chore: add support for OpenSearch 3.6.0

.pre-commit-config.yaml

@@ -38,6 +38,10 @@ repos:
     hooks:
       - id: shellcheck
         args: ["--severity=info"]
+        # Temporarily needed until all getting_started.sh.j2 scripts are made non-executable.
+        # As long as they are, prek will treat them as shell scripts and so this hook will fail.
+        # pre-commit behaves differently apparently and doesn't pass .j2 files to this hook.
+        exclude: \.j2$
 
   # WARNING (@NickLarsenNZ): Nix users need to install ruff first.
   # If you do not, you will need to delete the cached ruff binary shown in the

CHANGELOG.md

@@ -8,6 +8,7 @@ All notable changes to this project will be documented in this file.
 
 - BREAKING: Add required CLI argument and env var to set the image repository used to construct final product image names: `IMAGE_REPOSITORY` (`--image-repository`), eg. `oci.example.org/my/namespace` ([#141]).
 - Support hot-reloading of security configuration files ([#130]).
+- Add support for OpenSearch 3.6.0 and deprecate 3.4.0 ([#148]).
 
 ### Changed
 
@@ -25,6 +26,7 @@ All notable changes to this project will be documented in this file.
 [#141]: https://github.com/stackabletech/opensearch-operator/pull/141
 [#146]: https://github.com/stackabletech/opensearch-operator/pull/146
 [#147]: https://github.com/stackabletech/opensearch-operator/pull/147
+[#148]: https://github.com/stackabletech/opensearch-operator/pull/148
 [#149]: https://github.com/stackabletech/opensearch-operator/pull/149
 
 ## [26.3.0] - 2026-03-16

docs/modules/opensearch/examples/getting_started/getting_started.sh

@@ -141,7 +141,7 @@ kubectl create secret generic opensearch-credentials \
 
 helm install opensearch-dashboards opensearch-dashboards \
     --repo https://opensearch-project.github.io/helm-charts \
-    --version 3.4.0 \
+    --version 3.6.0 \
     --values opensearch-dashboards-values.yaml \
     --wait
 # end::opensearch-dashboards[]

docs/modules/opensearch/examples/getting_started/getting_started.sh.j2

@@ -141,7 +141,7 @@ kubectl create secret generic opensearch-credentials \
 
 helm install opensearch-dashboards opensearch-dashboards \
     --repo https://opensearch-project.github.io/helm-charts \
-    --version 3.4.0 \
+    --version 3.6.0 \
     --values opensearch-dashboards-values.yaml \
     --wait
 # end::opensearch-dashboards[]

docs/modules/opensearch/examples/getting_started/opensearch-dashboards-values.yaml

@@ -1,7 +1,7 @@
 ---
 image:
   repository: oci.stackable.tech/sdp/opensearch-dashboards
-  tag: 3.4.0-stackable0.0.0-dev
+  tag: 3.6.0-stackable0.0.0-dev
 serviceAccount:
   create: false
   name: simple-opensearch-serviceaccount

docs/modules/opensearch/examples/getting_started/opensearch-dashboards-values.yaml.j2

@@ -1,7 +1,7 @@
 ---
 image:
   repository: oci.stackable.tech/sdp/opensearch-dashboards
-  tag: 3.4.0-stackable{{ versions.opensearch }}
+  tag: 3.6.0-stackable{{ versions.opensearch }}
 serviceAccount:
   create: false
   name: simple-opensearch-serviceaccount

docs/modules/opensearch/examples/getting_started/opensearch.yaml

@@ -5,7 +5,7 @@ metadata:
   name: simple-opensearch
 spec:
   image:
-    productVersion: 3.4.0
+    productVersion: 3.6.0
   clusterConfig:
     security:
       settings:

docs/modules/opensearch/pages/usage-guide/opensearch-dashboards.adoc

@@ -13,7 +13,7 @@ A basic `values.yaml` file to deploy OpenSearch Dashboards with this chart might
 opensearchHosts: null # <1>
 image: # <2>
   repository: oci.stackable.tech/sdp/opensearch-dashboards
-  tag: 3.4.0-stackable0.0.0-dev
+  tag: 3.6.0-stackable0.0.0-dev
 serviceAccount:
   create: false
   name: opensearch-serviceaccount # <3>
@@ -92,7 +92,7 @@ After the values are adjusted according to your deployment, especially `opensear
 ----
 helm install opensearch-dashboards opensearch-dashboards \
     --repo https://opensearch-project.github.io/helm-charts \
-    --version 3.4.0 \
+    --version 3.6.0 \
     --values opensearch-dashboards-values.yaml \
     --wait
 ----

docs/modules/opensearch/pages/usage-guide/opensearch-dashboards.adoc.j2

@@ -13,7 +13,7 @@ A basic `values.yaml` file to deploy OpenSearch Dashboards with this chart might
 opensearchHosts: null # <1>
 image: # <2>
   repository: oci.stackable.tech/sdp/opensearch-dashboards
-  tag: 3.4.0-stackable{{ versions.opensearch }}
+  tag: 3.6.0-stackable{{ versions.opensearch }}
 serviceAccount:
   create: false
   name: opensearch-serviceaccount # <3>
@@ -92,7 +92,7 @@ After the values are adjusted according to your deployment, especially `opensear
 ----
 helm install opensearch-dashboards opensearch-dashboards \
     --repo https://opensearch-project.github.io/helm-charts \
-    --version 3.4.0 \
+    --version 3.6.0 \
     --values opensearch-dashboards-values.yaml \
     --wait
 ----

docs/modules/opensearch/pages/usage-guide/security.adoc

@@ -163,7 +163,7 @@ metadata:
   name: opensearch
 spec:
   image:
-    productVersion: 3.4.0
+    productVersion: 3.6.0
   clusterConfig:
     tls:
       serverSecretClass: tls # <1>

docs/modules/opensearch/partials/supported-versions.adoc

@@ -3,4 +3,5 @@
 // Stackable Platform documentation.
 
 - 3.1.0 (LTS)
-- 3.4.0
+- 3.6.0
+- 3.4.0 (deprecated)

rust/operator-binary/src/controller.rs

@@ -603,14 +603,14 @@ mod tests {
     fn validated_cluster() -> ValidatedCluster {
         ValidatedCluster::new(
             ResolvedProductImage {
-                product_version: "3.4.0".to_owned(),
-                app_version_label_value: LabelValue::from_str("3.4.0-stackable0.0.0-dev")
+                product_version: "3.6.0".to_owned(),
+                app_version_label_value: LabelValue::from_str("3.6.0-stackable0.0.0-dev")
                     .expect("should be a valid label value"),
-                image: "oci.stackable.tech/sdp/opensearch:3.4.0-stackable0.0.0-dev".to_string(),
+                image: "oci.stackable.tech/sdp/opensearch:3.6.0-stackable0.0.0-dev".to_string(),
                 image_pull_policy: "Always".to_owned(),
                 pull_secrets: None,
             },
-            ProductVersion::from_str_unsafe("3.4.0"),
+            ProductVersion::from_str_unsafe("3.6.0"),
             ClusterName::from_str_unsafe("my-opensearch"),
             NamespaceName::from_str_unsafe("default"),
             uuid!("e6ac237d-a6d4-43a1-8135-f36506110912"),

rust/operator-binary/src/controller/build.rs

@@ -177,14 +177,14 @@ mod tests {
     fn validated_cluster() -> ValidatedCluster {
         ValidatedCluster::new(
             ResolvedProductImage {
-                product_version: "3.4.0".to_owned(),
-                app_version_label_value: LabelValue::from_str("3.4.0-stackable0.0.0-dev")
+                product_version: "3.6.0".to_owned(),
+                app_version_label_value: LabelValue::from_str("3.6.0-stackable0.0.0-dev")
                     .expect("should be a valid label value"),
-                image: "oci.stackable.tech/sdp/opensearch:3.4.0-stackable0.0.0-dev".to_string(),
+                image: "oci.stackable.tech/sdp/opensearch:3.6.0-stackable0.0.0-dev".to_string(),
                 image_pull_policy: "Always".to_owned(),
                 pull_secrets: None,
             },
-            ProductVersion::from_str_unsafe("3.4.0"),
+            ProductVersion::from_str_unsafe("3.6.0"),
             ClusterName::from_str_unsafe("my-opensearch"),
             NamespaceName::from_str_unsafe("default"),
             uuid!("e6ac237d-a6d4-43a1-8135-f36506110912"),

rust/operator-binary/src/controller/build/node_config.rs

@@ -74,7 +74,7 @@ const CONFIG_OPTION_NODE_ROLES: &str = "node.roles";
 
 /// Defines the path for the logs
 /// OpenSearch grants the required access rights, see
-/// <https://github.com/opensearch-project/OpenSearch/blob/3.4.0/server/src/main/java/org/opensearch/bootstrap/Security.java#L369>
+/// <https://github.com/opensearch-project/OpenSearch/blob/3.6.0/server/src/main/java/org/opensearch/bootstrap/Security.java#L371>
 /// The permissions "write" and "delete" are required for the log file rollover.
 /// Type: string
 const CONFIG_OPTION_PATH_LOGS: &str = "path.logs";
@@ -386,7 +386,7 @@ impl NodeConfig {
     /// Please read the following sections for an explanation of these restrictions.
     ///
     /// This configuration setting replaces the setting `cluster.initial_master_nodes`, see
-    /// <https://github.com/opensearch-project/OpenSearch/blob/3.4.0/server/src/main/java/org/opensearch/cluster/coordination/ClusterBootstrapService.java#L79-L93>.
+    /// <https://github.com/opensearch-project/OpenSearch/blob/3.6.0/server/src/main/java/org/opensearch/cluster/coordination/ClusterBootstrapService.java#L79-L93>.
     ///
     /// This setting is required on nodes with the cluster-manager node role on a multi-node
     /// cluster. Otherwise the bootstrapping of the cluster fails and all pods report:
@@ -396,7 +396,7 @@ impl NodeConfig {
     /// error is thrown:
     ///  > setting [cluster.initial_cluster_manager_nodes] is not allowed when [discovery.type] is set to [single-node]
     ///
-    /// see <https://github.com/opensearch-project/OpenSearch/blob/3.4.0/server/src/main/java/org/opensearch/cluster/coordination/ClusterBootstrapService.java#L126-L136>
+    /// see <https://github.com/opensearch-project/OpenSearch/blob/3.6.0/server/src/main/java/org/opensearch/cluster/coordination/ClusterBootstrapService.java#L126-L136>
     ///
     /// This setting does not seem to have an effect on nodes without the cluster-manager node
     /// role. However, as it is recommended (see the Elasticsearch documentation below) to not set
@@ -549,7 +549,7 @@ mod tests {
     }
 
     fn node_config(test_config: TestConfig) -> NodeConfig {
-        let image: ProductImage = serde_json::from_str(r#"{"productVersion": "3.4.0"}"#)
+        let image: ProductImage = serde_json::from_str(r#"{"productVersion": "3.6.0"}"#)
             .expect("should be a valid ProductImage");
 
         let role_group_name = RoleGroupName::from_str_unsafe("data");
@@ -618,10 +618,10 @@ mod tests {
 
         let cluster = ValidatedCluster::new(
             ResolvedProductImage {
-                product_version: "3.4.0".to_owned(),
-                app_version_label_value: LabelValue::from_str("3.4.0-stackable0.0.0-dev")
+                product_version: "3.6.0".to_owned(),
+                app_version_label_value: LabelValue::from_str("3.6.0-stackable0.0.0-dev")
                     .expect("should be a valid label value"),
-                image: "oci.stackable.tech/sdp/opensearch:3.4.0-stackable0.0.0-dev".to_string(),
+                image: "oci.stackable.tech/sdp/opensearch:3.6.0-stackable0.0.0-dev".to_string(),
                 image_pull_policy: "Always".to_owned(),
                 pull_secrets: None,
             },

rust/operator-binary/src/controller/build/product_logging/config.rs

@@ -92,7 +92,7 @@ fn log4j2_console_appender_config(
             "PatternLayout".to_owned(),
         ),
         // Same as the default layout pattern of the console appender
-        // see https://github.com/opensearch-project/OpenSearch/blob/3.4.0/distribution/src/config/log4j2.properties#L17
+        // see https://github.com/opensearch-project/OpenSearch/blob/3.6.0/distribution/src/config/log4j2.properties#L17
         (
             "appender.CONSOLE.layout.pattern".to_owned(),
             "[%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n".to_owned(),