From b2ecdad53ba9b5efbad212ae3f8c9ad30df35542 Mon Sep 17 00:00:00 2001 From: keyhan Date: Fri, 3 Jul 2026 19:41:19 +0330 Subject: [PATCH] fix(logging): use ELASTIC_PASSWORD env in ES health probes Hardcoded Basic auth in probes broke after password rotation; exec probes read the live secret so Elasticsearch stays healthy when credentials change. Co-authored-by: Cursor --- .../templates/elasticsearch-statefulset.yaml | 23 ++++++++---------- backend/k8s/logging/elasticsearch-stack.yaml | 24 ++++++++----------- 2 files changed, 20 insertions(+), 27 deletions(-) diff --git a/backend/helm/cloudhost-logging/templates/elasticsearch-statefulset.yaml b/backend/helm/cloudhost-logging/templates/elasticsearch-statefulset.yaml index 99ccee3..6e6132f 100644 --- a/backend/helm/cloudhost-logging/templates/elasticsearch-statefulset.yaml +++ b/backend/helm/cloudhost-logging/templates/elasticsearch-statefulset.yaml @@ -1,4 +1,3 @@ -{{- $auth := printf "elastic:%s" .Values.elasticPassword | b64enc }} apiVersion: apps/v1 kind: StatefulSet metadata: @@ -74,22 +73,20 @@ spec: - name: es-data mountPath: /usr/share/elasticsearch/data readinessProbe: - httpGet: - path: /_cluster/health?local=true - port: 9200 - httpHeaders: - - name: Authorization - value: Basic {{ $auth }} + exec: + command: + - sh + - -c + - curl -sf -u "elastic:${ELASTIC_PASSWORD}" http://127.0.0.1:9200/_cluster/health?local=true initialDelaySeconds: 30 periodSeconds: 10 timeoutSeconds: 5 livenessProbe: - httpGet: - path: /_cluster/health?local=true - port: 9200 - httpHeaders: - - name: Authorization - value: Basic {{ $auth }} + exec: + command: + - sh + - -c + - curl -sf -u "elastic:${ELASTIC_PASSWORD}" http://127.0.0.1:9200/_cluster/health?local=true initialDelaySeconds: 60 periodSeconds: 30 timeoutSeconds: 10 diff --git a/backend/k8s/logging/elasticsearch-stack.yaml b/backend/k8s/logging/elasticsearch-stack.yaml index cb8c3d8..8569642 100644 --- a/backend/k8s/logging/elasticsearch-stack.yaml +++ b/backend/k8s/logging/elasticsearch-stack.yaml @@ -181,24 +181,20 @@ spec: - name: data mountPath: /usr/share/elasticsearch/data readinessProbe: - httpGet: - path: /_cluster/health?local=true - port: 9200 - scheme: HTTP - httpHeaders: - - name: Authorization - value: "Basic ZWxhc3RpYzpDbG91ZEhvc3QyMDI0IVNlY3VyZQ==" + exec: + command: + - sh + - -c + - curl -sf -u "elastic:${ELASTIC_PASSWORD}" http://127.0.0.1:9200/_cluster/health?local=true initialDelaySeconds: 30 periodSeconds: 10 timeoutSeconds: 5 livenessProbe: - httpGet: - path: /_cluster/health?local=true - port: 9200 - scheme: HTTP - httpHeaders: - - name: Authorization - value: "Basic ZWxhc3RpYzpDbG91ZEhvc3QyMDI0IVNlY3VyZQ==" + exec: + command: + - sh + - -c + - curl -sf -u "elastic:${ELASTIC_PASSWORD}" http://127.0.0.1:9200/_cluster/health?local=true initialDelaySeconds: 60 periodSeconds: 30 timeoutSeconds: 10