elasticsearch.yaml

apiVersion: elasticsearch.k8s.elastic.co/v1
kind: Elasticsearch
metadata:
  name: {{ .Release.Name }}-elasticsearch
spec:
  version: {{ .Values.elasticVersion }}
  image: {{ .Values.elasticsearch.image }}:{{ default .Values.elasticVersion  .Values.elasticsearch.imageTag }}
  auth:
    roles:
    - secretName: logstash-writer-role-secret
    - secretName: user-monitoring-role-secret
    fileRealm:
    - secretName: logstash-writer-secret
    - secretName: user-monitoring-secret
  nodeSets:
  {{- range .Values.elasticsearch.nodeSets }}
  - name: {{ .name }}
    count: {{ .count}}
    config: 
      xpack.security.authc.token.enabled: true
      http.cors.enabled : true
      http.cors.allow-origin : "*"
      http.cors.allow-methods : OPTIONS, HEAD, GET, POST, PUT, DELETE
      http.cors.allow-headers: "kbn-version, Origin, X-Requested-With, Content-Type, Accept, Engaged-Auth-Token"
      xpack.security.enabled: true
      xpack.security.http.ssl.enabled: true
      xpack.security.http.ssl.key: /usr/share/elasticsearch/config/certs/tls.key
      xpack.security.http.ssl.certificate: /usr/share/elasticsearch/config/certs/tls.crt
      xpack.security.http.ssl.certificate_authorities: [ "/usr/share/elasticsearch/config/certs/ca.crt" ]
      xpack.monitoring.collection.enabled: true
    volumeClaimTemplates:
      - metadata:
          name: elasticsearch-data 
        spec:
          accessModes:
          - ReadWriteOnce
          resources:
            requests:
              storage: {{ .diskSpace }}
          storageClassName: {{ .storageClassName }}
    podTemplate:
      metadata:
        labels:
          stack-namespace: {{$.Release.Namespace}} 
      spec:
        initContainers:
        - name: sysctl
          imagePullPolicy: Always
          command: ["/bin/bash", "-c"]
          args:
            - |
              sysctl -w vm.max_map_count=2628576 &&
              sysctl -w net.ipv4.tcp_retries2=5 &&
              sysctl -w vm.swappiness=1 
          securityContext:
            runAsUser: 0
            runAsGroup: 0
            runAsNonRoot: false
            privileged: true
        containers:
        - name: elasticsearch
          volumeMounts:
          - name: certs
            mountPath: /usr/share/elasticsearch/config/certs
          imagePullPolicy: Always
          securityContext:
            #runAsUser: 0
            #runAsGroup: 0
            runAsNonRoot: true
          {{- with .resources }}