Stackable Operator for OpenSearch
OpenSearch on the
Stackable Data Platform
Run OpenSearch natively on Kubernetes
Search, observability and analytics all in one
Logs, metrics, product catalogs, security events – the moment you need to find something fast across all of it, you need a search engine that scales. The Stackable Operator brings Kubernetes-native deployment to OpenSearch, the open-source search and analytics engine built on Apache Lucene. Node groups, versioning, scaling and high availability – all managed declaratively via CRDs. Run it on-prem, air-gapped or in a sovereign cloud – your data stays yours.
Why OpenSearch in the Stackable Data Platform (SDP)?
OpenSearch brings full-text search, real-time indexing and advanced analytics directly to your existing data landscape. Instead of forcing yet another data silo, it indexes the relevant parts of your source systems while the original data stays the single source of truth – so indexes can always be rebuilt from the systems underneath.
Enterprise-grade search & analytics
An open-source engine on Apache Lucene – full-text search, structured queries, aggregation and real-time insight.
Rich, integrated capabilities
Beyond search, OpenSearch brings vector search, anomaly detection, observability and security analytics together in one platform – a natural foundation for AI-driven retrieval.
Scalable & performant
Designed for massive volumes of unstructured data, with high throughput, low latency and horizontal scaling.
Broad observability coverage
Integrated support for log analysis, performance monitoring, and threat detection makes OpenSearch ideally suited for monitoring and security analytics.
Open architecture & modular tooling
Components like Data Prepper (ingestion and transformation) and the Vector Engine (for AI/ML use) support end-to-end data workflows.
Open & community-driven
Licensed under Apache 2.0 and governed by a foundation with a broad community behind it.
What does the Stackable Operator add for OpenSearch?
Role-based node pools
Run dedicated role groups (cluster_manager, data, ingest, coordinating_only, search, warm), each scaled and tuned independently, keeping indexing, querying and analytics workloads from competing for the same resources.
Vector search and ML built in
The Stackable image ships with the k-NN and ML plugins. Vector and semantic search, the retrieval layer behind AI use cases, is there without adding plugins yourself.
Run many clusters side by side
Define several OpenSearchCluster resources in one environment, each managed independently, to isolate dev, staging and production or separate tenants.
What do all Stackable operators have in common?
One operator framework (Rust)
Every operator follows the same CRD pattern with Roles, RoleGroups and ConfigOverrides. Learn one operator, and you find your way around the next one instantly.
Infrastructure-as-Code
Every data app is a YAML CRD that lives in Git – reviewable, lintable and CI/CD-ready. The same definition works on Dev, Test and Prod.
Lifecycle management (Day-2 operations)
Deployment, restarts, certificate rotation and rolling upgrades are handled automatically – including pod restarts when configs or secrets change. And because you need to see what’s running, monitoring and logging come built in: Prometheus, Vector and OpenTelemetry feed ready-made Grafana dashboards – one observability setup for the whole platform.
Security by default:
TLS, Kerberos for HDFS, OIDC login and OPA-based fine-grained authorization, all configurable per CRD. Daily vulnerability scans, SBOMs and cosign-signed images keep the whole platform patched – so you don’t track a dozen upstream projects yourself.
Kubernetes-native and modular
Runs on-prem, in any cloud or on a laptop, with no vendor lock-in – and explicit air-gapped support. Install only the operators you need, and add more later without touching the rest.
OpenShift-certified
All operators are Red Hat–certified and install directly from the Red Hat Certified Operators Catalog (OperatorHub) – compatible with Security Context Constraints and RBAC. Certified operation via a Stackable subscription.
Use Cases for OpenSearch
Log management & observability
Billions of log entries from apps, infrastructure and security systems, indexed in real time – for monitoring system state, spotting issues fast and staying compliant. Stackable automates cluster management, even at enterprise scale.
Security analytics & threat detection
Security teams analyze event streams from firewalls, servers and networks, correlating patterns to surface anomalies and threats – on clusters that stay highly available and easy to expand as data grows.
Search-driven customer experience
Fast, relevant product search built on OpenSearch. Indexing catalogs and user behavior improves conversion and personalization.
FAQ - Frequently Asked Questions about OpenSearch and Stackable
We recommend installing with stackablectl, our command-line tool that sets up the Stackable operators and their dependencies in one step; Helm charts are also available. Be sure to include the Commons, Secret and Listener operators – these are required and provide shared services such as configuration handling, secret management and service discovery. On OpenShift, the operator can be installed via the Red Hat Certified Operators Catalog.
The operator tracks current OpenSearch LTS releases along with other upstream versions; the supported-versions page in the Stackable documentation always lists what’s current. Select a version via the image in your OpenSearchCluster, or reference your own container image if you need a custom build.
Current list
No. The operator focuses on the OpenSearch search engine. OpenSearch Dashboards – the separate web UI for visualization – must be run independently.
You can scale each node group (for example cluster_manager, data, ingest, coordinating_only, search, warm) independently. Scaling down requires manual steps to safely move shards before removing nodes.
No. When you remove nodes, the operator does not automatically move the shards on them to the remaining nodes. This redistribution must be triggered manually beforehand – via the standard OpenSearch procedures, such as the cluster reroute API – before shrinking the cluster.
The operator supports rolling upgrades: it updates one node at a time so the cluster stays available throughout the process.
Memory and CPU: adjust the resource requests and limits in the CRD, and the operator restarts the affected pods to apply the change without downtime. Disk size: updating the size in the configuration typically does not resize existing persistent volumes (a Kubernetes limitation) – larger volumes must be provisioned manually or via a storage class that supports expansion.
TLS can be enabled end-to-end. Certificates are automatically generated and managed, or you can supply your own CA and certificates.
Yes. TLS can secure both the transport layer (node-to-node) and the client layer (HTTP).
Yes – by using the standard OpenSearch APIs. Shard allocation and zone/rack awareness are features of OpenSearch itself, not of the operator.
Yes. You can define multiple OpenSearchCluster resources in the same Kubernetes environment; the operator manages each cluster independently.
Yes. The operator exposes metrics that can be scraped by Prometheus, making it easy to integrate OpenSearch into your existing Kubernetes monitoring stack.
Yes. The Stackable image ships with the k-NN and ML plugins, so you can run vector and semantic search – the kind of retrieval that powers AI use cases – as well as OpenSearch’s ML features, without adding plugins yourself.
The operator has been tested on major managed and self-hosted Kubernetes platforms: EKS, AKS, GKE, OpenShift, IONOS and K3s. This flexibility lets you deploy OpenSearch reliably across cloud providers or on-premise infrastructure, while still benefiting from declarative management and operator automation.
Resources - Learn how to use the Stackable Operator for OpenSearch
Getting Started & Installation
Step-by-step instructions for installing the required Stackable operators – Commons, Secret, Listener and OpenSearch itself. Includes prerequisites, stackablectl commands and Helm options to get a production-ready OpenSearch cluster running quickly.
Operator Overview & CRD Documentation
A deep dive into the OpenSearchCluster Custom Resource Definition: learn how to declare clusters in YAML, configure node roles and resources, and understand the operator’s reconciliation logic.
GitHub Repository
The official open-source repository for the Stackable OpenSearch Operator, containing source code, Helm charts and example configurations. Ideal for developers and operators who want to explore configurations, contribute or automate deployments.
Demo
The opensearch-rag demo builds a RAG pipeline on OpenSearch’s vector search: k-NN search combined with keyword matching, a locally running LLM (via Ollama) and a JupyterLab notebook that walks through the pipeline step by step – entirely on Kubernetes, no GPU required, deployable with a single stackablectl command.
Subscribe to our Newsletter
With the Stackable newsletter, you’ll always stay up to date on the latest from Stackable!
Newsletter
Subscribe to the newsletter
With the Stackable newsletter you’ll always be up to date when it comes to updates around Stackable!