more TLS settings

CHANGES.rst

@@ -1,6 +1,13 @@
 Changelog
 =========
 
+2.0.0rc3 (2023-11-28)
+--------------------
+
+- Feature: set env ``INDEX_SSL_SHOW_WARN=1`` to pass as ``ssl_show_warn`` kwarg in OpenSearch client [jensens]
+- Feature: set env ``INDEX_SSL_ASSERT_HOSTNAME=1`` to pass as ``ssl_assert_hostname`` kwarg in OpenSearch client [jensens]
+
+
 2.0.0rc2 (2023-11-28)
 --------------------
 

README.rst

@@ -66,6 +66,16 @@ INDEX_VERIFY_CERTS
 
     Default: 0
 
+INDEX_SSL_SHOW_WARN
+    Whether to warn for unverified TLS request is made or not.
+
+    Default: 0
+
+INDEX_SSL_ASSERT_HOSTNAME
+    Whether to assert the hostname in TLS request or not.
+
+    Default: 0
+
 INDEX_LOGIN
     Username for the ElasticSearch 8+ or OpenSearch server.
 
@@ -76,6 +86,7 @@ INDEX_PASSWORD
 
     Default: admin
 
+
 CELERY_BROKER
     The broker URL for Celery.
     See `docs.celeryq.dev <https://docs.celeryq.dev/>`_ for details.

src/collective/elastic/ingest/client.py

@@ -48,6 +48,12 @@ def get_client(index_server_baseurl: str = ""):
             kwargs["verify_certs"] = bool(
                 int(os.environ.get("INDEX_VERIFY_CERTS", "0"))
             )
+            kwargs["ssl_show_warn"] = bool(
+                int(os.environ.get("INDEX_SSL_SHOW_WARN", "0"))
+            )
+            kwargs["ssl_assert_hostname"] = bool(
+                int(os.environ.get("INDEX_SSL_ASSERT_HOSTNAME", "0"))
+            )
         kwargs["http_auth"] = auth
         logger.info(f"OpenSearch client kwargs: {kwargs}")
         client = OpenSearch(**kwargs)