Adds documentation for security demo configuration setup

_install-and-configure/install-dashboards/debian.md

@@ -129,5 +129,5 @@ By default, OpenSearch Dashboards, like OpenSearch, binds to `localhost` when yo
     sudo systemctl restart opensearch-dashboards
     ```
 1. From a web browser, navigate to OpenSearch Dashboards. The default port is 5601.
-1. Log in with the default username `admin` and the default password `admin`.
+1. Log in with the default username `admin` and the default password `admin`. (For OpenSearch 2.12 and above, the password should be the custom admin password)
 1. Visit [Getting started with OpenSearch Dashboards]({{site.url}}{{site.baseurl}}/dashboards/index/) to learn more.

_install-and-configure/install-dashboards/helm.md

@@ -34,7 +34,7 @@ Before you get started, you must first use [Helm to install OpenSearch]({{site.u
 Make sure that you can send requests to your OpenSearch pod:
 
 ```json
-$ curl -XGET https://localhost:9200 -u 'admin:admin' --insecure
+$ curl -XGET https://localhost:9200 -u 'admin:< Admin password >' --insecure
 {
   "name" : "opensearch-cluster-master-1",
   "cluster_name" : "opensearch-cluster",

_install-and-configure/install-opensearch/debian.md

@@ -45,7 +45,15 @@ This guide assumes that you are comfortable working from the Linux command line
    # arm64
    sudo dpkg -i opensearch-{{site.opensearch_version}}-linux-arm64.deb
    ```
+   For OpenSearch 2.12 and higher, a custom admin password is required to be passed in order to set up security demo configuration. This can be done by following:
+   ```bash
+   # x64
+   sudo env OPENSEARCH_INITIAL_ADMIN_PASSWORD=< Admin password > dpkg -i opensearch-{{site.opensearch_version}}-linux-x64.deb
 
+   # arm64
+   sudo env OPENSEARCH_INITIAL_ADMIN_PASSWORD=< Admin password > dpkg -i opensearch-{{site.opensearch_version}}-linux-arm64.deb
+   ```
+
 1. After the installation succeeds, enable OpenSearch as a service.
     ```bash
     sudo systemctl enable opensearch
@@ -175,7 +183,7 @@ An OpenSearch node in its default configuration (with demo certificates and user
 1. Send requests to the server to verify that OpenSearch is running. Note the use of the `--insecure` flag, which is required because the TLS certificates are self-signed.
    - Send a request to port 9200:
       ```bash
-      curl -X GET https://localhost:9200 -u 'admin:admin' --insecure
+      curl -X GET https://localhost:9200 -u 'admin:< Admin password >' --insecure
       ```
       {% include copy.html %}
 
@@ -201,7 +209,7 @@ An OpenSearch node in its default configuration (with demo certificates and user
       ```
    - Query the plugins endpoint:
     ```bash
-    curl -X GET https://localhost:9200/_cat/plugins?v -u 'admin:admin' --insecure
+    curl -X GET https://localhost:9200/_cat/plugins?v -u 'admin:< Admin password >' --insecure
     ```
     {% include copy.html %}
 

_install-and-configure/install-opensearch/docker.md

@@ -90,9 +90,13 @@ Before continuing, you should verify that Docker is working correctly by deployi
     # This command maps ports 9200 and 9600, sets the discovery type to "single-node" and requests the newest image of OpenSearch
     docker run -d -p 9200:9200 -p 9600:9600 -e "discovery.type=single-node" opensearchproject/opensearch:latest
     ```
+   **Note**: For OpenSearch 2.12 and above, set the initial admin password before installation:
+   ```bash
+    docker run -d -p 9200:9200 -p 9600:9600 -e "discovery.type=single-node" -e "OPENSEARCH_INITIAL_ADMIN_PASSWORD=< Admin password >" opensearchproject/opensearch:latest
+    ```
 1. Send a request to port 9200. The default username and password are `admin`.
     ```bash
-    curl https://localhost:9200 -ku 'admin:admin'
+    curl https://localhost:9200 -ku 'admin:< Admin password >'
     ```
     {% include copy.html %}
 

_install-and-configure/install-opensearch/helm.md

@@ -98,6 +98,14 @@ You can also build the `opensearch-1.0.0.tgz` file manually:
    ```
    {% include copy.html %}
 
+** NOTE **: For OpenSearch 2.12 and above, customize the admin password in `values.yaml` under `extraEnvs`:
+
+```yaml
+extraEnvs:
+  - name: OPENSEARCH_INITIAL_ADMIN_PASSWORD
+    value: <your-strong-password>
+```
+
 #### Sample output
 
   ```yaml

_install-and-configure/install-opensearch/rpm.md

@@ -57,6 +57,20 @@ This guide assumes that you are comfortable working from the Linux command line
    # Install the arm64 package using rpm.
    sudo rpm -ivh opensearch-{{site.opensearch_version}}-linux-x64.rpm
    ```
+   For OpenSearch 2.12 and higher, a custom admin password is required to be passed in order to set up security demo configuration. This can be done by following:
+   ```bash
+    # Install the x64 package using yum.
+   sudo env OPENSEARCH_INITIAL_ADMIN_PASSWORD=< Admin password > yum install opensearch-{{site.opensearch_version}}-linux-x64.rpm
+
+   # Install the x64 package using rpm.
+   sudo env OPENSEARCH_INITIAL_ADMIN_PASSWORD=< Admin password > rpm -ivh opensearch-{{site.opensearch_version}}-linux-x64.rpm
+
+   # Install the arm64 package using yum.
+   sudo env OPENSEARCH_INITIAL_ADMIN_PASSWORD=< Admin password > yum install opensearch-{{site.opensearch_version}}-linux-x64.rpm
+
+   # Install the arm64 package using rpm.
+   sudo env OPENSEARCH_INITIAL_ADMIN_PASSWORD=< Admin password > rpm -ivh opensearch-{{site.opensearch_version}}-linux-x64.rpm
+   ```
 1. After the installation succeeds, enable OpenSearch as a service.
     ```bash
     sudo systemctl enable opensearch
@@ -147,7 +161,7 @@ An OpenSearch node in its default configuration (with demo certificates and user
 1. Send requests to the server to verify that OpenSearch is running. Note the use of the `--insecure` flag, which is required because the TLS certificates are self-signed.
    - Send a request to port 9200:
       ```bash
-      curl -X GET https://localhost:9200 -u 'admin:admin' --insecure
+      curl -X GET https://localhost:9200 -u 'admin:< Admin password >' --insecure
       ```
       {% include copy.html %}
 
@@ -173,7 +187,7 @@ An OpenSearch node in its default configuration (with demo certificates and user
       ```
    - Query the plugins endpoint:
       ```bash
-      curl -X GET https://localhost:9200/_cat/plugins?v -u 'admin:admin' --insecure
+      curl -X GET https://localhost:9200/_cat/plugins?v -u 'admin:< Admin password >' --insecure
       ```
       {% include copy.html %}
 

_install-and-configure/install-opensearch/tar.md

@@ -100,10 +100,16 @@ An OpenSearch node configured by the demo security script is not suitable for a
    ```
    {% include copy.html %}
 
+   **Note**: For OpenSearch 2.12 and above, set the initial admin password before installation:
+   ```bash
+   $ export OPENSEARCH_INITIAL_ADMIN_PASSWORD=<your-strong-password>
+   ```
+   {% include copy.html %}
+
 1. Open another terminal session and send requests to the server to verify that OpenSearch is running. Note the use of the `--insecure` flag, which is required because the TLS certificates are self-signed.
    - Send a request to port 9200:
       ```bash
-      curl -X GET https://localhost:9200 -u 'admin:admin' --insecure
+      curl -X GET https://localhost:9200 -u 'admin:< Admin password >' --insecure
       ```
       {% include copy.html %}
 
@@ -129,7 +135,7 @@ An OpenSearch node configured by the demo security script is not suitable for a
       ```
    - Query the plugins endpoint:
       ```bash
-      curl -X GET https://localhost:9200/_cat/plugins?v -u 'admin:admin' --insecure
+      curl -X GET https://localhost:9200/_cat/plugins?v -u 'admin:< Admin password >' --insecure
       ```
       {% include copy.html %}
 

_install-and-configure/install-opensearch/windows.md

@@ -70,11 +70,16 @@ An OpenSearch node in its default configuration (with demo certificates and user
          .\opensearch-windows-install.bat
          ```
          {% include copy.html %}
+         **Note**: For OpenSearch 2.12 and above, set the initial admin password before installation:
+         ```bat
+         > set OPENSEARCH_INITIAL_ADMIN_PASSWORD=<your-strong-password>
+         ```
+         {% include copy.html %}
 
 1. Open a new command prompt and send requests to the server to verify that OpenSearch is running. Note the use of the `--insecure` flag, which is required because the TLS certificates are self-signed.
    - Send a request to port 9200:
       ```bat
-      curl.exe -X GET https://localhost:9200 -u "admin:admin" --insecure
+      curl.exe -X GET https://localhost:9200 -u "admin:< Admin password >" --insecure
       ```
       {% include copy.html %}
 
@@ -100,7 +105,7 @@ An OpenSearch node in its default configuration (with demo certificates and user
       ```
    - Query the plugins endpoint:
       ```bat
-      curl.exe -X GET https://localhost:9200/_cat/plugins?v -u "admin:admin" --insecure
+      curl.exe -X GET https://localhost:9200/_cat/plugins?v -u "admin:< Admin password >" --insecure
       ```
       {% include copy.html %}
 

_install-and-configure/upgrade-opensearch/appendix/rolling-upgrade-lab.md

@@ -125,7 +125,7 @@ After selecting a host, you can begin the lab:
    1. Press `Ctrl+C` to stop following container logs and return to the command prompt.
 1. Use cURL to query the OpenSearch REST API. In the following command, `os-node-01` is queried by sending the request to host port `9201`, which is mapped to port `9200` on the container:
    ```bash
-   curl -s "https://localhost:9201" -ku admin:admin
+   curl -s "https://localhost:9201" -ku admin:< Admin password >
    ```
    {% include copy.html %}
    <p class="codeblock-label">Example response</p>
@@ -177,7 +177,7 @@ This section can be broken down into two parts:
    curl -H "Content-Type: application/x-ndjson" \
       -X PUT "https://localhost:9201/ecommerce?pretty" \
       --data-binary "@ecommerce-field_mappings.json" \
-      -ku admin:admin
+      -ku admin:< Admin password >
    ```
    {% include copy.html %}
    <p class="codeblock-label">Example response</p>
@@ -193,7 +193,7 @@ This section can be broken down into two parts:
    curl -H "Content-Type: application/x-ndjson" \
       -X PUT "https://localhost:9201/ecommerce/_bulk?pretty" \
       --data-binary "@ecommerce.json" \
-      -ku admin:admin
+      -ku admin:< Admin password >
    ```
    {% include copy.html %}
    <p class="codeblock-label">Example response (truncated)</p>
@@ -226,7 +226,7 @@ This section can be broken down into two parts:
    curl -H 'Content-Type: application/json' \
       -X GET "https://localhost:9201/ecommerce/_search?pretty=true&filter_path=hits.total" \
       -d'{"query":{"match":{"customer_first_name":"Sonya"}}}' \
-      -ku admin:admin
+      -ku admin:< Admin password >
    ```
    {% include copy.html %}
    <p class="codeblock-label" id="query-validation">Example response</p>
@@ -271,7 +271,7 @@ In this section you will be:
    curl -H 'Content-Type: application/json' \
       -X PUT "https://localhost:9201/_snapshot/snapshot-repo?pretty" \
       -d '{"type":"fs","settings":{"location":"/usr/share/opensearch/snapshots"}}' \
-      -ku admin:admin
+      -ku admin:< Admin password >
    ```
    {% include copy.html %}
    <p class="codeblock-label">Example response</p>
@@ -284,7 +284,7 @@ In this section you will be:
    ```bash
    curl -H 'Content-Type: application/json' \
       -X POST "https://localhost:9201/_snapshot/snapshot-repo/_verify?timeout=0s&master_timeout=50s&pretty" \
-      -ku admin:admin
+      -ku admin:< Admin password >
    ```
    {% include copy.html %}
    <p class="codeblock-label">Example response</p>
@@ -315,7 +315,7 @@ Snapshots are backups of a cluster’s indexes and state. See [Snapshots]({{site
    ```bash
    curl -H 'Content-Type: application/json' \
       -X PUT "https://localhost:9201/_snapshot/snapshot-repo/cluster-snapshot-v137?wait_for_completion=true&pretty" \
-      -ku admin:admin
+      -ku admin:< Admin password >
    ```
    {% include copy.html %}
    <p class="codeblock-label">Example response</p>
@@ -448,7 +448,7 @@ Some steps included in this section, like disabling shard replication and flushi
    curl -H 'Content-type: application/json' \
       -X PUT "https://localhost:9201/_cluster/settings?pretty" \
       -d'{"persistent":{"cluster.routing.allocation.enable":"primaries"}}' \
-      -ku admin:admin
+      -ku admin:< Admin password >
    ```
    {% include copy.html %}
    <p class="codeblock-label">Example response</p>
@@ -469,7 +469,7 @@ Some steps included in this section, like disabling shard replication and flushi
    ```
 1. Perform a flush operation on the cluster to commit transaction log entries to the Lucene index:
    ```bash
-   curl -X POST "https://localhost:9201/_flush?pretty" -ku admin:admin
+   curl -X POST "https://localhost:9201/_flush?pretty" -ku admin:< Admin password >
    ```
    {% include copy.html %}
    <p class="codeblock-label">Example response</p>
@@ -514,7 +514,7 @@ Some steps included in this section, like disabling shard replication and flushi
 1. **Optional**: Query the cluster to determine which node is acting as the cluster manager. You can run this command at any time during the process to see when a new cluster manager is elected:
    ```bash
    curl -s "https://localhost:9201/_cat/nodes?v&h=name,version,node.role,master" \
-      -ku admin:admin | column -t
+      -ku admin:< Admin password > | column -t
    ```
    {% include copy.html %}
    <p class="codeblock-label">Example response</p>
@@ -528,7 +528,7 @@ Some steps included in this section, like disabling shard replication and flushi
 1. **Optional**: Query the cluster to see how shard allocation changes as nodes are removed and replaced. You can run this command at any time during the process to see how shard statuses change:
    ```bash
    curl -s "https://localhost:9201/_cat/shards" \
-      -ku admin:admin
+      -ku admin:< Admin password >
    ```
    {% include copy.html %}
    <p class="codeblock-label">Example response</p>
@@ -644,7 +644,7 @@ Some steps included in this section, like disabling shard replication and flushi
 1. Confirm that your cluster is running the new version:
    ```bash
    curl -s "https://localhost:9201/_cat/nodes?v&h=name,version,node.role,master" \
-      -ku admin:admin | column -t
+      -ku admin:< Admin password > | column -t
    ```
    {% include copy.html %}
    <p class="codeblock-label">Example response</p>
@@ -700,7 +700,7 @@ Some steps included in this section, like disabling shard replication and flushi
    curl -H 'Content-type: application/json' \
       -X PUT "https://localhost:9201/_cluster/settings?pretty" \
       -d'{"persistent":{"cluster.routing.allocation.enable":"all"}}' \
-      -ku admin:admin
+      -ku admin:< Admin password >
    ```
    {% include copy.html %}
    <p class="codeblock-label">Example response</p>
@@ -735,7 +735,7 @@ For this cluster, post-upgrade validation steps can include verifying the follow
 1. Verify the current running version of your OpenSearch nodes:
    ```bash
    curl -s "https://localhost:9201/_cat/nodes?v&h=name,version,node.role,master" \
-      -ku admin:admin | column -t
+      -ku admin:< Admin password > | column -t
    ```
    {% include copy.html %}
    <p class="codeblock-label">Example response</p>
@@ -781,7 +781,7 @@ For this cluster, post-upgrade validation steps can include verifying the follow
 
 1. Query the [Cluster health]({{site.url}}{{site.baseurl}}/api-reference/cluster-api/cluster-health/) API endpoint to see information about the health of your cluster. You should see a status of `green`, which indicates that all primary and replica shards are allocated:
    ```bash
-   curl -s "https://localhost:9201/_cluster/health?pretty" -ku admin:admin
+   curl -s "https://localhost:9201/_cluster/health?pretty" -ku admin:< Admin password >
    ```
    {% include copy.html %}
    <p class="codeblock-label">Example response</p>
@@ -808,7 +808,7 @@ For this cluster, post-upgrade validation steps can include verifying the follow
    ```
 1. Query the [CAT shards]({{site.url}}{{site.baseurl}}/api-reference/cat/cat-shards/) API endpoint to see how shards are allocated after the cluster is upgrade:
    ```bash
-   curl -s "https://localhost:9201/_cat/shards" -ku admin:admin
+   curl -s "https://localhost:9201/_cat/shards" -ku admin:< Admin password >
    ```
    {% include copy.html %}
    <p class="codeblock-label">Example response</p>
@@ -860,7 +860,7 @@ You need to query the ecommerce index again in order to confirm that the sample
    curl -H 'Content-Type: application/json' \
       -X GET "https://localhost:9201/ecommerce/_search?pretty=true&filter_path=hits.total" \
       -d'{"query":{"match":{"customer_first_name":"Sonya"}}}' \
-      -ku admin:admin
+      -ku admin:< Admin password >
    ```
    {% include copy.html %}
    <p class="codeblock-label">Example response</p>