From 0880f4fffe195fd420df291731bf73d3ec39cd0e Mon Sep 17 00:00:00 2001
From: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com>
Date: Fri, 4 Apr 2025 14:13:21 +0200
Subject: [PATCH 1/2] add docs for opensearch, default to single-node install

Signed-off-by: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com>
---
 functions/kubernetes/charts/shuffle/README.md   | 10 +++++++++-
 functions/kubernetes/charts/shuffle/values.yaml | 15 +++++++++++++++
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/functions/kubernetes/charts/shuffle/README.md b/functions/kubernetes/charts/shuffle/README.md
index e2025f94..76150c48 100644
--- a/functions/kubernetes/charts/shuffle/README.md
+++ b/functions/kubernetes/charts/shuffle/README.md
@@ -105,6 +105,15 @@ SHUFFLE_DEFAULT_APIKEY: "72E41083-A6F6-4A1B-8538-B06B577F47F0" # Shuffle uses uu
 SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier"
 ```
 
+## OpenSearch
+
+Shuffle uses OpenSearch as its database. This helm chart installs a single-node OpenSearch cluster using [the Bitnami Helm Chart](https://github.com/bitnami/charts/blob/main/bitnami/opensearch/values.yaml).
+You can customize the helm chart using the values of the Bitnami helm chart under the `opensearch` prefix (e.g. `opensearch.master.replicaCOunt`).
+
+Alternatively, you can disable the built-in OpenSearch installation using `opensearch.enabled=false`.
+Provide your own OpenSearch url and username with `backend.openSearch.url` and `backend.openSearch.username`.
+The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env variable to the backend.
+
 ## Parameters
 
 ### Global parameters
@@ -598,4 +607,3 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier"
 
 ### Other Parameters
 
-
diff --git a/functions/kubernetes/charts/shuffle/values.yaml b/functions/kubernetes/charts/shuffle/values.yaml
index 23c5f8ea..507c2468 100644
--- a/functions/kubernetes/charts/shuffle/values.yaml
+++ b/functions/kubernetes/charts/shuffle/values.yaml
@@ -1744,9 +1744,24 @@ volumePermissions:
 ## OpenSearch chart configuration
 ## ref: https://github.com/bitnami/charts/blob/main/bitnami/opensearch/values.yaml
 ## @param opensearch.enabled Switch to enable or disable the opensearch helm chart
+## @skip opensearch.master
+## @skip opensearch.data
+## @skip opensearch.coordinating
+## @skip opensearch.ingest
+## @skip opensearch.dashboards
 ##
 opensearch:
   enabled: true
+  master:
+    replicaCount: 1
+  data:
+    replicaCount: 1
+  coordinating:
+    replicaCount: 1
+  ingest:
+    replicaCount: 1
+  dashboards:
+    enabled: true
 
 ## @section Vault Parameters
 ##

From 0119c7cb56738183748bac4444944f7f39e0a0fa Mon Sep 17 00:00:00 2001
From: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com>
Date: Fri, 4 Apr 2025 14:13:38 +0200
Subject: [PATCH 2/2] allow apps to access worker

Signed-off-by: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com>
---
 .../shuffle-worker/shuffle-worker-network-policy.yaml       | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-network-policy.yaml b/functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-network-policy.yaml
index 1b07d9a9..0ad96ada 100644
--- a/functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-network-policy.yaml
+++ b/functions/kubernetes/charts/shuffle/templates/shuffle-worker/shuffle-worker-network-policy.yaml
@@ -62,6 +62,12 @@ spec:
               kubernetes.io/metadata.name: {{ .Release.Namespace }}
           podSelector:
             matchLabels: {{ include "shuffle.orborus.matchLabels" . | nindent 14 }}
+        # Allow traffic from apps
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: {{ .Release.Namespace }}
+          podSelector:
+            matchLabels: {{ include "shuffle.app.matchLabels" . | nindent 14 }}
       {{- end }}
     {{- if .Values.worker.networkPolicy.extraIngress }}
     {{- include "common.tplvalues.render" ( dict "value" .Values.worker.networkPolicy.extraIngress "context" $ ) | nindent 4 }}