keyhan
35dd771f63
Deploy cloudhost-logging on cluster registration, ship app and optional service logs to ES with owner isolation, and fix Kibana 8.12 auth via kibana_system. Co-authored-by: Cursor <cursoragent@cursor.com>
100 lines
3.0 KiB
YAML
100 lines
3.0 KiB
YAML
{{- $auth := printf "elastic:%s" .Values.elasticPassword | b64enc }}
|
|
apiVersion: apps/v1
|
|
kind: StatefulSet
|
|
metadata:
|
|
name: elasticsearch
|
|
namespace: {{ include "cloudhost-logging.namespace" . }}
|
|
labels:
|
|
app: elasticsearch
|
|
spec:
|
|
serviceName: elasticsearch
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: elasticsearch
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: elasticsearch
|
|
spec:
|
|
securityContext:
|
|
fsGroup: 1000
|
|
initContainers:
|
|
- name: fix-permissions
|
|
image: {{ .Values.images.busybox }}
|
|
command:
|
|
- sh
|
|
- -c
|
|
- chown -R 1000:1000 /usr/share/elasticsearch/data
|
|
securityContext:
|
|
runAsUser: 0
|
|
privileged: true
|
|
volumeMounts:
|
|
- name: es-data
|
|
mountPath: /usr/share/elasticsearch/data
|
|
- name: increase-vm-max-map
|
|
image: {{ .Values.images.busybox }}
|
|
command:
|
|
- sysctl
|
|
- -w
|
|
- vm.max_map_count=262144
|
|
securityContext:
|
|
privileged: true
|
|
containers:
|
|
- name: elasticsearch
|
|
image: {{ .Values.images.elasticsearch }}
|
|
ports:
|
|
- containerPort: 9200
|
|
name: http
|
|
- containerPort: 9300
|
|
name: transport
|
|
env:
|
|
- name: discovery.type
|
|
value: single-node
|
|
- name: xpack.security.enabled
|
|
value: "true"
|
|
- name: xpack.security.http.ssl.enabled
|
|
value: "false"
|
|
- name: xpack.security.transport.ssl.enabled
|
|
value: "false"
|
|
- name: ELASTIC_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: elasticsearch-credentials
|
|
key: ELASTIC_PASSWORD
|
|
- name: ES_JAVA_OPTS
|
|
value: {{ .Values.elasticsearch.javaOpts | quote }}
|
|
- name: cluster.name
|
|
value: {{ .Values.clusterName | quote }}
|
|
- name: bootstrap.memory_lock
|
|
value: "false"
|
|
resources:
|
|
{{- toYaml .Values.elasticsearch.resources | nindent 12 }}
|
|
volumeMounts:
|
|
- name: es-data
|
|
mountPath: /usr/share/elasticsearch/data
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /_cluster/health?local=true
|
|
port: 9200
|
|
httpHeaders:
|
|
- name: Authorization
|
|
value: Basic {{ $auth }}
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /_cluster/health?local=true
|
|
port: 9200
|
|
httpHeaders:
|
|
- name: Authorization
|
|
value: Basic {{ $auth }}
|
|
initialDelaySeconds: 60
|
|
periodSeconds: 30
|
|
timeoutSeconds: 10
|
|
volumes:
|
|
- name: es-data
|
|
persistentVolumeClaim:
|
|
claimName: elasticsearch-data
|