Skip to content

Commit cc5ecc7

Browse files
FlyingliuhubFlyingliuhub
committed
add future playground
Signed-off-by: Tao Liu <liutaoaz@amazon.com>
1 parent 424ade5 commit cc5ecc7

File tree

3 files changed

+1512
-0
lines changed

3 files changed

+1512
-0
lines changed

‎.github/workflows/trigger-future-deploymnet.yml

+107
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
name: OpenSearch and OpenSearch Dashboards Deployment Template
2+
3+
on:
4+
push:
5+
branches: [ ec2-runner ]
6+
workflow_dispatch:
7+
inputs:
8+
deploy-fresh:
9+
required: false
10+
type: boolean
11+
description: 'Fresh Deploy OpenSearch and OpenSearch Dashboards'
12+
default: false
13+
deploy-upgrade:
14+
required: false
15+
type: boolean
16+
description: 'Upgrade OpenSearch and OpenSearch Dashboards'
17+
default: true
18+
osd-image-tag:
19+
required: true
20+
type: string
21+
description: 'Image tag for OpenSearch Dashboards'
22+
default: '3.0.0-8219474312'
23+
osd-image-repo:
24+
required: true
25+
type: string
26+
description: 'Image repo for OpenSearch Dashboards'
27+
default: 'public.ecr.aws/y0r0d3v8/actionrunner'
28+
os-image-tag:
29+
required: false
30+
type: string
31+
description: 'Image tag for OpenSearch'
32+
default: '3.0.0'
33+
os-image-repo:
34+
required: false
35+
type: string
36+
description: 'Image repo for OpenSearch'
37+
default: 'opensearchstaging/opensearch'
38+
39+
jobs:
40+
41+
Future-OS-OSD-Deployment:
42+
runs-on: ubuntu-latest
43+
44+
steps:
45+
- uses: actions/checkout@v3
46+
- name: Replace Tokens for opensearch-dashboards.yml
47+
uses: cschleiden/replace-tokens@v1
48+
with:
49+
files: '["${{ github.workspace }}/config/playground/helm/future/helm-opensearch-dashboards.yaml"]'
50+
tokenPrefix: '${'
51+
tokenSuffix: '}'
52+
env:
53+
OPENID_CLIENT_ID: ${{ secrets.OPENID_CLIENT_ID_FUTURE }}
54+
OPENID_CLIENT_SECRET: ${{ secrets.OPENID_CLIENT_SECRET_FUTURE }}
55+
OPENID_BASE_REDIRECT_URL: ${{ secrets.OPENID_BASE_REDIRECT_URL_FUTURE }}
56+
OPENID_LOGOUT_URL: ${{ secrets.OPENID_LOGOUT_URL_FUTURE }}
57+
GA_TRACKING_ID: ${{ secrets.GA_TRACKING_ID_FUTURE }}
58+
CERTIFICATE_ARN: ${{ secrets.CERTIFICATE_ARN_FUTURE }}
59+
KIBANASERVER: ${{ secrets.KIBANASERVER }}
60+
OSD-IMAGE-TAG: ${{ inputs.osd-image-tag }}
61+
OSD-IMAGE-REPO: ${{ inputs.osd-image-repo }}
62+
63+
- name: Replace Token in opensearch.yml
64+
uses: cschleiden/replace-tokens@v1
65+
with:
66+
files: '["${{ github.workspace }}/config/playground/helm/future/helm-opensearch.yaml"]'
67+
tokenPrefix: '${'
68+
tokenSuffix: '}'
69+
env:
70+
ESNODE_CERT: ${{ secrets.esnode_cert }}
71+
ESNODE_KEY_CERT: ${{ secrets.esnode_key_cert }}
72+
ROOT_CA_CERT: ${{ secrets.root_ca_cert }}
73+
OS-IMAGE-TAG: ${{ inputs.os-image-tag }}
74+
OS-IMAGE-REPO: ${{ inputs.os-image-repo }}
75+
- name: Configure AWS Credentials
76+
uses: aws-actions/configure-aws-credentials@v2
77+
with:
78+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_PINK }}
79+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_PINK }}
80+
aws-region: ${{ secrets.AWS_REGION_PINK }}
81+
82+
- name: Fresh Deploy OpenSearch and OpenSearch Dashboards By Helm Chart
83+
if: ${{ inputs.deploy-fresh }}
84+
uses: elastic-analytics/dashboards-action@main
85+
env:
86+
KUBE_CONFIG_DATA: ${{ secrets.AWS_ACCESS_KEY_ID_PINK }}
87+
with:
88+
plugins: "" # optional, list of Helm plugins. eg. helm-secrets or helm-diff.
89+
# Teardown the current OS and OSD and then install the lastest version
90+
# of OS and OSD as it only takes 23 seconds for the process, will add
91+
# blue/green deployment later.
92+
command: |
93+
kubectl get nodes
94+
95+
- name: Upgrade Deploy OpenSearch/OpenSearch Dashboards/ML By Helm Chart
96+
if: ${{ inputs.deploy-upgrade }}
97+
uses: elastic-analytics/dashboards-action@main
98+
env:
99+
KUBE_CONFIG_DATA: ${{ secrets.AWS_ACCESS_KEY_ID_PINK }}
100+
with:
101+
plugins: "" # optional, list of Helm plugins. eg. helm-secrets or helm-diff.
102+
# Teardown the current OS and OSD and then install the lastest version
103+
# of OS and OSD as it only takes 23 seconds for the process, will add
104+
# blue/green deployment later.
105+
command: |
106+
kubectl get nodes
107+

‎config/playground/helm/future/helm-opensearch-dashboards.yaml

+246
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,246 @@
1+
# Copyright OpenSearch Contributors
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
# Default values for opensearch-dashboards.
5+
# This is a YAML-formatted file.
6+
# Declare variables to be passed into your templates.
7+
8+
opensearchHosts: "https://opensearch-cluster-leader:9200"
9+
replicaCount: 2
10+
11+
image:
12+
repository: ${OSD_IMAGE_REPOSITORY}
13+
# override image tag, which is .Chart.AppVersion by default
14+
tag: ${OSD_IMAGE_TAG}
15+
pullPolicy: "Always"
16+
17+
startupProbe:
18+
tcpSocket:
19+
port: 5601
20+
periodSeconds: 10
21+
timeoutSeconds: 5
22+
failureThreshold: 20
23+
successThreshold: 1
24+
initialDelaySeconds: 10
25+
26+
livenessProbe:
27+
tcpSocket:
28+
port: 5601
29+
periodSeconds: 20
30+
timeoutSeconds: 5
31+
failureThreshold: 10
32+
successThreshold: 1
33+
initialDelaySeconds: 10
34+
35+
readinessProbe:
36+
tcpSocket:
37+
port: 5601
38+
periodSeconds: 20
39+
timeoutSeconds: 5
40+
failureThreshold: 10
41+
successThreshold: 1
42+
initialDelaySeconds: 10
43+
44+
imagePullSecrets: []
45+
nameOverride: ""
46+
fullnameOverride: ""
47+
48+
serviceAccount:
49+
# Specifies whether a service account should be created
50+
create: true
51+
# Annotations to add to the service account
52+
annotations: {}
53+
# The name of the service account to use.
54+
# If not set and create is true, a name is generated using the fullname template
55+
name: ""
56+
57+
rbac:
58+
create: true
59+
60+
# A list of secrets and their paths to mount inside the pod
61+
# This is useful for mounting certificates for security and for mounting
62+
# the X-Pack license
63+
secretMounts: []
64+
65+
podAnnotations: {}
66+
67+
extraEnvs: []
68+
69+
envFrom: []
70+
71+
extraVolumes: []
72+
73+
extraVolumeMounts: []
74+
75+
extraInitContainers: ""
76+
77+
extraContainers: ""
78+
79+
podSecurityContext: {}
80+
81+
securityContext:
82+
capabilities:
83+
drop:
84+
- ALL
85+
# readOnlyRootFilesystem: true
86+
runAsNonRoot: true
87+
runAsUser: 1000
88+
89+
config:
90+
# Default OpenSearch Dashboards configuration from docker image of Dashboards
91+
opensearch_dashboards.yml:
92+
opensearch.hosts: [https://localhost:9200]
93+
opensearch.ssl.verificationMode: none
94+
opensearch.username: kibanaserver
95+
opensearch.password: ${KIBANASERVER}
96+
opensearch.requestHeadersWhitelist: [authorization, securitytenant]
97+
opensearch_security.auth.anonymous_auth_enabled: true
98+
opensearch_security.multitenancy.enabled: true
99+
opensearch_security.multitenancy.tenants.enable_global: true
100+
opensearch_security.multitenancy.tenants.enable_private: true
101+
opensearch_security.multitenancy.tenants.preferred: [Global, Private]
102+
opensearch_security.readonly_mode.roles: [kibana_read_only]
103+
# Use this setting if you are running opensearch-dashboards without https
104+
opensearch_security.cookie.secure: false
105+
server.host: '0.0.0.0'
106+
# Use the consolidated menu and global header bar
107+
opensearchDashboards.branding.useExpandedHeader: false
108+
# Enable multiple datasource
109+
data_source.enabled: true
110+
data_source.endpointDeniedIPs: [
111+
'127.0.0.0/8',
112+
'::1/128',
113+
'169.254.0.0/16',
114+
'fe80::/10',
115+
'10.0.0.0/8',
116+
'172.16.0.0/12',
117+
'192.168.0.0/16',
118+
'fc00::/7',
119+
'0.0.0.0/8',
120+
'100.64.0.0/10',
121+
'192.0.0.0/24',
122+
'192.0.2.0/24',
123+
'198.18.0.0/15',
124+
'192.88.99.0/24',
125+
'198.51.100.0/24',
126+
'203.0.113.0/24',
127+
'224.0.0.0/4',
128+
'240.0.0.0/4',
129+
'255.255.255.255/32',
130+
'::/128',
131+
'2001:db8::/32',
132+
'ff00::/8',
133+
]
134+
# Enable ml_commons_dashboards
135+
# ml_commons_dashboards.enabled: true
136+
# Content security policy(csp) settings
137+
csp.rules: [ "connect-src 'self' www.google-analytics.com vectors.maps.opensearch.org tiles.maps.opensearch.org maps.opensearch.org;" ]
138+
csp.warnLegacyBrowsers: false
139+
google_analytics_plugin.trackingID: ${GA_TRACKING_ID}
140+
141+
# security plugin for openid
142+
opensearch_security.auth.type: ['Basicauth','openid']
143+
opensearch_security.auth.multiple_auth_enabled: true
144+
opensearch_security.ui.openid.login.buttonname: "Log in with Google account"
145+
opensearch_security.ui.openid.login.brandimage: "https://opensearch.org/assets/brand/PNG/Mark/opensearch_mark_default.png"
146+
opensearch_security.ui.openid.login.showbrandimage: true
147+
opensearch_security.openid.base_redirect_url: ${OPENID_REDIRECT_URL}
148+
opensearch_security.openid.scope: 'openid profile email'
149+
opensearch_security.openid.verify_hostnames: false
150+
opensearch_security.openid.refresh_tokens: false
151+
152+
opensearch_security.openid.connect_url: "https://accounts.google.com/.well-known/openid-configuration"
153+
opensearch_security.openid.client_id: ${OPENID_CLIENT_ID}
154+
opensearch_security.openid.client_secret: ${OPENID_CLIENT_SECRET}
155+
opensearch_security.openid.logout_url: ${OPENID_LOGOUT_URL}
156+
157+
uiSettings:
158+
overrides:
159+
"theme:next": true
160+
"theme:darkMode": false
161+
162+
priorityClassName: ""
163+
164+
opensearchAccount:
165+
secret: ""
166+
keyPassphrase:
167+
enabled: false
168+
169+
labels: {}
170+
171+
hostAliases: []
172+
173+
serverHost: "0.0.0.0"
174+
175+
service:
176+
type: NodePort
177+
# The IP family and IP families options are to set the behaviour in a dual-stack environment
178+
# Omitting these values will let the service fall back to whatever the CNI dictates the defaults
179+
# should be
180+
#
181+
# ipFamilyPolicy: SingleStack
182+
# ipFamilies:
183+
# - IPv4
184+
port: 5601
185+
#targetPort: 5601
186+
loadBalancerIP: ""
187+
nodePort: ""
188+
labels: {}
189+
annotations: {}
190+
loadBalancerSourceRanges: []
191+
# 0.0.0.0/0
192+
httpPortName: http
193+
194+
ingress:
195+
enabled: true
196+
ingressClassName: alb
197+
annotations:
198+
alb.ingress.kubernetes.io/scheme: internet-facing
199+
alb.ingress.kubernetes.io/certificate-arn: ${CERTIFICATE_ARN}
200+
alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
201+
alb.ingress.kubernetes.io/target-type: ip
202+
alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
203+
labels: {}
204+
hosts:
205+
- host: future.playground.opensearch.org
206+
paths:
207+
- path: /
208+
backend:
209+
service:
210+
name: "dashboards-opensearch-dashboards"
211+
port:
212+
number: 5601
213+
tls: []
214+
215+
resources:
216+
requests:
217+
cpu: "1"
218+
memory: "8G"
219+
limits:
220+
cpu: "3"
221+
memory: "24G"
222+
223+
autoscaling:
224+
# This requires metrics server to be installed, to install use kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml
225+
# See https://github.com/kubernetes-sigs/metrics-server
226+
enabled: false
227+
minReplicas: 2
228+
maxReplicas: 10
229+
targetCPUUtilizationPercentage: 80
230+
231+
updateStrategy:
232+
type: "Recreate"
233+
234+
nodeSelector: {}
235+
236+
tolerations: []
237+
238+
affinity: {}
239+
240+
# -- Array of extra K8s manifests to deploy
241+
extraObjects: []
242+
243+
# specify the external plugins to install
244+
plugins:
245+
enabled: true
246+
installList: ["https://github.com/BionIT/google-analytics-plugin/releases/download/3.0.0/googleAnalytics-3.0.0.zip"]

0 commit comments

Comments
 (0)