From beae59543cef64dc825d971ea7c532735034c06c Mon Sep 17 00:00:00 2001 From: Mosiur Rahman Date: Thu, 13 Aug 2026 07:38:55 +0000 Subject: [PATCH] Convert helm-charts-observability to regular directory --- helm-charts-observability | 1 - helm-charts-observability/.github/CODEOWNERS | 2 + .../.github/ISSUE_TEMPLATE/bug_template.md | 34 + .../.github/ISSUE_TEMPLATE/feature_request.md | 20 + .../.github/PULL_REQUEST_TEMPLATE.md | 15 + .../.github/workflows/add-untriaged.yml | 22 + .../.github/workflows/github-merit-badger.yml | 21 + .../.github/workflows/lint-test.yaml | 51 ++ .../.github/workflows/release.yaml | 42 + helm-charts-observability/.gitignore | 5 + helm-charts-observability/.whitesource | 22 + helm-charts-observability/ADMINS.md | 7 + helm-charts-observability/CODE_OF_CONDUCT.md | 22 + helm-charts-observability/CONTRIBUTING.md | 21 + helm-charts-observability/DEVELOPER_GUIDE.md | 15 + helm-charts-observability/LICENSE.txt | 175 +++++ helm-charts-observability/MAINTAINERS.md | 19 + helm-charts-observability/NOTICE.txt | 2 + helm-charts-observability/README.md | 116 +++ helm-charts-observability/charts/README.md | 0 .../charts/data-prepper/.helmignore | 23 + .../charts/data-prepper/CHANGELOG.md | 22 + .../charts/data-prepper/Chart.yaml | 50 ++ .../charts/data-prepper/README.md | 130 ++++ .../charts/data-prepper/README.md.gotmpl | 71 ++ .../data-prepper/certificate_renew_sop.md | 23 + .../data-prepper/cpanel_path_structure.txt | 126 +++ .../charts/data-prepper/prepper-ingress.yaml | 17 + .../data-prepper/prerequisit_inforamtion.md | 160 ++++ .../charts/data-prepper/template.yaml | 226 ++++++ .../charts/data-prepper/templates/NOTES.txt | 30 + .../data-prepper/templates/_helpers.tpl | 95 +++ .../data-prepper/templates/configmap.yaml | 15 + .../data-prepper/templates/demoPipeline.yaml | 25 + .../data-prepper/templates/deployment.yaml | 118 +++ .../charts/data-prepper/templates/hpa.yaml | 32 + .../data-prepper/templates/ingress.yaml | 61 ++ .../charts/data-prepper/templates/secret.yaml | 12 + .../data-prepper/templates/service.yaml | 17 + .../templates/serviceaccount.yaml | 13 + .../charts/data-prepper/values.yaml | 360 +++++++++ .../charts/opensearch-dashboards/.helmignore | 23 + .../charts/opensearch-dashboards/CHANGELOG.md | 117 +++ .../charts/opensearch-dashboards/Chart.yaml | 31 + .../charts/opensearch-dashboards/README.md | 141 ++++ .../kibanaserver-pass.yaml | 7 + .../opensearch-ca-public-key.yaml | 7 + .../opensearch-dashbaord-ingress.yaml | 26 + .../opensearch-dashboard-rendered-output.yaml | 155 ++++ .../opensearch-dashboards/templates/NOTES.txt | 22 + .../templates/_helpers.tpl | 103 +++ .../templates/autoscaler.yaml | 43 ++ .../templates/configmap.yaml | 16 + .../templates/deployment.yaml | 218 ++++++ .../templates/extraManifests.yaml | 8 + .../templates/ingress.yaml | 72 ++ .../templates/rolebinding.yaml | 15 + .../templates/service.yaml | 43 ++ .../templates/serviceMonitor.yaml | 20 + .../templates/serviceaccount.yaml | 16 + .../charts/opensearch-dashboards/values.yaml | 334 ++++++++ .../charts/opensearch/.helmignore | 23 + .../charts/opensearch/CHANGELOG.md | 127 ++++ .../charts/opensearch/Chart.yaml | 36 + .../charts/opensearch/README.md | 172 +++++ .../ci/ci-ingress-class-name-values.yaml | 442 +++++++++++ .../opensearch/ci/ci-rbac-enabled-values.yaml | 442 +++++++++++ .../charts/opensearch/ci/ci-values.yaml | 428 +++++++++++ .../charts/opensearch/internal_users.yaml | 11 + .../opensearch/opensearch-admin-cert.yaml | 9 + .../opensearch/opensearch-node-0-cert.yaml | 9 + .../opensearch/opensearch-node-1-cert.yaml | 9 + .../opensearch/opensearch-node-2-cert.yaml | 9 + .../charts/opensearch/opensearch-secret.yaml | 7 + .../opensearch/opensearch-template.yaml | 454 +++++++++++ .../charts/opensearch/templates/NOTES.txt | 2 + .../charts/opensearch/templates/_helpers.tpl | 144 ++++ .../opensearch/templates/configmap.yaml | 18 + .../opensearch/templates/extraManifests.yaml | 8 + .../charts/opensearch/templates/ingress.yaml | 65 ++ .../opensearch/templates/networkpolicy.yaml | 17 + .../templates/poddisruptionbudget.yaml | 17 + .../templates/podsecuritypolicy.yaml | 17 + .../charts/opensearch/templates/role.yaml | 22 + .../opensearch/templates/rolebinding.yaml | 21 + .../opensearch/templates/securityconfig.yaml | 19 + .../charts/opensearch/templates/service.yaml | 75 ++ .../templates/serviceMonitor-secret.yaml | 15 + .../opensearch/templates/serviceMonitor.yaml | 42 + .../opensearch/templates/serviceaccount.yaml | 17 + .../opensearch/templates/statefulset.yaml | 595 +++++++++++++++ .../charts/opensearch/values.yaml | 719 ++++++++++++++++++ helm-charts-observability/ct.yaml | 3 + 93 files changed, 7648 insertions(+), 1 deletion(-) delete mode 160000 helm-charts-observability create mode 100644 helm-charts-observability/.github/CODEOWNERS create mode 100644 helm-charts-observability/.github/ISSUE_TEMPLATE/bug_template.md create mode 100644 helm-charts-observability/.github/ISSUE_TEMPLATE/feature_request.md create mode 100644 helm-charts-observability/.github/PULL_REQUEST_TEMPLATE.md create mode 100644 helm-charts-observability/.github/workflows/add-untriaged.yml create mode 100644 helm-charts-observability/.github/workflows/github-merit-badger.yml create mode 100644 helm-charts-observability/.github/workflows/lint-test.yaml create mode 100644 helm-charts-observability/.github/workflows/release.yaml create mode 100644 helm-charts-observability/.gitignore create mode 100644 helm-charts-observability/.whitesource create mode 100644 helm-charts-observability/ADMINS.md create mode 100644 helm-charts-observability/CODE_OF_CONDUCT.md create mode 100644 helm-charts-observability/CONTRIBUTING.md create mode 100644 helm-charts-observability/DEVELOPER_GUIDE.md create mode 100644 helm-charts-observability/LICENSE.txt create mode 100644 helm-charts-observability/MAINTAINERS.md create mode 100644 helm-charts-observability/NOTICE.txt create mode 100644 helm-charts-observability/README.md create mode 100644 helm-charts-observability/charts/README.md create mode 100644 helm-charts-observability/charts/data-prepper/.helmignore create mode 100644 helm-charts-observability/charts/data-prepper/CHANGELOG.md create mode 100644 helm-charts-observability/charts/data-prepper/Chart.yaml create mode 100644 helm-charts-observability/charts/data-prepper/README.md create mode 100644 helm-charts-observability/charts/data-prepper/README.md.gotmpl create mode 100644 helm-charts-observability/charts/data-prepper/certificate_renew_sop.md create mode 100644 helm-charts-observability/charts/data-prepper/cpanel_path_structure.txt create mode 100644 helm-charts-observability/charts/data-prepper/prepper-ingress.yaml create mode 100644 helm-charts-observability/charts/data-prepper/prerequisit_inforamtion.md create mode 100644 helm-charts-observability/charts/data-prepper/template.yaml create mode 100644 helm-charts-observability/charts/data-prepper/templates/NOTES.txt create mode 100644 helm-charts-observability/charts/data-prepper/templates/_helpers.tpl create mode 100644 helm-charts-observability/charts/data-prepper/templates/configmap.yaml create mode 100644 helm-charts-observability/charts/data-prepper/templates/demoPipeline.yaml create mode 100644 helm-charts-observability/charts/data-prepper/templates/deployment.yaml create mode 100644 helm-charts-observability/charts/data-prepper/templates/hpa.yaml create mode 100644 helm-charts-observability/charts/data-prepper/templates/ingress.yaml create mode 100644 helm-charts-observability/charts/data-prepper/templates/secret.yaml create mode 100644 helm-charts-observability/charts/data-prepper/templates/service.yaml create mode 100644 helm-charts-observability/charts/data-prepper/templates/serviceaccount.yaml create mode 100644 helm-charts-observability/charts/data-prepper/values.yaml create mode 100644 helm-charts-observability/charts/opensearch-dashboards/.helmignore create mode 100644 helm-charts-observability/charts/opensearch-dashboards/CHANGELOG.md create mode 100644 helm-charts-observability/charts/opensearch-dashboards/Chart.yaml create mode 100644 helm-charts-observability/charts/opensearch-dashboards/README.md create mode 100644 helm-charts-observability/charts/opensearch-dashboards/kibanaserver-pass.yaml create mode 100644 helm-charts-observability/charts/opensearch-dashboards/opensearch-ca-public-key.yaml create mode 100644 helm-charts-observability/charts/opensearch-dashboards/opensearch-dashbaord-ingress.yaml create mode 100644 helm-charts-observability/charts/opensearch-dashboards/opensearch-dashboard-rendered-output.yaml create mode 100644 helm-charts-observability/charts/opensearch-dashboards/templates/NOTES.txt create mode 100644 helm-charts-observability/charts/opensearch-dashboards/templates/_helpers.tpl create mode 100644 helm-charts-observability/charts/opensearch-dashboards/templates/autoscaler.yaml create mode 100644 helm-charts-observability/charts/opensearch-dashboards/templates/configmap.yaml create mode 100644 helm-charts-observability/charts/opensearch-dashboards/templates/deployment.yaml create mode 100644 helm-charts-observability/charts/opensearch-dashboards/templates/extraManifests.yaml create mode 100644 helm-charts-observability/charts/opensearch-dashboards/templates/ingress.yaml create mode 100644 helm-charts-observability/charts/opensearch-dashboards/templates/rolebinding.yaml create mode 100644 helm-charts-observability/charts/opensearch-dashboards/templates/service.yaml create mode 100644 helm-charts-observability/charts/opensearch-dashboards/templates/serviceMonitor.yaml create mode 100644 helm-charts-observability/charts/opensearch-dashboards/templates/serviceaccount.yaml create mode 100644 helm-charts-observability/charts/opensearch-dashboards/values.yaml create mode 100644 helm-charts-observability/charts/opensearch/.helmignore create mode 100644 helm-charts-observability/charts/opensearch/CHANGELOG.md create mode 100644 helm-charts-observability/charts/opensearch/Chart.yaml create mode 100644 helm-charts-observability/charts/opensearch/README.md create mode 100644 helm-charts-observability/charts/opensearch/ci/ci-ingress-class-name-values.yaml create mode 100755 helm-charts-observability/charts/opensearch/ci/ci-rbac-enabled-values.yaml create mode 100755 helm-charts-observability/charts/opensearch/ci/ci-values.yaml create mode 100644 helm-charts-observability/charts/opensearch/internal_users.yaml create mode 100644 helm-charts-observability/charts/opensearch/opensearch-admin-cert.yaml create mode 100644 helm-charts-observability/charts/opensearch/opensearch-node-0-cert.yaml create mode 100644 helm-charts-observability/charts/opensearch/opensearch-node-1-cert.yaml create mode 100644 helm-charts-observability/charts/opensearch/opensearch-node-2-cert.yaml create mode 100644 helm-charts-observability/charts/opensearch/opensearch-secret.yaml create mode 100644 helm-charts-observability/charts/opensearch/opensearch-template.yaml create mode 100755 helm-charts-observability/charts/opensearch/templates/NOTES.txt create mode 100755 helm-charts-observability/charts/opensearch/templates/_helpers.tpl create mode 100644 helm-charts-observability/charts/opensearch/templates/configmap.yaml create mode 100644 helm-charts-observability/charts/opensearch/templates/extraManifests.yaml create mode 100644 helm-charts-observability/charts/opensearch/templates/ingress.yaml create mode 100644 helm-charts-observability/charts/opensearch/templates/networkpolicy.yaml create mode 100644 helm-charts-observability/charts/opensearch/templates/poddisruptionbudget.yaml create mode 100644 helm-charts-observability/charts/opensearch/templates/podsecuritypolicy.yaml create mode 100644 helm-charts-observability/charts/opensearch/templates/role.yaml create mode 100644 helm-charts-observability/charts/opensearch/templates/rolebinding.yaml create mode 100644 helm-charts-observability/charts/opensearch/templates/securityconfig.yaml create mode 100644 helm-charts-observability/charts/opensearch/templates/service.yaml create mode 100644 helm-charts-observability/charts/opensearch/templates/serviceMonitor-secret.yaml create mode 100644 helm-charts-observability/charts/opensearch/templates/serviceMonitor.yaml create mode 100644 helm-charts-observability/charts/opensearch/templates/serviceaccount.yaml create mode 100644 helm-charts-observability/charts/opensearch/templates/statefulset.yaml create mode 100644 helm-charts-observability/charts/opensearch/values.yaml create mode 100644 helm-charts-observability/ct.yaml diff --git a/helm-charts-observability b/helm-charts-observability deleted file mode 160000 index db3e0fb..0000000 --- a/helm-charts-observability +++ /dev/null @@ -1 +0,0 @@ -Subproject commit db3e0fb4a39aca283d73c0dbefa21b9b57b19243 diff --git a/helm-charts-observability/.github/CODEOWNERS b/helm-charts-observability/.github/CODEOWNERS new file mode 100644 index 0000000..4f1a561 --- /dev/null +++ b/helm-charts-observability/.github/CODEOWNERS @@ -0,0 +1,2 @@ +# This should match the owning team set up in https://github.com/orgs/opensearch-project/teams +* @TheAlgo @DandyDeveloper @peterzhuamazon @prudhvigodithi @gaiksaya diff --git a/helm-charts-observability/.github/ISSUE_TEMPLATE/bug_template.md b/helm-charts-observability/.github/ISSUE_TEMPLATE/bug_template.md new file mode 100644 index 0000000..eda2403 --- /dev/null +++ b/helm-charts-observability/.github/ISSUE_TEMPLATE/bug_template.md @@ -0,0 +1,34 @@ +--- +name: Bug report +about: Create a report to help us improve +title: "[BUG][Chart Name]" +labels: 'bug, untriaged' +assignees: '' +--- + +**Describe the bug** +A clear and concise description of what the bug is. + +**To Reproduce** +Steps to reproduce the behavior: +1. Go to '...' +2. Click on '....' +3. Scroll down to '....' +4. See error + +**Expected behavior** +A clear and concise description of what you expected to happen. + +**Chart Name** +Specify the Chart which is affected? + +**Screenshots** +If applicable, add screenshots to help explain your problem. + +**Host/Environment (please complete the following information):** + - Helm Version: [e.g. 3.x.x] + - Kubernetes Version: [e.g. 1.16.x] + +**Additional context** +Add any other context about the problem here. + diff --git a/helm-charts-observability/.github/ISSUE_TEMPLATE/feature_request.md b/helm-charts-observability/.github/ISSUE_TEMPLATE/feature_request.md new file mode 100644 index 0000000..f45a99a --- /dev/null +++ b/helm-charts-observability/.github/ISSUE_TEMPLATE/feature_request.md @@ -0,0 +1,20 @@ +--- +name: Feature request +about: Suggest an idea for this project +title: '[Enhancement][Chart Name]' +labels: 'enhancement, untriaged' +assignees: '' +--- + +**Is your feature request related to a problem? Please describe.** +A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] + +**Describe the solution you'd like** +A clear and concise description of what you want to happen. + +**Describe alternatives you've considered** +A clear and concise description of any alternative solutions or features you've considered. + +**Additional context** +Add any other context or screenshots about the feature request here. + diff --git a/helm-charts-observability/.github/PULL_REQUEST_TEMPLATE.md b/helm-charts-observability/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 0000000..c2edc66 --- /dev/null +++ b/helm-charts-observability/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,15 @@ +### Description +[Describe what this change achieves.] + +### Issues Resolved +[List any issues this PR will resolve. You should likely open an issue if one does not already exist.] + +### Check List +- [ ] Commits are signed per the DCO using --signoff + +For any changes to files within Helm chart directories: +- [ ] Helm chart version bumped +- [ ] Helm chart `CHANGELOG.md` updated to reflect change + +By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license. +For more information on following Developer Certificate of Origin and signing off your commits, please check [here](https://github.com/opensearch-project/helm-charts/blob/main/CONTRIBUTING.md#developer-certificate-of-origin). diff --git a/helm-charts-observability/.github/workflows/add-untriaged.yml b/helm-charts-observability/.github/workflows/add-untriaged.yml new file mode 100644 index 0000000..80a6de9 --- /dev/null +++ b/helm-charts-observability/.github/workflows/add-untriaged.yml @@ -0,0 +1,22 @@ +name: Apply 'untriaged' label during issue lifecycle + +on: + issues: + types: [opened, reopened, transferred] + +permissions: + issues: write + +jobs: + apply-label: + runs-on: ubuntu-latest + steps: + - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 + with: + script: | + github.rest.issues.addLabels({ + issue_number: context.issue.number, + owner: context.repo.owner, + repo: context.repo.repo, + labels: ['untriaged'] + }) diff --git a/helm-charts-observability/.github/workflows/github-merit-badger.yml b/helm-charts-observability/.github/workflows/github-merit-badger.yml new file mode 100644 index 0000000..d759d2a --- /dev/null +++ b/helm-charts-observability/.github/workflows/github-merit-badger.yml @@ -0,0 +1,21 @@ +--- +name: github-merit-badger +on: + pull_request_target: + types: + - opened + +jobs: + call-action: + runs-on: ubuntu-latest + permissions: + pull-requests: write + steps: + - uses: aws-github-ops/github-merit-badger@949750c3f54985fad4715e77f88942be7547f1bc # v0.0.98 + id: merit-badger + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + badges: '[first-time-contributor,repeat-contributor,valued-contributor,seasoned-contributor,all-star-contributor,distinguished-contributor]' + thresholds: '[0,3,6,13,25,50]' + badge-type: 'achievement' + ignore-usernames: '[opensearch-ci-bot]' diff --git a/helm-charts-observability/.github/workflows/lint-test.yaml b/helm-charts-observability/.github/workflows/lint-test.yaml new file mode 100644 index 0000000..299369b --- /dev/null +++ b/helm-charts-observability/.github/workflows/lint-test.yaml @@ -0,0 +1,51 @@ +# See https://github.com/helm/chart-testing-action +name: Lint and Test Charts + +on: [pull_request, workflow_dispatch] + +jobs: + lint-test: + runs-on: ubuntu-latest + strategy: + matrix: + k8s: ["1.19.16", "1.21.14", "1.22.9", "1.23.12", "1.24.7", "1.25.2"] + steps: + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + fetch-depth: 0 + persist-credentials: false + + - name: Install Helm + uses: azure/setup-helm@18bc76811624f360dbd7f18c2d4ecb32c7b87bab # v1.1 # TODO: update version + with: + version: v3.7.0 + + - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 + with: + python-version: '3.8' + + - name: Install chart-testing + uses: helm/chart-testing-action@5f16c27cf7a4fa9c776ff73734df3909b2b65127 # v2.1.0 + + - name: Run chart-testing (list-changed) + id: list-changed + run: | + changed=$(ct list-changed --config ct.yaml) + if [[ -n "$changed" ]]; then + echo "CHART_CHANGED=true" >> $GITHUB_ENV + fi + + - name: Run chart-testing (lint) + run: ct lint --config ct.yaml + + - name: Create kind cluster + uses: helm/kind-action@9e8295d178de23cbfbd8fa16cf844eec1d773a07 # v1.4.0 + with: + node_image: kindest/node:v${{ matrix.k8s }} + kubectl_version: v${{ matrix.k8s }} + if: ${{ env.CHART_CHANGED == 'true' }} + + # See https://github.com/helm/chart-testing/blob/main/doc/ct_install.md + - name: Run chart-testing (install) + run: ct install --config ct.yaml --debug diff --git a/helm-charts-observability/.github/workflows/release.yaml b/helm-charts-observability/.github/workflows/release.yaml new file mode 100644 index 0000000..c813ea6 --- /dev/null +++ b/helm-charts-observability/.github/workflows/release.yaml @@ -0,0 +1,42 @@ +name: Release Charts + +on: + workflow_dispatch: + push: + branches: + - main + +jobs: + release: + permissions: + contents: write + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + fetch-depth: 0 + persist-credentials: false + + - name: Configure the Git and CR binaries + run: | + git config user.name "$GITHUB_ACTOR" + git config user.email "$GITHUB_ACTOR@users.noreply.github.com" + echo "Download custom cr patched binary to support immutable release" + mkdir ./cr-patched + curl -SfL https://ci.opensearch.org/ci/dbc/tools/cr-587-immutable -o ./cr-patched/cr + chmod 755 ./cr-patched/cr + + - name: Install Helm + uses: azure/setup-helm@18bc76811624f360dbd7f18c2d4ecb32c7b87bab # v1.1 # TODO: update version + with: + version: v3.7.0 + + # See https://github.com/helm/chart-releaser + # See https://github.com/helm/chart-releaser-action + - name: Run chart-releaser + uses: helm/chart-releaser-action@a917fd15b20e8b64b94d9158ad54cd6345335584 # v1.6.0 + with: + install_dir: ./cr-patched + env: + CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}" diff --git a/helm-charts-observability/.gitignore b/helm-charts-observability/.gitignore new file mode 100644 index 0000000..4833670 --- /dev/null +++ b/helm-charts-observability/.gitignore @@ -0,0 +1,5 @@ +# macOS +.DS_Store + +# Windows +Thumbs.db diff --git a/helm-charts-observability/.whitesource b/helm-charts-observability/.whitesource new file mode 100644 index 0000000..e34827b --- /dev/null +++ b/helm-charts-observability/.whitesource @@ -0,0 +1,22 @@ +{ + "scanSettings": { + "configMode": "AUTO", + "configExternalURL": "", + "projectToken": "", + "baseBranches": [] + }, + "checkRunSettings": { + "vulnerableCheckRunConclusionLevel": "failure", + "displayMode": "diff", + "useMendCheckNames": true + }, + "issueSettings": { + "minSeverityLevel": "LOW", + "issueType": "DEPENDENCY" + }, + "remediateSettings": { + "workflowRules": { + "enabled": true + } + } +} \ No newline at end of file diff --git a/helm-charts-observability/ADMINS.md b/helm-charts-observability/ADMINS.md new file mode 100644 index 0000000..534cc1b --- /dev/null +++ b/helm-charts-observability/ADMINS.md @@ -0,0 +1,7 @@ +## Admins + +| Admin | GitHub ID | Affiliation | +| --------------- | --------------------------------------- | ----------- | +| Henri Yandell | [hyandell](https://github.com/hyandell) | Amazon | + +[This document](https://github.com/opensearch-project/.github/blob/main/ADMINS.md) explains what admins do in this repo. and how they should be doing it. If you're interested in becoming a maintainer, see [MAINTAINERS](MAINTAINERS.md). If you're interested in contributing, see [CONTRIBUTING](CONTRIBUTING.md). \ No newline at end of file diff --git a/helm-charts-observability/CODE_OF_CONDUCT.md b/helm-charts-observability/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..7129188 --- /dev/null +++ b/helm-charts-observability/CODE_OF_CONDUCT.md @@ -0,0 +1,22 @@ +This code of conduct applies to all spaces provided by the OpenSource project including in code, documentation, issue trackers, mailing lists, chat channels, wikis, blogs, social media and any other communication channels used by the project. + +**Our open source communities endeavor to:** + +* Be Inclusive: We are committed to being a community where everyone can join and contribute. This means using inclusive and welcoming language. +* Be Welcoming: We are committed to maintaining a safe space for everyone to be able to contribute. +* Be Respectful: We are committed to encouraging differing viewpoints, accepting constructive criticism and work collaboratively towards decisions that help the project grow. Disrespectful and unacceptable behavior will not be tolerated. +* Be Collaborative: We are committed to supporting what is best for our community and users. When we build anything for the benefit of the project, we should document the work we do and communicate to others on how this affects their work. + +**Our Responsibility. As contributors, members, or bystanders we each individually have the responsibility to behave professionally and respectfully at all times. Disrespectful and unacceptable behaviors include, but are not limited to:** + +* The use of violent threats, abusive, discriminatory, or derogatory language; +* Offensive comments related to gender, gender identity and expression, sexual orientation, disability, mental illness, race, political or religious affiliation; +* Posting of sexually explicit or violent content; +* The use of sexualized language and unwelcome sexual attention or advances; +* Public or private harassment of any kind; +* Publishing private information, such as physical or electronic address, without permission; +* Other conduct which could reasonably be considered inappropriate in a professional setting; +* Advocating for or encouraging any of the above behaviors. +* Enforcement and Reporting Code of Conduct Issues: + +Instances of abusive, harassing, or otherwise unacceptable behavior may be reported. [Contact us](mailto:opensource-codeofconduct@amazon.com). All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances. \ No newline at end of file diff --git a/helm-charts-observability/CONTRIBUTING.md b/helm-charts-observability/CONTRIBUTING.md new file mode 100644 index 0000000..1e71929 --- /dev/null +++ b/helm-charts-observability/CONTRIBUTING.md @@ -0,0 +1,21 @@ +## Contributing to this Project + +- [Contributing to OpenSearch](https://github.com/opensearch-project/.github/blob/main/CONTRIBUTING.md#contributing-to-opensearch) + - [First Things First](https://github.com/opensearch-project/.github/blob/main/CONTRIBUTING.md#contributing-to-opensearch) + - [Ways to Contribute](https://github.com/opensearch-project/.github/blob/main/CONTRIBUTING.md#ways-to-contribute) + - [Bug Reports](https://github.com/opensearch-project/.github/blob/main/CONTRIBUTING.md#bug-reports) + - [Feature Requests](https://github.com/opensearch-project/.github/blob/main/CONTRIBUTING.md#feature-requests) + - [Documentation Changes](https://github.com/opensearch-project/.github/blob/main/CONTRIBUTING.md#documentation-changes) + - [Contributing Code](https://github.com/opensearch-project/.github/blob/main/CONTRIBUTING.md#contributing-code) + - [Developer Certificate of Origin](https://github.com/opensearch-project/.github/blob/main/CONTRIBUTING.md#developer-certificate-of-origin) + - [Submitting a pull request](#submitting-a-pull-request) + - [Review Process](https://github.com/opensearch-project/.github/blob/main/CONTRIBUTING.md#review-process) + + ## Submitting a Pull Request + + Before submitting a pull request make sure you have validated the following: + 1. Check the [Version and Branching](https://github.com/opensearch-project/helm-charts/blob/main/README.md#version-and-branching) section before commiting a change through PR. + 1. All the individual commits in the PR should be signed off. See DCO [section](https://github.com/opensearch-project/.github/blob/main/CONTRIBUTING.md#developer-certificate-of-origin) for more details. + 1. Chart version should be bumped for every code change except docoumentation change. Refer the PR [#179](https://github.com/opensearch-project/helm-charts/pull/179) for an example. + 1. Make sure the PR does not have any merge conflicts. If there are any conflicts please rebase your commits over the code in `main` branch. + 1. Ensure the linting and testing checks passes once you raise the PR. Unless the lint is passing the PR cannot be merged. You will be able to see the results of the workflows. In case it is failing you can use it to debug further. diff --git a/helm-charts-observability/DEVELOPER_GUIDE.md b/helm-charts-observability/DEVELOPER_GUIDE.md new file mode 100644 index 0000000..fbddf26 --- /dev/null +++ b/helm-charts-observability/DEVELOPER_GUIDE.md @@ -0,0 +1,15 @@ +- [Developer Guide](#developer-guide) + - [Forking and Cloning](#forking-and-cloning) + - [Submitting Changes](#submitting-changes) + +## Developer Guide + +So you want to contribute code to this project? Excellent! We're glad you're here. Here's what you need to do. + +### Forking and Cloning + +Fork this repository on GitHub, and clone locally with `git clone`. + +### Submitting Changes + +See [CONTRIBUTING](CONTRIBUTING.md). \ No newline at end of file diff --git a/helm-charts-observability/LICENSE.txt b/helm-charts-observability/LICENSE.txt new file mode 100644 index 0000000..67db858 --- /dev/null +++ b/helm-charts-observability/LICENSE.txt @@ -0,0 +1,175 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. diff --git a/helm-charts-observability/MAINTAINERS.md b/helm-charts-observability/MAINTAINERS.md new file mode 100644 index 0000000..393ad71 --- /dev/null +++ b/helm-charts-observability/MAINTAINERS.md @@ -0,0 +1,19 @@ +## Overview + +This document contains a list of maintainers in this repo. See [opensearch-project/.github/RESPONSIBILITIES.md](https://github.com/opensearch-project/.github/blob/main/RESPONSIBILITIES.md#maintainer-responsibilities) that explains what the role of maintainer means, what maintainers do in this and other repos, and how they should be doing it. If you're interested in contributing, and becoming a maintainer, see [CONTRIBUTING](CONTRIBUTING.md). + +## Current Maintainers + +| Maintainer | GitHub ID | Affiliation | +| ----------------- | --------------------------------------------------- | ----------- | +| Peter Zhu | [peterzhuamazon](https://github.com/peterzhuamazon) | Amazon | +| Sayali Gaikawad | [gaiksaya](https://github.com/gaiksaya) | Amazon | +| Prudhvi Godithi | [prudhvigodithi](https://github.com/prudhvigodithi) | Amazon | +| Dhiraj Kumar Jain | [TheAlgo](https://github.com/TheAlgo) | Amazon | +| Aaron Layfield | [DandyDeveloper](https://github.com/DandyDeveloper) | Community | + +## Emeritus + +| Maintainer | GitHub ID | Affiliation | +| --------------------- | ----------------------------------------- | ----------- | +| Barani Bikshandi | [bbarani](https://github.com/bbarani) | Amazon | \ No newline at end of file diff --git a/helm-charts-observability/NOTICE.txt b/helm-charts-observability/NOTICE.txt new file mode 100644 index 0000000..731cb60 --- /dev/null +++ b/helm-charts-observability/NOTICE.txt @@ -0,0 +1,2 @@ +OpenSearch (https://opensearch.org/) +Copyright OpenSearch Contributors diff --git a/helm-charts-observability/README.md b/helm-charts-observability/README.md new file mode 100644 index 0000000..4f649b3 --- /dev/null +++ b/helm-charts-observability/README.md @@ -0,0 +1,116 @@ + + +- [OpenSearch Project Helm-Charts](#opensearch-project-helm-charts) +- [Status](#status) +- [Version and Branching](#version-and-branching) +- [Installation](#installation) +- [Change Logs](#change-logs) +- [Contributing](#contributing) +- [Getting Help](#getting-help) +- [Code of Conduct](#code-of-conduct) +- [Security](#security) +- [License](#license) + +## OpenSearch Project Helm Charts + +A community repository for Helm Charts of OpenSearch Project. + +## Status + +[![Lint and Test Charts](https://github.com/opensearch-project/helm-charts/actions/workflows/lint-test.yaml/badge.svg)](https://github.com/opensearch-project/helm-charts/actions/workflows/lint-test.yaml) + [![Release Charts](https://github.com/opensearch-project/helm-charts/actions/workflows/release.yaml/badge.svg)](https://github.com/opensearch-project/helm-charts/actions/workflows/release.yaml) + +## Version and Branching +As of now, this helm-charts repository maintains these branches: +* _main_ (Version is 3.x.x for both `version` and `appVersion` in `Chart.yaml`) +* _2.x_ (Version is 2.x.x for both `version` and `appVersion` in `Chart.yaml`) +* _1.x_ (Version is 1.x.x for both `version` and `appVersion` in `Chart.yaml`) +* _gh-pages_ (Reserved branch for publishing helm-charts through github pages) +
+ +Contributors should choose the corresponding branch(es) when commiting their change(s): +* If you have a change for a specific version, only open PR to specific branch +* If you have a change for all available versions, first open a PR on `main`, then open a backport PR with `[backport 1.x]` in the title, with label `backport 1.x`, etc. +* No changes should be commited to `gh-pages` by any contributor, as this branch should be only changed by github actions `chart-releaser` + +## Kubernetes Version Support +* This helm-chart repository is tested with kubernetes version 1.19 and above + +## Installation + +To install the OpenSearch Helm charts, execute the following commands: + +```shell +helm repo add opensearch https://opensearch-project.github.io/helm-charts/ +helm repo update +``` + +Once the charts repository reference is added, you can run the following command to see the charts. + +```shell +helm search repo opensearch +``` + +You can now deploy charts with this command. + +```shell +helm install my-deployment opensearch/ +``` + +Please see the `README.md` in the [OpenSearch](charts/opensearch) and [OpenSearch Dashboards](charts/opensearch-dashboards) directories for installation instructions. + + +### Breaking Change +For OpenSearch Chart version 2.18.0 and App Version OpenSearch version 2.12.0 and above require a custom strong password to be provided in order to setup demo admin user during the first time cluster installation, without this password the cluster would not spin up, unless demo config install is disabled or the cluster security settings are handled by the user. + +Note: This won’t impact users who have already installed the cluster and created the security index. It only affects users starting a brand new cluster with OpenSearch version 2.12.0 and above. + +The custom admin password can be supplied by adding the environment variable `OPENSEARCH_INITIAL_ADMIN_PASSWORD` in the `value.yml` as: +``` +extraEnvs: + - name: OPENSEARCH_INITIAL_ADMIN_PASSWORD + value: +``` +or during the installation example as `helm install opensearch opensearch/opensearch --set extraEnvs[0].name=OPENSEARCH_INITIAL_ADMIN_PASSWORD,extraEnvs[0].value=$OPENSEARCH_INITIAL_ADMIN_PASSWORD` + + +### Notes About Default Installation + +By default, on startup, the `install_demo_configuration.sh` is run via the `opensearch-docker-entrypoint.sh` script if `DISABLE_INSTALL_DEMO_CONFIG` is not `true`. + +If custom certificates are used and `allow_unsafe_democertificates` is set to `false` in the configuration, this can prevent pods from starting with the following error: `Demo certificates found but plugins.security.allow_unsafe_democertificates is set to false.` + +This can be solved by adding an environment variable in the `value.yml`: +``` +extraEnvs: + - name: DISABLE_INSTALL_DEMO_CONFIG + value: "true" +``` + +## Change Logs + +Please review the [OpenSearch](charts/opensearch/CHANGELOG.md) and the +[OpenSearch Dashboards](charts/opensearch-dashboards/CHANGELOG.md) change logs for the latest +release details. + +## Contributing + +See [developer guide](DEVELOPER_GUIDE.md) and [how to contribute to this project](CONTRIBUTING.md). + +## Getting Help + +If you find a bug, or have a feature request, please don't hesitate to open an issue in this repository. + +For more information, see [project website](https://opensearch.org/) and [documentation](https://opensearch.org/docs). If you need help and are unsure where to open an issue, try [forums](https://discuss.opendistrocommunity.dev/). + +## Code of Conduct + +This project has adopted the [Amazon Open Source Code of Conduct](CODE_OF_CONDUCT.md). For more information see the [Code of Conduct FAQ](https://aws.github.io/code-of-conduct-faq), or contact [opensource-codeofconduct@amazon.com](mailto:opensource-codeofconduct@amazon.com) with any additional questions or comments. + +## Security + +If you discover a potential security issue in this project we ask that you notify AWS/Amazon Security via our [vulnerability reporting page](http://aws.amazon.com/security/vulnerability-reporting/). Please do **not** create a public GitHub issue. + +## License + +This project is licensed under the [Apache v2.0 License](LICENSE.txt). diff --git a/helm-charts-observability/charts/README.md b/helm-charts-observability/charts/README.md new file mode 100644 index 0000000..e69de29 diff --git a/helm-charts-observability/charts/data-prepper/.helmignore b/helm-charts-observability/charts/data-prepper/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/helm-charts-observability/charts/data-prepper/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/helm-charts-observability/charts/data-prepper/CHANGELOG.md b/helm-charts-observability/charts/data-prepper/CHANGELOG.md new file mode 100644 index 0000000..99817c0 --- /dev/null +++ b/helm-charts-observability/charts/data-prepper/CHANGELOG.md @@ -0,0 +1,22 @@ +# Changelog +All notable changes to this project will be documented in this file. + +The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), +and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). + +## [0.3.1] +### Added +- Added configurable `initContainers` + +## [0.3.0] +### Added +- Demo pipeline not part of values.yaml. New value `pipelineConfig.demoPipeline` controls creation of demo pipeline. + +## [0.2.0] +### Added +- Added configurable `global.dockerRegistry` + +## [0.1.0] +### Added +- Create initial version of data-prepper helm chart + diff --git a/helm-charts-observability/charts/data-prepper/Chart.yaml b/helm-charts-observability/charts/data-prepper/Chart.yaml new file mode 100644 index 0000000..18b0a4e --- /dev/null +++ b/helm-charts-observability/charts/data-prepper/Chart.yaml @@ -0,0 +1,50 @@ +apiVersion: v2 +name: data-prepper +description: A Helm chart for Data Prepper + +# A chart can be either an 'application' or a 'library' chart. +# +# Application charts are a collection of templates that can be packaged into versioned archives +# to be deployed. +# +# Library charts provide useful utilities or functions for the chart developer. They're included as +# a dependency of application charts to inject those utilities and functions into the rendering +# pipeline. Library charts do not define any templates and therefore cannot be deployed. +type: application + +# This is the chart version. This version number should be incremented each time you make changes +# to the chart and its templates, including the app version. +# Versions are expected to follow Semantic Versioning (https://semver.org/) +version: 0.3.1 + +# This is the version number of the application being deployed. This version number should be +# incremented each time you make changes to the application. Versions are not expected to +# follow Semantic Versioning. They should reflect the version the application is using. +# It is recommended to use it with quotes. +appVersion: "2.8.0" + +maintainers: + - name: gaiksaya + url: https://github.com/gaiksaya + - name: peterzhuamazon + url: https://github.com/peterzhuamazon + - name: prudhvigodithi + url: https://github.com/prudhvigodithi + - name: sergk + url: https://github.com/sergk + - name: TheAlgo + url: https://github.com/TheAlgo + +home: https://opensearch.org/docs/latest/data-prepper/ +sources: + - https://github.com/opensearch-project/data-prepper + - https://github.com/opensearch-project/helm-charts + +annotations: + artifacthub.io/category: monitoring-logging + artifacthub.io/license: Apache-2.0 + artifacthub.io/links: | + - name: Data Prepper Documentation + url: https://opensearch.org/docs/latest/data-prepper/ + - name: OpenSearch Project + url: https://opensearch.org diff --git a/helm-charts-observability/charts/data-prepper/README.md b/helm-charts-observability/charts/data-prepper/README.md new file mode 100644 index 0000000..6f7cee1 --- /dev/null +++ b/helm-charts-observability/charts/data-prepper/README.md @@ -0,0 +1,130 @@ +# Data Prepper Helm Chart + +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2.8.0](https://img.shields.io/badge/AppVersion-2.8.0-informational?style=flat-square) + +A Helm chart for Data Prepper + +**Homepage:** + +Data Prepper is an essential component of the OpenSearch project, designed for high-volume data transformation and ingestion into OpenSearch. This Helm chart simplifies deploying Data Prepper on Kubernetes environments, ensuring you can easily set up your data processing pipelines. + +## Requirements + +Before installing the Data Prepper Helm chart, ensure your environment meets the following requirements: + +* Kubernetes >= 1.14 +* Helm >= 2.17.0 +* We recommend having at least 4 GiB of memory available for this deployment. A minimum of 2 GiB may suffice, but less than that could lead to deployment failures. + +## Installation + +To install the Data Prepper Helm chart, follow these steps: + +* Add the OpenSearch Helm repository if you haven't already: + +```bash +helm repo add opensearch https://opensearch-project.github.io/helm-charts/ +helm repo update +``` + +* Install the Data Prepper chart with: + +```bash +helm install my-data-prepper-release opensearch/data-prepper +``` + +Replace my-data-prepper-release with your desired release name. When no explicit pipeline is defined, this will configure a demo pipeline using a random source and stdout sink. + +## Configuration + +The Data Prepper Helm chart comes with a variety of configuration options to tailor the deployment to your needs. +The default values are specified in the [values.yaml](values.yaml) file. You can override these values by providing your own `values.yaml` file during installation or by specifying configuration options with --set flags. + +For a detailed list of configuration options, refer to the values.yaml file or the [Data Prepper documentation](https://opensearch.org/docs/latest/data-prepper/managing-data-prepper/configuring-data-prepper/). + +## Uninstalling the Chart + +To uninstall/delete the my-data-prepper deployment: + +```bash +helm delete my-data-prepper +``` + +This command removes all the Kubernetes components associated with the chart and deletes the release. + +## Contributing + +We welcome contributions! Please read our [CONTRIBUTING.md](../../CONTRIBUTING.md) for details on how to submit contributions to this project. + +## Maintainers + +| Name | Email | Url | +| ---- | ------ | --- | +| gaiksaya | | | +| peterzhuamazon | | | +| prudhvigodithi | | | +| sergk | | | +| TheAlgo | | | + +## Source Code + +* +* + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| affinity | object | `{}` | | +| autoscaling.enabled | bool | `false` | | +| autoscaling.maxReplicas | int | `100` | | +| autoscaling.minReplicas | int | `1` | | +| autoscaling.targetCPUUtilizationPercentage | int | `80` | | +| config | object | `{"data-prepper-config.yaml":"ssl: false\n# circuit_breakers:\n# heap:\n# usage: 2gb\n# reset: 30s\n# check_interval: 5s\n","log4j2-rolling.properties":"#\n# Copyright OpenSearch Contributors\n# SPDX-License-Identifier: Apache-2.0\n#\n\nstatus = error\ndest = err\nname = PropertiesConfig\n\nproperty.filename = log/data-prepper/data-prepper.log\n\nappender.console.type = Console\nappender.console.name = STDOUT\nappender.console.layout.type = PatternLayout\nappender.console.layout.pattern = %d{ISO8601} [%t] %-5p %40C - %m%n\n\nappender.rolling.type = RollingFile\nappender.rolling.name = RollingFile\nappender.rolling.fileName = ${filename}\nappender.rolling.filePattern = logs/data-prepper.log.%d{MM-dd-yy-HH}-%i.gz\nappender.rolling.layout.type = PatternLayout\nappender.rolling.layout.pattern = %d{ISO8601} [%t] %-5p %40C - %m%n\nappender.rolling.policies.type = Policies\nappender.rolling.policies.time.type = TimeBasedTriggeringPolicy\nappender.rolling.policies.time.interval = 1\nappender.rolling.policies.time.modulate = true\nappender.rolling.policies.size.type = SizeBasedTriggeringPolicy\nappender.rolling.policies.size.size=100MB\nappender.rolling.strategy.type = DefaultRolloverStrategy\nappender.rolling.strategy.max = 168\n\nrootLogger.level = warn\nrootLogger.appenderRef.stdout.ref = STDOUT\nrootLogger.appenderRef.file.ref = RollingFile\n\nlogger.pipeline.name = org.opensearch.dataprepper.pipeline\nlogger.pipeline.level = info\n\nlogger.parser.name = org.opensearch.dataprepper.parser\nlogger.parser.level = info\n\nlogger.plugins.name = org.opensearch.dataprepper.plugins\nlogger.plugins.level = info\n"}` | Data Prepper configuration | +| config."data-prepper-config.yaml" | string | `"ssl: false\n# circuit_breakers:\n# heap:\n# usage: 2gb\n# reset: 30s\n# check_interval: 5s\n"` | Main Data Prepper configuration file content | +| config."log4j2-rolling.properties" | string | `"#\n# Copyright OpenSearch Contributors\n# SPDX-License-Identifier: Apache-2.0\n#\n\nstatus = error\ndest = err\nname = PropertiesConfig\n\nproperty.filename = log/data-prepper/data-prepper.log\n\nappender.console.type = Console\nappender.console.name = STDOUT\nappender.console.layout.type = PatternLayout\nappender.console.layout.pattern = %d{ISO8601} [%t] %-5p %40C - %m%n\n\nappender.rolling.type = RollingFile\nappender.rolling.name = RollingFile\nappender.rolling.fileName = ${filename}\nappender.rolling.filePattern = logs/data-prepper.log.%d{MM-dd-yy-HH}-%i.gz\nappender.rolling.layout.type = PatternLayout\nappender.rolling.layout.pattern = %d{ISO8601} [%t] %-5p %40C - %m%n\nappender.rolling.policies.type = Policies\nappender.rolling.policies.time.type = TimeBasedTriggeringPolicy\nappender.rolling.policies.time.interval = 1\nappender.rolling.policies.time.modulate = true\nappender.rolling.policies.size.type = SizeBasedTriggeringPolicy\nappender.rolling.policies.size.size=100MB\nappender.rolling.strategy.type = DefaultRolloverStrategy\nappender.rolling.strategy.max = 168\n\nrootLogger.level = warn\nrootLogger.appenderRef.stdout.ref = STDOUT\nrootLogger.appenderRef.file.ref = RollingFile\n\nlogger.pipeline.name = org.opensearch.dataprepper.pipeline\nlogger.pipeline.level = info\n\nlogger.parser.name = org.opensearch.dataprepper.parser\nlogger.parser.level = info\n\nlogger.plugins.name = org.opensearch.dataprepper.plugins\nlogger.plugins.level = info\n"` | Log4j2 configuration for Data Prepper logging | +| extraEnvs | list | `[]` | Extra environment variables to pass to the Data Prepper container | +| fullnameOverride | string | `""` | Override the default fullname for the deployment | +| global.dockerRegistry | string | `""` | Set if you want to change the default docker registry, e.g. a private one. | +| image.pullPolicy | string | `"IfNotPresent"` | The image tag to pull. Default: IfNotPresent | +| image.repository | string | `"opensearchproject/data-prepper"` | The image repository from which to pull the Data Prepper image | +| image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. | +| imagePullSecrets | list | `[]` | List of imagePullSecrets to use if the Docker image is stored in a private registry | +| ingress.annotations | object | `{}` | | +| ingress.className | string | `""` | | +| ingress.enabled | bool | `false` | | +| ingress.hosts[0].host | string | `"chart-example.local"` | | +| ingress.hosts[0].paths[0].path | string | `"/"` | | +| ingress.hosts[0].paths[0].pathType | string | `"ImplementationSpecific"` | | +| ingress.tls | list | `[]` | | +| nameOverride | string | `""` | Override the default name for the deployment | +| nodeSelector | object | `{}` | | +| pipelineConfig | object | (See below) | Pipeline configuration | +| pipelineConfig.enabled | boolean | `false` | Enable inline configuration in `config` sub key. | +| pipelineConfig.config | object | `{}` | Pipeline configuration file inline if `enabled` is set to true | +| pipelineConfig.demoPipeline | boolean | "" | If set, a demo pipeline will be provisioned with source `random` and sink `stdout`. | +| pipelineConfig.existingSecret | string | `""` | The name of an existing secret containing the pipeline configuration. If enabled is false existingSecret is used. The existingSecret must have a key named `pipelines.yaml`. | +| podAnnotations | object | `{}` | | +| podLabels | object | `{}` | | +| podSecurityContext | object | `{}` | | +| initContainers | list | `[]` | Optional list of init containers for the pod | +| ports | list | `[{"name":"http-source","port":2021},{"name":"otel-traces","port":21890},{"name":"otel-metrics","port":21891},{"name":"otel-logs","port":21892}]` | Data Prepper ports | +| ports[0] | object | `{"name":"http-source","port":2021}` | The port that the source is running on. Default value is 2021. Valid options are between 0 and 65535. https://opensearch.org/docs/latest/data-prepper/pipelines/configuration/sources/http-source/ | +| ports[1] | object | `{"name":"otel-traces","port":21890}` | The port that the otel_trace_source source runs on. Default value is 21890. https://opensearch.org/docs/latest/data-prepper/pipelines/configuration/sources/otel-trace-source/ | +| ports[2] | object | `{"name":"otel-metrics","port":21891}` | The port that the OpenTelemtry metrics source runs on. Default value is 21891. https://opensearch.org/docs/latest/data-prepper/pipelines/configuration/sources/otel-metrics-source/ | +| ports[3] | object | `{"name":"otel-logs","port":21892}` | Represents the port that the otel_logs_source source is running on. Default value is 21892. https://opensearch.org/docs/latest/data-prepper/pipelines/configuration/sources/otel-logs-source/ | +| replicaCount | int | `1` | | +| resources | object | `{}` | | +| securityContext | object | `{}` | | +| service.type | string | `"ClusterIP"` | | +| serviceAccount.annotations | object | `{}` | Annotations to add to the service account | +| serviceAccount.automount | bool | `true` | Automatically mount a ServiceAccount's API credentials? | +| serviceAccount.create | bool | `true` | Specifies whether a service account should be created | +| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | +| tolerations | list | `[]` | | +| volumeMounts | list | `[]` | | +| volumes | list | `[]` | | + +## License + +This project is licensed under the Apache License 2.0 - see the [LICENSE.txt](../../LICENSE.txt) file for details. diff --git a/helm-charts-observability/charts/data-prepper/README.md.gotmpl b/helm-charts-observability/charts/data-prepper/README.md.gotmpl new file mode 100644 index 0000000..816511e --- /dev/null +++ b/helm-charts-observability/charts/data-prepper/README.md.gotmpl @@ -0,0 +1,71 @@ +# Data Prepper Helm Chart + +{{ template "chart.deprecationWarning" . }} + +{{ template "chart.badgesSection" . }} + +{{ template "chart.description" . }} + +{{ template "chart.homepageLine" . }} + +Data Prepper is an essential component of the OpenSearch project, designed for high-volume data transformation and ingestion into OpenSearch. This Helm chart simplifies deploying Data Prepper on Kubernetes environments, ensuring you can easily set up your data processing pipelines. + +## Requirements + +Before installing the Data Prepper Helm chart, ensure your environment meets the following requirements: + +* Kubernetes >= 1.14 +* Helm >= 2.17.0 +* We recommend having at least 4 GiB of memory available for this deployment. A minimum of 2 GiB may suffice, but less than that could lead to deployment failures. + +## Installation + +To install the Data Prepper Helm chart, follow these steps: + +* Add the OpenSearch Helm repository if you haven't already: + +```bash +helm repo add opensearch https://opensearch-project.github.io/helm-charts/ +helm repo update +``` + +* Install the Data Prepper chart with: + +```bash +helm install my-data-prepper-release opensearch/data-prepper +``` + +Replace my-data-prepper-release with your desired release name. + +## Configuration + +The Data Prepper Helm chart comes with a variety of configuration options to tailor the deployment to your needs. +The default values are specified in the [values.yaml](values.yaml) file. You can override these values by providing your own values.yaml file during installation or by specifying configuration options with --set flags. + +For a detailed list of configuration options, refer to the values.yaml file or the [Data Prepper documentation](https://opensearch.org/docs/latest/data-prepper/managing-data-prepper/configuring-data-prepper/). + +## Uninstalling the Chart + +To uninstall/delete the my-data-prepper deployment: + +```bash +helm delete my-data-prepper +``` + +This command removes all the Kubernetes components associated with the chart and deletes the release. + +## Contributing + +We welcome contributions! Please read our [CONTRIBUTING.md](../../CONTRIBUTING.md) for details on how to submit contributions to this project. + +{{ template "chart.maintainersSection" . }} + +{{ template "chart.sourcesSection" . }} + +{{ template "chart.requirementsSection" . }} + +{{ template "chart.valuesSection" . }} + +## License + +This project is licensed under the Apache License 2.0 - see the [LICENSE.txt](../../LICENSE.txt) file for details. diff --git a/helm-charts-observability/charts/data-prepper/certificate_renew_sop.md b/helm-charts-observability/charts/data-prepper/certificate_renew_sop.md new file mode 100644 index 0000000..99e2890 --- /dev/null +++ b/helm-charts-observability/charts/data-prepper/certificate_renew_sop.md @@ -0,0 +1,23 @@ +renew certificate using this command + +openssl x509 -req -in data-prepper-ingress.csr -CA $ROOT_CA_CERT -CAkey $ROOT_CA_KEY -CAcreateserial -out data-prepper-ingress.crt -days 365 -sha256 -extfile data-prepper-ingress.cnf -extensions server_extensions + + + +k delete secret -n observability dataprepper-ingress-tls + +then create kubernetes secret + +k create secret --namespace observability tls dataprepper-ingress-tls --cert=data-prepper-ingress.crt --key=data-prepper-ingress.key --dry-run=client -o yaml | k apply -f - + +verify + +k get secret -n observability dataprepper-ingress-tls -o jsonpath='{.type}{"\n"}' + +is should say kubernetes.io/tls + +kubectl get secret dataprepper-ingress-tls \ + -n observability \ + -o jsonpath='{.data.tls\.crt}' | +base64 -d | +openssl x509 -noout -subject -issuer -ext subjectAltName \ No newline at end of file diff --git a/helm-charts-observability/charts/data-prepper/cpanel_path_structure.txt b/helm-charts-observability/charts/data-prepper/cpanel_path_structure.txt new file mode 100644 index 0000000..69f056d --- /dev/null +++ b/helm-charts-observability/charts/data-prepper/cpanel_path_structure.txt @@ -0,0 +1,126 @@ +# System logs (/var/log) + +/var/log/agent360-install.log +/var/log/agent360.log +/var/log/alternatives.log +/var/log/alternatives.log.1 +/var/log/apache2/ +/var/log/apport.log +/var/log/apt/ +/var/log/audit/ +/var/log/auth.log +/var/log/auth.log.1 +/var/log/auth.log.2.gz +/var/log/auth.log.3.gz +/var/log/auth.log.4.gz +/var/log/bootstrap.log +/var/log/btmp +/var/log/btmp.1 +/var/log/chkservd.log +/var/log/clamav/ +/var/log/clam-update.log +/var/log/cloud-init.log +/var/log/cloud-init-output.log +/var/log/comet_backup_jobs_helper.log +/var/log/comet_backup_jobs_helper.log.1 +/var/log/cpanel-install.log +/var/log/cpanel-server-traffic/ +/var/log/dcpumon/ +/var/log/dist-upgrade/ +/var/log/dmesg +/var/log/dmesg.0 +/var/log/dmesg.1.gz +/var/log/dpkg.log +/var/log/dpkg.log.1 +/var/log/ea-passenger-analytics/ +/var/log/exim_mainlog +/var/log/exim_mainlog.1.gz +/var/log/exim_mainlog.2.gz +/var/log/exim_mainlog.3.gz +/var/log/exim_mainlog.4.gz +/var/log/exim_paniclog +/var/log/exim_paniclog.1.gz +/var/log/exim_paniclog.2.gz +/var/log/exim_paniclog.3.gz +/var/log/exim_paniclog.4.gz +/var/log/exim_rejectlog +/var/log/exim_rejectlog.1.gz +/var/log/exim_rejectlog.2.gz +/var/log/exim_rejectlog.3.gz +/var/log/exim_rejectlog.4.gz +/var/log/fail2ban.log +/var/log/fail2ban.log.1 +/var/log/fail2ban.log.2.gz +/var/log/fail2ban.log.3.gz +/var/log/fail2ban.log.4.gz +/var/log/faillog +/var/log/fontconfig.log +/var/log/imav-deploy.log +/var/log/imunify360/ +/var/log/imunify360_user_logs/ +/var/log/installer/ +/var/log/journal/ +/var/log/kern.log +/var/log/kern.log.1 +/var/log/kern.log.2.gz +/var/log/kern.log.3.gz +/var/log/kern.log.4.gz +/var/log/landscape/ +/var/log/lastlog +/var/log/lfd.log +/var/log/lfd.log.1.gz +/var/log/mail.err +/var/log/mail.log +/var/log/mail.log.1 +/var/log/mail.log.2.gz +/var/log/mail.log.3.gz +/var/log/mail.log.4.gz +/var/log/munin/ +/var/log/mysql/ +/var/log/named/ +/var/log/private/ +/var/log/quota_enable.log +/var/log/README +/var/log/sw-cp-server/ +/var/log/syslog +/var/log/syslog.1 +/var/log/syslog.2.gz +/var/log/syslog.3.gz +/var/log/syslog.4.gz +/var/log/sysstat/ +/var/log/ubuntu-advantage-apt-hook.log +/var/log/unattended-upgrades/ +/var/log/wp-toolkit/ +/var/log/wtmp +/var/log/xferlog.offsetftpsep + +# cPanel logs (/usr/local/cpanel/logs) + +/usr/local/cpanel/logs/access_log +/usr/local/cpanel/logs/api_tokens_log +/usr/local/cpanel/logs/backup_restore_manager_error_log +/usr/local/cpanel/logs/backup_restore_manager_log +/usr/local/cpanel/logs/build_locale_databases_log +/usr/local/cpanel/logs/cpbackup/ +/usr/local/cpanel/logs/cpbackup_transport_history.log +/usr/local/cpanel/logs/cpbackup_transporter/ +/usr/local/cpanel/logs/cpbackup_transporter.log +/usr/local/cpanel/logs/cpdavd_error_log +/usr/local/cpanel/logs/cpdavd_session_log +/usr/local/cpanel/logs/cphulkd.log +/usr/local/cpanel/logs/cphulkd_errors.log +/usr/local/cpanel/logs/cpwrapd_log +/usr/local/cpanel/logs/dnsadmin_log +/usr/local/cpanel/logs/error_log +/usr/local/cpanel/logs/incoming_http_requests.log +/usr/local/cpanel/logs/license_log +/usr/local/cpanel/logs/login_log +/usr/local/cpanel/logs/php-fpm/ +/usr/local/cpanel/logs/queueprocd.log +/usr/local/cpanel/logs/secpol_log +/usr/local/cpanel/logs/session_log +/usr/local/cpanel/logs/spamd_error_log +/usr/local/cpanel/logs/splitlogs_log +/usr/local/cpanel/logs/stats_log +/usr/local/cpanel/logs/tailwatchd_log +/usr/local/cpanel/logs/update_analysis \ No newline at end of file diff --git a/helm-charts-observability/charts/data-prepper/prepper-ingress.yaml b/helm-charts-observability/charts/data-prepper/prepper-ingress.yaml new file mode 100644 index 0000000..e7d9cdf --- /dev/null +++ b/helm-charts-observability/charts/data-prepper/prepper-ingress.yaml @@ -0,0 +1,17 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: prepper-ingress + namespace: observability +spec: + ingressClassName: nginx + rules: + - http: + paths: + - path: /logs + pathType: Prefix + backend: + service: + name: data-prepper + port: + number: 2021 \ No newline at end of file diff --git a/helm-charts-observability/charts/data-prepper/prerequisit_inforamtion.md b/helm-charts-observability/charts/data-prepper/prerequisit_inforamtion.md new file mode 100644 index 0000000..ead89d7 --- /dev/null +++ b/helm-charts-observability/charts/data-prepper/prerequisit_inforamtion.md @@ -0,0 +1,160 @@ +# Phase 1 + +## Infromation for preeper + +- OpenSearch Kubernetes Service name +``` +root@k8s-cp-01:~# k get svc -n observability +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE +brilliant-opensearch-cluster-master ClusterIP 10.43.44.32 9200/TCP,9300/TCP,9600/TCP 4d18h +brilliant-opensearch-cluster-master-headless ClusterIP None 9200/TCP,9300/TCP,9600/TCP 4d18h +brilliant-opensearch-dashboard-opensearch-dashboards ClusterIP 10.43.225.4 5601/TCP,9601/TCP 15h +root@k8s-cp-01:~# k get svc -n ingress-nginx +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE +ingress-nginx-controller LoadBalancer 10.43.211.10 80:31599/TCP,443:31186/TCP 26d +ingress-nginx-controller-admission ClusterIP 10.43.204.151 443/TCP 26d +ingress-nginx-controller-metrics ClusterIP 10.43.119.183 10254/TCP 26d +root@k8s-cp-01:~# +``` +- OpenSearch HTTPS port +*Mentioned above* +- CA certificate +*CA Certificate is in the server monitoring/opensearch-pki* +*There is another certificate + +``` +apiVersion: v1 +data: + root-ca.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUY3VENDQTlXZ0F3SUJBZ0lVTC9hTytnYS9YY3lzakFYbGh1WG92d0xLWkJjd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZVXhDekFKQmdOVkJBWVRBa0pFTVE0d0RBWURWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaAphMkV4RWpBUUJnTlZCQW9NQ1VKeWFXeHNhV0Z1ZERFYk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwCklFTkJNU1V3SXdZRFZRUUREQnhDY21sc2JHbGhiblFnVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUI0WERUSTIKTURjeU16RTFNREV4T1ZvWERUTTJNRGN5TURFMU1ERXhPVm93Z1lVeEN6QUpCZ05WQkFZVEFrSkVNUTR3REFZRApWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaGEyRXhFakFRQmdOVkJBb01DVUp5YVd4c2FXRnVkREViCk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwSUVOQk1TVXdJd1lEVlFRRERCeENjbWxzYkdsaGJuUWcKVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUlJQ0lqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FnOEFNSUlDQ2dLQwpBZ0VBdXlEYmRaMUFycWd6K1l3SkNUcWlxREtuUzNDRGhHekNxK0h5WDN3clBnV0JvZFBraHJCV3dkNzQ4ZjdqClhZWDNQditQS0F0ZzVGYjdxa2ZZUFZJR0FPZUNiUWxkRlJnZld0S2F2MkdxcHZseUlKcy9OZW5PZzFZQ3IydVUKbDE3UnFPNk1BSGt6d1pNTVFDV1JXMlFiUy9weVY0VHd6dkNxSTR1ZVpzOFJ4MndwbERJdWFPVXdJMEVTMG8zdQpWdDJHMVlCTWlFOUNVTDliQWlYbWQ0UTR4a1NFRFRvOVY1SVk3Z2dHYjFTU0xWU2x6RDJHZElaMGN3VlE2LzcwCnUrQ1FPa005ZXhIRVR2eGpGTmZ4azI2YlRZVUJmNnBNS2VpSDdMbC9ucjZFVVVzTW5DSUR5VGtnK3Zta1M5ZWoKUmY1R0QwQ00rcnl1V1BiRHlHOCtzcDh4d1N1ZkcydDdkUGZRSTUzd1Zzc1BKSkk5b0lsZ0lJWXkyMkFUMlo4RwpKL2dZbmYwMU5LREhSV1dBU2FQaTBLT2dURldqRG5xam94Q0FHZjVGVFRJSHdBQjVsMS8rMXZFbEkyNjQ2M2d4CnBWcTk4Vyt4U3FQQ0xaTW9sWlE5TVkwbjVHeGgvZjhkK0RPb1BVT0lXazJqWXdvS1JGQXJiTlNTNnkySnVrS3YKSWNvMnN4YUhqZkhrdDdqdDBkckRLcjUrelI5bndUWDhVN3hBaWlTYkVTekN6OWlvdU9QSEcxMFFtdzl6VVRNMgoxdzJmMmlQRWpvbFpBVjFBaFU3dzFWNHBzc3JpWDIvNTlDR1dYT1VEcWNnd2MwdWh4djRnWFRndXBCeGcrYU5yCllybWZwNndtejdzN3lmblh3T2xVaVRDRW1Bc2NBemNkMmdCaGwvN1dpcmFRZFVzQ0F3RUFBYU5UTUZFd0hRWUQKVlIwT0JCWUVGSGJhbmo2RkdNVWZ3bEMwSytqY081TTlHd0FwTUI4R0ExVWRJd1FZTUJhQUZIYmFuajZGR01VZgp3bEMwSytqY081TTlHd0FwTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3RFFZSktvWklodmNOQVFFTEJRQURnZ0lCCkFBZVVVVUFMTk5FNDM2UEwvZXl6V0c3bmlPdndXODF3UkdVdGdEUnJpY2xFWjh0K3MzUG9MOXRibyszUGN1ekgKakxsUFArYmVLY2tUTEZKVGZZWUN3Z0dWZkdIRXE1ejV1SUt3ZWIyMG9GSEg3ek9DSzF3VVJBSUlPZnFycncyMApjcWNzdTRnK3NENnl0bllWN2Y1T0RFT2RNaXpjVXRrbGpMSjVieXJLSU9OV2FrSTBpd0xLeXFPQWlGeUVSY2xiCjB0ZzhoTDR6dkRLVUZ6dVJycXhxS0padzNWUWUvM1JWUFYwZ0RLUW96VEQ0M3lnQUdGVlVjckx1dHZOK2V5bEEKVDdYMGtNZXJlVVRKd1N6RDVvenhGRXFkaDlLNHZkZTA2a3BuSXpQS2tEanNFZiszeW9WeFVxRGJCeGV3ai9aOApodzhmT3lBWC9jV2UvZlhmWVdPV3RpTlhiQVJRd0pvUWlLb3lacHRuNGpvRXhLWVB2Qzg0RitINEZnZnpidXFkCnNnL2R2SjBxcldGaUlZeWZBRS9NNGM3VTBDUnVsZ1lETXJhbktIUHhxTllVT21pRzM4T0xLTDlFMmlvV002UHYKek82djVvUk5pazFFN3BrRUVMSUFPczR3U2MvdG45MU01TmtpSjgyRXNEQ2ZaVG5FVU9Cd3VsRzZSbW8vYWF0agpCWUJEaHo0dnhmN0ZjNG13WEdXNVZXc1Qzd2ZVckErZ3l3VWo5dlFqTTV6SjEybDl4NU9Dd3pNMTJuQWdSZ1dFCkh4ZDh5TFhkNE9rTWRaRWNVckY5eWtSMGJUZ3AyWnowL3lPR21KbVpieHRNdHlGaTVMcmt6VElodWJNS1l2bncKcWsrbWdaUmNMcXBWclRSYTNiaGdEVzJrSWpFT2I5SHB6NG5MZ3loUVpCMFAKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= +kind: Secret +metadata: + annotations: + kubectl.kubernetes.io/last-applied-configuration: | + {"apiVersion":"v1","data":{"root-ca.pem":"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUY3VENDQTlXZ0F3SUJBZ0lVTC9hTytnYS9YY3lzakFYbGh1WG92d0xLWkJjd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZVXhDekFKQmdOVkJBWVRBa0pFTVE0d0RBWURWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaAphMkV4RWpBUUJnTlZCQW9NQ1VKeWFXeHNhV0Z1ZERFYk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwCklFTkJNU1V3SXdZRFZRUUREQnhDY21sc2JHbGhiblFnVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUI0WERUSTIKTURjeU16RTFNREV4T1ZvWERUTTJNRGN5TURFMU1ERXhPVm93Z1lVeEN6QUpCZ05WQkFZVEFrSkVNUTR3REFZRApWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaGEyRXhFakFRQmdOVkJBb01DVUp5YVd4c2FXRnVkREViCk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwSUVOQk1TVXdJd1lEVlFRRERCeENjbWxzYkdsaGJuUWcKVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUlJQ0lqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FnOEFNSUlDQ2dLQwpBZ0VBdXlEYmRaMUFycWd6K1l3SkNUcWlxREtuUzNDRGhHekNxK0h5WDN3clBnV0JvZFBraHJCV3dkNzQ4ZjdqClhZWDNQditQS0F0ZzVGYjdxa2ZZUFZJR0FPZUNiUWxkRlJnZld0S2F2MkdxcHZseUlKcy9OZW5PZzFZQ3IydVUKbDE3UnFPNk1BSGt6d1pNTVFDV1JXMlFiUy9weVY0VHd6dkNxSTR1ZVpzOFJ4MndwbERJdWFPVXdJMEVTMG8zdQpWdDJHMVlCTWlFOUNVTDliQWlYbWQ0UTR4a1NFRFRvOVY1SVk3Z2dHYjFTU0xWU2x6RDJHZElaMGN3VlE2LzcwCnUrQ1FPa005ZXhIRVR2eGpGTmZ4azI2YlRZVUJmNnBNS2VpSDdMbC9ucjZFVVVzTW5DSUR5VGtnK3Zta1M5ZWoKUmY1R0QwQ00rcnl1V1BiRHlHOCtzcDh4d1N1ZkcydDdkUGZRSTUzd1Zzc1BKSkk5b0lsZ0lJWXkyMkFUMlo4RwpKL2dZbmYwMU5LREhSV1dBU2FQaTBLT2dURldqRG5xam94Q0FHZjVGVFRJSHdBQjVsMS8rMXZFbEkyNjQ2M2d4CnBWcTk4Vyt4U3FQQ0xaTW9sWlE5TVkwbjVHeGgvZjhkK0RPb1BVT0lXazJqWXdvS1JGQXJiTlNTNnkySnVrS3YKSWNvMnN4YUhqZkhrdDdqdDBkckRLcjUrelI5bndUWDhVN3hBaWlTYkVTekN6OWlvdU9QSEcxMFFtdzl6VVRNMgoxdzJmMmlQRWpvbFpBVjFBaFU3dzFWNHBzc3JpWDIvNTlDR1dYT1VEcWNnd2MwdWh4djRnWFRndXBCeGcrYU5yCllybWZwNndtejdzN3lmblh3T2xVaVRDRW1Bc2NBemNkMmdCaGwvN1dpcmFRZFVzQ0F3RUFBYU5UTUZFd0hRWUQKVlIwT0JCWUVGSGJhbmo2RkdNVWZ3bEMwSytqY081TTlHd0FwTUI4R0ExVWRJd1FZTUJhQUZIYmFuajZGR01VZgp3bEMwSytqY081TTlHd0FwTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3RFFZSktvWklodmNOQVFFTEJRQURnZ0lCCkFBZVVVVUFMTk5FNDM2UEwvZXl6V0c3bmlPdndXODF3UkdVdGdEUnJpY2xFWjh0K3MzUG9MOXRibyszUGN1ekgKakxsUFArYmVLY2tUTEZKVGZZWUN3Z0dWZkdIRXE1ejV1SUt3ZWIyMG9GSEg3ek9DSzF3VVJBSUlPZnFycncyMApjcWNzdTRnK3NENnl0bllWN2Y1T0RFT2RNaXpjVXRrbGpMSjVieXJLSU9OV2FrSTBpd0xLeXFPQWlGeUVSY2xiCjB0ZzhoTDR6dkRLVUZ6dVJycXhxS0padzNWUWUvM1JWUFYwZ0RLUW96VEQ0M3lnQUdGVlVjckx1dHZOK2V5bEEKVDdYMGtNZXJlVVRKd1N6RDVvenhGRXFkaDlLNHZkZTA2a3BuSXpQS2tEanNFZiszeW9WeFVxRGJCeGV3ai9aOApodzhmT3lBWC9jV2UvZlhmWVdPV3RpTlhiQVJRd0pvUWlLb3lacHRuNGpvRXhLWVB2Qzg0RitINEZnZnpidXFkCnNnL2R2SjBxcldGaUlZeWZBRS9NNGM3VTBDUnVsZ1lETXJhbktIUHhxTllVT21pRzM4T0xLTDlFMmlvV002UHYKek82djVvUk5pazFFN3BrRUVMSUFPczR3U2MvdG45MU01TmtpSjgyRXNEQ2ZaVG5FVU9Cd3VsRzZSbW8vYWF0agpCWUJEaHo0dnhmN0ZjNG13WEdXNVZXc1Qzd2ZVckErZ3l3VWo5dlFqTTV6SjEybDl4NU9Dd3pNMTJuQWdSZ1dFCkh4ZDh5TFhkNE9rTWRaRWNVckY5eWtSMGJUZ3AyWnowL3lPR21KbVpieHRNdHlGaTVMcmt6VElodWJNS1l2bncKcWsrbWdaUmNMcXBWclRSYTNiaGdEVzJrSWpFT2I5SHB6NG5MZ3loUVpCMFAKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo="},"kind":"Secret","metadata":{"annotations":{},"name":"opensearch-dashboard-ca","namespace":"observability"}} + creationTimestamp: "2026-08-03T13:45:31Z" + name: opensearch-dashboard-ca + namespace: observability + resourceVersion: "4485295" + uid: 7fba4407-7eb1-456a-a10c-e8500630df2e +type: Opaque +``` +- Ingestion username/password +*username: logger* +*password: Enp129s0f0-l0gin* + +``` +root@k8s-cp-01:~# k get secret -n observability prepper-creds -o yaml +apiVersion: v1 +data: + logger: RW5wMTI5czBmMC1sMGdnM3I= +kind: Secret +metadata: + annotations: + kubectl.kubernetes.io/last-applied-configuration: | + {"apiVersion":"v1","data":{"logger":"RW5wMTI5czBmMC1sMGdnM3I="},"kind":"Secret","metadata":{"annotations":{},"name":"prepper-creds","namespace":"observability"}} + creationTimestamp: "2026-08-04T06:17:58Z" + name: prepper-creds + namespace: observability + resourceVersion: "4604982" + uid: 6592aff6-3e6b-45a1-9953-348c647ca8d3 +type: Opaque +root@k8s-cp-01:~# +``` + +- Target index name +*I am not understanding this* + +We will use dedicated ingestion user + + +# Phase 2 + +### Data Prepper pipeline: + +``` +cpanel-log-pipeline: + source: + http: + path: /logs + ssl: true + + + sink: + - opensearch: + hosts: ["brilliant-opensearch-cluster-master:9200"] + insecure: false + username: logger + password: ${LOGGER_PASSWORD} + index_type: custom + index: cpanel-test-%{yyyy.MM.dd} + ssl: true +``` + +log paths of cpanel: + +##### System logs (/var/log) + + +/var/log/apache2/ +/var/log/audit/ +/var/log/auth.log +/var/log/bootstrap.log +/var/log/chkservd.log +/var/log/clamav/ +/var/log/cpanel-install.log +/var/log/cpanel-server-traffic/ +/var/log/dmesg +/var/log/dpkg.log +/var/log/exim_mainlog +/var/log/exim_paniclog +/var/log/exim_rejectlog +/var/log/fail2ban.log +/var/log/kern.log +/var/log/lfd.log +/var/log/mail.err +/var/log/mail.log +/var/log/munin/ +/var/log/mysql/ +/var/log/named/ +/var/log/private/ +/var/log/quota_enable.log +/var/log/sw-cp-server/ +/var/log/syslog + +##### cPanel logs (/usr/local/cpanel/logs) + +/usr/local/cpanel/logs/access_log +/usr/local/cpanel/logs/api_tokens_log +/usr/local/cpanel/logs/backup_restore_manager_error_log +/usr/local/cpanel/logs/backup_restore_manager_log +/usr/local/cpanel/logs/build_locale_databases_log +/usr/local/cpanel/logs/cpbackup/ +/usr/local/cpanel/logs/cpbackup_transport_history.log +/usr/local/cpanel/logs/cpbackup_transporter/ +/usr/local/cpanel/logs/cpbackup_transporter.log +/usr/local/cpanel/logs/cpdavd_error_log +/usr/local/cpanel/logs/cpdavd_session_log +/usr/local/cpanel/logs/cphulkd.log +/usr/local/cpanel/logs/cphulkd_errors.log +/usr/local/cpanel/logs/cpwrapd_log +/usr/local/cpanel/logs/dnsadmin_log +/usr/local/cpanel/logs/error_log +/usr/local/cpanel/logs/incoming_http_requests.log +/usr/local/cpanel/logs/license_log +/usr/local/cpanel/logs/login_log +/usr/local/cpanel/logs/php-fpm/ +/usr/local/cpanel/logs/queueprocd.log +/usr/local/cpanel/logs/secpol_log +/usr/local/cpanel/logs/session_log +/usr/local/cpanel/logs/spamd_error_log +/usr/local/cpanel/logs/splitlogs_log +/usr/local/cpanel/logs/stats_log +/usr/local/cpanel/logs/tailwatchd_log +/usr/local/cpanel/logs/update_analysis + + +# Phase 3 + +I used values.yaml for creating the resources + + diff --git a/helm-charts-observability/charts/data-prepper/template.yaml b/helm-charts-observability/charts/data-prepper/template.yaml new file mode 100644 index 0000000..4ad6b56 --- /dev/null +++ b/helm-charts-observability/charts/data-prepper/template.yaml @@ -0,0 +1,226 @@ +--- +# Source: data-prepper/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: data-prepper + labels: + helm.sh/chart: data-prepper-0.3.1 + app.kubernetes.io/name: data-prepper + app.kubernetes.io/instance: data-prepper + app.kubernetes.io/version: "2.8.0" + app.kubernetes.io/managed-by: Helm +automountServiceAccountToken: true +--- +# Source: data-prepper/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + name: data-prepper-pipeline + labels: + helm.sh/chart: data-prepper-0.3.1 + app.kubernetes.io/name: data-prepper + app.kubernetes.io/instance: data-prepper + app.kubernetes.io/version: "2.8.0" + app.kubernetes.io/managed-by: Helm +type: Opaque +stringData: + pipelines.yaml: | + cpanel-log-pipeline: + buffer: + bounded_blocking: + batch_size: 128 + buffer_size: 2048 + delay: 10 + sink: + - opensearch: + cert: /usr/share/dataprepper/cert/root-ca.pem + hosts: + - https://brilliant-opensearch-cluster-master:9200 + index: cpanel-test-%{yyyy.MM.dd} + index_type: custom + insecure: false + password: ${LOGGER_PASSWORD} + username: logger + source: + http: + path: /logs + ssl: false + workers: 2 +--- +# Source: data-prepper/templates/configmap.yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: data-prepper-config + labels: + helm.sh/chart: data-prepper-0.3.1 + app.kubernetes.io/name: data-prepper + app.kubernetes.io/instance: data-prepper + app.kubernetes.io/version: "2.8.0" + app.kubernetes.io/managed-by: Helm +data: + data-prepper-config.yaml: | + ssl: false + # circuit_breakers: + # heap: + # usage: 2gb + # reset: 30s + # check_interval: 5s + + log4j2-rolling.properties: | + # + # Copyright OpenSearch Contributors + # SPDX-License-Identifier: Apache-2.0 + # + + status = error + dest = err + name = PropertiesConfig + + property.filename = log/data-prepper/data-prepper.log + + appender.console.type = Console + appender.console.name = STDOUT + appender.console.layout.type = PatternLayout + appender.console.layout.pattern = %d{ISO8601} [%t] %-5p %40C - %m%n + + appender.rolling.type = RollingFile + appender.rolling.name = RollingFile + appender.rolling.fileName = ${filename} + appender.rolling.filePattern = logs/data-prepper.log.%d{MM-dd-yy-HH}-%i.gz + appender.rolling.layout.type = PatternLayout + appender.rolling.layout.pattern = %d{ISO8601} [%t] %-5p %40C - %m%n + appender.rolling.policies.type = Policies + appender.rolling.policies.time.type = TimeBasedTriggeringPolicy + appender.rolling.policies.time.interval = 1 + appender.rolling.policies.time.modulate = true + appender.rolling.policies.size.type = SizeBasedTriggeringPolicy + appender.rolling.policies.size.size=100MB + appender.rolling.strategy.type = DefaultRolloverStrategy + appender.rolling.strategy.max = 168 + + rootLogger.level = warn + rootLogger.appenderRef.stdout.ref = STDOUT + rootLogger.appenderRef.file.ref = RollingFile + + logger.pipeline.name = org.opensearch.dataprepper.pipeline + logger.pipeline.level = info + + logger.parser.name = org.opensearch.dataprepper.parser + logger.parser.level = info + + logger.plugins.name = org.opensearch.dataprepper.plugins + logger.plugins.level = info +--- +# Source: data-prepper/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: data-prepper + labels: + helm.sh/chart: data-prepper-0.3.1 + app.kubernetes.io/name: data-prepper + app.kubernetes.io/instance: data-prepper + app.kubernetes.io/version: "2.8.0" + app.kubernetes.io/managed-by: Helm +spec: + type: ClusterIP + ports: + - name: http-source + port: 2021 + targetPort: 2021 + protocol: TCP + selector: + app.kubernetes.io/name: data-prepper + app.kubernetes.io/instance: data-prepper +--- +# Source: data-prepper/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: data-prepper + labels: + helm.sh/chart: data-prepper-0.3.1 + app.kubernetes.io/name: data-prepper + app.kubernetes.io/instance: data-prepper + app.kubernetes.io/version: "2.8.0" + app.kubernetes.io/managed-by: Helm +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: data-prepper + app.kubernetes.io/instance: data-prepper + template: + metadata: + annotations: + checksum/config: d9f25a6756b9ae068c1ec208e538bfd4708057961af4ababf7abb949f2458ac + checksum/pipelineconfig: 2166ddb3315ca7f85e5ee3ab3ebee0ede10992fb0882d771a2f9b9d9188f5df + labels: + helm.sh/chart: data-prepper-0.3.1 + app.kubernetes.io/name: data-prepper + app.kubernetes.io/instance: data-prepper + app.kubernetes.io/version: "2.8.0" + app.kubernetes.io/managed-by: Helm + spec: + serviceAccountName: data-prepper + securityContext: + {} + containers: + - name: data-prepper + env: + - name: LOGGER_PASSWORD + valueFrom: + secretKeyRef: + key: logger + secretName: prepper-creds + securityContext: + {} + image: "opensearchproject/data-prepper:2.8.0" + imagePullPolicy: IfNotPresent + ports: + - name: http-source + containerPort: 2021 + protocol: TCP + - name: server + containerPort: 4900 + protocol: TCP + livenessProbe: + httpGet: + path: /list + port: server + periodSeconds: 10 + initialDelaySeconds: 60 + failureThreshold: 2 + readinessProbe: + httpGet: + path: /list + port: server + resources: + limits: + cpu: 4 + memory: 6Gi + requests: + cpu: 2 + memory: 4Gi + volumeMounts: + - name: data-prepper-config + mountPath: /usr/share/data-prepper/config + readOnly: true + - name: data-prepper-pipelines + mountPath: /usr/share/data-prepper/pipelines + readOnly: true + - mountPath: /usr/share/dataprepper/cert + name: root-ca + readOnly: true + volumes: + - name: data-prepper-config + configMap: + name: data-prepper-config + - name: data-prepper-pipelines + secret: + secretName: data-prepper-pipeline + - name: root-ca + secret: + secretName: opensearch-dashboard-ca diff --git a/helm-charts-observability/charts/data-prepper/templates/NOTES.txt b/helm-charts-observability/charts/data-prepper/templates/NOTES.txt new file mode 100644 index 0000000..6814d81 --- /dev/null +++ b/helm-charts-observability/charts/data-prepper/templates/NOTES.txt @@ -0,0 +1,30 @@ +1. Get the application URL by running these commands: +{{- if .Values.ingress.enabled }} +{{- range $host := .Values.ingress.hosts }} + {{- range .paths }} + http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }} + {{- end }} +{{- end }} +{{- else if contains "NodePort" .Values.service.type }} + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "data-prepper.fullname" . }}) + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + echo http://$NODE_IP:$NODE_PORT +{{- else if contains "LoadBalancer" .Values.service.type }} + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + You can watch its status by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "data-prepper.fullname" . }}' + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "data-prepper.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") + echo http://$SERVICE_IP:{{ .Values.service.port }} +{{- else if contains "ClusterIP" .Values.service.type }} + export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "data-prepper.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") + export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}") + echo "Visit http://127.0.0.1:8080 to use your application" + kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT +{{- end }} + +{{- if eq "true" (include "data-prepper.demoPipeline" .) }} +The demo pipeline configuration is enabled, using the `random` source and `stdout` sink. +{{- else if .Values.pipelineConfig.enabled }} +Inline pipeline configuration is enabled. Please refer to the values.yaml file for the configuration. +{{- else }} +Pipeline configuration from secret {{ .Values.pipelineConfig.existingSecret }} is enabled. +{{- end }} \ No newline at end of file diff --git a/helm-charts-observability/charts/data-prepper/templates/_helpers.tpl b/helm-charts-observability/charts/data-prepper/templates/_helpers.tpl new file mode 100644 index 0000000..e10f00a --- /dev/null +++ b/helm-charts-observability/charts/data-prepper/templates/_helpers.tpl @@ -0,0 +1,95 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "data-prepper.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "data-prepper.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "data-prepper.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "data-prepper.labels" -}} +helm.sh/chart: {{ include "data-prepper.chart" . }} +{{ include "data-prepper.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "data-prepper.selectorLabels" -}} +app.kubernetes.io/name: {{ include "data-prepper.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "data-prepper.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "data-prepper.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + +{{/* +Create the dockerRegistry prefix if defined +*/}} +{{- define "data-prepper.dockerRegistry" -}} +{{- if eq .Values.global.dockerRegistry "" -}} + {{- .Values.global.dockerRegistry -}} +{{- else -}} + {{- .Values.global.dockerRegistry | trimSuffix "/" | printf "%s/" -}} +{{- end -}} +{{- end -}} + +{{/* +Utility to decide whether demoPipeline should be enabled. +If pipelineConfig.demoPipeline is true/false, return that value. +If pipelineConfig.demoPipeline is undefined, return true if no other pipeline is configured. +*/}} +{{- define "data-prepper.demoPipeline" -}} +{{- $demoPipeline := .Values.pipelineConfig.demoPipeline | toString -}} +{{- if eq $demoPipeline "true" -}} +{{ true }} +{{- else if eq $demoPipeline "false" -}} +{{ false }} +{{- else if or (not $demoPipeline) (eq $demoPipeline "") -}} +{{- if and (not .Values.pipelineConfig.enabled) (not .Values.pipelineConfig.existingSecret) -}} +{{ true }} +{{- else -}} +{{ false }} +{{- end -}} +{{- else -}} +{{ false }} +{{- end -}} +{{- end -}} \ No newline at end of file diff --git a/helm-charts-observability/charts/data-prepper/templates/configmap.yaml b/helm-charts-observability/charts/data-prepper/templates/configmap.yaml new file mode 100644 index 0000000..7ada9ee --- /dev/null +++ b/helm-charts-observability/charts/data-prepper/templates/configmap.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "data-prepper.fullname" . }}-config + labels: + {{- include "data-prepper.labels" . | nindent 4 }} +data: +{{- range $configName, $configYaml := .Values.config }} + {{ $configName }}: | + {{- if eq (kindOf $configYaml) "map" }} + {{- tpl (toYaml $configYaml) $ | nindent 4 }} + {{- else }} + {{- tpl $configYaml $ | nindent 4 -}} + {{- end -}} +{{- end -}} diff --git a/helm-charts-observability/charts/data-prepper/templates/demoPipeline.yaml b/helm-charts-observability/charts/data-prepper/templates/demoPipeline.yaml new file mode 100644 index 0000000..5c22c98 --- /dev/null +++ b/helm-charts-observability/charts/data-prepper/templates/demoPipeline.yaml @@ -0,0 +1,25 @@ +{{- if eq "true" (include "data-prepper.demoPipeline" .) }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "data-prepper.fullname" . }}-demo-pipeline + labels: + {{- include "data-prepper.labels" . | nindent 4 }} +type: Opaque +stringData: + pipelines.yaml: | + simple-sample-pipeline: + workers: 2 # the number of workers + delay: 5000 # in milliseconds, how long workers wait between read attempts + source: + random: {} + buffer: + bounded_blocking: + buffer_size: 1024 # max number of records the buffer accepts + batch_size: 256 # max number of records the buffer drains after each read + processor: + - string_converter: + upper_case: true + sink: + - stdout: {} +{{- end }} diff --git a/helm-charts-observability/charts/data-prepper/templates/deployment.yaml b/helm-charts-observability/charts/data-prepper/templates/deployment.yaml new file mode 100644 index 0000000..b172352 --- /dev/null +++ b/helm-charts-observability/charts/data-prepper/templates/deployment.yaml @@ -0,0 +1,118 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "data-prepper.fullname" . }} + labels: + {{- include "data-prepper.labels" . | nindent 4 }} +spec: + {{- if not .Values.autoscaling.enabled }} + replicas: {{ .Values.replicaCount }} + {{- end }} + selector: + matchLabels: + {{- include "data-prepper.selectorLabels" . | nindent 6 }} + template: + metadata: + annotations: + {{- with .Values.podAnnotations }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if .Values.config }} + checksum/config: {{ include (print .Template.BasePath "/configmap.yaml") . | sha256sum | trunc 63 }} + {{- end }} + {{- if .Values.pipelineConfig.enabled }} + checksum/pipelineconfig: {{ include (print .Template.BasePath "/secret.yaml") . | sha256sum | trunc 63 }} + {{- end }} + labels: + {{- include "data-prepper.labels" . | nindent 8 }} + {{- with .Values.podLabels }} + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "data-prepper.serviceAccountName" . }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + containers: + - name: {{ .Chart.Name }} + env: + {{- with .Values.extraEnvs }} + {{- toYaml . | nindent 12 }} + {{- end }} + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + image: "{{ template "data-prepper.dockerRegistry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + ports: + {{- range .Values.ports }} + - name: {{ .name }} + containerPort: {{ .port }} + protocol: TCP + {{- end }} + - name: server + containerPort: {{ (.Values.config).serverPort | default 4900 }} + protocol: TCP + livenessProbe: + httpGet: + path: /list + port: server + {{- if not ( empty (.Values.config).ssl ) }} + scheme: HTTPS + {{- end }} + periodSeconds: 10 + initialDelaySeconds: 60 + failureThreshold: 2 + readinessProbe: + httpGet: + path: /list + port: server + {{- if not ( empty (.Values.config).ssl ) }} + scheme: HTTPS + {{- end }} + resources: + {{- toYaml .Values.resources | nindent 12 }} + volumeMounts: + - name: data-prepper-config + mountPath: /usr/share/data-prepper/config + readOnly: true + - name: data-prepper-pipelines + mountPath: /usr/share/data-prepper/pipelines + readOnly: true + {{- with .Values.volumeMounts }} + {{- toYaml . | nindent 12 }} + {{- end }} + volumes: + - name: data-prepper-config + configMap: + name: {{ include "data-prepper.fullname" . }}-config + - name: data-prepper-pipelines + secret: + {{- if eq "true" (include "data-prepper.demoPipeline" .) }} + secretName: {{ include "data-prepper.fullname" . }}-demo-pipeline + {{- else if .Values.pipelineConfig.enabled }} + secretName: {{ include "data-prepper.fullname" . }}-pipeline + {{- else }} + secretName: {{ required "A valid pipeline configuration is required! Please set one of:\npipelineConfig.existingSecret - for your custom pipeline secret\npipelineConfig.enabled - for inline configuration in values.yaml or\npipelineConfig.demoPipeline=true - for a sample demo pipeline using random source and stdout sink." .Values.pipelineConfig.existingSecret }} + {{- end }} + {{- with .Values.volumes }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.initContainers }} + initContainers: + {{- toYaml . | nindent 8 }} + {{- end }} \ No newline at end of file diff --git a/helm-charts-observability/charts/data-prepper/templates/hpa.yaml b/helm-charts-observability/charts/data-prepper/templates/hpa.yaml new file mode 100644 index 0000000..ae2a773 --- /dev/null +++ b/helm-charts-observability/charts/data-prepper/templates/hpa.yaml @@ -0,0 +1,32 @@ +{{- if .Values.autoscaling.enabled }} +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "data-prepper.fullname" . }} + labels: + {{- include "data-prepper.labels" . | nindent 4 }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "data-prepper.fullname" . }} + minReplicas: {{ .Values.autoscaling.minReplicas }} + maxReplicas: {{ .Values.autoscaling.maxReplicas }} + metrics: + {{- if .Values.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }} + {{- end }} + {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + target: + type: Utilization + averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/helm-charts-observability/charts/data-prepper/templates/ingress.yaml b/helm-charts-observability/charts/data-prepper/templates/ingress.yaml new file mode 100644 index 0000000..facc897 --- /dev/null +++ b/helm-charts-observability/charts/data-prepper/templates/ingress.yaml @@ -0,0 +1,61 @@ +{{- if .Values.ingress.enabled -}} +{{- $fullName := include "data-prepper.fullname" . -}} +{{- $svcPort := .Values.service.port -}} +{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }} + {{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }} + {{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}} + {{- end }} +{{- end }} +{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1 +{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1beta1 +{{- else -}} +apiVersion: extensions/v1beta1 +{{- end }} +kind: Ingress +metadata: + name: {{ $fullName }} + labels: + {{- include "data-prepper.labels" . | nindent 4 }} + {{- with .Values.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }} + ingressClassName: {{ .Values.ingress.className }} + {{- end }} + {{- if .Values.ingress.tls }} + tls: + {{- range .Values.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} + {{- end }} + rules: + {{- range .Values.ingress.hosts }} + - host: {{ .host | quote }} + http: + paths: + {{- range .paths }} + - path: {{ .path }} + {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }} + pathType: {{ .pathType }} + {{- end }} + backend: + {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }} + service: + name: {{ $fullName }} + port: + number: {{ $svcPort }} + {{- else }} + serviceName: {{ $fullName }} + servicePort: {{ $svcPort }} + {{- end }} + {{- end }} + {{- end }} +{{- end }} diff --git a/helm-charts-observability/charts/data-prepper/templates/secret.yaml b/helm-charts-observability/charts/data-prepper/templates/secret.yaml new file mode 100644 index 0000000..0e4ff08 --- /dev/null +++ b/helm-charts-observability/charts/data-prepper/templates/secret.yaml @@ -0,0 +1,12 @@ +{{- if .Values.pipelineConfig.enabled }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "data-prepper.fullname" . }}-pipeline + labels: + {{- include "data-prepper.labels" . | nindent 4 }} +type: Opaque +stringData: + pipelines.yaml: | + {{- toYaml .Values.pipelineConfig.config | nindent 4 }} +{{- end }} diff --git a/helm-charts-observability/charts/data-prepper/templates/service.yaml b/helm-charts-observability/charts/data-prepper/templates/service.yaml new file mode 100644 index 0000000..5a6e186 --- /dev/null +++ b/helm-charts-observability/charts/data-prepper/templates/service.yaml @@ -0,0 +1,17 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "data-prepper.fullname" . }} + labels: + {{- include "data-prepper.labels" . | nindent 4 }} +spec: + type: {{ .Values.service.type }} + ports: + {{- range .Values.ports }} + - name: {{ .name }} + port: {{ .port }} + targetPort: {{ .port }} + protocol: TCP + {{- end }} + selector: + {{- include "data-prepper.selectorLabels" . | nindent 4 }} diff --git a/helm-charts-observability/charts/data-prepper/templates/serviceaccount.yaml b/helm-charts-observability/charts/data-prepper/templates/serviceaccount.yaml new file mode 100644 index 0000000..5a1f4ec --- /dev/null +++ b/helm-charts-observability/charts/data-prepper/templates/serviceaccount.yaml @@ -0,0 +1,13 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "data-prepper.serviceAccountName" . }} + labels: + {{- include "data-prepper.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +automountServiceAccountToken: {{ .Values.serviceAccount.automount }} +{{- end }} diff --git a/helm-charts-observability/charts/data-prepper/values.yaml b/helm-charts-observability/charts/data-prepper/values.yaml new file mode 100644 index 0000000..d2e9208 --- /dev/null +++ b/helm-charts-observability/charts/data-prepper/values.yaml @@ -0,0 +1,360 @@ +# Copyright OpenSearch Contributors +# SPDX-License-Identifier: Apache-2.0 + +# Default values for data-prepper. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 + +global: + # Set if you want to change the default docker registry, e.g. a private one. + dockerRegistry: "" + +image: + # -- The image repository from which to pull the Data Prepper image + repository: opensearchproject/data-prepper + # -- The image tag to pull. Default: IfNotPresent + pullPolicy: IfNotPresent + # -- Overrides the image tag whose default is the chart appVersion. + tag: "" + +# -- List of imagePullSecrets to use if the Docker image is stored in a private registry +imagePullSecrets: [] +# -- Override the default name for the deployment +nameOverride: "" +# -- Override the default fullname for the deployment +fullnameOverride: "" + +# -- Extra environment variables to pass to the Data Prepper container +extraEnvs: + # - name: "JAVA_OPTS" + # value: "-Dlog4j2.debug=true" + - name: "LOGGER_PASSWORD" + valueFrom: + secretKeyRef: + name: prepper-creds + key: logger +# Check https://opensearch.org/docs/latest/data-prepper/managing-data-prepper/configuring-data-prepper/ +# for more information on the configuration options +# -- Data Prepper configuration +config: + # -- Main Data Prepper configuration file content + data-prepper-config.yaml: | + ssl: false + # circuit_breakers: + # heap: + # usage: 2gb + # reset: 30s + # check_interval: 5s + + # -- Log4j2 configuration for Data Prepper logging + log4j2-rolling.properties: | + # + # Copyright OpenSearch Contributors + # SPDX-License-Identifier: Apache-2.0 + # + + status = error + dest = err + name = PropertiesConfig + + property.filename = log/data-prepper/data-prepper.log + + appender.console.type = Console + appender.console.name = STDOUT + appender.console.layout.type = PatternLayout + appender.console.layout.pattern = %d{ISO8601} [%t] %-5p %40C - %m%n + + appender.rolling.type = RollingFile + appender.rolling.name = RollingFile + appender.rolling.fileName = ${filename} + appender.rolling.filePattern = logs/data-prepper.log.%d{MM-dd-yy-HH}-%i.gz + appender.rolling.layout.type = PatternLayout + appender.rolling.layout.pattern = %d{ISO8601} [%t] %-5p %40C - %m%n + appender.rolling.policies.type = Policies + appender.rolling.policies.time.type = TimeBasedTriggeringPolicy + appender.rolling.policies.time.interval = 1 + appender.rolling.policies.time.modulate = true + appender.rolling.policies.size.type = SizeBasedTriggeringPolicy + appender.rolling.policies.size.size=100MB + appender.rolling.strategy.type = DefaultRolloverStrategy + appender.rolling.strategy.max = 168 + + rootLogger.level = warn + rootLogger.appenderRef.stdout.ref = STDOUT + rootLogger.appenderRef.file.ref = RollingFile + + logger.pipeline.name = org.opensearch.dataprepper.pipeline + logger.pipeline.level = info + + logger.parser.name = org.opensearch.dataprepper.parser + logger.parser.level = info + + logger.plugins.name = org.opensearch.dataprepper.plugins + logger.plugins.level = info + +# For OpenSearch Data Prepper is crucial for defining the behavior and structure of your data processing pipelines. +# Each pipeline is defined with a unique name and can include `source`, `processor`, and `sink` components to ingest, +# process, and output data respectively. This flexible configuration allows for the creation of complex data processing +# flows, including the routing of data between pipelines. +# For detailed information on the available options and to get the most up-to-date guidance on configuring `pipeline.yaml`, +# please consult the [OpenSearch Documentation on Pipelines](https://opensearch.org/docs/2.4/data-prepper/pipelines/pipelines/). +# This resource provides comprehensive examples and explanations of each component, ensuring you can tailor your Data Prepper +# deployment to meet your specific data processing needs. + +# -- Pipeline configuration +pipelineConfig: + # If 'true', a secret containing a demo pipeline configuration with random source and stdout sink will be created. + # If left undefined, the demo pipeline will be used only when no other pipeline is configured below + demoPipeline: "" + # -- The name of the existing secret containing the pipeline configuration. + # If enabled is false existingSecret is used. The existingSecret must have a key named `pipelines.yaml`. + existingSecret: "" + # If enabled, a secret containing the pipeline configuration will be created based on the 'config' section below. + enabled: true + # The configuration of the pipeline see https://opensearch.org/docs/2.4/data-prepper/pipelines/pipelines/ + config: + ## Provide your pipeline configuration here if 'enabled' is set to true. See documentation for more advanced pipelines + # simple-sample-pipeline: + # workers: 2 # the number of workers + # delay: 5000 # in milliseconds, how long workers wait between read attempt + cpanel-log-router: + workers: 2 + delay: 100 + source: + http: + path: /logs + ssl: false + port: 2021 + + buffer: + bounded_blocking: + buffer_size: 2048 + batch_size: 128 + + route: + - systemLog : '/log_source == "system.syslog"' + - accessLog : '/log_source == "cpanel.access_log"' + - auditLog : '/log_source == "audit.audit.log"' + + sink: + - pipeline: + name: cpanel-access-pipeline + routes: + - accessLog + + - pipeline: + name: cpanel-system-syslog-pipeline + routes: + - systemLog + + - pipeline: + name: cpanel-audit-pipeline + + - pipeline: + name: cpanel-all-log + + + + cpanel-access-pipeline: + source: + pipeline: + name: cpanel-log-router + + processor: + - grok: + break_on_match: false + match: + log: + - '^%{IP:client_ip} %{NOTSPACE:identity} %{NOTSPACE:user} \[%{GREEDYDATA:timestamp}\] "%{WORD:method} %{URIPATHPARAM:url} HTTP/%{NUMBER:http_version}" %{INT:http_status:int} %{NONNEGINT:bytes:long} "%{NOTSPACE:referrer}" "%{GREEDYDATA:user_agent}" "%{NOTSPACE:auth_method}" "%{GREEDYDATA:x_forwarded_for}" %{POSINT:service_port:int}$' + target_key: parsed + + - date: + match: + - key: /parsed/timestamp + patterns: + - "MM/dd/yyyy:HH:mm:ss Z" + destination: "@timestamp" + + sink: + - opensearch: + hosts: + - "https://brilliant-opensearch-cluster-master:9200" + insecure: false + username: logger + password: "Enp129s0f0-l0gin" + index_type: custom + cert: /usr/share/dataprepper/cert/root-ca.pem + index: cpanel-access-log-%{yyyy.MM.dd} + + cpanel-system-syslog-pipeline: + source: + pipeline: + name: cpanel-log-router + processor: + - drop_events: + drop_when: '/log_source != "system.syslog"' + - grok: + break_on_match: false + match: + log: + - '^%{TIMESTAMP_ISO8601:timestamp} %{NOTSPACE:hostname} %{DATA:process}\[(?:%{POSINT:pid})\]: %{GREEDYDATA:message}$' + target_key: parsed + sink: + - opensearch: + hosts: + - "https://brilliant-opensearch-cluster-master:9200" + insecure: false + username: logger + password: "Enp129s0f0-l0gin" + index_type: custom + cert: /usr/share/dataprepper/cert/root-ca.pem + index: cpanel-system-syslog-%{yyyy.MM.dd} + + cpanel-audit-pipeline: + source: + pipeline: + name: cpanel-log-router + processor: + - drop_events: + drop_when: '/log_source != "audit.audit.log"' + + sink: + - opensearch: + hosts: + - "https://brilliant-opensearch-cluster-master:9200" + insecure: false + username: logger + password: "Enp129s0f0-l0gin" + index_type: custom + cert: /usr/share/dataprepper/cert/root-ca.pem + index: cpanel-audit-log-%{yyyy.MM.dd} + + + cpanel-all-log: + source: + pipeline: + name: cpanel-log-router + + sink: + - opensearch: + hosts: + - "https://brilliant-opensearch-cluster-master:9200" + insecure: false + username: logger + password: "Enp129s0f0-l0gin" + index_type: custom + cert: /usr/share/dataprepper/cert/root-ca.pem + index: cpanel-all-log-%{yyyy.MM.dd} + + +# -- Data Prepper ports +ports: + # -- The port that the source is running on. Default value is 2021. Valid options are between 0 and 65535. + # https://opensearch.org/docs/latest/data-prepper/pipelines/configuration/sources/http-source/ + - name: http-source + port: 2021 + # # -- The port that the otel_trace_source source runs on. Default value is 21890. + # # https://opensearch.org/docs/latest/data-prepper/pipelines/configuration/sources/otel-trace-source/ + # - name: otel-traces + # port: 21890 + # # -- The port that the OpenTelemtry metrics source runs on. Default value is 21891. + # # https://opensearch.org/docs/latest/data-prepper/pipelines/configuration/sources/otel-metrics-source/ + # - name: otel-metrics + # port: 21891 + # # -- Represents the port that the otel_logs_source source is running on. Default value is 21892. + # # https://opensearch.org/docs/latest/data-prepper/pipelines/configuration/sources/otel-logs-source/ + # - name: otel-logs + # port: 21892 + +serviceAccount: + # -- Specifies whether a service account should be created + create: true + # -- Automatically mount a ServiceAccount's API credentials? + automount: true + # -- Annotations to add to the service account + annotations: {} + # -- The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + +podAnnotations: {} +podLabels: {} + +podSecurityContext: {} + # fsGroup: 2000 + +securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 1000 + +initContainers: [] + +service: + type: ClusterIP + port: 2021 + +ingress: + enabled: false + className: "nginx" + annotations: + kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + hosts: + - paths: + - path: /logs + pathType: Prefix + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + +resources: + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + limits: + cpu: 4 + memory: 6Gi + requests: + cpu: 2 + memory: 4Gi + +autoscaling: +# done for testing, in production this will be true + enabled: false + minReplicas: 1 + maxReplicas: 100 + targetCPUUtilizationPercentage: 75 + targetMemoryUtilizationPercentage: 75 + +# Additional volumes on the output Deployment definition. +volumes: +- name: root-ca + secret: + secretName: opensearch-dashboard-ca +# - name: foo +# secret: +# secretName: mysecret +# optional: false + +# Additional volumeMounts on the output Deployment definition. +volumeMounts: +- name: root-ca + readOnly: true + mountPath: /usr/share/dataprepper/cert +# - name: foo +# mountPath: "/etc/foo" +# readOnly: true + +nodeSelector: {} + +tolerations: [] + +affinity: {} diff --git a/helm-charts-observability/charts/opensearch-dashboards/.helmignore b/helm-charts-observability/charts/opensearch-dashboards/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/helm-charts-observability/charts/opensearch-dashboards/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/helm-charts-observability/charts/opensearch-dashboards/CHANGELOG.md b/helm-charts-observability/charts/opensearch-dashboards/CHANGELOG.md new file mode 100644 index 0000000..b4da774 --- /dev/null +++ b/helm-charts-observability/charts/opensearch-dashboards/CHANGELOG.md @@ -0,0 +1,117 @@ +# Changelog + +All notable changes to this project will be documented in this file. + +The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), +and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). + +--- +## [Unreleased] +### Added +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [3.7.0] +### Added +- Updated OpenSearch Dashboards appVersion to 3.7.0 +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [3.6.0] +### Added +- Updated OpenSearch Dashboards appVersion to 3.6.0 +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [3.5.0] +### Added +- Updated OpenSearch Dashboards appVersion to 3.5.0 +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [3.4.0] +### Added +- Updated OpenSearch Dashboards appVersion to 3.4.0 +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [3.3.0] +### Added +- Updated OpenSearch Dashboards appVersion to 3.3.0 +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [3.2.2] +### Added +- Support for disabling automountServiceAccountToken +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [3.2.1] +### Added +### Changed +- Correct changelogs +### Deprecated +### Removed +### Fixed +### Security +--- +## [3.2.0] +### Added +- Updated OpenSearch Dashboards appVersion to 3.2.0 +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [3.1.0] +### Added +- Updated OpenSearch Dashboards appVersion to 3.1.0 +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [3.0.0] +### Added +- Switch main branch to be 3.x with 3.0.0 as 1st release +### Changed +### Deprecated +### Removed +### Fixed +### Security + +[Unreleased]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-3.7.0...HEAD +[3.7.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-3.6.0...opensearch-dashboards-3.7.0 +[3.6.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-3.5.0...opensearch-dashboards-3.6.0 +[3.5.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-3.4.0...opensearch-dashboards-3.5.0 +[3.4.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-3.3.0...opensearch-dashboards-3.4.0 +[3.3.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-3.2.2...opensearch-dashboards-3.3.0 +[3.2.2]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-3.2.1...opensearch-dashboards-3.2.2 +[3.2.1]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-3.2.0...opensearch-dashboards-3.2.1 +[3.2.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-3.1.0...opensearch-dashboards-3.2.0 +[3.1.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-3.0.0...opensearch-dashboards-3.1.0 +[3.0.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-2.29.0...opensearch-dashboards-3.0.0 diff --git a/helm-charts-observability/charts/opensearch-dashboards/Chart.yaml b/helm-charts-observability/charts/opensearch-dashboards/Chart.yaml new file mode 100644 index 0000000..c0c6041 --- /dev/null +++ b/helm-charts-observability/charts/opensearch-dashboards/Chart.yaml @@ -0,0 +1,31 @@ +apiVersion: v2 +name: opensearch-dashboards +description: A Helm chart for OpenSearch Dashboards + +# A chart can be either an 'application' or a 'library' chart. +# +# Application charts are a collection of templates that can be packaged into versioned archives +# to be deployed. +# +# Library charts provide useful utilities or functions for the chart developer. They're included as +# a dependency of application charts to inject those utilities and functions into the rendering +# pipeline. Library charts do not define any templates and therefore cannot be deployed. +type: application + +# This is the chart version. This version number should be incremented each time you make changes +# to the chart and its templates, including the app version. +# Versions are expected to follow Semantic Versioning (https://semver.org/) +version: 3.7.0 + +# This is the version number of the application being deployed. This version number should be +# incremented each time you make changes to the application. Versions are not expected to +# follow Semantic Versioning. They should reflect the version the application is using. +# It is recommended to use it with quotes. +appVersion: "3.7.0" + +maintainers: + - name: DandyDeveloper + - name: gaiksaya + - name: peterzhuamazon + - name: prudhvigodithi + - name: TheAlgo diff --git a/helm-charts-observability/charts/opensearch-dashboards/README.md b/helm-charts-observability/charts/opensearch-dashboards/README.md new file mode 100644 index 0000000..d57eec4 --- /dev/null +++ b/helm-charts-observability/charts/opensearch-dashboards/README.md @@ -0,0 +1,141 @@ +# OpenSearch Dashboards Helm Chart + + This Helm chart installs [OpenSearch Dashboards](https://github.com/opensearch-project/OpenSearch-Dashboards) with configurable TLS, RBAC and much more configurations. This chart caters to a number of different use cases and setups. + +- [Requirements](#requirements) +- [Installing](#installing) +- [Uninstalling](#uninstalling) + +## Requirements + +- Kubernetes >= 1.14 +- Helm >= 2.17.0 +- We recommend you to have 8 GiB of memory available for this deployment, or at least 4 GiB for the minimum requirement. Else, the deployment is expected to fail. + +## Installing + +Once you've added this Helm repository as per the repository-level [README](../../README.md#installing) +then you can install the chart as follows: + +```shell +helm install my-release opensearch/opensearch-dashboards +``` + +The command deploys OpenSearch Dashboards with its associated components on the Kubernetes cluster in the default configuration. + +**NOTE:** If using Helm 2 then you'll need to add the [`--name`](https://v2.helm.sh/docs/helm/#options-21) command line argument. If unspecified, Helm 2 will autogenerate a name for you. + +## Uninstalling + +To delete/uninstall the chart with the release name `my-release`: + +```shell +helm uninstall my-release +``` + +## Configuration + +| Parameter | Description | Default | +| :--- | :--- | :--- | +| `envFrom` | Templatable string to be passed to the [environment from variables][] which will be appended to the `envFrom:` definition for the container | `[]` | +| `config` | Allows you to add any config files in `/usr/share/opensearch-dashboards/` such as `opensearch_dashboards.yml`. String or map format may be used for specifying content of each configuration file. In case of string format, the whole content of the config file will be replaced by new config file value when in case of using map format content of configuration file will be a result of merge. In both cases content passed through tpl. See [values.yaml][] for an example of the formatting | `{}` | +| `extraContainers` | Array of extra containers | `""` | +| `extraEnvs` | Extra environments variables to be passed to OpenSearch services | `[]` | +| `extraInitContainers` | Array of extra init containers | `[]` | +| `extraVolumeMounts` | Array of extra volume mounts | `[]` | +| `extraVolumes` | Array of extra volumes to be added | `[]` | +| `fullnameOverride` | Overrides the `clusterName` and `nodeGroup` when used in the naming of resources. This should only be used when using a single `nodeGroup`, otherwise you will have name conflicts | `""` | +| `hostAliases` | Configurable [hostAliases][] | `[]` | +| `image.pullPolicy` | The Kubernetes [imagePullPolicy][] value | `IfNotPresent` | +| `imagePullSecrets` | Configuration for [imagePullSecrets][] so that you can use a private registry for your image | `[]` | +| `image.tag` | The OpenSearch Docker image tag | `1.0.0` | +| `image.repository` | The OpenSearch Docker image | `opensearchproject/opensearch` | +| `ingress` | Configurable [ingress][] to expose the OpenSearch service. See [values.yaml][] for an example | see [values.yaml][] | +| `labels` | Configurable [labels][] applied to all OpenSearch pods | `{}` | +| `lifecycle` | Allows you to add [lifecycle hooks](https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/). See [values.yaml][] for an example | `{}` | +| `nameOverride` | Overrides the `clusterName` when used in the naming of resources | `""` | +| `nodeSelector` | Configurable [nodeSelector][] so that you can target specific nodes for your OpenSearch cluster | `{}` | +| `podAnnotations` | Configurable [annotations][] applied to all OpenSearch pods | `{}` | +| `podSecurityContext` | Allows you to set the [securityContext][] for the pod | see [values.yaml][] | +| `priorityClassName` | The name of the [PriorityClass][]. No default is supplied as the PriorityClass must be created first | `""` | +| `rbac` | Configuration for creating a role, role binding and ServiceAccount as part of this Helm chart with `create: true`. Also can be used to reference an external ServiceAccount with `serviceAccountName: "externalServiceAccountName"` | see [values.yaml][] | +| `resources` | Allows you to set the [resources][] for the StatefulSet | see [values.yaml][] | +| `secretMounts` | Allows you easily mount a secret as a file inside the StatefulSet. Useful for mounting certificates and other secrets. See [values.yaml][] for an example | `[]` | +| `securityContext` | Allows you to set the [securityContext][] for the container | see [values.yaml][] | +| `service.annotations` | [LoadBalancer annotations][] that Kubernetes will use for the service. This will configure load balancer if `service.type` is `LoadBalancer` | `{}` | +| `service.headless.annotations` | Allow you to set annotations on the headless service | `{}` | +| `service.externalTrafficPolicy` | Some cloud providers allow you to specify the [LoadBalancer externalTrafficPolicy][]. Kubernetes will use this to preserve the client source IP. This will configure load balancer if `service.type` is `LoadBalancer` | `""` | +| `service.httpPortName` | The name of the http port within the service | `http` | +| `service.labelsHeadless` | Labels to be added to headless service | `{}` | +| `service.labels` | Labels to be added to non-headless service | `{}` | +| `service.loadBalancerIP` | Some cloud providers allow you to specify the [loadBalancer][] IP. If the `loadBalancerIP` field is not specified, the IP is dynamically assigned. If you specify a `loadBalancerIP` but your cloud provider does not support the feature, it is ignored. | `""` | +| `service.loadBalancerSourceRanges` | The IP ranges that are allowed to access | `[]` | +| `service.nodePort` | Custom [nodePort][] port that can be set if you are using `service.type: nodePort` | `""` | +| `service.transportPortName` | The name of the transport port within the service | `transport` | +| `service.type` | OpenSearch [Service Types][] | `ClusterIP` | +| `service.ipFamilyPolicy` | This sets the preferred ip addresses in case of a dual-stack server, there are three options [PreferDualStack, SingleStack, RequireDualStack], [more information on dual stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/) | `""` | +| `service.ipFamilies` | Sets the preferred IP variants and in which order they are preferred, the first family you list is used for the legacy .spec.ClusterIP field, [more information on dual stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/) | `""` | +| `service.metricsPort` | The metrics port (for Performance Analyzer) that Kubernetes will use for the service. | `9601` | +| `service.metricsPortName` | The name of the metrics port (for Performance Analyzer) within the service | `metrics` | +| `serviceAccount.automountServiceAccountToken` | Specifies whether the Kubernetes API token for the ServiceAccount should be automatically mounted to the pod. | `true` | +| `tolerations` | Configurable [tolerations][] | `[]` | +| `topologySpreadConstraints` | Configuration for pod [topologySpreadConstraints][] | `[]` | +| `updateStrategy` | The [updateStrategy][] for the StatefulSet. By default Kubernetes will wait for the cluster to be green after upgrading each pod. Setting this to `OnDelete` will allow you to manually delete each pod during upgrades | `RollingUpdate` | +| `extraObjects` | Array of extra K8s manifests to deploy | list `[]` | +| `autoscaling.enabled` | Prerequisite: Install/Configure metrics server, to install use `kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml`, See [Metrics Server](https://github.com/kubernetes-sigs/metrics-server). | false | +| `autoscaling.minReplicas` | The lower limit for the number of replicas to which the autoscaler can scale down. | 1 | +| `autoscaling.maxReplicas` | The upper limit for the number of replicas to which the autoscaler can scale up. | 10 | +| `autoscaling.targetCPU` | The target value of the average CPU across all OpenSearch Dashboards pods. | 80 | +| `autoscaling.targetMemory` | The target value of the average memory across all OpenSearch Dashboards pods. Value should be tuned based on the requested memory value for OpenSearch Dashboards pods. Scaling based on memory utilization may be necessary for large datasets or complex dashboards. | 80 | +| `livenessProbe` | Configuration fields for the liveness [probe][] | see [exampleLiveness][] in `values.yaml`| +| `readinessProbe` | Configuration fields for the readiness [probe][] | see [exampleReadiness][] in `values.yaml`| +| `startupProbe` | Configuration fields for the startup [probe][] | see [exampleStartup][] in `values.yaml` | +| `plugins.enabled` | Allow/disallow to add 3rd Party / Custom plugins not offered in the default OpenSearchDashboards image | false | +| `plugins.installList` | Array containing the Opensearch Dashboards plugins to be installed in container | [] | +| `opensearchDashboardsYml.defaultMode` | Allow you to set the defaultMode for the opensearch_dashboards.yml mounted as configMap | | +| `dashboardAnnotations` | Allows you to configure custom annotation in the deployement of the OpenSearchDashboards container | {} | +| `serviceMonitor.enabled` | Enables the creation of a [ServiceMonitor] resource for Prometheus monitoring. Requires the Prometheus Operator to be installed in your Kubernetes cluster. | `false` | +| `serviceMonitor.path` | Path where metrics are exposed. Applicable only if `serviceMonitor.enabled` is set to `true`. | `/_prometheus/metrics` | +| `serviceMonitor.interval` | Interval at which metrics should be scraped by Prometheus. Applicable only if `serviceMonitor.enabled` is set to `true`. | `10s` | + +[environment from variables]: https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/#configure-all-key-value-pairs-in-a-configmap-as-container-environment-variables + +[values.yaml]:https://github.com/opensearch-project/helm-charts/blob/main/charts/opensearch/values.yaml + +[hostAliases]: https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + +[imagepullPolicy]: https://kubernetes.io/docs/concepts/containers/images/#updating-images +[imagePullSecrets]: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ +[ingress]: https://kubernetes.io/docs/concepts/services-networking/ingress/ +[resources]: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + +[labels]: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + +[nodeSelector]: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector + +[annotations]: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + +[securityContext]: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + +[priorityClass]: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass + +[loadBalancer annotations]: https://kubernetes.io/docs/concepts/services-networking/service/#ssl-support-on-aws +[loadBalancer externalTrafficPolicy]: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip +[loadBalancer]: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer + +[nodePort]: https://kubernetes.io/docs/concepts/services-networking/service/#nodeport + +[tolerations]: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + +[updateStrategy]: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/ + +[service types]: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + +[probe]: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-readiness-probes + +[exampleStartup]: https://github.com/opensearch-project/helm-charts/blob/main/charts/opensearch-dashboards/values.yaml#17 +[exampleLiveness]: https://github.com/opensearch-project/helm-charts/blob/main/charts/opensearch-dashboards/values.yaml#27 +[exampleReadiness]: https://github.com/opensearch-project/helm-charts/blob/main/charts/opensearch-dashboards/values.yaml#37 +[topologySpreadConstraints]: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints + +[ServiceMonitor]: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#servicemonitor diff --git a/helm-charts-observability/charts/opensearch-dashboards/kibanaserver-pass.yaml b/helm-charts-observability/charts/opensearch-dashboards/kibanaserver-pass.yaml new file mode 100644 index 0000000..3f8ed20 --- /dev/null +++ b/helm-charts-observability/charts/opensearch-dashboards/kibanaserver-pass.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +data: + KIBANASERVER_PASSWORD: RW5wMTI5czBmMA== +kind: Secret +metadata: + name: opensearch-kibanaserver-password + namespace: observability \ No newline at end of file diff --git a/helm-charts-observability/charts/opensearch-dashboards/opensearch-ca-public-key.yaml b/helm-charts-observability/charts/opensearch-dashboards/opensearch-ca-public-key.yaml new file mode 100644 index 0000000..4046dc3 --- /dev/null +++ b/helm-charts-observability/charts/opensearch-dashboards/opensearch-ca-public-key.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +data: + root-ca.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUY3VENDQTlXZ0F3SUJBZ0lVTC9hTytnYS9YY3lzakFYbGh1WG92d0xLWkJjd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZVXhDekFKQmdOVkJBWVRBa0pFTVE0d0RBWURWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaAphMkV4RWpBUUJnTlZCQW9NQ1VKeWFXeHNhV0Z1ZERFYk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwCklFTkJNU1V3SXdZRFZRUUREQnhDY21sc2JHbGhiblFnVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUI0WERUSTIKTURjeU16RTFNREV4T1ZvWERUTTJNRGN5TURFMU1ERXhPVm93Z1lVeEN6QUpCZ05WQkFZVEFrSkVNUTR3REFZRApWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaGEyRXhFakFRQmdOVkJBb01DVUp5YVd4c2FXRnVkREViCk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwSUVOQk1TVXdJd1lEVlFRRERCeENjbWxzYkdsaGJuUWcKVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUlJQ0lqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FnOEFNSUlDQ2dLQwpBZ0VBdXlEYmRaMUFycWd6K1l3SkNUcWlxREtuUzNDRGhHekNxK0h5WDN3clBnV0JvZFBraHJCV3dkNzQ4ZjdqClhZWDNQditQS0F0ZzVGYjdxa2ZZUFZJR0FPZUNiUWxkRlJnZld0S2F2MkdxcHZseUlKcy9OZW5PZzFZQ3IydVUKbDE3UnFPNk1BSGt6d1pNTVFDV1JXMlFiUy9weVY0VHd6dkNxSTR1ZVpzOFJ4MndwbERJdWFPVXdJMEVTMG8zdQpWdDJHMVlCTWlFOUNVTDliQWlYbWQ0UTR4a1NFRFRvOVY1SVk3Z2dHYjFTU0xWU2x6RDJHZElaMGN3VlE2LzcwCnUrQ1FPa005ZXhIRVR2eGpGTmZ4azI2YlRZVUJmNnBNS2VpSDdMbC9ucjZFVVVzTW5DSUR5VGtnK3Zta1M5ZWoKUmY1R0QwQ00rcnl1V1BiRHlHOCtzcDh4d1N1ZkcydDdkUGZRSTUzd1Zzc1BKSkk5b0lsZ0lJWXkyMkFUMlo4RwpKL2dZbmYwMU5LREhSV1dBU2FQaTBLT2dURldqRG5xam94Q0FHZjVGVFRJSHdBQjVsMS8rMXZFbEkyNjQ2M2d4CnBWcTk4Vyt4U3FQQ0xaTW9sWlE5TVkwbjVHeGgvZjhkK0RPb1BVT0lXazJqWXdvS1JGQXJiTlNTNnkySnVrS3YKSWNvMnN4YUhqZkhrdDdqdDBkckRLcjUrelI5bndUWDhVN3hBaWlTYkVTekN6OWlvdU9QSEcxMFFtdzl6VVRNMgoxdzJmMmlQRWpvbFpBVjFBaFU3dzFWNHBzc3JpWDIvNTlDR1dYT1VEcWNnd2MwdWh4djRnWFRndXBCeGcrYU5yCllybWZwNndtejdzN3lmblh3T2xVaVRDRW1Bc2NBemNkMmdCaGwvN1dpcmFRZFVzQ0F3RUFBYU5UTUZFd0hRWUQKVlIwT0JCWUVGSGJhbmo2RkdNVWZ3bEMwSytqY081TTlHd0FwTUI4R0ExVWRJd1FZTUJhQUZIYmFuajZGR01VZgp3bEMwSytqY081TTlHd0FwTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3RFFZSktvWklodmNOQVFFTEJRQURnZ0lCCkFBZVVVVUFMTk5FNDM2UEwvZXl6V0c3bmlPdndXODF3UkdVdGdEUnJpY2xFWjh0K3MzUG9MOXRibyszUGN1ekgKakxsUFArYmVLY2tUTEZKVGZZWUN3Z0dWZkdIRXE1ejV1SUt3ZWIyMG9GSEg3ek9DSzF3VVJBSUlPZnFycncyMApjcWNzdTRnK3NENnl0bllWN2Y1T0RFT2RNaXpjVXRrbGpMSjVieXJLSU9OV2FrSTBpd0xLeXFPQWlGeUVSY2xiCjB0ZzhoTDR6dkRLVUZ6dVJycXhxS0padzNWUWUvM1JWUFYwZ0RLUW96VEQ0M3lnQUdGVlVjckx1dHZOK2V5bEEKVDdYMGtNZXJlVVRKd1N6RDVvenhGRXFkaDlLNHZkZTA2a3BuSXpQS2tEanNFZiszeW9WeFVxRGJCeGV3ai9aOApodzhmT3lBWC9jV2UvZlhmWVdPV3RpTlhiQVJRd0pvUWlLb3lacHRuNGpvRXhLWVB2Qzg0RitINEZnZnpidXFkCnNnL2R2SjBxcldGaUlZeWZBRS9NNGM3VTBDUnVsZ1lETXJhbktIUHhxTllVT21pRzM4T0xLTDlFMmlvV002UHYKek82djVvUk5pazFFN3BrRUVMSUFPczR3U2MvdG45MU01TmtpSjgyRXNEQ2ZaVG5FVU9Cd3VsRzZSbW8vYWF0agpCWUJEaHo0dnhmN0ZjNG13WEdXNVZXc1Qzd2ZVckErZ3l3VWo5dlFqTTV6SjEybDl4NU9Dd3pNMTJuQWdSZ1dFCkh4ZDh5TFhkNE9rTWRaRWNVckY5eWtSMGJUZ3AyWnowL3lPR21KbVpieHRNdHlGaTVMcmt6VElodWJNS1l2bncKcWsrbWdaUmNMcXBWclRSYTNiaGdEVzJrSWpFT2I5SHB6NG5MZ3loUVpCMFAKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= +kind: Secret +metadata: + name: opensearch-dashboard-ca + namespace: observability \ No newline at end of file diff --git a/helm-charts-observability/charts/opensearch-dashboards/opensearch-dashbaord-ingress.yaml b/helm-charts-observability/charts/opensearch-dashboards/opensearch-dashbaord-ingress.yaml new file mode 100644 index 0000000..6b5c560 --- /dev/null +++ b/helm-charts-observability/charts/opensearch-dashboards/opensearch-dashbaord-ingress.yaml @@ -0,0 +1,26 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: brilliant-opensearch-dashboard-opensearch-dashboards + namespace: observability + labels: + helm.sh/chart: opensearch-dashboards-3.7.0 + app.kubernetes.io/name: opensearch-dashboards + app.kubernetes.io/instance: brilliant-opensearch-dashboard + app.kubernetes.io/version: "3.7.0" + annotations: + kubernetes.io/ingress.class: nginx +spec: + ingressClassName: nginx + rules: + - http: + paths: + - path: /opensearch + pathType: Prefix + backend: + service: + name: brilliant-opensearch-dashboard-opensearch-dashboards + port: + number: 5601 + + \ No newline at end of file diff --git a/helm-charts-observability/charts/opensearch-dashboards/opensearch-dashboard-rendered-output.yaml b/helm-charts-observability/charts/opensearch-dashboards/opensearch-dashboard-rendered-output.yaml new file mode 100644 index 0000000..ed2af27 --- /dev/null +++ b/helm-charts-observability/charts/opensearch-dashboards/opensearch-dashboard-rendered-output.yaml @@ -0,0 +1,155 @@ +--- +# Source: opensearch-dashboards/templates/configmap.yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: brilliant-opensearch-dashboard-opensearch-dashboards-config + labels: + helm.sh/chart: opensearch-dashboards-3.7.0 + app.kubernetes.io/name: opensearch-dashboards + app.kubernetes.io/instance: brilliant-opensearch-dashboard + app.kubernetes.io/version: "3.7.0" + app.kubernetes.io/managed-by: Helm +data: + opensearch_dashboards.yml: | + server: + name: dashboards + host: "0.0.0.0" + + opensearch: + username: kibanaserver + password: ${KIBANASERVER_PASSWORD} + ssl: + verificationMode: full + certificateAuthorities: /usr/share/opensearch-dashboards/certs/root-ca.pem +--- +# Source: opensearch-dashboards/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: brilliant-opensearch-dashboard-opensearch-dashboards + labels: + helm.sh/chart: opensearch-dashboards-3.7.0 + app.kubernetes.io/name: opensearch-dashboards + app.kubernetes.io/instance: brilliant-opensearch-dashboard + app.kubernetes.io/version: "3.7.0" + app.kubernetes.io/managed-by: Helm +spec: + type: ClusterIP + ports: + - port: 5601 + protocol: TCP + name: http + targetPort: 5601 + - name: metrics + protocol: TCP + port: 9601 + selector: + app.kubernetes.io/name: opensearch-dashboards + app.kubernetes.io/instance: brilliant-opensearch-dashboard +--- +# Source: opensearch-dashboards/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: brilliant-opensearch-dashboard-opensearch-dashboards + labels: + helm.sh/chart: opensearch-dashboards-3.7.0 + app.kubernetes.io/name: opensearch-dashboards + app.kubernetes.io/instance: brilliant-opensearch-dashboard + app.kubernetes.io/version: "3.7.0" + app.kubernetes.io/managed-by: Helm +spec: + replicas: 1 + strategy: + type: Recreate + selector: + matchLabels: + app.kubernetes.io/name: opensearch-dashboards + app.kubernetes.io/instance: brilliant-opensearch-dashboard + template: + metadata: + labels: + app.kubernetes.io/name: opensearch-dashboards + app.kubernetes.io/instance: brilliant-opensearch-dashboard + annotations: + configchecksum: 94f1f2434bc321e09c11f8b57337937eb527a3de2f9e79796a0c518e55b3bee + spec: + securityContext: + {} + serviceAccountName: default + volumes: + - name: config + configMap: + name: brilliant-opensearch-dashboard-opensearch-dashboards-config + # Currently some extra blocks accept strings + # to continue with backwards compatibility this is being kept + # whilst also allowing for yaml to be specified too. + - name: root-cert + secret: + secretName: opensearch-dashboard-ca + containers: + - name: dashboards + securityContext: + capabilities: + drop: + - ALL + runAsNonRoot: true + runAsUser: 1000 + image: "opensearchproject/opensearch-dashboards:3.7.0" + imagePullPolicy: "IfNotPresent" + readinessProbe: + failureThreshold: 10 + initialDelaySeconds: 10 + periodSeconds: 20 + successThreshold: 1 + tcpSocket: + port: 5601 + timeoutSeconds: 5 + livenessProbe: + failureThreshold: 10 + initialDelaySeconds: 10 + periodSeconds: 20 + successThreshold: 1 + tcpSocket: + port: 5601 + timeoutSeconds: 5 + startupProbe: + failureThreshold: 20 + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + tcpSocket: + port: 5601 + timeoutSeconds: 5 + env: + - name: OPENSEARCH_HOSTS + value: "https://brilliant-opensearch-cluster-master:9200" + - name: SERVER_HOST + value: "0.0.0.0" + - name: KIBANASERVER_PASSWORD + valueFrom: + secretKeyRef: + key: KIBANASERVER_PASSWORD + name: opensearch-kibanaserver-password + ports: + - containerPort: 5601 + name: http + protocol: TCP + resources: + limits: + cpu: "2" + memory: 6G + requests: + cpu: "1" + memory: 2G + volumeMounts: + - name: config + mountPath: /usr/share/opensearch-dashboards/config/opensearch_dashboards.yml + subPath: opensearch_dashboards.yml + # Currently some extra blocks accept strings + # to continue with backwards compatibility this is being kept + # whilst also allowing for yaml to be specified too. + - mountPath: /usr/share/opensearch-dashboards/certs + name: root-cert + readOnly: true diff --git a/helm-charts-observability/charts/opensearch-dashboards/templates/NOTES.txt b/helm-charts-observability/charts/opensearch-dashboards/templates/NOTES.txt new file mode 100644 index 0000000..d92acdc --- /dev/null +++ b/helm-charts-observability/charts/opensearch-dashboards/templates/NOTES.txt @@ -0,0 +1,22 @@ +1. Get the application URL by running these commands: +{{- if .Values.ingress.enabled }} +{{- range $host := .Values.ingress.hosts }} + {{- range .paths }} + http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }} + {{- end }} +{{- end }} +{{- else if contains "NodePort" .Values.service.type }} + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "opensearch-dashboards.fullname" . }}) + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + echo http://$NODE_IP:$NODE_PORT +{{- else if contains "LoadBalancer" .Values.service.type }} + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "opensearch-dashboards.fullname" . }}' + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "opensearch-dashboards.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") + echo http://$SERVICE_IP:{{ .Values.service.port }} +{{- else if contains "ClusterIP" .Values.service.type }} + export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "opensearch-dashboards.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") + export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}") + echo "Visit http://127.0.0.1:8080 to use your application" + kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT +{{- end }} diff --git a/helm-charts-observability/charts/opensearch-dashboards/templates/_helpers.tpl b/helm-charts-observability/charts/opensearch-dashboards/templates/_helpers.tpl new file mode 100644 index 0000000..a51f4ec --- /dev/null +++ b/helm-charts-observability/charts/opensearch-dashboards/templates/_helpers.tpl @@ -0,0 +1,103 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "opensearch-dashboards.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "opensearch-dashboards.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "opensearch-dashboards.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "opensearch-dashboards.labels" -}} +helm.sh/chart: {{ include "opensearch-dashboards.chart" . }} +{{ include "opensearch-dashboards.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "opensearch-dashboards.selectorLabels" -}} +app.kubernetes.io/name: {{ include "opensearch-dashboards.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "opensearch-dashboards.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} + {{- default (include "opensearch-dashboards.fullname" .) .Values.serviceAccount.name }}-dashboards +{{- else }} + {{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + +{{/* +Return the appropriate apiVersion for ingress. +*/}} +{{- define "opensearch-dashboards.ingress.apiVersion" -}} + {{- if and (.Capabilities.APIVersions.Has "networking.k8s.io/v1") (semverCompare ">= 1.19-0" .Capabilities.KubeVersion.Version) -}} + {{- print "networking.k8s.io/v1" -}} + {{- else if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1" -}} + {{- print "networking.k8s.io/v1beta1" -}} + {{- else -}} + {{- print "extensions/v1beta1" -}} + {{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for Horizontal Pod Autoscaler. +*/}} +{{- define "opensearch-dashboards.hpa.apiVersion" -}} +{{- if $.Capabilities.APIVersions.Has "autoscaling/v2/HorizontalPodAutoscaler" }} +{{- print "autoscaling/v2" }} +{{- else if $.Capabilities.APIVersions.Has "autoscaling/v2beta2/HorizontalPodAutoscaler" }} +{{- print "autoscaling/v2beta2" }} +{{- else if $.Capabilities.APIVersions.Has "autoscaling/v2beta1/HorizontalPodAutoscaler" }} +{{- print "autoscaling/v2beta1" }} +{{- else }} +{{- print "autoscaling/v1" }} +{{- end }} +{{- end }} + +{{/* +Return if ingress is stable. +*/}} +{{- define "opensearch-dashboards.ingress.isStable" -}} + {{- eq (include "opensearch-dashboards.ingress.apiVersion" .) "networking.k8s.io/v1" -}} +{{- end -}} +{{/* +Return if ingress supports ingressClassName. +*/}} +{{- define "opensearch-dashboards.ingress.supportsIngressClassName" -}} + {{- or (eq (include "opensearch-dashboards.ingress.isStable" .) "true") (and (eq (include "opensearch-dashboards.ingress.apiVersion" .) "networking.k8s.io/v1beta1") (semverCompare ">= 1.18-0" .Capabilities.KubeVersion.Version)) -}} +{{- end -}} diff --git a/helm-charts-observability/charts/opensearch-dashboards/templates/autoscaler.yaml b/helm-charts-observability/charts/opensearch-dashboards/templates/autoscaler.yaml new file mode 100644 index 0000000..ff054d3 --- /dev/null +++ b/helm-charts-observability/charts/opensearch-dashboards/templates/autoscaler.yaml @@ -0,0 +1,43 @@ +{{- if .Values.autoscaling.enabled -}} +apiVersion: {{ include "opensearch-dashboards.hpa.apiVersion" . }} +kind: HorizontalPodAutoscaler +metadata: + name: {{ template "opensearch-dashboards.fullname" . }}-hpa + labels: {{- include "opensearch-dashboards.labels" . | nindent 4 }} +spec: + maxReplicas: {{ .Values.autoscaling.maxReplicas }} + minReplicas: {{ .Values.autoscaling.minReplicas }} + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ template "opensearch-dashboards.fullname" . }} + {{- if eq (include "opensearch-dashboards.hpa.apiVersion" .) "autoscaling/v1" }} + targetCPUUtilizationPercentage: {{ .Values.autoscaling.targetCPUUtilizationPercentage | default .Values.autoscaling.targetCPU }} + {{- else }} + metrics: + {{- if .Values.autoscaling.targetMemory }} + - type: Resource + resource: + name: memory + {{- if eq (include "opensearch-dashboards.hpa.apiVersion" .) "autoscaling/v2beta1" }} + targetAverageUtilization: {{ .Values.autoscaling.targetMemory }} + {{- else }} + target: + type: Utilization + averageUtilization: {{ .Values.autoscaling.targetMemory }} + {{- end }} + {{- end }} + {{- if or .Values.autoscaling.targetCPU .Values.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + {{- if eq (include "opensearch-dashboards.hpa.apiVersion" .) "autoscaling/v2beta1" }} + targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage | default .Values.autoscaling.targetCPU }} + {{- else }} + target: + type: Utilization + averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage | default .Values.autoscaling.targetCPU }} + {{- end }} + {{- end }} + {{- end }} +{{- end }} diff --git a/helm-charts-observability/charts/opensearch-dashboards/templates/configmap.yaml b/helm-charts-observability/charts/opensearch-dashboards/templates/configmap.yaml new file mode 100644 index 0000000..ce33586 --- /dev/null +++ b/helm-charts-observability/charts/opensearch-dashboards/templates/configmap.yaml @@ -0,0 +1,16 @@ +{{- if .Values.config -}} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "opensearch-dashboards.fullname" . }}-config + labels: {{ include "opensearch-dashboards.labels" . | nindent 4 }} +data: +{{- range $configName, $configYaml := .Values.config }} + {{ $configName }}: | + {{- if eq (kindOf $configYaml) "map" }} + {{- tpl (toYaml $configYaml) $ | nindent 4 }} + {{- else }} + {{- tpl $configYaml $ | nindent 4 -}} + {{- end -}} +{{- end -}} +{{- end -}} diff --git a/helm-charts-observability/charts/opensearch-dashboards/templates/deployment.yaml b/helm-charts-observability/charts/opensearch-dashboards/templates/deployment.yaml new file mode 100644 index 0000000..12d15f2 --- /dev/null +++ b/helm-charts-observability/charts/opensearch-dashboards/templates/deployment.yaml @@ -0,0 +1,218 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ template "opensearch-dashboards.fullname" . }} + labels: {{- include "opensearch-dashboards.labels" . | nindent 4 }} + {{- with .Values.dashboardAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + replicas: {{ .Values.replicaCount }} + strategy: +{{ toYaml .Values.updateStrategy | indent 4 }} + selector: + matchLabels: +{{- include "opensearch-dashboards.selectorLabels" . | nindent 6 }} + template: + metadata: + labels: +{{- include "opensearch-dashboards.selectorLabels" . | nindent 8 }} + {{- range $key, $value := .Values.labels }} + {{ $key }}: {{ $value | quote }} + {{- end }} + annotations: + {{- range $key, $value := .Values.podAnnotations }} + {{ $key }}: {{ $value | quote }} + {{- end }} + {{- /* This forces a restart if the configmap has changed */}} + {{- if .Values.config }} + configchecksum: {{ include (print .Template.BasePath "/configmap.yaml") . | sha256sum | trunc 63 }} + {{- end }} + spec: +{{- if .Values.priorityClassName }} + priorityClassName: {{ .Values.priorityClassName }} +{{- end }} + securityContext: +{{ toYaml .Values.podSecurityContext | indent 8 }} + serviceAccountName: {{ template "opensearch-dashboards.serviceAccountName" . }} + {{- if .Values.hostAliases }} + hostAliases: {{ toYaml .Values.hostAliases | nindent 6 }} + {{- end }} + volumes: + {{- range .Values.secretMounts }} + - name: {{ .name }} + secret: + secretName: {{ .secretName }} + {{- end }} + {{- if .Values.config }} + - name: config + configMap: + name: {{ template "opensearch-dashboards.fullname" . }}-config + {{- if .Values.opensearchDashboardsYml.defaultMode }} + defaultMode: {{ .Values.opensearchDashboardsYml.defaultMode }} + {{- end }} + {{- end }} + {{- if .Values.extraVolumes }} + # Currently some extra blocks accept strings + # to continue with backwards compatibility this is being kept + # whilst also allowing for yaml to be specified too. + {{- if eq "string" (printf "%T" .Values.extraVolumes) }} +{{ tpl .Values.extraVolumes . | indent 8 }} + {{- else }} +{{ toYaml .Values.extraVolumes | indent 8 }} + {{- end }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: +{{ toYaml . | indent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: +{{ toYaml . | indent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: +{{ toYaml . | indent 8 }} + {{- end }} + {{- if .Values.topologySpreadConstraints }} + topologySpreadConstraints: +{{- toYaml .Values.topologySpreadConstraints | nindent 8 }} + {{- end }} + {{- if .Values.imagePullSecrets }} + imagePullSecrets: +{{ toYaml .Values.imagePullSecrets | indent 8 }} + {{- end }} + {{- if .Values.extraInitContainers }} + # Currently some extra blocks accept strings + # to continue with backwards compatibility this is being kept + # whilst also allowing for yaml to be specified too. + initContainers: + {{- if eq "string" (printf "%T" .Values.extraInitContainers) }} +{{ tpl .Values.extraInitContainers . | indent 6 }} + {{- else }} +{{ toYaml .Values.extraInitContainers | indent 6 }} + {{- end }} + {{- end }} + containers: + - name: dashboards + securityContext: +{{ toYaml .Values.securityContext | indent 10 }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: "{{ .Values.image.pullPolicy }}" + {{- if .Values.readinessProbe }} + readinessProbe: +{{ toYaml .Values.readinessProbe | indent 10 }} + {{- end }} + {{- if .Values.livenessProbe }} + livenessProbe: +{{ toYaml .Values.livenessProbe | indent 10 }} + {{- end }} + {{- if semverCompare ">=1.16-0" .Capabilities.KubeVersion.Version }} + {{- if .Values.readinessProbe }} + startupProbe: +{{ toYaml .Values.startupProbe | indent 10 }} + {{- end }} + {{- end }} + env: + {{- if .Values.opensearchURL }} + - name: OPENSEARCH_URL + value: "{{ .Values.opensearchURL }}" + {{- else if .Values.opensearchHosts }} + - name: OPENSEARCH_HOSTS + value: "{{ .Values.opensearchHosts }}" + {{- end }} + - name: SERVER_HOST + value: "{{ .Values.serverHost }}" + {{- if .Values.opensearchAccount.secret }} + - name: OPENSEARCH_USERNAME + valueFrom: + secretKeyRef: + name: {{ .Values.opensearchAccount.secret }} + key: username + - name: OPENSEARCH_PASSWORD + valueFrom: + secretKeyRef: + name: {{ .Values.opensearchAccount.secret }} + key: password + {{- if and .Values.opensearchAccount.keyPassphrase.enabled }} + - name: KEY_PASSPHRASE + valueFrom: + secretKeyRef: + name: {{ .Values.opensearchAccount.secret }} + key: keypassphrase + # 32-character random string to be used as cookie password by security plugin + {{- end }} + - name: COOKIE_PASS + valueFrom: + secretKeyRef: + name: {{ .Values.opensearchAccount.secret }} + key: cookie + {{- end }} +{{- if .Values.extraEnvs }} +{{ toYaml .Values.extraEnvs | indent 8 }} +{{- end }} +{{- if .Values.envFrom }} + envFrom: +{{ toYaml .Values.envFrom | indent 10 }} +{{- end }} + ports: + - containerPort: {{ .Values.service.port }} + name: {{ .Values.service.httpPortName | default "http" }} + protocol: TCP +{{- if .Values.plugins.enabled }} + command: + - sh + - -c + - | + #!/usr/bin/bash + set -e + {{- range $plugin := .Values.plugins.removeList }} + if ./bin/opensearch-dashboards-plugin list | grep -q {{ $plugin }}; then + ./bin/opensearch-dashboards-plugin remove {{ $plugin }} + fi + {{- end }} + {{- range $plugin := .Values.plugins.installList }} + ./bin/opensearch-dashboards-plugin install {{ $plugin }} + {{- end }} + bash opensearch-dashboards-docker-entrypoint.sh opensearch-dashboards +{{- end }} +{{- if .Values.lifecycle }} + lifecycle: +{{ toYaml .Values.lifecycle | indent 10 }} +{{- end }} + resources: +{{ toYaml .Values.resources | indent 10 }} + volumeMounts: + {{- range .Values.secretMounts }} + - name: {{ .name }} + mountPath: {{ .path }} + {{- if .subPath }} + subPath: {{ .subPath }} + {{- end }} + {{- end }} + {{- range $path, $config := .Values.config }} + - name: config + mountPath: /usr/share/opensearch-dashboards/config/{{ $path }} + subPath: {{ $path }} + {{- end }} + {{- if .Values.extraVolumeMounts }} + # Currently some extra blocks accept strings + # to continue with backwards compatibility this is being kept + # whilst also allowing for yaml to be specified too. + {{- if eq "string" (printf "%T" .Values.extraVolumeMounts) }} +{{ tpl .Values.extraVolumeMounts . | indent 10 }} + {{- else }} +{{ toYaml .Values.extraVolumeMounts | indent 10 }} + {{- end }} + {{- end }} + {{- if .Values.extraContainers }} + # Currently some extra blocks accept strings + # to continue with backwards compatibility this is being kept + # whilst also allowing for yaml to be specified too. + {{- if eq "string" (printf "%T" .Values.extraContainers) }} +{{ tpl .Values.extraContainers . | indent 6 }} + {{- else }} +{{ toYaml .Values.extraContainers | indent 6 }} + {{- end }} + {{- end }} diff --git a/helm-charts-observability/charts/opensearch-dashboards/templates/extraManifests.yaml b/helm-charts-observability/charts/opensearch-dashboards/templates/extraManifests.yaml new file mode 100644 index 0000000..c169b9d --- /dev/null +++ b/helm-charts-observability/charts/opensearch-dashboards/templates/extraManifests.yaml @@ -0,0 +1,8 @@ +{{ range .Values.extraObjects }} +--- +{{- if typeIs "string" . }} +{{ tpl . $ }} +{{- else }} +{{ tpl (toYaml .) $ }} +{{- end }} +{{ end }} \ No newline at end of file diff --git a/helm-charts-observability/charts/opensearch-dashboards/templates/ingress.yaml b/helm-charts-observability/charts/opensearch-dashboards/templates/ingress.yaml new file mode 100644 index 0000000..47d3bde --- /dev/null +++ b/helm-charts-observability/charts/opensearch-dashboards/templates/ingress.yaml @@ -0,0 +1,72 @@ +{{- if .Values.ingress.enabled -}} +{{- $fullName := include "opensearch-dashboards.fullname" . -}} +{{- $ingressApiIsStable := eq (include "opensearch-dashboards.ingress.isStable" .) "true" -}} +{{- $ingressSupportsIngressClassName := eq (include "opensearch-dashboards.ingress.supportsIngressClassName" .) "true" -}} +{{- $svcPort := .Values.service.port -}} +{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1 +{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1beta1 +{{- else -}} +apiVersion: extensions/v1beta1 +{{- end }} +kind: Ingress +metadata: + name: {{ $fullName }} + labels: + {{- include "opensearch-dashboards.labels" . | nindent 4 }} + {{- with .Values.ingress.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if and $ingressSupportsIngressClassName .Values.ingress.ingressClassName }} + ingressClassName: {{ .Values.ingress.ingressClassName }} + {{- end -}} + {{- if .Values.ingress.tls }} + tls: + {{- range .Values.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} + {{- end }} + rules: + {{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.Version -}} + {{- range .Values.ingress.hosts }} + - host: {{ .host | quote }} + http: + paths: + {{- range .paths }} + - path: {{ .path }} + pathType: Prefix + backend: + service: + name: {{ .backend.serviceName | default $fullName }} + port: + {{- if and .backend.servicePort (kindIs "string" .backend.servicePort) }} + name: {{ .backend.servicePort }} + {{- else }} + number: {{ .backend.servicePort | default $svcPort }} + {{- end }} + {{- end }} + {{- end }} + {{- else -}} + {{- range .Values.ingress.hosts }} + - host: {{ .host | quote }} + http: + paths: + {{- range .paths }} + - path: {{ .path }} + backend: + serviceName: {{ .backend.serviceName | default $fullName }} + servicePort: {{ .backend.servicePort | default $svcPort }} + {{- end }} + {{- end }} + {{- end }} + {{- end }} diff --git a/helm-charts-observability/charts/opensearch-dashboards/templates/rolebinding.yaml b/helm-charts-observability/charts/opensearch-dashboards/templates/rolebinding.yaml new file mode 100644 index 0000000..3fe2a21 --- /dev/null +++ b/helm-charts-observability/charts/opensearch-dashboards/templates/rolebinding.yaml @@ -0,0 +1,15 @@ +{{- if .Values.rbac.create -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: {{- include "opensearch-dashboards.labels" . | nindent 4 }} + name: {{ template "opensearch-dashboards.fullname" . }}-dashboards-rolebinding +roleRef: + kind: Role + name: {{ template "opensearch-dashboards.serviceAccountName" . }} + apiGroup: rbac.authorization.k8s.io +subjects: +- kind: ServiceAccount + name: {{ template "opensearch-dashboards.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/helm-charts-observability/charts/opensearch-dashboards/templates/service.yaml b/helm-charts-observability/charts/opensearch-dashboards/templates/service.yaml new file mode 100644 index 0000000..e7af094 --- /dev/null +++ b/helm-charts-observability/charts/opensearch-dashboards/templates/service.yaml @@ -0,0 +1,43 @@ +--- +apiVersion: v1 +kind: Service +metadata: + name: {{ template "opensearch-dashboards.fullname" . }} + labels: {{- include "opensearch-dashboards.labels" . | nindent 4 }} +{{- if .Values.service.labels }} +{{ toYaml .Values.service.labels | indent 4}} +{{- end }} +{{- with .Values.service.annotations }} + annotations: +{{ toYaml . | indent 4 }} +{{- end }} +spec: + type: {{ .Values.service.type }} + {{- if (semverCompare ">= 1.23-0" .Capabilities.KubeVersion.Version) }} + {{- if .Values.service.ipFamilyPolicy }} + ipFamilyPolicy: {{ .Values.service.ipFamilyPolicy }} + {{- end }} + {{- if .Values.service.ipFamilies }} + ipFamilies: {{ .Values.service.ipFamilies }} + {{- end }} + {{- end }} +{{- if .Values.service.loadBalancerIP }} + loadBalancerIP: {{ .Values.service.loadBalancerIP }} +{{- end }} +{{- with .Values.service.loadBalancerSourceRanges }} + loadBalancerSourceRanges: +{{ toYaml . | indent 4 }} +{{- end }} + ports: + - port: {{ .Values.service.port }} +{{- if .Values.service.nodePort }} + nodePort: {{ .Values.service.nodePort }} +{{- end }} + protocol: TCP + name: {{ .Values.service.httpPortName | default "http" }} + targetPort: {{ .Values.service.port }} + - name: {{ .Values.service.metricsPortName | default "metrics" }} + protocol: TCP + port: {{ .Values.service.metricsPort }} + selector: +{{- include "opensearch-dashboards.selectorLabels" . | nindent 4 }} diff --git a/helm-charts-observability/charts/opensearch-dashboards/templates/serviceMonitor.yaml b/helm-charts-observability/charts/opensearch-dashboards/templates/serviceMonitor.yaml new file mode 100644 index 0000000..ae92805 --- /dev/null +++ b/helm-charts-observability/charts/opensearch-dashboards/templates/serviceMonitor.yaml @@ -0,0 +1,20 @@ +{{- if .Values.serviceMonitor.enabled }} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ template "opensearch-dashboards.fullname" . }}-service-monitor + namespace: {{ .Release.Namespace }} + labels: + {{- include "opensearch-dashboards.labels" . | nindent 4 }} + {{- with .Values.serviceMonitor.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + selector: + matchLabels: + {{- include "opensearch-dashboards.selectorLabels" . | nindent 6 }} + endpoints: + - port: {{ .Values.service.metricsPortName | default "metrics" }} + interval: {{ .Values.serviceMonitor.interval }} + path: {{ .Values.serviceMonitor.path }} +{{- end }} diff --git a/helm-charts-observability/charts/opensearch-dashboards/templates/serviceaccount.yaml b/helm-charts-observability/charts/opensearch-dashboards/templates/serviceaccount.yaml new file mode 100644 index 0000000..8a7b9fe --- /dev/null +++ b/helm-charts-observability/charts/opensearch-dashboards/templates/serviceaccount.yaml @@ -0,0 +1,16 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "opensearch-dashboards.serviceAccountName" . }} + labels: + {{- include "opensearch-dashboards.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- end }} +{{- if .Values.serviceAccount.automountServiceAccountToken }} +{{- else }} +automountServiceAccountToken: false +{{- end -}} diff --git a/helm-charts-observability/charts/opensearch-dashboards/values.yaml b/helm-charts-observability/charts/opensearch-dashboards/values.yaml new file mode 100644 index 0000000..1501d26 --- /dev/null +++ b/helm-charts-observability/charts/opensearch-dashboards/values.yaml @@ -0,0 +1,334 @@ +# Copyright OpenSearch Contributors +# SPDX-License-Identifier: Apache-2.0 + +# Default values for opensearch-dashboards. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +opensearchHosts: "https://brilliant-opensearch-cluster-master:9200" +replicaCount: 1 + +image: + repository: "opensearchproject/opensearch-dashboards" + # override image tag, which is .Chart.AppVersion by default + tag: "3.7.0" + pullPolicy: "IfNotPresent" + +startupProbe: + tcpSocket: + port: 5601 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 20 + successThreshold: 1 + initialDelaySeconds: 10 + +livenessProbe: + tcpSocket: + port: 5601 + periodSeconds: 20 + timeoutSeconds: 5 + failureThreshold: 10 + successThreshold: 1 + initialDelaySeconds: 10 + +readinessProbe: + tcpSocket: + port: 5601 + periodSeconds: 20 + timeoutSeconds: 5 + failureThreshold: 10 + successThreshold: 1 + initialDelaySeconds: 10 + +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" + +serviceAccount: + # Specifies whether a service account should be created + create: false + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + namespace: observability + # Controls whether the ServiceAccount API token is automatically mounted on pod + automountServiceAccountToken: true + +rbac: + create: false + +# A list of secrets and their paths to mount inside the pod +# This is useful for mounting certificates for security and for mounting +# the X-Pack license +secretMounts: [] +# - name: certs +# secretName: opensearch-dashboard-ca +# - name: certs +# secretName: dashboard-certs +# path: /usr/share/dashboards/certs + +podAnnotations: {} + +# Deployment annotations +dashboardAnnotations: {} + +extraEnvs: +# - name: "NODE_OPTIONS" +# value: "--max-old-space-size=1800" + - name: KIBANASERVER_PASSWORD + valueFrom: + secretKeyRef: + name: opensearch-kibanaserver-password + key: KIBANASERVER_PASSWORD + +envFrom: [] + +extraVolumes: + - name: root-cert + secret: + secretName: opensearch-dashboard-ca + # - name: extras + # emptyDir: {} + +extraVolumeMounts: + - name: root-cert + readOnly: true + mountPath: /usr/share/opensearch-dashboards/certs + + # - name: extras + # mountPath: /usr/share/extras + # readOnly: true + +extraInitContainers: "" + +extraContainers: "" + +podSecurityContext: {} + +securityContext: + capabilities: + drop: + - ALL + # readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1000 + +config: + opensearch_dashboards.yml: | + server: + name: dashboards + host: "{{ .Values.serverHost }}" + basePath: /opensearch + rewriteBasePath: true + + opensearch: + username: kibanaserver + password: ${KIBANASERVER_PASSWORD} + ssl: + verificationMode: full + certificateAuthorities: + - /usr/share/opensearch-dashboards/certs/root-ca.pem + opensearch_security.multitenancy.enabled: false + + + data_source: + enabled: true + ssl: + verificationMode: full + certificateAuthorities: + - /usr/share/opensearch-dashboards/certs/root-ca.pem + authTypes: + NoAuthentication: + enabled: false + UsernamePassword: + enabled: true + AWSSigV4: + enabled: false + + workspace: + enabled: true + + explore: + enabled: true + + datasetManagement: + enabled: true + +opensearchDashboardsYml: + defaultMode: + # value should be 0-0777 + +priorityClassName: "" + +opensearchAccount: + secret: "" + keyPassphrase: + enabled: false + +labels: {} + +hostAliases: [] +# - ip: "127.0.0.1" +# hostnames: +# - "foo.local" +# - "bar.local" + +serverHost: "0.0.0.0" + +service: + type: ClusterIP + # The IP family and IP families options are to set the behaviour in a dual-stack environment + # Omitting these values will let the service fall back to whatever the CNI dictates the defaults + # should be + # + # ipFamilyPolicy: SingleStack + # ipFamilies: + # - IPv4 + port: 5601 + metricsPort: 9601 + loadBalancerIP: "" + nodePort: "" + labels: {} + annotations: {} + loadBalancerSourceRanges: [] + # 0.0.0.0/0 + httpPortName: http + metricsPortName: metrics + +ingress: + enabled: false + # For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName + # See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress + # ingressClassName: nginx + annotations: + kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + labels: {} + ingressClassName: nginx + hosts: +# - host: chart-example.local + - paths: + - path: / + backend: + serviceName: "" + servicePort: 5601 + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + +resources: + requests: + cpu: "1" + memory: "2Gi" + limits: + cpu: "2" + memory: "6Gi" + +autoscaling: + # This requires metrics server to be installed, to install use kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml + # See https://github.com/kubernetes-sigs/metrics-server + enabled: false + minReplicas: 1 + maxReplicas: 10 + # The legacy `targetCPUUtilizationPercentage` key has been deprecated in favor of `targetCPU` + targetCPU: "80" + targetMemory: "80" + +updateStrategy: + type: "Recreate" + +nodeSelector: {} + +tolerations: [] + +affinity: {} + +# This is the pod topology spread constraints +# https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ +topologySpreadConstraints: [] + +# -- Array of extra K8s manifests to deploy +extraObjects: [] + # - apiVersion: secrets-store.csi.x-k8s.io/v1 + # kind: SecretProviderClass + # metadata: + # name: argocd-secrets-store + # spec: + # provider: aws + # parameters: + # objects: | + # - objectName: "argocd" + # objectType: "secretsmanager" + # jmesPath: + # - path: "client_id" + # objectAlias: "client_id" + # - path: "client_secret" + # objectAlias: "client_secret" + # secretObjects: + # - data: + # - key: client_id + # objectName: client_id + # - key: client_secret + # objectName: client_secret + # secretName: argocd-secrets-store + # type: Opaque + # labels: + # app.kubernetes.io/part-of: argocd + # - | + # apiVersion: policy/v1 + # kind: PodDisruptionBudget + # metadata: + # name: {{ template "opensearch-dashboards.fullname" . }} + # labels: + # {{- include "opensearch-dashboards.labels" . | nindent 4 }} + # spec: + # minAvailable: 1 + # selector: + # matchLabels: +# {{- include "opensearch-dashboards.selectorLabels" . | nindent 6 }} + +# pod lifecycle policies as outlined here: +# https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks +lifecycle: {} + # preStop: + # exec: + # command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"] + # postStart: + # exec: + # command: + # - bash + # - -c + # - | + # #!/bin/bash + # curl -I "http://admin:admin@127.0.0.1:5601/status -H "kbn-xsrf: true" -H 'kbn-xsrf: true' -H "Content-Type: application/json" + +## Enable to add 3rd Party / Custom plugins not offered in the default OpenSearchDashboards image. +plugins: + enabled: false + installList: [] + # - example-fake-plugin-downloadable-url + removeList: [] + # - examplePluginName + +# ServiceMonitor Configuration for Prometheus +# Enabling this option will create a ServiceMonitor resource that allows Prometheus to scrape metrics from the OpenSearch service. +serviceMonitor: + # Set to true to enable the ServiceMonitor resource for OpenSearch Dashboards + enabled: false + + # HTTP path where metrics are exposed by OpenSearch Dashboards. + # Ensure this path is correctly set in your service. + path: /_prometheus/metrics + + # Frequency at which Prometheus will scrape metrics. + # Modify as needed for your monitoring requirements. + interval: 10s + + # additional labels to be added to the ServiceMonitor + # labels: + # k8s.example.com/prometheus: kube-prometheus + labels: {} diff --git a/helm-charts-observability/charts/opensearch/.helmignore b/helm-charts-observability/charts/opensearch/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/helm-charts-observability/charts/opensearch/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/helm-charts-observability/charts/opensearch/CHANGELOG.md b/helm-charts-observability/charts/opensearch/CHANGELOG.md new file mode 100644 index 0000000..0cbbae3 --- /dev/null +++ b/helm-charts-observability/charts/opensearch/CHANGELOG.md @@ -0,0 +1,127 @@ +# Changelog + +All notable changes to this project will be documented in this file. + +The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), +and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). + +--- +## [Unreleased] +### Added +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [3.7.0] +### Added +- Updated OpenSearch appVersion to 3.7.0 +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [3.6.0] +### Added +- Updated OpenSearch appVersion to 3.6.0 +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [3.5.0] +### Added +- Updated OpenSearch appVersion to 3.5.0 +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [3.4.0] +### Added +- Updated OpenSearch appVersion to 3.4.0 +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [3.3.2] +### Added +- Updated OpenSearch appVersion to 3.3.2 +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [3.3.1] +### Added +- Updated OpenSearch appVersion to 3.3.1 +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [3.3.0] +### Added +- Updated OpenSearch appVersion to 3.3.0 +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [3.2.1] +### Added +### Changed +### Deprecated +### Removed +### Fixed +- Added missing security context to configfile and keystore init containers to support restricted Kubernetes environments +### Security +--- +## [3.2.0] +### Added +- Updated OpenSearch appVersion to 3.2.0 +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [3.1.0] +### Added +- Updated OpenSearch appVersion to 3.1.0 +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [3.0.0] +### Added +### Changed +- Switch main branch to be 3.x with 3.0.0 as 1st release +### Deprecated +### Removed +### Fixed +### Security + +[Unreleased]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.7.0...HEAD +[3.7.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.6.0...opensearch-3.7.0 +[3.6.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.5.0...opensearch-3.6.0 +[3.5.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.4.0...opensearch-3.5.0 +[3.4.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.3.2...opensearch-3.4.0 +[3.3.2]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.3.1...opensearch-3.3.2 +[3.3.1]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.3.0...opensearch-3.3.1 +[3.3.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.2.1...opensearch-3.3.0 +[3.2.1]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.2.0...opensearch-3.2.1 +[3.2.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.1.0...opensearch-3.2.0 +[3.1.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.0.0...opensearch-3.1.0 +[3.0.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-2.33.0...opensearch-3.0.0 diff --git a/helm-charts-observability/charts/opensearch/Chart.yaml b/helm-charts-observability/charts/opensearch/Chart.yaml new file mode 100644 index 0000000..8ee38ef --- /dev/null +++ b/helm-charts-observability/charts/opensearch/Chart.yaml @@ -0,0 +1,36 @@ +apiVersion: v2 +name: opensearch +description: A Helm chart for OpenSearch + +# A chart can be either an 'application' or a 'library' chart. +# +# Application charts are a collection of templates that can be packaged into versioned archives +# to be deployed. +# +# Library charts provide useful utilities or functions for the chart developer. They're included as +# a dependency of application charts to inject those utilities and functions into the rendering +# pipeline. Library charts do not define any templates and therefore cannot be deployed. +type: application + +# This is the chart version. This version number should be incremented each time you make changes +# to the chart and its templates, including the app version. +# Versions are expected to follow Semantic Versioning (https://semver.org/) +version: 3.7.0 + +# This is the version number of the application being deployed. This version number should be +# incremented each time you make changes to the application. Versions are not expected to +# follow Semantic Versioning. They should reflect the version the application is using. +# It is recommended to use it with quotes. +appVersion: "3.7.0" + +maintainers: + - name: DandyDeveloper + - name: gaiksaya + - name: peterzhuamazon + - name: prudhvigodithi + - name: TheAlgo + +home: https://opensearch.org +sources: + - https://github.com/opensearch-project/opensearch + - https://github.com/opensearch-project/helm-charts diff --git a/helm-charts-observability/charts/opensearch/README.md b/helm-charts-observability/charts/opensearch/README.md new file mode 100644 index 0000000..d32292c --- /dev/null +++ b/helm-charts-observability/charts/opensearch/README.md @@ -0,0 +1,172 @@ +# OpenSearch Helm Chart + +This Helm chart installs [OpenSearch](https://github.com/opensearch-project/OpenSearch) with configurable TLS, RBAC and much more configurations. This chart caters a number of different use cases and setups. + +- [OpenSearch Helm Chart](#opensearch-helm-chart) +- [Requirements](#requirements) +- [Installing](#installing) +- [Uninstalling](#uninstalling) +- [Configuration](#configuration) + +## Requirements + +- Kubernetes >= 1.14 +- Helm >= 2.17.0 +- We recommend you to have 8 GiB of memory available for this deployment, or at least 4 GiB for the minimum requirement. Else, the deployment is expected to fail. + +## Installing + +Once you've added this Helm repository as per the repository-level [README](../../README.md#installing) then you can install the chart as follows: + +```shell +helm install my-release opensearch/opensearch +``` + +The command deploys OpenSearch with its associated components (data statefulsets, masters, clients) on the Kubernetes cluster in the default configuration. + +**NOTE:** If using Helm 2 then you'll need to add the [`--name`](https://v2.helm.sh/docs/helm/#options-21) command line argument. If unspecified, Helm 2 will autogenerate a name for you. + +## Uninstalling + +To delete/uninstall the chart with the release name `my-release`: + +```shell +helm uninstall my-release +``` + +## Configuration + +| Parameter | Description | Default | +| :---------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :-------------------------------------------------------------------------------------------------------------- | +| `antiAffinityTopologyKey` | The [anti-affinity][] topology key. By default this will prevent multiple Opensearch nodes from running on the same Kubernetes node | `kubernetes.io/hostname` | +| `antiAffinity` | Setting this to `hard` enforces the [anti-affinity][] rules. If it is set to `soft` it will be done "best effort". Setting it to `custom` will use whatever is set in the `customAntiAffinity` parameter. Other values will be ignored. | `hard` | +| `clusterName` | This will be used as the OpenSearch cluster name and should be unique per cluster in the namespace | `opensearch-cluster` | +| `customAntiAffinity` | Allows passing in custom anti-affinity settings as defined in the [anti-affinity][] rules. Using this parameter requires setting the `antiAffinity` parameter to `custom`. | `{}` | +| `enableServiceLinks` | Set to false to disabling service links, which can cause slow pod startup times when there are many services in the current namespace. | `true` | +| `envFrom` | Templatable string to be passed to the [environment from variables][] which will be appended to the `envFrom:` definition for the container | `[]` | +| `config` | Allows you to add any config files in `/usr/share/opensearch/config/` such as `opensearch.yml` and `log4j2.properties`. String or map format may be used for specifying content of each configuration file. In case of string format, the whole content of the config file will be replaced by new config file value when in case of using map format content of configuration file will be a result of merge. In both cases content passed through tpl. See [values.yaml][] for an example of the formatting (passed through tpl) | `{}` | +| `opensearchJavaOpts` | Java options for OpenSearch. This is where you should configure the jvm heap size | `-Xmx512M -Xms512M` | +| `majorVersion` | Used to set major version specific configuration. If you are using a custom image and not running the default OpenSearch version you will need to set this to the version you are running (e.g. `majorVersion: 1`) | `""` | +| `global.dockerRegistry` | Set if you want to change the default docker registry, e.g. a private one. | `""` | +| `extraContainers` | Array of extra containers | `""` | +| `extraEnvs` | Extra environments variables to be passed to OpenSearch services | `[]` | +| `extraInitContainers` | Array of extra init containers | `[]` | +| `extraVolumeMounts` | Array of extra volume mounts | `[]` | +| `extraVolumes` | Array of extra volumes to be added | `[]` | +| `fullnameOverride` | Overrides the `clusterName` and `nodeGroup` when used in the naming of resources. This should only be used when using a single `nodeGroup`, otherwise you will have name conflicts | `""` | +| `hostAliases` | Configurable [hostAliases][] | `[]` | +| `httpHostPort` | Expose another http-port as hostPort. Refer to documentation for more information and requirements about using hostPorts. | `""` | +| `httpPort` | The http port that Kubernetes will use for the healthchecks and the service. If you change this you will also need to set `http.port` in `extraEnvs` | `9200` | +| `image.pullPolicy` | The Kubernetes [imagePullPolicy][] value | `IfNotPresent` | +| `imagePullSecrets` | Configuration for [imagePullSecrets][] so that you can use a private registry for your image | `[]` | +| `image.tag` | The OpenSearch Docker image tag | `1.0.0` | +| `image.repository` | The OpenSearch Docker image | `opensearchproject/opensearch` | +| `ingress` | Configurable [ingress][] to expose the OpenSearch service. See [values.yaml][] for an example | see [values.yaml][] | +| `initResources` | Allows you to set the [resources][] for the `initContainer` in the StatefulSet | `{}` | +| `keystore` | Allows you map Kubernetes secrets into the keystore. | `[]` | +| `labels` | Configurable [labels][] applied to all OpenSearch pods | `{}` | +| `masterService` | The service name used to connect to the masters. You only need to set this if your master `nodeGroup` is set to something other than `master` | `""` | +| `maxUnavailable` | The [maxUnavailable][] value for the pod disruption budget. By default this will prevent Kubernetes from having more than 1 unhealthy pod in the node group | `1` | +| `metricsPort` | The metrics port (for Performance Analyzer) that Kubernetes will use for the service. | `9600` | +| `nameOverride` | Overrides the `clusterName` when used in the naming of resources | `""` | +| `networkHost` | Value for the `network.host OpenSearch setting` | `0.0.0.0` | +| `networkPolicy.create` | Enable network policy creation for OpenSearch | `false` | +| `nodeAffinity` | Value for the [node affinity settings][] | `{}` | +| `nodeGroup` | This is the name that will be used for each group of nodes in the cluster. The name will be `clusterName-nodeGroup-X` , `nameOverride-nodeGroup-X` if a `nameOverride` is specified, and `fullnameOverride-X` if a `fullnameOverride` is specified | `master` | +| `nodeSelector` | Configurable [nodeSelector][] so that you can target specific nodes for your OpenSearch cluster | `{}` | +| `persistence` | Enables a persistent volume for OpenSearch data. | see [values.yaml][] | +| `persistence.enableInitChown` | Disable the `fsgroup-volume` initContainer that will update permissions on the persistent disk. | `true` | +| `podAffinity` | Value for the [pod affinity settings][] | `{}` | +| `podAnnotations` | Configurable [annotations][] applied to all OpenSearch pods | `{}` | +| `podManagementPolicy` | By default Kubernetes [deploys StatefulSets serially][]. This deploys them in parallel so that they can discover each other | `Parallel` | +| `podSecurityContext` | Allows you to set the [securityContext][] for the pod | see [values.yaml][] | +| `podSecurityPolicy` | Configuration for create a pod security policy with minimal permissions to run this Helm chart with `create: true`. Also can be used to reference an external pod security policy with `name: "externalPodSecurityPolicy"` | see [values.yaml][] | +| `priorityClassName` | The name of the [PriorityClass][]. No default is supplied as the PriorityClass must be created first | `""` | +| `rbac` | Configuration for creating a role, role binding and ServiceAccount as part of this Helm chart with `create: true`. Also can be used to reference an external ServiceAccount with `serviceAccountName: "externalServiceAccountName"` | see [values.yaml][] | +| `rbac.automountServiceAccountToken` | Controls whether a service account token should be automatically mounted to the Pods. | `true` | +| `replicas` | Kubernetes replica count for the StatefulSet (i.e. how many pods) | `3` | +| `resources` | Allows you to set the [resources][] for the StatefulSet | see [values.yaml][] | +| `roles` | A list of the specific node [roles][] for the `nodeGroup` | see [values.yaml][] | +| `singleNode` | If `discovery.type` in the opensearch configuration is set to `"single-node"`, this should be set to `true`. If `true`, replicas will be forced to `1`. | `false` | +| `schedulerName` | Name of the [alternate scheduler][] | `""` | +| `secretMounts` | Allows you easily mount a secret as a file inside the StatefulSet. Useful for mounting certificates and other secrets. See [values.yaml][] for an example | `[]` | +| `securityConfig` | Configure the opensearch security plugin. There are multiple ways to inject configuration into the chart, see [values.yaml][] details. | By default an insecure demonstration configuration is set. This **must** be changed before going to production. | +| `securityContext` | Allows you to set the [securityContext][] for the container | see [values.yaml][] | +| `service.annotations` | [LoadBalancer annotations][] that Kubernetes will use for the service. This will configure load balancer if `service.type` is `LoadBalancer` | `{}` | +| `service.headless.annotations` | Allow you to set annotations on the headless service | `{}` | +| `service.externalTrafficPolicy` | Some cloud providers allow you to specify the [LoadBalancer externalTrafficPolicy][]. Kubernetes will use this to preserve the client source IP. This will configure load balancer if `service.type` is `LoadBalancer` | `""` | +| `service.httpPortName` | The name of the http port within the service | `http` | +| `service.labelsHeadless` | Labels to be added to headless service | `{}` | +| `service.labels` | Labels to be added to non-headless service | `{}` | +| `service.loadBalancerIP` | Some cloud providers allow you to specify the [loadBalancer][] IP. If the `loadBalancerIP` field is not specified, the IP is dynamically assigned. If you specify a `loadBalancerIP` but your cloud provider does not support the feature, it is ignored. | `""` | +| `service.loadBalancerSourceRanges` | The IP ranges that are allowed to access | `[]` | +| `service.metricsPortName` | The name of the metrics port (for Performance Analyzer) within the service | `metrics` | +| `service.nodePort` | Custom [nodePort][] port that can be set if you are using `service.type: nodePort` | `""` | +| `service.transportPortName` | The name of the transport port within the service | `transport` | +| `service.type` | OpenSearch [Service Types][] | `ClusterIP` | +| `service.ipFamilyPolicy` | This sets the preferred ip addresses in case of a dual-stack server, there are three options [PreferDualStack, SingleStack, RequireDualStack], [more information on dual stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/) | `""` | +| `service.ipFamilies` | Sets the preferred IP variants and in which order they are preferred, the first family you list is used for the legacy .spec.ClusterIP field, [more information on dual stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/) | `""` | +| `sidecarResources` | Allows you to set the [resources][] for the sidecar containers in the StatefulSet | {} | +| `sysctlInit` | Allows you to enable the `sysctlInit` to set sysctl vm.max_map_count through privileged `initContainer`. | `enabled: false` | +| `sysctlVmMaxMapCount` | Sets the [vm.max_map_count][] needed for OpenSearch | `262144` | +| `terminationGracePeriod` | The [terminationGracePeriod][] in seconds used when trying to stop the pod | `120` | +| `tolerations` | Configurable [tolerations][] | `[]` | +| `topologySpreadConstraints` | Configuration for pod [topologySpreadConstraints][] | `[]` | +| `transportHostPort` | Expose another transport port as hostPort. Refer to documentation for more information and requirements about using hostPorts. | `""` | +| `transportPort` | The transport port that Kubernetes will use for the service. If you change this you will also need to set transport port configuration in `extraEnvs` | `9300` | +| `updateStrategy` | The [updateStrategy][] for the StatefulSet. By default Kubernetes will wait for the cluster to be green after upgrading each pod. Setting this to `OnDelete` will allow you to manually delete each pod during upgrades | `RollingUpdate` | +| `volumeClaimTemplate` | Configuration for the [volumeClaimTemplate for StatefulSets][]. You will want to adjust the storage (default `30Gi` ) and the `storageClassName` if you are using a different storage class | see [values.yaml][] | +| `extraObjects` | Array of extra K8s manifests to deploy | list `[]` | +| `livenessProbe` | Configuration fields for the liveness [probe][] | see [exampleLiveness][] in `values.yaml` | +| `readinessProbe` | Configuration fields for the readiness [probe][] | see [exampleReadiness][] in `values.yaml` | +| `startupProbe` | Configuration fields for the startup [probe][] | see [exampleStartup][] in `values.yaml` | +| `plugins.enabled` | Allow/disallow to add 3rd Party / Custom plugins not offered in the default OpenSearchDashboards image | false | +| `plugins.installList` | Array containing the Opensearch Dashboards plugins to be installed in container | \[] | +| `opensearchLifecycle` | Allows you to configure lifecycle hooks for the OpenSearch container in the StatefulSet | {} | +| `lifecycle` | Allows you to configure lifecycle hooks for the OpenSearch container in the StatefulSet | {} | +| `openSearchAnnotations` | Allows you to configure custom annotation in the StatefullSet of the OpenSearch container | {} | +| `serviceMonitor.enabled` | Enables the creation of a [ServiceMonitor] resource for Prometheus monitoring. Requires the Prometheus Operator to be installed in your Kubernetes cluster. | `false` | +| `serviceMonitor.path` | Path where metrics are exposed. Applicable only if `serviceMonitor.enabled` is set to `true`. | `/_prometheus/metrics` | +| `serviceMonitor.interval` | Interval at which metrics should be scraped by Prometheus. Applicable only if `serviceMonitor.enabled` is set to `true`. | `10s` | +| `serviceMonitor.basicAuth.enabled` | Wheter or not the serviceMonitor should use basic auth | `false` | +| `serviceMonitor.basicAuth.existingSecret` | When using basicAuth for the serviceMonitor, use an existing secret | `""` | +| `serviceMonitor.basicAuth.username` | Username to be used for basic auth | `""` | +| `serviceMonitor.basicAuth.password` | Password to be used for basic auth | `""` | +| `serviceMonitor.scheme` | scheme to be used for scraping the metrics | `"http"` | +| `serviceMonitor.tlsConfig` | optional tlsConfig to be used for scraping | `{}` | + +[anti-affinity]: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity +[environment from variables]: https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/#configure-all-key-value-pairs-in-a-configmap-as-container-environment-variables +[values.yaml]: https://github.com/opensearch-project/helm-charts/blob/main/charts/opensearch/values.yaml +[hostAliases]: https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ +[imagepullPolicy]: https://kubernetes.io/docs/concepts/containers/images/#updating-images +[imagePullSecrets]: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ +[ingress]: https://kubernetes.io/docs/concepts/services-networking/ingress/ +[resources]: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ +[labels]: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ +[maxUnavailable]: https://kubernetes.io/docs/tasks/run-application/configure-pdb/#specifying-a-poddisruptionbudget +[node affinity settings]: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#node-affinity-beta-feature +[pod affinity settings]: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity +[nodeSelector]: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector +[annotations]: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ +[deploys statefulsets serially]: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies +[securityContext]: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ +[priorityClass]: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass +[roles]: https://opensearch.org/docs/opensearch/cluster/ +[alternate scheduler]: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/#specify-schedulers-for-pods +[loadBalancer annotations]: https://kubernetes.io/docs/concepts/services-networking/service/#ssl-support-on-aws +[loadBalancer externalTrafficPolicy]: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip +[loadBalancer]: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer +[nodePort]: https://kubernetes.io/docs/concepts/services-networking/service/#nodeport +[vm.max_map_count]: https://opensearch.org/docs/opensearch/install/important-settings/ +[terminationGracePeriod]: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods +[tolerations]: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ +[updateStrategy]: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/ +[volumeClaimTemplate for statefulsets]: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#stable-storage +[service types]: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types +[topologySpreadConstraints]: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints +[probe]: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-readiness-probes +[exampleStartup]: https://github.com/opensearch-project/helm-charts/blob/main/charts/opensearch/values.yaml#332 +[exampleLiveness]: https://github.com/opensearch-project/helm-charts/blob/main/charts/opensearch/values.yaml#340 +[exampleReadiness]: https://github.com/opensearch-project/helm-charts/blob/main/charts/opensearch/values.yaml#349 +[ServiceMonitor]: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#servicemonitor diff --git a/helm-charts-observability/charts/opensearch/ci/ci-ingress-class-name-values.yaml b/helm-charts-observability/charts/opensearch/ci/ci-ingress-class-name-values.yaml new file mode 100644 index 0000000..d78f930 --- /dev/null +++ b/helm-charts-observability/charts/opensearch/ci/ci-ingress-class-name-values.yaml @@ -0,0 +1,442 @@ +--- +clusterName: "opensearch-cluster" +nodeGroup: "master" + +# The service that non master groups will try to connect to when joining the cluster +# This should be set to clusterName + "-" + nodeGroup for your master group +masterService: "opensearch-cluster-master" + +# OpenSearch roles that will be applied to this nodeGroup +# These will be set as environment variable "node.roles". E.g. node.roles=master,ingest,data,remote_cluster_client +roles: + - master + - ingest + - data + - remote_cluster_client + +replicas: 1 + +# if not set, falls back to parsing .Values.imageTag, then .Chart.appVersion. +majorVersion: "" + +global: + # Set if you want to change the default docker registry, e.g. a private one. + dockerRegistry: "" + +# Allows you to add any config files in {{ .Values.opensearchHome }}/config +opensearchHome: /usr/share/opensearch +# such as opensearch.yml and log4j2.properties +config: + # Values must be YAML literal style scalar / YAML multiline string. + # : | + # + # log4j2.properties: | + # status = error + # + # appender.console.type = Console + # appender.console.name = console + # appender.console.layout.type = PatternLayout + # appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n + # + # rootLogger.level = info + # rootLogger.appenderRef.console.ref = console + opensearch.yml: | + cluster.name: opensearch-cluster + + # Bind to all interfaces because we don't know what IP address Docker will assign to us. + network.host: 0.0.0.0 + transport.host: localhost + transport.tcp.port: 9300 + + # Setting network.host to a non-loopback address enables the annoying bootstrap checks. "Single-node" mode disables them again. + # discovery.type: single-node + + # # Start OpenSearch Security Demo Configuration + # # WARNING: revise all the lines below before you go into production + # plugins: + # security: + # ssl: + # transport: + # pemcert_filepath: esnode.pem + # pemkey_filepath: esnode-key.pem + # pemtrustedcas_filepath: root-ca.pem + # enforce_hostname_verification: false + # http: + # enabled: true + # pemcert_filepath: esnode.pem + # pemkey_filepath: esnode-key.pem + # pemtrustedcas_filepath: root-ca.pem + # allow_unsafe_democertificates: true + # allow_default_init_securityindex: true + # authcz: + # admin_dn: + # - CN=kirk,OU=client,O=client,L=test,C=de + # audit.type: internal_opensearch + # enable_snapshot_restore_privilege: true + # check_snapshot_restore_write_privileges: true + # restapi: + # roles_enabled: ["all_access", "security_rest_api_access"] + # system_indices: + # enabled: true + # indices: + # [ + # ".opendistro-alerting-config", + # ".opendistro-alerting-alert*", + # ".opendistro-anomaly-results*", + # ".opendistro-anomaly-detector*", + # ".opendistro-anomaly-checkpoints", + # ".opendistro-anomaly-detection-state", + # ".opendistro-reports-*", + # ".opendistro-notifications-*", + # ".opendistro-notebooks", + # ".opendistro-asynchronous-search-response*", + # ] + # ######## End OpenSearch Security Demo Configuration ######## + # log4j2.properties: + +# Extra environment variables to append to this nodeGroup +# This will be appended to the current 'env:' key. You can use any of the kubernetes env +# syntax here +extraEnvs: + - name: OPENSEARCH_INITIAL_ADMIN_PASSWORD + value: myStrongPassword123@456 +# - name: MY_ENVIRONMENT_VAR +# value: the_value_goes_here + +# Allows you to load environment variables from kubernextes secret or config map +envFrom: [] +# - secretRef: +# name: env-secret +# - configMapRef: +# name: config-map + +# A list of secrets and their paths to mount inside the pod +# This is useful for mounting certificates for security and for mounting +# the X-Pack license +secretMounts: [] + +hostAliases: [] +# - ip: "127.0.0.1" +# hostnames: +# - "foo.local" +# - "bar.local" + +image: + repository: "opensearchproject/opensearch" + # override image tag, which is .Chart.AppVersion by default + tag: "" + pullPolicy: "IfNotPresent" + +podAnnotations: {} + # iam.amazonaws.com/role: es-cluster + +# additionals labels +labels: {} + +opensearchJavaOpts: "-Xmx512M -Xms512M" + +resources: + requests: + cpu: "1000m" + memory: "100Mi" + +initResources: {} + # limits: + # cpu: "25m" + # # memory: "128Mi" + # requests: + # cpu: "25m" + # memory: "128Mi" + +sidecarResources: {} + # limits: + # cpu: "25m" + # # memory: "128Mi" + # requests: + # cpu: "25m" + # memory: "128Mi" + +networkHost: "0.0.0.0" + +rbac: + create: false + serviceAccountAnnotations: {} + serviceAccountName: "" + automountServiceAccountToken: false + +podSecurityPolicy: + create: false + name: "" + spec: + privileged: true + fsGroup: + rule: RunAsAny + runAsUser: + rule: RunAsAny + seLinux: + rule: RunAsAny + supplementalGroups: + rule: RunAsAny + volumes: + - secret + - configMap + - persistentVolumeClaim + - emptyDir + +persistence: + enabled: true + # Set to false to disable the `fsgroup-volume` initContainer that will update permissions on the persistent disk. + enableInitChown: true + # override image, which is busybox by default + # image: busybox + # override image tag, which is latest by default + # imageTag: + labels: + # Add default labels for the volumeClaimTemplate of the StatefulSet + enabled: false + # OpenSearch Persistent Volume Storage Class + # If defined, storageClassName: + # If set to "-", storageClassName: "", which disables dynamic provisioning + # If undefined (the default) or set to null, no storageClassName spec is + # set, choosing the default provisioner. (gp2 on AWS, standard on + # GKE, AWS & OpenStack) + # + # storageClass: "-" + accessModes: + - ReadWriteOnce + size: 8Gi + annotations: {} + +extraVolumes: [] + # - name: extras + # emptyDir: {} + +extraVolumeMounts: [] + # - name: extras + # mountPath: /usr/share/extras + # readOnly: true + +extraContainers: [] + # - name: do-something + # image: busybox + # command: ['do', 'something'] + +extraInitContainers: [] + # - name: do-somethings + # image: busybox + # command: ['do', 'something'] + +# This is the PriorityClass settings as defined in +# https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass +priorityClassName: "" + +# By default this will make sure two pods don't end up on the same node +# Changing this to a region would allow you to spread pods across regions +antiAffinityTopologyKey: "kubernetes.io/hostname" + +# Hard means that by default pods will only be scheduled if there are enough nodes for them +# and that they will never end up on the same node. Setting this to soft will do this "best effort". +# Setting this to custom will use what is passed into customAntiAffinity. +antiAffinity: "soft" + +# Allows passing in custom anti-affinity settings as defined in +# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity +# Using this parameter requires setting antiAffinity to custom. +customAntiAffinity: {} + +# This is the node affinity settings as defined in +# https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#node-affinity-beta-feature +nodeAffinity: {} + +# This is the pod affinity settings as defined in +# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity +podAffinity: {} + +# The default is to deploy all pods serially. By setting this to parallel all pods are started at +# the same time when bootstrapping the cluster +podManagementPolicy: "Parallel" + +# The environment variables injected by service links are not used, but can lead to slow OpenSearch boot times when +# there are many services in the current namespace. +# If you experience slow pod startups you probably want to set this to `false`. +enableServiceLinks: true + +protocol: https +httpPort: 9200 +transportPort: 9300 +metricsPort: 9600 + +service: + labels: {} + labelsHeadless: {} + headless: + annotations: {} + type: ClusterIP + nodePort: "" + annotations: {} + httpPortName: http + transportPortName: transport + loadBalancerIP: "" + loadBalancerSourceRanges: [] + externalTrafficPolicy: "" + +updateStrategy: RollingUpdate + +# This is the max unavailable setting for the pod disruption budget +# The default value of 1 will make sure that kubernetes won't allow more than 1 +# of your pods to be unavailable during maintenance +maxUnavailable: 1 + +podSecurityContext: + fsGroup: 1000 + runAsUser: 1000 + +securityContext: + capabilities: + drop: + - ALL + # readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1000 + +securityConfig: + enabled: true + path: "/usr/share/opensearch/plugins/opensearch-security/securityconfig" + actionGroupsSecret: + configSecret: + internalUsersSecret: + rolesSecret: + rolesMappingSecret: + tenantsSecret: + # The following option simplifies securityConfig by using a single secret and + # specifying the config files as keys in the secret instead of creating + # different secrets for for each config file. + # Note that this is an alternative to the individual secret configuration + # above and shouldn't be used if the above secrets are used. + config: + # There are multiple ways to define the configuration here: + # * If you define anything under data, the chart will automatically create + # a secret and mount it. + # * If you define securityConfigSecret, the chart will assume this secret is + # created externally and mount it. + # * It is an error to define both data and securityConfigSecret. + securityConfigSecret: "" + data: {} + # config.yml: |- + # internal_users.yml: |- + # roles.yml: |- + # roles_mapping.yml: |- + # action_groups.yml: |- + # tenants.yml: |- + +# How long to wait for opensearch to stop gracefully +terminationGracePeriod: 120 + +sysctlVmMaxMapCount: 262144 + +startupProbe: + tcpSocket: + port: 9200 + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 3 + failureThreshold: 30 + +readinessProbe: + failureThreshold: 3 + initialDelaySeconds: 900 + periodSeconds: 10 + successThreshold: 3 + timeoutSeconds: 2 + +## Use an alternate scheduler. +## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ +## +schedulerName: "" + +imagePullSecrets: [] +nodeSelector: {} +tolerations: [] + +# Enabling this will publically expose your OpenSearch instance. +# Only enable this if you have security enabled on your cluster +ingress: + enabled: true + + # For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName + # See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress + ingressClassName: nginx + + annotations: {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + path: / + hosts: + - chart-example.local + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + +nameOverride: "" +fullnameOverride: "" + +masterTerminationFix: false + +lifecycle: {} + # preStop: + # exec: + # command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"] + # postStart: + # exec: + # command: + # - bash + # - -c + # - | + # #!/bin/bash + # # Add a template to adjust number of shards/replicas1 + # TEMPLATE_NAME=my_template + # INDEX_PATTERN="logstash-*" + # SHARD_COUNT=8 + # REPLICA_COUNT=1 + # ES_URL=http://localhost:9200 + # while [[ "$(curl -s -o /dev/null -w '%{http_code}\n' $ES_URL)" != "200" ]]; do sleep 1; done + # curl -XPUT "$ES_URL/_template/$TEMPLATE_NAME" -H 'Content-Type: application/json' -d'{"index_patterns":['\""$INDEX_PATTERN"\"'],"settings":{"number_of_shards":'$SHARD_COUNT',"number_of_replicas":'$REPLICA_COUNT'}}' + +keystore: [] + +networkPolicy: + ## Enable creation of NetworkPolicy resources. Only Ingress traffic is filtered for now. + ## In order for a Pod to access OpenSearch, it needs to have the following label: + ## {{ template "uname" . }}-client: "true" + ## Example for default configuration to access HTTP port: + ## opensearch-master-http-client: "true" + ## Example for default configuration to access transport port: + ## opensearch-master-transport-client: "true" + + http: + enabled: false + +# Deprecated +# please use the above podSecurityContext.fsGroup instead +fsGroup: "" + +## Set optimal sysctl's through securityContext. This requires privilege. Can be disabled if +## the system has already been preconfigured. (Ex: https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html) +## Also see: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ +sysctl: + enabled: false + +## Set optimal sysctl's through privileged initContainer. +sysctlInit: + enabled: true + # override image, which is busybox by default + # image: busybox + # override image tag, which is latest by default + # imageTag: + +## Enable to add 3rd Party / Custom plugins not offered in the default OpenSearch image. +plugins: + enabled: false + installList: [] + # - example-fake-plugin diff --git a/helm-charts-observability/charts/opensearch/ci/ci-rbac-enabled-values.yaml b/helm-charts-observability/charts/opensearch/ci/ci-rbac-enabled-values.yaml new file mode 100755 index 0000000..91b4a59 --- /dev/null +++ b/helm-charts-observability/charts/opensearch/ci/ci-rbac-enabled-values.yaml @@ -0,0 +1,442 @@ +--- +clusterName: "opensearch-cluster" +nodeGroup: "master" + +# The service that non master groups will try to connect to when joining the cluster +# This should be set to clusterName + "-" + nodeGroup for your master group +masterService: "opensearch-cluster-master" + +# OpenSearch roles that will be applied to this nodeGroup +# These will be set as environment variable "node.roles". E.g. node.roles=master,ingest,data,remote_cluster_client +roles: + - master + - ingest + - data + - remote_cluster_client + +replicas: 1 + +# if not set, falls back to parsing .Values.imageTag, then .Chart.appVersion. +majorVersion: "" + +global: + # Set if you want to change the default docker registry, e.g. a private one. + dockerRegistry: "" + +# Allows you to add any config files in {{ .Values.opensearchHome }}/config +opensearchHome: /usr/share/opensearch +# such as opensearch.yml and log4j2.properties +config: + # Values must be YAML literal style scalar / YAML multiline string. + # : | + # + # log4j2.properties: | + # status = error + # + # appender.console.type = Console + # appender.console.name = console + # appender.console.layout.type = PatternLayout + # appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n + # + # rootLogger.level = info + # rootLogger.appenderRef.console.ref = console + opensearch.yml: | + cluster.name: opensearch-cluster + + # Bind to all interfaces because we don't know what IP address Docker will assign to us. + network.host: 0.0.0.0 + transport.host: localhost + transport.tcp.port: 9300 + + # Setting network.host to a non-loopback address enables the annoying bootstrap checks. "Single-node" mode disables them again. + # discovery.type: single-node + + # # Start OpenSearch Security Demo Configuration + # # WARNING: revise all the lines below before you go into production + # plugins: + # security: + # ssl: + # transport: + # pemcert_filepath: esnode.pem + # pemkey_filepath: esnode-key.pem + # pemtrustedcas_filepath: root-ca.pem + # enforce_hostname_verification: false + # http: + # enabled: true + # pemcert_filepath: esnode.pem + # pemkey_filepath: esnode-key.pem + # pemtrustedcas_filepath: root-ca.pem + # allow_unsafe_democertificates: true + # allow_default_init_securityindex: true + # authcz: + # admin_dn: + # - CN=kirk,OU=client,O=client,L=test,C=de + # audit.type: internal_opensearch + # enable_snapshot_restore_privilege: true + # check_snapshot_restore_write_privileges: true + # restapi: + # roles_enabled: ["all_access", "security_rest_api_access"] + # system_indices: + # enabled: true + # indices: + # [ + # ".opendistro-alerting-config", + # ".opendistro-alerting-alert*", + # ".opendistro-anomaly-results*", + # ".opendistro-anomaly-detector*", + # ".opendistro-anomaly-checkpoints", + # ".opendistro-anomaly-detection-state", + # ".opendistro-reports-*", + # ".opendistro-notifications-*", + # ".opendistro-notebooks", + # ".opendistro-asynchronous-search-response*", + # ] + # ######## End OpenSearch Security Demo Configuration ######## + # log4j2.properties: + +# Extra environment variables to append to this nodeGroup +# This will be appended to the current 'env:' key. You can use any of the kubernetes env +# syntax here +extraEnvs: + - name: OPENSEARCH_INITIAL_ADMIN_PASSWORD + value: myStrongPassword123@456 +# - name: MY_ENVIRONMENT_VAR +# value: the_value_goes_here + +# Allows you to load environment variables from kubernextes secret or config map +envFrom: [] +# - secretRef: +# name: env-secret +# - configMapRef: +# name: config-map + +# A list of secrets and their paths to mount inside the pod +# This is useful for mounting certificates for security and for mounting +# the X-Pack license +secretMounts: [] + +hostAliases: [] +# - ip: "127.0.0.1" +# hostnames: +# - "foo.local" +# - "bar.local" + +image: + repository: "opensearchproject/opensearch" + # override image tag, which is .Chart.AppVersion by default + tag: "" + pullPolicy: "IfNotPresent" + +podAnnotations: {} + # iam.amazonaws.com/role: es-cluster + +# additionals labels +labels: {} + +opensearchJavaOpts: "-Xmx512M -Xms512M" + +resources: + requests: + cpu: "1000m" + memory: "100Mi" + +initResources: {} + # limits: + # cpu: "25m" + # # memory: "128Mi" + # requests: + # cpu: "25m" + # memory: "128Mi" + +sidecarResources: {} + # limits: + # cpu: "25m" + # # memory: "128Mi" + # requests: + # cpu: "25m" + # memory: "128Mi" + +networkHost: "0.0.0.0" + +rbac: + create: true + serviceAccountAnnotations: {} + serviceAccountName: "" + automountServiceAccountToken: true + +podSecurityPolicy: + create: false + name: "" + spec: + privileged: true + fsGroup: + rule: RunAsAny + runAsUser: + rule: RunAsAny + seLinux: + rule: RunAsAny + supplementalGroups: + rule: RunAsAny + volumes: + - secret + - configMap + - persistentVolumeClaim + - emptyDir + +persistence: + enabled: true + # Set to false to disable the `fsgroup-volume` initContainer that will update permissions on the persistent disk. + enableInitChown: true + # override image, which is busybox by default + # image: busybox + # override image tag, which is latest by default + # imageTag: + labels: + # Add default labels for the volumeClaimTemplate of the StatefulSet + enabled: false + # OpenSearch Persistent Volume Storage Class + # If defined, storageClassName: + # If set to "-", storageClassName: "", which disables dynamic provisioning + # If undefined (the default) or set to null, no storageClassName spec is + # set, choosing the default provisioner. (gp2 on AWS, standard on + # GKE, AWS & OpenStack) + # + # storageClass: "-" + accessModes: + - ReadWriteOnce + size: 8Gi + annotations: {} + +extraVolumes: [] + # - name: extras + # emptyDir: {} + +extraVolumeMounts: [] + # - name: extras + # mountPath: /usr/share/extras + # readOnly: true + +extraContainers: [] + # - name: do-something + # image: busybox + # command: ['do', 'something'] + +extraInitContainers: [] + # - name: do-somethings + # image: busybox + # command: ['do', 'something'] + +# This is the PriorityClass settings as defined in +# https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass +priorityClassName: "" + +# By default this will make sure two pods don't end up on the same node +# Changing this to a region would allow you to spread pods across regions +antiAffinityTopologyKey: "kubernetes.io/hostname" + +# Hard means that by default pods will only be scheduled if there are enough nodes for them +# and that they will never end up on the same node. Setting this to soft will do this "best effort". +# Setting this to custom will use what is passed into customAntiAffinity. +antiAffinity: "soft" + +# Allows passing in custom anti-affinity settings as defined in +# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity +# Using this parameter requires setting antiAffinity to custom. +customAntiAffinity: {} + +# This is the node affinity settings as defined in +# https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#node-affinity-beta-feature +nodeAffinity: {} + +# This is the pod affinity settings as defined in +# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity +podAffinity: {} + +# The default is to deploy all pods serially. By setting this to parallel all pods are started at +# the same time when bootstrapping the cluster +podManagementPolicy: "Parallel" + +# The environment variables injected by service links are not used, but can lead to slow OpenSearch boot times when +# there are many services in the current namespace. +# If you experience slow pod startups you probably want to set this to `false`. +enableServiceLinks: true + +protocol: https +httpPort: 9200 +transportPort: 9300 +metricsPort: 9600 + +service: + labels: {} + labelsHeadless: {} + headless: + annotations: {} + type: ClusterIP + nodePort: "" + annotations: {} + httpPortName: http + transportPortName: transport + loadBalancerIP: "" + loadBalancerSourceRanges: [] + externalTrafficPolicy: "" + +updateStrategy: RollingUpdate + +# This is the max unavailable setting for the pod disruption budget +# The default value of 1 will make sure that kubernetes won't allow more than 1 +# of your pods to be unavailable during maintenance +maxUnavailable: 1 + +podSecurityContext: + fsGroup: 1000 + runAsUser: 1000 + +securityContext: + capabilities: + drop: + - ALL + # readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1000 + +securityConfig: + enabled: true + path: "/usr/share/opensearch/plugins/opensearch-security/securityconfig" + actionGroupsSecret: + configSecret: + internalUsersSecret: + rolesSecret: + rolesMappingSecret: + tenantsSecret: + # The following option simplifies securityConfig by using a single secret and + # specifying the config files as keys in the secret instead of creating + # different secrets for for each config file. + # Note that this is an alternative to the individual secret configuration + # above and shouldn't be used if the above secrets are used. + config: + # There are multiple ways to define the configuration here: + # * If you define anything under data, the chart will automatically create + # a secret and mount it. + # * If you define securityConfigSecret, the chart will assume this secret is + # created externally and mount it. + # * It is an error to define both data and securityConfigSecret. + securityConfigSecret: "" + data: {} + # config.yml: |- + # internal_users.yml: |- + # roles.yml: |- + # roles_mapping.yml: |- + # action_groups.yml: |- + # tenants.yml: |- + +# How long to wait for opensearch to stop gracefully +terminationGracePeriod: 120 + +sysctlVmMaxMapCount: 262144 + +startupProbe: + tcpSocket: + port: 9200 + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 3 + failureThreshold: 30 + +readinessProbe: + failureThreshold: 3 + initialDelaySeconds: 900 + periodSeconds: 10 + successThreshold: 3 + timeoutSeconds: 2 + +## Use an alternate scheduler. +## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ +## +schedulerName: "" + +imagePullSecrets: [] +nodeSelector: {} +tolerations: [] + +# Enabling this will publically expose your OpenSearch instance. +# Only enable this if you have security enabled on your cluster +ingress: + enabled: false + + # For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName + # See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress + ingressClassName: nginx + + annotations: {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + path: / + hosts: + - chart-example.local + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + +nameOverride: "" +fullnameOverride: "" + +masterTerminationFix: false + +lifecycle: {} + # preStop: + # exec: + # command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"] + # postStart: + # exec: + # command: + # - bash + # - -c + # - | + # #!/bin/bash + # # Add a template to adjust number of shards/replicas1 + # TEMPLATE_NAME=my_template + # INDEX_PATTERN="logstash-*" + # SHARD_COUNT=8 + # REPLICA_COUNT=1 + # ES_URL=http://localhost:9200 + # while [[ "$(curl -s -o /dev/null -w '%{http_code}\n' $ES_URL)" != "200" ]]; do sleep 1; done + # curl -XPUT "$ES_URL/_template/$TEMPLATE_NAME" -H 'Content-Type: application/json' -d'{"index_patterns":['\""$INDEX_PATTERN"\"'],"settings":{"number_of_shards":'$SHARD_COUNT',"number_of_replicas":'$REPLICA_COUNT'}}' + +keystore: [] + +networkPolicy: + ## Enable creation of NetworkPolicy resources. Only Ingress traffic is filtered for now. + ## In order for a Pod to access OpenSearch, it needs to have the following label: + ## {{ template "uname" . }}-client: "true" + ## Example for default configuration to access HTTP port: + ## opensearch-master-http-client: "true" + ## Example for default configuration to access transport port: + ## opensearch-master-transport-client: "true" + + http: + enabled: false + +# Deprecated +# please use the above podSecurityContext.fsGroup instead +fsGroup: "" + +## Set optimal sysctl's through securityContext. This requires privilege. Can be disabled if +## the system has already been preconfigured. (Ex: https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html) +## Also see: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ +sysctl: + enabled: false + +## Set optimal sysctl's through privileged initContainer. +sysctlInit: + enabled: false + # override image, which is busybox by default + # image: busybox + # override image tag, which is latest by default + # imageTag: + +## Enable to add 3rd Party / Custom plugins not offered in the default OpenSearch image. +plugins: + enabled: false + installList: [] + # - example-fake-plugin diff --git a/helm-charts-observability/charts/opensearch/ci/ci-values.yaml b/helm-charts-observability/charts/opensearch/ci/ci-values.yaml new file mode 100755 index 0000000..b09ef89 --- /dev/null +++ b/helm-charts-observability/charts/opensearch/ci/ci-values.yaml @@ -0,0 +1,428 @@ +--- +clusterName: "opensearch-cluster" +nodeGroup: "master" + +# The service that non master groups will try to connect to when joining the cluster +# This should be set to clusterName + "-" + nodeGroup for your master group +masterService: "opensearch-cluster-master" + +# OpenSearch roles that will be applied to this nodeGroup +# These will be set as environment variable "node.roles". E.g. node.roles=master,ingest,data,remote_cluster_client +roles: + - master + - ingest + - data + - remote_cluster_client + +replicas: 1 + +# if not set, falls back to parsing .Values.imageTag, then .Chart.appVersion. +majorVersion: "" + +global: + # Set if you want to change the default docker registry, e.g. a private one. + dockerRegistry: "" + +# Allows you to add any config files in {{ .Values.opensearchHome }}/config +opensearchHome: /usr/share/opensearch +# such as opensearch.yml and log4j2.properties +config: + # Values must be YAML literal style scalar / YAML multiline string. + # : | + # + # log4j2.properties: | + # status = error + # + # appender.console.type = Console + # appender.console.name = console + # appender.console.layout.type = PatternLayout + # appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n + # + # rootLogger.level = info + # rootLogger.appenderRef.console.ref = console + opensearch.yml: | + cluster.name: opensearch-cluster + + # Bind to all interfaces because we don't know what IP address Docker will assign to us. + network.host: 0.0.0.0 + transport.host: localhost + transport.tcp.port: 9300 + + # Setting network.host to a non-loopback address enables the annoying bootstrap checks. "Single-node" mode disables them again. + # discovery.type: single-node + + # # Start OpenSearch Security Demo Configuration + # # WARNING: revise all the lines below before you go into production + # plugins: + # security: + # ssl: + # transport: + # pemcert_filepath: esnode.pem + # pemkey_filepath: esnode-key.pem + # pemtrustedcas_filepath: root-ca.pem + # enforce_hostname_verification: false + # http: + # enabled: true + # pemcert_filepath: esnode.pem + # pemkey_filepath: esnode-key.pem + # pemtrustedcas_filepath: root-ca.pem + # allow_unsafe_democertificates: true + # allow_default_init_securityindex: true + # authcz: + # admin_dn: + # - CN=kirk,OU=client,O=client,L=test,C=de + # audit.type: internal_opensearch + # enable_snapshot_restore_privilege: true + # check_snapshot_restore_write_privileges: true + # restapi: + # roles_enabled: ["all_access", "security_rest_api_access"] + # system_indices: + # enabled: true + # indices: + # [ + # ".opendistro-alerting-config", + # ".opendistro-alerting-alert*", + # ".opendistro-anomaly-results*", + # ".opendistro-anomaly-detector*", + # ".opendistro-anomaly-checkpoints", + # ".opendistro-anomaly-detection-state", + # ".opendistro-reports-*", + # ".opendistro-notifications-*", + # ".opendistro-notebooks", + # ".opendistro-asynchronous-search-response*", + # ] + # ######## End OpenSearch Security Demo Configuration ######## + # log4j2.properties: + +# Extra environment variables to append to this nodeGroup +# This will be appended to the current 'env:' key. You can use any of the kubernetes env +# syntax here +extraEnvs: + - name: OPENSEARCH_INITIAL_ADMIN_PASSWORD + value: myStrongPassword123@456 +# - name: MY_ENVIRONMENT_VAR +# value: the_value_goes_here + +# Allows you to load environment variables from kubernextes secret or config map +envFrom: [] +# - secretRef: +# name: env-secret +# - configMapRef: +# name: config-map + +# A list of secrets and their paths to mount inside the pod +# This is useful for mounting certificates for security and for mounting +# the X-Pack license +secretMounts: [] + +hostAliases: [] +# - ip: "127.0.0.1" +# hostnames: +# - "foo.local" +# - "bar.local" + + +image: + repository: "opensearchproject/opensearch" + # override image tag, which is .Chart.AppVersion by default + tag: "" + pullPolicy: "IfNotPresent" + + +podAnnotations: {} + # iam.amazonaws.com/role: es-cluster + +# additionals labels +labels: {} + +opensearchJavaOpts: "-Xmx512M -Xms512M" + +resources: + requests: + cpu: "1000m" + memory: "100Mi" + +initResources: {} + # limits: + # cpu: "25m" + # # memory: "128Mi" + # requests: + # cpu: "25m" + # memory: "128Mi" + +sidecarResources: {} + # limits: + # cpu: "25m" + # # memory: "128Mi" + # requests: + # cpu: "25m" + # memory: "128Mi" + +networkHost: "0.0.0.0" + +rbac: + create: false + serviceAccountAnnotations: {} + serviceAccountName: "" + +podSecurityPolicy: + create: false + name: "" + spec: + privileged: true + fsGroup: + rule: RunAsAny + runAsUser: + rule: RunAsAny + seLinux: + rule: RunAsAny + supplementalGroups: + rule: RunAsAny + volumes: + - secret + - configMap + - persistentVolumeClaim + - emptyDir + +persistence: + enabled: true + # Set to false to disable the `fsgroup-volume` initContainer that will update permissions on the persistent disk. + enableInitChown: true + # override image, which is busybox by default + # image: busybox + # override image tag, which is latest by default + # imageTag: + labels: + # Add default labels for the volumeClaimTemplate of the StatefulSet + enabled: false + # OpenSearch Persistent Volume Storage Class + # If defined, storageClassName: + # If set to "-", storageClassName: "", which disables dynamic provisioning + # If undefined (the default) or set to null, no storageClassName spec is + # set, choosing the default provisioner. (gp2 on AWS, standard on + # GKE, AWS & OpenStack) + # + # storageClass: "-" + accessModes: + - ReadWriteOnce + size: 8Gi + annotations: {} + +extraVolumes: [] + # - name: extras + # emptyDir: {} + +extraVolumeMounts: [] + # - name: extras + # mountPath: /usr/share/extras + # readOnly: true + +extraContainers: [] + # - name: do-something + # image: busybox + # command: ['do', 'something'] + +extraInitContainers: [] + # - name: do-somethings + # image: busybox + # command: ['do', 'something'] + +# This is the PriorityClass settings as defined in +# https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass +priorityClassName: "" + +# By default this will make sure two pods don't end up on the same node +# Changing this to a region would allow you to spread pods across regions +antiAffinityTopologyKey: "kubernetes.io/hostname" + +# Hard means that by default pods will only be scheduled if there are enough nodes for them +# and that they will never end up on the same node. Setting this to soft will do this "best effort". +# Setting this to custom will use what is passed into customAntiAffinity. +antiAffinity: "soft" + +# Allows passing in custom anti-affinity settings as defined in +# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity +# Using this parameter requires setting antiAffinity to custom. +customAntiAffinity: {} + +# This is the node affinity settings as defined in +# https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#node-affinity-beta-feature +nodeAffinity: {} + +# This is the pod affinity settings as defined in +# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity +podAffinity: {} + +# The default is to deploy all pods serially. By setting this to parallel all pods are started at +# the same time when bootstrapping the cluster +podManagementPolicy: "Parallel" + +# The environment variables injected by service links are not used, but can lead to slow OpenSearch boot times when +# there are many services in the current namespace. +# If you experience slow pod startups you probably want to set this to `false`. +enableServiceLinks: true + +protocol: https +httpPort: 9200 +transportPort: 9300 +metricsPort: 9600 + +service: + labels: {} + labelsHeadless: {} + headless: + annotations: {} + type: ClusterIP + nodePort: "" + annotations: {} + httpPortName: http + transportPortName: transport + loadBalancerIP: "" + loadBalancerSourceRanges: [] + externalTrafficPolicy: "" + +updateStrategy: RollingUpdate + +# This is the max unavailable setting for the pod disruption budget +# The default value of 1 will make sure that kubernetes won't allow more than 1 +# of your pods to be unavailable during maintenance +maxUnavailable: 1 + +podSecurityContext: + fsGroup: 1000 + runAsUser: 1000 + +securityContext: + capabilities: + drop: + - ALL + # readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1000 + +securityConfig: + enabled: true + path: "/usr/share/opensearch/plugins/opensearch-security/securityconfig" + actionGroupsSecret: + configSecret: + internalUsersSecret: + rolesSecret: + rolesMappingSecret: + tenantsSecret: + # The following option simplifies securityConfig by using a single secret and + # specifying the config files as keys in the secret instead of creating + # different secrets for for each config file. + # Note that this is an alternative to the individual secret configuration + # above and shouldn't be used if the above secrets are used. + config: + # There are multiple ways to define the configuration here: + # * If you define anything under data, the chart will automatically create + # a secret and mount it. + # * If you define securityConfigSecret, the chart will assume this secret is + # created externally and mount it. + # * It is an error to define both data and securityConfigSecret. + securityConfigSecret: "" + data: {} + # config.yml: |- + # internal_users.yml: |- + # roles.yml: |- + # roles_mapping.yml: |- + # action_groups.yml: |- + # tenants.yml: |- + +# How long to wait for opensearch to stop gracefully +terminationGracePeriod: 120 + +sysctlVmMaxMapCount: 262144 + +## Use an alternate scheduler. +## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ +## +schedulerName: "" + +imagePullSecrets: [] +nodeSelector: {} +tolerations: [] + +# Enabling this will publically expose your OpenSearch instance. +# Only enable this if you have security enabled on your cluster +ingress: + enabled: false + + # For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName + # See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress + ingressClassName: nginx + + annotations: {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + path: / + hosts: + - chart-example.local + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + +nameOverride: "" +fullnameOverride: "" + +masterTerminationFix: false + +lifecycle: {} + # preStop: + # exec: + # command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"] + # postStart: + # exec: + # command: + # - bash + # - -c + # - | + # #!/bin/bash + # # Add a template to adjust number of shards/replicas1 + # TEMPLATE_NAME=my_template + # INDEX_PATTERN="logstash-*" + # SHARD_COUNT=8 + # REPLICA_COUNT=1 + # ES_URL=http://localhost:9200 + # while [[ "$(curl -s -o /dev/null -w '%{http_code}\n' $ES_URL)" != "200" ]]; do sleep 1; done + # curl -XPUT "$ES_URL/_template/$TEMPLATE_NAME" -H 'Content-Type: application/json' -d'{"index_patterns":['\""$INDEX_PATTERN"\"'],"settings":{"number_of_shards":'$SHARD_COUNT',"number_of_replicas":'$REPLICA_COUNT'}}' + +keystore: [] + +networkPolicy: + ## Enable creation of NetworkPolicy resources. Only Ingress traffic is filtered for now. + ## In order for a Pod to access OpenSearch, it needs to have the following label: + ## {{ template "uname" . }}-client: "true" + ## Example for default configuration to access HTTP port: + ## opensearch-master-http-client: "true" + ## Example for default configuration to access transport port: + ## opensearch-master-transport-client: "true" + + http: + enabled: false + +# Deprecated +# please use the above podSecurityContext.fsGroup instead +fsGroup: "" + +## Set optimal sysctl's through securityContext. This requires privilege. Can be disabled if +## the system has already been preconfigured. (Ex: https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html) +## Also see: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ +sysctl: + enabled: false + +## Set optimal sysctl's through privileged initContainer. +sysctlInit: + enabled: false + # override image, which is busybox by default + # image: busybox + # override image tag, which is latest by default + # imageTag: + +## Enable to add 3rd Party / Custom plugins not offered in the default OpenSearch image. +plugins: + enabled: false + installList: [] + # - example-fake-plugin diff --git a/helm-charts-observability/charts/opensearch/internal_users.yaml b/helm-charts-observability/charts/opensearch/internal_users.yaml new file mode 100644 index 0000000..78e9ccf --- /dev/null +++ b/helm-charts-observability/charts/opensearch/internal_users.yaml @@ -0,0 +1,11 @@ +--- +_meta: + type: "internalusers" + config_version: 2 + +admin: + hash: "$2y$12$4lu31zUeAnqAtmVvdaA9l.YqPgj2W/WL/4tojqC6uVfp3k5inWOmW" + reserved: true + backend_roles: + - "admin" + description: "OpenSearch administrator" diff --git a/helm-charts-observability/charts/opensearch/opensearch-admin-cert.yaml b/helm-charts-observability/charts/opensearch/opensearch-admin-cert.yaml new file mode 100644 index 0000000..b347441 --- /dev/null +++ b/helm-charts-observability/charts/opensearch/opensearch-admin-cert.yaml @@ -0,0 +1,9 @@ +apiVersion: v1 +data: + admin-key.pem: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRRHB1UUpNMTFMemdiRWgKbkNtdmlueDJKR2lJWVJlODA3dG1tN3JuUllZNXIwaXh6OUpCVjlITmZYeUpjOWV6MmczenJUQVNtdEVFU0ZEZAorR0dvb2NnNmdwT3pnNG9ZSExkSUNSNjg1cjltREVZMXRkWnlzUW1JKy9wWHAza2Q3ZzRvazRSOEpRSWNydng4CmtiRkx6UjZ1Z2RhOFI0bFNSelR0aExsZm1GR0dxTFh1bkhnNlZydy9ucXNVeHZGR2dFU0QrWUxKL3E0eDNPeG8KMTBCc1NhTlppVjJsSTlRWWNlQ1dBNEVKMjRUR2ViUUgxckNsblNWd3BDUm92dWZ3enU5ZlVOSDdOQkJabEhXMQpWc2laek8xT2ZQM29xNXZNd3l5Z090SEFOTERwSCtCbGY2WHNQdERhRThNcXNLNStqdzV6bVRWOUp0c005ODN2CkFDaWo2SnozQWdNQkFBRUNnZ0VBSWVlUHVOdm5rYUYzczV0MnhKcy9VTmdaUGVkdnpSbWQ3dFdhZUdBeWgzMncKK3ZKZDJ0TEZnWnk1aXlyOTJINUNWZDRDd2tBcElBanBpam0wMlFTWENqM1U5VTZZb3NUUHBhaUZCL3dsT2NXQQpEZHlSL2xOR1FkUGp6Z0ZpWllBYUY3TEdua2UwRmJzZ3IyVm5KY3JjcjQzd082SFkvdEdMa1FVVzZ4SXFpWEQ2Cjh1NFJDTHA0OGRxOGNFODlWZnNCRnl1VkpUQmlnTjhXSnhFKzdYTUVzQ0NJRDM3aWRGeVRnb1poVFNoYXNCQUYKeVpVdmxSRW1rL0tnQ0VLM2ljeXljczZDN0N4WEU3ZHE3a2JNaVlSazM4R09rS2pmaklzTFNQVkFwZlRJaWliYgpHWW1RKzJLTFhSWi85bXlUOWc5dGpHTHd3K3dKczQ5blZYc1RGcXNkdVFLQmdRRDJrejZUTE5aMlZ0MTVvTndNCjhBYndab3E0ZjM3VTdCTzEyem5SNEowdzhQU0xoQ01IclltUFpNNlFSdFZnekpnS3hYalNTWGZRQStvVnZyQ2EKckZpeFNoNWdBSUVZR1JBMlhlWTN1S2dHSWVPcXFDR3ZpamZHczJ6MzI0YjNZMTRtcjkvL0g0U0k2SXZ3RU5qZwpDU3A0UlluQTlyMTFJdmM4dS9pR1VCOTlKUUtCZ1FEeXFBQ0p1RmV6dk44VEtIbXIxb0ZTK3JSL1FBbUpsazl5Ck9HNjJjMGRiZGx6QXJkek1PUFRDMmIvSWtrdGdHQk0yUEVnaU5lT1dFemJYQ1B0dVdQS0loaHJ4M2RwRzlhdnkKdHN3ZjRnL0JIeCtoalRDTGVLQStvMEFrWldoUnNSS09HbXdnRGtGTmEyOW1aWVdQTnk0S3dSSk9MeGRPWStaNgpMZTMwOHFjTTZ3S0JnRUZpN0k0VXJzNTAzSWhiYXQ4WGE0K21jWlRaWW1YT01LL2g4YVJCUHczeVo3YnpsR0o5CjEyT3FKTWpIcjkvYWdWc2g0SmRMR2pXVVJDZitDRkVMOFAwYW5aRnhzTW9XSTJGM1p3eFJzR1RuNmJxZ21VWTIKamZIb05MWkpoYkhtck5udmU2UG8xTG1GaVU1ZytWSDN2RVpta2xBVVhrdEl1VzFtbjFIbXYyTHRBb0dBWFpOTwpDYzROL0NFMHdWV1ZmaC9OWld1SzJadWZVZkNtR0gwTXJNMU4wa2FWeERRSDlyVnNKZ3dFdWxzNE9BbHd0elNOCitLdGhaWWxwVjRsK05IS1dyUEZTU0wxdUpIa3U0djE5UURwVUt2eE9uV1V1T0VxL09RaUpmcitnZUFoYUNIVEcKQjZLWHFqeHBERXJRTTRkcStQaTFqM0wzZ09KamlmQldXR1NPNlJzQ2dZRUF1Zk1Gb2RLYzVQQ1lLSFBUV3FCQQo5QXE5V3FERUdOL25nWTNoVVo4U2RpM3ZReUd2bUdXYmNnK21tdmZ5TkYvRkJialJYemRJM0N1Vm51NzNsTTNYCmFMb24xUWhsOUsxWFFJa0lONEJPTXNGT29BQzg1UkdzWWt6RVVlQXByR1d1SGRFek5jU3N1R2xWbkx5azZhcHgKNzl1aHI3Sit3MlBlNGplK21TZ3d1cFU9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K + admin.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZDakNDQXZLZ0F3SUJBZ0lVSXljc3FkNHF1b2d4ancxRTRLangzd0J0Yld3d0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZVXhDekFKQmdOVkJBWVRBa0pFTVE0d0RBWURWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaAphMkV4RWpBUUJnTlZCQW9NQ1VKeWFXeHNhV0Z1ZERFYk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwCklFTkJNU1V3SXdZRFZRUUREQnhDY21sc2JHbGhiblFnVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUI0WERUSTIKTURjeU16RTFNRGMwTTFvWERUSTRNVEF5TlRFMU1EYzBNMW93Z1lBeEN6QUpCZ05WQkFZVEFrSkVNUTR3REFZRApWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaGEyRXhFakFRQmdOVkJBb01DVUp5YVd4c2FXRnVkREVpCk1DQUdBMVVFQ3d3WlQzQmxibE5sWVhKamFDQkJaRzFwYm1semRISmhkRzl5Y3pFWk1CY0dBMVVFQXd3UWIzQmwKYm5ObFlYSmphQzFoWkcxcGJqQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQU9tNQpBa3pYVXZPQnNTR2NLYStLZkhZa2FJaGhGN3pUdTJhYnV1ZEZoam12U0xIUDBrRlgwYzE5ZklsejE3UGFEZk90Ck1CS2EwUVJJVU4zNFlhaWh5RHFDazdPRGloZ2N0MGdKSHJ6bXYyWU1SalcxMW5LeENZajcrbGVuZVIzdURpaVQKaEh3bEFoeXUvSHlSc1V2TkhxNkIxcnhIaVZKSE5PMkV1VitZVVlhb3RlNmNlRHBXdkQrZXF4VEc4VWFBUklQNQpnc24rcmpIYzdHalhRR3hKbzFtSlhhVWoxQmh4NEpZRGdRbmJoTVo1dEFmV3NLV2RKWENrSkdpKzUvRE83MTlRCjBmczBFRm1VZGJWV3lKbk03VTU4L2Vpcm04ekRMS0E2MGNBMHNPa2Y0R1YvcGV3KzBOb1R3eXF3cm42UERuT1oKTlgwbTJ3ejN6ZThBS0tQb25QY0NBd0VBQWFOMU1ITXdEQVlEVlIwVEFRSC9CQUl3QURBT0JnTlZIUThCQWY4RQpCQU1DQmFBd0V3WURWUjBsQkF3d0NnWUlLd1lCQlFVSEF3SXdIUVlEVlIwT0JCWUVGT0daUGY0NEEyWkt3Q0FPCk9sc0lSYnJ1WkdCZE1COEdBMVVkSXdRWU1CYUFGSGJhbmo2RkdNVWZ3bEMwSytqY081TTlHd0FwTUEwR0NTcUcKU0liM0RRRUJDd1VBQTRJQ0FRQllzY1p2WVB5YXVkUDlLeVhNc1BkKzJZbThnWFVkYmpoakJuaDdwQXlNNU52cgpMRUFXR3VTSVFidzlNREVBMUluYkZvejhjQThBUVRFZGZ5bUJNMFdUbkpHam9zcGNRYUJWNU03VXZhYlZEeE1UCkNEbnkzbU93SjMyZUpjWkZiVmpjSFFrcTBrN0RMcnRLZE1DV3haWEd1WHpJZHZwcDJ4TzVjRzZXY3lGZVEwVkwKUnV5eUFkRm5sTXVSY01LMnNoSHprK3lVSGFUb29rTEtYK1pmMGFlUGhudUwwMGMwaWloSmw5eVhvS0ZzUUR6Ywp0WWhXNmdBZVRVelUrUU5RWEZTZ2NOdmhKaDBOVVVQeWlqczZUWWZtL052N0t3MTRIY2JXbnRBVTlWNjFiLzc2CldHM0hJTnpxMEt0QnF3bVQ4cms1YlRybGVzZWd2QzFUeUo2bjlMZTd1TjhkY2NtYkh6SE9MYU1CV3FraHhtbGwKNWNZcENmUFBkb1duQWxrWnBya2NRdnJOZ3F6TGZzcHNwd1RaQTNueXV5RVZuSmE3N0ZmNVR2VmgwWld2QWgyRgpUNitWek14OENTVnllZzFCNzVUNWRTRG5aLzZ3bGwzMk5oZnZMajdFOHRGRlJBWHdPaHRicEJNS1ZUelJoYW5XCnZEcWVrRkUrM1ZnTGh5My9uck5GTVQrejdRWnJBSUV5QWhXZG45cXRtWEsyYmU2c21PZzEyQlAybjd2bHBIQm8KRE1IdmRpMGY2bTc5VlBkdUM2NkhTNm0wOG9jaGZUaHhINHBDUk00ZjZ2R2E1dUFsczRFK3VveUd4cklsZjQ0YgpBWGx4T3RRMk5Kem5vb282c0w0cXNXdS9VZlpBTXVZSmE3WlY4WDNHZ1paSzl2a3JLb3JFa3ZVS212cEpvQT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + root-ca.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUY3VENDQTlXZ0F3SUJBZ0lVTC9hTytnYS9YY3lzakFYbGh1WG92d0xLWkJjd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZVXhDekFKQmdOVkJBWVRBa0pFTVE0d0RBWURWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaAphMkV4RWpBUUJnTlZCQW9NQ1VKeWFXeHNhV0Z1ZERFYk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwCklFTkJNU1V3SXdZRFZRUUREQnhDY21sc2JHbGhiblFnVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUI0WERUSTIKTURjeU16RTFNREV4T1ZvWERUTTJNRGN5TURFMU1ERXhPVm93Z1lVeEN6QUpCZ05WQkFZVEFrSkVNUTR3REFZRApWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaGEyRXhFakFRQmdOVkJBb01DVUp5YVd4c2FXRnVkREViCk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwSUVOQk1TVXdJd1lEVlFRRERCeENjbWxzYkdsaGJuUWcKVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUlJQ0lqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FnOEFNSUlDQ2dLQwpBZ0VBdXlEYmRaMUFycWd6K1l3SkNUcWlxREtuUzNDRGhHekNxK0h5WDN3clBnV0JvZFBraHJCV3dkNzQ4ZjdqClhZWDNQditQS0F0ZzVGYjdxa2ZZUFZJR0FPZUNiUWxkRlJnZld0S2F2MkdxcHZseUlKcy9OZW5PZzFZQ3IydVUKbDE3UnFPNk1BSGt6d1pNTVFDV1JXMlFiUy9weVY0VHd6dkNxSTR1ZVpzOFJ4MndwbERJdWFPVXdJMEVTMG8zdQpWdDJHMVlCTWlFOUNVTDliQWlYbWQ0UTR4a1NFRFRvOVY1SVk3Z2dHYjFTU0xWU2x6RDJHZElaMGN3VlE2LzcwCnUrQ1FPa005ZXhIRVR2eGpGTmZ4azI2YlRZVUJmNnBNS2VpSDdMbC9ucjZFVVVzTW5DSUR5VGtnK3Zta1M5ZWoKUmY1R0QwQ00rcnl1V1BiRHlHOCtzcDh4d1N1ZkcydDdkUGZRSTUzd1Zzc1BKSkk5b0lsZ0lJWXkyMkFUMlo4RwpKL2dZbmYwMU5LREhSV1dBU2FQaTBLT2dURldqRG5xam94Q0FHZjVGVFRJSHdBQjVsMS8rMXZFbEkyNjQ2M2d4CnBWcTk4Vyt4U3FQQ0xaTW9sWlE5TVkwbjVHeGgvZjhkK0RPb1BVT0lXazJqWXdvS1JGQXJiTlNTNnkySnVrS3YKSWNvMnN4YUhqZkhrdDdqdDBkckRLcjUrelI5bndUWDhVN3hBaWlTYkVTekN6OWlvdU9QSEcxMFFtdzl6VVRNMgoxdzJmMmlQRWpvbFpBVjFBaFU3dzFWNHBzc3JpWDIvNTlDR1dYT1VEcWNnd2MwdWh4djRnWFRndXBCeGcrYU5yCllybWZwNndtejdzN3lmblh3T2xVaVRDRW1Bc2NBemNkMmdCaGwvN1dpcmFRZFVzQ0F3RUFBYU5UTUZFd0hRWUQKVlIwT0JCWUVGSGJhbmo2RkdNVWZ3bEMwSytqY081TTlHd0FwTUI4R0ExVWRJd1FZTUJhQUZIYmFuajZGR01VZgp3bEMwSytqY081TTlHd0FwTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3RFFZSktvWklodmNOQVFFTEJRQURnZ0lCCkFBZVVVVUFMTk5FNDM2UEwvZXl6V0c3bmlPdndXODF3UkdVdGdEUnJpY2xFWjh0K3MzUG9MOXRibyszUGN1ekgKakxsUFArYmVLY2tUTEZKVGZZWUN3Z0dWZkdIRXE1ejV1SUt3ZWIyMG9GSEg3ek9DSzF3VVJBSUlPZnFycncyMApjcWNzdTRnK3NENnl0bllWN2Y1T0RFT2RNaXpjVXRrbGpMSjVieXJLSU9OV2FrSTBpd0xLeXFPQWlGeUVSY2xiCjB0ZzhoTDR6dkRLVUZ6dVJycXhxS0padzNWUWUvM1JWUFYwZ0RLUW96VEQ0M3lnQUdGVlVjckx1dHZOK2V5bEEKVDdYMGtNZXJlVVRKd1N6RDVvenhGRXFkaDlLNHZkZTA2a3BuSXpQS2tEanNFZiszeW9WeFVxRGJCeGV3ai9aOApodzhmT3lBWC9jV2UvZlhmWVdPV3RpTlhiQVJRd0pvUWlLb3lacHRuNGpvRXhLWVB2Qzg0RitINEZnZnpidXFkCnNnL2R2SjBxcldGaUlZeWZBRS9NNGM3VTBDUnVsZ1lETXJhbktIUHhxTllVT21pRzM4T0xLTDlFMmlvV002UHYKek82djVvUk5pazFFN3BrRUVMSUFPczR3U2MvdG45MU01TmtpSjgyRXNEQ2ZaVG5FVU9Cd3VsRzZSbW8vYWF0agpCWUJEaHo0dnhmN0ZjNG13WEdXNVZXc1Qzd2ZVckErZ3l3VWo5dlFqTTV6SjEybDl4NU9Dd3pNMTJuQWdSZ1dFCkh4ZDh5TFhkNE9rTWRaRWNVckY5eWtSMGJUZ3AyWnowL3lPR21KbVpieHRNdHlGaTVMcmt6VElodWJNS1l2bncKcWsrbWdaUmNMcXBWclRSYTNiaGdEVzJrSWpFT2I5SHB6NG5MZ3loUVpCMFAKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= +kind: Secret +metadata: + name: opensearch-admin-cert + namespace: observability \ No newline at end of file diff --git a/helm-charts-observability/charts/opensearch/opensearch-node-0-cert.yaml b/helm-charts-observability/charts/opensearch/opensearch-node-0-cert.yaml new file mode 100644 index 0000000..cffc321 --- /dev/null +++ b/helm-charts-observability/charts/opensearch/opensearch-node-0-cert.yaml @@ -0,0 +1,9 @@ +apiVersion: v1 +data: + node-0-key.pem: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2Z0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktnd2dnU2tBZ0VBQW9JQkFRQzFoS3BOR1F2akRwQTYKbDhPVWpOcEFhUVh4RzIrOWh1Ulc3Qi9Md1I4eUYwWlFFRnBwQXhMdUdUNm9WNDAyWERWK2xUaEV3KzJ6QmZjZgpFeEZPYTRFRE02a0M0Z2Q2S0FBOEtWK0swc2xaanFuMDh0Unl3ZmRNa3ZFU01CYThRRGpITExsckFOSEUrTnZQCm5YeHVhakh0bEpNRDdMYUhHV2Q4QkpRcXdqTHY2cEt0aitaMmI5M25XY1JLRzBrNVg2YWdIWHB1emZXZWcwYjgKRUxDbEVoUWppdmNBTUQvTzJCM2JYSnBhUmIyYzUrWExZZDBhMHVUbjEveUR2WEQyZ3Evb1kzbEpVY3N5RTNKMgpjemxab1IvT1diTFZZcWhueHprcjRobXdFOE5Ra3VpbkhUZ0h1QUxDNTNvbUxLVThiRVhoRmVXbms0WnFRaEV4CkszTVl2OFhOQWdNQkFBRUNnZ0VBQmJOelR5cVY0ZjFuY0QrclVvaTkrTDgrV0RLVUVZVjJ1YzErdU5LSm5VbDMKMllua25RbTRyWHU0MDd3Smk3SGRDRUJvTWxpenFDZHNKSVlLZEJ1ODdlY2x6QmtNbDd5V2pVMHJXckVyY1JiMgordUlwanFwNE9aSjFPZGRZSk1vZzZRM2NOazBoOUNnYmJKWTEvZTNJbGFmN1JMMzBMdmdRU2xLR2ZoLzMrT3I5Ck1JQmVpMUxEQ1RFNUdRUVFwV0dZWEpOTmcyU0F6R3NXdlpYTmdmS0Z5MGVlT0VDMUt3TE5xaWNMMnRRUit6ZGwKL1Qxc3hWenUzQ05aSUlVQW1nVXg5c1dqcGJtU3UzMy81azFQS3U3SXVKcDRtek00Qkw1OFZWakU1N2pTN05nQgpRTjRiLzZOb0ZleFFGdXdkQStlZVd5TU9NM0FmdkpQR3NUNlNBaXBNWVFLQmdRRHV1WFd5eVFwSkorbWh2T0l6CmxGZm9GVFd6VTVuQnpjKytJSjlkRE0rTEdOaVJVaXlUZkdIdDdRM1E5OFFtSDF0M0tland3dkN5Z2xpeFhxNkoKa3hMZXEzOFk3cks1MU1PSHQxeDNDRWdWeFY5b2N3WTBSUklDVzJ4cHRiZjZVbzlZYituZmpqSHlDZU9hODhSdwp5cW9qYi9WNk1MUlVFSVY3UkRtMmczc2JsUUtCZ1FEQ3AydGV0UHltSDh0alp5VVBxU1ZnZnV5b29hWUZXZVh0CldXZm5kcGU0bmp2NVUzQlNoTXRzTnk4OGtieFJ1U2llVDNXYThubFN1WGJZUGJXVzRBcTBXSmYxbzNub0VKRDAKM2JNejRaV2NOUnNqNlQ1K2dTc1JjTU5ZOEdhbVFEQlRTZm9tb2ZvdVBhdkY2NGZ0ZDRablFCS2RKdWJDL2MyWApWU0svMllLeldRS0JnUUNWUVZFc1VmUGpYMWY4Ym9zQzhybXZlaXRVRG0zd3RRd3c5RmFQSitaUE1sNmRKVUtICmg5bjJseUx2UnluVkovL1kxbFEweTcwUDd0MGpNRzV4eDRtaHZKbS9iZVpDdDVyMHJKamNOMHBTaWsrbmoxc08KclN5Z1dxYkN4UUhkT1djMFJPeDFnSU1Mc0ZFazNVb3h0eFIvQ1kzeU1xZGNjK1B3K093WWg4WWRyUUtCZ1FDLwphRm5RV3pCRk91YUk3SmdvK2k3aTRHeGV0ZlhITlVzL1JiZENoLzlSYjJlU0dGWlBEbjNwLzZuWGFZZEE1VTNuCnZrTHJCcHYrbUprZ3NpMnFHc3pyNG1JckRZR0dqU085WlhRZUJDbFYzWEsrc1ZEZW5LMTVET1ZLdzdwc3FKbmMKak5ZS3Z5Ui82K3pKUm4zM0tKMWxVai83Z0pGU0ZMamhvcm4wNVRIOG9RS0JnQjhMZ1BGZFMvV3R5anJPS0J1OAo0d2hCRmZFZHcxNnlZNVRHQ0xwQmNoMUdrV3hBcGd1S3QyTmlVc01lMDdSd1daQndTWUNsdXBEVUNiVFVoeEJKClNlSXFDWENobWdtU2NFdlg2TEdHSXlFOU1GUXozbG52bmd1SE5KL0pwTUZGU291TStmR2g4eXY3WEJpY0JBR0sKeit6aXZwK2REZkVLYzVVd08xc3YvVVQzCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K + node-0.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUhyVENDQlpXZ0F3SUJBZ0lVSXljc3FkNHF1b2d4ancxRTRLangzd0J0Ylc0d0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZVXhDekFKQmdOVkJBWVRBa0pFTVE0d0RBWURWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaAphMkV4RWpBUUJnTlZCQW9NQ1VKeWFXeHNhV0Z1ZERFYk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwCklFTkJNU1V3SXdZRFZRUUREQnhDY21sc2JHbGhiblFnVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUI0WERUSTIKTURjeU16RTFNVE15TjFvWERUSTRNVEF5TlRFMU1UTXlOMW93ZWpFTE1Ba0dBMVVFQmhNQ1FrUXhEakFNQmdOVgpCQWdNQlVSb1lXdGhNUTR3REFZRFZRUUhEQVZFYUdGcllURVNNQkFHQTFVRUNnd0pRbkpwYkd4cFlXNTBNUmt3CkZ3WURWUVFMREJCUGNHVnVVMlZoY21Ob0lFNXZaR1Z6TVJ3d0dnWURWUVFEREJOdmNHVnVjMlZoY21Ob0xXMWgKYzNSbGNpMHdNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXRZU3FUUmtMNHc2UQpPcGZEbEl6YVFHa0Y4UnR2dllia1Z1d2Z5OEVmTWhkR1VCQmFhUU1TN2hrK3FGZU5ObHcxZnBVNFJNUHRzd1gzCkh4TVJUbXVCQXpPcEF1SUhlaWdBUENsZml0TEpXWTZwOVBMVWNzSDNUSkx4RWpBV3ZFQTR4eXk1YXdEUnhQamIKejUxOGJtb3g3WlNUQSt5Mmh4bG5mQVNVS3NJeTcrcVNyWS9tZG0vZDUxbkVTaHRKT1YrbW9CMTZiczMxbm9ORwovQkN3cFJJVUk0cjNBREEvenRnZDIxeWFXa1c5bk9mbHkySGRHdExrNTlmOGc3MXc5b0t2NkdONVNWSExNaE55CmRuTTVXYUVmemxteTFXS29aOGM1SytJWnNCUERVSkxvcHgwNEI3Z0N3dWQ2Sml5bFBHeEY0UlhscDVPR2FrSVIKTVN0ekdML0Z6UUlEQVFBQm80SURIVENDQXhrd0RBWURWUjBUQVFIL0JBSXdBREFPQmdOVkhROEJBZjhFQkFNQwpCYUF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01CMEdBMVVkRGdRV0JCU2R2Y1IzCjU1R1hRUFNjY0xlNncyL0xpTkNIMGpBZkJnTlZIU01FR0RBV2dCUjIycDQraFJqRkg4SlF0Q3ZvM0R1VFBSc0EKS1RDQ0FwZ0dBMVVkRVFTQ0FvOHdnZ0tMZ2lWaWNtbHNiR2xoYm5RdGIzQmxibk5sWVhKamFDMWpiSFZ6ZEdWeQpMVzFoYzNSbGNpMHdnbEppY21sc2JHbGhiblF0YjNCbGJuTmxZWEpqYUMxamJIVnpkR1Z5TFcxaGMzUmxjaTB3CkxtSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxXaGxZV1JzWlhOemdtQmkKY21sc2JHbGhiblF0YjNCbGJuTmxZWEpqYUMxamJIVnpkR1Z5TFcxaGMzUmxjaTB3TG1KeWFXeHNhV0Z1ZEMxdgpjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxXaGxZV1JzWlhOekxtOWljMlZ5ZG1GaWFXeHBkSG1DClpHSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxUQXVZbkpwYkd4cFlXNTAKTFc5d1pXNXpaV0Z5WTJndFkyeDFjM1JsY2kxdFlYTjBaWEl0YUdWaFpHeGxjM011YjJKelpYSjJZV0pwYkdsMAplUzV6ZG1PQ2NtSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxUQXVZbkpwCmJHeHBZVzUwTFc5d1pXNXpaV0Z5WTJndFkyeDFjM1JsY2kxdFlYTjBaWEl0YUdWaFpHeGxjM011YjJKelpYSjIKWVdKcGJHbDBlUzV6ZG1NdVkyeDFjM1JsY2k1c2IyTmhiSUlqWW5KcGJHeHBZVzUwTFc5d1pXNXpaV0Z5WTJndApZMngxYzNSbGNpMXRZWE4wWlhLQ01XSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6CmRHVnlMbTlpYzJWeWRtRmlhV3hwZEhtQ05XSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXQKYldGemRHVnlMbTlpYzJWeWRtRmlhV3hwZEhrdWMzWmpna05pY21sc2JHbGhiblF0YjNCbGJuTmxZWEpqYUMxagpiSFZ6ZEdWeUxXMWhjM1JsY2k1dlluTmxjblpoWW1sc2FYUjVMbk4yWXk1amJIVnpkR1Z5TG14dlkyRnNNQTBHCkNTcUdTSWIzRFFFQkN3VUFBNElDQVFCTXNUNUIrQnNWemRrcDRkaktDV0p1S2tNeWJidHRZb2xWeXpabXF6N0YKbE9vUEcvM3BVMUx4akgrVUsxWVRITmZaYUZvVGpRL09YVC9ORnJmL3JIQ2ZjQnFkYmNWNVZyWTlKaUVESFd1cwpiNGR4RkU3V0JaVTU0KzI1V1g5dnVHMFZUeHNnSDA4RUMvTVdwOENHandYSmhxamlRdkk0aWhGand1VnR0MVI1Cm9MWGZYS29BMEMxNjVHUFZjVmZ0a3FWcUovZWNlOS9teGNhSmVuQXY4d0dvRjlWcGFtSk1mL3IreDEvTE9YTnQKdmk1UmNOZGZMU3loOTdNRGhNYkVCMktsZE9ZYy9hNHpKS3lySGw2aWpacFA3WTdSUFFxMU9sQzRnWVFlLzd4aQpOZC9UdlpySXk0NDhPWFc3OUVlKzNIbWcweGJ6ZFltalBwNXFsWFBzaHdGWGtreU5sQWdWdVNwRk8wb2dmak9OCnlIN3FWRE5hbUhQNVZBKytJdTQxNVYxYVQvK0VGYWI3b2VIM2ozWklyTzFZeW1CL05TT1MvUXZzZEVBcHo0ZUkKVWpsdXFWdDg3aDd3Vm5OelJaMVJGWDk4YlhtQTUrNFRUYmRyMkZNenJvMC81T20rU285aEpxN1phc05Ba0RQagpxbzFJWVlmN0FUek5EOEtMVEJVRjl4OXl1V0ZOdlk2NDhuNzJzRzI2emgzWnNnaXpXZHpNKzY3emFXQUpPclFrCmZqbWdBMk5ZcUZqTWJROU1DWHcwTGpLUk9RTFZoc2hXTlF4RDJhd3lDOUwrYk5hcUUzMlFJK3hIOG53bWpRekwKaGlsdFlhczR5WFNjMmxocURiSytWMnJVR2JLNXBjTSt6MXJkNVE3L2hUcnNUaUp1YjlubGNDdGFpL1pCRnpPKwpIdz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + root-ca.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUY3VENDQTlXZ0F3SUJBZ0lVTC9hTytnYS9YY3lzakFYbGh1WG92d0xLWkJjd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZVXhDekFKQmdOVkJBWVRBa0pFTVE0d0RBWURWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaAphMkV4RWpBUUJnTlZCQW9NQ1VKeWFXeHNhV0Z1ZERFYk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwCklFTkJNU1V3SXdZRFZRUUREQnhDY21sc2JHbGhiblFnVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUI0WERUSTIKTURjeU16RTFNREV4T1ZvWERUTTJNRGN5TURFMU1ERXhPVm93Z1lVeEN6QUpCZ05WQkFZVEFrSkVNUTR3REFZRApWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaGEyRXhFakFRQmdOVkJBb01DVUp5YVd4c2FXRnVkREViCk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwSUVOQk1TVXdJd1lEVlFRRERCeENjbWxzYkdsaGJuUWcKVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUlJQ0lqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FnOEFNSUlDQ2dLQwpBZ0VBdXlEYmRaMUFycWd6K1l3SkNUcWlxREtuUzNDRGhHekNxK0h5WDN3clBnV0JvZFBraHJCV3dkNzQ4ZjdqClhZWDNQditQS0F0ZzVGYjdxa2ZZUFZJR0FPZUNiUWxkRlJnZld0S2F2MkdxcHZseUlKcy9OZW5PZzFZQ3IydVUKbDE3UnFPNk1BSGt6d1pNTVFDV1JXMlFiUy9weVY0VHd6dkNxSTR1ZVpzOFJ4MndwbERJdWFPVXdJMEVTMG8zdQpWdDJHMVlCTWlFOUNVTDliQWlYbWQ0UTR4a1NFRFRvOVY1SVk3Z2dHYjFTU0xWU2x6RDJHZElaMGN3VlE2LzcwCnUrQ1FPa005ZXhIRVR2eGpGTmZ4azI2YlRZVUJmNnBNS2VpSDdMbC9ucjZFVVVzTW5DSUR5VGtnK3Zta1M5ZWoKUmY1R0QwQ00rcnl1V1BiRHlHOCtzcDh4d1N1ZkcydDdkUGZRSTUzd1Zzc1BKSkk5b0lsZ0lJWXkyMkFUMlo4RwpKL2dZbmYwMU5LREhSV1dBU2FQaTBLT2dURldqRG5xam94Q0FHZjVGVFRJSHdBQjVsMS8rMXZFbEkyNjQ2M2d4CnBWcTk4Vyt4U3FQQ0xaTW9sWlE5TVkwbjVHeGgvZjhkK0RPb1BVT0lXazJqWXdvS1JGQXJiTlNTNnkySnVrS3YKSWNvMnN4YUhqZkhrdDdqdDBkckRLcjUrelI5bndUWDhVN3hBaWlTYkVTekN6OWlvdU9QSEcxMFFtdzl6VVRNMgoxdzJmMmlQRWpvbFpBVjFBaFU3dzFWNHBzc3JpWDIvNTlDR1dYT1VEcWNnd2MwdWh4djRnWFRndXBCeGcrYU5yCllybWZwNndtejdzN3lmblh3T2xVaVRDRW1Bc2NBemNkMmdCaGwvN1dpcmFRZFVzQ0F3RUFBYU5UTUZFd0hRWUQKVlIwT0JCWUVGSGJhbmo2RkdNVWZ3bEMwSytqY081TTlHd0FwTUI4R0ExVWRJd1FZTUJhQUZIYmFuajZGR01VZgp3bEMwSytqY081TTlHd0FwTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3RFFZSktvWklodmNOQVFFTEJRQURnZ0lCCkFBZVVVVUFMTk5FNDM2UEwvZXl6V0c3bmlPdndXODF3UkdVdGdEUnJpY2xFWjh0K3MzUG9MOXRibyszUGN1ekgKakxsUFArYmVLY2tUTEZKVGZZWUN3Z0dWZkdIRXE1ejV1SUt3ZWIyMG9GSEg3ek9DSzF3VVJBSUlPZnFycncyMApjcWNzdTRnK3NENnl0bllWN2Y1T0RFT2RNaXpjVXRrbGpMSjVieXJLSU9OV2FrSTBpd0xLeXFPQWlGeUVSY2xiCjB0ZzhoTDR6dkRLVUZ6dVJycXhxS0padzNWUWUvM1JWUFYwZ0RLUW96VEQ0M3lnQUdGVlVjckx1dHZOK2V5bEEKVDdYMGtNZXJlVVRKd1N6RDVvenhGRXFkaDlLNHZkZTA2a3BuSXpQS2tEanNFZiszeW9WeFVxRGJCeGV3ai9aOApodzhmT3lBWC9jV2UvZlhmWVdPV3RpTlhiQVJRd0pvUWlLb3lacHRuNGpvRXhLWVB2Qzg0RitINEZnZnpidXFkCnNnL2R2SjBxcldGaUlZeWZBRS9NNGM3VTBDUnVsZ1lETXJhbktIUHhxTllVT21pRzM4T0xLTDlFMmlvV002UHYKek82djVvUk5pazFFN3BrRUVMSUFPczR3U2MvdG45MU01TmtpSjgyRXNEQ2ZaVG5FVU9Cd3VsRzZSbW8vYWF0agpCWUJEaHo0dnhmN0ZjNG13WEdXNVZXc1Qzd2ZVckErZ3l3VWo5dlFqTTV6SjEybDl4NU9Dd3pNMTJuQWdSZ1dFCkh4ZDh5TFhkNE9rTWRaRWNVckY5eWtSMGJUZ3AyWnowL3lPR21KbVpieHRNdHlGaTVMcmt6VElodWJNS1l2bncKcWsrbWdaUmNMcXBWclRSYTNiaGdEVzJrSWpFT2I5SHB6NG5MZ3loUVpCMFAKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= +kind: Secret +metadata: + name: opensearch-node-0-cert + namespace: observability \ No newline at end of file diff --git a/helm-charts-observability/charts/opensearch/opensearch-node-1-cert.yaml b/helm-charts-observability/charts/opensearch/opensearch-node-1-cert.yaml new file mode 100644 index 0000000..813a106 --- /dev/null +++ b/helm-charts-observability/charts/opensearch/opensearch-node-1-cert.yaml @@ -0,0 +1,9 @@ +apiVersion: v1 +data: + node-1-key.pem: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2d0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktrd2dnU2xBZ0VBQW9JQkFRRGtMSk41UlZ0dGxCeDcKYlBoTGxjMThWdFMwVEYreGRqQ2FXbkw2RVM4OWowZkd4SzlzUGR6ektpMndYelA5RkFOVXRPakNXMmhTNVJySQpJdlZBZ1ROZUFqSTc4NUtLSExFd0FaU2xCZjV4cXA3aTlKbXJSOFMxSnNQMHV3c1orM3B4cHVMTzBPbFVTbzBICnpkanZwMGpPRzAzTXZGTjB3OFJnN1hlL3VhZzZPYjRDeFYzZUJ3YXYyZDVwMk83ZmdvemVEeW5Qd0hQck9YLzgKcDFISWtKRTZ5aC9yWjJKUmprVnV4ZDlaM0cybHVFRXlIN2MrRzhVbzhFK3NEOVBibm1ad2o5bDV4U1Ruck10LwpSbXJLN3JyVTFYMDdTSzBDWENrSW5BUlA1MGwzbmhwaU9HTDM0MHdldnhzSzNtRzFkWG41UzRwcnc3MHR0dms5Cm1KT0pRNjBoQWdNQkFBRUNnZ0VBSWI1bDROMWM5QXVmV3JGMjF0YkVtTXJPa2d0cGEza3JIdWlaY0ZueVBveGQKOVF0SlZoeWYvR1lVYzZ6Z3AyQzZUV0NqdTNxQkp5RXlvTDVxdnF0Y3lWNVJ4NFB4Ky9MYVVWc3FmRzB5ZitUWApzb0N4NlI2bi9KSkxFSHBJM2dMT3pOZjlXdENTY1NERlVvNGlzdTV1V2V5M3lMdGhMRGQzWjA0M0UyZUZkWGFsCkJSUEZvbEZ0ekc4d3BxS3R5K09taDljVXJBSFUwODdxS3cwcmJXVUhkN1JTUERSTXluMXY3dU9kSXZQQ241N28KQ1plMHNyQjVLbzNha0F5YUFRVVhQd25UWnlVeXVJdS9KWmtha3ZOMDE1cXhicW5WODZVOUpMQ1IwMVl4R055YQo4dHpkQXpPa1d2Yyt2b21WbExqNmw0aWx6OENrZ0lmYW50L1psQ2lWTVFLQmdRRC8zUGtwVFg3WnM5NkNvOEdqClNuSitwOG9hU0xFY2xHRXE0REVDb1JXanBhb1N2Z0J0WVVzMzhaSnBvdVh6ZEtFZmd6eHlrYUlkdDRYRXBBb2oKejVBenRRMWN5OTlqMjBSa2RoaU16SkFSc1pPcDZ2Zm9GQnFMV0pFY3VmRHB1cXYrRDdFT0t3Rjc0YlNyRll0Zgp6eThRYTRVRVhqSUZZSXFEOVg1QWRVWTlTd0tCZ1FEa1M4L3Y4SmlubVh4d2J3eTM2bVNlM2JCa1NVcXlYcXVXCnE2UVkvZGNrTDdQcWdrZjVUV1BZM1Z1Mm44MEU3cGZ1MmE4NTFYQW1KZVk4RHJOVU1OalY5dmIxaGFDYlk3ZjMKMmlnTk9EYndzTDJFNGUwZkE3bTVVVy9YODVKTzI4QjFUQmExREs0Titpd1lpUVVqSHFCeW9HUUV1TVVQSlgyNgpoTW5vNVR2WHd3S0JnUURsektTbitPYytSak5KcUNRcE1ac2xzRE52YWV4UW05K3RiNC8xS1pKUzJWNm4yS2h2CmxOdkcwaHZLN3JpUzhTUXBObWhiQ2Z2TnJ0L2czZWdSZzhHaS96Q1NNTFZoYlRTKytlWlF4d1Y2THNCTjh6QlcKNjM5dnVjc1RQdGxtUXZkb2h0Vmh3VFJpL0RPVkdST0ZxSUkvd0NIRzY0Y0hsMDZ3K0JNOWQxYnZnd0tCZ1FDMwpCbVNOUzBsSFRKRHNIc3VHZ3Y3cU1uYmczN1ZuN09nSm9rK3J6WTMycjl2QXpYUGdWWUFQODk4OE9UOEhqalQyClEwVHN5OFhlZjVIbVlpNjQ5M1JQalhBT0JIUnZQM0hVM2V3d05Qb3Uyck1GM283WXg0YlZJSW5YQ3Fvb1dKc2kKTHI4aHBTbkJnT2hyUHlhRU1tQ1ZwU3FxY210aHFqL3pFZFJCeDgzRE93S0JnUUNkTHQxVm5IR1ZqZ1F6b3J0WApycWNtQnU0bUtyWmFLdGxsM3lOS0MzNkh3OGgzU3FZUm5VTlZmK2pPUE8zM3NSR3JyNFZCTEtveEM0NEljdG9oClc2WjgvRmZCWDJIMDUzNjNHUkUxNmRGOFZ5YTN3b0xRUGpTcy9pQWdYR3psNXlSUFlhTWs2VlF4QjZwcytGOHEKWVpyNnoxMHNYQXRCbEszeU1FS1hVQldtL3c9PQotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0tCg== + node-1.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUhyVENDQlpXZ0F3SUJBZ0lVSXljc3FkNHF1b2d4ancxRTRLangzd0J0YlhBd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZVXhDekFKQmdOVkJBWVRBa0pFTVE0d0RBWURWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaAphMkV4RWpBUUJnTlZCQW9NQ1VKeWFXeHNhV0Z1ZERFYk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwCklFTkJNU1V3SXdZRFZRUUREQnhDY21sc2JHbGhiblFnVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUI0WERUSTIKTURjeU16RTFNalF3TUZvWERUSTRNVEF5TlRFMU1qUXdNRm93ZWpFTE1Ba0dBMVVFQmhNQ1FrUXhEakFNQmdOVgpCQWdNQlVSb1lXdGhNUTR3REFZRFZRUUhEQVZFYUdGcllURVNNQkFHQTFVRUNnd0pRbkpwYkd4cFlXNTBNUmt3CkZ3WURWUVFMREJCUGNHVnVVMlZoY21Ob0lFNXZaR1Z6TVJ3d0dnWURWUVFEREJOdmNHVnVjMlZoY21Ob0xXMWgKYzNSbGNpMHhNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQTVDeVRlVVZiYlpRYwplMno0UzVYTmZGYlV0RXhmc1hZd21scHkraEV2UFk5SHhzU3ZiRDNjOHlvdHNGOHovUlFEVkxUb3dsdG9VdVVhCnlDTDFRSUV6WGdJeU8vT1NpaHl4TUFHVXBRWCtjYXFlNHZTWnEwZkV0U2JEOUxzTEdmdDZjYWJpenREcFZFcU4KQjgzWTc2ZEl6aHROekx4VGRNUEVZTzEzdjdtb09qbStBc1ZkM2djR3I5bmVhZGp1MzRLTTNnOHB6OEJ6NnpsLwovS2RSeUpDUk9zb2Y2MmRpVVk1RmJzWGZXZHh0cGJoQk1oKzNQaHZGS1BCUHJBL1QyNTVtY0kvWmVjVWs1NnpMCmYwWnF5dTY2MU5WOU8waXRBbHdwQ0p3RVQrZEpkNTRhWWpoaTkrTk1IcjhiQ3Q1aHRYVjUrVXVLYThPOUxiYjUKUFppVGlVT3RJUUlEQVFBQm80SURIVENDQXhrd0RBWURWUjBUQVFIL0JBSXdBREFPQmdOVkhROEJBZjhFQkFNQwpCYUF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01CMEdBMVVkRGdRV0JCUTd2UE9PClFuWWpLZjRKRlFRT0tqN3plM2ozZHpBZkJnTlZIU01FR0RBV2dCUjIycDQraFJqRkg4SlF0Q3ZvM0R1VFBSc0EKS1RDQ0FwZ0dBMVVkRVFTQ0FvOHdnZ0tMZ2lWaWNtbHNiR2xoYm5RdGIzQmxibk5sWVhKamFDMWpiSFZ6ZEdWeQpMVzFoYzNSbGNpMHhnbEppY21sc2JHbGhiblF0YjNCbGJuTmxZWEpqYUMxamJIVnpkR1Z5TFcxaGMzUmxjaTB4CkxtSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxXaGxZV1JzWlhOemdtQmkKY21sc2JHbGhiblF0YjNCbGJuTmxZWEpqYUMxamJIVnpkR1Z5TFcxaGMzUmxjaTB4TG1KeWFXeHNhV0Z1ZEMxdgpjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxXaGxZV1JzWlhOekxtOWljMlZ5ZG1GaWFXeHBkSG1DClpHSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxURXVZbkpwYkd4cFlXNTAKTFc5d1pXNXpaV0Z5WTJndFkyeDFjM1JsY2kxdFlYTjBaWEl0YUdWaFpHeGxjM011YjJKelpYSjJZV0pwYkdsMAplUzV6ZG1PQ2NtSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxURXVZbkpwCmJHeHBZVzUwTFc5d1pXNXpaV0Z5WTJndFkyeDFjM1JsY2kxdFlYTjBaWEl0YUdWaFpHeGxjM011YjJKelpYSjIKWVdKcGJHbDBlUzV6ZG1NdVkyeDFjM1JsY2k1c2IyTmhiSUlqWW5KcGJHeHBZVzUwTFc5d1pXNXpaV0Z5WTJndApZMngxYzNSbGNpMXRZWE4wWlhLQ01XSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6CmRHVnlMbTlpYzJWeWRtRmlhV3hwZEhtQ05XSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXQKYldGemRHVnlMbTlpYzJWeWRtRmlhV3hwZEhrdWMzWmpna05pY21sc2JHbGhiblF0YjNCbGJuTmxZWEpqYUMxagpiSFZ6ZEdWeUxXMWhjM1JsY2k1dlluTmxjblpoWW1sc2FYUjVMbk4yWXk1amJIVnpkR1Z5TG14dlkyRnNNQTBHCkNTcUdTSWIzRFFFQkN3VUFBNElDQVFCQWpCbDUxOURUdllMVndKZmVQcWtwckw3RlBhTlFaVmkxZ0hLTFFhekIKSVNpZnVrZjI5WktEWGczRDNNV0orVDhWQXpaZ0JFQUFRLzNHOCt1N0ZUOFRuMjJJMUtmZjRLYkdDTHBQNjl0UwpHYkhZVEwzVjYxZjlNTkdLa3lpVGh1SG1PLzhISjFWQXNLamZ6N3BQMHA5VEJIRHBuYWNGSWNRTGFBcEdiaWJ4CmhRa3Q3OXFlaDN2YVpUL0hnV1lpenNxQWs4STJ6NDdLRUVCVWR0TjFWcmJiL0RBNW93ejh3M2NPNEcxbmVUS2wKQVZZS05TakNVYkV4UEN0aXZuckpzQUwvcmRJZnNMdERKQ3RBNFRFbW91UitLYzJkNWRsa1Y0S2dzeUFRMzRGWApTbzQyMVp4Qk92ZjQyN2JJN0crT0YzSXVmclk0N0xBYUpyeXBjd2ZVNitRSVdNckMrWnk2VXNtak15NTIzRTY3CldSUC9Wb0ErSmV6ck5XaFR1QkI3VDN0b3pDVlFlSmdnMkhyMkVDN0VVbnZUWWdOMjVubzJpWXFJejZ0Y1VWV0gKSEV2LzlGUFFlcUIzZ3pHczJnWXk3UUVZaXF3UUk4amxNbEFEZ0tra1hjbGlUWkhJYUpUV3Bwby9ZQVF3T1ZqUgptb2lhRUR4UHFEZnZLREZNdjlzQWVBdXRkL0xJVHlITHVOV0RXTVJlYndLR3ZoZlJjdlhJM084ek5CbTFjY0U1CnVTdmRObWZIMnh2aEhUa1dkdUplc1E4cFJIOUI5OTdoTTZ0NklxblVsN0tqNXhQYUNIWEEyZzRhemFocVRqd0wKQTRaaXZUYjhNU3A4WktLUDF4amR2KzNpdi9zQm5oVUZYV0taNGZjZTZjaW9KKzBrRENnT0p3eTJhUlNkazNNUgpzQT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + root-ca.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUY3VENDQTlXZ0F3SUJBZ0lVTC9hTytnYS9YY3lzakFYbGh1WG92d0xLWkJjd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZVXhDekFKQmdOVkJBWVRBa0pFTVE0d0RBWURWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaAphMkV4RWpBUUJnTlZCQW9NQ1VKeWFXeHNhV0Z1ZERFYk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwCklFTkJNU1V3SXdZRFZRUUREQnhDY21sc2JHbGhiblFnVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUI0WERUSTIKTURjeU16RTFNREV4T1ZvWERUTTJNRGN5TURFMU1ERXhPVm93Z1lVeEN6QUpCZ05WQkFZVEFrSkVNUTR3REFZRApWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaGEyRXhFakFRQmdOVkJBb01DVUp5YVd4c2FXRnVkREViCk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwSUVOQk1TVXdJd1lEVlFRRERCeENjbWxzYkdsaGJuUWcKVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUlJQ0lqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FnOEFNSUlDQ2dLQwpBZ0VBdXlEYmRaMUFycWd6K1l3SkNUcWlxREtuUzNDRGhHekNxK0h5WDN3clBnV0JvZFBraHJCV3dkNzQ4ZjdqClhZWDNQditQS0F0ZzVGYjdxa2ZZUFZJR0FPZUNiUWxkRlJnZld0S2F2MkdxcHZseUlKcy9OZW5PZzFZQ3IydVUKbDE3UnFPNk1BSGt6d1pNTVFDV1JXMlFiUy9weVY0VHd6dkNxSTR1ZVpzOFJ4MndwbERJdWFPVXdJMEVTMG8zdQpWdDJHMVlCTWlFOUNVTDliQWlYbWQ0UTR4a1NFRFRvOVY1SVk3Z2dHYjFTU0xWU2x6RDJHZElaMGN3VlE2LzcwCnUrQ1FPa005ZXhIRVR2eGpGTmZ4azI2YlRZVUJmNnBNS2VpSDdMbC9ucjZFVVVzTW5DSUR5VGtnK3Zta1M5ZWoKUmY1R0QwQ00rcnl1V1BiRHlHOCtzcDh4d1N1ZkcydDdkUGZRSTUzd1Zzc1BKSkk5b0lsZ0lJWXkyMkFUMlo4RwpKL2dZbmYwMU5LREhSV1dBU2FQaTBLT2dURldqRG5xam94Q0FHZjVGVFRJSHdBQjVsMS8rMXZFbEkyNjQ2M2d4CnBWcTk4Vyt4U3FQQ0xaTW9sWlE5TVkwbjVHeGgvZjhkK0RPb1BVT0lXazJqWXdvS1JGQXJiTlNTNnkySnVrS3YKSWNvMnN4YUhqZkhrdDdqdDBkckRLcjUrelI5bndUWDhVN3hBaWlTYkVTekN6OWlvdU9QSEcxMFFtdzl6VVRNMgoxdzJmMmlQRWpvbFpBVjFBaFU3dzFWNHBzc3JpWDIvNTlDR1dYT1VEcWNnd2MwdWh4djRnWFRndXBCeGcrYU5yCllybWZwNndtejdzN3lmblh3T2xVaVRDRW1Bc2NBemNkMmdCaGwvN1dpcmFRZFVzQ0F3RUFBYU5UTUZFd0hRWUQKVlIwT0JCWUVGSGJhbmo2RkdNVWZ3bEMwSytqY081TTlHd0FwTUI4R0ExVWRJd1FZTUJhQUZIYmFuajZGR01VZgp3bEMwSytqY081TTlHd0FwTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3RFFZSktvWklodmNOQVFFTEJRQURnZ0lCCkFBZVVVVUFMTk5FNDM2UEwvZXl6V0c3bmlPdndXODF3UkdVdGdEUnJpY2xFWjh0K3MzUG9MOXRibyszUGN1ekgKakxsUFArYmVLY2tUTEZKVGZZWUN3Z0dWZkdIRXE1ejV1SUt3ZWIyMG9GSEg3ek9DSzF3VVJBSUlPZnFycncyMApjcWNzdTRnK3NENnl0bllWN2Y1T0RFT2RNaXpjVXRrbGpMSjVieXJLSU9OV2FrSTBpd0xLeXFPQWlGeUVSY2xiCjB0ZzhoTDR6dkRLVUZ6dVJycXhxS0padzNWUWUvM1JWUFYwZ0RLUW96VEQ0M3lnQUdGVlVjckx1dHZOK2V5bEEKVDdYMGtNZXJlVVRKd1N6RDVvenhGRXFkaDlLNHZkZTA2a3BuSXpQS2tEanNFZiszeW9WeFVxRGJCeGV3ai9aOApodzhmT3lBWC9jV2UvZlhmWVdPV3RpTlhiQVJRd0pvUWlLb3lacHRuNGpvRXhLWVB2Qzg0RitINEZnZnpidXFkCnNnL2R2SjBxcldGaUlZeWZBRS9NNGM3VTBDUnVsZ1lETXJhbktIUHhxTllVT21pRzM4T0xLTDlFMmlvV002UHYKek82djVvUk5pazFFN3BrRUVMSUFPczR3U2MvdG45MU01TmtpSjgyRXNEQ2ZaVG5FVU9Cd3VsRzZSbW8vYWF0agpCWUJEaHo0dnhmN0ZjNG13WEdXNVZXc1Qzd2ZVckErZ3l3VWo5dlFqTTV6SjEybDl4NU9Dd3pNMTJuQWdSZ1dFCkh4ZDh5TFhkNE9rTWRaRWNVckY5eWtSMGJUZ3AyWnowL3lPR21KbVpieHRNdHlGaTVMcmt6VElodWJNS1l2bncKcWsrbWdaUmNMcXBWclRSYTNiaGdEVzJrSWpFT2I5SHB6NG5MZ3loUVpCMFAKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= +kind: Secret +metadata: + name: opensearch-node-1-cert + namespace: observability \ No newline at end of file diff --git a/helm-charts-observability/charts/opensearch/opensearch-node-2-cert.yaml b/helm-charts-observability/charts/opensearch/opensearch-node-2-cert.yaml new file mode 100644 index 0000000..6a970df --- /dev/null +++ b/helm-charts-observability/charts/opensearch/opensearch-node-2-cert.yaml @@ -0,0 +1,9 @@ +apiVersion: v1 +data: + node-2-key.pem: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2Z0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktnd2dnU2tBZ0VBQW9JQkFRRERTSjkxNWpYYUZjakEKUEVxMjFGcTgxcHZiNmdVUTZVRUppTUNxQXFTeU9WK3pvWWoyUUVJcDgxWEduWHpTOUFyc0d5VlpEU2xScGIzMgpqUklJS01lRU90N212VHJtMnBIUU1SOW04aTQwMXJqR0djVmI1RWtiK1VTQjNUdXJmdVFpSWpFTFNNTDZVbm02CnJ4dG5IOGZGcFR0TGdMNU9oRWdXeXQyRnhoL0hjeW9oTEhJTFZsUUlLZURrMnI4TWxGOGlwMXhuWUdrQmJja2cKU1AvOWY2K0ZhdnZaTGtnY21YNXFMeDRCTm9WWkZKYWUybi92SGpYSVFPS3NqVHdYSS9IM25RR3dsSHpwaC8vbAphL3NyYkVqb2tlREVsNk1VeE1uNHZPQWkvWERTc1E2MTJvNDE0WmlYcGlZOFczbE5DcER2MmdvSUxwQ3dLVnhuCjluWnYzR1cvQWdNQkFBRUNnZ0VBVFdESlRuNFplSUNKT3lLb3VDa01peWErT3pWUExKUkFJUGIrNEY2THc5TFkKQ09WSXo4cEdiVGp1RS9Uek1PTmlNSXZSRUtnV1p6TzFRYXhFS05kL3R2VmN2VERkMWZ0bEs0bExXQTgrSDlHMQpCVW5RMmNocTc1cWxlbytleFNWU1gvUU1XdHhKNWNZb1ZjQnNxei84ZUdRd1NvcUkzYk9zbk50bFMweGw2ekVVCjJRVitYU1pxWGlZdUswWjVUcHVnZjVLejc3ZURBcmJqbjNUU2tBVnVDbTFlNTAycHM1NXFpMzVodXd4dEFYUUIKU1REVU92ZzNsK3doUnVaREpsNGQ5L2lNWm9wcnJpY2dOYlJsV0RqVFhvMkZZb2ViLzNYVWpZSGtoUWxSSTdJMgpyQjQvZW1PUUhGR2NVaWl0TFJWbE1sakRqZWwzRjJUelJseFNDaS9EQVFLQmdRRDFncy8wRVlmd3JkNWxGV3VUClkrYThySGFESUw5UGNrQUdTVSt0dzJxWEszZ2JaZjAxTzh3eTZzN29pV2tZYmVWdUZOaVhzN0lLbm1aM1ZIZm8KQmNTVG9ySzBWZUZLdUhodmhwWVd6WnBROTc2bXM5ZU4wS1JLTndWWWdWSjlRNTRhTGxPSTVLeFdwU3ZIeTVBWgpGc3NEZW1uaHIyQ1ZSWFAzWEtzWm1uZ3o5d0tCZ1FETG9IZTAvNWhlazJOK3l2alRiN0FxeWpzUkZ1R1Y2TlM4CnlJbDRDUExpNGFUZGFDOHJ5WWtEeWcyVmw0WmR6Qm5XWTFlVTFUOHdobWZRbEJyb1hxWWx6YXlWNjViSVJML3MKMVQ5T1pXak42VDdDK2hFRHNDZmZkNjFCMkd3YzZnMTlkUzZUZ2NKN2hVOWhabjRYNmVGZEhjSkhNbGpsS3dZTQpjZE1XYTdGYWVRS0JnUURzdVBmNE50c2pseElqMTFhRnBFTDcwekxtVnJJQVVZSW9UWkhWVXVJNDVvSUZzUDVICjBPT2dpTVYrYzlmdzVTM2VTWjFhRUxyd0FERitoK1NoeE1YNU1Gd3RBODJhTldweTVvdGJhMTJMQ29ZNnlKZGoKdHpSaUZ0RkJ1RmdvVGdWbzZ4aENtM01NakhBOVVpc2I5ZDFEK2ttVGdYMllFSUt6bFJlcE5VY0htd0tCZ1FESgpEcXJrRnJPV1BxV3hIaXpPYUt0anRNYlp1dVFISnh4WFF4TXBhSHlhdFA0YWQ3S0w0N1RiL3ZlbXl6U3JETW8rCk8xelE0alpBYlpXNEIyVUNKK0taMVJraDlycXRCK1VScmdXU0hPTjgzVjlSR2FVUEpUSlpua3QraG5sSm0zaXkKZGJBRmljeEVObjhJeHpDZDRCcmIzSFJsNURxT0hRc2Q0bzN3eDJrWTBRS0JnRDQzaHloaFRLSkRib2F0blFqbApSb3ozMEZTdzc1T0xxQUFHelFQS1pLdTRBVFFiWWRESzV4N0Vvd2Q4MkJ2YTM3QmVuNTVjVzFObVJUb2NJV0ViCjBKVzYydi9TUzRDVnRvSUZHY0s4VkpVaTRRQkc1OU9vZTdEVEdqSE5GRmE0WUMvN1htQ3VxSG5MVlpYVnZiWisKTHZlUjdBd1N6S0xwckVOczBBSXVabWJpCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K + node-2.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUhyVENDQlpXZ0F3SUJBZ0lVSXljc3FkNHF1b2d4ancxRTRLangzd0J0YlhFd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZVXhDekFKQmdOVkJBWVRBa0pFTVE0d0RBWURWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaAphMkV4RWpBUUJnTlZCQW9NQ1VKeWFXeHNhV0Z1ZERFYk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwCklFTkJNU1V3SXdZRFZRUUREQnhDY21sc2JHbGhiblFnVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUI0WERUSTIKTURjeU16RTFNalF5T0ZvWERUSTRNVEF5TlRFMU1qUXlPRm93ZWpFTE1Ba0dBMVVFQmhNQ1FrUXhEakFNQmdOVgpCQWdNQlVSb1lXdGhNUTR3REFZRFZRUUhEQVZFYUdGcllURVNNQkFHQTFVRUNnd0pRbkpwYkd4cFlXNTBNUmt3CkZ3WURWUVFMREJCUGNHVnVVMlZoY21Ob0lFNXZaR1Z6TVJ3d0dnWURWUVFEREJOdmNHVnVjMlZoY21Ob0xXMWgKYzNSbGNpMHlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXcwaWZkZVkxMmhYSQp3RHhLdHRSYXZOYWIyK29GRU9sQkNZakFxZ0trc2psZnM2R0k5a0JDS2ZOVnhwMTgwdlFLN0JzbFdRMHBVYVc5CjlvMFNDQ2pIaERyZTVyMDY1dHFSMERFZlp2SXVOTmE0eGhuRlcrUkpHL2xFZ2QwN3EzN2tJaUl4QzBqQytsSjUKdXE4Ylp4L0h4YVU3UzRDK1RvUklGc3JkaGNZZngzTXFJU3h5QzFaVUNDbmc1TnEvREpSZklxZGNaMkJwQVczSgpJRWovL1grdmhXcjcyUzVJSEpsK2FpOGVBVGFGV1JTV250cC83eDQxeUVEaXJJMDhGeVB4OTUwQnNKUjg2WWYvCjVXdjdLMnhJNkpIZ3hKZWpGTVRKK0x6Z0l2MXcwckVPdGRxT05lR1lsNlltUEZ0NVRRcVE3OW9LQ0M2UXNDbGMKWi9aMmI5eGx2d0lEQVFBQm80SURIVENDQXhrd0RBWURWUjBUQVFIL0JBSXdBREFPQmdOVkhROEJBZjhFQkFNQwpCYUF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01CMEdBMVVkRGdRV0JCUXRNaXo3ClU5SDV2a0dzZjZ1NDlHWlVKQ3VsZmpBZkJnTlZIU01FR0RBV2dCUjIycDQraFJqRkg4SlF0Q3ZvM0R1VFBSc0EKS1RDQ0FwZ0dBMVVkRVFTQ0FvOHdnZ0tMZ2lWaWNtbHNiR2xoYm5RdGIzQmxibk5sWVhKamFDMWpiSFZ6ZEdWeQpMVzFoYzNSbGNpMHlnbEppY21sc2JHbGhiblF0YjNCbGJuTmxZWEpqYUMxamJIVnpkR1Z5TFcxaGMzUmxjaTB5CkxtSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxXaGxZV1JzWlhOemdtQmkKY21sc2JHbGhiblF0YjNCbGJuTmxZWEpqYUMxamJIVnpkR1Z5TFcxaGMzUmxjaTB5TG1KeWFXeHNhV0Z1ZEMxdgpjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxXaGxZV1JzWlhOekxtOWljMlZ5ZG1GaWFXeHBkSG1DClpHSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxUSXVZbkpwYkd4cFlXNTAKTFc5d1pXNXpaV0Z5WTJndFkyeDFjM1JsY2kxdFlYTjBaWEl0YUdWaFpHeGxjM011YjJKelpYSjJZV0pwYkdsMAplUzV6ZG1PQ2NtSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxUSXVZbkpwCmJHeHBZVzUwTFc5d1pXNXpaV0Z5WTJndFkyeDFjM1JsY2kxdFlYTjBaWEl0YUdWaFpHeGxjM011YjJKelpYSjIKWVdKcGJHbDBlUzV6ZG1NdVkyeDFjM1JsY2k1c2IyTmhiSUlqWW5KcGJHeHBZVzUwTFc5d1pXNXpaV0Z5WTJndApZMngxYzNSbGNpMXRZWE4wWlhLQ01XSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6CmRHVnlMbTlpYzJWeWRtRmlhV3hwZEhtQ05XSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXQKYldGemRHVnlMbTlpYzJWeWRtRmlhV3hwZEhrdWMzWmpna05pY21sc2JHbGhiblF0YjNCbGJuTmxZWEpqYUMxagpiSFZ6ZEdWeUxXMWhjM1JsY2k1dlluTmxjblpoWW1sc2FYUjVMbk4yWXk1amJIVnpkR1Z5TG14dlkyRnNNQTBHCkNTcUdTSWIzRFFFQkN3VUFBNElDQVFDcjZORXlETFlTZmVJYTdEK3oyelZVNWVvcHJwUi9PNkNPNWtvWlhCUlEKcFJFNTM3b2NLWU5TRGsxYVR3ZW1CWmE3bGxhSk82WDF3SEhPTTQxbzJ0em8zUTF2eDFMVm52OFBKSFJRNFdxVQptcE9jUjBXWk5rd0VqUWdqUjB4bmp1bGZWWXFEMm1WSmFsNlIweGlKTGNwdHlhSWV4QStJa3FZRm1JUFNncERHClRsaGtrL2pHeUI0U0p1YlVFYTFsTGxEcFFCZ0FHbk5TZFRCb2pSRkcxYS9JQWpwcmhyQXBsT1dJM1B0TXpXVlcKaE1ickEvelR6VFVUOEoxWnRMNXpBaklVRUdBTmNqZlZqenpQN2t4aWhZblc4b1hGNW1zYlo1R0pvWDNCTGQ5Mgp6Rm9pNGZyZ0l1eTdDWlAvSFJwU01hV0V6NHQ5cmtoR3BVcnhuOTBWM254Ky96QjYzRWhabU42bFFnalBaSkx6CkVNeTcyZzhSdURWdTZ0cWcrODc5STZKRlZPY1BqcVhuK2JoQ1NJM0ZkUUw3WXNtblR5Rlo0T2kwbHUxZkRqNi8KWXpyTmo5R1NKb3h1aGJqTy9Ta2J5cDRaS2gxUStoWDBLK0t0OVR0MEEzN1RsNDQzSjhSUytrNFgwSjRMNzgyeQo2NTllK1R3ZFNkK1JvVnlLUlMwYVVVL2tXemVWR0VxM0hMRk53UWdxQmlvem9oaS8zRU5Qa3ZOK2djRy9QNjkvCktCR0hXNDhCRnlVY1JBN3Z4MHQ5WjgyMVl5NVBPZFFUSTNCNnhialdZWTNiWjVaWUZndmp1SThTLytzWW9VVU8KN0wxby8rT0pjOFZtYzBjZ0E3QU01WmxDenFyMG1mWUtzRFV5U1FPcUZsWXN0b0VtczhrWll6Mk1JNVFkeDk1dQpjZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + root-ca.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUY3VENDQTlXZ0F3SUJBZ0lVTC9hTytnYS9YY3lzakFYbGh1WG92d0xLWkJjd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZVXhDekFKQmdOVkJBWVRBa0pFTVE0d0RBWURWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaAphMkV4RWpBUUJnTlZCQW9NQ1VKeWFXeHNhV0Z1ZERFYk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwCklFTkJNU1V3SXdZRFZRUUREQnhDY21sc2JHbGhiblFnVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUI0WERUSTIKTURjeU16RTFNREV4T1ZvWERUTTJNRGN5TURFMU1ERXhPVm93Z1lVeEN6QUpCZ05WQkFZVEFrSkVNUTR3REFZRApWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaGEyRXhFakFRQmdOVkJBb01DVUp5YVd4c2FXRnVkREViCk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwSUVOQk1TVXdJd1lEVlFRRERCeENjbWxzYkdsaGJuUWcKVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUlJQ0lqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FnOEFNSUlDQ2dLQwpBZ0VBdXlEYmRaMUFycWd6K1l3SkNUcWlxREtuUzNDRGhHekNxK0h5WDN3clBnV0JvZFBraHJCV3dkNzQ4ZjdqClhZWDNQditQS0F0ZzVGYjdxa2ZZUFZJR0FPZUNiUWxkRlJnZld0S2F2MkdxcHZseUlKcy9OZW5PZzFZQ3IydVUKbDE3UnFPNk1BSGt6d1pNTVFDV1JXMlFiUy9weVY0VHd6dkNxSTR1ZVpzOFJ4MndwbERJdWFPVXdJMEVTMG8zdQpWdDJHMVlCTWlFOUNVTDliQWlYbWQ0UTR4a1NFRFRvOVY1SVk3Z2dHYjFTU0xWU2x6RDJHZElaMGN3VlE2LzcwCnUrQ1FPa005ZXhIRVR2eGpGTmZ4azI2YlRZVUJmNnBNS2VpSDdMbC9ucjZFVVVzTW5DSUR5VGtnK3Zta1M5ZWoKUmY1R0QwQ00rcnl1V1BiRHlHOCtzcDh4d1N1ZkcydDdkUGZRSTUzd1Zzc1BKSkk5b0lsZ0lJWXkyMkFUMlo4RwpKL2dZbmYwMU5LREhSV1dBU2FQaTBLT2dURldqRG5xam94Q0FHZjVGVFRJSHdBQjVsMS8rMXZFbEkyNjQ2M2d4CnBWcTk4Vyt4U3FQQ0xaTW9sWlE5TVkwbjVHeGgvZjhkK0RPb1BVT0lXazJqWXdvS1JGQXJiTlNTNnkySnVrS3YKSWNvMnN4YUhqZkhrdDdqdDBkckRLcjUrelI5bndUWDhVN3hBaWlTYkVTekN6OWlvdU9QSEcxMFFtdzl6VVRNMgoxdzJmMmlQRWpvbFpBVjFBaFU3dzFWNHBzc3JpWDIvNTlDR1dYT1VEcWNnd2MwdWh4djRnWFRndXBCeGcrYU5yCllybWZwNndtejdzN3lmblh3T2xVaVRDRW1Bc2NBemNkMmdCaGwvN1dpcmFRZFVzQ0F3RUFBYU5UTUZFd0hRWUQKVlIwT0JCWUVGSGJhbmo2RkdNVWZ3bEMwSytqY081TTlHd0FwTUI4R0ExVWRJd1FZTUJhQUZIYmFuajZGR01VZgp3bEMwSytqY081TTlHd0FwTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3RFFZSktvWklodmNOQVFFTEJRQURnZ0lCCkFBZVVVVUFMTk5FNDM2UEwvZXl6V0c3bmlPdndXODF3UkdVdGdEUnJpY2xFWjh0K3MzUG9MOXRibyszUGN1ekgKakxsUFArYmVLY2tUTEZKVGZZWUN3Z0dWZkdIRXE1ejV1SUt3ZWIyMG9GSEg3ek9DSzF3VVJBSUlPZnFycncyMApjcWNzdTRnK3NENnl0bllWN2Y1T0RFT2RNaXpjVXRrbGpMSjVieXJLSU9OV2FrSTBpd0xLeXFPQWlGeUVSY2xiCjB0ZzhoTDR6dkRLVUZ6dVJycXhxS0padzNWUWUvM1JWUFYwZ0RLUW96VEQ0M3lnQUdGVlVjckx1dHZOK2V5bEEKVDdYMGtNZXJlVVRKd1N6RDVvenhGRXFkaDlLNHZkZTA2a3BuSXpQS2tEanNFZiszeW9WeFVxRGJCeGV3ai9aOApodzhmT3lBWC9jV2UvZlhmWVdPV3RpTlhiQVJRd0pvUWlLb3lacHRuNGpvRXhLWVB2Qzg0RitINEZnZnpidXFkCnNnL2R2SjBxcldGaUlZeWZBRS9NNGM3VTBDUnVsZ1lETXJhbktIUHhxTllVT21pRzM4T0xLTDlFMmlvV002UHYKek82djVvUk5pazFFN3BrRUVMSUFPczR3U2MvdG45MU01TmtpSjgyRXNEQ2ZaVG5FVU9Cd3VsRzZSbW8vYWF0agpCWUJEaHo0dnhmN0ZjNG13WEdXNVZXc1Qzd2ZVckErZ3l3VWo5dlFqTTV6SjEybDl4NU9Dd3pNMTJuQWdSZ1dFCkh4ZDh5TFhkNE9rTWRaRWNVckY5eWtSMGJUZ3AyWnowL3lPR21KbVpieHRNdHlGaTVMcmt6VElodWJNS1l2bncKcWsrbWdaUmNMcXBWclRSYTNiaGdEVzJrSWpFT2I5SHB6NG5MZ3loUVpCMFAKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= +kind: Secret +metadata: + name: opensearch-node-2-cert + namespace: observability \ No newline at end of file diff --git a/helm-charts-observability/charts/opensearch/opensearch-secret.yaml b/helm-charts-observability/charts/opensearch/opensearch-secret.yaml new file mode 100644 index 0000000..8807093 --- /dev/null +++ b/helm-charts-observability/charts/opensearch/opensearch-secret.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +data: + OPENSEARCH_INITIAL_ADMIN_PASSWORD: RW5wMTI5czBmMA== +kind: Secret +metadata: + name: opensearch-secret + namespace: observability \ No newline at end of file diff --git a/helm-charts-observability/charts/opensearch/opensearch-template.yaml b/helm-charts-observability/charts/opensearch/opensearch-template.yaml new file mode 100644 index 0000000..24a946c --- /dev/null +++ b/helm-charts-observability/charts/opensearch/opensearch-template.yaml @@ -0,0 +1,454 @@ +--- +# Source: opensearch/templates/poddisruptionbudget.yaml +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: "brilliant-opensearch-cluster-master-pdb" + labels: + helm.sh/chart: opensearch-3.7.0 + app.kubernetes.io/name: opensearch + app.kubernetes.io/instance: brilliant-opensearch + app.kubernetes.io/version: "3.7.0" + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: brilliant-opensearch-cluster-master +spec: + maxUnavailable: 1 + selector: + matchLabels: + app.kubernetes.io/name: opensearch + app.kubernetes.io/instance: brilliant-opensearch +--- +# Source: opensearch/templates/configmap.yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: brilliant-opensearch-cluster-master-config + labels: + helm.sh/chart: opensearch-3.7.0 + app.kubernetes.io/name: opensearch + app.kubernetes.io/instance: brilliant-opensearch + app.kubernetes.io/version: "3.7.0" + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: brilliant-opensearch-cluster-master +data: + opensearch.yml: | + cluster.name: brilliant-opensearch-cluster + + # Bind to all interfaces because we don't know what IP address Docker will assign to us. + network.host: 0.0.0.0 + + # Setting network.host to a non-loopback address enables the annoying bootstrap checks. "Single-node" mode disables them again. + # Implicitly done if ".singleNode" is set to "true". + # discovery.type: single-node + + # Start OpenSearch Security Demo Configuration + # WARNING: revise all the lines below before you go into production + plugins: + security: + nodes_dn: + - "CN=opensearch-master-0,OU=OpenSearch Nodes,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD" + - "CN=opensearch-master-1,OU=OpenSearch Nodes,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD" + - "CN=opensearch-master-2,OU=OpenSearch Nodes,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD" + ssl: + transport: + pemcert_filepath: certs/node.pem + pemkey_filepath: certs/node-key.pem + pemtrustedcas_filepath: certs/root-ca.pem + enforce_hostname_verification: true + resolve_hostname: true + http: + enabled: true + pemcert_filepath: certs/node.pem + pemkey_filepath: certs/node-key.pem + pemtrustedcas_filepath: certs/root-ca.pem + allow_unsafe_democertificates: false + allow_default_init_securityindex: true + authcz: + admin_dn: + - CN=opensearch-admin,OU=OpenSearch Administrators,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD + audit.type: internal_opensearch + enable_snapshot_restore_privilege: true + check_snapshot_restore_write_privileges: true + restapi: + roles_enabled: ["all_access", "security_rest_api_access"] + system_indices: + enabled: true + indices: + [ + ".opendistro-alerting-config", + ".opendistro-alerting-alert*", + ".opendistro-anomaly-results*", + ".opendistro-anomaly-detector*", + ".opendistro-anomaly-checkpoints", + ".opendistro-anomaly-detection-state", + ".opendistro-reports-*", + ".opendistro-notifications-*", + ".opendistro-notebooks", + ".opendistro-asynchronous-search-response*", + ] + ######## End OpenSearch Security Demo Configuration ######## +--- +# Source: opensearch/templates/service.yaml +kind: Service +apiVersion: v1 +metadata: + name: brilliant-opensearch-cluster-master + labels: + helm.sh/chart: opensearch-3.7.0 + app.kubernetes.io/name: opensearch + app.kubernetes.io/instance: brilliant-opensearch + app.kubernetes.io/version: "3.7.0" + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: brilliant-opensearch-cluster-master + annotations: + {} +spec: + type: ClusterIP + selector: + app.kubernetes.io/name: opensearch + app.kubernetes.io/instance: brilliant-opensearch + ports: + - name: http + protocol: TCP + port: 9200 + - name: transport + protocol: TCP + port: 9300 + - name: metrics + protocol: TCP + port: 9600 +--- +# Source: opensearch/templates/service.yaml +kind: Service +apiVersion: v1 +metadata: + name: brilliant-opensearch-cluster-master-headless + labels: + helm.sh/chart: opensearch-3.7.0 + app.kubernetes.io/name: opensearch + app.kubernetes.io/instance: brilliant-opensearch + app.kubernetes.io/version: "3.7.0" + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: brilliant-opensearch-cluster-master + annotations: + service.alpha.kubernetes.io/tolerate-unready-endpoints: "true" +spec: + clusterIP: None # This is needed for statefulset hostnames like opensearch-0 to resolve + # Create endpoints also if the related pod isn't ready + publishNotReadyAddresses: true + selector: + app.kubernetes.io/name: opensearch + app.kubernetes.io/instance: brilliant-opensearch + ports: + - name: http + port: 9200 + - name: transport + port: 9300 + - name: metrics + port: 9600 +--- +# Source: opensearch/templates/statefulset.yaml +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: brilliant-opensearch-cluster-master + labels: + helm.sh/chart: opensearch-3.7.0 + app.kubernetes.io/name: opensearch + app.kubernetes.io/instance: brilliant-opensearch + app.kubernetes.io/version: "3.7.0" + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: brilliant-opensearch-cluster-master + annotations: + majorVersion: "3" +spec: + serviceName: brilliant-opensearch-cluster-master-headless + selector: + matchLabels: + app.kubernetes.io/name: opensearch + app.kubernetes.io/instance: brilliant-opensearch + replicas: 3 + podManagementPolicy: Parallel + updateStrategy: + type: RollingUpdate + volumeClaimTemplates: + - metadata: + name: brilliant-opensearch-cluster-master + spec: + accessModes: + - "ReadWriteOnce" + resources: + requests: + storage: "120Gi" + storageClassName: "longhorn" + template: + metadata: + name: "brilliant-opensearch-cluster-master" + labels: + helm.sh/chart: opensearch-3.7.0 + app.kubernetes.io/name: opensearch + app.kubernetes.io/instance: brilliant-opensearch + app.kubernetes.io/version: "3.7.0" + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: brilliant-opensearch-cluster-master + annotations: + configchecksum: 695bb69d8226ee092a4062e8f2e3c1f5fd7f6ed596b739cdd7dd9dcb60249ff + spec: + securityContext: + fsGroup: 1000 + runAsUser: 1000 + automountServiceAccountToken: false + tolerations: + - effect: NoSchedule + key: dedicated + operator: Equal + value: storage + affinity: + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: app.kubernetes.io/instance + operator: In + values: + - brilliant-opensearch + - key: app.kubernetes.io/name + operator: In + values: + - opensearch + topologyKey: kubernetes.io/hostname + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/hostname + operator: NotIn + values: + - k8s-cp-01 + terminationGracePeriodSeconds: 120 + volumes: + - name: config + configMap: + name: brilliant-opensearch-cluster-master-config + - emptyDir: {} + name: config-emptydir + # Currently some extra blocks accept strings + # to continue with backwards compatibility this is being kept + # whilst also allowing for yaml to be specified too. + - name: node-0-source + secret: + defaultMode: 288 + secretName: opensearch-node-0-cert + - name: node-1-source + secret: + defaultMode: 288 + secretName: opensearch-node-1-cert + - name: node-2-source + secret: + defaultMode: 288 + secretName: opensearch-node-2-cert + - emptyDir: {} + name: runtime-certs + enableServiceLinks: true + initContainers: + - name: fsgroup-volume + image: "busybox:latest" + imagePullPolicy: "IfNotPresent" + command: ['sh', '-c'] + args: + - 'chown -R 1000:1000 /usr/share/opensearch/data' + securityContext: + runAsUser: 0 + resources: + {} + volumeMounts: + - name: "brilliant-opensearch-cluster-master" + mountPath: /usr/share/opensearch/data + - name: sysctl + image: "busybox:latest" + imagePullPolicy: "IfNotPresent" + command: + - sh + - -c + - | + set -xe + DESIRED="262144" + CURRENT=$(sysctl -n vm.max_map_count) + if [ "$DESIRED" -gt "$CURRENT" ]; then + sysctl -w vm.max_map_count=$DESIRED + fi + securityContext: + runAsUser: 0 + privileged: true + resources: + {} + - name: configfile + image: "opensearchproject/opensearch:3.7.0" + imagePullPolicy: "IfNotPresent" + command: + - sh + - -c + - | + #!/usr/bin/env bash + cp -r /tmp/configfolder/* /tmp/config/ + securityContext: + capabilities: + drop: + - ALL + runAsNonRoot: true + runAsUser: 1000 + resources: + {} + volumeMounts: + - mountPath: /tmp/config/ + name: config-emptydir + - name: config + mountPath: /tmp/configfolder/opensearch.yml + subPath: opensearch.yml + # Currently some extra blocks accept strings + # to continue with backwards compatibility this is being kept + # whilst also allowing for yaml to be specified too. + - command: + - /bin/sh + - -ec + - | + ordinal="${POD_NAME##*-}" + + case "${ordinal}" in + 0|1|2) + ;; + *) + echo "ERROR: unsupported pod name: ${POD_NAME}" + exit 1 + ;; + esac + + source_dir="/source/node-${ordinal}" + cert="${source_dir}/node-${ordinal}.pem" + key="${source_dir}/node-${ordinal}-key.pem" + ca="${source_dir}/root-ca.pem" + + test -r "${cert}" || { + echo "ERROR: certificate not readable: ${cert}" + exit 1 + } + + test -r "${key}" || { + echo "ERROR: private key not readable: ${key}" + exit 1 + } + + test -r "${ca}" || { + echo "ERROR: root CA not readable: ${ca}" + exit 1 + } + + cp "${cert}" /runtime/node.pem + cp "${key}" /runtime/node-key.pem + cp "${ca}" /runtime/root-ca.pem + + chmod 0644 /runtime/node.pem + chmod 0600 /runtime/node-key.pem + chmod 0644 /runtime/root-ca.pem + + echo "Selected node-${ordinal} certificate for ${POD_NAME}" + ls -l /runtime + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + image: busybox:1.36.1 + imagePullPolicy: IfNotPresent + name: select-node-certificate + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsGroup: 1000 + runAsNonRoot: true + runAsUser: 1000 + volumeMounts: + - mountPath: /source/node-0 + name: node-0-source + readOnly: true + - mountPath: /source/node-1 + name: node-1-source + readOnly: true + - mountPath: /source/node-2 + name: node-2-source + readOnly: true + - mountPath: /runtime + name: runtime-certs + containers: + - name: "opensearch" + securityContext: + capabilities: + drop: + - ALL + runAsNonRoot: true + runAsUser: 1000 + + image: "opensearchproject/opensearch:3.7.0" + imagePullPolicy: "IfNotPresent" + readinessProbe: + failureThreshold: 3 + periodSeconds: 5 + tcpSocket: + port: 9200 + timeoutSeconds: 3 + startupProbe: + failureThreshold: 30 + initialDelaySeconds: 5 + periodSeconds: 10 + tcpSocket: + port: 9200 + timeoutSeconds: 3 + ports: + - name: http + containerPort: 9200 + - name: transport + containerPort: 9300 + - name: metrics + containerPort: 9600 + resources: + limits: + cpu: "4" + memory: 8Gi + requests: + cpu: "2" + memory: 6Gi + env: + - name: node.name + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: cluster.initial_master_nodes + value: "brilliant-opensearch-cluster-master-0,brilliant-opensearch-cluster-master-1,brilliant-opensearch-cluster-master-2," + - name: discovery.seed_hosts + value: "brilliant-opensearch-cluster-master-headless" + - name: cluster.name + value: "brilliant-opensearch-cluster" + - name: network.host + value: "0.0.0.0" + - name: OPENSEARCH_JAVA_OPTS + value: "-Xmx3G -Xms3G" + - name: node.roles + value: "master,ingest,data,remote_cluster_client," + envFrom: + - secretRef: + name: opensearch-secret + volumeMounts: + - name: "brilliant-opensearch-cluster-master" + mountPath: /usr/share/opensearch/data + - name: config-emptydir + mountPath: /usr/share/opensearch/config/opensearch.yml + subPath: opensearch.yml + # Currently some extra blocks accept strings + # to continue with backwards compatibility this is being kept + # whilst also allowing for yaml to be specified too. + - mountPath: /usr/share/opensearch/config/certs + name: runtime-certs + readOnly: true diff --git a/helm-charts-observability/charts/opensearch/templates/NOTES.txt b/helm-charts-observability/charts/opensearch/templates/NOTES.txt new file mode 100755 index 0000000..110e677 --- /dev/null +++ b/helm-charts-observability/charts/opensearch/templates/NOTES.txt @@ -0,0 +1,2 @@ +Watch all cluster members come up. + $ kubectl get pods --namespace={{ .Release.Namespace }} -l app.kubernetes.io/component={{ template "opensearch.uname" . }} -w diff --git a/helm-charts-observability/charts/opensearch/templates/_helpers.tpl b/helm-charts-observability/charts/opensearch/templates/_helpers.tpl new file mode 100755 index 0000000..f7dc47d --- /dev/null +++ b/helm-charts-observability/charts/opensearch/templates/_helpers.tpl @@ -0,0 +1,144 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "opensearch.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "opensearch.fullname" -}} +{{- if contains .Chart.Name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "opensearch.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "opensearch.labels" -}} +helm.sh/chart: {{ include "opensearch.chart" . }} +{{ include "opensearch.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +app.kubernetes.io/component: {{ include "opensearch.uname" . }} +{{- with .Values.labels }} +{{ toYaml . }} +{{- end }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "opensearch.selectorLabels" -}} +app.kubernetes.io/name: {{ include "opensearch.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{- define "opensearch.uname" -}} +{{- if empty .Values.fullnameOverride -}} +{{- if empty .Values.nameOverride -}} +{{ .Values.clusterName }}-{{ .Values.nodeGroup }} +{{- else -}} +{{ .Values.nameOverride }}-{{ .Values.nodeGroup }} +{{- end -}} +{{- else -}} +{{ .Values.fullnameOverride }} +{{- end -}} +{{- end -}} + +{{- define "opensearch.masterService" -}} +{{- if empty .Values.masterService -}} +{{- if empty .Values.fullnameOverride -}} +{{- if empty .Values.nameOverride -}} +{{ .Values.clusterName }}-master +{{- else -}} +{{ .Values.nameOverride }}-master +{{- end -}} +{{- else -}} +{{ .Values.fullnameOverride }} +{{- end -}} +{{- else -}} +{{ .Values.masterService }} +{{- end -}} +{{- end -}} + +{{- define "opensearch.serviceName" -}} +{{- if eq .Values.nodeGroup "master" }} +{{- include "opensearch.masterService" . }} +{{- else }} +{{- include "opensearch.uname" . }} +{{- end }} +{{- end -}} + +{{- define "opensearch.endpoints" -}} +{{- $replicas := int (toString (.Values.replicas)) }} +{{- $uname := (include "opensearch.uname" .) }} + {{- range $i, $e := untilStep 0 $replicas 1 -}} +{{ $uname }}-{{ $i }}, + {{- end -}} +{{- end -}} + +{{- define "opensearch.majorVersion" -}} +{{- if .Values.majorVersion }} + {{- .Values.majorVersion }} +{{- else }} + {{- $version := semver (coalesce .Values.image.tag .Chart.AppVersion "1") }} + {{- $version.Major }} +{{- end }} +{{- end }} + +{{- define "opensearch.dockerRegistry" -}} +{{- if eq .Values.global.dockerRegistry "" -}} + {{- .Values.global.dockerRegistry -}} +{{- else -}} + {{- .Values.global.dockerRegistry | trimSuffix "/" | printf "%s/" -}} +{{- end -}} +{{- end -}} + +{{- define "opensearch.roles" -}} +{{- range $.Values.roles -}} +{{ . }}, +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for ingress. +*/}} +{{- define "opensearch.ingress.apiVersion" -}} + {{- if and (.Capabilities.APIVersions.Has "networking.k8s.io/v1") (semverCompare ">= 1.19-0" .Capabilities.KubeVersion.Version) -}} + {{- print "networking.k8s.io/v1" -}} + {{- else if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1" -}} + {{- print "networking.k8s.io/v1beta1" -}} + {{- else -}} + {{- print "extensions/v1beta1" -}} + {{- end -}} +{{- end -}} + +{{/* +Return if ingress is stable. +*/}} +{{- define "opensearch.ingress.isStable" -}} + {{- eq (include "opensearch.ingress.apiVersion" .) "networking.k8s.io/v1" -}} +{{- end -}} +{{/* +Return if ingress supports ingressClassName. +*/}} +{{- define "opensearch.ingress.supportsIngressClassName" -}} + {{- or (eq (include "opensearch.ingress.isStable" .) "true") (and (eq (include "opensearch.ingress.apiVersion" .) "networking.k8s.io/v1beta1") (semverCompare ">= 1.18-0" .Capabilities.KubeVersion.Version)) -}} +{{- end -}} diff --git a/helm-charts-observability/charts/opensearch/templates/configmap.yaml b/helm-charts-observability/charts/opensearch/templates/configmap.yaml new file mode 100644 index 0000000..4f2961b --- /dev/null +++ b/helm-charts-observability/charts/opensearch/templates/configmap.yaml @@ -0,0 +1,18 @@ +{{- $root := . }} +{{- if .Values.config }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "opensearch.uname" . }}-config + labels: + {{- include "opensearch.labels" . | nindent 4 }} +data: +{{- range $configName, $configYaml := .Values.config }} + {{ $configName }}: | + {{- if (eq (kindOf $configYaml) "map")}} + {{- tpl (toYaml $configYaml) $root | nindent 4 }} + {{- else -}} + {{- tpl $configYaml $root | nindent 4 }} + {{- end -}} +{{- end -}} +{{- end -}} diff --git a/helm-charts-observability/charts/opensearch/templates/extraManifests.yaml b/helm-charts-observability/charts/opensearch/templates/extraManifests.yaml new file mode 100644 index 0000000..c169b9d --- /dev/null +++ b/helm-charts-observability/charts/opensearch/templates/extraManifests.yaml @@ -0,0 +1,8 @@ +{{ range .Values.extraObjects }} +--- +{{- if typeIs "string" . }} +{{ tpl . $ }} +{{- else }} +{{ tpl (toYaml .) $ }} +{{- end }} +{{ end }} \ No newline at end of file diff --git a/helm-charts-observability/charts/opensearch/templates/ingress.yaml b/helm-charts-observability/charts/opensearch/templates/ingress.yaml new file mode 100644 index 0000000..d28c304 --- /dev/null +++ b/helm-charts-observability/charts/opensearch/templates/ingress.yaml @@ -0,0 +1,65 @@ +{{- if .Values.ingress.enabled -}} +{{- $fullName := include "opensearch.serviceName" . -}} +{{- $servicePort := .Values.httpPort -}} +{{- $ingressPath := .Values.ingress.path -}} +{{- $ingressApiIsStable := eq (include "opensearch.ingress.isStable" .) "true" -}} +{{- $ingressSupportsIngressClassName := eq (include "opensearch.ingress.supportsIngressClassName" .) "true" -}} +{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1 +{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1beta1 +{{- else -}} +apiVersion: extensions/v1beta1 +{{- end }} +kind: Ingress +metadata: + name: {{ $fullName }} + labels: + {{- include "opensearch.labels" . | nindent 4 }} + {{- with .Values.ingress.ingressLabels }} + {{- toYaml . | nindent 4 }} + {{- end }} +{{- with .Values.ingress.annotations }} + annotations: +{{ toYaml . | indent 4 }} +{{- end }} +spec: + {{- if and $ingressSupportsIngressClassName .Values.ingress.ingressClassName }} + ingressClassName: {{ .Values.ingress.ingressClassName }} + {{- end -}} +{{- if .Values.ingress.tls }} + tls: + {{- range .Values.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} +{{- end }} + rules: + {{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}} + {{- range .Values.ingress.hosts }} + - host: {{ . | quote }} + http: + paths: + - path: {{ $ingressPath }} + pathType: Prefix + backend: + service: + name: {{ $fullName }} + port: + number: {{ $servicePort }} + {{- end }} + {{- else -}} + {{- range .Values.ingress.hosts }} + - host: {{ . | quote }} + http: + paths: + - path: {{ $ingressPath }} + backend: + serviceName: {{ $fullName }} + servicePort: {{ $servicePort }} + {{- end }} + {{- end }} +{{- end }} diff --git a/helm-charts-observability/charts/opensearch/templates/networkpolicy.yaml b/helm-charts-observability/charts/opensearch/templates/networkpolicy.yaml new file mode 100644 index 0000000..51cd263 --- /dev/null +++ b/helm-charts-observability/charts/opensearch/templates/networkpolicy.yaml @@ -0,0 +1,17 @@ +{{- if .Values.networkPolicy.create -}} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ template "opensearch.uname" . }}-opensearch-net + labels: + {{- include "opensearch.labels" . | nindent 4 }} +spec: + ingress: + - from: + - podSelector: + matchLabels: + {{ template "opensearch.uname" . }}-transport-client: "true" + podSelector: + matchLabels: + {{ template "opensearch.uname" . }}-transport-client: "true" +{{- end }} diff --git a/helm-charts-observability/charts/opensearch/templates/poddisruptionbudget.yaml b/helm-charts-observability/charts/opensearch/templates/poddisruptionbudget.yaml new file mode 100644 index 0000000..68ab5b6 --- /dev/null +++ b/helm-charts-observability/charts/opensearch/templates/poddisruptionbudget.yaml @@ -0,0 +1,17 @@ +{{- if .Values.maxUnavailable }} +{{- if semverCompare ">=1.21-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: policy/v1 +{{- else -}} +apiVersion: policy/v1beta1 +{{- end }} +kind: PodDisruptionBudget +metadata: + name: "{{ template "opensearch.uname" . }}-pdb" + labels: + {{- include "opensearch.labels" . | nindent 4 }} +spec: + maxUnavailable: {{ .Values.maxUnavailable }} + selector: + matchLabels: + {{- include "opensearch.selectorLabels" . | nindent 6 }} +{{- end }} diff --git a/helm-charts-observability/charts/opensearch/templates/podsecuritypolicy.yaml b/helm-charts-observability/charts/opensearch/templates/podsecuritypolicy.yaml new file mode 100644 index 0000000..76f36fa --- /dev/null +++ b/helm-charts-observability/charts/opensearch/templates/podsecuritypolicy.yaml @@ -0,0 +1,17 @@ +{{- if semverCompare "<1.25-0" .Capabilities.KubeVersion.GitVersion -}} +{{- if .Values.podSecurityPolicy.create -}} +{{- $fullName := include "opensearch.uname" . -}} +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: {{ default $fullName .Values.podSecurityPolicy.name | quote }} + labels: + {{- include "opensearch.labels" . | nindent 4 }} +spec: +{{ toYaml .Values.podSecurityPolicy.spec | indent 2 }} +{{- if .Values.sysctl.enabled }} + allowedUnsafeSysctls: + - vm.max_map_count +{{- end }} +{{- end }} +{{- end }} diff --git a/helm-charts-observability/charts/opensearch/templates/role.yaml b/helm-charts-observability/charts/opensearch/templates/role.yaml new file mode 100644 index 0000000..cba3cf9 --- /dev/null +++ b/helm-charts-observability/charts/opensearch/templates/role.yaml @@ -0,0 +1,22 @@ +{{- if .Values.rbac.create -}} +{{- $fullName := include "opensearch.uname" . -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ $fullName | quote }} + labels: + {{- include "opensearch.labels" . | nindent 4 }} +rules: + - apiGroups: + - extensions + resources: + - podsecuritypolicies + resourceNames: + {{- if eq .Values.podSecurityPolicy.name "" }} + - {{ $fullName | quote }} + {{- else }} + - {{ .Values.podSecurityPolicy.name | quote }} + {{- end }} + verbs: + - use +{{- end -}} diff --git a/helm-charts-observability/charts/opensearch/templates/rolebinding.yaml b/helm-charts-observability/charts/opensearch/templates/rolebinding.yaml new file mode 100644 index 0000000..0445517 --- /dev/null +++ b/helm-charts-observability/charts/opensearch/templates/rolebinding.yaml @@ -0,0 +1,21 @@ +{{- if .Values.rbac.create -}} +{{- $fullName := include "opensearch.uname" . -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ $fullName | quote }} + labels: + {{- include "opensearch.labels" . | nindent 4 }} +subjects: + - kind: ServiceAccount + {{- if eq .Values.rbac.serviceAccountName "" }} + name: {{ $fullName | quote }} + {{- else }} + name: {{ .Values.rbac.serviceAccountName | quote }} + {{- end }} + namespace: {{ .Release.Namespace | quote }} +roleRef: + kind: Role + name: {{ $fullName | quote }} + apiGroup: rbac.authorization.k8s.io +{{- end -}} diff --git a/helm-charts-observability/charts/opensearch/templates/securityconfig.yaml b/helm-charts-observability/charts/opensearch/templates/securityconfig.yaml new file mode 100644 index 0000000..13d6364 --- /dev/null +++ b/helm-charts-observability/charts/opensearch/templates/securityconfig.yaml @@ -0,0 +1,19 @@ +{{- if .Values.securityConfig.config.data -}} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "opensearch.uname" . }}-securityconfig + namespace: {{ .Release.Namespace }} + labels: + {{- include "opensearch.labels" . | nindent 4 }} +type: Opaque +stringData: +{{- range $key, $val := .Values.securityConfig.config.data }} + {{ $key }}: | + {{- if (eq (kindOf $val) "map")}} + {{- tpl (toYaml $val) $ | nindent 4 }} + {{- else }} + {{- tpl $val $ | nindent 4 }} + {{- end }} +{{- end }} +{{- end }} diff --git a/helm-charts-observability/charts/opensearch/templates/service.yaml b/helm-charts-observability/charts/opensearch/templates/service.yaml new file mode 100644 index 0000000..78a6b07 --- /dev/null +++ b/helm-charts-observability/charts/opensearch/templates/service.yaml @@ -0,0 +1,75 @@ +--- +kind: Service +apiVersion: v1 +metadata: + name: {{ template "opensearch.serviceName" . }} + labels: + {{- include "opensearch.labels" . | nindent 4 }} +{{- if .Values.service.labels }} +{{ toYaml .Values.service.labels | indent 4 }} +{{- end }} + annotations: +{{ toYaml .Values.service.annotations | indent 4 }} +spec: + type: {{ .Values.service.type }} + {{- if (semverCompare ">= 1.23-0" .Capabilities.KubeVersion.Version) }} + {{- if .Values.service.ipFamilyPolicy }} + ipFamilyPolicy: {{ .Values.service.ipFamilyPolicy }} + {{- end }} + {{- if .Values.service.ipFamilies }} + ipFamilies: {{ .Values.service.ipFamilies }} + {{- end }} + {{- end }} + selector: + {{- include "opensearch.selectorLabels" . | nindent 4 }} + ports: + - name: {{ .Values.service.httpPortName | default "http" }} + protocol: TCP + port: {{ .Values.httpPort }} +{{- if .Values.service.nodePort }} + nodePort: {{ .Values.service.nodePort }} +{{- end }} + - name: {{ .Values.service.transportPortName | default "transport" }} + protocol: TCP + port: {{ .Values.transportPort }} + - name: {{ .Values.service.metricsPortName | default "metrics" }} + protocol: TCP + port: {{ .Values.metricsPort }} +{{- if .Values.service.loadBalancerIP }} + loadBalancerIP: {{ .Values.service.loadBalancerIP }} +{{- end }} +{{- with .Values.service.loadBalancerSourceRanges }} + loadBalancerSourceRanges: +{{ toYaml . | indent 4 }} +{{- end }} +{{- if .Values.service.externalTrafficPolicy }} + externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy }} +{{- end }} +--- +kind: Service +apiVersion: v1 +metadata: + name: {{ template "opensearch.serviceName" . }}-headless + labels: + {{- include "opensearch.labels" . | nindent 4 }} +{{- if .Values.service.labelsHeadless }} +{{ toYaml .Values.service.labelsHeadless | indent 4 }} +{{- end }} + annotations: + service.alpha.kubernetes.io/tolerate-unready-endpoints: "true" +{{- if .Values.service.headless.annotations }} +{{ toYaml .Values.service.headless.annotations | indent 4 }} +{{- end }} +spec: + clusterIP: None # This is needed for statefulset hostnames like opensearch-0 to resolve + # Create endpoints also if the related pod isn't ready + publishNotReadyAddresses: true + selector: + {{- include "opensearch.selectorLabels" . | nindent 4 }} + ports: + - name: {{ .Values.service.httpPortName | default "http" }} + port: {{ .Values.httpPort }} + - name: {{ .Values.service.transportPortName | default "transport" }} + port: {{ .Values.transportPort }} + - name: {{ .Values.service.metricsPortName | default "metrics" }} + port: {{ .Values.metricsPort }} diff --git a/helm-charts-observability/charts/opensearch/templates/serviceMonitor-secret.yaml b/helm-charts-observability/charts/opensearch/templates/serviceMonitor-secret.yaml new file mode 100644 index 0000000..5c8a2db --- /dev/null +++ b/helm-charts-observability/charts/opensearch/templates/serviceMonitor-secret.yaml @@ -0,0 +1,15 @@ +{{- if and .Values.serviceMonitor.enabled .Values.serviceMonitor.basicAuth.enabled (not .Values.serviceMonitor.basicAuth.existingSecret) }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "opensearch.uname" . }}-service-monitor-credentials + namespace: {{ .Release.Namespace }} + labels: + {{- include "opensearch.labels" . | nindent 4 }} + {{- with .Values.serviceMonitor.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} +data: + username: {{ .Values.serviceMonitor.basicAuth.username | b64enc | quote }} + password: {{ .Values.serviceMonitor.basicAuth.password | b64enc | quote }} +{{- end }} diff --git a/helm-charts-observability/charts/opensearch/templates/serviceMonitor.yaml b/helm-charts-observability/charts/opensearch/templates/serviceMonitor.yaml new file mode 100644 index 0000000..0abda69 --- /dev/null +++ b/helm-charts-observability/charts/opensearch/templates/serviceMonitor.yaml @@ -0,0 +1,42 @@ +{{- if .Values.serviceMonitor.enabled }} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ template "opensearch.uname" . }}-service-monitor + namespace: {{ .Release.Namespace }} + labels: + {{- include "opensearch.labels" . | nindent 4 }} + {{- with .Values.serviceMonitor.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + selector: + matchLabels: + {{- include "opensearch.selectorLabels" . | nindent 6 }} + endpoints: + - port: {{ .Values.service.httpPortName | default "http" }} + interval: {{ .Values.serviceMonitor.interval }} + path: {{ .Values.serviceMonitor.path }} + scheme: {{ .Values.serviceMonitor.scheme }} + {{- with .Values.serviceMonitor.tlsConfig }} + tlsConfig: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if .Values.serviceMonitor.basicAuth.enabled }} + basicAuth: + username: + {{- if .Values.serviceMonitor.basicAuth.existingSecret }} + name: {{ .Values.serviceMonitor.basicAuth.existingSecret }} + {{- else }} + name: {{ template "opensearch.uname" . }}-service-monitor-credentials + {{- end }} + key: username + password: + {{- if .Values.serviceMonitor.basicAuth.existingSecret }} + name: {{ .Values.serviceMonitor.basicAuth.existingSecret }} + {{- else }} + name: {{ template "opensearch.uname" . }}-service-monitor-credentials + {{- end }} + key: password + {{- end }} +{{- end }} diff --git a/helm-charts-observability/charts/opensearch/templates/serviceaccount.yaml b/helm-charts-observability/charts/opensearch/templates/serviceaccount.yaml new file mode 100644 index 0000000..81e2fcf --- /dev/null +++ b/helm-charts-observability/charts/opensearch/templates/serviceaccount.yaml @@ -0,0 +1,17 @@ +{{- if .Values.rbac.create -}} +{{- $fullName := include "opensearch.uname" . -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + {{- if eq .Values.rbac.serviceAccountName "" }} + name: {{ $fullName | quote }} + {{- else }} + name: {{ .Values.rbac.serviceAccountName | quote }} + {{- end }} + labels: + {{- include "opensearch.labels" . | nindent 4 }} + annotations: + {{- with .Values.rbac.serviceAccountAnnotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end -}} diff --git a/helm-charts-observability/charts/opensearch/templates/statefulset.yaml b/helm-charts-observability/charts/opensearch/templates/statefulset.yaml new file mode 100644 index 0000000..951293d --- /dev/null +++ b/helm-charts-observability/charts/opensearch/templates/statefulset.yaml @@ -0,0 +1,595 @@ +--- +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: {{ template "opensearch.uname" . }} + labels: + {{- include "opensearch.labels" . | nindent 4 }} + annotations: + majorVersion: "{{ include "opensearch.majorVersion" . }}" + {{- with .Values.openSearchAnnotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + serviceName: {{ template "opensearch.serviceName" . }}-headless + selector: + matchLabels: + {{- include "opensearch.selectorLabels" . | nindent 6 }} + {{- if .Values.singleNode }} + replicas: 1 + {{- else }} + replicas: {{ .Values.replicas }} + {{- end }} + podManagementPolicy: {{ .Values.podManagementPolicy }} + updateStrategy: + type: {{ .Values.updateStrategy }} + {{- if .Values.persistence.enabled }} + volumeClaimTemplates: + - metadata: + name: {{ template "opensearch.uname" . }} + {{- if or .Values.persistence.labels.enabled .Values.persistence.labels.additionalLabels }} + labels: + {{- if .Values.persistence.labels.enabled }} + {{- include "opensearch.labels" . | nindent 8 }} + {{- end }} + {{- with .Values.persistence.labels.additionalLabels }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- end }} + {{- with .Values.persistence.annotations }} + annotations: +{{ toYaml . | indent 8 }} + {{- end }} + spec: + accessModes: + {{- range .Values.persistence.accessModes }} + - {{ . | quote }} + {{- end }} + resources: + requests: + storage: {{ .Values.persistence.size | quote }} + {{- if .Values.persistence.storageClass }} + {{- if (eq "-" .Values.persistence.storageClass) }} + storageClassName: "" + {{- else }} + storageClassName: "{{ .Values.persistence.storageClass }}" + {{- end }} + {{- end }} + {{- end }} + template: + metadata: + name: "{{ template "opensearch.uname" . }}" + labels: + {{- include "opensearch.labels" . | nindent 8 }} + annotations: + {{- range $key, $value := .Values.podAnnotations }} + {{ $key }}: {{ $value | quote }} + {{- end }} + {{- /* This forces a restart if the configmap has changed */}} + {{- if .Values.config }} + configchecksum: {{ include (print .Template.BasePath "/configmap.yaml") . | sha256sum | trunc 63 }} + {{- end }} + {{- if .Values.securityConfig.config.data }} + securityconfigchecksum: {{ include (print .Template.BasePath "/securityconfig.yaml") . | sha256sum | trunc 63 }} + {{- end }} + spec: + {{- if .Values.schedulerName }} + schedulerName: "{{ .Values.schedulerName }}" + {{- end }} + securityContext: +{{ toYaml .Values.podSecurityContext | indent 8 }} + {{- if .Values.sysctl.enabled }} + sysctls: + - name: vm.max_map_count + value: {{ .Values.sysctlVmMaxMapCount | quote }} + {{- end }} + {{- if .Values.fsGroup }} + fsGroup: {{ .Values.fsGroup }} # Deprecated value, please use .Values.podSecurityContext.fsGroup + {{- end }} + {{- if and .Values.rbac.create (eq .Values.rbac.serviceAccountName "") }} + serviceAccountName: "{{ template "opensearch.uname" . }}" + automountServiceAccountToken: {{ ne .Values.rbac.automountServiceAccountToken false }} + {{- else if and .Values.rbac.create (ne .Values.rbac.serviceAccountName "") }} + serviceAccountName: {{ .Values.rbac.serviceAccountName | quote }} + automountServiceAccountToken: {{ ne .Values.rbac.automountServiceAccountToken false }} + {{- else }} + automountServiceAccountToken: {{ ne .Values.rbac.automountServiceAccountToken false }} + {{- end }} + {{- if .Values.imagePullSecrets }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: +{{ toYaml . | indent 6 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: +{{ toYaml . | indent 8 }} + {{- end }} + {{- if or (eq .Values.antiAffinity "hard") (eq .Values.antiAffinity "soft") (eq .Values.antiAffinity "custom") .Values.nodeAffinity .Values.podAffinity }} + {{- if .Values.priorityClassName }} + priorityClassName: {{ .Values.priorityClassName }} + {{- end }} + affinity: + {{- end }} + {{- if eq .Values.antiAffinity "hard" }} + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: app.kubernetes.io/instance + operator: In + values: + - {{ .Release.Name }} + - key: app.kubernetes.io/name + operator: In + values: + - {{ include "opensearch.name" . }} + topologyKey: {{ .Values.antiAffinityTopologyKey }} + {{- else if eq .Values.antiAffinity "soft" }} + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 1 + podAffinityTerm: + topologyKey: {{ .Values.antiAffinityTopologyKey }} + labelSelector: + matchExpressions: + - key: app.kubernetes.io/instance + operator: In + values: + - {{ .Release.Name }} + - key: app.kubernetes.io/name + operator: In + values: + - {{ include "opensearch.name" . }} + {{- else if eq .Values.antiAffinity "custom" }} + {{- with .Values.customAntiAffinity }} + podAntiAffinity: +{{ toYaml . | indent 10 }} + {{- end }} + {{- end }} + {{- with .Values.podAffinity }} + podAffinity: +{{ toYaml . | indent 10 }} + {{- end }} + {{- with .Values.nodeAffinity }} + nodeAffinity: +{{ toYaml . | indent 10 }} + {{- end }} + {{- if .Values.topologySpreadConstraints }} + topologySpreadConstraints: + {{- toYaml .Values.topologySpreadConstraints | nindent 8 }} + {{- end }} + terminationGracePeriodSeconds: {{ .Values.terminationGracePeriod }} + volumes: + {{- if .Values.config }} + - name: config + configMap: + name: {{ template "opensearch.uname" . }}-config + - emptyDir: {} + name: config-emptydir + {{- end }} + {{- range .Values.secretMounts }} + - name: {{ .name | required "secretMount .name is required" }} + secret: + secretName: {{ .secretName | required "secretMount .secretName is required" }} + {{- if .defaultMode }} + defaultMode: {{ .defaultMode }} + {{- end }} + {{- end }} + {{- if and .Values.securityConfig.config.data .Values.securityConfig.config.securityConfigSecret }} + {{ fail "Only one of .Values.securityConfig.config.data and .Values.securityConfig.config.securityConfigSecret may be defined. Please see the comment in values.yaml describing usage." }} + {{- end }} + {{- if .Values.securityConfig.config.data }} + - name: security-config-data + secret: + secretName: {{ include "opensearch.uname" . }}-securityconfig + {{- end }} + {{- with .Values.securityConfig.config.securityConfigSecret }} + - name: security-config-complete + secret: + secretName: {{ . | quote }} + {{- end }} + {{- if .Values.securityConfig.actionGroupsSecret }} + - name: action-groups + secret: + secretName: {{ .Values.securityConfig.actionGroupsSecret }} + {{- end }} + {{- if .Values.securityConfig.configSecret }} + - name: security-config + secret: + secretName: {{ .Values.securityConfig.configSecret }} + {{- end }} + {{- if .Values.securityConfig.internalUsersSecret }} + - name: internal-users-config + secret: + secretName: {{ .Values.securityConfig.internalUsersSecret }} + {{- end }} + {{- if .Values.securityConfig.rolesSecret }} + - name: roles + secret: + secretName: {{ .Values.securityConfig.rolesSecret }} + {{- end }} + {{- if .Values.securityConfig.rolesMappingSecret }} + - name: role-mapping + secret: + secretName: {{ .Values.securityConfig.rolesMappingSecret }} + {{- end -}} + {{- if .Values.securityConfig.tenantsSecret }} + - name: tenants + secret: + secretName: {{ .Values.securityConfig.tenantsSecret }} + {{- end }} +{{- if .Values.keystore }} + - name: keystore + emptyDir: {} + {{- range .Values.keystore }} + - name: keystore-{{ .secretName }} + secret: {{ toYaml . | nindent 12 }} + {{- end }} +{{ end }} + {{- if .Values.extraVolumes }} + # Currently some extra blocks accept strings + # to continue with backwards compatibility this is being kept + # whilst also allowing for yaml to be specified too. + {{- if eq "string" (printf "%T" .Values.extraVolumes) }} +{{ tpl .Values.extraVolumes . | indent 6 }} + {{- else }} +{{ toYaml .Values.extraVolumes | indent 6 }} + {{- end }} + {{- end }} + {{- if .Values.imagePullSecrets }} + imagePullSecrets: +{{ toYaml .Values.imagePullSecrets | indent 8 }} + {{- end }} + enableServiceLinks: {{ .Values.enableServiceLinks }} + {{- if .Values.hostAliases }} + hostAliases: {{ toYaml .Values.hostAliases | nindent 8 }} + {{- end }} + {{- if or (.Values.extraInitContainers) (.Values.keystore) (.Values.persistence.enabled) (.Values.sysctlInit.enabled) (.Values.config) }} + initContainers: +{{- if and .Values.persistence.enabled .Values.persistence.enableInitChown }} + - name: fsgroup-volume + image: "{{ template "opensearch.dockerRegistry" . }}{{ .Values.persistence.image | default "busybox" }}:{{ .Values.persistence.imageTag | default "latest" }}" + imagePullPolicy: "{{ .Values.image.pullPolicy }}" + command: ['sh', '-c'] + args: + - 'chown -R 1000:1000 /usr/share/opensearch/data' + securityContext: + runAsUser: 0 + resources: + {{- toYaml .Values.initResources | nindent 10 }} + volumeMounts: + - name: "{{ template "opensearch.uname" . }}" + mountPath: {{ .Values.opensearchHome }}/data +{{- end }} +{{- if .Values.sysctlInit.enabled }} + - name: sysctl + image: "{{ template "opensearch.dockerRegistry" . }}{{ .Values.sysctlInit.image | default "busybox" }}:{{ .Values.sysctlInit.imageTag | default "latest" }}" + imagePullPolicy: "{{ .Values.image.pullPolicy }}" + command: + - sh + - -c + - | + set -xe + DESIRED="{{ .Values.sysctlVmMaxMapCount }}" + CURRENT=$(sysctl -n vm.max_map_count) + if [ "$DESIRED" -gt "$CURRENT" ]; then + sysctl -w vm.max_map_count=$DESIRED + fi + securityContext: + runAsUser: 0 + privileged: true + resources: + {{- toYaml .Values.initResources | nindent 10 }} +{{- end }} +{{- if .Values.config }} + - name: configfile + image: "{{ template "opensearch.dockerRegistry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: "{{ .Values.image.pullPolicy }}" + command: + - sh + - -c + - | + #!/usr/bin/env bash + cp -r /tmp/configfolder/* /tmp/config/ + securityContext: +{{ toYaml .Values.securityContext | indent 10 }} + resources: + {{- toYaml .Values.initResources | nindent 10 }} + volumeMounts: + - mountPath: /tmp/config/ + name: config-emptydir + {{- range $path, $config := .Values.config }} + - name: config + mountPath: /tmp/configfolder/{{ $path }} + subPath: {{ $path }} + {{- end -}} +{{- end }} +{{- if .Values.keystore }} + - name: keystore + image: "{{ template "opensearch.dockerRegistry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: "{{ .Values.image.pullPolicy }}" + command: + - sh + - -c + - | + #!/usr/bin/env bash + set -euo pipefail + + {{ .Values.opensearchHome }}/bin/opensearch-keystore create + + for i in /tmp/keystoreSecrets/*/*; do + [ -f "$i" ] || continue + key=$(basename $i) + echo "Adding file $i to keystore key $key" + {{ .Values.opensearchHome }}/bin/opensearch-keystore add-file "$key" "$i" + done + + # Add the bootstrap password since otherwise the opensearch entrypoint tries to do this on startup + if [ ! -z ${PASSWORD+x} ]; then + echo 'Adding env $PASSWORD to keystore as key bootstrap.password' + echo "$PASSWORD" | {{ .Values.opensearchHome }}/bin/opensearch-keystore add -x bootstrap.password + fi + + cp -a {{ .Values.opensearchHome }}/config/opensearch.keystore /tmp/keystore/ + env: {{ toYaml .Values.extraEnvs | nindent 10 }} + envFrom: {{ toYaml .Values.envFrom | nindent 10 }} + securityContext: +{{ toYaml .Values.securityContext | indent 10 }} + resources: + {{- toYaml .Values.initResources | nindent 10 }} + volumeMounts: + - name: keystore + mountPath: /tmp/keystore + {{- range .Values.keystore }} + - name: keystore-{{ .secretName }} + mountPath: /tmp/keystoreSecrets/{{ .secretName }} + {{- end }} +{{- end }} + {{- if .Values.extraInitContainers }} + # Currently some extra blocks accept strings + # to continue with backwards compatibility this is being kept + # whilst also allowing for yaml to be specified too. + {{- if eq "string" (printf "%T" .Values.extraInitContainers) }} +{{ tpl .Values.extraInitContainers . | indent 6 }} + {{- else }} +{{ toYaml .Values.extraInitContainers | indent 6 }} + {{- end }} + {{- end }} + {{- end }} + containers: + - name: "{{ template "opensearch.name" . }}" + securityContext: +{{ toYaml .Values.securityContext | indent 10 }} + {{- if .Values.plugins.enabled }} + command: + - sh + - -c + - | + #!/usr/bin/env bash + set -euo pipefail + + {{- range $plugin := .Values.plugins.removeList }} + if ./bin/opensearch-plugin list | grep -q {{ $plugin }}; then + ./bin/opensearch-plugin remove {{ $plugin }} + fi + {{- end }} + + {{- range $plugin := .Values.plugins.installList }} + ./bin/opensearch-plugin install -b {{ $plugin }} + {{- end }} + + bash opensearch-docker-entrypoint.sh + {{- end }} + + image: "{{ template "opensearch.dockerRegistry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: "{{ .Values.image.pullPolicy }}" + readinessProbe: +{{ toYaml .Values.readinessProbe | indent 10 }} + {{- if .Values.livenessProbe }} + livenessProbe: +{{ toYaml .Values.livenessProbe | indent 10 }} + {{- end }} + {{- if semverCompare ">=1.16-0" .Capabilities.KubeVersion.Version }} + startupProbe: +{{ toYaml .Values.startupProbe | indent 10 }} + {{- end }} + ports: + - name: http + containerPort: {{ .Values.httpPort }} + {{- if .Values.httpHostPort }} + hostPort: {{ .Values.httpHostPort }} + {{- end }} + - name: transport + containerPort: {{ .Values.transportPort }} + {{- if .Values.transportHostPort }} + hostPort: {{ .Values.transportHostPort }} + {{- end }} + - name: metrics + containerPort: {{ .Values.metricsPort }} + resources: + {{- toYaml .Values.resources | nindent 10 }} + env: + - name: node.name + valueFrom: + fieldRef: + fieldPath: metadata.name + {{- if (and (has "master" .Values.roles) (not .Values.singleNode)) }} + - name: cluster.initial_master_nodes + value: "{{ template "opensearch.endpoints" . }}" + {{- end }} + - name: discovery.seed_hosts + value: "{{ template "opensearch.masterService" . }}-headless" + - name: cluster.name + value: "{{ .Values.clusterName }}" + - name: network.host + value: "{{ .Values.networkHost }}" + - name: OPENSEARCH_JAVA_OPTS + value: "{{ .Values.opensearchJavaOpts }}" + - name: node.roles + value: "{{ template "opensearch.roles" . }}" + {{- if .Values.singleNode }} + - name: discovery.type + value: "single-node" + {{- end }} +{{- if .Values.extraEnvs }} +{{ toYaml .Values.extraEnvs | indent 8 }} +{{- end }} +{{- if .Values.envFrom }} + envFrom: +{{ toYaml .Values.envFrom | indent 8 }} +{{- end }} +{{- if .Values.opensearchLifecycle }} + lifecycle: +{{ toYaml .Values.opensearchLifecycle | indent 10 }} +{{- end }} + volumeMounts: + {{- if .Values.persistence.enabled }} + - name: "{{ template "opensearch.uname" . }}" + mountPath: {{ .Values.opensearchHome }}/data + {{- end }} + {{- if .Values.keystore }} + - name: keystore + mountPath: {{ .Values.opensearchHome }}/config/opensearch.keystore + subPath: opensearch.keystore + {{- end }} + {{- if .Values.securityConfig.enabled }} + {{- if .Values.securityConfig.actionGroupsSecret }} + - mountPath: {{ .Values.securityConfig.path }}/action_groups.yml + name: action-groups + subPath: action_groups.yml + {{- end }} + {{- if .Values.securityConfig.configSecret }} + - mountPath: {{ .Values.securityConfig.path }}/config.yml + name: security-config + subPath: config.yml + {{- end }} + {{- if .Values.securityConfig.internalUsersSecret }} + - mountPath: {{ .Values.securityConfig.path }}/internal_users.yml + name: internal-users-config + subPath: internal_users.yml + {{- end }} + {{- if .Values.securityConfig.rolesSecret }} + - mountPath: {{ .Values.securityConfig.path }}/roles.yml + name: roles + subPath: roles.yml + {{- end }} + {{- if .Values.securityConfig.rolesMappingSecret }} + - mountPath: {{ .Values.securityConfig.path }}/roles_mapping.yml + name: role-mapping + subPath: roles_mapping.yml + {{- end }} + {{- if .Values.securityConfig.tenantsSecret }} + - mountPath: {{ .Values.securityConfig.path }}/tenants.yml + name: tenants + subPath: tenants.yml + {{- end }} + {{- if .Values.securityConfig.config.data }} + {{- if .Values.securityConfig.config.dataComplete }} + - mountPath: {{ .Values.securityConfig.path }} + name: security-config-data + {{- else }} + {{- range $key, $_ := .Values.securityConfig.config.data }} + - mountPath: {{ $.Values.securityConfig.path }}/{{ $key }} + name: security-config-data + subPath: {{ $key }} + {{- end }} + {{- end }} + {{- else if .Values.securityConfig.config.securityConfigSecret }} + - mountPath: {{ .Values.securityConfig.path }} + name: security-config-complete + {{- end }} + {{- end }} + {{- range .Values.secretMounts }} + - name: {{ .name | required "secretMount .name is required" }} + mountPath: {{ .path | required "secretMount .path is required" }} + {{- if .subPath }} + subPath: {{ .subPath }} + {{- end }} + {{- end }} + {{- range $path, $config := .Values.config }} + - name: config-emptydir + mountPath: {{ $.Values.opensearchHome }}/config/{{ $path }} + subPath: {{ $path }} + {{- end -}} + {{- if .Values.extraVolumeMounts }} + # Currently some extra blocks accept strings + # to continue with backwards compatibility this is being kept + # whilst also allowing for yaml to be specified too. + {{- if eq "string" (printf "%T" .Values.extraVolumeMounts) }} +{{ tpl .Values.extraVolumeMounts . | indent 8 }} + {{- else }} +{{ toYaml .Values.extraVolumeMounts | indent 8 }} + {{- end }} + {{- end }} + {{- if .Values.masterTerminationFix }} + {{- if has "master" .Values.roles }} + # This sidecar will prevent slow master re-election + - name: opensearch-master-graceful-termination-handler + image: "{{ template "opensearch.dockerRegistry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: "{{ .Values.image.pullPolicy }}" + command: + - "sh" + - -c + - | + #!/usr/bin/env bash + set -eo pipefail + + http () { + local path="${1}" + if [ -n "${USERNAME}" ] && [ -n "${PASSWORD}" ]; then + BASIC_AUTH="-u ${USERNAME}:${PASSWORD}" + else + BASIC_AUTH='' + fi + curl -XGET -s -k --fail ${BASIC_AUTH} {{ .Values.protocol }}://{{ template "opensearch.masterService" . }}:{{ .Values.httpPort }}${path} + } + + cleanup () { + while true ; do + local master="$(http "/_cat/master?h=node" || echo "")" + if [[ $master == "{{ template "opensearch.masterService" . }}"* && $master != "${NODE_NAME}" ]]; then + echo "This node is not master." + break + fi + echo "This node is still master, waiting gracefully for it to step down" + sleep 1 + done + + exit 0 + } + + trap cleanup SIGTERM + + sleep infinity & + wait $! + resources: + {{- toYaml .Values.sidecarResources | nindent 10 }} + env: + - name: NODE_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + {{- if .Values.extraEnvs }} +{{ toYaml .Values.extraEnvs | indent 8 }} + {{- end }} + {{- if .Values.envFrom }} + envFrom: +{{ toYaml .Values.envFrom | indent 8 }} + {{- end }} + {{- end }} + {{- end }} +{{- if .Values.lifecycle }} + lifecycle: +{{ toYaml .Values.lifecycle | indent 10 }} +{{- end }} + {{- if .Values.extraContainers }} + # Currently some extra blocks accept strings + # to continue with backwards compatibility this is being kept + # whilst also allowing for yaml to be specified too. + {{- if eq "string" (printf "%T" .Values.extraContainers) }} +{{ tpl .Values.extraContainers . | indent 6 }} + {{- else }} +{{ toYaml .Values.extraContainers | indent 6 }} + {{- end }} + {{- end }} diff --git a/helm-charts-observability/charts/opensearch/values.yaml b/helm-charts-observability/charts/opensearch/values.yaml new file mode 100644 index 0000000..89fb5d7 --- /dev/null +++ b/helm-charts-observability/charts/opensearch/values.yaml @@ -0,0 +1,719 @@ +--- +clusterName: "brilliant-opensearch-cluster" +nodeGroup: "master" + +# If discovery.type in the opensearch configuration is set to "single-node", +# this should be set to "true" +# If "true", replicas will be forced to 1 +singleNode: false + +# The service that non master groups will try to connect to when joining the cluster +# This should be set to clusterName + "-" + nodeGroup for your master group +masterService: "brilliant-opensearch-cluster-master" + +# OpenSearch roles that will be applied to this nodeGroup +# These will be set as environment variable "node.roles". E.g. node.roles=master,ingest,data,remote_cluster_client +roles: + - master + - ingest + - data + - remote_cluster_client + +replicas: 3 + +# if not set, falls back to parsing .Values.imageTag, then .Chart.appVersion. +majorVersion: "" + +global: + # Set if you want to change the default docker registry, e.g. a private one. + dockerRegistry: "" + +# Allows you to add any config files in {{ .Values.opensearchHome }}/config +opensearchHome: /usr/share/opensearch + +# such as opensearch.yml and log4j2.properties +config: + # Values must be YAML literal style scalar / YAML multiline string. + # : | + # + # log4j2.properties: | + # status = error + # + # appender.console.type = Console + # appender.console.name = console + # appender.console.layout.type = PatternLayout + # appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n + # + # rootLogger.level = info + # rootLogger.appenderRef.console.ref = console + opensearch.yml: | + cluster.name: brilliant-opensearch-cluster + + # Bind to all interfaces because we don't know what IP address Docker will assign to us. + network.host: 0.0.0.0 + + # Setting network.host to a non-loopback address enables the annoying bootstrap checks. "Single-node" mode disables them again. + # Implicitly done if ".singleNode" is set to "true". + # discovery.type: single-node + + # Start OpenSearch Security Demo Configuration + # WARNING: revise all the lines below before you go into production + plugins: + query: + datasources: + encryption: + masterkey: "8e74f8c437a820d8e2c99f11" + security: + nodes_dn: + - "CN=opensearch-master-0,OU=OpenSearch Nodes,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD" + - "CN=opensearch-master-1,OU=OpenSearch Nodes,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD" + - "CN=opensearch-master-2,OU=OpenSearch Nodes,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD" + ssl: + transport: + pemcert_filepath: certs/node.pem + pemkey_filepath: certs/node-key.pem + pemtrustedcas_filepath: certs/root-ca.pem + enforce_hostname_verification: false + resolve_hostname: true + http: + enabled: true + pemcert_filepath: certs/node.pem + pemkey_filepath: certs/node-key.pem + pemtrustedcas_filepath: certs/root-ca.pem + allow_unsafe_democertificates: false + allow_default_init_securityindex: true + authcz: + admin_dn: + - CN=opensearch-admin,OU=OpenSearch Administrators,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD + audit.type: internal_opensearch + enable_snapshot_restore_privilege: true + check_snapshot_restore_write_privileges: true + restapi: + roles_enabled: ["all_access", "security_rest_api_access"] + system_indices: + enabled: true + indices: + [ + ".opendistro-alerting-config", + ".opendistro-alerting-alert*", + ".opendistro-anomaly-results*", + ".opendistro-anomaly-detector*", + ".opendistro-anomaly-checkpoints", + ".opendistro-anomaly-detection-state", + ".opendistro-reports-*", + ".opendistro-notifications-*", + ".opendistro-notebooks", + ".opendistro-asynchronous-search-response*", + ] + ######## End OpenSearch Security Demo Configuration ######## + # log4j2.properties: + +# Extra environment variables to append to this nodeGroup +# This will be appended to the current 'env:' key. You can use any of the kubernetes env +# syntax here +extraEnvs: [] +# - name: MY_ENVIRONMENT_VAR +# value: the_value_goes_here +# Chart version 2.18.0 and App Version OpenSearch 2.12.0 onwards a custom strong password needs to be provided in order to setup demo admin user. +# Cluster will not spin-up without this unless demo config install is disabled. +# - name: OPENSEARCH_INITIAL_ADMIN_PASSWORD +# value: + +# Allows you to load environment variables from kubernetes secret or config map +envFrom: +- secretRef: + name: opensearch-secret # this the the admin password + + +# - configMapRef: +# name: config-map + +# A list of secrets and their paths to mount inside the pod +# This is useful for mounting certificates for security and for mounting +# the X-Pack license +secretMounts: [] + +hostAliases: [] +# - ip: "127.0.0.1" +# hostnames: +# - "foo.local" +# - "bar.local" + +image: + repository: "opensearchproject/opensearch" + # override image tag, which is .Chart.AppVersion by default + tag: "" + pullPolicy: "IfNotPresent" + +podAnnotations: {} + # iam.amazonaws.com/role: es-cluster + +# OpenSearch Statefulset annotations +openSearchAnnotations: {} + +# additionals labels +labels: {} + +opensearchJavaOpts: "-Xmx3G -Xms3G" + +resources: + requests: + cpu: "2" + memory: "6Gi" + limits: + cpu: "4" + memory: "8Gi" + +initResources: {} +# limits: +# cpu: "25m" +# memory: "128Mi" +# requests: +# cpu: "25m" +# memory: "128Mi" + +sidecarResources: {} +# limits: +# cpu: "25m" +# memory: "128Mi" +# requests: +# cpu: "25m" +# memory: "128Mi" + +networkHost: "0.0.0.0" + +rbac: + create: false + serviceAccountAnnotations: {} + serviceAccountName: "" + # Controls whether or not the Service Account token is automatically mounted to /var/run/secrets/kubernetes.io/serviceaccount + automountServiceAccountToken: false + +podSecurityPolicy: + create: false + name: "" + spec: + privileged: true + fsGroup: + rule: RunAsAny + runAsUser: + rule: RunAsAny + seLinux: + rule: RunAsAny + supplementalGroups: + rule: RunAsAny + volumes: + - secret + - configMap + - persistentVolumeClaim + - emptyDir + +persistence: + enabled: true + # Set to false to disable the `fsgroup-volume` initContainer that will update permissions on the persistent disk. + enableInitChown: true + # override image, which is busybox by default + # image: busybox + # override image tag, which is latest by default + # imageTag: + labels: + # Add default labels for the volumeClaimTemplate of the StatefulSet + enabled: false + # Add custom labels for the volumeClaimTemplate of the StatefulSet + additionalLabels: {} + # OpenSearch Persistent Volume Storage Class + # If defined, storageClassName: + # If set to "-", storageClassName: "", which disables dynamic provisioning + # If undefined (the default) or set to null, no storageClassName spec is + # set, choosing the default provisioner. (gp2 on AWS, standard on + # GKE, AWS & OpenStack) + # + storageClass: "longhorn" + accessModes: + - ReadWriteOnce + size: 120Gi + annotations: {} + +extraVolumes: + # - name: extras + # emptyDir: {} + - name: admin-certs + secret: + secretName: opensearch-admin-cert + defaultMode: 0400 + - name: custom-internal-users + secret: + secretName: opensearch-internal-users + defaultMode: 0440 + + - name: node-0-source + secret: + secretName: opensearch-node-0-cert + defaultMode: 0440 + - name: node-1-source + secret: + secretName: opensearch-node-1-cert + defaultMode: 0440 + - name: node-2-source + secret: + secretName: opensearch-node-2-cert + defaultMode: 0440 + + - name: runtime-certs + emptyDir: {} + + + +extraVolumeMounts: + # - name: extras + # mountPath: /usr/share/extras + # readOnly: true + - name: runtime-certs + mountPath: /usr/share/opensearch/config/certs + readOnly: true + - name: admin-certs + mountPath: /usr/share/opensearch/config/admin-certs + readOnly: true + - name: custom-internal-users + readOnly: true + mountPath: /usr/share/opensearch/config/custom-security + +extraContainers: [] + # - name: do-something + # image: busybox + # command: ['do', 'something'] + +# extraInitContainers: [] + # - name: do-somethings + # image: busybox + # command: ['do', 'something'] +extraInitContainers: + - name: select-node-certificate + image: "busybox:1.36.1" + imagePullPolicy: IfNotPresent + + securityContext: + runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 1000 + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL + + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + + command: + - /bin/sh + - -ec + - | + ordinal="${POD_NAME##*-}" + + case "${ordinal}" in + 0|1|2) + ;; + *) + echo "ERROR: unsupported pod name: ${POD_NAME}" + exit 1 + ;; + esac + + source_dir="/source/node-${ordinal}" + cert="${source_dir}/node-${ordinal}.pem" + key="${source_dir}/node-${ordinal}-key.pem" + ca="${source_dir}/root-ca.pem" + + test -r "${cert}" || { + echo "ERROR: certificate not readable: ${cert}" + exit 1 + } + + test -r "${key}" || { + echo "ERROR: private key not readable: ${key}" + exit 1 + } + + test -r "${ca}" || { + echo "ERROR: root CA not readable: ${ca}" + exit 1 + } + + cp "${cert}" /runtime/node.pem + cp "${key}" /runtime/node-key.pem + cp "${ca}" /runtime/root-ca.pem + + chmod 0644 /runtime/node.pem + chmod 0600 /runtime/node-key.pem + chmod 0644 /runtime/root-ca.pem + + echo "Selected node-${ordinal} certificate for ${POD_NAME}" + ls -l /runtime + + volumeMounts: + - name: node-0-source + mountPath: /source/node-0 + readOnly: true + + - name: node-1-source + mountPath: /source/node-1 + readOnly: true + + - name: node-2-source + mountPath: /source/node-2 + readOnly: true + + - name: runtime-certs + mountPath: /runtime +# This is the PriorityClass settings as defined in +# https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass +priorityClassName: "" + +# By default this will make sure two pods don't end up on the same node +# Changing this to a region would allow you to spread pods across regions +antiAffinityTopologyKey: "kubernetes.io/hostname" + +# Hard means that by default pods will only be scheduled if there are enough nodes for them +# and that they will never end up on the same node. Setting this to soft will do this "best effort". +# Setting this to custom will use what is passed into customAntiAffinity. +antiAffinity: "hard" + +# Allows passing in custom anti-affinity settings as defined in +# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity +# Using this parameter requires setting antiAffinity to custom. +customAntiAffinity: {} + +# This is the node affinity settings as defined in +# https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#node-affinity-beta-feature +nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/hostname + operator: NotIn + values: + - k8s-cp-01 + + +# This is the pod affinity settings as defined in +# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity +podAffinity: {} + +# This is the pod topology spread constraints +# https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ +topologySpreadConstraints: [] + +# The default is to deploy all pods serially. By setting this to parallel all pods are started at +# the same time when bootstrapping the cluster +podManagementPolicy: "Parallel" + +# The environment variables injected by service links are not used, but can lead to slow OpenSearch boot times when +# there are many services in the current namespace. +# If you experience slow pod startups you probably want to set this to `false`. +enableServiceLinks: true + +protocol: https +httpPort: 9200 +transportPort: 9300 +metricsPort: 9600 +httpHostPort: "" +transportHostPort: "" + + +service: + labels: {} + labelsHeadless: {} + headless: + annotations: {} + type: ClusterIP + # The IP family and IP families options are to set the behaviour in a dual-stack environment + # Omitting these values will let the service fall back to whatever the CNI dictates the defaults + # should be + # + # ipFamilyPolicy: SingleStack + # ipFamilies: + # - IPv4 + nodePort: "" + annotations: {} + httpPortName: http + transportPortName: transport + metricsPortName: metrics + loadBalancerIP: "" + loadBalancerSourceRanges: [] + externalTrafficPolicy: "" + +updateStrategy: RollingUpdate + +# This is the max unavailable setting for the pod disruption budget +# The default value of 1 will make sure that kubernetes won't allow more than 1 +# of your pods to be unavailable during maintenance +maxUnavailable: 1 + +podSecurityContext: + fsGroup: 1000 + runAsUser: 1000 + +securityContext: + capabilities: + drop: + - ALL + # readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1000 + +securityConfig: + enabled: true + path: "/usr/share/opensearch/config/opensearch-security" + actionGroupsSecret: + configSecret: + internalUsersSecret: + rolesSecret: + rolesMappingSecret: + tenantsSecret: + # The following option simplifies securityConfig by using a single secret and + # specifying the config files as keys in the secret instead of creating + # different secrets for for each config file. + # Note that this is an alternative to the individual secret configuration + # above and shouldn't be used if the above secrets are used. + config: + # There are multiple ways to define the configuration here: + # * If you define anything under data, the chart will automatically create + # a secret and mount it. This is best option to choose if you want to override all the + # existing yml files at once. + # * If you define securityConfigSecret, the chart will assume this secret is + # created externally and mount it. This is best option to choose if your intention is to + # only update a single yml file. + # * It is an error to define both data and securityConfigSecret. + securityConfigSecret: "" + dataComplete: true + data: {} + # config.yml: |- + # internal_users.yml: |- + # roles.yml: |- + # roles_mapping.yml: |- + # action_groups.yml: |- + # tenants.yml: |- + +# How long to wait for opensearch to stop gracefully +terminationGracePeriod: 120 + +sysctlVmMaxMapCount: 262144 + +startupProbe: + tcpSocket: + port: 9200 + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 3 + failureThreshold: 30 + +livenessProbe: {} + # periodSeconds: 20 + # timeoutSeconds: 5 + # failureThreshold: 10 + # successThreshold: 1 + # initialDelaySeconds: 10 + # tcpSocket: + # port: 9200 + +readinessProbe: + tcpSocket: + port: 9200 + periodSeconds: 5 + timeoutSeconds: 3 + failureThreshold: 3 + +## Use an alternate scheduler. +## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ +## +schedulerName: "" + +imagePullSecrets: [] +nodeSelector: {} +tolerations: +- key: "dedicated" + operator: "Equal" + value: "storage" + effect: "NoSchedule" + +# Enabling this will publically expose your OpenSearch instance. +# Only enable this if you have security enabled on your cluster +ingress: + enabled: false + # For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName + # See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress + # ingressClassName: nginx + + annotations: + kubernetes.io/ingress.class: nginx + kubernetes.io/tls-acme: "true" + ingressLabels: {} + path: / + hosts: [] + # - 118.67.213.76 + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + +nameOverride: "" +fullnameOverride: "" + +masterTerminationFix: false + +opensearchLifecycle: {} + # preStop: + # exec: + # command: ["/bin/sh", "-c", "echo Hello from the preStart handler > /usr/share/message"] + # postStart: + # exec: + # command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"] + +lifecycle: {} + # preStop: + # exec: + # command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"] + # postStart: + # exec: + # command: + # - bash + # - -c + # - | + # #!/bin/bash + # # Add a template to adjust number of shards/replicas1 + # TEMPLATE_NAME=my_template + # INDEX_PATTERN="logstash-*" + # SHARD_COUNT=8 + # REPLICA_COUNT=1 + # ES_URL=http://localhost:9200 + # while [[ "$(curl -s -o /dev/null -w '%{http_code}\n' $ES_URL)" != "200" ]]; do sleep 1; done + # curl -XPUT "$ES_URL/_template/$TEMPLATE_NAME" -H 'Content-Type: application/json' -d'{"index_patterns":['\""$INDEX_PATTERN"\"'],"settings":{"number_of_shards":'$SHARD_COUNT',"number_of_replicas":'$REPLICA_COUNT'}}' + +keystore: [] +# To add secrets to the keystore: +# - secretName: opensearch-encryption-key + +networkPolicy: + create: false + ## Enable creation of NetworkPolicy resources. Only Ingress traffic is filtered for now. + ## In order for a Pod to access OpenSearch, it needs to have the following label: + ## {{ template "uname" . }}-client: "true" + ## Example for default configuration to access HTTP port: + ## opensearch-master-http-client: "true" + ## Example for default configuration to access transport port: + ## opensearch-master-transport-client: "true" + + http: + enabled: false + +# Deprecated +# please use the above podSecurityContext.fsGroup instead +fsGroup: "" + +## Set optimal sysctl's through securityContext. This requires privilege. Can be disabled if +## the system has already been preconfigured. (Ex: https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html) +## Also see: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ +sysctl: + enabled: false + +## Set optimal sysctl's through privileged initContainer. +sysctlInit: + enabled: true + # override image, which is busybox by default + # image: busybox + # override image tag, which is latest by default + # imageTag: + +## Enable to add 3rd Party / Custom plugins not offered in the default OpenSearch image. +plugins: + enabled: false + installList: [] + # - example-fake-plugin + removeList: [] + # - example-fake-plugin + +# -- Array of extra K8s manifests to deploy +extraObjects: [] + # - apiVersion: secrets-store.csi.x-k8s.io/v1 + # kind: SecretProviderClass + # metadata: + # name: argocd-secrets-store + # spec: + # provider: aws + # parameters: + # objects: | + # - objectName: "argocd" + # objectType: "secretsmanager" + # jmesPath: + # - path: "client_id" + # objectAlias: "client_id" + # - path: "client_secret" + # objectAlias: "client_secret" + # secretObjects: + # - data: + # - key: client_id + # objectName: client_id + # - key: client_secret + # objectName: client_secret + # secretName: argocd-secrets-store + # type: Opaque + # labels: + # app.kubernetes.io/part-of: argocd + # - | + # apiVersion: policy/v1 + # kind: PodDisruptionBudget + # metadata: + # name: {{ template "opensearch.uname" . }} + # labels: + # {{- include "opensearch.labels" . | nindent 4 }} + # spec: + # minAvailable: 1 + # selector: + # matchLabels: + # {{- include "opensearch.selectorLabels" . | nindent 6 }} + +# ServiceMonitor Configuration for Prometheus +# Enabling this option will create a ServiceMonitor resource that allows Prometheus to scrape metrics from the OpenSearch service. +# This only creates the serviceMonitor, to actually have metrics Make sure to install the prometheus-exporter plugin needed for +# serving metrics over the `.Values.plugins` value: +# plugins: +# enabled: true +# installList: +# - https://github.com/aiven/prometheus-exporter-plugin-for-opensearch/releases/download/x.x.x.x/prometheus-exporter-x.x.x.x.zip +serviceMonitor: + # Set to true to enable the ServiceMonitor resource + enabled: false + + # HTTP path where metrics are exposed. + # Ensure this matches your OpenSearch service configuration. + path: /_prometheus/metrics + + # Scheme to use for scraping. + scheme: http + + # Frequency at which Prometheus will scrape metrics. + # Adjust based on your needs. + interval: 10s + + # additional labels to be added to the ServiceMonitor + # labels: + # k8s.example.com/prometheus: kube-prometheus + labels: {} + + # additional tlsConfig to be added to the ServiceMonitor + tlsConfig: {} + + # Basic Auth configuration for the service monitor + # You can either use existingSecret, which expects a secret to be already present with data.username and data.password + # or set the credentials over the helm values, making helm create a secret for you + # basicAuth: + # enaled: true + # existingSecret: my-secret + # username: my-username + # password: my-password + basicAuth: + enabled: false diff --git a/helm-charts-observability/ct.yaml b/helm-charts-observability/ct.yaml new file mode 100644 index 0000000..d523e91 --- /dev/null +++ b/helm-charts-observability/ct.yaml @@ -0,0 +1,3 @@ +# See https://github.com/helm/chart-testing#configuration +target-branch: main +helm-extra-args: --timeout 1000s