Convert helm-charts-observability to regular directory
This commit is contained in:
Mosiur Rahman
@@ -0,0 +1,454 @@
|
||||
---
|
||||
# Source: opensearch/templates/poddisruptionbudget.yaml
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: "brilliant-opensearch-cluster-master-pdb"
|
||||
labels:
|
||||
helm.sh/chart: opensearch-3.7.0
|
||||
app.kubernetes.io/name: opensearch
|
||||
app.kubernetes.io/instance: brilliant-opensearch
|
||||
app.kubernetes.io/version: "3.7.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/component: brilliant-opensearch-cluster-master
|
||||
spec:
|
||||
maxUnavailable: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: opensearch
|
||||
app.kubernetes.io/instance: brilliant-opensearch
|
||||
---
|
||||
# Source: opensearch/templates/configmap.yaml
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: brilliant-opensearch-cluster-master-config
|
||||
labels:
|
||||
helm.sh/chart: opensearch-3.7.0
|
||||
app.kubernetes.io/name: opensearch
|
||||
app.kubernetes.io/instance: brilliant-opensearch
|
||||
app.kubernetes.io/version: "3.7.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/component: brilliant-opensearch-cluster-master
|
||||
data:
|
||||
opensearch.yml: |
|
||||
cluster.name: brilliant-opensearch-cluster
|
||||
|
||||
# Bind to all interfaces because we don't know what IP address Docker will assign to us.
|
||||
network.host: 0.0.0.0
|
||||
|
||||
# Setting network.host to a non-loopback address enables the annoying bootstrap checks. "Single-node" mode disables them again.
|
||||
# Implicitly done if ".singleNode" is set to "true".
|
||||
# discovery.type: single-node
|
||||
|
||||
# Start OpenSearch Security Demo Configuration
|
||||
# WARNING: revise all the lines below before you go into production
|
||||
plugins:
|
||||
security:
|
||||
nodes_dn:
|
||||
- "CN=opensearch-master-0,OU=OpenSearch Nodes,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD"
|
||||
- "CN=opensearch-master-1,OU=OpenSearch Nodes,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD"
|
||||
- "CN=opensearch-master-2,OU=OpenSearch Nodes,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD"
|
||||
ssl:
|
||||
transport:
|
||||
pemcert_filepath: certs/node.pem
|
||||
pemkey_filepath: certs/node-key.pem
|
||||
pemtrustedcas_filepath: certs/root-ca.pem
|
||||
enforce_hostname_verification: true
|
||||
resolve_hostname: true
|
||||
http:
|
||||
enabled: true
|
||||
pemcert_filepath: certs/node.pem
|
||||
pemkey_filepath: certs/node-key.pem
|
||||
pemtrustedcas_filepath: certs/root-ca.pem
|
||||
allow_unsafe_democertificates: false
|
||||
allow_default_init_securityindex: true
|
||||
authcz:
|
||||
admin_dn:
|
||||
- CN=opensearch-admin,OU=OpenSearch Administrators,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD
|
||||
audit.type: internal_opensearch
|
||||
enable_snapshot_restore_privilege: true
|
||||
check_snapshot_restore_write_privileges: true
|
||||
restapi:
|
||||
roles_enabled: ["all_access", "security_rest_api_access"]
|
||||
system_indices:
|
||||
enabled: true
|
||||
indices:
|
||||
[
|
||||
".opendistro-alerting-config",
|
||||
".opendistro-alerting-alert*",
|
||||
".opendistro-anomaly-results*",
|
||||
".opendistro-anomaly-detector*",
|
||||
".opendistro-anomaly-checkpoints",
|
||||
".opendistro-anomaly-detection-state",
|
||||
".opendistro-reports-*",
|
||||
".opendistro-notifications-*",
|
||||
".opendistro-notebooks",
|
||||
".opendistro-asynchronous-search-response*",
|
||||
]
|
||||
######## End OpenSearch Security Demo Configuration ########
|
||||
---
|
||||
# Source: opensearch/templates/service.yaml
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: brilliant-opensearch-cluster-master
|
||||
labels:
|
||||
helm.sh/chart: opensearch-3.7.0
|
||||
app.kubernetes.io/name: opensearch
|
||||
app.kubernetes.io/instance: brilliant-opensearch
|
||||
app.kubernetes.io/version: "3.7.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/component: brilliant-opensearch-cluster-master
|
||||
annotations:
|
||||
{}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app.kubernetes.io/name: opensearch
|
||||
app.kubernetes.io/instance: brilliant-opensearch
|
||||
ports:
|
||||
- name: http
|
||||
protocol: TCP
|
||||
port: 9200
|
||||
- name: transport
|
||||
protocol: TCP
|
||||
port: 9300
|
||||
- name: metrics
|
||||
protocol: TCP
|
||||
port: 9600
|
||||
---
|
||||
# Source: opensearch/templates/service.yaml
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: brilliant-opensearch-cluster-master-headless
|
||||
labels:
|
||||
helm.sh/chart: opensearch-3.7.0
|
||||
app.kubernetes.io/name: opensearch
|
||||
app.kubernetes.io/instance: brilliant-opensearch
|
||||
app.kubernetes.io/version: "3.7.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/component: brilliant-opensearch-cluster-master
|
||||
annotations:
|
||||
service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
|
||||
spec:
|
||||
clusterIP: None # This is needed for statefulset hostnames like opensearch-0 to resolve
|
||||
# Create endpoints also if the related pod isn't ready
|
||||
publishNotReadyAddresses: true
|
||||
selector:
|
||||
app.kubernetes.io/name: opensearch
|
||||
app.kubernetes.io/instance: brilliant-opensearch
|
||||
ports:
|
||||
- name: http
|
||||
port: 9200
|
||||
- name: transport
|
||||
port: 9300
|
||||
- name: metrics
|
||||
port: 9600
|
||||
---
|
||||
# Source: opensearch/templates/statefulset.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: brilliant-opensearch-cluster-master
|
||||
labels:
|
||||
helm.sh/chart: opensearch-3.7.0
|
||||
app.kubernetes.io/name: opensearch
|
||||
app.kubernetes.io/instance: brilliant-opensearch
|
||||
app.kubernetes.io/version: "3.7.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/component: brilliant-opensearch-cluster-master
|
||||
annotations:
|
||||
majorVersion: "3"
|
||||
spec:
|
||||
serviceName: brilliant-opensearch-cluster-master-headless
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: opensearch
|
||||
app.kubernetes.io/instance: brilliant-opensearch
|
||||
replicas: 3
|
||||
podManagementPolicy: Parallel
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: brilliant-opensearch-cluster-master
|
||||
spec:
|
||||
accessModes:
|
||||
- "ReadWriteOnce"
|
||||
resources:
|
||||
requests:
|
||||
storage: "120Gi"
|
||||
storageClassName: "longhorn"
|
||||
template:
|
||||
metadata:
|
||||
name: "brilliant-opensearch-cluster-master"
|
||||
labels:
|
||||
helm.sh/chart: opensearch-3.7.0
|
||||
app.kubernetes.io/name: opensearch
|
||||
app.kubernetes.io/instance: brilliant-opensearch
|
||||
app.kubernetes.io/version: "3.7.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/component: brilliant-opensearch-cluster-master
|
||||
annotations:
|
||||
configchecksum: 695bb69d8226ee092a4062e8f2e3c1f5fd7f6ed596b739cdd7dd9dcb60249ff
|
||||
spec:
|
||||
securityContext:
|
||||
fsGroup: 1000
|
||||
runAsUser: 1000
|
||||
automountServiceAccountToken: false
|
||||
tolerations:
|
||||
- effect: NoSchedule
|
||||
key: dedicated
|
||||
operator: Equal
|
||||
value: storage
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchExpressions:
|
||||
- key: app.kubernetes.io/instance
|
||||
operator: In
|
||||
values:
|
||||
- brilliant-opensearch
|
||||
- key: app.kubernetes.io/name
|
||||
operator: In
|
||||
values:
|
||||
- opensearch
|
||||
topologyKey: kubernetes.io/hostname
|
||||
nodeAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: NotIn
|
||||
values:
|
||||
- k8s-cp-01
|
||||
terminationGracePeriodSeconds: 120
|
||||
volumes:
|
||||
- name: config
|
||||
configMap:
|
||||
name: brilliant-opensearch-cluster-master-config
|
||||
- emptyDir: {}
|
||||
name: config-emptydir
|
||||
# Currently some extra blocks accept strings
|
||||
# to continue with backwards compatibility this is being kept
|
||||
# whilst also allowing for yaml to be specified too.
|
||||
- name: node-0-source
|
||||
secret:
|
||||
defaultMode: 288
|
||||
secretName: opensearch-node-0-cert
|
||||
- name: node-1-source
|
||||
secret:
|
||||
defaultMode: 288
|
||||
secretName: opensearch-node-1-cert
|
||||
- name: node-2-source
|
||||
secret:
|
||||
defaultMode: 288
|
||||
secretName: opensearch-node-2-cert
|
||||
- emptyDir: {}
|
||||
name: runtime-certs
|
||||
enableServiceLinks: true
|
||||
initContainers:
|
||||
- name: fsgroup-volume
|
||||
image: "busybox:latest"
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
command: ['sh', '-c']
|
||||
args:
|
||||
- 'chown -R 1000:1000 /usr/share/opensearch/data'
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
resources:
|
||||
{}
|
||||
volumeMounts:
|
||||
- name: "brilliant-opensearch-cluster-master"
|
||||
mountPath: /usr/share/opensearch/data
|
||||
- name: sysctl
|
||||
image: "busybox:latest"
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
set -xe
|
||||
DESIRED="262144"
|
||||
CURRENT=$(sysctl -n vm.max_map_count)
|
||||
if [ "$DESIRED" -gt "$CURRENT" ]; then
|
||||
sysctl -w vm.max_map_count=$DESIRED
|
||||
fi
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
privileged: true
|
||||
resources:
|
||||
{}
|
||||
- name: configfile
|
||||
image: "opensearchproject/opensearch:3.7.0"
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
#!/usr/bin/env bash
|
||||
cp -r /tmp/configfolder/* /tmp/config/
|
||||
securityContext:
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
resources:
|
||||
{}
|
||||
volumeMounts:
|
||||
- mountPath: /tmp/config/
|
||||
name: config-emptydir
|
||||
- name: config
|
||||
mountPath: /tmp/configfolder/opensearch.yml
|
||||
subPath: opensearch.yml
|
||||
# Currently some extra blocks accept strings
|
||||
# to continue with backwards compatibility this is being kept
|
||||
# whilst also allowing for yaml to be specified too.
|
||||
- command:
|
||||
- /bin/sh
|
||||
- -ec
|
||||
- |
|
||||
ordinal="${POD_NAME##*-}"
|
||||
|
||||
case "${ordinal}" in
|
||||
0|1|2)
|
||||
;;
|
||||
*)
|
||||
echo "ERROR: unsupported pod name: ${POD_NAME}"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
source_dir="/source/node-${ordinal}"
|
||||
cert="${source_dir}/node-${ordinal}.pem"
|
||||
key="${source_dir}/node-${ordinal}-key.pem"
|
||||
ca="${source_dir}/root-ca.pem"
|
||||
|
||||
test -r "${cert}" || {
|
||||
echo "ERROR: certificate not readable: ${cert}"
|
||||
exit 1
|
||||
}
|
||||
|
||||
test -r "${key}" || {
|
||||
echo "ERROR: private key not readable: ${key}"
|
||||
exit 1
|
||||
}
|
||||
|
||||
test -r "${ca}" || {
|
||||
echo "ERROR: root CA not readable: ${ca}"
|
||||
exit 1
|
||||
}
|
||||
|
||||
cp "${cert}" /runtime/node.pem
|
||||
cp "${key}" /runtime/node-key.pem
|
||||
cp "${ca}" /runtime/root-ca.pem
|
||||
|
||||
chmod 0644 /runtime/node.pem
|
||||
chmod 0600 /runtime/node-key.pem
|
||||
chmod 0644 /runtime/root-ca.pem
|
||||
|
||||
echo "Selected node-${ordinal} certificate for ${POD_NAME}"
|
||||
ls -l /runtime
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
image: busybox:1.36.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: select-node-certificate
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
volumeMounts:
|
||||
- mountPath: /source/node-0
|
||||
name: node-0-source
|
||||
readOnly: true
|
||||
- mountPath: /source/node-1
|
||||
name: node-1-source
|
||||
readOnly: true
|
||||
- mountPath: /source/node-2
|
||||
name: node-2-source
|
||||
readOnly: true
|
||||
- mountPath: /runtime
|
||||
name: runtime-certs
|
||||
containers:
|
||||
- name: "opensearch"
|
||||
securityContext:
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
|
||||
image: "opensearchproject/opensearch:3.7.0"
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
periodSeconds: 5
|
||||
tcpSocket:
|
||||
port: 9200
|
||||
timeoutSeconds: 3
|
||||
startupProbe:
|
||||
failureThreshold: 30
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
tcpSocket:
|
||||
port: 9200
|
||||
timeoutSeconds: 3
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 9200
|
||||
- name: transport
|
||||
containerPort: 9300
|
||||
- name: metrics
|
||||
containerPort: 9600
|
||||
resources:
|
||||
limits:
|
||||
cpu: "4"
|
||||
memory: 8Gi
|
||||
requests:
|
||||
cpu: "2"
|
||||
memory: 6Gi
|
||||
env:
|
||||
- name: node.name
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: cluster.initial_master_nodes
|
||||
value: "brilliant-opensearch-cluster-master-0,brilliant-opensearch-cluster-master-1,brilliant-opensearch-cluster-master-2,"
|
||||
- name: discovery.seed_hosts
|
||||
value: "brilliant-opensearch-cluster-master-headless"
|
||||
- name: cluster.name
|
||||
value: "brilliant-opensearch-cluster"
|
||||
- name: network.host
|
||||
value: "0.0.0.0"
|
||||
- name: OPENSEARCH_JAVA_OPTS
|
||||
value: "-Xmx3G -Xms3G"
|
||||
- name: node.roles
|
||||
value: "master,ingest,data,remote_cluster_client,"
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: opensearch-secret
|
||||
volumeMounts:
|
||||
- name: "brilliant-opensearch-cluster-master"
|
||||
mountPath: /usr/share/opensearch/data
|
||||
- name: config-emptydir
|
||||
mountPath: /usr/share/opensearch/config/opensearch.yml
|
||||
subPath: opensearch.yml
|
||||
# Currently some extra blocks accept strings
|
||||
# to continue with backwards compatibility this is being kept
|
||||
# whilst also allowing for yaml to be specified too.
|
||||
- mountPath: /usr/share/opensearch/config/certs
|
||||
name: runtime-certs
|
||||
readOnly: true
|
||||
Reference in New Issue
Block a user