keyhan
6d9cd89cc5
Document server-side rollout (values, Sealed Secrets, logging, greenfield reset) with environment variables so any cluster can follow the same steps. Co-authored-by: Cursor <cursoragent@cursor.com>
21 lines
1009 B
YAML
21 lines
1009 B
YAML
# Example: seal Elasticsearch stack credentials (namespace logging).
|
|
# Full guide (any environment): RUNBOOK-DEPLOY.fa.md — Phase 4
|
|
# Apply elasticsearch-stack.yaml FIRST (without inline passwords), then create this Secret.
|
|
#
|
|
# kubectl -n logging create secret generic elasticsearch-credentials \
|
|
# --from-literal=ELASTIC_PASSWORD="$(openssl rand -base64 24)" \
|
|
# --from-literal=FLUENTBIT_PASSWORD="$(openssl rand -base64 24)" \
|
|
# --dry-run=client -o json \
|
|
# | kubeseal \
|
|
# --controller-name=sealed-secrets-controller \
|
|
# --controller-namespace=kube-system \
|
|
# --format yaml \
|
|
# > ../cloud-host-gitops/sealed-secrets/elasticsearch-credentials.yaml
|
|
#
|
|
# Backend must receive the same ELASTIC_* values via backend.env in values-abrban.yaml
|
|
# (or a separate SealedSecret referenced with envFrom).
|
|
#
|
|
# After deploy, verify:
|
|
# kubectl -n logging get secret elasticsearch-credentials
|
|
# curl -u elastic:$ELASTIC_PASSWORD https://elasticsearch.logging.svc.cluster.local:9200
|