Several improvements (pires#160)

* Removed redundant privileges * Remove double quotes * Use named ports * Add rollout to instructions to wait for things to be deployed * Adopt quay.io/pires/docker-elasticsearch-curator * Pin busybox image
tainnsre · Dec 20, 2017 · 24466a4 · 24466a4
1 parent fda27f9
commit 24466a4
Show file tree

Hide file tree

Showing 10 changed files with 69 additions and 93 deletions.
diff --git a/README.md b/README.md
@@ -64,17 +64,16 @@ Providing one's own version of [the images automatically built from this reposit
 kubectl create -f es-discovery-svc.yaml
 kubectl create -f es-svc.yaml
 kubectl create -f es-master.yaml
-```
-
-Wait until `es-master` deployment is provisioned, and
-```
+kubectl rollout status -f es-master.yaml
 kubectl create -f es-client.yaml
+kubectl rollout status -f es-client.yaml
 kubectl create -f es-data.yaml
+kubectl rollout status -f es-data.yaml
 ```
 
-Wait for containers to be in the `Running` state and check one of the Elasticsearch master nodes logs:
+Check one of the Elasticsearch master nodes logs:
 ```
-$ kubectl get svc,deployment,pods
+$ kubectl get svc,deployment,pods -l component=elasticsearch
 NAME                          TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)    AGE
 svc/elasticsearch             ClusterIP   10.100.35.143    <none>        9200/TCP   6m
 svc/elasticsearch-discovery   ClusterIP   10.100.247.154   <none>        9300/TCP   6m

diff --git a/es-client.yaml b/es-client.yaml
@@ -15,21 +15,16 @@ spec:
     spec:
       initContainers:
       - name: init-sysctl
-        image: busybox
-        imagePullPolicy: IfNotPresent
-        command: ["sysctl", "-w", "vm.max_map_count=262144"]
+        image: busybox:1.27.2
+        command:
+        - sysctl
+        - -w
+        - vm.max_map_count=262144
         securityContext:
           privileged: true
       containers:
       - name: es-client
-        securityContext:
-          privileged: false
-          capabilities:
-            add:
-              - IPC_LOCK
-              - SYS_RESOURCE
         image: quay.io/pires/docker-elasticsearch-kubernetes:6.1.0
-        imagePullPolicy: Always
         env:
         - name: NAMESPACE
           valueFrom:
@@ -39,32 +34,30 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.name
-        - name: "CLUSTER_NAME"
-          value: "myesdb"
+        - name: CLUSTER_NAME
+          value: myesdb
         - name: NODE_MASTER
           value: "false"
         - name: NODE_DATA
           value: "false"
         - name: HTTP_ENABLE
           value: "true"
-        - name: "ES_JAVA_OPTS"
-          value: "-Xms256m -Xmx256m"
-        - name: "NETWORK_HOST"
-          value: "_site_,_lo_"
+        - name: ES_JAVA_OPTS
+          value: -Xms256m -Xmx256m
+        - name: NETWORK_HOST
+          value: _site_,_lo_
         ports:
         - containerPort: 9200
           name: http
-          protocol: TCP
         - containerPort: 9300
           name: transport
-          protocol: TCP
         livenessProbe:
           tcpSocket:
-            port: 9300
+            port: transport
         readinessProbe:
           httpGet:
             path: /_cluster/health
-            port: 9200
+            port: http
           initialDelaySeconds: 20
           timeoutSeconds: 5
         volumeMounts:
@@ -73,4 +66,4 @@ spec:
       volumes:
           - emptyDir:
               medium: ""
-            name: "storage"
+            name: storage
diff --git a/es-curator_v1beta1.yaml b/es-curator_v1beta1.yaml
@@ -10,8 +10,11 @@ spec:
         spec:
           containers:
           - name: curator
-            image: bobrik/curator
-            args: ["--config", "/etc/config/config.yml", "/etc/config/action_file.yml"]
+            image: quay.io/pires/docker-elasticsearch-curator:5.4.1
+            args:
+            - --config
+            - /etc/config/config.yml
+            - /etc/config/action_file.yml
             volumeMounts:
               - name: config-volume
                 mountPath: /etc/config

diff --git a/es-curator_v2alpha1.yaml b/es-curator_v2alpha1.yaml
@@ -10,8 +10,11 @@ spec:
         spec:
           containers:
           - name: curator
-            image: bobrik/curator
-            args: ["--config", "/etc/config/config.yml", "/etc/config/action_file.yml"]
+            image: quay.io/pires/docker-elasticsearch-curator:5.4.1
+            args:
+            - --config
+            - /etc/config/config.yml
+            - /etc/config/action_file.yml
             volumeMounts:
               - name: config-volume
                 mountPath: /etc/config

diff --git a/es-data.yaml b/es-data.yaml
@@ -15,21 +15,16 @@ spec:
     spec:
       initContainers:
       - name: init-sysctl
-        image: busybox
-        imagePullPolicy: IfNotPresent
-        command: ["sysctl", "-w", "vm.max_map_count=262144"]
+        image: busybox:1.27.2
+        command:
+        - sysctl
+        - -w
+        - vm.max_map_count=262144
         securityContext:
           privileged: true
       containers:
       - name: es-data
-        securityContext:
-          privileged: false
-          capabilities:
-            add:
-              - IPC_LOCK
-              - SYS_RESOURCE
         image: quay.io/pires/docker-elasticsearch-kubernetes:6.1.0
-        imagePullPolicy: Always
         env:
         - name: NAMESPACE
           valueFrom:
@@ -39,23 +34,22 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.name
-        - name: "CLUSTER_NAME"
-          value: "myesdb"
+        - name: CLUSTER_NAME
+          value: myesdb
         - name: NODE_MASTER
           value: "false"
         - name: NODE_INGEST
           value: "false"
         - name: HTTP_ENABLE
           value: "false"
-        - name: "ES_JAVA_OPTS"
-          value: "-Xms256m -Xmx256m"
+        - name: ES_JAVA_OPTS
+          value: -Xms256m -Xmx256m
         ports:
         - containerPort: 9300
           name: transport
-          protocol: TCP
         livenessProbe:
           tcpSocket:
-            port: 9300
+            port: transport
           initialDelaySeconds: 20
           periodSeconds: 10
         volumeMounts:
@@ -64,4 +58,4 @@ spec:
       volumes:
           - emptyDir:
               medium: ""
-            name: "storage"
+            name: storage
diff --git a/es-master.yaml b/es-master.yaml
@@ -15,21 +15,16 @@ spec:
     spec:
       initContainers:
       - name: init-sysctl
-        image: busybox
-        imagePullPolicy: IfNotPresent
-        command: ["sysctl", "-w", "vm.max_map_count=262144"]
+        image: busybox:1.27.2
+        command:
+        - sysctl
+        - -w
+        - vm.max_map_count=262144
         securityContext:
           privileged: true
       containers:
       - name: es-master
-        securityContext:
-          privileged: false
-          capabilities:
-            add:
-              - IPC_LOCK
-              - SYS_RESOURCE
         image: quay.io/pires/docker-elasticsearch-kubernetes:6.1.0
-        imagePullPolicy: Always
         env:
         - name: NAMESPACE
           valueFrom:
@@ -39,9 +34,9 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.name
-        - name: "CLUSTER_NAME"
-          value: "myesdb"
-        - name: "NUMBER_OF_MASTERS"
+        - name: CLUSTER_NAME
+          value: myesdb
+        - name: NUMBER_OF_MASTERS
           value: "2"
         - name: NODE_MASTER
           value: "true"
@@ -51,15 +46,14 @@ spec:
           value: "false"
         - name: HTTP_ENABLE
           value: "false"
-        - name: "ES_JAVA_OPTS"
-          value: "-Xms256m -Xmx256m"
+        - name: ES_JAVA_OPTS
+          value: -Xms256m -Xmx256m
         ports:
         - containerPort: 9300
           name: transport
-          protocol: TCP
         livenessProbe:
           tcpSocket:
-            port: 9300
+            port: transport
         volumeMounts:
         - name: storage
           mountPath: /data

diff --git a/es-svc.yaml b/es-svc.yaml
@@ -12,5 +12,4 @@ spec:
   ports:
   - name: http
     port: 9200
-    protocol: TCP
 #type: LoadBalancer
diff --git a/kibana-svc.yaml b/kibana-svc.yaml
@@ -2,13 +2,12 @@ apiVersion: v1
 kind: Service
 metadata:
   name: kibana
-  namespace: default
   labels:
     component: kibana
 spec:
   selector:
     component: kibana
   ports:
-  - port: 80
-    targetPort: 5601
-    protocol: TCP
+  - name: http
+    port: 80
+    targetPort: http
diff --git a/kibana.yaml b/kibana.yaml
@@ -2,7 +2,6 @@ apiVersion: apps/v1beta1
 kind: Deployment
 metadata:
   name: kibana
-  namespace: default
   labels:
     component: kibana
 spec:
@@ -19,8 +18,8 @@ spec:
       - name: kibana
         image: cfontes/kibana-xpack-less:5.5.0
         env:
-        - name: "CLUSTER_NAME"
-          value: "myesdb"
+        - name: CLUSTER_NAME
+          value: myesdb
         - name: SERVER_BASEPATH
           value: /api/v1/proxy/namespaces/default/services/kibana
         - name: XPACK_SECURITY_ENABLED
@@ -38,5 +37,4 @@ spec:
             cpu: 100m
         ports:
         - containerPort: 5601
-          name: kibana
-          protocol: TCP
+          name: http
diff --git a/stateful/es-data-stateful.yaml b/stateful/es-data-stateful.yaml
@@ -16,20 +16,16 @@ spec:
     spec:
       initContainers:
       - name: init-sysctl
-        image: busybox
-        imagePullPolicy: IfNotPresent
-        command: ["sysctl", "-w", "vm.max_map_count=262144"]
+        image: busybox:1.27.2
+        command:
+        - sysctl
+        - -w
+        - vm.max_map_count=262144
         securityContext:
           privileged: true
       containers:
       - name: es-data
-        securityContext:
-          privileged: true
-          capabilities:
-            add:
-              - IPC_LOCK
         image: quay.io/pires/docker-elasticsearch-kubernetes:6.1.0
-        imagePullPolicy: Always
         env:
         - name: NAMESPACE
           valueFrom:
@@ -39,23 +35,22 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.name
-        - name: "CLUSTER_NAME"
-          value: "myesdb"
+        - name: CLUSTER_NAME
+          value: myesdb
         - name: NODE_MASTER
           value: "false"
         - name: NODE_INGEST
           value: "false"
         - name: HTTP_ENABLE
           value: "false"
-        - name: "ES_JAVA_OPTS"
-          value: "-Xms256m -Xmx256m"
+        - name: ES_JAVA_OPTS
+          value: -Xms256m -Xmx256m
         ports:
         - containerPort: 9300
           name: transport
-          protocol: TCP
         livenessProbe:
           tcpSocket:
-            port: 9300
+            port: transport
           initialDelaySeconds: 20
           periodSeconds: 10
         volumeMounts:
@@ -64,10 +59,9 @@ spec:
   volumeClaimTemplates:
   - metadata:
       name: storage
-      annotations:
-        volume.beta.kubernetes.io/storage-class: standard
     spec:
-      accessModes: [ "ReadWriteOnce" ]
+      storageClassName: standard
+      accessModes: [ ReadWriteOnce ]
       resources:
         requests:
           storage: 12Gi