Enable Elasticsearch running as non-root without any extra capabilities or privileges

helm/README.md

@@ -513,6 +513,9 @@ The following table lists the configurable parameters of the opendistro elastics
 | `kibana.livenessProbe`                                    | Configuration for the [livenessProbe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/)                     | `[]`                                                                    |
 | `kibana.startupProbe`                                    | Configuration for the [startupProbe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/)                     | `[]`                                                                    |
 | `elasticsearch.discoveryOverride`                         | For hot/warm architectures. Allows second aliased deployment to find cluster.                                                                            | `""`                                                                    |
+| `elasticsearch.fixmount.enabled`                          | Enable initContainer to fix mount permissions. Not required if setting a fsGroup via securityContext                                                     | `true`                                                                    |
+| `elasticsearch.sys_chroot.enabled`                        | Enable giving Elasticsearch containers the "SYS_CHROOT" capability.                                                                                      | `true`                                                                    |
+| `elasticsearch.sysctl.enabled`                            | Enable initContainer to set sysctl "vm.max_map_count"                                                                                                    | `true`                                                                  |
 | `elasticsearch.securityConfig.enabled`                    | Use custom [security configs](https://github.com/opendistro-for-elasticsearch/security/tree/master/securityconfig)                                       | `"true"`                                                                |
 | `elasticsearch.securityConfig.path`                       | Path to security config files                                                                                                                            | `"/usr/share/elasticsearch/plugins/opendistro_security/securityconfig"` |
 | `elasticsearch.securityConfig.actionGroupsSecret`         | Name of secret with [action_groups.yml](https://github.com/opendistro-for-elasticsearch/security/blob/master/securityconfig/action_groups.yml) defined   | `""`                                                                    |
@@ -521,6 +524,7 @@ The following table lists the configurable parameters of the opendistro elastics
 | `elasticsearch.securityConfig.rolesSecret`                | Name of secret with [roles.yml](https://github.com/opendistro-for-elasticsearch/security/blob/master/securityconfig/roles.yml) defined                   | `""`                                                                    |
 | `elasticsearch.securityConfig.rolesMappingSecret`         | Name of secret with [roles_mapping.yml](https://github.com/opendistro-for-elasticsearch/security/blob/master/securityconfig/roles_mapping.yml) defined   | `""`                                                                    |
 | `elasticsearch.securityConfig.tenantsSecret`              | Name of secret with [tenants.yml](https://github.com/opendistro-for-elasticsearch/security/blob/master/securityconfig/tenants.yml) defined               | `""`                                                                    |
+| `elasticsearch.securityContextCustom`                     | securityContext for the ElasticSearch pods                                                                                                               | `{}`                                                                    |
 | `elasticsearch.ssl.transport.existingCertSecret`          | Name of secret that contains the transport certs                                                                                                         | `""`                                                                    |
 | `elasticsearch.ssl.transport.existingCertSecretCertSubPath`  | Subpath of elastic transport cert secret                                                                                                              | `"elk-transport-crt.pem"`                                               |
 | `elasticsearch.ssl.transport.existingCertSecretKeySubPath`   | Subpath of elastic transport key secret                                                                                                               | `"elk-transport-key.pem"`                                               |

helm/opendistro-es/templates/elasticsearch/es-client-deploy.yaml

@@ -69,12 +69,18 @@ spec:
 {{- end }}
 {{- if .Values.elasticsearch.extraInitContainers }}
 {{ toYaml .Values.elasticsearch.extraInitContainers| indent 6 }}
+{{- end }}
+{{- with .Values.elasticsearch.securityContextCustom }}
+      securityContext:
+{{ toYaml . | indent 8 }}
 {{- end }}
       containers:
       - name: elasticsearch
         securityContext:
+{{- if .Values.elasticsearch.sys_chroot.enabled }}
           capabilities:
             add: ["SYS_CHROOT"]
+{{- end }}
         env:
         - name: cluster.name
           value: {{ .Values.global.clusterName }}

helm/opendistro-es/templates/elasticsearch/es-data-sts.yaml

@@ -65,13 +65,15 @@ spec:
         securityContext:
           privileged: true
 {{- end }}
+{{- if .Values.elasticsearch.fixmount.enabled }}
       - name: fixmount
         command: [ 'sh', '-c', 'chown -R 1000:1000 /usr/share/elasticsearch/data' ]
         image: {{ .Values.global.registry }}/{{ .Values.elasticsearch.initContainer.image }}:{{ .Values.elasticsearch.initContainer.imageTag }}
         volumeMounts:
           - mountPath: /usr/share/elasticsearch/data
             name: data
             subPath: {{ .Values.elasticsearch.data.persistence.subPath }}
+{{- end }}
 {{- if .Values.elasticsearch.extraInitContainers }}
 {{ toYaml .Values.elasticsearch.extraInitContainers| indent 6 }}
 {{- end }}
@@ -80,11 +82,17 @@ spec:
 {{ toYaml . | indent 8 }}
     {{- end }}
       serviceAccountName: {{ template "opendistro-es.elasticsearch.serviceAccountName" . }}
+{{- with .Values.elasticsearch.securityContextCustom }}
+      securityContext:
+{{ toYaml . | indent 8 }}
+{{- end }}
       containers:
       - name: elasticsearch
         securityContext:
+{{- if .Values.elasticsearch.sys_chroot.enabled }}
           capabilities:
             add: ["SYS_CHROOT"]
+{{- end }}
         env:
         - name: cluster.name
           value: {{ .Values.global.clusterName }}

helm/opendistro-es/templates/elasticsearch/es-master-sts.yaml

@@ -70,24 +70,32 @@ spec:
         securityContext:
           privileged: true
 {{- end }}
+{{- if .Values.elasticsearch.fixmount.enabled }}
       - name: fixmount
         command: [ 'sh', '-c', 'chown -R 1000:1000 /usr/share/elasticsearch/data' ]
         image: {{ .Values.global.registry }}/{{ .Values.elasticsearch.initContainer.image }}:{{ .Values.elasticsearch.initContainer.imageTag }}
         volumeMounts:
           - mountPath: /usr/share/elasticsearch/data
             name: data
             subPath: {{ .Values.elasticsearch.master.persistence.subPath }}
+{{- end }}
 {{- if .Values.elasticsearch.extraInitContainers }}
 {{ toYaml .Values.elasticsearch.extraInitContainers| indent 6 }}
 {{- end }}
 {{- if .Values.elasticsearch.master.extraInitContainers }}
 {{ toYaml .Values.elasticsearch.master.extraInitContainers| indent 6 }}
+{{- end }}
+{{- with .Values.elasticsearch.securityContextCustom }}
+      securityContext:
+{{ toYaml . | indent 8 }}
 {{- end }}
       containers:
       - name: elasticsearch
+{{- if .Values.elasticsearch.sys_chroot.enabled }}
         securityContext:
           capabilities:
             add: ["SYS_CHROOT"]
+{{- end }}
         env:
         - name: cluster.name
           value: {{ .Values.global.clusterName }}