Skip to content

Commit ab33611

Browse files
ArsolittArsolitt
committed
refactor(opensearch): switch CA and leaf private keys to ECDSA P-256
Replace RSA-4096 with ECDSA P-256 for both the HTTP CA certificate and the combined leaf certificate. ECDSA P-256 provides equivalent security with smaller key material and faster TLS handshakes. CA retains rotationPolicy Never; leaf retains rotationPolicy Always. Add assertions to tls_test.yaml verifying algorithm, size, and rotationPolicy for both certificate documents. Assisted-By: Claude <[email protected]> Signed-off-by: Arsolitt <[email protected]>
1 parent 43d7801 commit ab33611

2 files changed

Lines changed: 19 additions & 4 deletions

File tree

‎packages/apps/opensearch/templates/certmanager.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -60,8 +60,8 @@ spec:
6060
- cert sign
6161
privateKey:
6262
rotationPolicy: Never
63-
algorithm: RSA
64-
size: 4096
63+
algorithm: ECDSA
64+
size: 256
6565
issuerRef:
6666
name: {{ .Release.Name }}-http-selfsigned
6767
kind: Issuer
@@ -114,8 +114,8 @@ spec:
114114
{{- end }}
115115
privateKey:
116116
rotationPolicy: Always
117-
algorithm: RSA
118-
size: 4096
117+
algorithm: ECDSA
118+
size: 256
119119
issuerRef:
120120
name: {{ .Release.Name }}-http-ca
121121
kind: Issuer

‎packages/apps/opensearch/tests/tls_test.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,12 @@ tests:
127127
- equal:
128128
path: spec.privateKey.rotationPolicy
129129
value: Never
130+
- equal:
131+
path: spec.privateKey.algorithm
132+
value: ECDSA
133+
- equal:
134+
path: spec.privateKey.size
135+
value: 256
130136

131137
- it: third document is CA Issuer referencing the CA secret
132138
set:
@@ -157,6 +163,15 @@ tests:
157163
- equal:
158164
path: spec.issuerRef.name
159165
value: os-test-http-ca
166+
- equal:
167+
path: spec.privateKey.algorithm
168+
value: ECDSA
169+
- equal:
170+
path: spec.privateKey.size
171+
value: 256
172+
- equal:
173+
path: spec.privateKey.rotationPolicy
174+
value: Always
160175

161176
# --- SAN coverage for HTTP services ---
162177

0 commit comments

Comments
 (0)