all-in-one.yaml

#Trial license , stored in the ECK namespace
apiVersion: v1
kind: Secret
metadata:
  name: eck-trial-license
  namespace: elastic-system
  labels:
    license.k8s.elastic.co/type: enterprise_trial
  annotations:
    elastic.co/eula: accepted

---
#A namespace for all the elastic components
apiVersion: v1
kind: Namespace
metadata:
  name: devoops

---  
#Elasticsearch password (elastic:elastic)
apiVersion: v1
data:
  elastic: ZWxhc3RpYw==
kind: Secret
metadata: 
  name: esdev-es-elastic-user
  namespace: devoops
type: Opaque

---
#Elastic search 
apiVersion: elasticsearch.k8s.elastic.co/v1
kind: Elasticsearch
metadata:
  name: esdev
  namespace: devoops
spec:
  version: 8.15.3
  nodeSets:
  - name: default
    count: 1
    podTemplate:
      spec:
        containers:
        - name: elasticsearch
          env:
          - name: ES_JAVA_OPTS
            value: -Xms1g -Xmx1g
          resources:
            requests:
              memory: 2Gi
              cpu: 1
            limits:
              memory: 2Gi    
    config:
      # most Elasticsearch configuration parameters are possible to set, e.g: node.attr.attr_name: attr_value
      node.roles: ["master", "data", "ingest", "ml"]
      # this allows ES to run on nodes even if their vm.max_map_count has not been increased, at a performance cost
      node.store.allow_mmap: false
---
#Kibana with SSL disabled
apiVersion: kibana.k8s.elastic.co/v1
kind: Kibana
metadata:
  name: kbdev
  namespace: devoops
spec:
  version: 8.15.3
  count: 1
  config: 
    server.rewriteBasePath: true
    server.basePath: "/kibana"
    server.publicBaseUrl: "http://kubernetes.docker.internal/kibana"  
    xpack.fleet.packages:
    - name: apm
      version: latest
  http:
    tls:
      selfSignedCertificate:
        disabled: true
  podTemplate:
    spec:
      containers:
      - name: kibana
        readinessProbe:
          httpGet:
            scheme: HTTP
            path: /kibana
            port: 5601
        env:
          - name: NODE_OPTIONS
            value: "--max-old-space-size=2048"
        resources:
          requests:
            memory: 2Gi
            cpu: 1
          limits:
            memory: 2Gi
            cpu: 1 
  elasticsearchRef:
    name: "esdev"
---
#APM server, with RUM enabled
apiVersion: apm.k8s.elastic.co/v1
kind: ApmServer
metadata:
  name: apmdev
  namespace: devoops
spec:
  version: 8.15.3
  count: 1
  config:
    apm-server.auth.secret_token: "devoops!"
    apm-server.kibana.path: "/kibana"
    apm-server.ssl.enabled: false
    apm-server.kibana.ssl.enabled: false  
    apm-server.kibana.username: "elastic"
    apm-server.kibana.password: "elastic" #TODO , get this from secrets
    apm-server.rum.enabled: true
    apm-server.rum.allow_origins: [ '*' ]
    apm-server.rum.library_pattern: "node_modules|bower_components|~"
    apm-server.rum.exclude_from_grouping: "^/webpack"
    apm-server.rum.source_mapping.enabled: true
    apm-server.rum.source_mapping.cache.expiration: 5m
    apm-server.rum.source_mapping.index_pattern: "apm-*-sourcemap*"
  http:
    tls:
      selfSignedCertificate:
         disabled: true    
  podTemplate:
    spec:
      containers:
      - name: apm-server
        resources:
          requests:
            memory: 2Gi
            cpu: 1
          limits:
            memory: 2Gi
            cpu: 1  
  elasticsearchRef:
    name: "esdev"
  # this allows ECK to configure automatically the Kibana endpoint as described in https://www.elastic.co/guide/en/apm/server/current/setup-kibana-endpoint.html
  kibanaRef:
    name: "kbdev"

---
#File beat with SSL disabled
apiVersion: beat.k8s.elastic.co/v1beta1
kind: Beat
metadata:
  name: beatdev
  namespace: devoops
spec:
  type: filebeat
  version: 8.15.3
  elasticsearchRef:
    name: esdev
  kibanaRef:
    name: kbdev
  config:
    setup.kibana.path: /kibana
    setup.kibana.ssl.enabled: false
    filebeat:
      ssl:
        verificationMode: none
      autodiscover:
        providers:
          - type: kubernetes
            node: ${NODE_NAME}
            hints:
              enabled: true
              default_config:
                type: container
                paths:
                  - /var/log/containers/*${data.kubernetes.container.id}.log
    processors:
      - drop_event:
          when:
            or:
              - equals:
                  kubernetes.namespace: "kube-system"
              - equals:
                  kubernetes.namespace: "elastic-system"
              - equals:
                  kubernetes.namespace: "devoops"
              - regexp:
                  kubernetes.pod.name: "ingress-nginx-*"

      - add_cloud_metadata: {}
      - add_host_metadata: {}
  daemonSet:
    podTemplate:
      spec:
        serviceAccountName: filebeat
        automountServiceAccountToken: true
        terminationGracePeriodSeconds: 30
        dnsPolicy: ClusterFirstWithHostNet
        hostNetwork: true # Allows to provide richer host metadata
        containers:
          - name: filebeat
            securityContext:
              runAsUser: 0
            volumeMounts:
              - name: varlogcontainers
                mountPath: /var/log/containers
              - name: varlogpods
                mountPath: /var/log/pods
              - name: varlibdockercontainers
                mountPath: /var/lib/docker/containers
            env:
              - name: NODE_NAME
                valueFrom:
                  fieldRef:
                    fieldPath: spec.nodeName
        volumes:
          - name: varlogcontainers
            hostPath:
              path: /var/log/containers
          - name: varlogpods
            hostPath:
              path: /var/log/pods
          - name: varlibdockercontainers
            hostPath:
              path: /var/lib/docker/containers
---
#Filebeat cluster role
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: filebeat
  namespace: devoops
rules:
  - apiGroups: ['*']
    resources: ['*']
    verbs: ['*']
---
#Filebeat service account
apiVersion: v1
kind: ServiceAccount
metadata:
  name: filebeat
  namespace: devoops
---
#Role bindings for file beat
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: filebeat
  namespace: devoops
subjects:
  - kind: ServiceAccount
    name: filebeat
    namespace: devoops
roleRef:
  kind: ClusterRole
  name: filebeat
  apiGroup: rbac.authorization.k8s.io
---
#Ingress for Kibana
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: kbdev-kb-http-ingress
  namespace: devoops
spec:
  ingressClassName: nginx
  rules:
    - host: kubernetes.docker.internal
      http:
        paths:
          - backend:
              service:
                name: kbdev-kb-http
                port:
                  number: 5601
            path: /kibana
            pathType: Prefix

---
#Ingress for APM http server
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: apm-http-ingress
  namespace: devoops
  annotations:
    nginx.ingress.kubernetes.io/use-regex: "true"
    nginx.ingress.kubernetes.io/rewrite-target: /$2
spec:
  ingressClassName: nginx
  rules:
    - host: kubernetes.docker.internal
      http:
        paths:
          - backend:
              service:
                name: apmdev-apm-http
                port:
                  number: 8200
            path: /apm(/|$)(.*)
            pathType: ImplementationSpecific