Deploying ECK on OpenShift
editDeploying ECK on OpenShift
editThis page shows how to run ECK on OpenShift.
Only Elasticsearch and Kibana are compatible with the restricted
Security Context Constraint. To run the APM Server on OpenShift you must allow the Pod to run with the anyuid
SCC as described in Deploy an APM Server instance with a route
Before you begin
edit-
To run the instructions on this page, you must be a
system:admin
user or a user with the privileges to create Projects, CRDs, and RBAC resources at the cluster level. -
Set virtual memory settings on the Kubernetes nodes.
Before deploying an Elasticsearch cluster with ECK, make sure that the Kubernetes nodes in your cluster have the correct
vm.max_map_count
sysctl setting applied. By default, Pods created by ECK are likely to run with therestricted
Security Context Constraint (SCC) which restricts privileged access required to change this setting in the underlying Kubernetes nodes.Alternatively, you can opt for setting
node.store.allow_mmap: false
at the Elasticsearch node configuration level, but note that this has performance implications and is not recommended for production workloads.For more information, see: Virtual memory.
Deploy the operator
edit-
Apply the all-in-one template, as described in the quickstart.
oc apply -f https://download.elastic.co/downloads/eck/1.0.1/all-in-one.yaml
-
[Optional] If the Software Defined Network is configured with the
ovs-multitenant
plug-in, you must allow theelastic-system
namespace to access other Pods and Services in the cluster:oc adm pod-network make-projects-global elastic-system
-
Create a namespace to hold the Elastic resources (Elasticsearch, Kibana):
oc new-project elastic # creates the elastic project
By default the operator watches and creates resources in the
default
namespace. You need to patch the operator to manage resources in another namespace.kubectl patch statefulset/elastic-operator \ -n elastic-system \ --type='json' \ --patch '[{"op":"add","path":"/spec/template/spec/containers/0/env/-","value": {"name": "NAMESPACE", "value": "elastic"}}]'
Replace
elastic
in the examples above with the name of the namespace in which you want to deploy your resources. -
[Optional] Allow another user or a group of users to manage the Elastic resources:
oc adm policy add-role-to-user elastic-operator developer -n elastic
In the example above the user
developer
is allowed to manage Elastic resources in the namespaceelastic
.
Deploy an Elasticsearch instance with a route
editUse the following code to create an Elasticsearch cluster elasticsearch-sample
and a "passthrough" route to access it:
cat <<EOF | oc apply -n elastic -f - # This sample sets up an Elasticsearch cluster with an OpenShift route apiVersion: elasticsearch.k8s.elastic.co/v1 kind: Elasticsearch metadata: name: elasticsearch-sample spec: version: 8.15.3 nodeSets: - name: default count: 1 config: node.master: true node.data: true node.ingest: true node.store.allow_mmap: false --- apiVersion: route.openshift.io/v1 kind: Route metadata: name: elasticsearch-sample spec: #host: elasticsearch.example.com # override if you don't want to use the host that is automatically generated by OpenShift (<route-name>[-<namespace>].<suffix>) tls: termination: passthrough # Elasticsearch is the TLS endpoint insecureEdgeTerminationPolicy: Redirect to: kind: Service name: elasticsearch-sample-es-http EOF
Deploy a Kibana instance with a route
editUse the following code to create a Kibana instance and a "passthrough" route to access it:
cat <<EOF | oc apply -n elastic -f - apiVersion: kibana.k8s.elastic.co/v1 kind: Kibana metadata: name: kibana-sample spec: version: 8.15.3 count: 1 elasticsearchRef: name: "elasticsearch-sample" podTemplate: spec: containers: - name: kibana resources: limits: memory: 1Gi cpu: 1 --- apiVersion: v1 kind: Route metadata: name: kibana-sample spec: #host: kibana.example.com # override if you don't want to use the host that is automatically generated by OpenShift (<route-name>[-<namespace>].<suffix>) tls: termination: passthrough # Kibana is the TLS endpoint insecureEdgeTerminationPolicy: Redirect to: kind: Service name: kibana-sample-kb-http EOF
Use the following command to get the hosts of each Route
:
oc get route -n elastic
Deploy an APM Server instance with a route
editIt is currently not possible to run the APM Server with the restricted
SCC. A possible workaround is to allow the Pod to run with the default uid 1000
by assigning it to the anyuid
SCC:
-
Create a service account to run the APM Server
oc create serviceaccount apm-server -n elastic
-
Add the APM service account to the
anyuid
SCCoc adm policy add-scc-to-user anyuid -z apm-server -n elastic
scc "anyuid" added to: ["system:serviceaccount:elastic:apm-server"]
-
Deploy an APM Server and a route with the following manifest
cat <<EOF | oc apply -n elastic -f - apiVersion: apm.k8s.elastic.co/v1 kind: ApmServer metadata: name: apm-server-sample spec: version: 8.15.3 count: 1 elasticsearchRef: name: "elasticsearch-sample" podTemplate: spec: serviceAccountName: apm-server --- apiVersion: v1 kind: Route metadata: name: apm-server-sample spec: #host: apm-server.example.com # override if you don't want to use the host that is automatically generated by OpenShift (<route-name>[-<namespace>].<suffix>) tls: termination: passthrough # the APM Server is the TLS endpoint insecureEdgeTerminationPolicy: Redirect to: kind: Service name: apm-server-sample-apm-http EOF
To check that the Pod of the APM Server is using the correct SCC, use the following command:
oc get pod -o go-template='{{range .items}}{{$scc := index .metadata.annotations "openshift.io/scc"}}{{.metadata.name}}{{" scc:"}}{{range .spec.containers}}{{$scc}}{{" "}}{{"\n"}}{{end}}{{end}}'
apm-server-sample-apm-server-86bfc5c95c-96lbx scc:anyuid elasticsearch-sample-es-5tsqghmm79 scc:restricted elasticsearch-sample-es-6qk52mz5jk scc:restricted elasticsearch-sample-es-dg4vvpm2mr scc:restricted kibana-sample-kb-97c6b6b8d-lqfd2 scc:restricted
Elasticsearch plugins
editNote that Elasticsearch plugins cannot be installed at runtime in most OpenShift environments. This is because the plugin installer must run as root, but Elasticsearch is restricted from running as root. To add plugins to Elasticsearch, you can use custom images as described in Creating custom images.