Add unified logs platform with Helm-managed central Elasticsearch.

Deploy cloudhost-logging on cluster registration, ship app and optional service logs to ES with owner isolation, and fix Kibana 8.12 auth via kibana_system. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-15 15:56:33 +03:30
parent 2303985d0c
commit 35dd771f63
31 changed files with 1657 additions and 938 deletions
@@ -0,0 +1,46 @@
+{{/*
+  Optional log-shipper sidecar for Redis / RabbitMQ / Database pods.
+  Requires .workloadName, .workloadType (redis|rabbitmq|database), and root context .
+*/}}
+{{- define "cloudhost-app.logShipperContainers" -}}
+{{- if .root.Values.elasticsearch.enabled }}
+- name: log-shipper
+  image: fluent/fluent-bit:2.2
+  resources:
+    requests:
+      cpu: "10m"
+      memory: "32Mi"
+    limits:
+      cpu: "50m"
+      memory: "64Mi"
+  volumeMounts:
+    - name: varlogpods
+      mountPath: /var/log/pods
+      readOnly: true
+    - name: log-shipper-config
+      mountPath: /fluent-bit/etc
+  env:
+    - name: ES_HOST
+      value: "elasticsearch.logging.svc.cluster.local"
+    - name: ES_PORT
+      value: "9200"
+    - name: ES_PASSWORD
+      valueFrom:
+        secretKeyRef:
+          name: elasticsearch-credentials
+          key: ELASTIC_PASSWORD
+          optional: true
+{{- end }}
+{{- end }}
+
+{{- define "cloudhost-app.logShipperVolumes" -}}
+{{- if .root.Values.elasticsearch.enabled }}
+- name: varlogpods
+  hostPath:
+    path: /var/log/pods
+    type: Directory
+- name: log-shipper-config
+  configMap:
+    name: {{ .workloadName }}-log-shipper-config
+{{- end }}
+{{- end }}
@@ -138,8 +138,10 @@ spec:
            initialDelaySeconds: 30
            periodSeconds: 10
            failureThreshold: 5
+        {{- include "cloudhost-app.logShipperContainers" (dict "root" . "workloadName" $dbName "workloadType" "database") | nindent 8 }}
      volumes:
        - name: db-storage
          persistentVolumeClaim:
            claimName: {{ $dbName }}
+        {{- include "cloudhost-app.logShipperVolumes" (dict "root" . "workloadName" $dbName) | nindent 8 }}
 {{- end }}
@@ -31,8 +31,12 @@ data:
        Name          record_modifier
        Match         *
        Record        app {{ $name }}
+        Record        applicationName {{ $name }}
        Record        namespace {{ $ns }}
        Record        runtime {{ .Values.app.runtime }}
+        Record        ownerId {{ .Values.elasticsearch.ownerId }}
+        Record        applicationId {{ .Values.elasticsearch.applicationId }}
+        Record        workload app

    [FILTER]
        Name          parser
@@ -0,0 +1,151 @@
+{{- if .Values.elasticsearch.enabled }}
+{{- $name := include "cloudhost-app.name" . -}}
+{{- $ns   := include "cloudhost-app.namespace" . -}}
+{{- if .Values.redis.enabled }}
+{{- $redisName := printf "%s-redis" $name -}}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ $redisName }}-log-shipper-config
+  namespace: {{ $ns }}
+data:
+  fluent-bit.conf: |
+    [SERVICE]
+        Flush         5
+        Daemon        Off
+        Log_Level     info
+        Parsers_File  /fluent-bit/etc/parsers.conf
+    [INPUT]
+        Name              tail
+        Path              /var/log/pods/*{{ $redisName }}*/*/*.log
+        Tag               redis.{{ $redisName }}
+        Refresh_Interval  5
+        Parser            docker
+    [FILTER]
+        Name          record_modifier
+        Match         *
+        Record        app {{ $name }}
+        Record        applicationName {{ $name }}
+        Record        namespace {{ $ns }}
+        Record        ownerId {{ .Values.elasticsearch.ownerId }}
+        Record        applicationId {{ .Values.elasticsearch.applicationId }}
+        Record        workload redis
+    [OUTPUT]
+        Name          es
+        Match         *
+        Host          ${ES_HOST}
+        Port          ${ES_PORT}
+        HTTP_User     elastic
+        HTTP_Passwd   ${ES_PASSWORD}
+        Index         logs-{{ $ns }}-{{ $name }}
+        Logstash_Format On
+        Logstash_Prefix logs-{{ $ns }}
+        Suppress_Type_Name On
+        tls           Off
+  parsers.conf: |
+    [PARSER]
+        Name        docker
+        Format      json
+        Time_Key    time
+        Time_Format %Y-%m-%dT%H:%M:%S.%L
+{{- end }}
+{{- if .Values.rabbitmq.enabled }}
+{{- $rabbitName := printf "%s-rabbitmq" $name -}}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ $rabbitName }}-log-shipper-config
+  namespace: {{ $ns }}
+data:
+  fluent-bit.conf: |
+    [SERVICE]
+        Flush         5
+        Daemon        Off
+        Log_Level     info
+        Parsers_File  /fluent-bit/etc/parsers.conf
+    [INPUT]
+        Name              tail
+        Path              /var/log/pods/*{{ $rabbitName }}*/*/*.log
+        Tag               rabbitmq.{{ $rabbitName }}
+        Refresh_Interval  5
+        Parser            docker
+    [FILTER]
+        Name          record_modifier
+        Match         *
+        Record        app {{ $name }}
+        Record        applicationName {{ $name }}
+        Record        namespace {{ $ns }}
+        Record        ownerId {{ .Values.elasticsearch.ownerId }}
+        Record        applicationId {{ .Values.elasticsearch.applicationId }}
+        Record        workload rabbitmq
+    [OUTPUT]
+        Name          es
+        Match         *
+        Host          ${ES_HOST}
+        Port          ${ES_PORT}
+        HTTP_User     elastic
+        HTTP_Passwd   ${ES_PASSWORD}
+        Index         logs-{{ $ns }}-{{ $name }}
+        Logstash_Format On
+        Logstash_Prefix logs-{{ $ns }}
+        Suppress_Type_Name On
+        tls           Off
+  parsers.conf: |
+    [PARSER]
+        Name        docker
+        Format      json
+        Time_Key    time
+        Time_Format %Y-%m-%dT%H:%M:%S.%L
+{{- end }}
+{{- if .Values.database.enabled }}
+{{- $dbName := include "cloudhost-app.dbDeploymentName" . -}}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ $dbName }}-log-shipper-config
+  namespace: {{ $ns }}
+data:
+  fluent-bit.conf: |
+    [SERVICE]
+        Flush         5
+        Daemon        Off
+        Log_Level     info
+        Parsers_File  /fluent-bit/etc/parsers.conf
+    [INPUT]
+        Name              tail
+        Path              /var/log/pods/*{{ $dbName }}*/*/*.log
+        Tag               database.{{ $dbName }}
+        Refresh_Interval  5
+        Parser            docker
+    [FILTER]
+        Name          record_modifier
+        Match         *
+        Record        app {{ $name }}
+        Record        applicationName {{ $name }}
+        Record        namespace {{ $ns }}
+        Record        ownerId {{ .Values.elasticsearch.ownerId }}
+        Record        applicationId {{ .Values.elasticsearch.applicationId }}
+        Record        workload database
+    [OUTPUT]
+        Name          es
+        Match         *
+        Host          ${ES_HOST}
+        Port          ${ES_PORT}
+        HTTP_User     elastic
+        HTTP_Passwd   ${ES_PASSWORD}
+        Index         logs-{{ $ns }}-{{ $name }}
+        Logstash_Format On
+        Logstash_Prefix logs-{{ $ns }}
+        Suppress_Type_Name On
+        tls           Off
+  parsers.conf: |
+    [PARSER]
+        Name        docker
+        Format      json
+        Time_Key    time
+        Time_Format %Y-%m-%dT%H:%M:%S.%L
+{{- end }}
+{{- end }}
@@ -94,10 +94,12 @@ spec:
            initialDelaySeconds: 60
            periodSeconds: 30
            timeoutSeconds: 10
+        {{- include "cloudhost-app.logShipperContainers" (dict "root" . "workloadName" $rabbitName "workloadType" "rabbitmq") | nindent 8 }}
      volumes:
        - name: rabbitmq-data
          persistentVolumeClaim:
            claimName: {{ $rabbitName }}-data
+        {{- include "cloudhost-app.logShipperVolumes" (dict "root" . "workloadName" $rabbitName) | nindent 8 }}
 ---
 apiVersion: v1
 kind: Service
@@ -84,10 +84,12 @@ spec:
              command: ["redis-cli", "ping"]
            initialDelaySeconds: 15
            periodSeconds: 20
+        {{- include "cloudhost-app.logShipperContainers" (dict "root" . "workloadName" $redisName "workloadType" "redis") | nindent 8 }}
      volumes:
        - name: redis-data
          persistentVolumeClaim:
            claimName: {{ $redisName }}-data
+        {{- include "cloudhost-app.logShipperVolumes" (dict "root" . "workloadName" $redisName) | nindent 8 }}
 ---
 apiVersion: v1
 kind: Service
@@ -78,6 +78,8 @@ rabbitmq:
 elasticsearch:
  enabled: false
  logPaths: []
+  ownerId: ""
+  applicationId: ""

 # ── Change metadata ─────────────────────────────────────
 changeCause: ""
@@ -0,0 +1,6 @@
+apiVersion: v2
+name: cloudhost-logging
+description: CloudHost central logging stack (Elasticsearch + Kibana)
+type: application
+version: 0.1.0
+appVersion: "8.12.0"
@@ -0,0 +1,7 @@
+{{- define "cloudhost-logging.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "cloudhost-logging.namespace" -}}
+{{- .Values.namespace | default "logging" }}
+{{- end }}
@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: elasticsearch-data
+  namespace: {{ include "cloudhost-logging.namespace" . }}
+  labels:
+    app: elasticsearch
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+  annotations:
+    helm.sh/resource-policy: keep
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.storage }}
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: elasticsearch
+  namespace: {{ include "cloudhost-logging.namespace" . }}
+  labels:
+    app: elasticsearch
+spec:
+  type: ClusterIP
+  selector:
+    app: elasticsearch
+  ports:
+    - name: http
+      port: 9200
+      targetPort: 9200
+    - name: transport
+      port: 9300
+      targetPort: 9300
@@ -0,0 +1,99 @@
+{{- $auth := printf "elastic:%s" .Values.elasticPassword | b64enc }}
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: elasticsearch
+  namespace: {{ include "cloudhost-logging.namespace" . }}
+  labels:
+    app: elasticsearch
+spec:
+  serviceName: elasticsearch
+  replicas: 1
+  selector:
+    matchLabels:
+      app: elasticsearch
+  template:
+    metadata:
+      labels:
+        app: elasticsearch
+    spec:
+      securityContext:
+        fsGroup: 1000
+      initContainers:
+        - name: fix-permissions
+          image: {{ .Values.images.busybox }}
+          command:
+            - sh
+            - -c
+            - chown -R 1000:1000 /usr/share/elasticsearch/data
+          securityContext:
+            runAsUser: 0
+            privileged: true
+          volumeMounts:
+            - name: es-data
+              mountPath: /usr/share/elasticsearch/data
+        - name: increase-vm-max-map
+          image: {{ .Values.images.busybox }}
+          command:
+            - sysctl
+            - -w
+            - vm.max_map_count=262144
+          securityContext:
+            privileged: true
+      containers:
+        - name: elasticsearch
+          image: {{ .Values.images.elasticsearch }}
+          ports:
+            - containerPort: 9200
+              name: http
+            - containerPort: 9300
+              name: transport
+          env:
+            - name: discovery.type
+              value: single-node
+            - name: xpack.security.enabled
+              value: "true"
+            - name: xpack.security.http.ssl.enabled
+              value: "false"
+            - name: xpack.security.transport.ssl.enabled
+              value: "false"
+            - name: ELASTIC_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: elasticsearch-credentials
+                  key: ELASTIC_PASSWORD
+            - name: ES_JAVA_OPTS
+              value: {{ .Values.elasticsearch.javaOpts | quote }}
+            - name: cluster.name
+              value: {{ .Values.clusterName | quote }}
+            - name: bootstrap.memory_lock
+              value: "false"
+          resources:
+            {{- toYaml .Values.elasticsearch.resources | nindent 12 }}
+          volumeMounts:
+            - name: es-data
+              mountPath: /usr/share/elasticsearch/data
+          readinessProbe:
+            httpGet:
+              path: /_cluster/health?local=true
+              port: 9200
+              httpHeaders:
+                - name: Authorization
+                  value: Basic {{ $auth }}
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 5
+          livenessProbe:
+            httpGet:
+              path: /_cluster/health?local=true
+              port: 9200
+              httpHeaders:
+                - name: Authorization
+                  value: Basic {{ $auth }}
+            initialDelaySeconds: 60
+            periodSeconds: 30
+            timeoutSeconds: 10
+      volumes:
+        - name: es-data
+          persistentVolumeClaim:
+            claimName: elasticsearch-data
@@ -0,0 +1,96 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kibana
+  namespace: {{ include "cloudhost-logging.namespace" . }}
+  labels:
+    app: kibana
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: kibana
+  template:
+    metadata:
+      labels:
+        app: kibana
+    spec:
+      initContainers:
+        - name: setup-kibana-system-user
+          image: {{ .Values.images.curl | default "curlimages/curl:8.5.0" }}
+          env:
+            - name: ELASTIC_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: elasticsearch-credentials
+                  key: ELASTIC_PASSWORD
+            - name: KIBANA_SYSTEM_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: elasticsearch-credentials
+                  key: KIBANA_SYSTEM_PASSWORD
+          command:
+            - sh
+            - -ec
+            - |
+              echo "Waiting for Elasticsearch..."
+              until curl -sf -u "elastic:${ELASTIC_PASSWORD}" \
+                "http://elasticsearch:9200/_cluster/health?wait_for_status=yellow&timeout=60s"; do
+                sleep 5
+              done
+              echo "Setting kibana_system password..."
+              HTTP_CODE=$(curl -s -o /tmp/curl-out -w "%{http_code}" -X POST \
+                -u "elastic:${ELASTIC_PASSWORD}" \
+                "http://elasticsearch:9200/_security/user/kibana_system/_password" \
+                -H "Content-Type: application/json" \
+                -d "{\"password\":\"${KIBANA_SYSTEM_PASSWORD}\"}")
+              if [ "$HTTP_CODE" != "200" ] && [ "$HTTP_CODE" != "201" ]; then
+                echo "kibana_system password setup failed (HTTP $HTTP_CODE):"
+                cat /tmp/curl-out
+                exit 1
+              fi
+              echo "kibana_system user ready"
+              echo "Configuring single-node index settings..."
+              curl -sf -X PUT -u "elastic:${ELASTIC_PASSWORD}" \
+                "http://elasticsearch:9200/_index_template/single-node-zero-replicas" \
+                -H "Content-Type: application/json" \
+                -d '{"index_patterns":["*"],"priority":1,"template":{"settings":{"index.number_of_replicas":0}}}'
+              curl -sf -X PUT -u "elastic:${ELASTIC_PASSWORD}" \
+                "http://elasticsearch:9200/.kibana*/_settings" \
+                -H "Content-Type: application/json" \
+                -d '{"index":{"number_of_replicas":0}}' || true
+      containers:
+        - name: kibana
+          image: {{ .Values.images.kibana }}
+          ports:
+            - containerPort: 5601
+          env:
+            - name: ELASTICSEARCH_HOSTS
+              value: http://elasticsearch:9200
+            - name: ELASTICSEARCH_USERNAME
+              value: kibana_system
+            - name: ELASTICSEARCH_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: elasticsearch-credentials
+                  key: KIBANA_SYSTEM_PASSWORD
+            - name: SERVER_NAME
+              value: kibana
+            - name: XPACK_SECURITY_ENABLED
+              value: "true"
+          resources:
+            {{- toYaml .Values.kibana.resources | nindent 12 }}
+          readinessProbe:
+            httpGet:
+              path: /api/status
+              port: 5601
+            initialDelaySeconds: 45
+            periodSeconds: 10
+            timeoutSeconds: 5
+          livenessProbe:
+            httpGet:
+              path: /api/status
+              port: 5601
+            initialDelaySeconds: 90
+            periodSeconds: 30
+            timeoutSeconds: 5
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: kibana
+  namespace: {{ include "cloudhost-logging.namespace" . }}
+  labels:
+    app: kibana
+spec:
+  type: ClusterIP
+  selector:
+    app: kibana
+  ports:
+    - port: 5601
+      targetPort: 5601
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ include "cloudhost-logging.namespace" . }}
+  labels:
+    app.kubernetes.io/managed-by: cloudhost
+    app.kubernetes.io/instance: {{ .Release.Name }}
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: elasticsearch-credentials
+  namespace: {{ include "cloudhost-logging.namespace" . }}
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+type: Opaque
+stringData:
+  ELASTIC_PASSWORD: {{ required "elasticPassword is required" .Values.elasticPassword | quote }}
+  FLUENTBIT_PASSWORD: {{ required "fluentbitPassword is required" .Values.fluentbitPassword | quote }}
+  KIBANA_SYSTEM_PASSWORD: {{ required "kibanaSystemPassword is required" .Values.kibanaSystemPassword | quote }}
@@ -0,0 +1,34 @@
+namespace: logging
+
+elasticPassword: ""
+fluentbitPassword: ""
+kibanaSystemPassword: ""
+
+clusterName: cloudhost-logs
+
+storage: 50Gi
+
+images:
+  elasticsearch: docker.elastic.co/elasticsearch/elasticsearch:8.12.0
+  kibana: docker.elastic.co/kibana/kibana:8.12.0
+  busybox: busybox:1.36
+  curl: curlimages/curl:8.5.0
+
+elasticsearch:
+  javaOpts: "-Xms1g -Xmx1g"
+  resources:
+    requests:
+      cpu: 500m
+      memory: 2Gi
+    limits:
+      cpu: 2000m
+      memory: 4Gi
+
+kibana:
+  resources:
+    requests:
+      cpu: 50m
+      memory: 384Mi
+    limits:
+      cpu: 500m
+      memory: 768Mi