Convert helm-charts-observability to regular directory
This commit is contained in:
Mosiur Rahman
23
helm-charts-observability/charts/opensearch/.helmignore
Normal file
23
helm-charts-observability/charts/opensearch/.helmignore
Normal file
@@ -0,0 +1,23 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
127
helm-charts-observability/charts/opensearch/CHANGELOG.md
Normal file
127
helm-charts-observability/charts/opensearch/CHANGELOG.md
Normal file
@@ -0,0 +1,127 @@
|
||||
# Changelog
|
||||
|
||||
All notable changes to this project will be documented in this file.
|
||||
|
||||
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
||||
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
||||
|
||||
---
|
||||
## [Unreleased]
|
||||
### Added
|
||||
### Changed
|
||||
### Deprecated
|
||||
### Removed
|
||||
### Fixed
|
||||
### Security
|
||||
---
|
||||
## [3.7.0]
|
||||
### Added
|
||||
- Updated OpenSearch appVersion to 3.7.0
|
||||
### Changed
|
||||
### Deprecated
|
||||
### Removed
|
||||
### Fixed
|
||||
### Security
|
||||
---
|
||||
## [3.6.0]
|
||||
### Added
|
||||
- Updated OpenSearch appVersion to 3.6.0
|
||||
### Changed
|
||||
### Deprecated
|
||||
### Removed
|
||||
### Fixed
|
||||
### Security
|
||||
---
|
||||
## [3.5.0]
|
||||
### Added
|
||||
- Updated OpenSearch appVersion to 3.5.0
|
||||
### Changed
|
||||
### Deprecated
|
||||
### Removed
|
||||
### Fixed
|
||||
### Security
|
||||
---
|
||||
## [3.4.0]
|
||||
### Added
|
||||
- Updated OpenSearch appVersion to 3.4.0
|
||||
### Changed
|
||||
### Deprecated
|
||||
### Removed
|
||||
### Fixed
|
||||
### Security
|
||||
---
|
||||
## [3.3.2]
|
||||
### Added
|
||||
- Updated OpenSearch appVersion to 3.3.2
|
||||
### Changed
|
||||
### Deprecated
|
||||
### Removed
|
||||
### Fixed
|
||||
### Security
|
||||
---
|
||||
## [3.3.1]
|
||||
### Added
|
||||
- Updated OpenSearch appVersion to 3.3.1
|
||||
### Changed
|
||||
### Deprecated
|
||||
### Removed
|
||||
### Fixed
|
||||
### Security
|
||||
---
|
||||
## [3.3.0]
|
||||
### Added
|
||||
- Updated OpenSearch appVersion to 3.3.0
|
||||
### Changed
|
||||
### Deprecated
|
||||
### Removed
|
||||
### Fixed
|
||||
### Security
|
||||
---
|
||||
## [3.2.1]
|
||||
### Added
|
||||
### Changed
|
||||
### Deprecated
|
||||
### Removed
|
||||
### Fixed
|
||||
- Added missing security context to configfile and keystore init containers to support restricted Kubernetes environments
|
||||
### Security
|
||||
---
|
||||
## [3.2.0]
|
||||
### Added
|
||||
- Updated OpenSearch appVersion to 3.2.0
|
||||
### Changed
|
||||
### Deprecated
|
||||
### Removed
|
||||
### Fixed
|
||||
### Security
|
||||
---
|
||||
## [3.1.0]
|
||||
### Added
|
||||
- Updated OpenSearch appVersion to 3.1.0
|
||||
### Changed
|
||||
### Deprecated
|
||||
### Removed
|
||||
### Fixed
|
||||
### Security
|
||||
---
|
||||
## [3.0.0]
|
||||
### Added
|
||||
### Changed
|
||||
- Switch main branch to be 3.x with 3.0.0 as 1st release
|
||||
### Deprecated
|
||||
### Removed
|
||||
### Fixed
|
||||
### Security
|
||||
|
||||
[Unreleased]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.7.0...HEAD
|
||||
[3.7.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.6.0...opensearch-3.7.0
|
||||
[3.6.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.5.0...opensearch-3.6.0
|
||||
[3.5.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.4.0...opensearch-3.5.0
|
||||
[3.4.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.3.2...opensearch-3.4.0
|
||||
[3.3.2]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.3.1...opensearch-3.3.2
|
||||
[3.3.1]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.3.0...opensearch-3.3.1
|
||||
[3.3.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.2.1...opensearch-3.3.0
|
||||
[3.2.1]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.2.0...opensearch-3.2.1
|
||||
[3.2.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.1.0...opensearch-3.2.0
|
||||
[3.1.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-3.0.0...opensearch-3.1.0
|
||||
[3.0.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-2.33.0...opensearch-3.0.0
|
||||
36
helm-charts-observability/charts/opensearch/Chart.yaml
Normal file
36
helm-charts-observability/charts/opensearch/Chart.yaml
Normal file
@@ -0,0 +1,36 @@
|
||||
apiVersion: v2
|
||||
name: opensearch
|
||||
description: A Helm chart for OpenSearch
|
||||
|
||||
# A chart can be either an 'application' or a 'library' chart.
|
||||
#
|
||||
# Application charts are a collection of templates that can be packaged into versioned archives
|
||||
# to be deployed.
|
||||
#
|
||||
# Library charts provide useful utilities or functions for the chart developer. They're included as
|
||||
# a dependency of application charts to inject those utilities and functions into the rendering
|
||||
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
|
||||
type: application
|
||||
|
||||
# This is the chart version. This version number should be incremented each time you make changes
|
||||
# to the chart and its templates, including the app version.
|
||||
# Versions are expected to follow Semantic Versioning (https://semver.org/)
|
||||
version: 3.7.0
|
||||
|
||||
# This is the version number of the application being deployed. This version number should be
|
||||
# incremented each time you make changes to the application. Versions are not expected to
|
||||
# follow Semantic Versioning. They should reflect the version the application is using.
|
||||
# It is recommended to use it with quotes.
|
||||
appVersion: "3.7.0"
|
||||
|
||||
maintainers:
|
||||
- name: DandyDeveloper
|
||||
- name: gaiksaya
|
||||
- name: peterzhuamazon
|
||||
- name: prudhvigodithi
|
||||
- name: TheAlgo
|
||||
|
||||
home: https://opensearch.org
|
||||
sources:
|
||||
- https://github.com/opensearch-project/opensearch
|
||||
- https://github.com/opensearch-project/helm-charts
|
||||
172
helm-charts-observability/charts/opensearch/README.md
Normal file
172
helm-charts-observability/charts/opensearch/README.md
Normal file
@@ -0,0 +1,172 @@
|
||||
# OpenSearch Helm Chart
|
||||
|
||||
This Helm chart installs [OpenSearch](https://github.com/opensearch-project/OpenSearch) with configurable TLS, RBAC and much more configurations. This chart caters a number of different use cases and setups.
|
||||
|
||||
- [OpenSearch Helm Chart](#opensearch-helm-chart)
|
||||
- [Requirements](#requirements)
|
||||
- [Installing](#installing)
|
||||
- [Uninstalling](#uninstalling)
|
||||
- [Configuration](#configuration)
|
||||
|
||||
## Requirements
|
||||
|
||||
- Kubernetes >= 1.14
|
||||
- Helm >= 2.17.0
|
||||
- We recommend you to have 8 GiB of memory available for this deployment, or at least 4 GiB for the minimum requirement. Else, the deployment is expected to fail.
|
||||
|
||||
## Installing
|
||||
|
||||
Once you've added this Helm repository as per the repository-level [README](../../README.md#installing) then you can install the chart as follows:
|
||||
|
||||
```shell
|
||||
helm install my-release opensearch/opensearch
|
||||
```
|
||||
|
||||
The command deploys OpenSearch with its associated components (data statefulsets, masters, clients) on the Kubernetes cluster in the default configuration.
|
||||
|
||||
**NOTE:** If using Helm 2 then you'll need to add the [`--name`](https://v2.helm.sh/docs/helm/#options-21) command line argument. If unspecified, Helm 2 will autogenerate a name for you.
|
||||
|
||||
## Uninstalling
|
||||
|
||||
To delete/uninstall the chart with the release name `my-release`:
|
||||
|
||||
```shell
|
||||
helm uninstall my-release
|
||||
```
|
||||
|
||||
## Configuration
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| :---------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :-------------------------------------------------------------------------------------------------------------- |
|
||||
| `antiAffinityTopologyKey` | The [anti-affinity][] topology key. By default this will prevent multiple Opensearch nodes from running on the same Kubernetes node | `kubernetes.io/hostname` |
|
||||
| `antiAffinity` | Setting this to `hard` enforces the [anti-affinity][] rules. If it is set to `soft` it will be done "best effort". Setting it to `custom` will use whatever is set in the `customAntiAffinity` parameter. Other values will be ignored. | `hard` |
|
||||
| `clusterName` | This will be used as the OpenSearch cluster name and should be unique per cluster in the namespace | `opensearch-cluster` |
|
||||
| `customAntiAffinity` | Allows passing in custom anti-affinity settings as defined in the [anti-affinity][] rules. Using this parameter requires setting the `antiAffinity` parameter to `custom`. | `{}` |
|
||||
| `enableServiceLinks` | Set to false to disabling service links, which can cause slow pod startup times when there are many services in the current namespace. | `true` |
|
||||
| `envFrom` | Templatable string to be passed to the [environment from variables][] which will be appended to the `envFrom:` definition for the container | `[]` |
|
||||
| `config` | Allows you to add any config files in `/usr/share/opensearch/config/` such as `opensearch.yml` and `log4j2.properties`. String or map format may be used for specifying content of each configuration file. In case of string format, the whole content of the config file will be replaced by new config file value when in case of using map format content of configuration file will be a result of merge. In both cases content passed through tpl. See [values.yaml][] for an example of the formatting (passed through tpl) | `{}` |
|
||||
| `opensearchJavaOpts` | Java options for OpenSearch. This is where you should configure the jvm heap size | `-Xmx512M -Xms512M` |
|
||||
| `majorVersion` | Used to set major version specific configuration. If you are using a custom image and not running the default OpenSearch version you will need to set this to the version you are running (e.g. `majorVersion: 1`) | `""` |
|
||||
| `global.dockerRegistry` | Set if you want to change the default docker registry, e.g. a private one. | `""` |
|
||||
| `extraContainers` | Array of extra containers | `""` |
|
||||
| `extraEnvs` | Extra environments variables to be passed to OpenSearch services | `[]` |
|
||||
| `extraInitContainers` | Array of extra init containers | `[]` |
|
||||
| `extraVolumeMounts` | Array of extra volume mounts | `[]` |
|
||||
| `extraVolumes` | Array of extra volumes to be added | `[]` |
|
||||
| `fullnameOverride` | Overrides the `clusterName` and `nodeGroup` when used in the naming of resources. This should only be used when using a single `nodeGroup`, otherwise you will have name conflicts | `""` |
|
||||
| `hostAliases` | Configurable [hostAliases][] | `[]` |
|
||||
| `httpHostPort` | Expose another http-port as hostPort. Refer to documentation for more information and requirements about using hostPorts. | `""` |
|
||||
| `httpPort` | The http port that Kubernetes will use for the healthchecks and the service. If you change this you will also need to set `http.port` in `extraEnvs` | `9200` |
|
||||
| `image.pullPolicy` | The Kubernetes [imagePullPolicy][] value | `IfNotPresent` |
|
||||
| `imagePullSecrets` | Configuration for [imagePullSecrets][] so that you can use a private registry for your image | `[]` |
|
||||
| `image.tag` | The OpenSearch Docker image tag | `1.0.0` |
|
||||
| `image.repository` | The OpenSearch Docker image | `opensearchproject/opensearch` |
|
||||
| `ingress` | Configurable [ingress][] to expose the OpenSearch service. See [values.yaml][] for an example | see [values.yaml][] |
|
||||
| `initResources` | Allows you to set the [resources][] for the `initContainer` in the StatefulSet | `{}` |
|
||||
| `keystore` | Allows you map Kubernetes secrets into the keystore. | `[]` |
|
||||
| `labels` | Configurable [labels][] applied to all OpenSearch pods | `{}` |
|
||||
| `masterService` | The service name used to connect to the masters. You only need to set this if your master `nodeGroup` is set to something other than `master` | `""` |
|
||||
| `maxUnavailable` | The [maxUnavailable][] value for the pod disruption budget. By default this will prevent Kubernetes from having more than 1 unhealthy pod in the node group | `1` |
|
||||
| `metricsPort` | The metrics port (for Performance Analyzer) that Kubernetes will use for the service. | `9600` |
|
||||
| `nameOverride` | Overrides the `clusterName` when used in the naming of resources | `""` |
|
||||
| `networkHost` | Value for the `network.host OpenSearch setting` | `0.0.0.0` |
|
||||
| `networkPolicy.create` | Enable network policy creation for OpenSearch | `false` |
|
||||
| `nodeAffinity` | Value for the [node affinity settings][] | `{}` |
|
||||
| `nodeGroup` | This is the name that will be used for each group of nodes in the cluster. The name will be `clusterName-nodeGroup-X` , `nameOverride-nodeGroup-X` if a `nameOverride` is specified, and `fullnameOverride-X` if a `fullnameOverride` is specified | `master` |
|
||||
| `nodeSelector` | Configurable [nodeSelector][] so that you can target specific nodes for your OpenSearch cluster | `{}` |
|
||||
| `persistence` | Enables a persistent volume for OpenSearch data. | see [values.yaml][] |
|
||||
| `persistence.enableInitChown` | Disable the `fsgroup-volume` initContainer that will update permissions on the persistent disk. | `true` |
|
||||
| `podAffinity` | Value for the [pod affinity settings][] | `{}` |
|
||||
| `podAnnotations` | Configurable [annotations][] applied to all OpenSearch pods | `{}` |
|
||||
| `podManagementPolicy` | By default Kubernetes [deploys StatefulSets serially][]. This deploys them in parallel so that they can discover each other | `Parallel` |
|
||||
| `podSecurityContext` | Allows you to set the [securityContext][] for the pod | see [values.yaml][] |
|
||||
| `podSecurityPolicy` | Configuration for create a pod security policy with minimal permissions to run this Helm chart with `create: true`. Also can be used to reference an external pod security policy with `name: "externalPodSecurityPolicy"` | see [values.yaml][] |
|
||||
| `priorityClassName` | The name of the [PriorityClass][]. No default is supplied as the PriorityClass must be created first | `""` |
|
||||
| `rbac` | Configuration for creating a role, role binding and ServiceAccount as part of this Helm chart with `create: true`. Also can be used to reference an external ServiceAccount with `serviceAccountName: "externalServiceAccountName"` | see [values.yaml][] |
|
||||
| `rbac.automountServiceAccountToken` | Controls whether a service account token should be automatically mounted to the Pods. | `true` |
|
||||
| `replicas` | Kubernetes replica count for the StatefulSet (i.e. how many pods) | `3` |
|
||||
| `resources` | Allows you to set the [resources][] for the StatefulSet | see [values.yaml][] |
|
||||
| `roles` | A list of the specific node [roles][] for the `nodeGroup` | see [values.yaml][] |
|
||||
| `singleNode` | If `discovery.type` in the opensearch configuration is set to `"single-node"`, this should be set to `true`. If `true`, replicas will be forced to `1`. | `false` |
|
||||
| `schedulerName` | Name of the [alternate scheduler][] | `""` |
|
||||
| `secretMounts` | Allows you easily mount a secret as a file inside the StatefulSet. Useful for mounting certificates and other secrets. See [values.yaml][] for an example | `[]` |
|
||||
| `securityConfig` | Configure the opensearch security plugin. There are multiple ways to inject configuration into the chart, see [values.yaml][] details. | By default an insecure demonstration configuration is set. This **must** be changed before going to production. |
|
||||
| `securityContext` | Allows you to set the [securityContext][] for the container | see [values.yaml][] |
|
||||
| `service.annotations` | [LoadBalancer annotations][] that Kubernetes will use for the service. This will configure load balancer if `service.type` is `LoadBalancer` | `{}` |
|
||||
| `service.headless.annotations` | Allow you to set annotations on the headless service | `{}` |
|
||||
| `service.externalTrafficPolicy` | Some cloud providers allow you to specify the [LoadBalancer externalTrafficPolicy][]. Kubernetes will use this to preserve the client source IP. This will configure load balancer if `service.type` is `LoadBalancer` | `""` |
|
||||
| `service.httpPortName` | The name of the http port within the service | `http` |
|
||||
| `service.labelsHeadless` | Labels to be added to headless service | `{}` |
|
||||
| `service.labels` | Labels to be added to non-headless service | `{}` |
|
||||
| `service.loadBalancerIP` | Some cloud providers allow you to specify the [loadBalancer][] IP. If the `loadBalancerIP` field is not specified, the IP is dynamically assigned. If you specify a `loadBalancerIP` but your cloud provider does not support the feature, it is ignored. | `""` |
|
||||
| `service.loadBalancerSourceRanges` | The IP ranges that are allowed to access | `[]` |
|
||||
| `service.metricsPortName` | The name of the metrics port (for Performance Analyzer) within the service | `metrics` |
|
||||
| `service.nodePort` | Custom [nodePort][] port that can be set if you are using `service.type: nodePort` | `""` |
|
||||
| `service.transportPortName` | The name of the transport port within the service | `transport` |
|
||||
| `service.type` | OpenSearch [Service Types][] | `ClusterIP` |
|
||||
| `service.ipFamilyPolicy` | This sets the preferred ip addresses in case of a dual-stack server, there are three options [PreferDualStack, SingleStack, RequireDualStack], [more information on dual stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/) | `""` |
|
||||
| `service.ipFamilies` | Sets the preferred IP variants and in which order they are preferred, the first family you list is used for the legacy .spec.ClusterIP field, [more information on dual stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/) | `""` |
|
||||
| `sidecarResources` | Allows you to set the [resources][] for the sidecar containers in the StatefulSet | {} |
|
||||
| `sysctlInit` | Allows you to enable the `sysctlInit` to set sysctl vm.max_map_count through privileged `initContainer`. | `enabled: false` |
|
||||
| `sysctlVmMaxMapCount` | Sets the [vm.max_map_count][] needed for OpenSearch | `262144` |
|
||||
| `terminationGracePeriod` | The [terminationGracePeriod][] in seconds used when trying to stop the pod | `120` |
|
||||
| `tolerations` | Configurable [tolerations][] | `[]` |
|
||||
| `topologySpreadConstraints` | Configuration for pod [topologySpreadConstraints][] | `[]` |
|
||||
| `transportHostPort` | Expose another transport port as hostPort. Refer to documentation for more information and requirements about using hostPorts. | `""` |
|
||||
| `transportPort` | The transport port that Kubernetes will use for the service. If you change this you will also need to set transport port configuration in `extraEnvs` | `9300` |
|
||||
| `updateStrategy` | The [updateStrategy][] for the StatefulSet. By default Kubernetes will wait for the cluster to be green after upgrading each pod. Setting this to `OnDelete` will allow you to manually delete each pod during upgrades | `RollingUpdate` |
|
||||
| `volumeClaimTemplate` | Configuration for the [volumeClaimTemplate for StatefulSets][]. You will want to adjust the storage (default `30Gi` ) and the `storageClassName` if you are using a different storage class | see [values.yaml][] |
|
||||
| `extraObjects` | Array of extra K8s manifests to deploy | list `[]` |
|
||||
| `livenessProbe` | Configuration fields for the liveness [probe][] | see [exampleLiveness][] in `values.yaml` |
|
||||
| `readinessProbe` | Configuration fields for the readiness [probe][] | see [exampleReadiness][] in `values.yaml` |
|
||||
| `startupProbe` | Configuration fields for the startup [probe][] | see [exampleStartup][] in `values.yaml` |
|
||||
| `plugins.enabled` | Allow/disallow to add 3rd Party / Custom plugins not offered in the default OpenSearchDashboards image | false |
|
||||
| `plugins.installList` | Array containing the Opensearch Dashboards plugins to be installed in container | \[] |
|
||||
| `opensearchLifecycle` | Allows you to configure lifecycle hooks for the OpenSearch container in the StatefulSet | {} |
|
||||
| `lifecycle` | Allows you to configure lifecycle hooks for the OpenSearch container in the StatefulSet | {} |
|
||||
| `openSearchAnnotations` | Allows you to configure custom annotation in the StatefullSet of the OpenSearch container | {} |
|
||||
| `serviceMonitor.enabled` | Enables the creation of a [ServiceMonitor] resource for Prometheus monitoring. Requires the Prometheus Operator to be installed in your Kubernetes cluster. | `false` |
|
||||
| `serviceMonitor.path` | Path where metrics are exposed. Applicable only if `serviceMonitor.enabled` is set to `true`. | `/_prometheus/metrics` |
|
||||
| `serviceMonitor.interval` | Interval at which metrics should be scraped by Prometheus. Applicable only if `serviceMonitor.enabled` is set to `true`. | `10s` |
|
||||
| `serviceMonitor.basicAuth.enabled` | Wheter or not the serviceMonitor should use basic auth | `false` |
|
||||
| `serviceMonitor.basicAuth.existingSecret` | When using basicAuth for the serviceMonitor, use an existing secret | `""` |
|
||||
| `serviceMonitor.basicAuth.username` | Username to be used for basic auth | `""` |
|
||||
| `serviceMonitor.basicAuth.password` | Password to be used for basic auth | `""` |
|
||||
| `serviceMonitor.scheme` | scheme to be used for scraping the metrics | `"http"` |
|
||||
| `serviceMonitor.tlsConfig` | optional tlsConfig to be used for scraping | `{}` |
|
||||
|
||||
[anti-affinity]: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
|
||||
[environment from variables]: https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/#configure-all-key-value-pairs-in-a-configmap-as-container-environment-variables
|
||||
[values.yaml]: https://github.com/opensearch-project/helm-charts/blob/main/charts/opensearch/values.yaml
|
||||
[hostAliases]: https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/
|
||||
[imagepullPolicy]: https://kubernetes.io/docs/concepts/containers/images/#updating-images
|
||||
[imagePullSecrets]: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
[ingress]: https://kubernetes.io/docs/concepts/services-networking/ingress/
|
||||
[resources]: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
|
||||
[labels]: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
|
||||
[maxUnavailable]: https://kubernetes.io/docs/tasks/run-application/configure-pdb/#specifying-a-poddisruptionbudget
|
||||
[node affinity settings]: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#node-affinity-beta-feature
|
||||
[pod affinity settings]: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity
|
||||
[nodeSelector]: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
|
||||
[annotations]: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
|
||||
[deploys statefulsets serially]: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies
|
||||
[securityContext]: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
|
||||
[priorityClass]: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
|
||||
[roles]: https://opensearch.org/docs/opensearch/cluster/
|
||||
[alternate scheduler]: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/#specify-schedulers-for-pods
|
||||
[loadBalancer annotations]: https://kubernetes.io/docs/concepts/services-networking/service/#ssl-support-on-aws
|
||||
[loadBalancer externalTrafficPolicy]: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
|
||||
[loadBalancer]: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer
|
||||
[nodePort]: https://kubernetes.io/docs/concepts/services-networking/service/#nodeport
|
||||
[vm.max_map_count]: https://opensearch.org/docs/opensearch/install/important-settings/
|
||||
[terminationGracePeriod]: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods
|
||||
[tolerations]: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
|
||||
[updateStrategy]: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/
|
||||
[volumeClaimTemplate for statefulsets]: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#stable-storage
|
||||
[service types]: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
|
||||
[topologySpreadConstraints]: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints
|
||||
[probe]: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-readiness-probes
|
||||
[exampleStartup]: https://github.com/opensearch-project/helm-charts/blob/main/charts/opensearch/values.yaml#332
|
||||
[exampleLiveness]: https://github.com/opensearch-project/helm-charts/blob/main/charts/opensearch/values.yaml#340
|
||||
[exampleReadiness]: https://github.com/opensearch-project/helm-charts/blob/main/charts/opensearch/values.yaml#349
|
||||
[ServiceMonitor]: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#servicemonitor
|
||||
@@ -0,0 +1,442 @@
|
||||
---
|
||||
clusterName: "opensearch-cluster"
|
||||
nodeGroup: "master"
|
||||
|
||||
# The service that non master groups will try to connect to when joining the cluster
|
||||
# This should be set to clusterName + "-" + nodeGroup for your master group
|
||||
masterService: "opensearch-cluster-master"
|
||||
|
||||
# OpenSearch roles that will be applied to this nodeGroup
|
||||
# These will be set as environment variable "node.roles". E.g. node.roles=master,ingest,data,remote_cluster_client
|
||||
roles:
|
||||
- master
|
||||
- ingest
|
||||
- data
|
||||
- remote_cluster_client
|
||||
|
||||
replicas: 1
|
||||
|
||||
# if not set, falls back to parsing .Values.imageTag, then .Chart.appVersion.
|
||||
majorVersion: ""
|
||||
|
||||
global:
|
||||
# Set if you want to change the default docker registry, e.g. a private one.
|
||||
dockerRegistry: ""
|
||||
|
||||
# Allows you to add any config files in {{ .Values.opensearchHome }}/config
|
||||
opensearchHome: /usr/share/opensearch
|
||||
# such as opensearch.yml and log4j2.properties
|
||||
config:
|
||||
# Values must be YAML literal style scalar / YAML multiline string.
|
||||
# <filename>: |
|
||||
# <formatted-value(s)>
|
||||
# log4j2.properties: |
|
||||
# status = error
|
||||
#
|
||||
# appender.console.type = Console
|
||||
# appender.console.name = console
|
||||
# appender.console.layout.type = PatternLayout
|
||||
# appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n
|
||||
#
|
||||
# rootLogger.level = info
|
||||
# rootLogger.appenderRef.console.ref = console
|
||||
opensearch.yml: |
|
||||
cluster.name: opensearch-cluster
|
||||
|
||||
# Bind to all interfaces because we don't know what IP address Docker will assign to us.
|
||||
network.host: 0.0.0.0
|
||||
transport.host: localhost
|
||||
transport.tcp.port: 9300
|
||||
|
||||
# Setting network.host to a non-loopback address enables the annoying bootstrap checks. "Single-node" mode disables them again.
|
||||
# discovery.type: single-node
|
||||
|
||||
# # Start OpenSearch Security Demo Configuration
|
||||
# # WARNING: revise all the lines below before you go into production
|
||||
# plugins:
|
||||
# security:
|
||||
# ssl:
|
||||
# transport:
|
||||
# pemcert_filepath: esnode.pem
|
||||
# pemkey_filepath: esnode-key.pem
|
||||
# pemtrustedcas_filepath: root-ca.pem
|
||||
# enforce_hostname_verification: false
|
||||
# http:
|
||||
# enabled: true
|
||||
# pemcert_filepath: esnode.pem
|
||||
# pemkey_filepath: esnode-key.pem
|
||||
# pemtrustedcas_filepath: root-ca.pem
|
||||
# allow_unsafe_democertificates: true
|
||||
# allow_default_init_securityindex: true
|
||||
# authcz:
|
||||
# admin_dn:
|
||||
# - CN=kirk,OU=client,O=client,L=test,C=de
|
||||
# audit.type: internal_opensearch
|
||||
# enable_snapshot_restore_privilege: true
|
||||
# check_snapshot_restore_write_privileges: true
|
||||
# restapi:
|
||||
# roles_enabled: ["all_access", "security_rest_api_access"]
|
||||
# system_indices:
|
||||
# enabled: true
|
||||
# indices:
|
||||
# [
|
||||
# ".opendistro-alerting-config",
|
||||
# ".opendistro-alerting-alert*",
|
||||
# ".opendistro-anomaly-results*",
|
||||
# ".opendistro-anomaly-detector*",
|
||||
# ".opendistro-anomaly-checkpoints",
|
||||
# ".opendistro-anomaly-detection-state",
|
||||
# ".opendistro-reports-*",
|
||||
# ".opendistro-notifications-*",
|
||||
# ".opendistro-notebooks",
|
||||
# ".opendistro-asynchronous-search-response*",
|
||||
# ]
|
||||
# ######## End OpenSearch Security Demo Configuration ########
|
||||
# log4j2.properties:
|
||||
|
||||
# Extra environment variables to append to this nodeGroup
|
||||
# This will be appended to the current 'env:' key. You can use any of the kubernetes env
|
||||
# syntax here
|
||||
extraEnvs:
|
||||
- name: OPENSEARCH_INITIAL_ADMIN_PASSWORD
|
||||
value: myStrongPassword123@456
|
||||
# - name: MY_ENVIRONMENT_VAR
|
||||
# value: the_value_goes_here
|
||||
|
||||
# Allows you to load environment variables from kubernextes secret or config map
|
||||
envFrom: []
|
||||
# - secretRef:
|
||||
# name: env-secret
|
||||
# - configMapRef:
|
||||
# name: config-map
|
||||
|
||||
# A list of secrets and their paths to mount inside the pod
|
||||
# This is useful for mounting certificates for security and for mounting
|
||||
# the X-Pack license
|
||||
secretMounts: []
|
||||
|
||||
hostAliases: []
|
||||
# - ip: "127.0.0.1"
|
||||
# hostnames:
|
||||
# - "foo.local"
|
||||
# - "bar.local"
|
||||
|
||||
image:
|
||||
repository: "opensearchproject/opensearch"
|
||||
# override image tag, which is .Chart.AppVersion by default
|
||||
tag: ""
|
||||
pullPolicy: "IfNotPresent"
|
||||
|
||||
podAnnotations: {}
|
||||
# iam.amazonaws.com/role: es-cluster
|
||||
|
||||
# additionals labels
|
||||
labels: {}
|
||||
|
||||
opensearchJavaOpts: "-Xmx512M -Xms512M"
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: "1000m"
|
||||
memory: "100Mi"
|
||||
|
||||
initResources: {}
|
||||
# limits:
|
||||
# cpu: "25m"
|
||||
# # memory: "128Mi"
|
||||
# requests:
|
||||
# cpu: "25m"
|
||||
# memory: "128Mi"
|
||||
|
||||
sidecarResources: {}
|
||||
# limits:
|
||||
# cpu: "25m"
|
||||
# # memory: "128Mi"
|
||||
# requests:
|
||||
# cpu: "25m"
|
||||
# memory: "128Mi"
|
||||
|
||||
networkHost: "0.0.0.0"
|
||||
|
||||
rbac:
|
||||
create: false
|
||||
serviceAccountAnnotations: {}
|
||||
serviceAccountName: ""
|
||||
automountServiceAccountToken: false
|
||||
|
||||
podSecurityPolicy:
|
||||
create: false
|
||||
name: ""
|
||||
spec:
|
||||
privileged: true
|
||||
fsGroup:
|
||||
rule: RunAsAny
|
||||
runAsUser:
|
||||
rule: RunAsAny
|
||||
seLinux:
|
||||
rule: RunAsAny
|
||||
supplementalGroups:
|
||||
rule: RunAsAny
|
||||
volumes:
|
||||
- secret
|
||||
- configMap
|
||||
- persistentVolumeClaim
|
||||
- emptyDir
|
||||
|
||||
persistence:
|
||||
enabled: true
|
||||
# Set to false to disable the `fsgroup-volume` initContainer that will update permissions on the persistent disk.
|
||||
enableInitChown: true
|
||||
# override image, which is busybox by default
|
||||
# image: busybox
|
||||
# override image tag, which is latest by default
|
||||
# imageTag:
|
||||
labels:
|
||||
# Add default labels for the volumeClaimTemplate of the StatefulSet
|
||||
enabled: false
|
||||
# OpenSearch Persistent Volume Storage Class
|
||||
# If defined, storageClassName: <storageClass>
|
||||
# If set to "-", storageClassName: "", which disables dynamic provisioning
|
||||
# If undefined (the default) or set to null, no storageClassName spec is
|
||||
# set, choosing the default provisioner. (gp2 on AWS, standard on
|
||||
# GKE, AWS & OpenStack)
|
||||
#
|
||||
# storageClass: "-"
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
size: 8Gi
|
||||
annotations: {}
|
||||
|
||||
extraVolumes: []
|
||||
# - name: extras
|
||||
# emptyDir: {}
|
||||
|
||||
extraVolumeMounts: []
|
||||
# - name: extras
|
||||
# mountPath: /usr/share/extras
|
||||
# readOnly: true
|
||||
|
||||
extraContainers: []
|
||||
# - name: do-something
|
||||
# image: busybox
|
||||
# command: ['do', 'something']
|
||||
|
||||
extraInitContainers: []
|
||||
# - name: do-somethings
|
||||
# image: busybox
|
||||
# command: ['do', 'something']
|
||||
|
||||
# This is the PriorityClass settings as defined in
|
||||
# https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
|
||||
priorityClassName: ""
|
||||
|
||||
# By default this will make sure two pods don't end up on the same node
|
||||
# Changing this to a region would allow you to spread pods across regions
|
||||
antiAffinityTopologyKey: "kubernetes.io/hostname"
|
||||
|
||||
# Hard means that by default pods will only be scheduled if there are enough nodes for them
|
||||
# and that they will never end up on the same node. Setting this to soft will do this "best effort".
|
||||
# Setting this to custom will use what is passed into customAntiAffinity.
|
||||
antiAffinity: "soft"
|
||||
|
||||
# Allows passing in custom anti-affinity settings as defined in
|
||||
# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity
|
||||
# Using this parameter requires setting antiAffinity to custom.
|
||||
customAntiAffinity: {}
|
||||
|
||||
# This is the node affinity settings as defined in
|
||||
# https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#node-affinity-beta-feature
|
||||
nodeAffinity: {}
|
||||
|
||||
# This is the pod affinity settings as defined in
|
||||
# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity
|
||||
podAffinity: {}
|
||||
|
||||
# The default is to deploy all pods serially. By setting this to parallel all pods are started at
|
||||
# the same time when bootstrapping the cluster
|
||||
podManagementPolicy: "Parallel"
|
||||
|
||||
# The environment variables injected by service links are not used, but can lead to slow OpenSearch boot times when
|
||||
# there are many services in the current namespace.
|
||||
# If you experience slow pod startups you probably want to set this to `false`.
|
||||
enableServiceLinks: true
|
||||
|
||||
protocol: https
|
||||
httpPort: 9200
|
||||
transportPort: 9300
|
||||
metricsPort: 9600
|
||||
|
||||
service:
|
||||
labels: {}
|
||||
labelsHeadless: {}
|
||||
headless:
|
||||
annotations: {}
|
||||
type: ClusterIP
|
||||
nodePort: ""
|
||||
annotations: {}
|
||||
httpPortName: http
|
||||
transportPortName: transport
|
||||
loadBalancerIP: ""
|
||||
loadBalancerSourceRanges: []
|
||||
externalTrafficPolicy: ""
|
||||
|
||||
updateStrategy: RollingUpdate
|
||||
|
||||
# This is the max unavailable setting for the pod disruption budget
|
||||
# The default value of 1 will make sure that kubernetes won't allow more than 1
|
||||
# of your pods to be unavailable during maintenance
|
||||
maxUnavailable: 1
|
||||
|
||||
podSecurityContext:
|
||||
fsGroup: 1000
|
||||
runAsUser: 1000
|
||||
|
||||
securityContext:
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
# readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
|
||||
securityConfig:
|
||||
enabled: true
|
||||
path: "/usr/share/opensearch/plugins/opensearch-security/securityconfig"
|
||||
actionGroupsSecret:
|
||||
configSecret:
|
||||
internalUsersSecret:
|
||||
rolesSecret:
|
||||
rolesMappingSecret:
|
||||
tenantsSecret:
|
||||
# The following option simplifies securityConfig by using a single secret and
|
||||
# specifying the config files as keys in the secret instead of creating
|
||||
# different secrets for for each config file.
|
||||
# Note that this is an alternative to the individual secret configuration
|
||||
# above and shouldn't be used if the above secrets are used.
|
||||
config:
|
||||
# There are multiple ways to define the configuration here:
|
||||
# * If you define anything under data, the chart will automatically create
|
||||
# a secret and mount it.
|
||||
# * If you define securityConfigSecret, the chart will assume this secret is
|
||||
# created externally and mount it.
|
||||
# * It is an error to define both data and securityConfigSecret.
|
||||
securityConfigSecret: ""
|
||||
data: {}
|
||||
# config.yml: |-
|
||||
# internal_users.yml: |-
|
||||
# roles.yml: |-
|
||||
# roles_mapping.yml: |-
|
||||
# action_groups.yml: |-
|
||||
# tenants.yml: |-
|
||||
|
||||
# How long to wait for opensearch to stop gracefully
|
||||
terminationGracePeriod: 120
|
||||
|
||||
sysctlVmMaxMapCount: 262144
|
||||
|
||||
startupProbe:
|
||||
tcpSocket:
|
||||
port: 9200
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 30
|
||||
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
initialDelaySeconds: 900
|
||||
periodSeconds: 10
|
||||
successThreshold: 3
|
||||
timeoutSeconds: 2
|
||||
|
||||
## Use an alternate scheduler.
|
||||
## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
|
||||
##
|
||||
schedulerName: ""
|
||||
|
||||
imagePullSecrets: []
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
|
||||
# Enabling this will publically expose your OpenSearch instance.
|
||||
# Only enable this if you have security enabled on your cluster
|
||||
ingress:
|
||||
enabled: true
|
||||
|
||||
# For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName
|
||||
# See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress
|
||||
ingressClassName: nginx
|
||||
|
||||
annotations: {}
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
path: /
|
||||
hosts:
|
||||
- chart-example.local
|
||||
tls: []
|
||||
# - secretName: chart-example-tls
|
||||
# hosts:
|
||||
# - chart-example.local
|
||||
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
masterTerminationFix: false
|
||||
|
||||
lifecycle: {}
|
||||
# preStop:
|
||||
# exec:
|
||||
# command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"]
|
||||
# postStart:
|
||||
# exec:
|
||||
# command:
|
||||
# - bash
|
||||
# - -c
|
||||
# - |
|
||||
# #!/bin/bash
|
||||
# # Add a template to adjust number of shards/replicas1
|
||||
# TEMPLATE_NAME=my_template
|
||||
# INDEX_PATTERN="logstash-*"
|
||||
# SHARD_COUNT=8
|
||||
# REPLICA_COUNT=1
|
||||
# ES_URL=http://localhost:9200
|
||||
# while [[ "$(curl -s -o /dev/null -w '%{http_code}\n' $ES_URL)" != "200" ]]; do sleep 1; done
|
||||
# curl -XPUT "$ES_URL/_template/$TEMPLATE_NAME" -H 'Content-Type: application/json' -d'{"index_patterns":['\""$INDEX_PATTERN"\"'],"settings":{"number_of_shards":'$SHARD_COUNT',"number_of_replicas":'$REPLICA_COUNT'}}'
|
||||
|
||||
keystore: []
|
||||
|
||||
networkPolicy:
|
||||
## Enable creation of NetworkPolicy resources. Only Ingress traffic is filtered for now.
|
||||
## In order for a Pod to access OpenSearch, it needs to have the following label:
|
||||
## {{ template "uname" . }}-client: "true"
|
||||
## Example for default configuration to access HTTP port:
|
||||
## opensearch-master-http-client: "true"
|
||||
## Example for default configuration to access transport port:
|
||||
## opensearch-master-transport-client: "true"
|
||||
|
||||
http:
|
||||
enabled: false
|
||||
|
||||
# Deprecated
|
||||
# please use the above podSecurityContext.fsGroup instead
|
||||
fsGroup: ""
|
||||
|
||||
## Set optimal sysctl's through securityContext. This requires privilege. Can be disabled if
|
||||
## the system has already been preconfigured. (Ex: https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html)
|
||||
## Also see: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/
|
||||
sysctl:
|
||||
enabled: false
|
||||
|
||||
## Set optimal sysctl's through privileged initContainer.
|
||||
sysctlInit:
|
||||
enabled: true
|
||||
# override image, which is busybox by default
|
||||
# image: busybox
|
||||
# override image tag, which is latest by default
|
||||
# imageTag:
|
||||
|
||||
## Enable to add 3rd Party / Custom plugins not offered in the default OpenSearch image.
|
||||
plugins:
|
||||
enabled: false
|
||||
installList: []
|
||||
# - example-fake-plugin
|
||||
442
helm-charts-observability/charts/opensearch/ci/ci-rbac-enabled-values.yaml
Executable file
442
helm-charts-observability/charts/opensearch/ci/ci-rbac-enabled-values.yaml
Executable file
@@ -0,0 +1,442 @@
|
||||
---
|
||||
clusterName: "opensearch-cluster"
|
||||
nodeGroup: "master"
|
||||
|
||||
# The service that non master groups will try to connect to when joining the cluster
|
||||
# This should be set to clusterName + "-" + nodeGroup for your master group
|
||||
masterService: "opensearch-cluster-master"
|
||||
|
||||
# OpenSearch roles that will be applied to this nodeGroup
|
||||
# These will be set as environment variable "node.roles". E.g. node.roles=master,ingest,data,remote_cluster_client
|
||||
roles:
|
||||
- master
|
||||
- ingest
|
||||
- data
|
||||
- remote_cluster_client
|
||||
|
||||
replicas: 1
|
||||
|
||||
# if not set, falls back to parsing .Values.imageTag, then .Chart.appVersion.
|
||||
majorVersion: ""
|
||||
|
||||
global:
|
||||
# Set if you want to change the default docker registry, e.g. a private one.
|
||||
dockerRegistry: ""
|
||||
|
||||
# Allows you to add any config files in {{ .Values.opensearchHome }}/config
|
||||
opensearchHome: /usr/share/opensearch
|
||||
# such as opensearch.yml and log4j2.properties
|
||||
config:
|
||||
# Values must be YAML literal style scalar / YAML multiline string.
|
||||
# <filename>: |
|
||||
# <formatted-value(s)>
|
||||
# log4j2.properties: |
|
||||
# status = error
|
||||
#
|
||||
# appender.console.type = Console
|
||||
# appender.console.name = console
|
||||
# appender.console.layout.type = PatternLayout
|
||||
# appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n
|
||||
#
|
||||
# rootLogger.level = info
|
||||
# rootLogger.appenderRef.console.ref = console
|
||||
opensearch.yml: |
|
||||
cluster.name: opensearch-cluster
|
||||
|
||||
# Bind to all interfaces because we don't know what IP address Docker will assign to us.
|
||||
network.host: 0.0.0.0
|
||||
transport.host: localhost
|
||||
transport.tcp.port: 9300
|
||||
|
||||
# Setting network.host to a non-loopback address enables the annoying bootstrap checks. "Single-node" mode disables them again.
|
||||
# discovery.type: single-node
|
||||
|
||||
# # Start OpenSearch Security Demo Configuration
|
||||
# # WARNING: revise all the lines below before you go into production
|
||||
# plugins:
|
||||
# security:
|
||||
# ssl:
|
||||
# transport:
|
||||
# pemcert_filepath: esnode.pem
|
||||
# pemkey_filepath: esnode-key.pem
|
||||
# pemtrustedcas_filepath: root-ca.pem
|
||||
# enforce_hostname_verification: false
|
||||
# http:
|
||||
# enabled: true
|
||||
# pemcert_filepath: esnode.pem
|
||||
# pemkey_filepath: esnode-key.pem
|
||||
# pemtrustedcas_filepath: root-ca.pem
|
||||
# allow_unsafe_democertificates: true
|
||||
# allow_default_init_securityindex: true
|
||||
# authcz:
|
||||
# admin_dn:
|
||||
# - CN=kirk,OU=client,O=client,L=test,C=de
|
||||
# audit.type: internal_opensearch
|
||||
# enable_snapshot_restore_privilege: true
|
||||
# check_snapshot_restore_write_privileges: true
|
||||
# restapi:
|
||||
# roles_enabled: ["all_access", "security_rest_api_access"]
|
||||
# system_indices:
|
||||
# enabled: true
|
||||
# indices:
|
||||
# [
|
||||
# ".opendistro-alerting-config",
|
||||
# ".opendistro-alerting-alert*",
|
||||
# ".opendistro-anomaly-results*",
|
||||
# ".opendistro-anomaly-detector*",
|
||||
# ".opendistro-anomaly-checkpoints",
|
||||
# ".opendistro-anomaly-detection-state",
|
||||
# ".opendistro-reports-*",
|
||||
# ".opendistro-notifications-*",
|
||||
# ".opendistro-notebooks",
|
||||
# ".opendistro-asynchronous-search-response*",
|
||||
# ]
|
||||
# ######## End OpenSearch Security Demo Configuration ########
|
||||
# log4j2.properties:
|
||||
|
||||
# Extra environment variables to append to this nodeGroup
|
||||
# This will be appended to the current 'env:' key. You can use any of the kubernetes env
|
||||
# syntax here
|
||||
extraEnvs:
|
||||
- name: OPENSEARCH_INITIAL_ADMIN_PASSWORD
|
||||
value: myStrongPassword123@456
|
||||
# - name: MY_ENVIRONMENT_VAR
|
||||
# value: the_value_goes_here
|
||||
|
||||
# Allows you to load environment variables from kubernextes secret or config map
|
||||
envFrom: []
|
||||
# - secretRef:
|
||||
# name: env-secret
|
||||
# - configMapRef:
|
||||
# name: config-map
|
||||
|
||||
# A list of secrets and their paths to mount inside the pod
|
||||
# This is useful for mounting certificates for security and for mounting
|
||||
# the X-Pack license
|
||||
secretMounts: []
|
||||
|
||||
hostAliases: []
|
||||
# - ip: "127.0.0.1"
|
||||
# hostnames:
|
||||
# - "foo.local"
|
||||
# - "bar.local"
|
||||
|
||||
image:
|
||||
repository: "opensearchproject/opensearch"
|
||||
# override image tag, which is .Chart.AppVersion by default
|
||||
tag: ""
|
||||
pullPolicy: "IfNotPresent"
|
||||
|
||||
podAnnotations: {}
|
||||
# iam.amazonaws.com/role: es-cluster
|
||||
|
||||
# additionals labels
|
||||
labels: {}
|
||||
|
||||
opensearchJavaOpts: "-Xmx512M -Xms512M"
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: "1000m"
|
||||
memory: "100Mi"
|
||||
|
||||
initResources: {}
|
||||
# limits:
|
||||
# cpu: "25m"
|
||||
# # memory: "128Mi"
|
||||
# requests:
|
||||
# cpu: "25m"
|
||||
# memory: "128Mi"
|
||||
|
||||
sidecarResources: {}
|
||||
# limits:
|
||||
# cpu: "25m"
|
||||
# # memory: "128Mi"
|
||||
# requests:
|
||||
# cpu: "25m"
|
||||
# memory: "128Mi"
|
||||
|
||||
networkHost: "0.0.0.0"
|
||||
|
||||
rbac:
|
||||
create: true
|
||||
serviceAccountAnnotations: {}
|
||||
serviceAccountName: ""
|
||||
automountServiceAccountToken: true
|
||||
|
||||
podSecurityPolicy:
|
||||
create: false
|
||||
name: ""
|
||||
spec:
|
||||
privileged: true
|
||||
fsGroup:
|
||||
rule: RunAsAny
|
||||
runAsUser:
|
||||
rule: RunAsAny
|
||||
seLinux:
|
||||
rule: RunAsAny
|
||||
supplementalGroups:
|
||||
rule: RunAsAny
|
||||
volumes:
|
||||
- secret
|
||||
- configMap
|
||||
- persistentVolumeClaim
|
||||
- emptyDir
|
||||
|
||||
persistence:
|
||||
enabled: true
|
||||
# Set to false to disable the `fsgroup-volume` initContainer that will update permissions on the persistent disk.
|
||||
enableInitChown: true
|
||||
# override image, which is busybox by default
|
||||
# image: busybox
|
||||
# override image tag, which is latest by default
|
||||
# imageTag:
|
||||
labels:
|
||||
# Add default labels for the volumeClaimTemplate of the StatefulSet
|
||||
enabled: false
|
||||
# OpenSearch Persistent Volume Storage Class
|
||||
# If defined, storageClassName: <storageClass>
|
||||
# If set to "-", storageClassName: "", which disables dynamic provisioning
|
||||
# If undefined (the default) or set to null, no storageClassName spec is
|
||||
# set, choosing the default provisioner. (gp2 on AWS, standard on
|
||||
# GKE, AWS & OpenStack)
|
||||
#
|
||||
# storageClass: "-"
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
size: 8Gi
|
||||
annotations: {}
|
||||
|
||||
extraVolumes: []
|
||||
# - name: extras
|
||||
# emptyDir: {}
|
||||
|
||||
extraVolumeMounts: []
|
||||
# - name: extras
|
||||
# mountPath: /usr/share/extras
|
||||
# readOnly: true
|
||||
|
||||
extraContainers: []
|
||||
# - name: do-something
|
||||
# image: busybox
|
||||
# command: ['do', 'something']
|
||||
|
||||
extraInitContainers: []
|
||||
# - name: do-somethings
|
||||
# image: busybox
|
||||
# command: ['do', 'something']
|
||||
|
||||
# This is the PriorityClass settings as defined in
|
||||
# https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
|
||||
priorityClassName: ""
|
||||
|
||||
# By default this will make sure two pods don't end up on the same node
|
||||
# Changing this to a region would allow you to spread pods across regions
|
||||
antiAffinityTopologyKey: "kubernetes.io/hostname"
|
||||
|
||||
# Hard means that by default pods will only be scheduled if there are enough nodes for them
|
||||
# and that they will never end up on the same node. Setting this to soft will do this "best effort".
|
||||
# Setting this to custom will use what is passed into customAntiAffinity.
|
||||
antiAffinity: "soft"
|
||||
|
||||
# Allows passing in custom anti-affinity settings as defined in
|
||||
# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity
|
||||
# Using this parameter requires setting antiAffinity to custom.
|
||||
customAntiAffinity: {}
|
||||
|
||||
# This is the node affinity settings as defined in
|
||||
# https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#node-affinity-beta-feature
|
||||
nodeAffinity: {}
|
||||
|
||||
# This is the pod affinity settings as defined in
|
||||
# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity
|
||||
podAffinity: {}
|
||||
|
||||
# The default is to deploy all pods serially. By setting this to parallel all pods are started at
|
||||
# the same time when bootstrapping the cluster
|
||||
podManagementPolicy: "Parallel"
|
||||
|
||||
# The environment variables injected by service links are not used, but can lead to slow OpenSearch boot times when
|
||||
# there are many services in the current namespace.
|
||||
# If you experience slow pod startups you probably want to set this to `false`.
|
||||
enableServiceLinks: true
|
||||
|
||||
protocol: https
|
||||
httpPort: 9200
|
||||
transportPort: 9300
|
||||
metricsPort: 9600
|
||||
|
||||
service:
|
||||
labels: {}
|
||||
labelsHeadless: {}
|
||||
headless:
|
||||
annotations: {}
|
||||
type: ClusterIP
|
||||
nodePort: ""
|
||||
annotations: {}
|
||||
httpPortName: http
|
||||
transportPortName: transport
|
||||
loadBalancerIP: ""
|
||||
loadBalancerSourceRanges: []
|
||||
externalTrafficPolicy: ""
|
||||
|
||||
updateStrategy: RollingUpdate
|
||||
|
||||
# This is the max unavailable setting for the pod disruption budget
|
||||
# The default value of 1 will make sure that kubernetes won't allow more than 1
|
||||
# of your pods to be unavailable during maintenance
|
||||
maxUnavailable: 1
|
||||
|
||||
podSecurityContext:
|
||||
fsGroup: 1000
|
||||
runAsUser: 1000
|
||||
|
||||
securityContext:
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
# readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
|
||||
securityConfig:
|
||||
enabled: true
|
||||
path: "/usr/share/opensearch/plugins/opensearch-security/securityconfig"
|
||||
actionGroupsSecret:
|
||||
configSecret:
|
||||
internalUsersSecret:
|
||||
rolesSecret:
|
||||
rolesMappingSecret:
|
||||
tenantsSecret:
|
||||
# The following option simplifies securityConfig by using a single secret and
|
||||
# specifying the config files as keys in the secret instead of creating
|
||||
# different secrets for for each config file.
|
||||
# Note that this is an alternative to the individual secret configuration
|
||||
# above and shouldn't be used if the above secrets are used.
|
||||
config:
|
||||
# There are multiple ways to define the configuration here:
|
||||
# * If you define anything under data, the chart will automatically create
|
||||
# a secret and mount it.
|
||||
# * If you define securityConfigSecret, the chart will assume this secret is
|
||||
# created externally and mount it.
|
||||
# * It is an error to define both data and securityConfigSecret.
|
||||
securityConfigSecret: ""
|
||||
data: {}
|
||||
# config.yml: |-
|
||||
# internal_users.yml: |-
|
||||
# roles.yml: |-
|
||||
# roles_mapping.yml: |-
|
||||
# action_groups.yml: |-
|
||||
# tenants.yml: |-
|
||||
|
||||
# How long to wait for opensearch to stop gracefully
|
||||
terminationGracePeriod: 120
|
||||
|
||||
sysctlVmMaxMapCount: 262144
|
||||
|
||||
startupProbe:
|
||||
tcpSocket:
|
||||
port: 9200
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 30
|
||||
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
initialDelaySeconds: 900
|
||||
periodSeconds: 10
|
||||
successThreshold: 3
|
||||
timeoutSeconds: 2
|
||||
|
||||
## Use an alternate scheduler.
|
||||
## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
|
||||
##
|
||||
schedulerName: ""
|
||||
|
||||
imagePullSecrets: []
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
|
||||
# Enabling this will publically expose your OpenSearch instance.
|
||||
# Only enable this if you have security enabled on your cluster
|
||||
ingress:
|
||||
enabled: false
|
||||
|
||||
# For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName
|
||||
# See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress
|
||||
ingressClassName: nginx
|
||||
|
||||
annotations: {}
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
path: /
|
||||
hosts:
|
||||
- chart-example.local
|
||||
tls: []
|
||||
# - secretName: chart-example-tls
|
||||
# hosts:
|
||||
# - chart-example.local
|
||||
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
masterTerminationFix: false
|
||||
|
||||
lifecycle: {}
|
||||
# preStop:
|
||||
# exec:
|
||||
# command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"]
|
||||
# postStart:
|
||||
# exec:
|
||||
# command:
|
||||
# - bash
|
||||
# - -c
|
||||
# - |
|
||||
# #!/bin/bash
|
||||
# # Add a template to adjust number of shards/replicas1
|
||||
# TEMPLATE_NAME=my_template
|
||||
# INDEX_PATTERN="logstash-*"
|
||||
# SHARD_COUNT=8
|
||||
# REPLICA_COUNT=1
|
||||
# ES_URL=http://localhost:9200
|
||||
# while [[ "$(curl -s -o /dev/null -w '%{http_code}\n' $ES_URL)" != "200" ]]; do sleep 1; done
|
||||
# curl -XPUT "$ES_URL/_template/$TEMPLATE_NAME" -H 'Content-Type: application/json' -d'{"index_patterns":['\""$INDEX_PATTERN"\"'],"settings":{"number_of_shards":'$SHARD_COUNT',"number_of_replicas":'$REPLICA_COUNT'}}'
|
||||
|
||||
keystore: []
|
||||
|
||||
networkPolicy:
|
||||
## Enable creation of NetworkPolicy resources. Only Ingress traffic is filtered for now.
|
||||
## In order for a Pod to access OpenSearch, it needs to have the following label:
|
||||
## {{ template "uname" . }}-client: "true"
|
||||
## Example for default configuration to access HTTP port:
|
||||
## opensearch-master-http-client: "true"
|
||||
## Example for default configuration to access transport port:
|
||||
## opensearch-master-transport-client: "true"
|
||||
|
||||
http:
|
||||
enabled: false
|
||||
|
||||
# Deprecated
|
||||
# please use the above podSecurityContext.fsGroup instead
|
||||
fsGroup: ""
|
||||
|
||||
## Set optimal sysctl's through securityContext. This requires privilege. Can be disabled if
|
||||
## the system has already been preconfigured. (Ex: https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html)
|
||||
## Also see: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/
|
||||
sysctl:
|
||||
enabled: false
|
||||
|
||||
## Set optimal sysctl's through privileged initContainer.
|
||||
sysctlInit:
|
||||
enabled: false
|
||||
# override image, which is busybox by default
|
||||
# image: busybox
|
||||
# override image tag, which is latest by default
|
||||
# imageTag:
|
||||
|
||||
## Enable to add 3rd Party / Custom plugins not offered in the default OpenSearch image.
|
||||
plugins:
|
||||
enabled: false
|
||||
installList: []
|
||||
# - example-fake-plugin
|
||||
428
helm-charts-observability/charts/opensearch/ci/ci-values.yaml
Executable file
428
helm-charts-observability/charts/opensearch/ci/ci-values.yaml
Executable file
@@ -0,0 +1,428 @@
|
||||
---
|
||||
clusterName: "opensearch-cluster"
|
||||
nodeGroup: "master"
|
||||
|
||||
# The service that non master groups will try to connect to when joining the cluster
|
||||
# This should be set to clusterName + "-" + nodeGroup for your master group
|
||||
masterService: "opensearch-cluster-master"
|
||||
|
||||
# OpenSearch roles that will be applied to this nodeGroup
|
||||
# These will be set as environment variable "node.roles". E.g. node.roles=master,ingest,data,remote_cluster_client
|
||||
roles:
|
||||
- master
|
||||
- ingest
|
||||
- data
|
||||
- remote_cluster_client
|
||||
|
||||
replicas: 1
|
||||
|
||||
# if not set, falls back to parsing .Values.imageTag, then .Chart.appVersion.
|
||||
majorVersion: ""
|
||||
|
||||
global:
|
||||
# Set if you want to change the default docker registry, e.g. a private one.
|
||||
dockerRegistry: ""
|
||||
|
||||
# Allows you to add any config files in {{ .Values.opensearchHome }}/config
|
||||
opensearchHome: /usr/share/opensearch
|
||||
# such as opensearch.yml and log4j2.properties
|
||||
config:
|
||||
# Values must be YAML literal style scalar / YAML multiline string.
|
||||
# <filename>: |
|
||||
# <formatted-value(s)>
|
||||
# log4j2.properties: |
|
||||
# status = error
|
||||
#
|
||||
# appender.console.type = Console
|
||||
# appender.console.name = console
|
||||
# appender.console.layout.type = PatternLayout
|
||||
# appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n
|
||||
#
|
||||
# rootLogger.level = info
|
||||
# rootLogger.appenderRef.console.ref = console
|
||||
opensearch.yml: |
|
||||
cluster.name: opensearch-cluster
|
||||
|
||||
# Bind to all interfaces because we don't know what IP address Docker will assign to us.
|
||||
network.host: 0.0.0.0
|
||||
transport.host: localhost
|
||||
transport.tcp.port: 9300
|
||||
|
||||
# Setting network.host to a non-loopback address enables the annoying bootstrap checks. "Single-node" mode disables them again.
|
||||
# discovery.type: single-node
|
||||
|
||||
# # Start OpenSearch Security Demo Configuration
|
||||
# # WARNING: revise all the lines below before you go into production
|
||||
# plugins:
|
||||
# security:
|
||||
# ssl:
|
||||
# transport:
|
||||
# pemcert_filepath: esnode.pem
|
||||
# pemkey_filepath: esnode-key.pem
|
||||
# pemtrustedcas_filepath: root-ca.pem
|
||||
# enforce_hostname_verification: false
|
||||
# http:
|
||||
# enabled: true
|
||||
# pemcert_filepath: esnode.pem
|
||||
# pemkey_filepath: esnode-key.pem
|
||||
# pemtrustedcas_filepath: root-ca.pem
|
||||
# allow_unsafe_democertificates: true
|
||||
# allow_default_init_securityindex: true
|
||||
# authcz:
|
||||
# admin_dn:
|
||||
# - CN=kirk,OU=client,O=client,L=test,C=de
|
||||
# audit.type: internal_opensearch
|
||||
# enable_snapshot_restore_privilege: true
|
||||
# check_snapshot_restore_write_privileges: true
|
||||
# restapi:
|
||||
# roles_enabled: ["all_access", "security_rest_api_access"]
|
||||
# system_indices:
|
||||
# enabled: true
|
||||
# indices:
|
||||
# [
|
||||
# ".opendistro-alerting-config",
|
||||
# ".opendistro-alerting-alert*",
|
||||
# ".opendistro-anomaly-results*",
|
||||
# ".opendistro-anomaly-detector*",
|
||||
# ".opendistro-anomaly-checkpoints",
|
||||
# ".opendistro-anomaly-detection-state",
|
||||
# ".opendistro-reports-*",
|
||||
# ".opendistro-notifications-*",
|
||||
# ".opendistro-notebooks",
|
||||
# ".opendistro-asynchronous-search-response*",
|
||||
# ]
|
||||
# ######## End OpenSearch Security Demo Configuration ########
|
||||
# log4j2.properties:
|
||||
|
||||
# Extra environment variables to append to this nodeGroup
|
||||
# This will be appended to the current 'env:' key. You can use any of the kubernetes env
|
||||
# syntax here
|
||||
extraEnvs:
|
||||
- name: OPENSEARCH_INITIAL_ADMIN_PASSWORD
|
||||
value: myStrongPassword123@456
|
||||
# - name: MY_ENVIRONMENT_VAR
|
||||
# value: the_value_goes_here
|
||||
|
||||
# Allows you to load environment variables from kubernextes secret or config map
|
||||
envFrom: []
|
||||
# - secretRef:
|
||||
# name: env-secret
|
||||
# - configMapRef:
|
||||
# name: config-map
|
||||
|
||||
# A list of secrets and their paths to mount inside the pod
|
||||
# This is useful for mounting certificates for security and for mounting
|
||||
# the X-Pack license
|
||||
secretMounts: []
|
||||
|
||||
hostAliases: []
|
||||
# - ip: "127.0.0.1"
|
||||
# hostnames:
|
||||
# - "foo.local"
|
||||
# - "bar.local"
|
||||
|
||||
|
||||
image:
|
||||
repository: "opensearchproject/opensearch"
|
||||
# override image tag, which is .Chart.AppVersion by default
|
||||
tag: ""
|
||||
pullPolicy: "IfNotPresent"
|
||||
|
||||
|
||||
podAnnotations: {}
|
||||
# iam.amazonaws.com/role: es-cluster
|
||||
|
||||
# additionals labels
|
||||
labels: {}
|
||||
|
||||
opensearchJavaOpts: "-Xmx512M -Xms512M"
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: "1000m"
|
||||
memory: "100Mi"
|
||||
|
||||
initResources: {}
|
||||
# limits:
|
||||
# cpu: "25m"
|
||||
# # memory: "128Mi"
|
||||
# requests:
|
||||
# cpu: "25m"
|
||||
# memory: "128Mi"
|
||||
|
||||
sidecarResources: {}
|
||||
# limits:
|
||||
# cpu: "25m"
|
||||
# # memory: "128Mi"
|
||||
# requests:
|
||||
# cpu: "25m"
|
||||
# memory: "128Mi"
|
||||
|
||||
networkHost: "0.0.0.0"
|
||||
|
||||
rbac:
|
||||
create: false
|
||||
serviceAccountAnnotations: {}
|
||||
serviceAccountName: ""
|
||||
|
||||
podSecurityPolicy:
|
||||
create: false
|
||||
name: ""
|
||||
spec:
|
||||
privileged: true
|
||||
fsGroup:
|
||||
rule: RunAsAny
|
||||
runAsUser:
|
||||
rule: RunAsAny
|
||||
seLinux:
|
||||
rule: RunAsAny
|
||||
supplementalGroups:
|
||||
rule: RunAsAny
|
||||
volumes:
|
||||
- secret
|
||||
- configMap
|
||||
- persistentVolumeClaim
|
||||
- emptyDir
|
||||
|
||||
persistence:
|
||||
enabled: true
|
||||
# Set to false to disable the `fsgroup-volume` initContainer that will update permissions on the persistent disk.
|
||||
enableInitChown: true
|
||||
# override image, which is busybox by default
|
||||
# image: busybox
|
||||
# override image tag, which is latest by default
|
||||
# imageTag:
|
||||
labels:
|
||||
# Add default labels for the volumeClaimTemplate of the StatefulSet
|
||||
enabled: false
|
||||
# OpenSearch Persistent Volume Storage Class
|
||||
# If defined, storageClassName: <storageClass>
|
||||
# If set to "-", storageClassName: "", which disables dynamic provisioning
|
||||
# If undefined (the default) or set to null, no storageClassName spec is
|
||||
# set, choosing the default provisioner. (gp2 on AWS, standard on
|
||||
# GKE, AWS & OpenStack)
|
||||
#
|
||||
# storageClass: "-"
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
size: 8Gi
|
||||
annotations: {}
|
||||
|
||||
extraVolumes: []
|
||||
# - name: extras
|
||||
# emptyDir: {}
|
||||
|
||||
extraVolumeMounts: []
|
||||
# - name: extras
|
||||
# mountPath: /usr/share/extras
|
||||
# readOnly: true
|
||||
|
||||
extraContainers: []
|
||||
# - name: do-something
|
||||
# image: busybox
|
||||
# command: ['do', 'something']
|
||||
|
||||
extraInitContainers: []
|
||||
# - name: do-somethings
|
||||
# image: busybox
|
||||
# command: ['do', 'something']
|
||||
|
||||
# This is the PriorityClass settings as defined in
|
||||
# https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
|
||||
priorityClassName: ""
|
||||
|
||||
# By default this will make sure two pods don't end up on the same node
|
||||
# Changing this to a region would allow you to spread pods across regions
|
||||
antiAffinityTopologyKey: "kubernetes.io/hostname"
|
||||
|
||||
# Hard means that by default pods will only be scheduled if there are enough nodes for them
|
||||
# and that they will never end up on the same node. Setting this to soft will do this "best effort".
|
||||
# Setting this to custom will use what is passed into customAntiAffinity.
|
||||
antiAffinity: "soft"
|
||||
|
||||
# Allows passing in custom anti-affinity settings as defined in
|
||||
# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity
|
||||
# Using this parameter requires setting antiAffinity to custom.
|
||||
customAntiAffinity: {}
|
||||
|
||||
# This is the node affinity settings as defined in
|
||||
# https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#node-affinity-beta-feature
|
||||
nodeAffinity: {}
|
||||
|
||||
# This is the pod affinity settings as defined in
|
||||
# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity
|
||||
podAffinity: {}
|
||||
|
||||
# The default is to deploy all pods serially. By setting this to parallel all pods are started at
|
||||
# the same time when bootstrapping the cluster
|
||||
podManagementPolicy: "Parallel"
|
||||
|
||||
# The environment variables injected by service links are not used, but can lead to slow OpenSearch boot times when
|
||||
# there are many services in the current namespace.
|
||||
# If you experience slow pod startups you probably want to set this to `false`.
|
||||
enableServiceLinks: true
|
||||
|
||||
protocol: https
|
||||
httpPort: 9200
|
||||
transportPort: 9300
|
||||
metricsPort: 9600
|
||||
|
||||
service:
|
||||
labels: {}
|
||||
labelsHeadless: {}
|
||||
headless:
|
||||
annotations: {}
|
||||
type: ClusterIP
|
||||
nodePort: ""
|
||||
annotations: {}
|
||||
httpPortName: http
|
||||
transportPortName: transport
|
||||
loadBalancerIP: ""
|
||||
loadBalancerSourceRanges: []
|
||||
externalTrafficPolicy: ""
|
||||
|
||||
updateStrategy: RollingUpdate
|
||||
|
||||
# This is the max unavailable setting for the pod disruption budget
|
||||
# The default value of 1 will make sure that kubernetes won't allow more than 1
|
||||
# of your pods to be unavailable during maintenance
|
||||
maxUnavailable: 1
|
||||
|
||||
podSecurityContext:
|
||||
fsGroup: 1000
|
||||
runAsUser: 1000
|
||||
|
||||
securityContext:
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
# readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
|
||||
securityConfig:
|
||||
enabled: true
|
||||
path: "/usr/share/opensearch/plugins/opensearch-security/securityconfig"
|
||||
actionGroupsSecret:
|
||||
configSecret:
|
||||
internalUsersSecret:
|
||||
rolesSecret:
|
||||
rolesMappingSecret:
|
||||
tenantsSecret:
|
||||
# The following option simplifies securityConfig by using a single secret and
|
||||
# specifying the config files as keys in the secret instead of creating
|
||||
# different secrets for for each config file.
|
||||
# Note that this is an alternative to the individual secret configuration
|
||||
# above and shouldn't be used if the above secrets are used.
|
||||
config:
|
||||
# There are multiple ways to define the configuration here:
|
||||
# * If you define anything under data, the chart will automatically create
|
||||
# a secret and mount it.
|
||||
# * If you define securityConfigSecret, the chart will assume this secret is
|
||||
# created externally and mount it.
|
||||
# * It is an error to define both data and securityConfigSecret.
|
||||
securityConfigSecret: ""
|
||||
data: {}
|
||||
# config.yml: |-
|
||||
# internal_users.yml: |-
|
||||
# roles.yml: |-
|
||||
# roles_mapping.yml: |-
|
||||
# action_groups.yml: |-
|
||||
# tenants.yml: |-
|
||||
|
||||
# How long to wait for opensearch to stop gracefully
|
||||
terminationGracePeriod: 120
|
||||
|
||||
sysctlVmMaxMapCount: 262144
|
||||
|
||||
## Use an alternate scheduler.
|
||||
## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
|
||||
##
|
||||
schedulerName: ""
|
||||
|
||||
imagePullSecrets: []
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
|
||||
# Enabling this will publically expose your OpenSearch instance.
|
||||
# Only enable this if you have security enabled on your cluster
|
||||
ingress:
|
||||
enabled: false
|
||||
|
||||
# For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName
|
||||
# See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress
|
||||
ingressClassName: nginx
|
||||
|
||||
annotations: {}
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
path: /
|
||||
hosts:
|
||||
- chart-example.local
|
||||
tls: []
|
||||
# - secretName: chart-example-tls
|
||||
# hosts:
|
||||
# - chart-example.local
|
||||
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
masterTerminationFix: false
|
||||
|
||||
lifecycle: {}
|
||||
# preStop:
|
||||
# exec:
|
||||
# command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"]
|
||||
# postStart:
|
||||
# exec:
|
||||
# command:
|
||||
# - bash
|
||||
# - -c
|
||||
# - |
|
||||
# #!/bin/bash
|
||||
# # Add a template to adjust number of shards/replicas1
|
||||
# TEMPLATE_NAME=my_template
|
||||
# INDEX_PATTERN="logstash-*"
|
||||
# SHARD_COUNT=8
|
||||
# REPLICA_COUNT=1
|
||||
# ES_URL=http://localhost:9200
|
||||
# while [[ "$(curl -s -o /dev/null -w '%{http_code}\n' $ES_URL)" != "200" ]]; do sleep 1; done
|
||||
# curl -XPUT "$ES_URL/_template/$TEMPLATE_NAME" -H 'Content-Type: application/json' -d'{"index_patterns":['\""$INDEX_PATTERN"\"'],"settings":{"number_of_shards":'$SHARD_COUNT',"number_of_replicas":'$REPLICA_COUNT'}}'
|
||||
|
||||
keystore: []
|
||||
|
||||
networkPolicy:
|
||||
## Enable creation of NetworkPolicy resources. Only Ingress traffic is filtered for now.
|
||||
## In order for a Pod to access OpenSearch, it needs to have the following label:
|
||||
## {{ template "uname" . }}-client: "true"
|
||||
## Example for default configuration to access HTTP port:
|
||||
## opensearch-master-http-client: "true"
|
||||
## Example for default configuration to access transport port:
|
||||
## opensearch-master-transport-client: "true"
|
||||
|
||||
http:
|
||||
enabled: false
|
||||
|
||||
# Deprecated
|
||||
# please use the above podSecurityContext.fsGroup instead
|
||||
fsGroup: ""
|
||||
|
||||
## Set optimal sysctl's through securityContext. This requires privilege. Can be disabled if
|
||||
## the system has already been preconfigured. (Ex: https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html)
|
||||
## Also see: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/
|
||||
sysctl:
|
||||
enabled: false
|
||||
|
||||
## Set optimal sysctl's through privileged initContainer.
|
||||
sysctlInit:
|
||||
enabled: false
|
||||
# override image, which is busybox by default
|
||||
# image: busybox
|
||||
# override image tag, which is latest by default
|
||||
# imageTag:
|
||||
|
||||
## Enable to add 3rd Party / Custom plugins not offered in the default OpenSearch image.
|
||||
plugins:
|
||||
enabled: false
|
||||
installList: []
|
||||
# - example-fake-plugin
|
||||
@@ -0,0 +1,11 @@
|
||||
---
|
||||
_meta:
|
||||
type: "internalusers"
|
||||
config_version: 2
|
||||
|
||||
admin:
|
||||
hash: "$2y$12$4lu31zUeAnqAtmVvdaA9l.YqPgj2W/WL/4tojqC6uVfp3k5inWOmW"
|
||||
reserved: true
|
||||
backend_roles:
|
||||
- "admin"
|
||||
description: "OpenSearch administrator"
|
||||
@@ -0,0 +1,9 @@
|
||||
apiVersion: v1
|
||||
data:
|
||||
admin-key.pem: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRRHB1UUpNMTFMemdiRWgKbkNtdmlueDJKR2lJWVJlODA3dG1tN3JuUllZNXIwaXh6OUpCVjlITmZYeUpjOWV6MmczenJUQVNtdEVFU0ZEZAorR0dvb2NnNmdwT3pnNG9ZSExkSUNSNjg1cjltREVZMXRkWnlzUW1JKy9wWHAza2Q3ZzRvazRSOEpRSWNydng4CmtiRkx6UjZ1Z2RhOFI0bFNSelR0aExsZm1GR0dxTFh1bkhnNlZydy9ucXNVeHZGR2dFU0QrWUxKL3E0eDNPeG8KMTBCc1NhTlppVjJsSTlRWWNlQ1dBNEVKMjRUR2ViUUgxckNsblNWd3BDUm92dWZ3enU5ZlVOSDdOQkJabEhXMQpWc2laek8xT2ZQM29xNXZNd3l5Z090SEFOTERwSCtCbGY2WHNQdERhRThNcXNLNStqdzV6bVRWOUp0c005ODN2CkFDaWo2SnozQWdNQkFBRUNnZ0VBSWVlUHVOdm5rYUYzczV0MnhKcy9VTmdaUGVkdnpSbWQ3dFdhZUdBeWgzMncKK3ZKZDJ0TEZnWnk1aXlyOTJINUNWZDRDd2tBcElBanBpam0wMlFTWENqM1U5VTZZb3NUUHBhaUZCL3dsT2NXQQpEZHlSL2xOR1FkUGp6Z0ZpWllBYUY3TEdua2UwRmJzZ3IyVm5KY3JjcjQzd082SFkvdEdMa1FVVzZ4SXFpWEQ2Cjh1NFJDTHA0OGRxOGNFODlWZnNCRnl1VkpUQmlnTjhXSnhFKzdYTUVzQ0NJRDM3aWRGeVRnb1poVFNoYXNCQUYKeVpVdmxSRW1rL0tnQ0VLM2ljeXljczZDN0N4WEU3ZHE3a2JNaVlSazM4R09rS2pmaklzTFNQVkFwZlRJaWliYgpHWW1RKzJLTFhSWi85bXlUOWc5dGpHTHd3K3dKczQ5blZYc1RGcXNkdVFLQmdRRDJrejZUTE5aMlZ0MTVvTndNCjhBYndab3E0ZjM3VTdCTzEyem5SNEowdzhQU0xoQ01IclltUFpNNlFSdFZnekpnS3hYalNTWGZRQStvVnZyQ2EKckZpeFNoNWdBSUVZR1JBMlhlWTN1S2dHSWVPcXFDR3ZpamZHczJ6MzI0YjNZMTRtcjkvL0g0U0k2SXZ3RU5qZwpDU3A0UlluQTlyMTFJdmM4dS9pR1VCOTlKUUtCZ1FEeXFBQ0p1RmV6dk44VEtIbXIxb0ZTK3JSL1FBbUpsazl5Ck9HNjJjMGRiZGx6QXJkek1PUFRDMmIvSWtrdGdHQk0yUEVnaU5lT1dFemJYQ1B0dVdQS0loaHJ4M2RwRzlhdnkKdHN3ZjRnL0JIeCtoalRDTGVLQStvMEFrWldoUnNSS09HbXdnRGtGTmEyOW1aWVdQTnk0S3dSSk9MeGRPWStaNgpMZTMwOHFjTTZ3S0JnRUZpN0k0VXJzNTAzSWhiYXQ4WGE0K21jWlRaWW1YT01LL2g4YVJCUHczeVo3YnpsR0o5CjEyT3FKTWpIcjkvYWdWc2g0SmRMR2pXVVJDZitDRkVMOFAwYW5aRnhzTW9XSTJGM1p3eFJzR1RuNmJxZ21VWTIKamZIb05MWkpoYkhtck5udmU2UG8xTG1GaVU1ZytWSDN2RVpta2xBVVhrdEl1VzFtbjFIbXYyTHRBb0dBWFpOTwpDYzROL0NFMHdWV1ZmaC9OWld1SzJadWZVZkNtR0gwTXJNMU4wa2FWeERRSDlyVnNKZ3dFdWxzNE9BbHd0elNOCitLdGhaWWxwVjRsK05IS1dyUEZTU0wxdUpIa3U0djE5UURwVUt2eE9uV1V1T0VxL09RaUpmcitnZUFoYUNIVEcKQjZLWHFqeHBERXJRTTRkcStQaTFqM0wzZ09KamlmQldXR1NPNlJzQ2dZRUF1Zk1Gb2RLYzVQQ1lLSFBUV3FCQQo5QXE5V3FERUdOL25nWTNoVVo4U2RpM3ZReUd2bUdXYmNnK21tdmZ5TkYvRkJialJYemRJM0N1Vm51NzNsTTNYCmFMb24xUWhsOUsxWFFJa0lONEJPTXNGT29BQzg1UkdzWWt6RVVlQXByR1d1SGRFek5jU3N1R2xWbkx5azZhcHgKNzl1aHI3Sit3MlBlNGplK21TZ3d1cFU9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
|
||||
admin.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZDakNDQXZLZ0F3SUJBZ0lVSXljc3FkNHF1b2d4ancxRTRLangzd0J0Yld3d0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZVXhDekFKQmdOVkJBWVRBa0pFTVE0d0RBWURWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaAphMkV4RWpBUUJnTlZCQW9NQ1VKeWFXeHNhV0Z1ZERFYk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwCklFTkJNU1V3SXdZRFZRUUREQnhDY21sc2JHbGhiblFnVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUI0WERUSTIKTURjeU16RTFNRGMwTTFvWERUSTRNVEF5TlRFMU1EYzBNMW93Z1lBeEN6QUpCZ05WQkFZVEFrSkVNUTR3REFZRApWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaGEyRXhFakFRQmdOVkJBb01DVUp5YVd4c2FXRnVkREVpCk1DQUdBMVVFQ3d3WlQzQmxibE5sWVhKamFDQkJaRzFwYm1semRISmhkRzl5Y3pFWk1CY0dBMVVFQXd3UWIzQmwKYm5ObFlYSmphQzFoWkcxcGJqQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQU9tNQpBa3pYVXZPQnNTR2NLYStLZkhZa2FJaGhGN3pUdTJhYnV1ZEZoam12U0xIUDBrRlgwYzE5ZklsejE3UGFEZk90Ck1CS2EwUVJJVU4zNFlhaWh5RHFDazdPRGloZ2N0MGdKSHJ6bXYyWU1SalcxMW5LeENZajcrbGVuZVIzdURpaVQKaEh3bEFoeXUvSHlSc1V2TkhxNkIxcnhIaVZKSE5PMkV1VitZVVlhb3RlNmNlRHBXdkQrZXF4VEc4VWFBUklQNQpnc24rcmpIYzdHalhRR3hKbzFtSlhhVWoxQmh4NEpZRGdRbmJoTVo1dEFmV3NLV2RKWENrSkdpKzUvRE83MTlRCjBmczBFRm1VZGJWV3lKbk03VTU4L2Vpcm04ekRMS0E2MGNBMHNPa2Y0R1YvcGV3KzBOb1R3eXF3cm42UERuT1oKTlgwbTJ3ejN6ZThBS0tQb25QY0NBd0VBQWFOMU1ITXdEQVlEVlIwVEFRSC9CQUl3QURBT0JnTlZIUThCQWY4RQpCQU1DQmFBd0V3WURWUjBsQkF3d0NnWUlLd1lCQlFVSEF3SXdIUVlEVlIwT0JCWUVGT0daUGY0NEEyWkt3Q0FPCk9sc0lSYnJ1WkdCZE1COEdBMVVkSXdRWU1CYUFGSGJhbmo2RkdNVWZ3bEMwSytqY081TTlHd0FwTUEwR0NTcUcKU0liM0RRRUJDd1VBQTRJQ0FRQllzY1p2WVB5YXVkUDlLeVhNc1BkKzJZbThnWFVkYmpoakJuaDdwQXlNNU52cgpMRUFXR3VTSVFidzlNREVBMUluYkZvejhjQThBUVRFZGZ5bUJNMFdUbkpHam9zcGNRYUJWNU03VXZhYlZEeE1UCkNEbnkzbU93SjMyZUpjWkZiVmpjSFFrcTBrN0RMcnRLZE1DV3haWEd1WHpJZHZwcDJ4TzVjRzZXY3lGZVEwVkwKUnV5eUFkRm5sTXVSY01LMnNoSHprK3lVSGFUb29rTEtYK1pmMGFlUGhudUwwMGMwaWloSmw5eVhvS0ZzUUR6Ywp0WWhXNmdBZVRVelUrUU5RWEZTZ2NOdmhKaDBOVVVQeWlqczZUWWZtL052N0t3MTRIY2JXbnRBVTlWNjFiLzc2CldHM0hJTnpxMEt0QnF3bVQ4cms1YlRybGVzZWd2QzFUeUo2bjlMZTd1TjhkY2NtYkh6SE9MYU1CV3FraHhtbGwKNWNZcENmUFBkb1duQWxrWnBya2NRdnJOZ3F6TGZzcHNwd1RaQTNueXV5RVZuSmE3N0ZmNVR2VmgwWld2QWgyRgpUNitWek14OENTVnllZzFCNzVUNWRTRG5aLzZ3bGwzMk5oZnZMajdFOHRGRlJBWHdPaHRicEJNS1ZUelJoYW5XCnZEcWVrRkUrM1ZnTGh5My9uck5GTVQrejdRWnJBSUV5QWhXZG45cXRtWEsyYmU2c21PZzEyQlAybjd2bHBIQm8KRE1IdmRpMGY2bTc5VlBkdUM2NkhTNm0wOG9jaGZUaHhINHBDUk00ZjZ2R2E1dUFsczRFK3VveUd4cklsZjQ0YgpBWGx4T3RRMk5Kem5vb282c0w0cXNXdS9VZlpBTXVZSmE3WlY4WDNHZ1paSzl2a3JLb3JFa3ZVS212cEpvQT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
|
||||
root-ca.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUY3VENDQTlXZ0F3SUJBZ0lVTC9hTytnYS9YY3lzakFYbGh1WG92d0xLWkJjd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZVXhDekFKQmdOVkJBWVRBa0pFTVE0d0RBWURWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaAphMkV4RWpBUUJnTlZCQW9NQ1VKeWFXeHNhV0Z1ZERFYk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwCklFTkJNU1V3SXdZRFZRUUREQnhDY21sc2JHbGhiblFnVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUI0WERUSTIKTURjeU16RTFNREV4T1ZvWERUTTJNRGN5TURFMU1ERXhPVm93Z1lVeEN6QUpCZ05WQkFZVEFrSkVNUTR3REFZRApWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaGEyRXhFakFRQmdOVkJBb01DVUp5YVd4c2FXRnVkREViCk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwSUVOQk1TVXdJd1lEVlFRRERCeENjbWxzYkdsaGJuUWcKVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUlJQ0lqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FnOEFNSUlDQ2dLQwpBZ0VBdXlEYmRaMUFycWd6K1l3SkNUcWlxREtuUzNDRGhHekNxK0h5WDN3clBnV0JvZFBraHJCV3dkNzQ4ZjdqClhZWDNQditQS0F0ZzVGYjdxa2ZZUFZJR0FPZUNiUWxkRlJnZld0S2F2MkdxcHZseUlKcy9OZW5PZzFZQ3IydVUKbDE3UnFPNk1BSGt6d1pNTVFDV1JXMlFiUy9weVY0VHd6dkNxSTR1ZVpzOFJ4MndwbERJdWFPVXdJMEVTMG8zdQpWdDJHMVlCTWlFOUNVTDliQWlYbWQ0UTR4a1NFRFRvOVY1SVk3Z2dHYjFTU0xWU2x6RDJHZElaMGN3VlE2LzcwCnUrQ1FPa005ZXhIRVR2eGpGTmZ4azI2YlRZVUJmNnBNS2VpSDdMbC9ucjZFVVVzTW5DSUR5VGtnK3Zta1M5ZWoKUmY1R0QwQ00rcnl1V1BiRHlHOCtzcDh4d1N1ZkcydDdkUGZRSTUzd1Zzc1BKSkk5b0lsZ0lJWXkyMkFUMlo4RwpKL2dZbmYwMU5LREhSV1dBU2FQaTBLT2dURldqRG5xam94Q0FHZjVGVFRJSHdBQjVsMS8rMXZFbEkyNjQ2M2d4CnBWcTk4Vyt4U3FQQ0xaTW9sWlE5TVkwbjVHeGgvZjhkK0RPb1BVT0lXazJqWXdvS1JGQXJiTlNTNnkySnVrS3YKSWNvMnN4YUhqZkhrdDdqdDBkckRLcjUrelI5bndUWDhVN3hBaWlTYkVTekN6OWlvdU9QSEcxMFFtdzl6VVRNMgoxdzJmMmlQRWpvbFpBVjFBaFU3dzFWNHBzc3JpWDIvNTlDR1dYT1VEcWNnd2MwdWh4djRnWFRndXBCeGcrYU5yCllybWZwNndtejdzN3lmblh3T2xVaVRDRW1Bc2NBemNkMmdCaGwvN1dpcmFRZFVzQ0F3RUFBYU5UTUZFd0hRWUQKVlIwT0JCWUVGSGJhbmo2RkdNVWZ3bEMwSytqY081TTlHd0FwTUI4R0ExVWRJd1FZTUJhQUZIYmFuajZGR01VZgp3bEMwSytqY081TTlHd0FwTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3RFFZSktvWklodmNOQVFFTEJRQURnZ0lCCkFBZVVVVUFMTk5FNDM2UEwvZXl6V0c3bmlPdndXODF3UkdVdGdEUnJpY2xFWjh0K3MzUG9MOXRibyszUGN1ekgKakxsUFArYmVLY2tUTEZKVGZZWUN3Z0dWZkdIRXE1ejV1SUt3ZWIyMG9GSEg3ek9DSzF3VVJBSUlPZnFycncyMApjcWNzdTRnK3NENnl0bllWN2Y1T0RFT2RNaXpjVXRrbGpMSjVieXJLSU9OV2FrSTBpd0xLeXFPQWlGeUVSY2xiCjB0ZzhoTDR6dkRLVUZ6dVJycXhxS0padzNWUWUvM1JWUFYwZ0RLUW96VEQ0M3lnQUdGVlVjckx1dHZOK2V5bEEKVDdYMGtNZXJlVVRKd1N6RDVvenhGRXFkaDlLNHZkZTA2a3BuSXpQS2tEanNFZiszeW9WeFVxRGJCeGV3ai9aOApodzhmT3lBWC9jV2UvZlhmWVdPV3RpTlhiQVJRd0pvUWlLb3lacHRuNGpvRXhLWVB2Qzg0RitINEZnZnpidXFkCnNnL2R2SjBxcldGaUlZeWZBRS9NNGM3VTBDUnVsZ1lETXJhbktIUHhxTllVT21pRzM4T0xLTDlFMmlvV002UHYKek82djVvUk5pazFFN3BrRUVMSUFPczR3U2MvdG45MU01TmtpSjgyRXNEQ2ZaVG5FVU9Cd3VsRzZSbW8vYWF0agpCWUJEaHo0dnhmN0ZjNG13WEdXNVZXc1Qzd2ZVckErZ3l3VWo5dlFqTTV6SjEybDl4NU9Dd3pNMTJuQWdSZ1dFCkh4ZDh5TFhkNE9rTWRaRWNVckY5eWtSMGJUZ3AyWnowL3lPR21KbVpieHRNdHlGaTVMcmt6VElodWJNS1l2bncKcWsrbWdaUmNMcXBWclRSYTNiaGdEVzJrSWpFT2I5SHB6NG5MZ3loUVpCMFAKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: opensearch-admin-cert
|
||||
namespace: observability
|
||||
@@ -0,0 +1,9 @@
|
||||
apiVersion: v1
|
||||
data:
|
||||
node-0-key.pem: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2Z0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktnd2dnU2tBZ0VBQW9JQkFRQzFoS3BOR1F2akRwQTYKbDhPVWpOcEFhUVh4RzIrOWh1Ulc3Qi9Md1I4eUYwWlFFRnBwQXhMdUdUNm9WNDAyWERWK2xUaEV3KzJ6QmZjZgpFeEZPYTRFRE02a0M0Z2Q2S0FBOEtWK0swc2xaanFuMDh0Unl3ZmRNa3ZFU01CYThRRGpITExsckFOSEUrTnZQCm5YeHVhakh0bEpNRDdMYUhHV2Q4QkpRcXdqTHY2cEt0aitaMmI5M25XY1JLRzBrNVg2YWdIWHB1emZXZWcwYjgKRUxDbEVoUWppdmNBTUQvTzJCM2JYSnBhUmIyYzUrWExZZDBhMHVUbjEveUR2WEQyZ3Evb1kzbEpVY3N5RTNKMgpjemxab1IvT1diTFZZcWhueHprcjRobXdFOE5Ra3VpbkhUZ0h1QUxDNTNvbUxLVThiRVhoRmVXbms0WnFRaEV4CkszTVl2OFhOQWdNQkFBRUNnZ0VBQmJOelR5cVY0ZjFuY0QrclVvaTkrTDgrV0RLVUVZVjJ1YzErdU5LSm5VbDMKMllua25RbTRyWHU0MDd3Smk3SGRDRUJvTWxpenFDZHNKSVlLZEJ1ODdlY2x6QmtNbDd5V2pVMHJXckVyY1JiMgordUlwanFwNE9aSjFPZGRZSk1vZzZRM2NOazBoOUNnYmJKWTEvZTNJbGFmN1JMMzBMdmdRU2xLR2ZoLzMrT3I5Ck1JQmVpMUxEQ1RFNUdRUVFwV0dZWEpOTmcyU0F6R3NXdlpYTmdmS0Z5MGVlT0VDMUt3TE5xaWNMMnRRUit6ZGwKL1Qxc3hWenUzQ05aSUlVQW1nVXg5c1dqcGJtU3UzMy81azFQS3U3SXVKcDRtek00Qkw1OFZWakU1N2pTN05nQgpRTjRiLzZOb0ZleFFGdXdkQStlZVd5TU9NM0FmdkpQR3NUNlNBaXBNWVFLQmdRRHV1WFd5eVFwSkorbWh2T0l6CmxGZm9GVFd6VTVuQnpjKytJSjlkRE0rTEdOaVJVaXlUZkdIdDdRM1E5OFFtSDF0M0tland3dkN5Z2xpeFhxNkoKa3hMZXEzOFk3cks1MU1PSHQxeDNDRWdWeFY5b2N3WTBSUklDVzJ4cHRiZjZVbzlZYituZmpqSHlDZU9hODhSdwp5cW9qYi9WNk1MUlVFSVY3UkRtMmczc2JsUUtCZ1FEQ3AydGV0UHltSDh0alp5VVBxU1ZnZnV5b29hWUZXZVh0CldXZm5kcGU0bmp2NVUzQlNoTXRzTnk4OGtieFJ1U2llVDNXYThubFN1WGJZUGJXVzRBcTBXSmYxbzNub0VKRDAKM2JNejRaV2NOUnNqNlQ1K2dTc1JjTU5ZOEdhbVFEQlRTZm9tb2ZvdVBhdkY2NGZ0ZDRablFCS2RKdWJDL2MyWApWU0svMllLeldRS0JnUUNWUVZFc1VmUGpYMWY4Ym9zQzhybXZlaXRVRG0zd3RRd3c5RmFQSitaUE1sNmRKVUtICmg5bjJseUx2UnluVkovL1kxbFEweTcwUDd0MGpNRzV4eDRtaHZKbS9iZVpDdDVyMHJKamNOMHBTaWsrbmoxc08KclN5Z1dxYkN4UUhkT1djMFJPeDFnSU1Mc0ZFazNVb3h0eFIvQ1kzeU1xZGNjK1B3K093WWg4WWRyUUtCZ1FDLwphRm5RV3pCRk91YUk3SmdvK2k3aTRHeGV0ZlhITlVzL1JiZENoLzlSYjJlU0dGWlBEbjNwLzZuWGFZZEE1VTNuCnZrTHJCcHYrbUprZ3NpMnFHc3pyNG1JckRZR0dqU085WlhRZUJDbFYzWEsrc1ZEZW5LMTVET1ZLdzdwc3FKbmMKak5ZS3Z5Ui82K3pKUm4zM0tKMWxVai83Z0pGU0ZMamhvcm4wNVRIOG9RS0JnQjhMZ1BGZFMvV3R5anJPS0J1OAo0d2hCRmZFZHcxNnlZNVRHQ0xwQmNoMUdrV3hBcGd1S3QyTmlVc01lMDdSd1daQndTWUNsdXBEVUNiVFVoeEJKClNlSXFDWENobWdtU2NFdlg2TEdHSXlFOU1GUXozbG52bmd1SE5KL0pwTUZGU291TStmR2g4eXY3WEJpY0JBR0sKeit6aXZwK2REZkVLYzVVd08xc3YvVVQzCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
|
||||
node-0.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUhyVENDQlpXZ0F3SUJBZ0lVSXljc3FkNHF1b2d4ancxRTRLangzd0J0Ylc0d0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZVXhDekFKQmdOVkJBWVRBa0pFTVE0d0RBWURWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaAphMkV4RWpBUUJnTlZCQW9NQ1VKeWFXeHNhV0Z1ZERFYk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwCklFTkJNU1V3SXdZRFZRUUREQnhDY21sc2JHbGhiblFnVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUI0WERUSTIKTURjeU16RTFNVE15TjFvWERUSTRNVEF5TlRFMU1UTXlOMW93ZWpFTE1Ba0dBMVVFQmhNQ1FrUXhEakFNQmdOVgpCQWdNQlVSb1lXdGhNUTR3REFZRFZRUUhEQVZFYUdGcllURVNNQkFHQTFVRUNnd0pRbkpwYkd4cFlXNTBNUmt3CkZ3WURWUVFMREJCUGNHVnVVMlZoY21Ob0lFNXZaR1Z6TVJ3d0dnWURWUVFEREJOdmNHVnVjMlZoY21Ob0xXMWgKYzNSbGNpMHdNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXRZU3FUUmtMNHc2UQpPcGZEbEl6YVFHa0Y4UnR2dllia1Z1d2Z5OEVmTWhkR1VCQmFhUU1TN2hrK3FGZU5ObHcxZnBVNFJNUHRzd1gzCkh4TVJUbXVCQXpPcEF1SUhlaWdBUENsZml0TEpXWTZwOVBMVWNzSDNUSkx4RWpBV3ZFQTR4eXk1YXdEUnhQamIKejUxOGJtb3g3WlNUQSt5Mmh4bG5mQVNVS3NJeTcrcVNyWS9tZG0vZDUxbkVTaHRKT1YrbW9CMTZiczMxbm9ORwovQkN3cFJJVUk0cjNBREEvenRnZDIxeWFXa1c5bk9mbHkySGRHdExrNTlmOGc3MXc5b0t2NkdONVNWSExNaE55CmRuTTVXYUVmemxteTFXS29aOGM1SytJWnNCUERVSkxvcHgwNEI3Z0N3dWQ2Sml5bFBHeEY0UlhscDVPR2FrSVIKTVN0ekdML0Z6UUlEQVFBQm80SURIVENDQXhrd0RBWURWUjBUQVFIL0JBSXdBREFPQmdOVkhROEJBZjhFQkFNQwpCYUF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01CMEdBMVVkRGdRV0JCU2R2Y1IzCjU1R1hRUFNjY0xlNncyL0xpTkNIMGpBZkJnTlZIU01FR0RBV2dCUjIycDQraFJqRkg4SlF0Q3ZvM0R1VFBSc0EKS1RDQ0FwZ0dBMVVkRVFTQ0FvOHdnZ0tMZ2lWaWNtbHNiR2xoYm5RdGIzQmxibk5sWVhKamFDMWpiSFZ6ZEdWeQpMVzFoYzNSbGNpMHdnbEppY21sc2JHbGhiblF0YjNCbGJuTmxZWEpqYUMxamJIVnpkR1Z5TFcxaGMzUmxjaTB3CkxtSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxXaGxZV1JzWlhOemdtQmkKY21sc2JHbGhiblF0YjNCbGJuTmxZWEpqYUMxamJIVnpkR1Z5TFcxaGMzUmxjaTB3TG1KeWFXeHNhV0Z1ZEMxdgpjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxXaGxZV1JzWlhOekxtOWljMlZ5ZG1GaWFXeHBkSG1DClpHSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxUQXVZbkpwYkd4cFlXNTAKTFc5d1pXNXpaV0Z5WTJndFkyeDFjM1JsY2kxdFlYTjBaWEl0YUdWaFpHeGxjM011YjJKelpYSjJZV0pwYkdsMAplUzV6ZG1PQ2NtSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxUQXVZbkpwCmJHeHBZVzUwTFc5d1pXNXpaV0Z5WTJndFkyeDFjM1JsY2kxdFlYTjBaWEl0YUdWaFpHeGxjM011YjJKelpYSjIKWVdKcGJHbDBlUzV6ZG1NdVkyeDFjM1JsY2k1c2IyTmhiSUlqWW5KcGJHeHBZVzUwTFc5d1pXNXpaV0Z5WTJndApZMngxYzNSbGNpMXRZWE4wWlhLQ01XSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6CmRHVnlMbTlpYzJWeWRtRmlhV3hwZEhtQ05XSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXQKYldGemRHVnlMbTlpYzJWeWRtRmlhV3hwZEhrdWMzWmpna05pY21sc2JHbGhiblF0YjNCbGJuTmxZWEpqYUMxagpiSFZ6ZEdWeUxXMWhjM1JsY2k1dlluTmxjblpoWW1sc2FYUjVMbk4yWXk1amJIVnpkR1Z5TG14dlkyRnNNQTBHCkNTcUdTSWIzRFFFQkN3VUFBNElDQVFCTXNUNUIrQnNWemRrcDRkaktDV0p1S2tNeWJidHRZb2xWeXpabXF6N0YKbE9vUEcvM3BVMUx4akgrVUsxWVRITmZaYUZvVGpRL09YVC9ORnJmL3JIQ2ZjQnFkYmNWNVZyWTlKaUVESFd1cwpiNGR4RkU3V0JaVTU0KzI1V1g5dnVHMFZUeHNnSDA4RUMvTVdwOENHandYSmhxamlRdkk0aWhGand1VnR0MVI1Cm9MWGZYS29BMEMxNjVHUFZjVmZ0a3FWcUovZWNlOS9teGNhSmVuQXY4d0dvRjlWcGFtSk1mL3IreDEvTE9YTnQKdmk1UmNOZGZMU3loOTdNRGhNYkVCMktsZE9ZYy9hNHpKS3lySGw2aWpacFA3WTdSUFFxMU9sQzRnWVFlLzd4aQpOZC9UdlpySXk0NDhPWFc3OUVlKzNIbWcweGJ6ZFltalBwNXFsWFBzaHdGWGtreU5sQWdWdVNwRk8wb2dmak9OCnlIN3FWRE5hbUhQNVZBKytJdTQxNVYxYVQvK0VGYWI3b2VIM2ozWklyTzFZeW1CL05TT1MvUXZzZEVBcHo0ZUkKVWpsdXFWdDg3aDd3Vm5OelJaMVJGWDk4YlhtQTUrNFRUYmRyMkZNenJvMC81T20rU285aEpxN1phc05Ba0RQagpxbzFJWVlmN0FUek5EOEtMVEJVRjl4OXl1V0ZOdlk2NDhuNzJzRzI2emgzWnNnaXpXZHpNKzY3emFXQUpPclFrCmZqbWdBMk5ZcUZqTWJROU1DWHcwTGpLUk9RTFZoc2hXTlF4RDJhd3lDOUwrYk5hcUUzMlFJK3hIOG53bWpRekwKaGlsdFlhczR5WFNjMmxocURiSytWMnJVR2JLNXBjTSt6MXJkNVE3L2hUcnNUaUp1YjlubGNDdGFpL1pCRnpPKwpIdz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
|
||||
root-ca.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUY3VENDQTlXZ0F3SUJBZ0lVTC9hTytnYS9YY3lzakFYbGh1WG92d0xLWkJjd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZVXhDekFKQmdOVkJBWVRBa0pFTVE0d0RBWURWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaAphMkV4RWpBUUJnTlZCQW9NQ1VKeWFXeHNhV0Z1ZERFYk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwCklFTkJNU1V3SXdZRFZRUUREQnhDY21sc2JHbGhiblFnVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUI0WERUSTIKTURjeU16RTFNREV4T1ZvWERUTTJNRGN5TURFMU1ERXhPVm93Z1lVeEN6QUpCZ05WQkFZVEFrSkVNUTR3REFZRApWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaGEyRXhFakFRQmdOVkJBb01DVUp5YVd4c2FXRnVkREViCk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwSUVOQk1TVXdJd1lEVlFRRERCeENjbWxzYkdsaGJuUWcKVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUlJQ0lqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FnOEFNSUlDQ2dLQwpBZ0VBdXlEYmRaMUFycWd6K1l3SkNUcWlxREtuUzNDRGhHekNxK0h5WDN3clBnV0JvZFBraHJCV3dkNzQ4ZjdqClhZWDNQditQS0F0ZzVGYjdxa2ZZUFZJR0FPZUNiUWxkRlJnZld0S2F2MkdxcHZseUlKcy9OZW5PZzFZQ3IydVUKbDE3UnFPNk1BSGt6d1pNTVFDV1JXMlFiUy9weVY0VHd6dkNxSTR1ZVpzOFJ4MndwbERJdWFPVXdJMEVTMG8zdQpWdDJHMVlCTWlFOUNVTDliQWlYbWQ0UTR4a1NFRFRvOVY1SVk3Z2dHYjFTU0xWU2x6RDJHZElaMGN3VlE2LzcwCnUrQ1FPa005ZXhIRVR2eGpGTmZ4azI2YlRZVUJmNnBNS2VpSDdMbC9ucjZFVVVzTW5DSUR5VGtnK3Zta1M5ZWoKUmY1R0QwQ00rcnl1V1BiRHlHOCtzcDh4d1N1ZkcydDdkUGZRSTUzd1Zzc1BKSkk5b0lsZ0lJWXkyMkFUMlo4RwpKL2dZbmYwMU5LREhSV1dBU2FQaTBLT2dURldqRG5xam94Q0FHZjVGVFRJSHdBQjVsMS8rMXZFbEkyNjQ2M2d4CnBWcTk4Vyt4U3FQQ0xaTW9sWlE5TVkwbjVHeGgvZjhkK0RPb1BVT0lXazJqWXdvS1JGQXJiTlNTNnkySnVrS3YKSWNvMnN4YUhqZkhrdDdqdDBkckRLcjUrelI5bndUWDhVN3hBaWlTYkVTekN6OWlvdU9QSEcxMFFtdzl6VVRNMgoxdzJmMmlQRWpvbFpBVjFBaFU3dzFWNHBzc3JpWDIvNTlDR1dYT1VEcWNnd2MwdWh4djRnWFRndXBCeGcrYU5yCllybWZwNndtejdzN3lmblh3T2xVaVRDRW1Bc2NBemNkMmdCaGwvN1dpcmFRZFVzQ0F3RUFBYU5UTUZFd0hRWUQKVlIwT0JCWUVGSGJhbmo2RkdNVWZ3bEMwSytqY081TTlHd0FwTUI4R0ExVWRJd1FZTUJhQUZIYmFuajZGR01VZgp3bEMwSytqY081TTlHd0FwTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3RFFZSktvWklodmNOQVFFTEJRQURnZ0lCCkFBZVVVVUFMTk5FNDM2UEwvZXl6V0c3bmlPdndXODF3UkdVdGdEUnJpY2xFWjh0K3MzUG9MOXRibyszUGN1ekgKakxsUFArYmVLY2tUTEZKVGZZWUN3Z0dWZkdIRXE1ejV1SUt3ZWIyMG9GSEg3ek9DSzF3VVJBSUlPZnFycncyMApjcWNzdTRnK3NENnl0bllWN2Y1T0RFT2RNaXpjVXRrbGpMSjVieXJLSU9OV2FrSTBpd0xLeXFPQWlGeUVSY2xiCjB0ZzhoTDR6dkRLVUZ6dVJycXhxS0padzNWUWUvM1JWUFYwZ0RLUW96VEQ0M3lnQUdGVlVjckx1dHZOK2V5bEEKVDdYMGtNZXJlVVRKd1N6RDVvenhGRXFkaDlLNHZkZTA2a3BuSXpQS2tEanNFZiszeW9WeFVxRGJCeGV3ai9aOApodzhmT3lBWC9jV2UvZlhmWVdPV3RpTlhiQVJRd0pvUWlLb3lacHRuNGpvRXhLWVB2Qzg0RitINEZnZnpidXFkCnNnL2R2SjBxcldGaUlZeWZBRS9NNGM3VTBDUnVsZ1lETXJhbktIUHhxTllVT21pRzM4T0xLTDlFMmlvV002UHYKek82djVvUk5pazFFN3BrRUVMSUFPczR3U2MvdG45MU01TmtpSjgyRXNEQ2ZaVG5FVU9Cd3VsRzZSbW8vYWF0agpCWUJEaHo0dnhmN0ZjNG13WEdXNVZXc1Qzd2ZVckErZ3l3VWo5dlFqTTV6SjEybDl4NU9Dd3pNMTJuQWdSZ1dFCkh4ZDh5TFhkNE9rTWRaRWNVckY5eWtSMGJUZ3AyWnowL3lPR21KbVpieHRNdHlGaTVMcmt6VElodWJNS1l2bncKcWsrbWdaUmNMcXBWclRSYTNiaGdEVzJrSWpFT2I5SHB6NG5MZ3loUVpCMFAKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: opensearch-node-0-cert
|
||||
namespace: observability
|
||||
@@ -0,0 +1,9 @@
|
||||
apiVersion: v1
|
||||
data:
|
||||
node-1-key.pem: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2d0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktrd2dnU2xBZ0VBQW9JQkFRRGtMSk41UlZ0dGxCeDcKYlBoTGxjMThWdFMwVEYreGRqQ2FXbkw2RVM4OWowZkd4SzlzUGR6ektpMndYelA5RkFOVXRPakNXMmhTNVJySQpJdlZBZ1ROZUFqSTc4NUtLSExFd0FaU2xCZjV4cXA3aTlKbXJSOFMxSnNQMHV3c1orM3B4cHVMTzBPbFVTbzBICnpkanZwMGpPRzAzTXZGTjB3OFJnN1hlL3VhZzZPYjRDeFYzZUJ3YXYyZDVwMk83ZmdvemVEeW5Qd0hQck9YLzgKcDFISWtKRTZ5aC9yWjJKUmprVnV4ZDlaM0cybHVFRXlIN2MrRzhVbzhFK3NEOVBibm1ad2o5bDV4U1Ruck10LwpSbXJLN3JyVTFYMDdTSzBDWENrSW5BUlA1MGwzbmhwaU9HTDM0MHdldnhzSzNtRzFkWG41UzRwcnc3MHR0dms5Cm1KT0pRNjBoQWdNQkFBRUNnZ0VBSWI1bDROMWM5QXVmV3JGMjF0YkVtTXJPa2d0cGEza3JIdWlaY0ZueVBveGQKOVF0SlZoeWYvR1lVYzZ6Z3AyQzZUV0NqdTNxQkp5RXlvTDVxdnF0Y3lWNVJ4NFB4Ky9MYVVWc3FmRzB5ZitUWApzb0N4NlI2bi9KSkxFSHBJM2dMT3pOZjlXdENTY1NERlVvNGlzdTV1V2V5M3lMdGhMRGQzWjA0M0UyZUZkWGFsCkJSUEZvbEZ0ekc4d3BxS3R5K09taDljVXJBSFUwODdxS3cwcmJXVUhkN1JTUERSTXluMXY3dU9kSXZQQ241N28KQ1plMHNyQjVLbzNha0F5YUFRVVhQd25UWnlVeXVJdS9KWmtha3ZOMDE1cXhicW5WODZVOUpMQ1IwMVl4R055YQo4dHpkQXpPa1d2Yyt2b21WbExqNmw0aWx6OENrZ0lmYW50L1psQ2lWTVFLQmdRRC8zUGtwVFg3WnM5NkNvOEdqClNuSitwOG9hU0xFY2xHRXE0REVDb1JXanBhb1N2Z0J0WVVzMzhaSnBvdVh6ZEtFZmd6eHlrYUlkdDRYRXBBb2oKejVBenRRMWN5OTlqMjBSa2RoaU16SkFSc1pPcDZ2Zm9GQnFMV0pFY3VmRHB1cXYrRDdFT0t3Rjc0YlNyRll0Zgp6eThRYTRVRVhqSUZZSXFEOVg1QWRVWTlTd0tCZ1FEa1M4L3Y4SmlubVh4d2J3eTM2bVNlM2JCa1NVcXlYcXVXCnE2UVkvZGNrTDdQcWdrZjVUV1BZM1Z1Mm44MEU3cGZ1MmE4NTFYQW1KZVk4RHJOVU1OalY5dmIxaGFDYlk3ZjMKMmlnTk9EYndzTDJFNGUwZkE3bTVVVy9YODVKTzI4QjFUQmExREs0Titpd1lpUVVqSHFCeW9HUUV1TVVQSlgyNgpoTW5vNVR2WHd3S0JnUURsektTbitPYytSak5KcUNRcE1ac2xzRE52YWV4UW05K3RiNC8xS1pKUzJWNm4yS2h2CmxOdkcwaHZLN3JpUzhTUXBObWhiQ2Z2TnJ0L2czZWdSZzhHaS96Q1NNTFZoYlRTKytlWlF4d1Y2THNCTjh6QlcKNjM5dnVjc1RQdGxtUXZkb2h0Vmh3VFJpL0RPVkdST0ZxSUkvd0NIRzY0Y0hsMDZ3K0JNOWQxYnZnd0tCZ1FDMwpCbVNOUzBsSFRKRHNIc3VHZ3Y3cU1uYmczN1ZuN09nSm9rK3J6WTMycjl2QXpYUGdWWUFQODk4OE9UOEhqalQyClEwVHN5OFhlZjVIbVlpNjQ5M1JQalhBT0JIUnZQM0hVM2V3d05Qb3Uyck1GM283WXg0YlZJSW5YQ3Fvb1dKc2kKTHI4aHBTbkJnT2hyUHlhRU1tQ1ZwU3FxY210aHFqL3pFZFJCeDgzRE93S0JnUUNkTHQxVm5IR1ZqZ1F6b3J0WApycWNtQnU0bUtyWmFLdGxsM3lOS0MzNkh3OGgzU3FZUm5VTlZmK2pPUE8zM3NSR3JyNFZCTEtveEM0NEljdG9oClc2WjgvRmZCWDJIMDUzNjNHUkUxNmRGOFZ5YTN3b0xRUGpTcy9pQWdYR3psNXlSUFlhTWs2VlF4QjZwcytGOHEKWVpyNnoxMHNYQXRCbEszeU1FS1hVQldtL3c9PQotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0tCg==
|
||||
node-1.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUhyVENDQlpXZ0F3SUJBZ0lVSXljc3FkNHF1b2d4ancxRTRLangzd0J0YlhBd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZVXhDekFKQmdOVkJBWVRBa0pFTVE0d0RBWURWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaAphMkV4RWpBUUJnTlZCQW9NQ1VKeWFXeHNhV0Z1ZERFYk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwCklFTkJNU1V3SXdZRFZRUUREQnhDY21sc2JHbGhiblFnVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUI0WERUSTIKTURjeU16RTFNalF3TUZvWERUSTRNVEF5TlRFMU1qUXdNRm93ZWpFTE1Ba0dBMVVFQmhNQ1FrUXhEakFNQmdOVgpCQWdNQlVSb1lXdGhNUTR3REFZRFZRUUhEQVZFYUdGcllURVNNQkFHQTFVRUNnd0pRbkpwYkd4cFlXNTBNUmt3CkZ3WURWUVFMREJCUGNHVnVVMlZoY21Ob0lFNXZaR1Z6TVJ3d0dnWURWUVFEREJOdmNHVnVjMlZoY21Ob0xXMWgKYzNSbGNpMHhNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQTVDeVRlVVZiYlpRYwplMno0UzVYTmZGYlV0RXhmc1hZd21scHkraEV2UFk5SHhzU3ZiRDNjOHlvdHNGOHovUlFEVkxUb3dsdG9VdVVhCnlDTDFRSUV6WGdJeU8vT1NpaHl4TUFHVXBRWCtjYXFlNHZTWnEwZkV0U2JEOUxzTEdmdDZjYWJpenREcFZFcU4KQjgzWTc2ZEl6aHROekx4VGRNUEVZTzEzdjdtb09qbStBc1ZkM2djR3I5bmVhZGp1MzRLTTNnOHB6OEJ6NnpsLwovS2RSeUpDUk9zb2Y2MmRpVVk1RmJzWGZXZHh0cGJoQk1oKzNQaHZGS1BCUHJBL1QyNTVtY0kvWmVjVWs1NnpMCmYwWnF5dTY2MU5WOU8waXRBbHdwQ0p3RVQrZEpkNTRhWWpoaTkrTk1IcjhiQ3Q1aHRYVjUrVXVLYThPOUxiYjUKUFppVGlVT3RJUUlEQVFBQm80SURIVENDQXhrd0RBWURWUjBUQVFIL0JBSXdBREFPQmdOVkhROEJBZjhFQkFNQwpCYUF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01CMEdBMVVkRGdRV0JCUTd2UE9PClFuWWpLZjRKRlFRT0tqN3plM2ozZHpBZkJnTlZIU01FR0RBV2dCUjIycDQraFJqRkg4SlF0Q3ZvM0R1VFBSc0EKS1RDQ0FwZ0dBMVVkRVFTQ0FvOHdnZ0tMZ2lWaWNtbHNiR2xoYm5RdGIzQmxibk5sWVhKamFDMWpiSFZ6ZEdWeQpMVzFoYzNSbGNpMHhnbEppY21sc2JHbGhiblF0YjNCbGJuTmxZWEpqYUMxamJIVnpkR1Z5TFcxaGMzUmxjaTB4CkxtSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxXaGxZV1JzWlhOemdtQmkKY21sc2JHbGhiblF0YjNCbGJuTmxZWEpqYUMxamJIVnpkR1Z5TFcxaGMzUmxjaTB4TG1KeWFXeHNhV0Z1ZEMxdgpjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxXaGxZV1JzWlhOekxtOWljMlZ5ZG1GaWFXeHBkSG1DClpHSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxURXVZbkpwYkd4cFlXNTAKTFc5d1pXNXpaV0Z5WTJndFkyeDFjM1JsY2kxdFlYTjBaWEl0YUdWaFpHeGxjM011YjJKelpYSjJZV0pwYkdsMAplUzV6ZG1PQ2NtSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxURXVZbkpwCmJHeHBZVzUwTFc5d1pXNXpaV0Z5WTJndFkyeDFjM1JsY2kxdFlYTjBaWEl0YUdWaFpHeGxjM011YjJKelpYSjIKWVdKcGJHbDBlUzV6ZG1NdVkyeDFjM1JsY2k1c2IyTmhiSUlqWW5KcGJHeHBZVzUwTFc5d1pXNXpaV0Z5WTJndApZMngxYzNSbGNpMXRZWE4wWlhLQ01XSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6CmRHVnlMbTlpYzJWeWRtRmlhV3hwZEhtQ05XSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXQKYldGemRHVnlMbTlpYzJWeWRtRmlhV3hwZEhrdWMzWmpna05pY21sc2JHbGhiblF0YjNCbGJuTmxZWEpqYUMxagpiSFZ6ZEdWeUxXMWhjM1JsY2k1dlluTmxjblpoWW1sc2FYUjVMbk4yWXk1amJIVnpkR1Z5TG14dlkyRnNNQTBHCkNTcUdTSWIzRFFFQkN3VUFBNElDQVFCQWpCbDUxOURUdllMVndKZmVQcWtwckw3RlBhTlFaVmkxZ0hLTFFhekIKSVNpZnVrZjI5WktEWGczRDNNV0orVDhWQXpaZ0JFQUFRLzNHOCt1N0ZUOFRuMjJJMUtmZjRLYkdDTHBQNjl0UwpHYkhZVEwzVjYxZjlNTkdLa3lpVGh1SG1PLzhISjFWQXNLamZ6N3BQMHA5VEJIRHBuYWNGSWNRTGFBcEdiaWJ4CmhRa3Q3OXFlaDN2YVpUL0hnV1lpenNxQWs4STJ6NDdLRUVCVWR0TjFWcmJiL0RBNW93ejh3M2NPNEcxbmVUS2wKQVZZS05TakNVYkV4UEN0aXZuckpzQUwvcmRJZnNMdERKQ3RBNFRFbW91UitLYzJkNWRsa1Y0S2dzeUFRMzRGWApTbzQyMVp4Qk92ZjQyN2JJN0crT0YzSXVmclk0N0xBYUpyeXBjd2ZVNitRSVdNckMrWnk2VXNtak15NTIzRTY3CldSUC9Wb0ErSmV6ck5XaFR1QkI3VDN0b3pDVlFlSmdnMkhyMkVDN0VVbnZUWWdOMjVubzJpWXFJejZ0Y1VWV0gKSEV2LzlGUFFlcUIzZ3pHczJnWXk3UUVZaXF3UUk4amxNbEFEZ0tra1hjbGlUWkhJYUpUV3Bwby9ZQVF3T1ZqUgptb2lhRUR4UHFEZnZLREZNdjlzQWVBdXRkL0xJVHlITHVOV0RXTVJlYndLR3ZoZlJjdlhJM084ek5CbTFjY0U1CnVTdmRObWZIMnh2aEhUa1dkdUplc1E4cFJIOUI5OTdoTTZ0NklxblVsN0tqNXhQYUNIWEEyZzRhemFocVRqd0wKQTRaaXZUYjhNU3A4WktLUDF4amR2KzNpdi9zQm5oVUZYV0taNGZjZTZjaW9KKzBrRENnT0p3eTJhUlNkazNNUgpzQT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
|
||||
root-ca.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUY3VENDQTlXZ0F3SUJBZ0lVTC9hTytnYS9YY3lzakFYbGh1WG92d0xLWkJjd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZVXhDekFKQmdOVkJBWVRBa0pFTVE0d0RBWURWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaAphMkV4RWpBUUJnTlZCQW9NQ1VKeWFXeHNhV0Z1ZERFYk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwCklFTkJNU1V3SXdZRFZRUUREQnhDY21sc2JHbGhiblFnVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUI0WERUSTIKTURjeU16RTFNREV4T1ZvWERUTTJNRGN5TURFMU1ERXhPVm93Z1lVeEN6QUpCZ05WQkFZVEFrSkVNUTR3REFZRApWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaGEyRXhFakFRQmdOVkJBb01DVUp5YVd4c2FXRnVkREViCk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwSUVOQk1TVXdJd1lEVlFRRERCeENjbWxzYkdsaGJuUWcKVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUlJQ0lqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FnOEFNSUlDQ2dLQwpBZ0VBdXlEYmRaMUFycWd6K1l3SkNUcWlxREtuUzNDRGhHekNxK0h5WDN3clBnV0JvZFBraHJCV3dkNzQ4ZjdqClhZWDNQditQS0F0ZzVGYjdxa2ZZUFZJR0FPZUNiUWxkRlJnZld0S2F2MkdxcHZseUlKcy9OZW5PZzFZQ3IydVUKbDE3UnFPNk1BSGt6d1pNTVFDV1JXMlFiUy9weVY0VHd6dkNxSTR1ZVpzOFJ4MndwbERJdWFPVXdJMEVTMG8zdQpWdDJHMVlCTWlFOUNVTDliQWlYbWQ0UTR4a1NFRFRvOVY1SVk3Z2dHYjFTU0xWU2x6RDJHZElaMGN3VlE2LzcwCnUrQ1FPa005ZXhIRVR2eGpGTmZ4azI2YlRZVUJmNnBNS2VpSDdMbC9ucjZFVVVzTW5DSUR5VGtnK3Zta1M5ZWoKUmY1R0QwQ00rcnl1V1BiRHlHOCtzcDh4d1N1ZkcydDdkUGZRSTUzd1Zzc1BKSkk5b0lsZ0lJWXkyMkFUMlo4RwpKL2dZbmYwMU5LREhSV1dBU2FQaTBLT2dURldqRG5xam94Q0FHZjVGVFRJSHdBQjVsMS8rMXZFbEkyNjQ2M2d4CnBWcTk4Vyt4U3FQQ0xaTW9sWlE5TVkwbjVHeGgvZjhkK0RPb1BVT0lXazJqWXdvS1JGQXJiTlNTNnkySnVrS3YKSWNvMnN4YUhqZkhrdDdqdDBkckRLcjUrelI5bndUWDhVN3hBaWlTYkVTekN6OWlvdU9QSEcxMFFtdzl6VVRNMgoxdzJmMmlQRWpvbFpBVjFBaFU3dzFWNHBzc3JpWDIvNTlDR1dYT1VEcWNnd2MwdWh4djRnWFRndXBCeGcrYU5yCllybWZwNndtejdzN3lmblh3T2xVaVRDRW1Bc2NBemNkMmdCaGwvN1dpcmFRZFVzQ0F3RUFBYU5UTUZFd0hRWUQKVlIwT0JCWUVGSGJhbmo2RkdNVWZ3bEMwSytqY081TTlHd0FwTUI4R0ExVWRJd1FZTUJhQUZIYmFuajZGR01VZgp3bEMwSytqY081TTlHd0FwTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3RFFZSktvWklodmNOQVFFTEJRQURnZ0lCCkFBZVVVVUFMTk5FNDM2UEwvZXl6V0c3bmlPdndXODF3UkdVdGdEUnJpY2xFWjh0K3MzUG9MOXRibyszUGN1ekgKakxsUFArYmVLY2tUTEZKVGZZWUN3Z0dWZkdIRXE1ejV1SUt3ZWIyMG9GSEg3ek9DSzF3VVJBSUlPZnFycncyMApjcWNzdTRnK3NENnl0bllWN2Y1T0RFT2RNaXpjVXRrbGpMSjVieXJLSU9OV2FrSTBpd0xLeXFPQWlGeUVSY2xiCjB0ZzhoTDR6dkRLVUZ6dVJycXhxS0padzNWUWUvM1JWUFYwZ0RLUW96VEQ0M3lnQUdGVlVjckx1dHZOK2V5bEEKVDdYMGtNZXJlVVRKd1N6RDVvenhGRXFkaDlLNHZkZTA2a3BuSXpQS2tEanNFZiszeW9WeFVxRGJCeGV3ai9aOApodzhmT3lBWC9jV2UvZlhmWVdPV3RpTlhiQVJRd0pvUWlLb3lacHRuNGpvRXhLWVB2Qzg0RitINEZnZnpidXFkCnNnL2R2SjBxcldGaUlZeWZBRS9NNGM3VTBDUnVsZ1lETXJhbktIUHhxTllVT21pRzM4T0xLTDlFMmlvV002UHYKek82djVvUk5pazFFN3BrRUVMSUFPczR3U2MvdG45MU01TmtpSjgyRXNEQ2ZaVG5FVU9Cd3VsRzZSbW8vYWF0agpCWUJEaHo0dnhmN0ZjNG13WEdXNVZXc1Qzd2ZVckErZ3l3VWo5dlFqTTV6SjEybDl4NU9Dd3pNMTJuQWdSZ1dFCkh4ZDh5TFhkNE9rTWRaRWNVckY5eWtSMGJUZ3AyWnowL3lPR21KbVpieHRNdHlGaTVMcmt6VElodWJNS1l2bncKcWsrbWdaUmNMcXBWclRSYTNiaGdEVzJrSWpFT2I5SHB6NG5MZ3loUVpCMFAKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: opensearch-node-1-cert
|
||||
namespace: observability
|
||||
@@ -0,0 +1,9 @@
|
||||
apiVersion: v1
|
||||
data:
|
||||
node-2-key.pem: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2Z0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktnd2dnU2tBZ0VBQW9JQkFRRERTSjkxNWpYYUZjakEKUEVxMjFGcTgxcHZiNmdVUTZVRUppTUNxQXFTeU9WK3pvWWoyUUVJcDgxWEduWHpTOUFyc0d5VlpEU2xScGIzMgpqUklJS01lRU90N212VHJtMnBIUU1SOW04aTQwMXJqR0djVmI1RWtiK1VTQjNUdXJmdVFpSWpFTFNNTDZVbm02CnJ4dG5IOGZGcFR0TGdMNU9oRWdXeXQyRnhoL0hjeW9oTEhJTFZsUUlLZURrMnI4TWxGOGlwMXhuWUdrQmJja2cKU1AvOWY2K0ZhdnZaTGtnY21YNXFMeDRCTm9WWkZKYWUybi92SGpYSVFPS3NqVHdYSS9IM25RR3dsSHpwaC8vbAphL3NyYkVqb2tlREVsNk1VeE1uNHZPQWkvWERTc1E2MTJvNDE0WmlYcGlZOFczbE5DcER2MmdvSUxwQ3dLVnhuCjluWnYzR1cvQWdNQkFBRUNnZ0VBVFdESlRuNFplSUNKT3lLb3VDa01peWErT3pWUExKUkFJUGIrNEY2THc5TFkKQ09WSXo4cEdiVGp1RS9Uek1PTmlNSXZSRUtnV1p6TzFRYXhFS05kL3R2VmN2VERkMWZ0bEs0bExXQTgrSDlHMQpCVW5RMmNocTc1cWxlbytleFNWU1gvUU1XdHhKNWNZb1ZjQnNxei84ZUdRd1NvcUkzYk9zbk50bFMweGw2ekVVCjJRVitYU1pxWGlZdUswWjVUcHVnZjVLejc3ZURBcmJqbjNUU2tBVnVDbTFlNTAycHM1NXFpMzVodXd4dEFYUUIKU1REVU92ZzNsK3doUnVaREpsNGQ5L2lNWm9wcnJpY2dOYlJsV0RqVFhvMkZZb2ViLzNYVWpZSGtoUWxSSTdJMgpyQjQvZW1PUUhGR2NVaWl0TFJWbE1sakRqZWwzRjJUelJseFNDaS9EQVFLQmdRRDFncy8wRVlmd3JkNWxGV3VUClkrYThySGFESUw5UGNrQUdTVSt0dzJxWEszZ2JaZjAxTzh3eTZzN29pV2tZYmVWdUZOaVhzN0lLbm1aM1ZIZm8KQmNTVG9ySzBWZUZLdUhodmhwWVd6WnBROTc2bXM5ZU4wS1JLTndWWWdWSjlRNTRhTGxPSTVLeFdwU3ZIeTVBWgpGc3NEZW1uaHIyQ1ZSWFAzWEtzWm1uZ3o5d0tCZ1FETG9IZTAvNWhlazJOK3l2alRiN0FxeWpzUkZ1R1Y2TlM4CnlJbDRDUExpNGFUZGFDOHJ5WWtEeWcyVmw0WmR6Qm5XWTFlVTFUOHdobWZRbEJyb1hxWWx6YXlWNjViSVJML3MKMVQ5T1pXak42VDdDK2hFRHNDZmZkNjFCMkd3YzZnMTlkUzZUZ2NKN2hVOWhabjRYNmVGZEhjSkhNbGpsS3dZTQpjZE1XYTdGYWVRS0JnUURzdVBmNE50c2pseElqMTFhRnBFTDcwekxtVnJJQVVZSW9UWkhWVXVJNDVvSUZzUDVICjBPT2dpTVYrYzlmdzVTM2VTWjFhRUxyd0FERitoK1NoeE1YNU1Gd3RBODJhTldweTVvdGJhMTJMQ29ZNnlKZGoKdHpSaUZ0RkJ1RmdvVGdWbzZ4aENtM01NakhBOVVpc2I5ZDFEK2ttVGdYMllFSUt6bFJlcE5VY0htd0tCZ1FESgpEcXJrRnJPV1BxV3hIaXpPYUt0anRNYlp1dVFISnh4WFF4TXBhSHlhdFA0YWQ3S0w0N1RiL3ZlbXl6U3JETW8rCk8xelE0alpBYlpXNEIyVUNKK0taMVJraDlycXRCK1VScmdXU0hPTjgzVjlSR2FVUEpUSlpua3QraG5sSm0zaXkKZGJBRmljeEVObjhJeHpDZDRCcmIzSFJsNURxT0hRc2Q0bzN3eDJrWTBRS0JnRDQzaHloaFRLSkRib2F0blFqbApSb3ozMEZTdzc1T0xxQUFHelFQS1pLdTRBVFFiWWRESzV4N0Vvd2Q4MkJ2YTM3QmVuNTVjVzFObVJUb2NJV0ViCjBKVzYydi9TUzRDVnRvSUZHY0s4VkpVaTRRQkc1OU9vZTdEVEdqSE5GRmE0WUMvN1htQ3VxSG5MVlpYVnZiWisKTHZlUjdBd1N6S0xwckVOczBBSXVabWJpCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
|
||||
node-2.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUhyVENDQlpXZ0F3SUJBZ0lVSXljc3FkNHF1b2d4ancxRTRLangzd0J0YlhFd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZVXhDekFKQmdOVkJBWVRBa0pFTVE0d0RBWURWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaAphMkV4RWpBUUJnTlZCQW9NQ1VKeWFXeHNhV0Z1ZERFYk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwCklFTkJNU1V3SXdZRFZRUUREQnhDY21sc2JHbGhiblFnVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUI0WERUSTIKTURjeU16RTFNalF5T0ZvWERUSTRNVEF5TlRFMU1qUXlPRm93ZWpFTE1Ba0dBMVVFQmhNQ1FrUXhEakFNQmdOVgpCQWdNQlVSb1lXdGhNUTR3REFZRFZRUUhEQVZFYUdGcllURVNNQkFHQTFVRUNnd0pRbkpwYkd4cFlXNTBNUmt3CkZ3WURWUVFMREJCUGNHVnVVMlZoY21Ob0lFNXZaR1Z6TVJ3d0dnWURWUVFEREJOdmNHVnVjMlZoY21Ob0xXMWgKYzNSbGNpMHlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXcwaWZkZVkxMmhYSQp3RHhLdHRSYXZOYWIyK29GRU9sQkNZakFxZ0trc2psZnM2R0k5a0JDS2ZOVnhwMTgwdlFLN0JzbFdRMHBVYVc5CjlvMFNDQ2pIaERyZTVyMDY1dHFSMERFZlp2SXVOTmE0eGhuRlcrUkpHL2xFZ2QwN3EzN2tJaUl4QzBqQytsSjUKdXE4Ylp4L0h4YVU3UzRDK1RvUklGc3JkaGNZZngzTXFJU3h5QzFaVUNDbmc1TnEvREpSZklxZGNaMkJwQVczSgpJRWovL1grdmhXcjcyUzVJSEpsK2FpOGVBVGFGV1JTV250cC83eDQxeUVEaXJJMDhGeVB4OTUwQnNKUjg2WWYvCjVXdjdLMnhJNkpIZ3hKZWpGTVRKK0x6Z0l2MXcwckVPdGRxT05lR1lsNlltUEZ0NVRRcVE3OW9LQ0M2UXNDbGMKWi9aMmI5eGx2d0lEQVFBQm80SURIVENDQXhrd0RBWURWUjBUQVFIL0JBSXdBREFPQmdOVkhROEJBZjhFQkFNQwpCYUF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01CMEdBMVVkRGdRV0JCUXRNaXo3ClU5SDV2a0dzZjZ1NDlHWlVKQ3VsZmpBZkJnTlZIU01FR0RBV2dCUjIycDQraFJqRkg4SlF0Q3ZvM0R1VFBSc0EKS1RDQ0FwZ0dBMVVkRVFTQ0FvOHdnZ0tMZ2lWaWNtbHNiR2xoYm5RdGIzQmxibk5sWVhKamFDMWpiSFZ6ZEdWeQpMVzFoYzNSbGNpMHlnbEppY21sc2JHbGhiblF0YjNCbGJuTmxZWEpqYUMxamJIVnpkR1Z5TFcxaGMzUmxjaTB5CkxtSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxXaGxZV1JzWlhOemdtQmkKY21sc2JHbGhiblF0YjNCbGJuTmxZWEpqYUMxamJIVnpkR1Z5TFcxaGMzUmxjaTB5TG1KeWFXeHNhV0Z1ZEMxdgpjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxXaGxZV1JzWlhOekxtOWljMlZ5ZG1GaWFXeHBkSG1DClpHSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxUSXVZbkpwYkd4cFlXNTAKTFc5d1pXNXpaV0Z5WTJndFkyeDFjM1JsY2kxdFlYTjBaWEl0YUdWaFpHeGxjM011YjJKelpYSjJZV0pwYkdsMAplUzV6ZG1PQ2NtSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6ZEdWeUxUSXVZbkpwCmJHeHBZVzUwTFc5d1pXNXpaV0Z5WTJndFkyeDFjM1JsY2kxdFlYTjBaWEl0YUdWaFpHeGxjM011YjJKelpYSjIKWVdKcGJHbDBlUzV6ZG1NdVkyeDFjM1JsY2k1c2IyTmhiSUlqWW5KcGJHeHBZVzUwTFc5d1pXNXpaV0Z5WTJndApZMngxYzNSbGNpMXRZWE4wWlhLQ01XSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXRiV0Z6CmRHVnlMbTlpYzJWeWRtRmlhV3hwZEhtQ05XSnlhV3hzYVdGdWRDMXZjR1Z1YzJWaGNtTm9MV05zZFhOMFpYSXQKYldGemRHVnlMbTlpYzJWeWRtRmlhV3hwZEhrdWMzWmpna05pY21sc2JHbGhiblF0YjNCbGJuTmxZWEpqYUMxagpiSFZ6ZEdWeUxXMWhjM1JsY2k1dlluTmxjblpoWW1sc2FYUjVMbk4yWXk1amJIVnpkR1Z5TG14dlkyRnNNQTBHCkNTcUdTSWIzRFFFQkN3VUFBNElDQVFDcjZORXlETFlTZmVJYTdEK3oyelZVNWVvcHJwUi9PNkNPNWtvWlhCUlEKcFJFNTM3b2NLWU5TRGsxYVR3ZW1CWmE3bGxhSk82WDF3SEhPTTQxbzJ0em8zUTF2eDFMVm52OFBKSFJRNFdxVQptcE9jUjBXWk5rd0VqUWdqUjB4bmp1bGZWWXFEMm1WSmFsNlIweGlKTGNwdHlhSWV4QStJa3FZRm1JUFNncERHClRsaGtrL2pHeUI0U0p1YlVFYTFsTGxEcFFCZ0FHbk5TZFRCb2pSRkcxYS9JQWpwcmhyQXBsT1dJM1B0TXpXVlcKaE1ickEvelR6VFVUOEoxWnRMNXpBaklVRUdBTmNqZlZqenpQN2t4aWhZblc4b1hGNW1zYlo1R0pvWDNCTGQ5Mgp6Rm9pNGZyZ0l1eTdDWlAvSFJwU01hV0V6NHQ5cmtoR3BVcnhuOTBWM254Ky96QjYzRWhabU42bFFnalBaSkx6CkVNeTcyZzhSdURWdTZ0cWcrODc5STZKRlZPY1BqcVhuK2JoQ1NJM0ZkUUw3WXNtblR5Rlo0T2kwbHUxZkRqNi8KWXpyTmo5R1NKb3h1aGJqTy9Ta2J5cDRaS2gxUStoWDBLK0t0OVR0MEEzN1RsNDQzSjhSUytrNFgwSjRMNzgyeQo2NTllK1R3ZFNkK1JvVnlLUlMwYVVVL2tXemVWR0VxM0hMRk53UWdxQmlvem9oaS8zRU5Qa3ZOK2djRy9QNjkvCktCR0hXNDhCRnlVY1JBN3Z4MHQ5WjgyMVl5NVBPZFFUSTNCNnhialdZWTNiWjVaWUZndmp1SThTLytzWW9VVU8KN0wxby8rT0pjOFZtYzBjZ0E3QU01WmxDenFyMG1mWUtzRFV5U1FPcUZsWXN0b0VtczhrWll6Mk1JNVFkeDk1dQpjZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
|
||||
root-ca.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUY3VENDQTlXZ0F3SUJBZ0lVTC9hTytnYS9YY3lzakFYbGh1WG92d0xLWkJjd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZVXhDekFKQmdOVkJBWVRBa0pFTVE0d0RBWURWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaAphMkV4RWpBUUJnTlZCQW9NQ1VKeWFXeHNhV0Z1ZERFYk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwCklFTkJNU1V3SXdZRFZRUUREQnhDY21sc2JHbGhiblFnVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUI0WERUSTIKTURjeU16RTFNREV4T1ZvWERUTTJNRGN5TURFMU1ERXhPVm93Z1lVeEN6QUpCZ05WQkFZVEFrSkVNUTR3REFZRApWUVFJREFWRWFHRnJZVEVPTUF3R0ExVUVCd3dGUkdoaGEyRXhFakFRQmdOVkJBb01DVUp5YVd4c2FXRnVkREViCk1Ca0dBMVVFQ3d3U1QzQmxibE5sWVhKamFDQlNiMjkwSUVOQk1TVXdJd1lEVlFRRERCeENjbWxzYkdsaGJuUWcKVDNCbGJsTmxZWEpqYUNCU2IyOTBJRU5CTUlJQ0lqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FnOEFNSUlDQ2dLQwpBZ0VBdXlEYmRaMUFycWd6K1l3SkNUcWlxREtuUzNDRGhHekNxK0h5WDN3clBnV0JvZFBraHJCV3dkNzQ4ZjdqClhZWDNQditQS0F0ZzVGYjdxa2ZZUFZJR0FPZUNiUWxkRlJnZld0S2F2MkdxcHZseUlKcy9OZW5PZzFZQ3IydVUKbDE3UnFPNk1BSGt6d1pNTVFDV1JXMlFiUy9weVY0VHd6dkNxSTR1ZVpzOFJ4MndwbERJdWFPVXdJMEVTMG8zdQpWdDJHMVlCTWlFOUNVTDliQWlYbWQ0UTR4a1NFRFRvOVY1SVk3Z2dHYjFTU0xWU2x6RDJHZElaMGN3VlE2LzcwCnUrQ1FPa005ZXhIRVR2eGpGTmZ4azI2YlRZVUJmNnBNS2VpSDdMbC9ucjZFVVVzTW5DSUR5VGtnK3Zta1M5ZWoKUmY1R0QwQ00rcnl1V1BiRHlHOCtzcDh4d1N1ZkcydDdkUGZRSTUzd1Zzc1BKSkk5b0lsZ0lJWXkyMkFUMlo4RwpKL2dZbmYwMU5LREhSV1dBU2FQaTBLT2dURldqRG5xam94Q0FHZjVGVFRJSHdBQjVsMS8rMXZFbEkyNjQ2M2d4CnBWcTk4Vyt4U3FQQ0xaTW9sWlE5TVkwbjVHeGgvZjhkK0RPb1BVT0lXazJqWXdvS1JGQXJiTlNTNnkySnVrS3YKSWNvMnN4YUhqZkhrdDdqdDBkckRLcjUrelI5bndUWDhVN3hBaWlTYkVTekN6OWlvdU9QSEcxMFFtdzl6VVRNMgoxdzJmMmlQRWpvbFpBVjFBaFU3dzFWNHBzc3JpWDIvNTlDR1dYT1VEcWNnd2MwdWh4djRnWFRndXBCeGcrYU5yCllybWZwNndtejdzN3lmblh3T2xVaVRDRW1Bc2NBemNkMmdCaGwvN1dpcmFRZFVzQ0F3RUFBYU5UTUZFd0hRWUQKVlIwT0JCWUVGSGJhbmo2RkdNVWZ3bEMwSytqY081TTlHd0FwTUI4R0ExVWRJd1FZTUJhQUZIYmFuajZGR01VZgp3bEMwSytqY081TTlHd0FwTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3RFFZSktvWklodmNOQVFFTEJRQURnZ0lCCkFBZVVVVUFMTk5FNDM2UEwvZXl6V0c3bmlPdndXODF3UkdVdGdEUnJpY2xFWjh0K3MzUG9MOXRibyszUGN1ekgKakxsUFArYmVLY2tUTEZKVGZZWUN3Z0dWZkdIRXE1ejV1SUt3ZWIyMG9GSEg3ek9DSzF3VVJBSUlPZnFycncyMApjcWNzdTRnK3NENnl0bllWN2Y1T0RFT2RNaXpjVXRrbGpMSjVieXJLSU9OV2FrSTBpd0xLeXFPQWlGeUVSY2xiCjB0ZzhoTDR6dkRLVUZ6dVJycXhxS0padzNWUWUvM1JWUFYwZ0RLUW96VEQ0M3lnQUdGVlVjckx1dHZOK2V5bEEKVDdYMGtNZXJlVVRKd1N6RDVvenhGRXFkaDlLNHZkZTA2a3BuSXpQS2tEanNFZiszeW9WeFVxRGJCeGV3ai9aOApodzhmT3lBWC9jV2UvZlhmWVdPV3RpTlhiQVJRd0pvUWlLb3lacHRuNGpvRXhLWVB2Qzg0RitINEZnZnpidXFkCnNnL2R2SjBxcldGaUlZeWZBRS9NNGM3VTBDUnVsZ1lETXJhbktIUHhxTllVT21pRzM4T0xLTDlFMmlvV002UHYKek82djVvUk5pazFFN3BrRUVMSUFPczR3U2MvdG45MU01TmtpSjgyRXNEQ2ZaVG5FVU9Cd3VsRzZSbW8vYWF0agpCWUJEaHo0dnhmN0ZjNG13WEdXNVZXc1Qzd2ZVckErZ3l3VWo5dlFqTTV6SjEybDl4NU9Dd3pNMTJuQWdSZ1dFCkh4ZDh5TFhkNE9rTWRaRWNVckY5eWtSMGJUZ3AyWnowL3lPR21KbVpieHRNdHlGaTVMcmt6VElodWJNS1l2bncKcWsrbWdaUmNMcXBWclRSYTNiaGdEVzJrSWpFT2I5SHB6NG5MZ3loUVpCMFAKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: opensearch-node-2-cert
|
||||
namespace: observability
|
||||
@@ -0,0 +1,7 @@
|
||||
apiVersion: v1
|
||||
data:
|
||||
OPENSEARCH_INITIAL_ADMIN_PASSWORD: RW5wMTI5czBmMA==
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: opensearch-secret
|
||||
namespace: observability
|
||||
@@ -0,0 +1,454 @@
|
||||
---
|
||||
# Source: opensearch/templates/poddisruptionbudget.yaml
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: "brilliant-opensearch-cluster-master-pdb"
|
||||
labels:
|
||||
helm.sh/chart: opensearch-3.7.0
|
||||
app.kubernetes.io/name: opensearch
|
||||
app.kubernetes.io/instance: brilliant-opensearch
|
||||
app.kubernetes.io/version: "3.7.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/component: brilliant-opensearch-cluster-master
|
||||
spec:
|
||||
maxUnavailable: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: opensearch
|
||||
app.kubernetes.io/instance: brilliant-opensearch
|
||||
---
|
||||
# Source: opensearch/templates/configmap.yaml
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: brilliant-opensearch-cluster-master-config
|
||||
labels:
|
||||
helm.sh/chart: opensearch-3.7.0
|
||||
app.kubernetes.io/name: opensearch
|
||||
app.kubernetes.io/instance: brilliant-opensearch
|
||||
app.kubernetes.io/version: "3.7.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/component: brilliant-opensearch-cluster-master
|
||||
data:
|
||||
opensearch.yml: |
|
||||
cluster.name: brilliant-opensearch-cluster
|
||||
|
||||
# Bind to all interfaces because we don't know what IP address Docker will assign to us.
|
||||
network.host: 0.0.0.0
|
||||
|
||||
# Setting network.host to a non-loopback address enables the annoying bootstrap checks. "Single-node" mode disables them again.
|
||||
# Implicitly done if ".singleNode" is set to "true".
|
||||
# discovery.type: single-node
|
||||
|
||||
# Start OpenSearch Security Demo Configuration
|
||||
# WARNING: revise all the lines below before you go into production
|
||||
plugins:
|
||||
security:
|
||||
nodes_dn:
|
||||
- "CN=opensearch-master-0,OU=OpenSearch Nodes,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD"
|
||||
- "CN=opensearch-master-1,OU=OpenSearch Nodes,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD"
|
||||
- "CN=opensearch-master-2,OU=OpenSearch Nodes,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD"
|
||||
ssl:
|
||||
transport:
|
||||
pemcert_filepath: certs/node.pem
|
||||
pemkey_filepath: certs/node-key.pem
|
||||
pemtrustedcas_filepath: certs/root-ca.pem
|
||||
enforce_hostname_verification: true
|
||||
resolve_hostname: true
|
||||
http:
|
||||
enabled: true
|
||||
pemcert_filepath: certs/node.pem
|
||||
pemkey_filepath: certs/node-key.pem
|
||||
pemtrustedcas_filepath: certs/root-ca.pem
|
||||
allow_unsafe_democertificates: false
|
||||
allow_default_init_securityindex: true
|
||||
authcz:
|
||||
admin_dn:
|
||||
- CN=opensearch-admin,OU=OpenSearch Administrators,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD
|
||||
audit.type: internal_opensearch
|
||||
enable_snapshot_restore_privilege: true
|
||||
check_snapshot_restore_write_privileges: true
|
||||
restapi:
|
||||
roles_enabled: ["all_access", "security_rest_api_access"]
|
||||
system_indices:
|
||||
enabled: true
|
||||
indices:
|
||||
[
|
||||
".opendistro-alerting-config",
|
||||
".opendistro-alerting-alert*",
|
||||
".opendistro-anomaly-results*",
|
||||
".opendistro-anomaly-detector*",
|
||||
".opendistro-anomaly-checkpoints",
|
||||
".opendistro-anomaly-detection-state",
|
||||
".opendistro-reports-*",
|
||||
".opendistro-notifications-*",
|
||||
".opendistro-notebooks",
|
||||
".opendistro-asynchronous-search-response*",
|
||||
]
|
||||
######## End OpenSearch Security Demo Configuration ########
|
||||
---
|
||||
# Source: opensearch/templates/service.yaml
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: brilliant-opensearch-cluster-master
|
||||
labels:
|
||||
helm.sh/chart: opensearch-3.7.0
|
||||
app.kubernetes.io/name: opensearch
|
||||
app.kubernetes.io/instance: brilliant-opensearch
|
||||
app.kubernetes.io/version: "3.7.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/component: brilliant-opensearch-cluster-master
|
||||
annotations:
|
||||
{}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app.kubernetes.io/name: opensearch
|
||||
app.kubernetes.io/instance: brilliant-opensearch
|
||||
ports:
|
||||
- name: http
|
||||
protocol: TCP
|
||||
port: 9200
|
||||
- name: transport
|
||||
protocol: TCP
|
||||
port: 9300
|
||||
- name: metrics
|
||||
protocol: TCP
|
||||
port: 9600
|
||||
---
|
||||
# Source: opensearch/templates/service.yaml
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: brilliant-opensearch-cluster-master-headless
|
||||
labels:
|
||||
helm.sh/chart: opensearch-3.7.0
|
||||
app.kubernetes.io/name: opensearch
|
||||
app.kubernetes.io/instance: brilliant-opensearch
|
||||
app.kubernetes.io/version: "3.7.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/component: brilliant-opensearch-cluster-master
|
||||
annotations:
|
||||
service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
|
||||
spec:
|
||||
clusterIP: None # This is needed for statefulset hostnames like opensearch-0 to resolve
|
||||
# Create endpoints also if the related pod isn't ready
|
||||
publishNotReadyAddresses: true
|
||||
selector:
|
||||
app.kubernetes.io/name: opensearch
|
||||
app.kubernetes.io/instance: brilliant-opensearch
|
||||
ports:
|
||||
- name: http
|
||||
port: 9200
|
||||
- name: transport
|
||||
port: 9300
|
||||
- name: metrics
|
||||
port: 9600
|
||||
---
|
||||
# Source: opensearch/templates/statefulset.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: brilliant-opensearch-cluster-master
|
||||
labels:
|
||||
helm.sh/chart: opensearch-3.7.0
|
||||
app.kubernetes.io/name: opensearch
|
||||
app.kubernetes.io/instance: brilliant-opensearch
|
||||
app.kubernetes.io/version: "3.7.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/component: brilliant-opensearch-cluster-master
|
||||
annotations:
|
||||
majorVersion: "3"
|
||||
spec:
|
||||
serviceName: brilliant-opensearch-cluster-master-headless
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: opensearch
|
||||
app.kubernetes.io/instance: brilliant-opensearch
|
||||
replicas: 3
|
||||
podManagementPolicy: Parallel
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: brilliant-opensearch-cluster-master
|
||||
spec:
|
||||
accessModes:
|
||||
- "ReadWriteOnce"
|
||||
resources:
|
||||
requests:
|
||||
storage: "120Gi"
|
||||
storageClassName: "longhorn"
|
||||
template:
|
||||
metadata:
|
||||
name: "brilliant-opensearch-cluster-master"
|
||||
labels:
|
||||
helm.sh/chart: opensearch-3.7.0
|
||||
app.kubernetes.io/name: opensearch
|
||||
app.kubernetes.io/instance: brilliant-opensearch
|
||||
app.kubernetes.io/version: "3.7.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/component: brilliant-opensearch-cluster-master
|
||||
annotations:
|
||||
configchecksum: 695bb69d8226ee092a4062e8f2e3c1f5fd7f6ed596b739cdd7dd9dcb60249ff
|
||||
spec:
|
||||
securityContext:
|
||||
fsGroup: 1000
|
||||
runAsUser: 1000
|
||||
automountServiceAccountToken: false
|
||||
tolerations:
|
||||
- effect: NoSchedule
|
||||
key: dedicated
|
||||
operator: Equal
|
||||
value: storage
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchExpressions:
|
||||
- key: app.kubernetes.io/instance
|
||||
operator: In
|
||||
values:
|
||||
- brilliant-opensearch
|
||||
- key: app.kubernetes.io/name
|
||||
operator: In
|
||||
values:
|
||||
- opensearch
|
||||
topologyKey: kubernetes.io/hostname
|
||||
nodeAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: NotIn
|
||||
values:
|
||||
- k8s-cp-01
|
||||
terminationGracePeriodSeconds: 120
|
||||
volumes:
|
||||
- name: config
|
||||
configMap:
|
||||
name: brilliant-opensearch-cluster-master-config
|
||||
- emptyDir: {}
|
||||
name: config-emptydir
|
||||
# Currently some extra blocks accept strings
|
||||
# to continue with backwards compatibility this is being kept
|
||||
# whilst also allowing for yaml to be specified too.
|
||||
- name: node-0-source
|
||||
secret:
|
||||
defaultMode: 288
|
||||
secretName: opensearch-node-0-cert
|
||||
- name: node-1-source
|
||||
secret:
|
||||
defaultMode: 288
|
||||
secretName: opensearch-node-1-cert
|
||||
- name: node-2-source
|
||||
secret:
|
||||
defaultMode: 288
|
||||
secretName: opensearch-node-2-cert
|
||||
- emptyDir: {}
|
||||
name: runtime-certs
|
||||
enableServiceLinks: true
|
||||
initContainers:
|
||||
- name: fsgroup-volume
|
||||
image: "busybox:latest"
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
command: ['sh', '-c']
|
||||
args:
|
||||
- 'chown -R 1000:1000 /usr/share/opensearch/data'
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
resources:
|
||||
{}
|
||||
volumeMounts:
|
||||
- name: "brilliant-opensearch-cluster-master"
|
||||
mountPath: /usr/share/opensearch/data
|
||||
- name: sysctl
|
||||
image: "busybox:latest"
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
set -xe
|
||||
DESIRED="262144"
|
||||
CURRENT=$(sysctl -n vm.max_map_count)
|
||||
if [ "$DESIRED" -gt "$CURRENT" ]; then
|
||||
sysctl -w vm.max_map_count=$DESIRED
|
||||
fi
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
privileged: true
|
||||
resources:
|
||||
{}
|
||||
- name: configfile
|
||||
image: "opensearchproject/opensearch:3.7.0"
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
#!/usr/bin/env bash
|
||||
cp -r /tmp/configfolder/* /tmp/config/
|
||||
securityContext:
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
resources:
|
||||
{}
|
||||
volumeMounts:
|
||||
- mountPath: /tmp/config/
|
||||
name: config-emptydir
|
||||
- name: config
|
||||
mountPath: /tmp/configfolder/opensearch.yml
|
||||
subPath: opensearch.yml
|
||||
# Currently some extra blocks accept strings
|
||||
# to continue with backwards compatibility this is being kept
|
||||
# whilst also allowing for yaml to be specified too.
|
||||
- command:
|
||||
- /bin/sh
|
||||
- -ec
|
||||
- |
|
||||
ordinal="${POD_NAME##*-}"
|
||||
|
||||
case "${ordinal}" in
|
||||
0|1|2)
|
||||
;;
|
||||
*)
|
||||
echo "ERROR: unsupported pod name: ${POD_NAME}"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
source_dir="/source/node-${ordinal}"
|
||||
cert="${source_dir}/node-${ordinal}.pem"
|
||||
key="${source_dir}/node-${ordinal}-key.pem"
|
||||
ca="${source_dir}/root-ca.pem"
|
||||
|
||||
test -r "${cert}" || {
|
||||
echo "ERROR: certificate not readable: ${cert}"
|
||||
exit 1
|
||||
}
|
||||
|
||||
test -r "${key}" || {
|
||||
echo "ERROR: private key not readable: ${key}"
|
||||
exit 1
|
||||
}
|
||||
|
||||
test -r "${ca}" || {
|
||||
echo "ERROR: root CA not readable: ${ca}"
|
||||
exit 1
|
||||
}
|
||||
|
||||
cp "${cert}" /runtime/node.pem
|
||||
cp "${key}" /runtime/node-key.pem
|
||||
cp "${ca}" /runtime/root-ca.pem
|
||||
|
||||
chmod 0644 /runtime/node.pem
|
||||
chmod 0600 /runtime/node-key.pem
|
||||
chmod 0644 /runtime/root-ca.pem
|
||||
|
||||
echo "Selected node-${ordinal} certificate for ${POD_NAME}"
|
||||
ls -l /runtime
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
image: busybox:1.36.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: select-node-certificate
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
volumeMounts:
|
||||
- mountPath: /source/node-0
|
||||
name: node-0-source
|
||||
readOnly: true
|
||||
- mountPath: /source/node-1
|
||||
name: node-1-source
|
||||
readOnly: true
|
||||
- mountPath: /source/node-2
|
||||
name: node-2-source
|
||||
readOnly: true
|
||||
- mountPath: /runtime
|
||||
name: runtime-certs
|
||||
containers:
|
||||
- name: "opensearch"
|
||||
securityContext:
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
|
||||
image: "opensearchproject/opensearch:3.7.0"
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
periodSeconds: 5
|
||||
tcpSocket:
|
||||
port: 9200
|
||||
timeoutSeconds: 3
|
||||
startupProbe:
|
||||
failureThreshold: 30
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
tcpSocket:
|
||||
port: 9200
|
||||
timeoutSeconds: 3
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 9200
|
||||
- name: transport
|
||||
containerPort: 9300
|
||||
- name: metrics
|
||||
containerPort: 9600
|
||||
resources:
|
||||
limits:
|
||||
cpu: "4"
|
||||
memory: 8Gi
|
||||
requests:
|
||||
cpu: "2"
|
||||
memory: 6Gi
|
||||
env:
|
||||
- name: node.name
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: cluster.initial_master_nodes
|
||||
value: "brilliant-opensearch-cluster-master-0,brilliant-opensearch-cluster-master-1,brilliant-opensearch-cluster-master-2,"
|
||||
- name: discovery.seed_hosts
|
||||
value: "brilliant-opensearch-cluster-master-headless"
|
||||
- name: cluster.name
|
||||
value: "brilliant-opensearch-cluster"
|
||||
- name: network.host
|
||||
value: "0.0.0.0"
|
||||
- name: OPENSEARCH_JAVA_OPTS
|
||||
value: "-Xmx3G -Xms3G"
|
||||
- name: node.roles
|
||||
value: "master,ingest,data,remote_cluster_client,"
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: opensearch-secret
|
||||
volumeMounts:
|
||||
- name: "brilliant-opensearch-cluster-master"
|
||||
mountPath: /usr/share/opensearch/data
|
||||
- name: config-emptydir
|
||||
mountPath: /usr/share/opensearch/config/opensearch.yml
|
||||
subPath: opensearch.yml
|
||||
# Currently some extra blocks accept strings
|
||||
# to continue with backwards compatibility this is being kept
|
||||
# whilst also allowing for yaml to be specified too.
|
||||
- mountPath: /usr/share/opensearch/config/certs
|
||||
name: runtime-certs
|
||||
readOnly: true
|
||||
2
helm-charts-observability/charts/opensearch/templates/NOTES.txt
Executable file
2
helm-charts-observability/charts/opensearch/templates/NOTES.txt
Executable file
@@ -0,0 +1,2 @@
|
||||
Watch all cluster members come up.
|
||||
$ kubectl get pods --namespace={{ .Release.Namespace }} -l app.kubernetes.io/component={{ template "opensearch.uname" . }} -w
|
||||
144
helm-charts-observability/charts/opensearch/templates/_helpers.tpl
Executable file
144
helm-charts-observability/charts/opensearch/templates/_helpers.tpl
Executable file
@@ -0,0 +1,144 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "opensearch.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "opensearch.fullname" -}}
|
||||
{{- if contains .Chart.Name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "opensearch.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "opensearch.labels" -}}
|
||||
helm.sh/chart: {{ include "opensearch.chart" . }}
|
||||
{{ include "opensearch.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
app.kubernetes.io/component: {{ include "opensearch.uname" . }}
|
||||
{{- with .Values.labels }}
|
||||
{{ toYaml . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "opensearch.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "opensearch.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "opensearch.uname" -}}
|
||||
{{- if empty .Values.fullnameOverride -}}
|
||||
{{- if empty .Values.nameOverride -}}
|
||||
{{ .Values.clusterName }}-{{ .Values.nodeGroup }}
|
||||
{{- else -}}
|
||||
{{ .Values.nameOverride }}-{{ .Values.nodeGroup }}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{ .Values.fullnameOverride }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "opensearch.masterService" -}}
|
||||
{{- if empty .Values.masterService -}}
|
||||
{{- if empty .Values.fullnameOverride -}}
|
||||
{{- if empty .Values.nameOverride -}}
|
||||
{{ .Values.clusterName }}-master
|
||||
{{- else -}}
|
||||
{{ .Values.nameOverride }}-master
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{ .Values.fullnameOverride }}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{ .Values.masterService }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "opensearch.serviceName" -}}
|
||||
{{- if eq .Values.nodeGroup "master" }}
|
||||
{{- include "opensearch.masterService" . }}
|
||||
{{- else }}
|
||||
{{- include "opensearch.uname" . }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "opensearch.endpoints" -}}
|
||||
{{- $replicas := int (toString (.Values.replicas)) }}
|
||||
{{- $uname := (include "opensearch.uname" .) }}
|
||||
{{- range $i, $e := untilStep 0 $replicas 1 -}}
|
||||
{{ $uname }}-{{ $i }},
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "opensearch.majorVersion" -}}
|
||||
{{- if .Values.majorVersion }}
|
||||
{{- .Values.majorVersion }}
|
||||
{{- else }}
|
||||
{{- $version := semver (coalesce .Values.image.tag .Chart.AppVersion "1") }}
|
||||
{{- $version.Major }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "opensearch.dockerRegistry" -}}
|
||||
{{- if eq .Values.global.dockerRegistry "" -}}
|
||||
{{- .Values.global.dockerRegistry -}}
|
||||
{{- else -}}
|
||||
{{- .Values.global.dockerRegistry | trimSuffix "/" | printf "%s/" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "opensearch.roles" -}}
|
||||
{{- range $.Values.roles -}}
|
||||
{{ . }},
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for ingress.
|
||||
*/}}
|
||||
{{- define "opensearch.ingress.apiVersion" -}}
|
||||
{{- if and (.Capabilities.APIVersions.Has "networking.k8s.io/v1") (semverCompare ">= 1.19-0" .Capabilities.KubeVersion.Version) -}}
|
||||
{{- print "networking.k8s.io/v1" -}}
|
||||
{{- else if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1" -}}
|
||||
{{- print "networking.k8s.io/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "extensions/v1beta1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return if ingress is stable.
|
||||
*/}}
|
||||
{{- define "opensearch.ingress.isStable" -}}
|
||||
{{- eq (include "opensearch.ingress.apiVersion" .) "networking.k8s.io/v1" -}}
|
||||
{{- end -}}
|
||||
{{/*
|
||||
Return if ingress supports ingressClassName.
|
||||
*/}}
|
||||
{{- define "opensearch.ingress.supportsIngressClassName" -}}
|
||||
{{- or (eq (include "opensearch.ingress.isStable" .) "true") (and (eq (include "opensearch.ingress.apiVersion" .) "networking.k8s.io/v1beta1") (semverCompare ">= 1.18-0" .Capabilities.KubeVersion.Version)) -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,18 @@
|
||||
{{- $root := . }}
|
||||
{{- if .Values.config }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "opensearch.uname" . }}-config
|
||||
labels:
|
||||
{{- include "opensearch.labels" . | nindent 4 }}
|
||||
data:
|
||||
{{- range $configName, $configYaml := .Values.config }}
|
||||
{{ $configName }}: |
|
||||
{{- if (eq (kindOf $configYaml) "map")}}
|
||||
{{- tpl (toYaml $configYaml) $root | nindent 4 }}
|
||||
{{- else -}}
|
||||
{{- tpl $configYaml $root | nindent 4 }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,8 @@
|
||||
{{ range .Values.extraObjects }}
|
||||
---
|
||||
{{- if typeIs "string" . }}
|
||||
{{ tpl . $ }}
|
||||
{{- else }}
|
||||
{{ tpl (toYaml .) $ }}
|
||||
{{- end }}
|
||||
{{ end }}
|
||||
@@ -0,0 +1,65 @@
|
||||
{{- if .Values.ingress.enabled -}}
|
||||
{{- $fullName := include "opensearch.serviceName" . -}}
|
||||
{{- $servicePort := .Values.httpPort -}}
|
||||
{{- $ingressPath := .Values.ingress.path -}}
|
||||
{{- $ingressApiIsStable := eq (include "opensearch.ingress.isStable" .) "true" -}}
|
||||
{{- $ingressSupportsIngressClassName := eq (include "opensearch.ingress.supportsIngressClassName" .) "true" -}}
|
||||
{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
|
||||
apiVersion: networking.k8s.io/v1beta1
|
||||
{{- else -}}
|
||||
apiVersion: extensions/v1beta1
|
||||
{{- end }}
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
labels:
|
||||
{{- include "opensearch.labels" . | nindent 4 }}
|
||||
{{- with .Values.ingress.ingressLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.ingress.annotations }}
|
||||
annotations:
|
||||
{{ toYaml . | indent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if and $ingressSupportsIngressClassName .Values.ingress.ingressClassName }}
|
||||
ingressClassName: {{ .Values.ingress.ingressClassName }}
|
||||
{{- end -}}
|
||||
{{- if .Values.ingress.tls }}
|
||||
tls:
|
||||
{{- range .Values.ingress.tls }}
|
||||
- hosts:
|
||||
{{- range .hosts }}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
secretName: {{ .secretName }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
|
||||
{{- range .Values.ingress.hosts }}
|
||||
- host: {{ . | quote }}
|
||||
http:
|
||||
paths:
|
||||
- path: {{ $ingressPath }}
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: {{ $fullName }}
|
||||
port:
|
||||
number: {{ $servicePort }}
|
||||
{{- end }}
|
||||
{{- else -}}
|
||||
{{- range .Values.ingress.hosts }}
|
||||
- host: {{ . | quote }}
|
||||
http:
|
||||
paths:
|
||||
- path: {{ $ingressPath }}
|
||||
backend:
|
||||
serviceName: {{ $fullName }}
|
||||
servicePort: {{ $servicePort }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,17 @@
|
||||
{{- if .Values.networkPolicy.create -}}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: {{ template "opensearch.uname" . }}-opensearch-net
|
||||
labels:
|
||||
{{- include "opensearch.labels" . | nindent 4 }}
|
||||
spec:
|
||||
ingress:
|
||||
- from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
{{ template "opensearch.uname" . }}-transport-client: "true"
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{ template "opensearch.uname" . }}-transport-client: "true"
|
||||
{{- end }}
|
||||
@@ -0,0 +1,17 @@
|
||||
{{- if .Values.maxUnavailable }}
|
||||
{{- if semverCompare ">=1.21-0" .Capabilities.KubeVersion.GitVersion -}}
|
||||
apiVersion: policy/v1
|
||||
{{- else -}}
|
||||
apiVersion: policy/v1beta1
|
||||
{{- end }}
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: "{{ template "opensearch.uname" . }}-pdb"
|
||||
labels:
|
||||
{{- include "opensearch.labels" . | nindent 4 }}
|
||||
spec:
|
||||
maxUnavailable: {{ .Values.maxUnavailable }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "opensearch.selectorLabels" . | nindent 6 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,17 @@
|
||||
{{- if semverCompare "<1.25-0" .Capabilities.KubeVersion.GitVersion -}}
|
||||
{{- if .Values.podSecurityPolicy.create -}}
|
||||
{{- $fullName := include "opensearch.uname" . -}}
|
||||
apiVersion: policy/v1beta1
|
||||
kind: PodSecurityPolicy
|
||||
metadata:
|
||||
name: {{ default $fullName .Values.podSecurityPolicy.name | quote }}
|
||||
labels:
|
||||
{{- include "opensearch.labels" . | nindent 4 }}
|
||||
spec:
|
||||
{{ toYaml .Values.podSecurityPolicy.spec | indent 2 }}
|
||||
{{- if .Values.sysctl.enabled }}
|
||||
allowedUnsafeSysctls:
|
||||
- vm.max_map_count
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,22 @@
|
||||
{{- if .Values.rbac.create -}}
|
||||
{{- $fullName := include "opensearch.uname" . -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ $fullName | quote }}
|
||||
labels:
|
||||
{{- include "opensearch.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- extensions
|
||||
resources:
|
||||
- podsecuritypolicies
|
||||
resourceNames:
|
||||
{{- if eq .Values.podSecurityPolicy.name "" }}
|
||||
- {{ $fullName | quote }}
|
||||
{{- else }}
|
||||
- {{ .Values.podSecurityPolicy.name | quote }}
|
||||
{{- end }}
|
||||
verbs:
|
||||
- use
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,21 @@
|
||||
{{- if .Values.rbac.create -}}
|
||||
{{- $fullName := include "opensearch.uname" . -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ $fullName | quote }}
|
||||
labels:
|
||||
{{- include "opensearch.labels" . | nindent 4 }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
{{- if eq .Values.rbac.serviceAccountName "" }}
|
||||
name: {{ $fullName | quote }}
|
||||
{{- else }}
|
||||
name: {{ .Values.rbac.serviceAccountName | quote }}
|
||||
{{- end }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: {{ $fullName | quote }}
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,19 @@
|
||||
{{- if .Values.securityConfig.config.data -}}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "opensearch.uname" . }}-securityconfig
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "opensearch.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
stringData:
|
||||
{{- range $key, $val := .Values.securityConfig.config.data }}
|
||||
{{ $key }}: |
|
||||
{{- if (eq (kindOf $val) "map")}}
|
||||
{{- tpl (toYaml $val) $ | nindent 4 }}
|
||||
{{- else }}
|
||||
{{- tpl $val $ | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,75 @@
|
||||
---
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: {{ template "opensearch.serviceName" . }}
|
||||
labels:
|
||||
{{- include "opensearch.labels" . | nindent 4 }}
|
||||
{{- if .Values.service.labels }}
|
||||
{{ toYaml .Values.service.labels | indent 4 }}
|
||||
{{- end }}
|
||||
annotations:
|
||||
{{ toYaml .Values.service.annotations | indent 4 }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
{{- if (semverCompare ">= 1.23-0" .Capabilities.KubeVersion.Version) }}
|
||||
{{- if .Values.service.ipFamilyPolicy }}
|
||||
ipFamilyPolicy: {{ .Values.service.ipFamilyPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.ipFamilies }}
|
||||
ipFamilies: {{ .Values.service.ipFamilies }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
selector:
|
||||
{{- include "opensearch.selectorLabels" . | nindent 4 }}
|
||||
ports:
|
||||
- name: {{ .Values.service.httpPortName | default "http" }}
|
||||
protocol: TCP
|
||||
port: {{ .Values.httpPort }}
|
||||
{{- if .Values.service.nodePort }}
|
||||
nodePort: {{ .Values.service.nodePort }}
|
||||
{{- end }}
|
||||
- name: {{ .Values.service.transportPortName | default "transport" }}
|
||||
protocol: TCP
|
||||
port: {{ .Values.transportPort }}
|
||||
- name: {{ .Values.service.metricsPortName | default "metrics" }}
|
||||
protocol: TCP
|
||||
port: {{ .Values.metricsPort }}
|
||||
{{- if .Values.service.loadBalancerIP }}
|
||||
loadBalancerIP: {{ .Values.service.loadBalancerIP }}
|
||||
{{- end }}
|
||||
{{- with .Values.service.loadBalancerSourceRanges }}
|
||||
loadBalancerSourceRanges:
|
||||
{{ toYaml . | indent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.externalTrafficPolicy }}
|
||||
externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy }}
|
||||
{{- end }}
|
||||
---
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: {{ template "opensearch.serviceName" . }}-headless
|
||||
labels:
|
||||
{{- include "opensearch.labels" . | nindent 4 }}
|
||||
{{- if .Values.service.labelsHeadless }}
|
||||
{{ toYaml .Values.service.labelsHeadless | indent 4 }}
|
||||
{{- end }}
|
||||
annotations:
|
||||
service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
|
||||
{{- if .Values.service.headless.annotations }}
|
||||
{{ toYaml .Values.service.headless.annotations | indent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
clusterIP: None # This is needed for statefulset hostnames like opensearch-0 to resolve
|
||||
# Create endpoints also if the related pod isn't ready
|
||||
publishNotReadyAddresses: true
|
||||
selector:
|
||||
{{- include "opensearch.selectorLabels" . | nindent 4 }}
|
||||
ports:
|
||||
- name: {{ .Values.service.httpPortName | default "http" }}
|
||||
port: {{ .Values.httpPort }}
|
||||
- name: {{ .Values.service.transportPortName | default "transport" }}
|
||||
port: {{ .Values.transportPort }}
|
||||
- name: {{ .Values.service.metricsPortName | default "metrics" }}
|
||||
port: {{ .Values.metricsPort }}
|
||||
@@ -0,0 +1,15 @@
|
||||
{{- if and .Values.serviceMonitor.enabled .Values.serviceMonitor.basicAuth.enabled (not .Values.serviceMonitor.basicAuth.existingSecret) }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ template "opensearch.uname" . }}-service-monitor-credentials
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "opensearch.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceMonitor.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
username: {{ .Values.serviceMonitor.basicAuth.username | b64enc | quote }}
|
||||
password: {{ .Values.serviceMonitor.basicAuth.password | b64enc | quote }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,42 @@
|
||||
{{- if .Values.serviceMonitor.enabled }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ template "opensearch.uname" . }}-service-monitor
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "opensearch.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceMonitor.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "opensearch.selectorLabels" . | nindent 6 }}
|
||||
endpoints:
|
||||
- port: {{ .Values.service.httpPortName | default "http" }}
|
||||
interval: {{ .Values.serviceMonitor.interval }}
|
||||
path: {{ .Values.serviceMonitor.path }}
|
||||
scheme: {{ .Values.serviceMonitor.scheme }}
|
||||
{{- with .Values.serviceMonitor.tlsConfig }}
|
||||
tlsConfig:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.serviceMonitor.basicAuth.enabled }}
|
||||
basicAuth:
|
||||
username:
|
||||
{{- if .Values.serviceMonitor.basicAuth.existingSecret }}
|
||||
name: {{ .Values.serviceMonitor.basicAuth.existingSecret }}
|
||||
{{- else }}
|
||||
name: {{ template "opensearch.uname" . }}-service-monitor-credentials
|
||||
{{- end }}
|
||||
key: username
|
||||
password:
|
||||
{{- if .Values.serviceMonitor.basicAuth.existingSecret }}
|
||||
name: {{ .Values.serviceMonitor.basicAuth.existingSecret }}
|
||||
{{- else }}
|
||||
name: {{ template "opensearch.uname" . }}-service-monitor-credentials
|
||||
{{- end }}
|
||||
key: password
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,17 @@
|
||||
{{- if .Values.rbac.create -}}
|
||||
{{- $fullName := include "opensearch.uname" . -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
{{- if eq .Values.rbac.serviceAccountName "" }}
|
||||
name: {{ $fullName | quote }}
|
||||
{{- else }}
|
||||
name: {{ .Values.rbac.serviceAccountName | quote }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "opensearch.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- with .Values.rbac.serviceAccountAnnotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,595 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: {{ template "opensearch.uname" . }}
|
||||
labels:
|
||||
{{- include "opensearch.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
majorVersion: "{{ include "opensearch.majorVersion" . }}"
|
||||
{{- with .Values.openSearchAnnotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
serviceName: {{ template "opensearch.serviceName" . }}-headless
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "opensearch.selectorLabels" . | nindent 6 }}
|
||||
{{- if .Values.singleNode }}
|
||||
replicas: 1
|
||||
{{- else }}
|
||||
replicas: {{ .Values.replicas }}
|
||||
{{- end }}
|
||||
podManagementPolicy: {{ .Values.podManagementPolicy }}
|
||||
updateStrategy:
|
||||
type: {{ .Values.updateStrategy }}
|
||||
{{- if .Values.persistence.enabled }}
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: {{ template "opensearch.uname" . }}
|
||||
{{- if or .Values.persistence.labels.enabled .Values.persistence.labels.additionalLabels }}
|
||||
labels:
|
||||
{{- if .Values.persistence.labels.enabled }}
|
||||
{{- include "opensearch.labels" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.persistence.labels.additionalLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.persistence.annotations }}
|
||||
annotations:
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
{{- range .Values.persistence.accessModes }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.size | quote }}
|
||||
{{- if .Values.persistence.storageClass }}
|
||||
{{- if (eq "-" .Values.persistence.storageClass) }}
|
||||
storageClassName: ""
|
||||
{{- else }}
|
||||
storageClassName: "{{ .Values.persistence.storageClass }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
template:
|
||||
metadata:
|
||||
name: "{{ template "opensearch.uname" . }}"
|
||||
labels:
|
||||
{{- include "opensearch.labels" . | nindent 8 }}
|
||||
annotations:
|
||||
{{- range $key, $value := .Values.podAnnotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- /* This forces a restart if the configmap has changed */}}
|
||||
{{- if .Values.config }}
|
||||
configchecksum: {{ include (print .Template.BasePath "/configmap.yaml") . | sha256sum | trunc 63 }}
|
||||
{{- end }}
|
||||
{{- if .Values.securityConfig.config.data }}
|
||||
securityconfigchecksum: {{ include (print .Template.BasePath "/securityconfig.yaml") . | sha256sum | trunc 63 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.schedulerName }}
|
||||
schedulerName: "{{ .Values.schedulerName }}"
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{ toYaml .Values.podSecurityContext | indent 8 }}
|
||||
{{- if .Values.sysctl.enabled }}
|
||||
sysctls:
|
||||
- name: vm.max_map_count
|
||||
value: {{ .Values.sysctlVmMaxMapCount | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.fsGroup }}
|
||||
fsGroup: {{ .Values.fsGroup }} # Deprecated value, please use .Values.podSecurityContext.fsGroup
|
||||
{{- end }}
|
||||
{{- if and .Values.rbac.create (eq .Values.rbac.serviceAccountName "") }}
|
||||
serviceAccountName: "{{ template "opensearch.uname" . }}"
|
||||
automountServiceAccountToken: {{ ne .Values.rbac.automountServiceAccountToken false }}
|
||||
{{- else if and .Values.rbac.create (ne .Values.rbac.serviceAccountName "") }}
|
||||
serviceAccountName: {{ .Values.rbac.serviceAccountName | quote }}
|
||||
automountServiceAccountToken: {{ ne .Values.rbac.automountServiceAccountToken false }}
|
||||
{{- else }}
|
||||
automountServiceAccountToken: {{ ne .Values.rbac.automountServiceAccountToken false }}
|
||||
{{- end }}
|
||||
{{- if .Values.imagePullSecrets }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{ toYaml . | indent 6 }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if or (eq .Values.antiAffinity "hard") (eq .Values.antiAffinity "soft") (eq .Values.antiAffinity "custom") .Values.nodeAffinity .Values.podAffinity }}
|
||||
{{- if .Values.priorityClassName }}
|
||||
priorityClassName: {{ .Values.priorityClassName }}
|
||||
{{- end }}
|
||||
affinity:
|
||||
{{- end }}
|
||||
{{- if eq .Values.antiAffinity "hard" }}
|
||||
podAntiAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchExpressions:
|
||||
- key: app.kubernetes.io/instance
|
||||
operator: In
|
||||
values:
|
||||
- {{ .Release.Name }}
|
||||
- key: app.kubernetes.io/name
|
||||
operator: In
|
||||
values:
|
||||
- {{ include "opensearch.name" . }}
|
||||
topologyKey: {{ .Values.antiAffinityTopologyKey }}
|
||||
{{- else if eq .Values.antiAffinity "soft" }}
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 1
|
||||
podAffinityTerm:
|
||||
topologyKey: {{ .Values.antiAffinityTopologyKey }}
|
||||
labelSelector:
|
||||
matchExpressions:
|
||||
- key: app.kubernetes.io/instance
|
||||
operator: In
|
||||
values:
|
||||
- {{ .Release.Name }}
|
||||
- key: app.kubernetes.io/name
|
||||
operator: In
|
||||
values:
|
||||
- {{ include "opensearch.name" . }}
|
||||
{{- else if eq .Values.antiAffinity "custom" }}
|
||||
{{- with .Values.customAntiAffinity }}
|
||||
podAntiAffinity:
|
||||
{{ toYaml . | indent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.podAffinity }}
|
||||
podAffinity:
|
||||
{{ toYaml . | indent 10 }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeAffinity }}
|
||||
nodeAffinity:
|
||||
{{ toYaml . | indent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml .Values.topologySpreadConstraints | nindent 8 }}
|
||||
{{- end }}
|
||||
terminationGracePeriodSeconds: {{ .Values.terminationGracePeriod }}
|
||||
volumes:
|
||||
{{- if .Values.config }}
|
||||
- name: config
|
||||
configMap:
|
||||
name: {{ template "opensearch.uname" . }}-config
|
||||
- emptyDir: {}
|
||||
name: config-emptydir
|
||||
{{- end }}
|
||||
{{- range .Values.secretMounts }}
|
||||
- name: {{ .name | required "secretMount .name is required" }}
|
||||
secret:
|
||||
secretName: {{ .secretName | required "secretMount .secretName is required" }}
|
||||
{{- if .defaultMode }}
|
||||
defaultMode: {{ .defaultMode }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and .Values.securityConfig.config.data .Values.securityConfig.config.securityConfigSecret }}
|
||||
{{ fail "Only one of .Values.securityConfig.config.data and .Values.securityConfig.config.securityConfigSecret may be defined. Please see the comment in values.yaml describing usage." }}
|
||||
{{- end }}
|
||||
{{- if .Values.securityConfig.config.data }}
|
||||
- name: security-config-data
|
||||
secret:
|
||||
secretName: {{ include "opensearch.uname" . }}-securityconfig
|
||||
{{- end }}
|
||||
{{- with .Values.securityConfig.config.securityConfigSecret }}
|
||||
- name: security-config-complete
|
||||
secret:
|
||||
secretName: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.securityConfig.actionGroupsSecret }}
|
||||
- name: action-groups
|
||||
secret:
|
||||
secretName: {{ .Values.securityConfig.actionGroupsSecret }}
|
||||
{{- end }}
|
||||
{{- if .Values.securityConfig.configSecret }}
|
||||
- name: security-config
|
||||
secret:
|
||||
secretName: {{ .Values.securityConfig.configSecret }}
|
||||
{{- end }}
|
||||
{{- if .Values.securityConfig.internalUsersSecret }}
|
||||
- name: internal-users-config
|
||||
secret:
|
||||
secretName: {{ .Values.securityConfig.internalUsersSecret }}
|
||||
{{- end }}
|
||||
{{- if .Values.securityConfig.rolesSecret }}
|
||||
- name: roles
|
||||
secret:
|
||||
secretName: {{ .Values.securityConfig.rolesSecret }}
|
||||
{{- end }}
|
||||
{{- if .Values.securityConfig.rolesMappingSecret }}
|
||||
- name: role-mapping
|
||||
secret:
|
||||
secretName: {{ .Values.securityConfig.rolesMappingSecret }}
|
||||
{{- end -}}
|
||||
{{- if .Values.securityConfig.tenantsSecret }}
|
||||
- name: tenants
|
||||
secret:
|
||||
secretName: {{ .Values.securityConfig.tenantsSecret }}
|
||||
{{- end }}
|
||||
{{- if .Values.keystore }}
|
||||
- name: keystore
|
||||
emptyDir: {}
|
||||
{{- range .Values.keystore }}
|
||||
- name: keystore-{{ .secretName }}
|
||||
secret: {{ toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{ end }}
|
||||
{{- if .Values.extraVolumes }}
|
||||
# Currently some extra blocks accept strings
|
||||
# to continue with backwards compatibility this is being kept
|
||||
# whilst also allowing for yaml to be specified too.
|
||||
{{- if eq "string" (printf "%T" .Values.extraVolumes) }}
|
||||
{{ tpl .Values.extraVolumes . | indent 6 }}
|
||||
{{- else }}
|
||||
{{ toYaml .Values.extraVolumes | indent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{ toYaml .Values.imagePullSecrets | indent 8 }}
|
||||
{{- end }}
|
||||
enableServiceLinks: {{ .Values.enableServiceLinks }}
|
||||
{{- if .Values.hostAliases }}
|
||||
hostAliases: {{ toYaml .Values.hostAliases | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if or (.Values.extraInitContainers) (.Values.keystore) (.Values.persistence.enabled) (.Values.sysctlInit.enabled) (.Values.config) }}
|
||||
initContainers:
|
||||
{{- if and .Values.persistence.enabled .Values.persistence.enableInitChown }}
|
||||
- name: fsgroup-volume
|
||||
image: "{{ template "opensearch.dockerRegistry" . }}{{ .Values.persistence.image | default "busybox" }}:{{ .Values.persistence.imageTag | default "latest" }}"
|
||||
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
|
||||
command: ['sh', '-c']
|
||||
args:
|
||||
- 'chown -R 1000:1000 /usr/share/opensearch/data'
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
resources:
|
||||
{{- toYaml .Values.initResources | nindent 10 }}
|
||||
volumeMounts:
|
||||
- name: "{{ template "opensearch.uname" . }}"
|
||||
mountPath: {{ .Values.opensearchHome }}/data
|
||||
{{- end }}
|
||||
{{- if .Values.sysctlInit.enabled }}
|
||||
- name: sysctl
|
||||
image: "{{ template "opensearch.dockerRegistry" . }}{{ .Values.sysctlInit.image | default "busybox" }}:{{ .Values.sysctlInit.imageTag | default "latest" }}"
|
||||
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
set -xe
|
||||
DESIRED="{{ .Values.sysctlVmMaxMapCount }}"
|
||||
CURRENT=$(sysctl -n vm.max_map_count)
|
||||
if [ "$DESIRED" -gt "$CURRENT" ]; then
|
||||
sysctl -w vm.max_map_count=$DESIRED
|
||||
fi
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
privileged: true
|
||||
resources:
|
||||
{{- toYaml .Values.initResources | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.config }}
|
||||
- name: configfile
|
||||
image: "{{ template "opensearch.dockerRegistry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
#!/usr/bin/env bash
|
||||
cp -r /tmp/configfolder/* /tmp/config/
|
||||
securityContext:
|
||||
{{ toYaml .Values.securityContext | indent 10 }}
|
||||
resources:
|
||||
{{- toYaml .Values.initResources | nindent 10 }}
|
||||
volumeMounts:
|
||||
- mountPath: /tmp/config/
|
||||
name: config-emptydir
|
||||
{{- range $path, $config := .Values.config }}
|
||||
- name: config
|
||||
mountPath: /tmp/configfolder/{{ $path }}
|
||||
subPath: {{ $path }}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
{{- if .Values.keystore }}
|
||||
- name: keystore
|
||||
image: "{{ template "opensearch.dockerRegistry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
{{ .Values.opensearchHome }}/bin/opensearch-keystore create
|
||||
|
||||
for i in /tmp/keystoreSecrets/*/*; do
|
||||
[ -f "$i" ] || continue
|
||||
key=$(basename $i)
|
||||
echo "Adding file $i to keystore key $key"
|
||||
{{ .Values.opensearchHome }}/bin/opensearch-keystore add-file "$key" "$i"
|
||||
done
|
||||
|
||||
# Add the bootstrap password since otherwise the opensearch entrypoint tries to do this on startup
|
||||
if [ ! -z ${PASSWORD+x} ]; then
|
||||
echo 'Adding env $PASSWORD to keystore as key bootstrap.password'
|
||||
echo "$PASSWORD" | {{ .Values.opensearchHome }}/bin/opensearch-keystore add -x bootstrap.password
|
||||
fi
|
||||
|
||||
cp -a {{ .Values.opensearchHome }}/config/opensearch.keystore /tmp/keystore/
|
||||
env: {{ toYaml .Values.extraEnvs | nindent 10 }}
|
||||
envFrom: {{ toYaml .Values.envFrom | nindent 10 }}
|
||||
securityContext:
|
||||
{{ toYaml .Values.securityContext | indent 10 }}
|
||||
resources:
|
||||
{{- toYaml .Values.initResources | nindent 10 }}
|
||||
volumeMounts:
|
||||
- name: keystore
|
||||
mountPath: /tmp/keystore
|
||||
{{- range .Values.keystore }}
|
||||
- name: keystore-{{ .secretName }}
|
||||
mountPath: /tmp/keystoreSecrets/{{ .secretName }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.extraInitContainers }}
|
||||
# Currently some extra blocks accept strings
|
||||
# to continue with backwards compatibility this is being kept
|
||||
# whilst also allowing for yaml to be specified too.
|
||||
{{- if eq "string" (printf "%T" .Values.extraInitContainers) }}
|
||||
{{ tpl .Values.extraInitContainers . | indent 6 }}
|
||||
{{- else }}
|
||||
{{ toYaml .Values.extraInitContainers | indent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: "{{ template "opensearch.name" . }}"
|
||||
securityContext:
|
||||
{{ toYaml .Values.securityContext | indent 10 }}
|
||||
{{- if .Values.plugins.enabled }}
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
{{- range $plugin := .Values.plugins.removeList }}
|
||||
if ./bin/opensearch-plugin list | grep -q {{ $plugin }}; then
|
||||
./bin/opensearch-plugin remove {{ $plugin }}
|
||||
fi
|
||||
{{- end }}
|
||||
|
||||
{{- range $plugin := .Values.plugins.installList }}
|
||||
./bin/opensearch-plugin install -b {{ $plugin }}
|
||||
{{- end }}
|
||||
|
||||
bash opensearch-docker-entrypoint.sh
|
||||
{{- end }}
|
||||
|
||||
image: "{{ template "opensearch.dockerRegistry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
|
||||
readinessProbe:
|
||||
{{ toYaml .Values.readinessProbe | indent 10 }}
|
||||
{{- if .Values.livenessProbe }}
|
||||
livenessProbe:
|
||||
{{ toYaml .Values.livenessProbe | indent 10 }}
|
||||
{{- end }}
|
||||
{{- if semverCompare ">=1.16-0" .Capabilities.KubeVersion.Version }}
|
||||
startupProbe:
|
||||
{{ toYaml .Values.startupProbe | indent 10 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: {{ .Values.httpPort }}
|
||||
{{- if .Values.httpHostPort }}
|
||||
hostPort: {{ .Values.httpHostPort }}
|
||||
{{- end }}
|
||||
- name: transport
|
||||
containerPort: {{ .Values.transportPort }}
|
||||
{{- if .Values.transportHostPort }}
|
||||
hostPort: {{ .Values.transportHostPort }}
|
||||
{{- end }}
|
||||
- name: metrics
|
||||
containerPort: {{ .Values.metricsPort }}
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 10 }}
|
||||
env:
|
||||
- name: node.name
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
{{- if (and (has "master" .Values.roles) (not .Values.singleNode)) }}
|
||||
- name: cluster.initial_master_nodes
|
||||
value: "{{ template "opensearch.endpoints" . }}"
|
||||
{{- end }}
|
||||
- name: discovery.seed_hosts
|
||||
value: "{{ template "opensearch.masterService" . }}-headless"
|
||||
- name: cluster.name
|
||||
value: "{{ .Values.clusterName }}"
|
||||
- name: network.host
|
||||
value: "{{ .Values.networkHost }}"
|
||||
- name: OPENSEARCH_JAVA_OPTS
|
||||
value: "{{ .Values.opensearchJavaOpts }}"
|
||||
- name: node.roles
|
||||
value: "{{ template "opensearch.roles" . }}"
|
||||
{{- if .Values.singleNode }}
|
||||
- name: discovery.type
|
||||
value: "single-node"
|
||||
{{- end }}
|
||||
{{- if .Values.extraEnvs }}
|
||||
{{ toYaml .Values.extraEnvs | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.envFrom }}
|
||||
envFrom:
|
||||
{{ toYaml .Values.envFrom | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.opensearchLifecycle }}
|
||||
lifecycle:
|
||||
{{ toYaml .Values.opensearchLifecycle | indent 10 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
{{- if .Values.persistence.enabled }}
|
||||
- name: "{{ template "opensearch.uname" . }}"
|
||||
mountPath: {{ .Values.opensearchHome }}/data
|
||||
{{- end }}
|
||||
{{- if .Values.keystore }}
|
||||
- name: keystore
|
||||
mountPath: {{ .Values.opensearchHome }}/config/opensearch.keystore
|
||||
subPath: opensearch.keystore
|
||||
{{- end }}
|
||||
{{- if .Values.securityConfig.enabled }}
|
||||
{{- if .Values.securityConfig.actionGroupsSecret }}
|
||||
- mountPath: {{ .Values.securityConfig.path }}/action_groups.yml
|
||||
name: action-groups
|
||||
subPath: action_groups.yml
|
||||
{{- end }}
|
||||
{{- if .Values.securityConfig.configSecret }}
|
||||
- mountPath: {{ .Values.securityConfig.path }}/config.yml
|
||||
name: security-config
|
||||
subPath: config.yml
|
||||
{{- end }}
|
||||
{{- if .Values.securityConfig.internalUsersSecret }}
|
||||
- mountPath: {{ .Values.securityConfig.path }}/internal_users.yml
|
||||
name: internal-users-config
|
||||
subPath: internal_users.yml
|
||||
{{- end }}
|
||||
{{- if .Values.securityConfig.rolesSecret }}
|
||||
- mountPath: {{ .Values.securityConfig.path }}/roles.yml
|
||||
name: roles
|
||||
subPath: roles.yml
|
||||
{{- end }}
|
||||
{{- if .Values.securityConfig.rolesMappingSecret }}
|
||||
- mountPath: {{ .Values.securityConfig.path }}/roles_mapping.yml
|
||||
name: role-mapping
|
||||
subPath: roles_mapping.yml
|
||||
{{- end }}
|
||||
{{- if .Values.securityConfig.tenantsSecret }}
|
||||
- mountPath: {{ .Values.securityConfig.path }}/tenants.yml
|
||||
name: tenants
|
||||
subPath: tenants.yml
|
||||
{{- end }}
|
||||
{{- if .Values.securityConfig.config.data }}
|
||||
{{- if .Values.securityConfig.config.dataComplete }}
|
||||
- mountPath: {{ .Values.securityConfig.path }}
|
||||
name: security-config-data
|
||||
{{- else }}
|
||||
{{- range $key, $_ := .Values.securityConfig.config.data }}
|
||||
- mountPath: {{ $.Values.securityConfig.path }}/{{ $key }}
|
||||
name: security-config-data
|
||||
subPath: {{ $key }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- else if .Values.securityConfig.config.securityConfigSecret }}
|
||||
- mountPath: {{ .Values.securityConfig.path }}
|
||||
name: security-config-complete
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range .Values.secretMounts }}
|
||||
- name: {{ .name | required "secretMount .name is required" }}
|
||||
mountPath: {{ .path | required "secretMount .path is required" }}
|
||||
{{- if .subPath }}
|
||||
subPath: {{ .subPath }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range $path, $config := .Values.config }}
|
||||
- name: config-emptydir
|
||||
mountPath: {{ $.Values.opensearchHome }}/config/{{ $path }}
|
||||
subPath: {{ $path }}
|
||||
{{- end -}}
|
||||
{{- if .Values.extraVolumeMounts }}
|
||||
# Currently some extra blocks accept strings
|
||||
# to continue with backwards compatibility this is being kept
|
||||
# whilst also allowing for yaml to be specified too.
|
||||
{{- if eq "string" (printf "%T" .Values.extraVolumeMounts) }}
|
||||
{{ tpl .Values.extraVolumeMounts . | indent 8 }}
|
||||
{{- else }}
|
||||
{{ toYaml .Values.extraVolumeMounts | indent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.masterTerminationFix }}
|
||||
{{- if has "master" .Values.roles }}
|
||||
# This sidecar will prevent slow master re-election
|
||||
- name: opensearch-master-graceful-termination-handler
|
||||
image: "{{ template "opensearch.dockerRegistry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
|
||||
command:
|
||||
- "sh"
|
||||
- -c
|
||||
- |
|
||||
#!/usr/bin/env bash
|
||||
set -eo pipefail
|
||||
|
||||
http () {
|
||||
local path="${1}"
|
||||
if [ -n "${USERNAME}" ] && [ -n "${PASSWORD}" ]; then
|
||||
BASIC_AUTH="-u ${USERNAME}:${PASSWORD}"
|
||||
else
|
||||
BASIC_AUTH=''
|
||||
fi
|
||||
curl -XGET -s -k --fail ${BASIC_AUTH} {{ .Values.protocol }}://{{ template "opensearch.masterService" . }}:{{ .Values.httpPort }}${path}
|
||||
}
|
||||
|
||||
cleanup () {
|
||||
while true ; do
|
||||
local master="$(http "/_cat/master?h=node" || echo "")"
|
||||
if [[ $master == "{{ template "opensearch.masterService" . }}"* && $master != "${NODE_NAME}" ]]; then
|
||||
echo "This node is not master."
|
||||
break
|
||||
fi
|
||||
echo "This node is still master, waiting gracefully for it to step down"
|
||||
sleep 1
|
||||
done
|
||||
|
||||
exit 0
|
||||
}
|
||||
|
||||
trap cleanup SIGTERM
|
||||
|
||||
sleep infinity &
|
||||
wait $!
|
||||
resources:
|
||||
{{- toYaml .Values.sidecarResources | nindent 10 }}
|
||||
env:
|
||||
- name: NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
{{- if .Values.extraEnvs }}
|
||||
{{ toYaml .Values.extraEnvs | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.envFrom }}
|
||||
envFrom:
|
||||
{{ toYaml .Values.envFrom | indent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.lifecycle }}
|
||||
lifecycle:
|
||||
{{ toYaml .Values.lifecycle | indent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.extraContainers }}
|
||||
# Currently some extra blocks accept strings
|
||||
# to continue with backwards compatibility this is being kept
|
||||
# whilst also allowing for yaml to be specified too.
|
||||
{{- if eq "string" (printf "%T" .Values.extraContainers) }}
|
||||
{{ tpl .Values.extraContainers . | indent 6 }}
|
||||
{{- else }}
|
||||
{{ toYaml .Values.extraContainers | indent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
719
helm-charts-observability/charts/opensearch/values.yaml
Normal file
719
helm-charts-observability/charts/opensearch/values.yaml
Normal file
@@ -0,0 +1,719 @@
|
||||
---
|
||||
clusterName: "brilliant-opensearch-cluster"
|
||||
nodeGroup: "master"
|
||||
|
||||
# If discovery.type in the opensearch configuration is set to "single-node",
|
||||
# this should be set to "true"
|
||||
# If "true", replicas will be forced to 1
|
||||
singleNode: false
|
||||
|
||||
# The service that non master groups will try to connect to when joining the cluster
|
||||
# This should be set to clusterName + "-" + nodeGroup for your master group
|
||||
masterService: "brilliant-opensearch-cluster-master"
|
||||
|
||||
# OpenSearch roles that will be applied to this nodeGroup
|
||||
# These will be set as environment variable "node.roles". E.g. node.roles=master,ingest,data,remote_cluster_client
|
||||
roles:
|
||||
- master
|
||||
- ingest
|
||||
- data
|
||||
- remote_cluster_client
|
||||
|
||||
replicas: 3
|
||||
|
||||
# if not set, falls back to parsing .Values.imageTag, then .Chart.appVersion.
|
||||
majorVersion: ""
|
||||
|
||||
global:
|
||||
# Set if you want to change the default docker registry, e.g. a private one.
|
||||
dockerRegistry: ""
|
||||
|
||||
# Allows you to add any config files in {{ .Values.opensearchHome }}/config
|
||||
opensearchHome: /usr/share/opensearch
|
||||
|
||||
# such as opensearch.yml and log4j2.properties
|
||||
config:
|
||||
# Values must be YAML literal style scalar / YAML multiline string.
|
||||
# <filename>: |
|
||||
# <formatted-value(s)>
|
||||
# log4j2.properties: |
|
||||
# status = error
|
||||
#
|
||||
# appender.console.type = Console
|
||||
# appender.console.name = console
|
||||
# appender.console.layout.type = PatternLayout
|
||||
# appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n
|
||||
#
|
||||
# rootLogger.level = info
|
||||
# rootLogger.appenderRef.console.ref = console
|
||||
opensearch.yml: |
|
||||
cluster.name: brilliant-opensearch-cluster
|
||||
|
||||
# Bind to all interfaces because we don't know what IP address Docker will assign to us.
|
||||
network.host: 0.0.0.0
|
||||
|
||||
# Setting network.host to a non-loopback address enables the annoying bootstrap checks. "Single-node" mode disables them again.
|
||||
# Implicitly done if ".singleNode" is set to "true".
|
||||
# discovery.type: single-node
|
||||
|
||||
# Start OpenSearch Security Demo Configuration
|
||||
# WARNING: revise all the lines below before you go into production
|
||||
plugins:
|
||||
query:
|
||||
datasources:
|
||||
encryption:
|
||||
masterkey: "8e74f8c437a820d8e2c99f11"
|
||||
security:
|
||||
nodes_dn:
|
||||
- "CN=opensearch-master-0,OU=OpenSearch Nodes,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD"
|
||||
- "CN=opensearch-master-1,OU=OpenSearch Nodes,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD"
|
||||
- "CN=opensearch-master-2,OU=OpenSearch Nodes,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD"
|
||||
ssl:
|
||||
transport:
|
||||
pemcert_filepath: certs/node.pem
|
||||
pemkey_filepath: certs/node-key.pem
|
||||
pemtrustedcas_filepath: certs/root-ca.pem
|
||||
enforce_hostname_verification: false
|
||||
resolve_hostname: true
|
||||
http:
|
||||
enabled: true
|
||||
pemcert_filepath: certs/node.pem
|
||||
pemkey_filepath: certs/node-key.pem
|
||||
pemtrustedcas_filepath: certs/root-ca.pem
|
||||
allow_unsafe_democertificates: false
|
||||
allow_default_init_securityindex: true
|
||||
authcz:
|
||||
admin_dn:
|
||||
- CN=opensearch-admin,OU=OpenSearch Administrators,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD
|
||||
audit.type: internal_opensearch
|
||||
enable_snapshot_restore_privilege: true
|
||||
check_snapshot_restore_write_privileges: true
|
||||
restapi:
|
||||
roles_enabled: ["all_access", "security_rest_api_access"]
|
||||
system_indices:
|
||||
enabled: true
|
||||
indices:
|
||||
[
|
||||
".opendistro-alerting-config",
|
||||
".opendistro-alerting-alert*",
|
||||
".opendistro-anomaly-results*",
|
||||
".opendistro-anomaly-detector*",
|
||||
".opendistro-anomaly-checkpoints",
|
||||
".opendistro-anomaly-detection-state",
|
||||
".opendistro-reports-*",
|
||||
".opendistro-notifications-*",
|
||||
".opendistro-notebooks",
|
||||
".opendistro-asynchronous-search-response*",
|
||||
]
|
||||
######## End OpenSearch Security Demo Configuration ########
|
||||
# log4j2.properties:
|
||||
|
||||
# Extra environment variables to append to this nodeGroup
|
||||
# This will be appended to the current 'env:' key. You can use any of the kubernetes env
|
||||
# syntax here
|
||||
extraEnvs: []
|
||||
# - name: MY_ENVIRONMENT_VAR
|
||||
# value: the_value_goes_here
|
||||
# Chart version 2.18.0 and App Version OpenSearch 2.12.0 onwards a custom strong password needs to be provided in order to setup demo admin user.
|
||||
# Cluster will not spin-up without this unless demo config install is disabled.
|
||||
# - name: OPENSEARCH_INITIAL_ADMIN_PASSWORD
|
||||
# value: <strong-password>
|
||||
|
||||
# Allows you to load environment variables from kubernetes secret or config map
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: opensearch-secret # this the the admin password
|
||||
|
||||
|
||||
# - configMapRef:
|
||||
# name: config-map
|
||||
|
||||
# A list of secrets and their paths to mount inside the pod
|
||||
# This is useful for mounting certificates for security and for mounting
|
||||
# the X-Pack license
|
||||
secretMounts: []
|
||||
|
||||
hostAliases: []
|
||||
# - ip: "127.0.0.1"
|
||||
# hostnames:
|
||||
# - "foo.local"
|
||||
# - "bar.local"
|
||||
|
||||
image:
|
||||
repository: "opensearchproject/opensearch"
|
||||
# override image tag, which is .Chart.AppVersion by default
|
||||
tag: ""
|
||||
pullPolicy: "IfNotPresent"
|
||||
|
||||
podAnnotations: {}
|
||||
# iam.amazonaws.com/role: es-cluster
|
||||
|
||||
# OpenSearch Statefulset annotations
|
||||
openSearchAnnotations: {}
|
||||
|
||||
# additionals labels
|
||||
labels: {}
|
||||
|
||||
opensearchJavaOpts: "-Xmx3G -Xms3G"
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: "2"
|
||||
memory: "6Gi"
|
||||
limits:
|
||||
cpu: "4"
|
||||
memory: "8Gi"
|
||||
|
||||
initResources: {}
|
||||
# limits:
|
||||
# cpu: "25m"
|
||||
# memory: "128Mi"
|
||||
# requests:
|
||||
# cpu: "25m"
|
||||
# memory: "128Mi"
|
||||
|
||||
sidecarResources: {}
|
||||
# limits:
|
||||
# cpu: "25m"
|
||||
# memory: "128Mi"
|
||||
# requests:
|
||||
# cpu: "25m"
|
||||
# memory: "128Mi"
|
||||
|
||||
networkHost: "0.0.0.0"
|
||||
|
||||
rbac:
|
||||
create: false
|
||||
serviceAccountAnnotations: {}
|
||||
serviceAccountName: ""
|
||||
# Controls whether or not the Service Account token is automatically mounted to /var/run/secrets/kubernetes.io/serviceaccount
|
||||
automountServiceAccountToken: false
|
||||
|
||||
podSecurityPolicy:
|
||||
create: false
|
||||
name: ""
|
||||
spec:
|
||||
privileged: true
|
||||
fsGroup:
|
||||
rule: RunAsAny
|
||||
runAsUser:
|
||||
rule: RunAsAny
|
||||
seLinux:
|
||||
rule: RunAsAny
|
||||
supplementalGroups:
|
||||
rule: RunAsAny
|
||||
volumes:
|
||||
- secret
|
||||
- configMap
|
||||
- persistentVolumeClaim
|
||||
- emptyDir
|
||||
|
||||
persistence:
|
||||
enabled: true
|
||||
# Set to false to disable the `fsgroup-volume` initContainer that will update permissions on the persistent disk.
|
||||
enableInitChown: true
|
||||
# override image, which is busybox by default
|
||||
# image: busybox
|
||||
# override image tag, which is latest by default
|
||||
# imageTag:
|
||||
labels:
|
||||
# Add default labels for the volumeClaimTemplate of the StatefulSet
|
||||
enabled: false
|
||||
# Add custom labels for the volumeClaimTemplate of the StatefulSet
|
||||
additionalLabels: {}
|
||||
# OpenSearch Persistent Volume Storage Class
|
||||
# If defined, storageClassName: <storageClass>
|
||||
# If set to "-", storageClassName: "", which disables dynamic provisioning
|
||||
# If undefined (the default) or set to null, no storageClassName spec is
|
||||
# set, choosing the default provisioner. (gp2 on AWS, standard on
|
||||
# GKE, AWS & OpenStack)
|
||||
#
|
||||
storageClass: "longhorn"
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
size: 120Gi
|
||||
annotations: {}
|
||||
|
||||
extraVolumes:
|
||||
# - name: extras
|
||||
# emptyDir: {}
|
||||
- name: admin-certs
|
||||
secret:
|
||||
secretName: opensearch-admin-cert
|
||||
defaultMode: 0400
|
||||
- name: custom-internal-users
|
||||
secret:
|
||||
secretName: opensearch-internal-users
|
||||
defaultMode: 0440
|
||||
|
||||
- name: node-0-source
|
||||
secret:
|
||||
secretName: opensearch-node-0-cert
|
||||
defaultMode: 0440
|
||||
- name: node-1-source
|
||||
secret:
|
||||
secretName: opensearch-node-1-cert
|
||||
defaultMode: 0440
|
||||
- name: node-2-source
|
||||
secret:
|
||||
secretName: opensearch-node-2-cert
|
||||
defaultMode: 0440
|
||||
|
||||
- name: runtime-certs
|
||||
emptyDir: {}
|
||||
|
||||
|
||||
|
||||
extraVolumeMounts:
|
||||
# - name: extras
|
||||
# mountPath: /usr/share/extras
|
||||
# readOnly: true
|
||||
- name: runtime-certs
|
||||
mountPath: /usr/share/opensearch/config/certs
|
||||
readOnly: true
|
||||
- name: admin-certs
|
||||
mountPath: /usr/share/opensearch/config/admin-certs
|
||||
readOnly: true
|
||||
- name: custom-internal-users
|
||||
readOnly: true
|
||||
mountPath: /usr/share/opensearch/config/custom-security
|
||||
|
||||
extraContainers: []
|
||||
# - name: do-something
|
||||
# image: busybox
|
||||
# command: ['do', 'something']
|
||||
|
||||
# extraInitContainers: []
|
||||
# - name: do-somethings
|
||||
# image: busybox
|
||||
# command: ['do', 'something']
|
||||
extraInitContainers:
|
||||
- name: select-node-certificate
|
||||
image: "busybox:1.36.1"
|
||||
imagePullPolicy: IfNotPresent
|
||||
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
|
||||
command:
|
||||
- /bin/sh
|
||||
- -ec
|
||||
- |
|
||||
ordinal="${POD_NAME##*-}"
|
||||
|
||||
case "${ordinal}" in
|
||||
0|1|2)
|
||||
;;
|
||||
*)
|
||||
echo "ERROR: unsupported pod name: ${POD_NAME}"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
source_dir="/source/node-${ordinal}"
|
||||
cert="${source_dir}/node-${ordinal}.pem"
|
||||
key="${source_dir}/node-${ordinal}-key.pem"
|
||||
ca="${source_dir}/root-ca.pem"
|
||||
|
||||
test -r "${cert}" || {
|
||||
echo "ERROR: certificate not readable: ${cert}"
|
||||
exit 1
|
||||
}
|
||||
|
||||
test -r "${key}" || {
|
||||
echo "ERROR: private key not readable: ${key}"
|
||||
exit 1
|
||||
}
|
||||
|
||||
test -r "${ca}" || {
|
||||
echo "ERROR: root CA not readable: ${ca}"
|
||||
exit 1
|
||||
}
|
||||
|
||||
cp "${cert}" /runtime/node.pem
|
||||
cp "${key}" /runtime/node-key.pem
|
||||
cp "${ca}" /runtime/root-ca.pem
|
||||
|
||||
chmod 0644 /runtime/node.pem
|
||||
chmod 0600 /runtime/node-key.pem
|
||||
chmod 0644 /runtime/root-ca.pem
|
||||
|
||||
echo "Selected node-${ordinal} certificate for ${POD_NAME}"
|
||||
ls -l /runtime
|
||||
|
||||
volumeMounts:
|
||||
- name: node-0-source
|
||||
mountPath: /source/node-0
|
||||
readOnly: true
|
||||
|
||||
- name: node-1-source
|
||||
mountPath: /source/node-1
|
||||
readOnly: true
|
||||
|
||||
- name: node-2-source
|
||||
mountPath: /source/node-2
|
||||
readOnly: true
|
||||
|
||||
- name: runtime-certs
|
||||
mountPath: /runtime
|
||||
# This is the PriorityClass settings as defined in
|
||||
# https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
|
||||
priorityClassName: ""
|
||||
|
||||
# By default this will make sure two pods don't end up on the same node
|
||||
# Changing this to a region would allow you to spread pods across regions
|
||||
antiAffinityTopologyKey: "kubernetes.io/hostname"
|
||||
|
||||
# Hard means that by default pods will only be scheduled if there are enough nodes for them
|
||||
# and that they will never end up on the same node. Setting this to soft will do this "best effort".
|
||||
# Setting this to custom will use what is passed into customAntiAffinity.
|
||||
antiAffinity: "hard"
|
||||
|
||||
# Allows passing in custom anti-affinity settings as defined in
|
||||
# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity
|
||||
# Using this parameter requires setting antiAffinity to custom.
|
||||
customAntiAffinity: {}
|
||||
|
||||
# This is the node affinity settings as defined in
|
||||
# https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#node-affinity-beta-feature
|
||||
nodeAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: NotIn
|
||||
values:
|
||||
- k8s-cp-01
|
||||
|
||||
|
||||
# This is the pod affinity settings as defined in
|
||||
# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity
|
||||
podAffinity: {}
|
||||
|
||||
# This is the pod topology spread constraints
|
||||
# https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
|
||||
topologySpreadConstraints: []
|
||||
|
||||
# The default is to deploy all pods serially. By setting this to parallel all pods are started at
|
||||
# the same time when bootstrapping the cluster
|
||||
podManagementPolicy: "Parallel"
|
||||
|
||||
# The environment variables injected by service links are not used, but can lead to slow OpenSearch boot times when
|
||||
# there are many services in the current namespace.
|
||||
# If you experience slow pod startups you probably want to set this to `false`.
|
||||
enableServiceLinks: true
|
||||
|
||||
protocol: https
|
||||
httpPort: 9200
|
||||
transportPort: 9300
|
||||
metricsPort: 9600
|
||||
httpHostPort: ""
|
||||
transportHostPort: ""
|
||||
|
||||
|
||||
service:
|
||||
labels: {}
|
||||
labelsHeadless: {}
|
||||
headless:
|
||||
annotations: {}
|
||||
type: ClusterIP
|
||||
# The IP family and IP families options are to set the behaviour in a dual-stack environment
|
||||
# Omitting these values will let the service fall back to whatever the CNI dictates the defaults
|
||||
# should be
|
||||
#
|
||||
# ipFamilyPolicy: SingleStack
|
||||
# ipFamilies:
|
||||
# - IPv4
|
||||
nodePort: ""
|
||||
annotations: {}
|
||||
httpPortName: http
|
||||
transportPortName: transport
|
||||
metricsPortName: metrics
|
||||
loadBalancerIP: ""
|
||||
loadBalancerSourceRanges: []
|
||||
externalTrafficPolicy: ""
|
||||
|
||||
updateStrategy: RollingUpdate
|
||||
|
||||
# This is the max unavailable setting for the pod disruption budget
|
||||
# The default value of 1 will make sure that kubernetes won't allow more than 1
|
||||
# of your pods to be unavailable during maintenance
|
||||
maxUnavailable: 1
|
||||
|
||||
podSecurityContext:
|
||||
fsGroup: 1000
|
||||
runAsUser: 1000
|
||||
|
||||
securityContext:
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
# readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
|
||||
securityConfig:
|
||||
enabled: true
|
||||
path: "/usr/share/opensearch/config/opensearch-security"
|
||||
actionGroupsSecret:
|
||||
configSecret:
|
||||
internalUsersSecret:
|
||||
rolesSecret:
|
||||
rolesMappingSecret:
|
||||
tenantsSecret:
|
||||
# The following option simplifies securityConfig by using a single secret and
|
||||
# specifying the config files as keys in the secret instead of creating
|
||||
# different secrets for for each config file.
|
||||
# Note that this is an alternative to the individual secret configuration
|
||||
# above and shouldn't be used if the above secrets are used.
|
||||
config:
|
||||
# There are multiple ways to define the configuration here:
|
||||
# * If you define anything under data, the chart will automatically create
|
||||
# a secret and mount it. This is best option to choose if you want to override all the
|
||||
# existing yml files at once.
|
||||
# * If you define securityConfigSecret, the chart will assume this secret is
|
||||
# created externally and mount it. This is best option to choose if your intention is to
|
||||
# only update a single yml file.
|
||||
# * It is an error to define both data and securityConfigSecret.
|
||||
securityConfigSecret: ""
|
||||
dataComplete: true
|
||||
data: {}
|
||||
# config.yml: |-
|
||||
# internal_users.yml: |-
|
||||
# roles.yml: |-
|
||||
# roles_mapping.yml: |-
|
||||
# action_groups.yml: |-
|
||||
# tenants.yml: |-
|
||||
|
||||
# How long to wait for opensearch to stop gracefully
|
||||
terminationGracePeriod: 120
|
||||
|
||||
sysctlVmMaxMapCount: 262144
|
||||
|
||||
startupProbe:
|
||||
tcpSocket:
|
||||
port: 9200
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 30
|
||||
|
||||
livenessProbe: {}
|
||||
# periodSeconds: 20
|
||||
# timeoutSeconds: 5
|
||||
# failureThreshold: 10
|
||||
# successThreshold: 1
|
||||
# initialDelaySeconds: 10
|
||||
# tcpSocket:
|
||||
# port: 9200
|
||||
|
||||
readinessProbe:
|
||||
tcpSocket:
|
||||
port: 9200
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 3
|
||||
|
||||
## Use an alternate scheduler.
|
||||
## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
|
||||
##
|
||||
schedulerName: ""
|
||||
|
||||
imagePullSecrets: []
|
||||
nodeSelector: {}
|
||||
tolerations:
|
||||
- key: "dedicated"
|
||||
operator: "Equal"
|
||||
value: "storage"
|
||||
effect: "NoSchedule"
|
||||
|
||||
# Enabling this will publically expose your OpenSearch instance.
|
||||
# Only enable this if you have security enabled on your cluster
|
||||
ingress:
|
||||
enabled: false
|
||||
# For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName
|
||||
# See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress
|
||||
# ingressClassName: nginx
|
||||
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: nginx
|
||||
kubernetes.io/tls-acme: "true"
|
||||
ingressLabels: {}
|
||||
path: /
|
||||
hosts: []
|
||||
# - 118.67.213.76
|
||||
tls: []
|
||||
# - secretName: chart-example-tls
|
||||
# hosts:
|
||||
# - chart-example.local
|
||||
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
masterTerminationFix: false
|
||||
|
||||
opensearchLifecycle: {}
|
||||
# preStop:
|
||||
# exec:
|
||||
# command: ["/bin/sh", "-c", "echo Hello from the preStart handler > /usr/share/message"]
|
||||
# postStart:
|
||||
# exec:
|
||||
# command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"]
|
||||
|
||||
lifecycle: {}
|
||||
# preStop:
|
||||
# exec:
|
||||
# command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"]
|
||||
# postStart:
|
||||
# exec:
|
||||
# command:
|
||||
# - bash
|
||||
# - -c
|
||||
# - |
|
||||
# #!/bin/bash
|
||||
# # Add a template to adjust number of shards/replicas1
|
||||
# TEMPLATE_NAME=my_template
|
||||
# INDEX_PATTERN="logstash-*"
|
||||
# SHARD_COUNT=8
|
||||
# REPLICA_COUNT=1
|
||||
# ES_URL=http://localhost:9200
|
||||
# while [[ "$(curl -s -o /dev/null -w '%{http_code}\n' $ES_URL)" != "200" ]]; do sleep 1; done
|
||||
# curl -XPUT "$ES_URL/_template/$TEMPLATE_NAME" -H 'Content-Type: application/json' -d'{"index_patterns":['\""$INDEX_PATTERN"\"'],"settings":{"number_of_shards":'$SHARD_COUNT',"number_of_replicas":'$REPLICA_COUNT'}}'
|
||||
|
||||
keystore: []
|
||||
# To add secrets to the keystore:
|
||||
# - secretName: opensearch-encryption-key
|
||||
|
||||
networkPolicy:
|
||||
create: false
|
||||
## Enable creation of NetworkPolicy resources. Only Ingress traffic is filtered for now.
|
||||
## In order for a Pod to access OpenSearch, it needs to have the following label:
|
||||
## {{ template "uname" . }}-client: "true"
|
||||
## Example for default configuration to access HTTP port:
|
||||
## opensearch-master-http-client: "true"
|
||||
## Example for default configuration to access transport port:
|
||||
## opensearch-master-transport-client: "true"
|
||||
|
||||
http:
|
||||
enabled: false
|
||||
|
||||
# Deprecated
|
||||
# please use the above podSecurityContext.fsGroup instead
|
||||
fsGroup: ""
|
||||
|
||||
## Set optimal sysctl's through securityContext. This requires privilege. Can be disabled if
|
||||
## the system has already been preconfigured. (Ex: https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html)
|
||||
## Also see: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/
|
||||
sysctl:
|
||||
enabled: false
|
||||
|
||||
## Set optimal sysctl's through privileged initContainer.
|
||||
sysctlInit:
|
||||
enabled: true
|
||||
# override image, which is busybox by default
|
||||
# image: busybox
|
||||
# override image tag, which is latest by default
|
||||
# imageTag:
|
||||
|
||||
## Enable to add 3rd Party / Custom plugins not offered in the default OpenSearch image.
|
||||
plugins:
|
||||
enabled: false
|
||||
installList: []
|
||||
# - example-fake-plugin
|
||||
removeList: []
|
||||
# - example-fake-plugin
|
||||
|
||||
# -- Array of extra K8s manifests to deploy
|
||||
extraObjects: []
|
||||
# - apiVersion: secrets-store.csi.x-k8s.io/v1
|
||||
# kind: SecretProviderClass
|
||||
# metadata:
|
||||
# name: argocd-secrets-store
|
||||
# spec:
|
||||
# provider: aws
|
||||
# parameters:
|
||||
# objects: |
|
||||
# - objectName: "argocd"
|
||||
# objectType: "secretsmanager"
|
||||
# jmesPath:
|
||||
# - path: "client_id"
|
||||
# objectAlias: "client_id"
|
||||
# - path: "client_secret"
|
||||
# objectAlias: "client_secret"
|
||||
# secretObjects:
|
||||
# - data:
|
||||
# - key: client_id
|
||||
# objectName: client_id
|
||||
# - key: client_secret
|
||||
# objectName: client_secret
|
||||
# secretName: argocd-secrets-store
|
||||
# type: Opaque
|
||||
# labels:
|
||||
# app.kubernetes.io/part-of: argocd
|
||||
# - |
|
||||
# apiVersion: policy/v1
|
||||
# kind: PodDisruptionBudget
|
||||
# metadata:
|
||||
# name: {{ template "opensearch.uname" . }}
|
||||
# labels:
|
||||
# {{- include "opensearch.labels" . | nindent 4 }}
|
||||
# spec:
|
||||
# minAvailable: 1
|
||||
# selector:
|
||||
# matchLabels:
|
||||
# {{- include "opensearch.selectorLabels" . | nindent 6 }}
|
||||
|
||||
# ServiceMonitor Configuration for Prometheus
|
||||
# Enabling this option will create a ServiceMonitor resource that allows Prometheus to scrape metrics from the OpenSearch service.
|
||||
# This only creates the serviceMonitor, to actually have metrics Make sure to install the prometheus-exporter plugin needed for
|
||||
# serving metrics over the `.Values.plugins` value:
|
||||
# plugins:
|
||||
# enabled: true
|
||||
# installList:
|
||||
# - https://github.com/aiven/prometheus-exporter-plugin-for-opensearch/releases/download/x.x.x.x/prometheus-exporter-x.x.x.x.zip
|
||||
serviceMonitor:
|
||||
# Set to true to enable the ServiceMonitor resource
|
||||
enabled: false
|
||||
|
||||
# HTTP path where metrics are exposed.
|
||||
# Ensure this matches your OpenSearch service configuration.
|
||||
path: /_prometheus/metrics
|
||||
|
||||
# Scheme to use for scraping.
|
||||
scheme: http
|
||||
|
||||
# Frequency at which Prometheus will scrape metrics.
|
||||
# Adjust based on your needs.
|
||||
interval: 10s
|
||||
|
||||
# additional labels to be added to the ServiceMonitor
|
||||
# labels:
|
||||
# k8s.example.com/prometheus: kube-prometheus
|
||||
labels: {}
|
||||
|
||||
# additional tlsConfig to be added to the ServiceMonitor
|
||||
tlsConfig: {}
|
||||
|
||||
# Basic Auth configuration for the service monitor
|
||||
# You can either use existingSecret, which expects a secret to be already present with data.username and data.password
|
||||
# or set the credentials over the helm values, making helm create a secret for you
|
||||
# basicAuth:
|
||||
# enaled: true
|
||||
# existingSecret: my-secret
|
||||
# username: my-username
|
||||
# password: my-password
|
||||
basicAuth:
|
||||
enabled: false
|
||||
Reference in New Issue
Block a user