[bitnami/opensearch] Release 3.6.0-debian-12-r6 (#94013)

Signed-off-by: Bitnami Bot <bitnami.bot@broadcom.com>
2026-08-09 13:04:38 +08:00 · 2026-05-27 11:05:49 +02:00
parent 819c97c087
commit f639f63cfb
15 changed files with 136 additions and 67 deletions
@@ -9,7 +9,7 @@ ARG OPENSEARCH_PLUGINS
 ARG TARGETARCH

 LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bookworm" \
-      org.opencontainers.image.created="2026-05-23T10:10:30Z" \
+      org.opencontainers.image.created="2026-05-27T07:15:47Z" \
      org.opencontainers.image.description="Application packaged by Broadcom, Inc." \
      org.opencontainers.image.documentation="https://github.com/bitnami/containers/tree/main/bitnami/opensearch/README.md" \
      org.opencontainers.image.source="https://github.com/bitnami/containers/tree/main/bitnami/opensearch" \
@@ -38,12 +38,12 @@ RUN --mount=type=secret,id=downloads_url,env=SECRET_DOWNLOADS_URL \
    for COMPONENT in "${COMPONENTS[@]}"; do \
      if [ ! -f "${COMPONENT}.tar.gz" ]; then \
        curl -SsLf "https://${DOWNLOADS_URL}/${COMPONENT}.tar.gz" -O ; \
-        curl -SsLf "https://${DOWNLOADS_URL}/${COMPONENT}.tar.gz.sha256" -O ; \
      fi ; \
-      sha256sum -c "${COMPONENT}.tar.gz.sha256" ; \
+      sha256sum -c "/opt/bitnami/checksums/${COMPONENT}.tar.gz.sha256" ; \
      tar -zxf "${COMPONENT}.tar.gz" -C /opt/bitnami --strip-components=2 --no-same-owner ; \
-      rm -rf "${COMPONENT}".tar.gz{,.sha256} ; \
-    done
+      rm -rf "${COMPONENT}".tar.gz ; \
+    done ; \
+    rm -rf /opt/bitnami/checksums ;
 RUN apt-get update && apt-get upgrade -y && \
    apt-get clean && rm -rf /var/lib/apt/lists /var/cache/apt/archives
 RUN chmod g+rwX /opt/bitnami
@@ -54,7 +54,7 @@ RUN /opt/bitnami/scripts/opensearch/postunpack.sh
 RUN /opt/bitnami/scripts/java/postunpack.sh
 ENV APP_VERSION="3.6.0" \
    BITNAMI_APP_NAME="opensearch" \
-    IMAGE_REVISION="5" \
+    IMAGE_REVISION="6" \
    JAVA_HOME="/opt/bitnami/java" \
    LD_LIBRARY_PATH="/opt/bitnami/opensearch/plugins/opensearch-knn/lib:$LD_LIBRARY_PATH" \
    OPENSEARCH_JAVA_HOME="/opt/bitnami/java"
@@ -0,0 +1 @@
+190f3814d0362c10bc2373945a5fe00ff46aa2980ac2224528a32c7766a2b72d  jre-21.0.11-11-1-linux-amd64-debian-12.tar.gz
@@ -0,0 +1 @@
+08f71653cfeafd8e168835acfa95678ad52649c0b8c3512d285cedead2ea0a62  jre-21.0.11-11-1-linux-arm64-debian-12.tar.gz
@@ -0,0 +1 @@
+ce2396d7413e5284206c7e2fe252a6730405ffe4756bd83c46d418d53d1176ad  opensearch-3.6.0-0-linux-amd64-debian-12.tar.gz
@@ -0,0 +1 @@
+c1f7cd521f2be1d9be4fd736dc66e59d06f3c686b28d228bc40cc303065ceb1c  opensearch-3.6.0-0-linux-arm64-debian-12.tar.gz
@@ -0,0 +1 @@
+b7241b4121e1304b74a5e04db2d4e8d1db6aca71a65987d8c79836e5235cb927  yq-4.53.2-1-linux-amd64-debian-12.tar.gz
@@ -0,0 +1 @@
+ba312982d2ba0a320c116b4db0e0ef2518813be9a948a29bc9c3e05951049da9  yq-4.53.2-1-linux-arm64-debian-12.tar.gz
@@ -139,3 +139,40 @@ wait_for_log_entry() {
        return 1
    fi
 }
+
+########################
+# Creates a secure temporary file containing the provided secret
+# Arguments:
+#   $1 - secret to write to the temporary file
+# Returns:
+#   String
+#########################
+credential_to_temp_file() {
+    local secret="$1"
+    local tmp_file
+
+    # Use mktemp with a specific prefix for easier debugging if something lingers
+    if ! tmp_file=$(mktemp "${TMPDIR:-/tmp}/at.cred.XXXXXXXX"); then
+        echo "Error: Failed to create temp file" >&2
+        return 1
+    fi
+
+    # Restrict permissions before writing the secret
+    chmod 0600 "$tmp_file"
+    # Write secret and ensure it's flushed to disk
+    printf "%s" "$secret" > "$tmp_file"
+    # Output the filename so the caller can capture it
+    echo "$tmp_file"
+}
+
+########################
+# Cleans up temporary files created by credential_to_temp_file
+# Arguments:
+#   None
+# Returns:
+#   None
+#########################
+cleanup_credentials() {
+    debug "Cleaning up temporary files containing credentials"
+    rm -rf "${TMPDIR:-/tmp}"/at.cred.*
+}
@@ -2,7 +2,7 @@
 # Copyright Broadcom, Inc. All Rights Reserved.
 # SPDX-License-Identifier: APACHE-2.0
 #
-# Bitnami Opensearch library
+# Bitnami OpenSearch library

 # shellcheck disable=SC1090,SC1091

@@ -16,10 +16,10 @@
 . /opt/bitnami/scripts/libservice.sh
 . /opt/bitnami/scripts/libvalidations.sh

-# Opensearch Functions
+# OpenSearch Functions

 ########################
-# Bootstrap Opensearch Security by running the securityadmin.sh tool
+# Bootstrap OpenSearch Security by running the securityadmin.sh tool
 # Globals:
 #   DB_*
 #   OPENSEARCH_SECURITY_*
@@ -30,18 +30,23 @@
 #########################
 opensearch_security_bootstrap() {
    local failure=0
-    local cmd=("${OPENSEARCH_SECURITY_DIR}/tools/securityadmin.sh" "-nhnv")
-
-    cmd+=("-cd" "$OPENSEARCH_SECURITY_CONF_DIR")
-    cmd+=("-cn" "$DB_CLUSTER_NAME")
-    cmd+=("-h" "$(get_elasticsearch_hostname)")
-    cmd+=("-cacert" "$DB_CA_CERT_LOCATION")
-    cmd+=("-cert" "$OPENSEARCH_SECURITY_ADMIN_CERT_LOCATION")
-    cmd+=("-key" "$OPENSEARCH_SECURITY_ADMIN_KEY_LOCATION")
+    local cmd=(
+        "${OPENSEARCH_SECURITY_DIR}/tools/securityadmin.sh"
+        "-cd" "$OPENSEARCH_SECURITY_CONF_DIR"
+        "-cn" "$DB_CLUSTER_NAME"
+        # We want to use 127.0.0.1 to avoid being exposed to a potential DNS/ARP interception attack
+        "-h" "127.0.0.1"
+        "-cacert" "$DB_CA_CERT_LOCATION"
+        "-cert" "$OPENSEARCH_SECURITY_ADMIN_CERT_LOCATION"
+        "-key" "$OPENSEARCH_SECURITY_ADMIN_KEY_LOCATION"
+    )
+    # Given we're using 127.0.0.1, we need to suppress hostname verification
+    # when DB_TLS_VERIFICATION_MODE is full (default) to avoid a bootstrap failure
+    [[ "${DB_TLS_VERIFICATION_MODE:-full}" != "full" ]] && cmd+=("-nhnv")

    elasticsearch_start

-    info "Running Opensearch Admin tool..."
+    info "Running OpenSearch Admin tool..."
    "${cmd[@]}" || failure=$?
    elasticsearch_stop

@@ -66,9 +71,9 @@ opensearch_security_internal_user_set() {
    read -r -a attributes <<<"$(tr ',;' ' ' <<<"${5:-}")"
    local description="${6:-}"

-    local hash
-
-    hash=$("${OPENSEARCH_SECURITY_DIR}/tools/hash.sh" -p "$password" | sed '/^\*\*/d')
+    local hash password_file
+    password_file="$(credential_to_temp_file "$password")"
+    hash=$("${OPENSEARCH_SECURITY_DIR}/tools/hash.sh" -p "$(<"$password_file")" | sed '/^\*\*/d')
    yq -i eval ".$username.hash = \"$hash\"" "${OPENSEARCH_SECURITY_CONF_DIR}/internal_users.yml"

    if [[ -n "${backend_roles[*]:-}" ]]; then
@@ -88,7 +93,7 @@ opensearch_security_internal_user_set() {
 }

 ########################
-# Configure Opensearch Security built-in users and passwords
+# Configure OpenSearch Security built-in users and passwords
 # Globals:
 #   ELASTICSEARCH_*
 #   OPENSEARCH_SECURITY_*
@@ -98,11 +103,11 @@ opensearch_security_internal_user_set() {
 #   None
 #########################
 opensearch_security_configure_users() {
-    info "Configuring Opensearch security users and roles..."
+    info "Configuring OpenSearch security users and roles..."
    # Execute permission for configuration binaries
    chmod +x "${OPENSEARCH_SECURITY_DIR}/tools/hash.sh"
    chmod +x "${OPENSEARCH_SECURITY_DIR}/tools/securityadmin.sh"
-    # Opensearch security configuration
+    # OpenSearch security configuration
    if [ ! -f "${OPENSEARCH_SECURITY_DIR}/internal_users.yml" ]; then
        # Delete content of the demo file
        echo "" > "${OPENSEARCH_SECURITY_CONF_DIR}/internal_users.yml"
@@ -118,7 +123,7 @@ opensearch_security_configure_users() {
 }

 ########################
-# Configure Opensearch TLS settings
+# Configure OpenSearch TLS settings
 # Globals:
 #   DB_*
 # Arguments:
@@ -127,9 +132,11 @@ opensearch_security_configure_users() {
 #   None
 #########################
 opensearch_transport_tls_configuration(){
-    info "Configuring Opensearch Transport TLS settings..."
+    info "Configuring OpenSearch Transport TLS settings..."
    elasticsearch_conf_set plugins.security.ssl.transport.enabled "true"
-    elasticsearch_conf_write plugins.security.ssl.transport.enforce_hostname_verification "$DB_TLS_VERIFICATION_MODE" bool
+    local _enforce_hn_verify="false"
+    [[ "$DB_TLS_VERIFICATION_MODE" = "full" ]] && _enforce_hn_verify="true"
+    elasticsearch_conf_write plugins.security.ssl.transport.enforce_hostname_verification "$_enforce_hn_verify" bool

    if is_boolean_yes "$DB_TRANSPORT_TLS_USE_PEM"; then
        debug "Configuring Transport Layer TLS settings using PEM certificates..."
@@ -175,7 +182,7 @@ opensearch_http_tls_configuration(){

 #!/bin/bash
 #
-# Bitnami Elasticsearch/Opensearch common library
+# Bitnami Elasticsearch/OpenSearch common library

 # shellcheck disable=SC1090,SC1091

@@ -224,6 +231,7 @@ elasticsearch_conf_write() {
        ;;
    esac
    cp "$tempfile" "$DB_CONF_FILE"
+    rm "$tempfile"
 }

 ########################
@@ -384,6 +392,11 @@ elasticsearch_validate() {
        error "$1"
        error_code=1
    }
+    check_empty_value() {
+        if is_empty_value "${!1}"; then
+            print_validation_error "${1} must be set"
+        fi
+    }

    validate_node_roles() {
        if [ -n "$DB_NODE_ROLES" ]; then
@@ -406,6 +419,8 @@ elasticsearch_validate() {
        fi
    }

+    # TODO: these are not simple validations, they actually create users and adapt permissions on the filesystem
+    #    so we should move them to a separate function
    debug "Ensuring expected directories/files exist..."
    am_i_root && ensure_user_exists "$DB_DAEMON_USER" --group "$DB_DAEMON_GROUP"
    for dir in "$DB_TMP_DIR" "$DB_LOGS_DIR" "$DB_PLUGINS_DIR" "$DB_BASE_DIR/modules" "$DB_CONF_DIR"; do
@@ -422,7 +437,7 @@ elasticsearch_validate() {

    if ! is_boolean_yes "$DB_IS_DEDICATED_NODE"; then
        warn "Setting ${DB_FLAVOR^^}_IS_DEDICATED_NODE is disabled."
-        warn "${DB_FLAVOR^^}_NODE_ROLES will be ignored and ${DB_FLAVOR^} will asume all different roles."
+        warn "${DB_FLAVOR^^}_NODE_ROLES will be ignored and ${DB_FLAVOR^} will assume all different roles."
    else
        validate_node_roles
    fi
@@ -433,17 +448,20 @@ elasticsearch_validate() {

    if is_boolean_yes "$DB_ENABLE_SECURITY"; then
        if [[ "$DB_FLAVOR" = "opensearch" ]]; then
+            # Validate credentials
+            for var in "DB_PASSWORD" "OPENSEARCH_DASHBOARDS_PASSWORD" "LOGSTASH_PASSWORD"; do
+                check_empty_value "$var"
+            done
+            # Validate certificates
            if [[ ! -f "$OPENSEARCH_SECURITY_ADMIN_KEY_LOCATION" ]] || [[ ! -f "$OPENSEARCH_SECURITY_ADMIN_CERT_LOCATION" ]]; then
-                print_validation_error "In order to enable Opensearch Security, you must provide a valid admin PEM key and certificate."
-            fi
-            if is_empty_value "$OPENSEARCH_SECURITY_NODES_DN"; then
-                print_validation_error "The variable OPENSEARCH_SECURITY_NODES_DN is required."
-            fi
-            if is_empty_value "$OPENSEARCH_SECURITY_ADMIN_DN"; then
-                print_validation_error "The variable OPENSEARCH_SECURITY_ADMIN_DN is required."
+                print_validation_error "In order to enable OpenSearch Security, you must provide a valid admin PEM key and certificate."
            fi
+            # Validate DNs
+            for var in "OPENSEARCH_SECURITY_NODES_DN" "OPENSEARCH_SECURITY_ADMIN_DN"; do
+                check_empty_value "$var"
+            done
            if ! is_boolean_yes "$OPENSEARCH_ENABLE_REST_TLS"; then
-                print_validation_error "Opensearch does not support plaintext conections (HTTP) when Security is enabled."
+                print_validation_error "OpenSearch does not support plaintext connections (HTTP) when Security is enabled."
            fi
        fi
        if ! is_boolean_yes "$DB_SKIP_TRANSPORT_TLS"; then
@@ -586,6 +604,7 @@ elasticsearch_custom_configuration() {
    info "Adding custom configuration"
    yq eval-all 'select(fileIndex == 0) * select(fileIndex == 1)' "$DB_CONF_FILE" "$custom_conf_file" >"$tempfile"
    cp "$tempfile" "$DB_CONF_FILE"
+    rm "$tempfile"
 }

 ########################
@@ -689,7 +708,7 @@ EOF
 }

 ########################
-# Configure/initialize Elasticsearch/Opensearch
+# Configure/initialize Elasticsearch/OpenSearch
 # Globals:
 #   DB_*
 # Arguments:
@@ -934,21 +953,20 @@ elasticsearch_configure_logging() {
 }

 ########################
-# Check Elasticsearch/Opensearch health
+# Check Elasticsearch/OpenSearch health
 # Globals:
 #   DB_*
 # Arguments:
 #   None
 # Returns:
-#   0 when healthy (or waiting for Opensearch security bootstrap)
+#   0 when healthy (or waiting for OpenSearch security bootstrap)
 #   1 when unhealthy
 #########################
 elasticsearch_healthcheck() {
    info "Checking ${DB_FLAVOR^} health..."
-    local -r cmd="curl"
-    local command_args=("--silent" "--write-out" "%{http_code}")
+    local curl_args=("--silent" "--write-out" "%{http_code}")
    local protocol="http"
-    local host
+    local host output return_code

    host=$(get_elasticsearch_hostname)
    if validate_ipv6 "$host"; then
@@ -956,21 +974,27 @@ elasticsearch_healthcheck() {
    fi

    if is_boolean_yes "$DB_ENABLE_SECURITY"; then
-        command_args+=("-k" "--user" "${DB_USERNAME}:${DB_PASSWORD}")
-        is_boolean_yes "$DB_ENABLE_REST_TLS" && protocol="https"
+        # Avoid passing credentials as arguments to curl, to avoid leaking them given a local observer with /proc read access can read them
+        local user_file
+        user_file="$(credential_to_temp_file "${DB_USERNAME}:${DB_PASSWORD}")"
+        curl_args+=("--user" "$(<"$user_file")")
+        if is_boolean_yes "$DB_ENABLE_REST_TLS"; then
+            # TODO: use the CA certificate to verify the server certificate
+            # Currently it's not trivial given keystores / truststores are mounted
+            curl_args+=("-k")
+        fi
    fi

    # Combination of --silent, --output and --write-out allows us to obtain both the status code and the request body
    output=$(mktemp)
-    command_args+=("-o" "$output" "${protocol}://${host}:${DB_HTTP_PORT_NUMBER}/_cluster/health?local=true")
-    HTTP_CODE=$("$cmd" "${command_args[@]}")
+    curl_args+=("-o" "$output" "${protocol}://${host}:${DB_HTTP_PORT_NUMBER}/_cluster/health?local=true")
+    HTTP_CODE=$(curl "${curl_args[@]}") || true
+    return_code=1
    if [[ ${HTTP_CODE} -ge 200 && ${HTTP_CODE} -le 299 ]] || ([[ "$DB_FLAVOR" = "opensearch" ]] && [[ ${HTTP_CODE} -eq 503 ]] && grep -q "OpenSearch Security not initialized" "$output" ); then
-        rm "$output"
-        return 0
-    else
-        rm "$output"
-        return 1
+        return_code=0
    fi
+    rm "$output"
+    return "$return_code"
 }

 ########################
@@ -197,7 +197,7 @@ export DB_ACTION_DESTRUCTIVE_REQUIRES_NAME="$OPENSEARCH_ACTION_DESTRUCTIVE_REQUI
 # Opensearch Security configuration
 export OPENSEARCH_ENABLE_SECURITY="${OPENSEARCH_ENABLE_SECURITY:-false}"
 export DB_ENABLE_SECURITY="$OPENSEARCH_ENABLE_SECURITY"
-export OPENSEARCH_PASSWORD="${OPENSEARCH_PASSWORD:-bitnami}"
+export OPENSEARCH_PASSWORD="${OPENSEARCH_PASSWORD:-}"
 export DB_PASSWORD="$OPENSEARCH_PASSWORD"
 export OPENSEARCH_USERNAME="admin"
 export DB_USERNAME="$OPENSEARCH_USERNAME"
@@ -264,8 +264,8 @@ export DB_HTTP_TLS_CA_CERT_LOCATION="$OPENSEARCH_HTTP_TLS_CA_CERT_LOCATION"
 export OPENSEARCH_SECURITY_DIR="${OPENSEARCH_SECURITY_DIR:-${DB_PLUGINS_DIR}/opensearch-security}"
 export OPENSEARCH_SECURITY_CONF_DIR="${OPENSEARCH_SECURITY_CONF_DIR:-${DB_CONF_DIR}/opensearch-security}"
 OPENSEARCH_DASHBOARDS_PASSWORD="${OPENSEARCH_DASHBOARDS_PASSWORD:-"${KIBANA_PASSWORD:-}"}"
-export OPENSEARCH_DASHBOARDS_PASSWORD="${OPENSEARCH_DASHBOARDS_PASSWORD:-bitnami}"
-export LOGSTASH_PASSWORD="${LOGSTASH_PASSWORD:-bitnami}"
+export OPENSEARCH_DASHBOARDS_PASSWORD="${OPENSEARCH_DASHBOARDS_PASSWORD:-}"
+export LOGSTASH_PASSWORD="${LOGSTASH_PASSWORD:-}"
 export OPENSEARCH_SET_CGROUP="${OPENSEARCH_SET_CGROUP:-true}"
 export OPENSEARCH_SECURITY_BOOTSTRAP="${OPENSEARCH_SECURITY_BOOTSTRAP:-false}"
 export OPENSEARCH_SECURITY_NODES_DN="${OPENSEARCH_SECURITY_NODES_DN:-}"
@@ -25,9 +25,9 @@ debug "Copying files from $DB_DEFAULT_CONF_DIR to $DB_CONF_DIR"
 cp -nr "$DB_DEFAULT_CONF_DIR"/. "$DB_CONF_DIR"

 if [[ "$1" = "/opt/bitnami/scripts/opensearch/run.sh" ]]; then
-    info "** Starting Opensearch setup **"
+    info "** Starting OpenSearch setup **"
    /opt/bitnami/scripts/opensearch/setup.sh
-    info "** Opensearch setup finished! **"
+    info "** OpenSearch setup finished! **"
 fi

 echo ""
@@ -12,7 +12,9 @@ set -o pipefail
 # Load libraries
 . /opt/bitnami/scripts/libopensearch.sh

-# Load Opensearch environment variables
+# Load OpenSearch environment variables
 . /opt/bitnami/scripts/opensearch-env.sh

+# Ensure we clean up temporary files when this script ends
+trap "cleanup_credentials" EXIT
 elasticsearch_healthcheck
@@ -32,7 +32,7 @@ fi

 ARGS+=("$@")

-info "** Starting Opensearch **"
+info "** Starting OpenSearch **"
 if am_i_root; then
    exec_as_user "$DB_DAEMON_USER" "$EXEC" "${ARGS[@]}"
 else
@@ -17,17 +17,17 @@ set -o pipefail
 # Load environment
 . /opt/bitnami/scripts/opensearch-env.sh

-# Ensure Opensearch environment variables settings are valid
+# Ensure OpenSearch environment variables settings are valid
 elasticsearch_validate
-# Ensure Opensearch is stopped when this script ends
-trap "elasticsearch_stop" EXIT
+# Ensure OpenSearch is stopped when this script ends and we clean up temporary files
+trap "elasticsearch_stop; cleanup_credentials" EXIT
 # Ensure 'daemon' user exists when running as 'root'
 am_i_root && ensure_user_exists "$DB_DAEMON_USER" --group "$DB_DAEMON_GROUP"
-# Ensure Opensearch is initialized
+# Ensure OpenSearch is initialized
 elasticsearch_initialize
 # Ensure kernel settings are valid
 elasticsearch_validate_kernel
-# Install Opensearch plugins
+# Install OpenSearch plugins
 elasticsearch_install_plugins
 # Ensure custom initialization scripts are executed
 elasticsearch_custom_init_scripts
@@ -104,7 +104,7 @@ The following tables list the main variables you can set.
 | `OPENSEARCH_HTTP_PORT_NUMBER`                  | Opensearch port                                                                                                     | `9200`                                      |
 | `OPENSEARCH_ACTION_DESTRUCTIVE_REQUIRES_NAME`  | Enable action destructive requires name                                                                             | `nil`                                       |
 | `OPENSEARCH_ENABLE_SECURITY`                   | Enable Opensearch security settings.                                                                                | `false`                                     |
-| `OPENSEARCH_PASSWORD`                          | Password for "admin" user.                                                                                          | `bitnami`                                   |
+| `OPENSEARCH_PASSWORD`                          | Password for "admin" user.                                                                                          | `nil`                                       |
 | `OPENSEARCH_TLS_VERIFICATION_MODE`             | Opensearch TLS verification mode in transport layer.                                                                | `full`                                      |
 | `OPENSEARCH_TLS_USE_PEM`                       | Configure Security settings using PEM certificates.                                                                 | `false`                                     |
 | `OPENSEARCH_KEYSTORE_PASSWORD`                 | Password for the Opensearch keystore containing the certificates or password-protected PEM key.                     | `nil`                                       |
@@ -137,8 +137,8 @@ The following tables list the main variables you can set.
 | `OPENSEARCH_HTTP_TLS_CA_CERT_LOCATION`         | Path to CA certificate for HTTP TLS.                                                                                | `$DB_CA_CERT_LOCATION`                      |
 | `OPENSEARCH_SECURITY_DIR`                      | Root directory of the Opensearch Security plugin.                                                                   | `${DB_PLUGINS_DIR}/opensearch-security`     |
 | `OPENSEARCH_SECURITY_CONF_DIR`                 | Configuration directory of the Opensearch Security plugin.                                                          | `${DB_CONF_DIR}/opensearch-security`        |
-| `OPENSEARCH_DASHBOARDS_PASSWORD`               | Password for the Opensearch-dashboards user.                                                                        | `bitnami`                                   |
-| `LOGSTASH_PASSWORD`                            | Password for the Logstash user.                                                                                     | `bitnami`                                   |
+| `OPENSEARCH_DASHBOARDS_PASSWORD`               | Password for the Opensearch-dashboards user.                                                                        | `nil`                                       |
+| `LOGSTASH_PASSWORD`                            | Password for the Logstash user.                                                                                     | `nil`                                       |
 | `OPENSEARCH_SET_CGROUP`                        | Configure Opensearch java opts with cgroup hierarchy override, so cgroup statistics are available in the container. | `true`                                      |
 | `OPENSEARCH_SECURITY_BOOTSTRAP`                | If set to true, this node will be configured with instructions to bootstrap the Opensearch security config.         | `false`                                     |
 | `OPENSEARCH_SECURITY_NODES_DN`                 | Comma-separated list including the Opensearch nodes allowed TLS DNs.                                                | `nil`                                       |
				`@@ -0,0 +1 @@`
				`190f3814d0362c10bc2373945a5fe00ff46aa2980ac2224528a32c7766a2b72d jre-21.0.11-11-1-linux-amd64-debian-12.tar.gz`
				`@@ -0,0 +1 @@`
				`08f71653cfeafd8e168835acfa95678ad52649c0b8c3512d285cedead2ea0a62 jre-21.0.11-11-1-linux-arm64-debian-12.tar.gz`
				`@@ -0,0 +1 @@`
				`ce2396d7413e5284206c7e2fe252a6730405ffe4756bd83c46d418d53d1176ad opensearch-3.6.0-0-linux-amd64-debian-12.tar.gz`
				`@@ -0,0 +1 @@`
				`c1f7cd521f2be1d9be4fd736dc66e59d06f3c686b28d228bc40cc303065ceb1c opensearch-3.6.0-0-linux-arm64-debian-12.tar.gz`
				`@@ -0,0 +1 @@`
				`b7241b4121e1304b74a5e04db2d4e8d1db6aca71a65987d8c79836e5235cb927 yq-4.53.2-1-linux-amd64-debian-12.tar.gz`
				`@@ -0,0 +1 @@`
				`ba312982d2ba0a320c116b4db0e0ef2518813be9a948a29bc9c3e05951049da9 yq-4.53.2-1-linux-arm64-debian-12.tar.gz`