# http://github.com/helm/charts
# e3a9ecbdece57ecc580539aaf3b12b9b54075a40

nameOverride: "logging-es"
fullnameOverride: "logging-es"

externalHost: search-k8s-logs-nilqsdo5nhjzxdayh2rxdnitse.us-west-2.es.amazonaws.com

elasticsearch:
  enabled: false

kibana:
  enabled: true

logstash:
  enabled: false

filebeat:
  enabled: false

fluentd:
  enabled: false

fluent-bit:
  enabled: true

fluentd-elasticsearch:
  enabled: false

nginx-ldapauth-proxy:
  enabled: false
  # Example config to get it working with ELK. Adjust as you need to.
  # proxy:
  #   port: 5601
  #   # This is the internal hostname for the kibana service
  #   host: "elk-kibana.default.svc.cluster.local"
  #   authName: "ELK:Infrastructure:LDAP"
  #   ldapHost: "ldap.example.com"
  #   ldapDN: "dc=example,dc=com"
  #   ldapFilter: "objectClass=organizationalPerson"
  #   ldapBindDN: "cn=reader,dc=example,dc=com"
  #   requires:
  #     - name: "ELK-USER"
  #       filter: "cn=elkuser,ou=groups,dc=example,dc=com"
  # ingress:
  #   enabled: true
  #   hosts:
  #     - "elk.example.com"
  #   annotations:
  #     kubernetes.io/ingress.class: nginx
  #   tls:
  #     - hosts:
  #       - elk.example.com
  #       secretName: example-elk-tls
  # secrets:
  #   ldapBindPassword: PASSWORD
elasticsearch-curator:
  enabled: true

elasticsearch-exporter:
  enabled: true

elastic-stack:
  elasticsearch:
    appVersion: "6.7.0"

    ## Define serviceAccount names for components. Defaults to component's fully qualified name.
    ##
    serviceAccounts:
      client:
        create: true
        name:
      master:
        create: true
        name:
      data:
        create: true
        name:

    ## Specify if a Pod Security Policy for node-exporter must be created
    ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/
    ##
    podSecurityPolicy:
      enabled: false
      annotations: {}
        ## Specify pod annotations
        ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#apparmor
        ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp
        ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#sysctl
        ##
        # seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
        # seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
        # apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'

    image:
      repository: "docker.elastic.co/elasticsearch/elasticsearch-oss"
      tag: "6.7.0"
      pullPolicy: "IfNotPresent"
      # If specified, use these secrets to access the image
      # pullSecrets:
      #   - registry-secret

    testFramework:
      image: "dduportal/bats"
      tag: "0.4.0"

    initImage:
      repository: "busybox"
      tag: "latest"
      pullPolicy: "Always"

    cluster:
      name: "elasticsearch"
      # If you want X-Pack installed, switch to an image that includes it, enable this option and toggle the features you want
      # enabled in the environment variables outlined in the README
      xpackEnable: false
      # Some settings must be placed in a keystore, so they need to be mounted in from a secret.
      # Use this setting to specify the name of the secret
      # keystoreSecret: eskeystore
      config: {}
      # Custom parameters, as string, to be added to ES_JAVA_OPTS environment variable
      additionalJavaOpts: ""
      # Command to run at the end of deployment
      bootstrapShellCommand: ""
      env:
        # IMPORTANT: https://www.elastic.co/guide/en/elasticsearch/reference/current/important-settings.html#minimum_master_nodes
        # To prevent data loss, it is vital to configure the discovery.zen.minimum_master_nodes setting so that each master-eligible
        # node knows the minimum number of master-eligible nodes that must be visible in order to form a cluster.
        MINIMUM_MASTER_NODES: "2"
      # List of plugins to install via dedicated init container
      plugins: []
        # - ingest-attachment
        # - mapper-size

    client:
      name: client
      replicas: 2
      serviceType: ClusterIP
      ## If coupled with serviceType = "NodePort", this will set a specific nodePort to the client HTTP port
      # httpNodePort: 30920
      loadBalancerIP: {}
      loadBalancerSourceRanges: {}
    ## (dict) If specified, apply these annotations to the client service
    #  serviceAnnotations:
    #    example: client-svc-foo
      heapSize: "512m"
      # additionalJavaOpts: "-XX:MaxRAM=512m"
      antiAffinity: "soft"
      nodeAffinity: {}
      nodeSelector: {}
      tolerations: []
      initResources: {}
        # limits:
        #   cpu: "25m"
        #   # memory: "128Mi"
        # requests:
        #   cpu: "25m"
        #   memory: "128Mi"
      resources:
        limits:
          cpu: 1
          # memory: "1024Mi"
        requests:
          cpu: 1
          memory: 512Mi
      priorityClassName: ""
      ## (dict) If specified, apply these annotations to each client Pod
      # podAnnotations:
      #   example: client-foo
      podDisruptionBudget:
        enabled: false
        minAvailable: 1
        # maxUnavailable: 1
      ingress:
        enabled: true
        # user: NAME
        # password: PASSWORD
        annotations: {}
          # kubernetes.io/ingress.class: nginx
          # kubernetes.io/tls-acme: "true"
        path: /
        hosts:
          - logging.zooxlabs.com
        tls:
         - hosts:
             - logging.zooxlabs.com

    master:
      name: master
      exposeHttp: false
      replicas: 3
      heapSize: "2048m"
      # additionalJavaOpts: "-XX:MaxRAM=512m"
      persistence:
        enabled: true
        accessMode: ReadWriteOnce
        name: data
        size: "4Gi"
        # storageClass: "ssd"
      readinessProbe:
        httpGet:
          path: /_cluster/health?local=true
          port: 9200
        initialDelaySeconds: 5
      antiAffinity: "soft"
      nodeAffinity: {}
      nodeSelector: {}
      tolerations: []
      initResources: {}
        # limits:
        #   cpu: "25m"
        #   # memory: "128Mi"
        # requests:
        #   cpu: "25m"
        #   memory: "128Mi"
      resources:
        limits:
          cpu: "1"
          # memory: "1024Mi"
        requests:
          cpu: "500m"
          memory: "512Mi"
      priorityClassName: ""
      ## (dict) If specified, apply these annotations to each master Pod
      # podAnnotations:
      #   example: master-foo
      podManagementPolicy: OrderedReady
      podDisruptionBudget:
        enabled: false
        minAvailable: 2  # Same as `cluster.env.MINIMUM_MASTER_NODES`
        # maxUnavailable: 1
      updateStrategy:
        type: OnDelete

    data:
      name: data
      exposeHttp: false
      replicas: 4
      heapSize: "10240m"
      # additionalJavaOpts: "-XX:MaxRAM=1536m"
      persistence:
        enabled: true
        accessMode: ReadWriteOnce
        name: data
        size: "500Gi"
        # storageClass: "ssd"
      readinessProbe:
        httpGet:
          path: /_cluster/health?local=true
          port: 9200
        initialDelaySeconds: 5
      terminationGracePeriodSeconds: 3600
      antiAffinity: "soft"
      nodeAffinity: {}
      nodeSelector: {}
      tolerations: []
      initResources: {}
        # limits:
        #   cpu: "25m"
        #   # memory: "128Mi"
        # requests:
        #   cpu: "25m"
        #   memory: "128Mi"
      resources:
        limits:
          cpu: "5"
          # memory: "2048Mi"
        requests:
          cpu: "2.5"
          memory: "10240Mi"
      priorityClassName: ""
      ## (dict) If specified, apply these annotations to each data Pod
      # podAnnotations:
      #   example: data-foo
      podDisruptionBudget:
        enabled: false
        # minAvailable: 1
        maxUnavailable: 2
      podManagementPolicy: OrderedReady
      updateStrategy:
        type: OnDelete
      hooks:  # post-start and pre-stop hooks
        drain:  # drain the node before stopping it and re-integrate it into the cluster after start
          enabled: true

    ## Sysctl init container to setup vm.max_map_count
    # see https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html
    # and https://www.elastic.co/guide/en/elasticsearch/reference/current/setup-configuration-memory.html#mlockall
    sysctlInitContainer:
      enabled: true
    ## Additional init containers
    extraInitContainers: |

  kibana:
    ingress:
      enabled: true
      hosts:
        - kibana.zooxlabs.com
      # annotations:
      #   kubernetes.io/ingress.class: nginx
      #   kubernetes.io/tls-acme: "true"
      tls:
        - hosts:
          - kibana.zooxlabs.com
    files:
      kibana.yml:
        ## Default Kibana configuration from kibana-docker.
        server.name: kibana
        server.host: "0"
        ## For kibana < 6.6, use elasticsearch.url instead
        elasticsearch.hosts: http://logging-es-elasticsearch-client:9200
        elasticsearch.url: http://logging-es-elasticsearch-client:9200

    env:
      ELASTICSEARCH_HOSTS: http://logging-es-elasticsearch-client:9200
      ELASTICSEARCH_URL: http://logging-es-elasticsearch-client:9200

  fluent-bit:
    image:
      fluent_bit:
        repository: fluent/fluent-bit
        tag: 1.0.6
      pullPolicy: IfNotPresent

    # When enabled, exposes json and prometheus metrics on {{ .Release.Name }}-metrics service
    metrics:
      enabled: true
      service:
        annotations: {}
        # In order for Prometheus to consume metrics automatically use the following annotations:
        # prometheus.io/path: "/api/v1/metrics/prometheus"
        # prometheus.io/port: "2020"
        # prometheus.io/scrape: "true"
        port: 2020
        type: ClusterIP

    # When enabled, fluent-bit will keep track of tailing offsets across pod restarts.
    trackOffsets: false

    backend:
      type: es
      es:
        host: elasticsearch
        port: 80
        # Elastic Index Name
        index: kubernetes_cluster
        type: flb_type
        logstash_prefix: kubernetes_cluster
        replace_dots: "On"
        time_key: "@timestamp"
        # Optional username credential for Elastic X-Pack access
        http_user:
        # Password for user defined in HTTP_User
        http_passwd:
        # Optional TLS encryption to ElasticSearch instance
        tls: "off"
        tls_verify: "off"
        # TLS certificate for the Elastic (in PEM format). Use if tls=on and tls_verify=on.
        tls_ca: ""
        # TLS debugging levels = 1-4
        tls_debug: 1

      ##
      ## Ref: http://fluentbit.io/documentation/current/output/http.html
      ##
      http:
        host: 127.0.0.1
        port: 80
        uri: "/"
        http_user:
        http_passwd:
        tls: "off"
        tls_verify: "on"
        tls_debug: 1
        ## Specify the data format to be used in the HTTP request body
        ## Can be either 'msgpack' or 'json'
        format: msgpack

    parsers:
      enabled: false
      ## List the respective parsers in key: value format per entry
      ## Regex required fields are name and regex. JSON required field
      ## is name.
      regex: []
      ##  json parser config can be defined by providing an extraEntries field.
      ##  The following entry:
      ## json:
      ##   - extraEntries: |
      ##       Decode_Field_As  escaped log do_next
      ##       Decode_Field_As  json log
      ##
      ##  translates into
      ##
      ##   Command       |  Decoder  | Field | Optional Action   |
      ##   ==============|===========|=======|===================|
      ##   Decode_Field_As  escaped   log  do_next
      ##   Decode_Field_As  json log
      ##
      json: []

    env: []

    ## Annotations to add to the DaemonSet's Pods
    podAnnotations: {}

    ## By default there different 'files' provides in the config
    ## (fluent-bit.conf, custom_parsers.conf). This defeats
    ## changing a configmap (since it uses subPath). If this
    ## variable is set, the user is assumed to have provided,
    ## in 'existingConfigMap' the entire config (etc/*) of fluent-bit,
    ## parsers and system config. In this case, no subPath is
    ## used
    fullConfigMap: false

    ## ConfigMap override where fullname is {{.Release.Name}}-{{.Values.existingConfigMap}}
    ## Defining existingConfigMap will cause templates/config.yaml
    ## to NOT generate a ConfigMap resource
    ##
    existingConfigMap: ""

    rawConfig: |-
      @INCLUDE fluent-bit-service.conf
      @INCLUDE fluent-bit-input.conf
      [FILTER]
        Name    lua
        Match   kube.*
        script  /fluent-bit/etc/functions.lua
        call    dedot
      @INCLUDE fluent-bit-filter.conf
      @INCLUDE fluent-bit-output.conf

    extraEntries:
      input: |-
    #     # >=1 additional Key/Value entrie(s) for existing Input section
      filter: |-
      output: |-
    #     # >=1 additional Key/Value entrie(s) for existing Ouput section

    ## Extra ports to add to the daemonset ports section
    extraPorts: []

    ## Extra volumes containing additional files required for fluent-bit to work
    ## (eg. CA certificates)
    ## Ref: https://kubernetes.io/docs/concepts/storage/volumes/
    ##
    extraVolumes:
      - name: lua-functions
        configMap:
          name: logging-es-lua-functions

    ## Extra volume mounts for the fluent-bit pod.
    ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-volume-storage/
    ##
    extraVolumeMounts:
      - name: lua-functions
        mountPath: /fluent-bit/etc/functions.lua
        readOnly: true
        subPath: functions.lua

    resources: {}
      # limits:
      #   cpu: 100m
      #   memory: 128Mi
      # requests:
      #   cpu: 10m
      #   memory: 8Mi

    # When enabled, pods will bind to the node's network namespace.
    hostNetwork: false

    # Which DNS policy to use for the pod.
    # Consider switching to 'ClusterFirstWithHostNet' when 'hostNetwork' is enabled.
    dnsPolicy: ClusterFirst

    ## Node tolerations for fluent-bit scheduling to nodes with taints
    ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
    ##
    tolerations: []
    # - key: "key"
    #  operator: "Equal|Exists"
    #  value: "value"
    #  effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)"

    ## Node labels for fluent-bit pod assignment
    ## Ref: https://kubernetes.io/docs/user-guide/node-selection/
    ##
    nodeSelector: {}
    affinity: {}

    input:
      tail:
        memBufLimit: 50MB
        parser: docker
        path: /var/log/containers/*.log
      systemd:
        enabled: true
        filters:
          systemdUnit:
            - docker.service
            - kubelet.service
            - node-problem-detector.service
        maxEntries: 1000
        readFromTail: true
        tag: host.*

    filter:
      kubeURL: https://kubernetes.default.svc:443
      kubeCAFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
      kubeTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
      kubeTag: kube
    # If true, check to see if the log field content is a JSON string map, if so,
    # it append the map fields as part of the log structure.
      mergeJSONLog: true

    # If true, enable the use of monitoring for a pod annotation of
    # fluentbit.io/parser: parser_name. parser_name must be the name
    # of a parser contained within parsers.conf
      enableParser: true

    # If true, enable the use of monitoring for a pod annotation of
    # fluentbit.io/exclude: true. If present, discard logs from that pod.
      enableExclude: true

    rbac:
      # Specifies whether RBAC resources should be created
      create: true

    taildb:
      directory: /var/lib/fluent-bit

    serviceAccount:
      # Specifies whether a ServiceAccount should be created
      create: true
      # The name of the ServiceAccount to use.
      # If not set and create is true, a name is generated using the fullname template
      name:

  elasticsearch-curator:

    # stable/elasticsearch-curator

    hooks:
      install: false
      upgrade: false

    cronjob:
      # At 01:00 every day
      schedule: "0 1 * * *"
      annotations: {}
      concurrencyPolicy: ""
      failedJobsHistoryLimit: ""
      successfulJobsHistoryLimit: ""

    dry-run: false

    configMaps:
      # Delete indices older than 7 days
      action_file_yml: |-
        ---
        actions:
          1:
            action: snapshot
            description: "Take a snapshot every day"
            options:
              repository: "k8s-logs"
              name: <latest-{now/d}>
              timeout_override:
              continue_if_exception: False
              disable_action: False
              ignore_empty_list: True
            filters:
            - filtertype: age
              source: name
              direction: younger
              timestring: '%Y.%m.%d'
              unit: days
              unit_count: 1
              field:
              stats_result:
              epoch:
              exclude: False
            - filtertype: pattern
              kind: prefix
              value: kubernetes_cluster
          2:
            action: delete_indices
            description: "Clean up all kubernetes logs older than 30 days"
            options:
              timeout_override:
              continue_if_exception: False
              disable_action: False
              ignore_empty_list: True
            filters:
            - filtertype: age
              source: name
              direction: older
              timestring: '%Y.%m.%d'
              unit: days
              unit_count: 30
              field:
              stats_result:
              epoch:
              exclude: False
            - filtertype: pattern
              kind: prefix
              value: kubernetes_cluster

    #  Having config_yaml WILL override the other config
      config_yml: |-
        ---
        client:
          hosts:
            - elasticsearch
          port: 80
          url_prefix:
          use_ssl: False
          certificate:
          client_cert:
          client_key:
          ssl_no_validate: False
          http_auth:
          timeout: 30
          master_only: False
        logging:
          loglevel: INFO
          logfile:
          logformat: default
          blacklist: ['elasticsearch', 'urllib3']

  elasticsearch-exporter:
    ## number of exporter instances
    ##
    replicaCount: 1

    ## restart policy for all containers
    ##
    restartPolicy: Always

    image:
      repository: justwatch/elasticsearch_exporter
      tag: 1.0.2
      pullPolicy: IfNotPresent

    resources: {}
      # requests:
      #   cpu: 100m
      #   memory: 128Mi
      # limits:
      #   cpu: 100m
      #   memory: 128Mi

    priorityClassName: ""

    nodeSelector: {}

    tolerations: {}

    podAnnotations: {}

    service:
      type: ClusterIP
      httpPort: 9108
      annotations: {}

    es:
      ## Address (host and port) of the Elasticsearch node we should connect to.
      ## This could be a local node (localhost:9200, for instance), or the address
      ## of a remote Elasticsearch server. When basic auth is needed,
      ## specify as: <proto>://<user>:<password>@<host>:<port>. e.g., http://admin:pass@localhost:9200.
      ##
      uri: http://elasticsearch

      ## If true, query stats for all nodes in the cluster, rather than just the
      ## node we connect to.
      ##
      all: true

      ## If true, query stats for all indices in the cluster.
      ##
      indices: true

      ## Timeout for trying to get stats from Elasticsearch. (ex: 20s)
      ##
      timeout: 30s

      ssl:
        ## If true, a secure connection to ES cluster is used (requires SSL certs below)
        ##
        enabled: false

        ca:

          ## PEM that contains trusted CAs used for setting up secure Elasticsearch connection
          ##
          # pem:

        client:

          ## PEM that contains the client cert to connect to Elasticsearch.
          ##
          # pem:

          ## Private key for client auth when connecting to Elasticsearch
          ##
          # key:

    web:
      ## Path under which to expose metrics.
      ##
      path: /metrics

    serviceMonitor:
      ## If true, a ServiceMonitor CRD is created for a prometheus operator
      ## https://github.com/coreos/prometheus-operator
      ##
      enabled: true
      #  namespace: monitoring
      labels: {}
      interval: 10s
      scrapeTimeout: 10s
      scheme: http
