455 lines
14 KiB
YAML
455 lines
14 KiB
YAML
---
|
|
# Source: opensearch/templates/poddisruptionbudget.yaml
|
|
apiVersion: policy/v1
|
|
kind: PodDisruptionBudget
|
|
metadata:
|
|
name: "brilliant-opensearch-cluster-master-pdb"
|
|
labels:
|
|
helm.sh/chart: opensearch-3.7.0
|
|
app.kubernetes.io/name: opensearch
|
|
app.kubernetes.io/instance: brilliant-opensearch
|
|
app.kubernetes.io/version: "3.7.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/component: brilliant-opensearch-cluster-master
|
|
spec:
|
|
maxUnavailable: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: opensearch
|
|
app.kubernetes.io/instance: brilliant-opensearch
|
|
---
|
|
# Source: opensearch/templates/configmap.yaml
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: brilliant-opensearch-cluster-master-config
|
|
labels:
|
|
helm.sh/chart: opensearch-3.7.0
|
|
app.kubernetes.io/name: opensearch
|
|
app.kubernetes.io/instance: brilliant-opensearch
|
|
app.kubernetes.io/version: "3.7.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/component: brilliant-opensearch-cluster-master
|
|
data:
|
|
opensearch.yml: |
|
|
cluster.name: brilliant-opensearch-cluster
|
|
|
|
# Bind to all interfaces because we don't know what IP address Docker will assign to us.
|
|
network.host: 0.0.0.0
|
|
|
|
# Setting network.host to a non-loopback address enables the annoying bootstrap checks. "Single-node" mode disables them again.
|
|
# Implicitly done if ".singleNode" is set to "true".
|
|
# discovery.type: single-node
|
|
|
|
# Start OpenSearch Security Demo Configuration
|
|
# WARNING: revise all the lines below before you go into production
|
|
plugins:
|
|
security:
|
|
nodes_dn:
|
|
- "CN=opensearch-master-0,OU=OpenSearch Nodes,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD"
|
|
- "CN=opensearch-master-1,OU=OpenSearch Nodes,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD"
|
|
- "CN=opensearch-master-2,OU=OpenSearch Nodes,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD"
|
|
ssl:
|
|
transport:
|
|
pemcert_filepath: certs/node.pem
|
|
pemkey_filepath: certs/node-key.pem
|
|
pemtrustedcas_filepath: certs/root-ca.pem
|
|
enforce_hostname_verification: true
|
|
resolve_hostname: true
|
|
http:
|
|
enabled: true
|
|
pemcert_filepath: certs/node.pem
|
|
pemkey_filepath: certs/node-key.pem
|
|
pemtrustedcas_filepath: certs/root-ca.pem
|
|
allow_unsafe_democertificates: false
|
|
allow_default_init_securityindex: true
|
|
authcz:
|
|
admin_dn:
|
|
- CN=opensearch-admin,OU=OpenSearch Administrators,O=Brilliant,L=Dhaka,ST=Dhaka,C=BD
|
|
audit.type: internal_opensearch
|
|
enable_snapshot_restore_privilege: true
|
|
check_snapshot_restore_write_privileges: true
|
|
restapi:
|
|
roles_enabled: ["all_access", "security_rest_api_access"]
|
|
system_indices:
|
|
enabled: true
|
|
indices:
|
|
[
|
|
".opendistro-alerting-config",
|
|
".opendistro-alerting-alert*",
|
|
".opendistro-anomaly-results*",
|
|
".opendistro-anomaly-detector*",
|
|
".opendistro-anomaly-checkpoints",
|
|
".opendistro-anomaly-detection-state",
|
|
".opendistro-reports-*",
|
|
".opendistro-notifications-*",
|
|
".opendistro-notebooks",
|
|
".opendistro-asynchronous-search-response*",
|
|
]
|
|
######## End OpenSearch Security Demo Configuration ########
|
|
---
|
|
# Source: opensearch/templates/service.yaml
|
|
kind: Service
|
|
apiVersion: v1
|
|
metadata:
|
|
name: brilliant-opensearch-cluster-master
|
|
labels:
|
|
helm.sh/chart: opensearch-3.7.0
|
|
app.kubernetes.io/name: opensearch
|
|
app.kubernetes.io/instance: brilliant-opensearch
|
|
app.kubernetes.io/version: "3.7.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/component: brilliant-opensearch-cluster-master
|
|
annotations:
|
|
{}
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
app.kubernetes.io/name: opensearch
|
|
app.kubernetes.io/instance: brilliant-opensearch
|
|
ports:
|
|
- name: http
|
|
protocol: TCP
|
|
port: 9200
|
|
- name: transport
|
|
protocol: TCP
|
|
port: 9300
|
|
- name: metrics
|
|
protocol: TCP
|
|
port: 9600
|
|
---
|
|
# Source: opensearch/templates/service.yaml
|
|
kind: Service
|
|
apiVersion: v1
|
|
metadata:
|
|
name: brilliant-opensearch-cluster-master-headless
|
|
labels:
|
|
helm.sh/chart: opensearch-3.7.0
|
|
app.kubernetes.io/name: opensearch
|
|
app.kubernetes.io/instance: brilliant-opensearch
|
|
app.kubernetes.io/version: "3.7.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/component: brilliant-opensearch-cluster-master
|
|
annotations:
|
|
service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
|
|
spec:
|
|
clusterIP: None # This is needed for statefulset hostnames like opensearch-0 to resolve
|
|
# Create endpoints also if the related pod isn't ready
|
|
publishNotReadyAddresses: true
|
|
selector:
|
|
app.kubernetes.io/name: opensearch
|
|
app.kubernetes.io/instance: brilliant-opensearch
|
|
ports:
|
|
- name: http
|
|
port: 9200
|
|
- name: transport
|
|
port: 9300
|
|
- name: metrics
|
|
port: 9600
|
|
---
|
|
# Source: opensearch/templates/statefulset.yaml
|
|
apiVersion: apps/v1
|
|
kind: StatefulSet
|
|
metadata:
|
|
name: brilliant-opensearch-cluster-master
|
|
labels:
|
|
helm.sh/chart: opensearch-3.7.0
|
|
app.kubernetes.io/name: opensearch
|
|
app.kubernetes.io/instance: brilliant-opensearch
|
|
app.kubernetes.io/version: "3.7.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/component: brilliant-opensearch-cluster-master
|
|
annotations:
|
|
majorVersion: "3"
|
|
spec:
|
|
serviceName: brilliant-opensearch-cluster-master-headless
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: opensearch
|
|
app.kubernetes.io/instance: brilliant-opensearch
|
|
replicas: 3
|
|
podManagementPolicy: Parallel
|
|
updateStrategy:
|
|
type: RollingUpdate
|
|
volumeClaimTemplates:
|
|
- metadata:
|
|
name: brilliant-opensearch-cluster-master
|
|
spec:
|
|
accessModes:
|
|
- "ReadWriteOnce"
|
|
resources:
|
|
requests:
|
|
storage: "120Gi"
|
|
storageClassName: "longhorn"
|
|
template:
|
|
metadata:
|
|
name: "brilliant-opensearch-cluster-master"
|
|
labels:
|
|
helm.sh/chart: opensearch-3.7.0
|
|
app.kubernetes.io/name: opensearch
|
|
app.kubernetes.io/instance: brilliant-opensearch
|
|
app.kubernetes.io/version: "3.7.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/component: brilliant-opensearch-cluster-master
|
|
annotations:
|
|
configchecksum: 695bb69d8226ee092a4062e8f2e3c1f5fd7f6ed596b739cdd7dd9dcb60249ff
|
|
spec:
|
|
securityContext:
|
|
fsGroup: 1000
|
|
runAsUser: 1000
|
|
automountServiceAccountToken: false
|
|
tolerations:
|
|
- effect: NoSchedule
|
|
key: dedicated
|
|
operator: Equal
|
|
value: storage
|
|
affinity:
|
|
podAntiAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
- labelSelector:
|
|
matchExpressions:
|
|
- key: app.kubernetes.io/instance
|
|
operator: In
|
|
values:
|
|
- brilliant-opensearch
|
|
- key: app.kubernetes.io/name
|
|
operator: In
|
|
values:
|
|
- opensearch
|
|
topologyKey: kubernetes.io/hostname
|
|
nodeAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
nodeSelectorTerms:
|
|
- matchExpressions:
|
|
- key: kubernetes.io/hostname
|
|
operator: NotIn
|
|
values:
|
|
- k8s-cp-01
|
|
terminationGracePeriodSeconds: 120
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: brilliant-opensearch-cluster-master-config
|
|
- emptyDir: {}
|
|
name: config-emptydir
|
|
# Currently some extra blocks accept strings
|
|
# to continue with backwards compatibility this is being kept
|
|
# whilst also allowing for yaml to be specified too.
|
|
- name: node-0-source
|
|
secret:
|
|
defaultMode: 288
|
|
secretName: opensearch-node-0-cert
|
|
- name: node-1-source
|
|
secret:
|
|
defaultMode: 288
|
|
secretName: opensearch-node-1-cert
|
|
- name: node-2-source
|
|
secret:
|
|
defaultMode: 288
|
|
secretName: opensearch-node-2-cert
|
|
- emptyDir: {}
|
|
name: runtime-certs
|
|
enableServiceLinks: true
|
|
initContainers:
|
|
- name: fsgroup-volume
|
|
image: "busybox:latest"
|
|
imagePullPolicy: "IfNotPresent"
|
|
command: ['sh', '-c']
|
|
args:
|
|
- 'chown -R 1000:1000 /usr/share/opensearch/data'
|
|
securityContext:
|
|
runAsUser: 0
|
|
resources:
|
|
{}
|
|
volumeMounts:
|
|
- name: "brilliant-opensearch-cluster-master"
|
|
mountPath: /usr/share/opensearch/data
|
|
- name: sysctl
|
|
image: "busybox:latest"
|
|
imagePullPolicy: "IfNotPresent"
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
set -xe
|
|
DESIRED="262144"
|
|
CURRENT=$(sysctl -n vm.max_map_count)
|
|
if [ "$DESIRED" -gt "$CURRENT" ]; then
|
|
sysctl -w vm.max_map_count=$DESIRED
|
|
fi
|
|
securityContext:
|
|
runAsUser: 0
|
|
privileged: true
|
|
resources:
|
|
{}
|
|
- name: configfile
|
|
image: "opensearchproject/opensearch:3.7.0"
|
|
imagePullPolicy: "IfNotPresent"
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
#!/usr/bin/env bash
|
|
cp -r /tmp/configfolder/* /tmp/config/
|
|
securityContext:
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
resources:
|
|
{}
|
|
volumeMounts:
|
|
- mountPath: /tmp/config/
|
|
name: config-emptydir
|
|
- name: config
|
|
mountPath: /tmp/configfolder/opensearch.yml
|
|
subPath: opensearch.yml
|
|
# Currently some extra blocks accept strings
|
|
# to continue with backwards compatibility this is being kept
|
|
# whilst also allowing for yaml to be specified too.
|
|
- command:
|
|
- /bin/sh
|
|
- -ec
|
|
- |
|
|
ordinal="${POD_NAME##*-}"
|
|
|
|
case "${ordinal}" in
|
|
0|1|2)
|
|
;;
|
|
*)
|
|
echo "ERROR: unsupported pod name: ${POD_NAME}"
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
source_dir="/source/node-${ordinal}"
|
|
cert="${source_dir}/node-${ordinal}.pem"
|
|
key="${source_dir}/node-${ordinal}-key.pem"
|
|
ca="${source_dir}/root-ca.pem"
|
|
|
|
test -r "${cert}" || {
|
|
echo "ERROR: certificate not readable: ${cert}"
|
|
exit 1
|
|
}
|
|
|
|
test -r "${key}" || {
|
|
echo "ERROR: private key not readable: ${key}"
|
|
exit 1
|
|
}
|
|
|
|
test -r "${ca}" || {
|
|
echo "ERROR: root CA not readable: ${ca}"
|
|
exit 1
|
|
}
|
|
|
|
cp "${cert}" /runtime/node.pem
|
|
cp "${key}" /runtime/node-key.pem
|
|
cp "${ca}" /runtime/root-ca.pem
|
|
|
|
chmod 0644 /runtime/node.pem
|
|
chmod 0600 /runtime/node-key.pem
|
|
chmod 0644 /runtime/root-ca.pem
|
|
|
|
echo "Selected node-${ordinal} certificate for ${POD_NAME}"
|
|
ls -l /runtime
|
|
env:
|
|
- name: POD_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.name
|
|
image: busybox:1.36.1
|
|
imagePullPolicy: IfNotPresent
|
|
name: select-node-certificate
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
readOnlyRootFilesystem: true
|
|
runAsGroup: 1000
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
volumeMounts:
|
|
- mountPath: /source/node-0
|
|
name: node-0-source
|
|
readOnly: true
|
|
- mountPath: /source/node-1
|
|
name: node-1-source
|
|
readOnly: true
|
|
- mountPath: /source/node-2
|
|
name: node-2-source
|
|
readOnly: true
|
|
- mountPath: /runtime
|
|
name: runtime-certs
|
|
containers:
|
|
- name: "opensearch"
|
|
securityContext:
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
|
|
image: "opensearchproject/opensearch:3.7.0"
|
|
imagePullPolicy: "IfNotPresent"
|
|
readinessProbe:
|
|
failureThreshold: 3
|
|
periodSeconds: 5
|
|
tcpSocket:
|
|
port: 9200
|
|
timeoutSeconds: 3
|
|
startupProbe:
|
|
failureThreshold: 30
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
tcpSocket:
|
|
port: 9200
|
|
timeoutSeconds: 3
|
|
ports:
|
|
- name: http
|
|
containerPort: 9200
|
|
- name: transport
|
|
containerPort: 9300
|
|
- name: metrics
|
|
containerPort: 9600
|
|
resources:
|
|
limits:
|
|
cpu: "4"
|
|
memory: 8Gi
|
|
requests:
|
|
cpu: "2"
|
|
memory: 6Gi
|
|
env:
|
|
- name: node.name
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.name
|
|
- name: cluster.initial_master_nodes
|
|
value: "brilliant-opensearch-cluster-master-0,brilliant-opensearch-cluster-master-1,brilliant-opensearch-cluster-master-2,"
|
|
- name: discovery.seed_hosts
|
|
value: "brilliant-opensearch-cluster-master-headless"
|
|
- name: cluster.name
|
|
value: "brilliant-opensearch-cluster"
|
|
- name: network.host
|
|
value: "0.0.0.0"
|
|
- name: OPENSEARCH_JAVA_OPTS
|
|
value: "-Xmx3G -Xms3G"
|
|
- name: node.roles
|
|
value: "master,ingest,data,remote_cluster_client,"
|
|
envFrom:
|
|
- secretRef:
|
|
name: opensearch-secret
|
|
volumeMounts:
|
|
- name: "brilliant-opensearch-cluster-master"
|
|
mountPath: /usr/share/opensearch/data
|
|
- name: config-emptydir
|
|
mountPath: /usr/share/opensearch/config/opensearch.yml
|
|
subPath: opensearch.yml
|
|
# Currently some extra blocks accept strings
|
|
# to continue with backwards compatibility this is being kept
|
|
# whilst also allowing for yaml to be specified too.
|
|
- mountPath: /usr/share/opensearch/config/certs
|
|
name: runtime-certs
|
|
readOnly: true
|