[apm-server] use new elasticsearch credentials (#1399)

This commit updates apm-server values to use the new Elasticsearch credentials from #1384. Relates to #1375
elastic · Oct 12, 2021 · 10dc561 · 10dc561
1 parent a5fdd4f
commit 10dc561
Show file tree

Hide file tree

Showing 6 changed files with 64 additions and 48 deletions.
diff --git a/apm-server/README.md b/apm-server/README.md
@@ -91,7 +91,7 @@ as a reference. They are also used in the automated testing of this chart.
 | `autoscaling`               | Enable the [horizontal pod autoscaler][]                                                                                                                   | see [values.yaml][]                |
 | `envFrom`                   | Templatable string to be passed to the [environment from variables][] which will be appended to the `envFrom:` definition for the container                | `[]`                               |
 | `extraContainers`           | Templatable string of additional containers to be passed to the `tpl` function                                                                             | `""`                               |
-| `extraEnvs`                 | Extra [environment variables][] which will be appended to the `env:` definition for the container                                                          | `[]`                               |
+| `extraEnvs`                 | Extra [environment variables][] which will be appended to the `env:` definition for the container                                                          | see [values.yaml][]                |
 | `extraInitContainers`       | Templatable string of additional containers to be passed to the `tpl` function                                                                             | `""`                               |
 | `extraVolumeMounts`         | List of additional `volumeMounts`                                                                                                                          | `[]`                               |
 | `extraVolumes`              | List of additional `volumes`                                                                                                                               | `[]`                               |

diff --git a/apm-server/examples/oss/test/goss.yaml b/apm-server/examples/oss/test/goss.yaml
@@ -3,9 +3,11 @@ http:
     status: 200
     timeout: 2000
     body:
-      - '8.0.0'
+      - "8.0.0"
   http://elasticsearch-master:9200/_cat/indices:
     status: 200
     timeout: 2000
+    username: "{{ .Env.ELASTICSEARCH_USERNAME }}"
+    password: "{{ .Env.ELASTICSEARCH_PASSWORD }}"
     body:
-      - 'apm-oss-8.0.0'
+      - "apm-oss-8.0.0"
diff --git a/apm-server/examples/oss/values.yaml b/apm-server/examples/oss/values.yaml
@@ -11,6 +11,8 @@ apmConfig:
 
     output.elasticsearch:
       hosts: ["http://elasticsearch-master:9200"]
+      username: "${ELASTICSEARCH_USERNAME}"
+      password: "${ELASTICSEARCH_PASSWORD}"
       index: "apm-oss-%{[observer.version]}-%{+yyyy.MM.dd}"
 
     setup.template.name: "apm-server"

diff --git a/apm-server/examples/security/values.yaml b/apm-server/examples/security/values.yaml
@@ -17,13 +17,13 @@ secretMounts:
     path: /usr/share/apm-server/config/certs
 
 extraEnvs:
-  - name: 'ELASTICSEARCH_USERNAME'
+  - name: "ELASTICSEARCH_USERNAME"
     valueFrom:
       secretKeyRef:
-        name: elastic-credentials
+        name: security-master-credentials
         key: username
-  - name: 'ELASTICSEARCH_PASSWORD'
+  - name: "ELASTICSEARCH_PASSWORD"
     valueFrom:
       secretKeyRef:
-        name: elastic-credentials
+        name: security-master-credentials
         key: password
diff --git a/apm-server/examples/upgrade/values.yaml b/apm-server/examples/upgrade/values.yaml
@@ -10,3 +10,17 @@ apmConfig:
 
     output.elasticsearch:
       hosts: ["http://upgrade-master:9200"]
+      username: "${ELASTICSEARCH_USERNAME}"
+      password: "${ELASTICSEARCH_PASSWORD}"
+
+extraEnvs:
+  - name: "ELASTICSEARCH_USERNAME"
+    valueFrom:
+      secretKeyRef:
+        name: upgrade-master-credentials
+        key: username
+  - name: "ELASTICSEARCH_PASSWORD"
+    valueFrom:
+      secretKeyRef:
+        name: upgrade-master-credentials
+        key: password
diff --git a/apm-server/values.yaml b/apm-server/values.yaml
@@ -9,10 +9,8 @@ apmConfig:
 
     output.elasticsearch:
       hosts: ["http://elasticsearch-master:9200"]
-      ## If you have security enabled- you'll need to add the credentials
-      ## as environment variables
-      # username: "${ELASTICSEARCH_USERNAME}"
-      # password: "${ELASTICSEARCH_PASSWORD}"
+      username: "${ELASTICSEARCH_USERNAME}"
+      password: "${ELASTICSEARCH_PASSWORD}"
       ## If SSL is enabled
       # protocol: https
       # ssl.certificate_authorities:
@@ -33,17 +31,17 @@ extraInitContainers: ""
 # Extra environment variables to append to the DaemonSet pod spec.
 # This will be appended to the current 'env:' key. You can use any of the kubernetes env
 # syntax here
-extraEnvs: []
-  #  - name: 'ELASTICSEARCH_USERNAME'
-  #    valueFrom:
-  #      secretKeyRef:
-  #        name: elastic-credentials
-  #        key: username
-  #  - name: 'ELASTICSEARCH_PASSWORD'
-  #    valueFrom:
-  #      secretKeyRef:
-  #        name: elastic-credentials
-  #        key: password
+extraEnvs:
+  - name: "ELASTICSEARCH_USERNAME"
+    valueFrom:
+      secretKeyRef:
+        name: elasticsearch-master-credentials
+        key: username
+  - name: "ELASTICSEARCH_PASSWORD"
+    valueFrom:
+      secretKeyRef:
+        name: elasticsearch-master-credentials
+        key: password
 
 # Allows you to load environment variables from kubernetes secret or config map
 envFrom: []
@@ -53,13 +51,13 @@ envFrom: []
 #     name: config-map
 
 extraVolumeMounts: []
-  # - name: extras
-  #   mountPath: /usr/share/extras
-  #   readOnly: true
+# - name: extras
+#   mountPath: /usr/share/extras
+#   readOnly: true
 
 extraVolumes: []
-  # - name: extras
-  #   emptyDir: {}
+# - name: extras
+#   emptyDir: {}
 
 hostAliases: []
 #- ip: "127.0.0.1"
@@ -76,7 +74,7 @@ imagePullSecrets: []
 managedServiceAccount: true
 
 podAnnotations: {}
-  # iam.amazonaws.com/role: es-cluster
+# iam.amazonaws.com/role: es-cluster
 
 # additionals labels
 labels: {}
@@ -111,19 +109,19 @@ readinessProbe:
   timeoutSeconds: 5
 
 resources:
-    requests:
-      cpu: "100m"
-      memory: "100Mi"
-    limits:
-      cpu: "1000m"
-      memory: "512Mi"
+  requests:
+    cpu: "100m"
+    memory: "100Mi"
+  limits:
+    cpu: "1000m"
+    memory: "512Mi"
 
 # Custom service account override that the pod will use
 serviceAccount: ""
 
 # Annotations to add to the ServiceAccount that is created if the serviceAccount value isn't set.
 serviceAccountAnnotations: {}
-  # eks.amazonaws.com/role-arn: arn:aws:iam::111111111111:role/k8s.clustername.namespace.serviceaccount
+# eks.amazonaws.com/role-arn: arn:aws:iam::111111111111:role/k8s.clustername.namespace.serviceaccount
 
 # A list of secrets and their paths to mount inside the pod
 secretMounts: []
@@ -160,8 +158,8 @@ autoscaling:
 ingress:
   enabled: false
   annotations: {}
-    # kubernetes.io/ingress.class: nginx
-    # kubernetes.io/tls-acme: "true"
+  # kubernetes.io/ingress.class: nginx
+  # kubernetes.io/tls-acme: "true"
   path: /
   hosts:
     - chart-example.local
@@ -176,16 +174,16 @@ service:
   port: 8200
   nodePort: ""
   annotations: {}
-    # cloud.google.com/load-balancer-type: "Internal"
-    # service.beta.kubernetes.io/aws-load-balancer-internal: 0.0.0.0/0
-    # service.beta.kubernetes.io/azure-load-balancer-internal: "true"
-    # service.beta.kubernetes.io/openstack-internal-load-balancer: "true"
-    # service.beta.kubernetes.io/cce-load-balancer-internal-vpc: "true"
+  # cloud.google.com/load-balancer-type: "Internal"
+  # service.beta.kubernetes.io/aws-load-balancer-internal: 0.0.0.0/0
+  # service.beta.kubernetes.io/azure-load-balancer-internal: "true"
+  # service.beta.kubernetes.io/openstack-internal-load-balancer: "true"
+  # service.beta.kubernetes.io/cce-load-balancer-internal-vpc: "true"
 
 lifecycle: {}
-  # preStop:
-  #   exec:
-  #     command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"]
-  # postStart:
-  #   exec:
-  #     command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"]
+# preStop:
+#   exec:
+#     command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"]
+# postStart:
+#   exec:
+#     command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"]