diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index edd03dff..4f1a5611 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1,2 +1,2 @@ # This should match the owning team set up in https://github.com/orgs/opensearch-project/teams -* @bbarani @TheAlgo @DandyDeveloper @peterzhuamazon @prudhvigodithi @gaiksaya +* @TheAlgo @DandyDeveloper @peterzhuamazon @prudhvigodithi @gaiksaya diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 6b928b23..6197cca5 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -28,6 +28,6 @@ jobs: # See https://github.com/helm/chart-releaser # See https://github.com/helm/chart-releaser-action - name: Run chart-releaser - uses: helm/chart-releaser-action@v1.2.1 + uses: helm/chart-releaser-action@v1.6.0 env: CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}" diff --git a/MAINTAINERS.md b/MAINTAINERS.md index 15c3e24c..393ad71e 100644 --- a/MAINTAINERS.md +++ b/MAINTAINERS.md @@ -6,9 +6,14 @@ This document contains a list of maintainers in this repo. See [opensearch-proje | Maintainer | GitHub ID | Affiliation | | ----------------- | --------------------------------------------------- | ----------- | -| Barani Bikshandi | [bbarani](https://github.com/bbarani) | Amazon | | Peter Zhu | [peterzhuamazon](https://github.com/peterzhuamazon) | Amazon | | Sayali Gaikawad | [gaiksaya](https://github.com/gaiksaya) | Amazon | | Prudhvi Godithi | [prudhvigodithi](https://github.com/prudhvigodithi) | Amazon | | Dhiraj Kumar Jain | [TheAlgo](https://github.com/TheAlgo) | Amazon | | Aaron Layfield | [DandyDeveloper](https://github.com/DandyDeveloper) | Community | + +## Emeritus + +| Maintainer | GitHub ID | Affiliation | +| --------------------- | ----------------------------------------- | ----------- | +| Barani Bikshandi | [bbarani](https://github.com/bbarani) | Amazon | \ No newline at end of file diff --git a/README.md b/README.md index afaa9f8e..d5bab0d9 100644 --- a/README.md +++ b/README.md @@ -62,7 +62,7 @@ Please see the `README.md` in the [OpenSearch](charts/opensearch) and [OpenSearc ### Breaking Change For OpenSearch Chart version 2.18.0 and App Version OpenSearch version 2.12.0 and above require a custom strong password to be provided in order to setup demo admin user during the first time cluster installation, without this password the cluster would not spin up, unless demo config install is disabled or the cluster security settings are handled by the user. -Note: This wont impact users who already installed the cluster and where the security index created, only impacts users starting the brand new cluster with OpenSearch version `2.12.0` and above. +Note: This won’t impact users who have already installed the cluster and created the security index. It only affects users starting a brand new cluster with OpenSearch version 2.12.0 and above. The custom admin password can be supplied by adding the environment variable `OPENSEARCH_INITIAL_ADMIN_PASSWORD` in the `value.yml` as: ``` @@ -75,9 +75,9 @@ or during the installation example as `helm install opensearch opensearch/opense ### Notes About Default Installation -By default, on startup, the `install_demo_configuration.sh` is runned via the `opensearch-docker-entrypoint.sh` script if `DISABLE_INSTALL_DEMO_CONFIG` is not `true`. +By default, on startup, the `install_demo_configuration.sh` is run via the `opensearch-docker-entrypoint.sh` script if `DISABLE_INSTALL_DEMO_CONFIG` is not `true`. -In case custom certificates are used and `allow_unsafe_democertificates` is set to `false` in the configuration, this can prevent pods to start with the following error: `Demo certificates found but plugins.security.allow_unsafe_democertificates is set to false.` +If custom certificates are used and `allow_unsafe_democertificates` is set to `false` in the configuration, this can prevent pods from starting with the following error: `Demo certificates found but plugins.security.allow_unsafe_democertificates is set to false.` This can be solved by adding an environment variable in the `value.yml`: ``` diff --git a/charts/data-prepper/.helmignore b/charts/data-prepper/.helmignore new file mode 100644 index 00000000..0e8a0eb3 --- /dev/null +++ b/charts/data-prepper/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/data-prepper/CHANGELOG.md b/charts/data-prepper/CHANGELOG.md new file mode 100644 index 00000000..d0b61260 --- /dev/null +++ b/charts/data-prepper/CHANGELOG.md @@ -0,0 +1,10 @@ +# Changelog +All notable changes to this project will be documented in this file. + +The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), +and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). + +## [Unreleased] +### Added +- Create initial version of data-prepper helm chart + diff --git a/charts/data-prepper/Chart.yaml b/charts/data-prepper/Chart.yaml new file mode 100644 index 00000000..dd53bd76 --- /dev/null +++ b/charts/data-prepper/Chart.yaml @@ -0,0 +1,50 @@ +apiVersion: v2 +name: data-prepper +description: A Helm chart for Data Prepper + +# A chart can be either an 'application' or a 'library' chart. +# +# Application charts are a collection of templates that can be packaged into versioned archives +# to be deployed. +# +# Library charts provide useful utilities or functions for the chart developer. They're included as +# a dependency of application charts to inject those utilities and functions into the rendering +# pipeline. Library charts do not define any templates and therefore cannot be deployed. +type: application + +# This is the chart version. This version number should be incremented each time you make changes +# to the chart and its templates, including the app version. +# Versions are expected to follow Semantic Versioning (https://semver.org/) +version: 0.1.0 + +# This is the version number of the application being deployed. This version number should be +# incremented each time you make changes to the application. Versions are not expected to +# follow Semantic Versioning. They should reflect the version the application is using. +# It is recommended to use it with quotes. +appVersion: "2.8.0" + +maintainers: + - name: gaiksaya + url: https://github.com/gaiksaya + - name: peterzhuamazon + url: https://github.com/peterzhuamazon + - name: prudhvigodithi + url: https://github.com/prudhvigodithi + - name: sergk + url: https://github.com/sergk + - name: TheAlgo + url: https://github.com/TheAlgo + +home: https://opensearch.org/docs/latest/data-prepper/ +sources: + - https://github.com/opensearch-project/data-prepper + - https://github.com/opensearch-project/helm-charts + +annotations: + artifacthub.io/category: monitoring-logging + artifacthub.io/license: Apache-2.0 + artifacthub.io/links: | + - name: Data Prepper Documentation + url: https://opensearch.org/docs/latest/data-prepper/ + - name: OpenSearch Project + url: https://opensearch.org diff --git a/charts/data-prepper/README.md b/charts/data-prepper/README.md new file mode 100644 index 00000000..d35c92f7 --- /dev/null +++ b/charts/data-prepper/README.md @@ -0,0 +1,125 @@ +# Data Prepper Helm Chart + +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2.8.0](https://img.shields.io/badge/AppVersion-2.8.0-informational?style=flat-square) + +A Helm chart for Data Prepper + +**Homepage:** + +Data Prepper is an essential component of the OpenSearch project, designed for high-volume data transformation and ingestion into OpenSearch. This Helm chart simplifies deploying Data Prepper on Kubernetes environments, ensuring you can easily set up your data processing pipelines. + +## Requirements + +Before installing the Data Prepper Helm chart, ensure your environment meets the following requirements: + +* Kubernetes >= 1.14 +* Helm >= 2.17.0 +* We recommend having at least 4 GiB of memory available for this deployment. A minimum of 2 GiB may suffice, but less than that could lead to deployment failures. + +## Installation + +To install the Data Prepper Helm chart, follow these steps: + +* Add the OpenSearch Helm repository if you haven't already: + +```bash +helm repo add opensearch https://opensearch-project.github.io/helm-charts/ +helm repo update +``` + +* Install the Data Prepper chart with: + +```bash +helm install my-data-prepper-release opensearch/data-prepper +``` + +Replace my-data-prepper-release with your desired release name. + +## Configuration + +The Data Prepper Helm chart comes with a variety of configuration options to tailor the deployment to your needs. +The default values are specified in the [values.yaml](values.yaml) file. You can override these values by providing your own values.yaml file during installation or by specifying configuration options with --set flags. + +For a detailed list of configuration options, refer to the values.yaml file or the [Data Prepper documentation](https://opensearch.org/docs/latest/data-prepper/managing-data-prepper/configuring-data-prepper/). + +## Uninstalling the Chart + +To uninstall/delete the my-data-prepper deployment: + +```bash +helm delete my-data-prepper +``` + +This command removes all the Kubernetes components associated with the chart and deletes the release. + +## Contributing + +We welcome contributions! Please read our [CONTRIBUTING.md](../../CONTRIBUTING.md) for details on how to submit contributions to this project. + +## Maintainers + +| Name | Email | Url | +| ---- | ------ | --- | +| gaiksaya | | | +| peterzhuamazon | | | +| prudhvigodithi | | | +| sergk | | | +| TheAlgo | | | + +## Source Code + +* +* + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| affinity | object | `{}` | | +| autoscaling.enabled | bool | `false` | | +| autoscaling.maxReplicas | int | `100` | | +| autoscaling.minReplicas | int | `1` | | +| autoscaling.targetCPUUtilizationPercentage | int | `80` | | +| config | object | `{"data-prepper-config.yaml":"ssl: false\n# circuit_breakers:\n# heap:\n# usage: 2gb\n# reset: 30s\n# check_interval: 5s\n","log4j2-rolling.properties":"#\n# Copyright OpenSearch Contributors\n# SPDX-License-Identifier: Apache-2.0\n#\n\nstatus = error\ndest = err\nname = PropertiesConfig\n\nproperty.filename = log/data-prepper/data-prepper.log\n\nappender.console.type = Console\nappender.console.name = STDOUT\nappender.console.layout.type = PatternLayout\nappender.console.layout.pattern = %d{ISO8601} [%t] %-5p %40C - %m%n\n\nappender.rolling.type = RollingFile\nappender.rolling.name = RollingFile\nappender.rolling.fileName = ${filename}\nappender.rolling.filePattern = logs/data-prepper.log.%d{MM-dd-yy-HH}-%i.gz\nappender.rolling.layout.type = PatternLayout\nappender.rolling.layout.pattern = %d{ISO8601} [%t] %-5p %40C - %m%n\nappender.rolling.policies.type = Policies\nappender.rolling.policies.time.type = TimeBasedTriggeringPolicy\nappender.rolling.policies.time.interval = 1\nappender.rolling.policies.time.modulate = true\nappender.rolling.policies.size.type = SizeBasedTriggeringPolicy\nappender.rolling.policies.size.size=100MB\nappender.rolling.strategy.type = DefaultRolloverStrategy\nappender.rolling.strategy.max = 168\n\nrootLogger.level = warn\nrootLogger.appenderRef.stdout.ref = STDOUT\nrootLogger.appenderRef.file.ref = RollingFile\n\nlogger.pipeline.name = org.opensearch.dataprepper.pipeline\nlogger.pipeline.level = info\n\nlogger.parser.name = org.opensearch.dataprepper.parser\nlogger.parser.level = info\n\nlogger.plugins.name = org.opensearch.dataprepper.plugins\nlogger.plugins.level = info\n"}` | Data Prepper configuration | +| config."data-prepper-config.yaml" | string | `"ssl: false\n# circuit_breakers:\n# heap:\n# usage: 2gb\n# reset: 30s\n# check_interval: 5s\n"` | Main Data Prepper configuration file content | +| config."log4j2-rolling.properties" | string | `"#\n# Copyright OpenSearch Contributors\n# SPDX-License-Identifier: Apache-2.0\n#\n\nstatus = error\ndest = err\nname = PropertiesConfig\n\nproperty.filename = log/data-prepper/data-prepper.log\n\nappender.console.type = Console\nappender.console.name = STDOUT\nappender.console.layout.type = PatternLayout\nappender.console.layout.pattern = %d{ISO8601} [%t] %-5p %40C - %m%n\n\nappender.rolling.type = RollingFile\nappender.rolling.name = RollingFile\nappender.rolling.fileName = ${filename}\nappender.rolling.filePattern = logs/data-prepper.log.%d{MM-dd-yy-HH}-%i.gz\nappender.rolling.layout.type = PatternLayout\nappender.rolling.layout.pattern = %d{ISO8601} [%t] %-5p %40C - %m%n\nappender.rolling.policies.type = Policies\nappender.rolling.policies.time.type = TimeBasedTriggeringPolicy\nappender.rolling.policies.time.interval = 1\nappender.rolling.policies.time.modulate = true\nappender.rolling.policies.size.type = SizeBasedTriggeringPolicy\nappender.rolling.policies.size.size=100MB\nappender.rolling.strategy.type = DefaultRolloverStrategy\nappender.rolling.strategy.max = 168\n\nrootLogger.level = warn\nrootLogger.appenderRef.stdout.ref = STDOUT\nrootLogger.appenderRef.file.ref = RollingFile\n\nlogger.pipeline.name = org.opensearch.dataprepper.pipeline\nlogger.pipeline.level = info\n\nlogger.parser.name = org.opensearch.dataprepper.parser\nlogger.parser.level = info\n\nlogger.plugins.name = org.opensearch.dataprepper.plugins\nlogger.plugins.level = info\n"` | Log4j2 configuration for Data Prepper logging | +| extraEnvs | list | `[]` | Extra environment variables to pass to the Data Prepper container | +| fullnameOverride | string | `""` | Override the default fullname for the deployment | +| image.pullPolicy | string | `"IfNotPresent"` | The image tag to pull. Default: IfNotPresent | +| image.repository | string | `"opensearchproject/data-prepper"` | The image repository from which to pull the Data Prepper image | +| image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. | +| imagePullSecrets | list | `[]` | List of imagePullSecrets to use if the Docker image is stored in a private registry | +| ingress.annotations | object | `{}` | | +| ingress.className | string | `""` | | +| ingress.enabled | bool | `false` | | +| ingress.hosts[0].host | string | `"chart-example.local"` | | +| ingress.hosts[0].paths[0].path | string | `"/"` | | +| ingress.hosts[0].paths[0].pathType | string | `"ImplementationSpecific"` | | +| ingress.tls | list | `[]` | | +| nameOverride | string | `""` | Override the default name for the deployment | +| nodeSelector | object | `{}` | | +| pipelineConfig | object | `{"config":{"simple-sample-pipeline":{"buffer":{"bounded_blocking":{"batch_size":256,"buffer_size":1024}},"delay":5000,"processor":[{"string_converter":{"upper_case":true}}],"sink":[{"stdout":null}],"source":{"random":null},"workers":2}},"enabled":true,"existingSecret":""}` | Pipeline configuration | +| pipelineConfig.existingSecret | string | `""` | The name of the existing secret containing the pipeline configuration. If enabled is false existingSecret is used. The existingSecret must have a key named `pipelines.yaml`. | +| podAnnotations | object | `{}` | | +| podLabels | object | `{}` | | +| podSecurityContext | object | `{}` | | +| ports | list | `[{"name":"http-source","port":2021},{"name":"otel-traces","port":21890},{"name":"otel-metrics","port":21891},{"name":"otel-logs","port":21892}]` | Data Prepper ports | +| ports[0] | object | `{"name":"http-source","port":2021}` | The port that the source is running on. Default value is 2021. Valid options are between 0 and 65535. https://opensearch.org/docs/latest/data-prepper/pipelines/configuration/sources/http-source/ | +| ports[1] | object | `{"name":"otel-traces","port":21890}` | The port that the otel_trace_source source runs on. Default value is 21890. https://opensearch.org/docs/latest/data-prepper/pipelines/configuration/sources/otel-trace-source/ | +| ports[2] | object | `{"name":"otel-metrics","port":21891}` | The port that the OpenTelemtry metrics source runs on. Default value is 21891. https://opensearch.org/docs/latest/data-prepper/pipelines/configuration/sources/otel-metrics-source/ | +| ports[3] | object | `{"name":"otel-logs","port":21892}` | Represents the port that the otel_logs_source source is running on. Default value is 21892. https://opensearch.org/docs/latest/data-prepper/pipelines/configuration/sources/otel-logs-source/ | +| replicaCount | int | `1` | | +| resources | object | `{}` | | +| securityContext | object | `{}` | | +| service.type | string | `"ClusterIP"` | | +| serviceAccount.annotations | object | `{}` | Annotations to add to the service account | +| serviceAccount.automount | bool | `true` | Automatically mount a ServiceAccount's API credentials? | +| serviceAccount.create | bool | `true` | Specifies whether a service account should be created | +| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | +| tolerations | list | `[]` | | +| volumeMounts | list | `[]` | | +| volumes | list | `[]` | | + +## License + +This project is licensed under the Apache License 2.0 - see the [LICENSE.txt](../../LICENSE.txt) file for details. diff --git a/charts/data-prepper/README.md.gotmpl b/charts/data-prepper/README.md.gotmpl new file mode 100644 index 00000000..816511e9 --- /dev/null +++ b/charts/data-prepper/README.md.gotmpl @@ -0,0 +1,71 @@ +# Data Prepper Helm Chart + +{{ template "chart.deprecationWarning" . }} + +{{ template "chart.badgesSection" . }} + +{{ template "chart.description" . }} + +{{ template "chart.homepageLine" . }} + +Data Prepper is an essential component of the OpenSearch project, designed for high-volume data transformation and ingestion into OpenSearch. This Helm chart simplifies deploying Data Prepper on Kubernetes environments, ensuring you can easily set up your data processing pipelines. + +## Requirements + +Before installing the Data Prepper Helm chart, ensure your environment meets the following requirements: + +* Kubernetes >= 1.14 +* Helm >= 2.17.0 +* We recommend having at least 4 GiB of memory available for this deployment. A minimum of 2 GiB may suffice, but less than that could lead to deployment failures. + +## Installation + +To install the Data Prepper Helm chart, follow these steps: + +* Add the OpenSearch Helm repository if you haven't already: + +```bash +helm repo add opensearch https://opensearch-project.github.io/helm-charts/ +helm repo update +``` + +* Install the Data Prepper chart with: + +```bash +helm install my-data-prepper-release opensearch/data-prepper +``` + +Replace my-data-prepper-release with your desired release name. + +## Configuration + +The Data Prepper Helm chart comes with a variety of configuration options to tailor the deployment to your needs. +The default values are specified in the [values.yaml](values.yaml) file. You can override these values by providing your own values.yaml file during installation or by specifying configuration options with --set flags. + +For a detailed list of configuration options, refer to the values.yaml file or the [Data Prepper documentation](https://opensearch.org/docs/latest/data-prepper/managing-data-prepper/configuring-data-prepper/). + +## Uninstalling the Chart + +To uninstall/delete the my-data-prepper deployment: + +```bash +helm delete my-data-prepper +``` + +This command removes all the Kubernetes components associated with the chart and deletes the release. + +## Contributing + +We welcome contributions! Please read our [CONTRIBUTING.md](../../CONTRIBUTING.md) for details on how to submit contributions to this project. + +{{ template "chart.maintainersSection" . }} + +{{ template "chart.sourcesSection" . }} + +{{ template "chart.requirementsSection" . }} + +{{ template "chart.valuesSection" . }} + +## License + +This project is licensed under the Apache License 2.0 - see the [LICENSE.txt](../../LICENSE.txt) file for details. diff --git a/charts/data-prepper/templates/NOTES.txt b/charts/data-prepper/templates/NOTES.txt new file mode 100644 index 00000000..cae9ebaf --- /dev/null +++ b/charts/data-prepper/templates/NOTES.txt @@ -0,0 +1,22 @@ +1. Get the application URL by running these commands: +{{- if .Values.ingress.enabled }} +{{- range $host := .Values.ingress.hosts }} + {{- range .paths }} + http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }} + {{- end }} +{{- end }} +{{- else if contains "NodePort" .Values.service.type }} + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "data-prepper.fullname" . }}) + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + echo http://$NODE_IP:$NODE_PORT +{{- else if contains "LoadBalancer" .Values.service.type }} + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + You can watch its status by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "data-prepper.fullname" . }}' + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "data-prepper.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") + echo http://$SERVICE_IP:{{ .Values.service.port }} +{{- else if contains "ClusterIP" .Values.service.type }} + export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "data-prepper.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") + export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}") + echo "Visit http://127.0.0.1:8080 to use your application" + kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT +{{- end }} diff --git a/charts/data-prepper/templates/_helpers.tpl b/charts/data-prepper/templates/_helpers.tpl new file mode 100644 index 00000000..e5e11945 --- /dev/null +++ b/charts/data-prepper/templates/_helpers.tpl @@ -0,0 +1,62 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "data-prepper.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "data-prepper.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "data-prepper.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "data-prepper.labels" -}} +helm.sh/chart: {{ include "data-prepper.chart" . }} +{{ include "data-prepper.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "data-prepper.selectorLabels" -}} +app.kubernetes.io/name: {{ include "data-prepper.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "data-prepper.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "data-prepper.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} diff --git a/charts/data-prepper/templates/configmap.yaml b/charts/data-prepper/templates/configmap.yaml new file mode 100644 index 00000000..7ada9ee4 --- /dev/null +++ b/charts/data-prepper/templates/configmap.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "data-prepper.fullname" . }}-config + labels: + {{- include "data-prepper.labels" . | nindent 4 }} +data: +{{- range $configName, $configYaml := .Values.config }} + {{ $configName }}: | + {{- if eq (kindOf $configYaml) "map" }} + {{- tpl (toYaml $configYaml) $ | nindent 4 }} + {{- else }} + {{- tpl $configYaml $ | nindent 4 -}} + {{- end -}} +{{- end -}} diff --git a/charts/data-prepper/templates/deployment.yaml b/charts/data-prepper/templates/deployment.yaml new file mode 100644 index 00000000..3db562c7 --- /dev/null +++ b/charts/data-prepper/templates/deployment.yaml @@ -0,0 +1,112 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "data-prepper.fullname" . }} + labels: + {{- include "data-prepper.labels" . | nindent 4 }} +spec: + {{- if not .Values.autoscaling.enabled }} + replicas: {{ .Values.replicaCount }} + {{- end }} + selector: + matchLabels: + {{- include "data-prepper.selectorLabels" . | nindent 6 }} + template: + metadata: + annotations: + {{- with .Values.podAnnotations }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if .Values.config }} + checksum/config: {{ include (print .Template.BasePath "/configmap.yaml") . | sha256sum | trunc 63 }} + {{- end }} + {{- if .Values.pipelineConfig.enabled }} + checksum/pipelineconfig: {{ include (print .Template.BasePath "/secret.yaml") . | sha256sum | trunc 63 }} + {{- end }} + labels: + {{- include "data-prepper.labels" . | nindent 8 }} + {{- with .Values.podLabels }} + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "data-prepper.serviceAccountName" . }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + containers: + - name: {{ .Chart.Name }} + env: + {{- with .Values.extraEnvs }} + {{- toYaml . | nindent 12 }} + {{- end }} + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + ports: + {{- range .Values.ports }} + - name: {{ .name }} + containerPort: {{ .port }} + protocol: TCP + {{- end }} + - name: server + containerPort: {{ (.Values.config).serverPort | default 4900 }} + protocol: TCP + livenessProbe: + httpGet: + path: /list + port: server + {{- if not ( empty (.Values.config).ssl ) }} + scheme: HTTPS + {{- end }} + periodSeconds: 10 + initialDelaySeconds: 2 + failureThreshold: 2 + readinessProbe: + httpGet: + path: /list + port: server + {{- if not ( empty (.Values.config).ssl ) }} + scheme: HTTPS + {{- end }} + resources: + {{- toYaml .Values.resources | nindent 12 }} + volumeMounts: + - name: data-prepper-config + mountPath: /usr/share/data-prepper/config + readOnly: true + - name: data-prepper-pipelines + mountPath: /usr/share/data-prepper/pipelines + readOnly: true + {{- with .Values.volumeMounts }} + {{- toYaml . | nindent 12 }} + {{- end }} + volumes: + - name: data-prepper-config + configMap: + name: {{ include "data-prepper.fullname" . }}-config + - name: data-prepper-pipelines + secret: + {{- if .Values.pipelineConfig.enabled }} + secretName: {{ include "data-prepper.fullname" . }}-pipeline + {{- else }} + secretName: {{ required "A valid .Values.pipelineConfig.existingSecret entry required!" .Values.pipelineConfig.existingSecret }} + {{- end }} + {{- with .Values.volumes }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/charts/data-prepper/templates/hpa.yaml b/charts/data-prepper/templates/hpa.yaml new file mode 100644 index 00000000..ae2a7731 --- /dev/null +++ b/charts/data-prepper/templates/hpa.yaml @@ -0,0 +1,32 @@ +{{- if .Values.autoscaling.enabled }} +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "data-prepper.fullname" . }} + labels: + {{- include "data-prepper.labels" . | nindent 4 }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "data-prepper.fullname" . }} + minReplicas: {{ .Values.autoscaling.minReplicas }} + maxReplicas: {{ .Values.autoscaling.maxReplicas }} + metrics: + {{- if .Values.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }} + {{- end }} + {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + target: + type: Utilization + averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/charts/data-prepper/templates/ingress.yaml b/charts/data-prepper/templates/ingress.yaml new file mode 100644 index 00000000..facc8973 --- /dev/null +++ b/charts/data-prepper/templates/ingress.yaml @@ -0,0 +1,61 @@ +{{- if .Values.ingress.enabled -}} +{{- $fullName := include "data-prepper.fullname" . -}} +{{- $svcPort := .Values.service.port -}} +{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }} + {{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }} + {{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}} + {{- end }} +{{- end }} +{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1 +{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1beta1 +{{- else -}} +apiVersion: extensions/v1beta1 +{{- end }} +kind: Ingress +metadata: + name: {{ $fullName }} + labels: + {{- include "data-prepper.labels" . | nindent 4 }} + {{- with .Values.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }} + ingressClassName: {{ .Values.ingress.className }} + {{- end }} + {{- if .Values.ingress.tls }} + tls: + {{- range .Values.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} + {{- end }} + rules: + {{- range .Values.ingress.hosts }} + - host: {{ .host | quote }} + http: + paths: + {{- range .paths }} + - path: {{ .path }} + {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }} + pathType: {{ .pathType }} + {{- end }} + backend: + {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }} + service: + name: {{ $fullName }} + port: + number: {{ $svcPort }} + {{- else }} + serviceName: {{ $fullName }} + servicePort: {{ $svcPort }} + {{- end }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/data-prepper/templates/secret.yaml b/charts/data-prepper/templates/secret.yaml new file mode 100644 index 00000000..0e4ff081 --- /dev/null +++ b/charts/data-prepper/templates/secret.yaml @@ -0,0 +1,12 @@ +{{- if .Values.pipelineConfig.enabled }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "data-prepper.fullname" . }}-pipeline + labels: + {{- include "data-prepper.labels" . | nindent 4 }} +type: Opaque +stringData: + pipelines.yaml: | + {{- toYaml .Values.pipelineConfig.config | nindent 4 }} +{{- end }} diff --git a/charts/data-prepper/templates/service.yaml b/charts/data-prepper/templates/service.yaml new file mode 100644 index 00000000..5a6e1860 --- /dev/null +++ b/charts/data-prepper/templates/service.yaml @@ -0,0 +1,17 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "data-prepper.fullname" . }} + labels: + {{- include "data-prepper.labels" . | nindent 4 }} +spec: + type: {{ .Values.service.type }} + ports: + {{- range .Values.ports }} + - name: {{ .name }} + port: {{ .port }} + targetPort: {{ .port }} + protocol: TCP + {{- end }} + selector: + {{- include "data-prepper.selectorLabels" . | nindent 4 }} diff --git a/charts/data-prepper/templates/serviceaccount.yaml b/charts/data-prepper/templates/serviceaccount.yaml new file mode 100644 index 00000000..5a1f4ec5 --- /dev/null +++ b/charts/data-prepper/templates/serviceaccount.yaml @@ -0,0 +1,13 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "data-prepper.serviceAccountName" . }} + labels: + {{- include "data-prepper.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +automountServiceAccountToken: {{ .Values.serviceAccount.automount }} +{{- end }} diff --git a/charts/data-prepper/values.yaml b/charts/data-prepper/values.yaml new file mode 100644 index 00000000..b63cf837 --- /dev/null +++ b/charts/data-prepper/values.yaml @@ -0,0 +1,354 @@ +# Copyright OpenSearch Contributors +# SPDX-License-Identifier: Apache-2.0 + +# Default values for data-prepper. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 + +image: + # -- The image repository from which to pull the Data Prepper image + repository: opensearchproject/data-prepper + # -- The image tag to pull. Default: IfNotPresent + pullPolicy: IfNotPresent + # -- Overrides the image tag whose default is the chart appVersion. + tag: "" + +# -- List of imagePullSecrets to use if the Docker image is stored in a private registry +imagePullSecrets: [] +# -- Override the default name for the deployment +nameOverride: "" +# -- Override the default fullname for the deployment +fullnameOverride: "" + +# -- Extra environment variables to pass to the Data Prepper container +extraEnvs: [] + # - name: "JAVA_OPTS" + # value: "-Dlog4j2.debug=true" + +# Check https://opensearch.org/docs/latest/data-prepper/managing-data-prepper/configuring-data-prepper/ +# for more information on the configuration options +# -- Data Prepper configuration +config: + # -- Main Data Prepper configuration file content + data-prepper-config.yaml: | + ssl: false + # circuit_breakers: + # heap: + # usage: 2gb + # reset: 30s + # check_interval: 5s + + # -- Log4j2 configuration for Data Prepper logging + log4j2-rolling.properties: | + # + # Copyright OpenSearch Contributors + # SPDX-License-Identifier: Apache-2.0 + # + + status = error + dest = err + name = PropertiesConfig + + property.filename = log/data-prepper/data-prepper.log + + appender.console.type = Console + appender.console.name = STDOUT + appender.console.layout.type = PatternLayout + appender.console.layout.pattern = %d{ISO8601} [%t] %-5p %40C - %m%n + + appender.rolling.type = RollingFile + appender.rolling.name = RollingFile + appender.rolling.fileName = ${filename} + appender.rolling.filePattern = logs/data-prepper.log.%d{MM-dd-yy-HH}-%i.gz + appender.rolling.layout.type = PatternLayout + appender.rolling.layout.pattern = %d{ISO8601} [%t] %-5p %40C - %m%n + appender.rolling.policies.type = Policies + appender.rolling.policies.time.type = TimeBasedTriggeringPolicy + appender.rolling.policies.time.interval = 1 + appender.rolling.policies.time.modulate = true + appender.rolling.policies.size.type = SizeBasedTriggeringPolicy + appender.rolling.policies.size.size=100MB + appender.rolling.strategy.type = DefaultRolloverStrategy + appender.rolling.strategy.max = 168 + + rootLogger.level = warn + rootLogger.appenderRef.stdout.ref = STDOUT + rootLogger.appenderRef.file.ref = RollingFile + + logger.pipeline.name = org.opensearch.dataprepper.pipeline + logger.pipeline.level = info + + logger.parser.name = org.opensearch.dataprepper.parser + logger.parser.level = info + + logger.plugins.name = org.opensearch.dataprepper.plugins + logger.plugins.level = info + +# For OpenSearch Data Prepper is crucial for defining the behavior and structure of your data processing pipelines. +# Each pipeline is defined with a unique name and can include `source`, `processor`, and `sink` components to ingest, +# process, and output data respectively. This flexible configuration allows for the creation of complex data processing +# flows, including the routing of data between pipelines. +# For detailed information on the available options and to get the most up-to-date guidance on configuring `pipeline.yaml`, +# please consult the [OpenSearch Documentation on Pipelines](https://opensearch.org/docs/2.4/data-prepper/pipelines/pipelines/). +# This resource provides comprehensive examples and explanations of each component, ensuring you can tailor your Data Prepper +# deployment to meet your specific data processing needs. + +# -- Pipeline configuration +pipelineConfig: + # If enabled, a secret containing the pipeline configuration will be created based on the 'config' section below. + enabled: true + # -- The name of the existing secret containing the pipeline configuration. + # If enabled is false existingSecret is used. The existingSecret must have a key named `pipelines.yaml`. + existingSecret: "" + # The configuration of the pipeline see https://opensearch.org/docs/2.4/data-prepper/pipelines/pipelines/ + config: + ## Simple Example + simple-sample-pipeline: + workers: 2 # the number of workers + delay: 5000 # in milliseconds, how long workers wait between read attempts + source: + random: + buffer: + bounded_blocking: + buffer_size: 1024 # max number of records the buffer accepts + batch_size: 256 # max number of records the buffer drains after each read + processor: + - string_converter: + upper_case: true + sink: + - stdout: + + ## More Complex example + # otel-logs-pipeline: + # workers: 5 + # delay: 10 + # source: + # otel_logs_source: + # ssl: false + # buffer: + # bounded_blocking: + # sink: + # - opensearch: + # hosts: ["https://opensearch-cluster-master:9200"] + # username: "admin" + # password: "admin" + # insecure: true + # index_type: custom + # index: events-%{yyyy.MM.dd} + # #max_retries: 20 + # bulk_size: 4 + # otel-trace-pipeline: + # # workers is the number of threads processing data in each pipeline. + # # We recommend same value for all pipelines. + # # default value is 1, set a value based on the machine you are running Data Prepper + # workers: 8 + # # delay in milliseconds is how often the worker threads should process data. + # # Recommend not to change this config as we want the otel-trace-pipeline to process as quick as possible + # # default value is 3_000 ms + # delay: "100" + # source: + # otel_trace_source: + # ssl: false # Change this to enable encryption in transit + # buffer: + # bounded_blocking: + # # buffer_size is the number of ExportTraceRequest from otel-collector the data prepper should hold in memeory. + # # We recommend to keep the same buffer_size for all pipelines. + # # Make sure you configure sufficient heap + # # default value is 12800 + # buffer_size: 25600 + # # This is the maximum number of request each worker thread will process within the delay. + # # Default is 200. + # # Make sure buffer_size >= workers * batch_size + # batch_size: 400 + # sink: + # - pipeline: + # name: "raw-traces-pipeline" + # - pipeline: + # name: "otel-service-map-pipeline" + # raw-traces-pipeline: + # workers: 5 + # delay: 3000 + # source: + # pipeline: + # name: "otel-trace-pipeline" + # buffer: + # bounded_blocking: + # buffer_size: 25600 # max number of records the buffer accepts + # batch_size: 400 # max number of records the buffer drains after each read + # processor: + # - otel_traces: + # - otel_trace_group: + # hosts: [ "https://opensearch-cluster-master:9200" ] + # insecure: true + # username: "admin" + # password: "admin" + # sink: + # - opensearch: + # hosts: ["https://opensearch-cluster-master:9200"] + # username: "admin" + # password: "admin" + # insecure: true + # index_type: trace-analytics-raw + # otel-service-map-pipeline: + # workers: 5 + # delay: 3000 + # source: + # pipeline: + # name: "otel-trace-pipeline" + # processor: + # - service_map: + # # The window duration is the maximum length of time the data prepper stores the most recent trace data to evaluvate service-map relationships. + # # The default is 3 minutes, this means we can detect relationships between services from spans reported in last 3 minutes. + # # Set higher value if your applications have higher latency. + # window_duration: 180 + # buffer: + # bounded_blocking: + # # buffer_size is the number of ExportTraceRequest from otel-collector the data prepper should hold in memeory. + # # We recommend to keep the same buffer_size for all pipelines. + # # Make sure you configure sufficient heap + # # default value is 12800 + # buffer_size: 25600 + # # This is the maximum number of request each worker thread will process within the delay. + # # Default is 200. + # # Make sure buffer_size >= workers * batch_size + # batch_size: 400 + # sink: + # - opensearch: + # hosts: ["https://opensearch-cluster-master:9200"] + # username: "admin" + # password: "admin" + # insecure: true + # index_type: trace-analytics-service-map + # #index: otel-v1-apm-span-%{yyyy.MM.dd} + # #max_retries: 20 + # bulk_size: 4 + # otel-metrics-pipeline: + # workers: 8 + # delay: 3000 + # source: + # otel_metrics_source: + # health_check_service: true + # ssl: false + # buffer: + # bounded_blocking: + # buffer_size: 1024 # max number of records the buffer accepts + # batch_size: 1024 # max number of records the buffer drains after each read + # processor: + # - otel_metrics: + # calculate_histogram_buckets: true + # calculate_exponential_histogram_buckets: true + # exponential_histogram_max_allowed_scale: 10 + # flatten_attributes: false + # sink: + # - opensearch: + # hosts: ["https://opensearch-cluster-master:9200"] + # username: "admin" + # password: "admin" + # insecure: true + # index_type: custom + # index: metrics-%{yyyy.MM.dd} + # #max_retries: 20 + # bulk_size: 4 + +# -- Data Prepper ports +ports: + # -- The port that the source is running on. Default value is 2021. Valid options are between 0 and 65535. + # https://opensearch.org/docs/latest/data-prepper/pipelines/configuration/sources/http-source/ + - name: http-source + port: 2021 + # -- The port that the otel_trace_source source runs on. Default value is 21890. + # https://opensearch.org/docs/latest/data-prepper/pipelines/configuration/sources/otel-trace-source/ + - name: otel-traces + port: 21890 + # -- The port that the OpenTelemtry metrics source runs on. Default value is 21891. + # https://opensearch.org/docs/latest/data-prepper/pipelines/configuration/sources/otel-metrics-source/ + - name: otel-metrics + port: 21891 + # -- Represents the port that the otel_logs_source source is running on. Default value is 21892. + # https://opensearch.org/docs/latest/data-prepper/pipelines/configuration/sources/otel-logs-source/ + - name: otel-logs + port: 21892 + +serviceAccount: + # -- Specifies whether a service account should be created + create: true + # -- Automatically mount a ServiceAccount's API credentials? + automount: true + # -- Annotations to add to the service account + annotations: {} + # -- The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + +podAnnotations: {} +podLabels: {} + +podSecurityContext: {} + # fsGroup: 2000 + +securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 1000 + +service: + type: ClusterIP + +ingress: + enabled: false + className: "" + annotations: {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + hosts: + - host: chart-example.local + paths: + - path: / + pathType: ImplementationSpecific + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + +resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + +autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 100 + targetCPUUtilizationPercentage: 80 + # targetMemoryUtilizationPercentage: 80 + +# Additional volumes on the output Deployment definition. +volumes: [] +# - name: foo +# secret: +# secretName: mysecret +# optional: false + +# Additional volumeMounts on the output Deployment definition. +volumeMounts: [] +# - name: foo +# mountPath: "/etc/foo" +# readOnly: true + +nodeSelector: {} + +tolerations: [] + +affinity: {} diff --git a/charts/opensearch-dashboards/CHANGELOG.md b/charts/opensearch-dashboards/CHANGELOG.md index 1fba9bb2..24698f59 100644 --- a/charts/opensearch-dashboards/CHANGELOG.md +++ b/charts/opensearch-dashboards/CHANGELOG.md @@ -1,4 +1,5 @@ # Changelog + All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), @@ -13,9 +14,136 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed ### Security --- +## [2.25.0] +### Added +- Updated OpenSearch Dashboards appVersion to 2.18.0 +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [2.24.1] +### Added +### Changed +### Deprecated +### Removed +### Fixed +- Resolved `helm lint` errors with extraObjects +### Security +--- +## [2.24.0] +### Added +- Updated OpenSearch Dashboards appVersion to 2.17.1 +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [2.23.0] +### Added +- Updated OpenSearch Dashboards appVersion to 2.17.0 +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [2.22.0] +### Added +- Ability to add additional `labels` to `serviceMonitor` +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [2.21.2] +### Added +### Changed +### Deprecated +### Removed +### Fixed +- Bug `protocol` missing for metrics in `Service` +### Security +--- +## [2.21.1] +### Added +### Changed +### Deprecated +### Removed +### Fixed +- Fixed `ServiceMonitor` bug for `port` value +### Security +--- +## [2.21.0] +### Added +- Added `ServiceMonitor` support for Prometheus monitoring +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [2.20.0] +### Added +- Updated OpenSearch Dashboards appVersion to 2.16.0 +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [2.19.1] +### Added +### Changed +### Deprecated +### Removed +### Fixed +- Fixed pod topology spread constraints in Dashboards +### Security +--- +## [2.19.0] +### Added +- Updated OpenSearch Dashboards appVersion to 2.15.0 +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [2.18.0] +### Added +- Updated OpenSearch Dashboards appVersion to 2.14.0 +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [2.17.0] +### Added +- Updated OpenSearch Dashboards appVersion to 2.13.0 +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [2.16.1] +### Added +- Support for newer HorizontalPodAutoscaler api in Dashboards +- Ability to configure HorizontalPodAutoscaler to use memory as a metric source type +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- ## [2.16.0] ### Added -- Updated OpenSearch Dashboards appVersion to 2.12.0 +- Updated OpenSearch Dashboards appVersion to 2.12.0 ### Changed ### Deprecated ### Removed @@ -66,7 +194,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Removed ### Fixed ### Security - --- ## [2.11.1] ### Added @@ -303,7 +430,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed ### Security -[Unreleased]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-2.16.0...HEAD +[Unreleased]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-2.25.0...HEAD +[2.25.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-2.24.1...opensearch-dashboards-2.25.0 +[2.24.1]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-2.24.0...opensearch-dashboards-2.24.1 +[2.24.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-2.23.0...opensearch-dashboards-2.24.0 +[2.23.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-2.22.0...opensearch-dashboards-2.23.0 +[2.22.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-2.21.1...opensearch-dashboards-2.22.0 +[2.21.2]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-2.21.1...opensearch-dashboards-2.21.2 +[2.21.1]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-2.21.0...opensearch-dashboards-2.21.1 +[2.21.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-2.20.0...opensearch-dashboards-2.21.0 +[2.20.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-2.19.1...opensearch-dashboards-2.20.0 +[2.19.1]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-2.19.0...opensearch-dashboards-2.19.1 +[2.19.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-2.18.0...opensearch-dashboards-2.19.0 +[2.18.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-2.17.0...opensearch-dashboards-2.18.0 +[2.17.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-2.16.0...opensearch-dashboards-2.17.0 [2.16.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-2.15.1...opensearch-dashboards-2.16.0 [2.15.1]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-2.15.0...opensearch-dashboards-2.15.1 [2.15.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-2.14.0...opensearch-dashboards-2.15.0 diff --git a/charts/opensearch-dashboards/Chart.yaml b/charts/opensearch-dashboards/Chart.yaml index a1242a5f..0e85909d 100644 --- a/charts/opensearch-dashboards/Chart.yaml +++ b/charts/opensearch-dashboards/Chart.yaml @@ -15,17 +15,16 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 2.16.0 +version: 2.25.0 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. # It is recommended to use it with quotes. -appVersion: "2.12.0" +appVersion: "2.18.0" maintainers: - name: DandyDeveloper - - name: bbarani - name: gaiksaya - name: peterzhuamazon - name: prudhvigodithi diff --git a/charts/opensearch-dashboards/README.md b/charts/opensearch-dashboards/README.md index ebd356bd..57def7f0 100644 --- a/charts/opensearch-dashboards/README.md +++ b/charts/opensearch-dashboards/README.md @@ -2,95 +2,139 @@ This Helm chart installs [OpenSearch Dashboards](https://github.com/opensearch-project/OpenSearch-Dashboards) with configurable TLS, RBAC and much more configurations. This chart caters to a number of different use cases and setups. - - [Requirements](#requirements) - - [Installing](#installing) - - [Uninstalling](#uninstalling) +- [Requirements](#requirements) +- [Installing](#installing) +- [Uninstalling](#uninstalling) - ## Requirements +## Requirements - * Kubernetes >= 1.14 - * Helm >= 2.17.0 - * We recommend you to have 8 GiB of memory available for this deployment, or at least 4 GiB for the minimum requirement. Else, the deployment is expected to fail. +- Kubernetes >= 1.14 +- Helm >= 2.17.0 +- We recommend you to have 8 GiB of memory available for this deployment, or at least 4 GiB for the minimum requirement. Else, the deployment is expected to fail. - ## Installing +## Installing - Once you've added this Helm repository as per the repository-level [README](../../README.md#installing) - then you can install the chart as follows: +Once you've added this Helm repository as per the repository-level [README](../../README.md#installing) +then you can install the chart as follows: - ```shell - helm install my-release opensearch/opensearch-dashboards - ``` +```shell +helm install my-release opensearch/opensearch-dashboards +``` - The command deploys OpenSearch Dashboards with its associated components on the Kubernetes cluster in the default configuration. +The command deploys OpenSearch Dashboards with its associated components on the Kubernetes cluster in the default configuration. - **NOTE:** If using Helm 2 then you'll need to add the [`--name`](https://v2.helm.sh/docs/helm/#options-21) command line argument. If unspecified, Helm 2 will autogenerate a name for you. +**NOTE:** If using Helm 2 then you'll need to add the [`--name`](https://v2.helm.sh/docs/helm/#options-21) command line argument. If unspecified, Helm 2 will autogenerate a name for you. - ## Uninstalling - To delete/uninstall the chart with the release name `my-release`: +## Uninstalling - ```shell - helm uninstall my-release - ``` +To delete/uninstall the chart with the release name `my-release`: + +```shell +helm uninstall my-release +``` ## Configuration -| Parameter | Description | Default | -|------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------| -| `envFrom` | Templatable string to be passed to the [environment from variables][] which will be appended to the `envFrom:` definition for the container | `[]` | -| `config` | Allows you to add any config files in `/usr/share/opensearch-dashboards/` such as `opensearch_dashboards.yml`. String or map format may be used for specifying content of each configuration file. In case of string format, the whole content of the config file will be replaced by new config file value when in case of using map format content of configuration file will be a result of merge. In both cases content passed through tpl. See [values.yaml][] for an example of the formatting | `{}` | -| `extraContainers` | Array of extra containers | `""` | -| `extraEnvs` | Extra environments variables to be passed to OpenSearch services | `[]` | -| `extraInitContainers` | Array of extra init containers | `[]` | -| `extraVolumeMounts` | Array of extra volume mounts | `[] ` | -| `extraVolumes` | Array of extra volumes to be added | `[]` | -| `fullnameOverride` | Overrides the `clusterName` and `nodeGroup` when used in the naming of resources. This should only be used when using a single `nodeGroup`, otherwise you will have name conflicts | `""` | -| `hostAliases` | Configurable [hostAliases][] | `[]` | -| `image.pullPolicy` | The Kubernetes [imagePullPolicy][] value | `IfNotPresent` | -| `imagePullSecrets` | Configuration for [imagePullSecrets][] so that you can use a private registry for your image | `[]` | -| `image.tag` | The OpenSearch Docker image tag | `1.0.0` | -| `image.repository` | The OpenSearch Docker image | `opensearchproject/opensearch` | -| `ingress` | Configurable [ingress][] to expose the OpenSearch service. See [values.yaml][] for an example | see [values.yaml][] | -| `labels` | Configurable [labels][] applied to all OpenSearch pods | `{}` | -| `lifecycle` | Allows you to add [lifecycle hooks](https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/). See [values.yaml][] for an example | `{}` | -| `nameOverride` | Overrides the `clusterName` when used in the naming of resources | `""` | -| `nodeSelector` | Configurable [nodeSelector][] so that you can target specific nodes for your OpenSearch cluster | `{}` | -| `podAnnotations` | Configurable [annotations][] applied to all OpenSearch pods | `{}` | -| `podSecurityContext` | Allows you to set the [securityContext][] for the pod | see [values.yaml][] | -| `priorityClassName` | The name of the [PriorityClass][]. No default is supplied as the PriorityClass must be created first | `""` | -| `rbac` | Configuration for creating a role, role binding and ServiceAccount as part of this Helm chart with `create: true`. Also can be used to reference an external ServiceAccount with `serviceAccountName: "externalServiceAccountName"` | see [values.yaml][] | -| `resources` | Allows you to set the [resources][] for the StatefulSet | see [values.yaml][] | -| `secretMounts` | Allows you easily mount a secret as a file inside the StatefulSet. Useful for mounting certificates and other secrets. See [values.yaml][] for an example | `[]` | -| `securityContext` | Allows you to set the [securityContext][] for the container | see [values.yaml][] | -| `service.annotations` | [LoadBalancer annotations][] that Kubernetes will use for the service. This will configure load balancer if `service.type` is `LoadBalancer` | `{}` | -| `service.headless.annotations` | Allow you to set annotations on the headless service | `{}` | -| `service.externalTrafficPolicy` | Some cloud providers allow you to specify the [LoadBalancer externalTrafficPolicy][]. Kubernetes will use this to preserve the client source IP. This will configure load balancer if `service.type` is `LoadBalancer` | `""` | -| `service.httpPortName` | The name of the http port within the service | `http` | -| `service.labelsHeadless` | Labels to be added to headless service | `{}` | -| `service.labels` | Labels to be added to non-headless service | `{}` | -| `service.loadBalancerIP` | Some cloud providers allow you to specify the [loadBalancer][] IP. If the `loadBalancerIP` field is not specified, the IP is dynamically assigned. If you specify a `loadBalancerIP` but your cloud provider does not support the feature, it is ignored. | `""` | -| `service.loadBalancerSourceRanges` | The IP ranges that are allowed to access | `[]` | -| `service.nodePort` | Custom [nodePort][] port that can be set if you are using `service.type: nodePort` | `""` | -| `service.transportPortName` | The name of the transport port within the service | `transport` | -| `service.type` | OpenSearch [Service Types][] | `ClusterIP` | -| `service.ipFamilyPolicy` | This sets the preferred ip addresses in case of a dual-stack server, there are three options [PreferDualStack, SingleStack, RequireDualStack], [more information on dual stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/) | `""` | -| `service.ipFamilies` | Sets the preferred IP variants and in which order they are preferred, the first family you list is used for the legacy .spec.ClusterIP field, [more information on dual stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/) | `""` | -| `tolerations` | Configurable [tolerations][] | `[]` | +| Parameter | Description | Default | +| :--- | :--- | :--- | +| `envFrom` | Templatable string to be passed to the [environment from variables][] which will be appended to the `envFrom:` definition for the container | `[]` | +| `config` | Allows you to add any config files in `/usr/share/opensearch-dashboards/` such as `opensearch_dashboards.yml`. String or map format may be used for specifying content of each configuration file. In case of string format, the whole content of the config file will be replaced by new config file value when in case of using map format content of configuration file will be a result of merge. In both cases content passed through tpl. See [values.yaml][] for an example of the formatting | `{}` | +| `extraContainers` | Array of extra containers | `""` | +| `extraEnvs` | Extra environments variables to be passed to OpenSearch services | `[]` | +| `extraInitContainers` | Array of extra init containers | `[]` | +| `extraVolumeMounts` | Array of extra volume mounts | `[]` | +| `extraVolumes` | Array of extra volumes to be added | `[]` | +| `fullnameOverride` | Overrides the `clusterName` and `nodeGroup` when used in the naming of resources. This should only be used when using a single `nodeGroup`, otherwise you will have name conflicts | `""` | +| `hostAliases` | Configurable [hostAliases][] | `[]` | +| `image.pullPolicy` | The Kubernetes [imagePullPolicy][] value | `IfNotPresent` | +| `imagePullSecrets` | Configuration for [imagePullSecrets][] so that you can use a private registry for your image | `[]` | +| `image.tag` | The OpenSearch Docker image tag | `1.0.0` | +| `image.repository` | The OpenSearch Docker image | `opensearchproject/opensearch` | +| `ingress` | Configurable [ingress][] to expose the OpenSearch service. See [values.yaml][] for an example | see [values.yaml][] | +| `labels` | Configurable [labels][] applied to all OpenSearch pods | `{}` | +| `lifecycle` | Allows you to add [lifecycle hooks](https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/). See [values.yaml][] for an example | `{}` | +| `nameOverride` | Overrides the `clusterName` when used in the naming of resources | `""` | +| `nodeSelector` | Configurable [nodeSelector][] so that you can target specific nodes for your OpenSearch cluster | `{}` | +| `podAnnotations` | Configurable [annotations][] applied to all OpenSearch pods | `{}` | +| `podSecurityContext` | Allows you to set the [securityContext][] for the pod | see [values.yaml][] | +| `priorityClassName` | The name of the [PriorityClass][]. No default is supplied as the PriorityClass must be created first | `""` | +| `rbac` | Configuration for creating a role, role binding and ServiceAccount as part of this Helm chart with `create: true`. Also can be used to reference an external ServiceAccount with `serviceAccountName: "externalServiceAccountName"` | see [values.yaml][] | +| `resources` | Allows you to set the [resources][] for the StatefulSet | see [values.yaml][] | +| `secretMounts` | Allows you easily mount a secret as a file inside the StatefulSet. Useful for mounting certificates and other secrets. See [values.yaml][] for an example | `[]` | +| `securityContext` | Allows you to set the [securityContext][] for the container | see [values.yaml][] | +| `service.annotations` | [LoadBalancer annotations][] that Kubernetes will use for the service. This will configure load balancer if `service.type` is `LoadBalancer` | `{}` | +| `service.headless.annotations` | Allow you to set annotations on the headless service | `{}` | +| `service.externalTrafficPolicy` | Some cloud providers allow you to specify the [LoadBalancer externalTrafficPolicy][]. Kubernetes will use this to preserve the client source IP. This will configure load balancer if `service.type` is `LoadBalancer` | `""` | +| `service.httpPortName` | The name of the http port within the service | `http` | +| `service.labelsHeadless` | Labels to be added to headless service | `{}` | +| `service.labels` | Labels to be added to non-headless service | `{}` | +| `service.loadBalancerIP` | Some cloud providers allow you to specify the [loadBalancer][] IP. If the `loadBalancerIP` field is not specified, the IP is dynamically assigned. If you specify a `loadBalancerIP` but your cloud provider does not support the feature, it is ignored. | `""` | +| `service.loadBalancerSourceRanges` | The IP ranges that are allowed to access | `[]` | +| `service.nodePort` | Custom [nodePort][] port that can be set if you are using `service.type: nodePort` | `""` | +| `service.transportPortName` | The name of the transport port within the service | `transport` | +| `service.type` | OpenSearch [Service Types][] | `ClusterIP` | +| `service.ipFamilyPolicy` | This sets the preferred ip addresses in case of a dual-stack server, there are three options [PreferDualStack, SingleStack, RequireDualStack], [more information on dual stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/) | `""` | +| `service.ipFamilies` | Sets the preferred IP variants and in which order they are preferred, the first family you list is used for the legacy .spec.ClusterIP field, [more information on dual stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/) | `""` | +| `service.metricsPort` | The metrics port (for Performance Analyzer) that Kubernetes will use for the service. | `9601` | +| `service.metricsPortName` | The name of the metrics port (for Performance Analyzer) within the service | `metrics` | +| `tolerations` | Configurable [tolerations][] | `[]` | | `topologySpreadConstraints` | Configuration for pod [topologySpreadConstraints][] | `[]` | -| `updateStrategy` | The [updateStrategy][] for the StatefulSet. By default Kubernetes will wait for the cluster to be green after upgrading each pod. Setting this to `OnDelete` will allow you to manually delete each pod during upgrades | `RollingUpdate` | -| `extraObjects` | Array of extra K8s manifests to deploy | list `[]` | -| `autoscaling` | Prerequisite: Install/Configure metrics server, to install use `kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml`, See https://github.com/kubernetes-sigs/metrics-server. Configurable pod autoscaling stratergy to scale based on `targetCPUUtilizationPercentage`, configure `minReplicas` and `maxReplicas` for desired scaling | false | -| `livenessProbe` | Configuration fields for the liveness [probe][] | see [exampleLiveness][] in `values.yaml`| -| `readinessProbe` | Configuration fields for the readiness [probe][] | see [exampleReadiness][] in `values.yaml`| -| `startupProbe` | Configuration fields for the startup [probe][] | see [exampleStartup][] in `values.yaml` | -| `plugins.enabled` | Allow/disallow to add 3rd Party / Custom plugins not offered in the default OpenSearchDashboards image | false | -| `plugins.installList` | Array containing the Opensearch Dashboards plugins to be installed in container | [] | -| `opensearchDashboardsYml.defaultMode` | Allow you to set the defaultMode for the opensearch_dashboards.yml mounted as configMap | | -| `dashboardAnnotations` | Allows you to configure custom annotation in the deployement of the OpenSearchDashboards container | {} | +| `updateStrategy` | The [updateStrategy][] for the StatefulSet. By default Kubernetes will wait for the cluster to be green after upgrading each pod. Setting this to `OnDelete` will allow you to manually delete each pod during upgrades | `RollingUpdate` | +| `extraObjects` | Array of extra K8s manifests to deploy | list `[]` | +| `autoscaling.enabled` | Prerequisite: Install/Configure metrics server, to install use `kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml`, See [Metrics Server](https://github.com/kubernetes-sigs/metrics-server). | false | +| `autoscaling.minReplicas` | The lower limit for the number of replicas to which the autoscaler can scale down. | 1 | +| `autoscaling.maxReplicas` | The upper limit for the number of replicas to which the autoscaler can scale up. | 10 | +| `autoscaling.targetCPU` | The target value of the average CPU across all OpenSearch Dashboards pods. | 80 | +| `autoscaling.targetMemory` | The target value of the average memory across all OpenSearch Dashboards pods. Value should be tuned based on the requested memory value for OpenSearch Dashboards pods. Scaling based on memory utilization may be necessary for large datasets or complex dashboards. | 80 | +| `livenessProbe` | Configuration fields for the liveness [probe][] | see [exampleLiveness][] in `values.yaml`| +| `readinessProbe` | Configuration fields for the readiness [probe][] | see [exampleReadiness][] in `values.yaml`| +| `startupProbe` | Configuration fields for the startup [probe][] | see [exampleStartup][] in `values.yaml` | +| `plugins.enabled` | Allow/disallow to add 3rd Party / Custom plugins not offered in the default OpenSearchDashboards image | false | +| `plugins.installList` | Array containing the Opensearch Dashboards plugins to be installed in container | [] | +| `opensearchDashboardsYml.defaultMode` | Allow you to set the defaultMode for the opensearch_dashboards.yml mounted as configMap | | +| `dashboardAnnotations` | Allows you to configure custom annotation in the deployement of the OpenSearchDashboards container | {} | +| `serviceMonitor.enabled` | Enables the creation of a [ServiceMonitor] resource for Prometheus monitoring. Requires the Prometheus Operator to be installed in your Kubernetes cluster. | `false` | +| `serviceMonitor.path` | Path where metrics are exposed. Applicable only if `serviceMonitor.enabled` is set to `true`. | `/_prometheus/metrics` | +| `serviceMonitor.interval` | Interval at which metrics should be scraped by Prometheus. Applicable only if `serviceMonitor.enabled` is set to `true`. | `10s` | -[probe]: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-readiness-probes +[environment from variables]: https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/#configure-all-key-value-pairs-in-a-configmap-as-container-environment-variables + +[values.yaml]:https://github.com/opensearch-project/helm-charts/blob/main/charts/opensearch/values.yaml + +[hostAliases]: https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + +[imagepullPolicy]: https://kubernetes.io/docs/concepts/containers/images/#updating-images +[imagePullSecrets]: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ +[ingress]: https://kubernetes.io/docs/concepts/services-networking/ingress/ +[resources]: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + +[labels]: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + +[nodeSelector]: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector + +[annotations]: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + +[securityContext]: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ +[priorityClass]: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass + +[loadBalancer annotations]: https://kubernetes.io/docs/concepts/services-networking/service/#ssl-support-on-aws +[loadBalancer externalTrafficPolicy]: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip +[loadBalancer]: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer + +[nodePort]: https://kubernetes.io/docs/concepts/services-networking/service/#nodeport + +[tolerations]: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + +[updateStrategy]: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/ + +[service types]: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + +[probe]: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-readiness-probes [exampleStartup]: https://github.com/opensearch-project/helm-charts/blob/main/charts/opensearch-dashboards/values.yaml#17 [exampleLiveness]: https://github.com/opensearch-project/helm-charts/blob/main/charts/opensearch-dashboards/values.yaml#27 [exampleReadiness]: https://github.com/opensearch-project/helm-charts/blob/main/charts/opensearch-dashboards/values.yaml#37 [topologySpreadConstraints]: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints + +[ServiceMonitor]: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#servicemonitor diff --git a/charts/opensearch-dashboards/templates/_helpers.tpl b/charts/opensearch-dashboards/templates/_helpers.tpl index 6c4b60ba..a51f4ec0 100644 --- a/charts/opensearch-dashboards/templates/_helpers.tpl +++ b/charts/opensearch-dashboards/templates/_helpers.tpl @@ -74,6 +74,21 @@ Return the appropriate apiVersion for ingress. {{- end -}} {{- end -}} +{{/* +Return the appropriate apiVersion for Horizontal Pod Autoscaler. +*/}} +{{- define "opensearch-dashboards.hpa.apiVersion" -}} +{{- if $.Capabilities.APIVersions.Has "autoscaling/v2/HorizontalPodAutoscaler" }} +{{- print "autoscaling/v2" }} +{{- else if $.Capabilities.APIVersions.Has "autoscaling/v2beta2/HorizontalPodAutoscaler" }} +{{- print "autoscaling/v2beta2" }} +{{- else if $.Capabilities.APIVersions.Has "autoscaling/v2beta1/HorizontalPodAutoscaler" }} +{{- print "autoscaling/v2beta1" }} +{{- else }} +{{- print "autoscaling/v1" }} +{{- end }} +{{- end }} + {{/* Return if ingress is stable. */}} diff --git a/charts/opensearch-dashboards/templates/autoscaler.yaml b/charts/opensearch-dashboards/templates/autoscaler.yaml index be628442..ff054d39 100644 --- a/charts/opensearch-dashboards/templates/autoscaler.yaml +++ b/charts/opensearch-dashboards/templates/autoscaler.yaml @@ -1,5 +1,5 @@ {{- if .Values.autoscaling.enabled -}} -apiVersion: autoscaling/v1 +apiVersion: {{ include "opensearch-dashboards.hpa.apiVersion" . }} kind: HorizontalPodAutoscaler metadata: name: {{ template "opensearch-dashboards.fullname" . }}-hpa @@ -11,5 +11,33 @@ spec: apiVersion: apps/v1 kind: Deployment name: {{ template "opensearch-dashboards.fullname" . }} - targetCPUUtilizationPercentage: {{ .Values.autoscaling.targetCPUUtilizationPercentage }} -{{- end }} \ No newline at end of file + {{- if eq (include "opensearch-dashboards.hpa.apiVersion" .) "autoscaling/v1" }} + targetCPUUtilizationPercentage: {{ .Values.autoscaling.targetCPUUtilizationPercentage | default .Values.autoscaling.targetCPU }} + {{- else }} + metrics: + {{- if .Values.autoscaling.targetMemory }} + - type: Resource + resource: + name: memory + {{- if eq (include "opensearch-dashboards.hpa.apiVersion" .) "autoscaling/v2beta1" }} + targetAverageUtilization: {{ .Values.autoscaling.targetMemory }} + {{- else }} + target: + type: Utilization + averageUtilization: {{ .Values.autoscaling.targetMemory }} + {{- end }} + {{- end }} + {{- if or .Values.autoscaling.targetCPU .Values.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + {{- if eq (include "opensearch-dashboards.hpa.apiVersion" .) "autoscaling/v2beta1" }} + targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage | default .Values.autoscaling.targetCPU }} + {{- else }} + target: + type: Utilization + averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage | default .Values.autoscaling.targetCPU }} + {{- end }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/opensearch-dashboards/templates/deployment.yaml b/charts/opensearch-dashboards/templates/deployment.yaml index 0103754b..21eaa8e2 100644 --- a/charts/opensearch-dashboards/templates/deployment.yaml +++ b/charts/opensearch-dashboards/templates/deployment.yaml @@ -79,7 +79,7 @@ spec: {{- end }} {{- if .Values.topologySpreadConstraints }} topologySpreadConstraints: -{- toYaml .Values.topologySpreadConstraints | nindent 8 }} +{{- toYaml .Values.topologySpreadConstraints | nindent 8 }} {{- end }} {{- if .Values.imagePullSecrets }} imagePullSecrets: diff --git a/charts/opensearch-dashboards/templates/extraManifests.yaml b/charts/opensearch-dashboards/templates/extraManifests.yaml index d6abe5fb..c169b9d0 100644 --- a/charts/opensearch-dashboards/templates/extraManifests.yaml +++ b/charts/opensearch-dashboards/templates/extraManifests.yaml @@ -1,8 +1,8 @@ {{ range .Values.extraObjects }} --- {{- if typeIs "string" . }} -{{- tpl . $ }} +{{ tpl . $ }} {{- else }} -{{- tpl (toYaml .) $ }} +{{ tpl (toYaml .) $ }} {{- end }} {{ end }} \ No newline at end of file diff --git a/charts/opensearch-dashboards/templates/service.yaml b/charts/opensearch-dashboards/templates/service.yaml index e520f5c1..16962f16 100644 --- a/charts/opensearch-dashboards/templates/service.yaml +++ b/charts/opensearch-dashboards/templates/service.yaml @@ -36,6 +36,9 @@ spec: protocol: TCP name: {{ .Values.service.httpPortName | default "http" }} targetPort: {{ .Values.service.port }} + - name: {{ .Values.service.metricsPortName | default "metrics" }} + protocol: TCP + port: {{ .Values.service.metricsPort }} selector: app: {{ .Chart.Name }} release: {{ .Release.Name | quote }} diff --git a/charts/opensearch-dashboards/templates/serviceMonitor.yaml b/charts/opensearch-dashboards/templates/serviceMonitor.yaml new file mode 100644 index 00000000..ae92805a --- /dev/null +++ b/charts/opensearch-dashboards/templates/serviceMonitor.yaml @@ -0,0 +1,20 @@ +{{- if .Values.serviceMonitor.enabled }} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ template "opensearch-dashboards.fullname" . }}-service-monitor + namespace: {{ .Release.Namespace }} + labels: + {{- include "opensearch-dashboards.labels" . | nindent 4 }} + {{- with .Values.serviceMonitor.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + selector: + matchLabels: + {{- include "opensearch-dashboards.selectorLabels" . | nindent 6 }} + endpoints: + - port: {{ .Values.service.metricsPortName | default "metrics" }} + interval: {{ .Values.serviceMonitor.interval }} + path: {{ .Values.serviceMonitor.path }} +{{- end }} diff --git a/charts/opensearch-dashboards/values.yaml b/charts/opensearch-dashboards/values.yaml index 096c9c01..e62ef4a7 100644 --- a/charts/opensearch-dashboards/values.yaml +++ b/charts/opensearch-dashboards/values.yaml @@ -156,6 +156,7 @@ service: # ipFamilies: # - IPv4 port: 5601 + metricsPort: 9601 loadBalancerIP: "" nodePort: "" labels: {} @@ -163,6 +164,7 @@ service: loadBalancerSourceRanges: [] # 0.0.0.0/0 httpPortName: http + metricsPortName: metrics ingress: enabled: false @@ -199,7 +201,9 @@ autoscaling: enabled: false minReplicas: 1 maxReplicas: 10 - targetCPUUtilizationPercentage: 80 + # The legacy `targetCPUUtilizationPercentage` key has been deprecated in favor of `targetCPU` + targetCPU: "80" + targetMemory: "80" updateStrategy: type: "Recreate" @@ -276,3 +280,22 @@ plugins: # - example-fake-plugin-downloadable-url removeList: [] # - securityDashboards + +# ServiceMonitor Configuration for Prometheus +# Enabling this option will create a ServiceMonitor resource that allows Prometheus to scrape metrics from the OpenSearch service. +serviceMonitor: + # Set to true to enable the ServiceMonitor resource for OpenSearch Dashboards + enabled: false + + # HTTP path where metrics are exposed by OpenSearch Dashboards. + # Ensure this path is correctly set in your service. + path: /_prometheus/metrics + + # Frequency at which Prometheus will scrape metrics. + # Modify as needed for your monitoring requirements. + interval: 10s + + # additional labels to be added to the ServiceMonitor + # labels: + # k8s.example.com/prometheus: kube-prometheus + labels: {} \ No newline at end of file diff --git a/charts/opensearch/CHANGELOG.md b/charts/opensearch/CHANGELOG.md index 0be6735f..cb6b3c5b 100644 --- a/charts/opensearch/CHANGELOG.md +++ b/charts/opensearch/CHANGELOG.md @@ -1,4 +1,5 @@ # Changelog + All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), @@ -12,20 +13,162 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Removed ### Fixed ### Security - --- - +## [2.28.0] +### Added +### Changed +### Deprecated +### Removed +### Fixed +- Fix metricsPort and plugins usage info in values.yaml +### Security +--- +## [2.27.1] +### Added +### Changed +### Deprecated +### Removed +### Fixed +- Remove default opensearch.yml config in Values.yaml to avoid security plugin conflicts +### Security +--- +## [2.27.0] +### Added +- Updated OpenSearch appVersion to 2.18.0 +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [2.26.1] +### Added +### Changed +### Deprecated +### Removed +### Fixed +- Resolved `helm lint` errors with extraObjects +### Security +--- +## [2.26.0] +### Added +- Updated OpenSearch appVersion to 2.17.1 +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [2.25.0] +### Added +- Updated OpenSearch appVersion to 2.17.0 +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [2.24.1] +### Added +- Allow user-defined labels on persistent volume claim +### Changed +### Deprecated +### Removed +### Fixed +### Security +======= +## [2.24.0] +### Added +- Ability to add additional `labels` to `serviceMonitor` +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [2.23.2] +### Added +- Metrics configuration in both `Service` templates +### Changed +### Deprecated +### Removed +### Fixed +- Bug `protocol` missing for metrics in `Service` +### Security +--- +## [2.23.1] +### Added +### Changed +### Deprecated +### Removed +### Fixed +- Fixed `ServiceMonitor` bug for `port` value +### Security +--- +## [2.23.0] +### Added +- Added `ServiceMonitor` support for Prometheus monitoring +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [2.22.1] +### Added +### Changed +### Deprecated +### Removed +### Fixed +- Fixed opensearchJavaOpts defaults in README +### Security +--- +## [2.22.0] +### Added +- Updated OpenSearch appVersion to 2.16.0 +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [2.21.0] +### Added +- Updated OpenSearch appVersion to 2.15.0 +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [2.20.0] +### Added +- Updated OpenSearch appVersion to 2.14.0 +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- +## [2.19.0] +### Added +- Updated OpenSearch appVersion to 2.13.0 +### Changed +### Deprecated +### Removed +### Fixed +### Security +--- ## [2.18.0] ### Added ### Breaking - - Requires an initial admin password to be setup starting from App Version OpenSearch 2.12.0. Refer this github issue: https://github.com/opensearch-project/security/issues/3622 - - Updated OpenSearch appVersion to 2.12.0 +- Requires an initial admin password to be setup starting from App Version OpenSearch 2.12.0. Refer this github issue: https://github.com/opensearch-project/security/issues/3622 +- Updated OpenSearch appVersion to 2.12.0 ### Changed ### Deprecated ### Removed ### Fixed ### Security - --- ## [2.17.3] ### Added @@ -396,8 +539,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed ### Security - -[Unreleased]: https://github.com/opensearch-project/helm-charts/compare/opensearch-2.18.0...HEAD +[Unreleased]: https://github.com/opensearch-project/helm-charts/compare/opensearch-2.28.0...HEAD +[2.28.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-2.27.1...opensearch-2.28.0 +[2.27.1]: https://github.com/opensearch-project/helm-charts/compare/opensearch-2.27.0...opensearch-2.27.1 +[2.27.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-2.26.1...opensearch-2.27.0 +[2.26.1]: https://github.com/opensearch-project/helm-charts/compare/opensearch-2.26.0...opensearch-2.26.1 +[2.26.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-2.25.0...opensearch-2.26.0 +[2.25.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-2.24.1...opensearch-2.25.0 +[2.24.1]: https://github.com/opensearch-project/helm-charts/compare/opensearch-2.24.0...opensearch-2.24.1 +[2.24.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-2.23.1...opensearch-2.24.0 +[2.23.2]: https://github.com/opensearch-project/helm-charts/compare/opensearch-2.23.1...opensearch-2.23.2 +[2.23.1]: https://github.com/opensearch-project/helm-charts/compare/opensearch-2.23.0...opensearch-2.23.1 +[2.23.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-2.22.1...opensearch-2.23.0 +[2.22.1]: https://github.com/opensearch-project/helm-charts/compare/opensearch-2.22.0...opensearch-2.22.1 +[2.22.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-2.21.0...opensearch-2.22.0 +[2.21.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-2.20.0...opensearch-2.21.0 +[2.20.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-2.19.0...opensearch-2.20.0 +[2.19.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-2.18.0...opensearch-2.19.0 [2.18.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-2.17.3...opensearch-2.18.0 [2.17.3]: https://github.com/opensearch-project/helm-charts/compare/opensearch-2.17.2...opensearch-2.17.3 [2.17.2]: https://github.com/opensearch-project/helm-charts/compare/opensearch-2.17.1...opensearch-2.17.2 @@ -437,4 +595,3 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 [2.2.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-2.1.0...opensearch-2.2.0 [2.1.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-2.0.1...opensearch-2.1.0 [2.0.1]: https://github.com/opensearch-project/helm-charts/compare/opensearch-2.0.0...opensearch-2.0.1 - diff --git a/charts/opensearch/Chart.yaml b/charts/opensearch/Chart.yaml index 7959f5c6..8df4f194 100644 --- a/charts/opensearch/Chart.yaml +++ b/charts/opensearch/Chart.yaml @@ -15,17 +15,16 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 2.18.0 +version: 2.28.0 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. # It is recommended to use it with quotes. -appVersion: "2.12.0" +appVersion: "2.18.0" maintainers: - name: DandyDeveloper - - name: bbarani - name: gaiksaya - name: peterzhuamazon - name: prudhvigodithi diff --git a/charts/opensearch/README.md b/charts/opensearch/README.md index 7991d37a..d68f28d3 100644 --- a/charts/opensearch/README.md +++ b/charts/opensearch/README.md @@ -3,16 +3,16 @@ This Helm chart installs [OpenSearch](https://github.com/opensearch-project/OpenSearch) with configurable TLS, RBAC and much more configurations. This chart caters a number of different use cases and setups. - [OpenSearch Helm Chart](#opensearch-helm-chart) - - [Requirements](#requirements) - - [Installing](#installing) - - [Uninstalling](#uninstalling) - - [Configuration](#configuration) +- [Requirements](#requirements) +- [Installing](#installing) +- [Uninstalling](#uninstalling) +- [Configuration](#configuration) ## Requirements -* Kubernetes >= 1.14 -* Helm >= 2.17.0 -* We recommend you to have 8 GiB of memory available for this deployment, or at least 4 GiB for the minimum requirement. Else, the deployment is expected to fail. +- Kubernetes >= 1.14 +- Helm >= 2.17.0 +- We recommend you to have 8 GiB of memory available for this deployment, or at least 4 GiB for the minimum requirement. Else, the deployment is expected to fail. ## Installing @@ -27,6 +27,7 @@ The command deploys OpenSearch with its associated components (data statefulsets **NOTE:** If using Helm 2 then you'll need to add the [`--name`](https://v2.helm.sh/docs/helm/#options-21) command line argument. If unspecified, Helm 2 will autogenerate a name for you. ## Uninstalling + To delete/uninstall the chart with the release name `my-release`: ```shell @@ -35,95 +36,98 @@ helm uninstall my-release ## Configuration -| Parameter | Description | Default | -| ----------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- | -| `antiAffinityTopologyKey` | The [anti-affinity][] topology key. By default this will prevent multiple Opensearch nodes from running on the same Kubernetes node | `kubernetes.io/hostname` | -| `antiAffinity` | Setting this to `hard` enforces the [anti-affinity][] rules. If it is set to `soft` it will be done "best effort". Setting it to `custom` will use whatever is set in the `customAntiAffinity` parameter. Other values will be ignored. | `hard` | -| `clusterName` | This will be used as the OpenSearch cluster name and should be unique per cluster in the namespace | `opensearch-cluster` | -| `customAntiAffinity` | Allows passing in custom anti-affinity settings as defined in the [anti-affinity][] rules. Using this parameter requires setting the `antiAffinity` parameter to `custom`. | `{}` | -| `enableServiceLinks` | Set to false to disabling service links, which can cause slow pod startup times when there are many services in the current namespace. | `true` | -| `envFrom` | Templatable string to be passed to the [environment from variables][] which will be appended to the `envFrom:` definition for the container | `[]` | -| `config` | Allows you to add any config files in `/usr/share/opensearch/config/` such as `opensearch.yml` and `log4j2.properties`. String or map format may be used for specifying content of each configuration file. In case of string format, the whole content of the config file will be replaced by new config file value when in case of using map format content of configuration file will be a result of merge. In both cases content passed through tpl. See [values.yaml][] for an example of the formatting (passed through tpl) | `{}` | -| `opensearchJavaOpts` | Java options for OpenSearch. This is where you should configure the jvm heap size | `-Xmx1g -Xms1g` | -| `majorVersion` | Used to set major version specific configuration. If you are using a custom image and not running the default OpenSearch version you will need to set this to the version you are running (e.g. `majorVersion: 1`) | `""` | -| `global.dockerRegistry` | Set if you want to change the default docker registry, e.g. a private one. | `""` | -| `extraContainers` | Array of extra containers | `""` | -| `extraEnvs` | Extra environments variables to be passed to OpenSearch services | `[]` | -| `extraInitContainers` | Array of extra init containers | `[]` | -| `extraVolumeMounts` | Array of extra volume mounts | `[]` | -| `extraVolumes` | Array of extra volumes to be added | `[]` | -| `fullnameOverride` | Overrides the `clusterName` and `nodeGroup` when used in the naming of resources. This should only be used when using a single `nodeGroup`, otherwise you will have name conflicts | `""` | -| `hostAliases` | Configurable [hostAliases][] | `[]` | -| `httpHostPort` | Expose another http-port as hostPort. Refer to documentation for more information and requirements about using hostPorts. | `""` | -| `httpPort` | The http port that Kubernetes will use for the healthchecks and the service. If you change this you will also need to set `http.port` in `extraEnvs` | `9200` | -| `image.pullPolicy` | The Kubernetes [imagePullPolicy][] value | `IfNotPresent` | -| `imagePullSecrets` | Configuration for [imagePullSecrets][] so that you can use a private registry for your image | `[]` | -| `image.tag` | The OpenSearch Docker image tag | `1.0.0` | -| `image.repository` | The OpenSearch Docker image | `opensearchproject/opensearch` | -| `ingress` | Configurable [ingress][] to expose the OpenSearch service. See [values.yaml][] for an example | see [values.yaml][] | -| `initResources` | Allows you to set the [resources][] for the `initContainer` in the StatefulSet | `{}` | -| `keystore` | Allows you map Kubernetes secrets into the keystore. | `[]` | -| `labels` | Configurable [labels][] applied to all OpenSearch pods | `{}` | -| `masterService` | The service name used to connect to the masters. You only need to set this if your master `nodeGroup` is set to something other than `master` | `""` | -| `maxUnavailable` | The [maxUnavailable][] value for the pod disruption budget. By default this will prevent Kubernetes from having more than 1 unhealthy pod in the node group | `1` | -| `metricsPort` | The metrics port (for Performance Analyzer) that Kubernetes will use for the service. | `9600` | -| `nameOverride` | Overrides the `clusterName` when used in the naming of resources | `""` | -| `networkHost` | Value for the `network.host OpenSearch setting` | `0.0.0.0` | -| `networkPolicy.create` | Enable network policy creation for OpenSearch | `false` | -| `nodeAffinity` | Value for the [node affinity settings][] | `{}` | -| `nodeGroup` | This is the name that will be used for each group of nodes in the cluster. The name will be `clusterName-nodeGroup-X` , `nameOverride-nodeGroup-X` if a `nameOverride` is specified, and `fullnameOverride-X` if a `fullnameOverride` is specified | `master` | -| `nodeSelector` | Configurable [nodeSelector][] so that you can target specific nodes for your OpenSearch cluster | `{}` | -| `persistence` | Enables a persistent volume for OpenSearch data. | see [values.yaml][] | -| `persistence.enableInitChown` | Disable the `fsgroup-volume` initContainer that will update permissions on the persistent disk. | `true` | -| `podAffinity` | Value for the [pod affinity settings][] | `{}` | -| `podAnnotations` | Configurable [annotations][] applied to all OpenSearch pods | `{}` | -| `podManagementPolicy` | By default Kubernetes [deploys StatefulSets serially][]. This deploys them in parallel so that they can discover each other | `Parallel` | -| `podSecurityContext` | Allows you to set the [securityContext][] for the pod | see [values.yaml][] | -| `podSecurityPolicy` | Configuration for create a pod security policy with minimal permissions to run this Helm chart with `create: true`. Also can be used to reference an external pod security policy with `name: "externalPodSecurityPolicy"` | see [values.yaml][] | -| `priorityClassName` | The name of the [PriorityClass][]. No default is supplied as the PriorityClass must be created first | `""` | -| `rbac` | Configuration for creating a role, role binding and ServiceAccount as part of this Helm chart with `create: true`. Also can be used to reference an external ServiceAccount with `serviceAccountName: "externalServiceAccountName"` | see [values.yaml][] | -| `rbac.automountServiceAccountToken` | Controls whether a service account token should be automatically mounted to the Pods. | `true` | -| `replicas` | Kubernetes replica count for the StatefulSet (i.e. how many pods) | `3` | -| `resources` | Allows you to set the [resources][] for the StatefulSet | see [values.yaml][] | -| `roles` | A list of the specific node [roles][] for the `nodeGroup` | see [values.yaml][] | -| `singleNode` | If `discovery.type` in the opensearch configuration is set to `"single-node"`, this should be set to `true`. If `true`, replicas will be forced to `1`. | `false` | -| `schedulerName` | Name of the [alternate scheduler][] | `""` | -| `secretMounts` | Allows you easily mount a secret as a file inside the StatefulSet. Useful for mounting certificates and other secrets. See [values.yaml][] for an example | `[]` | -| `securityConfig` | Configure the opensearch security plugin. There are multiple ways to inject configuration into the chart, see [values.yaml][] details. | By default an insecure demonstration configuration is set. This **must** be changed before going to production. | -| `securityContext` | Allows you to set the [securityContext][] for the container | see [values.yaml][] | -| `service.annotations` | [LoadBalancer annotations][] that Kubernetes will use for the service. This will configure load balancer if `service.type` is `LoadBalancer` | `{}` | -| `service.headless.annotations` | Allow you to set annotations on the headless service | `{}` | -| `service.externalTrafficPolicy` | Some cloud providers allow you to specify the [LoadBalancer externalTrafficPolicy][]. Kubernetes will use this to preserve the client source IP. This will configure load balancer if `service.type` is `LoadBalancer` | `""` | -| `service.httpPortName` | The name of the http port within the service | `http` | -| `service.labelsHeadless` | Labels to be added to headless service | `{}` | -| `service.labels` | Labels to be added to non-headless service | `{}` | -| `service.loadBalancerIP` | Some cloud providers allow you to specify the [loadBalancer][] IP. If the `loadBalancerIP` field is not specified, the IP is dynamically assigned. If you specify a `loadBalancerIP` but your cloud provider does not support the feature, it is ignored. | `""` | -| `service.loadBalancerSourceRanges` | The IP ranges that are allowed to access | `[]` | -| `service.metricsPortName` | The name of the metrics port (for Performance Analyzer) within the service | `metrics` | -| `service.nodePort` | Custom [nodePort][] port that can be set if you are using `service.type: nodePort` | `""` | -| `service.transportPortName` | The name of the transport port within the service | `transport` | -| `service.type` | OpenSearch [Service Types][] | `ClusterIP` | -| `service.ipFamilyPolicy` | This sets the preferred ip addresses in case of a dual-stack server, there are three options [PreferDualStack, SingleStack, RequireDualStack], [more information on dual stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/) | `""` | -| `service.ipFamilies` | Sets the preferred IP variants and in which order they are preferred, the first family you list is used for the legacy .spec.ClusterIP field, [more information on dual stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/) | `""` | -| `sidecarResources` | Allows you to set the [resources][] for the sidecar containers in the StatefulSet | {} | -| `sysctlInit` | Allows you to enable the `sysctlInit` to set sysctl vm.max_map_count through privileged `initContainer`. | `enabled: false` | -| `sysctlVmMaxMapCount` | Sets the [vm.max_map_count][] needed for OpenSearch | `262144` | -| `terminationGracePeriod` | The [terminationGracePeriod][] in seconds used when trying to stop the pod | `120` | -| `tolerations` | Configurable [tolerations][] | `[]` | -| `topologySpreadConstraints` | Configuration for pod [topologySpreadConstraints][] | `[]` | -| `transportHostPort` | Expose another transport port as hostPort. Refer to documentation for more information and requirements about using hostPorts. | `""` | -| `transportPort` | The transport port that Kubernetes will use for the service. If you change this you will also need to set transport port configuration in `extraEnvs` | `9300` | -| `updateStrategy` | The [updateStrategy][] for the StatefulSet. By default Kubernetes will wait for the cluster to be green after upgrading each pod. Setting this to `OnDelete` will allow you to manually delete each pod during upgrades | `RollingUpdate` | -| `volumeClaimTemplate` | Configuration for the [volumeClaimTemplate for StatefulSets][]. You will want to adjust the storage (default `30Gi` ) and the `storageClassName` if you are using a different storage class | see [values.yaml][] | -| `extraObjects` | Array of extra K8s manifests to deploy | list `[]` | -| `livenessProbe` | Configuration fields for the liveness [probe][] | see [exampleLiveness][] in `values.yaml` | -| `readinessProbe` | Configuration fields for the readiness [probe][] | see [exampleReadiness][] in `values.yaml` | -| `startupProbe` | Configuration fields for the startup [probe][] | see [exampleStartup][] in `values.yaml` | -| `plugins.enabled` | Allow/disallow to add 3rd Party / Custom plugins not offered in the default OpenSearchDashboards image | false | -| `plugins.installList` | Array containing the Opensearch Dashboards plugins to be installed in container | \[] | -| `opensearchLifecycle` | Allows you to configure lifecycle hooks for the OpenSearch container in the StatefulSet | {} | -| `lifecycle` | Allows you to configure lifecycle hooks for the OpenSearch container in the StatefulSet | {} | -| `openSearchAnnotations` | Allows you to configure custom annotation in the StatefullSet of the OpenSearch container | {} | +| Parameter | Description | Default | +| :--- | :--- | :--- | +| `antiAffinityTopologyKey` | The [anti-affinity][] topology key. By default this will prevent multiple Opensearch nodes from running on the same Kubernetes node | `kubernetes.io/hostname` | +| `antiAffinity` | Setting this to `hard` enforces the [anti-affinity][] rules. If it is set to `soft` it will be done "best effort". Setting it to `custom` will use whatever is set in the `customAntiAffinity` parameter. Other values will be ignored. | `hard` | +| `clusterName` | This will be used as the OpenSearch cluster name and should be unique per cluster in the namespace | `opensearch-cluster` | +| `customAntiAffinity` | Allows passing in custom anti-affinity settings as defined in the [anti-affinity][] rules. Using this parameter requires setting the `antiAffinity` parameter to `custom`. | `{}` | +| `enableServiceLinks` | Set to false to disabling service links, which can cause slow pod startup times when there are many services in the current namespace. | `true` | +| `envFrom` | Templatable string to be passed to the [environment from variables][] which will be appended to the `envFrom:` definition for the container | `[]` | +| `config` | Allows you to add any config files in `/usr/share/opensearch/config/` such as `opensearch.yml` and `log4j2.properties`. String or map format may be used for specifying content of each configuration file. In case of string format, the whole content of the config file will be replaced by new config file value when in case of using map format content of configuration file will be a result of merge. In both cases content passed through tpl. See [values.yaml][] for an example of the formatting (passed through tpl) | `{}` | +| `opensearchJavaOpts` | Java options for OpenSearch. This is where you should configure the jvm heap size | `-Xmx512M -Xms512M` | +| `majorVersion` | Used to set major version specific configuration. If you are using a custom image and not running the default OpenSearch version you will need to set this to the version you are running (e.g. `majorVersion: 1`) | `""` | +| `global.dockerRegistry` | Set if you want to change the default docker registry, e.g. a private one. | `""` | +| `extraContainers` | Array of extra containers | `""` | +| `extraEnvs` | Extra environments variables to be passed to OpenSearch services | `[]` | +| `extraInitContainers` | Array of extra init containers | `[]` | +| `extraVolumeMounts` | Array of extra volume mounts | `[]` | +| `extraVolumes` | Array of extra volumes to be added | `[]` | +| `fullnameOverride` | Overrides the `clusterName` and `nodeGroup` when used in the naming of resources. This should only be used when using a single `nodeGroup`, otherwise you will have name conflicts | `""` | +| `hostAliases` | Configurable [hostAliases][] | `[]` | +| `httpHostPort` | Expose another http-port as hostPort. Refer to documentation for more information and requirements about using hostPorts. | `""` | +| `httpPort` | The http port that Kubernetes will use for the healthchecks and the service. If you change this you will also need to set `http.port` in `extraEnvs` | `9200` | +| `image.pullPolicy` | The Kubernetes [imagePullPolicy][] value | `IfNotPresent` | +| `imagePullSecrets` | Configuration for [imagePullSecrets][] so that you can use a private registry for your image | `[]` | +| `image.tag` | The OpenSearch Docker image tag | `1.0.0` | +| `image.repository` | The OpenSearch Docker image | `opensearchproject/opensearch` | +| `ingress` | Configurable [ingress][] to expose the OpenSearch service. See [values.yaml][] for an example | see [values.yaml][] | +| `initResources` | Allows you to set the [resources][] for the `initContainer` in the StatefulSet | `{}` | +| `keystore` | Allows you map Kubernetes secrets into the keystore. | `[]` | +| `labels` | Configurable [labels][] applied to all OpenSearch pods | `{}` | +| `masterService` | The service name used to connect to the masters. You only need to set this if your master `nodeGroup` is set to something other than `master` | `""` | +| `maxUnavailable` | The [maxUnavailable][] value for the pod disruption budget. By default this will prevent Kubernetes from having more than 1 unhealthy pod in the node group | `1` | +| `metricsPort` | The metrics port (for Performance Analyzer) that Kubernetes will use for the service. | `9600` | +| `nameOverride` | Overrides the `clusterName` when used in the naming of resources | `""` | +| `networkHost` | Value for the `network.host OpenSearch setting` | `0.0.0.0` | +| `networkPolicy.create` | Enable network policy creation for OpenSearch | `false` | +| `nodeAffinity` | Value for the [node affinity settings][] | `{}` | +| `nodeGroup` | This is the name that will be used for each group of nodes in the cluster. The name will be `clusterName-nodeGroup-X` , `nameOverride-nodeGroup-X` if a `nameOverride` is specified, and `fullnameOverride-X` if a `fullnameOverride` is specified | `master` | +| `nodeSelector` | Configurable [nodeSelector][] so that you can target specific nodes for your OpenSearch cluster | `{}` | +| `persistence` | Enables a persistent volume for OpenSearch data. | see [values.yaml][] | +| `persistence.enableInitChown` | Disable the `fsgroup-volume` initContainer that will update permissions on the persistent disk. | `true` | +| `podAffinity` | Value for the [pod affinity settings][] | `{}` | +| `podAnnotations` | Configurable [annotations][] applied to all OpenSearch pods | `{}` | +| `podManagementPolicy` | By default Kubernetes [deploys StatefulSets serially][]. This deploys them in parallel so that they can discover each other | `Parallel` | +| `podSecurityContext` | Allows you to set the [securityContext][] for the pod | see [values.yaml][] | +| `podSecurityPolicy` | Configuration for create a pod security policy with minimal permissions to run this Helm chart with `create: true`. Also can be used to reference an external pod security policy with `name: "externalPodSecurityPolicy"` | see [values.yaml][] | +| `priorityClassName` | The name of the [PriorityClass][]. No default is supplied as the PriorityClass must be created first | `""` | +| `rbac` | Configuration for creating a role, role binding and ServiceAccount as part of this Helm chart with `create: true`. Also can be used to reference an external ServiceAccount with `serviceAccountName: "externalServiceAccountName"` | see [values.yaml][] | +| `rbac.automountServiceAccountToken` | Controls whether a service account token should be automatically mounted to the Pods. | `true` | +| `replicas` | Kubernetes replica count for the StatefulSet (i.e. how many pods) | `3` | +| `resources` | Allows you to set the [resources][] for the StatefulSet | see [values.yaml][] | +| `roles` | A list of the specific node [roles][] for the `nodeGroup` | see [values.yaml][] | +| `singleNode` | If `discovery.type` in the opensearch configuration is set to `"single-node"`, this should be set to `true`. If `true`, replicas will be forced to `1`. | `false` | +| `schedulerName` | Name of the [alternate scheduler][] | `""` | +| `secretMounts` | Allows you easily mount a secret as a file inside the StatefulSet. Useful for mounting certificates and other secrets. See [values.yaml][] for an example | `[]` | +| `securityConfig` | Configure the opensearch security plugin. There are multiple ways to inject configuration into the chart, see [values.yaml][] details. | By default an insecure demonstration configuration is set. This **must** be changed before going to production. | +| `securityContext` | Allows you to set the [securityContext][] for the container | see [values.yaml][] | +| `service.annotations` | [LoadBalancer annotations][] that Kubernetes will use for the service. This will configure load balancer if `service.type` is `LoadBalancer` | `{}` | +| `service.headless.annotations` | Allow you to set annotations on the headless service | `{}` | +| `service.externalTrafficPolicy` | Some cloud providers allow you to specify the [LoadBalancer externalTrafficPolicy][]. Kubernetes will use this to preserve the client source IP. This will configure load balancer if `service.type` is `LoadBalancer` | `""` | +| `service.httpPortName` | The name of the http port within the service | `http` | +| `service.labelsHeadless` | Labels to be added to headless service | `{}` | +| `service.labels` | Labels to be added to non-headless service | `{}` | +| `service.loadBalancerIP` | Some cloud providers allow you to specify the [loadBalancer][] IP. If the `loadBalancerIP` field is not specified, the IP is dynamically assigned. If you specify a `loadBalancerIP` but your cloud provider does not support the feature, it is ignored. | `""` | +| `service.loadBalancerSourceRanges` | The IP ranges that are allowed to access | `[]` | +| `service.metricsPortName` | The name of the metrics port (for Performance Analyzer) within the service | `metrics` | +| `service.nodePort` | Custom [nodePort][] port that can be set if you are using `service.type: nodePort` | `""` | +| `service.transportPortName` | The name of the transport port within the service | `transport` | +| `service.type` | OpenSearch [Service Types][] | `ClusterIP` | +| `service.ipFamilyPolicy` | This sets the preferred ip addresses in case of a dual-stack server, there are three options [PreferDualStack, SingleStack, RequireDualStack], [more information on dual stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/) | `""` | +| `service.ipFamilies` | Sets the preferred IP variants and in which order they are preferred, the first family you list is used for the legacy .spec.ClusterIP field, [more information on dual stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/) | `""` | +| `sidecarResources` | Allows you to set the [resources][] for the sidecar containers in the StatefulSet | {} | +| `sysctlInit` | Allows you to enable the `sysctlInit` to set sysctl vm.max_map_count through privileged `initContainer`. | `enabled: false` | +| `sysctlVmMaxMapCount` | Sets the [vm.max_map_count][] needed for OpenSearch | `262144` | +| `terminationGracePeriod` | The [terminationGracePeriod][] in seconds used when trying to stop the pod | `120` | +| `tolerations` | Configurable [tolerations][] | `[]` | +| `topologySpreadConstraints` | Configuration for pod [topologySpreadConstraints][] | `[]` | +| `transportHostPort` | Expose another transport port as hostPort. Refer to documentation for more information and requirements about using hostPorts. | `""` | +| `transportPort` | The transport port that Kubernetes will use for the service. If you change this you will also need to set transport port configuration in `extraEnvs` | `9300` | +| `updateStrategy` | The [updateStrategy][] for the StatefulSet. By default Kubernetes will wait for the cluster to be green after upgrading each pod. Setting this to `OnDelete` will allow you to manually delete each pod during upgrades | `RollingUpdate` | +| `volumeClaimTemplate` | Configuration for the [volumeClaimTemplate for StatefulSets][]. You will want to adjust the storage (default `30Gi` ) and the `storageClassName` if you are using a different storage class | see [values.yaml][] | +| `extraObjects` | Array of extra K8s manifests to deploy | list `[]` | +| `livenessProbe` | Configuration fields for the liveness [probe][] | see [exampleLiveness][] in `values.yaml` | +| `readinessProbe` | Configuration fields for the readiness [probe][] | see [exampleReadiness][] in `values.yaml` | +| `startupProbe` | Configuration fields for the startup [probe][] | see [exampleStartup][] in `values.yaml` | +| `plugins.enabled` | Allow/disallow to add 3rd Party / Custom plugins not offered in the default OpenSearchDashboards image | false | +| `plugins.installList` | Array containing the Opensearch Dashboards plugins to be installed in container | \[] | +| `opensearchLifecycle` | Allows you to configure lifecycle hooks for the OpenSearch container in the StatefulSet | {} | +| `lifecycle` | Allows you to configure lifecycle hooks for the OpenSearch container in the StatefulSet | {} | +| `openSearchAnnotations` | Allows you to configure custom annotation in the StatefullSet of the OpenSearch container | {} | +| `serviceMonitor.enabled` | Enables the creation of a [ServiceMonitor] resource for Prometheus monitoring. Requires the Prometheus Operator to be installed in your Kubernetes cluster. | `false` | +| `serviceMonitor.path` | Path where metrics are exposed. Applicable only if `serviceMonitor.enabled` is set to `true`. | `/_prometheus/metrics` | +| `serviceMonitor.interval` | Interval at which metrics should be scraped by Prometheus. Applicable only if `serviceMonitor.enabled` is set to `true`. | `10s` | [anti-affinity]: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity @@ -133,7 +137,7 @@ helm uninstall my-release [hostAliases]: https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ -[image.pullPolicy]: https://kubernetes.io/docs/concepts/containers/images/#updating-images +[imagepullPolicy]: https://kubernetes.io/docs/concepts/containers/images/#updating-images [imagePullSecrets]: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ [ingress]: https://kubernetes.io/docs/concepts/services-networking/ingress/ [resources]: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ @@ -163,12 +167,9 @@ helm uninstall my-release [loadBalancer annotations]: https://kubernetes.io/docs/concepts/services-networking/service/#ssl-support-on-aws [loadBalancer externalTrafficPolicy]: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip [loadBalancer]: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer -[maxUnavailable]: https://kubernetes.io/docs/tasks/run-application/configure-pdb/#specifying-a-poddisruptionbudget [nodePort]: https://kubernetes.io/docs/concepts/services-networking/service/#nodeport -[nodeSelector]: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector - [vm.max_map_count]: https://opensearch.org/docs/opensearch/install/important-settings/ [terminationGracePeriod]: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods @@ -186,3 +187,5 @@ helm uninstall my-release [exampleStartup]: https://github.com/opensearch-project/helm-charts/blob/main/charts/opensearch/values.yaml#332 [exampleLiveness]: https://github.com/opensearch-project/helm-charts/blob/main/charts/opensearch/values.yaml#340 [exampleReadiness]: https://github.com/opensearch-project/helm-charts/blob/main/charts/opensearch/values.yaml#349 + +[ServiceMonitor]: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#servicemonitor diff --git a/charts/opensearch/ci/ci-ingress-class-name-values.yaml b/charts/opensearch/ci/ci-ingress-class-name-values.yaml index c02e2756..d78f930f 100644 --- a/charts/opensearch/ci/ci-ingress-class-name-values.yaml +++ b/charts/opensearch/ci/ci-ingress-class-name-values.yaml @@ -51,47 +51,47 @@ config: # Setting network.host to a non-loopback address enables the annoying bootstrap checks. "Single-node" mode disables them again. # discovery.type: single-node - # Start OpenSearch Security Demo Configuration - # WARNING: revise all the lines below before you go into production - plugins: - security: - ssl: - transport: - pemcert_filepath: esnode.pem - pemkey_filepath: esnode-key.pem - pemtrustedcas_filepath: root-ca.pem - enforce_hostname_verification: false - http: - enabled: true - pemcert_filepath: esnode.pem - pemkey_filepath: esnode-key.pem - pemtrustedcas_filepath: root-ca.pem - allow_unsafe_democertificates: true - allow_default_init_securityindex: true - authcz: - admin_dn: - - CN=kirk,OU=client,O=client,L=test,C=de - audit.type: internal_opensearch - enable_snapshot_restore_privilege: true - check_snapshot_restore_write_privileges: true - restapi: - roles_enabled: ["all_access", "security_rest_api_access"] - system_indices: - enabled: true - indices: - [ - ".opendistro-alerting-config", - ".opendistro-alerting-alert*", - ".opendistro-anomaly-results*", - ".opendistro-anomaly-detector*", - ".opendistro-anomaly-checkpoints", - ".opendistro-anomaly-detection-state", - ".opendistro-reports-*", - ".opendistro-notifications-*", - ".opendistro-notebooks", - ".opendistro-asynchronous-search-response*", - ] - ######## End OpenSearch Security Demo Configuration ######## + # # Start OpenSearch Security Demo Configuration + # # WARNING: revise all the lines below before you go into production + # plugins: + # security: + # ssl: + # transport: + # pemcert_filepath: esnode.pem + # pemkey_filepath: esnode-key.pem + # pemtrustedcas_filepath: root-ca.pem + # enforce_hostname_verification: false + # http: + # enabled: true + # pemcert_filepath: esnode.pem + # pemkey_filepath: esnode-key.pem + # pemtrustedcas_filepath: root-ca.pem + # allow_unsafe_democertificates: true + # allow_default_init_securityindex: true + # authcz: + # admin_dn: + # - CN=kirk,OU=client,O=client,L=test,C=de + # audit.type: internal_opensearch + # enable_snapshot_restore_privilege: true + # check_snapshot_restore_write_privileges: true + # restapi: + # roles_enabled: ["all_access", "security_rest_api_access"] + # system_indices: + # enabled: true + # indices: + # [ + # ".opendistro-alerting-config", + # ".opendistro-alerting-alert*", + # ".opendistro-anomaly-results*", + # ".opendistro-anomaly-detector*", + # ".opendistro-anomaly-checkpoints", + # ".opendistro-anomaly-detection-state", + # ".opendistro-reports-*", + # ".opendistro-notifications-*", + # ".opendistro-notebooks", + # ".opendistro-asynchronous-search-response*", + # ] + # ######## End OpenSearch Security Demo Configuration ######## # log4j2.properties: # Extra environment variables to append to this nodeGroup diff --git a/charts/opensearch/ci/ci-rbac-enabled-values.yaml b/charts/opensearch/ci/ci-rbac-enabled-values.yaml index b2463d55..91b4a595 100755 --- a/charts/opensearch/ci/ci-rbac-enabled-values.yaml +++ b/charts/opensearch/ci/ci-rbac-enabled-values.yaml @@ -51,47 +51,47 @@ config: # Setting network.host to a non-loopback address enables the annoying bootstrap checks. "Single-node" mode disables them again. # discovery.type: single-node - # Start OpenSearch Security Demo Configuration - # WARNING: revise all the lines below before you go into production - plugins: - security: - ssl: - transport: - pemcert_filepath: esnode.pem - pemkey_filepath: esnode-key.pem - pemtrustedcas_filepath: root-ca.pem - enforce_hostname_verification: false - http: - enabled: true - pemcert_filepath: esnode.pem - pemkey_filepath: esnode-key.pem - pemtrustedcas_filepath: root-ca.pem - allow_unsafe_democertificates: true - allow_default_init_securityindex: true - authcz: - admin_dn: - - CN=kirk,OU=client,O=client,L=test,C=de - audit.type: internal_opensearch - enable_snapshot_restore_privilege: true - check_snapshot_restore_write_privileges: true - restapi: - roles_enabled: ["all_access", "security_rest_api_access"] - system_indices: - enabled: true - indices: - [ - ".opendistro-alerting-config", - ".opendistro-alerting-alert*", - ".opendistro-anomaly-results*", - ".opendistro-anomaly-detector*", - ".opendistro-anomaly-checkpoints", - ".opendistro-anomaly-detection-state", - ".opendistro-reports-*", - ".opendistro-notifications-*", - ".opendistro-notebooks", - ".opendistro-asynchronous-search-response*", - ] - ######## End OpenSearch Security Demo Configuration ######## + # # Start OpenSearch Security Demo Configuration + # # WARNING: revise all the lines below before you go into production + # plugins: + # security: + # ssl: + # transport: + # pemcert_filepath: esnode.pem + # pemkey_filepath: esnode-key.pem + # pemtrustedcas_filepath: root-ca.pem + # enforce_hostname_verification: false + # http: + # enabled: true + # pemcert_filepath: esnode.pem + # pemkey_filepath: esnode-key.pem + # pemtrustedcas_filepath: root-ca.pem + # allow_unsafe_democertificates: true + # allow_default_init_securityindex: true + # authcz: + # admin_dn: + # - CN=kirk,OU=client,O=client,L=test,C=de + # audit.type: internal_opensearch + # enable_snapshot_restore_privilege: true + # check_snapshot_restore_write_privileges: true + # restapi: + # roles_enabled: ["all_access", "security_rest_api_access"] + # system_indices: + # enabled: true + # indices: + # [ + # ".opendistro-alerting-config", + # ".opendistro-alerting-alert*", + # ".opendistro-anomaly-results*", + # ".opendistro-anomaly-detector*", + # ".opendistro-anomaly-checkpoints", + # ".opendistro-anomaly-detection-state", + # ".opendistro-reports-*", + # ".opendistro-notifications-*", + # ".opendistro-notebooks", + # ".opendistro-asynchronous-search-response*", + # ] + # ######## End OpenSearch Security Demo Configuration ######## # log4j2.properties: # Extra environment variables to append to this nodeGroup diff --git a/charts/opensearch/ci/ci-values.yaml b/charts/opensearch/ci/ci-values.yaml index fbd24cc8..b09ef89a 100755 --- a/charts/opensearch/ci/ci-values.yaml +++ b/charts/opensearch/ci/ci-values.yaml @@ -51,47 +51,47 @@ config: # Setting network.host to a non-loopback address enables the annoying bootstrap checks. "Single-node" mode disables them again. # discovery.type: single-node - # Start OpenSearch Security Demo Configuration - # WARNING: revise all the lines below before you go into production - plugins: - security: - ssl: - transport: - pemcert_filepath: esnode.pem - pemkey_filepath: esnode-key.pem - pemtrustedcas_filepath: root-ca.pem - enforce_hostname_verification: false - http: - enabled: true - pemcert_filepath: esnode.pem - pemkey_filepath: esnode-key.pem - pemtrustedcas_filepath: root-ca.pem - allow_unsafe_democertificates: true - allow_default_init_securityindex: true - authcz: - admin_dn: - - CN=kirk,OU=client,O=client,L=test,C=de - audit.type: internal_opensearch - enable_snapshot_restore_privilege: true - check_snapshot_restore_write_privileges: true - restapi: - roles_enabled: ["all_access", "security_rest_api_access"] - system_indices: - enabled: true - indices: - [ - ".opendistro-alerting-config", - ".opendistro-alerting-alert*", - ".opendistro-anomaly-results*", - ".opendistro-anomaly-detector*", - ".opendistro-anomaly-checkpoints", - ".opendistro-anomaly-detection-state", - ".opendistro-reports-*", - ".opendistro-notifications-*", - ".opendistro-notebooks", - ".opendistro-asynchronous-search-response*", - ] - ######## End OpenSearch Security Demo Configuration ######## + # # Start OpenSearch Security Demo Configuration + # # WARNING: revise all the lines below before you go into production + # plugins: + # security: + # ssl: + # transport: + # pemcert_filepath: esnode.pem + # pemkey_filepath: esnode-key.pem + # pemtrustedcas_filepath: root-ca.pem + # enforce_hostname_verification: false + # http: + # enabled: true + # pemcert_filepath: esnode.pem + # pemkey_filepath: esnode-key.pem + # pemtrustedcas_filepath: root-ca.pem + # allow_unsafe_democertificates: true + # allow_default_init_securityindex: true + # authcz: + # admin_dn: + # - CN=kirk,OU=client,O=client,L=test,C=de + # audit.type: internal_opensearch + # enable_snapshot_restore_privilege: true + # check_snapshot_restore_write_privileges: true + # restapi: + # roles_enabled: ["all_access", "security_rest_api_access"] + # system_indices: + # enabled: true + # indices: + # [ + # ".opendistro-alerting-config", + # ".opendistro-alerting-alert*", + # ".opendistro-anomaly-results*", + # ".opendistro-anomaly-detector*", + # ".opendistro-anomaly-checkpoints", + # ".opendistro-anomaly-detection-state", + # ".opendistro-reports-*", + # ".opendistro-notifications-*", + # ".opendistro-notebooks", + # ".opendistro-asynchronous-search-response*", + # ] + # ######## End OpenSearch Security Demo Configuration ######## # log4j2.properties: # Extra environment variables to append to this nodeGroup diff --git a/charts/opensearch/templates/extraManifests.yaml b/charts/opensearch/templates/extraManifests.yaml index d6abe5fb..c169b9d0 100644 --- a/charts/opensearch/templates/extraManifests.yaml +++ b/charts/opensearch/templates/extraManifests.yaml @@ -1,8 +1,8 @@ {{ range .Values.extraObjects }} --- {{- if typeIs "string" . }} -{{- tpl . $ }} +{{ tpl . $ }} {{- else }} -{{- tpl (toYaml .) $ }} +{{ tpl (toYaml .) $ }} {{- end }} {{ end }} \ No newline at end of file diff --git a/charts/opensearch/templates/service.yaml b/charts/opensearch/templates/service.yaml index 4c28b2f3..78a6b074 100644 --- a/charts/opensearch/templates/service.yaml +++ b/charts/opensearch/templates/service.yaml @@ -32,6 +32,9 @@ spec: - name: {{ .Values.service.transportPortName | default "transport" }} protocol: TCP port: {{ .Values.transportPort }} + - name: {{ .Values.service.metricsPortName | default "metrics" }} + protocol: TCP + port: {{ .Values.metricsPort }} {{- if .Values.service.loadBalancerIP }} loadBalancerIP: {{ .Values.service.loadBalancerIP }} {{- end }} diff --git a/charts/opensearch/templates/serviceMonitor.yaml b/charts/opensearch/templates/serviceMonitor.yaml new file mode 100644 index 00000000..f4bd8418 --- /dev/null +++ b/charts/opensearch/templates/serviceMonitor.yaml @@ -0,0 +1,20 @@ +{{- if .Values.serviceMonitor.enabled }} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ template "opensearch.uname" . }}-service-monitor + namespace: {{ .Release.Namespace }} + labels: + {{- include "opensearch.labels" . | nindent 4 }} + {{- with .Values.serviceMonitor.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + selector: + matchLabels: + {{- include "opensearch.selectorLabels" . | nindent 6 }} + endpoints: + - port: {{ .Values.service.httpPortName | default "http" }} + interval: {{ .Values.serviceMonitor.interval }} + path: {{ .Values.serviceMonitor.path }} +{{- end }} diff --git a/charts/opensearch/templates/statefulset.yaml b/charts/opensearch/templates/statefulset.yaml index dff761dc..d87e4724 100644 --- a/charts/opensearch/templates/statefulset.yaml +++ b/charts/opensearch/templates/statefulset.yaml @@ -27,9 +27,14 @@ spec: volumeClaimTemplates: - metadata: name: {{ template "opensearch.uname" . }} - {{- if .Values.persistence.labels.enabled }} + {{- if or .Values.persistence.labels.enabled .Values.persistence.labels.additionalLabels }} labels: - {{- include "opensearch.labels" . | nindent 8 }} + {{- if .Values.persistence.labels.enabled }} + {{- include "opensearch.labels" . | nindent 8 }} + {{- end }} + {{- with .Values.persistence.labels.additionalLabels }} + {{- toYaml . | nindent 8 }} + {{- end }} {{- end }} {{- with .Values.persistence.annotations }} annotations: diff --git a/charts/opensearch/values.yaml b/charts/opensearch/values.yaml index c6fd760d..9703c9dc 100644 --- a/charts/opensearch/values.yaml +++ b/charts/opensearch/values.yaml @@ -58,44 +58,44 @@ config: # Start OpenSearch Security Demo Configuration # WARNING: revise all the lines below before you go into production - plugins: - security: - ssl: - transport: - pemcert_filepath: esnode.pem - pemkey_filepath: esnode-key.pem - pemtrustedcas_filepath: root-ca.pem - enforce_hostname_verification: false - http: - enabled: true - pemcert_filepath: esnode.pem - pemkey_filepath: esnode-key.pem - pemtrustedcas_filepath: root-ca.pem - allow_unsafe_democertificates: true - allow_default_init_securityindex: true - authcz: - admin_dn: - - CN=kirk,OU=client,O=client,L=test,C=de - audit.type: internal_opensearch - enable_snapshot_restore_privilege: true - check_snapshot_restore_write_privileges: true - restapi: - roles_enabled: ["all_access", "security_rest_api_access"] - system_indices: - enabled: true - indices: - [ - ".opendistro-alerting-config", - ".opendistro-alerting-alert*", - ".opendistro-anomaly-results*", - ".opendistro-anomaly-detector*", - ".opendistro-anomaly-checkpoints", - ".opendistro-anomaly-detection-state", - ".opendistro-reports-*", - ".opendistro-notifications-*", - ".opendistro-notebooks", - ".opendistro-asynchronous-search-response*", - ] + # plugins: + # security: + # ssl: + # transport: + # pemcert_filepath: esnode.pem + # pemkey_filepath: esnode-key.pem + # pemtrustedcas_filepath: root-ca.pem + # enforce_hostname_verification: false + # http: + # enabled: true + # pemcert_filepath: esnode.pem + # pemkey_filepath: esnode-key.pem + # pemtrustedcas_filepath: root-ca.pem + # allow_unsafe_democertificates: true + # allow_default_init_securityindex: true + # authcz: + # admin_dn: + # - CN=kirk,OU=client,O=client,L=test,C=de + # audit.type: internal_opensearch + # enable_snapshot_restore_privilege: true + # check_snapshot_restore_write_privileges: true + # restapi: + # roles_enabled: ["all_access", "security_rest_api_access"] + # system_indices: + # enabled: true + # indices: + # [ + # ".opendistro-alerting-config", + # ".opendistro-alerting-alert*", + # ".opendistro-anomaly-results*", + # ".opendistro-anomaly-detector*", + # ".opendistro-anomaly-checkpoints", + # ".opendistro-anomaly-detection-state", + # ".opendistro-reports-*", + # ".opendistro-notifications-*", + # ".opendistro-notebooks", + # ".opendistro-asynchronous-search-response*", + # ] ######## End OpenSearch Security Demo Configuration ######## # log4j2.properties: @@ -205,6 +205,8 @@ persistence: labels: # Add default labels for the volumeClaimTemplate of the StatefulSet enabled: false + # Add custom labels for the volumeClaimTemplate of the StatefulSet + additionalLabels: {} # OpenSearch Persistent Volume Storage Class # If defined, storageClassName: # If set to "-", storageClassName: "", which disables dynamic provisioning @@ -531,3 +533,28 @@ extraObjects: [] # selector: # matchLabels: # {{- include "opensearch.selectorLabels" . | nindent 6 }} + +# ServiceMonitor Configuration for Prometheus +# Enabling this option will create a ServiceMonitor resource that allows Prometheus to scrape metrics from the OpenSearch service. +# This only creates the serviceMonitor, to actually have metrics Make sure to install the prometheus-exporter plugin needed for +# serving metrics over the `.Values.plugins` value: +# plugins: +# enabled: true +# installList: +# - https://github.com/aiven/prometheus-exporter-plugin-for-opensearch/releases/download/x.x.x.x/prometheus-exporter-x.x.x.x.zip +serviceMonitor: + # Set to true to enable the ServiceMonitor resource + enabled: false + + # HTTP path where metrics are exposed. + # Ensure this matches your OpenSearch service configuration. + path: /_prometheus/metrics + + # Frequency at which Prometheus will scrape metrics. + # Adjust based on your needs. + interval: 10s + + # additional labels to be added to the ServiceMonitor + # labels: + # k8s.example.com/prometheus: kube-prometheus + labels: {}