Skip to content

Elasticsearch and Kibana Big Bang integration

This Big Bang-owned chart renders ECK Elasticsearch and Kibana custom resources, not an upstream workload Helm chart. ECK reconciles those resources into workloads and Services. This package supplies Iron Bank images, node-set configuration, OIDC, metrics, dashboards, network controls, and disruption budgets. It does not install the ECK controller or CRDs.

Use the package values and generated reference for chart entry points. For the full CR API, consult the ECK 3.5.0 Elasticsearch specification and Kibana specification, matching the operator selected during this guide’s integration review. Not every upstream CR field is exposed by this chart; do not add an upstream wrapper.

Raw Elasticsearch settings enter through elasticsearch.common.config and each node set’s config; node-set settings override common settings. Raw Kibana settings enter through kibana.config and override generated chart configuration by deep merge. For their complete 9.x configuration surface, use the authoritative Elasticsearch settings and Kibana settings rather than reproducing nested upstream options here.

Configuration and dependencies

With packageConfiguration.version: v1, the umbrella entry point is packages.elasticsearchKibana. The legacy elasticsearchKibana path remains a Big Bang 3.x compatibility entry point; canonical configuration wins if both are supplied. Chart settings go under packages.elasticsearchKibana.values. For direct chart use, omit the umbrella wrapper and supply the package values.

packageConfiguration:
  version: v1
packages:
  elasticsearchKibana:
    enabled: true

The umbrella creates HelmRelease ek targeting namespace logging (default Helm release logging-ek), namespace/pull-secret resources, and a release dependency on ECK Operator. Enabling this workload also selects the operator release even if the operator’s own enable flag is false. Additional default dependencies include monitoring, Gatekeeper, and Kyverno Policies when enabled. Do not remove the operator dependency with a dependency override without another supported CRD and controller lifecycle plan.

The umbrella maps domain, image-pull, network, monitoring, mesh, SSO, and service-account settings. Its Flux values order is common, generated defaults, then user overlays; package values can override generated mappings. See the umbrella package-management contract and values mapping.

Fluent Bit is a separately enabled collector, not installed by this chart. Selecting the EFK stack, disabling an alternative stack, and copying collector credentials are cross-package concerns owned by the umbrella and collector repositories. See log access.

Storage

Each rendered Elasticsearch node set receives a ReadWriteOnce claim template named elasticsearch-data. Configure storage separately for master and data nodes; optional ingest, ML, and coordinating node sets have their own persistence values. An empty storageClassName is omitted from the CR, allowing Kubernetes storage-class defaulting. This example shows the nesting, not a production sizing recommendation:

packageConfiguration:
  version: v1
packages:
  elasticsearchKibana:
    enabled: true
    values:
      elasticsearch:
        master:
          persistence:
            storageClassName: ""
            size: 10Gi
        data:
          persistence:
            storageClassName: ""
            size: 100Gi

The chart does not expose volumeClaimDeletePolicy; ECK’s default lifecycle applies. Review ECK volume claims before scale-down, deletion, or storage changes. Shrinking a PVC or changing its storage class is not an in-place migration. Have a tested snapshot/restore plan.

High availability

elasticsearch.<node-set>.count and kibana.count control workload pod counts, not Elasticsearch index replica settings. This chart defaults to three master nodes, four data nodes, and three Kibana instances. Counts alone do not establish HA: plan failure-domain placement, shard replication, capacity, and client access. A single Kibana instance is not redundant.

Scheduling describes the chart’s placement entry points. The chart delegates the default Elasticsearch disruption budget to ECK. To use chart-managed per-node-set budgets, disable elasticsearch.clusterPodDisruptionBudget.enabled; the chart rejects enabling both models. Kibana’s chart-managed budget is separately opt-in. Budgets regulate voluntary disruption, not failures or data replication.

Istio configuration

The package’s standalone istio.enabled defaults to false. In an umbrella deployment, mesh enablement and namespace enrollment come from the platform’s Istiod/ambient configuration, not an obsolete top-level istio.enabled toggle. Use domain for the platform domain and the current routes.inbound.kibana values for route overrides. The default Kibana route targets <release>-kb-http:5601 at kibana.<domain>; routes.inbound.elasticsearch is disabled by default.

packageConfiguration:
  version: v1
packages:
  elasticsearchKibana:
    values:
      routes:
        inbound:
          kibana:
            hosts:
              - logs.example.com

Routes are rendered by bb-common when the Istio networking API is available. A route declaration does not install a gateway, provision DNS, or configure its TLS certificate. Coordinate custom hosts with the gateway and OIDC redirect URL. The umbrella supplies the selected ingress gateway; direct chart users must select an existing gateway. See mesh security and network policies.

The package disables Kibana’s ECK self-signed HTTP TLS when istio.enabled is true. It does not disable Elasticsearch HTTP TLS. Elasticsearch transport port 9300 is excluded from sidecar interception and has a port-level mTLS exception because Elastic handles transport TLS. Enabling the Elasticsearch inbound route also adds a port-9200 peer-authentication exception in STRICT mode; review that exposure explicitly rather than treating it as an ordinary Kibana route.

Single sign on (SSO)

The umbrella entry point is packages.elasticsearchKibana.sso; the chart’s own entry point is sso. The package renders realms on every enabled Elasticsearch node set, Kibana login providers, and client-secret keystore wiring. Authentication does not create role mappings. See OIDC integration for provider, redirect, CA, network, and least-privilege authorization requirements.

Licensing

Confirm OIDC entitlement and trial limitations against Elastic’s ECK license guidance. Do not infer feature entitlement from chart enablement.

The umbrella license entry point is packages.elasticsearchKibana.license (elasticsearchKibana.license in the legacy model), not values.license. The umbrella forwards trial and keyJSON to ECK Operator’s generated defaults. The operator package, not this workload chart, owns the license Secret and trial EULA annotation in its namespace. An explicit packages.eckOperator.values.license overlay can override those generated defaults; it is not a required relocation of the umbrella license setting. Keep license material in encrypted/managed inputs. Controller, CRD, and license lifecycle procedures belong to ECK Operator.

Health checks and operations

The package’s post-install/upgrade wait job checks observed generations plus Elasticsearch Ready phase and Kibana green health. Those gates do not prove log ingestion, every shard’s health, snapshots, or successful SSO. Use troubleshooting for read-only status checks and safe access, metrics for Prometheus integration, and maintenance for validation coverage and upgrade evidence.