mosiur/brilliant-monitoring
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Convert helm-charts-observability to regular directory

Browse Source
This commit is contained in:
Mosiur Rahman
2026-08-13 07:38:55 +00:00
parent 0362f95667
commit beae59543c
93 changed files with 7648 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

0
helm-charts-observability/charts/README.md Normal file
View File

23
helm-charts-observability/charts/data-prepper/.helmignore Normal file
View File

@@ -0,0 +1,23 @@
# Patterns to ignore when building packages.
# This supports shell glob matching, relative path matching, and
# negation (prefixed with !). Only one pattern per line.
.DS_Store
# Common VCS dirs
.git/
.gitignore
.bzr/
.bzrignore
.hg/
.hgignore
.svn/
# Common backup files
*.swp
*.bak
*.tmp
*.orig
*~
# Various IDEs
.project
.idea/
*.tmproj
.vscode/

22
helm-charts-observability/charts/data-prepper/CHANGELOG.md Normal file
View File

@@ -0,0 +1,22 @@
# Changelog
All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
## [0.3.1]
### Added
- Added configurable `initContainers`
## [0.3.0]
### Added
- Demo pipeline not part of values.yaml. New value `pipelineConfig.demoPipeline` controls creation of demo pipeline.
## [0.2.0]
### Added
- Added configurable `global.dockerRegistry`
## [0.1.0]
### Added
- Create initial version of data-prepper helm chart

50
helm-charts-observability/charts/data-prepper/Chart.yaml Normal file
View File

@@ -0,0 +1,50 @@
apiVersion: v2
name: data-prepper
description: A Helm chart for Data Prepper
# A chart can be either an 'application' or a 'library' chart.
#
# Application charts are a collection of templates that can be packaged into versioned archives
# to be deployed.
#
# Library charts provide useful utilities or functions for the chart developer. They're included as
# a dependency of application charts to inject those utilities and functions into the rendering
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
type: application
# This is the chart version. This version number should be incremented each time you make changes
# to the chart and its templates, including the app version.
# Versions are expected to follow Semantic Versioning (https://semver.org/)
version: 0.3.1
# This is the version number of the application being deployed. This version number should be
# incremented each time you make changes to the application. Versions are not expected to
# follow Semantic Versioning. They should reflect the version the application is using.
# It is recommended to use it with quotes.
appVersion: "2.8.0"
maintainers:
- name: gaiksaya
url: https://github.com/gaiksaya
- name: peterzhuamazon
url: https://github.com/peterzhuamazon
- name: prudhvigodithi
url: https://github.com/prudhvigodithi
- name: sergk
url: https://github.com/sergk
- name: TheAlgo
url: https://github.com/TheAlgo
home: https://opensearch.org/docs/latest/data-prepper/
sources:
- https://github.com/opensearch-project/data-prepper
- https://github.com/opensearch-project/helm-charts
annotations:
artifacthub.io/category: monitoring-logging
artifacthub.io/license: Apache-2.0
artifacthub.io/links: |
- name: Data Prepper Documentation
url: https://opensearch.org/docs/latest/data-prepper/
- name: OpenSearch Project
url: https://opensearch.org

130
helm-charts-observability/charts/data-prepper/README.md Normal file
View File

@@ -0,0 +1,130 @@
# Data Prepper Helm Chart
![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2.8.0](https://img.shields.io/badge/AppVersion-2.8.0-informational?style=flat-square)
A Helm chart for Data Prepper
**Homepage:** <https://opensearch.org/docs/latest/data-prepper/>
Data Prepper is an essential component of the OpenSearch project, designed for high-volume data transformation and ingestion into OpenSearch. This Helm chart simplifies deploying Data Prepper on Kubernetes environments, ensuring you can easily set up your data processing pipelines.
## Requirements
Before installing the Data Prepper Helm chart, ensure your environment meets the following requirements:
* Kubernetes >= 1.14
* Helm >= 2.17.0
* We recommend having at least 4 GiB of memory available for this deployment. A minimum of 2 GiB may suffice, but less than that could lead to deployment failures.
## Installation
To install the Data Prepper Helm chart, follow these steps:
* Add the OpenSearch Helm repository if you haven't already:
```bash
helm repo add opensearch https://opensearch-project.github.io/helm-charts/
helm repo update
```
* Install the Data Prepper chart with:
```bash
helm install my-data-prepper-release opensearch/data-prepper
```
Replace my-data-prepper-release with your desired release name. When no explicit pipeline is defined, this will configure a demo pipeline using a random source and stdout sink.
## Configuration
The Data Prepper Helm chart comes with a variety of configuration options to tailor the deployment to your needs.
The default values are specified in the [values.yaml](values.yaml) file. You can override these values by providing your own `values.yaml` file during installation or by specifying configuration options with --set flags.
For a detailed list of configuration options, refer to the values.yaml file or the [Data Prepper documentation](https://opensearch.org/docs/latest/data-prepper/managing-data-prepper/configuring-data-prepper/).
## Uninstalling the Chart
To uninstall/delete the my-data-prepper deployment:
```bash
helm delete my-data-prepper
```
This command removes all the Kubernetes components associated with the chart and deletes the release.
## Contributing
We welcome contributions! Please read our [CONTRIBUTING.md](../../CONTRIBUTING.md) for details on how to submit contributions to this project.
## Maintainers
| Name | Email | Url |
| ---- | ------ | --- |
| gaiksaya | | <https://github.com/gaiksaya> |
| peterzhuamazon | | <https://github.com/peterzhuamazon> |
| prudhvigodithi | | <https://github.com/prudhvigodithi> |
| sergk | | <https://github.com/sergk> |
| TheAlgo | | <https://github.com/TheAlgo> |
## Source Code
* <https://github.com/opensearch-project/data-prepper>
* <https://github.com/opensearch-project/helm-charts>
## Values
| Key | Type | Default | Description |
|-----|------|---------|-------------|
| affinity | object | `{}` | |
| autoscaling.enabled | bool | `false` | |
| autoscaling.maxReplicas | int | `100` | |
| autoscaling.minReplicas | int | `1` | |
| autoscaling.targetCPUUtilizationPercentage | int | `80` | |
| config | object | `{"data-prepper-config.yaml":"ssl: false\n# circuit_breakers:\n# heap:\n# usage: 2gb\n# reset: 30s\n# check_interval: 5s\n","log4j2-rolling.properties":"#\n# Copyright OpenSearch Contributors\n# SPDX-License-Identifier: Apache-2.0\n#\n\nstatus = error\ndest = err\nname = PropertiesConfig\n\nproperty.filename = log/data-prepper/data-prepper.log\n\nappender.console.type = Console\nappender.console.name = STDOUT\nappender.console.layout.type = PatternLayout\nappender.console.layout.pattern = %d{ISO8601} [%t] %-5p %40C - %m%n\n\nappender.rolling.type = RollingFile\nappender.rolling.name = RollingFile\nappender.rolling.fileName = ${filename}\nappender.rolling.filePattern = logs/data-prepper.log.%d{MM-dd-yy-HH}-%i.gz\nappender.rolling.layout.type = PatternLayout\nappender.rolling.layout.pattern = %d{ISO8601} [%t] %-5p %40C - %m%n\nappender.rolling.policies.type = Policies\nappender.rolling.policies.time.type = TimeBasedTriggeringPolicy\nappender.rolling.policies.time.interval = 1\nappender.rolling.policies.time.modulate = true\nappender.rolling.policies.size.type = SizeBasedTriggeringPolicy\nappender.rolling.policies.size.size=100MB\nappender.rolling.strategy.type = DefaultRolloverStrategy\nappender.rolling.strategy.max = 168\n\nrootLogger.level = warn\nrootLogger.appenderRef.stdout.ref = STDOUT\nrootLogger.appenderRef.file.ref = RollingFile\n\nlogger.pipeline.name = org.opensearch.dataprepper.pipeline\nlogger.pipeline.level = info\n\nlogger.parser.name = org.opensearch.dataprepper.parser\nlogger.parser.level = info\n\nlogger.plugins.name = org.opensearch.dataprepper.plugins\nlogger.plugins.level = info\n"}` | Data Prepper configuration |
| config."data-prepper-config.yaml" | string | `"ssl: false\n# circuit_breakers:\n# heap:\n# usage: 2gb\n# reset: 30s\n# check_interval: 5s\n"` | Main Data Prepper configuration file content |
| config."log4j2-rolling.properties" | string | `"#\n# Copyright OpenSearch Contributors\n# SPDX-License-Identifier: Apache-2.0\n#\n\nstatus = error\ndest = err\nname = PropertiesConfig\n\nproperty.filename = log/data-prepper/data-prepper.log\n\nappender.console.type = Console\nappender.console.name = STDOUT\nappender.console.layout.type = PatternLayout\nappender.console.layout.pattern = %d{ISO8601} [%t] %-5p %40C - %m%n\n\nappender.rolling.type = RollingFile\nappender.rolling.name = RollingFile\nappender.rolling.fileName = ${filename}\nappender.rolling.filePattern = logs/data-prepper.log.%d{MM-dd-yy-HH}-%i.gz\nappender.rolling.layout.type = PatternLayout\nappender.rolling.layout.pattern = %d{ISO8601} [%t] %-5p %40C - %m%n\nappender.rolling.policies.type = Policies\nappender.rolling.policies.time.type = TimeBasedTriggeringPolicy\nappender.rolling.policies.time.interval = 1\nappender.rolling.policies.time.modulate = true\nappender.rolling.policies.size.type = SizeBasedTriggeringPolicy\nappender.rolling.policies.size.size=100MB\nappender.rolling.strategy.type = DefaultRolloverStrategy\nappender.rolling.strategy.max = 168\n\nrootLogger.level = warn\nrootLogger.appenderRef.stdout.ref = STDOUT\nrootLogger.appenderRef.file.ref = RollingFile\n\nlogger.pipeline.name = org.opensearch.dataprepper.pipeline\nlogger.pipeline.level = info\n\nlogger.parser.name = org.opensearch.dataprepper.parser\nlogger.parser.level = info\n\nlogger.plugins.name = org.opensearch.dataprepper.plugins\nlogger.plugins.level = info\n"` | Log4j2 configuration for Data Prepper logging |
| extraEnvs | list | `[]` | Extra environment variables to pass to the Data Prepper container |
| fullnameOverride | string | `""` | Override the default fullname for the deployment |
| global.dockerRegistry | string | `""` | Set if you want to change the default docker registry, e.g. a private one. |
| image.pullPolicy | string | `"IfNotPresent"` | The image tag to pull. Default: IfNotPresent |
| image.repository | string | `"opensearchproject/data-prepper"` | The image repository from which to pull the Data Prepper image |
| image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. |
| imagePullSecrets | list | `[]` | List of imagePullSecrets to use if the Docker image is stored in a private registry |
| ingress.annotations | object | `{}` | |
| ingress.className | string | `""` | |
| ingress.enabled | bool | `false` | |
| ingress.hosts[0].host | string | `"chart-example.local"` | |
| ingress.hosts[0].paths[0].path | string | `"/"` | |
| ingress.hosts[0].paths[0].pathType | string | `"ImplementationSpecific"` | |
| ingress.tls | list | `[]` | |
| nameOverride | string | `""` | Override the default name for the deployment |
| nodeSelector | object | `{}` | |
| pipelineConfig | object | (See below) | Pipeline configuration |
| pipelineConfig.enabled | boolean | `false` | Enable inline configuration in `config` sub key. |
| pipelineConfig.config | object | `{}` | Pipeline configuration file inline if `enabled` is set to true |
| pipelineConfig.demoPipeline | boolean | "" | If set, a demo pipeline will be provisioned with source `random` and sink `stdout`. |
| pipelineConfig.existingSecret | string | `""` | The name of an existing secret containing the pipeline configuration. If enabled is false existingSecret is used. The existingSecret must have a key named `pipelines.yaml`. |
| podAnnotations | object | `{}` | |
| podLabels | object | `{}` | |
| podSecurityContext | object | `{}` | |
| initContainers | list | `[]` | Optional list of init containers for the pod |
| ports | list | `[{"name":"http-source","port":2021},{"name":"otel-traces","port":21890},{"name":"otel-metrics","port":21891},{"name":"otel-logs","port":21892}]` | Data Prepper ports |
| ports[0] | object | `{"name":"http-source","port":2021}` | The port that the source is running on. Default value is 2021. Valid options are between 0 and 65535. https://opensearch.org/docs/latest/data-prepper/pipelines/configuration/sources/http-source/ |
| ports[1] | object | `{"name":"otel-traces","port":21890}` | The port that the otel_trace_source source runs on. Default value is 21890. https://opensearch.org/docs/latest/data-prepper/pipelines/configuration/sources/otel-trace-source/ |
| ports[2] | object | `{"name":"otel-metrics","port":21891}` | The port that the OpenTelemtry metrics source runs on. Default value is 21891. https://opensearch.org/docs/latest/data-prepper/pipelines/configuration/sources/otel-metrics-source/ |
| ports[3] | object | `{"name":"otel-logs","port":21892}` | Represents the port that the otel_logs_source source is running on. Default value is 21892. https://opensearch.org/docs/latest/data-prepper/pipelines/configuration/sources/otel-logs-source/ |
| replicaCount | int | `1` | |
| resources | object | `{}` | |
| securityContext | object | `{}` | |
| service.type | string | `"ClusterIP"` | |
| serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
| serviceAccount.automount | bool | `true` | Automatically mount a ServiceAccount's API credentials? |
| serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
| tolerations | list | `[]` | |
| volumeMounts | list | `[]` | |
| volumes | list | `[]` | |
## License
This project is licensed under the Apache License 2.0 - see the [LICENSE.txt](../../LICENSE.txt) file for details.

71
helm-charts-observability/charts/data-prepper/README.md.gotmpl Normal file
View File

@@ -0,0 +1,71 @@
# Data Prepper Helm Chart
{{ template "chart.deprecationWarning" . }}
{{ template "chart.badgesSection" . }}
{{ template "chart.description" . }}
{{ template "chart.homepageLine" . }}
Data Prepper is an essential component of the OpenSearch project, designed for high-volume data transformation and ingestion into OpenSearch. This Helm chart simplifies deploying Data Prepper on Kubernetes environments, ensuring you can easily set up your data processing pipelines.
## Requirements
Before installing the Data Prepper Helm chart, ensure your environment meets the following requirements:
* Kubernetes >= 1.14
* Helm >= 2.17.0
* We recommend having at least 4 GiB of memory available for this deployment. A minimum of 2 GiB may suffice, but less than that could lead to deployment failures.
## Installation
To install the Data Prepper Helm chart, follow these steps:
* Add the OpenSearch Helm repository if you haven't already:
```bash
helm repo add opensearch https://opensearch-project.github.io/helm-charts/
helm repo update
```
* Install the Data Prepper chart with:
```bash
helm install my-data-prepper-release opensearch/data-prepper
```
Replace my-data-prepper-release with your desired release name.
## Configuration
The Data Prepper Helm chart comes with a variety of configuration options to tailor the deployment to your needs.
The default values are specified in the [values.yaml](values.yaml) file. You can override these values by providing your own values.yaml file during installation or by specifying configuration options with --set flags.
For a detailed list of configuration options, refer to the values.yaml file or the [Data Prepper documentation](https://opensearch.org/docs/latest/data-prepper/managing-data-prepper/configuring-data-prepper/).
## Uninstalling the Chart
To uninstall/delete the my-data-prepper deployment:
```bash
helm delete my-data-prepper
```
This command removes all the Kubernetes components associated with the chart and deletes the release.
## Contributing
We welcome contributions! Please read our [CONTRIBUTING.md](../../CONTRIBUTING.md) for details on how to submit contributions to this project.
{{ template "chart.maintainersSection" . }}
{{ template "chart.sourcesSection" . }}
{{ template "chart.requirementsSection" . }}
{{ template "chart.valuesSection" . }}
## License
This project is licensed under the Apache License 2.0 - see the [LICENSE.txt](../../LICENSE.txt) file for details.

23
helm-charts-observability/charts/data-prepper/certificate_renew_sop.md Normal file
View File

@@ -0,0 +1,23 @@
renew certificate using this command
openssl x509 -req -in data-prepper-ingress.csr -CA $ROOT_CA_CERT -CAkey $ROOT_CA_KEY -CAcreateserial -out data-prepper-ingress.crt -days 365 -sha256 -extfile data-prepper-ingress.cnf -extensions server_extensions
k delete secret -n observability dataprepper-ingress-tls
then create kubernetes secret
k create secret --namespace observability tls dataprepper-ingress-tls --cert=data-prepper-ingress.crt --key=data-prepper-ingress.key --dry-run=client -o yaml | k apply -f -
verify
k get secret -n observability dataprepper-ingress-tls -o jsonpath='{.type}{"\n"}'
is should say kubernetes.io/tls
kubectl get secret dataprepper-ingress-tls \
-n observability \
-o jsonpath='{.data.tls\.crt}' |
base64 -d |
openssl x509 -noout -subject -issuer -ext subjectAltName

126
helm-charts-observability/charts/data-prepper/cpanel_path_structure.txt Normal file
View File

@@ -0,0 +1,126 @@
# System logs (/var/log)
/var/log/agent360-install.log
/var/log/agent360.log
/var/log/alternatives.log
/var/log/alternatives.log.1
/var/log/apache2/
/var/log/apport.log
/var/log/apt/
/var/log/audit/
/var/log/auth.log
/var/log/auth.log.1
/var/log/auth.log.2.gz
/var/log/auth.log.3.gz
/var/log/auth.log.4.gz
/var/log/bootstrap.log
/var/log/btmp
/var/log/btmp.1
/var/log/chkservd.log
/var/log/clamav/
/var/log/clam-update.log
/var/log/cloud-init.log
/var/log/cloud-init-output.log
/var/log/comet_backup_jobs_helper.log
/var/log/comet_backup_jobs_helper.log.1
/var/log/cpanel-install.log
/var/log/cpanel-server-traffic/
/var/log/dcpumon/
/var/log/dist-upgrade/
/var/log/dmesg
/var/log/dmesg.0
/var/log/dmesg.1.gz
/var/log/dpkg.log
/var/log/dpkg.log.1
/var/log/ea-passenger-analytics/
/var/log/exim_mainlog
/var/log/exim_mainlog.1.gz
/var/log/exim_mainlog.2.gz
/var/log/exim_mainlog.3.gz
/var/log/exim_mainlog.4.gz
/var/log/exim_paniclog
/var/log/exim_paniclog.1.gz
/var/log/exim_paniclog.2.gz
/var/log/exim_paniclog.3.gz
/var/log/exim_paniclog.4.gz
/var/log/exim_rejectlog
/var/log/exim_rejectlog.1.gz
/var/log/exim_rejectlog.2.gz
/var/log/exim_rejectlog.3.gz
/var/log/exim_rejectlog.4.gz
/var/log/fail2ban.log
/var/log/fail2ban.log.1
/var/log/fail2ban.log.2.gz
/var/log/fail2ban.log.3.gz
/var/log/fail2ban.log.4.gz
/var/log/faillog
/var/log/fontconfig.log
/var/log/imav-deploy.log
/var/log/imunify360/
/var/log/imunify360_user_logs/
/var/log/installer/
/var/log/journal/
/var/log/kern.log
/var/log/kern.log.1
/var/log/kern.log.2.gz
/var/log/kern.log.3.gz
/var/log/kern.log.4.gz
/var/log/landscape/
/var/log/lastlog
/var/log/lfd.log
/var/log/lfd.log.1.gz
/var/log/mail.err
/var/log/mail.log
/var/log/mail.log.1
/var/log/mail.log.2.gz
/var/log/mail.log.3.gz
/var/log/mail.log.4.gz
/var/log/munin/
/var/log/mysql/
/var/log/named/
/var/log/private/
/var/log/quota_enable.log
/var/log/README
/var/log/sw-cp-server/
/var/log/syslog
/var/log/syslog.1
/var/log/syslog.2.gz
/var/log/syslog.3.gz
/var/log/syslog.4.gz
/var/log/sysstat/
/var/log/ubuntu-advantage-apt-hook.log
/var/log/unattended-upgrades/
/var/log/wp-toolkit/
/var/log/wtmp
/var/log/xferlog.offsetftpsep
# cPanel logs (/usr/local/cpanel/logs)
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/api_tokens_log
/usr/local/cpanel/logs/backup_restore_manager_error_log
/usr/local/cpanel/logs/backup_restore_manager_log
/usr/local/cpanel/logs/build_locale_databases_log
/usr/local/cpanel/logs/cpbackup/
/usr/local/cpanel/logs/cpbackup_transport_history.log
/usr/local/cpanel/logs/cpbackup_transporter/
/usr/local/cpanel/logs/cpbackup_transporter.log
/usr/local/cpanel/logs/cpdavd_error_log
/usr/local/cpanel/logs/cpdavd_session_log
/usr/local/cpanel/logs/cphulkd.log
/usr/local/cpanel/logs/cphulkd_errors.log
/usr/local/cpanel/logs/cpwrapd_log
/usr/local/cpanel/logs/dnsadmin_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/incoming_http_requests.log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/php-fpm/
/usr/local/cpanel/logs/queueprocd.log
/usr/local/cpanel/logs/secpol_log
/usr/local/cpanel/logs/session_log
/usr/local/cpanel/logs/spamd_error_log
/usr/local/cpanel/logs/splitlogs_log
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/tailwatchd_log
/usr/local/cpanel/logs/update_analysis

17
helm-charts-observability/charts/data-prepper/prepper-ingress.yaml Normal file
View File

@@ -0,0 +1,17 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: prepper-ingress
namespace: observability
spec:
ingressClassName: nginx
rules:
- http:
paths:
- path: /logs
pathType: Prefix
backend:
service:
name: data-prepper
port:
number: 2021

160
helm-charts-observability/charts/data-prepper/prerequisit_inforamtion.md Normal file
View File

@@ -0,0 +1,160 @@
# Phase 1
## Infromation for preeper
- OpenSearch Kubernetes Service name
```
root@k8s-cp-01:~# k get svc -n observability
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
brilliant-opensearch-cluster-master ClusterIP 10.43.44.32 <none> 9200/TCP,9300/TCP,9600/TCP 4d18h
brilliant-opensearch-cluster-master-headless ClusterIP None <none> 9200/TCP,9300/TCP,9600/TCP 4d18h
brilliant-opensearch-dashboard-opensearch-dashboards ClusterIP 10.43.225.4 <none> 5601/TCP,9601/TCP 15h
root@k8s-cp-01:~# k get svc -n ingress-nginx
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
ingress-nginx-controller LoadBalancer 10.43.211.10 <pending> 80:31599/TCP,443:31186/TCP 26d
ingress-nginx-controller-admission ClusterIP 10.43.204.151 <none> 443/TCP 26d
ingress-nginx-controller-metrics ClusterIP 10.43.119.183 <none> 10254/TCP 26d
root@k8s-cp-01:~#
```
- OpenSearch HTTPS port
*Mentioned above*
- CA certificate
*CA Certificate is in the server monitoring/opensearch-pki*
*There is another certificate
```
apiVersion: v1
data:
root-ca.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUY3VENDQTlXZ0F3SUJBZ0lVTC9hTytnYS9YY3lzakFYbGh1WG92d0xLWkJjd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZVXhDekFKQmdOVkJBWVRBa0pFTVE0d0RBWURWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaAphMkV4RWpBUUJnTlZCQW9NQ1VKeWFXeHNhV0Z1ZERFYk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwCklFTkJNU1V3SXdZRFZRUUREQnhDY21sc2JHbGhiblFnVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUI0WERUSTIKTURjeU16RTFNREV4T1ZvWERUTTJNRGN5TURFMU1ERXhPVm93Z1lVeEN6QUpCZ05WQkFZVEFrSkVNUTR3REFZRApWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaGEyRXhFakFRQmdOVkJBb01DVUp5YVd4c2FXRnVkREViCk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwSUVOQk1TVXdJd1lEVlFRRERCeENjbWxzYkdsaGJuUWcKVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUlJQ0lqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FnOEFNSUlDQ2dLQwpBZ0VBdXlEYmRaMUFycWd6K1l3SkNUcWlxREtuUzNDRGhHekNxK0h5WDN3clBnV0JvZFBraHJCV3dkNzQ4ZjdqClhZWDNQditQS0F0ZzVGYjdxa2ZZUFZJR0FPZUNiUWxkRlJnZld0S2F2MkdxcHZseUlKcy9OZW5PZzFZQ3IydVUKbDE3UnFPNk1BSGt6d1pNTVFDV1JXMlFiUy9weVY0VHd6dkNxSTR1ZVpzOFJ4MndwbERJdWFPVXdJMEVTMG8zdQpWdDJHMVlCTWlFOUNVTDliQWlYbWQ0UTR4a1NFRFRvOVY1SVk3Z2dHYjFTU0xWU2x6RDJHZElaMGN3VlE2LzcwCnUrQ1FPa005ZXhIRVR2eGpGTmZ4azI2YlRZVUJmNnBNS2VpSDdMbC9ucjZFVVVzTW5DSUR5VGtnK3Zta1M5ZWoKUmY1R0QwQ00rcnl1V1BiRHlHOCtzcDh4d1N1ZkcydDdkUGZRSTUzd1Zzc1BKSkk5b0lsZ0lJWXkyMkFUMlo4RwpKL2dZbmYwMU5LREhSV1dBU2FQaTBLT2dURldqRG5xam94Q0FHZjVGVFRJSHdBQjVsMS8rMXZFbEkyNjQ2M2d4CnBWcTk4Vyt4U3FQQ0xaTW9sWlE5TVkwbjVHeGgvZjhkK0RPb1BVT0lXazJqWXdvS1JGQXJiTlNTNnkySnVrS3YKSWNvMnN4YUhqZkhrdDdqdDBkckRLcjUrelI5bndUWDhVN3hBaWlTYkVTekN6OWlvdU9QSEcxMFFtdzl6VVRNMgoxdzJmMmlQRWpvbFpBVjFBaFU3dzFWNHBzc3JpWDIvNTlDR1dYT1VEcWNnd2MwdWh4djRnWFRndXBCeGcrYU5yCllybWZwNndtejdzN3lmblh3T2xVaVRDRW1Bc2NBemNkMmdCaGwvN1dpcmFRZFVzQ0F3RUFBYU5UTUZFd0hRWUQKVlIwT0JCWUVGSGJhbmo2RkdNVWZ3bEMwSytqY081TTlHd0FwTUI4R0ExVWRJd1FZTUJhQUZIYmFuajZGR01VZgp3bEMwSytqY081TTlHd0FwTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3RFFZSktvWklodmNOQVFFTEJRQURnZ0lCCkFBZVVVVUFMTk5FNDM2UEwvZXl6V0c3bmlPdndXODF3UkdVdGdEUnJpY2xFWjh0K3MzUG9MOXRibyszUGN1ekgKakxsUFArYmVLY2tUTEZKVGZZWUN3Z0dWZkdIRXE1ejV1SUt3ZWIyMG9GSEg3ek9DSzF3VVJBSUlPZnFycncyMApjcWNzdTRnK3NENnl0bllWN2Y1T0RFT2RNaXpjVXRrbGpMSjVieXJLSU9OV2FrSTBpd0xLeXFPQWlGeUVSY2xiCjB0ZzhoTDR6dkRLVUZ6dVJycXhxS0padzNWUWUvM1JWUFYwZ0RLUW96VEQ0M3lnQUdGVlVjckx1dHZOK2V5bEEKVDdYMGtNZXJlVVRKd1N6RDVvenhGRXFkaDlLNHZkZTA2a3BuSXpQS2tEanNFZiszeW9WeFVxRGJCeGV3ai9aOApodzhmT3lBWC9jV2UvZlhmWVdPV3RpTlhiQVJRd0pvUWlLb3lacHRuNGpvRXhLWVB2Qzg0RitINEZnZnpidXFkCnNnL2R2SjBxcldGaUlZeWZBRS9NNGM3VTBDUnVsZ1lETXJhbktIUHhxTllVT21pRzM4T0xLTDlFMmlvV002UHYKek82djVvUk5pazFFN3BrRUVMSUFPczR3U2MvdG45MU01TmtpSjgyRXNEQ2ZaVG5FVU9Cd3VsRzZSbW8vYWF0agpCWUJEaHo0dnhmN0ZjNG13WEdXNVZXc1Qzd2ZVckErZ3l3VWo5dlFqTTV6SjEybDl4NU9Dd3pNMTJuQWdSZ1dFCkh4ZDh5TFhkNE9rTWRaRWNVckY5eWtSMGJUZ3AyWnowL3lPR21KbVpieHRNdHlGaTVMcmt6VElodWJNS1l2bncKcWsrbWdaUmNMcXBWclRSYTNiaGdEVzJrSWpFT2I5SHB6NG5MZ3loUVpCMFAKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
kind: Secret
metadata:
annotations:
kubectl.kubernetes.io/last-applied-configuration: |
{"apiVersion":"v1","data":{"root-ca.pem":"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUY3VENDQTlXZ0F3SUJBZ0lVTC9hTytnYS9YY3lzakFYbGh1WG92d0xLWkJjd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZVXhDekFKQmdOVkJBWVRBa0pFTVE0d0RBWURWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaAphMkV4RWpBUUJnTlZCQW9NQ1VKeWFXeHNhV0Z1ZERFYk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwCklFTkJNU1V3SXdZRFZRUUREQnhDY21sc2JHbGhiblFnVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUI0WERUSTIKTURjeU16RTFNREV4T1ZvWERUTTJNRGN5TURFMU1ERXhPVm93Z1lVeEN6QUpCZ05WQkFZVEFrSkVNUTR3REFZRApWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaGEyRXhFakFRQmdOVkJBb01DVUp5YVd4c2FXRnVkREViCk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwSUVOQk1TVXdJd1lEVlFRRERCeENjbWxzYkdsaGJuUWcKVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUlJQ0lqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FnOEFNSUlDQ2dLQwpBZ0VBdXlEYmRaMUFycWd6K1l3SkNUcWlxREtuUzNDRGhHekNxK0h5WDN3clBnV0JvZFBraHJCV3dkNzQ4ZjdqClhZWDNQditQS0F0ZzVGYjdxa2ZZUFZJR0FPZUNiUWxkRlJnZld0S2F2MkdxcHZseUlKcy9OZW5PZzFZQ3IydVUKbDE3UnFPNk1BSGt6d1pNTVFDV1JXMlFiUy9weVY0VHd6dkNxSTR1ZVpzOFJ4MndwbERJdWFPVXdJMEVTMG8zdQpWdDJHMVlCTWlFOUNVTDliQWlYbWQ0UTR4a1NFRFRvOVY1SVk3Z2dHYjFTU0xWU2x6RDJHZElaMGN3VlE2LzcwCnUrQ1FPa005ZXhIRVR2eGpGTmZ4azI2YlRZVUJmNnBNS2VpSDdMbC9ucjZFVVVzTW5DSUR5VGtnK3Zta1M5ZWoKUmY1R0QwQ00rcnl1V1BiRHlHOCtzcDh4d1N1ZkcydDdkUGZRSTUzd1Zzc1BKSkk5b0lsZ0lJWXkyMkFUMlo4RwpKL2dZbmYwMU5LREhSV1dBU2FQaTBLT2dURldqRG5xam94Q0FHZjVGVFRJSHdBQjVsMS8rMXZFbEkyNjQ2M2d4CnBWcTk4Vyt4U3FQQ0xaTW9sWlE5TVkwbjVHeGgvZjhkK0RPb1BVT0lXazJqWXdvS1JGQXJiTlNTNnkySnVrS3YKSWNvMnN4YUhqZkhrdDdqdDBkckRLcjUrelI5bndUWDhVN3hBaWlTYkVTekN6OWlvdU9QSEcxMFFtdzl6VVRNMgoxdzJmMmlQRWpvbFpBVjFBaFU3dzFWNHBzc3JpWDIvNTlDR1dYT1VEcWNnd2MwdWh4djRnWFRndXBCeGcrYU5yCllybWZwNndtejdzN3lmblh3T2xVaVRDRW1Bc2NBemNkMmdCaGwvN1dpcmFRZFVzQ0F3RUFBYU5UTUZFd0hRWUQKVlIwT0JCWUVGSGJhbmo2RkdNVWZ3bEMwSytqY081TTlHd0FwTUI4R0ExVWRJd1FZTUJhQUZIYmFuajZGR01VZgp3bEMwSytqY081TTlHd0FwTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3RFFZSktvWklodmNOQVFFTEJRQURnZ0lCCkFBZVVVVUFMTk5FNDM2UEwvZXl6V0c3bmlPdndXODF3UkdVdGdEUnJpY2xFWjh0K3MzUG9MOXRibyszUGN1ekgKakxsUFArYmVLY2tUTEZKVGZZWUN3Z0dWZkdIRXE1ejV1SUt3ZWIyMG9GSEg3ek9DSzF3VVJBSUlPZnFycncyMApjcWNzdTRnK3NENnl0bllWN2Y1T0RFT2RNaXpjVXRrbGpMSjVieXJLSU9OV2FrSTBpd0xLeXFPQWlGeUVSY2xiCjB0ZzhoTDR6dkRLVUZ6dVJycXhxS0padzNWUWUvM1JWUFYwZ0RLUW96VEQ0M3lnQUdGVlVjckx1dHZOK2V5bEEKVDdYMGtNZXJlVVRKd1N6RDVvenhGRXFkaDlLNHZkZTA2a3BuSXpQS2tEanNFZiszeW9WeFVxRGJCeGV3ai9aOApodzhmT3lBWC9jV2UvZlhmWVdPV3RpTlhiQVJRd0pvUWlLb3lacHRuNGpvRXhLWVB2Qzg0RitINEZnZnpidXFkCnNnL2R2SjBxcldGaUlZeWZBRS9NNGM3VTBDUnVsZ1lETXJhbktIUHhxTllVT21pRzM4T0xLTDlFMmlvV002UHYKek82djVvUk5pazFFN3BrRUVMSUFPczR3U2MvdG45MU01TmtpSjgyRXNEQ2ZaVG5FVU9Cd3VsRzZSbW8vYWF0agpCWUJEaHo0dnhmN0ZjNG13WEdXNVZXc1Qzd2ZVckErZ3l3VWo5dlFqTTV6SjEybDl4NU9Dd3pNMTJuQWdSZ1dFCkh4ZDh5TFhkNE9rTWRaRWNVckY5eWtSMGJUZ3AyWnowL3lPR21KbVpieHRNdHlGaTVMcmt6VElodWJNS1l2bncKcWsrbWdaUmNMcXBWclRSYTNiaGdEVzJrSWpFT2I5SHB6NG5MZ3loUVpCMFAKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo="},"kind":"Secret","metadata":{"annotations":{},"name":"opensearch-dashboard-ca","namespace":"observability"}}
creationTimestamp: "2026-08-03T13:45:31Z"
name: opensearch-dashboard-ca
namespace: observability
resourceVersion: "4485295"
uid: 7fba4407-7eb1-456a-a10c-e8500630df2e
type: Opaque
```
- Ingestion username/password
*username: logger*
*password: Enp129s0f0-l0gin*
```
root@k8s-cp-01:~# k get secret -n observability prepper-creds -o yaml
apiVersion: v1
data:
logger: RW5wMTI5czBmMC1sMGdnM3I=
kind: Secret
metadata:
annotations:
kubectl.kubernetes.io/last-applied-configuration: |
{"apiVersion":"v1","data":{"logger":"RW5wMTI5czBmMC1sMGdnM3I="},"kind":"Secret","metadata":{"annotations":{},"name":"prepper-creds","namespace":"observability"}}
creationTimestamp: "2026-08-04T06:17:58Z"
name: prepper-creds
namespace: observability
resourceVersion: "4604982"
uid: 6592aff6-3e6b-45a1-9953-348c647ca8d3
type: Opaque
root@k8s-cp-01:~#
```
- Target index name
*I am not understanding this*
We will use dedicated ingestion user
# Phase 2
### Data Prepper pipeline:
```
cpanel-log-pipeline:
source:
http:
path: /logs
ssl: true
sink:
- opensearch:
hosts: ["brilliant-opensearch-cluster-master:9200"]
insecure: false
username: logger
password: ${LOGGER_PASSWORD}
index_type: custom
index: cpanel-test-%{yyyy.MM.dd}
ssl: true
```
log paths of cpanel:
##### System logs (/var/log)
/var/log/apache2/
/var/log/audit/
/var/log/auth.log
/var/log/bootstrap.log
/var/log/chkservd.log
/var/log/clamav/
/var/log/cpanel-install.log
/var/log/cpanel-server-traffic/
/var/log/dmesg
/var/log/dpkg.log
/var/log/exim_mainlog
/var/log/exim_paniclog
/var/log/exim_rejectlog
/var/log/fail2ban.log
/var/log/kern.log
/var/log/lfd.log
/var/log/mail.err
/var/log/mail.log
/var/log/munin/
/var/log/mysql/
/var/log/named/
/var/log/private/
/var/log/quota_enable.log
/var/log/sw-cp-server/
/var/log/syslog
##### cPanel logs (/usr/local/cpanel/logs)
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/api_tokens_log
/usr/local/cpanel/logs/backup_restore_manager_error_log
/usr/local/cpanel/logs/backup_restore_manager_log
/usr/local/cpanel/logs/build_locale_databases_log
/usr/local/cpanel/logs/cpbackup/
/usr/local/cpanel/logs/cpbackup_transport_history.log
/usr/local/cpanel/logs/cpbackup_transporter/
/usr/local/cpanel/logs/cpbackup_transporter.log
/usr/local/cpanel/logs/cpdavd_error_log
/usr/local/cpanel/logs/cpdavd_session_log
/usr/local/cpanel/logs/cphulkd.log
/usr/local/cpanel/logs/cphulkd_errors.log
/usr/local/cpanel/logs/cpwrapd_log
/usr/local/cpanel/logs/dnsadmin_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/incoming_http_requests.log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/php-fpm/
/usr/local/cpanel/logs/queueprocd.log
/usr/local/cpanel/logs/secpol_log
/usr/local/cpanel/logs/session_log
/usr/local/cpanel/logs/spamd_error_log
/usr/local/cpanel/logs/splitlogs_log
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/tailwatchd_log
/usr/local/cpanel/logs/update_analysis
# Phase 3
I used values.yaml for creating the resources

226
helm-charts-observability/charts/data-prepper/template.yaml Normal file
View File

@@ -0,0 +1,226 @@
---
# Source: data-prepper/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: data-prepper
labels:
helm.sh/chart: data-prepper-0.3.1
app.kubernetes.io/name: data-prepper
app.kubernetes.io/instance: data-prepper
app.kubernetes.io/version: "2.8.0"
app.kubernetes.io/managed-by: Helm
automountServiceAccountToken: true
---
# Source: data-prepper/templates/secret.yaml
apiVersion: v1
kind: Secret
metadata:
name: data-prepper-pipeline
labels:
helm.sh/chart: data-prepper-0.3.1
app.kubernetes.io/name: data-prepper
app.kubernetes.io/instance: data-prepper
app.kubernetes.io/version: "2.8.0"
app.kubernetes.io/managed-by: Helm
type: Opaque
stringData:
pipelines.yaml: |
cpanel-log-pipeline:
buffer:
bounded_blocking:
batch_size: 128
buffer_size: 2048
delay: 10
sink:
- opensearch:
cert: /usr/share/dataprepper/cert/root-ca.pem
hosts:
- https://brilliant-opensearch-cluster-master:9200
index: cpanel-test-%{yyyy.MM.dd}
index_type: custom
insecure: false
password: ${LOGGER_PASSWORD}
username: logger
source:
http:
path: /logs
ssl: false
workers: 2
---
# Source: data-prepper/templates/configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: data-prepper-config
labels:
helm.sh/chart: data-prepper-0.3.1
app.kubernetes.io/name: data-prepper
app.kubernetes.io/instance: data-prepper
app.kubernetes.io/version: "2.8.0"
app.kubernetes.io/managed-by: Helm
data:
data-prepper-config.yaml: |
ssl: false
# circuit_breakers:
# heap:
# usage: 2gb
# reset: 30s
# check_interval: 5s
log4j2-rolling.properties: |
#
# Copyright OpenSearch Contributors
# SPDX-License-Identifier: Apache-2.0
#
status = error
dest = err
name = PropertiesConfig
property.filename = log/data-prepper/data-prepper.log
appender.console.type = Console
appender.console.name = STDOUT
appender.console.layout.type = PatternLayout
appender.console.layout.pattern = %d{ISO8601} [%t] %-5p %40C - %m%n
appender.rolling.type = RollingFile
appender.rolling.name = RollingFile
appender.rolling.fileName = ${filename}
appender.rolling.filePattern = logs/data-prepper.log.%d{MM-dd-yy-HH}-%i.gz
appender.rolling.layout.type = PatternLayout
appender.rolling.layout.pattern = %d{ISO8601} [%t] %-5p %40C - %m%n
appender.rolling.policies.type = Policies
appender.rolling.policies.time.type = TimeBasedTriggeringPolicy
appender.rolling.policies.time.interval = 1
appender.rolling.policies.time.modulate = true
appender.rolling.policies.size.type = SizeBasedTriggeringPolicy
appender.rolling.policies.size.size=100MB
appender.rolling.strategy.type = DefaultRolloverStrategy
appender.rolling.strategy.max = 168
rootLogger.level = warn
rootLogger.appenderRef.stdout.ref = STDOUT
rootLogger.appenderRef.file.ref = RollingFile
logger.pipeline.name = org.opensearch.dataprepper.pipeline
logger.pipeline.level = info
logger.parser.name = org.opensearch.dataprepper.parser
logger.parser.level = info
logger.plugins.name = org.opensearch.dataprepper.plugins
logger.plugins.level = info
---
# Source: data-prepper/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
name: data-prepper
labels:
helm.sh/chart: data-prepper-0.3.1
app.kubernetes.io/name: data-prepper
app.kubernetes.io/instance: data-prepper
app.kubernetes.io/version: "2.8.0"
app.kubernetes.io/managed-by: Helm
spec:
type: ClusterIP
ports:
- name: http-source
port: 2021
targetPort: 2021
protocol: TCP
selector:
app.kubernetes.io/name: data-prepper
app.kubernetes.io/instance: data-prepper
---
# Source: data-prepper/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: data-prepper
labels:
helm.sh/chart: data-prepper-0.3.1
app.kubernetes.io/name: data-prepper
app.kubernetes.io/instance: data-prepper
app.kubernetes.io/version: "2.8.0"
app.kubernetes.io/managed-by: Helm
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/name: data-prepper
app.kubernetes.io/instance: data-prepper
template:
metadata:
annotations:
checksum/config: d9f25a6756b9ae068c1ec208e538bfd4708057961af4ababf7abb949f2458ac
checksum/pipelineconfig: 2166ddb3315ca7f85e5ee3ab3ebee0ede10992fb0882d771a2f9b9d9188f5df
labels:
helm.sh/chart: data-prepper-0.3.1
app.kubernetes.io/name: data-prepper
app.kubernetes.io/instance: data-prepper
app.kubernetes.io/version: "2.8.0"
app.kubernetes.io/managed-by: Helm
spec:
serviceAccountName: data-prepper
securityContext:
{}
containers:
- name: data-prepper
env:
- name: LOGGER_PASSWORD
valueFrom:
secretKeyRef:
key: logger
secretName: prepper-creds
securityContext:
{}
image: "opensearchproject/data-prepper:2.8.0"
imagePullPolicy: IfNotPresent
ports:
- name: http-source
containerPort: 2021
protocol: TCP
- name: server
containerPort: 4900
protocol: TCP
livenessProbe:
httpGet:
path: /list
port: server
periodSeconds: 10
initialDelaySeconds: 60
failureThreshold: 2
readinessProbe:
httpGet:
path: /list
port: server
resources:
limits:
cpu: 4
memory: 6Gi
requests:
cpu: 2
memory: 4Gi
volumeMounts:
- name: data-prepper-config
mountPath: /usr/share/data-prepper/config
readOnly: true
- name: data-prepper-pipelines
mountPath: /usr/share/data-prepper/pipelines
readOnly: true
- mountPath: /usr/share/dataprepper/cert
name: root-ca
readOnly: true
volumes:
- name: data-prepper-config
configMap:
name: data-prepper-config
- name: data-prepper-pipelines
secret:
secretName: data-prepper-pipeline
- name: root-ca
secret:
secretName: opensearch-dashboard-ca

30
helm-charts-observability/charts/data-prepper/templates/NOTES.txt Normal file
View File

@@ -0,0 +1,30 @@
1. Get the application URL by running these commands:
{{- if .Values.ingress.enabled }}
{{- range $host := .Values.ingress.hosts }}
{{- range .paths }}
http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
{{- end }}
{{- end }}
{{- else if contains "NodePort" .Values.service.type }}
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "data-prepper.fullname" . }})
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
echo http://$NODE_IP:$NODE_PORT
{{- else if contains "LoadBalancer" .Values.service.type }}
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
You can watch its status by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "data-prepper.fullname" . }}'
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "data-prepper.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
echo http://$SERVICE_IP:{{ .Values.service.port }}
{{- else if contains "ClusterIP" .Values.service.type }}
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "data-prepper.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
echo "Visit http://127.0.0.1:8080 to use your application"
kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
{{- end }}
{{- if eq "true" (include "data-prepper.demoPipeline" .) }}
The demo pipeline configuration is enabled, using the `random` source and `stdout` sink.
{{- else if .Values.pipelineConfig.enabled }}
Inline pipeline configuration is enabled. Please refer to the values.yaml file for the configuration.
{{- else }}
Pipeline configuration from secret {{ .Values.pipelineConfig.existingSecret }} is enabled.
{{- end }}

95
helm-charts-observability/charts/data-prepper/templates/_helpers.tpl Normal file
View File

@@ -0,0 +1,95 @@
{{/*
Expand the name of the chart.
*/}}
{{- define "data-prepper.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "data-prepper.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- $name := default .Chart.Name .Values.nameOverride }}
{{- if contains $name .Release.Name }}
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
{{- end }}
{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "data-prepper.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Common labels
*/}}
{{- define "data-prepper.labels" -}}
helm.sh/chart: {{ include "data-prepper.chart" . }}
{{ include "data-prepper.selectorLabels" . }}
{{- if .Chart.AppVersion }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- end }}
{{/*
Selector labels
*/}}
{{- define "data-prepper.selectorLabels" -}}
app.kubernetes.io/name: {{ include "data-prepper.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}
{{/*
Create the name of the service account to use
*/}}
{{- define "data-prepper.serviceAccountName" -}}
{{- if .Values.serviceAccount.create }}
{{- default (include "data-prepper.fullname" .) .Values.serviceAccount.name }}
{{- else }}
{{- default "default" .Values.serviceAccount.name }}
{{- end }}
{{- end }}
{{/*
Create the dockerRegistry prefix if defined
*/}}
{{- define "data-prepper.dockerRegistry" -}}
{{- if eq .Values.global.dockerRegistry "" -}}
{{- .Values.global.dockerRegistry -}}
{{- else -}}
{{- .Values.global.dockerRegistry | trimSuffix "/" | printf "%s/" -}}
{{- end -}}
{{- end -}}
{{/*
Utility to decide whether demoPipeline should be enabled.
If pipelineConfig.demoPipeline is true/false, return that value.
If pipelineConfig.demoPipeline is undefined, return true if no other pipeline is configured.
*/}}
{{- define "data-prepper.demoPipeline" -}}
{{- $demoPipeline := .Values.pipelineConfig.demoPipeline | toString -}}
{{- if eq $demoPipeline "true" -}}
{{ true }}
{{- else if eq $demoPipeline "false" -}}
{{ false }}
{{- else if or (not $demoPipeline) (eq $demoPipeline "") -}}
{{- if and (not .Values.pipelineConfig.enabled) (not .Values.pipelineConfig.existingSecret) -}}
{{ true }}
{{- else -}}
{{ false }}
{{- end -}}
{{- else -}}
{{ false }}
{{- end -}}
{{- end -}}

15
helm-charts-observability/charts/data-prepper/templates/configmap.yaml Normal file
View File

@@ -0,0 +1,15 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "data-prepper.fullname" . }}-config
labels:
{{- include "data-prepper.labels" . | nindent 4 }}
data:
{{- range $configName, $configYaml := .Values.config }}
{{ $configName }}: |
{{- if eq (kindOf $configYaml) "map" }}
{{- tpl (toYaml $configYaml) $ | nindent 4 }}
{{- else }}
{{- tpl $configYaml $ | nindent 4 -}}
{{- end -}}
{{- end -}}

25
helm-charts-observability/charts/data-prepper/templates/demoPipeline.yaml Normal file
View File

@@ -0,0 +1,25 @@
{{- if eq "true" (include "data-prepper.demoPipeline" .) }}
apiVersion: v1
kind: Secret
metadata:
name: {{ include "data-prepper.fullname" . }}-demo-pipeline
labels:
{{- include "data-prepper.labels" . | nindent 4 }}
type: Opaque
stringData:
pipelines.yaml: |
simple-sample-pipeline:
workers: 2 # the number of workers
delay: 5000 # in milliseconds, how long workers wait between read attempts
source:
random: {}
buffer:
bounded_blocking:
buffer_size: 1024 # max number of records the buffer accepts
batch_size: 256 # max number of records the buffer drains after each read
processor:
- string_converter:
upper_case: true
sink:
- stdout: {}
{{- end }}

118
helm-charts-observability/charts/data-prepper/templates/deployment.yaml Normal file
View File

@@ -0,0 +1,118 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ include "data-prepper.fullname" . }}
labels:
{{- include "data-prepper.labels" . | nindent 4 }}
spec:
{{- if not .Values.autoscaling.enabled }}
replicas: {{ .Values.replicaCount }}
{{- end }}
selector:
matchLabels:
{{- include "data-prepper.selectorLabels" . | nindent 6 }}
template:
metadata:
annotations:
{{- with .Values.podAnnotations }}
{{- toYaml . | nindent 8 }}
{{- end }}
{{- if .Values.config }}
checksum/config: {{ include (print .Template.BasePath "/configmap.yaml") . | sha256sum | trunc 63 }}
{{- end }}
{{- if .Values.pipelineConfig.enabled }}
checksum/pipelineconfig: {{ include (print .Template.BasePath "/secret.yaml") . | sha256sum | trunc 63 }}
{{- end }}
labels:
{{- include "data-prepper.labels" . | nindent 8 }}
{{- with .Values.podLabels }}
{{- toYaml . | nindent 8 }}
{{- end }}
spec:
{{- with .Values.imagePullSecrets }}
imagePullSecrets:
{{- toYaml . | nindent 8 }}
{{- end }}
serviceAccountName: {{ include "data-prepper.serviceAccountName" . }}
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
containers:
- name: {{ .Chart.Name }}
env:
{{- with .Values.extraEnvs }}
{{- toYaml . | nindent 12 }}
{{- end }}
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
image: "{{ template "data-prepper.dockerRegistry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
imagePullPolicy: {{ .Values.image.pullPolicy }}
ports:
{{- range .Values.ports }}
- name: {{ .name }}
containerPort: {{ .port }}
protocol: TCP
{{- end }}
- name: server
containerPort: {{ (.Values.config).serverPort | default 4900 }}
protocol: TCP
livenessProbe:
httpGet:
path: /list
port: server
{{- if not ( empty (.Values.config).ssl ) }}
scheme: HTTPS
{{- end }}
periodSeconds: 10
initialDelaySeconds: 60
failureThreshold: 2
readinessProbe:
httpGet:
path: /list
port: server
{{- if not ( empty (.Values.config).ssl ) }}
scheme: HTTPS
{{- end }}
resources:
{{- toYaml .Values.resources | nindent 12 }}
volumeMounts:
- name: data-prepper-config
mountPath: /usr/share/data-prepper/config
readOnly: true
- name: data-prepper-pipelines
mountPath: /usr/share/data-prepper/pipelines
readOnly: true
{{- with .Values.volumeMounts }}
{{- toYaml . | nindent 12 }}
{{- end }}
volumes:
- name: data-prepper-config
configMap:
name: {{ include "data-prepper.fullname" . }}-config
- name: data-prepper-pipelines
secret:
{{- if eq "true" (include "data-prepper.demoPipeline" .) }}
secretName: {{ include "data-prepper.fullname" . }}-demo-pipeline
{{- else if .Values.pipelineConfig.enabled }}
secretName: {{ include "data-prepper.fullname" . }}-pipeline
{{- else }}
secretName: {{ required "A valid pipeline configuration is required! Please set one of:\npipelineConfig.existingSecret - for your custom pipeline secret\npipelineConfig.enabled - for inline configuration in values.yaml or\npipelineConfig.demoPipeline=true - for a sample demo pipeline using random source and stdout sink." .Values.pipelineConfig.existingSecret }}
{{- end }}
{{- with .Values.volumes }}
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.nodeSelector }}
nodeSelector:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.affinity }}
affinity:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.tolerations }}
tolerations:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.initContainers }}
initContainers:
{{- toYaml . | nindent 8 }}
{{- end }}

32
helm-charts-observability/charts/data-prepper/templates/hpa.yaml Normal file
View File

@@ -0,0 +1,32 @@
{{- if .Values.autoscaling.enabled }}
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
name: {{ include "data-prepper.fullname" . }}
labels:
{{- include "data-prepper.labels" . | nindent 4 }}
spec:
scaleTargetRef:
apiVersion: apps/v1
kind: Deployment
name: {{ include "data-prepper.fullname" . }}
minReplicas: {{ .Values.autoscaling.minReplicas }}
maxReplicas: {{ .Values.autoscaling.maxReplicas }}
metrics:
{{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
- type: Resource
resource:
name: cpu
target:
type: Utilization
averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
{{- end }}
{{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
- type: Resource
resource:
name: memory
target:
type: Utilization
averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
{{- end }}
{{- end }}

61
helm-charts-observability/charts/data-prepper/templates/ingress.yaml Normal file
View File

@@ -0,0 +1,61 @@
{{- if .Values.ingress.enabled -}}
{{- $fullName := include "data-prepper.fullname" . -}}
{{- $svcPort := .Values.service.port -}}
{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
{{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }}
{{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}}
{{- end }}
{{- end }}
{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
apiVersion: networking.k8s.io/v1
{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
apiVersion: networking.k8s.io/v1beta1
{{- else -}}
apiVersion: extensions/v1beta1
{{- end }}
kind: Ingress
metadata:
name: {{ $fullName }}
labels:
{{- include "data-prepper.labels" . | nindent 4 }}
{{- with .Values.ingress.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
{{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
ingressClassName: {{ .Values.ingress.className }}
{{- end }}
{{- if .Values.ingress.tls }}
tls:
{{- range .Values.ingress.tls }}
- hosts:
{{- range .hosts }}
- {{ . | quote }}
{{- end }}
secretName: {{ .secretName }}
{{- end }}
{{- end }}
rules:
{{- range .Values.ingress.hosts }}
- host: {{ .host | quote }}
http:
paths:
{{- range .paths }}
- path: {{ .path }}
{{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }}
pathType: {{ .pathType }}
{{- end }}
backend:
{{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
service:
name: {{ $fullName }}
port:
number: {{ $svcPort }}
{{- else }}
serviceName: {{ $fullName }}
servicePort: {{ $svcPort }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}

12
helm-charts-observability/charts/data-prepper/templates/secret.yaml Normal file
View File

@@ -0,0 +1,12 @@
{{- if .Values.pipelineConfig.enabled }}
apiVersion: v1
kind: Secret
metadata:
name: {{ include "data-prepper.fullname" . }}-pipeline
labels:
{{- include "data-prepper.labels" . | nindent 4 }}
type: Opaque
stringData:
pipelines.yaml: |
{{- toYaml .Values.pipelineConfig.config | nindent 4 }}
{{- end }}

17
helm-charts-observability/charts/data-prepper/templates/service.yaml Normal file
View File

@@ -0,0 +1,17 @@
apiVersion: v1
kind: Service
metadata:
name: {{ include "data-prepper.fullname" . }}
labels:
{{- include "data-prepper.labels" . | nindent 4 }}
spec:
type: {{ .Values.service.type }}
ports:
{{- range .Values.ports }}
- name: {{ .name }}
port: {{ .port }}
targetPort: {{ .port }}
protocol: TCP
{{- end }}
selector:
{{- include "data-prepper.selectorLabels" . | nindent 4 }}

13
helm-charts-observability/charts/data-prepper/templates/serviceaccount.yaml Normal file
View File

@@ -0,0 +1,13 @@
{{- if .Values.serviceAccount.create -}}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "data-prepper.serviceAccountName" . }}
labels:
{{- include "data-prepper.labels" . | nindent 4 }}
{{- with .Values.serviceAccount.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
automountServiceAccountToken: {{ .Values.serviceAccount.automount }}
{{- end }}

360
helm-charts-observability/charts/data-prepper/values.yaml Normal file
View File

@@ -0,0 +1,360 @@
# Copyright OpenSearch Contributors
# SPDX-License-Identifier: Apache-2.0
# Default values for data-prepper.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.
replicaCount: 1
global:
# Set if you want to change the default docker registry, e.g. a private one.
dockerRegistry: ""
image:
# -- The image repository from which to pull the Data Prepper image
repository: opensearchproject/data-prepper
# -- The image tag to pull. Default: IfNotPresent
pullPolicy: IfNotPresent
# -- Overrides the image tag whose default is the chart appVersion.
tag: ""
# -- List of imagePullSecrets to use if the Docker image is stored in a private registry
imagePullSecrets: []
# -- Override the default name for the deployment
nameOverride: ""
# -- Override the default fullname for the deployment
fullnameOverride: ""
# -- Extra environment variables to pass to the Data Prepper container
extraEnvs:
# - name: "JAVA_OPTS"
# value: "-Dlog4j2.debug=true"
- name: "LOGGER_PASSWORD"
valueFrom:
secretKeyRef:
name: prepper-creds
key: logger
# Check https://opensearch.org/docs/latest/data-prepper/managing-data-prepper/configuring-data-prepper/
# for more information on the configuration options
# -- Data Prepper configuration
config:
# -- Main Data Prepper configuration file content
data-prepper-config.yaml: |
ssl: false
# circuit_breakers:
# heap:
# usage: 2gb
# reset: 30s
# check_interval: 5s
# -- Log4j2 configuration for Data Prepper logging
log4j2-rolling.properties: |
#
# Copyright OpenSearch Contributors
# SPDX-License-Identifier: Apache-2.0
#
status = error
dest = err
name = PropertiesConfig
property.filename = log/data-prepper/data-prepper.log
appender.console.type = Console
appender.console.name = STDOUT
appender.console.layout.type = PatternLayout
appender.console.layout.pattern = %d{ISO8601} [%t] %-5p %40C - %m%n
appender.rolling.type = RollingFile
appender.rolling.name = RollingFile
appender.rolling.fileName = ${filename}
appender.rolling.filePattern = logs/data-prepper.log.%d{MM-dd-yy-HH}-%i.gz
appender.rolling.layout.type = PatternLayout
appender.rolling.layout.pattern = %d{ISO8601} [%t] %-5p %40C - %m%n
appender.rolling.policies.type = Policies
appender.rolling.policies.time.type = TimeBasedTriggeringPolicy
appender.rolling.policies.time.interval = 1
appender.rolling.policies.time.modulate = true
appender.rolling.policies.size.type = SizeBasedTriggeringPolicy
appender.rolling.policies.size.size=100MB
appender.rolling.strategy.type = DefaultRolloverStrategy
appender.rolling.strategy.max = 168
rootLogger.level = warn
rootLogger.appenderRef.stdout.ref = STDOUT
rootLogger.appenderRef.file.ref = RollingFile
logger.pipeline.name = org.opensearch.dataprepper.pipeline
logger.pipeline.level = info
logger.parser.name = org.opensearch.dataprepper.parser
logger.parser.level = info
logger.plugins.name = org.opensearch.dataprepper.plugins
logger.plugins.level = info
# For OpenSearch Data Prepper is crucial for defining the behavior and structure of your data processing pipelines.
# Each pipeline is defined with a unique name and can include `source`, `processor`, and `sink` components to ingest,
# process, and output data respectively. This flexible configuration allows for the creation of complex data processing
# flows, including the routing of data between pipelines.
# For detailed information on the available options and to get the most up-to-date guidance on configuring `pipeline.yaml`,
# please consult the [OpenSearch Documentation on Pipelines](https://opensearch.org/docs/2.4/data-prepper/pipelines/pipelines/).
# This resource provides comprehensive examples and explanations of each component, ensuring you can tailor your Data Prepper
# deployment to meet your specific data processing needs.
# -- Pipeline configuration
pipelineConfig:
# If 'true', a secret containing a demo pipeline configuration with random source and stdout sink will be created.
# If left undefined, the demo pipeline will be used only when no other pipeline is configured below
demoPipeline: ""
# -- The name of the existing secret containing the pipeline configuration.
# If enabled is false existingSecret is used. The existingSecret must have a key named `pipelines.yaml`.
existingSecret: ""
# If enabled, a secret containing the pipeline configuration will be created based on the 'config' section below.
enabled: true
# The configuration of the pipeline see https://opensearch.org/docs/2.4/data-prepper/pipelines/pipelines/
config:
## Provide your pipeline configuration here if 'enabled' is set to true. See documentation for more advanced pipelines
# simple-sample-pipeline:
# workers: 2 # the number of workers
# delay: 5000 # in milliseconds, how long workers wait between read attempt
cpanel-log-router:
workers: 2
delay: 100
source:
http:
path: /logs
ssl: false
port: 2021
buffer:
bounded_blocking:
buffer_size: 2048
batch_size: 128
route:
- systemLog : '/log_source == "system.syslog"'
- accessLog : '/log_source == "cpanel.access_log"'
- auditLog : '/log_source == "audit.audit.log"'
sink:
- pipeline:
name: cpanel-access-pipeline
routes:
- accessLog
- pipeline:
name: cpanel-system-syslog-pipeline
routes:
- systemLog
- pipeline:
name: cpanel-audit-pipeline
- pipeline:
name: cpanel-all-log
cpanel-access-pipeline:
source:
pipeline:
name: cpanel-log-router
processor:
- grok:
break_on_match: false
match:
log:
- '^%{IP:client_ip} %{NOTSPACE:identity} %{NOTSPACE:user} \[%{GREEDYDATA:timestamp}\] "%{WORD:method} %{URIPATHPARAM:url} HTTP/%{NUMBER:http_version}" %{INT:http_status:int} %{NONNEGINT:bytes:long} "%{NOTSPACE:referrer}" "%{GREEDYDATA:user_agent}" "%{NOTSPACE:auth_method}" "%{GREEDYDATA:x_forwarded_for}" %{POSINT:service_port:int}$'
target_key: parsed
- date:
match:
- key: /parsed/timestamp
patterns:
- "MM/dd/yyyy:HH:mm:ss Z"
destination: "@timestamp"
sink:
- opensearch:
hosts:
- "https://brilliant-opensearch-cluster-master:9200"
insecure: false
username: logger
password: "Enp129s0f0-l0gin"
index_type: custom
cert: /usr/share/dataprepper/cert/root-ca.pem
index: cpanel-access-log-%{yyyy.MM.dd}
cpanel-system-syslog-pipeline:
source:
pipeline:
name: cpanel-log-router
processor:
- drop_events:
drop_when: '/log_source != "system.syslog"'
- grok:
break_on_match: false
match:
log:
- '^%{TIMESTAMP_ISO8601:timestamp} %{NOTSPACE:hostname} %{DATA:process}\[(?:%{POSINT:pid})\]: %{GREEDYDATA:message}$'
target_key: parsed
sink:
- opensearch:
hosts:
- "https://brilliant-opensearch-cluster-master:9200"
insecure: false
username: logger
password: "Enp129s0f0-l0gin"
index_type: custom
cert: /usr/share/dataprepper/cert/root-ca.pem
index: cpanel-system-syslog-%{yyyy.MM.dd}
cpanel-audit-pipeline:
source:
pipeline:
name: cpanel-log-router
processor:
- drop_events:
drop_when: '/log_source != "audit.audit.log"'
sink:
- opensearch:
hosts:
- "https://brilliant-opensearch-cluster-master:9200"
insecure: false
username: logger
password: "Enp129s0f0-l0gin"
index_type: custom
cert: /usr/share/dataprepper/cert/root-ca.pem
index: cpanel-audit-log-%{yyyy.MM.dd}
cpanel-all-log:
source:
pipeline:
name: cpanel-log-router
sink:
- opensearch:
hosts:
- "https://brilliant-opensearch-cluster-master:9200"
insecure: false
username: logger
password: "Enp129s0f0-l0gin"
index_type: custom
cert: /usr/share/dataprepper/cert/root-ca.pem
index: cpanel-all-log-%{yyyy.MM.dd}
# -- Data Prepper ports
ports:
# -- The port that the source is running on. Default value is 2021. Valid options are between 0 and 65535.
# https://opensearch.org/docs/latest/data-prepper/pipelines/configuration/sources/http-source/
- name: http-source
port: 2021
# # -- The port that the otel_trace_source source runs on. Default value is 21890.
# # https://opensearch.org/docs/latest/data-prepper/pipelines/configuration/sources/otel-trace-source/
# - name: otel-traces
# port: 21890
# # -- The port that the OpenTelemtry metrics source runs on. Default value is 21891.
# # https://opensearch.org/docs/latest/data-prepper/pipelines/configuration/sources/otel-metrics-source/
# - name: otel-metrics
# port: 21891
# # -- Represents the port that the otel_logs_source source is running on. Default value is 21892.
# # https://opensearch.org/docs/latest/data-prepper/pipelines/configuration/sources/otel-logs-source/
# - name: otel-logs
# port: 21892
serviceAccount:
# -- Specifies whether a service account should be created
create: true
# -- Automatically mount a ServiceAccount's API credentials?
automount: true
# -- Annotations to add to the service account
annotations: {}
# -- The name of the service account to use.
# If not set and create is true, a name is generated using the fullname template
name: ""
podAnnotations: {}
podLabels: {}
podSecurityContext: {}
# fsGroup: 2000
securityContext: {}
# capabilities:
# drop:
# - ALL
# readOnlyRootFilesystem: true
# runAsNonRoot: true
# runAsUser: 1000
initContainers: []
service:
type: ClusterIP
port: 2021
ingress:
enabled: false
className: "nginx"
annotations:
kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: "true"
hosts:
- paths:
- path: /logs
pathType: Prefix
tls: []
# - secretName: chart-example-tls
# hosts:
# - chart-example.local
resources:
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
# resources, such as Minikube. If you do want to specify resources, uncomment the following
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
limits:
cpu: 4
memory: 6Gi
requests:
cpu: 2
memory: 4Gi
autoscaling:
# done for testing, in production this will be true
enabled: false
minReplicas: 1
maxReplicas: 100
targetCPUUtilizationPercentage: 75
targetMemoryUtilizationPercentage: 75
# Additional volumes on the output Deployment definition.
volumes:
- name: root-ca
secret:
secretName: opensearch-dashboard-ca
# - name: foo
# secret:
# secretName: mysecret
# optional: false
# Additional volumeMounts on the output Deployment definition.
volumeMounts:
- name: root-ca
readOnly: true
mountPath: /usr/share/dataprepper/cert
# - name: foo
# mountPath: "/etc/foo"
# readOnly: true
nodeSelector: {}
tolerations: []
affinity: {}

23
helm-charts-observability/charts/opensearch-dashboards/.helmignore Normal file
View File

@@ -0,0 +1,23 @@
# Patterns to ignore when building packages.
# This supports shell glob matching, relative path matching, and
# negation (prefixed with !). Only one pattern per line.
.DS_Store
# Common VCS dirs
.git/
.gitignore
.bzr/
.bzrignore
.hg/
.hgignore
.svn/
# Common backup files
*.swp
*.bak
*.tmp
*.orig
*~
# Various IDEs
.project
.idea/
*.tmproj
.vscode/

117
helm-charts-observability/charts/opensearch-dashboards/CHANGELOG.md Normal file
View File

@@ -0,0 +1,117 @@
# Changelog
All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
---
## [Unreleased]
### Added
### Changed
### Deprecated
### Removed
### Fixed
### Security
---
## [3.7.0]
### Added
- Updated OpenSearch Dashboards appVersion to 3.7.0
### Changed
### Deprecated
### Removed
### Fixed
### Security
---
## [3.6.0]
### Added
- Updated OpenSearch Dashboards appVersion to 3.6.0
### Changed
### Deprecated
### Removed
### Fixed
### Security
---
## [3.5.0]
### Added
- Updated OpenSearch Dashboards appVersion to 3.5.0
### Changed
### Deprecated
### Removed
### Fixed
### Security
---
## [3.4.0]
### Added
- Updated OpenSearch Dashboards appVersion to 3.4.0
### Changed
### Deprecated
### Removed
### Fixed
### Security
---
## [3.3.0]
### Added
- Updated OpenSearch Dashboards appVersion to 3.3.0
### Changed
### Deprecated
### Removed
### Fixed
### Security
---
## [3.2.2]
### Added
- Support for disabling automountServiceAccountToken
### Changed
### Deprecated
### Removed
### Fixed
### Security
---
## [3.2.1]
### Added
### Changed
- Correct changelogs
### Deprecated
### Removed
### Fixed
### Security
---
## [3.2.0]
### Added
- Updated OpenSearch Dashboards appVersion to 3.2.0
### Changed
### Deprecated
### Removed
### Fixed
### Security
---
## [3.1.0]
### Added
- Updated OpenSearch Dashboards appVersion to 3.1.0
### Changed
### Deprecated
### Removed
### Fixed
### Security
---
## [3.0.0]
### Added
- Switch main branch to be 3.x with 3.0.0 as 1st release
### Changed
### Deprecated
### Removed
### Fixed
### Security
[Unreleased]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-3.7.0...HEAD
[3.7.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-3.6.0...opensearch-dashboards-3.7.0
[3.6.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-3.5.0...opensearch-dashboards-3.6.0
[3.5.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-3.4.0...opensearch-dashboards-3.5.0
[3.4.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-3.3.0...opensearch-dashboards-3.4.0
[3.3.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-3.2.2...opensearch-dashboards-3.3.0
[3.2.2]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-3.2.1...opensearch-dashboards-3.2.2
[3.2.1]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-3.2.0...opensearch-dashboards-3.2.1
[3.2.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-3.1.0...opensearch-dashboards-3.2.0
[3.1.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-3.0.0...opensearch-dashboards-3.1.0
[3.0.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-2.29.0...opensearch-dashboards-3.0.0

31
helm-charts-observability/charts/opensearch-dashboards/Chart.yaml Normal file
View File

@@ -0,0 +1,31 @@
apiVersion: v2
name: opensearch-dashboards
description: A Helm chart for OpenSearch Dashboards
# A chart can be either an 'application' or a 'library' chart.
#
# Application charts are a collection of templates that can be packaged into versioned archives
# to be deployed.
#
# Library charts provide useful utilities or functions for the chart developer. They're included as
# a dependency of application charts to inject those utilities and functions into the rendering
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
type: application
# This is the chart version. This version number should be incremented each time you make changes
# to the chart and its templates, including the app version.
# Versions are expected to follow Semantic Versioning (https://semver.org/)
version: 3.7.0
# This is the version number of the application being deployed. This version number should be
# incremented each time you make changes to the application. Versions are not expected to
# follow Semantic Versioning. They should reflect the version the application is using.
# It is recommended to use it with quotes.
appVersion: "3.7.0"
maintainers:
- name: DandyDeveloper
- name: gaiksaya
- name: peterzhuamazon
- name: prudhvigodithi
- name: TheAlgo

141
helm-charts-observability/charts/opensearch-dashboards/README.md Normal file
View File

@@ -0,0 +1,141 @@
# OpenSearch Dashboards Helm Chart
This Helm chart installs [OpenSearch Dashboards](https://github.com/opensearch-project/OpenSearch-Dashboards) with configurable TLS, RBAC and much more configurations. This chart caters to a number of different use cases and setups.
- [Requirements](#requirements)
- [Installing](#installing)
- [Uninstalling](#uninstalling)
## Requirements
- Kubernetes >= 1.14
- Helm >= 2.17.0
- We recommend you to have 8 GiB of memory available for this deployment, or at least 4 GiB for the minimum requirement. Else, the deployment is expected to fail.
## Installing
Once you've added this Helm repository as per the repository-level [README](../../README.md#installing)
then you can install the chart as follows:
```shell
helm install my-release opensearch/opensearch-dashboards
```
The command deploys OpenSearch Dashboards with its associated components on the Kubernetes cluster in the default configuration.
**NOTE:** If using Helm 2 then you'll need to add the [`--name`](https://v2.helm.sh/docs/helm/#options-21) command line argument. If unspecified, Helm 2 will autogenerate a name for you.
## Uninstalling
To delete/uninstall the chart with the release name `my-release`:
```shell
helm uninstall my-release
```
## Configuration
| Parameter | Description | Default |
| :--- | :--- | :--- |
| `envFrom` | Templatable string to be passed to the [environment from variables][] which will be appended to the `envFrom:` definition for the container | `[]` |
| `config` | Allows you to add any config files in `/usr/share/opensearch-dashboards/` such as `opensearch_dashboards.yml`. String or map format may be used for specifying content of each configuration file. In case of string format, the whole content of the config file will be replaced by new config file value when in case of using map format content of configuration file will be a result of merge. In both cases content passed through tpl. See [values.yaml][] for an example of the formatting | `{}` |
| `extraContainers` | Array of extra containers | `""` |
| `extraEnvs` | Extra environments variables to be passed to OpenSearch services | `[]` |
| `extraInitContainers` | Array of extra init containers | `[]` |
| `extraVolumeMounts` | Array of extra volume mounts | `[]` |
| `extraVolumes` | Array of extra volumes to be added | `[]` |
| `fullnameOverride` | Overrides the `clusterName` and `nodeGroup` when used in the naming of resources. This should only be used when using a single `nodeGroup`, otherwise you will have name conflicts | `""` |
| `hostAliases` | Configurable [hostAliases][] | `[]` |
| `image.pullPolicy` | The Kubernetes [imagePullPolicy][] value | `IfNotPresent` |
| `imagePullSecrets` | Configuration for [imagePullSecrets][] so that you can use a private registry for your image | `[]` |
| `image.tag` | The OpenSearch Docker image tag | `1.0.0` |
| `image.repository` | The OpenSearch Docker image | `opensearchproject/opensearch` |
| `ingress` | Configurable [ingress][] to expose the OpenSearch service. See [values.yaml][] for an example | see [values.yaml][] |
| `labels` | Configurable [labels][] applied to all OpenSearch pods | `{}` |
| `lifecycle` | Allows you to add [lifecycle hooks](https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/). See [values.yaml][] for an example | `{}` |
| `nameOverride` | Overrides the `clusterName` when used in the naming of resources | `""` |
| `nodeSelector` | Configurable [nodeSelector][] so that you can target specific nodes for your OpenSearch cluster | `{}` |
| `podAnnotations` | Configurable [annotations][] applied to all OpenSearch pods | `{}` |
| `podSecurityContext` | Allows you to set the [securityContext][] for the pod | see [values.yaml][] |
| `priorityClassName` | The name of the [PriorityClass][]. No default is supplied as the PriorityClass must be created first | `""` |
| `rbac` | Configuration for creating a role, role binding and ServiceAccount as part of this Helm chart with `create: true`. Also can be used to reference an external ServiceAccount with `serviceAccountName: "externalServiceAccountName"` | see [values.yaml][] |
| `resources` | Allows you to set the [resources][] for the StatefulSet | see [values.yaml][] |
| `secretMounts` | Allows you easily mount a secret as a file inside the StatefulSet. Useful for mounting certificates and other secrets. See [values.yaml][] for an example | `[]` |
| `securityContext` | Allows you to set the [securityContext][] for the container | see [values.yaml][] |
| `service.annotations` | [LoadBalancer annotations][] that Kubernetes will use for the service. This will configure load balancer if `service.type` is `LoadBalancer` | `{}` |
| `service.headless.annotations` | Allow you to set annotations on the headless service | `{}` |
| `service.externalTrafficPolicy` | Some cloud providers allow you to specify the [LoadBalancer externalTrafficPolicy][]. Kubernetes will use this to preserve the client source IP. This will configure load balancer if `service.type` is `LoadBalancer` | `""` |
| `service.httpPortName` | The name of the http port within the service | `http` |
| `service.labelsHeadless` | Labels to be added to headless service | `{}` |
| `service.labels` | Labels to be added to non-headless service | `{}` |
| `service.loadBalancerIP` | Some cloud providers allow you to specify the [loadBalancer][] IP. If the `loadBalancerIP` field is not specified, the IP is dynamically assigned. If you specify a `loadBalancerIP` but your cloud provider does not support the feature, it is ignored. | `""` |
| `service.loadBalancerSourceRanges` | The IP ranges that are allowed to access | `[]` |
| `service.nodePort` | Custom [nodePort][] port that can be set if you are using `service.type: nodePort` | `""` |
| `service.transportPortName` | The name of the transport port within the service | `transport` |
| `service.type` | OpenSearch [Service Types][] | `ClusterIP` |
| `service.ipFamilyPolicy` | This sets the preferred ip addresses in case of a dual-stack server, there are three options [PreferDualStack, SingleStack, RequireDualStack], [more information on dual stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/) | `""` |
| `service.ipFamilies` | Sets the preferred IP variants and in which order they are preferred, the first family you list is used for the legacy .spec.ClusterIP field, [more information on dual stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/) | `""` |
| `service.metricsPort` | The metrics port (for Performance Analyzer) that Kubernetes will use for the service. | `9601` |
| `service.metricsPortName` | The name of the metrics port (for Performance Analyzer) within the service | `metrics` |
| `serviceAccount.automountServiceAccountToken` | Specifies whether the Kubernetes API token for the ServiceAccount should be automatically mounted to the pod. | `true` |
| `tolerations` | Configurable [tolerations][] | `[]` |
| `topologySpreadConstraints` | Configuration for pod [topologySpreadConstraints][] | `[]` |
| `updateStrategy` | The [updateStrategy][] for the StatefulSet. By default Kubernetes will wait for the cluster to be green after upgrading each pod. Setting this to `OnDelete` will allow you to manually delete each pod during upgrades | `RollingUpdate` |
| `extraObjects` | Array of extra K8s manifests to deploy | list `[]` |
| `autoscaling.enabled` | Prerequisite: Install/Configure metrics server, to install use `kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml`, See [Metrics Server](https://github.com/kubernetes-sigs/metrics-server). | false |
| `autoscaling.minReplicas` | The lower limit for the number of replicas to which the autoscaler can scale down. | 1 |
| `autoscaling.maxReplicas` | The upper limit for the number of replicas to which the autoscaler can scale up. | 10 |
| `autoscaling.targetCPU` | The target value of the average CPU across all OpenSearch Dashboards pods. | 80 |
| `autoscaling.targetMemory` | The target value of the average memory across all OpenSearch Dashboards pods. Value should be tuned based on the requested memory value for OpenSearch Dashboards pods. Scaling based on memory utilization may be necessary for large datasets or complex dashboards. | 80 |
| `livenessProbe` | Configuration fields for the liveness [probe][] | see [exampleLiveness][] in `values.yaml`|
| `readinessProbe` | Configuration fields for the readiness [probe][] | see [exampleReadiness][] in `values.yaml`|
| `startupProbe` | Configuration fields for the startup [probe][] | see [exampleStartup][] in `values.yaml` |
| `plugins.enabled` | Allow/disallow to add 3rd Party / Custom plugins not offered in the default OpenSearchDashboards image | false |
| `plugins.installList` | Array containing the Opensearch Dashboards plugins to be installed in container | [] |
| `opensearchDashboardsYml.defaultMode` | Allow you to set the defaultMode for the opensearch_dashboards.yml mounted as configMap | |
| `dashboardAnnotations` | Allows you to configure custom annotation in the deployement of the OpenSearchDashboards container | {} |
| `serviceMonitor.enabled` | Enables the creation of a [ServiceMonitor] resource for Prometheus monitoring. Requires the Prometheus Operator to be installed in your Kubernetes cluster. | `false` |
| `serviceMonitor.path` | Path where metrics are exposed. Applicable only if `serviceMonitor.enabled` is set to `true`. | `/_prometheus/metrics` |
| `serviceMonitor.interval` | Interval at which metrics should be scraped by Prometheus. Applicable only if `serviceMonitor.enabled` is set to `true`. | `10s` |
[environment from variables]: https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/#configure-all-key-value-pairs-in-a-configmap-as-container-environment-variables
[values.yaml]:https://github.com/opensearch-project/helm-charts/blob/main/charts/opensearch/values.yaml
[hostAliases]: https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/
[imagepullPolicy]: https://kubernetes.io/docs/concepts/containers/images/#updating-images
[imagePullSecrets]: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
[ingress]: https://kubernetes.io/docs/concepts/services-networking/ingress/
[resources]: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
[labels]: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
[nodeSelector]: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
[annotations]: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
[securityContext]: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
[priorityClass]: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
[loadBalancer annotations]: https://kubernetes.io/docs/concepts/services-networking/service/#ssl-support-on-aws
[loadBalancer externalTrafficPolicy]: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
[loadBalancer]: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer
[nodePort]: https://kubernetes.io/docs/concepts/services-networking/service/#nodeport
[tolerations]: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
[updateStrategy]: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/
[service types]: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
[probe]: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-readiness-probes
[exampleStartup]: https://github.com/opensearch-project/helm-charts/blob/main/charts/opensearch-dashboards/values.yaml#17
[exampleLiveness]: https://github.com/opensearch-project/helm-charts/blob/main/charts/opensearch-dashboards/values.yaml#27
[exampleReadiness]: https://github.com/opensearch-project/helm-charts/blob/main/charts/opensearch-dashboards/values.yaml#37
[topologySpreadConstraints]: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints
[ServiceMonitor]: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#servicemonitor

7
helm-charts-observability/charts/opensearch-dashboards/kibanaserver-pass.yaml Normal file
View File

@@ -0,0 +1,7 @@
apiVersion: v1
data:
KIBANASERVER_PASSWORD: RW5wMTI5czBmMA==
kind: Secret
metadata:
name: opensearch-kibanaserver-password
namespace: observability

7
helm-charts-observability/charts/opensearch-dashboards/opensearch-ca-public-key.yaml Normal file
View File

@@ -0,0 +1,7 @@
apiVersion: v1
data:
root-ca.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUY3VENDQTlXZ0F3SUJBZ0lVTC9hTytnYS9YY3lzakFYbGh1WG92d0xLWkJjd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZVXhDekFKQmdOVkJBWVRBa0pFTVE0d0RBWURWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaAphMkV4RWpBUUJnTlZCQW9NQ1VKeWFXeHNhV0Z1ZERFYk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwCklFTkJNU1V3SXdZRFZRUUREQnhDY21sc2JHbGhiblFnVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUI0WERUSTIKTURjeU16RTFNREV4T1ZvWERUTTJNRGN5TURFMU1ERXhPVm93Z1lVeEN6QUpCZ05WQkFZVEFrSkVNUTR3REFZRApWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaGEyRXhFakFRQmdOVkJBb01DVUp5YVd4c2FXRnVkREViCk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwSUVOQk1TVXdJd1lEVlFRRERCeENjbWxzYkdsaGJuUWcKVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUlJQ0lqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FnOEFNSUlDQ2dLQwpBZ0VBdXlEYmRaMUFycWd6K1l3SkNUcWlxREtuUzNDRGhHekNxK0h5WDN3clBnV0JvZFBraHJCV3dkNzQ4ZjdqClhZWDNQditQS0F0ZzVGYjdxa2ZZUFZJR0FPZUNiUWxkRlJnZld0S2F2MkdxcHZseUlKcy9OZW5PZzFZQ3IydVUKbDE3UnFPNk1BSGt6d1pNTVFDV1JXMlFiUy9weVY0VHd6dkNxSTR1ZVpzOFJ4MndwbERJdWFPVXdJMEVTMG8zdQpWdDJHMVlCTWlFOUNVTDliQWlYbWQ0UTR4a1NFRFRvOVY1SVk3Z2dHYjFTU0xWU2x6RDJHZElaMGN3VlE2LzcwCnUrQ1FPa005ZXhIRVR2eGpGTmZ4azI2YlRZVUJmNnBNS2VpSDdMbC9ucjZFVVVzTW5DSUR5VGtnK3Zta1M5ZWoKUmY1R0QwQ00rcnl1V1BiRHlHOCtzcDh4d1N1ZkcydDdkUGZRSTUzd1Zzc1BKSkk5b0lsZ0lJWXkyMkFUMlo4RwpKL2dZbmYwMU5LREhSV1dBU2FQaTBLT2dURldqRG5xam94Q0FHZjVGVFRJSHdBQjVsMS8rMXZFbEkyNjQ2M2d4CnBWcTk4Vyt4U3FQQ0xaTW9sWlE5TVkwbjVHeGgvZjhkK0RPb1BVT0lXazJqWXdvS1JGQXJiTlNTNnkySnVrS3YKSWNvMnN4YUhqZkhrdDdqdDBkckRLcjUrelI5bndUWDhVN3hBaWlTYkVTekN6OWlvdU9QSEcxMFFtdzl6VVRNMgoxdzJmMmlQRWpvbFpBVjFBaFU3dzFWNHBzc3JpWDIvNTlDR1dYT1VEcWNnd2MwdWh4djRnWFRndXBCeGcrYU5yCllybWZwNndtejdzN3lmblh3T2xVaVRDRW1Bc2NBemNkMmdCaGwvN1dpcmFRZFVzQ0F3RUFBYU5UTUZFd0hRWUQKVlIwT0JCWUVGSGJhbmo2RkdNVWZ3bEMwSytqY081TTlHd0FwTUI4R0ExVWRJd1FZTUJhQUZIYmFuajZGR01VZgp3bEMwSytqY081TTlHd0FwTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3RFFZSktvWklodmNOQVFFTEJRQURnZ0lCCkFBZVVVVUFMTk5FNDM2UEwvZXl6V0c3bmlPdndXODF3UkdVdGdEUnJpY2xFWjh0K3MzUG9MOXRibyszUGN1ekgKakxsUFArYmVLY2tUTEZKVGZZWUN3Z0dWZkdIRXE1ejV1SUt3ZWIyMG9GSEg3ek9DSzF3VVJBSUlPZnFycncyMApjcWNzdTRnK3NENnl0bllWN2Y1T0RFT2RNaXpjVXRrbGpMSjVieXJLSU9OV2FrSTBpd0xLeXFPQWlGeUVSY2xiCjB0ZzhoTDR6dkRLVUZ6dVJycXhxS0padzNWUWUvM1JWUFYwZ0RLUW96VEQ0M3lnQUdGVlVjckx1dHZOK2V5bEEKVDdYMGtNZXJlVVRKd1N6RDVvenhGRXFkaDlLNHZkZTA2a3BuSXpQS2tEanNFZiszeW9WeFVxRGJCeGV3ai9aOApodzhmT3lBWC9jV2UvZlhmWVdPV3RpTlhiQVJRd0pvUWlLb3lacHRuNGpvRXhLWVB2Qzg0RitINEZnZnpidXFkCnNnL2R2SjBxcldGaUlZeWZBRS9NNGM3VTBDUnVsZ1lETXJhbktIUHhxTllVT21pRzM4T0xLTDlFMmlvV002UHYKek82djVvUk5pazFFN3BrRUVMSUFPczR3U2MvdG45MU01TmtpSjgyRXNEQ2ZaVG5FVU9Cd3VsRzZSbW8vYWF0agpCWUJEaHo0dnhmN0ZjNG13WEdXNVZXc1Qzd2ZVckErZ3l3VWo5dlFqTTV6SjEybDl4NU9Dd3pNMTJuQWdSZ1dFCkh4ZDh5TFhkNE9rTWRaRWNVckY5eWtSMGJUZ3AyWnowL3lPR21KbVpieHRNdHlGaTVMcmt6VElodWJNS1l2bncKcWsrbWdaUmNMcXBWclRSYTNiaGdEVzJrSWpFT2I5SHB6NG5MZ3loUVpCMFAKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
kind: Secret
metadata:
name: opensearch-dashboard-ca
namespace: observability

26
helm-charts-observability/charts/opensearch-dashboards/opensearch-dashbaord-ingress.yaml Normal file
View File

@@ -0,0 +1,26 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: brilliant-opensearch-dashboard-opensearch-dashboards
namespace: observability
labels:
helm.sh/chart: opensearch-dashboards-3.7.0
app.kubernetes.io/name: opensearch-dashboards
app.kubernetes.io/instance: brilliant-opensearch-dashboard
app.kubernetes.io/version: "3.7.0"
annotations:
kubernetes.io/ingress.class: nginx
spec:
ingressClassName: nginx
rules:
- http:
paths:
- path: /opensearch
pathType: Prefix
backend:
service:
name: brilliant-opensearch-dashboard-opensearch-dashboards
port:
number: 5601

155
helm-charts-observability/charts/opensearch-dashboards/opensearch-dashboard-rendered-output.yaml Normal file
View File

@@ -0,0 +1,155 @@
---
# Source: opensearch-dashboards/templates/configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: brilliant-opensearch-dashboard-opensearch-dashboards-config
labels:
helm.sh/chart: opensearch-dashboards-3.7.0
app.kubernetes.io/name: opensearch-dashboards
app.kubernetes.io/instance: brilliant-opensearch-dashboard
app.kubernetes.io/version: "3.7.0"
app.kubernetes.io/managed-by: Helm
data:
opensearch_dashboards.yml: |
server:
name: dashboards
host: "0.0.0.0"
opensearch:
username: kibanaserver
password: ${KIBANASERVER_PASSWORD}
ssl:
verificationMode: full
certificateAuthorities: /usr/share/opensearch-dashboards/certs/root-ca.pem
---
# Source: opensearch-dashboards/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
name: brilliant-opensearch-dashboard-opensearch-dashboards
labels:
helm.sh/chart: opensearch-dashboards-3.7.0
app.kubernetes.io/name: opensearch-dashboards
app.kubernetes.io/instance: brilliant-opensearch-dashboard
app.kubernetes.io/version: "3.7.0"
app.kubernetes.io/managed-by: Helm
spec:
type: ClusterIP
ports:
- port: 5601
protocol: TCP
name: http
targetPort: 5601
- name: metrics
protocol: TCP
port: 9601
selector:
app.kubernetes.io/name: opensearch-dashboards
app.kubernetes.io/instance: brilliant-opensearch-dashboard
---
# Source: opensearch-dashboards/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: brilliant-opensearch-dashboard-opensearch-dashboards
labels:
helm.sh/chart: opensearch-dashboards-3.7.0
app.kubernetes.io/name: opensearch-dashboards
app.kubernetes.io/instance: brilliant-opensearch-dashboard
app.kubernetes.io/version: "3.7.0"
app.kubernetes.io/managed-by: Helm
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app.kubernetes.io/name: opensearch-dashboards
app.kubernetes.io/instance: brilliant-opensearch-dashboard
template:
metadata:
labels:
app.kubernetes.io/name: opensearch-dashboards
app.kubernetes.io/instance: brilliant-opensearch-dashboard
annotations:
configchecksum: 94f1f2434bc321e09c11f8b57337937eb527a3de2f9e79796a0c518e55b3bee
spec:
securityContext:
{}
serviceAccountName: default
volumes:
- name: config
configMap:
name: brilliant-opensearch-dashboard-opensearch-dashboards-config
# Currently some extra blocks accept strings
# to continue with backwards compatibility this is being kept
# whilst also allowing for yaml to be specified too.
- name: root-cert
secret:
secretName: opensearch-dashboard-ca
containers:
- name: dashboards
securityContext:
capabilities:
drop:
- ALL
runAsNonRoot: true
runAsUser: 1000
image: "opensearchproject/opensearch-dashboards:3.7.0"
imagePullPolicy: "IfNotPresent"
readinessProbe:
failureThreshold: 10
initialDelaySeconds: 10
periodSeconds: 20
successThreshold: 1
tcpSocket:
port: 5601
timeoutSeconds: 5
livenessProbe:
failureThreshold: 10
initialDelaySeconds: 10
periodSeconds: 20
successThreshold: 1
tcpSocket:
port: 5601
timeoutSeconds: 5
startupProbe:
failureThreshold: 20
initialDelaySeconds: 10
periodSeconds: 10
successThreshold: 1
tcpSocket:
port: 5601
timeoutSeconds: 5
env:
- name: OPENSEARCH_HOSTS
value: "https://brilliant-opensearch-cluster-master:9200"
- name: SERVER_HOST
value: "0.0.0.0"
- name: KIBANASERVER_PASSWORD
valueFrom:
secretKeyRef:
key: KIBANASERVER_PASSWORD
name: opensearch-kibanaserver-password
ports:
- containerPort: 5601
name: http
protocol: TCP
resources:
limits:
cpu: "2"
memory: 6G
requests:
cpu: "1"
memory: 2G
volumeMounts:
- name: config
mountPath: /usr/share/opensearch-dashboards/config/opensearch_dashboards.yml
subPath: opensearch_dashboards.yml
# Currently some extra blocks accept strings
# to continue with backwards compatibility this is being kept
# whilst also allowing for yaml to be specified too.
- mountPath: /usr/share/opensearch-dashboards/certs
name: root-cert
readOnly: true

22
helm-charts-observability/charts/opensearch-dashboards/templates/NOTES.txt Normal file
View File

@@ -0,0 +1,22 @@
1. Get the application URL by running these commands:
{{- if .Values.ingress.enabled }}
{{- range $host := .Values.ingress.hosts }}
{{- range .paths }}
http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
{{- end }}
{{- end }}
{{- else if contains "NodePort" .Values.service.type }}
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "opensearch-dashboards.fullname" . }})
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
echo http://$NODE_IP:$NODE_PORT
{{- else if contains "LoadBalancer" .Values.service.type }}
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "opensearch-dashboards.fullname" . }}'
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "opensearch-dashboards.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
echo http://$SERVICE_IP:{{ .Values.service.port }}
{{- else if contains "ClusterIP" .Values.service.type }}
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "opensearch-dashboards.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
echo "Visit http://127.0.0.1:8080 to use your application"
kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
{{- end }}

103
helm-charts-observability/charts/opensearch-dashboards/templates/_helpers.tpl Normal file
View File

@@ -0,0 +1,103 @@
{{/*
Expand the name of the chart.
*/}}
{{- define "opensearch-dashboards.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "opensearch-dashboards.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- $name := default .Chart.Name .Values.nameOverride }}
{{- if contains $name .Release.Name }}
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
{{- end }}
{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "opensearch-dashboards.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Common labels
*/}}
{{- define "opensearch-dashboards.labels" -}}
helm.sh/chart: {{ include "opensearch-dashboards.chart" . }}
{{ include "opensearch-dashboards.selectorLabels" . }}
{{- if .Chart.AppVersion }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- end }}
{{/*
Selector labels
*/}}
{{- define "opensearch-dashboards.selectorLabels" -}}
app.kubernetes.io/name: {{ include "opensearch-dashboards.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}
{{/*
Create the name of the service account to use
*/}}
{{- define "opensearch-dashboards.serviceAccountName" -}}
{{- if .Values.serviceAccount.create }}
{{- default (include "opensearch-dashboards.fullname" .) .Values.serviceAccount.name }}-dashboards
{{- else }}
{{- default "default" .Values.serviceAccount.name }}
{{- end }}
{{- end }}
{{/*
Return the appropriate apiVersion for ingress.
*/}}
{{- define "opensearch-dashboards.ingress.apiVersion" -}}
{{- if and (.Capabilities.APIVersions.Has "networking.k8s.io/v1") (semverCompare ">= 1.19-0" .Capabilities.KubeVersion.Version) -}}
{{- print "networking.k8s.io/v1" -}}
{{- else if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1" -}}
{{- print "networking.k8s.io/v1beta1" -}}
{{- else -}}
{{- print "extensions/v1beta1" -}}
{{- end -}}
{{- end -}}
{{/*
Return the appropriate apiVersion for Horizontal Pod Autoscaler.
*/}}
{{- define "opensearch-dashboards.hpa.apiVersion" -}}
{{- if $.Capabilities.APIVersions.Has "autoscaling/v2/HorizontalPodAutoscaler" }}
{{- print "autoscaling/v2" }}
{{- else if $.Capabilities.APIVersions.Has "autoscaling/v2beta2/HorizontalPodAutoscaler" }}
{{- print "autoscaling/v2beta2" }}
{{- else if $.Capabilities.APIVersions.Has "autoscaling/v2beta1/HorizontalPodAutoscaler" }}
{{- print "autoscaling/v2beta1" }}
{{- else }}
{{- print "autoscaling/v1" }}
{{- end }}
{{- end }}
{{/*
Return if ingress is stable.
*/}}
{{- define "opensearch-dashboards.ingress.isStable" -}}
{{- eq (include "opensearch-dashboards.ingress.apiVersion" .) "networking.k8s.io/v1" -}}
{{- end -}}
{{/*
Return if ingress supports ingressClassName.
*/}}
{{- define "opensearch-dashboards.ingress.supportsIngressClassName" -}}
{{- or (eq (include "opensearch-dashboards.ingress.isStable" .) "true") (and (eq (include "opensearch-dashboards.ingress.apiVersion" .) "networking.k8s.io/v1beta1") (semverCompare ">= 1.18-0" .Capabilities.KubeVersion.Version)) -}}
{{- end -}}

43
helm-charts-observability/charts/opensearch-dashboards/templates/autoscaler.yaml Normal file
View File

@@ -0,0 +1,43 @@
{{- if .Values.autoscaling.enabled -}}
apiVersion: {{ include "opensearch-dashboards.hpa.apiVersion" . }}
kind: HorizontalPodAutoscaler
metadata:
name: {{ template "opensearch-dashboards.fullname" . }}-hpa
labels: {{- include "opensearch-dashboards.labels" . | nindent 4 }}
spec:
maxReplicas: {{ .Values.autoscaling.maxReplicas }}
minReplicas: {{ .Values.autoscaling.minReplicas }}
scaleTargetRef:
apiVersion: apps/v1
kind: Deployment
name: {{ template "opensearch-dashboards.fullname" . }}
{{- if eq (include "opensearch-dashboards.hpa.apiVersion" .) "autoscaling/v1" }}
targetCPUUtilizationPercentage: {{ .Values.autoscaling.targetCPUUtilizationPercentage | default .Values.autoscaling.targetCPU }}
{{- else }}
metrics:
{{- if .Values.autoscaling.targetMemory }}
- type: Resource
resource:
name: memory
{{- if eq (include "opensearch-dashboards.hpa.apiVersion" .) "autoscaling/v2beta1" }}
targetAverageUtilization: {{ .Values.autoscaling.targetMemory }}
{{- else }}
target:
type: Utilization
averageUtilization: {{ .Values.autoscaling.targetMemory }}
{{- end }}
{{- end }}
{{- if or .Values.autoscaling.targetCPU .Values.autoscaling.targetCPUUtilizationPercentage }}
- type: Resource
resource:
name: cpu
{{- if eq (include "opensearch-dashboards.hpa.apiVersion" .) "autoscaling/v2beta1" }}
targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage | default .Values.autoscaling.targetCPU }}
{{- else }}
target:
type: Utilization
averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage | default .Values.autoscaling.targetCPU }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}

16
helm-charts-observability/charts/opensearch-dashboards/templates/configmap.yaml Normal file
View File

@@ -0,0 +1,16 @@
{{- if .Values.config -}}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ template "opensearch-dashboards.fullname" . }}-config
labels: {{ include "opensearch-dashboards.labels" . | nindent 4 }}
data:
{{- range $configName, $configYaml := .Values.config }}
{{ $configName }}: |
{{- if eq (kindOf $configYaml) "map" }}
{{- tpl (toYaml $configYaml) $ | nindent 4 }}
{{- else }}
{{- tpl $configYaml $ | nindent 4 -}}
{{- end -}}
{{- end -}}
{{- end -}}

218
helm-charts-observability/charts/opensearch-dashboards/templates/deployment.yaml Normal file
View File

@@ -0,0 +1,218 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ template "opensearch-dashboards.fullname" . }}
labels: {{- include "opensearch-dashboards.labels" . | nindent 4 }}
{{- with .Values.dashboardAnnotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
replicas: {{ .Values.replicaCount }}
strategy:
{{ toYaml .Values.updateStrategy | indent 4 }}
selector:
matchLabels:
{{- include "opensearch-dashboards.selectorLabels" . | nindent 6 }}
template:
metadata:
labels:
{{- include "opensearch-dashboards.selectorLabels" . | nindent 8 }}
{{- range $key, $value := .Values.labels }}
{{ $key }}: {{ $value | quote }}
{{- end }}
annotations:
{{- range $key, $value := .Values.podAnnotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- /* This forces a restart if the configmap has changed */}}
{{- if .Values.config }}
configchecksum: {{ include (print .Template.BasePath "/configmap.yaml") . | sha256sum | trunc 63 }}
{{- end }}
spec:
{{- if .Values.priorityClassName }}
priorityClassName: {{ .Values.priorityClassName }}
{{- end }}
securityContext:
{{ toYaml .Values.podSecurityContext | indent 8 }}
serviceAccountName: {{ template "opensearch-dashboards.serviceAccountName" . }}
{{- if .Values.hostAliases }}
hostAliases: {{ toYaml .Values.hostAliases | nindent 6 }}
{{- end }}
volumes:
{{- range .Values.secretMounts }}
- name: {{ .name }}
secret:
secretName: {{ .secretName }}
{{- end }}
{{- if .Values.config }}
- name: config
configMap:
name: {{ template "opensearch-dashboards.fullname" . }}-config
{{- if .Values.opensearchDashboardsYml.defaultMode }}
defaultMode: {{ .Values.opensearchDashboardsYml.defaultMode }}
{{- end }}
{{- end }}
{{- if .Values.extraVolumes }}
# Currently some extra blocks accept strings
# to continue with backwards compatibility this is being kept
# whilst also allowing for yaml to be specified too.
{{- if eq "string" (printf "%T" .Values.extraVolumes) }}
{{ tpl .Values.extraVolumes . | indent 8 }}
{{- else }}
{{ toYaml .Values.extraVolumes | indent 8 }}
{{- end }}
{{- end }}
{{- with .Values.nodeSelector }}
nodeSelector:
{{ toYaml . | indent 8 }}
{{- end }}
{{- with .Values.affinity }}
affinity:
{{ toYaml . | indent 8 }}
{{- end }}
{{- with .Values.tolerations }}
tolerations:
{{ toYaml . | indent 8 }}
{{- end }}
{{- if .Values.topologySpreadConstraints }}
topologySpreadConstraints:
{{- toYaml .Values.topologySpreadConstraints | nindent 8 }}
{{- end }}
{{- if .Values.imagePullSecrets }}
imagePullSecrets:
{{ toYaml .Values.imagePullSecrets | indent 8 }}
{{- end }}
{{- if .Values.extraInitContainers }}
# Currently some extra blocks accept strings
# to continue with backwards compatibility this is being kept
# whilst also allowing for yaml to be specified too.
initContainers:
{{- if eq "string" (printf "%T" .Values.extraInitContainers) }}
{{ tpl .Values.extraInitContainers . | indent 6 }}
{{- else }}
{{ toYaml .Values.extraInitContainers | indent 6 }}
{{- end }}
{{- end }}
containers:
- name: dashboards
securityContext:
{{ toYaml .Values.securityContext | indent 10 }}
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
{{- if .Values.readinessProbe }}
readinessProbe:
{{ toYaml .Values.readinessProbe | indent 10 }}
{{- end }}
{{- if .Values.livenessProbe }}
livenessProbe:
{{ toYaml .Values.livenessProbe | indent 10 }}
{{- end }}
{{- if semverCompare ">=1.16-0" .Capabilities.KubeVersion.Version }}
{{- if .Values.readinessProbe }}
startupProbe:
{{ toYaml .Values.startupProbe | indent 10 }}
{{- end }}
{{- end }}
env:
{{- if .Values.opensearchURL }}
- name: OPENSEARCH_URL
value: "{{ .Values.opensearchURL }}"
{{- else if .Values.opensearchHosts }}
- name: OPENSEARCH_HOSTS
value: "{{ .Values.opensearchHosts }}"
{{- end }}
- name: SERVER_HOST
value: "{{ .Values.serverHost }}"
{{- if .Values.opensearchAccount.secret }}
- name: OPENSEARCH_USERNAME
valueFrom:
secretKeyRef:
name: {{ .Values.opensearchAccount.secret }}
key: username
- name: OPENSEARCH_PASSWORD
valueFrom:
secretKeyRef:
name: {{ .Values.opensearchAccount.secret }}
key: password
{{- if and .Values.opensearchAccount.keyPassphrase.enabled }}
- name: KEY_PASSPHRASE
valueFrom:
secretKeyRef:
name: {{ .Values.opensearchAccount.secret }}
key: keypassphrase
# 32-character random string to be used as cookie password by security plugin
{{- end }}
- name: COOKIE_PASS
valueFrom:
secretKeyRef:
name: {{ .Values.opensearchAccount.secret }}
key: cookie
{{- end }}
{{- if .Values.extraEnvs }}
{{ toYaml .Values.extraEnvs | indent 8 }}
{{- end }}
{{- if .Values.envFrom }}
envFrom:
{{ toYaml .Values.envFrom | indent 10 }}
{{- end }}
ports:
- containerPort: {{ .Values.service.port }}
name: {{ .Values.service.httpPortName | default "http" }}
protocol: TCP
{{- if .Values.plugins.enabled }}
command:
- sh
- -c
- |
#!/usr/bin/bash
set -e
{{- range $plugin := .Values.plugins.removeList }}
if ./bin/opensearch-dashboards-plugin list | grep -q {{ $plugin }}; then
./bin/opensearch-dashboards-plugin remove {{ $plugin }}
fi
{{- end }}
{{- range $plugin := .Values.plugins.installList }}
./bin/opensearch-dashboards-plugin install {{ $plugin }}
{{- end }}
bash opensearch-dashboards-docker-entrypoint.sh opensearch-dashboards
{{- end }}
{{- if .Values.lifecycle }}
lifecycle:
{{ toYaml .Values.lifecycle | indent 10 }}
{{- end }}
resources:
{{ toYaml .Values.resources | indent 10 }}
volumeMounts:
{{- range .Values.secretMounts }}
- name: {{ .name }}
mountPath: {{ .path }}
{{- if .subPath }}
subPath: {{ .subPath }}
{{- end }}
{{- end }}
{{- range $path, $config := .Values.config }}
- name: config
mountPath: /usr/share/opensearch-dashboards/config/{{ $path }}
subPath: {{ $path }}
{{- end }}
{{- if .Values.extraVolumeMounts }}
# Currently some extra blocks accept strings
# to continue with backwards compatibility this is being kept
# whilst also allowing for yaml to be specified too.
{{- if eq "string" (printf "%T" .Values.extraVolumeMounts) }}
{{ tpl .Values.extraVolumeMounts . | indent 10 }}
{{- else }}
{{ toYaml .Values.extraVolumeMounts | indent 10 }}
{{- end }}
{{- end }}
{{- if .Values.extraContainers }}
# Currently some extra blocks accept strings
# to continue with backwards compatibility this is being kept
# whilst also allowing for yaml to be specified too.
{{- if eq "string" (printf "%T" .Values.extraContainers) }}
{{ tpl .Values.extraContainers . | indent 6 }}
{{- else }}
{{ toYaml .Values.extraContainers | indent 6 }}
{{- end }}
{{- end }}

8
helm-charts-observability/charts/opensearch-dashboards/templates/extraManifests.yaml Normal file
View File

@@ -0,0 +1,8 @@
{{ range .Values.extraObjects }}
---
{{- if typeIs "string" . }}
{{ tpl . $ }}
{{- else }}
{{ tpl (toYaml .) $ }}
{{- end }}
{{ end }}

72
helm-charts-observability/charts/opensearch-dashboards/templates/ingress.yaml Normal file
View File

@@ -0,0 +1,72 @@
{{- if .Values.ingress.enabled -}}
{{- $fullName := include "opensearch-dashboards.fullname" . -}}
{{- $ingressApiIsStable := eq (include "opensearch-dashboards.ingress.isStable" .) "true" -}}
{{- $ingressSupportsIngressClassName := eq (include "opensearch-dashboards.ingress.supportsIngressClassName" .) "true" -}}
{{- $svcPort := .Values.service.port -}}
{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
apiVersion: networking.k8s.io/v1
{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
apiVersion: networking.k8s.io/v1beta1
{{- else -}}
apiVersion: extensions/v1beta1
{{- end }}
kind: Ingress
metadata:
name: {{ $fullName }}
labels:
{{- include "opensearch-dashboards.labels" . | nindent 4 }}
{{- with .Values.ingress.labels }}
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with .Values.ingress.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
{{- if and $ingressSupportsIngressClassName .Values.ingress.ingressClassName }}
ingressClassName: {{ .Values.ingress.ingressClassName }}
{{- end -}}
{{- if .Values.ingress.tls }}
tls:
{{- range .Values.ingress.tls }}
- hosts:
{{- range .hosts }}
- {{ . | quote }}
{{- end }}
secretName: {{ .secretName }}
{{- end }}
{{- end }}
rules:
{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.Version -}}
{{- range .Values.ingress.hosts }}
- host: {{ .host | quote }}
http:
paths:
{{- range .paths }}
- path: {{ .path }}
pathType: Prefix
backend:
service:
name: {{ .backend.serviceName | default $fullName }}
port:
{{- if and .backend.servicePort (kindIs "string" .backend.servicePort) }}
name: {{ .backend.servicePort }}
{{- else }}
number: {{ .backend.servicePort | default $svcPort }}
{{- end }}
{{- end }}
{{- end }}
{{- else -}}
{{- range .Values.ingress.hosts }}
- host: {{ .host | quote }}
http:
paths:
{{- range .paths }}
- path: {{ .path }}
backend:
serviceName: {{ .backend.serviceName | default $fullName }}
servicePort: {{ .backend.servicePort | default $svcPort }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}

15
helm-charts-observability/charts/opensearch-dashboards/templates/rolebinding.yaml Normal file
View File

@@ -0,0 +1,15 @@
{{- if .Values.rbac.create -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
labels: {{- include "opensearch-dashboards.labels" . | nindent 4 }}
name: {{ template "opensearch-dashboards.fullname" . }}-dashboards-rolebinding
roleRef:
kind: Role
name: {{ template "opensearch-dashboards.serviceAccountName" . }}
apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
name: {{ template "opensearch-dashboards.serviceAccountName" . }}
namespace: {{ .Release.Namespace }}
{{- end }}

43
helm-charts-observability/charts/opensearch-dashboards/templates/service.yaml Normal file
View File

@@ -0,0 +1,43 @@
---
apiVersion: v1
kind: Service
metadata:
name: {{ template "opensearch-dashboards.fullname" . }}
labels: {{- include "opensearch-dashboards.labels" . | nindent 4 }}
{{- if .Values.service.labels }}
{{ toYaml .Values.service.labels | indent 4}}
{{- end }}
{{- with .Values.service.annotations }}
annotations:
{{ toYaml . | indent 4 }}
{{- end }}
spec:
type: {{ .Values.service.type }}
{{- if (semverCompare ">= 1.23-0" .Capabilities.KubeVersion.Version) }}
{{- if .Values.service.ipFamilyPolicy }}
ipFamilyPolicy: {{ .Values.service.ipFamilyPolicy }}
{{- end }}
{{- if .Values.service.ipFamilies }}
ipFamilies: {{ .Values.service.ipFamilies }}
{{- end }}
{{- end }}
{{- if .Values.service.loadBalancerIP }}
loadBalancerIP: {{ .Values.service.loadBalancerIP }}
{{- end }}
{{- with .Values.service.loadBalancerSourceRanges }}
loadBalancerSourceRanges:
{{ toYaml . | indent 4 }}
{{- end }}
ports:
- port: {{ .Values.service.port }}
{{- if .Values.service.nodePort }}
nodePort: {{ .Values.service.nodePort }}
{{- end }}
protocol: TCP
name: {{ .Values.service.httpPortName | default "http" }}
targetPort: {{ .Values.service.port }}
- name: {{ .Values.service.metricsPortName | default "metrics" }}
protocol: TCP
port: {{ .Values.service.metricsPort }}
selector:
{{- include "opensearch-dashboards.selectorLabels" . | nindent 4 }}

20
helm-charts-observability/charts/opensearch-dashboards/templates/serviceMonitor.yaml Normal file
View File

@@ -0,0 +1,20 @@
{{- if .Values.serviceMonitor.enabled }}
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
name: {{ template "opensearch-dashboards.fullname" . }}-service-monitor
namespace: {{ .Release.Namespace }}
labels:
{{- include "opensearch-dashboards.labels" . | nindent 4 }}
{{- with .Values.serviceMonitor.labels }}
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
selector:
matchLabels:
{{- include "opensearch-dashboards.selectorLabels" . | nindent 6 }}
endpoints:
- port: {{ .Values.service.metricsPortName | default "metrics" }}
interval: {{ .Values.serviceMonitor.interval }}
path: {{ .Values.serviceMonitor.path }}
{{- end }}

16
helm-charts-observability/charts/opensearch-dashboards/templates/serviceaccount.yaml Normal file
View File

@@ -0,0 +1,16 @@
{{- if .Values.serviceAccount.create -}}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "opensearch-dashboards.serviceAccountName" . }}
labels:
{{- include "opensearch-dashboards.labels" . | nindent 4 }}
{{- with .Values.serviceAccount.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- end }}
{{- if .Values.serviceAccount.automountServiceAccountToken }}
{{- else }}
automountServiceAccountToken: false
{{- end -}}

334
helm-charts-observability/charts/opensearch-dashboards/values.yaml Normal file
View File

@@ -0,0 +1,334 @@
# Copyright OpenSearch Contributors
# SPDX-License-Identifier: Apache-2.0
# Default values for opensearch-dashboards.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.
opensearchHosts: "https://brilliant-opensearch-cluster-master:9200"
replicaCount: 1
image:
repository: "opensearchproject/opensearch-dashboards"
# override image tag, which is .Chart.AppVersion by default
tag: "3.7.0"
pullPolicy: "IfNotPresent"
startupProbe:
tcpSocket:
port: 5601
periodSeconds: 10
timeoutSeconds: 5
failureThreshold: 20
successThreshold: 1
initialDelaySeconds: 10
livenessProbe:
tcpSocket:
port: 5601
periodSeconds: 20
timeoutSeconds: 5
failureThreshold: 10
successThreshold: 1
initialDelaySeconds: 10
readinessProbe:
tcpSocket:
port: 5601
periodSeconds: 20
timeoutSeconds: 5
failureThreshold: 10
successThreshold: 1
initialDelaySeconds: 10
imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""
serviceAccount:
# Specifies whether a service account should be created
create: false
# Annotations to add to the service account
annotations: {}
# The name of the service account to use.
# If not set and create is true, a name is generated using the fullname template
name: ""
namespace: observability
# Controls whether the ServiceAccount API token is automatically mounted on pod
automountServiceAccountToken: true
rbac:
create: false
# A list of secrets and their paths to mount inside the pod
# This is useful for mounting certificates for security and for mounting
# the X-Pack license
secretMounts: []
# - name: certs
# secretName: opensearch-dashboard-ca
# - name: certs
# secretName: dashboard-certs
# path: /usr/share/dashboards/certs
podAnnotations: {}
# Deployment annotations
dashboardAnnotations: {}
extraEnvs:
# - name: "NODE_OPTIONS"
# value: "--max-old-space-size=1800"
- name: KIBANASERVER_PASSWORD
valueFrom:
secretKeyRef:
name: opensearch-kibanaserver-password
key: KIBANASERVER_PASSWORD
envFrom: []
extraVolumes:
- name: root-cert
secret:
secretName: opensearch-dashboard-ca
# - name: extras
# emptyDir: {}
extraVolumeMounts:
- name: root-cert
readOnly: true
mountPath: /usr/share/opensearch-dashboards/certs
# - name: extras
# mountPath: /usr/share/extras
# readOnly: true
extraInitContainers: ""
extraContainers: ""
podSecurityContext: {}
securityContext:
capabilities:
drop:
- ALL
# readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
config:
opensearch_dashboards.yml: |
server:
name: dashboards
host: "{{ .Values.serverHost }}"
basePath: /opensearch
rewriteBasePath: true
opensearch:
username: kibanaserver
password: ${KIBANASERVER_PASSWORD}
ssl:
verificationMode: full
certificateAuthorities:
- /usr/share/opensearch-dashboards/certs/root-ca.pem
opensearch_security.multitenancy.enabled: false
data_source:
enabled: true
ssl:
verificationMode: full
certificateAuthorities:
- /usr/share/opensearch-dashboards/certs/root-ca.pem
authTypes:
NoAuthentication:
enabled: false
UsernamePassword:
enabled: true
AWSSigV4:
enabled: false
workspace:
enabled: true
explore:
enabled: true
datasetManagement:
enabled: true
opensearchDashboardsYml:
defaultMode:
# value should be 0-0777
priorityClassName: ""
opensearchAccount:
secret: ""
keyPassphrase:
enabled: false
labels: {}
hostAliases: []
# - ip: "127.0.0.1"
# hostnames:
# - "foo.local"
# - "bar.local"
serverHost: "0.0.0.0"
service:
type: ClusterIP
# The IP family and IP families options are to set the behaviour in a dual-stack environment
# Omitting these values will let the service fall back to whatever the CNI dictates the defaults
# should be
#
# ipFamilyPolicy: SingleStack
# ipFamilies:
# - IPv4
port: 5601
metricsPort: 9601
loadBalancerIP: ""
nodePort: ""
labels: {}
annotations: {}
loadBalancerSourceRanges: []
# 0.0.0.0/0
httpPortName: http
metricsPortName: metrics
ingress:
enabled: false
# For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName
# See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress
# ingressClassName: nginx
annotations:
kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: "true"
labels: {}
ingressClassName: nginx
hosts:
# - host: chart-example.local
- paths:
- path: /
backend:
serviceName: ""
servicePort: 5601
tls: []
# - secretName: chart-example-tls
# hosts:
# - chart-example.local
resources:
requests:
cpu: "1"
memory: "2Gi"
limits:
cpu: "2"
memory: "6Gi"
autoscaling:
# This requires metrics server to be installed, to install use kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml
# See https://github.com/kubernetes-sigs/metrics-server
enabled: false
minReplicas: 1
maxReplicas: 10
# The legacy `targetCPUUtilizationPercentage` key has been deprecated in favor of `targetCPU`
targetCPU: "80"
targetMemory: "80"
updateStrategy:
type: "Recreate"
nodeSelector: {}
tolerations: []
affinity: {}
# This is the pod topology spread constraints
# https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
topologySpreadConstraints: []
# -- Array of extra K8s manifests to deploy
extraObjects: []
# - apiVersion: secrets-store.csi.x-k8s.io/v1
# kind: SecretProviderClass
# metadata:
# name: argocd-secrets-store
# spec:
# provider: aws
# parameters:
# objects: |
# - objectName: "argocd"
# objectType: "secretsmanager"
# jmesPath:
# - path: "client_id"
# objectAlias: "client_id"
# - path: "client_secret"
# objectAlias: "client_secret"
# secretObjects:
# - data:
# - key: client_id
# objectName: client_id
# - key: client_secret
# objectName: client_secret
# secretName: argocd-secrets-store
# type: Opaque
# labels:
# app.kubernetes.io/part-of: argocd
# - |
# apiVersion: policy/v1
# kind: PodDisruptionBudget
# metadata:
# name: {{ template "opensearch-dashboards.fullname" . }}
# labels:
# {{- include "opensearch-dashboards.labels" . | nindent 4 }}
# spec:
# minAvailable: 1
# selector:
# matchLabels:
# {{- include "opensearch-dashboards.selectorLabels" . | nindent 6 }}
# pod lifecycle policies as outlined here:
# https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks
lifecycle: {}
# preStop:
# exec:
# command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"]
# postStart:
# exec:
# command:
# - bash
# - -c
# - |
# #!/bin/bash
# curl -I "http://admin:admin@127.0.0.1:5601/status -H "kbn-xsrf: true" -H 'kbn-xsrf: true' -H "Content-Type: application/json"
## Enable to add 3rd Party / Custom plugins not offered in the default OpenSearchDashboards image.
plugins:
enabled: false
installList: []
# - example-fake-plugin-downloadable-url
removeList: []
# - examplePluginName
# ServiceMonitor Configuration for Prometheus
# Enabling this option will create a ServiceMonitor resource that allows Prometheus to scrape metrics from the OpenSearch service.
serviceMonitor:
# Set to true to enable the ServiceMonitor resource for OpenSearch Dashboards
enabled: false
# HTTP path where metrics are exposed by OpenSearch Dashboards.
# Ensure this path is correctly set in your service.
path: /_prometheus/metrics
# Frequency at which Prometheus will scrape metrics.
# Modify as needed for your monitoring requirements.
interval: 10s
# additional labels to be added to the ServiceMonitor
# labels:
# k8s.example.com/prometheus: kube-prometheus
labels: {}

23
helm-charts-observability/charts/opensearch/.helmignore Normal file
View File

@@ -0,0 +1,23 @@
# Patterns to ignore when building packages.
# This supports shell glob matching, relative path matching, and
# negation (prefixed with !). Only one pattern per line.
.DS_Store
# Common VCS dirs
.git/
.gitignore
.bzr/
.bzrignore
.hg/
.hgignore
.svn/
# Common backup files
*.swp
*.bak
*.tmp
*.orig
*~
# Various IDEs
.project
.idea/
*.tmproj
.vscode/

127
helm-charts-observability/charts/opensearch/CHANGELOG.md Normal file
View File

@@ -0,0 +1,127 @@
# Changelog
All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
---
## [Unreleased]
### Added
### Changed
### Deprecated
### Removed
### Fixed
### Security
---
## [3.7.0]
### Added
- Updated OpenSearch appVersion to 3.7.0
### Changed
### Deprecated
### Removed
### Fixed
### Security
---
## [3.6.0]
### Added
- Updated OpenSearch appVersion to 3.6.0
### Changed
### Deprecated
### Removed
### Fixed
### Security
---
## [3.5.0]
### Added
- Updated OpenSearch appVersion to 3.5.0
### Changed
### Deprecated
### Removed
### Fixed
### Security
---
## [3.4.0]
### Added
- Updated OpenSearch appVersion to 3.4.0
### Changed
### Deprecated
### Removed
### Fixed
### Security
---
## [3.3.2]
### Added
- Updated OpenSearch appVersion to 3.3.2
### Changed
### Deprecated
### Removed
### Fixed
### Security
---
## [3.3.1]
### Added
- Updated OpenSearch appVersion to 3.3.1
### Changed
### Deprecated
### Removed
### Fixed
### Security
---
## [3.3.0]
### Added
- Updated OpenSearch appVersion to 3.3.0
### Changed
### Deprecated
### Removed
### Fixed
### Security
---
## [3.2.1]
### Added
### Changed
### Deprecated
### Removed
### Fixed
- Added missing security context to configfile and keystore init containers to support restricted Kubernetes environments
### Security
---
## [3.2.0]
### Added
- Updated OpenSearch appVersion to 3.2.0
### Changed
### Deprecated
### Removed
### Fixed
### Security
---
## [3.1.0]
### Added
- Updated OpenSearch appVersion to 3.1.0
### Changed
### Deprecated
### Removed
### Fixed
### Security
---
## [3.0.0]
### Added
### Changed
- Switch main branch to be 3.x with 3.0.0 as 1st release
### Deprecated
### Removed
### Fixed
### Security
[Unreleased]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.7.0...HEAD
[3.7.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.6.0...opensearch-3.7.0
[3.6.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.5.0...opensearch-3.6.0
[3.5.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.4.0...opensearch-3.5.0
[3.4.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.3.2...opensearch-3.4.0
[3.3.2]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.3.1...opensearch-3.3.2
[3.3.1]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.3.0...opensearch-3.3.1
[3.3.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.2.1...opensearch-3.3.0
[3.2.1]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.2.0...opensearch-3.2.1
[3.2.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.1.0...opensearch-3.2.0
[3.1.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.0.0...opensearch-3.1.0
[3.0.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-2.33.0...opensearch-3.0.0

36
helm-charts-observability/charts/opensearch/Chart.yaml Normal file
View File

@@ -0,0 +1,36 @@
apiVersion: v2
name: opensearch
description: A Helm chart for OpenSearch
# A chart can be either an 'application' or a 'library' chart.
#
# Application charts are a collection of templates that can be packaged into versioned archives
# to be deployed.
#
# Library charts provide useful utilities or functions for the chart developer. They're included as
# a dependency of application charts to inject those utilities and functions into the rendering
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
type: application
# This is the chart version. This version number should be incremented each time you make changes
# to the chart and its templates, including the app version.
# Versions are expected to follow Semantic Versioning (https://semver.org/)
version: 3.7.0
# This is the version number of the application being deployed. This version number should be
# incremented each time you make changes to the application. Versions are not expected to
# follow Semantic Versioning. They should reflect the version the application is using.
# It is recommended to use it with quotes.
appVersion: "3.7.0"
maintainers:
- name: DandyDeveloper
- name: gaiksaya
- name: peterzhuamazon
- name: prudhvigodithi
- name: TheAlgo
home: https://opensearch.org
sources:
- https://github.com/opensearch-project/opensearch
- https://github.com/opensearch-project/helm-charts

172
helm-charts-observability/charts/opensearch/README.md Normal file
View File

@@ -0,0 +1,172 @@
# OpenSearch Helm Chart
This Helm chart installs [OpenSearch](https://github.com/opensearch-project/OpenSearch) with configurable TLS, RBAC and much more configurations. This chart caters a number of different use cases and setups.
- [OpenSearch Helm Chart](#opensearch-helm-chart)
- [Requirements](#requirements)
- [Installing](#installing)
- [Uninstalling](#uninstalling)
- [Configuration](#configuration)
## Requirements
- Kubernetes >= 1.14
- Helm >= 2.17.0
- We recommend you to have 8 GiB of memory available for this deployment, or at least 4 GiB for the minimum requirement. Else, the deployment is expected to fail.
## Installing
Once you've added this Helm repository as per the repository-level [README](../../README.md#installing) then you can install the chart as follows:
```shell
helm install my-release opensearch/opensearch
```
The command deploys OpenSearch with its associated components (data statefulsets, masters, clients) on the Kubernetes cluster in the default configuration.
**NOTE:** If using Helm 2 then you'll need to add the [`--name`](https://v2.helm.sh/docs/helm/#options-21) command line argument. If unspecified, Helm 2 will autogenerate a name for you.
## Uninstalling
To delete/uninstall the chart with the release name `my-release`:
```shell
helm uninstall my-release
```
## Configuration
| Parameter | Description | Default |
| :---------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :-------------------------------------------------------------------------------------------------------------- |
| `antiAffinityTopologyKey` | The [anti-affinity][] topology key. By default this will prevent multiple Opensearch nodes from running on the same Kubernetes node | `kubernetes.io/hostname` |
| `antiAffinity` | Setting this to `hard` enforces the [anti-affinity][] rules. If it is set to `soft` it will be done "best effort". Setting it to `custom` will use whatever is set in the `customAntiAffinity` parameter. Other values will be ignored. | `hard` |
| `clusterName` | This will be used as the OpenSearch cluster name and should be unique per cluster in the namespace | `opensearch-cluster` |
| `customAntiAffinity` | Allows passing in custom anti-affinity settings as defined in the [anti-affinity][] rules. Using this parameter requires setting the `antiAffinity` parameter to `custom`. | `{}` |
| `enableServiceLinks` | Set to false to disabling service links, which can cause slow pod startup times when there are many services in the current namespace. | `true` |
| `envFrom` | Templatable string to be passed to the [environment from variables][] which will be appended to the `envFrom:` definition for the container | `[]` |
| `config` | Allows you to add any config files in `/usr/share/opensearch/config/` such as `opensearch.yml` and `log4j2.properties`. String or map format may be used for specifying content of each configuration file. In case of string format, the whole content of the config file will be replaced by new config file value when in case of using map format content of configuration file will be a result of merge. In both cases content passed through tpl. See [values.yaml][] for an example of the formatting (passed through tpl) | `{}` |
| `opensearchJavaOpts` | Java options for OpenSearch. This is where you should configure the jvm heap size | `-Xmx512M -Xms512M` |
| `majorVersion` | Used to set major version specific configuration. If you are using a custom image and not running the default OpenSearch version you will need to set this to the version you are running (e.g. `majorVersion: 1`) | `""` |
| `global.dockerRegistry` | Set if you want to change the default docker registry, e.g. a private one. | `""` |
| `extraContainers` | Array of extra containers | `""` |
| `extraEnvs` | Extra environments variables to be passed to OpenSearch services | `[]` |
| `extraInitContainers` | Array of extra init containers | `[]` |
| `extraVolumeMounts` | Array of extra volume mounts | `[]` |
| `extraVolumes` | Array of extra volumes to be added | `[]` |
| `fullnameOverride` | Overrides the `clusterName` and `nodeGroup` when used in the naming of resources. This should only be used when using a single `nodeGroup`, otherwise you will have name conflicts | `""` |
| `hostAliases` | Configurable [hostAliases][] | `[]` |
| `httpHostPort` | Expose another http-port as hostPort. Refer to documentation for more information and requirements about using hostPorts. | `""` |
| `httpPort` | The http port that Kubernetes will use for the healthchecks and the service. If you change this you will also need to set `http.port` in `extraEnvs` | `9200` |
| `image.pullPolicy` | The Kubernetes [imagePullPolicy][] value | `IfNotPresent` |
| `imagePullSecrets` | Configuration for [imagePullSecrets][] so that you can use a private registry for your image | `[]` |
| `image.tag` | The OpenSearch Docker image tag | `1.0.0` |
| `image.repository` | The OpenSearch Docker image | `opensearchproject/opensearch` |
| `ingress` | Configurable [ingress][] to expose the OpenSearch service. See [values.yaml][] for an example | see [values.yaml][] |
| `initResources` | Allows you to set the [resources][] for the `initContainer` in the StatefulSet | `{}` |
| `keystore` | Allows you map Kubernetes secrets into the keystore. | `[]` |
| `labels` | Configurable [labels][] applied to all OpenSearch pods | `{}` |
| `masterService` | The service name used to connect to the masters. You only need to set this if your master `nodeGroup` is set to something other than `master` | `""` |
| `maxUnavailable` | The [maxUnavailable][] value for the pod disruption budget. By default this will prevent Kubernetes from having more than 1 unhealthy pod in the node group | `1` |
| `metricsPort` | The metrics port (for Performance Analyzer) that Kubernetes will use for the service. | `9600` |
| `nameOverride` | Overrides the `clusterName` when used in the naming of resources | `""` |
| `networkHost` | Value for the `network.host OpenSearch setting` | `0.0.0.0` |
| `networkPolicy.create` | Enable network policy creation for OpenSearch | `false` |
| `nodeAffinity` | Value for the [node affinity settings][] | `{}` |
| `nodeGroup` | This is the name that will be used for each group of nodes in the cluster. The name will be `clusterName-nodeGroup-X` , `nameOverride-nodeGroup-X` if a `nameOverride` is specified, and `fullnameOverride-X` if a `fullnameOverride` is specified | `master` |
| `nodeSelector` | Configurable [nodeSelector][] so that you can target specific nodes for your OpenSearch cluster | `{}` |
| `persistence` | Enables a persistent volume for OpenSearch data. | see [values.yaml][] |
| `persistence.enableInitChown` | Disable the `fsgroup-volume` initContainer that will update permissions on the persistent disk. | `true` |
| `podAffinity` | Value for the [pod affinity settings][] | `{}` |
| `podAnnotations` | Configurable [annotations][] applied to all OpenSearch pods | `{}` |
| `podManagementPolicy` | By default Kubernetes [deploys StatefulSets serially][]. This deploys them in parallel so that they can discover each other | `Parallel` |
| `podSecurityContext` | Allows you to set the [securityContext][] for the pod | see [values.yaml][] |
| `podSecurityPolicy` | Configuration for create a pod security policy with minimal permissions to run this Helm chart with `create: true`. Also can be used to reference an external pod security policy with `name: "externalPodSecurityPolicy"` | see [values.yaml][] |
| `priorityClassName` | The name of the [PriorityClass][]. No default is supplied as the PriorityClass must be created first | `""` |
| `rbac` | Configuration for creating a role, role binding and ServiceAccount as part of this Helm chart with `create: true`. Also can be used to reference an external ServiceAccount with `serviceAccountName: "externalServiceAccountName"` | see [values.yaml][] |
| `rbac.automountServiceAccountToken` | Controls whether a service account token should be automatically mounted to the Pods. | `true` |
| `replicas` | Kubernetes replica count for the StatefulSet (i.e. how many pods) | `3` |
| `resources` | Allows you to set the [resources][] for the StatefulSet | see [values.yaml][] |
| `roles` | A list of the specific node [roles][] for the `nodeGroup` | see [values.yaml][] |
| `singleNode` | If `discovery.type` in the opensearch configuration is set to `"single-node"`, this should be set to `true`. If `true`, replicas will be forced to `1`. | `false` |
| `schedulerName` | Name of the [alternate scheduler][] | `""` |
| `secretMounts` | Allows you easily mount a secret as a file inside the StatefulSet. Useful for mounting certificates and other secrets. See [values.yaml][] for an example | `[]` |
| `securityConfig` | Configure the opensearch security plugin. There are multiple ways to inject configuration into the chart, see [values.yaml][] details. | By default an insecure demonstration configuration is set. This **must** be changed before going to production. |
| `securityContext` | Allows you to set the [securityContext][] for the container | see [values.yaml][] |
| `service.annotations` | [LoadBalancer annotations][] that Kubernetes will use for the service. This will configure load balancer if `service.type` is `LoadBalancer` | `{}` |
| `service.headless.annotations` | Allow you to set annotations on the headless service | `{}` |
| `service.externalTrafficPolicy` | Some cloud providers allow you to specify the [LoadBalancer externalTrafficPolicy][]. Kubernetes will use this to preserve the client source IP. This will configure load balancer if `service.type` is `LoadBalancer` | `""` |
| `service.httpPortName` | The name of the http port within the service | `http` |
| `service.labelsHeadless` | Labels to be added to headless service | `{}` |
| `service.labels` | Labels to be added to non-headless service | `{}` |
| `service.loadBalancerIP` | Some cloud providers allow you to specify the [loadBalancer][] IP. If the `loadBalancerIP` field is not specified, the IP is dynamically assigned. If you specify a `loadBalancerIP` but your cloud provider does not support the feature, it is ignored. | `""` |
| `service.loadBalancerSourceRanges` | The IP ranges that are allowed to access | `[]` |
| `service.metricsPortName` | The name of the metrics port (for Performance Analyzer) within the service | `metrics` |
| `service.nodePort` | Custom [nodePort][] port that can be set if you are using `service.type: nodePort` | `""` |
| `service.transportPortName` | The name of the transport port within the service | `transport` |
| `service.type` | OpenSearch [Service Types][] | `ClusterIP` |
| `service.ipFamilyPolicy` | This sets the preferred ip addresses in case of a dual-stack server, there are three options [PreferDualStack, SingleStack, RequireDualStack], [more information on dual stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/) | `""` |
| `service.ipFamilies` | Sets the preferred IP variants and in which order they are preferred, the first family you list is used for the legacy .spec.ClusterIP field, [more information on dual stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/) | `""` |
| `sidecarResources` | Allows you to set the [resources][] for the sidecar containers in the StatefulSet | {} |
| `sysctlInit` | Allows you to enable the `sysctlInit` to set sysctl vm.max_map_count through privileged `initContainer`. | `enabled: false` |
| `sysctlVmMaxMapCount` | Sets the [vm.max_map_count][] needed for OpenSearch | `262144` |
| `terminationGracePeriod` | The [terminationGracePeriod][] in seconds used when trying to stop the pod | `120` |
| `tolerations` | Configurable [tolerations][] | `[]` |
| `topologySpreadConstraints` | Configuration for pod [topologySpreadConstraints][] | `[]` |
| `transportHostPort` | Expose another transport port as hostPort. Refer to documentation for more information and requirements about using hostPorts. | `""` |
| `transportPort` | The transport port that Kubernetes will use for the service. If you change this you will also need to set transport port configuration in `extraEnvs` | `9300` |
| `updateStrategy` | The [updateStrategy][] for the StatefulSet. By default Kubernetes will wait for the cluster to be green after upgrading each pod. Setting this to `OnDelete` will allow you to manually delete each pod during upgrades | `RollingUpdate` |
| `volumeClaimTemplate` | Configuration for the [volumeClaimTemplate for StatefulSets][]. You will want to adjust the storage (default `30Gi` ) and the `storageClassName` if you are using a different storage class | see [values.yaml][] |
| `extraObjects` | Array of extra K8s manifests to deploy | list `[]` |
| `livenessProbe` | Configuration fields for the liveness [probe][] | see [exampleLiveness][] in `values.yaml` |
| `readinessProbe` | Configuration fields for the readiness [probe][] | see [exampleReadiness][] in `values.yaml` |
| `startupProbe` | Configuration fields for the startup [probe][] | see [exampleStartup][] in `values.yaml` |
| `plugins.enabled` | Allow/disallow to add 3rd Party / Custom plugins not offered in the default OpenSearchDashboards image | false |
| `plugins.installList` | Array containing the Opensearch Dashboards plugins to be installed in container | \[] |
| `opensearchLifecycle` | Allows you to configure lifecycle hooks for the OpenSearch container in the StatefulSet | {} |
| `lifecycle` | Allows you to configure lifecycle hooks for the OpenSearch container in the StatefulSet | {} |
| `openSearchAnnotations` | Allows you to configure custom annotation in the StatefullSet of the OpenSearch container | {} |
| `serviceMonitor.enabled` | Enables the creation of a [ServiceMonitor] resource for Prometheus monitoring. Requires the Prometheus Operator to be installed in your Kubernetes cluster. | `false` |
| `serviceMonitor.path` | Path where metrics are exposed. Applicable only if `serviceMonitor.enabled` is set to `true`. | `/_prometheus/metrics` |
| `serviceMonitor.interval` | Interval at which metrics should be scraped by Prometheus. Applicable only if `serviceMonitor.enabled` is set to `true`. | `10s` |
| `serviceMonitor.basicAuth.enabled` | Wheter or not the serviceMonitor should use basic auth | `false` |
| `serviceMonitor.basicAuth.existingSecret` | When using basicAuth for the serviceMonitor, use an existing secret | `""` |
| `serviceMonitor.basicAuth.username` | Username to be used for basic auth | `""` |
| `serviceMonitor.basicAuth.password` | Password to be used for basic auth | `""` |
| `serviceMonitor.scheme` | scheme to be used for scraping the metrics | `"http"` |
| `serviceMonitor.tlsConfig` | optional tlsConfig to be used for scraping | `{}` |
[anti-affinity]: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
[environment from variables]: https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/#configure-all-key-value-pairs-in-a-configmap-as-container-environment-variables
[values.yaml]: https://github.com/opensearch-project/helm-charts/blob/main/charts/opensearch/values.yaml
[hostAliases]: https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/
[imagepullPolicy]: https://kubernetes.io/docs/concepts/containers/images/#updating-images
[imagePullSecrets]: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
[ingress]: https://kubernetes.io/docs/concepts/services-networking/ingress/
[resources]: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
[labels]: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
[maxUnavailable]: https://kubernetes.io/docs/tasks/run-application/configure-pdb/#specifying-a-poddisruptionbudget
[node affinity settings]: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#node-affinity-beta-feature
[pod affinity settings]: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity
[nodeSelector]: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
[annotations]: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
[deploys statefulsets serially]: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies
[securityContext]: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
[priorityClass]: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
[roles]: https://opensearch.org/docs/opensearch/cluster/
[alternate scheduler]: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/#specify-schedulers-for-pods
[loadBalancer annotations]: https://kubernetes.io/docs/concepts/services-networking/service/#ssl-support-on-aws
[loadBalancer externalTrafficPolicy]: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
[loadBalancer]: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer
[nodePort]: https://kubernetes.io/docs/concepts/services-networking/service/#nodeport
[vm.max_map_count]: https://opensearch.org/docs/opensearch/install/important-settings/
[terminationGracePeriod]: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods
[tolerations]: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
[updateStrategy]: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/
[volumeClaimTemplate for statefulsets]: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#stable-storage
[service types]: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
[topologySpreadConstraints]: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints
[probe]: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-readiness-probes
[exampleStartup]: https://github.com/opensearch-project/helm-charts/blob/main/charts/opensearch/values.yaml#332
[exampleLiveness]: https://github.com/opensearch-project/helm-charts/blob/main/charts/opensearch/values.yaml#340
[exampleReadiness]: https://github.com/opensearch-project/helm-charts/blob/main/charts/opensearch/values.yaml#349
[ServiceMonitor]: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#servicemonitor

442
helm-charts-observability/charts/opensearch/ci/ci-ingress-class-name-values.yaml Normal file
View File

@@ -0,0 +1,442 @@
---
clusterName: "opensearch-cluster"
nodeGroup: "master"
# The service that non master groups will try to connect to when joining the cluster
# This should be set to clusterName + "-" + nodeGroup for your master group
masterService: "opensearch-cluster-master"
# OpenSearch roles that will be applied to this nodeGroup
# These will be set as environment variable "node.roles". E.g. node.roles=master,ingest,data,remote_cluster_client
roles:
- master
- ingest
- data
- remote_cluster_client
replicas: 1
# if not set, falls back to parsing .Values.imageTag, then .Chart.appVersion.
majorVersion: ""
global:
# Set if you want to change the default docker registry, e.g. a private one.
dockerRegistry: ""
# Allows you to add any config files in {{ .Values.opensearchHome }}/config
opensearchHome: /usr/share/opensearch
# such as opensearch.yml and log4j2.properties
config:
# Values must be YAML literal style scalar / YAML multiline string.
# <filename>: |
# <formatted-value(s)>
# log4j2.properties: |
# status = error
#
# appender.console.type = Console
# appender.console.name = console
# appender.console.layout.type = PatternLayout
# appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n
#
# rootLogger.level = info
# rootLogger.appenderRef.console.ref = console
opensearch.yml: |
cluster.name: opensearch-cluster
# Bind to all interfaces because we don't know what IP address Docker will assign to us.
network.host: 0.0.0.0
transport.host: localhost
transport.tcp.port: 9300
# Setting network.host to a non-loopback address enables the annoying bootstrap checks. "Single-node" mode disables them again.
# discovery.type: single-node
# # Start OpenSearch Security Demo Configuration
# # WARNING: revise all the lines below before you go into production
# plugins:
# security:
# ssl:
# transport:
# pemcert_filepath: esnode.pem
# pemkey_filepath: esnode-key.pem
# pemtrustedcas_filepath: root-ca.pem
# enforce_hostname_verification: false
# http:
# enabled: true
# pemcert_filepath: esnode.pem
# pemkey_filepath: esnode-key.pem
# pemtrustedcas_filepath: root-ca.pem
# allow_unsafe_democertificates: true
# allow_default_init_securityindex: true
# authcz:
# admin_dn:
# - CN=kirk,OU=client,O=client,L=test,C=de
# audit.type: internal_opensearch
# enable_snapshot_restore_privilege: true
# check_snapshot_restore_write_privileges: true
# restapi:
# roles_enabled: ["all_access", "security_rest_api_access"]
# system_indices:
# enabled: true
# indices:
# [
# ".opendistro-alerting-config",
# ".opendistro-alerting-alert*",
# ".opendistro-anomaly-results*",
# ".opendistro-anomaly-detector*",
# ".opendistro-anomaly-checkpoints",
# ".opendistro-anomaly-detection-state",
# ".opendistro-reports-*",
# ".opendistro-notifications-*",
# ".opendistro-notebooks",
# ".opendistro-asynchronous-search-response*",
# ]
# ######## End OpenSearch Security Demo Configuration ########
# log4j2.properties:
# Extra environment variables to append to this nodeGroup
# This will be appended to the current 'env:' key. You can use any of the kubernetes env
# syntax here
extraEnvs:
- name: OPENSEARCH_INITIAL_ADMIN_PASSWORD
value: myStrongPassword123@456
# - name: MY_ENVIRONMENT_VAR
# value: the_value_goes_here
# Allows you to load environment variables from kubernextes secret or config map
envFrom: []
# - secretRef:
# name: env-secret
# - configMapRef:
# name: config-map
# A list of secrets and their paths to mount inside the pod
# This is useful for mounting certificates for security and for mounting
# the X-Pack license
secretMounts: []
hostAliases: []
# - ip: "127.0.0.1"
# hostnames:
# - "foo.local"
# - "bar.local"
image:
repository: "opensearchproject/opensearch"
# override image tag, which is .Chart.AppVersion by default
tag: ""
pullPolicy: "IfNotPresent"
podAnnotations: {}
# iam.amazonaws.com/role: es-cluster
# additionals labels
labels: {}
opensearchJavaOpts: "-Xmx512M -Xms512M"
resources:
requests:
cpu: "1000m"
memory: "100Mi"
initResources: {}
# limits:
# cpu: "25m"
# # memory: "128Mi"
# requests:
# cpu: "25m"
# memory: "128Mi"
sidecarResources: {}
# limits:
# cpu: "25m"
# # memory: "128Mi"
# requests:
# cpu: "25m"
# memory: "128Mi"
networkHost: "0.0.0.0"
rbac:
create: false
serviceAccountAnnotations: {}
serviceAccountName: ""
automountServiceAccountToken: false
podSecurityPolicy:
create: false
name: ""
spec:
privileged: true
fsGroup:
rule: RunAsAny
runAsUser:
rule: RunAsAny
seLinux:
rule: RunAsAny
supplementalGroups:
rule: RunAsAny
volumes:
- secret
- configMap
- persistentVolumeClaim
- emptyDir
persistence:
enabled: true
# Set to false to disable the `fsgroup-volume` initContainer that will update permissions on the persistent disk.
enableInitChown: true
# override image, which is busybox by default
# image: busybox
# override image tag, which is latest by default
# imageTag:
labels:
# Add default labels for the volumeClaimTemplate of the StatefulSet
enabled: false
# OpenSearch Persistent Volume Storage Class
# If defined, storageClassName: <storageClass>
# If set to "-", storageClassName: "", which disables dynamic provisioning
# If undefined (the default) or set to null, no storageClassName spec is
# set, choosing the default provisioner. (gp2 on AWS, standard on
# GKE, AWS & OpenStack)
#
# storageClass: "-"
accessModes:
- ReadWriteOnce
size: 8Gi
annotations: {}
extraVolumes: []
# - name: extras
# emptyDir: {}
extraVolumeMounts: []
# - name: extras
# mountPath: /usr/share/extras
# readOnly: true
extraContainers: []
# - name: do-something
# image: busybox
# command: ['do', 'something']
extraInitContainers: []
# - name: do-somethings
# image: busybox
# command: ['do', 'something']
# This is the PriorityClass settings as defined in
# https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
priorityClassName: ""
# By default this will make sure two pods don't end up on the same node
# Changing this to a region would allow you to spread pods across regions
antiAffinityTopologyKey: "kubernetes.io/hostname"
# Hard means that by default pods will only be scheduled if there are enough nodes for them
# and that they will never end up on the same node. Setting this to soft will do this "best effort".
# Setting this to custom will use what is passed into customAntiAffinity.
antiAffinity: "soft"
# Allows passing in custom anti-affinity settings as defined in
# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity
# Using this parameter requires setting antiAffinity to custom.
customAntiAffinity: {}
# This is the node affinity settings as defined in
# https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#node-affinity-beta-feature
nodeAffinity: {}
# This is the pod affinity settings as defined in
# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity
podAffinity: {}
# The default is to deploy all pods serially. By setting this to parallel all pods are started at
# the same time when bootstrapping the cluster
podManagementPolicy: "Parallel"
# The environment variables injected by service links are not used, but can lead to slow OpenSearch boot times when
# there are many services in the current namespace.
# If you experience slow pod startups you probably want to set this to `false`.
enableServiceLinks: true
protocol: https
httpPort: 9200
transportPort: 9300
metricsPort: 9600
service:
labels: {}
labelsHeadless: {}
headless:
annotations: {}
type: ClusterIP
nodePort: ""
annotations: {}
httpPortName: http
transportPortName: transport
loadBalancerIP: ""
loadBalancerSourceRanges: []
externalTrafficPolicy: ""
updateStrategy: RollingUpdate
# This is the max unavailable setting for the pod disruption budget
# The default value of 1 will make sure that kubernetes won't allow more than 1
# of your pods to be unavailable during maintenance
maxUnavailable: 1
podSecurityContext:
fsGroup: 1000
runAsUser: 1000
securityContext:
capabilities:
drop:
- ALL
# readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
securityConfig:
enabled: true
path: "/usr/share/opensearch/plugins/opensearch-security/securityconfig"
actionGroupsSecret:
configSecret:
internalUsersSecret:
rolesSecret:
rolesMappingSecret:
tenantsSecret:
# The following option simplifies securityConfig by using a single secret and
# specifying the config files as keys in the secret instead of creating
# different secrets for for each config file.
# Note that this is an alternative to the individual secret configuration
# above and shouldn't be used if the above secrets are used.
config:
# There are multiple ways to define the configuration here:
# * If you define anything under data, the chart will automatically create
# a secret and mount it.
# * If you define securityConfigSecret, the chart will assume this secret is
# created externally and mount it.
# * It is an error to define both data and securityConfigSecret.
securityConfigSecret: ""
data: {}
# config.yml: |-
# internal_users.yml: |-
# roles.yml: |-
# roles_mapping.yml: |-
# action_groups.yml: |-
# tenants.yml: |-
# How long to wait for opensearch to stop gracefully
terminationGracePeriod: 120
sysctlVmMaxMapCount: 262144
startupProbe:
tcpSocket:
port: 9200
initialDelaySeconds: 5
periodSeconds: 10
timeoutSeconds: 3
failureThreshold: 30
readinessProbe:
failureThreshold: 3
initialDelaySeconds: 900
periodSeconds: 10
successThreshold: 3
timeoutSeconds: 2
## Use an alternate scheduler.
## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
##
schedulerName: ""
imagePullSecrets: []
nodeSelector: {}
tolerations: []
# Enabling this will publically expose your OpenSearch instance.
# Only enable this if you have security enabled on your cluster
ingress:
enabled: true
# For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName
# See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress
ingressClassName: nginx
annotations: {}
# kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: "true"
path: /
hosts:
- chart-example.local
tls: []
# - secretName: chart-example-tls
# hosts:
# - chart-example.local
nameOverride: ""
fullnameOverride: ""
masterTerminationFix: false
lifecycle: {}
# preStop:
# exec:
# command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"]
# postStart:
# exec:
# command:
# - bash
# - -c
# - |
# #!/bin/bash
# # Add a template to adjust number of shards/replicas1
# TEMPLATE_NAME=my_template
# INDEX_PATTERN="logstash-*"
# SHARD_COUNT=8
# REPLICA_COUNT=1
# ES_URL=http://localhost:9200
# while [[ "$(curl -s -o /dev/null -w '%{http_code}\n' $ES_URL)" != "200" ]]; do sleep 1; done
# curl -XPUT "$ES_URL/_template/$TEMPLATE_NAME" -H 'Content-Type: application/json' -d'{"index_patterns":['\""$INDEX_PATTERN"\"'],"settings":{"number_of_shards":'$SHARD_COUNT',"number_of_replicas":'$REPLICA_COUNT'}}'
keystore: []
networkPolicy:
## Enable creation of NetworkPolicy resources. Only Ingress traffic is filtered for now.
## In order for a Pod to access OpenSearch, it needs to have the following label:
## {{ template "uname" . }}-client: "true"
## Example for default configuration to access HTTP port:
## opensearch-master-http-client: "true"
## Example for default configuration to access transport port:
## opensearch-master-transport-client: "true"
http:
enabled: false
# Deprecated
# please use the above podSecurityContext.fsGroup instead
fsGroup: ""
## Set optimal sysctl's through securityContext. This requires privilege. Can be disabled if
## the system has already been preconfigured. (Ex: https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html)
## Also see: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/
sysctl:
enabled: false
## Set optimal sysctl's through privileged initContainer.
sysctlInit:
enabled: true
# override image, which is busybox by default
# image: busybox
# override image tag, which is latest by default
# imageTag:
## Enable to add 3rd Party / Custom plugins not offered in the default OpenSearch image.
plugins:
enabled: false
installList: []
# - example-fake-plugin

442
helm-charts-observability/charts/opensearch/ci/ci-rbac-enabled-values.yaml Executable file
View File

@@ -0,0 +1,442 @@
---
clusterName: "opensearch-cluster"
nodeGroup: "master"
# The service that non master groups will try to connect to when joining the cluster
# This should be set to clusterName + "-" + nodeGroup for your master group
masterService: "opensearch-cluster-master"
# OpenSearch roles that will be applied to this nodeGroup
# These will be set as environment variable "node.roles". E.g. node.roles=master,ingest,data,remote_cluster_client
roles:
- master
- ingest
- data
- remote_cluster_client
replicas: 1
# if not set, falls back to parsing .Values.imageTag, then .Chart.appVersion.
majorVersion: ""
global:
# Set if you want to change the default docker registry, e.g. a private one.
dockerRegistry: ""
# Allows you to add any config files in {{ .Values.opensearchHome }}/config
opensearchHome: /usr/share/opensearch
# such as opensearch.yml and log4j2.properties
config:
# Values must be YAML literal style scalar / YAML multiline string.
# <filename>: |
# <formatted-value(s)>
# log4j2.properties: |
# status = error
#
# appender.console.type = Console
# appender.console.name = console
# appender.console.layout.type = PatternLayout
# appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n
#
# rootLogger.level = info
# rootLogger.appenderRef.console.ref = console
opensearch.yml: |
cluster.name: opensearch-cluster
# Bind to all interfaces because we don't know what IP address Docker will assign to us.
network.host: 0.0.0.0
transport.host: localhost
transport.tcp.port: 9300
# Setting network.host to a non-loopback address enables the annoying bootstrap checks. "Single-node" mode disables them again.
# discovery.type: single-node
# # Start OpenSearch Security Demo Configuration
# # WARNING: revise all the lines below before you go into production
# plugins:
# security:
# ssl:
# transport:
# pemcert_filepath: esnode.pem
# pemkey_filepath: esnode-key.pem
# pemtrustedcas_filepath: root-ca.pem
# enforce_hostname_verification: false
# http:
# enabled: true
# pemcert_filepath: esnode.pem
# pemkey_filepath: esnode-key.pem
# pemtrustedcas_filepath: root-ca.pem
# allow_unsafe_democertificates: true
# allow_default_init_securityindex: true
# authcz:
# admin_dn:
# - CN=kirk,OU=client,O=client,L=test,C=de
# audit.type: internal_opensearch
# enable_snapshot_restore_privilege: true
# check_snapshot_restore_write_privileges: true
# restapi:
# roles_enabled: ["all_access", "security_rest_api_access"]
# system_indices:
# enabled: true
# indices:
# [
# ".opendistro-alerting-config",
# ".opendistro-alerting-alert*",
# ".opendistro-anomaly-results*",
# ".opendistro-anomaly-detector*",
# ".opendistro-anomaly-checkpoints",
# ".opendistro-anomaly-detection-state",
# ".opendistro-reports-*",
# ".opendistro-notifications-*",
# ".opendistro-notebooks",
# ".opendistro-asynchronous-search-response*",
# ]
# ######## End OpenSearch Security Demo Configuration ########
# log4j2.properties:
# Extra environment variables to append to this nodeGroup
# This will be appended to the current 'env:' key. You can use any of the kubernetes env
# syntax here
extraEnvs:
- name: OPENSEARCH_INITIAL_ADMIN_PASSWORD
value: myStrongPassword123@456
# - name: MY_ENVIRONMENT_VAR
# value: the_value_goes_here
# Allows you to load environment variables from kubernextes secret or config map
envFrom: []
# - secretRef:
# name: env-secret
# - configMapRef:
# name: config-map
# A list of secrets and their paths to mount inside the pod
# This is useful for mounting certificates for security and for mounting
# the X-Pack license
secretMounts: []
hostAliases: []
# - ip: "127.0.0.1"
# hostnames:
# - "foo.local"
# - "bar.local"
image:
repository: "opensearchproject/opensearch"
# override image tag, which is .Chart.AppVersion by default
tag: ""
pullPolicy: "IfNotPresent"
podAnnotations: {}
# iam.amazonaws.com/role: es-cluster
# additionals labels
labels: {}
opensearchJavaOpts: "-Xmx512M -Xms512M"
resources:
requests:
cpu: "1000m"
memory: "100Mi"
initResources: {}
# limits:
# cpu: "25m"
# # memory: "128Mi"
# requests:
# cpu: "25m"
# memory: "128Mi"
sidecarResources: {}
# limits:
# cpu: "25m"
# # memory: "128Mi"
# requests:
# cpu: "25m"
# memory: "128Mi"
networkHost: "0.0.0.0"
rbac:
create: true
serviceAccountAnnotations: {}
serviceAccountName: ""
automountServiceAccountToken: true
podSecurityPolicy:
create: false
name: ""
spec:
privileged: true
fsGroup:
rule: RunAsAny
runAsUser:
rule: RunAsAny
seLinux:
rule: RunAsAny
supplementalGroups:
rule: RunAsAny
volumes:
- secret
- configMap
- persistentVolumeClaim
- emptyDir
persistence:
enabled: true
# Set to false to disable the `fsgroup-volume` initContainer that will update permissions on the persistent disk.
enableInitChown: true
# override image, which is busybox by default
# image: busybox
# override image tag, which is latest by default
# imageTag:
labels:
# Add default labels for the volumeClaimTemplate of the StatefulSet
enabled: false
# OpenSearch Persistent Volume Storage Class
# If defined, storageClassName: <storageClass>
# If set to "-", storageClassName: "", which disables dynamic provisioning
# If undefined (the default) or set to null, no storageClassName spec is
# set, choosing the default provisioner. (gp2 on AWS, standard on
# GKE, AWS & OpenStack)
#
# storageClass: "-"
accessModes:
- ReadWriteOnce
size: 8Gi
annotations: {}
extraVolumes: []
# - name: extras
# emptyDir: {}
extraVolumeMounts: []
# - name: extras
# mountPath: /usr/share/extras
# readOnly: true
extraContainers: []
# - name: do-something
# image: busybox
# command: ['do', 'something']
extraInitContainers: []
# - name: do-somethings
# image: busybox
# command: ['do', 'something']
# This is the PriorityClass settings as defined in
# https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
priorityClassName: ""
# By default this will make sure two pods don't end up on the same node
# Changing this to a region would allow you to spread pods across regions
antiAffinityTopologyKey: "kubernetes.io/hostname"
# Hard means that by default pods will only be scheduled if there are enough nodes for them
# and that they will never end up on the same node. Setting this to soft will do this "best effort".
# Setting this to custom will use what is passed into customAntiAffinity.
antiAffinity: "soft"
# Allows passing in custom anti-affinity settings as defined in
# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity
# Using this parameter requires setting antiAffinity to custom.
customAntiAffinity: {}
# This is the node affinity settings as defined in
# https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#node-affinity-beta-feature
nodeAffinity: {}
# This is the pod affinity settings as defined in
# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity
podAffinity: {}
# The default is to deploy all pods serially. By setting this to parallel all pods are started at
# the same time when bootstrapping the cluster
podManagementPolicy: "Parallel"
# The environment variables injected by service links are not used, but can lead to slow OpenSearch boot times when
# there are many services in the current namespace.
# If you experience slow pod startups you probably want to set this to `false`.
enableServiceLinks: true
protocol: https
httpPort: 9200
transportPort: 9300
metricsPort: 9600
service:
labels: {}
labelsHeadless: {}
headless:
annotations: {}
type: ClusterIP
nodePort: ""
annotations: {}
httpPortName: http
transportPortName: transport
loadBalancerIP: ""
loadBalancerSourceRanges: []
externalTrafficPolicy: ""
updateStrategy: RollingUpdate
# This is the max unavailable setting for the pod disruption budget
# The default value of 1 will make sure that kubernetes won't allow more than 1
# of your pods to be unavailable during maintenance
maxUnavailable: 1
podSecurityContext:
fsGroup: 1000
runAsUser: 1000
securityContext:
capabilities:
drop:
- ALL
# readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
securityConfig:
enabled: true
path: "/usr/share/opensearch/plugins/opensearch-security/securityconfig"
actionGroupsSecret:
configSecret:
internalUsersSecret:
rolesSecret:
rolesMappingSecret:
tenantsSecret:
# The following option simplifies securityConfig by using a single secret and
# specifying the config files as keys in the secret instead of creating
# different secrets for for each config file.
# Note that this is an alternative to the individual secret configuration
# above and shouldn't be used if the above secrets are used.
config:
# There are multiple ways to define the configuration here:
# * If you define anything under data, the chart will automatically create
# a secret and mount it.
# * If you define securityConfigSecret, the chart will assume this secret is
# created externally and mount it.
# * It is an error to define both data and securityConfigSecret.
securityConfigSecret: ""
data: {}
# config.yml: |-
# internal_users.yml: |-
# roles.yml: |-
# roles_mapping.yml: |-
# action_groups.yml: |-
# tenants.yml: |-
# How long to wait for opensearch to stop gracefully
terminationGracePeriod: 120
sysctlVmMaxMapCount: 262144
startupProbe:
tcpSocket:
port: 9200
initialDelaySeconds: 5
periodSeconds: 10
timeoutSeconds: 3
failureThreshold: 30
readinessProbe:
failureThreshold: 3
initialDelaySeconds: 900
periodSeconds: 10
successThreshold: 3
timeoutSeconds: 2
## Use an alternate scheduler.
## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
##
schedulerName: ""
imagePullSecrets: []
nodeSelector: {}
tolerations: []
# Enabling this will publically expose your OpenSearch instance.
# Only enable this if you have security enabled on your cluster
ingress:
enabled: false
# For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName
# See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress
ingressClassName: nginx
annotations: {}
# kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: "true"
path: /
hosts:
- chart-example.local
tls: []
# - secretName: chart-example-tls
# hosts:
# - chart-example.local
nameOverride: ""
fullnameOverride: ""
masterTerminationFix: false
lifecycle: {}
# preStop:
# exec:
# command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"]
# postStart:
# exec:
# command:
# - bash
# - -c
# - |
# #!/bin/bash
# # Add a template to adjust number of shards/replicas1
# TEMPLATE_NAME=my_template
# INDEX_PATTERN="logstash-*"
# SHARD_COUNT=8
# REPLICA_COUNT=1
# ES_URL=http://localhost:9200
# while [[ "$(curl -s -o /dev/null -w '%{http_code}\n' $ES_URL)" != "200" ]]; do sleep 1; done
# curl -XPUT "$ES_URL/_template/$TEMPLATE_NAME" -H 'Content-Type: application/json' -d'{"index_patterns":['\""$INDEX_PATTERN"\"'],"settings":{"number_of_shards":'$SHARD_COUNT',"number_of_replicas":'$REPLICA_COUNT'}}'
keystore: []
networkPolicy:
## Enable creation of NetworkPolicy resources. Only Ingress traffic is filtered for now.
## In order for a Pod to access OpenSearch, it needs to have the following label:
## {{ template "uname" . }}-client: "true"
## Example for default configuration to access HTTP port:
## opensearch-master-http-client: "true"
## Example for default configuration to access transport port:
## opensearch-master-transport-client: "true"
http:
enabled: false
# Deprecated
# please use the above podSecurityContext.fsGroup instead
fsGroup: ""
## Set optimal sysctl's through securityContext. This requires privilege. Can be disabled if
## the system has already been preconfigured. (Ex: https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html)
## Also see: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/
sysctl:
enabled: false
## Set optimal sysctl's through privileged initContainer.
sysctlInit:
enabled: false
# override image, which is busybox by default
# image: busybox
# override image tag, which is latest by default
# imageTag:
## Enable to add 3rd Party / Custom plugins not offered in the default OpenSearch image.
plugins:
enabled: false
installList: []
# - example-fake-plugin

428
helm-charts-observability/charts/opensearch/ci/ci-values.yaml Executable file
View File

@@ -0,0 +1,428 @@
---
clusterName: "opensearch-cluster"
nodeGroup: "master"
# The service that non master groups will try to connect to when joining the cluster
# This should be set to clusterName + "-" + nodeGroup for your master group
masterService: "opensearch-cluster-master"
# OpenSearch roles that will be applied to this nodeGroup
# These will be set as environment variable "node.roles". E.g. node.roles=master,ingest,data,remote_cluster_client
roles:
- master
- ingest
- data
- remote_cluster_client
replicas: 1
# if not set, falls back to parsing .Values.imageTag, then .Chart.appVersion.
majorVersion: ""
global:
# Set if you want to change the default docker registry, e.g. a private one.
dockerRegistry: ""
# Allows you to add any config files in {{ .Values.opensearchHome }}/config
opensearchHome: /usr/share/opensearch
# such as opensearch.yml and log4j2.properties
config:
# Values must be YAML literal style scalar / YAML multiline string.
# <filename>: |
# <formatted-value(s)>
# log4j2.properties: |
# status = error
#
# appender.console.type = Console
# appender.console.name = console
# appender.console.layout.type = PatternLayout
# appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n
#
# rootLogger.level = info
# rootLogger.appenderRef.console.ref = console
opensearch.yml: |
cluster.name: opensearch-cluster
# Bind to all interfaces because we don't know what IP address Docker will assign to us.
network.host: 0.0.0.0
transport.host: localhost
transport.tcp.port: 9300
# Setting network.host to a non-loopback address enables the annoying bootstrap checks. "Single-node" mode disables them again.
# discovery.type: single-node
# # Start OpenSearch Security Demo Configuration
# # WARNING: revise all the lines below before you go into production
# plugins:
# security:
# ssl:
# transport:
# pemcert_filepath: esnode.pem
# pemkey_filepath: esnode-key.pem
# pemtrustedcas_filepath: root-ca.pem
# enforce_hostname_verification: false
# http:
# enabled: true
# pemcert_filepath: esnode.pem
# pemkey_filepath: esnode-key.pem
# pemtrustedcas_filepath: root-ca.pem
# allow_unsafe_democertificates: true
# allow_default_init_securityindex: true
# authcz:
# admin_dn:
# - CN=kirk,OU=client,O=client,L=test,C=de
# audit.type: internal_opensearch
# enable_snapshot_restore_privilege: true
# check_snapshot_restore_write_privileges: true
# restapi:
# roles_enabled: ["all_access", "security_rest_api_access"]
# system_indices:
# enabled: true
# indices:
# [
# ".opendistro-alerting-config",
# ".opendistro-alerting-alert*",
# ".opendistro-anomaly-results*",
# ".opendistro-anomaly-detector*",
# ".opendistro-anomaly-checkpoints",
# ".opendistro-anomaly-detection-state",
# ".opendistro-reports-*",
# ".opendistro-notifications-*",
# ".opendistro-notebooks",
# ".opendistro-asynchronous-search-response*",
# ]
# ######## End OpenSearch Security Demo Configuration ########
# log4j2.properties:
# Extra environment variables to append to this nodeGroup
# This will be appended to the current 'env:' key. You can use any of the kubernetes env
# syntax here
extraEnvs:
- name: OPENSEARCH_INITIAL_ADMIN_PASSWORD
value: myStrongPassword123@456
# - name: MY_ENVIRONMENT_VAR
# value: the_value_goes_here
# Allows you to load environment variables from kubernextes secret or config map
envFrom: []
# - secretRef:
# name: env-secret
# - configMapRef:
# name: config-map
# A list of secrets and their paths to mount inside the pod
# This is useful for mounting certificates for security and for mounting
# the X-Pack license
secretMounts: []
hostAliases: []
# - ip: "127.0.0.1"
# hostnames:
# - "foo.local"
# - "bar.local"
image:
repository: "opensearchproject/opensearch"
# override image tag, which is .Chart.AppVersion by default
tag: ""
pullPolicy: "IfNotPresent"
podAnnotations: {}
# iam.amazonaws.com/role: es-cluster
# additionals labels
labels: {}
opensearchJavaOpts: "-Xmx512M -Xms512M"
resources:
requests:
cpu: "1000m"
memory: "100Mi"
initResources: {}
# limits:
# cpu: "25m"
# # memory: "128Mi"
# requests:
# cpu: "25m"
# memory: "128Mi"
sidecarResources: {}
# limits:
# cpu: "25m"
# # memory: "128Mi"
# requests:
# cpu: "25m"
# memory: "128Mi"
networkHost: "0.0.0.0"
rbac:
create: false
serviceAccountAnnotations: {}
serviceAccountName: ""
podSecurityPolicy:
create: false
name: ""
spec:
privileged: true
fsGroup:
rule: RunAsAny
runAsUser:
rule: RunAsAny
seLinux:
rule: RunAsAny
supplementalGroups:
rule: RunAsAny
volumes:
- secret
- configMap
- persistentVolumeClaim
- emptyDir
persistence:
enabled: true
# Set to false to disable the `fsgroup-volume` initContainer that will update permissions on the persistent disk.
enableInitChown: true
# override image, which is busybox by default
# image: busybox
# override image tag, which is latest by default
# imageTag:
labels:
# Add default labels for the volumeClaimTemplate of the StatefulSet
enabled: false
# OpenSearch Persistent Volume Storage Class
# If defined, storageClassName: <storageClass>
# If set to "-", storageClassName: "", which disables dynamic provisioning
# If undefined (the default) or set to null, no storageClassName spec is
# set, choosing the default provisioner. (gp2 on AWS, standard on
# GKE, AWS & OpenStack)
#
# storageClass: "-"
accessModes:
- ReadWriteOnce
size: 8Gi
annotations: {}
extraVolumes: []
# - name: extras
# emptyDir: {}
extraVolumeMounts: []
# - name: extras
# mountPath: /usr/share/extras
# readOnly: true
extraContainers: []
# - name: do-something
# image: busybox
# command: ['do', 'something']
extraInitContainers: []
# - name: do-somethings
# image: busybox
# command: ['do', 'something']
# This is the PriorityClass settings as defined in
# https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
priorityClassName: ""
# By default this will make sure two pods don't end up on the same node
# Changing this to a region would allow you to spread pods across regions
antiAffinityTopologyKey: "kubernetes.io/hostname"
# Hard means that by default pods will only be scheduled if there are enough nodes for them
# and that they will never end up on the same node. Setting this to soft will do this "best effort".
# Setting this to custom will use what is passed into customAntiAffinity.
antiAffinity: "soft"
# Allows passing in custom anti-affinity settings as defined in
# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity
# Using this parameter requires setting antiAffinity to custom.
customAntiAffinity: {}
# This is the node affinity settings as defined in
# https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#node-affinity-beta-feature
nodeAffinity: {}
# This is the pod affinity settings as defined in
# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity
podAffinity: {}
# The default is to deploy all pods serially. By setting this to parallel all pods are started at
# the same time when bootstrapping the cluster
podManagementPolicy: "Parallel"
# The environment variables injected by service links are not used, but can lead to slow OpenSearch boot times when
# there are many services in the current namespace.
# If you experience slow pod startups you probably want to set this to `false`.
enableServiceLinks: true
protocol: https
httpPort: 9200
transportPort: 9300
metricsPort: 9600
service:
labels: {}
labelsHeadless: {}
headless:
annotations: {}
type: ClusterIP
nodePort: ""
annotations: {}
httpPortName: http
transportPortName: transport
loadBalancerIP: ""
loadBalancerSourceRanges: []
externalTrafficPolicy: ""
updateStrategy: RollingUpdate
# This is the max unavailable setting for the pod disruption budget
# The default value of 1 will make sure that kubernetes won't allow more than 1
# of your pods to be unavailable during maintenance
maxUnavailable: 1
podSecurityContext:
fsGroup: 1000
runAsUser: 1000
securityContext:
capabilities:
drop:
- ALL
# readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
securityConfig:
enabled: true
path: "/usr/share/opensearch/plugins/opensearch-security/securityconfig"
actionGroupsSecret:
configSecret:
internalUsersSecret:
rolesSecret:
rolesMappingSecret:
tenantsSecret:
# The following option simplifies securityConfig by using a single secret and
# specifying the config files as keys in the secret instead of creating
# different secrets for for each config file.
# Note that this is an alternative to the individual secret configuration
# above and shouldn't be used if the above secrets are used.
config:
# There are multiple ways to define the configuration here:
# * If you define anything under data, the chart will automatically create
# a secret and mount it.
# * If you define securityConfigSecret, the chart will assume this secret is
# created externally and mount it.
# * It is an error to define both data and securityConfigSecret.
securityConfigSecret: ""
data: {}
# config.yml: |-
# internal_users.yml: |-
# roles.yml: |-
# roles_mapping.yml: |-
# action_groups.yml: |-
# tenants.yml: |-
# How long to wait for opensearch to stop gracefully
terminationGracePeriod: 120
sysctlVmMaxMapCount: 262144
## Use an alternate scheduler.
## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
##
schedulerName: ""
imagePullSecrets: []
nodeSelector: {}
tolerations: []
# Enabling this will publically expose your OpenSearch instance.
# Only enable this if you have security enabled on your cluster
ingress:
enabled: false
# For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName
# See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress
ingressClassName: nginx
annotations: {}
# kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: "true"
path: /
hosts:
- chart-example.local
tls: []
# - secretName: chart-example-tls
# hosts:
# - chart-example.local
nameOverride: ""
fullnameOverride: ""
masterTerminationFix: false
lifecycle: {}
# preStop:
# exec:
# command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"]
# postStart:
# exec:
# command:
# - bash
# - -c
# - |
# #!/bin/bash
# # Add a template to adjust number of shards/replicas1
# TEMPLATE_NAME=my_template
# INDEX_PATTERN="logstash-*"
# SHARD_COUNT=8
# REPLICA_COUNT=1
# ES_URL=http://localhost:9200
# while [[ "$(curl -s -o /dev/null -w '%{http_code}\n' $ES_URL)" != "200" ]]; do sleep 1; done
# curl -XPUT "$ES_URL/_template/$TEMPLATE_NAME" -H 'Content-Type: application/json' -d'{"index_patterns":['\""$INDEX_PATTERN"\"'],"settings":{"number_of_shards":'$SHARD_COUNT',"number_of_replicas":'$REPLICA_COUNT'}}'
keystore: []
networkPolicy:
## Enable creation of NetworkPolicy resources. Only Ingress traffic is filtered for now.
## In order for a Pod to access OpenSearch, it needs to have the following label:
## {{ template "uname" . }}-client: "true"
## Example for default configuration to access HTTP port:
## opensearch-master-http-client: "true"
## Example for default configuration to access transport port:
## opensearch-master-transport-client: "true"
http:
enabled: false
# Deprecated
# please use the above podSecurityContext.fsGroup instead
fsGroup: ""
## Set optimal sysctl's through securityContext. This requires privilege. Can be disabled if
## the system has already been preconfigured. (Ex: https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html)
## Also see: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/
sysctl:
enabled: false
## Set optimal sysctl's through privileged initContainer.
sysctlInit:
enabled: false
# override image, which is busybox by default
# image: busybox
# override image tag, which is latest by default
# imageTag:
## Enable to add 3rd Party / Custom plugins not offered in the default OpenSearch image.
plugins:
enabled: false
installList: []
# - example-fake-plugin

11
helm-charts-observability/charts/opensearch/internal_users.yaml Normal file
View File

@@ -0,0 +1,11 @@
---
_meta:
type: "internalusers"
config_version: 2
admin:
hash: "$2y$12$4lu31zUeAnqAtmVvdaA9l.YqPgj2W/WL/4tojqC6uVfp3k5inWOmW"
reserved: true
backend_roles:
- "admin"
description: "OpenSearch administrator"

9
helm-charts-observability/charts/opensearch/opensearch-admin-cert.yaml Normal file
View File

@@ -0,0 +1,9 @@
apiVersion: v1
data:
admin-key.pem: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRRHB1UUpNMTFMemdiRWgKbkNtdmlueDJKR2lJWVJlODA3dG1tN3JuUllZNXIwaXh6OUpCVjlITmZYeUpjOWV6MmczenJUQVNtdEVFU0ZEZAorR0dvb2NnNmdwT3pnNG9ZSExkSUNSNjg1cjltREVZMXRkWnlzUW1JKy9wWHAza2Q3ZzRvazRSOEpRSWNydng4CmtiRkx6UjZ1Z2RhOFI0bFNSelR0aExsZm1GR0dxTFh1bkhnNlZydy9ucXNVeHZGR2dFU0QrWUxKL3E0eDNPeG8KMTBCc1NhTlppVjJsSTlRWWNlQ1dBNEVKMjRUR2ViUUgxckNsblNWd3BDUm92dWZ3enU5ZlVOSDdOQkJabEhXMQpWc2laek8xT2ZQM29xNXZNd3l5Z090SEFOTERwSCtCbGY2WHNQdERhRThNcXNLNStqdzV6bVRWOUp0c005ODN2CkFDaWo2SnozQWdNQkFBRUNnZ0VBSWVlUHVOdm5rYUYzczV0MnhKcy9VTmdaUGVkdnpSbWQ3dFdhZUdBeWgzMncKK3ZKZDJ0TEZnWnk1aXlyOTJINUNWZDRDd2tBcElBanBpam0wMlFTWENqM1U5VTZZb3NUUHBhaUZCL3dsT2NXQQpEZHlSL2xOR1FkUGp6Z0ZpWllBYUY3TEdua2UwRmJzZ3IyVm5KY3JjcjQzd082SFkvdEdMa1FVVzZ4SXFpWEQ2Cjh1NFJDTHA0OGRxOGNFODlWZnNCRnl1VkpUQmlnTjhXSnhFKzdYTUVzQ0NJRDM3aWRGeVRnb1poVFNoYXNCQUYKeVpVdmxSRW1rL0tnQ0VLM2ljeXljczZDN0N4WEU3ZHE3a2JNaVlSazM4R09rS2pmaklzTFNQVkFwZlRJaWliYgpHWW1RKzJLTFhSWi85bXlUOWc5dGpHTHd3K3dKczQ5blZYc1RGcXNkdVFLQmdRRDJrejZUTE5aMlZ0MTVvTndNCjhBYndab3E0ZjM3VTdCTzEyem5SNEowdzhQU0xoQ01IclltUFpNNlFSdFZnekpnS3hYalNTWGZRQStvVnZyQ2EKckZpeFNoNWdBSUVZR1JBMlhlWTN1S2dHSWVPcXFDR3ZpamZHczJ6MzI0YjNZMTRtcjkvL0g0U0k2SXZ3RU5qZwpDU3A0UlluQTlyMTFJdmM4dS9pR1VCOTlKUUtCZ1FEeXFBQ0p1RmV6dk44VEtIbXIxb0ZTK3JSL1FBbUpsazl5Ck9HNjJjMGRiZGx6QXJkek1PUFRDMmIvSWtrdGdHQk0yUEVnaU5lT1dFemJYQ1B0dVdQS0loaHJ4M2RwRzlhdnkKdHN3ZjRnL0JIeCtoalRDTGVLQStvMEFrWldoUnNSS09HbXdnRGtGTmEyOW1aWVdQTnk0S3dSSk9MeGRPWStaNgpMZTMwOHFjTTZ3S0JnRUZpN0k0VXJzNTAzSWhiYXQ4WGE0K21jWlRaWW1YT01LL2g4YVJCUHczeVo3YnpsR0o5CjEyT3FKTWpIcjkvYWdWc2g0SmRMR2pXVVJDZitDRkVMOFAwYW5aRnhzTW9XSTJGM1p3eFJzR1RuNmJxZ21VWTIKamZIb05MWkpoYkhtck5udmU2UG8xTG1GaVU1ZytWSDN2RVpta2xBVVhrdEl1VzFtbjFIbXYyTHRBb0dBWFpOTwpDYzROL0NFMHdWV1ZmaC9OWld1SzJadWZVZkNtR0gwTXJNMU4wa2FWeERRSDlyVnNKZ3dFdWxzNE9BbHd0elNOCitLdGhaWWxwVjRsK05IS1dyUEZTU0wxdUpIa3U0djE5UURwVUt2eE9uV1V1T0VxL09RaUpmcitnZUFoYUNIVEcKQjZLWHFqeHBERXJRTTRkcStQaTFqM0wzZ09KamlmQldXR1NPNlJzQ2dZRUF1Zk1Gb2RLYzVQQ1lLSFBUV3FCQQo5QXE5V3FERUdOL25nWTNoVVo4U2RpM3ZReUd2bUdXYmNnK21tdmZ5TkYvRkJialJYemRJM0N1Vm51NzNsTTNYCmFMb24xUWhsOUsxWFFJa0lONEJPTXNGT29BQzg1UkdzWWt6RVVlQXByR1d1SGRFek5jU3N1R2xWbkx5azZhcHgKNzl1aHI3Sit3MlBlNGplK21TZ3d1cFU9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
admin.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZDakNDQXZLZ0F3SUJBZ0lVSXljc3FkNHF1b2d4ancxRTRLangzd0J0Yld3d0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZVXhDekFKQmdOVkJBWVRBa0pFTVE0d0RBWURWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaAphMkV4RWpBUUJnTlZCQW9NQ1VKeWFXeHNhV0Z1ZERFYk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwCklFTkJNU1V3SXdZRFZRUUREQnhDY21sc2JHbGhiblFnVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUI0WERUSTIKTURjeU16RTFNRGMwTTFvWERUSTRNVEF5TlRFMU1EYzBNMW93Z1lBeEN6QUpCZ05WQkFZVEFrSkVNUTR3REFZRApWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaGEyRXhFakFRQmdOVkJBb01DVUp5YVd4c2FXRnVkREVpCk1DQUdBMVVFQ3d3WlQzQmxibE5sWVhKamFDQkJaRzFwYm1semRISmhkRzl5Y3pFWk1CY0dBMVVFQXd3UWIzQmwKYm5ObFlYSmphQzFoWkcxcGJqQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQU9tNQpBa3pYVXZPQnNTR2NLYStLZkhZa2FJaGhGN3pUdTJhYnV1ZEZoam12U0xIUDBrRlgwYzE5ZklsejE3UGFEZk90Ck1CS2EwUVJJVU4zNFlhaWh5RHFDazdPRGloZ2N0MGdKSHJ6bXYyWU1SalcxMW5LeENZajcrbGVuZVIzdURpaVQKaEh3bEFoeXUvSHlSc1V2TkhxNkIxcnhIaVZKSE5PMkV1VitZVVlhb3RlNmNlRHBXdkQrZXF4VEc4VWFBUklQNQpnc24rcmpIYzdHalhRR3hKbzFtSlhhVWoxQmh4NEpZRGdRbmJoTVo1dEFmV3NLV2RKWENrSkdpKzUvRE83MTlRCjBmczBFRm1VZGJWV3lKbk03VTU4L2Vpcm04ekRMS0E2MGNBMHNPa2Y0R1YvcGV3KzBOb1R3eXF3cm42UERuT1oKTlgwbTJ3ejN6ZThBS0tQb25QY0NBd0VBQWFOMU1ITXdEQVlEVlIwVEFRSC9CQUl3QURBT0JnTlZIUThCQWY4RQpCQU1DQmFBd0V3WURWUjBsQkF3d0NnWUlLd1lCQlFVSEF3SXdIUVlEVlIwT0JCWUVGT0daUGY0NEEyWkt3Q0FPCk9sc0lSYnJ1WkdCZE1COEdBMVVkSXdRWU1CYUFGSGJhbmo2RkdNVWZ3bEMwSytqY081TTlHd0FwTUEwR0NTcUcKU0liM0RRRUJDd1VBQTRJQ0FRQllzY1p2WVB5YXVkUDlLeVhNc1BkKzJZbThnWFVkYmpoakJuaDdwQXlNNU52cgpMRUFXR3VTSVFidzlNREVBMUluYkZvejhjQThBUVRFZGZ5bUJNMFdUbkpHam9zcGNRYUJWNU03VXZhYlZEeE1UCkNEbnkzbU93SjMyZUpjWkZiVmpjSFFrcTBrN0RMcnRLZE1DV3haWEd1WHpJZHZwcDJ4TzVjRzZXY3lGZVEwVkwKUnV5eUFkRm5sTXVSY01LMnNoSHprK3lVSGFUb29rTEtYK1pmMGFlUGhudUwwMGMwaWloSmw5eVhvS0ZzUUR6Ywp0WWhXNmdBZVRVelUrUU5RWEZTZ2NOdmhKaDBOVVVQeWlqczZUWWZtL052N0t3MTRIY2JXbnRBVTlWNjFiLzc2CldHM0hJTnpxMEt0QnF3bVQ4cms1YlRybGVzZWd2QzFUeUo2bjlMZTd1TjhkY2NtYkh6SE9MYU1CV3FraHhtbGwKNWNZcENmUFBkb1duQWxrWnBya2NRdnJOZ3F6TGZzcHNwd1RaQTNueXV5RVZuSmE3N0ZmNVR2VmgwWld2QWgyRgpUNitWek14OENTVnllZzFCNzVUNWRTRG5aLzZ3bGwzMk5oZnZMajdFOHRGRlJBWHdPaHRicEJNS1ZUelJoYW5XCnZEcWVrRkUrM1ZnTGh5My9uck5GTVQrejdRWnJBSUV5QWhXZG45cXRtWEsyYmU2c21PZzEyQlAybjd2bHBIQm8KRE1IdmRpMGY2bTc5VlBkdUM2NkhTNm0wOG9jaGZUaHhINHBDUk00ZjZ2R2E1dUFsczRFK3VveUd4cklsZjQ0YgpBWGx4T3RRMk5Kem5vb282c0w0cXNXdS9VZlpBTXVZSmE3WlY4WDNHZ1paSzl2a3JLb3JFa3ZVS212cEpvQT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
root-ca.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUY3VENDQTlXZ0F3SUJBZ0lVTC9hTytnYS9YY3lzakFYbGh1WG92d0xLWkJjd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZVXhDekFKQmdOVkJBWVRBa0pFTVE0d0RBWURWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaAphMkV4RWpBUUJnTlZCQW9NQ1VKeWFXeHNhV0Z1ZERFYk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwCklFTkJNU1V3SXdZRFZRUUREQnhDY21sc2JHbGhiblFnVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUI0WERUSTIKTURjeU16RTFNREV4T1ZvWERUTTJNRGN5TURFMU1ERXhPVm93Z1lVeEN6QUpCZ05WQkFZVEFrSkVNUTR3REFZRApWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaGEyRXhFakFRQmdOVkJBb01DVUp5YVd4c2FXRnVkREViCk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwSUVOQk1TVXdJd1lEVlFRRERCeENjbWxzYkdsaGJuUWcKVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUlJQ0lqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FnOEFNSUlDQ2dLQwpBZ0VBdXlEYmRaMUFycWd6K1l3SkNUcWlxREtuUzNDRGhHekNxK0h5WDN3clBnV0JvZFBraHJCV3dkNzQ4ZjdqClhZWDNQditQS0F0ZzVGYjdxa2ZZUFZJR0FPZUNiUWxkRlJnZld0S2F2MkdxcHZseUlKcy9OZW5PZzFZQ3IydVUKbDE3UnFPNk1BSGt6d1pNTVFDV1JXMlFiUy9weVY0VHd6dkNxSTR1ZVpzOFJ4MndwbERJdWFPVXdJMEVTMG8zdQpWdDJHMVlCTWlFOUNVTDliQWlYbWQ0UTR4a1NFRFRvOVY1SVk3Z2dHYjFTU0xWU2x6RDJHZElaMGN3VlE2LzcwCnUrQ1FPa005ZXhIRVR2eGpGTmZ4azI2YlRZVUJmNnBNS2VpSDdMbC9ucjZFVVVzTW5DSUR5VGtnK3Zta1M5ZWoKUmY1R0QwQ00rcnl1V1BiRHlHOCtzcDh4d1N1ZkcydDdkUGZRSTUzd1Zzc1BKSkk5b0lsZ0lJWXkyMkFUMlo4RwpKL2dZbmYwMU5LREhSV1dBU2FQaTBLT2dURldqRG5xam94Q0FHZjVGVFRJSHdBQjVsMS8rMXZFbEkyNjQ2M2d4CnBWcTk4Vyt4U3FQQ0xaTW9sWlE5TVkwbjVHeGgvZjhkK0RPb1BVT0lXazJqWXdvS1JGQXJiTlNTNnkySnVrS3YKSWNvMnN4YUhqZkhrdDdqdDBkckRLcjUrelI5bndUWDhVN3hBaWlTYkVTekN6OWlvdU9QSEcxMFFtdzl6VVRNMgoxdzJmMmlQRWpvbFpBVjFBaFU3dzFWNHBzc3JpWDIvNTlDR1dYT1VEcWNnd2MwdWh4djRnWFRndXBCeGcrYU5yCllybWZwNndtejdzN3lmblh3T2xVaVRDRW1Bc2NBemNkMmdCaGwvN1dpcmFRZFVzQ0F3RUFBYU5UTUZFd0hRWUQKVlIwT0JCWUVGSGJhbmo2RkdNVWZ3bEMwSytqY081TTlHd0FwTUI4R0ExVWRJd1FZTUJhQUZIYmFuajZGR01VZgp3bEMwSytqY081TTlHd0FwTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3RFFZSktvWklodmNOQVFFTEJRQURnZ0lCCkFBZVVVVUFMTk5FNDM2UEwvZXl6V0c3bmlPdndXODF3UkdVdGdEUnJpY2xFWjh0K3MzUG9MOXRibyszUGN1ekgKakxsUFArYmVLY2tUTEZKVGZZWUN3Z0dWZkdIRXE1ejV1SUt3ZWIyMG9GSEg3ek9DSzF3VVJBSUlPZnFycncyMApjcWNzdTRnK3NENnl0bllWN2Y1T0RFT2RNaXpjVXRrbGpMSjVieXJLSU9OV2FrSTBpd0xLeXFPQWlGeUVSY2xiCjB0ZzhoTDR6dkRLVUZ6dVJycXhxS0padzNWUWUvM1JWUFYwZ0RLUW96VEQ0M3lnQUdGVlVjckx1dHZOK2V5bEEKVDdYMGtNZXJlVVRKd1N6RDVvenhGRXFkaDlLNHZkZTA2a3BuSXpQS2tEanNFZiszeW9WeFVxRGJCeGV3ai9aOApodzhmT3lBWC9jV2UvZlhmWVdPV3RpTlhiQVJRd0pvUWlLb3lacHRuNGpvRXhLWVB2Qzg0RitINEZnZnpidXFkCnNnL2R2SjBxcldGaUlZeWZBRS9NNGM3VTBDUnVsZ1lETXJhbktIUHhxTllVT21pRzM4T0xLTDlFMmlvV002UHYKek82djVvUk5pazFFN3BrRUVMSUFPczR3U2MvdG45MU01TmtpSjgyRXNEQ2ZaVG5FVU9Cd3VsRzZSbW8vYWF0agpCWUJEaHo0dnhmN0ZjNG13WEdXNVZXc1Qzd2ZVckErZ3l3VWo5dlFqTTV6SjEybDl4NU9Dd3pNMTJuQWdSZ1dFCkh4ZDh5TFhkNE9rTWRaRWNVckY5eWtSMGJUZ3AyWnowL3lPR21KbVpieHRNdHlGaTVMcmt6VElodWJNS1l2bncKcWsrbWdaUmNMcXBWclRSYTNiaGdEVzJrSWpFT2I5SHB6NG5MZ3loUVpCMFAKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
kind: Secret
metadata:
name: opensearch-admin-cert
namespace: observability

9
helm-charts-observability/charts/opensearch/opensearch-node-0-cert.yaml Normal file
View File

@@ -0,0 +1,9 @@
apiVersion: v1
data:
node-0-key.pem: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2Z0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktnd2dnU2tBZ0VBQW9JQkFRQzFoS3BOR1F2akRwQTYKbDhPVWpOcEFhUVh4RzIrOWh1Ulc3Qi9Md1I4eUYwWlFFRnBwQXhMdUdUNm9WNDAyWERWK2xUaEV3KzJ6QmZjZgpFeEZPYTRFRE02a0M0Z2Q2S0FBOEtWK0swc2xaanFuMDh0Unl3ZmRNa3ZFU01CYThRRGpITExsckFOSEUrTnZQCm5YeHVhakh0bEpNRDdMYUhHV2Q4QkpRcXdqTHY2cEt0aitaMmI5M25XY1JLRzBrNVg2YWdIWHB1emZXZWcwYjgKRUxDbEVoUWppdmNBTUQvTzJCM2JYSnBhUmIyYzUrWExZZDBhMHVUbjEveUR2WEQyZ3Evb1kzbEpVY3N5RTNKMgpjemxab1IvT1diTFZZcWhueHprcjRobXdFOE5Ra3VpbkhUZ0h1QUxDNTNvbUxLVThiRVhoRmVXbms0WnFRaEV4CkszTVl2OFhOQWdNQkFBRUNnZ0VBQmJOelR5cVY0ZjFuY0QrclVvaTkrTDgrV0RLVUVZVjJ1YzErdU5LSm5VbDMKMllua25RbTRyWHU0MDd3Smk3SGRDRUJvTWxpenFDZHNKSVlLZEJ1ODdlY2x6QmtNbDd5V2pVMHJXckVyY1JiMgordUlwanFwNE9aSjFPZGRZSk1vZzZRM2NOazBoOUNnYmJKWTEvZTNJbGFmN1JMMzBMdmdRU2xLR2ZoLzMrT3I5Ck1JQmVpMUxEQ1RFNUdRUVFwV0dZWEpOTmcyU0F6R3NXdlpYTmdmS0Z5MGVlT0VDMUt3TE5xaWNMMnRRUit6ZGwKL1Qxc3hWenUzQ05aSUlVQW1nVXg5c1dqcGJtU3UzMy81azFQS3U3SXVKcDRtek00Qkw1OFZWakU1N2pTN05nQgpRTjRiLzZOb0ZleFFGdXdkQStlZVd5TU9NM0FmdkpQR3NUNlNBaXBNWVFLQmdRRHV1WFd5eVFwSkorbWh2T0l6CmxGZm9GVFd6VTVuQnpjKytJSjlkRE0rTEdOaVJVaXlUZkdIdDdRM1E5OFFtSDF0M0tland3dkN5Z2xpeFhxNkoKa3hMZXEzOFk3cks1MU1PSHQxeDNDRWdWeFY5b2N3WTBSUklDVzJ4cHRiZjZVbzlZYituZmpqSHlDZU9hODhSdwp5cW9qYi9WNk1MUlVFSVY3UkRtMmczc2JsUUtCZ1FEQ3AydGV0UHltSDh0alp5VVBxU1ZnZnV5b29hWUZXZVh0CldXZm5kcGU0bmp2NVUzQlNoTXRzTnk4OGtieFJ1U2llVDNXYThubFN1WGJZUGJXVzRBcTBXSmYxbzNub0VKRDAKM2JNejRaV2NOUnNqNlQ1K2dTc1JjTU5ZOEdhbVFEQlRTZm9tb2ZvdVBhdkY2NGZ0ZDRablFCS2RKdWJDL2MyWApWU0svMllLeldRS0JnUUNWUVZFc1VmUGpYMWY4Ym9zQzhybXZlaXRVRG0zd3RRd3c5RmFQSitaUE1sNmRKVUtICmg5bjJseUx2UnluVkovL1kxbFEweTcwUDd0MGpNRzV4eDRtaHZKbS9iZVpDdDVyMHJKamNOMHBTaWsrbmoxc08KclN5Z1dxYkN4UUhkT1djMFJPeDFnSU1Mc0ZFazNVb3h0eFIvQ1kzeU1xZGNjK1B3K093WWg4WWRyUUtCZ1FDLwphRm5RV3pCRk91YUk3SmdvK2k3aTRHeGV0ZlhITlVzL1JiZENoLzlSYjJlU0dGWlBEbjNwLzZuWGFZZEE1VTNuCnZrTHJCcHYrbUprZ3NpMnFHc3pyNG1JckRZR0dqU085WlhRZUJDbFYzWEsrc1ZEZW5LMTVET1ZLdzdwc3FKbmMKak5ZS3Z5Ui82K3pKUm4zM0tKMWxVai83Z0pGU0ZMamhvcm4wNVRIOG9RS0JnQjhMZ1BGZFMvV3R5anJPS0J1OAo0d2hCRmZFZHcxNnlZNVRHQ0xwQmNoMUdrV3hBcGd1S3QyTmlVc01lMDdSd1daQndTWUNsdXBEVUNiVFVoeEJKClNlSXFDWENobWdtU2NFdlg2TEdHSXlFOU1GUXozbG52bmd1SE5KL0pwTUZGU291TStmR2g4eXY3WEJpY0JBR0sKeit6aXZwK2REZkVLYzVVd08xc3YvVVQzCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
node-0.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUhyVENDQlpXZ0F3SUJBZ0lVSXljc3FkNHF1b2d4ancxRTRLangzd0J0Ylc0d0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZVXhDekFKQmdOVkJBWVRBa0pFTVE0d0RBWURWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaAphMkV4RWpBUUJnTlZCQW9NQ1VKeWFXeHNhV0Z1ZERFYk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwCklFTkJNU1V3SXdZRFZRUUREQnhDY21sc2JHbGhiblFnVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUI0WERUSTIKTURjeU16RTFNVE15TjFvWERUSTRNVEF5TlRFMU1UTXlOMW93ZWpFTE1Ba0dBMVVFQmhNQ1FrUXhEakFNQmdOVgpCQWdNQlVSb1lXdGhNUTR3REFZRFZRUUhEQVZFYUdGcllURVNNQkFHQTFVRUNnd0pRbkpwYkd4cFlXNTBNUmt3CkZ3WURWUVFMREJCUGNHVnVVMlZoY21Ob0lFNXZaR1Z6TVJ3d0dnWURWUVFEREJOdmNHVnVjMlZoY21Ob0xXMWgKYzNSbGNpMHdNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXRZU3FUUmtMNHc2UQpPcGZEbEl6YVFHa0Y4UnR2dllia1Z1d2Z5OEVmTWhkR1VCQmFhUU1TN2hrK3FGZU5ObHcxZnBVNFJNUHRzd1gzCkh4TVJUbXVCQXpPcEF1SUhlaWdBUENsZml0TEpXWTZwOVBMVWNzSDNUSkx4RWpBV3ZFQTR4eXk1YXdEUnhQamIKejUxOGJtb3g3WlNUQSt5Mmh4bG5mQVNVS3NJeTcrcVNyWS9tZG0vZDUxbkVTaHRKT1YrbW9CMTZiczMxbm9ORwovQkN3cFJJVUk0cjNBREEvenRnZDIxeWFXa1c5bk9mbHkySGRHdExrNTlmOGc3MXc5b0t2NkdONVNWSExNaE55CmRuTTVXYUVmemxteTFXS29aOGM1SytJWnNCUERVSkxvcHgwNEI3Z0N3dWQ2Sml5bFBHeEY0UlhscDVPR2FrSVIKTVN0ekdML0Z6UUlEQVFBQm80SURIVENDQXhrd0RBWURWUjBUQVFIL0JBSXdBREFPQmdOVkhROEJBZjhFQkFNQwpCYUF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01CMEdBMVVkRGdRV0JCU2R2Y1IzCjU1R1hRUFNjY0xlNncyL0xpTkNIMGpBZkJnTlZIU01FR0RBV2dCUjIycDQraFJqRkg4SlF0Q3ZvM0R1VFBSc0EKS1RDQ0FwZ0dBMVVkRVFTQ0FvOHdnZ0tMZ2lWaWNtbHNiR2xoYm5RdGIzQmxibk5sWVhKamFDMWpiSFZ6ZEdWeQpMVzFoYzNSbGNpMHdnbEppY21sc2JHbGhiblF0YjNCbGJuTmxZWEpqYUMxamJIVnpkR1Z5TFcxaGMzUmxjaTB3CkxtSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxXaGxZV1JzWlhOemdtQmkKY21sc2JHbGhiblF0YjNCbGJuTmxZWEpqYUMxamJIVnpkR1Z5TFcxaGMzUmxjaTB3TG1KeWFXeHNhV0Z1ZEMxdgpjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxXaGxZV1JzWlhOekxtOWljMlZ5ZG1GaWFXeHBkSG1DClpHSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxUQXVZbkpwYkd4cFlXNTAKTFc5d1pXNXpaV0Z5WTJndFkyeDFjM1JsY2kxdFlYTjBaWEl0YUdWaFpHeGxjM011YjJKelpYSjJZV0pwYkdsMAplUzV6ZG1PQ2NtSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxUQXVZbkpwCmJHeHBZVzUwTFc5d1pXNXpaV0Z5WTJndFkyeDFjM1JsY2kxdFlYTjBaWEl0YUdWaFpHeGxjM011YjJKelpYSjIKWVdKcGJHbDBlUzV6ZG1NdVkyeDFjM1JsY2k1c2IyTmhiSUlqWW5KcGJHeHBZVzUwTFc5d1pXNXpaV0Z5WTJndApZMngxYzNSbGNpMXRZWE4wWlhLQ01XSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6CmRHVnlMbTlpYzJWeWRtRmlhV3hwZEhtQ05XSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXQKYldGemRHVnlMbTlpYzJWeWRtRmlhV3hwZEhrdWMzWmpna05pY21sc2JHbGhiblF0YjNCbGJuTmxZWEpqYUMxagpiSFZ6ZEdWeUxXMWhjM1JsY2k1dlluTmxjblpoWW1sc2FYUjVMbk4yWXk1amJIVnpkR1Z5TG14dlkyRnNNQTBHCkNTcUdTSWIzRFFFQkN3VUFBNElDQVFCTXNUNUIrQnNWemRrcDRkaktDV0p1S2tNeWJidHRZb2xWeXpabXF6N0YKbE9vUEcvM3BVMUx4akgrVUsxWVRITmZaYUZvVGpRL09YVC9ORnJmL3JIQ2ZjQnFkYmNWNVZyWTlKaUVESFd1cwpiNGR4RkU3V0JaVTU0KzI1V1g5dnVHMFZUeHNnSDA4RUMvTVdwOENHandYSmhxamlRdkk0aWhGand1VnR0MVI1Cm9MWGZYS29BMEMxNjVHUFZjVmZ0a3FWcUovZWNlOS9teGNhSmVuQXY4d0dvRjlWcGFtSk1mL3IreDEvTE9YTnQKdmk1UmNOZGZMU3loOTdNRGhNYkVCMktsZE9ZYy9hNHpKS3lySGw2aWpacFA3WTdSUFFxMU9sQzRnWVFlLzd4aQpOZC9UdlpySXk0NDhPWFc3OUVlKzNIbWcweGJ6ZFltalBwNXFsWFBzaHdGWGtreU5sQWdWdVNwRk8wb2dmak9OCnlIN3FWRE5hbUhQNVZBKytJdTQxNVYxYVQvK0VGYWI3b2VIM2ozWklyTzFZeW1CL05TT1MvUXZzZEVBcHo0ZUkKVWpsdXFWdDg3aDd3Vm5OelJaMVJGWDk4YlhtQTUrNFRUYmRyMkZNenJvMC81T20rU285aEpxN1phc05Ba0RQagpxbzFJWVlmN0FUek5EOEtMVEJVRjl4OXl1V0ZOdlk2NDhuNzJzRzI2emgzWnNnaXpXZHpNKzY3emFXQUpPclFrCmZqbWdBMk5ZcUZqTWJROU1DWHcwTGpLUk9RTFZoc2hXTlF4RDJhd3lDOUwrYk5hcUUzMlFJK3hIOG53bWpRekwKaGlsdFlhczR5WFNjMmxocURiSytWMnJVR2JLNXBjTSt6MXJkNVE3L2hUcnNUaUp1YjlubGNDdGFpL1pCRnpPKwpIdz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
root-ca.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUY3VENDQTlXZ0F3SUJBZ0lVTC9hTytnYS9YY3lzakFYbGh1WG92d0xLWkJjd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZVXhDekFKQmdOVkJBWVRBa0pFTVE0d0RBWURWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaAphMkV4RWpBUUJnTlZCQW9NQ1VKeWFXeHNhV0Z1ZERFYk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwCklFTkJNU1V3SXdZRFZRUUREQnhDY21sc2JHbGhiblFnVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUI0WERUSTIKTURjeU16RTFNREV4T1ZvWERUTTJNRGN5TURFMU1ERXhPVm93Z1lVeEN6QUpCZ05WQkFZVEFrSkVNUTR3REFZRApWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaGEyRXhFakFRQmdOVkJBb01DVUp5YVd4c2FXRnVkREViCk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwSUVOQk1TVXdJd1lEVlFRRERCeENjbWxzYkdsaGJuUWcKVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUlJQ0lqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FnOEFNSUlDQ2dLQwpBZ0VBdXlEYmRaMUFycWd6K1l3SkNUcWlxREtuUzNDRGhHekNxK0h5WDN3clBnV0JvZFBraHJCV3dkNzQ4ZjdqClhZWDNQditQS0F0ZzVGYjdxa2ZZUFZJR0FPZUNiUWxkRlJnZld0S2F2MkdxcHZseUlKcy9OZW5PZzFZQ3IydVUKbDE3UnFPNk1BSGt6d1pNTVFDV1JXMlFiUy9weVY0VHd6dkNxSTR1ZVpzOFJ4MndwbERJdWFPVXdJMEVTMG8zdQpWdDJHMVlCTWlFOUNVTDliQWlYbWQ0UTR4a1NFRFRvOVY1SVk3Z2dHYjFTU0xWU2x6RDJHZElaMGN3VlE2LzcwCnUrQ1FPa005ZXhIRVR2eGpGTmZ4azI2YlRZVUJmNnBNS2VpSDdMbC9ucjZFVVVzTW5DSUR5VGtnK3Zta1M5ZWoKUmY1R0QwQ00rcnl1V1BiRHlHOCtzcDh4d1N1ZkcydDdkUGZRSTUzd1Zzc1BKSkk5b0lsZ0lJWXkyMkFUMlo4RwpKL2dZbmYwMU5LREhSV1dBU2FQaTBLT2dURldqRG5xam94Q0FHZjVGVFRJSHdBQjVsMS8rMXZFbEkyNjQ2M2d4CnBWcTk4Vyt4U3FQQ0xaTW9sWlE5TVkwbjVHeGgvZjhkK0RPb1BVT0lXazJqWXdvS1JGQXJiTlNTNnkySnVrS3YKSWNvMnN4YUhqZkhrdDdqdDBkckRLcjUrelI5bndUWDhVN3hBaWlTYkVTekN6OWlvdU9QSEcxMFFtdzl6VVRNMgoxdzJmMmlQRWpvbFpBVjFBaFU3dzFWNHBzc3JpWDIvNTlDR1dYT1VEcWNnd2MwdWh4djRnWFRndXBCeGcrYU5yCllybWZwNndtejdzN3lmblh3T2xVaVRDRW1Bc2NBemNkMmdCaGwvN1dpcmFRZFVzQ0F3RUFBYU5UTUZFd0hRWUQKVlIwT0JCWUVGSGJhbmo2RkdNVWZ3bEMwSytqY081TTlHd0FwTUI4R0ExVWRJd1FZTUJhQUZIYmFuajZGR01VZgp3bEMwSytqY081TTlHd0FwTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3RFFZSktvWklodmNOQVFFTEJRQURnZ0lCCkFBZVVVVUFMTk5FNDM2UEwvZXl6V0c3bmlPdndXODF3UkdVdGdEUnJpY2xFWjh0K3MzUG9MOXRibyszUGN1ekgKakxsUFArYmVLY2tUTEZKVGZZWUN3Z0dWZkdIRXE1ejV1SUt3ZWIyMG9GSEg3ek9DSzF3VVJBSUlPZnFycncyMApjcWNzdTRnK3NENnl0bllWN2Y1T0RFT2RNaXpjVXRrbGpMSjVieXJLSU9OV2FrSTBpd0xLeXFPQWlGeUVSY2xiCjB0ZzhoTDR6dkRLVUZ6dVJycXhxS0padzNWUWUvM1JWUFYwZ0RLUW96VEQ0M3lnQUdGVlVjckx1dHZOK2V5bEEKVDdYMGtNZXJlVVRKd1N6RDVvenhGRXFkaDlLNHZkZTA2a3BuSXpQS2tEanNFZiszeW9WeFVxRGJCeGV3ai9aOApodzhmT3lBWC9jV2UvZlhmWVdPV3RpTlhiQVJRd0pvUWlLb3lacHRuNGpvRXhLWVB2Qzg0RitINEZnZnpidXFkCnNnL2R2SjBxcldGaUlZeWZBRS9NNGM3VTBDUnVsZ1lETXJhbktIUHhxTllVT21pRzM4T0xLTDlFMmlvV002UHYKek82djVvUk5pazFFN3BrRUVMSUFPczR3U2MvdG45MU01TmtpSjgyRXNEQ2ZaVG5FVU9Cd3VsRzZSbW8vYWF0agpCWUJEaHo0dnhmN0ZjNG13WEdXNVZXc1Qzd2ZVckErZ3l3VWo5dlFqTTV6SjEybDl4NU9Dd3pNMTJuQWdSZ1dFCkh4ZDh5TFhkNE9rTWRaRWNVckY5eWtSMGJUZ3AyWnowL3lPR21KbVpieHRNdHlGaTVMcmt6VElodWJNS1l2bncKcWsrbWdaUmNMcXBWclRSYTNiaGdEVzJrSWpFT2I5SHB6NG5MZ3loUVpCMFAKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
kind: Secret
metadata:
name: opensearch-node-0-cert
namespace: observability

9
helm-charts-observability/charts/opensearch/opensearch-node-1-cert.yaml Normal file
View File

@@ -0,0 +1,9 @@
apiVersion: v1
data:
node-1-key.pem: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2d0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktrd2dnU2xBZ0VBQW9JQkFRRGtMSk41UlZ0dGxCeDcKYlBoTGxjMThWdFMwVEYreGRqQ2FXbkw2RVM4OWowZkd4SzlzUGR6ektpMndYelA5RkFOVXRPakNXMmhTNVJySQpJdlZBZ1ROZUFqSTc4NUtLSExFd0FaU2xCZjV4cXA3aTlKbXJSOFMxSnNQMHV3c1orM3B4cHVMTzBPbFVTbzBICnpkanZwMGpPRzAzTXZGTjB3OFJnN1hlL3VhZzZPYjRDeFYzZUJ3YXYyZDVwMk83ZmdvemVEeW5Qd0hQck9YLzgKcDFISWtKRTZ5aC9yWjJKUmprVnV4ZDlaM0cybHVFRXlIN2MrRzhVbzhFK3NEOVBibm1ad2o5bDV4U1Ruck10LwpSbXJLN3JyVTFYMDdTSzBDWENrSW5BUlA1MGwzbmhwaU9HTDM0MHdldnhzSzNtRzFkWG41UzRwcnc3MHR0dms5Cm1KT0pRNjBoQWdNQkFBRUNnZ0VBSWI1bDROMWM5QXVmV3JGMjF0YkVtTXJPa2d0cGEza3JIdWlaY0ZueVBveGQKOVF0SlZoeWYvR1lVYzZ6Z3AyQzZUV0NqdTNxQkp5RXlvTDVxdnF0Y3lWNVJ4NFB4Ky9MYVVWc3FmRzB5ZitUWApzb0N4NlI2bi9KSkxFSHBJM2dMT3pOZjlXdENTY1NERlVvNGlzdTV1V2V5M3lMdGhMRGQzWjA0M0UyZUZkWGFsCkJSUEZvbEZ0ekc4d3BxS3R5K09taDljVXJBSFUwODdxS3cwcmJXVUhkN1JTUERSTXluMXY3dU9kSXZQQ241N28KQ1plMHNyQjVLbzNha0F5YUFRVVhQd25UWnlVeXVJdS9KWmtha3ZOMDE1cXhicW5WODZVOUpMQ1IwMVl4R055YQo4dHpkQXpPa1d2Yyt2b21WbExqNmw0aWx6OENrZ0lmYW50L1psQ2lWTVFLQmdRRC8zUGtwVFg3WnM5NkNvOEdqClNuSitwOG9hU0xFY2xHRXE0REVDb1JXanBhb1N2Z0J0WVVzMzhaSnBvdVh6ZEtFZmd6eHlrYUlkdDRYRXBBb2oKejVBenRRMWN5OTlqMjBSa2RoaU16SkFSc1pPcDZ2Zm9GQnFMV0pFY3VmRHB1cXYrRDdFT0t3Rjc0YlNyRll0Zgp6eThRYTRVRVhqSUZZSXFEOVg1QWRVWTlTd0tCZ1FEa1M4L3Y4SmlubVh4d2J3eTM2bVNlM2JCa1NVcXlYcXVXCnE2UVkvZGNrTDdQcWdrZjVUV1BZM1Z1Mm44MEU3cGZ1MmE4NTFYQW1KZVk4RHJOVU1OalY5dmIxaGFDYlk3ZjMKMmlnTk9EYndzTDJFNGUwZkE3bTVVVy9YODVKTzI4QjFUQmExREs0Titpd1lpUVVqSHFCeW9HUUV1TVVQSlgyNgpoTW5vNVR2WHd3S0JnUURsektTbitPYytSak5KcUNRcE1ac2xzRE52YWV4UW05K3RiNC8xS1pKUzJWNm4yS2h2CmxOdkcwaHZLN3JpUzhTUXBObWhiQ2Z2TnJ0L2czZWdSZzhHaS96Q1NNTFZoYlRTKytlWlF4d1Y2THNCTjh6QlcKNjM5dnVjc1RQdGxtUXZkb2h0Vmh3VFJpL0RPVkdST0ZxSUkvd0NIRzY0Y0hsMDZ3K0JNOWQxYnZnd0tCZ1FDMwpCbVNOUzBsSFRKRHNIc3VHZ3Y3cU1uYmczN1ZuN09nSm9rK3J6WTMycjl2QXpYUGdWWUFQODk4OE9UOEhqalQyClEwVHN5OFhlZjVIbVlpNjQ5M1JQalhBT0JIUnZQM0hVM2V3d05Qb3Uyck1GM283WXg0YlZJSW5YQ3Fvb1dKc2kKTHI4aHBTbkJnT2hyUHlhRU1tQ1ZwU3FxY210aHFqL3pFZFJCeDgzRE93S0JnUUNkTHQxVm5IR1ZqZ1F6b3J0WApycWNtQnU0bUtyWmFLdGxsM3lOS0MzNkh3OGgzU3FZUm5VTlZmK2pPUE8zM3NSR3JyNFZCTEtveEM0NEljdG9oClc2WjgvRmZCWDJIMDUzNjNHUkUxNmRGOFZ5YTN3b0xRUGpTcy9pQWdYR3psNXlSUFlhTWs2VlF4QjZwcytGOHEKWVpyNnoxMHNYQXRCbEszeU1FS1hVQldtL3c9PQotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0tCg==
node-1.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUhyVENDQlpXZ0F3SUJBZ0lVSXljc3FkNHF1b2d4ancxRTRLangzd0J0YlhBd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZVXhDekFKQmdOVkJBWVRBa0pFTVE0d0RBWURWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaAphMkV4RWpBUUJnTlZCQW9NQ1VKeWFXeHNhV0Z1ZERFYk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwCklFTkJNU1V3SXdZRFZRUUREQnhDY21sc2JHbGhiblFnVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUI0WERUSTIKTURjeU16RTFNalF3TUZvWERUSTRNVEF5TlRFMU1qUXdNRm93ZWpFTE1Ba0dBMVVFQmhNQ1FrUXhEakFNQmdOVgpCQWdNQlVSb1lXdGhNUTR3REFZRFZRUUhEQVZFYUdGcllURVNNQkFHQTFVRUNnd0pRbkpwYkd4cFlXNTBNUmt3CkZ3WURWUVFMREJCUGNHVnVVMlZoY21Ob0lFNXZaR1Z6TVJ3d0dnWURWUVFEREJOdmNHVnVjMlZoY21Ob0xXMWgKYzNSbGNpMHhNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQTVDeVRlVVZiYlpRYwplMno0UzVYTmZGYlV0RXhmc1hZd21scHkraEV2UFk5SHhzU3ZiRDNjOHlvdHNGOHovUlFEVkxUb3dsdG9VdVVhCnlDTDFRSUV6WGdJeU8vT1NpaHl4TUFHVXBRWCtjYXFlNHZTWnEwZkV0U2JEOUxzTEdmdDZjYWJpenREcFZFcU4KQjgzWTc2ZEl6aHROekx4VGRNUEVZTzEzdjdtb09qbStBc1ZkM2djR3I5bmVhZGp1MzRLTTNnOHB6OEJ6NnpsLwovS2RSeUpDUk9zb2Y2MmRpVVk1RmJzWGZXZHh0cGJoQk1oKzNQaHZGS1BCUHJBL1QyNTVtY0kvWmVjVWs1NnpMCmYwWnF5dTY2MU5WOU8waXRBbHdwQ0p3RVQrZEpkNTRhWWpoaTkrTk1IcjhiQ3Q1aHRYVjUrVXVLYThPOUxiYjUKUFppVGlVT3RJUUlEQVFBQm80SURIVENDQXhrd0RBWURWUjBUQVFIL0JBSXdBREFPQmdOVkhROEJBZjhFQkFNQwpCYUF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01CMEdBMVVkRGdRV0JCUTd2UE9PClFuWWpLZjRKRlFRT0tqN3plM2ozZHpBZkJnTlZIU01FR0RBV2dCUjIycDQraFJqRkg4SlF0Q3ZvM0R1VFBSc0EKS1RDQ0FwZ0dBMVVkRVFTQ0FvOHdnZ0tMZ2lWaWNtbHNiR2xoYm5RdGIzQmxibk5sWVhKamFDMWpiSFZ6ZEdWeQpMVzFoYzNSbGNpMHhnbEppY21sc2JHbGhiblF0YjNCbGJuTmxZWEpqYUMxamJIVnpkR1Z5TFcxaGMzUmxjaTB4CkxtSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxXaGxZV1JzWlhOemdtQmkKY21sc2JHbGhiblF0YjNCbGJuTmxZWEpqYUMxamJIVnpkR1Z5TFcxaGMzUmxjaTB4TG1KeWFXeHNhV0Z1ZEMxdgpjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxXaGxZV1JzWlhOekxtOWljMlZ5ZG1GaWFXeHBkSG1DClpHSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxURXVZbkpwYkd4cFlXNTAKTFc5d1pXNXpaV0Z5WTJndFkyeDFjM1JsY2kxdFlYTjBaWEl0YUdWaFpHeGxjM011YjJKelpYSjJZV0pwYkdsMAplUzV6ZG1PQ2NtSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxURXVZbkpwCmJHeHBZVzUwTFc5d1pXNXpaV0Z5WTJndFkyeDFjM1JsY2kxdFlYTjBaWEl0YUdWaFpHeGxjM011YjJKelpYSjIKWVdKcGJHbDBlUzV6ZG1NdVkyeDFjM1JsY2k1c2IyTmhiSUlqWW5KcGJHeHBZVzUwTFc5d1pXNXpaV0Z5WTJndApZMngxYzNSbGNpMXRZWE4wWlhLQ01XSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6CmRHVnlMbTlpYzJWeWRtRmlhV3hwZEhtQ05XSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXQKYldGemRHVnlMbTlpYzJWeWRtRmlhV3hwZEhrdWMzWmpna05pY21sc2JHbGhiblF0YjNCbGJuTmxZWEpqYUMxagpiSFZ6ZEdWeUxXMWhjM1JsY2k1dlluTmxjblpoWW1sc2FYUjVMbk4yWXk1amJIVnpkR1Z5TG14dlkyRnNNQTBHCkNTcUdTSWIzRFFFQkN3VUFBNElDQVFCQWpCbDUxOURUdllMVndKZmVQcWtwckw3RlBhTlFaVmkxZ0hLTFFhekIKSVNpZnVrZjI5WktEWGczRDNNV0orVDhWQXpaZ0JFQUFRLzNHOCt1N0ZUOFRuMjJJMUtmZjRLYkdDTHBQNjl0UwpHYkhZVEwzVjYxZjlNTkdLa3lpVGh1SG1PLzhISjFWQXNLamZ6N3BQMHA5VEJIRHBuYWNGSWNRTGFBcEdiaWJ4CmhRa3Q3OXFlaDN2YVpUL0hnV1lpenNxQWs4STJ6NDdLRUVCVWR0TjFWcmJiL0RBNW93ejh3M2NPNEcxbmVUS2wKQVZZS05TakNVYkV4UEN0aXZuckpzQUwvcmRJZnNMdERKQ3RBNFRFbW91UitLYzJkNWRsa1Y0S2dzeUFRMzRGWApTbzQyMVp4Qk92ZjQyN2JJN0crT0YzSXVmclk0N0xBYUpyeXBjd2ZVNitRSVdNckMrWnk2VXNtak15NTIzRTY3CldSUC9Wb0ErSmV6ck5XaFR1QkI3VDN0b3pDVlFlSmdnMkhyMkVDN0VVbnZUWWdOMjVubzJpWXFJejZ0Y1VWV0gKSEV2LzlGUFFlcUIzZ3pHczJnWXk3UUVZaXF3UUk4amxNbEFEZ0tra1hjbGlUWkhJYUpUV3Bwby9ZQVF3T1ZqUgptb2lhRUR4UHFEZnZLREZNdjlzQWVBdXRkL0xJVHlITHVOV0RXTVJlYndLR3ZoZlJjdlhJM084ek5CbTFjY0U1CnVTdmRObWZIMnh2aEhUa1dkdUplc1E4cFJIOUI5OTdoTTZ0NklxblVsN0tqNXhQYUNIWEEyZzRhemFocVRqd0wKQTRaaXZUYjhNU3A4WktLUDF4amR2KzNpdi9zQm5oVUZYV0taNGZjZTZjaW9KKzBrRENnT0p3eTJhUlNkazNNUgpzQT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
root-ca.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUY3VENDQTlXZ0F3SUJBZ0lVTC9hTytnYS9YY3lzakFYbGh1WG92d0xLWkJjd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZVXhDekFKQmdOVkJBWVRBa0pFTVE0d0RBWURWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaAphMkV4RWpBUUJnTlZCQW9NQ1VKeWFXeHNhV0Z1ZERFYk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwCklFTkJNU1V3SXdZRFZRUUREQnhDY21sc2JHbGhiblFnVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUI0WERUSTIKTURjeU16RTFNREV4T1ZvWERUTTJNRGN5TURFMU1ERXhPVm93Z1lVeEN6QUpCZ05WQkFZVEFrSkVNUTR3REFZRApWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaGEyRXhFakFRQmdOVkJBb01DVUp5YVd4c2FXRnVkREViCk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwSUVOQk1TVXdJd1lEVlFRRERCeENjbWxzYkdsaGJuUWcKVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUlJQ0lqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FnOEFNSUlDQ2dLQwpBZ0VBdXlEYmRaMUFycWd6K1l3SkNUcWlxREtuUzNDRGhHekNxK0h5WDN3clBnV0JvZFBraHJCV3dkNzQ4ZjdqClhZWDNQditQS0F0ZzVGYjdxa2ZZUFZJR0FPZUNiUWxkRlJnZld0S2F2MkdxcHZseUlKcy9OZW5PZzFZQ3IydVUKbDE3UnFPNk1BSGt6d1pNTVFDV1JXMlFiUy9weVY0VHd6dkNxSTR1ZVpzOFJ4MndwbERJdWFPVXdJMEVTMG8zdQpWdDJHMVlCTWlFOUNVTDliQWlYbWQ0UTR4a1NFRFRvOVY1SVk3Z2dHYjFTU0xWU2x6RDJHZElaMGN3VlE2LzcwCnUrQ1FPa005ZXhIRVR2eGpGTmZ4azI2YlRZVUJmNnBNS2VpSDdMbC9ucjZFVVVzTW5DSUR5VGtnK3Zta1M5ZWoKUmY1R0QwQ00rcnl1V1BiRHlHOCtzcDh4d1N1ZkcydDdkUGZRSTUzd1Zzc1BKSkk5b0lsZ0lJWXkyMkFUMlo4RwpKL2dZbmYwMU5LREhSV1dBU2FQaTBLT2dURldqRG5xam94Q0FHZjVGVFRJSHdBQjVsMS8rMXZFbEkyNjQ2M2d4CnBWcTk4Vyt4U3FQQ0xaTW9sWlE5TVkwbjVHeGgvZjhkK0RPb1BVT0lXazJqWXdvS1JGQXJiTlNTNnkySnVrS3YKSWNvMnN4YUhqZkhrdDdqdDBkckRLcjUrelI5bndUWDhVN3hBaWlTYkVTekN6OWlvdU9QSEcxMFFtdzl6VVRNMgoxdzJmMmlQRWpvbFpBVjFBaFU3dzFWNHBzc3JpWDIvNTlDR1dYT1VEcWNnd2MwdWh4djRnWFRndXBCeGcrYU5yCllybWZwNndtejdzN3lmblh3T2xVaVRDRW1Bc2NBemNkMmdCaGwvN1dpcmFRZFVzQ0F3RUFBYU5UTUZFd0hRWUQKVlIwT0JCWUVGSGJhbmo2RkdNVWZ3bEMwSytqY081TTlHd0FwTUI4R0ExVWRJd1FZTUJhQUZIYmFuajZGR01VZgp3bEMwSytqY081TTlHd0FwTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3RFFZSktvWklodmNOQVFFTEJRQURnZ0lCCkFBZVVVVUFMTk5FNDM2UEwvZXl6V0c3bmlPdndXODF3UkdVdGdEUnJpY2xFWjh0K3MzUG9MOXRibyszUGN1ekgKakxsUFArYmVLY2tUTEZKVGZZWUN3Z0dWZkdIRXE1ejV1SUt3ZWIyMG9GSEg3ek9DSzF3VVJBSUlPZnFycncyMApjcWNzdTRnK3NENnl0bllWN2Y1T0RFT2RNaXpjVXRrbGpMSjVieXJLSU9OV2FrSTBpd0xLeXFPQWlGeUVSY2xiCjB0ZzhoTDR6dkRLVUZ6dVJycXhxS0padzNWUWUvM1JWUFYwZ0RLUW96VEQ0M3lnQUdGVlVjckx1dHZOK2V5bEEKVDdYMGtNZXJlVVRKd1N6RDVvenhGRXFkaDlLNHZkZTA2a3BuSXpQS2tEanNFZiszeW9WeFVxRGJCeGV3ai9aOApodzhmT3lBWC9jV2UvZlhmWVdPV3RpTlhiQVJRd0pvUWlLb3lacHRuNGpvRXhLWVB2Qzg0RitINEZnZnpidXFkCnNnL2R2SjBxcldGaUlZeWZBRS9NNGM3VTBDUnVsZ1lETXJhbktIUHhxTllVT21pRzM4T0xLTDlFMmlvV002UHYKek82djVvUk5pazFFN3BrRUVMSUFPczR3U2MvdG45MU01TmtpSjgyRXNEQ2ZaVG5FVU9Cd3VsRzZSbW8vYWF0agpCWUJEaHo0dnhmN0ZjNG13WEdXNVZXc1Qzd2ZVckErZ3l3VWo5dlFqTTV6SjEybDl4NU9Dd3pNMTJuQWdSZ1dFCkh4ZDh5TFhkNE9rTWRaRWNVckY5eWtSMGJUZ3AyWnowL3lPR21KbVpieHRNdHlGaTVMcmt6VElodWJNS1l2bncKcWsrbWdaUmNMcXBWclRSYTNiaGdEVzJrSWpFT2I5SHB6NG5MZ3loUVpCMFAKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
kind: Secret
metadata:
name: opensearch-node-1-cert
namespace: observability

9
helm-charts-observability/charts/opensearch/opensearch-node-2-cert.yaml Normal file
View File

@@ -0,0 +1,9 @@
apiVersion: v1
data:
node-2-key.pem: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2Z0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktnd2dnU2tBZ0VBQW9JQkFRRERTSjkxNWpYYUZjakEKUEVxMjFGcTgxcHZiNmdVUTZVRUppTUNxQXFTeU9WK3pvWWoyUUVJcDgxWEduWHpTOUFyc0d5VlpEU2xScGIzMgpqUklJS01lRU90N212VHJtMnBIUU1SOW04aTQwMXJqR0djVmI1RWtiK1VTQjNUdXJmdVFpSWpFTFNNTDZVbm02CnJ4dG5IOGZGcFR0TGdMNU9oRWdXeXQyRnhoL0hjeW9oTEhJTFZsUUlLZURrMnI4TWxGOGlwMXhuWUdrQmJja2cKU1AvOWY2K0ZhdnZaTGtnY21YNXFMeDRCTm9WWkZKYWUybi92SGpYSVFPS3NqVHdYSS9IM25RR3dsSHpwaC8vbAphL3NyYkVqb2tlREVsNk1VeE1uNHZPQWkvWERTc1E2MTJvNDE0WmlYcGlZOFczbE5DcER2MmdvSUxwQ3dLVnhuCjluWnYzR1cvQWdNQkFBRUNnZ0VBVFdESlRuNFplSUNKT3lLb3VDa01peWErT3pWUExKUkFJUGIrNEY2THc5TFkKQ09WSXo4cEdiVGp1RS9Uek1PTmlNSXZSRUtnV1p6TzFRYXhFS05kL3R2VmN2VERkMWZ0bEs0bExXQTgrSDlHMQpCVW5RMmNocTc1cWxlbytleFNWU1gvUU1XdHhKNWNZb1ZjQnNxei84ZUdRd1NvcUkzYk9zbk50bFMweGw2ekVVCjJRVitYU1pxWGlZdUswWjVUcHVnZjVLejc3ZURBcmJqbjNUU2tBVnVDbTFlNTAycHM1NXFpMzVodXd4dEFYUUIKU1REVU92ZzNsK3doUnVaREpsNGQ5L2lNWm9wcnJpY2dOYlJsV0RqVFhvMkZZb2ViLzNYVWpZSGtoUWxSSTdJMgpyQjQvZW1PUUhGR2NVaWl0TFJWbE1sakRqZWwzRjJUelJseFNDaS9EQVFLQmdRRDFncy8wRVlmd3JkNWxGV3VUClkrYThySGFESUw5UGNrQUdTVSt0dzJxWEszZ2JaZjAxTzh3eTZzN29pV2tZYmVWdUZOaVhzN0lLbm1aM1ZIZm8KQmNTVG9ySzBWZUZLdUhodmhwWVd6WnBROTc2bXM5ZU4wS1JLTndWWWdWSjlRNTRhTGxPSTVLeFdwU3ZIeTVBWgpGc3NEZW1uaHIyQ1ZSWFAzWEtzWm1uZ3o5d0tCZ1FETG9IZTAvNWhlazJOK3l2alRiN0FxeWpzUkZ1R1Y2TlM4CnlJbDRDUExpNGFUZGFDOHJ5WWtEeWcyVmw0WmR6Qm5XWTFlVTFUOHdobWZRbEJyb1hxWWx6YXlWNjViSVJML3MKMVQ5T1pXak42VDdDK2hFRHNDZmZkNjFCMkd3YzZnMTlkUzZUZ2NKN2hVOWhabjRYNmVGZEhjSkhNbGpsS3dZTQpjZE1XYTdGYWVRS0JnUURzdVBmNE50c2pseElqMTFhRnBFTDcwekxtVnJJQVVZSW9UWkhWVXVJNDVvSUZzUDVICjBPT2dpTVYrYzlmdzVTM2VTWjFhRUxyd0FERitoK1NoeE1YNU1Gd3RBODJhTldweTVvdGJhMTJMQ29ZNnlKZGoKdHpSaUZ0RkJ1RmdvVGdWbzZ4aENtM01NakhBOVVpc2I5ZDFEK2ttVGdYMllFSUt6bFJlcE5VY0htd0tCZ1FESgpEcXJrRnJPV1BxV3hIaXpPYUt0anRNYlp1dVFISnh4WFF4TXBhSHlhdFA0YWQ3S0w0N1RiL3ZlbXl6U3JETW8rCk8xelE0alpBYlpXNEIyVUNKK0taMVJraDlycXRCK1VScmdXU0hPTjgzVjlSR2FVUEpUSlpua3QraG5sSm0zaXkKZGJBRmljeEVObjhJeHpDZDRCcmIzSFJsNURxT0hRc2Q0bzN3eDJrWTBRS0JnRDQzaHloaFRLSkRib2F0blFqbApSb3ozMEZTdzc1T0xxQUFHelFQS1pLdTRBVFFiWWRESzV4N0Vvd2Q4MkJ2YTM3QmVuNTVjVzFObVJUb2NJV0ViCjBKVzYydi9TUzRDVnRvSUZHY0s4VkpVaTRRQkc1OU9vZTdEVEdqSE5GRmE0WUMvN1htQ3VxSG5MVlpYVnZiWisKTHZlUjdBd1N6S0xwckVOczBBSXVabWJpCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
node-2.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUhyVENDQlpXZ0F3SUJBZ0lVSXljc3FkNHF1b2d4ancxRTRLangzd0J0YlhFd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZVXhDekFKQmdOVkJBWVRBa0pFTVE0d0RBWURWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaAphMkV4RWpBUUJnTlZCQW9NQ1VKeWFXeHNhV0Z1ZERFYk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwCklFTkJNU1V3SXdZRFZRUUREQnhDY21sc2JHbGhiblFnVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUI0WERUSTIKTURjeU16RTFNalF5T0ZvWERUSTRNVEF5TlRFMU1qUXlPRm93ZWpFTE1Ba0dBMVVFQmhNQ1FrUXhEakFNQmdOVgpCQWdNQlVSb1lXdGhNUTR3REFZRFZRUUhEQVZFYUdGcllURVNNQkFHQTFVRUNnd0pRbkpwYkd4cFlXNTBNUmt3CkZ3WURWUVFMREJCUGNHVnVVMlZoY21Ob0lFNXZaR1Z6TVJ3d0dnWURWUVFEREJOdmNHVnVjMlZoY21Ob0xXMWgKYzNSbGNpMHlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXcwaWZkZVkxMmhYSQp3RHhLdHRSYXZOYWIyK29GRU9sQkNZakFxZ0trc2psZnM2R0k5a0JDS2ZOVnhwMTgwdlFLN0JzbFdRMHBVYVc5CjlvMFNDQ2pIaERyZTVyMDY1dHFSMERFZlp2SXVOTmE0eGhuRlcrUkpHL2xFZ2QwN3EzN2tJaUl4QzBqQytsSjUKdXE4Ylp4L0h4YVU3UzRDK1RvUklGc3JkaGNZZngzTXFJU3h5QzFaVUNDbmc1TnEvREpSZklxZGNaMkJwQVczSgpJRWovL1grdmhXcjcyUzVJSEpsK2FpOGVBVGFGV1JTV250cC83eDQxeUVEaXJJMDhGeVB4OTUwQnNKUjg2WWYvCjVXdjdLMnhJNkpIZ3hKZWpGTVRKK0x6Z0l2MXcwckVPdGRxT05lR1lsNlltUEZ0NVRRcVE3OW9LQ0M2UXNDbGMKWi9aMmI5eGx2d0lEQVFBQm80SURIVENDQXhrd0RBWURWUjBUQVFIL0JBSXdBREFPQmdOVkhROEJBZjhFQkFNQwpCYUF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01CMEdBMVVkRGdRV0JCUXRNaXo3ClU5SDV2a0dzZjZ1NDlHWlVKQ3VsZmpBZkJnTlZIU01FR0RBV2dCUjIycDQraFJqRkg4SlF0Q3ZvM0R1VFBSc0EKS1RDQ0FwZ0dBMVVkRVFTQ0FvOHdnZ0tMZ2lWaWNtbHNiR2xoYm5RdGIzQmxibk5sWVhKamFDMWpiSFZ6ZEdWeQpMVzFoYzNSbGNpMHlnbEppY21sc2JHbGhiblF0YjNCbGJuTmxZWEpqYUMxamJIVnpkR1Z5TFcxaGMzUmxjaTB5CkxtSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxXaGxZV1JzWlhOemdtQmkKY21sc2JHbGhiblF0YjNCbGJuTmxZWEpqYUMxamJIVnpkR1Z5TFcxaGMzUmxjaTB5TG1KeWFXeHNhV0Z1ZEMxdgpjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxXaGxZV1JzWlhOekxtOWljMlZ5ZG1GaWFXeHBkSG1DClpHSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxUSXVZbkpwYkd4cFlXNTAKTFc5d1pXNXpaV0Z5WTJndFkyeDFjM1JsY2kxdFlYTjBaWEl0YUdWaFpHeGxjM011YjJKelpYSjJZV0pwYkdsMAplUzV6ZG1PQ2NtSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxUSXVZbkpwCmJHeHBZVzUwTFc5d1pXNXpaV0Z5WTJndFkyeDFjM1JsY2kxdFlYTjBaWEl0YUdWaFpHeGxjM011YjJKelpYSjIKWVdKcGJHbDBlUzV6ZG1NdVkyeDFjM1JsY2k1c2IyTmhiSUlqWW5KcGJHeHBZVzUwTFc5d1pXNXpaV0Z5WTJndApZMngxYzNSbGNpMXRZWE4wWlhLQ01XSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6CmRHVnlMbTlpYzJWeWRtRmlhV3hwZEhtQ05XSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXQKYldGemRHVnlMbTlpYzJWeWRtRmlhV3hwZEhrdWMzWmpna05pY21sc2JHbGhiblF0YjNCbGJuTmxZWEpqYUMxagpiSFZ6ZEdWeUxXMWhjM1JsY2k1dlluTmxjblpoWW1sc2FYUjVMbk4yWXk1amJIVnpkR1Z5TG14dlkyRnNNQTBHCkNTcUdTSWIzRFFFQkN3VUFBNElDQVFDcjZORXlETFlTZmVJYTdEK3oyelZVNWVvcHJwUi9PNkNPNWtvWlhCUlEKcFJFNTM3b2NLWU5TRGsxYVR3ZW1CWmE3bGxhSk82WDF3SEhPTTQxbzJ0em8zUTF2eDFMVm52OFBKSFJRNFdxVQptcE9jUjBXWk5rd0VqUWdqUjB4bmp1bGZWWXFEMm1WSmFsNlIweGlKTGNwdHlhSWV4QStJa3FZRm1JUFNncERHClRsaGtrL2pHeUI0U0p1YlVFYTFsTGxEcFFCZ0FHbk5TZFRCb2pSRkcxYS9JQWpwcmhyQXBsT1dJM1B0TXpXVlcKaE1ickEvelR6VFVUOEoxWnRMNXpBaklVRUdBTmNqZlZqenpQN2t4aWhZblc4b1hGNW1zYlo1R0pvWDNCTGQ5Mgp6Rm9pNGZyZ0l1eTdDWlAvSFJwU01hV0V6NHQ5cmtoR3BVcnhuOTBWM254Ky96QjYzRWhabU42bFFnalBaSkx6CkVNeTcyZzhSdURWdTZ0cWcrODc5STZKRlZPY1BqcVhuK2JoQ1NJM0ZkUUw3WXNtblR5Rlo0T2kwbHUxZkRqNi8KWXpyTmo5R1NKb3h1aGJqTy9Ta2J5cDRaS2gxUStoWDBLK0t0OVR0MEEzN1RsNDQzSjhSUytrNFgwSjRMNzgyeQo2NTllK1R3ZFNkK1JvVnlLUlMwYVVVL2tXemVWR0VxM0hMRk53UWdxQmlvem9oaS8zRU5Qa3ZOK2djRy9QNjkvCktCR0hXNDhCRnlVY1JBN3Z4MHQ5WjgyMVl5NVBPZFFUSTNCNnhialdZWTNiWjVaWUZndmp1SThTLytzWW9VVU8KN0wxby8rT0pjOFZtYzBjZ0E3QU01WmxDenFyMG1mWUtzRFV5U1FPcUZsWXN0b0VtczhrWll6Mk1JNVFkeDk1dQpjZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
root-ca.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUY3VENDQTlXZ0F3SUJBZ0lVTC9hTytnYS9YY3lzakFYbGh1WG92d0xLWkJjd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZVXhDekFKQmdOVkJBWVRBa0pFTVE0d0RBWURWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaAphMkV4RWpBUUJnTlZCQW9NQ1VKeWFXeHNhV0Z1ZERFYk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwCklFTkJNU1V3SXdZRFZRUUREQnhDY21sc2JHbGhiblFnVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUI0WERUSTIKTURjeU16RTFNREV4T1ZvWERUTTJNRGN5TURFMU1ERXhPVm93Z1lVeEN6QUpCZ05WQkFZVEFrSkVNUTR3REFZRApWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaGEyRXhFakFRQmdOVkJBb01DVUp5YVd4c2FXRnVkREViCk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwSUVOQk1TVXdJd1lEVlFRRERCeENjbWxzYkdsaGJuUWcKVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUlJQ0lqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FnOEFNSUlDQ2dLQwpBZ0VBdXlEYmRaMUFycWd6K1l3SkNUcWlxREtuUzNDRGhHekNxK0h5WDN3clBnV0JvZFBraHJCV3dkNzQ4ZjdqClhZWDNQditQS0F0ZzVGYjdxa2ZZUFZJR0FPZUNiUWxkRlJnZld0S2F2MkdxcHZseUlKcy9OZW5PZzFZQ3IydVUKbDE3UnFPNk1BSGt6d1pNTVFDV1JXMlFiUy9weVY0VHd6dkNxSTR1ZVpzOFJ4MndwbERJdWFPVXdJMEVTMG8zdQpWdDJHMVlCTWlFOUNVTDliQWlYbWQ0UTR4a1NFRFRvOVY1SVk3Z2dHYjFTU0xWU2x6RDJHZElaMGN3VlE2LzcwCnUrQ1FPa005ZXhIRVR2eGpGTmZ4azI2YlRZVUJmNnBNS2VpSDdMbC9ucjZFVVVzTW5DSUR5VGtnK3Zta1M5ZWoKUmY1R0QwQ00rcnl1V1BiRHlHOCtzcDh4d1N1ZkcydDdkUGZRSTUzd1Zzc1BKSkk5b0lsZ0lJWXkyMkFUMlo4RwpKL2dZbmYwMU5LREhSV1dBU2FQaTBLT2dURldqRG5xam94Q0FHZjVGVFRJSHdBQjVsMS8rMXZFbEkyNjQ2M2d4CnBWcTk4Vyt4U3FQQ0xaTW9sWlE5TVkwbjVHeGgvZjhkK0RPb1BVT0lXazJqWXdvS1JGQXJiTlNTNnkySnVrS3YKSWNvMnN4YUhqZkhrdDdqdDBkckRLcjUrelI5bndUWDhVN3hBaWlTYkVTekN6OWlvdU9QSEcxMFFtdzl6VVRNMgoxdzJmMmlQRWpvbFpBVjFBaFU3dzFWNHBzc3JpWDIvNTlDR1dYT1VEcWNnd2MwdWh4djRnWFRndXBCeGcrYU5yCllybWZwNndtejdzN3lmblh3T2xVaVRDRW1Bc2NBemNkMmdCaGwvN1dpcmFRZFVzQ0F3RUFBYU5UTUZFd0hRWUQKVlIwT0JCWUVGSGJhbmo2RkdNVWZ3bEMwSytqY081TTlHd0FwTUI4R0ExVWRJd1FZTUJhQUZIYmFuajZGR01VZgp3bEMwSytqY081TTlHd0FwTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3RFFZSktvWklodmNOQVFFTEJRQURnZ0lCCkFBZVVVVUFMTk5FNDM2UEwvZXl6V0c3bmlPdndXODF3UkdVdGdEUnJpY2xFWjh0K3MzUG9MOXRibyszUGN1ekgKakxsUFArYmVLY2tUTEZKVGZZWUN3Z0dWZkdIRXE1ejV1SUt3ZWIyMG9GSEg3ek9DSzF3VVJBSUlPZnFycncyMApjcWNzdTRnK3NENnl0bllWN2Y1T0RFT2RNaXpjVXRrbGpMSjVieXJLSU9OV2FrSTBpd0xLeXFPQWlGeUVSY2xiCjB0ZzhoTDR6dkRLVUZ6dVJycXhxS0padzNWUWUvM1JWUFYwZ0RLUW96VEQ0M3lnQUdGVlVjckx1dHZOK2V5bEEKVDdYMGtNZXJlVVRKd1N6RDVvenhGRXFkaDlLNHZkZTA2a3BuSXpQS2tEanNFZiszeW9WeFVxRGJCeGV3ai9aOApodzhmT3lBWC9jV2UvZlhmWVdPV3RpTlhiQVJRd0pvUWlLb3lacHRuNGpvRXhLWVB2Qzg0RitINEZnZnpidXFkCnNnL2R2SjBxcldGaUlZeWZBRS9NNGM3VTBDUnVsZ1lETXJhbktIUHhxTllVT21pRzM4T0xLTDlFMmlvV002UHYKek82djVvUk5pazFFN3BrRUVMSUFPczR3U2MvdG45MU01TmtpSjgyRXNEQ2ZaVG5FVU9Cd3VsRzZSbW8vYWF0agpCWUJEaHo0dnhmN0ZjNG13WEdXNVZXc1Qzd2ZVckErZ3l3VWo5dlFqTTV6SjEybDl4NU9Dd3pNMTJuQWdSZ1dFCkh4ZDh5TFhkNE9rTWRaRWNVckY5eWtSMGJUZ3AyWnowL3lPR21KbVpieHRNdHlGaTVMcmt6VElodWJNS1l2bncKcWsrbWdaUmNMcXBWclRSYTNiaGdEVzJrSWpFT2I5SHB6NG5MZ3loUVpCMFAKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
kind: Secret
metadata:
name: opensearch-node-2-cert
namespace: observability

7
helm-charts-observability/charts/opensearch/opensearch-secret.yaml Normal file
View File

@@ -0,0 +1,7 @@
apiVersion: v1
data:
OPENSEARCH_INITIAL_ADMIN_PASSWORD: RW5wMTI5czBmMA==
kind: Secret
metadata:
name: opensearch-secret
namespace: observability

454
helm-charts-observability/charts/opensearch/opensearch-template.yaml Normal file
View File

@@ -0,0 +1,454 @@
---
# Source: opensearch/templates/poddisruptionbudget.yaml
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
name: "brilliant-opensearch-cluster-master-pdb"
labels:
helm.sh/chart: opensearch-3.7.0
app.kubernetes.io/name: opensearch
app.kubernetes.io/instance: brilliant-opensearch
app.kubernetes.io/version: "3.7.0"
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/component: brilliant-opensearch-cluster-master
spec:
maxUnavailable: 1
selector:
matchLabels:
app.kubernetes.io/name: opensearch
app.kubernetes.io/instance: brilliant-opensearch
---
# Source: opensearch/templates/configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: brilliant-opensearch-cluster-master-config
labels:
helm.sh/chart: opensearch-3.7.0
app.kubernetes.io/name: opensearch
app.kubernetes.io/instance: brilliant-opensearch
app.kubernetes.io/version: "3.7.0"
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/component: brilliant-opensearch-cluster-master
data:
opensearch.yml: |
cluster.name: brilliant-opensearch-cluster
# Bind to all interfaces because we don't know what IP address Docker will assign to us.
network.host: 0.0.0.0
# Setting network.host to a non-loopback address enables the annoying bootstrap checks. "Single-node" mode disables them again.
# Implicitly done if ".singleNode" is set to "true".
# discovery.type: single-node
# Start OpenSearch Security Demo Configuration
# WARNING: revise all the lines below before you go into production
plugins:
security:
nodes_dn:
- "CN=opensearch-master-0,OU=OpenSearch Nodes,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD"
- "CN=opensearch-master-1,OU=OpenSearch Nodes,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD"
- "CN=opensearch-master-2,OU=OpenSearch Nodes,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD"
ssl:
transport:
pemcert_filepath: certs/node.pem
pemkey_filepath: certs/node-key.pem
pemtrustedcas_filepath: certs/root-ca.pem
enforce_hostname_verification: true
resolve_hostname: true
http:
enabled: true
pemcert_filepath: certs/node.pem
pemkey_filepath: certs/node-key.pem
pemtrustedcas_filepath: certs/root-ca.pem
allow_unsafe_democertificates: false
allow_default_init_securityindex: true
authcz:
admin_dn:
- CN=opensearch-admin,OU=OpenSearch Administrators,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD
audit.type: internal_opensearch
enable_snapshot_restore_privilege: true
check_snapshot_restore_write_privileges: true
restapi:
roles_enabled: ["all_access", "security_rest_api_access"]
system_indices:
enabled: true
indices:
[
".opendistro-alerting-config",
".opendistro-alerting-alert*",
".opendistro-anomaly-results*",
".opendistro-anomaly-detector*",
".opendistro-anomaly-checkpoints",
".opendistro-anomaly-detection-state",
".opendistro-reports-*",
".opendistro-notifications-*",
".opendistro-notebooks",
".opendistro-asynchronous-search-response*",
]
######## End OpenSearch Security Demo Configuration ########
---
# Source: opensearch/templates/service.yaml
kind: Service
apiVersion: v1
metadata:
name: brilliant-opensearch-cluster-master
labels:
helm.sh/chart: opensearch-3.7.0
app.kubernetes.io/name: opensearch
app.kubernetes.io/instance: brilliant-opensearch
app.kubernetes.io/version: "3.7.0"
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/component: brilliant-opensearch-cluster-master
annotations:
{}
spec:
type: ClusterIP
selector:
app.kubernetes.io/name: opensearch
app.kubernetes.io/instance: brilliant-opensearch
ports:
- name: http
protocol: TCP
port: 9200
- name: transport
protocol: TCP
port: 9300
- name: metrics
protocol: TCP
port: 9600
---
# Source: opensearch/templates/service.yaml
kind: Service
apiVersion: v1
metadata:
name: brilliant-opensearch-cluster-master-headless
labels:
helm.sh/chart: opensearch-3.7.0
app.kubernetes.io/name: opensearch
app.kubernetes.io/instance: brilliant-opensearch
app.kubernetes.io/version: "3.7.0"
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/component: brilliant-opensearch-cluster-master
annotations:
service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
spec:
clusterIP: None # This is needed for statefulset hostnames like opensearch-0 to resolve
# Create endpoints also if the related pod isn't ready
publishNotReadyAddresses: true
selector:
app.kubernetes.io/name: opensearch
app.kubernetes.io/instance: brilliant-opensearch
ports:
- name: http
port: 9200
- name: transport
port: 9300
- name: metrics
port: 9600
---
# Source: opensearch/templates/statefulset.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: brilliant-opensearch-cluster-master
labels:
helm.sh/chart: opensearch-3.7.0
app.kubernetes.io/name: opensearch
app.kubernetes.io/instance: brilliant-opensearch
app.kubernetes.io/version: "3.7.0"
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/component: brilliant-opensearch-cluster-master
annotations:
majorVersion: "3"
spec:
serviceName: brilliant-opensearch-cluster-master-headless
selector:
matchLabels:
app.kubernetes.io/name: opensearch
app.kubernetes.io/instance: brilliant-opensearch
replicas: 3
podManagementPolicy: Parallel
updateStrategy:
type: RollingUpdate
volumeClaimTemplates:
- metadata:
name: brilliant-opensearch-cluster-master
spec:
accessModes:
- "ReadWriteOnce"
resources:
requests:
storage: "120Gi"
storageClassName: "longhorn"
template:
metadata:
name: "brilliant-opensearch-cluster-master"
labels:
helm.sh/chart: opensearch-3.7.0
app.kubernetes.io/name: opensearch
app.kubernetes.io/instance: brilliant-opensearch
app.kubernetes.io/version: "3.7.0"
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/component: brilliant-opensearch-cluster-master
annotations:
configchecksum: 695bb69d8226ee092a4062e8f2e3c1f5fd7f6ed596b739cdd7dd9dcb60249ff
spec:
securityContext:
fsGroup: 1000
runAsUser: 1000
automountServiceAccountToken: false
tolerations:
- effect: NoSchedule
key: dedicated
operator: Equal
value: storage
affinity:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchExpressions:
- key: app.kubernetes.io/instance
operator: In
values:
- brilliant-opensearch
- key: app.kubernetes.io/name
operator: In
values:
- opensearch
topologyKey: kubernetes.io/hostname
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/hostname
operator: NotIn
values:
- k8s-cp-01
terminationGracePeriodSeconds: 120
volumes:
- name: config
configMap:
name: brilliant-opensearch-cluster-master-config
- emptyDir: {}
name: config-emptydir
# Currently some extra blocks accept strings
# to continue with backwards compatibility this is being kept
# whilst also allowing for yaml to be specified too.
- name: node-0-source
secret:
defaultMode: 288
secretName: opensearch-node-0-cert
- name: node-1-source
secret:
defaultMode: 288
secretName: opensearch-node-1-cert
- name: node-2-source
secret:
defaultMode: 288
secretName: opensearch-node-2-cert
- emptyDir: {}
name: runtime-certs
enableServiceLinks: true
initContainers:
- name: fsgroup-volume
image: "busybox:latest"
imagePullPolicy: "IfNotPresent"
command: ['sh', '-c']
args:
- 'chown -R 1000:1000 /usr/share/opensearch/data'
securityContext:
runAsUser: 0
resources:
{}
volumeMounts:
- name: "brilliant-opensearch-cluster-master"
mountPath: /usr/share/opensearch/data
- name: sysctl
image: "busybox:latest"
imagePullPolicy: "IfNotPresent"
command:
- sh
- -c
- |
set -xe
DESIRED="262144"
CURRENT=$(sysctl -n vm.max_map_count)
if [ "$DESIRED" -gt "$CURRENT" ]; then
sysctl -w vm.max_map_count=$DESIRED
fi
securityContext:
runAsUser: 0
privileged: true
resources:
{}
- name: configfile
image: "opensearchproject/opensearch:3.7.0"
imagePullPolicy: "IfNotPresent"
command:
- sh
- -c
- |
#!/usr/bin/env bash
cp -r /tmp/configfolder/* /tmp/config/
securityContext:
capabilities:
drop:
- ALL
runAsNonRoot: true
runAsUser: 1000
resources:
{}
volumeMounts:
- mountPath: /tmp/config/
name: config-emptydir
- name: config
mountPath: /tmp/configfolder/opensearch.yml
subPath: opensearch.yml
# Currently some extra blocks accept strings
# to continue with backwards compatibility this is being kept
# whilst also allowing for yaml to be specified too.
- command:
- /bin/sh
- -ec
- |
ordinal="${POD_NAME##*-}"
case "${ordinal}" in
0|1|2)
;;
*)
echo "ERROR: unsupported pod name: ${POD_NAME}"
exit 1
;;
esac
source_dir="/source/node-${ordinal}"
cert="${source_dir}/node-${ordinal}.pem"
key="${source_dir}/node-${ordinal}-key.pem"
ca="${source_dir}/root-ca.pem"
test -r "${cert}" || {
echo "ERROR: certificate not readable: ${cert}"
exit 1
}
test -r "${key}" || {
echo "ERROR: private key not readable: ${key}"
exit 1
}
test -r "${ca}" || {
echo "ERROR: root CA not readable: ${ca}"
exit 1
}
cp "${cert}" /runtime/node.pem
cp "${key}" /runtime/node-key.pem
cp "${ca}" /runtime/root-ca.pem
chmod 0644 /runtime/node.pem
chmod 0600 /runtime/node-key.pem
chmod 0644 /runtime/root-ca.pem
echo "Selected node-${ordinal} certificate for ${POD_NAME}"
ls -l /runtime
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
image: busybox:1.36.1
imagePullPolicy: IfNotPresent
name: select-node-certificate
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsGroup: 1000
runAsNonRoot: true
runAsUser: 1000
volumeMounts:
- mountPath: /source/node-0
name: node-0-source
readOnly: true
- mountPath: /source/node-1
name: node-1-source
readOnly: true
- mountPath: /source/node-2
name: node-2-source
readOnly: true
- mountPath: /runtime
name: runtime-certs
containers:
- name: "opensearch"
securityContext:
capabilities:
drop:
- ALL
runAsNonRoot: true
runAsUser: 1000
image: "opensearchproject/opensearch:3.7.0"
imagePullPolicy: "IfNotPresent"
readinessProbe:
failureThreshold: 3
periodSeconds: 5
tcpSocket:
port: 9200
timeoutSeconds: 3
startupProbe:
failureThreshold: 30
initialDelaySeconds: 5
periodSeconds: 10
tcpSocket:
port: 9200
timeoutSeconds: 3
ports:
- name: http
containerPort: 9200
- name: transport
containerPort: 9300
- name: metrics
containerPort: 9600
resources:
limits:
cpu: "4"
memory: 8Gi
requests:
cpu: "2"
memory: 6Gi
env:
- name: node.name
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: cluster.initial_master_nodes
value: "brilliant-opensearch-cluster-master-0,brilliant-opensearch-cluster-master-1,brilliant-opensearch-cluster-master-2,"
- name: discovery.seed_hosts
value: "brilliant-opensearch-cluster-master-headless"
- name: cluster.name
value: "brilliant-opensearch-cluster"
- name: network.host
value: "0.0.0.0"
- name: OPENSEARCH_JAVA_OPTS
value: "-Xmx3G -Xms3G"
- name: node.roles
value: "master,ingest,data,remote_cluster_client,"
envFrom:
- secretRef:
name: opensearch-secret
volumeMounts:
- name: "brilliant-opensearch-cluster-master"
mountPath: /usr/share/opensearch/data
- name: config-emptydir
mountPath: /usr/share/opensearch/config/opensearch.yml
subPath: opensearch.yml
# Currently some extra blocks accept strings
# to continue with backwards compatibility this is being kept
# whilst also allowing for yaml to be specified too.
- mountPath: /usr/share/opensearch/config/certs
name: runtime-certs
readOnly: true

2
helm-charts-observability/charts/opensearch/templates/NOTES.txt Executable file
View File

@@ -0,0 +1,2 @@
Watch all cluster members come up.
$ kubectl get pods --namespace={{ .Release.Namespace }} -l app.kubernetes.io/component={{ template "opensearch.uname" . }} -w

144
helm-charts-observability/charts/opensearch/templates/_helpers.tpl Executable file
View File

@@ -0,0 +1,144 @@
{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "opensearch.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "opensearch.fullname" -}}
{{- if contains .Chart.Name .Release.Name }}
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "opensearch.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Common labels
*/}}
{{- define "opensearch.labels" -}}
helm.sh/chart: {{ include "opensearch.chart" . }}
{{ include "opensearch.selectorLabels" . }}
{{- if .Chart.AppVersion }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
app.kubernetes.io/component: {{ include "opensearch.uname" . }}
{{- with .Values.labels }}
{{ toYaml . }}
{{- end }}
{{- end }}
{{/*
Selector labels
*/}}
{{- define "opensearch.selectorLabels" -}}
app.kubernetes.io/name: {{ include "opensearch.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}
{{- define "opensearch.uname" -}}
{{- if empty .Values.fullnameOverride -}}
{{- if empty .Values.nameOverride -}}
{{ .Values.clusterName }}-{{ .Values.nodeGroup }}
{{- else -}}
{{ .Values.nameOverride }}-{{ .Values.nodeGroup }}
{{- end -}}
{{- else -}}
{{ .Values.fullnameOverride }}
{{- end -}}
{{- end -}}
{{- define "opensearch.masterService" -}}
{{- if empty .Values.masterService -}}
{{- if empty .Values.fullnameOverride -}}
{{- if empty .Values.nameOverride -}}
{{ .Values.clusterName }}-master
{{- else -}}
{{ .Values.nameOverride }}-master
{{- end -}}
{{- else -}}
{{ .Values.fullnameOverride }}
{{- end -}}
{{- else -}}
{{ .Values.masterService }}
{{- end -}}
{{- end -}}
{{- define "opensearch.serviceName" -}}
{{- if eq .Values.nodeGroup "master" }}
{{- include "opensearch.masterService" . }}
{{- else }}
{{- include "opensearch.uname" . }}
{{- end }}
{{- end -}}
{{- define "opensearch.endpoints" -}}
{{- $replicas := int (toString (.Values.replicas)) }}
{{- $uname := (include "opensearch.uname" .) }}
{{- range $i, $e := untilStep 0 $replicas 1 -}}
{{ $uname }}-{{ $i }},
{{- end -}}
{{- end -}}
{{- define "opensearch.majorVersion" -}}
{{- if .Values.majorVersion }}
{{- .Values.majorVersion }}
{{- else }}
{{- $version := semver (coalesce .Values.image.tag .Chart.AppVersion "1") }}
{{- $version.Major }}
{{- end }}
{{- end }}
{{- define "opensearch.dockerRegistry" -}}
{{- if eq .Values.global.dockerRegistry "" -}}
{{- .Values.global.dockerRegistry -}}
{{- else -}}
{{- .Values.global.dockerRegistry | trimSuffix "/" | printf "%s/" -}}
{{- end -}}
{{- end -}}
{{- define "opensearch.roles" -}}
{{- range $.Values.roles -}}
{{ . }},
{{- end -}}
{{- end -}}
{{/*
Return the appropriate apiVersion for ingress.
*/}}
{{- define "opensearch.ingress.apiVersion" -}}
{{- if and (.Capabilities.APIVersions.Has "networking.k8s.io/v1") (semverCompare ">= 1.19-0" .Capabilities.KubeVersion.Version) -}}
{{- print "networking.k8s.io/v1" -}}
{{- else if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1" -}}
{{- print "networking.k8s.io/v1beta1" -}}
{{- else -}}
{{- print "extensions/v1beta1" -}}
{{- end -}}
{{- end -}}
{{/*
Return if ingress is stable.
*/}}
{{- define "opensearch.ingress.isStable" -}}
{{- eq (include "opensearch.ingress.apiVersion" .) "networking.k8s.io/v1" -}}
{{- end -}}
{{/*
Return if ingress supports ingressClassName.
*/}}
{{- define "opensearch.ingress.supportsIngressClassName" -}}
{{- or (eq (include "opensearch.ingress.isStable" .) "true") (and (eq (include "opensearch.ingress.apiVersion" .) "networking.k8s.io/v1beta1") (semverCompare ">= 1.18-0" .Capabilities.KubeVersion.Version)) -}}
{{- end -}}

18
helm-charts-observability/charts/opensearch/templates/configmap.yaml Normal file
View File

@@ -0,0 +1,18 @@
{{- $root := . }}
{{- if .Values.config }}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ template "opensearch.uname" . }}-config
labels:
{{- include "opensearch.labels" . | nindent 4 }}
data:
{{- range $configName, $configYaml := .Values.config }}
{{ $configName }}: |
{{- if (eq (kindOf $configYaml) "map")}}
{{- tpl (toYaml $configYaml) $root | nindent 4 }}
{{- else -}}
{{- tpl $configYaml $root | nindent 4 }}
{{- end -}}
{{- end -}}
{{- end -}}

8
helm-charts-observability/charts/opensearch/templates/extraManifests.yaml Normal file
View File

@@ -0,0 +1,8 @@
{{ range .Values.extraObjects }}
---
{{- if typeIs "string" . }}
{{ tpl . $ }}
{{- else }}
{{ tpl (toYaml .) $ }}
{{- end }}
{{ end }}

65
helm-charts-observability/charts/opensearch/templates/ingress.yaml Normal file
View File

@@ -0,0 +1,65 @@
{{- if .Values.ingress.enabled -}}
{{- $fullName := include "opensearch.serviceName" . -}}
{{- $servicePort := .Values.httpPort -}}
{{- $ingressPath := .Values.ingress.path -}}
{{- $ingressApiIsStable := eq (include "opensearch.ingress.isStable" .) "true" -}}
{{- $ingressSupportsIngressClassName := eq (include "opensearch.ingress.supportsIngressClassName" .) "true" -}}
{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
apiVersion: networking.k8s.io/v1
{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
apiVersion: networking.k8s.io/v1beta1
{{- else -}}
apiVersion: extensions/v1beta1
{{- end }}
kind: Ingress
metadata:
name: {{ $fullName }}
labels:
{{- include "opensearch.labels" . | nindent 4 }}
{{- with .Values.ingress.ingressLabels }}
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with .Values.ingress.annotations }}
annotations:
{{ toYaml . | indent 4 }}
{{- end }}
spec:
{{- if and $ingressSupportsIngressClassName .Values.ingress.ingressClassName }}
ingressClassName: {{ .Values.ingress.ingressClassName }}
{{- end -}}
{{- if .Values.ingress.tls }}
tls:
{{- range .Values.ingress.tls }}
- hosts:
{{- range .hosts }}
- {{ . }}
{{- end }}
secretName: {{ .secretName }}
{{- end }}
{{- end }}
rules:
{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
{{- range .Values.ingress.hosts }}
- host: {{ . | quote }}
http:
paths:
- path: {{ $ingressPath }}
pathType: Prefix
backend:
service:
name: {{ $fullName }}
port:
number: {{ $servicePort }}
{{- end }}
{{- else -}}
{{- range .Values.ingress.hosts }}
- host: {{ . | quote }}
http:
paths:
- path: {{ $ingressPath }}
backend:
serviceName: {{ $fullName }}
servicePort: {{ $servicePort }}
{{- end }}
{{- end }}
{{- end }}

17
helm-charts-observability/charts/opensearch/templates/networkpolicy.yaml Normal file
View File

@@ -0,0 +1,17 @@
{{- if .Values.networkPolicy.create -}}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: {{ template "opensearch.uname" . }}-opensearch-net
labels:
{{- include "opensearch.labels" . | nindent 4 }}
spec:
ingress:
- from:
- podSelector:
matchLabels:
{{ template "opensearch.uname" . }}-transport-client: "true"
podSelector:
matchLabels:
{{ template "opensearch.uname" . }}-transport-client: "true"
{{- end }}

17
helm-charts-observability/charts/opensearch/templates/poddisruptionbudget.yaml Normal file
View File

@@ -0,0 +1,17 @@
{{- if .Values.maxUnavailable }}
{{- if semverCompare ">=1.21-0" .Capabilities.KubeVersion.GitVersion -}}
apiVersion: policy/v1
{{- else -}}
apiVersion: policy/v1beta1
{{- end }}
kind: PodDisruptionBudget
metadata:
name: "{{ template "opensearch.uname" . }}-pdb"
labels:
{{- include "opensearch.labels" . | nindent 4 }}
spec:
maxUnavailable: {{ .Values.maxUnavailable }}
selector:
matchLabels:
{{- include "opensearch.selectorLabels" . | nindent 6 }}
{{- end }}

17
helm-charts-observability/charts/opensearch/templates/podsecuritypolicy.yaml Normal file
View File

@@ -0,0 +1,17 @@
{{- if semverCompare "<1.25-0" .Capabilities.KubeVersion.GitVersion -}}
{{- if .Values.podSecurityPolicy.create -}}
{{- $fullName := include "opensearch.uname" . -}}
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: {{ default $fullName .Values.podSecurityPolicy.name | quote }}
labels:
{{- include "opensearch.labels" . | nindent 4 }}
spec:
{{ toYaml .Values.podSecurityPolicy.spec | indent 2 }}
{{- if .Values.sysctl.enabled }}
allowedUnsafeSysctls:
- vm.max_map_count
{{- end }}
{{- end }}
{{- end }}

22
helm-charts-observability/charts/opensearch/templates/role.yaml Normal file
View File

@@ -0,0 +1,22 @@
{{- if .Values.rbac.create -}}
{{- $fullName := include "opensearch.uname" . -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: {{ $fullName | quote }}
labels:
{{- include "opensearch.labels" . | nindent 4 }}
rules:
- apiGroups:
- extensions
resources:
- podsecuritypolicies
resourceNames:
{{- if eq .Values.podSecurityPolicy.name "" }}
- {{ $fullName | quote }}
{{- else }}
- {{ .Values.podSecurityPolicy.name | quote }}
{{- end }}
verbs:
- use
{{- end -}}

21
helm-charts-observability/charts/opensearch/templates/rolebinding.yaml Normal file
View File

@@ -0,0 +1,21 @@
{{- if .Values.rbac.create -}}
{{- $fullName := include "opensearch.uname" . -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: {{ $fullName | quote }}
labels:
{{- include "opensearch.labels" . | nindent 4 }}
subjects:
- kind: ServiceAccount
{{- if eq .Values.rbac.serviceAccountName "" }}
name: {{ $fullName | quote }}
{{- else }}
name: {{ .Values.rbac.serviceAccountName | quote }}
{{- end }}
namespace: {{ .Release.Namespace | quote }}
roleRef:
kind: Role
name: {{ $fullName | quote }}
apiGroup: rbac.authorization.k8s.io
{{- end -}}

19
helm-charts-observability/charts/opensearch/templates/securityconfig.yaml Normal file
View File

@@ -0,0 +1,19 @@
{{- if .Values.securityConfig.config.data -}}
apiVersion: v1
kind: Secret
metadata:
name: {{ include "opensearch.uname" . }}-securityconfig
namespace: {{ .Release.Namespace }}
labels:
{{- include "opensearch.labels" . | nindent 4 }}
type: Opaque
stringData:
{{- range $key, $val := .Values.securityConfig.config.data }}
{{ $key }}: |
{{- if (eq (kindOf $val) "map")}}
{{- tpl (toYaml $val) $ | nindent 4 }}
{{- else }}
{{- tpl $val $ | nindent 4 }}
{{- end }}
{{- end }}
{{- end }}

75
helm-charts-observability/charts/opensearch/templates/service.yaml Normal file
View File

@@ -0,0 +1,75 @@
---
kind: Service
apiVersion: v1
metadata:
name: {{ template "opensearch.serviceName" . }}
labels:
{{- include "opensearch.labels" . | nindent 4 }}
{{- if .Values.service.labels }}
{{ toYaml .Values.service.labels | indent 4 }}
{{- end }}
annotations:
{{ toYaml .Values.service.annotations | indent 4 }}
spec:
type: {{ .Values.service.type }}
{{- if (semverCompare ">= 1.23-0" .Capabilities.KubeVersion.Version) }}
{{- if .Values.service.ipFamilyPolicy }}
ipFamilyPolicy: {{ .Values.service.ipFamilyPolicy }}
{{- end }}
{{- if .Values.service.ipFamilies }}
ipFamilies: {{ .Values.service.ipFamilies }}
{{- end }}
{{- end }}
selector:
{{- include "opensearch.selectorLabels" . | nindent 4 }}
ports:
- name: {{ .Values.service.httpPortName | default "http" }}
protocol: TCP
port: {{ .Values.httpPort }}
{{- if .Values.service.nodePort }}
nodePort: {{ .Values.service.nodePort }}
{{- end }}
- name: {{ .Values.service.transportPortName | default "transport" }}
protocol: TCP
port: {{ .Values.transportPort }}
- name: {{ .Values.service.metricsPortName | default "metrics" }}
protocol: TCP
port: {{ .Values.metricsPort }}
{{- if .Values.service.loadBalancerIP }}
loadBalancerIP: {{ .Values.service.loadBalancerIP }}
{{- end }}
{{- with .Values.service.loadBalancerSourceRanges }}
loadBalancerSourceRanges:
{{ toYaml . | indent 4 }}
{{- end }}
{{- if .Values.service.externalTrafficPolicy }}
externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy }}
{{- end }}
---
kind: Service
apiVersion: v1
metadata:
name: {{ template "opensearch.serviceName" . }}-headless
labels:
{{- include "opensearch.labels" . | nindent 4 }}
{{- if .Values.service.labelsHeadless }}
{{ toYaml .Values.service.labelsHeadless | indent 4 }}
{{- end }}
annotations:
service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
{{- if .Values.service.headless.annotations }}
{{ toYaml .Values.service.headless.annotations | indent 4 }}
{{- end }}
spec:
clusterIP: None # This is needed for statefulset hostnames like opensearch-0 to resolve
# Create endpoints also if the related pod isn't ready
publishNotReadyAddresses: true
selector:
{{- include "opensearch.selectorLabels" . | nindent 4 }}
ports:
- name: {{ .Values.service.httpPortName | default "http" }}
port: {{ .Values.httpPort }}
- name: {{ .Values.service.transportPortName | default "transport" }}
port: {{ .Values.transportPort }}
- name: {{ .Values.service.metricsPortName | default "metrics" }}
port: {{ .Values.metricsPort }}

15
helm-charts-observability/charts/opensearch/templates/serviceMonitor-secret.yaml Normal file
View File

@@ -0,0 +1,15 @@
{{- if and .Values.serviceMonitor.enabled .Values.serviceMonitor.basicAuth.enabled (not .Values.serviceMonitor.basicAuth.existingSecret) }}
apiVersion: v1
kind: Secret
metadata:
name: {{ template "opensearch.uname" . }}-service-monitor-credentials
namespace: {{ .Release.Namespace }}
labels:
{{- include "opensearch.labels" . | nindent 4 }}
{{- with .Values.serviceMonitor.labels }}
{{- toYaml . | nindent 4 }}
{{- end }}
data:
username: {{ .Values.serviceMonitor.basicAuth.username | b64enc | quote }}
password: {{ .Values.serviceMonitor.basicAuth.password | b64enc | quote }}
{{- end }}

42
helm-charts-observability/charts/opensearch/templates/serviceMonitor.yaml Normal file
View File

@@ -0,0 +1,42 @@
{{- if .Values.serviceMonitor.enabled }}
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
name: {{ template "opensearch.uname" . }}-service-monitor
namespace: {{ .Release.Namespace }}
labels:
{{- include "opensearch.labels" . | nindent 4 }}
{{- with .Values.serviceMonitor.labels }}
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
selector:
matchLabels:
{{- include "opensearch.selectorLabels" . | nindent 6 }}
endpoints:
- port: {{ .Values.service.httpPortName | default "http" }}
interval: {{ .Values.serviceMonitor.interval }}
path: {{ .Values.serviceMonitor.path }}
scheme: {{ .Values.serviceMonitor.scheme }}
{{- with .Values.serviceMonitor.tlsConfig }}
tlsConfig:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- if .Values.serviceMonitor.basicAuth.enabled }}
basicAuth:
username:
{{- if .Values.serviceMonitor.basicAuth.existingSecret }}
name: {{ .Values.serviceMonitor.basicAuth.existingSecret }}
{{- else }}
name: {{ template "opensearch.uname" . }}-service-monitor-credentials
{{- end }}
key: username
password:
{{- if .Values.serviceMonitor.basicAuth.existingSecret }}
name: {{ .Values.serviceMonitor.basicAuth.existingSecret }}
{{- else }}
name: {{ template "opensearch.uname" . }}-service-monitor-credentials
{{- end }}
key: password
{{- end }}
{{- end }}

17
helm-charts-observability/charts/opensearch/templates/serviceaccount.yaml Normal file
View File

@@ -0,0 +1,17 @@
{{- if .Values.rbac.create -}}
{{- $fullName := include "opensearch.uname" . -}}
apiVersion: v1
kind: ServiceAccount
metadata:
{{- if eq .Values.rbac.serviceAccountName "" }}
name: {{ $fullName | quote }}
{{- else }}
name: {{ .Values.rbac.serviceAccountName | quote }}
{{- end }}
labels:
{{- include "opensearch.labels" . | nindent 4 }}
annotations:
{{- with .Values.rbac.serviceAccountAnnotations }}
{{- toYaml . | nindent 4 }}
{{- end }}
{{- end -}}

595
helm-charts-observability/charts/opensearch/templates/statefulset.yaml Normal file
View File

@@ -0,0 +1,595 @@
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: {{ template "opensearch.uname" . }}
labels:
{{- include "opensearch.labels" . | nindent 4 }}
annotations:
majorVersion: "{{ include "opensearch.majorVersion" . }}"
{{- with .Values.openSearchAnnotations }}
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
serviceName: {{ template "opensearch.serviceName" . }}-headless
selector:
matchLabels:
{{- include "opensearch.selectorLabels" . | nindent 6 }}
{{- if .Values.singleNode }}
replicas: 1
{{- else }}
replicas: {{ .Values.replicas }}
{{- end }}
podManagementPolicy: {{ .Values.podManagementPolicy }}
updateStrategy:
type: {{ .Values.updateStrategy }}
{{- if .Values.persistence.enabled }}
volumeClaimTemplates:
- metadata:
name: {{ template "opensearch.uname" . }}
{{- if or .Values.persistence.labels.enabled .Values.persistence.labels.additionalLabels }}
labels:
{{- if .Values.persistence.labels.enabled }}
{{- include "opensearch.labels" . | nindent 8 }}
{{- end }}
{{- with .Values.persistence.labels.additionalLabels }}
{{- toYaml . | nindent 8 }}
{{- end }}
{{- end }}
{{- with .Values.persistence.annotations }}
annotations:
{{ toYaml . | indent 8 }}
{{- end }}
spec:
accessModes:
{{- range .Values.persistence.accessModes }}
- {{ . | quote }}
{{- end }}
resources:
requests:
storage: {{ .Values.persistence.size | quote }}
{{- if .Values.persistence.storageClass }}
{{- if (eq "-" .Values.persistence.storageClass) }}
storageClassName: ""
{{- else }}
storageClassName: "{{ .Values.persistence.storageClass }}"
{{- end }}
{{- end }}
{{- end }}
template:
metadata:
name: "{{ template "opensearch.uname" . }}"
labels:
{{- include "opensearch.labels" . | nindent 8 }}
annotations:
{{- range $key, $value := .Values.podAnnotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- /* This forces a restart if the configmap has changed */}}
{{- if .Values.config }}
configchecksum: {{ include (print .Template.BasePath "/configmap.yaml") . | sha256sum | trunc 63 }}
{{- end }}
{{- if .Values.securityConfig.config.data }}
securityconfigchecksum: {{ include (print .Template.BasePath "/securityconfig.yaml") . | sha256sum | trunc 63 }}
{{- end }}
spec:
{{- if .Values.schedulerName }}
schedulerName: "{{ .Values.schedulerName }}"
{{- end }}
securityContext:
{{ toYaml .Values.podSecurityContext | indent 8 }}
{{- if .Values.sysctl.enabled }}
sysctls:
- name: vm.max_map_count
value: {{ .Values.sysctlVmMaxMapCount | quote }}
{{- end }}
{{- if .Values.fsGroup }}
fsGroup: {{ .Values.fsGroup }} # Deprecated value, please use .Values.podSecurityContext.fsGroup
{{- end }}
{{- if and .Values.rbac.create (eq .Values.rbac.serviceAccountName "") }}
serviceAccountName: "{{ template "opensearch.uname" . }}"
automountServiceAccountToken: {{ ne .Values.rbac.automountServiceAccountToken false }}
{{- else if and .Values.rbac.create (ne .Values.rbac.serviceAccountName "") }}
serviceAccountName: {{ .Values.rbac.serviceAccountName | quote }}
automountServiceAccountToken: {{ ne .Values.rbac.automountServiceAccountToken false }}
{{- else }}
automountServiceAccountToken: {{ ne .Values.rbac.automountServiceAccountToken false }}
{{- end }}
{{- if .Values.imagePullSecrets }}
{{- end }}
{{- with .Values.tolerations }}
tolerations:
{{ toYaml . | indent 6 }}
{{- end }}
{{- with .Values.nodeSelector }}
nodeSelector:
{{ toYaml . | indent 8 }}
{{- end }}
{{- if or (eq .Values.antiAffinity "hard") (eq .Values.antiAffinity "soft") (eq .Values.antiAffinity "custom") .Values.nodeAffinity .Values.podAffinity }}
{{- if .Values.priorityClassName }}
priorityClassName: {{ .Values.priorityClassName }}
{{- end }}
affinity:
{{- end }}
{{- if eq .Values.antiAffinity "hard" }}
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchExpressions:
- key: app.kubernetes.io/instance
operator: In
values:
- {{ .Release.Name }}
- key: app.kubernetes.io/name
operator: In
values:
- {{ include "opensearch.name" . }}
topologyKey: {{ .Values.antiAffinityTopologyKey }}
{{- else if eq .Values.antiAffinity "soft" }}
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- weight: 1
podAffinityTerm:
topologyKey: {{ .Values.antiAffinityTopologyKey }}
labelSelector:
matchExpressions:
- key: app.kubernetes.io/instance
operator: In
values:
- {{ .Release.Name }}
- key: app.kubernetes.io/name
operator: In
values:
- {{ include "opensearch.name" . }}
{{- else if eq .Values.antiAffinity "custom" }}
{{- with .Values.customAntiAffinity }}
podAntiAffinity:
{{ toYaml . | indent 10 }}
{{- end }}
{{- end }}
{{- with .Values.podAffinity }}
podAffinity:
{{ toYaml . | indent 10 }}
{{- end }}
{{- with .Values.nodeAffinity }}
nodeAffinity:
{{ toYaml . | indent 10 }}
{{- end }}
{{- if .Values.topologySpreadConstraints }}
topologySpreadConstraints:
{{- toYaml .Values.topologySpreadConstraints | nindent 8 }}
{{- end }}
terminationGracePeriodSeconds: {{ .Values.terminationGracePeriod }}
volumes:
{{- if .Values.config }}
- name: config
configMap:
name: {{ template "opensearch.uname" . }}-config
- emptyDir: {}
name: config-emptydir
{{- end }}
{{- range .Values.secretMounts }}
- name: {{ .name | required "secretMount .name is required" }}
secret:
secretName: {{ .secretName | required "secretMount .secretName is required" }}
{{- if .defaultMode }}
defaultMode: {{ .defaultMode }}
{{- end }}
{{- end }}
{{- if and .Values.securityConfig.config.data .Values.securityConfig.config.securityConfigSecret }}
{{ fail "Only one of .Values.securityConfig.config.data and .Values.securityConfig.config.securityConfigSecret may be defined. Please see the comment in values.yaml describing usage." }}
{{- end }}
{{- if .Values.securityConfig.config.data }}
- name: security-config-data
secret:
secretName: {{ include "opensearch.uname" . }}-securityconfig
{{- end }}
{{- with .Values.securityConfig.config.securityConfigSecret }}
- name: security-config-complete
secret:
secretName: {{ . | quote }}
{{- end }}
{{- if .Values.securityConfig.actionGroupsSecret }}
- name: action-groups
secret:
secretName: {{ .Values.securityConfig.actionGroupsSecret }}
{{- end }}
{{- if .Values.securityConfig.configSecret }}
- name: security-config
secret:
secretName: {{ .Values.securityConfig.configSecret }}
{{- end }}
{{- if .Values.securityConfig.internalUsersSecret }}
- name: internal-users-config
secret:
secretName: {{ .Values.securityConfig.internalUsersSecret }}
{{- end }}
{{- if .Values.securityConfig.rolesSecret }}
- name: roles
secret:
secretName: {{ .Values.securityConfig.rolesSecret }}
{{- end }}
{{- if .Values.securityConfig.rolesMappingSecret }}
- name: role-mapping
secret:
secretName: {{ .Values.securityConfig.rolesMappingSecret }}
{{- end -}}
{{- if .Values.securityConfig.tenantsSecret }}
- name: tenants
secret:
secretName: {{ .Values.securityConfig.tenantsSecret }}
{{- end }}
{{- if .Values.keystore }}
- name: keystore
emptyDir: {}
{{- range .Values.keystore }}
- name: keystore-{{ .secretName }}
secret: {{ toYaml . | nindent 12 }}
{{- end }}
{{ end }}
{{- if .Values.extraVolumes }}
# Currently some extra blocks accept strings
# to continue with backwards compatibility this is being kept
# whilst also allowing for yaml to be specified too.
{{- if eq "string" (printf "%T" .Values.extraVolumes) }}
{{ tpl .Values.extraVolumes . | indent 6 }}
{{- else }}
{{ toYaml .Values.extraVolumes | indent 6 }}
{{- end }}
{{- end }}
{{- if .Values.imagePullSecrets }}
imagePullSecrets:
{{ toYaml .Values.imagePullSecrets | indent 8 }}
{{- end }}
enableServiceLinks: {{ .Values.enableServiceLinks }}
{{- if .Values.hostAliases }}
hostAliases: {{ toYaml .Values.hostAliases | nindent 8 }}
{{- end }}
{{- if or (.Values.extraInitContainers) (.Values.keystore) (.Values.persistence.enabled) (.Values.sysctlInit.enabled) (.Values.config) }}
initContainers:
{{- if and .Values.persistence.enabled .Values.persistence.enableInitChown }}
- name: fsgroup-volume
image: "{{ template "opensearch.dockerRegistry" . }}{{ .Values.persistence.image | default "busybox" }}:{{ .Values.persistence.imageTag | default "latest" }}"
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
command: ['sh', '-c']
args:
- 'chown -R 1000:1000 /usr/share/opensearch/data'
securityContext:
runAsUser: 0
resources:
{{- toYaml .Values.initResources | nindent 10 }}
volumeMounts:
- name: "{{ template "opensearch.uname" . }}"
mountPath: {{ .Values.opensearchHome }}/data
{{- end }}
{{- if .Values.sysctlInit.enabled }}
- name: sysctl
image: "{{ template "opensearch.dockerRegistry" . }}{{ .Values.sysctlInit.image | default "busybox" }}:{{ .Values.sysctlInit.imageTag | default "latest" }}"
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
command:
- sh
- -c
- |
set -xe
DESIRED="{{ .Values.sysctlVmMaxMapCount }}"
CURRENT=$(sysctl -n vm.max_map_count)
if [ "$DESIRED" -gt "$CURRENT" ]; then
sysctl -w vm.max_map_count=$DESIRED
fi
securityContext:
runAsUser: 0
privileged: true
resources:
{{- toYaml .Values.initResources | nindent 10 }}
{{- end }}
{{- if .Values.config }}
- name: configfile
image: "{{ template "opensearch.dockerRegistry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
command:
- sh
- -c
- |
#!/usr/bin/env bash
cp -r /tmp/configfolder/* /tmp/config/
securityContext:
{{ toYaml .Values.securityContext | indent 10 }}
resources:
{{- toYaml .Values.initResources | nindent 10 }}
volumeMounts:
- mountPath: /tmp/config/
name: config-emptydir
{{- range $path, $config := .Values.config }}
- name: config
mountPath: /tmp/configfolder/{{ $path }}
subPath: {{ $path }}
{{- end -}}
{{- end }}
{{- if .Values.keystore }}
- name: keystore
image: "{{ template "opensearch.dockerRegistry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
command:
- sh
- -c
- |
#!/usr/bin/env bash
set -euo pipefail
{{ .Values.opensearchHome }}/bin/opensearch-keystore create
for i in /tmp/keystoreSecrets/*/*; do
[ -f "$i" ] || continue
key=$(basename $i)
echo "Adding file $i to keystore key $key"
{{ .Values.opensearchHome }}/bin/opensearch-keystore add-file "$key" "$i"
done
# Add the bootstrap password since otherwise the opensearch entrypoint tries to do this on startup
if [ ! -z ${PASSWORD+x} ]; then
echo 'Adding env $PASSWORD to keystore as key bootstrap.password'
echo "$PASSWORD" | {{ .Values.opensearchHome }}/bin/opensearch-keystore add -x bootstrap.password
fi
cp -a {{ .Values.opensearchHome }}/config/opensearch.keystore /tmp/keystore/
env: {{ toYaml .Values.extraEnvs | nindent 10 }}
envFrom: {{ toYaml .Values.envFrom | nindent 10 }}
securityContext:
{{ toYaml .Values.securityContext | indent 10 }}
resources:
{{- toYaml .Values.initResources | nindent 10 }}
volumeMounts:
- name: keystore
mountPath: /tmp/keystore
{{- range .Values.keystore }}
- name: keystore-{{ .secretName }}
mountPath: /tmp/keystoreSecrets/{{ .secretName }}
{{- end }}
{{- end }}
{{- if .Values.extraInitContainers }}
# Currently some extra blocks accept strings
# to continue with backwards compatibility this is being kept
# whilst also allowing for yaml to be specified too.
{{- if eq "string" (printf "%T" .Values.extraInitContainers) }}
{{ tpl .Values.extraInitContainers . | indent 6 }}
{{- else }}
{{ toYaml .Values.extraInitContainers | indent 6 }}
{{- end }}
{{- end }}
{{- end }}
containers:
- name: "{{ template "opensearch.name" . }}"
securityContext:
{{ toYaml .Values.securityContext | indent 10 }}
{{- if .Values.plugins.enabled }}
command:
- sh
- -c
- |
#!/usr/bin/env bash
set -euo pipefail
{{- range $plugin := .Values.plugins.removeList }}
if ./bin/opensearch-plugin list | grep -q {{ $plugin }}; then
./bin/opensearch-plugin remove {{ $plugin }}
fi
{{- end }}
{{- range $plugin := .Values.plugins.installList }}
./bin/opensearch-plugin install -b {{ $plugin }}
{{- end }}
bash opensearch-docker-entrypoint.sh
{{- end }}
image: "{{ template "opensearch.dockerRegistry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
readinessProbe:
{{ toYaml .Values.readinessProbe | indent 10 }}
{{- if .Values.livenessProbe }}
livenessProbe:
{{ toYaml .Values.livenessProbe | indent 10 }}
{{- end }}
{{- if semverCompare ">=1.16-0" .Capabilities.KubeVersion.Version }}
startupProbe:
{{ toYaml .Values.startupProbe | indent 10 }}
{{- end }}
ports:
- name: http
containerPort: {{ .Values.httpPort }}
{{- if .Values.httpHostPort }}
hostPort: {{ .Values.httpHostPort }}
{{- end }}
- name: transport
containerPort: {{ .Values.transportPort }}
{{- if .Values.transportHostPort }}
hostPort: {{ .Values.transportHostPort }}
{{- end }}
- name: metrics
containerPort: {{ .Values.metricsPort }}
resources:
{{- toYaml .Values.resources | nindent 10 }}
env:
- name: node.name
valueFrom:
fieldRef:
fieldPath: metadata.name
{{- if (and (has "master" .Values.roles) (not .Values.singleNode)) }}
- name: cluster.initial_master_nodes
value: "{{ template "opensearch.endpoints" . }}"
{{- end }}
- name: discovery.seed_hosts
value: "{{ template "opensearch.masterService" . }}-headless"
- name: cluster.name
value: "{{ .Values.clusterName }}"
- name: network.host
value: "{{ .Values.networkHost }}"
- name: OPENSEARCH_JAVA_OPTS
value: "{{ .Values.opensearchJavaOpts }}"
- name: node.roles
value: "{{ template "opensearch.roles" . }}"
{{- if .Values.singleNode }}
- name: discovery.type
value: "single-node"
{{- end }}
{{- if .Values.extraEnvs }}
{{ toYaml .Values.extraEnvs | indent 8 }}
{{- end }}
{{- if .Values.envFrom }}
envFrom:
{{ toYaml .Values.envFrom | indent 8 }}
{{- end }}
{{- if .Values.opensearchLifecycle }}
lifecycle:
{{ toYaml .Values.opensearchLifecycle | indent 10 }}
{{- end }}
volumeMounts:
{{- if .Values.persistence.enabled }}
- name: "{{ template "opensearch.uname" . }}"
mountPath: {{ .Values.opensearchHome }}/data
{{- end }}
{{- if .Values.keystore }}
- name: keystore
mountPath: {{ .Values.opensearchHome }}/config/opensearch.keystore
subPath: opensearch.keystore
{{- end }}
{{- if .Values.securityConfig.enabled }}
{{- if .Values.securityConfig.actionGroupsSecret }}
- mountPath: {{ .Values.securityConfig.path }}/action_groups.yml
name: action-groups
subPath: action_groups.yml
{{- end }}
{{- if .Values.securityConfig.configSecret }}
- mountPath: {{ .Values.securityConfig.path }}/config.yml
name: security-config
subPath: config.yml
{{- end }}
{{- if .Values.securityConfig.internalUsersSecret }}
- mountPath: {{ .Values.securityConfig.path }}/internal_users.yml
name: internal-users-config
subPath: internal_users.yml
{{- end }}
{{- if .Values.securityConfig.rolesSecret }}
- mountPath: {{ .Values.securityConfig.path }}/roles.yml
name: roles
subPath: roles.yml
{{- end }}
{{- if .Values.securityConfig.rolesMappingSecret }}
- mountPath: {{ .Values.securityConfig.path }}/roles_mapping.yml
name: role-mapping
subPath: roles_mapping.yml
{{- end }}
{{- if .Values.securityConfig.tenantsSecret }}
- mountPath: {{ .Values.securityConfig.path }}/tenants.yml
name: tenants
subPath: tenants.yml
{{- end }}
{{- if .Values.securityConfig.config.data }}
{{- if .Values.securityConfig.config.dataComplete }}
- mountPath: {{ .Values.securityConfig.path }}
name: security-config-data
{{- else }}
{{- range $key, $_ := .Values.securityConfig.config.data }}
- mountPath: {{ $.Values.securityConfig.path }}/{{ $key }}
name: security-config-data
subPath: {{ $key }}
{{- end }}
{{- end }}
{{- else if .Values.securityConfig.config.securityConfigSecret }}
- mountPath: {{ .Values.securityConfig.path }}
name: security-config-complete
{{- end }}
{{- end }}
{{- range .Values.secretMounts }}
- name: {{ .name | required "secretMount .name is required" }}
mountPath: {{ .path | required "secretMount .path is required" }}
{{- if .subPath }}
subPath: {{ .subPath }}
{{- end }}
{{- end }}
{{- range $path, $config := .Values.config }}
- name: config-emptydir
mountPath: {{ $.Values.opensearchHome }}/config/{{ $path }}
subPath: {{ $path }}
{{- end -}}
{{- if .Values.extraVolumeMounts }}
# Currently some extra blocks accept strings
# to continue with backwards compatibility this is being kept
# whilst also allowing for yaml to be specified too.
{{- if eq "string" (printf "%T" .Values.extraVolumeMounts) }}
{{ tpl .Values.extraVolumeMounts . | indent 8 }}
{{- else }}
{{ toYaml .Values.extraVolumeMounts | indent 8 }}
{{- end }}
{{- end }}
{{- if .Values.masterTerminationFix }}
{{- if has "master" .Values.roles }}
# This sidecar will prevent slow master re-election
- name: opensearch-master-graceful-termination-handler
image: "{{ template "opensearch.dockerRegistry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
command:
- "sh"
- -c
- |
#!/usr/bin/env bash
set -eo pipefail
http () {
local path="${1}"
if [ -n "${USERNAME}" ] && [ -n "${PASSWORD}" ]; then
BASIC_AUTH="-u ${USERNAME}:${PASSWORD}"
else
BASIC_AUTH=''
fi
curl -XGET -s -k --fail ${BASIC_AUTH} {{ .Values.protocol }}://{{ template "opensearch.masterService" . }}:{{ .Values.httpPort }}${path}
}
cleanup () {
while true ; do
local master="$(http "/_cat/master?h=node" || echo "")"
if [[ $master == "{{ template "opensearch.masterService" . }}"* && $master != "${NODE_NAME}" ]]; then
echo "This node is not master."
break
fi
echo "This node is still master, waiting gracefully for it to step down"
sleep 1
done
exit 0
}
trap cleanup SIGTERM
sleep infinity &
wait $!
resources:
{{- toYaml .Values.sidecarResources | nindent 10 }}
env:
- name: NODE_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
{{- if .Values.extraEnvs }}
{{ toYaml .Values.extraEnvs | indent 8 }}
{{- end }}
{{- if .Values.envFrom }}
envFrom:
{{ toYaml .Values.envFrom | indent 8 }}
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.lifecycle }}
lifecycle:
{{ toYaml .Values.lifecycle | indent 10 }}
{{- end }}
{{- if .Values.extraContainers }}
# Currently some extra blocks accept strings
# to continue with backwards compatibility this is being kept
# whilst also allowing for yaml to be specified too.
{{- if eq "string" (printf "%T" .Values.extraContainers) }}
{{ tpl .Values.extraContainers . | indent 6 }}
{{- else }}
{{ toYaml .Values.extraContainers | indent 6 }}
{{- end }}
{{- end }}

719
helm-charts-observability/charts/opensearch/values.yaml Normal file
View File

@@ -0,0 +1,719 @@
---
clusterName: "brilliant-opensearch-cluster"
nodeGroup: "master"
# If discovery.type in the opensearch configuration is set to "single-node",
# this should be set to "true"
# If "true", replicas will be forced to 1
singleNode: false
# The service that non master groups will try to connect to when joining the cluster
# This should be set to clusterName + "-" + nodeGroup for your master group
masterService: "brilliant-opensearch-cluster-master"
# OpenSearch roles that will be applied to this nodeGroup
# These will be set as environment variable "node.roles". E.g. node.roles=master,ingest,data,remote_cluster_client
roles:
- master
- ingest
- data
- remote_cluster_client
replicas: 3
# if not set, falls back to parsing .Values.imageTag, then .Chart.appVersion.
majorVersion: ""
global:
# Set if you want to change the default docker registry, e.g. a private one.
dockerRegistry: ""
# Allows you to add any config files in {{ .Values.opensearchHome }}/config
opensearchHome: /usr/share/opensearch
# such as opensearch.yml and log4j2.properties
config:
# Values must be YAML literal style scalar / YAML multiline string.
# <filename>: |
# <formatted-value(s)>
# log4j2.properties: |
# status = error
#
# appender.console.type = Console
# appender.console.name = console
# appender.console.layout.type = PatternLayout
# appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n
#
# rootLogger.level = info
# rootLogger.appenderRef.console.ref = console
opensearch.yml: |
cluster.name: brilliant-opensearch-cluster
# Bind to all interfaces because we don't know what IP address Docker will assign to us.
network.host: 0.0.0.0
# Setting network.host to a non-loopback address enables the annoying bootstrap checks. "Single-node" mode disables them again.
# Implicitly done if ".singleNode" is set to "true".
# discovery.type: single-node
# Start OpenSearch Security Demo Configuration
# WARNING: revise all the lines below before you go into production
plugins:
query:
datasources:
encryption:
masterkey: "8e74f8c437a820d8e2c99f11"
security:
nodes_dn:
- "CN=opensearch-master-0,OU=OpenSearch Nodes,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD"
- "CN=opensearch-master-1,OU=OpenSearch Nodes,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD"
- "CN=opensearch-master-2,OU=OpenSearch Nodes,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD"
ssl:
transport:
pemcert_filepath: certs/node.pem
pemkey_filepath: certs/node-key.pem
pemtrustedcas_filepath: certs/root-ca.pem
enforce_hostname_verification: false
resolve_hostname: true
http:
enabled: true
pemcert_filepath: certs/node.pem
pemkey_filepath: certs/node-key.pem
pemtrustedcas_filepath: certs/root-ca.pem
allow_unsafe_democertificates: false
allow_default_init_securityindex: true
authcz:
admin_dn:
- CN=opensearch-admin,OU=OpenSearch Administrators,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD
audit.type: internal_opensearch
enable_snapshot_restore_privilege: true
check_snapshot_restore_write_privileges: true
restapi:
roles_enabled: ["all_access", "security_rest_api_access"]
system_indices:
enabled: true
indices:
[
".opendistro-alerting-config",
".opendistro-alerting-alert*",
".opendistro-anomaly-results*",
".opendistro-anomaly-detector*",
".opendistro-anomaly-checkpoints",
".opendistro-anomaly-detection-state",
".opendistro-reports-*",
".opendistro-notifications-*",
".opendistro-notebooks",
".opendistro-asynchronous-search-response*",
]
######## End OpenSearch Security Demo Configuration ########
# log4j2.properties:
# Extra environment variables to append to this nodeGroup
# This will be appended to the current 'env:' key. You can use any of the kubernetes env
# syntax here
extraEnvs: []
# - name: MY_ENVIRONMENT_VAR
# value: the_value_goes_here
# Chart version 2.18.0 and App Version OpenSearch 2.12.0 onwards a custom strong password needs to be provided in order to setup demo admin user.
# Cluster will not spin-up without this unless demo config install is disabled.
# - name: OPENSEARCH_INITIAL_ADMIN_PASSWORD
# value: <strong-password>
# Allows you to load environment variables from kubernetes secret or config map
envFrom:
- secretRef:
name: opensearch-secret # this the the admin password
# - configMapRef:
# name: config-map
# A list of secrets and their paths to mount inside the pod
# This is useful for mounting certificates for security and for mounting
# the X-Pack license
secretMounts: []
hostAliases: []
# - ip: "127.0.0.1"
# hostnames:
# - "foo.local"
# - "bar.local"
image:
repository: "opensearchproject/opensearch"
# override image tag, which is .Chart.AppVersion by default
tag: ""
pullPolicy: "IfNotPresent"
podAnnotations: {}
# iam.amazonaws.com/role: es-cluster
# OpenSearch Statefulset annotations
openSearchAnnotations: {}
# additionals labels
labels: {}
opensearchJavaOpts: "-Xmx3G -Xms3G"
resources:
requests:
cpu: "2"
memory: "6Gi"
limits:
cpu: "4"
memory: "8Gi"
initResources: {}
# limits:
# cpu: "25m"
# memory: "128Mi"
# requests:
# cpu: "25m"
# memory: "128Mi"
sidecarResources: {}
# limits:
# cpu: "25m"
# memory: "128Mi"
# requests:
# cpu: "25m"
# memory: "128Mi"
networkHost: "0.0.0.0"
rbac:
create: false
serviceAccountAnnotations: {}
serviceAccountName: ""
# Controls whether or not the Service Account token is automatically mounted to /var/run/secrets/kubernetes.io/serviceaccount
automountServiceAccountToken: false
podSecurityPolicy:
create: false
name: ""
spec:
privileged: true
fsGroup:
rule: RunAsAny
runAsUser:
rule: RunAsAny
seLinux:
rule: RunAsAny
supplementalGroups:
rule: RunAsAny
volumes:
- secret
- configMap
- persistentVolumeClaim
- emptyDir
persistence:
enabled: true
# Set to false to disable the `fsgroup-volume` initContainer that will update permissions on the persistent disk.
enableInitChown: true
# override image, which is busybox by default
# image: busybox
# override image tag, which is latest by default
# imageTag:
labels:
# Add default labels for the volumeClaimTemplate of the StatefulSet
enabled: false
# Add custom labels for the volumeClaimTemplate of the StatefulSet
additionalLabels: {}
# OpenSearch Persistent Volume Storage Class
# If defined, storageClassName: <storageClass>
# If set to "-", storageClassName: "", which disables dynamic provisioning
# If undefined (the default) or set to null, no storageClassName spec is
# set, choosing the default provisioner. (gp2 on AWS, standard on
# GKE, AWS & OpenStack)
#
storageClass: "longhorn"
accessModes:
- ReadWriteOnce
size: 120Gi
annotations: {}
extraVolumes:
# - name: extras
# emptyDir: {}
- name: admin-certs
secret:
secretName: opensearch-admin-cert
defaultMode: 0400
- name: custom-internal-users
secret:
secretName: opensearch-internal-users
defaultMode: 0440
- name: node-0-source
secret:
secretName: opensearch-node-0-cert
defaultMode: 0440
- name: node-1-source
secret:
secretName: opensearch-node-1-cert
defaultMode: 0440
- name: node-2-source
secret:
secretName: opensearch-node-2-cert
defaultMode: 0440
- name: runtime-certs
emptyDir: {}
extraVolumeMounts:
# - name: extras
# mountPath: /usr/share/extras
# readOnly: true
- name: runtime-certs
mountPath: /usr/share/opensearch/config/certs
readOnly: true
- name: admin-certs
mountPath: /usr/share/opensearch/config/admin-certs
readOnly: true
- name: custom-internal-users
readOnly: true
mountPath: /usr/share/opensearch/config/custom-security
extraContainers: []
# - name: do-something
# image: busybox
# command: ['do', 'something']
# extraInitContainers: []
# - name: do-somethings
# image: busybox
# command: ['do', 'something']
extraInitContainers:
- name: select-node-certificate
image: "busybox:1.36.1"
imagePullPolicy: IfNotPresent
securityContext:
runAsNonRoot: true
runAsUser: 1000
runAsGroup: 1000
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
drop:
- ALL
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
command:
- /bin/sh
- -ec
- |
ordinal="${POD_NAME##*-}"
case "${ordinal}" in
0|1|2)
;;
*)
echo "ERROR: unsupported pod name: ${POD_NAME}"
exit 1
;;
esac
source_dir="/source/node-${ordinal}"
cert="${source_dir}/node-${ordinal}.pem"
key="${source_dir}/node-${ordinal}-key.pem"
ca="${source_dir}/root-ca.pem"
test -r "${cert}" || {
echo "ERROR: certificate not readable: ${cert}"
exit 1
}
test -r "${key}" || {
echo "ERROR: private key not readable: ${key}"
exit 1
}
test -r "${ca}" || {
echo "ERROR: root CA not readable: ${ca}"
exit 1
}
cp "${cert}" /runtime/node.pem
cp "${key}" /runtime/node-key.pem
cp "${ca}" /runtime/root-ca.pem
chmod 0644 /runtime/node.pem
chmod 0600 /runtime/node-key.pem
chmod 0644 /runtime/root-ca.pem
echo "Selected node-${ordinal} certificate for ${POD_NAME}"
ls -l /runtime
volumeMounts:
- name: node-0-source
mountPath: /source/node-0
readOnly: true
- name: node-1-source
mountPath: /source/node-1
readOnly: true
- name: node-2-source
mountPath: /source/node-2
readOnly: true
- name: runtime-certs
mountPath: /runtime
# This is the PriorityClass settings as defined in
# https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
priorityClassName: ""
# By default this will make sure two pods don't end up on the same node
# Changing this to a region would allow you to spread pods across regions
antiAffinityTopologyKey: "kubernetes.io/hostname"
# Hard means that by default pods will only be scheduled if there are enough nodes for them
# and that they will never end up on the same node. Setting this to soft will do this "best effort".
# Setting this to custom will use what is passed into customAntiAffinity.
antiAffinity: "hard"
# Allows passing in custom anti-affinity settings as defined in
# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity
# Using this parameter requires setting antiAffinity to custom.
customAntiAffinity: {}
# This is the node affinity settings as defined in
# https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#node-affinity-beta-feature
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/hostname
operator: NotIn
values:
- k8s-cp-01
# This is the pod affinity settings as defined in
# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity
podAffinity: {}
# This is the pod topology spread constraints
# https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
topologySpreadConstraints: []
# The default is to deploy all pods serially. By setting this to parallel all pods are started at
# the same time when bootstrapping the cluster
podManagementPolicy: "Parallel"
# The environment variables injected by service links are not used, but can lead to slow OpenSearch boot times when
# there are many services in the current namespace.
# If you experience slow pod startups you probably want to set this to `false`.
enableServiceLinks: true
protocol: https
httpPort: 9200
transportPort: 9300
metricsPort: 9600
httpHostPort: ""
transportHostPort: ""
service:
labels: {}
labelsHeadless: {}
headless:
annotations: {}
type: ClusterIP
# The IP family and IP families options are to set the behaviour in a dual-stack environment
# Omitting these values will let the service fall back to whatever the CNI dictates the defaults
# should be
#
# ipFamilyPolicy: SingleStack
# ipFamilies:
# - IPv4
nodePort: ""
annotations: {}
httpPortName: http
transportPortName: transport
metricsPortName: metrics
loadBalancerIP: ""
loadBalancerSourceRanges: []
externalTrafficPolicy: ""
updateStrategy: RollingUpdate
# This is the max unavailable setting for the pod disruption budget
# The default value of 1 will make sure that kubernetes won't allow more than 1
# of your pods to be unavailable during maintenance
maxUnavailable: 1
podSecurityContext:
fsGroup: 1000
runAsUser: 1000
securityContext:
capabilities:
drop:
- ALL
# readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
securityConfig:
enabled: true
path: "/usr/share/opensearch/config/opensearch-security"
actionGroupsSecret:
configSecret:
internalUsersSecret:
rolesSecret:
rolesMappingSecret:
tenantsSecret:
# The following option simplifies securityConfig by using a single secret and
# specifying the config files as keys in the secret instead of creating
# different secrets for for each config file.
# Note that this is an alternative to the individual secret configuration
# above and shouldn't be used if the above secrets are used.
config:
# There are multiple ways to define the configuration here:
# * If you define anything under data, the chart will automatically create
# a secret and mount it. This is best option to choose if you want to override all the
# existing yml files at once.
# * If you define securityConfigSecret, the chart will assume this secret is
# created externally and mount it. This is best option to choose if your intention is to
# only update a single yml file.
# * It is an error to define both data and securityConfigSecret.
securityConfigSecret: ""
dataComplete: true
data: {}
# config.yml: |-
# internal_users.yml: |-
# roles.yml: |-
# roles_mapping.yml: |-
# action_groups.yml: |-
# tenants.yml: |-
# How long to wait for opensearch to stop gracefully
terminationGracePeriod: 120
sysctlVmMaxMapCount: 262144
startupProbe:
tcpSocket:
port: 9200
initialDelaySeconds: 5
periodSeconds: 10
timeoutSeconds: 3
failureThreshold: 30
livenessProbe: {}
# periodSeconds: 20
# timeoutSeconds: 5
# failureThreshold: 10
# successThreshold: 1
# initialDelaySeconds: 10
# tcpSocket:
# port: 9200
readinessProbe:
tcpSocket:
port: 9200
periodSeconds: 5
timeoutSeconds: 3
failureThreshold: 3
## Use an alternate scheduler.
## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
##
schedulerName: ""
imagePullSecrets: []
nodeSelector: {}
tolerations:
- key: "dedicated"
operator: "Equal"
value: "storage"
effect: "NoSchedule"
# Enabling this will publically expose your OpenSearch instance.
# Only enable this if you have security enabled on your cluster
ingress:
enabled: false
# For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName
# See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress
# ingressClassName: nginx
annotations:
kubernetes.io/ingress.class: nginx
kubernetes.io/tls-acme: "true"
ingressLabels: {}
path: /
hosts: []
# - 118.67.213.76
tls: []
# - secretName: chart-example-tls
# hosts:
# - chart-example.local
nameOverride: ""
fullnameOverride: ""
masterTerminationFix: false
opensearchLifecycle: {}
# preStop:
# exec:
# command: ["/bin/sh", "-c", "echo Hello from the preStart handler > /usr/share/message"]
# postStart:
# exec:
# command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"]
lifecycle: {}
# preStop:
# exec:
# command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"]
# postStart:
# exec:
# command:
# - bash
# - -c
# - |
# #!/bin/bash
# # Add a template to adjust number of shards/replicas1
# TEMPLATE_NAME=my_template
# INDEX_PATTERN="logstash-*"
# SHARD_COUNT=8
# REPLICA_COUNT=1
# ES_URL=http://localhost:9200
# while [[ "$(curl -s -o /dev/null -w '%{http_code}\n' $ES_URL)" != "200" ]]; do sleep 1; done
# curl -XPUT "$ES_URL/_template/$TEMPLATE_NAME" -H 'Content-Type: application/json' -d'{"index_patterns":['\""$INDEX_PATTERN"\"'],"settings":{"number_of_shards":'$SHARD_COUNT',"number_of_replicas":'$REPLICA_COUNT'}}'
keystore: []
# To add secrets to the keystore:
# - secretName: opensearch-encryption-key
networkPolicy:
create: false
## Enable creation of NetworkPolicy resources. Only Ingress traffic is filtered for now.
## In order for a Pod to access OpenSearch, it needs to have the following label:
## {{ template "uname" . }}-client: "true"
## Example for default configuration to access HTTP port:
## opensearch-master-http-client: "true"
## Example for default configuration to access transport port:
## opensearch-master-transport-client: "true"
http:
enabled: false
# Deprecated
# please use the above podSecurityContext.fsGroup instead
fsGroup: ""
## Set optimal sysctl's through securityContext. This requires privilege. Can be disabled if
## the system has already been preconfigured. (Ex: https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html)
## Also see: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/
sysctl:
enabled: false
## Set optimal sysctl's through privileged initContainer.
sysctlInit:
enabled: true
# override image, which is busybox by default
# image: busybox
# override image tag, which is latest by default
# imageTag:
## Enable to add 3rd Party / Custom plugins not offered in the default OpenSearch image.
plugins:
enabled: false
installList: []
# - example-fake-plugin
removeList: []
# - example-fake-plugin
# -- Array of extra K8s manifests to deploy
extraObjects: []
# - apiVersion: secrets-store.csi.x-k8s.io/v1
# kind: SecretProviderClass
# metadata:
# name: argocd-secrets-store
# spec:
# provider: aws
# parameters:
# objects: |
# - objectName: "argocd"
# objectType: "secretsmanager"
# jmesPath:
# - path: "client_id"
# objectAlias: "client_id"
# - path: "client_secret"
# objectAlias: "client_secret"
# secretObjects:
# - data:
# - key: client_id
# objectName: client_id
# - key: client_secret
# objectName: client_secret
# secretName: argocd-secrets-store
# type: Opaque
# labels:
# app.kubernetes.io/part-of: argocd
# - |
# apiVersion: policy/v1
# kind: PodDisruptionBudget
# metadata:
# name: {{ template "opensearch.uname" . }}
# labels:
# {{- include "opensearch.labels" . | nindent 4 }}
# spec:
# minAvailable: 1
# selector:
# matchLabels:
# {{- include "opensearch.selectorLabels" . | nindent 6 }}
# ServiceMonitor Configuration for Prometheus
# Enabling this option will create a ServiceMonitor resource that allows Prometheus to scrape metrics from the OpenSearch service.
# This only creates the serviceMonitor, to actually have metrics Make sure to install the prometheus-exporter plugin needed for
# serving metrics over the `.Values.plugins` value:
# plugins:
# enabled: true
# installList:
# - https://github.com/aiven/prometheus-exporter-plugin-for-opensearch/releases/download/x.x.x.x/prometheus-exporter-x.x.x.x.zip
serviceMonitor:
# Set to true to enable the ServiceMonitor resource
enabled: false
# HTTP path where metrics are exposed.
# Ensure this matches your OpenSearch service configuration.
path: /_prometheus/metrics
# Scheme to use for scraping.
scheme: http
# Frequency at which Prometheus will scrape metrics.
# Adjust based on your needs.
interval: 10s
# additional labels to be added to the ServiceMonitor
# labels:
# k8s.example.com/prometheus: kube-prometheus
labels: {}
# additional tlsConfig to be added to the ServiceMonitor
tlsConfig: {}
# Basic Auth configuration for the service monitor
# You can either use existingSecret, which expects a secret to be already present with data.username and data.password
# or set the credentials over the helm values, making helm create a secret for you
# basicAuth:
# enaled: true
# existingSecret: my-secret
# username: my-username
# password: my-password
basicAuth:
enabled: false