[metricbeat] using https to connect to elasticsearch

metricbeat/examples/default/test/goss-metrics.yaml

@@ -17,31 +17,29 @@ user:
     gid: 1000
 
 http:
-  http://elasticsearch-master:9200/_cat/indices:
+  https://elasticsearch-master:9200/_cat/indices:
+    allow-insecure: true
     status: 200
     timeout: 2000
     username: "{{ .Env.ELASTICSEARCH_USERNAME }}"
     password: "{{ .Env.ELASTICSEARCH_PASSWORD }}"
     body:
       - "metricbeat-8.1.0"
-
-  ? "http://elasticsearch-master:9200/_search?q=metricset.name:state_container%20AND%20kubernetes.container.name:metricbeat"
-  : status: 200
+  https://elasticsearch-master:9200/_search?q=metricset.name:state_deployment:
+    status: 200
+    allow-insecure: true
     timeout: 2000
     username: "{{ .Env.ELASTICSEARCH_USERNAME }}"
     password: "{{ .Env.ELASTICSEARCH_PASSWORD }}"
-    body:
-      - "metricbeat-8.1.0"
 
 file:
   /usr/share/metricbeat/metricbeat.yml:
     exists: true
     contains:
       - "output.elasticsearch"
-      - "elasticsearch-master:9200"
 
 command:
   cd /usr/share/metricbeat && metricbeat test output:
     exit-status: 0
     stdout:
-      - "elasticsearch: http://elasticsearch-master:9200"
+      - "elasticsearch: https://elasticsearch-master:9200"

metricbeat/examples/default/test/goss.yaml

@@ -21,20 +21,22 @@ user:
     gid: 1000
 
 http:
-  http://elasticsearch-master:9200/_cat/indices:
+  https://elasticsearch-master:9200/_cat/indices:
+    allow-insecure: true
     status: 200
     timeout: 2000
     username: "{{ .Env.ELASTICSEARCH_USERNAME }}"
     password: "{{ .Env.ELASTICSEARCH_PASSWORD }}"
     body:
       - "metricbeat-8.1.0"
-  ? "http://elasticsearch-master:9200/_search?q=metricset.name:container%20AND%20kubernetes.container.name:metricbeat"
-  : status: 200
+  https://elasticsearch-master:9200/_search?q=metricset.name:container:
+    status: 200
     timeout: 2000
-    username: "{{ .Env.ELASTICSEARCH_USERNAME }}"
-    password: "{{ .Env.ELASTICSEARCH_PASSWORD }}"
     body:
       - "metricbeat-8.1.0"
+    allow-insecure: true
+    username: "{{ .Env.ELASTICSEARCH_USERNAME }}"
+    password: "{{ .Env.ELASTICSEARCH_PASSWORD }}"
 
 file:
   /usr/share/metricbeat/metricbeat.yml:
@@ -48,4 +50,4 @@ command:
   cd /usr/share/metricbeat && metricbeat test output:
     exit-status: 0
     stdout:
-      - "elasticsearch: http://elasticsearch-master:9200"
+      - "elasticsearch: https://elasticsearch-master:9200"

metricbeat/examples/oss/test/goss-metrics.yaml

@@ -17,20 +17,20 @@ user:
     gid: 1000
 
 http:
-  http://elasticsearch-master:9200/_cat/indices:
+  https://elasticsearch-master:9200/_cat/indices:
     status: 200
+    allow-insecure: true
     timeout: 2000
     username: "{{ .Env.ELASTICSEARCH_USERNAME }}"
     password: "{{ .Env.ELASTICSEARCH_PASSWORD }}"
     body:
       - "metricbeat-oss-8.1.0"
-  http://elasticsearch-master:9200/_search?q=metricset.name:state_deployment:
+  https://elasticsearch-master:9200/_search?q=metricset.name:state_deployment:
+    allow-insecure: true
     status: 200
     timeout: 2000
     username: "{{ .Env.ELASTICSEARCH_USERNAME }}"
     password: "{{ .Env.ELASTICSEARCH_PASSWORD }}"
-    body:
-      - "metricbeat-oss-8.1.0"
 
 file:
   /usr/share/metricbeat/metricbeat.yml:
@@ -42,4 +42,4 @@ command:
   cd /usr/share/metricbeat && metricbeat test output:
     exit-status: 0
     stdout:
-      - "elasticsearch: http://elasticsearch-master:9200"
+      - "elasticsearch: https://elasticsearch-master:9200"

metricbeat/examples/oss/test/goss.yaml

@@ -21,8 +21,9 @@ user:
     gid: 1000
 
 http:
-  http://elasticsearch-master:9200/_cat/indices:
+  https://elasticsearch-master:9200/_cat/indices:
     status: 200
+    allow-insecure: true
     timeout: 2000
     username: "{{ .Env.ELASTICSEARCH_USERNAME }}"
     password: "{{ .Env.ELASTICSEARCH_PASSWORD }}"
@@ -40,4 +41,4 @@ command:
   cd /usr/share/metricbeat && metricbeat test output:
     exit-status: 0
     stdout:
-      - "elasticsearch: http://elasticsearch-master:9200"
+      - "elasticsearch: https://elasticsearch-master:9200"

metricbeat/examples/oss/values.yaml

@@ -52,9 +52,16 @@ daemonset:
         username: '${ELASTICSEARCH_USERNAME}'
         password: '${ELASTICSEARCH_PASSWORD}'
         index: "metricbeat-oss-%{[agent.version]}-%{+yyyy.MM.dd}"
+        protocol: https
+        ssl.certificate_authorities:
+          - /usr/share/metricbeat/config/certs/ca.crt
       setup.ilm.enabled: false
       setup.template.name: "metricbeat"
       setup.template.pattern: "metricbeat-oss-*"
+  secretMounts:
+    - name: elasticsearch-master-certs
+      secretName: elasticsearch-master-certs
+      path: /usr/share/metricbeat/config/certs
 
 deployment:
   metricbeatConfig:
@@ -75,6 +82,13 @@ deployment:
         username: '${ELASTICSEARCH_USERNAME}'
         password: '${ELASTICSEARCH_PASSWORD}'
         index: "metricbeat-oss-%{[agent.version]}-%{+yyyy.MM.dd}"
+        protocol: https
+        ssl.certificate_authorities:
+          - /usr/share/metricbeat/config/certs/ca.crt
       setup.ilm.enabled: false
       setup.template.name: "metricbeat"
       setup.template.pattern: "metricbeat-oss-*"
+  secretMounts:
+    - name: elasticsearch-master-certs
+      secretName: elasticsearch-master-certs
+      path: /usr/share/metricbeat/config/certs

metricbeat/examples/upgrade/test/goss-metrics.yaml

@@ -17,17 +17,20 @@ user:
     gid: 1000
 
 http:
-  http://upgrade-master:9200/_cat/indices:
+  https://upgrade-master:9200/_cat/indices:
+    allow-insecure: true
     status: 200
     timeout: 2000
+    username: "{{ .Env.ELASTICSEARCH_USERNAME }}"
+    password: "{{ .Env.ELASTICSEARCH_PASSWORD }}"
     body:
-      - "metricbeat-7.10.0"
-
-  ? "http://upgrade-master:9200/_search?q=metricset.name:state_container%20AND%20kubernetes.container.name:metricbeat"
-  : status: 200
+      - "metricbeat-8.1.0"
+  https://upgrade-master:9200/_search?q=metricset.name:state_container%20AND%20kubernetes.container.name:metricbeat:
+    status: 200
     timeout: 2000
-    body:
-      - "metricbeat-7.10.0"
+    allow-insecure: true
+    username: "{{ .Env.ELASTICSEARCH_USERNAME }}"
+    password: "{{ .Env.ELASTICSEARCH_PASSWORD }}"
 
 file:
   /usr/share/metricbeat/metricbeat.yml:
@@ -39,4 +42,4 @@ command:
   cd /usr/share/metricbeat && metricbeat test output:
     exit-status: 0
     stdout:
-      - "elasticsearch: http://upgrade-master:9200"
+      - "elasticsearch: https://upgrade-master:9200"

metricbeat/examples/upgrade/test/goss.yaml

@@ -21,16 +21,20 @@ user:
     gid: 1000
 
 http:
-  http://upgrade-master:9200/_cat/indices:
+  https://upgrade-master:9200/_cat/indices:
+    allow-insecure: true
+    username: "{{ .Env.ELASTICSEARCH_USERNAME }}"
+    password: "{{ .Env.ELASTICSEARCH_PASSWORD }}"
     status: 200
     timeout: 2000
     body:
       - "metricbeat-8.1.0"
-  ? "http://upgrade-master:9200/_search?q=metricset.name:container%20AND%20kubernetes.container.name:metricbeat"
-  : status: 200
+  https://upgrade-master:9200/_search?q=metricset.name:container%20AND%20kubernetes.container.name:metricbeat:
+    allow-insecure: true
+    username: "{{ .Env.ELASTICSEARCH_USERNAME }}"
+    password: "{{ .Env.ELASTICSEARCH_PASSWORD }}"
+    status: 200
     timeout: 2000
-    body:
-      - "metricbeat-8.1.0"
 
 file:
   /usr/share/metricbeat/metricbeat.yml:
@@ -43,4 +47,4 @@ command:
   cd /usr/share/metricbeat && metricbeat test output:
     exit-status: 0
     stdout:
-      - "elasticsearch: http://upgrade-master:9200"
+      - "elasticsearch: https://upgrade-master:9200"

metricbeat/examples/upgrade/values.yaml

@@ -1,14 +1,106 @@
----
-extraEnvs:
-  - name: ELASTICSEARCH_HOSTS
-    value: upgrade-master:9200
-  - name: "ELASTICSEARCH_USERNAME"
-    valueFrom:
-      secretKeyRef:
-        name: upgrade-master-credentials
-        key: username
-  - name: "ELASTICSEARCH_PASSWORD"
-    valueFrom:
-      secretKeyRef:
-        name: upgrade-master-credentials
-        key: password
+daemonset:
+  extraEnvs:
+    - name: "ELASTICSEARCH_USERNAME"
+      valueFrom:
+        secretKeyRef:
+          name: upgrade-master-credentials
+          key: username
+    - name: "ELASTICSEARCH_PASSWORD"
+      valueFrom:
+        secretKeyRef:
+          name: upgrade-master-credentials
+          key: password
+  metricbeatConfig:
+    metricbeat.yml: |
+      metricbeat.modules:
+      - module: kubernetes
+        metricsets:
+          - container
+          - node
+          - pod
+          - system
+          - volume
+        period: 10s
+        host: "${NODE_NAME}"
+        hosts: ["https://${NODE_NAME}:10250"]
+        bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+        ssl.verification_mode: "none"
+        # If using Red Hat OpenShift remove ssl.verification_mode entry and
+        # uncomment these settings:
+        #ssl.certificate_authorities:
+          #- /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt
+        processors:
+        - add_kubernetes_metadata: ~
+      - module: kubernetes
+        enabled: true
+        metricsets:
+          - event
+      - module: system
+        period: 10s
+        metricsets:
+          - cpu
+          - load
+          - memory
+          - network
+          - process
+          - process_summary
+        processes: ['.*']
+        process.include_top_n:
+          by_cpu: 5
+          by_memory: 5
+      - module: system
+        period: 1m
+        metricsets:
+          - filesystem
+          - fsstat
+        processors:
+        - drop_event.when.regexp:
+            system.filesystem.mount_point: '^/(sys|cgroup|proc|dev|etc|host|lib)($|/)'
+      output.elasticsearch:
+        username: '${ELASTICSEARCH_USERNAME}'
+        password: '${ELASTICSEARCH_PASSWORD}'
+        protocol: https
+        hosts: ["https://upgrade-master:9200"]
+        ssl.certificate_authorities:
+          - /usr/share/metricbeat/certs/ca.crt
+  secretMounts:
+    - name: upgrade-master-certs
+      secretName: upgrade-master-certs
+      path: /usr/share/metricbeat/certs
+
+deployment:
+  extraEnvs:
+    - name: "ELASTICSEARCH_USERNAME"
+      valueFrom:
+        secretKeyRef:
+          name: upgrade-master-credentials
+          key: username
+    - name: "ELASTICSEARCH_PASSWORD"
+      valueFrom:
+        secretKeyRef:
+          name: upgrade-master-credentials
+          key: password
+  metricbeatConfig:
+    metricbeat.yml: |
+      metricbeat.modules:
+      - module: kubernetes
+        enabled: true
+        metricsets:
+          - state_node
+          - state_deployment
+          - state_replicaset
+          - state_pod
+          - state_container
+        period: 10s
+        hosts: ["${KUBE_STATE_METRICS_HOSTS}"]
+      output.elasticsearch:
+        username: '${ELASTICSEARCH_USERNAME}'
+        password: '${ELASTICSEARCH_PASSWORD}'
+        protocol: https
+        hosts: ["https://upgrade-master:9200"]
+        ssl.certificate_authorities:
+          - /usr/share/metricbeat/certs/ca.crt
+  secretMounts:
+    - name: upgrade-master-certs
+      secretName: upgrade-master-certs
+      path: /usr/share/metricbeat/certs

metricbeat/values.yaml

@@ -86,13 +86,18 @@ daemonset:
         - drop_event.when.regexp:
             system.filesystem.mount_point: '^/(sys|cgroup|proc|dev|etc|host|lib)($|/)'
       output.elasticsearch:
-        hosts: '${ELASTICSEARCH_HOSTS:elasticsearch-master:9200}'
+        hosts: '["https://${ELASTICSEARCH_HOSTS:elasticsearch-master:9200}"]'
+        ssl.enabled: true
+        ssl.certificate_authorities: ["/usr/share/metricbeat/certs/ca.crt"]
         username: '${ELASTICSEARCH_USERNAME}'
         password: '${ELASTICSEARCH_PASSWORD}'
   nodeSelector: {}
   # A list of secrets and their paths to mount inside the pod
   # This is useful for mounting certificates for security other sensitive values
-  secretMounts: []
+  secretMounts:
+    - name: elasticsearch-master-certs
+      secretName: elasticsearch-master-certs
+      path: /usr/share/metricbeat/certs/
   #  - name: metricbeat-certificates
   #    secretName: metricbeat-certificates
   #    path: /usr/share/metricbeat/certs
@@ -165,13 +170,18 @@ deployment:
         period: 10s
         hosts: ["${KUBE_STATE_METRICS_HOSTS}"]
       output.elasticsearch:
-        hosts: '${ELASTICSEARCH_HOSTS:elasticsearch-master:9200}'
+        hosts: '["https://${ELASTICSEARCH_HOSTS:elasticsearch-master:9200}"]'
         username: '${ELASTICSEARCH_USERNAME}'
         password: '${ELASTICSEARCH_PASSWORD}'
+        ssl.enabled: true
+        ssl.certificate_authorities: ["/usr/share/metricbeat/certs/ca.crt"]
   nodeSelector: {}
   # A list of secrets and their paths to mount inside the pod
   # This is useful for mounting certificates for security other sensitive values
-  secretMounts: []
+  secretMounts:
+    - name: elasticsearch-master-certs
+      secretName: elasticsearch-master-certs
+      path: /usr/share/metricbeat/certs/
   #  - name: metricbeat-certificates
   #    secretName: metricbeat-certificates
   #    path: /usr/share/metricbeat/certs