diff options
author | Alex Auvolat <alex@adnab.me> | 2022-02-26 18:56:16 +0100 |
---|---|---|
committer | Alex Auvolat <alex@adnab.me> | 2022-02-26 18:56:16 +0100 |
commit | 8064d91dfb76bc38466b5e9382b4d43f3188a444 (patch) | |
tree | 396e14eff2cc2e3135b24ff8c7000f7393bb1a36 | |
parent | 823c8bd3ba029176405a0e3e718d96632b63cd88 (diff) | |
download | nixcfg-8064d91dfb76bc38466b5e9382b4d43f3188a444.tar.gz nixcfg-8064d91dfb76bc38466b5e9382b4d43f3188a444.zip |
Add security to telemetry deployment
-rw-r--r-- | app/telemetry/config/apm-config.yaml | 6 | ||||
-rw-r--r-- | app/telemetry/config/grafana/provisioning/datasources/elastic.yaml | 4 | ||||
-rw-r--r-- | app/telemetry/deploy/telemetry.hcl | 3 | ||||
-rw-r--r-- | doc/telemetry.md | 37 |
4 files changed, 48 insertions, 2 deletions
diff --git a/app/telemetry/config/apm-config.yaml b/app/telemetry/config/apm-config.yaml index 1c1e645..881cb40 100644 --- a/app/telemetry/config/apm-config.yaml +++ b/app/telemetry/config/apm-config.yaml @@ -8,3 +8,9 @@ output.elasticsearch: # In case you specify and additional path, the scheme is required: `http://localhost:9200/path`. # IPv6 addresses should always be defined as: `https://[2001:db8::1]:9200`. hosts: ["localhost:9200"] + username: "apm" + password: "{{ key "secrets/telemetry/elastic_passwords/apm" }}" + +logging: + level: warning + to_stderr: true diff --git a/app/telemetry/config/grafana/provisioning/datasources/elastic.yaml b/app/telemetry/config/grafana/provisioning/datasources/elastic.yaml index 8108a53..a41be6f 100644 --- a/app/telemetry/config/grafana/provisioning/datasources/elastic.yaml +++ b/app/telemetry/config/grafana/provisioning/datasources/elastic.yaml @@ -5,8 +5,8 @@ datasources: type: elasticsearch access: proxy url: http://localhost:9200 - password: '' - user: '' + password: '{{ key "secrets/telemetry/elastic_passwords/grafana" }}' + user: 'grafana' database: apm-* basicAuth: false isDefault: true diff --git a/app/telemetry/deploy/telemetry.hcl b/app/telemetry/deploy/telemetry.hcl index e92d0ec..48ea4ea 100644 --- a/app/telemetry/deploy/telemetry.hcl +++ b/app/telemetry/deploy/telemetry.hcl @@ -77,6 +77,7 @@ http.port=9200 cluster.name=es-docker-cluster discovery.type=single-node bootstrap.memory_lock=true +xpack.security.enabled=true ES_JAVA_OPTS=-Xms512m -Xmx512m EOH destination = "secrets/env" @@ -96,6 +97,8 @@ EOH data = <<EOH SERVER_NAME=kibana.local ELASTICSEARCH_HOSTS=http://localhost:9200 +ELASTICSEARCH_USERNAME=kibana_system +ELASTICSEARCH_PASSWORD={{ key "secrets/telemetry/elastic_passwords/kibana_system" }} EOH destination = "secrets/env" env = true diff --git a/doc/telemetry.md b/doc/telemetry.md new file mode 100644 index 0000000..ee8d0dd --- /dev/null +++ b/doc/telemetry.md @@ -0,0 +1,37 @@ +# create elasticsearch passwords + +in elasticsearch container + +```bash +./bin/elasticsearch-setup-passwords auto +``` + +save passwords in consul, at: + +- `secrets/telemetry/elastic_passwords/apm_system` for user `apm_system` +- `secrets/telemetry/elastic_passwords/kibana_system` for user `kibana_system` +- `secrets/telemetry/elastic_passwords/elastic` for user `elastic` + +check kibana works, login to kibana with user `elastic` + +# create role and user for apm + +create role `apm_writer`, give privileges: + +- cluster privileges `manage_ilm`, `read_ilm`, `manage_ingest_pipelines` +- on index `apm-*` privileges `create_doc`, `create_index`, `view_index_metadata` +- on index `apm-*sourcemap` privilege `read_cross_cluster` + +create user `apm` with roles `apm_writer` and `apm_system`. give it a randomly generated password that you save in `secrets/telemetry/elastic_passwords/apm` + +check apm data is ingested correctly (visible in kibana) + +# create role and user for grafana + +create role `grafana`, give privileges: + +- on index `apm-*` privileges `read` and `view_index_metadata` + +create user `grafana` with role `grafana`. give it a randomly generated password that you save in `secrets/telemetry/elastic_passwords/grafana` + +check grafana works |