Ctrlk
Portal
Edit

For ECK

ReadonlyREST plugins officially support installation on Elasticsearch and Kibana working in Kubernetes cluster and managed by the ECK operator.

You can choose one of the following installation methods:

Installation methods

Using our Docker images from Docker Hub

The easiest and fastest method to start with a ROR-powered ELK stack on ECK is to use our official images. We will show you how to do it in the following sections:

Elasticsearch node with ReadonlyREST plugin

If we want to add the ReadonlyREST plugin to the simple Elasticsearch cluster specification from ECK Quickstart we should do it as below:

apiVersion: elasticsearch.k8s.elastic.co/v1
kind: Elasticsearch
metadata:
  name: quickstart
spec:
  version: 8.14.3
  # check https://hub.docker.com/r/beshultd/elasticsearch-readonlyrest
  image: beshultd/elasticsearch-readonlyrest:8.14.3-ror-latest 
  nodeSets:
  - name: default
    count: 1
    config:
      node.store.allow_mmap: false
    podTemplate:
        spec:
          containers:
            - name: elasticsearch
              # we have to run our image as root (id: 0) - after the required patching step Elasticsearch will be run using "elasticsearch" user (id: 1000)
              securityContext:
                runAsNonRoot: false
                runAsUser: 0
                runAsGroup: 0
              env:
                # we have to explicitly agree to patch the ES binaries (the patching step will be done only once)
                - name: I_UNDERSTAND_AND_ACCEPT_ES_PATCHING
                  value: "yes"
                # these two passwords are used by "elastic-internal" and "elastic-internal-probe" users - these users are used by ECK
                - name: INTERNAL_USR_PASS
                  valueFrom:
                    secretKeyRef:
                      name: quickstart-es-internal-users
                      key: elastic-internal
                - name: INTERNAL_PROBE_PASS
                  valueFrom:
                    secretKeyRef:
                      name: quickstart-es-internal-users
                      key: elastic-internal-probe
                # Kibana service account to handle internal Kibana requests 
                - name: KIBANA_SERVICE_ACCOUNT_TOKEN
                  valueFrom:
                    secretKeyRef:
                      name: quickstart-kibana-user
                      key: token
              # the initial readonlyrest.yml file loaded by ROR plugin during ES startup
              volumeMounts:
                - name: config-ror
                  mountPath: /usr/share/elasticsearch/config/readonlyrest.yml
                  subPath: readonlyrest.yml
          volumes:
            - name: config-ror
              configMap:
                name: config-readonlyrest.yml

ReadonlyREST initial settings

The initial settings can be defined as ConfigMap like this:

Notice that if you use ROR Enterprise, you can take advantage of the Cluster-wide Settings functionality and reload configuration on all your nodes without restarting K8s' PODs.

Kibana node with ReadonlyREST plugin

If we want to add the ReadonlyREST plugin to the simple Kibana instance specification from ECK Quickstart we should do it as follows:

And these are all differences we need to make to run ECK Quickstart with ReadonlyREST instead of X-Pack security.

Using Docker images built by you and stored in your registry

As you probably noticed, our docker images have to be run with root privileges. It's due to legal reasons and you, as a user, have to confirm that you agree to do the patching steps. If running a pod with root privileges is something you cannot accept, you can create your own image with the patching step done at the image creation level (not at runtime as our image does) and save it your your own registry.

Expand to see details

Elasticsearch with ROR custom image

The minimal Elasticsearch with ROR image definition looks like this:

And then you can build it as follows:

And place the elasticsearch-with-ror image in your registry.

Elasticsearch node with ReadonlyREST plugin

If we want to add the ReadonlyREST plugin to the simple Elasticsearch cluster specification from ECK Quickstart we should do it as below:

Check the section from the previous paragraph to see how to define config-ror.

Kibana with ROR custom image

The minimal Kibana with ROR image definition looks like this:

And then you can build it as follows:

And place the kibana-with-ror image in your registry.

Kibana node with ReadonlyREST plugin

If we want to add the ReadonlyREST plugin to the simple Kibana instance specification from ECK Quickstart we should do it as follows:

And these are all differences we need to make to run ECK Quickstart with ReadonlyREST instead of X-Pack security.

Using an Init Container

This is not a recommended method.

It's possible to install ROR using an Init Container. Unfortunately, this method is not as easy to use in the case of ROR. This is due to the required ReadonlyREST patching step (for both plugins), which allows ROR to work with Elasticsearch/Kibana. During this step, the ROR patcher tool modifies some of the Elasticsearch and Kibana binaries. Different versions of Elasticsearch/Kibana require different binaries to be modified. In order to do this in a Kubernetes-based environment, we need to mount appropriate locations from the Elasticsearch/Kibana POD to the init container that will install ROR. The volumes should have write permissions because of the changes made by the ROR patcher. You can still use this method, but as you can see it's not that easy.

Expand to see details

If you are still interested in this one, please take a look at the examples in our repository:

Handling asynchronous ROR startup

ReadonlyREST starts asynchronously during Elasticsearch initialization. In some cases, there may be a brief moment when the pod reports as ready, but ROR is still starting up. During this window, requests may receive error responses (403/401/503, depending on your settings).

If you need to ensure that the pod is only marked as ready after ROR has fully started, you can use the sidecar pattern described below.

Note: This is an optional pattern and not required for most deployments. Elastic does not recommend overriding the default Elasticsearch readiness probe. The sidecar pattern allows you to achieve ROR readiness checking without modifying the main Elasticsearch probe.

Sidecar pattern for ROR readiness

The following example extends the basic Elasticsearch configuration by adding a sidecar container (ror-ready-gate) that includes its own readiness probe. This probe checks if ROR is ready to handle requests by testing the cluster health endpoint with proper authentication:

How it works

  1. The ror-ready-gate sidecar container runs alongside Elasticsearch

  2. Its readiness probe makes authenticated requests to the cluster health endpoint

  3. The pod is only marked ready when both containers pass their readiness checks

  4. This ensures ROR is fully initialized before the pod receives traffic

The readiness probe will retry for up to 5 minutes (60 failures × 5 second period) before marking the pod as failed.

Notes

  • ReadonlyREST SSL can be used but it's simpler to leave xpack.security.enabled: true and use X-Pack SSL instead

  • To figure out how to obtain the ROR License see our guide.

Example

You can check the ROR-powered ECK Quickstart example by running our one-liner script. It supports MacOS and Linux.

PreviousReadonlyREST APINextUniversal Builds

Last updated