logging-es-kopf-template.yaml

---
kind: Template
apiVersion: v1
metadata:
  name: logging-es-kopf
  annotations:
    openshift.io/display-name: Kopf for Origin Aggregated Logging
    description: Kopf is a simple web administration tool for elasticsearch written in JavaScript + AngularJS + jQuery + Twitter bootstrap. For more information see github.com/lmenezes/elasticsearch-kopf.
      It is expected that Origin Aggregated Logging project has been deployed.
    tags: kopf,elasticsearch,administration
    iconClass: icon-apache
    template.openshift.io/long-description: This template defines resources needed
      to deploy Kopf, the web administration tool for elasticsearch v2.
labels:
  template: logging-es-kopf
objects:
- kind: OAuthClient
  apiVersion: v1
  metadata:
    labels:
      logging-infra: support
    name: kopf-proxy
  redirectURIs:
  - https://${KOPF_SECURE_URL}
  respondWithChallenges: false
  secret: ${OPENSHIFT_OAUTH_CLIENT_SECRET}
  scopeRestrictions:
  - literals:
    - user:info
    - user:check-access
    - user:list-projects
- kind: ServiceAccount
  apiVersion: v1
  metadata:
    name: aggregated-logging-es-kopf
    labels:
      logging: logging-es-kopf
    annotations:
      serviceaccounts.openshift.io/oauth-redirectreference.primary: '{"kind":"OAuthRedirectReference","apiVersion":"v1","reference":{"kind":"Route","name":"logging-es-kopf"}}'
- kind: Route
  apiVersion: v1
  metadata:
    name: logging-es-kopf
    labels:
      logging: logging-es-kopf
  spec:
    host: ${KOPF_SECURE_URL}
    to:
      name: logging-es-kopf
    tls:
      termination: Reencrypt
- kind: Service
  apiVersion: v1
  metadata:
    name: logging-es-kopf
    annotations:
      description: Exposes and load balances the application pods
    labels:
      logging: logging-es-kopf
    annotations:
      service.alpha.openshift.io/serving-cert-secret-name: proxy-tls
  spec:
    ports:
    - name: proxy
      port: 443
      targetPort: 4443
    selector:
      logging: logging-es-kopf
- kind: ImageStream
  apiVersion: v1
  metadata:
    name: logging-es-kopf
    labels:
      logging: logging-es-kopf
    annotations:
      description: Keeps track of changes in the application image
- kind: ImageStream
  apiVersion: v1
  metadata:
    name: openshift-httpd
    labels:
      logging: logging-es-kopf
    namespace: ${NAMESPACE}
    annotations:
      openshift.io/display-name: apache http server
  spec:
    dockerImageRepository: docker.io/centos/httpd-24-centos7
- kind: BuildConfig
  apiVersion: v1
  metadata:
    name: logging-es-kopf
    labels:
      logging: logging-es-kopf
    annotations:
      description: Defines how to build the application
  spec:
    source:
      type: Git
      git:
        uri: ${SOURCE_REPOSITORY_URL}
        ref: ${SOURCE_REPOSITORY_REF}
      contextDir: ${CONTEXT_DIR}
    strategy:
      type: Source
      sourceStrategy:
        from:
          kind: ImageStreamTag
          namespace: ${NAMESPACE}
          name: openshift-httpd:latest
    output:
      to:
        kind: ImageStreamTag
        name: logging-es-kopf:latest
    triggers:
    - type: ImageChange
    - type: ConfigChange
- kind: DeploymentConfig
  apiVersion: v1
  metadata:
    name: logging-es-kopf
    labels:
      logging: logging-es-kopf
    annotations:
      description: Defines how to deploy the application server
  spec:
    replicas: 1
    selector:
      name: logging-es-kopf
    template:
      metadata:
        name: logging-es-kopf
        labels:
          name: logging-es-kopf
          logging: logging-es-kopf
      spec:
        containers:
        - name: logging-es-kopf
          image: logging-es-kopf
          command: ["/opt/app-root/scripts/run-kopf.sh"]
          ports:
          volumeMounts:
          - mountPath: /etc/httpd/conf/
            name: config
          - mountPath: /opt/app-root/scripts/
            name: run
          - mountPath: /etc/elasticsearch/secret
            name: elasticsearch
            readOnly: true
          resources:
            limits:
              memory: ${KOPF_MEMORY_LIMIT}
        - name: logging-es-kopf-auth-proxy
          image: openshift/oauth-proxy:v1.0.0
          imagePullPolicy: Always
          args:
          - --https-address=:4443
          - -provider=openshift
          - -client-id=kopf-proxy
          - -client-secret=${OPENSHIFT_OAUTH_CLIENT_SECRET}
          - -upstream=http://localhost:8080
          - '-openshift-sar={"namespace": "default", "verb": "create", "resource": "pods"}'
          - --tls-cert=/etc/tls/private/tls.crt
          - --tls-key=/etc/tls/private/tls.key
          - --cookie-secret=${SESSION_SECRET}=
          - -pass-access-token
          ports:
          - containerPort: 4443
            name: kopf-proxy
            protocol: TCP
          volumeMounts:
          - mountPath: /etc/tls/private
            name: proxy-tls
            readOnly: true
          resources:
            limits:
              memory: ${AUTH_PROXY_MEMORY_LIMIT}
        volumes:
        - name: elasticsearch
          secret:
            secretName: logging-elasticsearch
        - name: config
          configMap:
            name: logging-es-kopf-config
            defaultMode: 0611
        - name: run
          configMap:
            name: logging-es-kopf-run
            defaultMode: 0611
        - name: proxy-tls
          secret:
            secretName: proxy-tls
    strategy:
      type: Recreate
    triggers:
    - type: ImageChange
      imageChangeParams:
        automatic: true
        containerNames:
        - logging-es-kopf
        from:
          kind: ImageStreamTag
          name: logging-es-kopf:latest
    - type: ConfigChange
- kind: ConfigMap
  apiVersion: v1
  metadata:
    name: logging-es-kopf-run
    labels:
      logging: logging-es-kopf
  data:
    run-kopf.sh: |
      #!/bin/bash

      set -eu

      KOPF_REFRESH_RATE="${KOPF_REFRESH_RATE:-5000}"
      KOPF_THEME="${KOPF_THEME:-dark}"
      KOPF_WITH_CREDENTIALS="${KOPF_WITH_CREDENTIALS:-false}"
      KOPF_ES_ROOT_PATH="${KOPF_ES_ROOT_PATH:-/es}"
      cat <<EOF > /opt/app-root/src/kopf_external_settings.json
      {
          "elasticsearch_root_path": "${KOPF_ES_ROOT_PATH}",
          "with_credentials": ${KOPF_WITH_CREDENTIALS},
          "theme": "${KOPF_THEME}",
          "refresh_rate": ${KOPF_REFRESH_RATE}
      }
      EOF

      # create key pair where the private key is stored in the traditional format (RSA)
      mkdir -p /tmp/certs
      cat /etc/elasticsearch/secret/admin-cert > /tmp/certs/adminkeypair.pem
      openssl rsa -in /etc/elasticsearch/secret/admin-key >> /tmp/certs/adminkeypair.pem
      chmod 644 /tmp/certs/adminkeypair.pem

      exec /usr/bin/run-httpd

- kind: ConfigMap
  apiVersion: v1
  metadata:
    name: logging-es-kopf-config
    labels:
      logging: logging-es-kopf
  data:
    httpd.conf: |
      #
      # This is the main Apache HTTP server configuration file.  It contains the
      # configuration directives that give the server its instructions.
      # See <URL:http://httpd.apache.org/docs/2.4/> for detailed information.
      # In particular, see
      # <URL:http://httpd.apache.org/docs/2.4/mod/directives.html>
      # for a discussion of each configuration directive.
      #
      # Do NOT simply read the instructions in here without understanding
      # what they do.  They're here only as hints or reminders.  If you are unsure
      # consult the online docs. You have been warned.
      #
      # Configuration and logfile names: If the filenames you specify for many
      # of the server's control files begin with "/" (or "drive:/" for Win32), the
      # server will use that explicit path.  If the filenames do *not* begin
      # with "/", the value of ServerRoot is prepended -- so 'log/access_log'
      # with ServerRoot set to '/www' will be interpreted by the
      # server as '/www/log/access_log', where as '/log/access_log' will be
      # interpreted as '/log/access_log'.

      #
      # ServerRoot: The top of the directory tree under which the server's
      # configuration, error, and log files are kept.
      #
      # Do not add a slash at the end of the directory path.  If you point
      # ServerRoot at a non-local disk, be sure to specify a local disk on the
      # Mutex directive, if file-based mutexes are used.  If you wish to share the
      # same ServerRoot for multiple httpd daemons, you will need to change at
      # least PidFile.
      #
      ServerRoot "/opt/rh/httpd24/root/etc/httpd"

      #
      # Listen: Allows you to bind Apache to specific IP addresses and/or
      # ports, instead of the default. See also the <VirtualHost>
      # directive.
      #
      # Change this to Listen on specific IP addresses as shown below to
      # prevent Apache from glomming onto all bound IP addresses.
      #
      #Listen 12.34.56.78:80
      Listen 0.0.0.0:8080

      #
      # Dynamic Shared Object (DSO) Support
      #
      # To be able to use the functionality of a module which was built as a DSO you
      # have to place corresponding `LoadModule' lines at this location so the
      # directives contained in it are actually available _before_ they are used.
      # Statically compiled modules (those listed by `httpd -l') do not need
      # to be loaded here.
      #
      # Example:
      # LoadModule foo_module modules/mod_foo.so
      #
      Include conf.modules.d/*.conf

      #
      # If you wish httpd to run as a different user or group, you must run
      # httpd as root initially and it will switch.
      #
      # User/Group: The name (or #number) of the user/group to run httpd as.
      # It is usually good practice to create a dedicated user and group for
      # running httpd, as with most system services.
      #
      User default
      Group root

      # 'Main' server configuration
      #
      # The directives in this section set up the values used by the 'main'
      # server, which responds to any requests that aren't handled by a
      # <VirtualHost> definition.  These values also provide defaults for
      # any <VirtualHost> containers you may define later in the file.
      #
      # All of these directives may appear inside <VirtualHost> containers,
      # in which case these default settings will be overridden for the
      # virtual host being defined.
      #

      #
      # ServerAdmin: Your address, where problems with the server should be
      # e-mailed.  This address appears on some server-generated pages, such
      # as error documents.  e.g. admin@your-domain.com
      #
      ServerAdmin root@localhost

      #
      # ServerName gives the name and port that the server uses to identify itself.
      # This can often be determined automatically, but we recommend you specify
      # it explicitly to prevent problems during startup.
      #
      # If your host doesn't have a registered DNS name, enter its IP address here.
      #
      #ServerName www.example.com:80

      #
      # Deny access to the entirety of your server's filesystem. You must
      # explicitly permit access to web content directories in other
      # <Directory> blocks below.
      #
      <Directory />
          AllowOverride none
          Require all denied
      </Directory>

      #
      # Note that from this point forward you must specifically allow
      # particular features to be enabled - so if something's not working as
      # you might expect, make sure that you have specifically enabled it
      # below.
      #

      #
      # DocumentRoot: The directory out of which you will serve your
      # documents. By default, all requests are taken from this directory, but
      # symbolic links and aliases may be used to point to other locations.
      #
      DocumentRoot "/opt/app-root/src"

      #
      # Relax access to content within /opt/rh/httpd24/root/var/www.
      #
      <Directory "/opt/rh/httpd24/root/var/www">
          AllowOverride None
          # Allow open access:
          Require all granted
      </Directory>

      # Further relax access to the default document root:
      <Directory "/opt/app-root/src">
          #
          # Possible values for the Options directive are "None", "All",
          # or any combination of:
          #   Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
          #
          # Note that "MultiViews" must be named *explicitly* --- "Options All"
          # doesn't give it to you.
          #
          # The Options directive is both complicated and important.  Please see
          # http://httpd.apache.org/docs/2.4/mod/core.html#options
          # for more information.
          #
          Options Indexes FollowSymLinks

          #
          # AllowOverride controls what directives may be placed in .htaccess files.
          # It can be "All", "None", or any combination of the keywords:
          #   Options FileInfo AuthConfig Limit
          #
          AllowOverride All

          #
          # Controls who can get stuff from this server.
          #
          Require all granted
      </Directory>

      #
      # DirectoryIndex: sets the file that Apache will serve if a directory
      # is requested.
      #
      <IfModule dir_module>
          DirectoryIndex index.html
      </IfModule>

      #
      # The following lines prevent .htaccess and .htpasswd files from being
      # viewed by Web clients.
      #
      <Files ".ht*">
          Require all denied
      </Files>

      #
      # ErrorLog: The location of the error log file.
      # If you do not specify an ErrorLog directive within a <VirtualHost>
      # container, error messages relating to that virtual host will be
      # logged here.  If you *do* define an error logfile for a <VirtualHost>
      # container, that host's errors will be logged there and not here.
      #
      ErrorLog |/usr/bin/cat

      #
      # LogLevel: Control the number of messages logged to the error_log.
      # Possible values include: debug, info, notice, warn, error, crit,
      # alert, emerg.
      #
      LogLevel warn

      <IfModule log_config_module>
          #
          # The following directives define some format nicknames for use with
          # a CustomLog directive (see below).
          #
          LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
          LogFormat "%h %l %u %t \"%r\" %>s %b" common

          <IfModule logio_module>
            # You need to enable mod_logio.c to use %I and %O
            LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
          </IfModule>

          #
          # The location and format of the access logfile (Common Logfile Format).
          # If you do not define any access logfiles within a <VirtualHost>
          # container, they will be logged here.  Contrariwise, if you *do*
          # define per-<VirtualHost> access logfiles, transactions will be
          # logged therein and *not* in this file.
          #
          #CustomLog "logs/access_log" common

          #
          # If you prefer a logfile with access, agent, and referer information
          # (Combined Logfile Format) you can use the following directive.
          #
          CustomLog |/usr/bin/cat combined
      </IfModule>

      <IfModule alias_module>
          #
          # Redirect: Allows you to tell clients about documents that used to
          # exist in your server's namespace, but do not anymore. The client
          # will make a new request for the document at its new location.
          # Example:
          # Redirect permanent /foo http://www.example.com/bar

          #
          # Alias: Maps web paths into filesystem paths and is used to
          # access content that does not live under the DocumentRoot.
          # Example:
          # Alias /webpath /full/filesystem/path
          #
          # If you include a trailing / on /webpath then the server will
          # require it to be present in the URL.  You will also likely
          # need to provide a <Directory> section to allow access to
          # the filesystem path.

          #
          # ScriptAlias: This controls which directories contain server scripts.
          # ScriptAliases are essentially the same as Aliases, except that
          # documents in the target directory are treated as applications and
          # run by the server when requested rather than as documents sent to the
          # client.  The same rules about trailing "/" apply to ScriptAlias
          # directives as to Alias.
          #
          ScriptAlias /cgi-bin/ "/opt/rh/httpd24/root/var/www/cgi-bin/"

      </IfModule>

      #
      # "/opt/rh/httpd24/root/var/www/cgi-bin" should be changed to whatever your ScriptAliased
      # CGI directory exists, if you have that configured.
      #
      <Directory "/opt/rh/httpd24/root/var/www/cgi-bin">
          AllowOverride None
          Options None
          Require all granted
      </Directory>

      <IfModule mime_module>
          #
          # TypesConfig points to the file containing the list of mappings from
          # filename extension to MIME-type.
          #
          TypesConfig /etc/mime.types

          #
          # AddType allows you to add to or override the MIME configuration
          # file specified in TypesConfig for specific file types.
          #
          #AddType application/x-gzip .tgz
          #
          # AddEncoding allows you to have certain browsers uncompress
          # information on the fly. Note: Not all browsers support this.
          #
          #AddEncoding x-compress .Z
          #AddEncoding x-gzip .gz .tgz
          #
          # If the AddEncoding directives above are commented-out, then you
          # probably should define those extensions to indicate media types:
          #
          AddType application/x-compress .Z
          AddType application/x-gzip .gz .tgz

          #
          # AddHandler allows you to map certain file extensions to "handlers":
          # actions unrelated to filetype. These can be either built into the server
          # or added with the Action directive (see below)
          #
          # To use CGI scripts outside of ScriptAliased directories:
          # (You will also need to add "ExecCGI" to the "Options" directive.)
          #
          #AddHandler cgi-script .cgi

          # For type maps (negotiated resources):
          #AddHandler type-map var

          #
          # Filters allow you to process content before it is sent to the client.
          #
          # To parse .shtml files for server-side includes (SSI):
          # (You will also need to add "Includes" to the "Options" directive.)
          #
          AddType text/html .shtml
          AddOutputFilter INCLUDES .shtml
      </IfModule>

      #
      # Specify a default charset for all content served; this enables
      # interpretation of all content as UTF-8 by default.  To use the
      # default browser choice (ISO-8859-1), or to allow the META tags
      # in HTML content to override this choice, comment out this
      # directive:
      #
      AddDefaultCharset UTF-8

      <IfModule mime_magic_module>
          #
          # The mod_mime_magic module allows the server to use various hints from the
          # contents of the file itself to determine its type.  The MIMEMagicFile
          # directive tells the module where the hint definitions are located.
          #
          MIMEMagicFile conf/magic
      </IfModule>

      #
      # Customizable error responses come in three flavors:
      # 1) plain text 2) local redirects 3) external redirects
      #
      # Some examples:
      #ErrorDocument 500 "The server made a boo boo."
      #ErrorDocument 404 /missing.html
      #ErrorDocument 404 "/cgi-bin/missing_handler.pl"
      #ErrorDocument 402 http://www.example.com/subscription_info.html
      #

      #
      # EnableMMAP and EnableSendfile: On systems that support it,
      # memory-mapping or the sendfile syscall may be used to deliver
      # files.  This usually improves server performance, but must
      # be turned off when serving from networked-mounted
      # filesystems or if support for these functions is otherwise
      # broken on your system.
      # Defaults if commented: EnableMMAP On, EnableSendfile Off
      #
      #EnableMMAP off
      EnableSendfile on

      # Supplemental configuration
      #
      # Load config files in the "/etc/httpd/conf.d" directory, if any.
      IncludeOptional conf.d/*.conf
      IncludeOptional /opt/app-root/etc/httpd.d/*.conf

      <VirtualHost *:*>
          SSLProxyVerify none
          SSLProxyCheckPeerCN Off
          SSLProxyCheckPeerName Off

          ProxyRequests Off
          ProxyPreserveHost On
          SSLProxyEngine On
          SSLCACertificateFile            /etc/elasticsearch/secret/admin-ca
          SSLCertificateFile              /etc/elasticsearch/secret/admin-cert
          SSLCertificateKeyFile           /etc/elasticsearch/secret/admin-key
          SSLProxyCACertificateFile       /etc/elasticsearch/secret/admin-ca
          SSLProxyMachineCertificateFile  /tmp/certs/adminkeypair.pem
          <Location /es>
            ProxyPass         "https://${ES_SERVICE_NAME}:${ES_SERVICE_PORT}/"
            ProxyPassReverse  "https://${ES_SERVICE_NAME}:${ES_SERVICE_PORT}/"
            Order allow,deny
            Allow from all
            RewriteEngine On
            RewriteRule "^/es/(.*)$" "/$1"
          </Location>
      </VirtualHost>

parameters:
- name: NAMESPACE
  displayName: Namespace
  description: The Namespace where the ImageStream resides.
  required: true
  value: logging
- name: KOPF_SECURE_URL
  displayName: Kopf public URL
  description: The public URL for the Openshift OAuth Provider. Enter value without https://
  required: true
- name: KOPF_MEMORY_LIMIT
  displayName: Memory Limit for Kopf container
  description: Maximum amount of memory the Kopf container can use.
  required: true
  value: 128Mi
- name: AUTH_PROXY_MEMORY_LIMIT
  displayName: Memory Limit for Openshift Auth Proxy container
  description: Maximum amount of memory the Auth Proxy container can use.
  required: true
  value: 128Mi
- name: SOURCE_REPOSITORY_URL
  displayName: Git Repository URL
  description: The URL of the repository with Kopf application source code.
  required: true
  value: https://github.com/lmenezes/elasticsearch-kopf.git
- name: SOURCE_REPOSITORY_REF
  displayName: Git Reference
  description: Set this to select the Kopf release, which you want to use.
  value: v2.1.2
- name: CONTEXT_DIR
  displayName: Context Directory
  description: The relative path to Kopf www resources is _site.
  value: _site
- name: ES_SERVICE_NAME
  displayName: The Elasticsearch service name
  description: Optionally use this variable to change the service name. Default is logging-es.
  value: logging-es
- name: ES_SERVICE_PORT
  displayName: The Elasticsearch service port
  description: Optionally use this variable to change the service port. Default is 9200.
  value: "9200"
- name: SESSION_SECRET
  description: The session secret for the proxy. Generated automatically.
  generate: "expression"
  from: "[a-zA-Z0-9]{43}"
- name: OPENSHIFT_OAUTH_CLIENT_SECRET
  description: Oauth client secret. Generated automatically.
  from: "user[a-zA-Z0-9]{64}"
  generate: "expression"