62 lines
1.9 KiB
YAML
62 lines
1.9 KiB
YAML
# Anonymous auth: Kibana logs into ES as credentials.username using the password from Secret
|
|
# kibana-anonymous-sso (required; anonymous cannot work without it). Must match that ES user.
|
|
# Google SSO is only at the ingress (oauth2-proxy). See kibana-anonymous-sso.example.yaml.
|
|
apiVersion: kibana.k8s.elastic.co/v1
|
|
kind: Kibana
|
|
metadata:
|
|
name: kibana-eck-observability-prd
|
|
namespace: eck-observability-prd
|
|
spec:
|
|
version: 9.3.1
|
|
secureSettings:
|
|
- secretName: kibana-anonymous-sso
|
|
config:
|
|
server.publicBaseUrl: http://kibana-prd-observability.prd.meesho.int
|
|
monitoring.ui.ccs.enabled: false
|
|
xpack.security.authc.providers:
|
|
anonymous.anonymous1:
|
|
order: 0
|
|
credentials:
|
|
username: kibana-anonymous-viewer
|
|
password: "${xpack.security.authc.providers.anonymous.anonymous1.credentials.password}"
|
|
basic.basic1:
|
|
order: 1
|
|
count: 1
|
|
elasticsearchRef:
|
|
name: eck-observability-prd
|
|
podTemplate:
|
|
metadata:
|
|
annotations:
|
|
cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
|
|
spec:
|
|
tolerations:
|
|
- effect: NoSchedule
|
|
key: elastic-observability-common-nodes
|
|
operator: Equal
|
|
value: "true"
|
|
nodeSelector:
|
|
elastic-observability-common-nodes: "true"
|
|
containers:
|
|
- name: kibana
|
|
# Override ECK's default readiness probe (/login → 404 when anonymous auth is enabled).
|
|
# /api/status returns 200 whenever Kibana is healthy, regardless of auth config.
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /api/status
|
|
port: 5601
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 10
|
|
failureThreshold: 3
|
|
resources:
|
|
requests:
|
|
memory: 25Gi
|
|
cpu: 10
|
|
limits:
|
|
memory: 25Gi
|
|
cpu: 13
|
|
|
|
http:
|
|
tls:
|
|
selfSignedCertificate:
|
|
disabled: true
|