fix(service): elasticsearch-with-kibana not generating account token (#8067)
This commit is contained in:
Andras Bacsai
GitHub
commit
6f677af657
1 changed files with 48 additions and 48 deletions
|
|
@ -7,82 +7,82 @@
|
||||||
services:
|
services:
|
||||||
elasticsearch:
|
elasticsearch:
|
||||||
image: 'elastic/elasticsearch:9.1.2'
|
image: 'elastic/elasticsearch:9.1.2'
|
||||||
container_name: elasticsearch
|
|
||||||
restart: unless-stopped
|
|
||||||
environment:
|
environment:
|
||||||
- ELASTIC_PASSWORD=${SERVICE_PASSWORD_ELASTICSEARCH}
|
- ELASTIC_USER=elastic # Default built-in superuser (can't be changed); included here to avoid confusion about the username
|
||||||
- 'ES_JAVA_OPTS=-Xms512m -Xmx512m'
|
- 'ELASTIC_PASSWORD=${SERVICE_PASSWORD_ELASTICSEARCH}'
|
||||||
- discovery.type=single-node
|
- 'ES_JAVA_OPTS=-Xms512m -Xmx512m' # Limit JVM heap size to 512MB to prevent Elasticsearch from consuming all system memory
|
||||||
- bootstrap.memory_lock=true
|
- discovery.type=single-node # Disable clustering; run as a standalone node (sufficient for most local or single-host setups)
|
||||||
- xpack.security.enabled=true
|
- bootstrap.memory_lock=true # Prevent memory swapping by locking JVM memory (helps with performance/stability)
|
||||||
- xpack.security.http.ssl.enabled=false
|
- xpack.security.http.ssl.enabled=false # SSL is unnecessary for HTTP traffic within the isolated Docker network
|
||||||
- xpack.security.transport.ssl.enabled=false
|
|
||||||
volumes:
|
volumes:
|
||||||
- '/etc/localtime:/etc/localtime:ro'
|
- '/etc/localtime:/etc/localtime:ro' # Sync container timezone with host
|
||||||
- 'elasticsearch-data:/usr/share/elasticsearch/data'
|
- 'elasticsearch-data:/usr/share/elasticsearch/data'
|
||||||
healthcheck:
|
healthcheck:
|
||||||
test:
|
test:
|
||||||
- CMD-SHELL
|
- CMD-SHELL
|
||||||
- 'curl --user elastic:${SERVICE_PASSWORD_ELASTICSEARCH} --silent --fail http://localhost:9200/_cluster/health || exit 1'
|
- 'curl --user elastic:${SERVICE_PASSWORD_ELASTICSEARCH} --silent --fail http://localhost:9200/_cluster/health'
|
||||||
interval: 10s
|
interval: 10s
|
||||||
timeout: 10s
|
timeout: 10s
|
||||||
retries: 24
|
retries: 24
|
||||||
|
|
||||||
kibana:
|
kibana:
|
||||||
image: 'kibana:9.1.2'
|
image: 'kibana:9.1.2'
|
||||||
container_name: kibana
|
|
||||||
restart: unless-stopped
|
|
||||||
environment:
|
environment:
|
||||||
- SERVICE_URL_KIBANA_5601
|
- SERVICE_URL_KIBANA_5601
|
||||||
- 'SERVER_NAME=${SERVICE_URL_KIBANA}'
|
- 'KIBANA_PASSWORD=${SERVICE_PASSWORD_KIBANA}'
|
||||||
- 'SERVER_PUBLICBASEURL=${SERVICE_URL_KIBANA}'
|
- 'ELASTICSEARCH_SERVICEACCOUNTTOKEN=${ELASTICSEARCH_SERVICEACCOUNTTOKEN}' # Kibana authenticates to Elasticsearch using this service token
|
||||||
- 'ELASTICSEARCH_HOSTS=http://elasticsearch:9200'
|
- 'SERVER_NAME=${SERVICE_FQDN_KIBANA}' # For generating links and setting cookie domains
|
||||||
- 'ELASTICSEARCH_USERNAME=kibana_system'
|
- 'SERVER_PUBLICBASEURL=${SERVICE_URL_KIBANA}' # Public URL used in generated links (reporting, alerting, etc.)
|
||||||
- 'ELASTICSEARCH_PASSWORD=${SERVICE_PASSWORD_KIBANA}'
|
- 'ELASTICSEARCH_HOSTS=http://elasticsearch:9200' # Connect Kibana to Elasticsearch Service
|
||||||
- 'XPACK_SECURITY_ENCRYPTIONKEY=${SERVICE_PASSWORD_XPACKSECURITY}'
|
- XPACK.SECURITY.ENABLED=true # Enable authentication and authorization (required for service tokens, roles, etc.)
|
||||||
- 'XPACK_REPORTING_ENCRYPTIONKEY=${SERVICE_PASSWORD_XPACKREPORTING}'
|
- 'XPACK_SECURITY_ENCRYPTIONKEY=${SERVICE_PASSWORD_XPACKSECURITY}' # Required for encrypted session & auth tokens
|
||||||
- 'XPACK_ENCRYPTEDSAVEDOBJECTS_ENCRYPTIONKEY=${SERVICE_PASSWORD_XPACKENCRYPTEDSAVEDOBJECTS}'
|
- 'XPACK_REPORTING_ENCRYPTIONKEY=${SERVICE_PASSWORD_XPACKREPORTING}' # Required for reporting (PDFs, PNGs)
|
||||||
- 'TELEMETRY_OPTIN=${TELEMETRY_OPTIN:-false}'
|
- 'XPACK_ENCRYPTEDSAVEDOBJECTS_ENCRYPTIONKEY=${SERVICE_PASSWORD_XPACKENCRYPTEDSAVEDOBJECTS}' # Required for encrypting saved objects like alerts
|
||||||
|
- 'TELEMETRY_OPTIN=${TELEMETRY_OPTIN:-false}' # Disable telemetry by default (opt-in only)
|
||||||
volumes:
|
volumes:
|
||||||
- '/etc/localtime:/etc/localtime:ro'
|
- '/etc/localtime:/etc/localtime:ro' # Sync container timezone with host
|
||||||
- 'kibana-data:/usr/share/kibana/data'
|
- 'kibana-data:/usr/share/kibana/data'
|
||||||
depends_on:
|
depends_on:
|
||||||
setup:
|
elasticsearch:
|
||||||
condition: service_completed_successfully
|
condition: service_healthy
|
||||||
healthcheck:
|
healthcheck:
|
||||||
test:
|
test:
|
||||||
- CMD-SHELL
|
- CMD-SHELL
|
||||||
- "curl -s http://localhost:5601/api/status | grep -q '\"level\":\"available\"' || exit 1"
|
- "curl -s -I http://localhost:5601 | grep -q 'HTTP/1.1 302 Found'" # Expect HTTP 302 (redirect) from Kibana login page
|
||||||
interval: 10s
|
interval: 10s
|
||||||
timeout: 10s
|
timeout: 10s
|
||||||
retries: 120
|
retries: 120
|
||||||
|
kibana-token-generator:
|
||||||
setup:
|
image: 'alpine:latest'
|
||||||
image: 'elastic/elasticsearch:9.1.2'
|
|
||||||
container_name: kibana-setup
|
|
||||||
depends_on:
|
depends_on:
|
||||||
elasticsearch:
|
elasticsearch:
|
||||||
condition: service_healthy
|
condition: service_healthy
|
||||||
exclude_from_hc: true
|
exclude_from_hc: true
|
||||||
environment:
|
environment:
|
||||||
- 'ELASTIC_PASSWORD=${SERVICE_PASSWORD_ELASTICSEARCH}'
|
- 'ELASTIC_PASSWORD=${SERVICE_PASSWORD_ELASTICSEARCH}' # Needed to authenticate the ELASTICSEARCH_SERVICEACCOUNTTOKEN creation request
|
||||||
- 'KIBANA_PASSWORD=${SERVICE_PASSWORD_KIBANA}'
|
|
||||||
entrypoint:
|
entrypoint:
|
||||||
- sh
|
- sh
|
||||||
- '-c'
|
- '-c'
|
||||||
- |
|
- |
|
||||||
echo "Setting up Kibana user password..."
|
apk add --no-cache curl jq >/dev/null 2>&1
|
||||||
|
echo "Generating Kibana service token..."
|
||||||
until curl -s -u "elastic:${ELASTIC_PASSWORD}" http://elasticsearch:9200/_cluster/health | grep -q '"status":"green\|yellow"'; do
|
RESPONSE=$(curl -s -w "\n%{http_code}" -u elastic:"$${ELASTIC_PASSWORD}" -X POST "http://elasticsearch:9200/_security/service/elastic/kibana/credential/token/kibana-service-token")
|
||||||
echo "Waiting for Elasticsearch..."
|
HTTP_CODE=$$(echo "$${RESPONSE}" | tail -n1)
|
||||||
sleep 2
|
BODY=$$(echo "$${RESPONSE}" | head -n -1)
|
||||||
done
|
if [ "$${HTTP_CODE}" = "200" ]; then
|
||||||
|
CREATED=$$(echo "$${BODY}" | jq -r '.created')
|
||||||
echo "Setting password for kibana_system user..."
|
if [ "$${CREATED}" = "true" ]; then
|
||||||
curl -s -X POST -u "elastic:${ELASTIC_PASSWORD}" \
|
TOKEN_VALUE=$$(echo "$${BODY}" | jq -r '.token.value')
|
||||||
-H "Content-Type: application/json" \
|
echo "Token created successfully:"
|
||||||
http://elasticsearch:9200/_security/user/kibana_system/_password \
|
echo "$${TOKEN_VALUE}"
|
||||||
-d "{\"password\":\"${KIBANA_PASSWORD}\"}" || exit 1
|
else
|
||||||
|
echo "Unexpected response, token not created:"
|
||||||
echo "Kibana setup completed successfully"
|
echo "$${BODY}"
|
||||||
restart: 'no'
|
fi
|
||||||
|
elif [ "$${HTTP_CODE}" = "409" ]; then
|
||||||
|
echo "Token already exists. Skipping token creation."
|
||||||
|
else
|
||||||
|
echo "Failed to create token. HTTP code: $${HTTP_CODE}"
|
||||||
|
echo "$${BODY}"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
restart: 'no' # Run once to generate token, then exit
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue