Project: Disable safeguard plugin (or auth) in Elasticsearch

[jalberto]

I appreciate the authentication plugin included, I sugges make it optional.
All my services are in a private network and not exposed to internet, so don't need authentication (I can imagine this to be common for loggin or internal services).

Is there any workaround to disable it?

[jalberto]

Only option I can see is to add searchguard.disabled: true to elasticsearch.yml but doesn't seems possible in kubedb 0.8

Also I can see a SEARCHGUARD_DISABLED: false ENV in ES pod, but cannot find how to manipulate it in kubedb

[tamalsaha]

This will be supported in the next release. Currently you can manually set SEARCHGUARD_DISABLED=false on the StatefulSets that are used to run ES pod.

[jalberto]

thanks @tamalsaha tha tis what I did, but was trying to avoid manual editing :)

I still suggest to bring a vanilla as possible ES and every plugin to be optional. ES is a moving target, it updates frequently and is very common plugins are not ready for new versions quick enough, this cause a lot of troubles and blocks (specially in staging or tests envs)

[tamalsaha]

Custom Env support has been already implemented in master #163 .

Auth via x-pack will get special support #142 . This needs some code change to setup certs etc.

For any general extension, #193 and #183 are worked on. The general plan is that you can build your custom image with whatever extension you want and use that with KubeDB operator.

Please let us know:

1. if there are cases that can be addressed with these issues resolved.
2. something we can do to make the experience easier for users.

[jalberto]

That sounds like a good plan @tamalsaha
Once those issues are done, does it means the default image used by kubedb will be a vanilla one?

[tamalsaha]

The default image used by KubeDB is here:
https://github.com/kubedb/elasticsearch/tree/master/hack/docker/elasticsearch

Base images are coming from excellent work by @pires here: https://github.com/pires/docker-elasticsearch-kubernetes

If you want to build your custom image, then you should use KubeDB's image as the source.

[jalberto]

@pires work is great! used that images before ES6 went out, but since 6.x those images are not necessary anymore since official images:

• use a minimal image, quite small
• doesn't need any external discovery mechanism anymore
• xpack is opensourced and included

[tamalsaha]

@jalberto, if you would like to contribute images based on ES's official docker images, we are happy to accept it :)

Nothing is set in stone for ever. We wanted to use alpine based images for smaller size. If official images fit the criteria, we can re-evaluate.

Especially, with https://github.com/kubedb/project/issues/183#issuecomment-409715800 in, it is going to be really easy to use any image from any source.

[stormmore]

I would say from a enterprise, encrypt everywhere approach the bare minimum even for ES should be HTTPS. I choose KubeDB because they seemed to strike the right balance security vs. usability

[jalberto]

@stormmore I agree, for that reason my whole VNET is encrypted, instead of handle that to each service ( I have a lot...).
In enterprise the common is to use VPN (or similar) to encrypt all the sensible communication, HTTPS over VPN is hard to justify in my case :)

I am in favour of sensible defaults but the more components are optional the better

[tamalsaha]

This will be possible in next release by setting Env SEARCHGUARD_DISABLED=true .

Searchguard will be remain default on as it now (0.8.0 release).

Please use https://github.com/kubedb/project/issues/142 for any conv on xpack.

[jalberto]

@tamalsaha it seems after some period of time, ES stafulset get overwritten to it's original config (this make sense following the operator pattern) but it means this workaround is not valid :(

[tamalsaha]

Until the next release is out, your best option is to build the image yourself and disable it https://github.com/kubedb/elasticsearch/blob/0.8.0/hack/docker/elasticsearch/6.2.4/config/elasticsearch.yml .

See here: https://kubedb.com/docs/0.8.0/guides/elasticsearch/private-registry/using-private-registry/

We are working as fast as we can, but a new release is at least 2 weeks out. We want to address one the common feature requests even if that means we have to push out the release date.