diff options
6 files changed, 258 insertions, 16 deletions
diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/config/elasticsearch.yml b/kubernetes/aai/charts/aai-elasticsearch/resources/config/elasticsearch.yml index 3f3c109af8..24b3c5aefc 100644 --- a/kubernetes/aai/charts/aai-elasticsearch/resources/config/elasticsearch.yml +++ b/kubernetes/aai/charts/aai-elasticsearch/resources/config/elasticsearch.yml @@ -80,11 +80,11 @@ node.max_local_storage_nodes: 1 # Set the number of shards (splits) of an index (5 by default): -index.number_of_shards: 5 +#index.number_of_shards: 5 # Set the number of replicas (additional copies) of an index (1 by default): -index.number_of_replicas: 1 +#index.number_of_replicas: 1 # These settings directly affect the performance of index and search operations # in your cluster. Assuming you have enough machines to hold shards and @@ -116,13 +116,13 @@ index.number_of_replicas: 1 # Path to directory where to store index data allocated for this node. # Use swm auto link to redirect the data directory if necessary. -#path.data: /opt/app/elasticsearch/data +path.data: /usr/share/elasticsearch/data # path.data: /path/to/data1,/path/to/data2 # path.work: /path/to/work -#path.logs: /opt/app/elasticsearch/logs +path.logs: /usr/share/elasticsearch/logs #path.plugins: /opt/app/elasticsearch/plugins @@ -141,7 +141,7 @@ index.number_of_replicas: 1 # # Set this property to true to lock the memory: default is true -bootstrap.mlockall: true +#bootstrap.memory_lock: true # Make sure that the ES_MIN_MEM and ES_MAX_MEM environment variables are set # to the same value, and that the machine has enough memory to allocate @@ -150,6 +150,28 @@ bootstrap.mlockall: true # You should also make sure that the Elasticsearch process is allowed to lock # the memory, eg. by using `ulimit -l unlimited`. +### Kernel Settings + +# Elasticsearch installs system call filters of various flavors depending on the +# operating system (e.g., seccomp on Linux). These system call filters are +# installed to prevent the ability to execute system calls related to forking +# as a defense mechanism against arbitrary code execution attacks on +# Elasticsearch The system call filter check ensures that if system call +# filters are enabled, then they were successfully installed. To pass the system +# call filter check you must either fix any configuration errors on your system +# that prevented system call filters from installing (check your logs), or at +# your own risk disable system call filters by setting +# bootstrap.system_call_filter to false. +# See: https://www.elastic.co/guide/en/elasticsearch/reference/current/system-call-filter-check.html +# +# seccomp is found in Linux kernels: 2.6.37–2.6.39, 3.0–3.19, 4.0–4.9, +# 4.10-rc+HEAD +# +# The default setting is to disable the filters assuming an older kernel +# version where seccomp is not available. +# See: https://discuss.elastic.co/t/elasticsearch-warn-unable-to-install-syscall-filter/42819 + +bootstrap.system_call_filter: false ############################## Network And HTTP ############################### # Elasticsearch, by default, binds itself to the 0.0.0.0 address, and listens @@ -252,7 +274,7 @@ indices.recovery.max_bytes_per_sec: 20mb # recovering a shard from a peer: # # indices.recovery.concurrent_streams: 5 -indices.recovery.concurrent_streams: 5 +#indices.recovery.concurrent_streams: 5 ################################## Discovery ################################## @@ -269,8 +291,8 @@ discovery.zen.minimum_master_nodes: 1 # Set this option to a higher value on a slow or congested network # to minimize discovery failures: # -# discovery.zen.ping.timeout: 3s -discovery.zen.ping.timeout: +# discovery.zen.ping_timeout: 3s +discovery.zen.ping_timeout: 3s # For more information, see # <http://elasticsearch.org/guide/en/elasticsearch/reference/current/modules-discovery-zen.html> @@ -281,7 +303,7 @@ discovery.zen.ping.timeout: # # 1. Disable multicast discovery (enabled by default): # discovery.zen.ping.multicast.enabled: false -discovery.zen.ping.multicast.enabled: false +#discovery.zen.ping.multicast.enabled: false # 2. Configure an initial list of master nodes in the cluster @@ -413,3 +435,11 @@ discovery.zen.ping.unicast.hosts: ["0.0.0.0"] ##################################################### #X#security.manager.enabled: false #X#searchguard.authcz.admin_dn: + +##################################################### +##### X-Pack Configuration +##################################################### +xpack.security.enabled: false +xpack.ml.enabled: false +xpack.monitoring.enabled: false +xpack.watcher.enabled: false diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/config/jvm.options b/kubernetes/aai/charts/aai-elasticsearch/resources/config/jvm.options new file mode 100644 index 0000000000..e69d7983c0 --- /dev/null +++ b/kubernetes/aai/charts/aai-elasticsearch/resources/config/jvm.options @@ -0,0 +1,117 @@ +# Copyright © 2018 Amdocs, AT&T, Bell Canada +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +## JVM configuration + +################################################################ +## IMPORTANT: JVM heap size +################################################################ +## +## You should always set the min and max JVM heap +## size to the same value. For example, to set +## the heap to 4 GB, set: +## +## -Xms4g +## -Xmx4g +## +## See https://www.elastic.co/guide/en/elasticsearch/reference/current/heap-size.html +## for more information +## +################################################################ + +# Xms represents the initial size of total heap space +# Xmx represents the maximum size of total heap space + +-Xms1g +-Xmx1g + +################################################################ +## Expert settings +################################################################ +## +## All settings below this section are considered +## expert settings. Don't tamper with them unless +## you understand what you are doing +## +################################################################ + +## GC configuration +-XX:+UseConcMarkSweepGC +-XX:CMSInitiatingOccupancyFraction=75 +-XX:+UseCMSInitiatingOccupancyOnly + +## optimizations + +# pre-touch memory pages used by the JVM during initialization +-XX:+AlwaysPreTouch + +## basic + +# force the server VM +-server + +# explicitly set the stack size +-Xss1m + +# set to headless, just in case +-Djava.awt.headless=true + +# ensure UTF-8 encoding by default (e.g. filenames) +-Dfile.encoding=UTF-8 + +# use our provided JNA always versus the system one +-Djna.nosys=true + +# turn off a JDK optimization that throws away stack traces for common +# exceptions because stack traces are important for debugging +-XX:-OmitStackTraceInFastThrow + +# flags to configure Netty +-Dio.netty.noUnsafe=true +-Dio.netty.noKeySetOptimization=true +-Dio.netty.recycler.maxCapacityPerThread=0 + +# log4j 2 +-Dlog4j.shutdownHookEnabled=false +-Dlog4j2.disable.jmx=true + +## heap dumps + +# generate a heap dump when an allocation from the Java heap fails +# heap dumps are created in the working directory of the JVM +-XX:+HeapDumpOnOutOfMemoryError + +# specify an alternative path for heap dumps +# ensure the directory exists and has sufficient space +#-XX:HeapDumpPath=/heap/dump/path + +## GC logging + +#-XX:+PrintGCDetails +#-XX:+PrintGCTimeStamps +#-XX:+PrintGCDateStamps +#-XX:+PrintClassHistogram +#-XX:+PrintTenuringDistribution +#-XX:+PrintGCApplicationStoppedTime + +# log GC status to a file with time stamps +# ensure the directory exists +#-Xloggc:${loggc} + +# By default, the GC log file will not rotate. +# By uncommenting the lines below, the GC log file +# will be rotated every 128MB at most 32 times. +#-XX:+UseGCLogFileRotation +#-XX:NumberOfGCLogFiles=32 +#-XX:GCLogFileSize=128M diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/config/log4j2.properties b/kubernetes/aai/charts/aai-elasticsearch/resources/config/log4j2.properties new file mode 100644 index 0000000000..e674865221 --- /dev/null +++ b/kubernetes/aai/charts/aai-elasticsearch/resources/config/log4j2.properties @@ -0,0 +1,88 @@ +# Copyright © 2018 Amdocs, AT&T, Bell Canada +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +status = error + +# log action execution errors for easier debugging +logger.action.name = org.elasticsearch.action +logger.action.level = INFO + +appender.console.type = Console +appender.console.name = console +appender.console.layout.type = PatternLayout +appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] %marker%m%n + +appender.rolling.type = RollingFile +appender.rolling.name = rolling +appender.rolling.fileName = ${sys:es.logs.base_path}.log +appender.rolling.layout.type = PatternLayout +appender.rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] %marker%.10000m%n +appender.rolling.filePattern = ${sys:es.logs.base_path}-%d{yyyy-MM-dd}.log +appender.rolling.policies.type = Policies +appender.rolling.policies.time.type = TimeBasedTriggeringPolicy +appender.rolling.policies.time.interval = 1 +appender.rolling.policies.time.modulate = true + +rootLogger.level = info +rootLogger.appenderRef.console.ref = console +rootLogger.appenderRef.rolling.ref = rolling + +# appender.deprecation_rolling.type = RollingFile +# appender.deprecation_rolling.name = deprecation_rolling +# appender.deprecation_rolling.fileName = ${sys:es.logs.base_path}_deprecation.log +# appender.deprecation_rolling.layout.type = PatternLayout +# appender.deprecation_rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] %marker%.10000m%n +# appender.deprecation_rolling.filePattern = ${sys:es.logs.base_path}_deprecation-%i.log.gz +# appender.deprecation_rolling.policies.type = Policies +# appender.deprecation_rolling.policies.size.type = SizeBasedTriggeringPolicy +# appender.deprecation_rolling.policies.size.size = 1GB +# appender.deprecation_rolling.strategy.type = DefaultRolloverStrategy +# appender.deprecation_rolling.strategy.max = 4 + +# logger.deprecation.name = org.elasticsearch.deprecation +# logger.deprecation.level = warn +# logger.deprecation.appenderRef.deprecation_rolling.ref = deprecation_rolling +# logger.deprecation.additivity = false + +appender.index_search_slowlog_rolling.type = RollingFile +appender.index_search_slowlog_rolling.name = index_search_slowlog_rolling +appender.index_search_slowlog_rolling.fileName = ${sys:es.logs.base_path}_index_search_slowlog.log +appender.index_search_slowlog_rolling.layout.type = PatternLayout +appender.index_search_slowlog_rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c] %marker%.10000m%n +appender.index_search_slowlog_rolling.filePattern = ${sys:es.logs.base_path}_index_search_slowlog-%d{yyyy-MM-dd}.log +appender.index_search_slowlog_rolling.policies.type = Policies +appender.index_search_slowlog_rolling.policies.time.type = TimeBasedTriggeringPolicy +appender.index_search_slowlog_rolling.policies.time.interval = 1 +appender.index_search_slowlog_rolling.policies.time.modulate = true + +logger.index_search_slowlog_rolling.name = index.search.slowlog +logger.index_search_slowlog_rolling.level = trace +logger.index_search_slowlog_rolling.appenderRef.index_search_slowlog_rolling.ref = index_search_slowlog_rolling +logger.index_search_slowlog_rolling.additivity = false + +appender.index_indexing_slowlog_rolling.type = RollingFile +appender.index_indexing_slowlog_rolling.name = index_indexing_slowlog_rolling +appender.index_indexing_slowlog_rolling.fileName = ${sys:es.logs.base_path}_index_indexing_slowlog.log +appender.index_indexing_slowlog_rolling.layout.type = PatternLayout +appender.index_indexing_slowlog_rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c] %marker%.10000m%n +appender.index_indexing_slowlog_rolling.filePattern = ${sys:es.logs.base_path}_index_indexing_slowlog-%d{yyyy-MM-dd}.log +appender.index_indexing_slowlog_rolling.policies.type = Policies +appender.index_indexing_slowlog_rolling.policies.time.type = TimeBasedTriggeringPolicy +appender.index_indexing_slowlog_rolling.policies.time.interval = 1 +appender.index_indexing_slowlog_rolling.policies.time.modulate = true + +logger.index_indexing_slowlog.name = index.indexing.slowlog.index +logger.index_indexing_slowlog.level = trace +logger.index_indexing_slowlog.appenderRef.index_indexing_slowlog_rolling.ref = index_indexing_slowlog_rolling +logger.index_indexing_slowlog.additivity = false diff --git a/kubernetes/aai/charts/aai-elasticsearch/templates/configmap.yaml b/kubernetes/aai/charts/aai-elasticsearch/templates/configmap.yaml index 4fe634c838..c60b8f2da8 100644 --- a/kubernetes/aai/charts/aai-elasticsearch/templates/configmap.yaml +++ b/kubernetes/aai/charts/aai-elasticsearch/templates/configmap.yaml @@ -25,5 +25,5 @@ metadata: release: {{ .Release.Name }} heritage: {{ .Release.Service }} data: -{{ tpl (.Files.Glob "resources/config/elasticsearch.yml").AsConfig . | indent 2 }} +{{ tpl (.Files.Glob "resources/config/*").AsConfig . | indent 2 }} #{{ end }} diff --git a/kubernetes/aai/charts/aai-elasticsearch/templates/deployment.yaml b/kubernetes/aai/charts/aai-elasticsearch/templates/deployment.yaml index a6c93b8ea0..24cdb921b2 100644 --- a/kubernetes/aai/charts/aai-elasticsearch/templates/deployment.yaml +++ b/kubernetes/aai/charts/aai-elasticsearch/templates/deployment.yaml @@ -39,9 +39,10 @@ spec: - /bin/sh - -c - | - mkdir -p /logroot/elasticsearch/es-data - chmod -R 777 /logroot/elasticsearch/es-data - chown -R root:root /logroot + mkdir -p /logroot/elasticsearch/logs + mkdir -p /logroot/elasticsearch/data + chmod -R 777 /logroot/elasticsearch + chown -R 1000:1000 /logroot env: - name: NAMESPACE valueFrom: @@ -59,7 +60,7 @@ spec: hostname: {{ include "common.name" . }} containers: - name: {{ include "common.name" . }} - image: {{ .Values.global.dockerhubRepository | default .Values.dockerhubRepository }}/{{ .Values.image }} + image: {{ .Values.global.loggingRepository | default .Values.loggingRepository }}/{{ .Values.image }} imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} ports: - containerPort: {{ .Values.service.internalPort }} @@ -84,6 +85,12 @@ spec: - name: elasticsearch-config subPath: elasticsearch.yml mountPath: /usr/share/elasticsearch/config/elasticsearch.yml + - name: elasticsearch-config + subPath: jvm.options + mountPath: /usr/share/elasticsearch/config/jvm.options + - name: elasticsearch-config + subPath: log4j2.properties + mountPath: /usr/share/elasticsearch/config/log4j2.properties - name: elasticsearch-data mountPath: /usr/share/elasticsearch/data resources: diff --git a/kubernetes/aai/charts/aai-elasticsearch/values.yaml b/kubernetes/aai/charts/aai-elasticsearch/values.yaml index a800c4e7d5..8eb4d279bd 100644 --- a/kubernetes/aai/charts/aai-elasticsearch/values.yaml +++ b/kubernetes/aai/charts/aai-elasticsearch/values.yaml @@ -19,8 +19,8 @@ global: # global defaults nodePortPrefix: 302 # application image -dockerhubRepository: docker.io -image: elasticsearch:2.4.1 +loggingRepository: docker.elastic.co +image: elasticsearch/elasticsearch:6.1.2 pullPolicy: Always flavor: small |