elasticsearch.yaml

---
# Source: elasticsearch/templates/poddisruptionbudget.yaml
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: "elasticsearch-master-pdb"
spec:
  maxUnavailable: 1
  selector:
    matchLabels:
      app: "elasticsearch-master"
---
# Source: elasticsearch/templates/secret-cert.yaml
apiVersion: v1
kind: Secret
type: kubernetes.io/tls
metadata:
  name: elasticsearch-master-certs
  labels:
    app: elasticsearch-master
    chart: "elasticsearch"
    heritage: Helm
    release: elasticsearch
data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURoekNDQW0rZ0F3SUJBZ0lRSkdpcWxaNjNqcmZkeklZWk50K0RXakFOQmdrcWhraUc5dzBCQVFzRkFEQWIKTVJrd0Z3WURWUVFERXhCbGJHRnpkR2xqYzJWaGNtTm9MV05oTUI0WERUSTFNRE13TlRFeE16SXhPRm9YRFRJMgpNRE13TlRFeE16SXhPRm93SHpFZE1Cc0dBMVVFQXhNVVpXeGhjM1JwWTNObFlYSmphQzF0WVhOMFpYSXdnZ0VpCk1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLQW9JQkFRRHB5a2MzdkdrNERsUlFqdlhiY2hlZUQzUXgKa1dlcjJqcHJ5b2M2U29WZkVMcmE2S2xrNWhzeUh0OXdnZmh2RGwxR0hrV3YyV1VoTnF6cUJpNGFVamovM1AyWgpZK3BJdVR6R3JzS2hHYmF4ekxBU21kUkh5b2NadTNITjYvVm1pQXhnakpaQll2eHZKMkdGa3FLbnN1ZjVZeFdDClk5OHpaSXdWd3phRkVUUEk0amdxbHNqNE5VNGg2OUdocU5CaVpVa0RyTmZqNkNMeDNqN3c5MjR4MUMzeCtBUkEKSDBRVkxiMHh5WGVSS3g3QldaOVN1V2c5M2NqZnpneHFNLzUycFVkRVA4ZWhhblZRd25xZVJQcFJKYU5ZWjlGNQpMSVZXUUpENCtsbXdmbjBBVWlibkxSVzZDYXpsYUFuY1RrMWN5YVZzQnNqZzA1aUVCaFlGaEF2N0dKU2pBZ01CCkFBR2pnY0l3Z2I4d0RnWURWUjBQQVFIL0JBUURBZ1dnTUIwR0ExVWRKUVFXTUJRR0NDc0dBUVVGQndNQkJnZ3IKQmdFRkJRY0RBakFNQmdOVkhSTUJBZjhFQWpBQU1COEdBMVVkSXdRWU1CYUFGSnVDN1JSUGc2Q3lYUkVFdDBrVwo2eDFzUWovQ01GOEdBMVVkRVFSWU1GYUNGR1ZzWVhOMGFXTnpaV0Z5WTJndGJXRnpkR1Z5Z2h4bGJHRnpkR2xqCmMyVmhjbU5vTFcxaGMzUmxjaTVrWldaaGRXeDBnaUJsYkdGemRHbGpjMlZoY21Ob0xXMWhjM1JsY2k1a1pXWmgKZFd4MExuTjJZekFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBSzNTV284RU16eWJEd3pQR1VHMEh1NXUrNmhvOAp3WDNjZWtpdTJYQzFZZVRMTXNmMmk1RHZvZ1JmOFVXVVRwZmt4SGwvTmlVS3Zwcm1xREdRUGdkQmdMUDlRVVFqCnRDVDNuOUdGSzRsNkJBU0wrTXdxWk1HK2dCRytQTjBtaFJ1MUJzMEFHaWthK1lTcC9pc00wYWwwRzd3bUNSaWgKbHNoY2RLb3BvNHR3SjVleEtpNTYrQUtSNEVoMzY1Wk9rK3BQdVlwZ3dBL3hQV2hxdzZhTEw2a1B3ZXhPYUJ6SwphcStBRXBlMGhaWkRlWnNKNFdyQW5oQVFYc1VxaVhUSlhiTW1MejdDRE9TU05iS3BsV1l2Z3FtWkZ6TC9mRXFpCjZWQWJNL2V5RVU0MU5JVG15b1FJemR0dW94aWNDOHY1WFZuMitWVDF4Zk83WTltUXZLNjEwMEJrMWc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcFFJQkFBS0NBUUVBNmNwSE43eHBPQTVVVUk3MTIzSVhuZzkwTVpGbnE5bzZhOHFIT2txRlh4QzYydWlwClpPWWJNaDdmY0lINGJ3NWRSaDVGcjlsbElUYXM2Z1l1R2xJNC85ejltV1BxU0xrOHhxN0NvUm0yc2N5d0VwblUKUjhxSEdidHh6ZXYxWm9nTVlJeVdRV0w4YnlkaGhaS2lwN0xuK1dNVmdtUGZNMlNNRmNNMmhSRXp5T0k0S3BiSQorRFZPSWV2Um9halFZbVZKQTZ6WDQrZ2k4ZDQrOFBkdU1kUXQ4ZmdFUUI5RUZTMjlNY2wza1NzZXdWbWZVcmxvClBkM0kzODRNYWpQK2RxVkhSRC9Ib1dwMVVNSjZua1Q2VVNXaldHZlJlU3lGVmtDUStQcFpzSDU5QUZJbTV5MFYKdWdtczVXZ0ozRTVOWE1tbGJBYkk0Tk9ZaEFZV0JZUUwreGlVb3dJREFRQUJBb0lCQVFEaStnTFlwdkNVZnJ6MwpGVVMyei9jRCtzYjVWTTBNK0tzZGVaeCtTRmxpS1hEd0ZWQllhRnJnOXo1QkViNHJ2QXRzaHZsck42bktiRFhHClkwZWhRRkNjZ0dZcDVPcFJ2cDIxMjNlVVJzMnJveWtTZGd5MXduZ1YwSGsxemk4TFkyeDQxQ1VReUZTQ2FmNXgKV3lMVm80azZBeXVmMHV5aERhNC9kcTVZMUpHdEpiRHM1emt5ZllCS1pPcmJLQk9XbW95TjAyUmxFMEZSNkcwcAo1aXphS203Z05OdWFsU3h2Sm5hTGwrTE9VK0JIRWJLSlFORVFoOVF6M1NYb0Njd2lRVXFyVW9PKzIyYjhkQUl6CnlEZVVPU1JrbUJZZzRXTFJ4OTJQMHZIUEpXRUdtMEZSU0lheEpWeHBKK25pRld0Y0EzTWg4SFJyT205SlU4TnoKNkpYSmVEVDVBb0dCQU83aTJTZVhYRHM3Y3ZZa2RIczlzQnNIaDI2UkdxQTZxVDFXUURQWG9hM2ZIYTRUYTUvdAoxcE5Kb3NtbVlTb3FIbVdaRVFPOGo1K0VHVnY3SVNidkhNenE3aW0vcGVHeWh4azhGcVM4ZS9ENTRyRFdjNFk2CnVUZEZMd0kwQUNROGNUZFdIcUUxTkZVMnJwV1pEV3diMkdjcjViZ1VDdzVmYmZGREVINGRxbWZQQW9HQkFQcUoKK0ZzeXpRQVdTVExZalpiK0VPTzE1Nnk2L2N4bml6VllPQVVCQ1ZjWnJIZE9VcE5RY2Nld3NLeU1YaXcvVWErYgp4Q01VRWJDd0xEWHdjTlZBZjFaQ2x2RERjbEptQ0UzWnUyazd4aURFQTMweCtia1RILytwcldTRm5DUENvbUFnCjVUa1M0SU50YWh5UVIvbTQrWVRRODJzTUU2cmJ5emZZRithMTVtYnRBb0dBQU9MQWNXQWpUR2p0QlRLZlovR1QKbkpZTGo0SmtPZUhkek1kc0Y0VWVLVm5oYjByTkpGdXFad05uNGgyRzBMUTFScVVwcGZ6bC8yNXE5YWRadVI0NwoyaHFvNVdpN2dibTZ2SUkzaDBiWG9zNGFaQk4zZkREdGpPSHB5YlZOcHRTK2lyajhCaGIvYWExNU9qN0dDUGVWCmR0UjMxcFhrY0pveit5Z0hnS0ExaUlzQ2dZRUFsbzlEU01zR2x2N05qbGpFL2ZCQWhoZFMybUtsRXFsRzV3L1UKMm16OUIvTE55Z1N2YXdmMDJHUStSL015eExSb2luZTVMcnRveGgyWTgvRkNYV1VkSU9Gemc4eHdiMFFSeVhjSApRUDVDMm4zdyt0T0Zsc3IvZDh5bi9yaXNWSEVxMDBueGRwTDVpUUcvdXRxWjVtQmEwbzRmT2oxUHRHWFJnZ1hDCmwwckk0eUVDZ1lFQXhpdytCSjFSZGxoTTIwUFc1SXgzcVMzeGg3SjczSVV4aVQ4UnZiVGpkTkx5RDVtajlTTHYKUmxTdWswaVpNUGFKa1hvRTQyRmtwdjErRktGVVE1NSs1WGpZT1RVSWhUM056ME5VMm5VUEpkZU1OSlI4bExQNgp0V2dYWlFPS3N6SDAvUjBDYnpxcVJaV1hWZVNHcnRGZDlQUmRURUEzWEdIMHEwVVdKb2NLWFowPQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURJVENDQWdtZ0F3SUJBZ0lRSU0wWU1EQ1RmL3doQ2twYzhpRGtSekFOQmdrcWhraUc5dzBCQVFzRkFEQWIKTVJrd0Z3WURWUVFERXhCbGJHRnpkR2xqYzJWaGNtTm9MV05oTUI0WERUSTFNRE13TlRFeE16SXhPRm9YRFRJMgpNRE13TlRFeE16SXhPRm93R3pFWk1CY0dBMVVFQXhNUVpXeGhjM1JwWTNObFlYSmphQzFqWVRDQ0FTSXdEUVlKCktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQUtRZ1p4RWRxcTlRVnhKTVN0NXJYdVVqY29aakZGQm4KaCtib0ZIV3BWdmZsV3VsWFlMTlRSTno4T2JLMDlrQ2I1ZlljUS9hTUoxNkVQd1F2OHlUdkFCSVZqKzJ3S1BBVApid05Xb3d4cjhRL1I3RFdLa2RRVWpoMGJrZ2hDSzh2b3U2TDVkbCtMU2hwR3NoaXpaSnRHeVJjakhmbmVLSDUxCkZycUpjY1ozSjVUUWVCa0l1M3NXcGFkWVRuRmVtUGNhazlUdWh0ZTRPMWJJZUJtbFBUWXpCZ095ZWs1MU45eHoKNXdUK3VLMWR4U2JwUUZyakN5UlZkaitmUzRIeVJ1NjlERTZRT0lzUElzV0dSNmNHWFc3WCtzVlhEYWIwU0tidgo5ZGsvYzRaWlQ1ZmRvRDJUN2F6eWQybGJkVnJLZEtZd1QrS090ZWY0bXlidVlHZ0RjQzRRdnBjQ0F3RUFBYU5oCk1GOHdEZ1lEVlIwUEFRSC9CQVFEQWdLa01CMEdBMVVkSlFRV01CUUdDQ3NHQVFVRkJ3TUJCZ2dyQmdFRkJRY0QKQWpBUEJnTlZIUk1CQWY4RUJUQURBUUgvTUIwR0ExVWREZ1FXQkJTYmd1MFVUNE9nc2wwUkJMZEpGdXNkYkVJLwp3akFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBQmhhUWtRWlg3aDRLditkbnVuMExRUmlrWkpRMTJjUE9yaUk5CkZzZS9GUWxzcUxUV24yU0t3cUE2V1RzeXlDUjhyS1ZwTEdCUmxGT0dKV2hGZkhOd0RIT2RNbTJWMFA5YUxuTzYKK2JrYjN4WnhiTGg1M2h5VXFNK3Q4aURnYTVUa2lSTWNHRVdwc2lUNVpidzBZd0dKdmN4ZFRGTHBraDJ6R1RKdQpEWnQxTy9SZ3ZuSzNQSEIrVmZZRDd5RWJYbUdxUlVQTGU3TXpVa1oydHRIdDc2TURNRytvYndwaVJDMEdQbCtBCmVRdDRZVHhEczZsSEpYc08rNGdZa2dXREtSNmpLWEpsSDBHTVY2d1crOWRhYUswUkZxNncrTE0zSlkxVnRDYloKUTNzVHR5QWlxblNPOERnLytVV0lLblZ4UzZOemtYOTFONWVUL0ttUk1FcTg1QVlValE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
---
# Source: elasticsearch/templates/secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: elasticsearch-master-credentials
  labels:
    heritage: "Helm"
    release: "elasticsearch"
    chart: "elasticsearch"
    app: "elasticsearch-master"
type: Opaque
data:
  username: ZWxhc3RpYw==
  password: "bWJvYUxydm80WEVENVh2cQ=="
---
# Source: elasticsearch/templates/service.yaml
kind: Service
apiVersion: v1
metadata:
  name: elasticsearch-master
  labels:
    heritage: "Helm"
    release: "elasticsearch"
    chart: "elasticsearch"
    app: "elasticsearch-master"
  annotations:
    {}
spec:
  type: ClusterIP
  selector:
    release: "elasticsearch"
    chart: "elasticsearch"
    app: "elasticsearch-master"
  publishNotReadyAddresses: false
  ports:
  - name: http
    protocol: TCP
    port: 9200
  - name: transport
    protocol: TCP
    port: 9300
---
# Source: elasticsearch/templates/service.yaml
kind: Service
apiVersion: v1
metadata:
  name: elasticsearch-master-headless
  labels:
    heritage: "Helm"
    release: "elasticsearch"
    chart: "elasticsearch"
    app: "elasticsearch-master"
  annotations:
    service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
spec:
  clusterIP: None # This is needed for statefulset hostnames like elasticsearch-0 to resolve
  # Create endpoints also if the related pod isn't ready
  publishNotReadyAddresses: true
  selector:
    app: "elasticsearch-master"
  ports:
  - name: http
    port: 9200
  - name: transport
    port: 9300
---
# Source: elasticsearch/templates/statefulset.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: elasticsearch-master
  labels:
    heritage: "Helm"
    release: "elasticsearch"
    chart: "elasticsearch"
    app: "elasticsearch-master"
  annotations:
    esMajorVersion: "8"
spec:
  serviceName: elasticsearch-master-headless
  selector:
    matchLabels:
      app: "elasticsearch-master"
  replicas: 3
  podManagementPolicy: Parallel
  updateStrategy:
    type: RollingUpdate
  volumeClaimTemplates:
  - metadata:
      name: elasticsearch-master
    spec:
      accessModes:
      - ReadWriteOnce
      resources:
        requests:
          storage: 30Gi
  template:
    metadata:
      name: "elasticsearch-master"
      labels:
        release: "elasticsearch"
        chart: "elasticsearch"
        app: "elasticsearch-master"
      annotations:
        
    spec:
      securityContext:
        fsGroup: 1000
        runAsUser: 1000
      automountServiceAccountToken: true
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: app
                operator: In
                values:
                - "elasticsearch-master"
            topologyKey: kubernetes.io/hostname
      terminationGracePeriodSeconds: 120
      volumes:
        - name: elasticsearch-certs
          secret:
           secretName: elasticsearch-master-certs
      enableServiceLinks: true
      initContainers:
      - name: configure-sysctl
        securityContext:
          runAsUser: 0
          privileged: true
        image: "docker.elastic.co/elasticsearch/elasticsearch:8.5.1"
        imagePullPolicy: "IfNotPresent"
        command: ["sysctl", "-w", "vm.max_map_count=262144"]
        resources:
          {}

      containers:
      - name: "elasticsearch"
        securityContext:
          capabilities:
            drop:
            - ALL
          runAsNonRoot: true
          runAsUser: 1000
        image: "docker.elastic.co/elasticsearch/elasticsearch:8.5.1"
        imagePullPolicy: "IfNotPresent"
        readinessProbe:
          exec:
            command:
              - bash
              - -c
              - |
                set -e

                # Exit if ELASTIC_PASSWORD in unset
                if [ -z "${ELASTIC_PASSWORD}" ]; then
                  echo "ELASTIC_PASSWORD variable is missing, exiting"
                  exit 1
                fi

                # If the node is starting up wait for the cluster to be ready (request params: "wait_for_status=green&timeout=1s" )
                # Once it has started only check that the node itself is responding
                START_FILE=/tmp/.es_start_file

                # Disable nss cache to avoid filling dentry cache when calling curl
                # This is required with Elasticsearch Docker using nss < 3.52
                export NSS_SDB_USE_CACHE=no

                http () {
                  local path="${1}"
                  local args="${2}"
                  set -- -XGET -s

                  if [ "$args" != "" ]; then
                    set -- "$@" $args
                  fi

                  set -- "$@" -u "elastic:${ELASTIC_PASSWORD}"

                  curl --output /dev/null -k "$@" "https://127.0.0.1:9200${path}"
                }

                if [ -f "${START_FILE}" ]; then
                  echo 'Elasticsearch is already running, lets check the node is healthy'
                  HTTP_CODE=$(http "/" "-w %{http_code}")
                  RC=$?
                  if [[ ${RC} -ne 0 ]]; then
                    echo "curl --output /dev/null -k -XGET -s -w '%{http_code}' \${BASIC_AUTH} https://127.0.0.1:9200/ failed with RC ${RC}"
                    exit ${RC}
                  fi
                  # ready if HTTP code 200, 503 is tolerable if ES version is 6.x
                  if [[ ${HTTP_CODE} == "200" ]]; then
                    exit 0
                  elif [[ ${HTTP_CODE} == "503" && "8" == "6" ]]; then
                    exit 0
                  else
                    echo "curl --output /dev/null -k -XGET -s -w '%{http_code}' \${BASIC_AUTH} https://127.0.0.1:9200/ failed with HTTP code ${HTTP_CODE}"
                    exit 1
                  fi

                else
                  echo 'Waiting for elasticsearch cluster to become ready (request params: "wait_for_status=green&timeout=1s" )'
                  if http "/_cluster/health?wait_for_status=green&timeout=1s" "--fail" ; then
                    touch ${START_FILE}
                    exit 0
                  else
                    echo 'Cluster is not yet ready (request params: "wait_for_status=green&timeout=1s" )'
                    exit 1
                  fi
                fi
          failureThreshold: 3
          initialDelaySeconds: 10
          periodSeconds: 10
          successThreshold: 3
          timeoutSeconds: 5
        ports:
        - name: http
          containerPort: 9200
        - name: transport
          containerPort: 9300
        resources:
          limits:
            cpu: 1000m
            memory: 2Gi
          requests:
            cpu: 1000m
            memory: 2Gi
        env:
          - name: node.name
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          - name: cluster.initial_master_nodes
            value: "elasticsearch-master-0,elasticsearch-master-1,elasticsearch-master-2,"
          - name: node.roles
            value: "master,data,data_content,data_hot,data_warm,data_cold,ingest,ml,remote_cluster_client,transform,"
          - name: discovery.seed_hosts
            value: "elasticsearch-master-headless"
          - name: cluster.name
            value: "elasticsearch"
          - name: network.host
            value: "0.0.0.0"
          - name: ELASTIC_PASSWORD
            valueFrom:
              secretKeyRef:
                name: elasticsearch-master-credentials
                key: password
          - name: xpack.security.enabled
            value: "true"
          - name: xpack.security.transport.ssl.enabled
            value: "true"
          - name: xpack.security.http.ssl.enabled
            value: "true"
          - name: xpack.security.transport.ssl.verification_mode
            value: "certificate"
          - name: xpack.security.transport.ssl.key
            value: "/usr/share/elasticsearch/config/certs/tls.key"
          - name: xpack.security.transport.ssl.certificate
            value: "/usr/share/elasticsearch/config/certs/tls.crt"
          - name: xpack.security.transport.ssl.certificate_authorities
            value: "/usr/share/elasticsearch/config/certs/ca.crt"
          - name: xpack.security.http.ssl.key
            value: "/usr/share/elasticsearch/config/certs/tls.key"
          - name: xpack.security.http.ssl.certificate
            value: "/usr/share/elasticsearch/config/certs/tls.crt"
          - name: xpack.security.http.ssl.certificate_authorities
            value: "/usr/share/elasticsearch/config/certs/ca.crt"
        volumeMounts:
          - name: "elasticsearch-master"
            mountPath: /usr/share/elasticsearch/data
          - name: elasticsearch-certs
            mountPath: /usr/share/elasticsearch/config/certs
            readOnly: true
---
# Source: elasticsearch/templates/test/test-elasticsearch-health.yaml
apiVersion: v1
kind: Pod
metadata:
  name: "elasticsearch-vmump-test"
  annotations:
    "helm.sh/hook": test
    "helm.sh/hook-delete-policy": hook-succeeded
spec:
  securityContext:
    fsGroup: 1000
    runAsUser: 1000
  containers:
  - name: "elasticsearch-eawvt-test"
    env:
      - name: ELASTIC_PASSWORD
        valueFrom:
          secretKeyRef:
            name: elasticsearch-master-credentials
            key: password
    image: "docker.elastic.co/elasticsearch/elasticsearch:8.5.1"
    imagePullPolicy: "IfNotPresent"
    command:
      - "sh"
      - "-c"
      - |
        #!/usr/bin/env bash -e
        curl -XGET --fail --cacert /usr/share/elasticsearch/config/certs/tls.crt -u "elastic:${ELASTIC_PASSWORD}" https://'elasticsearch-master:9200/_cluster/health?wait_for_status=green&timeout=1s'
    volumeMounts:
      - name: elasticsearch-certs
        mountPath: /usr/share/elasticsearch/config/certs
        readOnly: true
  restartPolicy: Never
  volumes:
    - name: elasticsearch-certs
      secret:
        secretName: elasticsearch-master-certs