diff --git a/k8s/infra/databases/opensearch.yaml b/k8s/infra/databases/opensearch.yaml index 091c7d9..847d73a 100644 --- a/k8s/infra/databases/opensearch.yaml +++ b/k8s/infra/databases/opensearch.yaml @@ -183,7 +183,6 @@ spec: securityContext: runAsNonRoot: true runAsUser: 1000 - fsGroup: 1000 capabilities: drop: - ALL @@ -236,6 +235,168 @@ spec: - podSelector: matchLabels: app.kubernetes.io/name: poimen-memory + - podSelector: + matchLabels: + app.kubernetes.io/name: opensearch-dashboards ports: - protocol: TCP port: 9200 + +--- + +# OpenSearch Dashboards: UI for monitoring, querying, and managing OpenSearch +apiVersion: v1 +kind: Service +metadata: + name: opensearch-dashboards + namespace: poimen + labels: + app.kubernetes.io/name: opensearch-dashboards +spec: + type: ClusterIP + selector: + app.kubernetes.io/name: opensearch-dashboards + ports: + - name: http + port: 5601 + targetPort: 5601 + +--- + +# ConfigMap: OpenSearch Dashboards configuration +apiVersion: v1 +kind: ConfigMap +metadata: + name: opensearch-dashboards-config + namespace: poimen +data: + opensearch_dashboards.yml: | + # OpenSearch Dashboards configuration + server.name: opensearch-dashboards + server.host: "0.0.0.0" + server.port: 5601 + + # OpenSearch connection + opensearch.hosts: ["http://opensearch-internal.poimen.svc.cluster.local:9200"] + opensearch.username: "admin" + opensearch.password: "admin" + opensearch.ssl.verificationMode: none + + # Dashboards index + opensearch_dashboards.index: ".opensearch_dashboards" + + # Logging + logging.dest: stdout + logging.level: info + +--- + +# Deployment: OpenSearch Dashboards +apiVersion: apps/v1 +kind: Deployment +metadata: + name: opensearch-dashboards + namespace: poimen + labels: + app.kubernetes.io/name: opensearch-dashboards +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: opensearch-dashboards + template: + metadata: + labels: + app.kubernetes.io/name: opensearch-dashboards + spec: + serviceAccountName: opensearch-dashboards + + containers: + - name: opensearch-dashboards + image: opensearchproject/opensearch-dashboards:2.11.0 + imagePullPolicy: IfNotPresent + + ports: + - name: http + containerPort: 5601 + + env: + - name: OPENSEARCH_HOSTS + value: "http://opensearch-internal.poimen.svc.cluster.local:9200" + - name: OPENSEARCH_USERNAME + value: "admin" + - name: OPENSEARCH_PASSWORD + valueFrom: + secretKeyRef: + name: opensearch-dashboards-secret + key: password + + # Volume mounts + volumeMounts: + - name: opensearch-dashboards-config + mountPath: /usr/share/opensearch-dashboards/config/opensearch_dashboards.yml + subPath: opensearch_dashboards.yml + + # Resource limits + resources: + requests: + memory: "256Mi" + cpu: "100m" + limits: + memory: "512Mi" + cpu: "500m" + + # Liveness probe + livenessProbe: + httpGet: + path: /api/status + port: 5601 + initialDelaySeconds: 30 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 3 + + # Readiness probe + readinessProbe: + httpGet: + path: /api/status + port: 5601 + initialDelaySeconds: 15 + periodSeconds: 5 + timeoutSeconds: 3 + failureThreshold: 2 + + # Security context + securityContext: + runAsNonRoot: true + runAsUser: 1000 + capabilities: + drop: + - ALL + + # Volumes + volumes: + - name: opensearch-dashboards-config + configMap: + name: opensearch-dashboards-config + +--- + +# Secret: OpenSearch Dashboards password +apiVersion: v1 +kind: Secret +metadata: + name: opensearch-dashboards-secret + namespace: poimen +type: Opaque +stringData: + password: "admin" # ⚠️ Change in production + +--- + +# ServiceAccount for OpenSearch Dashboards +apiVersion: v1 +kind: ServiceAccount +metadata: + name: opensearch-dashboards + namespace: poimen