for the console appender
                                          loggers:
                                            type: object
                                            default: {}
                                            description: Configuration per logger
                                            additionalProperties:
                                              type: object
                                              properties:
                                                level:
                                                  enum:
                                                    - TRACE
                                                    - DEBUG
                                                    - INFO
                                                    - WARN
                                                    - ERROR
                                                    - FATAL
                                                    - NONE
                                                    - null
                                                  type: string
                                                  nullable: true
                                                  description: >-
                                                    The log level threshold.

                                                    Log events with a lower log
                                                    level are discarded.
                                              description: Configuration of a logger
                                        description: Log configuration of the container
                                      create-admin-certificate:
                                        type: object
                                        anyOf:
                                          - required:
                                              - custom
                                          - {}
                                          - {}
                                        properties:
                                          file:
                                            type: object
                                            nullable: true
                                            properties:
                                              level:
                                                enum:
                                                  - TRACE
                                                  - DEBUG
                                                  - INFO
                                                  - WARN
                                                  - ERROR
                                                  - FATAL
                                                  - NONE
                                                  - null
                                                type: string
                                                nullable: true
                                                description: >-
                                                  The log level threshold.

                                                  Log events with a lower log
                                                  level are discarded.
                                            description: Configuration for the file appender
                                          custom:
                                            type: object
                                            properties:
                                              configMap:
                                                type: string
                                                nullable: true
                                                description: ConfigMap containing the log configuration files
                                            description: Log configuration provided in a ConfigMap
                                          console:
                                            type: object
                                            nullable: true
                                            properties:
                                              level:
                                                enum:
                                                  - TRACE
                                                  - DEBUG
                                                  - INFO
                                                  - WARN
                                                  - ERROR
                                                  - FATAL
                                                  - NONE
                                                  - null
                                                type: string
                                                nullable: true
                                                description: >-
                                                  The log level threshold.

                                                  Log events with a lower log
                                                  level are discarded.
                                            description: Configuration for the console appender
                                          loggers:
                                            type: object
                                            default: {}
                                            description: Configuration per logger
                                            additionalProperties:
                                              type: object
                                              properties:
                                                level:
                                                  enum:
                                                    - TRACE
                                                    - DEBUG
                                                    - INFO
                                                    - WARN
                                                    - ERROR
                                                    - FATAL
                                                    - NONE
                                                    - null
                                                  type: string
                                                  nullable: true
                                                  description: >-
                                                    The log level threshold.

                                                    Log events with a lower log
                                                    level are discarded.
                                              description: Configuration of a logger
                                        description: Log configuration of the container
                                    description: Log configuration per container.
                                  enableVectorAgent:
                                    type: boolean
                                    nullable: true
                                    description: Whether or not to deploy a container with the Vector log agent.
                                description: Logging configuration, learn more in the [logging concept
                                  documentation](https://docs.stackable.tech/home/26.7/concepts/logging).
                              affinity:
                                type: object
                                default:
                                  podAffinity: null
                                  nodeAffinity: null
                                  nodeSelector: null
                                  podAntiAffinity: null
                                properties:
                                  podAffinity:
                                    type: object
                                    nullable: true
                                    description: Same as the `spec.affinity.podAffinity` field on the Pod, see the
                                      [Kubernetes
                                      docs](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node)
                                    x-kubernetes-preserve-unknown-fields: true
                                  nodeAffinity:
                                    type: object
                                    nullable: true
                                    description: Same as the `spec.affinity.nodeAffinity` field on the Pod, see the
                                      [Kubernetes
                                      docs](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node)
                                    x-kubernetes-preserve-unknown-fields: true
                                  nodeSelector:
                                    type: object
                                    nullable: true
                                    description: Simple key-value pairs forming a nodeSelector, see the [Kubernetes
                                      docs](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node)
                                    additionalProperties:
                                      type: string
                                  podAntiAffinity:
                                    type: object
                                    nullable: true
                                    description: Same as the `spec.affinity.podAntiAffinity` field on the Pod, see
                                      the [Kubernetes
                                      docs](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node)
                                    x-kubernetes-preserve-unknown-fields: true
                                description: |-
                                  These configuration settings control
                                  [Pod placement](https://docs.stackable.tech/home/26.7/concepts/operations/pod_placement).
                              nodeRoles:
                                type: array
                                items:
                                  enum:
                                    - cluster_manager
                                    - coordinating_only
                                    - data
                                    - ingest
                                    - remote_cluster_client
                                    - warm
                                    - search
                                  type: string
                                nullable: true
                                description: |-
                                  Roles of the OpenSearch node.

                                  Consult the [node roles
                                  documentation](https://docs.stackable.tech/home/26.7/opensearch/usage-guide/node-roles) for details.
                              resources:
                                type: object
                                default:
                                  cpu:
                                    max: null
                                    min: null
                                  memory:
                                    limit: null
                                    runtimeLimits: {}
                                  storage:
                                    data:
                                      capacity: null
                                properties:
                                  cpu:
                                    type: object
                                    default:
                                      max: null
                                      min: null
                                    properties:
                                      max:
                                        nullable: true
                                        description: >-
                                          The maximum amount of CPU cores that
                                          can be requested by Pods.

                                          Equivalent to the `limit` for Pod
                                          resource configuration.

                                          Cores are specified either as a
                                          decimal point number or as milli
                                          units.

                                          For example:`1.5` will be 1.5 cores,
                                          also written as `1500m`.
                                        x-kubernetes-int-or-string: true
                                      min:
                                        nullable: true
                                        description: >-
                                          The minimal amount of CPU cores that
                                          Pods need to run.

                                          Equivalent to the `request` for Pod
                                          resource configuration.

                                          Cores are specified either as a
                                          decimal point number or as milli
                                          units.

                                          For example:`1.5` will be 1.5 cores,
                                          also written as `1500m`.
                                        x-kubernetes-int-or-string: true
                                  memory:
                                    type: object
                                    properties:
                                      limit:
                                        nullable: true
                                        description: |-
                                          The maximum amount of memory that should be available to the Pod.
                                          Specified as a byte [Quantity](https://kubernetes.io/docs/reference/kubernetes-api/common-definitions/quantity/),
                                          which means these suffixes are supported: E, P, T, G, M, k.
                                          You can also use the power-of-two equivalents: Ei, Pi, Ti, Gi, Mi, Ki.
                                          For example, the following represent roughly the same value:
                                          `128974848, 129e6, 129M,  128974848000m, 123Mi`
                                        x-kubernetes-int-or-string: true
                                      runtimeLimits:
                                        type: object
                                        description: Additional options that can be specified.
                                  storage:
                                    type: object
                                    properties:
                                      data:
                                        type: object
                                        default:
                                          capacity: null
                                        properties:
                                          capacity:
                                            nullable: true
                                            description: >-
                                              Quantity is a fixed-point
                                              representation of a number. It
                                              provides convenient
                                              marshaling/unmarshaling in JSON
                                              and YAML, in addition to String()
                                              and AsInt64() accessors.


                                              The serialization format is:


                                              ``` <quantity>        ::=
                                              <signedNumber><suffix>

                                              	(Note that <suffix> may be empty, from the "" case in <decimalSI>.)

                                              <digit>           ::= 0 | 1 | ...
                                              | 9 <digits>          ::= <digit>
                                              | <digit><digits>
                                              <number>          ::= <digits> |
                                              <digits>.<digits> | <digits>. |
                                              .<digits> <sign>            ::=
                                              "+" | "-" <signedNumber>    ::=
                                              <number> | <sign><number>
                                              <suffix>          ::= <binarySI> |
                                              <decimalExponent> | <decimalSI>
                                              <binarySI>        ::= Ki | Mi | Gi
                                              | Ti | Pi | Ei

                                              	(International System of units; See: http://physics.nist.gov/cuu/Units/binary.html)

                                              <decimalSI>       ::= m | "" | k |
                                              M | G | T | P | E

                                              	(Note that 1024 = 1Ki but 1000 = 1k; I didn't choose the capitalization.)

                                              <decimalExponent> ::= "e"
                                              <signedNumber> | "E"
                                              <signedNumber> ```


                                              No matter which of the three
                                              exponent forms is used, no
                                              quantity may represent a number
                                              greater than 2^63-1 in magnitude,
                                              nor may it have more than 3
                                              decimal places. Numbers larger or
                                              more precise will be capped or
                                              rounded up. (E.g.: 0.1m will
                                              rounded up to 1m.) This may be
                                              extended in the future if we
                                              require larger or smaller
                                              quantities.


                                              When a Quantity is parsed from a
                                              string, it will remember the type
                                              of suffix it had, and will use the
                                              same type again when it is
                                              serialized.


                                              Before serializing, Quantity will
                                              be put in "canonical form". This
                                              means that Exponent/suffix will be
                                              adjusted up or down (with a
                                              corresponding increase or decrease
                                              in Mantissa) such that:


                                              - No precision is lost - No
                                              fractional digits will be emitted
                                              - The exponent (or suffix) is as
                                              large as possible.


                                              The sign will be omitted unless
                                              the number is negative.


                                              Examples:


                                              - 1.5 will be serialized as
                                              "1500m" - 1.5Gi will be serialized
                                              as "1536Mi"


                                              Note that the quantity will NEVER
                                              be internally represented by a
                                              floating point number. That is the
                                              whole point of this exercise.


                                              Non-canonical values will still
                                              parse as long as they are well
                                              formed, but will be re-emitted in
                                              their canonical form. (So always
                                              use canonical form, or don't
                                              diff.)


                                              This format is intended to make it
                                              difficult to use these numbers
                                              without writing some sort of
                                              special handling code in the hopes
                                              that that will cause implementors
                                              to also use a fixed point
                                              implementation.
                                            x-kubernetes-int-or-string: true
                                          selectors:
                                            type: object
                                            nullable: true
                                            properties:
                                              matchLabels:
                                                type: object
                                                description: matchLabels is a map of {key,value} pairs. A single {key,value} in
                                                  the matchLabels map is
                                                  equivalent to an element of
                                                  matchExpressions, whose key
                                                  field is "key", the operator
                                                  is "In", and the values array
                                                  contains only "value". The
                                                  requirements are ANDed.
                                                additionalProperties:
                                                  type: string
                                              matchExpressions:
                                                type: array
                                                items:
                                                  type: object
                                                  required:
                                                    - key
                                                    - operator
                                                  properties:
                                                    key:
                                                      type: string
                                                      description: key is the label key that the selector applies to.
                                                    values:
                                                      type: array
                                                      items:
                                                        type: string
                                                      description: values is an array of string values. If the operator is In or
                                                        NotIn, the values array
                                                        must be non-empty. If
                                                        the operator is Exists
                                                        or DoesNotExist, the
                                                        values array must be
                                                        empty. This array is
                                                        replaced during a
                                                        strategic merge patch.
                                                    operator:
                                                      type: string
                                                      description: operator represents a key's relationship to a set of values. Valid
                                                        operators are In, NotIn,
                                                        Exists and DoesNotExist.
                                                  description: A label selector requirement is a selector that contains values, a
                                                    key, and an operator that
                                                    relates the key and values.
                                                description: matchExpressions is a list of label selector requirements. The
                                                  requirements are ANDed.
                                            description: A label selector is a label query over a set of resources. The
                                              result of matchLabels and
                                              matchExpressions are ANDed. An
                                              empty label selector matches all
                                              objects. A null label selector
                                              matches no objects.
                                          storageClass:
                                            type: string
                                            nullable: true
                                description: >-
                                  Resource usage is configured here, this
                                  includes CPU usage, memory usage and disk
                                  storage

                                  usage, if this role needs any.
                              listenerClass:
                                type: string
                                pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                nullable: true
                                maxLength: 253
                                minLength: 1
                                description: |-
                                  This field controls which
                                  [ListenerClass](https://docs.stackable.tech/home/nightly/listener-operator/listenerclass.html)
                                  is used to expose the HTTP communication.
                              discoveryServiceExposed:
                                type: boolean
                                nullable: true
                                description: Determines whether this role group is exposed in the discovery
                                  service.
                              gracefulShutdownTimeout:
                                type: string
                                nullable: true
                                description: >-
                                  Time period Pods have to gracefully shut down,
                                  e.g. `30m`, `1h` or `2d`. Consult the

                                  operator documentation for details.
                              requestedSecretLifetime:
                                type: string
                                nullable: true
                                description: >-
                                  Request secret (currently only autoTls
                                  certificates) lifetime from the secret
                                  operator, e.g. `7d`, or `30d`.

                                  This can be shortened by the
                                  `maxCertificateLifetime` setting on the
                                  SecretClass issuing the TLS certificate.


                                  Defaults to 1d.
                          replicas:
                            type: integer
                            format: uint16
                            maximum: 65535
                            minimum: 0
                            nullable: true
                          cliOverrides:
                            type: object
                            default: {}
                            additionalProperties:
                              type: string
                          envOverrides:
                            type: object
                            default: {}
                            description: |-
                              `envOverrides` configure environment variables to be set in the Pods.
                              It is a map from strings to strings - environment variables and the value to set.
                              Read the
                              [environment variable overrides documentation](https://docs.stackable.tech/home/26.7/concepts/overrides#env-overrides)
                              for more information and consult the operator specific usage guide to find out about
                              the product specific environment variables that are available.
                            additionalProperties:
                              type: string
                          podOverrides:
                            type: object
                            default: {}
                            description: |-
                              In the `podOverrides` property you can define a
                              [PodTemplateSpec](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#podtemplatespec-v1-core)
                              to override any property that can be set on a Kubernetes Pod.
                              Read the
                              [Pod overrides documentation](https://docs.stackable.tech/home/26.7/concepts/overrides#pod-overrides)
                              for more information.
                            x-kubernetes-preserve-unknown-fields: true
                          configOverrides:
                            type: object
                            properties:
                              opensearch.yml:
                                type: object
                                default:
                                  jsonMergePatch: {}
                                description: >-
                                  ConfigOverrides as key-value pairs, JSON merge
                                  patch, JSON patch or JSON object.


                                  The key-value pairs, JSON merge patch and JSON
                                  patch are merged with/applied to the

                                  configuration provided by the operator. The
                                  user-provided JSON object replaces the

                                  configuration of the operator.


                                  Example for key-value pairs:


                                  ```yaml

                                  stringProperty: new value

                                  booleanProperty: "true"

                                  ```


                                  Example for a JSON merge patch:


                                  ```yaml

                                  jsonMergePatch:
                                    stringProperty: new value
                                    booleanProperty: true
                                    nestedProperty:
                                      key: value
                                  ```


                                  Example for a JSON patch:


                                  ```yaml

                                  jsonPatch:
                                    - op: replace
                                      path: /stringProperty
                                      value: new value
                                  ```


                                  Example for a JSON object:


                                  ```yaml

                                  userProvided:
                                    stringProperty: new value
                                    booleanProperty: true
                                    nestedProperty:
                                      key: value
                                  ```
                                x-kubernetes-preserve-unknown-fields: true
                            description: |-
                              The `configOverrides` can be used to configure properties in product config files
                              that are not exposed in the CRD. Read the
                              [config overrides documentation](https://docs.stackable.tech/home/26.7/concepts/overrides#config-overrides)
                              and consult the operator specific usage guide documentation for details on the
                              available config files and settings for the specific product.
                    cliOverrides:
                      type: object
                      default: {}
                      additionalProperties:
                        type: string
                    envOverrides:
                      type: object
                      default: {}
                      description: |-
                        `envOverrides` configure environment variables to be set in the Pods.
                        It is a map from strings to strings - environment variables and the value to set.
                        Read the
                        [environment variable overrides documentation](https://docs.stackable.tech/home/26.7/concepts/overrides#env-overrides)
                        for more information and consult the operator specific usage guide to find out about
                        the product specific environment variables that are available.
                      additionalProperties:
                        type: string
                    podOverrides:
                      type: object
                      default: {}
                      description: |-
                        In the `podOverrides` property you can define a
                        [PodTemplateSpec](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#podtemplatespec-v1-core)
                        to override any property that can be set on a Kubernetes Pod.
                        Read the
                        [Pod overrides documentation](https://docs.stackable.tech/home/26.7/concepts/overrides#pod-overrides)
                        for more information.
                      x-kubernetes-preserve-unknown-fields: true
                    configOverrides:
                      type: object
                      properties:
                        opensearch.yml:
                          type: object
                          default:
                            jsonMergePatch: {}
                          description: >-
                            ConfigOverrides as key-value pairs, JSON merge
                            patch, JSON patch or JSON object.


                            The key-value pairs, JSON merge patch and JSON patch
                            are merged with/applied to the

                            configuration provided by the operator. The
                            user-provided JSON object replaces the

                            configuration of the operator.


                            Example for key-value pairs:


                            ```yaml

                            stringProperty: new value

                            booleanProperty: "true"

                            ```


                            Example for a JSON merge patch:


                            ```yaml

                            jsonMergePatch:
                              stringProperty: new value
                              booleanProperty: true
                              nestedProperty:
                                key: value
                            ```


                            Example for a JSON patch:


                            ```yaml

                            jsonPatch:
                              - op: replace
                                path: /stringProperty
                                value: new value
                            ```


                            Example for a JSON object:


                            ```yaml

                            userProvided:
                              stringProperty: new value
                              booleanProperty: true
                              nestedProperty:
                                key: value
                            ```
                          x-kubernetes-preserve-unknown-fields: true
                      description: |-
                        The `configOverrides` can be used to configure properties in product config files
                        that are not exposed in the CRD. Read the
                        [config overrides documentation](https://docs.stackable.tech/home/26.7/concepts/overrides#config-overrides)
                        and consult the operator specific usage guide documentation for details on the
                        available config files and settings for the specific product.
                  description: |-
                    This struct represents a role - e.g. HDFS datanodes or Trino workers. It has a key-value-map containing
                    all the roleGroups that are part of this role. Additionally, there is a `config`, which is configurable
                    at the role *and* roleGroup level. Everything at roleGroup level is merged on top of what is configured
                    on role level. There is also a second form of config, which can only be configured
                    at role level, the `roleConfig`.
                    You can learn more about this in the
                    [Roles and role group concept documentation](https://docs.stackable.tech/home/26.7/concepts/roles-and-role-groups).
                clusterConfig:
                  type: object
                  default:
                    tls:
                      serverSecretClass: tls
                      internalSecretClass: tls
                    keystore: []
                    security:
                      enabled: true
                      settings:
                        audit:
                          content:
                            value:
                              _meta:
                                type: audit
                                config_version: 2
                              config:
                                enabled: false
                          managedBy: API
                        roles:
                          content:
                            value:
                              _meta:
                                type: roles
                                config_version: 2
                          managedBy: API
                        config:
                          content:
                            value:
                              _meta:
                                type: config
                                config_version: 2
                              config:
                                dynamic:
                                  http: {}
                                  authc: {}
                                  authz: {}
                          managedBy: API
                        nodesDn:
                          content:
                            value:
                              _meta:
                                type: nodesdn
                                config_version: 2
                          managedBy: API
                        tenants:
                          content:
                            value:
                              _meta:
                                type: tenants
                                config_version: 2
                          managedBy: API
                        allowList:
                          content:
                            value:
                              _meta:
                                type: allowlist
                                config_version: 2
                              config:
                                enabled: false
                          managedBy: API
                        actionGroups:
                          content:
                            value:
                              _meta:
                                type: actiongroups
                                config_version: 2
                          managedBy: API
                        rolesMapping:
                          content:
                            value:
                              _meta:
                                type: rolesmapping
                                config_version: 2
                          managedBy: API
                        internalUsers:
                          content:
                            value:
                              _meta:
                                type: internalusers
                                config_version: 2
                          managedBy: API
                      managingRoleGroup: security-config
                  properties:
                    tls:
                      type: object
                      default:
                        serverSecretClass: tls
                        internalSecretClass: tls
                      properties:
                        serverSecretClass:
                          type: string
                          default: tls
                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                          nullable: true
                          maxLength: 253
                          minLength: 1
                          description: >-
                            Only affects client connections to the REST API.

                            This setting controls:

                            - If TLS encryption is used at all

                            - Which cert the servers should use to authenticate
                            themselves against the client
                        internalSecretClass:
                          type: string
                          default: tls
                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                          maxLength: 253
                          minLength: 1
                          description: >-
                            Only affects internal communication (transport).
                            Used for mutual verification between OpenSearch
                            nodes.

                            This setting controls:

                            - Which cert the servers should use to authenticate
                            themselves against other servers

                            - Which ca.crt to use when validating the other
                            server
                      description: >-
                        TLS configuration options for the server (REST API) and
                        internal communication (transport).


                        This configuration is only effective if the OpenSearch
                        security plugin is not disabled.
                    keystore:
                      type: array
                      items:
                        type: object
                        required:
                          - key
                          - secretKeyRef
                        properties:
                          key:
                            type: string
                            pattern: ^[A-Za-z0-9_\-.]+$
                            minLength: 1
                            description: Key in the OpenSearch keystore
                          secretKeyRef:
                            type: object
                            required:
                              - key
                              - name
                            properties:
                              key:
                                type: string
                                pattern: ^[-._a-zA-Z0-9]+$
                                maxLength: 253
                                minLength: 1
                                description: Key in the Secret that contains the value
                              name:
                                type: string
                                pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                maxLength: 253
                                minLength: 1
                                description: Name of the Secret
                            description: Reference to the Secret containing the value which will be stored
                              in the OpenSearch keystore
                      default: []
                      description: Entries to add to the OpenSearch keystore.
                    security:
                      type: object
                      default:
                        enabled: true
                        settings:
                          audit:
                            content:
                              value:
                                _meta:
                                  type: audit
                                  config_version: 2
                                config:
                                  enabled: false
                            managedBy: API
                          roles:
                            content:
                              value:
                                _meta:
                                  type: roles
                                  config_version: 2
                            managedBy: API
                          config:
                            content:
                              value:
                                _meta:
                                  type: config
                                  config_version: 2
                                config:
                                  dynamic:
                                    http: {}
                                    authc: {}
                                    authz: {}
                            managedBy: API
                          nodesDn:
                            content:
                              value:
                                _meta:
                                  type: nodesdn
                                  config_version: 2
                            managedBy: API
                          tenants:
                            content:
                              value:
                                _meta:
                                  type: tenants
                                  config_version: 2
                            managedBy: API
                          allowList:
                            content:
                              value:
                                _meta:
                                  type: allowlist
                                  config_version: 2
                                config:
                                  enabled: false
                            managedBy: API
                          actionGroups:
                            content:
                              value:
                                _meta:
                                  type: actiongroups
                                  config_version: 2
                            managedBy: API
                          rolesMapping:
                            content:
                              value:
                                _meta:
                                  type: rolesmapping
                                  config_version: 2
                            managedBy: API
                          internalUsers:
                            content:
                              value:
                                _meta:
                                  type: internalusers
                                  config_version: 2
                            managedBy: API
                        managingRoleGroup: security-config
                      properties:
                        enabled:
                          type: boolean
                          default: true
                          description: >-
                            Whether to enable the OpenSearch security plugin


                            Disabling the security plugin also disables TLS and
                            exposes the security index if it

                            exists.
                        settings:
                          type: object
                          default:
                            audit:
                              content:
                                value:
                                  _meta:
                                    type: audit
                                    config_version: 2
                                  config:
                                    enabled: false
                              managedBy: API
                            roles:
                              content:
                                value:
                                  _meta:
                                    type: roles
                                    config_version: 2
                              managedBy: API
                            config:
                              content:
                                value:
                                  _meta:
                                    type: config
                                    config_version: 2
                                  config:
                                    dynamic:
                                      http: {}
                                      authc: {}
                                      authz: {}
                              managedBy: API
                            nodesDn:
                              content:
                                value:
                                  _meta:
                                    type: nodesdn
                                    config_version: 2
                              managedBy: API
                            tenants:
                              content:
                                value:
                                  _meta:
                                    type: tenants
                                    config_version: 2
                              managedBy: API
                            allowList:
                              content:
                                value:
                                  _meta:
                                    type: allowlist
                                    config_version: 2
                                  config:
                                    enabled: false
                              managedBy: API
                            actionGroups:
                              content:
                                value:
                                  _meta:
                                    type: actiongroups
                                    config_version: 2
                              managedBy: API
                            rolesMapping:
                              content:
                                value:
                                  _meta:
                                    type: rolesmapping
                                    config_version: 2
                              managedBy: API
                            internalUsers:
                              content:
                                value:
                                  _meta:
                                    type: internalusers
                                    config_version: 2
                              managedBy: API
                          properties:
                            audit:
                              type: object
                              default:
                                content:
                                  value:
                                    _meta:
                                      type: audit
                                      config_version: 2
                                    config:
                                      enabled: false
                                managedBy: API
                              required:
                                - content
                                - managedBy
                              properties:
                                content:
                                  type: object
                                  oneOf:
                                    - required:
                                        - value
                                    - required:
                                        - valueFrom
                                  properties:
                                    value:
                                      type: object
                                      description: Security configuration file content defined inline
                                      x-kubernetes-preserve-unknown-fields: true
                                    valueFrom:
                                      type: object
                                      oneOf:
                                        - required:
                                            - configMapKeyRef
                                        - required:
                                            - secretKeyRef
                                      properties:
                                        secretKeyRef:
                                          type: object
                                          required:
                                            - key
                                            - name
                                          properties:
                                            key:
                                              type: string
                                              pattern: ^[-._a-zA-Z0-9]+$
                                              maxLength: 253
                                              minLength: 1
                                              description: Key in the Secret that contains the value
                                            name:
                                              type: string
                                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                              maxLength: 253
                                              minLength: 1
                                              description: Name of the Secret
                                          description: Reference to a key in a Secret
                                        configMapKeyRef:
                                          type: object
                                          required:
                                            - key
                                            - name
                                          properties:
                                            key:
                                              type: string
                                              pattern: ^[-._a-zA-Z0-9]+$
                                              maxLength: 253
                                              minLength: 1
                                              description: Key in the ConfigMap that contains the value
                                            name:
                                              type: string
                                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                              maxLength: 253
                                              minLength: 1
                                              description: Name of the ConfigMap
                                          description: Reference to a key in a ConfigMap
                                      description: Security configuration file content ingested from a ConfigMap or
                                        Secret
                                  description: The content of the security configuration file
                                managedBy:
                                  enum:
                                    - API
                                    - operator
                                  type: string
                                  description: >-
                                    Whether this configuration should only be
                                    applied initially and afterwards be managed

                                    via the "API", or managed all the time by
                                    the "operator".


                                    If this configuration is changed later from
                                    "API" to "operator", then the changes made

                                    via the API are overridden.
                              description: |-
                                Settings for audit logging

                                see
                                <https://docs.opensearch.org/latest/security/audit-logs/index/#settings-in-audityml>
                            roles:
                              type: object
                              default:
                                content:
                                  value:
                                    _meta:
                                      type: roles
                                      config_version: 2
                                managedBy: API
                              required:
                                - content
                                - managedBy
                              properties:
                                content:
                                  type: object
                                  oneOf:
                                    - required:
                                        - value
                                    - required:
                                        - valueFrom
                                  properties:
                                    value:
                                      type: object
                                      description: Security configuration file content defined inline
                                      x-kubernetes-preserve-unknown-fields: true
                                    valueFrom:
                                      type: object
                                      oneOf:
                                        - required:
                                            - configMapKeyRef
                                        - required:
                                            - secretKeyRef
                                      properties:
                                        secretKeyRef:
                                          type: object
                                          required:
                                            - key
                                            - name
                                          properties:
                                            key:
                                              type: string
                                              pattern: ^[-._a-zA-Z0-9]+$
                                              maxLength: 253
                                              minLength: 1
                                              description: Key in the Secret that contains the value
                                            name:
                                              type: string
                                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                              maxLength: 253
                                              minLength: 1
                                              description: Name of the Secret
                                          description: Reference to a key in a Secret
                                        configMapKeyRef:
                                          type: object
                                          required:
                                            - key
                                            - name
                                          properties:
                                            key:
                                              type: string
                                              pattern: ^[-._a-zA-Z0-9]+$
                                              maxLength: 253
                                              minLength: 1
                                              description: Key in the ConfigMap that contains the value
                                            name:
                                              type: string
                                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                              maxLength: 253
                                              minLength: 1
                                              description: Name of the ConfigMap
                                          description: Reference to a key in a ConfigMap
                                      description: Security configuration file content ingested from a ConfigMap or
                                        Secret
                                  description: The content of the security configuration file
                                managedBy:
                                  enum:
                                    - API
                                    - operator
                                  type: string
                                  description: >-
                                    Whether this configuration should only be
                                    applied initially and afterwards be managed

                                    via the "API", or managed all the time by
                                    the "operator".


                                    If this configuration is changed later from
                                    "API" to "operator", then the changes made

                                    via the API are overridden.
                              description: |-
                                Definition of roles in the security plugin

                                see <https://docs.opensearch.org/latest/security/configuration/yaml/#rolesyml>
                            config:
                              type: object
                              default:
                                content:
                                  value:
                                    _meta:
                                      type: config
                                      config_version: 2
                                    config:
                                      dynamic:
                                        http: {}
                                        authc: {}
                                        authz: {}
                                managedBy: API
                              required:
                                - content
                                - managedBy
                              properties:
                                content:
                                  type: object
                                  oneOf:
                                    - required:
                                        - value
                                    - required:
                                        - valueFrom
                                  properties:
                                    value:
                                      type: object
                                      description: Security configuration file content defined inline
                                      x-kubernetes-preserve-unknown-fields: true
                                    valueFrom:
                                      type: object
                                      oneOf:
                                        - required:
                                            - configMapKeyRef
                                        - required:
                                            - secretKeyRef
                                      properties:
                                        secretKeyRef:
                                          type: object
                                          required:
                                            - key
                                            - name
                                          properties:
                                            key:
                                              type: string
                                              pattern: ^[-._a-zA-Z0-9]+$
                                              maxLength: 253
                                              minLength: 1
                                              description: Key in the Secret that contains the value
                                            name:
                                              type: string
                                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                              maxLength: 253
                                              minLength: 1
                                              description: Name of the Secret
                                          description: Reference to a key in a Secret
                                        configMapKeyRef:
                                          type: object
                                          required:
                                            - key
                                            - name
                                          properties:
                                            key:
                                              type: string
                                              pattern: ^[-._a-zA-Z0-9]+$
                                              maxLength: 253
                                              minLength: 1
                                              description: Key in the ConfigMap that contains the value
                                            name:
                                              type: string
                                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                              maxLength: 253
                                              minLength: 1
                                              description: Name of the ConfigMap
                                          description: Reference to a key in a ConfigMap
                                      description: Security configuration file content ingested from a ConfigMap or
                                        Secret
                                  description: The content of the security configuration file
                                managedBy:
                                  enum:
                                    - API
                                    - operator
                                  type: string
                                  description: >-
                                    Whether this configuration should only be
                                    applied initially and afterwards be managed

                                    via the "API", or managed all the time by
                                    the "operator".


                                    If this configuration is changed later from
                                    "API" to "operator", then the changes made

                                    via the API are overridden.
                              description: |-
                                Configuration of the security backend

                                see <https://docs.opensearch.org/latest/security/configuration/configuration/>
                            nodesDn:
                              type: object
                              default:
                                content:
                                  value:
                                    _meta:
                                      type: nodesdn
                                      config_version: 2
                                managedBy: API
                              required:
                                - content
                                - managedBy
                              properties:
                                content:
                                  type: object
                                  oneOf:
                                    - required:
                                        - value
                                    - required:
                                        - valueFrom
                                  properties:
                                    value:
                                      type: object
                                      description: Security configuration file content defined inline
                                      x-kubernetes-preserve-unknown-fields: true
                                    valueFrom:
                                      type: object
                                      oneOf:
                                        - required:
                                            - configMapKeyRef
                                        - required:
                                            - secretKeyRef
                                      properties:
                                        secretKeyRef:
                                          type: object
                                          required:
                                            - key
                                            - name
                                          properties:
                                            key:
                                              type: string
                                              pattern: ^[-._a-zA-Z0-9]+$
                                              maxLength: 253
                                              minLength: 1
                                              description: Key in the Secret that contains the value
                                            name:
                                              type: string
                                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                              maxLength: 253
                                              minLength: 1
                                              description: Name of the Secret
                                          description: Reference to a key in a Secret
                                        configMapKeyRef:
                                          type: object
                                          required:
                                            - key
                                            - name
                                          properties:
                                            key:
                                              type: string
                                              pattern: ^[-._a-zA-Z0-9]+$
                                              maxLength: 253
                                              minLength: 1
                                              description: Key in the ConfigMap that contains the value
                                            name:
                                              type: string
                                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                              maxLength: 253
                                              minLength: 1
                                              description: Name of the ConfigMap
                                          description: Reference to a key in a ConfigMap
                                      description: Security configuration file content ingested from a ConfigMap or
                                        Secret
                                  description: The content of the security configuration file
                                managedBy:
                                  enum:
                                    - API
                                    - operator
                                  type: string
                                  description: >-
                                    Whether this configuration should only be
                                    applied initially and afterwards be managed

                                    via the "API", or managed all the time by
                                    the "operator".


                                    If this configuration is changed later from
                                    "API" to "operator", then the changes made

                                    via the API are overridden.
                              description: |-
                                Distinguished names (DNs) of nodes to allow communication between nodes and clusters

                                see <https://docs.opensearch.org/latest/security/configuration/yaml/#nodes_dnyml>
                            tenants:
                              type: object
                              default:
                                content:
                                  value:
                                    _meta:
                                      type: tenants
                                      config_version: 2
                                managedBy: API
                              required:
                                - content
                                - managedBy
                              properties:
                                content:
                                  type: object
                                  oneOf:
                                    - required:
                                        - value
                                    - required:
                                        - valueFrom
                                  properties:
                                    value:
                                      type: object
                                      description: Security configuration file content defined inline
                                      x-kubernetes-preserve-unknown-fields: true
                                    valueFrom:
                                      type: object
                                      oneOf:
                                        - required:
                                            - configMapKeyRef
                                        - required:
                                            - secretKeyRef
                                      properties:
                                        secretKeyRef:
                                          type: object
                                          required:
                                            - key
                                            - name
                                          properties:
                                            key:
                                              type: string
                                              pattern: ^[-._a-zA-Z0-9]+$
                                              maxLength: 253
                                              minLength: 1
                                              description: Key in the Secret that contains the value
                                            name:
                                              type: string
                                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                              maxLength: 253
                                              minLength: 1
                                              description: Name of the Secret
                                          description: Reference to a key in a Secret
                                        configMapKeyRef:
                                          type: object
                                          required:
                                            - key
                                            - name
                                          properties:
                                            key:
                                              type: string
                                              pattern: ^[-._a-zA-Z0-9]+$
                                              maxLength: 253
                                              minLength: 1
                                              description: Key in the ConfigMap that contains the value
                                            name:
                                              type: string
                                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                              maxLength: 253
                                              minLength: 1
                                              description: Name of the ConfigMap
                                          description: Reference to a key in a ConfigMap
                                      description: Security configuration file content ingested from a ConfigMap or
                                        Secret
                                  description: The content of the security configuration file
                                managedBy:
                                  enum:
                                    - API
                                    - operator
                                  type: string
                                  description: >-
                                    Whether this configuration should only be
                                    applied initially and afterwards be managed

                                    via the "API", or managed all the time by
                                    the "operator".


                                    If this configuration is changed later from
                                    "API" to "operator", then the changes made

                                    via the API are overridden.
                              description: |-
                                OpenSearch Dashboards tenants

                                see <https://docs.opensearch.org/latest/security/configuration/yaml/#tenantsyml>
                            allowList:
                              type: object
                              default:
                                content:
                                  value:
                                    _meta:
                                      type: allowlist
                                      config_version: 2
                                    config:
                                      enabled: false
                                managedBy: API
                              required:
                                - content
                                - managedBy
                              properties:
                                content:
                                  type: object
                                  oneOf:
                                    - required:
                                        - value
                                    - required:
                                        - valueFrom
                                  properties:
                                    value:
                                      type: object
                                      description: Security configuration file content defined inline
                                      x-kubernetes-preserve-unknown-fields: true
                                    valueFrom:
                                      type: object
                                      oneOf:
                                        - required:
                                            - configMapKeyRef
                                        - required:
                                            - secretKeyRef
                                      properties:
                                        secretKeyRef:
                                          type: object
                                          required:
                                            - key
                                            - name
                                          properties:
                                            key:
                                              type: string
                                              pattern: ^[-._a-zA-Z0-9]+$
                                              maxLength: 253
                                              minLength: 1
                                              description: Key in the Secret that contains the value
                                            name:
                                              type: string
                                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                              maxLength: 253
                                              minLength: 1
                                              description: Name of the Secret
                                          description: Reference to a key in a Secret
                                        configMapKeyRef:
                                          type: object
                                          required:
                                            - key
                                            - name
                                          properties:
                                            key:
                                              type: string
                                              pattern: ^[-._a-zA-Z0-9]+$
                                              maxLength: 253
                                              minLength: 1
                                              description: Key in the ConfigMap that contains the value
                                            name:
                                              type: string
                                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                              maxLength: 253
                                              minLength: 1
                                              description: Name of the ConfigMap
                                          description: Reference to a key in a ConfigMap
                                      description: Security configuration file content ingested from a ConfigMap or
                                        Secret
                                  description: The content of the security configuration file
                                managedBy:
                                  enum:
                                    - API
                                    - operator
                                  type: string
                                  description: >-
                                    Whether this configuration should only be
                                    applied initially and afterwards be managed

                                    via the "API", or managed all the time by
                                    the "operator".


                                    If this configuration is changed later from
                                    "API" to "operator", then the changes made

                                    via the API are overridden.
                              description: |-
                                List of allowed HTTP endpoints

                                see <https://docs.opensearch.org/latest/security/configuration/yaml/#allowlistyml>
                            actionGroups:
                              type: object
                              default:
                                content:
                                  value:
                                    _meta:
                                      type: actiongroups
                                      config_version: 2
                                managedBy: API
                              required:
                                - content
                                - managedBy
                              properties:
                                content:
                                  type: object
                                  oneOf:
                                    - required:
                                        - value
                                    - required:
                                        - valueFrom
                                  properties:
                                    value:
                                      type: object
                                      description: Security configuration file content defined inline
                                      x-kubernetes-preserve-unknown-fields: true
                                    valueFrom:
                                      type: object
                                      oneOf:
                                        - required:
                                            - configMapKeyRef
                                        - required:
                                            - secretKeyRef
                                      properties:
                                        secretKeyRef:
                                          type: object
                                          required:
                                            - key
                                            - name
                                          properties:
                                            key:
                                              type: string
                                              pattern: ^[-._a-zA-Z0-9]+$
                                              maxLength: 253
                                              minLength: 1
                                              description: Key in the Secret that contains the value
                                            name:
                                              type: string
                                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                              maxLength: 253
                                              minLength: 1
                                              description: Name of the Secret
                                          description: Reference to a key in a Secret
                                        configMapKeyRef:
                                          type: object
                                          required:
                                            - key
                                            - name
                                          properties:
                                            key:
                                              type: string
                                              pattern: ^[-._a-zA-Z0-9]+$
                                              maxLength: 253
                                              minLength: 1
                                              description: Key in the ConfigMap that contains the value
                                            name:
                                              type: string
                                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                              maxLength: 253
                                              minLength: 1
                                              description: Name of the ConfigMap
                                          description: Reference to a key in a ConfigMap
                                      description: Security configuration file content ingested from a ConfigMap or
                                        Secret
                                  description: The content of the security configuration file
                                managedBy:
                                  enum:
                                    - API
                                    - operator
                                  type: string
                                  description: >-
                                    Whether this configuration should only be
                                    applied initially and afterwards be managed

                                    via the "API", or managed all the time by
                                    the "operator".


                                    If this configuration is changed later from
                                    "API" to "operator", then the changes made

                                    via the API are overridden.
                              description: |-
                                User-defined action groups

                                see <https://docs.opensearch.org/latest/security/configuration/yaml/#action_groupsyml>
                            rolesMapping:
                              type: object
                              default:
                                content:
                                  value:
                                    _meta:
                                      type: rolesmapping
                                      config_version: 2
                                managedBy: API
                              required:
                                - content
                                - managedBy
                              properties:
                                content:
                                  type: object
                                  oneOf:
                                    - required:
                                        - value
                                    - required:
                                        - valueFrom
                                  properties:
                                    value:
                                      type: object
                                      description: Security configuration file content defined inline
                                      x-kubernetes-preserve-unknown-fields: true
                                    valueFrom:
                                      type: object
                                      oneOf:
                                        - required:
                                            - configMapKeyRef
                                        - required:
                                            - secretKeyRef
                                      properties:
                                        secretKeyRef:
                                          type: object
                                          required:
                                            - key
                                            - name
                                          properties:
                                            key:
                                              type: string
                                              pattern: ^[-._a-zA-Z0-9]+$
                                              maxLength: 253
                                              minLength: 1
                                              description: Key in the Secret that contains the value
                                            name:
                                              type: string
                                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                              maxLength: 253
                                              minLength: 1
                                              description: Name of the Secret
                                          description: Reference to a key in a Secret
                                        configMapKeyRef:
                                          type: object
                                          required:
                                            - key
                                            - name
                                          properties:
                                            key:
                                              type: string
                                              pattern: ^[-._a-zA-Z0-9]+$
                                              maxLength: 253
                                              minLength: 1
                                              description: Key in the ConfigMap that contains the value
                                            name:
                                              type: string
                                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                              maxLength: 253
                                              minLength: 1
                                              description: Name of the ConfigMap
                                          description: Reference to a key in a ConfigMap
                                      description: Security configuration file content ingested from a ConfigMap or
                                        Secret
                                  description: The content of the security configuration file
                                managedBy:
                                  enum:
                                    - API
                                    - operator
                                  type: string
                                  description: >-
                                    Whether this configuration should only be
                                    applied initially and afterwards be managed

                                    via the "API", or managed all the time by
                                    the "operator".


                                    If this configuration is changed later from
                                    "API" to "operator", then the changes made

                                    via the API are overridden.
                              description: |-
                                Role mappings to users or backend roles

                                see <https://docs.opensearch.org/latest/security/configuration/yaml/#roles_mappingyml>
                            internalUsers:
                              type: object
                              default:
                                content:
                                  value:
                                    _meta:
                                      type: internalusers
                                      config_version: 2
                                managedBy: API
                              required:
                                - content
                                - managedBy
                              properties:
                                content:
                                  type: object
                                  oneOf:
                                    - required:
                                        - value
                                    - required:
                                        - valueFrom
                                  properties:
                                    value:
                                      type: object
                                      description: Security configuration file content defined inline
                                      x-kubernetes-preserve-unknown-fields: true
                                    valueFrom:
                                      type: object
                                      oneOf:
                                        - required:
                                            - configMapKeyRef
                                        - required:
                                            - secretKeyRef
                                      properties:
                                        secretKeyRef:
                                          type: object
                                          required:
                                            - key
                                            - name
                                          properties:
                                            key:
                                              type: string
                                              pattern: ^[-._a-zA-Z0-9]+$
                                              maxLength: 253
                                              minLength: 1
                                              description: Key in the Secret that contains the value
                                            name:
                                              type: string
                                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                              maxLength: 253
                                              minLength: 1
                                              description: Name of the Secret
                                          description: Reference to a key in a Secret
                                        configMapKeyRef:
                                          type: object
                                          required:
                                            - key
                                            - name
                                          properties:
                                            key:
                                              type: string
                                              pattern: ^[-._a-zA-Z0-9]+$
                                              maxLength: 253
                                              minLength: 1
                                              description: Key in the ConfigMap that contains the value
                                            name:
                                              type: string
                                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                              maxLength: 253
                                              minLength: 1
                                              description: Name of the ConfigMap
                                          description: Reference to a key in a ConfigMap
                                      description: Security configuration file content ingested from a ConfigMap or
                                        Secret
                                  description: The content of the security configuration file
                                managedBy:
                                  enum:
                                    - API
                                    - operator
                                  type: string
                                  description: >-
                                    Whether this configuration should only be
                                    applied initially and afterwards be managed

                                    via the "API", or managed all the time by
                                    the "operator".


                                    If this configuration is changed later from
                                    "API" to "operator", then the changes made

                                    via the API are overridden.
                              description: |-
                                The internal user database

                                see <https://docs.opensearch.org/latest/security/configuration/yaml/#internal_usersyml>
                          description: Settings for the OpenSearch security plugin
                        managingRoleGroup:
                          type: string
                          default: security-config
                          maxLength: 63
                          minLength: 1
                          description: The role group that updates the security index if any setting is
                            managed by the operator.
                      description: Configuration of the OpenSearch security plugin
                    vectorAggregatorConfigMapName:
                      type: string
                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                      nullable: true
                      maxLength: 253
                      minLength: 1
                      description: |-
                        Name of the Vector aggregator [discovery ConfigMap](https://docs.stackable.tech/home/26.7/concepts/service_discovery).
                        It must contain the key `ADDRESS` with the address of the Vector aggregator.
                        Follow the [logging tutorial](https://docs.stackable.tech/home/26.7/tutorials/logging-vector-aggregator)
                        to learn how to configure log aggregation with Vector.
                  description: Configuration that applies to all roles and role groups
                objectOverrides:
                  type: array
                  items:
                    type: object
                    x-kubernetes-preserve-unknown-fields: true
                  default: []
                  description: |-
                    A list of generic Kubernetes objects, which are merged into the objects that the operator
                    creates.

                    List entries are arbitrary YAML objects, which need to be valid Kubernetes objects.

                    Read the [Object overrides documentation](https://docs.stackable.tech/home/26.7/concepts/overrides#object-overrides)
                    for more information.
                clusterOperation:
                  type: object
                  default:
                    stopped: false
                    reconciliationPaused: false
                  properties:
                    stopped:
                      type: boolean
                      default: false
                      description: >-
                        Flag to stop the cluster. This means all deployed
                        resources (e.g. Services, StatefulSets,

                        ConfigMaps) are kept but all deployed Pods (e.g.
                        replicas from a StatefulSet) are scaled to 0

                        and therefore stopped and removed.

                        If applied at the same time with `reconciliationPaused`,
                        the latter will pause reconciliation

                        and `stopped` will take no effect until
                        `reconciliationPaused` is set to false or removed.
                    reconciliationPaused:
                      type: boolean
                      default: false
                      description: >-
                        Flag to stop cluster reconciliation by the operator.
                        This means that all changes in the

                        custom resource spec are ignored until this flag is set
                        to false or removed. The operator

                        will however still watch the deployed resources at the
                        time and update the custom resource

                        status field.

                        If applied at the same time with `stopped`,
                        `reconciliationPaused` will take precedence over

                        `stopped` and stop the reconciliation immediately.
                  description: |-
                    [Cluster operations](https://docs.stackable.tech/home/26.7/concepts/operations/cluster_operations)
                    properties, allow stopping the product instance as well as pausing reconciliation.
              description: |-
                An OpenSearch cluster stacklet. This resource is managed by the Stackable operator for
                OpenSearch. Find more information on how to use it and the resources that the operator
                generates in the [operator documentation](https://docs.stackable.tech/home/26.7/opensearch/).
            status:
              type: object
              nullable: true
              properties:
                conditions:
                  type: array
                  items:
                    type: object
                    required:
                      - status
                      - type
                    properties:
                      type:
                        enum:
                          - Available
                          - Degraded
                          - Progressing
                          - ReconciliationPaused
                          - Stopped
                        type: string
                        description: Type of deployment condition.
                      reason:
                        type: string
                        nullable: true
                        description: The reason for the condition's last transition.
                      status:
                        enum:
                          - "True"
                          - "False"
                          - Unknown
                        type: string
                        description: Status of the condition, one of True, False, Unknown.
                      message:
                        type: string
                        nullable: true
                        description: A human readable message indicating details about the transition.
                      lastTransitionTime:
                        type: string
                        format: date-time
                        nullable: true
                        description: Last time the condition transitioned from one status to another.
                  default: []
                discoveryHash:
                  type: string
                  nullable: true
                  description: An opaque value that changes every time a discovery detail does
          description: An OpenSearch cluster stacklet. This resource is managed by the
            Stackable operator for OpenSearch.
      served: true
      storage: true
      subresources:
        status: {}
      additionalPrinterColumns: []
metadata:
  name: opensearchclusters.opensearch.stackable.tech
apiVersion: apiextensions.k8s.io/v1
