Helm-charts: Install plugins?

[elijahsgh]

initContainers doesn't seem to be exposed. Is there a way to install plugins with this chart?

[Crazybus]

Hi!

The recommended way to install plugins into our docker images is to create a custom docker image.

The Dockerfile would look something like:

ARG elasticsearch_version
FROM docker.elastic.co/elasticsearch/elasticsearch:${elasticsearch_version}

RUN bin/elasticsearch-plugin install --batch repository-gcs

And then updating image: in values to point to your custom image.

There are a couple reasons we recommend this.

1. Tying the availability of Elasticsearch to the download service to install plugins is not a great idea or something that we recommend. Especially in Kubernetes where it is normal and expected for a container to be moved to another host at random times.
2. Mutating the state of a running docker image (by installing plugins) goes against best practices of containers and immutable infrastructure.

[elijahsgh]

I see. Thank you!

My next question was going to be how to insert values into the elasticsearch keystore, but it sounds like the answer all-around is custom image. :+1:

[Crazybus]

The keystore contains sensitive secrets and isn't really suitable to being baked into the docker image. It would also mean you would need seperate docker images for each cluster you have. It's much better to store it as a kubernetes secret and mount it into the container.

$ kubectl create secret generic elasticsearch-keystore --from-file=./elasticsearch.keystore

Then mount it via the secretMounts value.

secretMounts:
  - name: elasticsearch-keystore
    secretName: elasticsearch-keystore
    path: /usr/share/elasticsearch/config/elasticsearch.keystore
    subPath: elasticsearch.keystore

I have made a note to get both of these examples added into the readme since I'm sure others will have the same question.

[Crazybus]

Added an FAQ section in https://github.com/elastic/helm-charts/pull/52

[elijahsgh]

Sounds great and the FAQ is looking good. I was able to get the gcs-repository working just fine (funny that's the one you put in your example). :)

I had one more question, though. For the elasticsearch.keystore, is it somehow tied to a cluster? Can I generate that with any keystore tool (for example, from a desktop) and have it work with any deployment I do, or is there some seed based on the cluster config that will make that not work?

To get my deploy working I just used the elasticsearch-keystore tool in the custom image I created, but I wasn't sure if that was somehow seeded with a keystore encryption key.

[Crazybus]

Can I generate that with any keystore tool (for example, from a desktop) and have it work with any deployment I do, or is there some seed based on the cluster config that will make that not work?

Yup, it just works! I used the elasticsearch-keystore command from my laptop (macbook running OSX) which works just fine in any other cluster.

[elijahsgh]

Thank you for the assistance. Everything is working great with the strategy that was added to the FAQ.