This repository has been archived by the owner on Feb 22, 2022. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 16.7k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Harden elasticsearch chart for Kube 1.5 (#1062)
* Update elasticsearch chart to work with Kube 1.5 * Add environment variable KUBERNETES_MASTER, resolves issue documented here: fabric8io/fabric8#6229 (comment) * Rename PetSet to StatefulSet, rename template file * Add initialDelay and increase timesouts to all liveness and readiness checks. This was the only way I could get it to deploy reliably in my environment. * Update to a newer image version * Harden aspects of the elasticsearch chart * Added configmap to explicitly provide cluster configurations and scripts * Replace depreciating `ES_HEAP_SIZE` with `ES_JAVA_OPTS` to position for ES v5 support * Removed alpha storage class operators * Removed catastrophic liveness probe checking entire clusters health * Readiness probe now inspects local node health * Added termination grace period (defaults to 15m) to allow pre-stop-script.sh time to gracefully migrate shards * Added init container to configure `vm.max_map_count` * Updated elasticsearch.yaml: * Added `PROCESSOR` configuration to prevent large cluster garbage collection issues leading to node eviction * Added configurable gateway defaults to help avoid a split brain, requiring two masters online and in consensus before recovery can continue * Updated pre-stop-script.sh: * Check `v1beta1` `statefulset` endpoint * Evalute `.spec.replicas` for statefulset desired size * Clear `_cluster/settings` ip exclusion prior to shutdown to avoid a possible (random) ip match scenario on expansion of the clsuter * Data nodes now use default storage class if once is not specified * Apply best practices * Add Notes for client service types, and warnings
- Loading branch information
1 parent
eb6d3e2
commit 09892a3
Showing
16 changed files
with
510 additions
and
272 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,11 +1,15 @@ | ||
| name: elasticsearch | ||
| home: https://www.elastic.co/products/elasticsearch | ||
| version: 0.1.4 | ||
| version: 0.1.6 | ||
| description: Flexible and powerful open source, distributed real-time search and analytics engine. | ||
| icon: https://static-www.elastic.co/assets/blteb1c97719574938d/logo-elastic-elasticsearch-lt.svg | ||
| sources: | ||
| - https://www.elastic.co/products/elasticsearch | ||
| - https://github.com/jetstack/elasticsearch-pet | ||
| - https://github.com/giantswarm/kubernetes-elastic-stack | ||
| - https://github.com/GoogleCloudPlatform/elasticsearch-docker | ||
| maintainers: | ||
| - name: Christian Simon | ||
| email: [email protected] | ||
| - name: Michael Haselton | ||
| email: [email protected] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| The elasticsearch cluster has been installed. | ||
|
|
||
| Elasticsearch can be accessed: | ||
|
|
||
| * Within your cluster, at the following DNS name at port 9200: | ||
|
|
||
| {{ template "client.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local | ||
|
|
||
| * From outside the cluster, run these commands in the same shell: | ||
| {{- if contains "NodePort" .Values.client.serviceType }} | ||
|
|
||
| export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "client.fullname" . }}) | ||
| export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") | ||
| echo http://$NODE_IP:$NODE_PORT | ||
| {{- else if contains "LoadBalancer" .Values.client.serviceType }} | ||
|
|
||
| WARNING: You have likely exposed your Elasticsearch cluster direct to the internet. | ||
| Elasticsearch does not implement any security for public facing clusters by default. | ||
| As a minimum level of security; switch to ClusterIP/NodePort and place an Nginx gateway infront of the cluster in order to lock down access to dangerous HTTP endpoints and verbs. | ||
|
|
||
| NOTE: It may take a few minutes for the LoadBalancer IP to be available. | ||
| You can watch the status of by running 'kubectl get svc -w {{ template "client.fullname" . }}' | ||
|
|
||
| export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "client.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}') | ||
| echo http://$SERVICE_IP:9200 | ||
| {{- else if contains "ClusterIP" .Values.client.serviceType }} | ||
|
|
||
| export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ template "name" . }},component={{ .Values.client.name }},release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") | ||
| echo "Visit http://127.0.0.1:9200 to use Elasticsearch" | ||
| kubectl port-forward --namespace {{ .Release.Namespace }} $POD_NAME 9200:9200 | ||
| {{- end }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| {{/* vim: set filetype=mustache: */}} | ||
| {{/* | ||
| Expand the name of the chart. | ||
| */}} | ||
| {{- define "name" -}} | ||
| {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} | ||
| {{- end -}} | ||
|
|
||
| {{/* | ||
| Create a default fully qualified app name. | ||
| We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). | ||
| */}} | ||
| {{- define "fullname" -}} | ||
| {{- $name := default .Chart.Name .Values.nameOverride -}} | ||
| {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} | ||
| {{- end -}} | ||
|
|
||
| {{/* | ||
| Create a default fully qualified client name. | ||
| We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). | ||
| */}} | ||
| {{- define "client.fullname" -}} | ||
| {{- $name := default .Chart.Name .Values.nameOverride -}} | ||
| {{- printf "%s-%s-%s" .Release.Name $name .Values.client.name | trunc 63 | trimSuffix "-" -}} | ||
| {{- end -}} | ||
|
|
||
| {{/* | ||
| Create a default fully qualified data name. | ||
| We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). | ||
| */}} | ||
| {{- define "data.fullname" -}} | ||
| {{- $name := default .Chart.Name .Values.nameOverride -}} | ||
| {{- printf "%s-%s-%s" .Release.Name $name .Values.data.name | trunc 63 | trimSuffix "-" -}} | ||
| {{- end -}} | ||
|
|
||
| {{/* | ||
| Create a default fully qualified master name. | ||
| We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). | ||
| */}} | ||
| {{- define "master.fullname" -}} | ||
| {{- $name := default .Chart.Name .Values.nameOverride -}} | ||
| {{- printf "%s-%s-%s" .Release.Name $name .Values.master.name | trunc 63 | trimSuffix "-" -}} | ||
| {{- end -}} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
19 changes: 19 additions & 0 deletions
19
incubator/elasticsearch/templates/elasticsearch-client-svc.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| apiVersion: v1 | ||
| kind: Service | ||
| metadata: | ||
| labels: | ||
| app: {{ template "name" . }} | ||
| chart: {{ .Chart.Name }}-{{ .Chart.Version }} | ||
| component: "{{ .Values.client.name }}" | ||
| heritage: {{ .Release.Service }} | ||
| release: {{ .Release.Name }} | ||
| name: {{ template "client.fullname" . }} | ||
| spec: | ||
| ports: | ||
| - port: 9200 | ||
| targetPort: http | ||
| selector: | ||
| app: {{ template "name" . }} | ||
| component: "{{ .Values.client.name }}" | ||
| release: {{ .Release.Name }} | ||
| type: {{ .Values.client.serviceType }} |
16 changes: 0 additions & 16 deletions
16
incubator/elasticsearch/templates/elasticsearch-cluster-svc.yaml
This file was deleted.
Oops, something went wrong.
Oops, something went wrong.