From 8064d91dfb76bc38466b5e9382b4d43f3188a444 Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Sat, 26 Feb 2022 18:56:16 +0100 Subject: Add security to telemetry deployment --- doc/telemetry.md | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 doc/telemetry.md (limited to 'doc') diff --git a/doc/telemetry.md b/doc/telemetry.md new file mode 100644 index 0000000..ee8d0dd --- /dev/null +++ b/doc/telemetry.md @@ -0,0 +1,37 @@ +# create elasticsearch passwords + +in elasticsearch container + +```bash +./bin/elasticsearch-setup-passwords auto +``` + +save passwords in consul, at: + +- `secrets/telemetry/elastic_passwords/apm_system` for user `apm_system` +- `secrets/telemetry/elastic_passwords/kibana_system` for user `kibana_system` +- `secrets/telemetry/elastic_passwords/elastic` for user `elastic` + +check kibana works, login to kibana with user `elastic` + +# create role and user for apm + +create role `apm_writer`, give privileges: + +- cluster privileges `manage_ilm`, `read_ilm`, `manage_ingest_pipelines` +- on index `apm-*` privileges `create_doc`, `create_index`, `view_index_metadata` +- on index `apm-*sourcemap` privilege `read_cross_cluster` + +create user `apm` with roles `apm_writer` and `apm_system`. give it a randomly generated password that you save in `secrets/telemetry/elastic_passwords/apm` + +check apm data is ingested correctly (visible in kibana) + +# create role and user for grafana + +create role `grafana`, give privileges: + +- on index `apm-*` privileges `read` and `view_index_metadata` + +create user `grafana` with role `grafana`. give it a randomly generated password that you save in `secrets/telemetry/elastic_passwords/grafana` + +check grafana works -- cgit v1.2.3