From 204b020f0213a3654d50a4ca7a1daebdd0c286ae Mon Sep 17 00:00:00 2001 From: Siri Date: Mon, 4 Mar 2019 23:33:07 +0700 Subject: [PATCH] [graylog] Add Graylog chart (#9366) * Add Graylog chart Signed-off-by: KongZ * Fixed lint Signed-off-by: KongZ * Graylog 2.4:lastest remove wget from dockerfile and /docker-entrypoint.sh no longer working with k8s Signed-off-by: KongZ * Fixed journal permissions Signed-off-by: KongZ * remove rest_transport_uri and increase livenessProbe timeout Signed-off-by: KongZ * change node-id location, add metrics plugin, increase liveness timeout Signed-off-by: KongZ * apply new suggested standard labels Signed-off-by: KongZ * Add ES and MongoDB in requirements.yaml, also add options to auto install or manual Signed-off-by: KongZ * fixed elasticsearch could not start Signed-off-by: KongZ * trim trailing space Signed-off-by: KongZ * add new line character at the end of file Signed-off-by: KongZ * Move to incubator Signed-off-by: KongZ * remove requirements.lock Signed-off-by: KongZ * Add secrets to rbac role, update README Signed-off-by: KongZ * Update label in notes.txt Signed-off-by: KongZ * Fixed entrypoint to match with latest Graylog image Signed-off-by: KongZ * Upgrade Graylog to 2.5 and ES 6.5 Signed-off-by: KongZ * Fixed lint and add note about graylog image Signed-off-by: KongZ * Move to stable, add graylog.chart func Signed-off-by: KongZ * use UseCGroupMemoryLimitForHeap Signed-off-by: KongZ * update selector lables Signed-off-by: KongZ --- stable/graylog/Chart.yaml | 16 ++ stable/graylog/OWNERS | 4 + stable/graylog/README.md | 215 +++++++++++++++ stable/graylog/requirements.yaml | 11 + stable/graylog/templates/NOTES.txt | 80 ++++++ stable/graylog/templates/_helpers.tpl | 83 ++++++ stable/graylog/templates/configmap.yaml | 148 +++++++++++ stable/graylog/templates/files-configmap.yaml | 17 ++ stable/graylog/templates/ingress.yaml | 34 +++ stable/graylog/templates/master-service.yaml | 51 ++++ stable/graylog/templates/role.yaml | 22 ++ stable/graylog/templates/rolebinding.yaml | 19 ++ stable/graylog/templates/secret.yaml | 20 ++ stable/graylog/templates/serviceaccount.yaml | 12 + stable/graylog/templates/statefulset.yaml | 249 ++++++++++++++++++ stable/graylog/templates/tcp-service.yaml | 54 ++++ stable/graylog/templates/udp-service.yaml | 54 ++++ stable/graylog/templates/web-service.yaml | 50 ++++ stable/graylog/values.yaml | 244 +++++++++++++++++ 19 files changed, 1383 insertions(+) create mode 100755 stable/graylog/Chart.yaml create mode 100755 stable/graylog/OWNERS create mode 100644 stable/graylog/README.md create mode 100644 stable/graylog/requirements.yaml create mode 100644 stable/graylog/templates/NOTES.txt create mode 100644 stable/graylog/templates/_helpers.tpl create mode 100644 stable/graylog/templates/configmap.yaml create mode 100644 stable/graylog/templates/files-configmap.yaml create mode 100644 stable/graylog/templates/ingress.yaml create mode 100644 stable/graylog/templates/master-service.yaml create mode 100644 stable/graylog/templates/role.yaml create mode 100644 stable/graylog/templates/rolebinding.yaml create mode 100644 stable/graylog/templates/secret.yaml create mode 100644 stable/graylog/templates/serviceaccount.yaml create mode 100644 stable/graylog/templates/statefulset.yaml create mode 100644 stable/graylog/templates/tcp-service.yaml create mode 100644 stable/graylog/templates/udp-service.yaml create mode 100644 stable/graylog/templates/web-service.yaml create mode 100644 stable/graylog/values.yaml diff --git a/stable/graylog/Chart.yaml b/stable/graylog/Chart.yaml new file mode 100755 index 0000000000..e68810d918 --- /dev/null +++ b/stable/graylog/Chart.yaml @@ -0,0 +1,16 @@ +name: graylog +home: https://www.graylog.org +version: 0.1.0 +appVersion: 2.5.1-3 +description: Graylog is the centralized log management solution built to open standards for capturing, storing, and enabling real-time analysis of terabytes of machine data. +keywords: +- graylog +- logs +- syslog +- gelf +icon: https://global-uploads.webflow.com/5a218ef7897bf400019e2f16/5a218ef7897bf400019e2f60_logo-graylog.png +sources: +- https://www.graylog.org +maintainers: +- name: KongZ + email: goonohc@gmail.com diff --git a/stable/graylog/OWNERS b/stable/graylog/OWNERS new file mode 100755 index 0000000000..ede67635f3 --- /dev/null +++ b/stable/graylog/OWNERS @@ -0,0 +1,4 @@ +approvers: +- KongZ +reviewers: +- KongZ diff --git a/stable/graylog/README.md b/stable/graylog/README.md new file mode 100644 index 0000000000..03e502c57e --- /dev/null +++ b/stable/graylog/README.md @@ -0,0 +1,215 @@ +# Graylog + +This chart provide the [Graylog](https://www.graylog.org/) deployments. +Note: It is strongly recommend to use on Official Graylog image to run this chart. + +## Quick Installation +This chart requires the following charts before install Graylog + +1. MongoDB +2. Elasticsearch + +To install the Graylog Chart with all dependencies + +```bash +kubectl create namespace graylog + +helm repo add incubator http://storage.googleapis.com/kubernetes-charts-incubator +helm install --namespace "graylog" -n "graylog" incubator/graylog +``` + +## Manually Install Dependencies +This method is *recommended* when you want to expand the availability, scalability, and security of the services. You need to install MongoDB replicaset and Elasticsearch with proper settings before install Graylog. + +To install MongoDB, run + +```bash +helm install --namespace "graylog" -n "mongodb" stable/mongodb-replicaset +``` + +To install Elasticsearch, run + +```bash +helm install --namespace "graylog" -n "elasticsearch" stable/elasticsearch +``` + +Note: There are many alternative Elasticsearch available on GitHub. If you found the `stable/elasticsearch` is not suitable, you can search other charts from GitHub repositories. + +## Install Chart +To install the Graylog Chart into your Kubernetes cluster (This Chart requires persistent volume by default, you may need to create a storage class before install chart. + +```bash +helm repo add incubator http://storage.googleapis.com/kubernetes-charts-incubator +helm install --namespace "graylog" -n "graylog" incubator/graylog \ + --set tags.install-mongodb=false\ + --set tags.install-elasticsearch=false\ + --set graylog.mongodb.uri=mongodb://mongodb-mongodb-replicaset-0.mongodb-mongodb-replicaset.graylog.svc.cluster.local:27017/graylog?replicaSet=rs0 \ + --set elasticsearch.hosts=http://elasticsearch-client.graylog.svc.cluster.local:9200 +``` + +After installation succeeds, you can get a status of Chart + +```bash +helm status "graylog" +``` + +If you want to delete your Chart, use this command +```bash +helm delete --purge "graylog" +``` + +## Install Chart with specific Graylog cluster size +By default, this Chart will create a graylog with 2 nodes (1 master, 1 coordinating). If you want to change the cluster size during installation, you can use `--set graylog.replicas={value}` argument. Or edit `values.yaml` + +For example: +Set cluster size to 5 + +```bash +helm install --namespace "graylog" -n "graylog" --set servers.replicas=5 stable/graylog +``` + +The command above will install 1 master and 4 coordinating. + +## Install Chart with specific node pool +Sometime you may need to deploy your graylog to specific node pool to allocate resources. +For example, you have 6 vms in node pools and you want to deploy graylog to node which labeled as `cloud.google.com/gke-nodepool: graylog-pool` + +Set the following values in `values.yaml` + +```yaml +servers: + nodeSelector: { cloud.google.com/gke-nodepool: graylog-pool } +``` + +## Configuration + +The following table lists the configurable parameters of the Cassandra chart and their default values. + +| Parameter | Description | Default | +|-----------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------| +| `graylog.image` | `graylog` image repository | `graylog/graylog:2.4` | +| `graylog.imagePullPolicy` | Image pull policy | `IfNotPresent` | +| `graylog.replicas` | The number of Graylog instances in the cluster. The chart will automatic create assign master to one of replicas | `2` | +| `graylog.resources` | CPU/Memory resource requests/limits | Memory: `1024Mi`, CPU: `500m` | +| `graylog.heapSize` | Override Java heap size. If this value empty, chart will allocate heapsize using `-XX:+UseCGroupMemoryLimitForHeap` | `` | +| `graylog.nodeSelector` | Graylog server pod assignment | `{}` | +| `graylog.affinity` | Graylog server affinity | `{}` | +| `graylog.tolerations` | Graylog server tolerations | `[]` | +| `graylog.nodeSelector` | Graylog server node selector | `{}` | +| `graylog.service.type` | Kubernetes Service type | `ClusterIP` | +| `graylog.service.port` | Graylog Service port | `9000` | +| `graylog.podAnnotations` | Kubernetes Pod annotations | `{}` | +| `graylog.terminationGracePeriodSeconds` | Pod termination grace period | `120` | +| `graylog.updateStrategy` | Update Strategy of the StatefulSet | `OnDelete` | +| `graylog.persistence.enabled` | Use a PVC to persist data | `true` | +| `graylog.persistence.storageClass` | Storage class of backing PVC | `nil` (uses storage class annotation) | +| `graylog.persistence.accessMode` | Use volume as ReadOnly or ReadWrite | `ReadWriteOnce` | +| `graylog.persistence.size` | Size of data volume | `10Gi` | +| `graylog.ingress.enabled` | If true, Graylog Ingress will be created | `false` | +| `graylog.ingress.port` | Graylog Ingress port | `false` | +| `graylog.ingress.annotations` | Graylog Ingress annotations | `{}` | +| `graylog.ingress.hosts` | Graylog Ingress host names | `[]` | +| `graylog.ingress.tls` | Graylog Ingress TLS configuration (YAML) | `[]` | +| `graylog.input` | Graylog Input configuration (YAML) Sees #Input section for detail | `{}` | +| `graylog.metrics.enabled` | If true, add Prometheus annotations to pods | `false` | +| `graylog.geoip.enabled` | If true, Maxmind Geoip Lite will be installed to ${GRAYLOG_HOME}/etc/GeoLite2-City.mmdb | `false` | +| `graylog.plugins` | A list of Graylog installation plugins | `[]` | +| `graylog.rootUsername` | Graylog root user name | `admin` | +| `graylog.rootPassword` | Graylog root password. If not set, random 10-character alphanumeric string | `` | +| `graylog.rootEmail` | Graylog root email. | `` | +| `graylog.rootTimezone` | Graylog root timezone. | `UTC` | +| `graylog.elasticsearch.hosts` | Graylog Elasticsearch host name. You need to specific where data will be stored. | `` | +| `graylog.mongodb.uri` | Graylog MongoDB connection string. You need to specific where data will be stored. | `` | +| `graylog.transportEmail.enabled` | If true, enable transport email settings on Graylog | `false` | +| `graylog.serverFiles` | Add additional server files on /etc/graylog/server. This is useful for enable TLS on input | `{}` | +| `rbac.create` | If true, create & use RBAC resources | `true` | +| `rbac.serviceAccount.create` | If true, create the Graylog service account | `true` | +| `rbac.serviceAccount.name` | Name of the server service account to use or create | `{{ graylog.fullname }}` | +| `tags.install-mongodb` | If true, this chart will install MongoDB from requirement dependencies. If you want to install MongoDB by yourself, please set to `false` | `true` | +| `tags.install-elasticsearch` | If true, this chart will install Elasticsearch from requirement dependencies. If you want to install Elasticsearch by yourself, please set to `false` | `true` | + +## How it works +This chart will create a Graylog statefulset with one Master node. The chart will automatically create Master node Pod label `graylog-role=master`, if it does not exists. The others Pods will be label with `graylog-role=coordinating` + +This chart will automatically calculate Java heap size from given `resources.requests.memory` value. If you want to specify number of heap size, you can set `graylog.heapSize` to your desired value. The `graylog.heapSize` value must be in JVM `-Xmx` format. + +## Input +You can enable input ports by edit the `input` values. For example, you want to create a GELF input on port `12222`, and `12223` with Cloud LoadBalancer and syslog on UDP port `5410` without load balancer. + +``` + input: + tcp: + service: + type: LoadBalancer + loadBalancerIP: + ports: + - name: gelf1 + port: 12222 + - name: gelf2 + port: 12223 + udp: + service: + type: ClusterIP + ports: + - name: syslog + port: 5410 +``` + +Note: Name must be in IANA_SVC_NAME (at most 15 characters, matching regex [a-z0-9]([a-z0-9-]*[a-z0-9])* and it must contains at least one letter [a-z], hyphens cannot be adjacent to other hyphens) + +Note: The port list should be sorted by port number. + + +## Input TLS +To enable TLS on input in Graylog, you need to specify the server private key and certificate. You can add them in `graylog.serverFiles` value. For example + +```yaml +graylog: + serverFiles: + server.cert: | + -----BEGIN CERTIFICATE----- + MIIFYTCCA0mgAwIBAgICEAIwDQYJKoZIhvcNAQELBQAwcjELMAkGA1UEBhMCVEgx + EDAOBgNVBAgMB0Jhbmdrb2sxEDAOBgNVBAcMB0Jhbmdrb2sxGDAWBgNVBAoMD09t + aXNlIENvLiwgTHRkLjEPMA0GA1UECwwGRGV2b3BzMRQwEgYDVQQDDAtjYS5vbWlz + ZS5jbzAeFw0xNzA2MDEwOTQ0NTJaFw0xOTA2MjEwOTQ0NTJaMHkxCzAJBgNVBAYT + AlRIMRAwDgYDVQQIDAdCYW5na29rMRAwDgYDVQQHDAdCYW5na29rMRgwFgYDVQQK + DA9PbWlzZSBDby4sIEx0ZC4xDzANBgNVBAsMBkRldm9wczEbMBkGA1UEAwwSZ3Jh + 4YE6FOKJmiDV7KsmoSO2JTEaZAK6sdxI7zFJJH0TNFIuKewEBsVH/W5RccjwK/z/ + BHwoTQc95zbfFjt1JwDiq8jGTVnQoXH99wAIW+HDYq6hqHyqW3YuQ8QvXfi/ebAs + rn0urmEC7JhsZIg92AqVYEgdp5H6uFqPIK1U6aYrz5zzZpRfEA== + -----END CERTIFICATE----- + server.key: | + -----BEGIN PRIVATE KEY----- + MIIEugIBADANBgkqhkiG9w0BAQEFAASCBKQwggSgAgEAAoIBAQC1zwgrnurQGlwe + ZcKe2RXLs9XzQo4PzNsbxRQXSZef/siUZ/X3phd7Tt7QbQv8sxoZFR1/R4neN3KV + tsWJ6YL3CY1IwqzxtR6SHzkg/CgUFgP4Jq9NDodOFRlmkZBK9iO9x/VITxLZPBQt + f+ygeNhfG/oZZxlLSWNC/adlFfUGI8TujCGGyydxAegyWRYmhkLM7F3vRqMXiUn2 + UP/nPEMasHiHS7r99RzJILbU494aNYTxprfBAoGAdWwO/4I/r3Zo672AvCs2s/P6 + G85cX2hKMFy3B4/Ww53jFA3bsWTOyXBv4srl3v9C3xkQmDwUxPDshEN45JX1AMIc + vxQkW5cm2IaPHB1BsuQpAuW6qIBT/NZqLmexb4jipAjTN4wQ2dkjI/zK2/SST5wb + vNufGafZ1IpvkUsDkA0= + -----END PRIVATE KEY----- +``` + +Then configure Graylog input to + +| Parameter | Value | +|----------------|---------------------------------| +| tls_cert_file: | /etc/graylog/server/server.cert | +| tls_enable: | true | +| tls_key_file: | /etc/graylog/server/server.key | + +## Get Graylog status +You can get your Graylog status by running the command + +``` +kubectl get po -L graylog-role +``` + +Output +``` +NAME READY STATUS RESTARTS AGE graylog-ROLE +graylog-0 1/1 Running 0 1d master +graylog-1 1/1 Running 0 1d coordinating +graylog-2 1/1 Running 0 1m coordinating +``` diff --git a/stable/graylog/requirements.yaml b/stable/graylog/requirements.yaml new file mode 100644 index 0000000000..c4924c348b --- /dev/null +++ b/stable/graylog/requirements.yaml @@ -0,0 +1,11 @@ +dependencies: +- name: elasticsearch + version: 1.15.0 + repository: https://kubernetes-charts.storage.googleapis.com/ + tags: + - install-elasticsearch +- name: mongodb-replicaset + version: 3.8.4 + repository: https://kubernetes-charts.storage.googleapis.com/ + tags: + - install-mongodb diff --git a/stable/graylog/templates/NOTES.txt b/stable/graylog/templates/NOTES.txt new file mode 100644 index 0000000000..eaf341bc06 --- /dev/null +++ b/stable/graylog/templates/NOTES.txt @@ -0,0 +1,80 @@ +To connect to your Graylog server: + +1. Get the application URL by running these commands: +{{- if .Values.graylog.ingress.enabled }} +{{- range .Values.graylog.ingress.hosts }} + http://{{ . }} +{{- end }} +{{- else if contains "NodePort" .Values.graylog.service.type }} + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "fullname" . }}) + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + echo http://$NODE_IP:$NODE_PORT +{{- else if contains "LoadBalancer" .Values.graylog.service.type }} + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + You can watch the status of by running 'kubectl get svc -w {{ template "graylog.fullname" . }}' + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "graylog.fullname" . }}-web -o jsonpath='{.status.loadBalancer.ingress[0].ip}') + echo http://$SERVICE_IP:{{ default 9000 .Values.graylog.service.port }} +{{- else if contains "ClusterIP" .Values.graylog.service.type }} + export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ template "graylog.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") + echo "Visit http://127.0.0.1:9000 to use your application" + kubectl port-forward $POD_NAME 9000:9000 +{{- end }} + +2. The Graylog root users + + echo "User: {{ .Values.graylog.rootUsername }}" + echo "Password: $(kubectl get secret {{ template "graylog.fullname" . }} -o "jsonpath={.data['auth']}" | base64 -D)" + +To send logs to graylog: + + +{{- if .Values.graylog.input.tcp }} +1. TCP + +{{- if contains "NodePort" .Values.graylog.input.tcp.service.type }} + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "fullname" . }}) + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + echo $NODE_IP:$NODE_PORT +{{- else if contains "LoadBalancer" .Values.graylog.input.tcp.service.type }} + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "graylog.fullname" . }}-tcp -o jsonpath='{.status.loadBalancer.ingress[0].ip}') + {{- range .Values.graylog.input.tcp.ports }} + echo "{{ .name }} on $SERVICE_IP:{{ .port }}" + {{- end }} + + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + You can watch the status of by running 'kubectl get svc -w {{ template "graylog.fullname" . }}-tcp' + +{{- else if contains "ClusterIP" .Values.graylog.input.tcp.service.type }} + export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ template "graylog.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") + {{- range .Values.graylog.input.tcp.ports }} + Run the command + kubectl port-forward $POD_NAME {{ .port }}:{{ .port }} + Then send logs to 127.0.0.1:{{ .port }} + {{- end }} +{{- end }} +{{- end }} +{{- if .Values.graylog.input.udp }} +2. UDP + +{{- if contains "NodePort" .Values.graylog.input.udp.service.type }} + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "fullname" . }}) + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + echo $NODE_IP:$NODE_PORT +{{- else if contains "LoadBalancer" .Values.graylog.input.udp.service.type }} + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "graylog.fullname" . }}-udp -o jsonpath='{.status.loadBalancer.ingress[0].ip}') + {{- range .Values.graylog.input.udp.ports }} + echo "{{ .name }} on $SERVICE_IP:{{ .port }}" + {{- end }} + + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + You can watch the status of by running 'kubectl get svc -w {{ template "graylog.fullname" . }}-udp' + +{{- else if contains "ClusterIP" .Values.graylog.input.udp.service.type }} + export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ template "graylog.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") + {{- range .Values.graylog.input.udp.ports }} + Run the command + kubectl port-forward $POD_NAME {{ .port }}:{{ .port }} + Then send logs to 127.0.0.1:{{ .port }} + {{- end }} +{{- end }} +{{- end }} diff --git a/stable/graylog/templates/_helpers.tpl b/stable/graylog/templates/_helpers.tpl new file mode 100644 index 0000000000..c169085eb1 --- /dev/null +++ b/stable/graylog/templates/_helpers.tpl @@ -0,0 +1,83 @@ +{{/* vim: set filetype=mustache: */}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "graylog.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "graylog.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create the name of the service account to use +*/}} +{{- define "graylog.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "graylog.fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} + + +{{/* +Print Host URL +*/}} +{{- define "graylog.url" -}} +{{- if .Values.graylog.ingress.enabled }} +{{- if .Values.graylog.ingress.tls }} +{{- range .Values.graylog.ingress.tls }}{{ range .hosts }}https://{{ . }}{{ end }}{{ end }} +{{- else }} +{{- range .Values.graylog.ingress.hosts }}http://{{ . }}{{ end }} +{{- end }} +{{- end }} +{{- end -}} + +{{/* +Create a default fully qualified elasticsearch name or use the `graylog.elasticsearch.hosts` value if defined. +Or use chart dependencies with release name +*/}} +{{- define "graylog.elasticsearch.hosts" -}} +{{- if .Values.graylog.elasticsearch.hosts }} + {{- .Values.graylog.elasticsearch.hosts -}} +{{- else }} + {{- printf "http://%s-elasticsearch-client.%s.svc.cluster.local:9200" .Release.Name .Release.Namespace -}} +{{- end -}} +{{- end -}} + +{{/* +Create a default fully qualified mongodb name or use the `graylog.mongodb.uri` value if defined. +Or use chart dependencies with release name +*/}} +{{- define "graylog.mongodb.uri" -}} +{{- if .Values.graylog.mongodb.uri }} + {{- .Values.graylog.mongodb.uri -}} +{{- else }} + {{- printf "mongodb://%s-mongodb-replicaset.%s.svc.cluster.local:27017/graylog?replicaSet=rs0" .Release.Name .Release.Namespace -}} +{{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "graylog.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} diff --git a/stable/graylog/templates/configmap.yaml b/stable/graylog/templates/configmap.yaml new file mode 100644 index 0000000000..16a78f7e1b --- /dev/null +++ b/stable/graylog/templates/configmap.yaml @@ -0,0 +1,148 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "graylog.fullname" . }} + labels: + app.kubernetes.io/name: {{ template "graylog.name" . }} + helm.sh/chart: {{ template "graylog.chart" . }} + app.kubernetes.io/managed-by: "{{ .Release.Service }}" + app.kubernetes.io/instance: "{{ .Release.Name }}" + app.kubernetes.io/version: "{{ .Chart.AppVersion }}" +data: + log4j2.xml: |- + + + + + + + + + + %d{yyyy-MM-dd'T'HH:mm:ss.SSSXXX} %-5p [%c{1}] %m%n + + + + + + + + + + + + + + + %d [%c{1}] - %m - %X%n + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + graylog.conf: |- + node_id_file = /usr/share/graylog/data/journal/node-id + root_username = {{ .Values.graylog.rootUsername }} + root_email = {{ .Values.graylog.rootEmail }} + root_timezone = {{ default "UTC" .Values.graylog.rootTimezone }} + plugin_dir = /usr/share/graylog/plugin + rest_listen_uri = http://0.0.0.0:9000/api/ + #web_enable = true + web_listen_uri = http://0.0.0.0:9000/ + {{- if .Values.graylog.ingress.enabled }} + web_endpoint_uri = {{ template "graylog.url" .}}/api + {{- end }} + elasticsearch_hosts = {{ template "graylog.elasticsearch.hosts" . }} + elasticsearch_connect_timeout = 10s + elasticsearch_socket_timeout = 60s + #elasticsearch_idle_timeout = -1s + #elasticsearch_max_total_connections = 20 + #elasticsearch_max_total_connections_per_route = 2 + #elasticsearch_max_retries = 2 + rotation_strategy = {{ default "time" .Values.graylog.elasticsearch.rotationStrategy }} + elasticsearch_max_docs_per_index = {{ default "20000000" .Values.graylog.elasticsearch.maxDocsPerIndex }} + elasticsearch_max_time_per_index = 1w + elasticsearch_max_number_of_indices = {{ default 24 .Values.graylog.elasticsearch.maxNumberOfIndices }} + retention_strategy = {{ default "delete" .Values.graylog.elasticsearch.retentionStrategy }} + elasticsearch_shards = {{ default 5 .Values.graylog.elasticsearch.shards }} + elasticsearch_replicas = {{ default 0 .Values.graylog.elasticsearch.replicas }} + elasticsearch_index_prefix = {{ default "graylog" .Values.graylog.elasticsearch.indexPrefix }} + output_batch_size = 500 + output_flush_interval = 1 + output_fault_count_threshold = 5 + output_fault_penalty_seconds = 30 + processbuffer_processors = 5 + outputbuffer_processors = 3 + processor_wait_strategy = blocking + ring_size = 65536 + inputbuffer_ring_size = 65536 + inputbuffer_processors = 2 + inputbuffer_wait_strategy = blocking + message_journal_enabled = true + message_journal_dir = /usr/share/graylog/data/journal + lb_recognition_period_seconds = 3 + # Use a replica set instead of a single host + mongodb_uri = {{ template "graylog.mongodb.uri" . }} + mongodb_max_connections = {{ default 1000 .Values.graylog.mongodb.maxConnections }} + mongodb_threads_allowed_to_block_multiplier = 5 + # Email transport + transport_email_enabled = {{ default false .Values.graylog.transportEmail.enabled }} + transport_email_hostname = {{ default .Values.graylog.transportEmail.hostname }} + transport_email_port = {{ default .Values.graylog.transportEmail.port }} + transport_email_use_auth = {{ default .Values.graylog.transportEmail.useAuth }} + transport_email_use_tls = {{ default .Values.graylog.transportEmail.useTls }} + transport_email_use_ssl = {{ default .Values.graylog.transportEmail.useSsl }} + transport_email_auth_username = {{ default .Values.graylog.transportEmail.authUsername }} + transport_email_auth_password = {{ default .Values.graylog.transportEmail.authPassword }} + transport_email_subject_prefix = {{ default .Values.graylog.transportEmail.subjectPrefix }} + transport_email_from_email = {{ default .Values.graylog.transportEmail.fromEmail }} + {{- if .Values.graylog.ingress.enabled }} + transport_email_web_interface_url = {{ template "graylog.url" .}} + {{- end }} + content_packs_dir = /usr/share/graylog/data/contentpacks + content_packs_auto_load = grok-patterns.json + proxied_requests_thread_pool_size = 32 diff --git a/stable/graylog/templates/files-configmap.yaml b/stable/graylog/templates/files-configmap.yaml new file mode 100644 index 0000000000..85d062ea20 --- /dev/null +++ b/stable/graylog/templates/files-configmap.yaml @@ -0,0 +1,17 @@ +{{- if .Values.graylog.serverFiles -}} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "graylog.fullname" . }}-files + labels: + app.kubernetes.io/name: {{ template "graylog.name" . }} + helm.sh/chart: {{ template "graylog.chart" . }} + app.kubernetes.io/managed-by: "{{ .Release.Service }}" + app.kubernetes.io/instance: "{{ .Release.Name }}" + app.kubernetes.io/version: "{{ .Chart.AppVersion }}" +data: +{{- range $key, $value := .Values.graylog.serverFiles }} + {{ $key }}: | +{{ $value | default "{}" | indent 4 }} +{{- end -}} +{{- end -}} diff --git a/stable/graylog/templates/ingress.yaml b/stable/graylog/templates/ingress.yaml new file mode 100644 index 0000000000..7c90186b6e --- /dev/null +++ b/stable/graylog/templates/ingress.yaml @@ -0,0 +1,34 @@ +{{- if .Values.graylog.ingress.enabled -}} +apiVersion: extensions/v1beta1 +kind: Ingress +metadata: + annotations: + {{- range $key, $value := .Values.graylog.ingress.annotations }} + {{ $key }}: {{ $value | quote }} + {{- end }} + labels: + app.kubernetes.io/name: {{ template "graylog.name" . }} + helm.sh/chart: {{ template "graylog.chart" . }} + app.kubernetes.io/managed-by: "{{ .Release.Service }}" + app.kubernetes.io/instance: "{{ .Release.Name }}" + app.kubernetes.io/version: "{{ .Chart.AppVersion }}" + app.kubernetes.io/component: "web" + name: {{ template "graylog.fullname" . }}-web +spec: + rules: + {{- range .Values.graylog.ingress.hosts }} + - host: {{ . }} + http: + paths: + - backend: + serviceName: {{ template "graylog.fullname" $ }}-web + servicePort: graylog + {{- if $.Values.graylog.ingress.path }} + path: {{ $.Values.graylog.ingress.path }} + {{- end -}} + {{- end -}} + {{- if .Values.graylog.ingress.tls }} + tls: +{{ toYaml .Values.graylog.ingress.tls | indent 4 }} + {{- end -}} +{{- end -}} diff --git a/stable/graylog/templates/master-service.yaml b/stable/graylog/templates/master-service.yaml new file mode 100644 index 0000000000..cd8104662c --- /dev/null +++ b/stable/graylog/templates/master-service.yaml @@ -0,0 +1,51 @@ +apiVersion: v1 +kind: Service +metadata: +{{- if .Values.graylog.service.annotations }} + annotations: +{{ toYaml .Values.graylog.service.annotations | indent 4 }} +{{- end }} + name: {{ template "graylog.fullname" . }}-master + labels: + app.kubernetes.io/name: {{ template "graylog.name" . }} + helm.sh/chart: {{ template "graylog.chart" . }} + app.kubernetes.io/managed-by: "{{ .Release.Service }}" + app.kubernetes.io/instance: "{{ .Release.Name }}" + app.kubernetes.io/version: "{{ .Chart.AppVersion }}" + graylog-role: "master" +spec: + ports: + - name: graylog + port: {{ default 9000 .Values.graylog.service.port }} + protocol: TCP + targetPort: 9000 +{{- if contains "NodePort" .Values.graylog.service.type }} + {{- if .Values.graylog.service.nodePort }} + nodePort: {{ .Values.graylog.service.nodePort }} + {{- end }} +{{- end }} +{{- if .Values.graylog.service.externalIPs }} + externalIPs: +{{ toYaml .Values.graylog.service.externalIPs | indent 4 }} +{{- end }} +{{- if eq "ClusterIP" .Values.graylog.service.type }} + {{- if .Values.graylog.service.clusterIP }} + clusterIP: {{ .Values.graylog.service.clusterIP }} + {{- end }} +{{- end }} + selector: + app.kubernetes.io/name: {{ template "graylog.name" . }} + app.kubernetes.io/instance: "{{ .Release.Name }}" + graylog-role: "master" + type: "{{ .Values.graylog.service.type }}" +{{- if eq "LoadBalancer" .Values.graylog.service.type }} + {{- if .Values.graylog.service.loadBalancerIP }} + loadBalancerIP: {{ .Values.graylog.service.loadBalancerIP }} + {{- end -}} + {{- if .Values.graylog.service.loadBalancerSourceRanges }} + loadBalancerSourceRanges: + {{- range .Values.graylog.service.loadBalancerSourceRanges }} + - {{ . }} + {{- end }} + {{- end -}} +{{- end -}} diff --git a/stable/graylog/templates/role.yaml b/stable/graylog/templates/role.yaml new file mode 100644 index 0000000000..b0390d2475 --- /dev/null +++ b/stable/graylog/templates/role.yaml @@ -0,0 +1,22 @@ +{{- if .Values.rbac.create -}} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: Role +metadata: + name: {{ template "graylog.fullname" . }} + labels: + app.kubernetes.io/name: {{ template "graylog.name" . }} + helm.sh/chart: {{ template "graylog.chart" . }} + app.kubernetes.io/managed-by: "{{ .Release.Service }}" + app.kubernetes.io/instance: "{{ .Release.Name }}" + app.kubernetes.io/version: "{{ .Chart.AppVersion }}" +rules: +- apiGroups: + - "" + resources: + - pods + - secrets + verbs: + - get + - list + - patch +{{- end -}} diff --git a/stable/graylog/templates/rolebinding.yaml b/stable/graylog/templates/rolebinding.yaml new file mode 100644 index 0000000000..06e10de32c --- /dev/null +++ b/stable/graylog/templates/rolebinding.yaml @@ -0,0 +1,19 @@ +{{- if .Values.rbac.create -}} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: RoleBinding +metadata: + name: {{ template "graylog.fullname" . }} + labels: + app.kubernetes.io/name: {{ template "graylog.name" . }} + helm.sh/chart: {{ template "graylog.chart" . }} + app.kubernetes.io/managed-by: "{{ .Release.Service }}" + app.kubernetes.io/instance: "{{ .Release.Name }}" + app.kubernetes.io/version: "{{ .Chart.AppVersion }}" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "graylog.fullname" . }} +subjects: +- kind: ServiceAccount + name: {{ template "graylog.serviceAccountName" . }} +{{- end -}} diff --git a/stable/graylog/templates/secret.yaml b/stable/graylog/templates/secret.yaml new file mode 100644 index 0000000000..4a823c4b94 --- /dev/null +++ b/stable/graylog/templates/secret.yaml @@ -0,0 +1,20 @@ +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "graylog.fullname" . }} + labels: + app.kubernetes.io/name: {{ template "graylog.name" . }} + helm.sh/chart: {{ template "graylog.chart" . }} + app.kubernetes.io/managed-by: "{{ .Release.Service }}" + app.kubernetes.io/instance: "{{ .Release.Name }}" + app.kubernetes.io/version: "{{ .Chart.AppVersion }}" +type: Opaque +data: + {{- if .Values.graylog.rootPassword }} + graylog-password-secret: {{ .Values.graylog.rootPassword | b64enc | quote }} + graylog-password-sha2: {{ .Values.graylog.rootPassword | sha256sum | b64enc | quote }} + {{- else }} + {{- $randpass := randAlphaNum 16 }} + graylog-password-secret: {{ $randpass | b64enc | quote }} + graylog-password-sha2: {{ $randpass | sha256sum | b64enc | quote }} + {{- end }} diff --git a/stable/graylog/templates/serviceaccount.yaml b/stable/graylog/templates/serviceaccount.yaml new file mode 100644 index 0000000000..9932790f4d --- /dev/null +++ b/stable/graylog/templates/serviceaccount.yaml @@ -0,0 +1,12 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "graylog.serviceAccountName" . }} + labels: + app.kubernetes.io/name: {{ template "graylog.name" . }} + helm.sh/chart: {{ template "graylog.chart" . }} + app.kubernetes.io/managed-by: "{{ .Release.Service }}" + app.kubernetes.io/instance: "{{ .Release.Name }}" + app.kubernetes.io/version: "{{ .Chart.AppVersion }}" +{{- end -}} diff --git a/stable/graylog/templates/statefulset.yaml b/stable/graylog/templates/statefulset.yaml new file mode 100644 index 0000000000..be51a5ce52 --- /dev/null +++ b/stable/graylog/templates/statefulset.yaml @@ -0,0 +1,249 @@ +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: {{ template "graylog.fullname" . }} + labels: + app.kubernetes.io/name: {{ template "graylog.name" . }} + helm.sh/chart: {{ template "graylog.chart" . }} + app.kubernetes.io/managed-by: "{{ .Release.Service }}" + app.kubernetes.io/instance: "{{ .Release.Name }}" + app.kubernetes.io/version: "{{ .Chart.AppVersion }}" +spec: + serviceName: {{ template "graylog.fullname" . }} + replicas: {{ .Values.graylog.replicas }} + selector: + matchLabels: + app.kubernetes.io/name: {{ template "graylog.name" . }} + app.kubernetes.io/instance: "{{ .Release.Name }}" + app.kubernetes.io/managed-by: "{{ .Release.Service }}" + template: + metadata: + labels: + app.kubernetes.io/name: {{ template "graylog.name" . }} + helm.sh/chart: {{ template "graylog.chart" . }} + app.kubernetes.io/managed-by: "{{ .Release.Service }}" + app.kubernetes.io/instance: "{{ .Release.Name }}" + app.kubernetes.io/version: "{{ .Chart.AppVersion }}" + annotations: + {{- if .Values.graylog.podAnnotations }} + {{- range $key, $value := .Values.graylog.podAnnotations }} + {{ $key }}: {{ $value | quote }} + {{- end }} + {{- end }} + {{- if .Values.graylog.metrics.enabled }} + prometheus.io/scrape: "true" + prometheus.io/port: "9000" + {{- end }} + spec: + serviceAccountName: {{ template "graylog.serviceAccountName" . }} + updateStrategy: {{ .Values.graylog.updateStrategy }} +{{- if .Values.graylog.nodeSelector }} + nodeSelector: +{{ toYaml .Values.graylog.nodeSelector | indent 8 }} +{{- end }} +{{- if .Values.graylog.affinity }} + affinity: +{{ toYaml .Values.graylog.affinity | indent 8 }} + +{{- end }} +{{- if .Values.graylog.tolerations }} + tolerations: +{{ toYaml .Values.graylog.tolerations | indent 8 }} +{{- end }} + initContainers: + - name: "setup" + image: "busybox" + imagePullPolicy: IfNotPresent + # Graylog journal will recursive in every subdirectories. Any invalid format directories will cause errors + command: + - /bin/sh + - -c + - rm -rf /usr/share/graylog/data/journal/lost+found && + wget https://storage.googleapis.com/kubernetes-release/release/v1.11.4/bin/linux/amd64/kubectl -O /k8s/kubectl && + chmod +x /k8s/kubectl + securityContext: + privileged: true + volumeMounts: + - name: journal + mountPath: /usr/share/graylog/data/journal + - mountPath: /k8s + name: kubectl + containers: + - name: graylog-server + image: "{{ .Values.graylog.image.repository }}" + imagePullPolicy: {{ .Values.graylog.image.pullPolicy | quote }} + command: + - bash + - -c + - | + GRAYLOG_HOME=/usr/share/graylog + GRAYLOG_USER=graylog + GRAYLOG_GROUP=graylog + chown -R ${GRAYLOG_USER}:${GRAYLOG_GROUP} ${GRAYLOG_HOME}/data/ + MASTER_NAME="{{ template "graylog.fullname" . }}-master.{{ .Release.Namespace }}.svc.cluster.local" + # Looking for Master IP + MASTER_IP=`/k8s/kubectl get pod -o jsonpath='{range .items[*]}{.metadata.name} {.status.podIP}{"\n"}{end}' -l graylog-role=master --field-selector=status.phase=Running|awk '{print $2}'` + echo "Current master is $MASTER_IP" + if [[ -z "$MASTER_IP" ]]; then + echo "Launching $HOSTNAME as master" + export GRAYLOG_IS_MASTER="true" + /k8s/kubectl label --overwrite pod $HOSTNAME graylog-role="master" + else + echo "Launching $HOSTNAME as coordinating" + export GRAYLOG_IS_MASTER="false" + /k8s/kubectl label --overwrite pod $HOSTNAME graylog-role="coordinating" + fi + # Download plugins + {{- if .Values.graylog.plugins }} + echo "Downloading Graylog Plugins..." + {{- range .Values.graylog.plugins }} + echo "Downloading {{ .url }} ..." + curl -s --location --retry 3 -o ${GRAYLOG_HOME}/plugin/{{ .name }} "{{ .url }}" + {{- end }} + {{- end }} + {{- if .Values.graylog.metrics.enabled }} + echo "Downloading https://github.com/graylog-labs/graylog-plugin-metrics-reporter/releases/download/2.4.0-beta.3/metrics-reporter-prometheus-2.4.0-beta.3.jar ..." + curl -s --location --retry 3 -o ${GRAYLOG_HOME}/plugin/metrics-reporter-prometheus-2.4.0-beta.3.jar "https://github.com/graylog-labs/graylog-plugin-metrics-reporter/releases/download/2.4.0-beta.3/metrics-reporter-prometheus-2.4.0-beta.3.jar" + {{- end }} + chown -R ${GRAYLOG_USER}:${GRAYLOG_GROUP} ${GRAYLOG_HOME}/plugin/ + {{- if .Values.graylog.geoip.enabled }} + echo "Downloading Maxmind GeoLite2 ..." + curl -s --location --retry 3 -o /tmp/GeoLite2-City.tar.gz "https://geolite.maxmind.com/download/geoip/database/GeoLite2-City.tar.gz" + curlreturn=$? + if [[ $curlreturn -eq 0 ]]; then + mkdir -p ${GRAYLOG_HOME}/geoip && cd ${GRAYLOG_HOME}/geoip && tar xvzf /tmp/GeoLite2-City.tar.gz --wildcards "*.mmdb" --strip-components=1 -C ${GRAYLOG_HOME}/geoip && chown -R graylog:graylog ${GRAYLOG_HOME}/geoip + fi + {{- end }} + # Start Graylog + echo "Starting graylog" + # Original docker-entrypoint.sh in Graylog Docker will error while executing since you can't chown readonly files in `config` + # exec /docker-entrypoint.sh graylog + echo "Graylog Home ${GRAYLOG_HOME}" + echo "Graylog User ${GRAYLOG_USER}" + echo "JVM Options ${GRAYLOG_SERVER_JAVA_OPTS}" + "${JAVA_HOME}/bin/java" \ + ${GRAYLOG_SERVER_JAVA_OPTS} \ + -jar \ + -Dlog4j.configurationFile=${GRAYLOG_HOME}/config/log4j2.xml \ + -Djava.library.path=${GRAYLOG_HOME}/lib/sigar/ \ + -Dgraylog2.installation_source=docker \ + ${GRAYLOG_HOME}/graylog.jar \ + server \ + -f ${GRAYLOG_HOME}/config/graylog.conf + env: + - name: GRAYLOG_SERVER_JAVA_OPTS + {{- $javaOpts := "-Djava.net.preferIPv4Stack=true -XX:NewRatio=1 -server -XX:+ResizeTLAB -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnloadingEnabled -XX:+UseParNewGC -XX:-OmitStackTraceInFastThrow" }} + {{- if .Values.graylog.heapSize -}} + value: "{{ $javaOpts }} {{ printf "-Xms%s -Xmx%s" .Values.graylog.heapSize .Values.graylog.heapSize}}" + {{- else }} + value: "{{ $javaOpts }} -XX:+UnlockExperimentalVMOptions -XX:+UseCGroupMemoryLimitForHeap" + {{- end }} + - name: GRAYLOG_PASSWORD_SECRET + valueFrom: + secretKeyRef: + name: {{ template "graylog.fullname" . }} + key: graylog-password-secret + - name: GRAYLOG_ROOT_PASSWORD_SHA2 + valueFrom: + secretKeyRef: + name: {{ template "graylog.fullname" . }} + key: graylog-password-sha2 + ports: + - containerPort: 9000 + name: graylog + {{- with .Values.graylog.input }} + {{- if .udp }} + {{- range .udp.ports }} + - containerPort: {{ .port }} + name: {{ .name }} + protocol: UDP + {{- end }} + {{- end }} + {{- if .tcp }} + {{- range .tcp.ports }} + - containerPort: {{ .port }} + name: {{ .name }} + protocol: TCP + {{- end }} + {{- end }} + {{- end }} + resources: +{{ toYaml .Values.graylog.resources | indent 12 }} + livenessProbe: + httpGet: + path: /api/system/lbstatus + port: 9000 + initialDelaySeconds: 120 + periodSeconds: 30 + failureThreshold: 3 + successThreshold: 1 + timeoutSeconds: 5 + readinessProbe: + httpGet: + path: /api/system/lbstatus + port: 9000 + initialDelaySeconds: 60 + periodSeconds: 10 + failureThreshold: 3 + successThreshold: 1 + timeoutSeconds: 5 + volumeMounts: + - name: journal + mountPath: /usr/share/graylog/data/journal + - name: config + mountPath: /usr/share/graylog/config + {{- if .Values.graylog.serverFiles }} + - name: files + mountPath: /etc/graylog/server + {{- end }} + - name: kubectl + mountPath: /k8s + lifecycle: + preStop: + exec: + command: + - bash + - -ec + - | + ROOT_PASSWORD=`/k8s/kubectl get secret {{ template "graylog.fullname" . }} -o "jsonpath={.data['graylog-password-secret']}" | base64 -d` + curl -XPOST -sS -u "{{ .Values.graylog.rootUsername }}:${ROOT_PASSWORD}" "localhost:9000/api/system/shutdown/shutdown" + terminationGracePeriodSeconds: {{ default 30 .Values.graylog.terminationGracePeriodSeconds }} + volumes: + - name: config + configMap: + name: {{ template "graylog.fullname" . }} + items: + - key: graylog.conf + path: graylog.conf + mode: 292 # 0444 + - key: log4j2.xml + path: log4j2.xml + mode: 292 # 0444 + {{- if .Values.graylog.serverFiles }} + - name: files + configMap: + name: {{ template "graylog.fullname" . }}-files + {{- end }} + - name: kubectl + emptyDir: {} +{{- if not .Values.graylog.persistence.enabled }} + - name: journal + emptyDir: {} +{{- else }} + volumeClaimTemplates: + - metadata: + name: journal + spec: + accessModes: + - {{ .Values.graylog.persistence.accessMode | quote }} + {{- if .Values.graylog.persistence.storageClass }} + {{- if (eq "-" .Values.graylog.persistence.storageClass) }} + storageClassName: "" + {{- else }} + storageClassName: "{{ .Values.graylog.persistence.storageClass }}" + {{- end }} + {{- end }} + resources: + requests: + storage: "{{ .Values.graylog.persistence.size }}" +{{- end }} diff --git a/stable/graylog/templates/tcp-service.yaml b/stable/graylog/templates/tcp-service.yaml new file mode 100644 index 0000000000..c118a2e5cf --- /dev/null +++ b/stable/graylog/templates/tcp-service.yaml @@ -0,0 +1,54 @@ +{{- if .Values.graylog.input.tcp }} +apiVersion: v1 +kind: Service +metadata: +{{- if .Values.graylog.input.tcp.service.annotations }} + annotations: +{{ toYaml .Values.graylog.input.tcp.service.annotations | indent 4 }} +{{- end }} + name: {{ template "graylog.fullname" . }}-tcp + labels: + app.kubernetes.io/name: {{ template "graylog.name" . }} + helm.sh/chart: {{ template "graylog.chart" . }} + app.kubernetes.io/managed-by: "{{ .Release.Service }}" + app.kubernetes.io/instance: "{{ .Release.Name }}" + app.kubernetes.io/version: "{{ .Chart.AppVersion }}" + app.kubernetes.io/component: "TCP" +spec: + ports: + {{- range .Values.graylog.input.tcp.ports }} + - name: {{ .name }} + port: {{ .port }} + protocol: TCP + targetPort: {{ .port }} + {{- end }} +{{- if contains "NodePort" .Values.graylog.input.tcp.service.type }} + {{- if .Values.graylog.input.tcp.service.nodePort }} + nodePort: {{ .Values.graylog.input.tcp.service.nodePort }} + {{- end }} +{{- end }} +{{- if .Values.graylog.input.tcp.service.externalIPs }} + externalIPs: +{{ toYaml .Values.graylog.input.tcp.service.externalIPs | indent 4 }} +{{- end }} +{{- if eq "ClusterIP" .Values.graylog.input.tcp.service.type }} + {{- if .Values.graylog.input.tcp.service.clusterIP }} + clusterIP: {{ .Values.graylog.input.tcp.service.clusterIP }} + {{- end }} +{{- end }} + selector: + app.kubernetes.io/name: {{ template "graylog.name" . }} + app.kubernetes.io/instance: "{{ .Release.Name }}" + type: "{{ .Values.graylog.input.tcp.service.type }}" +{{- if eq "LoadBalancer" .Values.graylog.input.tcp.service.type }} + {{- if .Values.graylog.input.tcp.service.loadBalancerIP }} + loadBalancerIP: {{ .Values.graylog.input.tcp.service.loadBalancerIP }} + {{- end -}} + {{- if .Values.graylog.input.tcp.service.loadBalancerSourceRanges }} + loadBalancerSourceRanges: + {{- range .Values.graylog.input.tcp.service.loadBalancerSourceRanges }} + - {{ . }} + {{- end }} + {{- end -}} +{{- end -}} +{{- end }} diff --git a/stable/graylog/templates/udp-service.yaml b/stable/graylog/templates/udp-service.yaml new file mode 100644 index 0000000000..81f591e71d --- /dev/null +++ b/stable/graylog/templates/udp-service.yaml @@ -0,0 +1,54 @@ +{{- if .Values.graylog.input.udp }} +apiVersion: v1 +kind: Service +metadata: +{{- if .Values.graylog.input.udp.service.annotations }} + annotations: +{{ toYaml .Values.graylog.input.udp.service.annotations | indent 4 }} +{{- end }} + name: {{ template "graylog.fullname" . }}-udp + labels: + app.kubernetes.io/name: {{ template "graylog.name" . }} + helm.sh/chart: {{ template "graylog.chart" . }} + app.kubernetes.io/managed-by: "{{ .Release.Service }}" + app.kubernetes.io/instance: "{{ .Release.Name }}" + app.kubernetes.io/version: "{{ .Chart.AppVersion }}" + app.kubernetes.io/component: "UDP" +spec: + ports: + {{- range .Values.graylog.input.udp.ports }} + - name: {{ .name }} + port: {{ .port }} + protocol: UDP + targetPort: {{ .port }} + {{- end }} +{{- if contains "NodePort" .Values.graylog.input.udp.service.type }} + {{- if .Values.graylog.input.udp.service.nodePort }} + nodePort: {{ .Values.graylog.input.udp.service.nodePort }} + {{- end }} +{{- end }} +{{- if .Values.graylog.input.udp.service.externalIPs }} + externalIPs: +{{ toYaml .Values.graylog.input.udp.service.externalIPs | indent 4 }} +{{- end }} +{{- if eq "ClusterIP" .Values.graylog.input.udp.service.type }} + {{- if .Values.graylog.input.udp.service.clusterIP }} + clusterIP: {{ .Values.graylog.input.udp.service.clusterIP }} + {{- end }} +{{- end }} + selector: + app.kubernetes.io/name: {{ template "graylog.name" . }} + app.kubernetes.io/instance: "{{ .Release.Name }}" + type: "{{ .Values.graylog.input.udp.service.type }}" +{{- if eq "LoadBalancer" .Values.graylog.input.udp.service.type }} + {{- if .Values.graylog.input.udp.service.loadBalancerIP }} + loadBalancerIP: {{ .Values.graylog.input.udp.service.loadBalancerIP }} + {{- end -}} + {{- if .Values.graylog.input.udp.service.loadBalancerSourceRanges }} + loadBalancerSourceRanges: + {{- range .Values.graylog.input.udp.service.loadBalancerSourceRanges }} + - {{ . }} + {{- end }} + {{- end -}} +{{- end -}} +{{- end }} diff --git a/stable/graylog/templates/web-service.yaml b/stable/graylog/templates/web-service.yaml new file mode 100644 index 0000000000..a2482a4aa2 --- /dev/null +++ b/stable/graylog/templates/web-service.yaml @@ -0,0 +1,50 @@ +apiVersion: v1 +kind: Service +metadata: +{{- if .Values.graylog.service.annotations }} + annotations: +{{ toYaml .Values.graylog.service.annotations | indent 4 }} +{{- end }} + name: {{ template "graylog.fullname" . }}-web + labels: + app.kubernetes.io/name: {{ template "graylog.name" . }} + helm.sh/chart: {{ template "graylog.chart" . }} + app.kubernetes.io/managed-by: "{{ .Release.Service }}" + app.kubernetes.io/instance: "{{ .Release.Name }}" + app.kubernetes.io/version: "{{ .Chart.AppVersion }}" + app.kubernetes.io/component: "web" +spec: + ports: + - name: graylog + port: {{ default 9000 .Values.graylog.service.port }} + protocol: TCP + targetPort: 9000 +{{- if contains "NodePort" .Values.graylog.service.type }} + {{- if .Values.graylog.service.nodePort }} + nodePort: {{ .Values.graylog.service.nodePort }} + {{- end }} +{{- end }} +{{- if .Values.graylog.service.externalIPs }} + externalIPs: +{{ toYaml .Values.graylog.service.externalIPs | indent 4 }} +{{- end }} +{{- if eq "ClusterIP" .Values.graylog.service.type }} + {{- if .Values.graylog.service.clusterIP }} + clusterIP: {{ .Values.graylog.service.clusterIP }} + {{- end }} +{{- end }} + selector: + app.kubernetes.io/name: {{ template "graylog.name" . }} + app.kubernetes.io/instance: "{{ .Release.Name }}" + type: "{{ .Values.graylog.service.type }}" +{{- if eq "LoadBalancer" .Values.graylog.service.type }} + {{- if .Values.graylog.service.loadBalancerIP }} + loadBalancerIP: {{ .Values.graylog.service.loadBalancerIP }} + {{- end -}} + {{- if .Values.graylog.service.loadBalancerSourceRanges }} + loadBalancerSourceRanges: + {{- range .Values.graylog.service.loadBalancerSourceRanges }} + - {{ . }} + {{- end }} + {{- end -}} +{{- end -}} diff --git a/stable/graylog/values.yaml b/stable/graylog/values.yaml new file mode 100644 index 0000000000..c9ebc1c4a3 --- /dev/null +++ b/stable/graylog/values.yaml @@ -0,0 +1,244 @@ +# Default values for Graylog. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +rbac: + # Specifies whether RBAC resources should be created + ## + create: true + +serviceAccount: + # Specifies whether a ServiceAccount should be created + ## + create: true + # The name of the ServiceAccount to use. + # If not set and create is true, a name is generated using the fullname template + ## + name: + +tags: + # If true, this chart will install Elasticsearch from requirement dependencies + install-elasticsearch: true + # If true, this chart will install MongoDB replicaset from requirement dependencies + install-mongodb: true + +graylog: + ## Graylog image version + ## Ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + ## Important note: Official Graylog Docker image may replace the existing Docker image tags and cause some corrupt when starting the pod. + ## Make sure you strict with the `x` version of Graylog where `x` is ${version}-${x} + ## + image: + repository: "graylog/graylog:2.5.1-3" + pullPolicy: "IfNotPresent" + + replicas: 2 + + ## Pod affinity + ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## + + affinity: {} + ## Node tolerations for node-exporter scheduling to nodes with taints + ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + ## + + tolerations: [] + # - key: "key" + # operator: "Equal|Exists" + # value: "value" + # effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)" + + ## Node labels for node-exporter pod assignment + ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ + ## + nodeSelector: {} + + ## Annotations to be added to Graylog pods + ## + podAnnotations: {} + + persistence: + ## If true, Graylog will create/use a Persistent Volume Claim + ## If false, use emptyDir + ## + enabled: true + ## Graylog data Persistent Volume access modes + ## Must match those of existing PV or dynamic provisioner + ## Ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ + ## + accessMode: ReadWriteOnce + ## Graylog data Persistent Volume size + ## + size: "20Gi" + ## Graylog data Persistent Volume Storage Class + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) + ## + # storageClass: "ssd" + + ## Additional plugins you need to install on Graylog. + plugins: [] + # - name: graylog-plugin-slack-2.7.1.jar + # url: https://github.com/omise/graylog-plugin-slack/releases/download/2.7.1/graylog-plugin-slack-2.7.1.jar + # - name: graylog-plugin-function-check-diff-1.0.0.jar + # url: https://github.com/omise/graylog-plugin-function-check-diff/releases/download/1.0.0/graylog-plugin-function-check-diff-1.0.0.jar + # - name: graylog-plugin-custom-alert-condition-1.0.0.jar + # url: https://github.com/omise/graylog-plugin-custom-alert-condition/releases/download/v1.0.0/graylog-plugin-custom-alert-condition-1.0.0.jar + + ## A service for Graylog web interface + service: + type: ClusterIP + port: 9000 + + ## Additional input ports for receiving logs from servers + ## Note: Name must be in IANA_SVC_NAME (at most 15 characters, matching regex [a-z0-9]([a-z0-9-]*[a-z0-9])* and it must contains at least one letter [a-z], hyphens cannot be adjacent to other hyphens) + ## Note: Array must be sorted by port order + ## + input: {} + # tcp: + # service: + # type: LoadBalancer + # loadBalancerIP: + # ports: + # - name: gelf + # port: 12222 + # udp: + # service: + # type: ClusterIP + # ports: + # - name: syslog + # port: 12222 + + ingress: + ## If true, Graylog server Ingress will be created + ## + enabled: false + port: 80 + ## Graylog server Ingress annotations + ## + annotations: {} + ## Graylog server Ingress hostnames with optional path + ## Must be provided if Ingress is enabled + ## Note: Graylog does not support two URL. You can specify only single URL + ## + hosts: [] + # - graylog.yourdomain.com + + ## Graylog server Ingress TLS configuration + ## Secrets must be manually created in the namespace + ## + tls: [] + # - secretName: graylog-server-tls + # hosts: + # - graylog.yourdomain.com + + + ## Configure resource requests and limits + ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ + ## + resources: + limits: + cpu: "1" + requests: + cpu: "500m" + memory: "1024Mi" + + ## Set Graylog Java heapsize. If this value empty, chart will allocate heapsize using `-XX:+UseCGroupMemoryLimitForHeap` + ## ref: https://blogs.oracle.com/java-platform-group/java-se-support-for-docker-cpu-and-memory-limits + ## + # heapSize: "1024g" + + ## RollingUpdate update strategy + ## ref: https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#updating-statefulsets + updateStrategy: OnDelete + ## Graylog server pod termination grace period + ## + terminationGracePeriodSeconds: 120 + + metrics: + ## If true, prometheus annotations will not be attached + ## + enabled: false + + geoip: + ## If true, Maxmind GeoLite2 will be installed to ${GRAYLOG_HOME}/geoip location + ## + enabled: false + + ## Graylog root user name + ## + rootUsername: "admin" + + ## Graylog root password + ## Defaults to a random 16-character alphanumeric string if not set + ## + # rootPassword: "" + + ## Graylog root email + ## + rootEmail: "" + + ## Graylog root timezone + ## + rootTimezone: "UTC" + + elasticsearch: + ## List of Elasticsearch hosts Graylog should connect to. + ## Need to be specified as a comma-separated list of valid URIs for the http ports of your elasticsearch nodes. + ## If one or more of your elasticsearch hosts require authentication, include the credentials in each node URI that + ## requires authentication. + ## + # hosts: http://elasticsearch-client.graylog.svc.cluster.local:9200 + + ## These configuration settings are only used on the first start of Graylog. After that, + ## index related settings can be changed in the Graylog web interface on the 'System / Indices' page. + ## Also see http://docs.graylog.org/en/2.3/pages/configuration/index_model.html#index-set-configuration. + rotationStrategy: time + maxNumberOfIndices: 24 + retentionStrategy: delete + shards: 5 + replicas: 1 + indexPrefix: graylog + + mongodb: + ## MongoDB connection string + ## See https://docs.mongodb.com/manual/reference/connection-string/ for details + # uri: mongodb://user:pass@host1:27017,host2:27017,host3:27017/graylog?replicaSet=rs01 + + ## Increase this value according to the maximum connections your MongoDB server can handle from a single client + ## if you encounter MongoDB connection problems. + maxConnections: 1000 + + transportEmail: + ## If true, enable Email transport. + enabled: false + hostname: "" + port: 2587 + useAuth: true + useTls: true + useSsl: true + authUsername: "" + authPassword: "" + subjectPrefix: "[graylog]" + fromEmail: "" + + ## Additional server files will be deployed to /etc/graylog/server + ## For example, you can put server certificates or authorized clients certificates here + ## + serverFiles: {} + # graylog-server.key: | + # graylog-server.cert: | + +## Specify Elasticsearch version from requirement dependencies. Ignore this seection if you install Elasticsearch manually. +## Note: Graylog 2.4 requires Elasticsearch version <= 5.6 +elasticsearch: + image: + repository: "docker.elastic.co/elasticsearch/elasticsearch-oss" + tag: "6.5.4" + cluster: + xpackEnable: false