Add unified logs platform with Helm-managed central Elasticsearch.

Deploy cloudhost-logging on cluster registration, ship app and optional service logs to ES with owner isolation, and fix Kibana 8.12 auth via kibana_system. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-15 15:56:33 +03:30
parent 2303985d0c
commit 35dd771f63
31 changed files with 1657 additions and 938 deletions
@@ -0,0 +1,96 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kibana
+  namespace: {{ include "cloudhost-logging.namespace" . }}
+  labels:
+    app: kibana
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: kibana
+  template:
+    metadata:
+      labels:
+        app: kibana
+    spec:
+      initContainers:
+        - name: setup-kibana-system-user
+          image: {{ .Values.images.curl | default "curlimages/curl:8.5.0" }}
+          env:
+            - name: ELASTIC_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: elasticsearch-credentials
+                  key: ELASTIC_PASSWORD
+            - name: KIBANA_SYSTEM_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: elasticsearch-credentials
+                  key: KIBANA_SYSTEM_PASSWORD
+          command:
+            - sh
+            - -ec
+            - |
+              echo "Waiting for Elasticsearch..."
+              until curl -sf -u "elastic:${ELASTIC_PASSWORD}" \
+                "http://elasticsearch:9200/_cluster/health?wait_for_status=yellow&timeout=60s"; do
+                sleep 5
+              done
+              echo "Setting kibana_system password..."
+              HTTP_CODE=$(curl -s -o /tmp/curl-out -w "%{http_code}" -X POST \
+                -u "elastic:${ELASTIC_PASSWORD}" \
+                "http://elasticsearch:9200/_security/user/kibana_system/_password" \
+                -H "Content-Type: application/json" \
+                -d "{\"password\":\"${KIBANA_SYSTEM_PASSWORD}\"}")
+              if [ "$HTTP_CODE" != "200" ] && [ "$HTTP_CODE" != "201" ]; then
+                echo "kibana_system password setup failed (HTTP $HTTP_CODE):"
+                cat /tmp/curl-out
+                exit 1
+              fi
+              echo "kibana_system user ready"
+              echo "Configuring single-node index settings..."
+              curl -sf -X PUT -u "elastic:${ELASTIC_PASSWORD}" \
+                "http://elasticsearch:9200/_index_template/single-node-zero-replicas" \
+                -H "Content-Type: application/json" \
+                -d '{"index_patterns":["*"],"priority":1,"template":{"settings":{"index.number_of_replicas":0}}}'
+              curl -sf -X PUT -u "elastic:${ELASTIC_PASSWORD}" \
+                "http://elasticsearch:9200/.kibana*/_settings" \
+                -H "Content-Type: application/json" \
+                -d '{"index":{"number_of_replicas":0}}' || true
+      containers:
+        - name: kibana
+          image: {{ .Values.images.kibana }}
+          ports:
+            - containerPort: 5601
+          env:
+            - name: ELASTICSEARCH_HOSTS
+              value: http://elasticsearch:9200
+            - name: ELASTICSEARCH_USERNAME
+              value: kibana_system
+            - name: ELASTICSEARCH_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: elasticsearch-credentials
+                  key: KIBANA_SYSTEM_PASSWORD
+            - name: SERVER_NAME
+              value: kibana
+            - name: XPACK_SECURITY_ENABLED
+              value: "true"
+          resources:
+            {{- toYaml .Values.kibana.resources | nindent 12 }}
+          readinessProbe:
+            httpGet:
+              path: /api/status
+              port: 5601
+            initialDelaySeconds: 45
+            periodSeconds: 10
+            timeoutSeconds: 5
+          livenessProbe:
+            httpGet:
+              path: /api/status
+              port: 5601
+            initialDelaySeconds: 90
+            periodSeconds: 30
+            timeoutSeconds: 5