NOT FOR PRODUCTION USE

dev

Partially based on https://www.elastic.co/docs/deploy-manage/deploy/self-managed/install-elasticsearch-docker-compose

Local two-node Elasticsearch cluster for development, run with Docker Compose. Generates its own CA + node certificates on first start and seeds a few example roles and users via the Security API.

There is no Kibana service in this compose file — the kibana_system password is configured so you can run Kibana in dev mode and point it at this cluster.

Layout

• docker-compose.yml — setup (CA + cert generation, sets kibana_system password), es01, es02 (HTTP + transport TLS, security enabled).
• docker-compose.saml.yml — opt-in override that adds a SAML "Mock IdP" realm to es01/es02 for local Kibana with mockIdpPlugin enabled (see SAML Mock IdP).
• .env — STACK_VERSION, ELASTIC_PASSWORD, KIBANA_PASSWORD, CLUSTER_NAME, LICENSE (basic or trial), ES_PORT, MEM_LIMIT.
• create-users.sh — POSTs roles (data_user, dev_reporting_user, discover_read_only) and users (test_user, discover_read_only_user) to https://localhost:9200.
• certs/ — generated by the setup service on first run; gitignored.
• saml/metadata.xml, saml/roles.yml — pre-generated IdP metadata and stateful built-in roles, mounted into ES when the SAML override is used.

Usage

Start the cluster:

docker compose up -d

es01 is exposed on https://localhost:${ES_PORT} (default 9200). The CA cert is written to certs/ca/ca.crt; use it (or curl -k) to talk to the cluster:

curl --cacert certs/ca/ca.crt -u elastic:changeme https://localhost:9200

Seed example roles and users (cluster must be up):

./create-users.sh

Stop and wipe data:

docker compose down -v

SAML Mock IdP

To run local Kibana (yarn start) with the SAML provider that the Mock IdP plugin drives, bring the cluster up with the SAML override:

docker compose -f docker-compose.yml -f docker-compose.saml.yml up -d

This adds a cloud-saml-kibana SAML realm to both ES nodes, mounts a pre-generated saml/metadata.xml (signed with Kibana's dev cert from @kbn/dev-utils) and the stateful built-in roles (viewer, editor, admin, system_indices_superuser) via saml/roles.yml. A saml-setup one-shot container then creates the mock-idp-mapping role mapping that maps the SAML groups attribute to ES roles — this is what kbn-es would normally do when starting ES via yarn es snapshot. Kibana is assumed to be reachable at http://localhost:5601/kbn — that base path comes from MOCK_IDP_KIBANA_BASE_PATH and Kibana auto-applies it when mockIdpPlugin is enabled, so just run:

yarn start

Requires LICENSE=trial in .env (SAML is not available on basic). Without -f docker-compose.saml.yml the cluster comes up exactly as before, with no SAML realm — pair that with yarn start --mockIdpPlugin.enabled=false if Kibana would otherwise auto-configure the SAML provider.

If you change the Kibana URL or base path, regenerate saml/metadata.xml and update the sp.entity_id / sp.acs / sp.logout URLs in docker-compose.saml.yml to match.

Notes

• Default passwords in .env are changeme. Change them before exposing the cluster anywhere non-local.
• Bumping STACK_VERSION against an existing data01/data02 volume can fail — docker compose down -v to start clean.
• If cert generation gets into a bad state, delete certs/ and bring the stack back up; the setup service will regenerate everything.