# Anonymous auth: Kibana logs into ES as credentials.username using the password from Secret
# kibana-anonymous-sso (required; anonymous cannot work without it). Must match that ES user.
# Google SSO is only at the ingress (oauth2-proxy). See kibana-anonymous-sso.example.yaml.
apiVersion: kibana.k8s.elastic.co/v1
kind: Kibana
metadata:
  name: kibana-eck-observability-prd
  namespace: eck-observability-prd
spec:
  version: 9.3.1
  secureSettings:
    - secretName: kibana-anonymous-sso
  config:
    server.publicBaseUrl: http://kibana-prd-observability.prd.meesho.int
    monitoring.ui.ccs.enabled: false
    xpack.security.authc.providers:
      anonymous.anonymous1:
        order: 0
        credentials:
          username: kibana-anonymous-viewer
          password: "${xpack.security.authc.providers.anonymous.anonymous1.credentials.password}"
      basic.basic1:
        order: 1
  count: 1
  elasticsearchRef:
    name: eck-observability-prd
  podTemplate:
    metadata:
      annotations:
        cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
    spec:
      tolerations:
        - effect: NoSchedule
          key: elastic-observability-common-nodes
          operator: Equal
          value: "true"
      nodeSelector:
        elastic-observability-common-nodes: "true"
      containers:
        - name: kibana
          # Override ECK's default readiness probe (/login → 404 when anonymous auth is enabled).
          # /api/status returns 200 whenever Kibana is healthy, regardless of auth config.
          readinessProbe:
            httpGet:
              path: /api/status
              port: 5601
            initialDelaySeconds: 30
            periodSeconds: 10
            failureThreshold: 3
          resources:
            requests:
              memory: 25Gi
              cpu: 10
            limits:
              memory: 25Gi
              cpu: 13

  http:
    tls:
      selfSignedCertificate:
        disabled: true