Add unified logs platform with Helm-managed central Elasticsearch.
Deploy cloudhost-logging on cluster registration, ship app and optional service logs to ES with owner isolation, and fix Kibana 8.12 auth via kibana_system. Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
keyhan
@@ -0,0 +1,6 @@
|
||||
apiVersion: v2
|
||||
name: cloudhost-logging
|
||||
description: CloudHost central logging stack (Elasticsearch + Kibana)
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "8.12.0"
|
||||
@@ -0,0 +1,7 @@
|
||||
{{- define "cloudhost-logging.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "cloudhost-logging.namespace" -}}
|
||||
{{- .Values.namespace | default "logging" }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,17 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: elasticsearch-data
|
||||
namespace: {{ include "cloudhost-logging.namespace" . }}
|
||||
labels:
|
||||
app: elasticsearch
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
annotations:
|
||||
helm.sh/resource-policy: keep
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.storage }}
|
||||
@@ -0,0 +1,18 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: elasticsearch
|
||||
namespace: {{ include "cloudhost-logging.namespace" . }}
|
||||
labels:
|
||||
app: elasticsearch
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: elasticsearch
|
||||
ports:
|
||||
- name: http
|
||||
port: 9200
|
||||
targetPort: 9200
|
||||
- name: transport
|
||||
port: 9300
|
||||
targetPort: 9300
|
||||
@@ -0,0 +1,99 @@
|
||||
{{- $auth := printf "elastic:%s" .Values.elasticPassword | b64enc }}
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: elasticsearch
|
||||
namespace: {{ include "cloudhost-logging.namespace" . }}
|
||||
labels:
|
||||
app: elasticsearch
|
||||
spec:
|
||||
serviceName: elasticsearch
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: elasticsearch
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: elasticsearch
|
||||
spec:
|
||||
securityContext:
|
||||
fsGroup: 1000
|
||||
initContainers:
|
||||
- name: fix-permissions
|
||||
image: {{ .Values.images.busybox }}
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- chown -R 1000:1000 /usr/share/elasticsearch/data
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
privileged: true
|
||||
volumeMounts:
|
||||
- name: es-data
|
||||
mountPath: /usr/share/elasticsearch/data
|
||||
- name: increase-vm-max-map
|
||||
image: {{ .Values.images.busybox }}
|
||||
command:
|
||||
- sysctl
|
||||
- -w
|
||||
- vm.max_map_count=262144
|
||||
securityContext:
|
||||
privileged: true
|
||||
containers:
|
||||
- name: elasticsearch
|
||||
image: {{ .Values.images.elasticsearch }}
|
||||
ports:
|
||||
- containerPort: 9200
|
||||
name: http
|
||||
- containerPort: 9300
|
||||
name: transport
|
||||
env:
|
||||
- name: discovery.type
|
||||
value: single-node
|
||||
- name: xpack.security.enabled
|
||||
value: "true"
|
||||
- name: xpack.security.http.ssl.enabled
|
||||
value: "false"
|
||||
- name: xpack.security.transport.ssl.enabled
|
||||
value: "false"
|
||||
- name: ELASTIC_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: elasticsearch-credentials
|
||||
key: ELASTIC_PASSWORD
|
||||
- name: ES_JAVA_OPTS
|
||||
value: {{ .Values.elasticsearch.javaOpts | quote }}
|
||||
- name: cluster.name
|
||||
value: {{ .Values.clusterName | quote }}
|
||||
- name: bootstrap.memory_lock
|
||||
value: "false"
|
||||
resources:
|
||||
{{- toYaml .Values.elasticsearch.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: es-data
|
||||
mountPath: /usr/share/elasticsearch/data
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /_cluster/health?local=true
|
||||
port: 9200
|
||||
httpHeaders:
|
||||
- name: Authorization
|
||||
value: Basic {{ $auth }}
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /_cluster/health?local=true
|
||||
port: 9200
|
||||
httpHeaders:
|
||||
- name: Authorization
|
||||
value: Basic {{ $auth }}
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 10
|
||||
volumes:
|
||||
- name: es-data
|
||||
persistentVolumeClaim:
|
||||
claimName: elasticsearch-data
|
||||
@@ -0,0 +1,96 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: kibana
|
||||
namespace: {{ include "cloudhost-logging.namespace" . }}
|
||||
labels:
|
||||
app: kibana
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: kibana
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: kibana
|
||||
spec:
|
||||
initContainers:
|
||||
- name: setup-kibana-system-user
|
||||
image: {{ .Values.images.curl | default "curlimages/curl:8.5.0" }}
|
||||
env:
|
||||
- name: ELASTIC_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: elasticsearch-credentials
|
||||
key: ELASTIC_PASSWORD
|
||||
- name: KIBANA_SYSTEM_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: elasticsearch-credentials
|
||||
key: KIBANA_SYSTEM_PASSWORD
|
||||
command:
|
||||
- sh
|
||||
- -ec
|
||||
- |
|
||||
echo "Waiting for Elasticsearch..."
|
||||
until curl -sf -u "elastic:${ELASTIC_PASSWORD}" \
|
||||
"http://elasticsearch:9200/_cluster/health?wait_for_status=yellow&timeout=60s"; do
|
||||
sleep 5
|
||||
done
|
||||
echo "Setting kibana_system password..."
|
||||
HTTP_CODE=$(curl -s -o /tmp/curl-out -w "%{http_code}" -X POST \
|
||||
-u "elastic:${ELASTIC_PASSWORD}" \
|
||||
"http://elasticsearch:9200/_security/user/kibana_system/_password" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "{\"password\":\"${KIBANA_SYSTEM_PASSWORD}\"}")
|
||||
if [ "$HTTP_CODE" != "200" ] && [ "$HTTP_CODE" != "201" ]; then
|
||||
echo "kibana_system password setup failed (HTTP $HTTP_CODE):"
|
||||
cat /tmp/curl-out
|
||||
exit 1
|
||||
fi
|
||||
echo "kibana_system user ready"
|
||||
echo "Configuring single-node index settings..."
|
||||
curl -sf -X PUT -u "elastic:${ELASTIC_PASSWORD}" \
|
||||
"http://elasticsearch:9200/_index_template/single-node-zero-replicas" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"index_patterns":["*"],"priority":1,"template":{"settings":{"index.number_of_replicas":0}}}'
|
||||
curl -sf -X PUT -u "elastic:${ELASTIC_PASSWORD}" \
|
||||
"http://elasticsearch:9200/.kibana*/_settings" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"index":{"number_of_replicas":0}}' || true
|
||||
containers:
|
||||
- name: kibana
|
||||
image: {{ .Values.images.kibana }}
|
||||
ports:
|
||||
- containerPort: 5601
|
||||
env:
|
||||
- name: ELASTICSEARCH_HOSTS
|
||||
value: http://elasticsearch:9200
|
||||
- name: ELASTICSEARCH_USERNAME
|
||||
value: kibana_system
|
||||
- name: ELASTICSEARCH_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: elasticsearch-credentials
|
||||
key: KIBANA_SYSTEM_PASSWORD
|
||||
- name: SERVER_NAME
|
||||
value: kibana
|
||||
- name: XPACK_SECURITY_ENABLED
|
||||
value: "true"
|
||||
resources:
|
||||
{{- toYaml .Values.kibana.resources | nindent 12 }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /api/status
|
||||
port: 5601
|
||||
initialDelaySeconds: 45
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /api/status
|
||||
port: 5601
|
||||
initialDelaySeconds: 90
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 5
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: kibana
|
||||
namespace: {{ include "cloudhost-logging.namespace" . }}
|
||||
labels:
|
||||
app: kibana
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: kibana
|
||||
ports:
|
||||
- port: 5601
|
||||
targetPort: 5601
|
||||
@@ -0,0 +1,7 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: {{ include "cloudhost-logging.namespace" . }}
|
||||
labels:
|
||||
app.kubernetes.io/managed-by: cloudhost
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
@@ -0,0 +1,13 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: elasticsearch-credentials
|
||||
namespace: {{ include "cloudhost-logging.namespace" . }}
|
||||
labels:
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
type: Opaque
|
||||
stringData:
|
||||
ELASTIC_PASSWORD: {{ required "elasticPassword is required" .Values.elasticPassword | quote }}
|
||||
FLUENTBIT_PASSWORD: {{ required "fluentbitPassword is required" .Values.fluentbitPassword | quote }}
|
||||
KIBANA_SYSTEM_PASSWORD: {{ required "kibanaSystemPassword is required" .Values.kibanaSystemPassword | quote }}
|
||||
@@ -0,0 +1,34 @@
|
||||
namespace: logging
|
||||
|
||||
elasticPassword: ""
|
||||
fluentbitPassword: ""
|
||||
kibanaSystemPassword: ""
|
||||
|
||||
clusterName: cloudhost-logs
|
||||
|
||||
storage: 50Gi
|
||||
|
||||
images:
|
||||
elasticsearch: docker.elastic.co/elasticsearch/elasticsearch:8.12.0
|
||||
kibana: docker.elastic.co/kibana/kibana:8.12.0
|
||||
busybox: busybox:1.36
|
||||
curl: curlimages/curl:8.5.0
|
||||
|
||||
elasticsearch:
|
||||
javaOpts: "-Xms1g -Xmx1g"
|
||||
resources:
|
||||
requests:
|
||||
cpu: 500m
|
||||
memory: 2Gi
|
||||
limits:
|
||||
cpu: 2000m
|
||||
memory: 4Gi
|
||||
|
||||
kibana:
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 384Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 768Mi
|
||||
Reference in New Issue
Block a user