fix(logging): use ELASTIC_PASSWORD env in ES health probes

Hardcoded Basic auth in probes broke after password rotation; exec probes
read the live secret so Elasticsearch stays healthy when credentials change.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/helm/cloudhost-logging/templates/elasticsearch-statefulset.yaml

@@ -1,4 +1,3 @@
-{{- $auth := printf "elastic:%s" .Values.elasticPassword | b64enc }}
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
@@ -74,22 +73,20 @@ spec:
             - name: es-data
               mountPath: /usr/share/elasticsearch/data
           readinessProbe:
-            httpGet:
+            exec:
-              path: /_cluster/health?local=true
+              command:
-              port: 9200
+                - sh
-              httpHeaders:
+                - -c
-                - name: Authorization
+                - curl -sf -u "elastic:${ELASTIC_PASSWORD}" http://127.0.0.1:9200/_cluster/health?local=true
-                  value: Basic {{ $auth }}
             initialDelaySeconds: 30
             periodSeconds: 10
             timeoutSeconds: 5
           livenessProbe:
-            httpGet:
+            exec:
-              path: /_cluster/health?local=true
+              command:
-              port: 9200
+                - sh
-              httpHeaders:
+                - -c
-                - name: Authorization
+                - curl -sf -u "elastic:${ELASTIC_PASSWORD}" http://127.0.0.1:9200/_cluster/health?local=true
-                  value: Basic {{ $auth }}
             initialDelaySeconds: 60
             periodSeconds: 30
             timeoutSeconds: 10

backend/k8s/logging/elasticsearch-stack.yaml

@@ -181,24 +181,20 @@ spec:
             - name: data
               mountPath: /usr/share/elasticsearch/data
           readinessProbe:
-            httpGet:
+            exec:
-              path: /_cluster/health?local=true
+              command:
-              port: 9200
+                - sh
-              scheme: HTTP
+                - -c
-              httpHeaders:
+                - curl -sf -u "elastic:${ELASTIC_PASSWORD}" http://127.0.0.1:9200/_cluster/health?local=true
-                - name: Authorization
-                  value: "Basic ZWxhc3RpYzpDbG91ZEhvc3QyMDI0IVNlY3VyZQ=="
             initialDelaySeconds: 30
             periodSeconds: 10
             timeoutSeconds: 5
           livenessProbe:
-            httpGet:
+            exec:
-              path: /_cluster/health?local=true
+              command:
-              port: 9200
+                - sh
-              scheme: HTTP
+                - -c
-              httpHeaders:
+                - curl -sf -u "elastic:${ELASTIC_PASSWORD}" http://127.0.0.1:9200/_cluster/health?local=true
-                - name: Authorization
-                  value: "Basic ZWxhc3RpYzpDbG91ZEhvc3QyMDI0IVNlY3VyZQ=="
             initialDelaySeconds: 60
             periodSeconds: 30
             timeoutSeconds: 10