Kvindo™ Cloud Docs
An OpenSearch Parameter Set is a named, reusable collection of cluster-wide OpenSearch settings. Attach it to a cluster via spec.parametersSetId to apply a consistent profile — a larger query cache, deeper search queues, a faster recovery budget — without editing each cluster individually.
• Keys are raw OpenSearch setting names — indices.queries.cache.size, not a Kvindo-specific alias. They are checked against a fixed allow-list, so an unrecognized key or an out-of-range value is rejected as a synchronous 400 naming the supported set, rather than forwarded and silently ignored by a node
• Hot vs restart — a dynamic setting is pushed through PUT _cluster/settings and takes effect without a restart. A setting that can only live in opensearch.yml is rendered there and applied with a rolling restart, one node at a time. The allow-list below marks which is which
• Values are always strings — quote numbers, sizes and percentages ("1024", "512mb", "10%") the way the underlying setting expects
• A size takes a percentage or a byte unit — b, kb, mb, gb, tb, or %. A percentage is range-checked to 1–100, so a nonsensical 0% or 500% is refused here instead of starting a node with a value OpenSearch cannot interpret
• One cross-key rule — indices.fielddata.cache.size must be smaller than indices.breaker.fielddata.limit. A cache at or above its own breaker means every query that fills the cache trips the breaker instead of evicting from it. The pair is only compared when both sides are given in the same unit kind
• Reuse — one set can be referenced by many clusters; updating the set re-applies to every cluster that references it
• Swapping freely — changing which parameter set a cluster references is the one field its modify guardrails leave unrestricted
• indices.query.bool.max_clause_count — integer 1024 – 16777216. Applied hot. Existing search threads may keep the old value until they are recycled
• indices.fielddata.cache.size — size (percent or bytes). Applied hot. Must be smaller than indices.breaker.fielddata.limit
• search.max_buckets — integer ≥ 1. Requires a rolling restart
• reindex.remote.whitelist — comma-separated list of host:port entries. Applied hot. Widens which remote hosts a reindex-from-remote may reach
• http.max_initial_line_length — size (percent or bytes). Requires a rolling restart
• indices.recovery.max_bytes_per_sec — size (percent or bytes). Applied hot. The per-node recovery bandwidth budget — the main lever on how long a node takes to come back
• indices.recovery.max_concurrent_file_chunks — integer 1 – 1024. Applied hot.
• indices.memory.index_buffer_size — size (percent or bytes). Requires a rolling restart
• indices.queries.cache.size — size (percent or bytes). Requires a rolling restart
• indices.breaker.fielddata.limit — size (percent or bytes). Applied hot. Must be larger than indices.fielddata.cache.size
• thread_pool.search.queue_size — integer 1 – 100000. Applied hot. A deeper search queue absorbs bursts at the cost of latency for everything queued behind them
• thread_pool.write.queue_size — integer 1 – 100000. Applied hot.
• indices.time_series_index.default_index_merge_policy — one of default, tiered, log_byte_size. Requires a rolling restart
• cluster.routing.allocation.disk.watermark.low — size (percent or bytes; default 85%). Applied hot. Past it, no new replica is allocated on that node
• cluster.routing.allocation.disk.watermark.high — size (percent or bytes; default 90%). Applied hot. Past it, OpenSearch moves shards off that node
low and high watermarks are yours to tune, but the flood_stage threshold is not settable through a Parameter Set — see below. If you raise high, remember that flood_stage stays at its platform-managed 95%, so the gap between them shrinks.These keys are refused with their own explanation — not silently dropped — so a rejected request reads as a decision rather than a missing feature. Each is a platform-managed value that a tenant must not be able to set.
• cluster.routing.allocation.disk.watermark.flood_stage — platform-managed at its 95% default. Past it, OpenSearch places a read-only block on every index with a shard on the full node, and that block is the last thing standing between a tenant and a full volume. Exposing it would let a caller set 100% and lose the cluster to a full disk
• cluster.default_number_of_replicas — derived from the data-node count: 0 on a single-data-node cluster, so its indices are not permanently yellow, and 1 otherwise. Letting a tenant set it would allow making every index unrecoverable on a one-node cluster
• action.destructive_requires_name — forced true, so a wildcard delete is never possible
• cluster.no_cluster_manager_block — pinned to write, so losing cluster-manager quorum is a predictable write outage (reads keep working) rather than a choice
• Everything under plugins.security.* — the platform owns the security configuration
• Listener, discovery and node-identity keys (network.*, http.port, http.host, discovery.*, cluster.initial_cluster_manager_nodes, node.roles, node.name, node.attr.*, path.*), and the per-index index.* settings — those are the user's own, per index, not a cluster setting
A tenant role deliberately carries no cluster:admin/settings/update, so PUT _cluster/settings is refused for it: a Parameter Set is the only path to a cluster setting, which is what makes this allow-list meaningful rather than decorative.
| UI Name | API / kc name | Terraform name | Optional | Format | Default | Is read only | Description |
|---|---|---|---|---|---|---|---|
| Parameters | spec.parameters |
spec.parameters |
No | map of string → string | {} |
No | Raw OpenSearch cluster settings applied to clusters that reference this set — see the allow-list above. An unrecognized key, an out-of-range value, or a bad size is rejected at request time, not silently forwarded |
A profile with a larger fielddata cache and a deeper search queue. Reference it from an OpenSearch Cluster via spec.parametersSetId.
Terraform
Python SDK
Resource docs
Examples
More in this section