diff --git a/incubator/elastic-stack/.helmignore b/incubator/elastic-stack/.helmignore new file mode 100644 index 0000000000..f0c1319444 --- /dev/null +++ b/incubator/elastic-stack/.helmignore @@ -0,0 +1,21 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj diff --git a/incubator/elastic-stack/Chart.yaml b/incubator/elastic-stack/Chart.yaml new file mode 100644 index 0000000000..6324446112 --- /dev/null +++ b/incubator/elastic-stack/Chart.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +description: A Helm chart for ELK +home: https://www.elastic.co/products +icon: https://www.elastic.co/assets/bltb35193323e8f1770/logo-elastic-stack-lt.svg +name: elastic-stack +version: 0.8.0 +appVersion: 6.0 +maintainers: +- name: rendhalver + email: pete.brown@powerhrg.com +- name: jar361 + email: jrodgers@powerhrg.com +- name: christian-roggia + email: christian.roggia@gmail.com diff --git a/incubator/elastic-stack/OWNERS b/incubator/elastic-stack/OWNERS new file mode 100644 index 0000000000..ee2cba86a8 --- /dev/null +++ b/incubator/elastic-stack/OWNERS @@ -0,0 +1,6 @@ +approvers: +- christian-roggia +- rendhalver +reviewers: +- christian-roggia +- rendhalver diff --git a/incubator/elastic-stack/README.md b/incubator/elastic-stack/README.md new file mode 100644 index 0000000000..292e7ed59d --- /dev/null +++ b/incubator/elastic-stack/README.md @@ -0,0 +1,44 @@ +# Elastic-stack Helm Chart + +This chart installs an elasticsearch cluster with kibana and logstash by default. +You can optionally disable logstash and install Fluentd if you prefer. It also optionally installs nginx-ldapauth-proxy and elasticsearch-curator. + +## Prerequisites Details + +* Kubernetes 1.8+ +* PV dynamic provisioning support on the underlying infrastructure + +## Chart Details +This chart will do the following: + +* Implemented a dynamically scalable elasticsearch cluster using Kubernetes StatefulSets/Deployments +* Multi-role deployment: master, client (coordinating) and data nodes +* Statefulset Supports scaling down without degrading the cluster + +## Installing the Chart + +To install the chart with the release name `my-release`: + +```bash +$ helm repo add incubator http://storage.googleapis.com/kubernetes-charts-incubator +$ helm install --name my-release incubator/elastic-stack +``` + +## Deleting the Charts + +Delete the Helm deployment as normal + +``` +$ helm delete my-release +``` + +Deletion of the StatefulSet doesn't cascade to deleting associated PVCs. To delete them: + +``` +$ kubectl delete pvc -l release=my-release,component=data +``` + +## Configuration + +Each requirement is configured with the options provided by that Chart. +Please consult the relevant charts for their configuration options. diff --git a/incubator/elastic-stack/requirements.lock b/incubator/elastic-stack/requirements.lock new file mode 100644 index 0000000000..bec868c2f4 --- /dev/null +++ b/incubator/elastic-stack/requirements.lock @@ -0,0 +1,21 @@ +dependencies: +- name: elasticsearch + repository: https://kubernetes-charts-incubator.storage.googleapis.com/ + version: 1.0.0 +- name: kibana + repository: https://kubernetes-charts.storage.googleapis.com/ + version: 0.6.0 +- name: logstash + repository: https://kubernetes-charts-incubator.storage.googleapis.com/ + version: 0.6.3 +- name: fluentd + repository: https://kubernetes-charts-incubator.storage.googleapis.com/ + version: 0.1.4 +- name: nginx-ldapauth-proxy + repository: https://kubernetes-charts.storage.googleapis.com/ + version: 0.1.2 +- name: elasticsearch-curator + repository: https://kubernetes-charts-incubator.storage.googleapis.com/ + version: 0.2.1 +digest: sha256:9d3100ecbb9146bd34d27eb5f608f52a9de8728a8ee499cc2e873865941bbfb5 +generated: 2018-06-18T14:34:01.676967041+10:00 diff --git a/incubator/elastic-stack/requirements.yaml b/incubator/elastic-stack/requirements.yaml new file mode 100644 index 0000000000..ae6ac1cecb --- /dev/null +++ b/incubator/elastic-stack/requirements.yaml @@ -0,0 +1,23 @@ +dependencies: +- name: elasticsearch + version: ^1.0.0 + repository: https://kubernetes-charts-incubator.storage.googleapis.com/ +- name: kibana + version: ^0.6.0 + repository: https://kubernetes-charts.storage.googleapis.com/ +- name: logstash + version: ^0.6.0 + repository: https://kubernetes-charts-incubator.storage.googleapis.com/ + condition: logstash.enabled +- name: fluentd + version: ^0.1.0 + repository: https://kubernetes-charts-incubator.storage.googleapis.com/ + condition: fluentd.enabled +- name: nginx-ldapauth-proxy + version: ^0.1.0 + repository: https://kubernetes-charts.storage.googleapis.com/ + condition: nginx-ldapauth-proxy.enabled +- name: elasticsearch-curator + version: ^0.2.0 + repository: https://kubernetes-charts-incubator.storage.googleapis.com/ + condition: elasticsearch-curator.enabled diff --git a/incubator/elastic-stack/templates/NOTES.txt b/incubator/elastic-stack/templates/NOTES.txt new file mode 100644 index 0000000000..96ae71d8eb --- /dev/null +++ b/incubator/elastic-stack/templates/NOTES.txt @@ -0,0 +1,31 @@ +The elasticsearch cluster and associated extras have been installed. + +Kibana can be accessed: + + * Within your cluster, at the following DNS name at port 9200: + + {{ template "kibana.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local + + * From outside the cluster, run these commands in the same shell: + {{- if contains "NodePort" .Values.kibana.service.type }} + + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "kibana.fullname" . }}) + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + echo http://$NODE_IP:$NODE_PORT + {{- else if contains "LoadBalancer" .Values.kibana.service.type }} + + WARNING: You have likely exposed your Elasticsearch cluster direct to the internet. + Elasticsearch does not implement any security for public facing clusters by default. + As a minimum level of security; switch to ClusterIP/NodePort and place an Nginx gateway infront of the cluster in order to lock down access to dangerous HTTP endpoints and verbs. + + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + You can watch the status of by running 'kubectl get svc -w {{ template "kibana.fullname" . }}' + + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "kibana.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}') + echo http://$SERVICE_IP:9200 + {{- else if contains "ClusterIP" .Values.kibana.service.type }} + + export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ template "kibana.name" . }},release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") + echo "Visit http://127.0.0.1:5601 to use Kibana" + kubectl port-forward --namespace {{ .Release.Namespace }} $POD_NAME 5601:5601 + {{- end }} diff --git a/incubator/elastic-stack/templates/_helpers.tpl b/incubator/elastic-stack/templates/_helpers.tpl new file mode 100644 index 0000000000..c23cdb96b1 --- /dev/null +++ b/incubator/elastic-stack/templates/_helpers.tpl @@ -0,0 +1,32 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "elastic-stack.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "elastic-stack.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "elastic-stack.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} diff --git a/incubator/elastic-stack/values.yaml b/incubator/elastic-stack/values.yaml new file mode 100644 index 0000000000..7537581272 --- /dev/null +++ b/incubator/elastic-stack/values.yaml @@ -0,0 +1,43 @@ +# Default values for elk. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +kibana: + env: + ELASTICSEARCH_URL: http://http.default.svc.cluster.local:9200 + +logstash: + enabled: true + +fluentd: + enabled: false + +nginx-ldapauth-proxy: + enabled: false + # Example config to get it working with ELK. Adjust as you need to. + # proxy: + # port: 5601 + # # This is the internal hostname for the kibana service + # host: "elk-kibana.default.svc.cluster.local" + # authName: "ELK:Infrastructure:LDAP" + # ldapHost: "ldap.example.com" + # ldapDN: "dc=example,dc=com" + # ldapFilter: "objectClass=organizationalPerson" + # ldapBindDN: "cn=reader,dc=example,dc=com" + # requires: + # - name: "ELK-USER" + # filter: "cn=elkuser,ou=groups,dc=example,dc=com" + # ingress: + # enabled: true + # hosts: + # - "elk.example.com" + # annotations: + # kubernetes.io/ingress.class: nginx + # tls: + # - hosts: + # - elk.example.com + # secretName: example-elk-tls + # secrets: + # ldapBindPassword: PASSWORD +elasticsearch-curator: + enabled: false