keyhan
b2ecdad53b
Build and Deploy Platform / build-and-deploy (push) Failing after 30m14s
Hardcoded Basic auth in probes broke after password rotation; exec probes read the live secret so Elasticsearch stays healthy when credentials change. Co-authored-by: Cursor <cursoragent@cursor.com>
97 lines
2.9 KiB
YAML
97 lines
2.9 KiB
YAML
apiVersion: apps/v1
|
|
kind: StatefulSet
|
|
metadata:
|
|
name: elasticsearch
|
|
namespace: {{ include "cloudhost-logging.namespace" . }}
|
|
labels:
|
|
app: elasticsearch
|
|
spec:
|
|
serviceName: elasticsearch
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: elasticsearch
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: elasticsearch
|
|
spec:
|
|
securityContext:
|
|
fsGroup: 1000
|
|
initContainers:
|
|
- name: fix-permissions
|
|
image: {{ .Values.images.busybox }}
|
|
command:
|
|
- sh
|
|
- -c
|
|
- chown -R 1000:1000 /usr/share/elasticsearch/data
|
|
securityContext:
|
|
runAsUser: 0
|
|
privileged: true
|
|
volumeMounts:
|
|
- name: es-data
|
|
mountPath: /usr/share/elasticsearch/data
|
|
- name: increase-vm-max-map
|
|
image: {{ .Values.images.busybox }}
|
|
command:
|
|
- sysctl
|
|
- -w
|
|
- vm.max_map_count=262144
|
|
securityContext:
|
|
privileged: true
|
|
containers:
|
|
- name: elasticsearch
|
|
image: {{ .Values.images.elasticsearch }}
|
|
ports:
|
|
- containerPort: 9200
|
|
name: http
|
|
- containerPort: 9300
|
|
name: transport
|
|
env:
|
|
- name: discovery.type
|
|
value: single-node
|
|
- name: xpack.security.enabled
|
|
value: "true"
|
|
- name: xpack.security.http.ssl.enabled
|
|
value: "false"
|
|
- name: xpack.security.transport.ssl.enabled
|
|
value: "false"
|
|
- name: ELASTIC_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: elasticsearch-credentials
|
|
key: ELASTIC_PASSWORD
|
|
- name: ES_JAVA_OPTS
|
|
value: {{ .Values.elasticsearch.javaOpts | quote }}
|
|
- name: cluster.name
|
|
value: {{ .Values.clusterName | quote }}
|
|
- name: bootstrap.memory_lock
|
|
value: "false"
|
|
resources:
|
|
{{- toYaml .Values.elasticsearch.resources | nindent 12 }}
|
|
volumeMounts:
|
|
- name: es-data
|
|
mountPath: /usr/share/elasticsearch/data
|
|
readinessProbe:
|
|
exec:
|
|
command:
|
|
- sh
|
|
- -c
|
|
- curl -sf -u "elastic:${ELASTIC_PASSWORD}" http://127.0.0.1:9200/_cluster/health?local=true
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
livenessProbe:
|
|
exec:
|
|
command:
|
|
- sh
|
|
- -c
|
|
- curl -sf -u "elastic:${ELASTIC_PASSWORD}" http://127.0.0.1:9200/_cluster/health?local=true
|
|
initialDelaySeconds: 60
|
|
periodSeconds: 30
|
|
timeoutSeconds: 10
|
|
volumes:
|
|
- name: es-data
|
|
persistentVolumeClaim:
|
|
claimName: elasticsearch-data
|