TLS settings for gRPC (opensearch-project#10653)

* Add gRPC tls settings.

Signed-off-by: Finn Carroll <[email protected]>

* Update _security/configuration/tls.md

Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Finn <[email protected]>

* Update _security/configuration/tls.md

Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Finn <[email protected]>

* Update _security/configuration/tls.md

Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Finn <[email protected]>

* Update _security/configuration/tls.md

Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Finn <[email protected]>

* Update _security/configuration/tls.md

Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Finn <[email protected]>

* Update _security/configuration/tls.md

Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Finn <[email protected]>

* Update _security/configuration/tls.md

Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Finn <[email protected]>

* Update _security/configuration/tls.md

Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Finn <[email protected]>

* Update _security/configuration/tls.md

Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Finn <[email protected]>

* Update _security/configuration/tls.md

Co-authored-by: kolchfa-aws <[email protected]>
Signed-off-by: Finn <[email protected]>

* Fix gRPC heading level -> 2.

Signed-off-by: Finn Carroll <[email protected]>

* Clarify keystore/trusstore alias behavior.

Signed-off-by: Finn Carroll <[email protected]>

* Apply suggestions from code review

Signed-off-by: kolchfa-aws <[email protected]>

* Apply suggestions from code review

Signed-off-by: Nathan Bower <[email protected]>

---------

Signed-off-by: Finn Carroll <[email protected]>
Signed-off-by: Finn <[email protected]>
Signed-off-by: kolchfa-aws <[email protected]>
Signed-off-by: Nathan Bower <[email protected]>
Co-authored-by: kolchfa-aws <[email protected]>
Co-authored-by: Nathan Bower <[email protected]>

Author: 3 people

_security/configuration/tls.md

@@ -310,6 +310,37 @@ You should receive the following response:
 { "message": "successfully updated http certs"}
 ```
 
+## Configuring TLS certificates for gRPC
 
+gRPC supports encryption in transit only. Trust stores and certificates configured as root CAs in PEM format are used only for the purpose of TLS client authorization. Role-based access is not available for gRPC endpoints. 
+{: .warning}
 
+You can configure TLS on the optional gRPC transport in `opensearch.yml`. For more information about using the gRPC plugin, see [Enabling the plugin]({{site.url}}{{site.baseurl}}/api-reference/grpc-apis/index/#enabling-the-plugin).
 
+### PEM key settings (X.509 PEM certificates and PKCS #8 keys)
+
+The following table lists the available gRPC PEM key settings.
+
+Name | Description
+:--- | :---
+`plugins.security.ssl.aux.secure-transport-grpc.enabled` | Whether to enable TLS for gRPC. If enabled, only HTTPS is allowed. Optional. Default is `false`.
+`plugins.security.ssl.aux.secure-transport-grpc.pemkey_filepath` | The path to the certificate's key file (PKCS #8), specified as a relative path from the `config` directory. The file must reside within the `config` directory. Required.
+`plugins.security.ssl.aux.secure-transport-grpc.pemkey_password` | The key password. Omit this setting if the key has no password. Optional.
+`plugins.security.ssl.aux.secure-transport-grpc.pemcert_filepath` | The path to the X.509 node certificate chain (in PEM format), specified as a relative path from the `config` directory. The file must reside within the `config` directory. Required.
+`plugins.security.ssl.aux.secure-transport-grpc.pemtrustedcas_filepath` | The path to the root CAs (in PEM format), specified as a relative path from the `config` directory. The file must reside within the `config` directory. Required.
+
+### Keystore and truststore
+
+The following table lists the available gRPC keystore and truststore settings.
+
+Name | Description
+:--- | :---
+`plugins.security.ssl.aux.secure-transport-grpc.enabled` | Whether to enable TLS for gRPC. If enabled, only HTTPS is allowed. Optional. Default is `false`.
+`plugins.security.ssl.aux.secure-transport-grpc.keystore_type` | The type of the keystore file, JKS or PKCS12/PFX. Optional. Default is JKS.
+`plugins.security.ssl.aux.secure-transport-grpc.keystore_filepath` | The path to the keystore file, specified as a relative path from the `config` directory. The file must reside within the `config` directory. Required.
+`plugins.security.ssl.aux.secure-transport-grpc.keystore_alias` | The alias of the key pair to use from the provided keystore. Optional. Defaults to the first key pair added to the keystore.
+`plugins.security.ssl.aux.secure-transport-grpc.keystore_password` | The password for the keystore. Default is `changeit`.
+`plugins.security.ssl.aux.secure-transport-grpc.truststore_type` | The type of the truststore file, JKS or PKCS12/PFX. Default is JKS.
+`plugins.security.ssl.aux.secure-transport-grpc.truststore_filepath` | The path to the truststore file, specified as a relative path from the `config` directory. The file must reside within the `config` directory. Required.
+`plugins.security.ssl.aux.secure-transport-grpc.truststore_alias` | The alias of the certificate to use from the provided truststore. Optional. Default is all certificates.
+`plugins.security.ssl.aux.secure-transport-grpc.truststore_password` | The password for the truststore. Default is `changeit`.