Skip to content

Commit c31a890

Browse files
mergify[bot]eedugon
mergify[bot]
and
eedugon
authored
Fleet Server on kubernetes document proposal (elastic#1518) (elastic#1653)
* fleet server on kubernetes document added --------- Co-authored-by: Brandon Morelli <[email protected]> Co-authored-by: Lara Moreno <[email protected]> Co-authored-by: David Kilfoyle <[email protected]> Co-authored-by: Mikołaj Świątek <[email protected]> (cherry picked from commit c8e3d71) Co-authored-by: Edu González de la Herrán <[email protected]>
1 parent 8e47df0 commit c31a890

File tree

3 files changed

+660
-0
lines changed

3 files changed

+660
-0
lines changed

‎docs/en/ingest-management/fleet/add-fleet-server-kubernetes-content.asciidoc‎

Lines changed: 209 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,209 @@
1+
// tag::quickstart-secret[]
2+
The following command assumes you have the {es} CA available as a local file.
3+
+
4+
[source, shell]
5+
------------------------------------------------------------
6+
kubectl create secret generic fleet-server-ssl \
7+
--from-file=es-ca.crt=<PATH_TO_ES_CA_CERT_FILE>
8+
------------------------------------------------------------
9+
+
10+
--
11+
When running the command, substitute the following values:
12+
13+
* `<PATH_TO_ES_CA_CERT_FILE>` with your local file containing the {es} CA(s).
14+
--
15+
+
16+
If you prefer to obtain a *yaml manifest* of the Secret to create, append `--dry-run=client -o=yaml` to the command and save the output to a file.
17+
// end::quickstart-secret[]
18+
19+
// ***************************************************
20+
// ***************************************************
21+
22+
// tag::production-secret[]
23+
The following command assumes you have the {es} CA and the {fleet-server} certificate, key and CA available as local files.
24+
+
25+
[source, shell]
26+
------------------------------------------------------------
27+
kubectl create secret generic fleet-server-ssl \
28+
--from-file=es-ca.crt=<PATH_TO_ES_CA_CERT_FILE> \
29+
--from-file=fleet-ca.crt=<PATH_TO_FLEET_CA_CERT_FILE> \
30+
--from-file=fleet-server.crt=<PATH_TO_FLEET_SERVER_CERT> \
31+
--from-file=fleet-server.key=<PATH_TO_FLEET_SERVER_CERT_KEY> \
32+
--from-literal=fleet_url='<FLEET_URL>'
33+
------------------------------------------------------------
34+
+
35+
--
36+
When running the command, substitute the following values:
37+
38+
* `<PATH_TO_ES_CA_CERT_FILE>` with your local file containing the {es} CA(s).
39+
* `<PATH_TO_FLEET_CA_CERT_FILE>` with your local file containing the {fleet-server} CA.
40+
* `<PATH_TO_FLEET_SERVER_CERT>` with your local file containing the server TLS certificate for the {fleet-server}.
41+
* `<PATH_TO_FLEET_SERVER_CERT_KEY>` with your local file containing the server TLS key for the {fleet-server}.
42+
* `<FLEET_URL>` with the URL that points to the {fleet-server}, for example `https://fleet-svc`. This URL will be used by the {fleet-server} during its bootstrap, and its hostname must be included in the server certificate’s x509 Subject Alternative Name (SAN) list.
43+
--
44+
+
45+
If you prefer to obtain a *yaml manifest* of the Secret to create, append `--dry-run=client -o=yaml` to the command and save the output to a file.
46+
// end::production-secret[]
47+
48+
// ***************************************************
49+
// ***************************************************
50+
51+
// tag::quickstart-deployment[]
52+
["source","yaml",subs="attributes"]
53+
------------------------------------------------------------
54+
apiVersion: v1
55+
kind: Service
56+
metadata:
57+
name: fleet-svc
58+
spec:
59+
type: ClusterIP
60+
selector:
61+
app: fleet-server
62+
ports:
63+
- port: 443
64+
protocol: TCP
65+
targetPort: 8220
66+
---
67+
apiVersion: apps/v1
68+
kind: Deployment
69+
metadata:
70+
name: fleet-server
71+
spec:
72+
replicas: 1
73+
selector:
74+
matchLabels:
75+
app: fleet-server
76+
template:
77+
metadata:
78+
labels:
79+
app: fleet-server
80+
spec:
81+
automountServiceAccountToken: false
82+
containers:
83+
- name: elastic-agent
84+
image: docker.elastic.co/beats/elastic-agent:{version}
85+
env:
86+
- name: FLEET_SERVER_ENABLE
87+
value: "true"
88+
- name: FLEET_SERVER_ELASTICSEARCH_HOST
89+
valueFrom:
90+
secretKeyRef:
91+
name: fleet-server-config
92+
key: elastic_endpoint
93+
- name: FLEET_SERVER_SERVICE_TOKEN
94+
valueFrom:
95+
secretKeyRef:
96+
name: fleet-server-config
97+
key: elastic_service_token
98+
- name: FLEET_SERVER_POLICY_ID
99+
valueFrom:
100+
secretKeyRef:
101+
name: fleet-server-config
102+
key: fleet_policy_id
103+
- name: ELASTICSEARCH_CA
104+
value: /mnt/certs/es-ca.crt
105+
ports:
106+
- containerPort: 8220
107+
protocol: TCP
108+
resources: {}
109+
volumeMounts:
110+
- name: certs
111+
mountPath: /mnt/certs
112+
readOnly: true
113+
volumes:
114+
- name: certs
115+
secret:
116+
defaultMode: 420
117+
optional: false
118+
secretName: fleet-server-ssl
119+
------------------------------------------------------------
120+
// end::quickstart-deployment[]
121+
122+
// ***************************************************
123+
// ***************************************************
124+
125+
// tag::production-deployment[]
126+
["source","yaml",subs="attributes"]
127+
------------------------------------------------------------
128+
apiVersion: v1
129+
kind: Service
130+
metadata:
131+
name: fleet-svc
132+
spec:
133+
type: ClusterIP
134+
selector:
135+
app: fleet-server
136+
ports:
137+
- port: 443
138+
protocol: TCP
139+
targetPort: 8220
140+
---
141+
apiVersion: apps/v1
142+
kind: Deployment
143+
metadata:
144+
name: fleet-server
145+
spec:
146+
replicas: 1
147+
selector:
148+
matchLabels:
149+
app: fleet-server
150+
template:
151+
metadata:
152+
labels:
153+
app: fleet-server
154+
spec:
155+
automountServiceAccountToken: false
156+
containers:
157+
- name: elastic-agent
158+
image: docker.elastic.co/beats/elastic-agent:{version}
159+
env:
160+
- name: FLEET_SERVER_ENABLE
161+
value: "true"
162+
- name: FLEET_SERVER_ELASTICSEARCH_HOST
163+
valueFrom:
164+
secretKeyRef:
165+
name: fleet-server-config
166+
key: elastic_endpoint
167+
- name: FLEET_SERVER_SERVICE_TOKEN
168+
valueFrom:
169+
secretKeyRef:
170+
name: fleet-server-config
171+
key: elastic_service_token
172+
- name: FLEET_SERVER_POLICY_ID
173+
valueFrom:
174+
secretKeyRef:
175+
name: fleet-server-config
176+
key: fleet_policy_id
177+
- name: ELASTICSEARCH_CA
178+
value: /mnt/certs/es-ca.crt
179+
- name: FLEET_SERVER_CERT
180+
value: /mnt/certs/fleet-server.crt
181+
- name: FLEET_SERVER_CERT_KEY
182+
value: /mnt/certs/fleet-server.key
183+
- name: FLEET_CA
184+
value: /mnt/certs/fleet-ca.crt
185+
- name: FLEET_URL
186+
valueFrom:
187+
secretKeyRef:
188+
name: fleet-server-ssl
189+
key: fleet_url
190+
- name: FLEET_SERVER_TIMEOUT
191+
value: '60s'
192+
- name: FLEET_SERVER_PORT
193+
value: '8220'
194+
ports:
195+
- containerPort: 8220
196+
protocol: TCP
197+
resources: {}
198+
volumeMounts:
199+
- name: certs
200+
mountPath: /mnt/certs
201+
readOnly: true
202+
volumes:
203+
- name: certs
204+
secret:
205+
defaultMode: 420
206+
optional: false
207+
secretName: fleet-server-ssl
208+
------------------------------------------------------------
209+
// end::production-deployment[]

0 commit comments

Comments
 (0)