keyhan
35dd771f63
Deploy cloudhost-logging on cluster registration, ship app and optional service logs to ES with owner isolation, and fix Kibana 8.12 auth via kibana_system. Co-authored-by: Cursor <cursoragent@cursor.com>
97 lines
3.5 KiB
YAML
97 lines
3.5 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: kibana
|
|
namespace: {{ include "cloudhost-logging.namespace" . }}
|
|
labels:
|
|
app: kibana
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: kibana
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: kibana
|
|
spec:
|
|
initContainers:
|
|
- name: setup-kibana-system-user
|
|
image: {{ .Values.images.curl | default "curlimages/curl:8.5.0" }}
|
|
env:
|
|
- name: ELASTIC_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: elasticsearch-credentials
|
|
key: ELASTIC_PASSWORD
|
|
- name: KIBANA_SYSTEM_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: elasticsearch-credentials
|
|
key: KIBANA_SYSTEM_PASSWORD
|
|
command:
|
|
- sh
|
|
- -ec
|
|
- |
|
|
echo "Waiting for Elasticsearch..."
|
|
until curl -sf -u "elastic:${ELASTIC_PASSWORD}" \
|
|
"http://elasticsearch:9200/_cluster/health?wait_for_status=yellow&timeout=60s"; do
|
|
sleep 5
|
|
done
|
|
echo "Setting kibana_system password..."
|
|
HTTP_CODE=$(curl -s -o /tmp/curl-out -w "%{http_code}" -X POST \
|
|
-u "elastic:${ELASTIC_PASSWORD}" \
|
|
"http://elasticsearch:9200/_security/user/kibana_system/_password" \
|
|
-H "Content-Type: application/json" \
|
|
-d "{\"password\":\"${KIBANA_SYSTEM_PASSWORD}\"}")
|
|
if [ "$HTTP_CODE" != "200" ] && [ "$HTTP_CODE" != "201" ]; then
|
|
echo "kibana_system password setup failed (HTTP $HTTP_CODE):"
|
|
cat /tmp/curl-out
|
|
exit 1
|
|
fi
|
|
echo "kibana_system user ready"
|
|
echo "Configuring single-node index settings..."
|
|
curl -sf -X PUT -u "elastic:${ELASTIC_PASSWORD}" \
|
|
"http://elasticsearch:9200/_index_template/single-node-zero-replicas" \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"index_patterns":["*"],"priority":1,"template":{"settings":{"index.number_of_replicas":0}}}'
|
|
curl -sf -X PUT -u "elastic:${ELASTIC_PASSWORD}" \
|
|
"http://elasticsearch:9200/.kibana*/_settings" \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"index":{"number_of_replicas":0}}' || true
|
|
containers:
|
|
- name: kibana
|
|
image: {{ .Values.images.kibana }}
|
|
ports:
|
|
- containerPort: 5601
|
|
env:
|
|
- name: ELASTICSEARCH_HOSTS
|
|
value: http://elasticsearch:9200
|
|
- name: ELASTICSEARCH_USERNAME
|
|
value: kibana_system
|
|
- name: ELASTICSEARCH_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: elasticsearch-credentials
|
|
key: KIBANA_SYSTEM_PASSWORD
|
|
- name: SERVER_NAME
|
|
value: kibana
|
|
- name: XPACK_SECURITY_ENABLED
|
|
value: "true"
|
|
resources:
|
|
{{- toYaml .Values.kibana.resources | nindent 12 }}
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /api/status
|
|
port: 5601
|
|
initialDelaySeconds: 45
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /api/status
|
|
port: 5601
|
|
initialDelaySeconds: 90
|
|
periodSeconds: 30
|
|
timeoutSeconds: 5
|