elasticsearch

Helm chart

iamguarded

Last changed

Request a free trial

Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.

Tag:

Compare:

# This file has been modified by Chainguard, Inc.

# Chainguard, Inc. modifications are subject to the license

# available at: https://www.chainguard.dev/legal/software-license-agreement

# SPDX-License-Identifier: APACHE-2.0

## @section Global parameters

## Global Docker image parameters

## Please, note that this will override the image parameters, including dependencies, configured to use the global value

## Current available global Docker image parameters: imageRegistry, imagePullSecrets and storageClass

## @param global.imageRegistry Global Docker image registry

## @param global.imagePullSecrets Global Docker registry secret names as an array

## @param global.defaultStorageClass Global default StorageClass for Persistent Volume(s)

## @param global.storageClass DEPRECATED: use global.defaultStorageClass instead

## @param global.elasticsearch.service.name Elasticsearch service name to be referenced by the Kibana subchart (ignored if kibanaEnabled=false or global.elasticsearch.service.fullname is set)

## @param global.elasticsearch.service.fullname Full Elasticsearch service name to be referenced by the Kibana subchart (ignored if kibanaEnabled=false)

## @param global.elasticsearch.service.ports.restAPI Elasticsearch service restAPI port to be used in the Kibana subchart (ignored if kibanaEnabled=false)

## @param global.kibanaEnabled Whether or not to enable Kibana

global:

imageRegistry: ""

## E.g.

## imagePullSecrets:

## - myRegistryKeySecretName

imagePullSecrets: []

defaultStorageClass: ""

storageClass: ""

## Security parameters

security:

## @param global.security.allowInsecureImages Allows skipping image verification

allowInsecureImages: false

elasticsearch:

service:

fullname: ""

ports:

restAPI: 9200

kibanaEnabled: false

## Compatibility adaptations for Kubernetes platforms

compatibility:

## Compatibility adaptations for Openshift

openshift:

## @param global.compatibility.openshift.adaptSecurityContext Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation)

adaptSecurityContext: auto

org: ""

## @section Common parameters

## @param kubeVersion Override Kubernetes version

kubeVersion: ""

## @param nameOverride String to partially override common.names.fullname

nameOverride: ""

## @param fullnameOverride String to fully override common.names.fullname

fullnameOverride: ""

## @param commonLabels Labels to add to all deployed objects

commonLabels: {}

## @param commonAnnotations Annotations to add to all deployed objects

commonAnnotations: {}

## @param clusterDomain Kubernetes cluster domain name

clusterDomain: cluster.local

## @param extraDeploy Array of extra objects to deploy with the release

extraDeploy: []

## @param namespaceOverride String to fully override common.names.namespace

namespaceOverride: ""

## @param usePasswordFiles Mount credentials as files instead of using environment variables

usePasswordFiles: true

## Enable diagnostic mode in the deployment

diagnosticMode:

## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden)

enabled: false

## @param diagnosticMode.command Command to override all containers in the deployment

command:

- sleep

## @param diagnosticMode.args Args to override all containers in the deployment

args:

- infinity

## @section Elasticsearch cluster Parameters

100

## @param clusterName Elasticsearch cluster name

101

102

clusterName: elastic

103

## @param containerPorts.restAPI Elasticsearch REST API port

104

## @param containerPorts.transport Elasticsearch Transport port

105

106

containerPorts:

107

restAPI: 9200

108

transport: 9300

109

## @param plugins Comma, semi-colon or space separated list of plugins to install at initialization

110

111

plugins: ""

112

## @param snapshotRepoPath File System snapshot repository path

113

114

snapshotRepoPath: ""

115

## @param config Override elasticsearch configuration

116

117

config: {}

118

## @param extraConfig Append extra configuration to the elasticsearch node configuration

119

## Use this instead of `config` to add more configuration

120

## See below example:

121

## extraConfig:

122

## node:

123

## store:

124

## allow_mmap: false

125

## ref: https://www.elastic.co/guide/en/elasticsearch/reference/current/settings.html

126

127

extraConfig: {}

128

## @param extraHosts A list of external hosts which are part of this cluster

129

## Example Use Case: When you have a cluster with nodes spaned acorss multiple K8s or namespaces

130

## extraHosts:

131

## - datacenter2-elasticsearch-master-hl.namespace2.svc

132

## - datacenter2-elasticsearch-data-hl.namespace2.svc

133

extraHosts: []

134

## @param extraVolumes A list of volumes to be added to the pod

135

## Example Use Case: mount ssl certificates when elasticsearch has tls enabled

136

## extraVolumes:

137

## - name: es-certs

138

## secret:

139

## defaultMode: 420

140

## secretName: es-certs

141

extraVolumes: []

142

## @param extraVolumeMounts A list of volume mounts to be added to the pod

143

## extraVolumeMounts:

144

## - name: es-certs

145

## mountPath: /certs

146

## readOnly: true

147

extraVolumeMounts: []

148

## @param initScripts Dictionary of init scripts. Evaluated as a template.

149

## Specify dictionary of scripts to be run at first boot

150

## Alternatively, you can put your scripts under the files/docker-entrypoint-initdb.d directory

151

## For example:

152

## initScripts:

153

## my_init_script.sh: |

154

## #!/bin/sh

155

## echo "Do something."

156

157

initScripts: {}

158

## @param initScriptsCM ConfigMap with the init scripts. Evaluated as a template.

159

## Note: This will override initScripts

160

161

initScriptsCM: ""

162

## @param initScriptsSecret Secret containing `/docker-entrypoint-initdb.d` scripts to be executed at initialization time that contain sensitive data. Evaluated as a template.

163

164

initScriptsSecret: ""

165

## @param extraEnvVars Array containing extra env vars to be added to all pods (evaluated as a template)

166

## For example:

167

## extraEnvVars:

168

## - name: MY_ENV_VAR

169

## value: env_var_value

170

171

extraEnvVars: []

172

## @param extraEnvVarsCM ConfigMap containing extra env vars to be added to all pods (evaluated as a template)

173

174

extraEnvVarsCM: ""

175

## @param extraEnvVarsSecret Secret containing extra env vars to be added to all pods (evaluated as a template)

176

177

extraEnvVarsSecret: ""

178

## @param sidecars Add additional sidecar containers to the all elasticsearch node pod(s)

179

## e.g:

180

## sidecars:

181

## - name: your-image-name

182

## image: your-image

183

## imagePullPolicy: Always

184

## ports:

185

## - name: portname

186

## containerPort: 1234

187

188

sidecars: []

189

## @param initContainers Add additional init containers to the all elasticsearch node pod(s)

190

## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/

191

## e.g:

192

## initContainers:

193

## - name: your-image-name

194

## image: your-image

195

## imagePullPolicy: Always

196

## command: ['sh', '-c', 'echo "hello world"']

197

198

initContainers: []

199

## @param enableDefaultInitContainers enables (or disables if false) the default init containers (sysctl, volume permissions, copy plugins etc...)

200

201

enableDefaultInitContainers: true

202

## @param useIstioLabels Use this variable to add Istio labels to all pods

203

204

useIstioLabels: true

205

## Iamguarded Elasticsearch image

206

## @param image.registry [default: REGISTRY_NAME] Elasticsearch image registry

207

## @param image.repository [default: REPOSITORY_NAME/elasticsearch] Elasticsearch image repository

208

## @skip image.tag Elasticsearch image tag (immutable tags are recommended)

209

## @param image.digest Elasticsearch image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag

210

## @param image.pullPolicy Elasticsearch image pull policy

211

## @param image.pullSecrets Elasticsearch image pull secrets

212

## @param image.debug Enable Elasticsearch image debug mode

213

214

image:

215

registry: cgr.dev

216

repository: chainguard-private/elasticsearch-iamguarded

217

tag: 9.5.4

218

digest: ""

219

## Specify a imagePullPolicy

220

## ref: http://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images

221

222

pullPolicy: IfNotPresent

223

## Optionally specify an array of imagePullSecrets.

224

## Secrets must be manually created in the namespace.

225

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

226

## e.g:

227

## pullSecrets:

228

## - myRegistryKeySecretName

229

230

pullSecrets: []

231

## Enable debug mode

232

233

debug: false

234

## X-Pack security parameters

235

## Note: TLS configuration is required in order to configure password authentication

236

237

security:

238

## @param security.enabled Enable X-Pack Security settings

239

240

enabled: false

241

## @param security.elasticPassword Password for 'elastic' user

242

243

elasticPassword: ""

244

## @param security.existingSecret Name of the existing secret containing the Elasticsearch password (expected key: `elasticsearch-password`)

245

246

existingSecret: ""

247

## FIPS mode

248

## @param security.fipsMode Configure elasticsearch with FIPS 140 compliant mode

249

## Ref: https://www.elastic.co/guide/en/elasticsearch/reference/current/fips-140-compliance.html

250

251

fipsMode: false

252

## TLS configuration

253

254

tls:

255

## @param security.tls.restEncryption Enable SSL/TLS encryption for Elasticsearch REST API.

256

257

restEncryption: true

258

## @param security.tls.autoGenerated Create self-signed TLS certificates.

259

## NOTE: If autoGenerated certs are enabled and a new node type is enabled using helm upgrade, make sure you remove previously existing Elasticsearch TLS secrets.

260

## Otherwise, the new node certs won't match the existing certs.

261

262

autoGenerated: false

263

## @param security.tls.verificationMode Verification mode for SSL communications.

264

## Supported values: full, certificate, none.

265

## Ref: https://www.elastic.co/guide/en/elasticsearch/reference/current/security-settings.html

266

267

verificationMode: "full"

268

## @param security.tls.master.existingSecret Existing secret containing the certificates for the master nodes

269

## @param security.tls.data.existingSecret Existing secret containing the certificates for the data nodes

270

## @param security.tls.ingest.existingSecret Existing secret containing the certificates for the ingest nodes

271

## @param security.tls.coordinating.existingSecret Existing secret containing the certificates for the coordinating nodes

272

273

master:

274

existingSecret: ""

275

data:

276

existingSecret: ""

277

ingest:

278

existingSecret: ""

279

coordinating:

280

existingSecret: ""

281

## @param security.tls.keystoreFilename Name of the keystore file

282

283

keystoreFilename: elasticsearch.keystore.jks

284

## @param security.tls.truststoreFilename Name of the truststore

285

286

truststoreFilename: elasticsearch.truststore.jks

287

## @param security.tls.usePemCerts Use this variable if your secrets contain PEM certificates instead of JKS/PKCS12

288

## Ignored when using autoGenerated certs.

289

290

usePemCerts: false

291

## @param security.tls.passwordsSecret Existing secret containing the Keystore and Truststore passwords, or key password if PEM certs are used

292

293

passwordsSecret: ""

294

## @param security.tls.keystorePassword Password to access the JKS/PKCS12 keystore or PEM key when they are password-protected.

295

## Ignored if security.tls.passwordsSecret is provided.

296

297

keystorePassword: ""

298

## @param security.tls.truststorePassword Password to access the JKS/PKCS12 truststore when they are password-protected.

299

## Ignored if security.tls.passwordsSecret is provided.

300

301

truststorePassword: ""

302

## @param security.tls.keyPassword Password to access the PEM key when they are password-protected.

303

## Ignored if security.tls.passwordsSecret is provided.

304

305

keyPassword: ""

306

## @param security.tls.secretKeystoreKey Name of the secret key containing the Keystore password

307

308

secretKeystoreKey: ""

309

## @param security.tls.secretTruststoreKey Name of the secret key containing the Truststore password

310

311

secretTruststoreKey: ""

312

## @param security.tls.secretKey Name of the secret key containing the PEM key password

313

314

secretKey: ""

315

## @section Traffic Exposure Parameters

316

317

318

## Elasticsearch service parameters

319

320

service:

321

## @param service.type Elasticsearch service type

322

323

type: ClusterIP

324

## @param service.ports.restAPI Elasticsearch service REST API port

325

## @param service.ports.transport Elasticsearch service transport port

326

327

ports:

328

restAPI: 9200

329

transport: 9300

330

## Node ports to expose

331

## @param service.nodePorts.restAPI Node port for REST API

332

## @param service.nodePorts.transport Node port for REST API

333

## NOTE: choose port between <30000-32767>

334

335

nodePorts:

336

restAPI: ""

337

transport: ""

338

## @param service.clusterIP Elasticsearch service Cluster IP

339

## e.g.:

340

## clusterIP: None

341

342

clusterIP: ""

343

## @param service.loadBalancerIP Elasticsearch service Load Balancer IP

344

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-loadbalancer

345

346

loadBalancerIP: ""

347

## @param service.loadBalancerSourceRanges Elasticsearch service Load Balancer sources

348

## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service

349

## e.g:

350

## loadBalancerSourceRanges:

351

## - 10.10.10.0/24

352

353

loadBalancerSourceRanges: []

354

## @param service.externalTrafficPolicy Elasticsearch service external traffic policy

355

## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip

356

357

externalTrafficPolicy: Cluster

358

## @param service.annotations Additional custom annotations for Elasticsearch service

359

360

annotations: {}

361

## @param service.extraPorts Extra ports to expose in Elasticsearch service (normally used with the `sidecars` value)

362

363

extraPorts: []

364

## @param service.sessionAffinity Session Affinity for Kubernetes service, can be "None" or "ClientIP"

365

## If "ClientIP", consecutive client requests will be directed to the same Pod

366

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies

367

368

sessionAffinity: None

369

## @param service.sessionAffinityConfig Additional settings for the sessionAffinity

370

## sessionAffinityConfig:

371

## clientIP:

372

## timeoutSeconds: 300

373

374

sessionAffinityConfig: {}

375

## Elasticsearch ingress parameters

376

## ref: http://kubernetes.io/docs/concepts/services-networking/ingress/

377

378

ingress:

379

## @param ingress.enabled Enable ingress record generation for Elasticsearch

380

381

enabled: false

382

## @param ingress.pathType Ingress path type

383

384

pathType: ImplementationSpecific

385

## @param ingress.apiVersion Force Ingress API version (automatically detected if not set)

386

387

apiVersion: ""

388

## @param ingress.hostname Default host for the ingress record

389

390

hostname: elasticsearch.local

391

## @param ingress.path Default path for the ingress record

392

## NOTE: You may need to set this to '/*' in order to use this with ALB ingress controllers

393

394

path: /

395

## @param ingress.annotations Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations.

396

## Use this parameter to set the required annotations for cert-manager, see

397

## ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations

398

## e.g:

399

## annotations:

400

## kubernetes.io/ingress.class: nginx

401

## cert-manager.io/cluster-issuer: cluster-issuer-name

402

403

annotations: {}

404

## @param ingress.tls Enable TLS configuration for the host defined at `ingress.hostname` parameter

405

## TLS certificates will be retrieved from a TLS secret with name: `{{- printf "%s-tls" .Values.ingress.hostname }}`

406

## You can:

407

## - Use the `ingress.secrets` parameter to create this TLS secret

408

## - Rely on cert-manager to create it by setting the corresponding annotations

409

## - Rely on Helm to create self-signed certificates by setting `ingress.selfSigned=true`

410

411

tls: false

412

## @param ingress.selfSigned Create a TLS secret for this ingress record using self-signed certificates generated by Helm

413

414

selfSigned: false

415

## @param ingress.ingressClassName IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+)

416

## This is supported in Kubernetes 1.18+ and required if you have more than one IngressClass marked as the default for your cluster .

417

## ref: https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/

418

419

ingressClassName: ""

420

## @param ingress.extraHosts An array with additional hostname(s) to be covered with the ingress record

421

## e.g:

422

## extraHosts:

423

## - name: elasticsearch.local

424

## path: /

425

426

extraHosts: []

427

## @param ingress.extraPaths An array with additional arbitrary paths that may need to be added to the ingress under the main host

428

## e.g:

429

## extraPaths:

430

## - path: /*

431

## backend:

432

## serviceName: ssl-redirect

433

## servicePort: use-annotation

434

435

extraPaths: []

436

## @param ingress.extraTls TLS configuration for additional hostname(s) to be covered with this ingress record

437

## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls

438

## e.g:

439

## extraTls:

440

## - hosts:

441

## - elasticsearch.local

442

## secretName: elasticsearch.local-tls

443

444

extraTls: []

445

## @param ingress.secrets Custom TLS certificates as secrets

446

## NOTE: 'key' and 'certificate' are expected in PEM format

447

## NOTE: 'name' should line up with a 'secretName' set further up

448

## If it is not set and you're using cert-manager, this is unneeded, as it will create a secret for you with valid certificates

449

## If it is not set and you're NOT using cert-manager either, self-signed certificates will be created valid for 365 days

450

## It is also possible to create and manage the certificates outside of this helm chart

451

## Please see README.md for more information

452

## e.g:

453

## secrets:

454

## - name: elasticsearch.local-tls

455

## key: |-

456

## -----BEGIN RSA PRIVATE KEY-----

457

## ...

458

## -----END RSA PRIVATE KEY-----

459

## certificate: |-

460

## -----BEGIN CERTIFICATE-----

461

## ...

462

## -----END CERTIFICATE-----

463

464

secrets: []

465

## @param ingress.extraRules Additional rules to be covered with this ingress record

466

## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules

467

## e.g:

468

## extraRules:

469

## - host: example.local

470

## http:

471

## path: /

472

## backend:

473

## service:

474

## name: example-svc

475

## port:

476

## name: http

477

478

extraRules: []

479

## @section Master-elegible nodes parameters

480

master:

481

## @param master.masterOnly Deploy the Elasticsearch master-elegible nodes as master-only nodes. Recommended for high-demand deployments.

482

## If you are

483

masterOnly: true

484

## @param master.replicaCount Number of master-elegible replicas to deploy

485

486

replicaCount: 2

487

## @param master.extraRoles Append extra roles to the node role

488

489

extraRoles: []

490

## Pod Disruption Budget configuration

491

## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb

492

## @param master.pdb.create Enable/disable a Pod Disruption Budget creation

493

## @param master.pdb.minAvailable Minimum number/percentage of pods that should remain scheduled

494

## @param master.pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable

495

496

pdb:

497

create: true

498

minAvailable: ""

499

maxUnavailable: ""

500

## @param master.nameOverride String to partially override elasticsearch.master.fullname

501

502

nameOverride: ""

503

## @param master.fullnameOverride String to fully override elasticsearch.master.fullname

504

505

fullnameOverride: ""

506

## @param master.servicenameOverride String to fully override elasticsearch.master.servicename

507

508

servicenameOverride: ""

509

## @param master.annotations [object] Annotations for the master statefulset

510

511

annotations: {}

512

## @param master.updateStrategy.type Master-elegible nodes statefulset stategy type

513

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies

514

515

updateStrategy:

516

type: RollingUpdate

517

## Elasticsearch resource requests and limits

518

## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

519

## We usually recommend not to specify default resources and to leave this as a conscious

520

## choice for the user. This also increases chances charts run on environments with little

521

## resources, such as Minikube. If you do want to specify resources, uncomment the following

522

## lines, adjust them as necessary, and remove the curly braces after 'resources:'.

523

## @param master.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if master.resources is set (master.resources is recommended for production).

524

525

resourcesPreset: "small"

526

## @param master.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)

527

## Example:

528

## resources:

529

## requests:

530

## cpu: 2

531

## memory: 512Mi

532

## limits:

533

## cpu: 3

534

## memory: 1024Mi

535

536

resources: {}

537

## @param master.heapSize Elasticsearch master-eligible node heap size.

538

## Note: The recommended heapSize is half of the container's memory.

539

## If omitted, it will be automatically set.

540

## Example:

541

## heapSize: 128m

542

543

heapSize: 128m

544

## Configure Pods Security Context

545

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod

546

## @param master.podSecurityContext.enabled Enabled master-elegible pods' Security Context

547

## @param master.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy

548

## @param master.podSecurityContext.sysctls Set kernel settings using the sysctl interface

549

## @param master.podSecurityContext.supplementalGroups Set filesystem extra groups

550

## @param master.podSecurityContext.fsGroup Set master-elegible pod's Security Context fsGroup

551

552

podSecurityContext:

553

enabled: true

554

fsGroupChangePolicy: Always

555

sysctls: []

556

supplementalGroups: []

557

fsGroup: 1001

558

## Configure Container Security Context

559

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod

560

## @param master.containerSecurityContext.enabled Elasticseacrh master-eligible container securityContext

561

## @param master.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container

562

## @param master.containerSecurityContext.runAsUser User ID for the Elasticseacrh master-eligible container

563

## @param master.containerSecurityContext.runAsGroup Group ID for the Elasticseacrh master-eligible container

564

## @param master.containerSecurityContext.runAsNonRoot Set Elasticsearch master-eligible container's Security Context runAsNonRoot

565

## @param master.containerSecurityContext.privileged Set Elasticsearch master-eligible container's Security Context privileged

566

## @param master.containerSecurityContext.allowPrivilegeEscalation Set Elasticsearch master-eligible container's Security Context allowPrivilegeEscalation

567

## @param master.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem

568

## @param master.containerSecurityContext.capabilities.drop List of capabilities to be dropped

569

## @param master.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile

570

571

containerSecurityContext:

572

enabled: true

573

seLinuxOptions: {}

574

runAsUser: 1001

575

runAsGroup: 1001

576

runAsNonRoot: true

577

privileged: false

578

allowPrivilegeEscalation: false

579

readOnlyRootFilesystem: true

580

capabilities:

581

drop: ["ALL"]

582

seccompProfile:

583

type: "RuntimeDefault"

584

## Network Policies

585

## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/

586

587

networkPolicy:

588

## @param master.networkPolicy.enabled Specifies whether a NetworkPolicy should be created

589

590

enabled: true

591

## @param master.networkPolicy.allowExternal Don't require server label for connections

592

## The Policy model to apply. When set to false, only pods with the correct

593

## server label will have network access to the ports server is listening

594

## on. When true, server will accept connections from any source

595

## (with the correct destination port).

596

597

allowExternal: true

598

## @param master.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.

599

600

allowExternalEgress: true

601

## @param master.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy

602

## e.g:

603

## extraIngress:

604

## - ports:

605

## - port: 1234

606

## from:

607

## - podSelector:

608

## - matchLabels:

609

## - role: frontend

610

## - podSelector:

611

## - matchExpressions:

612

## - key: role

613

## operator: In

614

## values:

615

## - frontend

616

extraIngress: []

617

## @param master.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy

618

## e.g:

619

## extraEgress:

620

## - ports:

621

## - port: 1234

622

## to:

623

## - podSelector:

624

## - matchLabels:

625

## - role: frontend

626

## - podSelector:

627

## - matchExpressions:

628

## - key: role

629

## operator: In

630

## values:

631

## - frontend

632

633

extraEgress: []

634

## @param master.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces

635

## @param master.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces

636

637

ingressNSMatchLabels: {}

638

ingressNSPodMatchLabels: {}

639

## @param master.automountServiceAccountToken Mount Service Account token in pod

640

641

automountServiceAccountToken: false

642

## @param master.hostAliases master-elegible pods host aliases

643

## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/

644

645

hostAliases: []

646

## @param master.podLabels Extra labels for master-elegible pods

647

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/

648

649

podLabels: {}

650

## @param master.podAnnotations Annotations for master-elegible pods

651

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

652

653

podAnnotations: {}

654

## @param master.shareProcessNamespace Share a single process namespace between all of the containers in pod

655

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/share-process-namespace/

656

657

shareProcessNamespace: false

658

## @param master.podAffinityPreset Pod affinity preset. Ignored if `master.affinity` is set. Allowed values: `soft` or `hard`

659

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity

660

661

podAffinityPreset: ""

662

## @param master.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `master.affinity` is set. Allowed values: `soft` or `hard`

663

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity

664

665

podAntiAffinityPreset: ""

666

## Node master.affinity preset

667

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity

668

669

nodeAffinityPreset:

670

## @param master.nodeAffinityPreset.type Node affinity preset type. Ignored if `master.affinity` is set. Allowed values: `soft` or `hard`

671

672

type: ""

673

## @param master.nodeAffinityPreset.key Node label key to match. Ignored if `master.affinity` is set

674

675

key: ""

676

## @param master.nodeAffinityPreset.values Node label values to match. Ignored if `master.affinity` is set

677

## E.g.

678

## values:

679

## - e2e-az1

680

## - e2e-az2

681

682

values: []

683

## @param master.affinity Affinity for master-elegible pods assignment

684

## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity

685

## NOTE: `master.podAffinityPreset`, `master.podAntiAffinityPreset`, and `master.nodeAffinityPreset` will be ignored when it's set

686

687

affinity: {}

688

## @param master.nodeSelector Node labels for master-elegible pods assignment

689

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

690

691

nodeSelector: {}

692

## @param master.tolerations Tolerations for master-elegible pods assignment

693

## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/

694

695

tolerations: []

696

## @param master.priorityClassName master-elegible pods' priorityClassName

697

698

priorityClassName: ""

699

## @param master.schedulerName Name of the k8s scheduler (other than default) for master-elegible pods

700

## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/

701

702

schedulerName: ""

703

## @param master.terminationGracePeriodSeconds In seconds, time the given to the Elasticsearch Master pod needs to terminate gracefully

704

## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods

705

706

terminationGracePeriodSeconds: ""

707

## @param master.topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template

708

## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods

709

710

topologySpreadConstraints: []

711

## @param master.podManagementPolicy podManagementPolicy to manage scaling operation of Elasticsearch master pods

712

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies

713

714

podManagementPolicy: "Parallel"

715

## @param master.minReadySeconds How many seconds a pod needs to be ready before killing the next, during update

716

717

minReadySeconds: 0

718

## Configure extra options for Elasticsearch master-elegible containers' liveness, readiness and startup probes

719

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes

720

## @param master.startupProbe.enabled Enable/disable the startup probe (master nodes pod)

721

## @param master.startupProbe.initialDelaySeconds Delay before startup probe is initiated (master nodes pod)

722

## @param master.startupProbe.periodSeconds How often to perform the probe (master nodes pod)

723

## @param master.startupProbe.timeoutSeconds When the probe times out (master nodes pod)

724

## @param master.startupProbe.successThreshold Minimum consecutive successes for the probe to be considered successful after having failed (master nodes pod)

725

## @param master.startupProbe.failureThreshold Minimum consecutive failures for the probe to be considered failed after having succeeded

726

727

startupProbe:

728

enabled: false

729

initialDelaySeconds: 90

730

periodSeconds: 10

731

timeoutSeconds: 5

732

successThreshold: 1

733

failureThreshold: 5

734

## @param master.livenessProbe.enabled Enable/disable the liveness probe (master-eligible nodes pod)

735

## @param master.livenessProbe.initialDelaySeconds Delay before liveness probe is initiated (master-eligible nodes pod)

736

## @param master.livenessProbe.periodSeconds How often to perform the probe (master-eligible nodes pod)

737

## @param master.livenessProbe.timeoutSeconds When the probe times out (master-eligible nodes pod)

738

## @param master.livenessProbe.successThreshold Minimum consecutive successes for the probe to be considered successful after having failed (master-eligible nodes pod)

739

## @param master.livenessProbe.failureThreshold Minimum consecutive failures for the probe to be considered failed after having succeeded

740

741

livenessProbe:

742

enabled: true

743

initialDelaySeconds: 180

744

periodSeconds: 10

745

timeoutSeconds: 5

746

successThreshold: 1

747

failureThreshold: 5

748

## @param master.readinessProbe.enabled Enable/disable the readiness probe (master-eligible nodes pod)

749

## @param master.readinessProbe.initialDelaySeconds Delay before readiness probe is initiated (master-eligible nodes pod)

750

## @param master.readinessProbe.periodSeconds How often to perform the probe (master-eligible nodes pod)

751

## @param master.readinessProbe.timeoutSeconds When the probe times out (master-eligible nodes pod)

752

## @param master.readinessProbe.successThreshold Minimum consecutive successes for the probe to be considered successful after having failed (master-eligible nodes pod)

753

## @param master.readinessProbe.failureThreshold Minimum consecutive failures for the probe to be considered failed after having succeeded

754

755

readinessProbe:

756

enabled: true

757

initialDelaySeconds: 90

758

periodSeconds: 10

759

timeoutSeconds: 5

760

successThreshold: 1

761

failureThreshold: 5

762

## @param master.customStartupProbe Override default startup probe

763

764

customStartupProbe: {}

765

## @param master.customLivenessProbe Override default liveness probe

766

767

customLivenessProbe: {}

768

## @param master.customReadinessProbe Override default readiness probe

769

770

customReadinessProbe: {}

771

## @param master.command Override default container command (useful when using custom images)

772

773

command: []

774

## @param master.args Override default container args (useful when using custom images)

775

776

args: []

777

## @param master.lifecycleHooks for the master-elegible container(s) to automate configuration before or after startup

778

779

lifecycleHooks: {}

780

## @param master.extraEnvVars Array with extra environment variables to add to master-elegible nodes

781

## e.g:

782

## extraEnvVars:

783

## - name: FOO

784

## value: "bar"

785

786

extraEnvVars: []

787

## @param master.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for master-elegible nodes

788

789

extraEnvVarsCM: ""

790

## @param master.extraEnvVarsSecret Name of existing Secret containing extra env vars for master-elegible nodes

791

792

extraEnvVarsSecret: ""

793

## @param master.extraVolumes Optionally specify extra list of additional volumes for the master-elegible pod(s)

794

795

extraVolumes: []

796

## @param master.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the master-elegible container(s)

797

798

extraVolumeMounts: []

799

## @param master.sidecars Add additional sidecar containers to the master-elegible pod(s)

800

## e.g:

801

## sidecars:

802

## - name: your-image-name

803

## image: your-image

804

## imagePullPolicy: Always

805

## ports:

806

## - name: portname

807

## containerPort: 1234

808

809

sidecars: []

810

## @param master.initContainers Add additional init containers to the master-elegible pod(s)

811

## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/

812

## e.g:

813

## initContainers:

814

## - name: your-image-name

815

## image: your-image

816

## imagePullPolicy: Always

817

## command: ['sh', '-c', 'echo "hello world"']

818

819

initContainers: []

820

## Enable persistence using Persistent Volume Claims

821

## ref: https://kubernetes.io/docs/concepts/storage/persistent-volumes/

822

823

persistence:

824

## @param master.persistence.enabled Enable persistence using a `PersistentVolumeClaim`

825

826

enabled: true

827

## @param master.persistence.storageClass Persistent Volume Storage Class

828

## If defined, storageClassName: <storageClass>

829

## If set to "-", storageClassName: "", which disables dynamic provisioning

830

## If undefined (the default) or set to null, no storageClassName spec is

831

## set, choosing the default provisioner. (gp2 on AWS, standard on

832

## GKE, AWS & OpenStack)

833

834

storageClass: ""

835

## @param master.persistence.existingClaim Existing Persistent Volume Claim

836

## then accept the value as an existing Persistent Volume Claim to which

837

## the container should be bound

838

839

existingClaim: ""

840

## @param master.persistence.existingVolume Existing Persistent Volume for use as volume match label selector to the `volumeClaimTemplate`. Ignored when `master.persistence.selector` is set.

841

842

existingVolume: ""

843

## @param master.persistence.selector Configure custom selector for existing Persistent Volume. Overwrites `master.persistence.existingVolume`

844

## selector:

845

## matchLabels:

846

## volume:

847

848

selector: {}

849

## @param master.persistence.annotations Persistent Volume Claim annotations

850

851

annotations: {}

852

## @param master.persistence.accessModes Persistent Volume Access Modes

853

854

accessModes:

855

- ReadWriteOnce

856

## @param master.persistence.size Persistent Volume Size

857

858

size: 8Gi

859

## Master Persistent Volume Claim Retention Policy

860

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#persistentvolumeclaim-retention

861

862

persistentVolumeClaimRetentionPolicy:

863

## @param master.persistentVolumeClaimRetentionPolicy.enabled Enable Persistent volume retention policy for Master StatefulSet

864

865

enabled: false

866

## @param master.persistentVolumeClaimRetentionPolicy.whenScaled Volume retention behavior when the replica count of the StatefulSet is reduced

867

868

whenScaled: Retain

869

## @param master.persistentVolumeClaimRetentionPolicy.whenDeleted Volume retention behavior that applies when the StatefulSet is deleted

870

871

whenDeleted: Retain

872

## Pods Service Account

873

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

874

## @param master.serviceAccount.create Specifies whether a ServiceAccount should be created

875

## @param master.serviceAccount.name Name of the service account to use. If not set and create is true, a name is generated using the fullname template.

876

## @param master.serviceAccount.automountServiceAccountToken Automount service account token for the server service account

877

## @param master.serviceAccount.annotations Annotations for service account. Evaluated as a template. Only used if `create` is `true`.

878

879

serviceAccount:

880

create: true

881

882

automountServiceAccountToken: false

883

annotations: {}

884

## Enable HorizontalPodAutoscaler for Elasticsearch Master pods

885

## ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/

886

## @param master.autoscaling.enabled Whether enable horizontal pod autoscale

887

## @param master.autoscaling.minReplicas Configure a minimum amount of pods

888

## @param master.autoscaling.maxReplicas Configure a maximum amount of pods

889

## @param master.autoscaling.targetCPU Define the CPU target to trigger the scaling actions (utilization percentage)

890

## @param master.autoscaling.targetMemory Define the memory target to trigger the scaling actions (utilization percentage)

891

892

autoscaling:

893

enabled: false

894

minReplicas: 3

895

maxReplicas: 11

896

targetCPU: ""

897

targetMemory: ""

898

## @section Data-only nodes parameters

899

data:

900

## @param data.replicaCount Number of data-only replicas to deploy

901

902

replicaCount: 2

903

## @param data.extraRoles Append extra roles to the node role

904

905

extraRoles: []

906

## Pod Disruption Budget configuration

907

## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb

908

## @param data.pdb.create Enable/disable a Pod Disruption Budget creation

909

## @param data.pdb.minAvailable Minimum number/percentage of pods that should remain scheduled

910

## @param data.pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable

911

912

pdb:

913

create: true

914

minAvailable: ""

915

maxUnavailable: ""

916

## @param data.nameOverride String to partially override elasticsearch.data.fullname

917

918

nameOverride: ""

919

## @param data.fullnameOverride String to fully override elasticsearch.data.fullname

920

921

fullnameOverride: ""

922

## @param data.servicenameOverride String to fully override elasticsearch.data.servicename

923

924

servicenameOverride: ""

925

## @param data.annotations [object] Annotations for the data statefulset

926

927

annotations: {}

928

## @param data.updateStrategy.type Data-only nodes statefulset stategy type

929

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies

930

931

updateStrategy:

932

type: RollingUpdate

933

## Elasticsearch resource requests and limits

934

## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

935

## @param data.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if data.resources is set (data.resources is recommended for production).

936

937

resourcesPreset: "medium"

938

## @param data.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)

939

## Example:

940

## resources:

941

## requests:

942

## cpu: 2

943

## memory: 512Mi

944

## limits:

945

## cpu: 3

946

## memory: 1024Mi

947

948

resources: {}

949

## @param data.heapSize Elasticsearch data node heap size.

950

## Note: The recommended heapSize is half of the container's memory.

951

## If omitted, it will be automatically set.

952

## Example:

953

## heapSize: 128m

954

955

heapSize: 1024m

956

## Configure Pods Security Context

957

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod

958

## @param data.podSecurityContext.enabled Enabled data pods' Security Context

959

## @param data.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy

960

## @param data.podSecurityContext.sysctls Set kernel settings using the sysctl interface

961

## @param data.podSecurityContext.supplementalGroups Set filesystem extra groups

962

## @param data.podSecurityContext.fsGroup Set data pod's Security Context fsGroup

963

964

podSecurityContext:

965

enabled: true

966

fsGroupChangePolicy: Always

967

sysctls: []

968

supplementalGroups: []

969

fsGroup: 1001

970

## Configure Container Security Context

971

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod

972

## @param data.containerSecurityContext.enabled Elasticseacrh data container securityContext

973

## @param data.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container

974

## @param data.containerSecurityContext.runAsUser User ID for the Elasticseacrh data container

975

## @param data.containerSecurityContext.runAsGroup Group ID for the Elasticseacrh data container

976

## @param data.containerSecurityContext.runAsNonRoot Set Elasticsearch data container's Security Context runAsNonRoot

977

## @param data.containerSecurityContext.privileged Set Elasticsearch data container's Security Context privileged

978

## @param data.containerSecurityContext.allowPrivilegeEscalation Set Elasticsearch data container's Security Context allowPrivilegeEscalation

979

## @param data.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem

980

## @param data.containerSecurityContext.capabilities.drop List of capabilities to be dropped

981

## @param data.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile

982

983

containerSecurityContext:

984

enabled: true

985

seLinuxOptions: {}

986

runAsUser: 1001

987

runAsGroup: 1001

988

runAsNonRoot: true

989

privileged: false

990

allowPrivilegeEscalation: false

991

readOnlyRootFilesystem: true

992

capabilities:

993

drop: ["ALL"]

994

seccompProfile:

995

type: "RuntimeDefault"

996

## Network Policies

997

## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/

998

999

networkPolicy:

1000

## @param data.networkPolicy.enabled Specifies whether a NetworkPolicy should be created

1001

1002

enabled: true

1003

## @param data.networkPolicy.allowExternal Don't require server label for connections

1004

## The Policy model to apply. When set to false, only pods with the correct

1005

## server label will have network access to the ports server is listening

1006

## on. When true, server will accept connections from any source

1007

## (with the correct destination port).

1008

1009

allowExternal: true

1010

## @param data.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.

1011

1012

allowExternalEgress: true

1013

## @param data.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy

1014

## e.g:

1015

## extraIngress:

1016

## - ports:

1017

## - port: 1234

1018

## from:

1019

## - podSelector:

1020

## - matchLabels:

1021

## - role: frontend

1022

## - podSelector:

1023

## - matchExpressions:

1024

## - key: role

1025

## operator: In

1026

## values:

1027

## - frontend

1028

extraIngress: []

1029

## @param data.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy

1030

## e.g:

1031

## extraEgress:

1032

## - ports:

1033

## - port: 1234

1034

## to:

1035

## - podSelector:

1036

## - matchLabels:

1037

## - role: frontend

1038

## - podSelector:

1039

## - matchExpressions:

1040

## - key: role

1041

## operator: In

1042

## values:

1043

## - frontend

1044

1045

extraEgress: []

1046

## @param data.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces

1047

## @param data.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces

1048

1049

ingressNSMatchLabels: {}

1050

ingressNSPodMatchLabels: {}

1051

## @param data.automountServiceAccountToken Mount Service Account token in pod

1052

1053

automountServiceAccountToken: false

1054

## @param data.hostAliases data pods host aliases

1055

## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/

1056

1057

hostAliases: []

1058

## @param data.podLabels Extra labels for data pods

1059

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/

1060

1061

podLabels: {}

1062

## @param data.podAnnotations Annotations for data pods

1063

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

1064

1065

podAnnotations: {}

1066

## @param data.shareProcessNamespace Share a single process namespace between all of the containers in pod

1067

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/share-process-namespace/

1068

1069

shareProcessNamespace: false

1070

## @param data.podAffinityPreset Pod affinity preset. Ignored if `data.affinity` is set. Allowed values: `soft` or `hard`

1071

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity

1072

1073

podAffinityPreset: ""

1074

## @param data.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `data.affinity` is set. Allowed values: `soft` or `hard`

1075

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity

1076

1077

podAntiAffinityPreset: ""

1078

## Node data.affinity preset

1079

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity

1080

1081

nodeAffinityPreset:

1082

## @param data.nodeAffinityPreset.type Node affinity preset type. Ignored if `data.affinity` is set. Allowed values: `soft` or `hard`

1083

1084

type: ""

1085

## @param data.nodeAffinityPreset.key Node label key to match. Ignored if `data.affinity` is set

1086

1087

key: ""

1088

## @param data.nodeAffinityPreset.values Node label values to match. Ignored if `data.affinity` is set

1089

## E.g.

1090

## values:

1091

## - e2e-az1

1092

## - e2e-az2

1093

1094

values: []

1095

## @param data.affinity Affinity for data pods assignment

1096

## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity

1097

## NOTE: `data.podAffinityPreset`, `data.podAntiAffinityPreset`, and `data.nodeAffinityPreset` will be ignored when it's set

1098

1099

affinity: {}

1100

## @param data.nodeSelector Node labels for data pods assignment

1101

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

1102

1103

nodeSelector: {}

1104

## @param data.tolerations Tolerations for data pods assignment

1105

## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/

1106

1107

tolerations: []

1108

## @param data.priorityClassName data pods' priorityClassName

1109

1110

priorityClassName: ""

1111

## @param data.schedulerName Name of the k8s scheduler (other than default) for data pods

1112

## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/

1113

1114

schedulerName: ""

1115

## @param data.terminationGracePeriodSeconds In seconds, time the given to the Elasticsearch data pod needs to terminate gracefully

1116

## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods

1117

1118

terminationGracePeriodSeconds: ""

1119

## @param data.topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template

1120

## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods

1121

1122

topologySpreadConstraints: []

1123

## @param data.podManagementPolicy podManagementPolicy to manage scaling operation of Elasticsearch data pods

1124

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies

1125

1126

podManagementPolicy: "Parallel"

1127

## @param data.minReadySeconds How many seconds a pod needs to be ready before killing the next, during update

1128

1129

minReadySeconds: 0

1130

## Configure extra options for Elasticsearch data containers' liveness, readiness and startup probes

1131

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes

1132

## @param data.startupProbe.enabled Enable/disable the startup probe (data nodes pod)

1133

## @param data.startupProbe.initialDelaySeconds Delay before startup probe is initiated (data nodes pod)

1134

## @param data.startupProbe.periodSeconds How often to perform the probe (data nodes pod)

1135

## @param data.startupProbe.timeoutSeconds When the probe times out (data nodes pod)

1136

## @param data.startupProbe.successThreshold Minimum consecutive successes for the probe to be considered successful after having failed (data nodes pod)

1137

## @param data.startupProbe.failureThreshold Minimum consecutive failures for the probe to be considered failed after having succeeded

1138

1139

startupProbe:

1140

enabled: false

1141

initialDelaySeconds: 90

1142

periodSeconds: 10

1143

timeoutSeconds: 5

1144

successThreshold: 1

1145

failureThreshold: 5

1146

## @param data.livenessProbe.enabled Enable/disable the liveness probe (data nodes pod)

1147

## @param data.livenessProbe.initialDelaySeconds Delay before liveness probe is initiated (data nodes pod)

1148

## @param data.livenessProbe.periodSeconds How often to perform the probe (data nodes pod)

1149

## @param data.livenessProbe.timeoutSeconds When the probe times out (data nodes pod)

1150

## @param data.livenessProbe.successThreshold Minimum consecutive successes for the probe to be considered successful after having failed (data nodes pod)

1151

## @param data.livenessProbe.failureThreshold Minimum consecutive failures for the probe to be considered failed after having succeeded

1152

1153

livenessProbe:

1154

enabled: true

1155

initialDelaySeconds: 180

1156

periodSeconds: 10

1157

timeoutSeconds: 5

1158

successThreshold: 1

1159

failureThreshold: 5

1160

## @param data.readinessProbe.enabled Enable/disable the readiness probe (data nodes pod)

1161

## @param data.readinessProbe.initialDelaySeconds Delay before readiness probe is initiated (data nodes pod)

1162

## @param data.readinessProbe.periodSeconds How often to perform the probe (data nodes pod)

1163

## @param data.readinessProbe.timeoutSeconds When the probe times out (data nodes pod)

1164

## @param data.readinessProbe.successThreshold Minimum consecutive successes for the probe to be considered successful after having failed (data nodes pod)

1165

## @param data.readinessProbe.failureThreshold Minimum consecutive failures for the probe to be considered failed after having succeeded

1166

1167

readinessProbe:

1168

enabled: true

1169

initialDelaySeconds: 90

1170

periodSeconds: 10

1171

timeoutSeconds: 5

1172

successThreshold: 1

1173

failureThreshold: 5

1174

## @param data.customStartupProbe Override default startup probe

1175

1176

customStartupProbe: {}

1177

## @param data.customLivenessProbe Override default liveness probe

1178

1179

customLivenessProbe: {}

1180

## @param data.customReadinessProbe Override default readiness probe

1181

1182

customReadinessProbe: {}

1183

## @param data.command Override default container command (useful when using custom images)

1184

1185

command: []

1186

## @param data.args Override default container args (useful when using custom images)

1187

1188

args: []

1189

## @param data.lifecycleHooks for the data container(s) to automate configuration before or after startup

1190

1191

lifecycleHooks: {}

1192

## @param data.extraEnvVars Array with extra environment variables to add to data nodes

1193

## e.g:

1194

## extraEnvVars:

1195

## - name: FOO

1196

## value: "bar"

1197

1198

extraEnvVars: []

1199

## @param data.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for data nodes

1200

1201

extraEnvVarsCM: ""

1202

## @param data.extraEnvVarsSecret Name of existing Secret containing extra env vars for data nodes

1203

1204

extraEnvVarsSecret: ""

1205

## @param data.extraVolumes Optionally specify extra list of additional volumes for the data pod(s)

1206

1207

extraVolumes: []

1208

## @param data.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the data container(s)

1209

1210

extraVolumeMounts: []

1211

## @param data.sidecars Add additional sidecar containers to the data pod(s)

1212

## e.g:

1213

## sidecars:

1214

## - name: your-image-name

1215

## image: your-image

1216

## imagePullPolicy: Always

1217

## ports:

1218

## - name: portname

1219

## containerPort: 1234

1220

1221

sidecars: []

1222

## @param data.initContainers Add additional init containers to the data pod(s)

1223

## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/

1224

## e.g:

1225

## initContainers:

1226

## - name: your-image-name

1227

## image: your-image

1228

## imagePullPolicy: Always

1229

## command: ['sh', '-c', 'echo "hello world"']

1230

1231

initContainers: []

1232

## Enable persistence using Persistent Volume Claims

1233

## ref: https://kubernetes.io/docs/concepts/storage/persistent-volumes/

1234

1235

persistence:

1236

## @param data.persistence.enabled Enable persistence using a `PersistentVolumeClaim`

1237

1238

enabled: true

1239

## @param data.persistence.storageClass Persistent Volume Storage Class

1240

## If defined, storageClassName: <storageClass>

1241

## If set to "-", storageClassName: "", which disables dynamic provisioning

1242

## If undefined (the default) or set to null, no storageClassName spec is

1243

## set, choosing the default provisioner. (gp2 on AWS, standard on

1244

## GKE, AWS & OpenStack)

1245

1246

storageClass: ""

1247

## @param data.persistence.existingClaim Existing Persistent Volume Claim

1248

## then accept the value as an existing Persistent Volume Claim to which

1249

## the container should be bound

1250

1251

existingClaim: ""

1252

## @param data.persistence.existingVolume Existing Persistent Volume for use as volume match label selector to the `volumeClaimTemplate`. Ignored when `data.persistence.selector` is set.

1253

1254

existingVolume: ""

1255

## @param data.persistence.selector Configure custom selector for existing Persistent Volume. Overwrites `data.persistence.existingVolume`

1256

## selector:

1257

## matchLabels:

1258

## volume:

1259

1260

selector: {}

1261

## @param data.persistence.annotations Persistent Volume Claim annotations

1262

1263

annotations: {}

1264

## @param data.persistence.accessModes Persistent Volume Access Modes

1265

1266

accessModes:

1267

- ReadWriteOnce

1268

## @param data.persistence.size Persistent Volume Size

1269

1270

size: 8Gi

1271

## Data Persistent Volume Claim Retention Policy

1272

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#persistentvolumeclaim-retention

1273

1274

persistentVolumeClaimRetentionPolicy:

1275

## @param data.persistentVolumeClaimRetentionPolicy.enabled Enable Persistent volume retention policy for Data StatefulSet

1276

1277

enabled: false

1278

## @param data.persistentVolumeClaimRetentionPolicy.whenScaled Volume retention behavior when the replica count of the StatefulSet is reduced

1279

1280

whenScaled: Retain

1281

## @param data.persistentVolumeClaimRetentionPolicy.whenDeleted Volume retention behavior that applies when the StatefulSet is deleted

1282

1283

whenDeleted: Retain

1284

## Pods Service Account

1285

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

1286

## @param data.serviceAccount.create Specifies whether a ServiceAccount should be created

1287

## @param data.serviceAccount.name Name of the service account to use. If not set and create is true, a name is generated using the fullname template.

1288

## @param data.serviceAccount.automountServiceAccountToken Automount service account token for the server service account

1289

## @param data.serviceAccount.annotations Annotations for service account. Evaluated as a template. Only used if `create` is `true`.

1290

1291

serviceAccount:

1292

create: true

1293

1294

automountServiceAccountToken: false

1295

annotations: {}

1296

## Enable HorizontalPodAutoscaler for Elasticsearch data pods

1297

## ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/

1298

## @param data.autoscaling.enabled Whether enable horizontal pod autoscale

1299

## @param data.autoscaling.minReplicas Configure a minimum amount of pods

1300

## @param data.autoscaling.maxReplicas Configure a maximum amount of pods

1301

## @param data.autoscaling.targetCPU Define the CPU target to trigger the scaling actions (utilization percentage)

1302

## @param data.autoscaling.targetMemory Define the memory target to trigger the scaling actions (utilization percentage)

1303

1304

autoscaling:

1305

enabled: false

1306

minReplicas: 3

1307

maxReplicas: 11

1308

targetCPU: ""

1309

targetMemory: ""

1310

## @section Coordinating-only nodes parameters

1311

coordinating:

1312

## @param coordinating.replicaCount Number of coordinating-only replicas to deploy

1313

1314

replicaCount: 2

1315

## @param coordinating.extraRoles Append extra roles to the node role

1316

## NOTE: In Elasticsearch, all nodes act as coordinators, coordinating-only nodes do not have any other role by default.

1317

1318

extraRoles: []

1319

## Pod Disruption Budget configuration

1320

## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb

1321

## @param coordinating.pdb.create Enable/disable a Pod Disruption Budget creation

1322

## @param coordinating.pdb.minAvailable Minimum number/percentage of pods that should remain scheduled

1323

## @param coordinating.pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable

1324

1325

pdb:

1326

create: true

1327

minAvailable: ""

1328

maxUnavailable: ""

1329

## @param coordinating.nameOverride String to partially override elasticsearch.coordinating.fullname

1330

1331

nameOverride: ""

1332

## @param coordinating.fullnameOverride String to fully override elasticsearch.coordinating.fullname

1333

1334

fullnameOverride: ""

1335

## @param coordinating.servicenameOverride String to fully override elasticsearch.coordinating.servicename

1336

1337

servicenameOverride: ""

1338

## @param coordinating.annotations [object] Annotations for the coordinating-only statefulset

1339

1340

annotations: {}

1341

## @param coordinating.updateStrategy.type Coordinating-only nodes statefulset stategy type

1342

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies

1343

1344

updateStrategy:

1345

type: RollingUpdate

1346

## Elasticsearch resource requests and limits

1347

## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

1348

## @param coordinating.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if coordinating.resources is set (coordinating.resources is recommended for production).

1349

1350

resourcesPreset: "small"

1351

## @param coordinating.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)

1352

## Example:

1353

## resources:

1354

## requests:

1355

## cpu: 2

1356

## memory: 512Mi

1357

## limits:

1358

## cpu: 3

1359

## memory: 1024Mi

1360

1361

resources: {}

1362

## @param coordinating.heapSize Elasticsearch coordinating node heap size.

1363

## Note: The recommended heapSize is half of the container's memory.

1364

## If omitted, it will be automatically set.

1365

## Example:

1366

## heapSize: 128m

1367

1368

heapSize: 128m

1369

## Configure Pods Security Context

1370

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod

1371

## @param coordinating.podSecurityContext.enabled Enabled coordinating-only pods' Security Context

1372

## @param coordinating.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy

1373

## @param coordinating.podSecurityContext.sysctls Set kernel settings using the sysctl interface

1374

## @param coordinating.podSecurityContext.supplementalGroups Set filesystem extra groups

1375

## @param coordinating.podSecurityContext.fsGroup Set coordinating-only pod's Security Context fsGroup

1376

1377

podSecurityContext:

1378

enabled: true

1379

fsGroupChangePolicy: Always

1380

sysctls: []

1381

supplementalGroups: []

1382

fsGroup: 1001

1383

## Configure Container Security Context

1384

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod

1385

## @param coordinating.containerSecurityContext.enabled Elasticseacrh coordinating container securityContext

1386

## @param coordinating.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container

1387

## @param coordinating.containerSecurityContext.runAsUser User ID for the Elasticseacrh coordinating container

1388

## @param coordinating.containerSecurityContext.runAsGroup Group ID for the Elasticseacrh coordinating container

1389

## @param coordinating.containerSecurityContext.runAsNonRoot Set Elasticsearch coordinating container's Security Context runAsNonRoot

1390

## @param coordinating.containerSecurityContext.privileged Set Elasticsearch coordinating container's Security Context privileged

1391

## @param coordinating.containerSecurityContext.allowPrivilegeEscalation Set Elasticsearch coordinating container's Security Context allowPrivilegeEscalation

1392

## @param coordinating.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem

1393

## @param coordinating.containerSecurityContext.capabilities.drop List of capabilities to be dropped

1394

## @param coordinating.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile

1395

1396

containerSecurityContext:

1397

enabled: true

1398

seLinuxOptions: {}

1399

runAsUser: 1001

1400

runAsGroup: 1001

1401

runAsNonRoot: true

1402

privileged: false

1403

allowPrivilegeEscalation: false

1404

readOnlyRootFilesystem: true

1405

capabilities:

1406

drop: ["ALL"]

1407

seccompProfile:

1408

type: "RuntimeDefault"

1409

## Network Policies

1410

## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/

1411

1412

networkPolicy:

1413

## @param coordinating.networkPolicy.enabled Specifies whether a NetworkPolicy should be created

1414

1415

enabled: true

1416

## @param coordinating.networkPolicy.allowExternal Don't require server label for connections

1417

## The Policy model to apply. When set to false, only pods with the correct

1418

## server label will have network access to the ports server is listening

1419

## on. When true, server will accept connections from any source

1420

## (with the correct destination port).

1421

1422

allowExternal: true

1423

## @param coordinating.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.

1424

1425

allowExternalEgress: true

1426

## @param coordinating.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy

1427

## e.g:

1428

## extraIngress:

1429

## - ports:

1430

## - port: 1234

1431

## from:

1432

## - podSelector:

1433

## - matchLabels:

1434

## - role: frontend

1435

## - podSelector:

1436

## - matchExpressions:

1437

## - key: role

1438

## operator: In

1439

## values:

1440

## - frontend

1441

extraIngress: []

1442

## @param coordinating.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy

1443

## e.g:

1444

## extraEgress:

1445

## - ports:

1446

## - port: 1234

1447

## to:

1448

## - podSelector:

1449

## - matchLabels:

1450

## - role: frontend

1451

## - podSelector:

1452

## - matchExpressions:

1453

## - key: role

1454

## operator: In

1455

## values:

1456

## - frontend

1457

1458

extraEgress: []

1459

## @param coordinating.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces

1460

## @param coordinating.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces

1461

1462

ingressNSMatchLabels: {}

1463

ingressNSPodMatchLabels: {}

1464

## @param coordinating.automountServiceAccountToken Mount Service Account token in pod

1465

1466

automountServiceAccountToken: false

1467

## @param coordinating.hostAliases coordinating-only pods host aliases

1468

## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/

1469

1470

hostAliases: []

1471

## @param coordinating.podLabels Extra labels for coordinating-only pods

1472

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/

1473

1474

podLabels: {}

1475

## @param coordinating.podAnnotations Annotations for coordinating-only pods

1476

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

1477

1478

podAnnotations: {}

1479

## @param coordinating.shareProcessNamespace Share a single process namespace between all of the containers in pod

1480

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/share-process-namespace/

1481

1482

shareProcessNamespace: false

1483

## @param coordinating.podAffinityPreset Pod affinity preset. Ignored if `coordinating.affinity` is set. Allowed values: `soft` or `hard`

1484

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity

1485

1486

podAffinityPreset: ""

1487

## @param coordinating.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `coordinating.affinity` is set. Allowed values: `soft` or `hard`

1488

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity

1489

1490

podAntiAffinityPreset: ""

1491

## Node coordinating.affinity preset

1492

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity

1493

1494

nodeAffinityPreset:

1495

## @param coordinating.nodeAffinityPreset.type Node affinity preset type. Ignored if `coordinating.affinity` is set. Allowed values: `soft` or `hard`

1496

1497

type: ""

1498

## @param coordinating.nodeAffinityPreset.key Node label key to match. Ignored if `coordinating.affinity` is set

1499

1500

key: ""

1501

## @param coordinating.nodeAffinityPreset.values Node label values to match. Ignored if `coordinating.affinity` is set

1502

## E.g.

1503

## values:

1504

## - e2e-az1

1505

## - e2e-az2

1506

1507

values: []

1508

## @param coordinating.affinity Affinity for coordinating-only pods assignment

1509

## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity

1510

## NOTE: `coordinating.podAffinityPreset`, `coordinating.podAntiAffinityPreset`, and `coordinating.nodeAffinityPreset` will be ignored when it's set

1511

1512

affinity: {}

1513

## @param coordinating.nodeSelector Node labels for coordinating-only pods assignment

1514

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

1515

1516

nodeSelector: {}

1517

## @param coordinating.tolerations Tolerations for coordinating-only pods assignment

1518

## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/

1519

1520

tolerations: []

1521

## @param coordinating.priorityClassName coordinating-only pods' priorityClassName

1522

1523

priorityClassName: ""

1524

## @param coordinating.schedulerName Name of the k8s scheduler (other than default) for coordinating-only pods

1525

## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/

1526

1527

schedulerName: ""

1528

## @param coordinating.terminationGracePeriodSeconds In seconds, time the given to the Elasticsearch coordinating pod needs to terminate gracefully

1529

## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods

1530

1531

terminationGracePeriodSeconds: ""

1532

## @param coordinating.topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template

1533

## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods

1534

1535

topologySpreadConstraints: []

1536

## @param coordinating.podManagementPolicy podManagementPolicy to manage scaling operation of Elasticsearch coordinating pods

1537

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies

1538

1539

podManagementPolicy: "Parallel"

1540

## @param coordinating.minReadySeconds How many seconds a pod needs to be ready before killing the next, during update

1541

1542

minReadySeconds: 0

1543

## Configure extra options for Elasticsearch coordinating-only containers' liveness, readiness and startup probes

1544

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes

1545

## @param coordinating.startupProbe.enabled Enable/disable the startup probe (coordinating-only nodes pod)

1546

## @param coordinating.startupProbe.initialDelaySeconds Delay before startup probe is initiated (coordinating-only nodes pod)

1547

## @param coordinating.startupProbe.periodSeconds How often to perform the probe (coordinating-only nodes pod)

1548

## @param coordinating.startupProbe.timeoutSeconds When the probe times out (coordinating-only nodes pod)

1549

## @param coordinating.startupProbe.successThreshold Minimum consecutive successes for the probe to be considered successful after having failed (coordinating-only nodes pod)

1550

## @param coordinating.startupProbe.failureThreshold Minimum consecutive failures for the probe to be considered failed after having succeeded

1551

1552

startupProbe:

1553

enabled: false

1554

initialDelaySeconds: 90

1555

periodSeconds: 10

1556

timeoutSeconds: 5

1557

successThreshold: 1

1558

failureThreshold: 5

1559

## @param coordinating.livenessProbe.enabled Enable/disable the liveness probe (coordinating-only nodes pod)

1560

## @param coordinating.livenessProbe.initialDelaySeconds Delay before liveness probe is initiated (coordinating-only nodes pod)

1561

## @param coordinating.livenessProbe.periodSeconds How often to perform the probe (coordinating-only nodes pod)

1562

## @param coordinating.livenessProbe.timeoutSeconds When the probe times out (coordinating-only nodes pod)

1563

## @param coordinating.livenessProbe.successThreshold Minimum consecutive successes for the probe to be considered successful after having failed (coordinating-only nodes pod)

1564

## @param coordinating.livenessProbe.failureThreshold Minimum consecutive failures for the probe to be considered failed after having succeeded

1565

1566

livenessProbe:

1567

enabled: true

1568

initialDelaySeconds: 180

1569

periodSeconds: 10

1570

timeoutSeconds: 5

1571

successThreshold: 1

1572

failureThreshold: 5

1573

## @param coordinating.readinessProbe.enabled Enable/disable the readiness probe (coordinating-only nodes pod)

1574

## @param coordinating.readinessProbe.initialDelaySeconds Delay before readiness probe is initiated (coordinating-only nodes pod)

1575

## @param coordinating.readinessProbe.periodSeconds How often to perform the probe (coordinating-only nodes pod)

1576

## @param coordinating.readinessProbe.timeoutSeconds When the probe times out (coordinating-only nodes pod)

1577

## @param coordinating.readinessProbe.successThreshold Minimum consecutive successes for the probe to be considered successful after having failed (coordinating-only nodes pod)

1578

## @param coordinating.readinessProbe.failureThreshold Minimum consecutive failures for the probe to be considered failed after having succeeded

1579

1580

readinessProbe:

1581

enabled: true

1582

initialDelaySeconds: 90

1583

periodSeconds: 10

1584

timeoutSeconds: 5

1585

successThreshold: 1

1586

failureThreshold: 5

1587

## @param coordinating.customStartupProbe Override default startup probe

1588

1589

customStartupProbe: {}

1590

## @param coordinating.customLivenessProbe Override default liveness probe

1591

1592

customLivenessProbe: {}

1593

## @param coordinating.customReadinessProbe Override default readiness probe

1594

1595

customReadinessProbe: {}

1596

## @param coordinating.command Override default container command (useful when using custom images)

1597

1598

command: []

1599

## @param coordinating.args Override default container args (useful when using custom images)

1600

1601

args: []

1602

## @param coordinating.lifecycleHooks for the coordinating-only container(s) to automate configuration before or after startup

1603

1604

lifecycleHooks: {}

1605

## @param coordinating.extraEnvVars Array with extra environment variables to add to coordinating-only nodes

1606

## e.g:

1607

## extraEnvVars:

1608

## - name: FOO

1609

## value: "bar"

1610

1611

extraEnvVars: []

1612

## @param coordinating.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for coordinating-only nodes

1613

1614

extraEnvVarsCM: ""

1615

## @param coordinating.extraEnvVarsSecret Name of existing Secret containing extra env vars for coordinating-only nodes

1616

1617

extraEnvVarsSecret: ""

1618

## @param coordinating.extraVolumes Optionally specify extra list of additional volumes for the coordinating-only pod(s)

1619

1620

extraVolumes: []

1621

## @param coordinating.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the coordinating-only container(s)

1622

1623

extraVolumeMounts: []

1624

## @param coordinating.sidecars Add additional sidecar containers to the coordinating-only pod(s)

1625

## e.g:

1626

## sidecars:

1627

## - name: your-image-name

1628

## image: your-image

1629

## imagePullPolicy: Always

1630

## ports:

1631

## - name: portname

1632

## containerPort: 1234

1633

1634

sidecars: []

1635

## @param coordinating.initContainers Add additional init containers to the coordinating-only pod(s)

1636

## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/

1637

## e.g:

1638

## initContainers:

1639

## - name: your-image-name

1640

## image: your-image

1641

## imagePullPolicy: Always

1642

## command: ['sh', '-c', 'echo "hello world"']

1643

1644

initContainers: []

1645

## Pods Service Account

1646

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

1647

## @param coordinating.serviceAccount.create Specifies whether a ServiceAccount should be created

1648

## @param coordinating.serviceAccount.name Name of the service account to use. If not set and create is true, a name is generated using the fullname template.

1649

## @param coordinating.serviceAccount.automountServiceAccountToken Automount service account token for the server service account

1650

## @param coordinating.serviceAccount.annotations Annotations for service account. Evaluated as a template. Only used if `create` is `true`.

1651

1652

serviceAccount:

1653

create: true

1654

1655

automountServiceAccountToken: false

1656

annotations: {}

1657

## Enable HorizontalPodAutoscaler for Elasticsearch coordinating pods

1658

## ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/

1659

## @param coordinating.autoscaling.enabled Whether enable horizontal pod autoscale

1660

## @param coordinating.autoscaling.minReplicas Configure a minimum amount of pods

1661

## @param coordinating.autoscaling.maxReplicas Configure a maximum amount of pods

1662

## @param coordinating.autoscaling.targetCPU Define the CPU target to trigger the scaling actions (utilization percentage)

1663

## @param coordinating.autoscaling.targetMemory Define the memory target to trigger the scaling actions (utilization percentage)

1664

1665

autoscaling:

1666

enabled: false

1667

minReplicas: 3

1668

maxReplicas: 11

1669

targetCPU: ""

1670

targetMemory: ""

1671

## @section Ingest-only nodes parameters

1672

ingest:

1673

## @param ingest.enabled Enable ingest nodes

1674

1675

enabled: true

1676

## @param ingest.replicaCount Number of ingest-only replicas to deploy

1677

1678

replicaCount: 2

1679

## @param ingest.extraRoles Append extra roles to the node role

1680

1681

extraRoles: []

1682

## Pod Disruption Budget configuration

1683

## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb

1684

## @param ingest.pdb.create Enable/disable a Pod Disruption Budget creation

1685

## @param ingest.pdb.minAvailable Minimum number/percentage of pods that should remain scheduled

1686

## @param ingest.pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable

1687

1688

pdb:

1689

create: true

1690

minAvailable: ""

1691

maxUnavailable: ""

1692

## @param ingest.nameOverride String to partially override elasticsearch.ingest.fullname

1693

1694

nameOverride: ""

1695

## @param ingest.fullnameOverride String to fully override elasticsearch.ingest.fullname

1696

1697

fullnameOverride: ""

1698

## @param ingest.servicenameOverride String to fully override ingest.master.servicename

1699

1700

servicenameOverride: ""

1701

## @param ingest.annotations [object] Annotations for the ingest statefulset

1702

1703

annotations: {}

1704

## @param ingest.containerPorts.restAPI Elasticsearch REST API port

1705

## @param ingest.containerPorts.transport Elasticsearch Transport port

1706

1707

containerPorts:

1708

restAPI: 9200

1709

transport: 9300

1710

## @param ingest.updateStrategy.type Ingest-only nodes statefulset stategy type

1711

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies

1712

1713

updateStrategy:

1714

type: RollingUpdate

1715

## Elasticsearch resource requests and limits

1716

## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

1717

## @param ingest.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if ingest.resources is set (ingest.resources is recommended for production).

1718

1719

resourcesPreset: "small"

1720

## @param ingest.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)

1721

## Example:

1722

## resources:

1723

## requests:

1724

## cpu: 2

1725

## memory: 512Mi

1726

## limits:

1727

## cpu: 3

1728

## memory: 1024Mi

1729

1730

resources: {}

1731

## @param ingest.heapSize Elasticsearch ingest-only node heap size.

1732

## Note: The recommended heapSize is half of the container's memory.

1733

## If omitted, it will be automatically set.

1734

## Example:

1735

## heapSize: 128m

1736

1737

heapSize: 128m

1738

## Configure Pods Security Context

1739

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod

1740

## @param ingest.podSecurityContext.enabled Enabled ingest-only pods' Security Context

1741

## @param ingest.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy

1742

## @param ingest.podSecurityContext.sysctls Set kernel settings using the sysctl interface

1743

## @param ingest.podSecurityContext.supplementalGroups Set filesystem extra groups

1744

## @param ingest.podSecurityContext.fsGroup Set ingest-only pod's Security Context fsGroup

1745

1746

podSecurityContext:

1747

enabled: true

1748

fsGroupChangePolicy: Always

1749

sysctls: []

1750

supplementalGroups: []

1751

fsGroup: 1001

1752

## Configure Container Security Context

1753

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod

1754

## @param ingest.containerSecurityContext.enabled Elasticseacrh ingest container securityContext

1755

## @param ingest.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container

1756

## @param ingest.containerSecurityContext.runAsUser User ID for the Elasticseacrh ingest container

1757

## @param ingest.containerSecurityContext.runAsGroup Group ID for the Elasticseacrh ingest container

1758

## @param ingest.containerSecurityContext.runAsNonRoot Set Elasticsearch ingest container's Security Context runAsNonRoot

1759

## @param ingest.containerSecurityContext.privileged Set Elasticsearch ingest container's Security Context privileged

1760

## @param ingest.containerSecurityContext.allowPrivilegeEscalation Set Elasticsearch ingest container's Security Context allowPrivilegeEscalation

1761

## @param ingest.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem

1762

## @param ingest.containerSecurityContext.capabilities.drop List of capabilities to be dropped

1763

## @param ingest.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile

1764

1765

containerSecurityContext:

1766

enabled: true

1767

seLinuxOptions: {}

1768

runAsUser: 1001

1769

runAsGroup: 1001

1770

runAsNonRoot: true

1771

privileged: false

1772

allowPrivilegeEscalation: false

1773

readOnlyRootFilesystem: true

1774

capabilities:

1775

drop: ["ALL"]

1776

seccompProfile:

1777

type: "RuntimeDefault"

1778

## Network Policies

1779

## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/

1780

1781

networkPolicy:

1782

## @param ingest.networkPolicy.enabled Specifies whether a NetworkPolicy should be created

1783

1784

enabled: true

1785

## @param ingest.networkPolicy.allowExternal Don't require server label for connections

1786

## The Policy model to apply. When set to false, only pods with the correct

1787

## server label will have network access to the ports server is listening

1788

## on. When true, server will accept connections from any source

1789

## (with the correct destination port).

1790

1791

allowExternal: true

1792

## @param ingest.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.

1793

1794

allowExternalEgress: true

1795

## @param ingest.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy

1796

## e.g:

1797

## extraIngress:

1798

## - ports:

1799

## - port: 1234

1800

## from:

1801

## - podSelector:

1802

## - matchLabels:

1803

## - role: frontend

1804

## - podSelector:

1805

## - matchExpressions:

1806

## - key: role

1807

## operator: In

1808

## values:

1809

## - frontend

1810

extraIngress: []

1811

## @param ingest.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy

1812

## e.g:

1813

## extraEgress:

1814

## - ports:

1815

## - port: 1234

1816

## to:

1817

## - podSelector:

1818

## - matchLabels:

1819

## - role: frontend

1820

## - podSelector:

1821

## - matchExpressions:

1822

## - key: role

1823

## operator: In

1824

## values:

1825

## - frontend

1826

1827

extraEgress: []

1828

## @param ingest.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces

1829

## @param ingest.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces

1830

1831

ingressNSMatchLabels: {}

1832

ingressNSPodMatchLabels: {}

1833

## @param ingest.automountServiceAccountToken Mount Service Account token in pod

1834

1835

automountServiceAccountToken: false

1836

## @param ingest.hostAliases ingest-only pods host aliases

1837

## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/

1838

1839

hostAliases: []

1840

## @param ingest.podLabels Extra labels for ingest-only pods

1841

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/

1842

1843

podLabels: {}

1844

## @param ingest.podAnnotations Annotations for ingest-only pods

1845

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

1846

1847

podAnnotations: {}

1848

## @param ingest.shareProcessNamespace Share a single process namespace between all of the containers in pod

1849

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/share-process-namespace/

1850

1851

shareProcessNamespace: false

1852

## @param ingest.podAffinityPreset Pod affinity preset. Ignored if `ingest.affinity` is set. Allowed values: `soft` or `hard`

1853

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity

1854

1855

podAffinityPreset: ""

1856

## @param ingest.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `ingest.affinity` is set. Allowed values: `soft` or `hard`

1857

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity

1858

1859

podAntiAffinityPreset: ""

1860

## Node ingest.affinity preset

1861

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity

1862

1863

nodeAffinityPreset:

1864

## @param ingest.nodeAffinityPreset.type Node affinity preset type. Ignored if `ingest.affinity` is set. Allowed values: `soft` or `hard`

1865

1866

type: ""

1867

## @param ingest.nodeAffinityPreset.key Node label key to match. Ignored if `ingest.affinity` is set

1868

1869

key: ""

1870

## @param ingest.nodeAffinityPreset.values Node label values to match. Ignored if `ingest.affinity` is set

1871

## E.g.

1872

## values:

1873

## - e2e-az1

1874

## - e2e-az2

1875

1876

values: []

1877

## @param ingest.affinity Affinity for ingest-only pods assignment

1878

## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity

1879

## NOTE: `ingest.podAffinityPreset`, `ingest.podAntiAffinityPreset`, and `ingest.nodeAffinityPreset` will be ignored when it's set

1880

1881

affinity: {}

1882

## @param ingest.nodeSelector Node labels for ingest-only pods assignment

1883

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

1884

1885

nodeSelector: {}

1886

## @param ingest.tolerations Tolerations for ingest-only pods assignment

1887

## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/

1888

1889

tolerations: []

1890

## @param ingest.priorityClassName ingest-only pods' priorityClassName

1891

1892

priorityClassName: ""

1893

## @param ingest.schedulerName Name of the k8s scheduler (other than default) for ingest-only pods

1894

## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/

1895

1896

schedulerName: ""

1897

## @param ingest.terminationGracePeriodSeconds In seconds, time the given to the Elasticsearch ingest pod needs to terminate gracefully

1898

## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods

1899

1900

terminationGracePeriodSeconds: ""

1901

## @param ingest.topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template

1902

## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods

1903

1904

topologySpreadConstraints: []

1905

## @param ingest.podManagementPolicy podManagementPolicy to manage scaling operation of Elasticsearch ingest pods

1906

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies

1907

1908

podManagementPolicy: "Parallel"

1909

## @param ingest.minReadySeconds How many seconds a pod needs to be ready before killing the next, during update

1910

1911

minReadySeconds: 0

1912

## Configure extra options for Elasticsearch ingest-only containers' liveness, readiness and startup probes

1913

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes

1914

## @param ingest.startupProbe.enabled Enable/disable the startup probe (ingest-only nodes pod)

1915

## @param ingest.startupProbe.initialDelaySeconds Delay before startup probe is initiated (ingest-only nodes pod)

1916

## @param ingest.startupProbe.periodSeconds How often to perform the probe (ingest-only nodes pod)

1917

## @param ingest.startupProbe.timeoutSeconds When the probe times out (ingest-only nodes pod)

1918

## @param ingest.startupProbe.successThreshold Minimum consecutive successes for the probe to be considered successful after having failed (ingest-only nodes pod)

1919

## @param ingest.startupProbe.failureThreshold Minimum consecutive failures for the probe to be considered failed after having succeeded

1920

1921

startupProbe:

1922

enabled: false

1923

initialDelaySeconds: 90

1924

periodSeconds: 10

1925

timeoutSeconds: 5

1926

successThreshold: 1

1927

failureThreshold: 5

1928

## @param ingest.livenessProbe.enabled Enable/disable the liveness probe (ingest-only nodes pod)

1929

## @param ingest.livenessProbe.initialDelaySeconds Delay before liveness probe is initiated (ingest-only nodes pod)

1930

## @param ingest.livenessProbe.periodSeconds How often to perform the probe (ingest-only nodes pod)

1931

## @param ingest.livenessProbe.timeoutSeconds When the probe times out (ingest-only nodes pod)

1932

## @param ingest.livenessProbe.successThreshold Minimum consecutive successes for the probe to be considered successful after having failed (ingest-only nodes pod)

1933

## @param ingest.livenessProbe.failureThreshold Minimum consecutive failures for the probe to be considered failed after having succeeded

1934

1935

livenessProbe:

1936

enabled: true

1937

initialDelaySeconds: 180

1938

periodSeconds: 10

1939

timeoutSeconds: 5

1940

successThreshold: 1

1941

failureThreshold: 5

1942

## @param ingest.readinessProbe.enabled Enable/disable the readiness probe (ingest-only nodes pod)

1943

## @param ingest.readinessProbe.initialDelaySeconds Delay before readiness probe is initiated (ingest-only nodes pod)

1944

## @param ingest.readinessProbe.periodSeconds How often to perform the probe (ingest-only nodes pod)

1945

## @param ingest.readinessProbe.timeoutSeconds When the probe times out (ingest-only nodes pod)

1946

## @param ingest.readinessProbe.successThreshold Minimum consecutive successes for the probe to be considered successful after having failed (ingest-only nodes pod)

1947

## @param ingest.readinessProbe.failureThreshold Minimum consecutive failures for the probe to be considered failed after having succeeded

1948

1949

readinessProbe:

1950

enabled: true

1951

initialDelaySeconds: 90

1952

periodSeconds: 10

1953

timeoutSeconds: 5

1954

successThreshold: 1

1955

failureThreshold: 5

1956

## @param ingest.customStartupProbe Override default startup probe

1957

1958

customStartupProbe: {}

1959

## @param ingest.customLivenessProbe Override default liveness probe

1960

1961

customLivenessProbe: {}

1962

## @param ingest.customReadinessProbe Override default readiness probe

1963

1964

customReadinessProbe: {}

1965

## @param ingest.command Override default container command (useful when using custom images)

1966

1967

command: []

1968

## @param ingest.args Override default container args (useful when using custom images)

1969

1970

args: []

1971

## @param ingest.lifecycleHooks for the ingest-only container(s) to automate configuration before or after startup

1972

1973

lifecycleHooks: {}

1974

## @param ingest.extraEnvVars Array with extra environment variables to add to ingest-only nodes

1975

## e.g:

1976

## extraEnvVars:

1977

## - name: FOO

1978

## value: "bar"

1979

1980

extraEnvVars: []

1981

## @param ingest.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for ingest-only nodes

1982

1983

extraEnvVarsCM: ""

1984

## @param ingest.extraEnvVarsSecret Name of existing Secret containing extra env vars for ingest-only nodes

1985

1986

extraEnvVarsSecret: ""

1987

## @param ingest.extraVolumes Optionally specify extra list of additional volumes for the ingest-only pod(s)

1988

1989

extraVolumes: []

1990

## @param ingest.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the ingest-only container(s)

1991

1992

extraVolumeMounts: []

1993

## @param ingest.sidecars Add additional sidecar containers to the ingest-only pod(s)

1994

## e.g:

1995

## sidecars:

1996

## - name: your-image-name

1997

## image: your-image

1998

## imagePullPolicy: Always

1999

## ports:

2000

## - name: portname

2001

## containerPort: 1234

2002

2003

sidecars: []

2004

## @param ingest.initContainers Add additional init containers to the ingest-only pod(s)

2005

## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/

2006

## e.g:

2007

## initContainers:

2008

## - name: your-image-name

2009

## image: your-image

2010

## imagePullPolicy: Always

2011

## command: ['sh', '-c', 'echo "hello world"']

2012

2013

initContainers: []

2014

## Pods Service Account

2015

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

2016

## @param ingest.serviceAccount.create Specifies whether a ServiceAccount should be created

2017

## @param ingest.serviceAccount.name Name of the service account to use. If not set and create is true, a name is generated using the fullname template.

2018

## @param ingest.serviceAccount.automountServiceAccountToken Automount service account token for the server service account

2019

## @param ingest.serviceAccount.annotations Annotations for service account. Evaluated as a template. Only used if `create` is `true`.

2020

2021

serviceAccount:

2022

create: true

2023

2024

automountServiceAccountToken: false

2025

annotations: {}

2026

## Enable HorizontalPodAutoscaler for Elasticsearch ingest-only pods

2027

## ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/

2028

## @param ingest.autoscaling.enabled Whether enable horizontal pod autoscale

2029

## @param ingest.autoscaling.minReplicas Configure a minimum amount of pods

2030

## @param ingest.autoscaling.maxReplicas Configure a maximum amount of pods

2031

## @param ingest.autoscaling.targetCPU Define the CPU target to trigger the scaling actions (utilization percentage)

2032

## @param ingest.autoscaling.targetMemory Define the memory target to trigger the scaling actions (utilization percentage)

2033

2034

autoscaling:

2035

enabled: false

2036

minReplicas: 3

2037

maxReplicas: 11

2038

targetCPU: ""

2039

targetMemory: ""

2040

## Elasticsearch Ingest-only Service

2041

## Recommended for heavy ingestion, improves performance by sending ingest traffic directly into the ingest nodes.

2042

## NOTE: Ingest nodes will only accept index requests with an associated pipeline, any other request won't be rerouted.

2043

2044

service:

2045

## @param ingest.service.enabled Enable Ingest-only service

2046

2047

enabled: false

2048

## @param ingest.service.type Elasticsearch ingest-only service type

2049

2050

type: ClusterIP

2051

## @param ingest.service.ports.restAPI Elasticsearch service REST API port

2052

## @param ingest.service.ports.transport Elasticsearch service transport port

2053

2054

ports:

2055

restAPI: 9200

2056

transport: 9300

2057

## Node ports to expose

2058

## @param ingest.service.nodePorts.restAPI Node port for REST API

2059

## @param ingest.service.nodePorts.transport Node port for REST API

2060

## NOTE: choose port between <30000-32767>

2061

2062

nodePorts:

2063

restAPI: ""

2064

transport: ""

2065

## @param ingest.service.clusterIP Elasticsearch ingest-only service Cluster IP

2066

## e.g.:

2067

## clusterIP: None

2068

2069

clusterIP: ""

2070

## @param ingest.service.loadBalancerIP Elasticsearch ingest-only service Load Balancer IP

2071

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-loadbalancer

2072

2073

loadBalancerIP: ""

2074

## @param ingest.service.loadBalancerSourceRanges Elasticsearch ingest-only service Load Balancer sources

2075

## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service

2076

## e.g:

2077

## loadBalancerSourceRanges:

2078

## - 10.10.10.0/24

2079

2080

loadBalancerSourceRanges: []

2081

## @param ingest.service.externalTrafficPolicy Elasticsearch ingest-only service external traffic policy

2082

## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip

2083

2084

externalTrafficPolicy: Cluster

2085

## @param ingest.service.extraPorts Extra ports to expose (normally used with the `sidecar` value)

2086

2087

extraPorts: []

2088

## @param ingest.service.annotations Additional custom annotations for Elasticsearch ingest-only service

2089

2090

annotations: {}

2091

## @param ingest.service.sessionAffinity Session Affinity for Kubernetes service, can be "None" or "ClientIP"

2092

## If "ClientIP", consecutive client requests will be directed to the same Pod

2093

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies

2094

2095

sessionAffinity: None

2096

## @param ingest.service.sessionAffinityConfig Additional settings for the sessionAffinity

2097

## sessionAffinityConfig:

2098

## clientIP:

2099

## timeoutSeconds: 300

2100

2101

sessionAffinityConfig: {}

2102

## Elasticsearch Ingest-only ingress parameters

2103

## ref: http://kubernetes.io/docs/concepts/services-networking/ingress/

2104

2105

ingress:

2106

## @param ingest.ingress.enabled Enable ingress record generation for Elasticsearch

2107

2108

enabled: false

2109

## @param ingest.ingress.pathType Ingress path type

2110

2111

pathType: ImplementationSpecific

2112

## @param ingest.ingress.apiVersion Force Ingress API version (automatically detected if not set)

2113

2114

apiVersion: ""

2115

## @param ingest.ingress.hostname Default host for the ingress record

2116

2117

hostname: elasticsearch-ingest.local

2118

## @param ingest.ingress.path Default path for the ingress record

2119

## NOTE: You may need to set this to '/*' in order to use this with ALB ingress controllers

2120

2121

path: /

2122

## @param ingest.ingress.annotations Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations.

2123

## Use this parameter to set the required annotations for cert-manager, see

2124

## ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations

2125

## e.g:

2126

## annotations:

2127

## kubernetes.io/ingress.class: nginx

2128

## cert-manager.io/cluster-issuer: cluster-issuer-name

2129

2130

annotations: {}

2131

## @param ingest.ingress.tls Enable TLS configuration for the host defined at `ingress.hostname` parameter

2132

## TLS certificates will be retrieved from a TLS secret with name: `{{- printf "%s-tls" .Values.ingress.hostname }}`

2133

## You can:

2134

## - Use the `ingress.secrets` parameter to create this TLS secret

2135

## - Rely on cert-manager to create it by setting the corresponding annotations

2136

## - Rely on Helm to create self-signed certificates by setting `ingress.selfSigned=true`

2137

2138

tls: false

2139

## @param ingest.ingress.selfSigned Create a TLS secret for this ingress record using self-signed certificates generated by Helm

2140

2141

selfSigned: false

2142

## @param ingest.ingress.ingressClassName IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+)

2143

## This is supported in Kubernetes 1.18+ and required if you have more than one IngressClass marked as the default for your cluster .

2144

## ref: https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/

2145

2146

ingressClassName: ""

2147

## @param ingest.ingress.extraHosts An array with additional hostname(s) to be covered with the ingress record

2148

## e.g:

2149

## extraHosts:

2150

## - name: elasticsearch.local

2151

## path: /

2152

2153

extraHosts: []

2154

## @param ingest.ingress.extraPaths An array with additional arbitrary paths that may need to be added to the ingress under the main host

2155

## e.g:

2156

## extraPaths:

2157

## - path: /*

2158

## backend:

2159

## serviceName: ssl-redirect

2160

## servicePort: use-annotation

2161

2162

extraPaths: []

2163

## @param ingest.ingress.extraTls TLS configuration for additional hostname(s) to be covered with this ingress record

2164

## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls

2165

## e.g:

2166

## extraTls:

2167

## - hosts:

2168

## - elasticsearch.local

2169

## secretName: elasticsearch.local-tls

2170

2171

extraTls: []

2172

## @param ingest.ingress.secrets Custom TLS certificates as secrets

2173

## NOTE: 'key' and 'certificate' are expected in PEM format

2174

## NOTE: 'name' should line up with a 'secretName' set further up

2175

## If it is not set and you're using cert-manager, this is unneeded, as it will create a secret for you with valid certificates

2176

## If it is not set and you're NOT using cert-manager either, self-signed certificates will be created valid for 365 days

2177

## It is also possible to create and manage the certificates outside of this helm chart

2178

## Please see README.md for more information

2179

## e.g:

2180

## secrets:

2181

## - name: elasticsearch.local-tls

2182

## key: |-

2183

## -----BEGIN RSA PRIVATE KEY-----

2184

## ...

2185

## -----END RSA PRIVATE KEY-----

2186

## certificate: |-

2187

## -----BEGIN CERTIFICATE-----

2188

## ...

2189

## -----END CERTIFICATE-----

2190

2191

secrets: []

2192

## @param ingest.ingress.extraRules Additional rules to be covered with this ingress record

2193

## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules

2194

## e.g:

2195

## extraRules:

2196

## - host: example.local

2197

## http:

2198

## path: /

2199

## backend:

2200

## service:

2201

## name: example-svc

2202

## port:

2203

## name: http

2204

2205

extraRules: []

2206

## @section Metrics parameters

2207

2208

## Elasticsearch Prometheus exporter configuration

2209

2210

metrics:

2211

## @param metrics.enabled Enable prometheus exporter

2212

2213

enabled: false

2214

## @param metrics.nameOverride Metrics pod name

2215

2216

nameOverride: ""

2217

## @param metrics.fullnameOverride String to fully override common.names.fullname

2218

2219

fullnameOverride: ""

2220

## @param metrics.image.registry [default: REGISTRY_NAME] Metrics exporter image registry

2221

## @param metrics.image.repository [default: REPOSITORY_NAME/elasticsearch-exporter] Metrics exporter image repository

2222

## @skip metrics.image.tag Metrics exporter image tag

2223

## @param metrics.image.digest Metrics exporter image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag

2224

## @param metrics.image.pullPolicy Metrics exporter image pull policy

2225

## @param metrics.image.pullSecrets Metrics exporter image pull secrets

2226

2227

image:

2228

registry: cgr.dev

2229

repository: chainguard-private/prometheus-elasticsearch-exporter-iamguarded

2230

tag: 1.11.0

2231

digest: ""

2232

pullPolicy: IfNotPresent

2233

## Optionally specify an array of imagePullSecrets.

2234

## Secrets must be manually created in the namespace.

2235

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

2236

## e.g:

2237

## pullSecrets:

2238

## - myRegistryKeySecretName

2239

2240

pullSecrets: []

2241

## @param metrics.annotations [object] Annotations for metrics

2242

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

2243

2244

annotations:

2245

helm.sh/hook: "post-install,post-upgrade"

2246

helm.sh/hook-weight: "5"

2247

## @param metrics.extraArgs Extra arguments to add to the default exporter command

2248

## ref: https://github.com/justwatchcom/elasticsearch_exporter

2249

## e.g

2250

## extraArgs:

2251

## - --es.snapshots

2252

## - --es.indices

2253

2254

extraArgs: []

2255

## @param metrics.automountServiceAccountToken Mount Service Account token in pod

2256

2257

automountServiceAccountToken: false

2258

## @param metrics.hostAliases Add deployment host aliases

2259

## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/

2260

2261

hostAliases: []

2262

## @param metrics.schedulerName Name of the k8s scheduler (other than default)

2263

## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/

2264

2265

schedulerName: ""

2266

## @param metrics.priorityClassName Elasticsearch metrics exporter pods' priorityClassName

2267

2268

priorityClassName: ""

2269

## Elasticsearch Prometheus exporter container ports

2270

## @param metrics.containerPorts.http Metrics HTTP port

2271

2272

containerPorts:

2273

http: 9114

2274

## Network Policies

2275

## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/

2276

2277

networkPolicy:

2278

## @param metrics.networkPolicy.enabled Specifies whether a NetworkPolicy should be created

2279

2280

enabled: true

2281

## @param metrics.networkPolicy.allowExternal Don't require server label for connections

2282

## The Policy model to apply. When set to false, only pods with the correct

2283

## server label will have network access to the ports server is listening

2284

## on. When true, server will accept connections from any source

2285

## (with the correct destination port).

2286

2287

allowExternal: true

2288

## @param metrics.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.

2289

2290

allowExternalEgress: true

2291

## @param metrics.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy

2292

## e.g:

2293

## extraIngress:

2294

## - ports:

2295

## - port: 1234

2296

## from:

2297

## - podSelector:

2298

## - matchLabels:

2299

## - role: frontend

2300

## - podSelector:

2301

## - matchExpressions:

2302

## - key: role

2303

## operator: In

2304

## values:

2305

## - frontend

2306

extraIngress: []

2307

## @param metrics.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy

2308

## e.g:

2309

## extraEgress:

2310

## - ports:

2311

## - port: 1234

2312

## to:

2313

## - podSelector:

2314

## - matchLabels:

2315

## - role: frontend

2316

## - podSelector:

2317

## - matchExpressions:

2318

## - key: role

2319

## operator: In

2320

## values:

2321

## - frontend

2322

2323

extraEgress: []

2324

## @param metrics.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces

2325

## @param metrics.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces

2326

2327

ingressNSMatchLabels: {}

2328

ingressNSPodMatchLabels: {}

2329

## Elasticsearch Prometheus exporter service type

2330

2331

service:

2332

## @param metrics.service.type Metrics exporter endpoint service type

2333

2334

type: ClusterIP

2335

## @param metrics.service.port Metrics exporter endpoint service port

2336

2337

port: 9114

2338

## @param metrics.service.annotations [object] Provide any additional annotations which may be required.

2339

## This can be used to set the LoadBalancer service type to internal only.

2340

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer

2341

2342

annotations:

2343

prometheus.io/scrape: "true"

2344

prometheus.io/port: "9114"

2345

## @param metrics.podAffinityPreset Metrics Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard`

2346

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity

2347

2348

podAffinityPreset: ""

2349

## @param metrics.podAntiAffinityPreset Metrics Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard`

2350

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity

2351

2352

podAntiAffinityPreset: ""

2353

## Node affinity preset

2354

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity

2355

## @param metrics.nodeAffinityPreset.type Metrics Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard`

2356

## @param metrics.nodeAffinityPreset.key Metrics Node label key to match Ignored if `affinity` is set.

2357

## @param metrics.nodeAffinityPreset.values Metrics Node label values to match. Ignored if `affinity` is set.

2358

2359

nodeAffinityPreset:

2360

type: ""

2361

## E.g.

2362

## key: "kubernetes.io/e2e-az-name"

2363

2364

key: ""

2365

## E.g.

2366

## values:

2367

## - e2e-az1

2368

## - e2e-az2

2369

2370

values: []

2371

## @param metrics.affinity Metrics Affinity for pod assignment

2372

## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity

2373

## Note: podAffinityPreset, podAntiAffinityPreset, and nodeAffinityPreset will be ignored when it's set

2374

2375

affinity: {}

2376

## @param metrics.nodeSelector Metrics Node labels for pod assignment

2377

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

2378

2379

nodeSelector: {}

2380

## @param metrics.tolerations Metrics Tolerations for pod assignment

2381

## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/

2382

2383

tolerations: []

2384

## @param metrics.topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template

2385

## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods

2386

2387

topologySpreadConstraints: []

2388

## Elasticsearch Prometheus exporter resource requests and limits

2389

## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

2390

## We usually recommend not to specify default resources and to leave this as a conscious

2391

## choice for the user. This also increases chances charts run on environments with little

2392

## resources, such as Minikube. If you do want to specify resources, uncomment the following

2393

## lines, adjust them as necessary, and remove the curly braces after 'resources:'.

2394

## @param metrics.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if metrics.resources is set (metrics.resources is recommended for production).

2395

2396

resourcesPreset: "nano"

2397

## @param metrics.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)

2398

## Example:

2399

## resources:

2400

## requests:

2401

## cpu: 2

2402

## memory: 512Mi

2403

## limits:

2404

## cpu: 3

2405

## memory: 1024Mi

2406

2407

resources: {}

2408

## Elasticsearch metrics container's liveness probe

2409

## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes

2410

## @param metrics.livenessProbe.enabled Enable/disable the liveness probe (metrics pod)

2411

## @param metrics.livenessProbe.initialDelaySeconds Delay before liveness probe is initiated (metrics pod)

2412

## @param metrics.livenessProbe.periodSeconds How often to perform the probe (metrics pod)

2413

## @param metrics.livenessProbe.timeoutSeconds When the probe times out (metrics pod)

2414

## @param metrics.livenessProbe.failureThreshold Minimum consecutive failures for the probe to be considered failed after having succeeded

2415

## @param metrics.livenessProbe.successThreshold Minimum consecutive successes for the probe to be considered successful after having failed (metrics pod)

2416

2417

livenessProbe:

2418

enabled: true

2419

initialDelaySeconds: 60

2420

periodSeconds: 10

2421

timeoutSeconds: 5

2422

successThreshold: 1

2423

failureThreshold: 5

2424

## Elasticsearch metrics container's readiness probe

2425

## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes

2426

## @param metrics.readinessProbe.enabled Enable/disable the readiness probe (metrics pod)

2427

## @param metrics.readinessProbe.initialDelaySeconds Delay before readiness probe is initiated (metrics pod)

2428

## @param metrics.readinessProbe.periodSeconds How often to perform the probe (metrics pod)

2429

## @param metrics.readinessProbe.timeoutSeconds When the probe times out (metrics pod)

2430

## @param metrics.readinessProbe.failureThreshold Minimum consecutive failures for the probe to be considered failed after having succeeded

2431

## @param metrics.readinessProbe.successThreshold Minimum consecutive successes for the probe to be considered successful after having failed (metrics pod)

2432

2433

readinessProbe:

2434

enabled: true

2435

initialDelaySeconds: 5

2436

periodSeconds: 10

2437

timeoutSeconds: 1

2438

successThreshold: 1

2439

failureThreshold: 5

2440

## Elasticsearch metrics container's startup probe

2441

## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes

2442

## @param metrics.startupProbe.enabled Enable/disable the startup probe (metrics pod)

2443

## @param metrics.startupProbe.initialDelaySeconds Delay before startup probe is initiated (metrics pod)

2444

## @param metrics.startupProbe.periodSeconds How often to perform the probe (metrics pod)

2445

## @param metrics.startupProbe.timeoutSeconds When the probe times out (metrics pod)

2446

## @param metrics.startupProbe.failureThreshold Minimum consecutive failures for the probe to be considered failed after having succeeded

2447

## @param metrics.startupProbe.successThreshold Minimum consecutive successes for the probe to be considered successful after having failed (metrics pod)

2448

2449

startupProbe:

2450

enabled: false

2451

initialDelaySeconds: 5

2452

periodSeconds: 10

2453

timeoutSeconds: 1

2454

successThreshold: 1

2455

failureThreshold: 5

2456

## @param metrics.customStartupProbe Custom liveness probe for the Web component

2457

2458

customStartupProbe: {}

2459

## @param metrics.customLivenessProbe Custom liveness probe for the Web component

2460

2461

customLivenessProbe: {}

2462

## @param metrics.customReadinessProbe Custom readiness probe for the Web component

2463

2464

customReadinessProbe: {}

2465

## @param metrics.podAnnotations [object] Metrics exporter pod Annotation and Labels

2466

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

2467

2468

podAnnotations:

2469

prometheus.io/scrape: "true"

2470

prometheus.io/port: "9114"

2471

## @param metrics.podLabels Extra labels to add to Pod

2472

2473

podLabels: {}

2474

## Configure Pods Security Context

2475

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod

2476

## @param metrics.podSecurityContext.enabled Enabled Elasticsearch metrics exporter pods' Security Context

2477

## @param metrics.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy

2478

## @param metrics.podSecurityContext.sysctls Set kernel settings using the sysctl interface

2479

## @param metrics.podSecurityContext.supplementalGroups Set filesystem extra groups

2480

## @param metrics.podSecurityContext.fsGroup Set Elasticsearch metrics exporter pod's Security Context fsGroup

2481

2482

podSecurityContext:

2483

enabled: true

2484

fsGroupChangePolicy: Always

2485

sysctls: []

2486

supplementalGroups: []

2487

fsGroup: 1001

2488

## Configure Container Security Context

2489

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod

2490

## @param metrics.containerSecurityContext.enabled Elasticseacrh exporter container securityContext

2491

## @param metrics.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container

2492

## @param metrics.containerSecurityContext.runAsUser User ID for the Elasticseacrh exporter container

2493

## @param metrics.containerSecurityContext.runAsGroup Group ID for the Elasticseacrh exporter container

2494

## @param metrics.containerSecurityContext.runAsNonRoot Set Elasticsearch exporter container's Security Context runAsNonRoot

2495

## @param metrics.containerSecurityContext.privileged Set Elasticsearch exporter container's Security Context privileged

2496

## @param metrics.containerSecurityContext.allowPrivilegeEscalation Set Elasticsearch exporter container's Security Context allowPrivilegeEscalation

2497

## @param metrics.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem

2498

## @param metrics.containerSecurityContext.capabilities.drop List of capabilities to be dropped

2499

## @param metrics.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile

2500

2501

containerSecurityContext:

2502

enabled: true

2503

seLinuxOptions: {}

2504

runAsUser: 1001

2505

runAsGroup: 1001

2506

runAsNonRoot: true

2507

privileged: false

2508

allowPrivilegeEscalation: false

2509

readOnlyRootFilesystem: true

2510

capabilities:

2511

drop: ["ALL"]

2512

seccompProfile:

2513

type: "RuntimeDefault"

2514

## @param metrics.command Override default container command (useful when using custom images)

2515

2516

command: []

2517

## @param metrics.args Override default container args (useful when using custom images)

2518

2519

args: []

2520

## @param metrics.extraEnvVars Array with extra environment variables to add to Elasticsearch metrics exporter nodes

2521

## e.g:

2522

## extraEnvVars:

2523

## - name: FOO

2524

## value: "bar"

2525

2526

extraEnvVars: []

2527

## @param metrics.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for Elasticsearch metrics exporter nodes

2528

2529

extraEnvVarsCM: ""

2530

## @param metrics.extraEnvVarsSecret Name of existing Secret containing extra env vars for Elasticsearch metrics exporter nodes

2531

2532

extraEnvVarsSecret: ""

2533

## @param metrics.extraVolumes Optionally specify extra list of additional volumes for the Elasticsearch metrics exporter pod(s)

2534

2535

extraVolumes: []

2536

## @param metrics.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the Elasticsearch metrics exporter container(s)

2537

2538

extraVolumeMounts: []

2539

## @param metrics.sidecars Add additional sidecar containers to the Elasticsearch metrics exporter pod(s)

2540

## e.g:

2541

## sidecars:

2542

## - name: your-image-name

2543

## image: your-image

2544

## imagePullPolicy: Always

2545

## ports:

2546

## - name: portname

2547

## containerPort: 1234

2548

2549

sidecars: []

2550

## @param metrics.initContainers Add additional init containers to the Elasticsearch metrics exporter pod(s)

2551

## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/

2552

## e.g:

2553

## initContainers:

2554

## - name: your-image-name

2555

## image: your-image

2556

## imagePullPolicy: Always

2557

## command: ['sh', '-c', 'echo "hello world"']

2558

2559

initContainers: []

2560

## Pods Service Account

2561

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

2562

## @param metrics.serviceAccount.create Specifies whether a ServiceAccount should be created

2563

## @param metrics.serviceAccount.name Name of the service account to use. If not set and create is true, a name is generated using the fullname template.

2564

## @param metrics.serviceAccount.automountServiceAccountToken Automount service account token for the server service account

2565

## @param metrics.serviceAccount.annotations Annotations for service account. Evaluated as a template. Only used if `create` is `true`.

2566

2567

serviceAccount:

2568

create: true

2569

2570

automountServiceAccountToken: false

2571

annotations: {}

2572

## Prometheus Operator ServiceMonitor configuration

2573

2574

serviceMonitor:

2575

## @param metrics.serviceMonitor.enabled Create ServiceMonitor Resource for scraping metrics using PrometheusOperator

2576

2577

enabled: false

2578

## @param metrics.serviceMonitor.namespace Namespace which Prometheus is running in

2579

## e.g:

2580

## namespace: monitoring

2581

2582

namespace: ""

2583

## @param metrics.serviceMonitor.jobLabel The name of the label on the target service to use as the job name in prometheus.

2584

2585

jobLabel: ""

2586

## @param metrics.serviceMonitor.interval Interval at which metrics should be scraped

2587

## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint

2588

2589

interval: ""

2590

## @param metrics.serviceMonitor.scrapeTimeout Timeout after which the scrape is ended

2591

## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint

2592

2593

scrapeTimeout: ""

2594

## @param metrics.serviceMonitor.relabelings RelabelConfigs to apply to samples before scraping

2595

## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#relabelconfig

2596

2597

relabelings: []

2598

## @param metrics.serviceMonitor.metricRelabelings MetricRelabelConfigs to apply to samples before ingestion

2599

## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#relabelconfig

2600

2601

metricRelabelings: []

2602

## @param metrics.serviceMonitor.selector ServiceMonitor selector labels

2603

2604

## selector:

2605

## prometheus: my-prometheus

2606

2607

selector: {}

2608

## @param metrics.serviceMonitor.labels Extra labels for the ServiceMonitor

2609

2610

labels: {}

2611

## @param metrics.serviceMonitor.honorLabels honorLabels chooses the metric's labels on collisions with target labels

2612

2613

honorLabels: false

2614

## Prometheus Operator PrometheusRule configuration

2615

2616

prometheusRule:

2617

## @param metrics.prometheusRule.enabled Creates a Prometheus Operator PrometheusRule (also requires `metrics.enabled` to be `true` and `metrics.prometheusRule.rules`)

2618

2619

enabled: false

2620

## @param metrics.prometheusRule.namespace Namespace for the PrometheusRule Resource (defaults to the Release Namespace)

2621

2622

namespace: ""

2623

## @param metrics.prometheusRule.additionalLabels Additional labels that can be used so PrometheusRule will be discovered by Prometheus

2624

2625

additionalLabels: {}

2626

## @param metrics.prometheusRule.rules Prometheus Rule definitions

2627

# - alert: es cluster error

2628

# annotations:

2629

# summary: "es cluster error"

2630

# description: "es cluster error, cluster state {{`{{`}} $labels.color {{`}}`}}"

2631

# expr: elasticsearch_cluster_health_status{color="red"} ==1 or elasticsearch_cluster_health_status{color="yellow"} ==1

2632

# for: 1m

2633

# labels:

2634

# severity: critical

2635

# group: PaaS

2636

2637

rules: []

2638

## @section Init Container Parameters

2639

2640

## 'volumePermissions' init container parameters

2641

## Changes the owner and group of the persistent volume mount point to runAsUser:fsGroup values

2642

## based on the *podSecurityContext/*containerSecurityContext parameters

2643

2644

volumePermissions:

2645

## @param volumePermissions.enabled Enable init container that changes volume permissions in the data directory (for cases where the default k8s `runAsUser` and `fsUser` values do not work)

2646

2647

enabled: false

2648

## @param volumePermissions.image.registry [default: REGISTRY_NAME] Init container volume-permissions image registry

2649

## @param volumePermissions.image.repository [default: REPOSITORY_NAME/os-shell] Init container volume-permissions image name

2650

## @skip volumePermissions.image.tag Init container volume-permissions image tag

2651

## @param volumePermissions.image.digest Init container volume-permissions image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag

2652

## @param volumePermissions.image.pullPolicy Init container volume-permissions image pull policy

2653

## @param volumePermissions.image.pullSecrets Init container volume-permissions image pull secrets

2654

2655

image:

2656

registry: cgr.dev

2657

repository: chainguard-private/os-shell-iamguarded

2658

tag: 1.0.0

2659

digest: ""

2660

pullPolicy: IfNotPresent

2661

## Optionally specify an array of imagePullSecrets.

2662

## Secrets must be manually created in the namespace.

2663

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

2664

## e.g:

2665

## pullSecrets:

2666

## - myRegistryKeySecretName

2667

2668

pullSecrets: []

2669

## Init container' resource requests and limits

2670

## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

2671

## We usually recommend not to specify default resources and to leave this as a conscious

2672

## choice for the user. This also increases chances charts run on environments with little

2673

## resources, such as Minikube. If you do want to specify resources, uncomment the following

2674

## lines, adjust them as necessary, and remove the curly braces after 'resources:'.

2675

## @param volumePermissions.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production).

2676

2677

resourcesPreset: "nano"

2678

## @param volumePermissions.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)

2679

## Example:

2680

## resources:

2681

## requests:

2682

## cpu: 2

2683

## memory: 512Mi

2684

## limits:

2685

## cpu: 3

2686

## memory: 1024Mi

2687

2688

resources: {}

2689

## Kernel settings modifier image

2690

2691

sysctlImage:

2692

## @param sysctlImage.enabled Enable kernel settings modifier image

2693

2694

enabled: true

2695

## @param sysctlImage.registry [default: REGISTRY_NAME] Kernel settings modifier image registry

2696

## @param sysctlImage.repository [default: REPOSITORY_NAME/os-shell] Kernel settings modifier image repository

2697

## @skip sysctlImage.tag Kernel settings modifier image tag

2698

## @param sysctlImage.digest Kernel settings modifier image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag

2699

## @param sysctlImage.pullPolicy Kernel settings modifier image pull policy

2700

## @param sysctlImage.pullSecrets Kernel settings modifier image pull secrets

2701

2702

registry: cgr.dev

2703

repository: chainguard-private/os-shell-iamguarded

2704

tag: 1.0.0

2705

digest: ""

2706

## Specify a imagePullPolicy

2707

## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images

2708

2709

pullPolicy: IfNotPresent

2710

## Optionally specify an array of imagePullSecrets.

2711

## Secrets must be manually created in the namespace.

2712

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

2713

## e.g:

2714

## pullSecrets:

2715

## - myRegistryKeySecretName

2716

2717

pullSecrets: []

2718

## Init container' resource requests and limits

2719

## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

2720

## We usually recommend not to specify default resources and to leave this as a conscious

2721

## choice for the user. This also increases chances charts run on environments with little

2722

## resources, such as Minikube. If you do want to specify resources, uncomment the following

2723

## lines, adjust them as necessary, and remove the curly braces after 'resources:'.

2724

## @param sysctlImage.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if sysctlImage.resources is set (sysctlImage.resources is recommended for production).

2725

2726

resourcesPreset: "nano"

2727

## @param sysctlImage.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)

2728

## Example:

2729

## resources:

2730

## requests:

2731

## cpu: 2

2732

## memory: 512Mi

2733

## limits:

2734

## cpu: 3

2735

## memory: 1024Mi

2736

2737

resources: {}

2738

## @section Kibana Parameters

2739

2740

## Bundled Kibana parameters

2741

## @param kibana.elasticsearch.hosts [array] Array containing hostnames for the ES instances. Used to generate the URL

2742

## @param kibana.elasticsearch.port Port to connect Kibana and ES instance. Used to generate the URL

2743

2744

kibana:

2745

elasticsearch:

2746

hosts:

2747

- '{{ include "elasticsearch.service.name" . }}'

2748

port: '{{ include "elasticsearch.service.ports.restAPI" . }}'

2749

image:

2750

registry: cgr.dev

2751

repository: chainguard-private/kibana-iamguarded

2752

tag: 9.5.4

2753

digest: ""

2754

volumePermissions:

2755

image:

2756

registry: cgr.dev

2757

repository: chainguard-private/os-shell-iamguarded

2758

tag: 1.0.0

2759

digest: ""

2760

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.

elasticsearch

The trusted source for open source

Product

Solutions

Customers

Resources

Company