Upgrade ECK operator

2024-07-27 10:50:17 +03:00
parent 4141c6b8ae
commit 97563e8092
5 changed files with 6319 additions and 704 deletions
--- a/elastic-system/.gitignore
+++ b/elastic-system/.gitignore
@@ -0,0 +1,2 @@
+crds.yaml
+operator.yaml
--- a/elastic-system/README.md
+++ b/elastic-system/README.md
@@ -1,7 +1,7 @@
 # elastic-operator

 ```
-wget https://download.elastic.co/downloads/eck/2.4.0/crds.yaml
-wget https://download.elastic.co/downloads/eck/2.4.0/operator.yaml
+wget https://download.elastic.co/downloads/eck/2.13.0/crds.yaml
+wget https://download.elastic.co/downloads/eck/2.13.0/operator.yaml
 kubectl apply -n elastic-system -f application.yml -f crds.yaml -f operator.yaml
 ```
--- a/elastic-system/application.yml
+++ b/elastic-system/application.yml
@@ -5,7 +5,7 @@ metadata:
  name: filebeat
 spec:
  type: filebeat
-  version: 8.4.3
+  version: 8.14.3
  elasticsearchRef:
    name: elasticsearch
  config:
@@ -218,10 +218,10 @@ kind: Elasticsearch
 metadata:
  name: elasticsearch
 spec:
-  version: 8.4.3
+  version: 8.14.3
  nodeSets:
  - name: default
-    count: 1
+    count: 2
    volumeClaimTemplates:
    - metadata:
        name: elasticsearch-data
@@ -242,7 +242,7 @@ kind: Kibana
 metadata:
  name: kibana
 spec:
-  version: 8.4.3
+  version: 8.14.3
  count: 1
  elasticsearchRef:
    name: elasticsearch
@@ -329,3 +329,28 @@ spec:
      app.kubernetes.io/name: elasticsearch-exporter
  podMetricsEndpoints:
    - port: exporter
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: kibana
+  annotations:
+    external-dns.alpha.kubernetes.io/target: traefik.k-space.ee
+    kubernetes.io/ingress.class: traefik
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: 'true'
+spec:
+  tls:
+    - hosts:
+        - '*.k-space.ee'
+  rules:
+    - host: kibana.k-space.ee
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: kibana-kb-http
+                port:
+                  number: 5601
--- a/elastic-system/crds.yaml
+++ b/elastic-system/crds.yaml
--- a/elastic-system/operator.yaml
+++ b/elastic-system/operator.yaml
@@ -9,12 +9,13 @@ metadata:
 # Source: eck-operator/templates/service-account.yaml
 apiVersion: v1
 kind: ServiceAccount
+automountServiceAccountToken: true
 metadata:
  name: elastic-operator
  namespace: elastic-system
  labels:
    control-plane: elastic-operator
-    app.kubernetes.io/version: "2.4.0"
+    app.kubernetes.io/version: "2.13.0"
 ---
 # Source: eck-operator/templates/webhook.yaml
 apiVersion: v1
@@ -24,7 +25,7 @@ metadata:
  namespace: elastic-system
  labels:
    control-plane: elastic-operator
-    app.kubernetes.io/version: "2.4.0"
+    app.kubernetes.io/version: "2.13.0"
 ---
 # Source: eck-operator/templates/configmap.yaml
 apiVersion: v1
@@ -34,7 +35,7 @@ metadata:
  namespace: elastic-system
  labels:
    control-plane: elastic-operator
-    app.kubernetes.io/version: "2.4.0"
+    app.kubernetes.io/version: "2.13.0"
 data:
  eck.yaml: |-
    log-verbosity: 0
@@ -45,6 +46,7 @@ data:
    ca-cert-rotate-before: 24h
    cert-validity: 8760h
    cert-rotate-before: 24h
+    disable-config-watch: false
    exposed-node-labels: [topology.kubernetes.io/.*,failure-domain.beta.kubernetes.io/.*]
    set-default-security-context: auto-detect
    kube-client-timeout: 60s
@@ -54,7 +56,11 @@ data:
    validate-storage-class: true
    enable-webhook: true
    webhook-name: elastic-webhook.k8s.elastic.co
+    webhook-port: 9443
+    operator-namespace: elastic-system
    enable-leader-election: true
+    elasticsearch-observation-interval: 10s
+    ubi-only: false
 ---
 # Source: eck-operator/templates/cluster-roles.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -63,7 +69,7 @@ metadata:
  name: elastic-operator
  labels:
    control-plane: elastic-operator
-    app.kubernetes.io/version: "2.4.0"
+    app.kubernetes.io/version: "2.13.0"
 rules:
 - apiGroups:
  - "authorization.k8s.io"
@@ -151,6 +157,19 @@ rules:
  - create
  - update
  - patch
+- apiGroups:
+  - autoscaling.k8s.elastic.co
+  resources:
+  - elasticsearchautoscalers
+  - elasticsearchautoscalers/status
+  - elasticsearchautoscalers/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
 - apiGroups:
  - kibana.k8s.elastic.co
  resources:
@@ -229,6 +248,32 @@ rules:
  - create
  - update
  - patch
+- apiGroups:
+  - stackconfigpolicy.k8s.elastic.co
+  resources:
+  - stackconfigpolicies
+  - stackconfigpolicies/status
+  - stackconfigpolicies/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+- apiGroups:
+  - logstash.k8s.elastic.co
+  resources:
+  - logstashes
+  - logstashes/status
+  - logstashes/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
 - apiGroups:
  - storage.k8s.io
  resources:
@@ -268,11 +313,14 @@ metadata:
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
    control-plane: elastic-operator
-    app.kubernetes.io/version: "2.4.0"
+    app.kubernetes.io/version: "2.13.0"
 rules:
 - apiGroups: ["elasticsearch.k8s.elastic.co"]
  resources: ["elasticsearches"]
  verbs: ["get", "list", "watch"]
+- apiGroups: ["autoscaling.k8s.elastic.co"]
+  resources: ["elasticsearchautoscalers"]
+  verbs: ["get", "list", "watch"]
 - apiGroups: ["apm.k8s.elastic.co"]
  resources: ["apmservers"]
  verbs: ["get", "list", "watch"]
@@ -291,6 +339,12 @@ rules:
 - apiGroups: ["maps.k8s.elastic.co"]
  resources: ["elasticmapsservers"]
  verbs: ["get", "list", "watch"]
+- apiGroups: ["stackconfigpolicy.k8s.elastic.co"]
+  resources: ["stackconfigpolicies"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["logstash.k8s.elastic.co"]
+  resources: ["logstashes"]
+  verbs: ["get", "list", "watch"]
 ---
 # Source: eck-operator/templates/cluster-roles.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -301,11 +355,14 @@ metadata:
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
    control-plane: elastic-operator
-    app.kubernetes.io/version: "2.4.0"
+    app.kubernetes.io/version: "2.13.0"
 rules:
 - apiGroups: ["elasticsearch.k8s.elastic.co"]
  resources: ["elasticsearches"]
  verbs: ["create", "delete", "deletecollection", "patch", "update"]
+- apiGroups: ["autoscaling.k8s.elastic.co"]
+  resources: ["elasticsearchautoscalers"]
+  verbs: ["create", "delete", "deletecollection", "patch", "update"]
 - apiGroups: ["apm.k8s.elastic.co"]
  resources: ["apmservers"]
  verbs: ["create", "delete", "deletecollection", "patch", "update"]
@@ -324,6 +381,12 @@ rules:
 - apiGroups: ["maps.k8s.elastic.co"]
  resources: ["elasticmapsservers"]
  verbs: ["create", "delete", "deletecollection", "patch", "update"]
+- apiGroups: ["stackconfigpolicy.k8s.elastic.co"]
+  resources: ["stackconfigpolicies"]
+  verbs: ["create", "delete", "deletecollection", "patch", "update"]
+- apiGroups: ["logstash.k8s.elastic.co"]
+  resources: ["logstashes"]
+  verbs: ["create", "delete", "deletecollection", "patch", "update"]
 ---
 # Source: eck-operator/templates/role-bindings.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -332,7 +395,7 @@ metadata:
  name: elastic-operator
  labels:
    control-plane: elastic-operator
-    app.kubernetes.io/version: "2.4.0"
+    app.kubernetes.io/version: "2.13.0"
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
@@ -350,7 +413,7 @@ metadata:
  namespace: elastic-system
  labels:
    control-plane: elastic-operator
-    app.kubernetes.io/version: "2.4.0"
+    app.kubernetes.io/version: "2.13.0"
 spec:
  ports:
  - name: https
@@ -367,7 +430,7 @@ metadata:
  namespace: elastic-system
  labels:
    control-plane: elastic-operator
-    app.kubernetes.io/version: "2.4.0"
+    app.kubernetes.io/version: "2.13.0"
 spec:
  selector:
    matchLabels:
@@ -380,21 +443,29 @@ spec:
        # Rename the fields "error" to "error.message" and "source" to "event.source"
        # This is to avoid a conflict with the ECS "error" and "source" documents.
        "co.elastic.logs/raw": "[{\"type\":\"container\",\"json.keys_under_root\":true,\"paths\":[\"/var/log/containers/*${data.kubernetes.container.id}.log\"],\"processors\":[{\"convert\":{\"mode\":\"rename\",\"ignore_missing\":true,\"fields\":[{\"from\":\"error\",\"to\":\"_error\"}]}},{\"convert\":{\"mode\":\"rename\",\"ignore_missing\":true,\"fields\":[{\"from\":\"_error\",\"to\":\"error.message\"}]}},{\"convert\":{\"mode\":\"rename\",\"ignore_missing\":true,\"fields\":[{\"from\":\"source\",\"to\":\"_source\"}]}},{\"convert\":{\"mode\":\"rename\",\"ignore_missing\":true,\"fields\":[{\"from\":\"_source\",\"to\":\"event.source\"}]}}]}]"
-        "checksum/config": a99a5f63f628a1ca8df440c12506cdfbf17827a1175dc5765b05f22f92b12b95
+        "checksum/config": 8b10381ca4067cf2c56aecc94c799473b09486202e146d2d7e5d6714f4c2e533
      labels:
        control-plane: elastic-operator
    spec:
      terminationGracePeriodSeconds: 10
      serviceAccountName: elastic-operator
+      automountServiceAccountToken: true
      securityContext:
        runAsNonRoot: true
      containers:
-      - image: "docker.elastic.co/eck/eck-operator:2.4.0"
+      - image: "docker.elastic.co/eck/eck-operator:2.13.0"
        imagePullPolicy: IfNotPresent
        name: manager
        args:
        - "manager"
        - "--config=/conf/eck.yaml"
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
        env:
        - name: OPERATOR_NAMESPACE
          valueFrom:
@@ -440,10 +511,9 @@ metadata:
  name: elastic-webhook.k8s.elastic.co
  labels:
    control-plane: elastic-operator
-    app.kubernetes.io/version: "2.4.0"
+    app.kubernetes.io/version: "2.13.0"
 webhooks:
 - clientConfig:
-    caBundle: Cg==
    service:
      name: elastic-webhook-server
      namespace: elastic-system
@@ -451,7 +521,7 @@ webhooks:
  failurePolicy: Ignore
  name: elastic-agent-validation-v1alpha1.k8s.elastic.co
  matchPolicy: Exact
-  admissionReviewVersions: [v1beta1]
+  admissionReviewVersions: [v1, v1beta1]
  sideEffects: None
  rules:
  - apiGroups:
@@ -464,7 +534,6 @@ webhooks:
    resources:
    - agents
 - clientConfig:
-    caBundle: Cg==
    service:
      name: elastic-webhook-server
      namespace: elastic-system
@@ -472,7 +541,7 @@ webhooks:
  failurePolicy: Ignore
  name: elastic-apm-validation-v1.k8s.elastic.co
  matchPolicy: Exact
-  admissionReviewVersions: [v1beta1]
+  admissionReviewVersions: [v1, v1beta1]
  sideEffects: None
  rules:
  - apiGroups:
@@ -485,7 +554,6 @@ webhooks:
    resources:
    - apmservers
 - clientConfig:
-    caBundle: Cg==
    service:
      name: elastic-webhook-server
      namespace: elastic-system
@@ -493,7 +561,7 @@ webhooks:
  failurePolicy: Ignore
  name: elastic-apm-validation-v1beta1.k8s.elastic.co
  matchPolicy: Exact
-  admissionReviewVersions: [v1beta1]
+  admissionReviewVersions: [v1, v1beta1]
  sideEffects: None
  rules:
  - apiGroups:
@@ -506,7 +574,6 @@ webhooks:
    resources:
    - apmservers
 - clientConfig:
-    caBundle: Cg==
    service:
      name: elastic-webhook-server
      namespace: elastic-system
@@ -514,7 +581,7 @@ webhooks:
  failurePolicy: Ignore
  name: elastic-beat-validation-v1beta1.k8s.elastic.co
  matchPolicy: Exact
-  admissionReviewVersions: [v1beta1]
+  admissionReviewVersions: [v1, v1beta1]
  sideEffects: None
  rules:
  - apiGroups:
@@ -527,7 +594,6 @@ webhooks:
    resources:
    - beats
 - clientConfig:
-    caBundle: Cg==
    service:
      name: elastic-webhook-server
      namespace: elastic-system
@@ -535,7 +601,7 @@ webhooks:
  failurePolicy: Ignore
  name: elastic-ent-validation-v1.k8s.elastic.co
  matchPolicy: Exact
-  admissionReviewVersions: [v1beta1]
+  admissionReviewVersions: [v1, v1beta1]
  sideEffects: None
  rules:
  - apiGroups:
@@ -548,7 +614,6 @@ webhooks:
    resources:
    - enterprisesearches
 - clientConfig:
-    caBundle: Cg==
    service:
      name: elastic-webhook-server
      namespace: elastic-system
@@ -556,7 +621,7 @@ webhooks:
  failurePolicy: Ignore
  name: elastic-ent-validation-v1beta1.k8s.elastic.co
  matchPolicy: Exact
-  admissionReviewVersions: [v1beta1]
+  admissionReviewVersions: [v1, v1beta1]
  sideEffects: None
  rules:
  - apiGroups:
@@ -569,7 +634,6 @@ webhooks:
    resources:
    - enterprisesearches
 - clientConfig:
-    caBundle: Cg==
    service:
      name: elastic-webhook-server
      namespace: elastic-system
@@ -577,7 +641,7 @@ webhooks:
  failurePolicy: Ignore
  name: elastic-es-validation-v1.k8s.elastic.co
  matchPolicy: Exact
-  admissionReviewVersions: [v1beta1]
+  admissionReviewVersions: [v1, v1beta1]
  sideEffects: None
  rules:
  - apiGroups:
@@ -590,7 +654,6 @@ webhooks:
    resources:
    - elasticsearches
 - clientConfig:
-    caBundle: Cg==
    service:
      name: elastic-webhook-server
      namespace: elastic-system
@@ -598,7 +661,7 @@ webhooks:
  failurePolicy: Ignore
  name: elastic-es-validation-v1beta1.k8s.elastic.co
  matchPolicy: Exact
-  admissionReviewVersions: [v1beta1]
+  admissionReviewVersions: [v1, v1beta1]
  sideEffects: None
  rules:
  - apiGroups:
@@ -611,7 +674,26 @@ webhooks:
    resources:
    - elasticsearches
 - clientConfig:
-    caBundle: Cg==
+    service:
+      name: elastic-webhook-server
+      namespace: elastic-system
+      path: /validate-ems-k8s-elastic-co-v1alpha1-mapsservers
+  failurePolicy: Ignore
+  name: elastic-ems-validation-v1alpha1.k8s.elastic.co
+  matchPolicy: Exact
+  admissionReviewVersions: [v1, v1beta1]
+  sideEffects: None
+  rules:
+  - apiGroups:
+    - maps.k8s.elastic.co
+    apiVersions:
+    - v1alpha1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - mapsservers
+- clientConfig:
    service:
      name: elastic-webhook-server
      namespace: elastic-system
@@ -619,7 +701,7 @@ webhooks:
  failurePolicy: Ignore
  name: elastic-kb-validation-v1.k8s.elastic.co
  matchPolicy: Exact
-  admissionReviewVersions: [v1beta1]
+  admissionReviewVersions: [v1, v1beta1]
  sideEffects: None
  rules:
  - apiGroups:
@@ -632,7 +714,6 @@ webhooks:
    resources:
    - kibanas
 - clientConfig:
-    caBundle: Cg==
    service:
      name: elastic-webhook-server
      namespace: elastic-system
@@ -640,7 +721,7 @@ webhooks:
  failurePolicy: Ignore
  name: elastic-kb-validation-v1beta1.k8s.elastic.co
  matchPolicy: Exact
-  admissionReviewVersions: [v1beta1]
+  admissionReviewVersions: [v1, v1beta1]
  sideEffects: None
  rules:
  - apiGroups:
@@ -652,4 +733,64 @@ webhooks:
    - UPDATE
    resources:
    - kibanas
+- clientConfig:
+    service:
+      name: elastic-webhook-server
+      namespace: elastic-system
+      path: /validate-autoscaling-k8s-elastic-co-v1alpha1-elasticsearchautoscaler
+  failurePolicy: Ignore
+  name: elastic-esa-validation-v1alpha1.k8s.elastic.co
+  matchPolicy: Exact
+  admissionReviewVersions: [v1, v1beta1]
+  sideEffects: None
+  rules:
+  - apiGroups:
+    - autoscaling.k8s.elastic.co
+    apiVersions:
+    - v1alpha1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - elasticsearchautoscalers
+- clientConfig:
+    service:
+      name: elastic-webhook-server
+      namespace: elastic-system
+      path: /validate-scp-k8s-elastic-co-v1alpha1-stackconfigpolicies
+  failurePolicy: Ignore
+  name: elastic-scp-validation-v1alpha1.k8s.elastic.co
+  matchPolicy: Exact
+  admissionReviewVersions: [v1, v1beta1]
+  sideEffects: None
+  rules:
+  - apiGroups:
+    - stackconfigpolicy.k8s.elastic.co
+    apiVersions:
+    - v1alpha1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - stackconfigpolicies
+- clientConfig:
+    service:
+      name: elastic-webhook-server
+      namespace: elastic-system
+      path: /validate-logstash-k8s-elastic-co-v1alpha1-logstash
+  failurePolicy: Ignore
+  name: elastic-logstash-validation-v1alpha1.k8s.elastic.co
+  matchPolicy: Exact
+  admissionReviewVersions: [v1, v1beta1]
+  sideEffects: None
+  rules:
+  - apiGroups:
+    - logstash.k8s.elastic.co
+    apiVersions:
+    - v1alpha1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - logstashes