Skip to content

Commit d7dfb78

Browse files
kilfoylekilfoyle
committed
add appendices, mostly
1 parent 1cf4cd0 commit d7dfb78

File tree

1 file changed

+254
-8
lines changed

1 file changed

+254
-8
lines changed

‎docs/en/install-upgrade/air-gapped-install.asciidoc

Lines changed: 254 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -198,52 +198,298 @@ The following script generates a SystemD service file on a RHEL 8 system in orde
198198

199199
[source,shell]
200200
----
201-
toast
201+
#!/usr/bin/env bash
202+
203+
EPR_BIND_ADDRESS="0.0.0.0"
204+
EPR_BIND_PORT="8443"
205+
EPR_TLS_CERT="/etc/elastic/epr/epr.pem"
206+
EPR_TLS_KEY="/etc/elastic/epr/epr-key.pem"
207+
EPR_IMAGE="docker.elastic.co/package-registry/distribution:8.4.3"
208+
209+
podman create \
210+
--name "elastic-epr" \
211+
-p "$EPR_BIND_ADDRESS:$EPR_BIND_PORT:$EPR_BIND_PORT" \
212+
-v "$EPR_TLS_CERT:/etc/ssl/epr.crt:ro" \
213+
-v "$EPR_TLS_KEY:/etc/ssl/epr.key:ro" \
214+
-e "EPR_ADDRESS=0.0.0.0:$EPR_BIND_PORT" \
215+
-e "EPR_TLS_CERT=/etc/ssl/epr.crt" \
216+
-e "EPR_TLS_KEY=/etc/ssl/epr.key" \
217+
"$EPR_IMAGE"
218+
219+
## creates service file in the root directory
220+
# podman generate systemd --new --files --name elastic-epr --restart-policy always
221+
----
222+
223+
The following is an example of an actual SystemD service file for an EPR, launched as a Podman service.
224+
225+
[source,shell]
226+
----
227+
# container-elastic-epr.service
228+
# autogenerated by Podman 4.1.1
229+
# Wed Oct 19 13:12:33 UTC 2022
230+
231+
[Unit]
232+
Description=Podman container-elastic-epr.service
233+
Documentation=man:podman-generate-systemd(1)
234+
Wants=network-online.target
235+
After=network-online.target
236+
RequiresMountsFor=%t/containers
237+
238+
[Service]
239+
Environment=PODMAN_SYSTEMD_UNIT=%n
240+
Restart=always
241+
TimeoutStopSec=70
242+
ExecStartPre=/bin/rm -f %t/%n.ctr-id
243+
ExecStart=/usr/bin/podman run \
244+
--cidfile=%t/%n.ctr-id \
245+
--cgroups=no-conmon \
246+
--rm \
247+
--sdnotify=conmon \
248+
-d \
249+
--replace \
250+
--name elastic-epr \
251+
-p 0.0.0.0:8443:8443 \
252+
-v /etc/elastic/epr/epr.pem:/etc/ssl/epr.crt:ro \
253+
-v /etc/elastic/epr/epr-key.pem:/etc/ssl/epr.key:ro \
254+
-e EPR_ADDRESS=0.0.0.0:8443 \
255+
-e EPR_TLS_CERT=/etc/ssl/epr.crt \
256+
-e EPR_TLS_KEY=/etc/ssl/epr.key docker.elastic.co/package-registry/distribution:8.6.2
257+
ExecStop=/usr/bin/podman stop --ignore --cidfile=%t/%n.ctr-id
258+
ExecStopPost=/usr/bin/podman rm -f --ignore --cidfile=%t/%n.ctr-id
259+
Type=notify
260+
NotifyAccess=all
261+
262+
[Install]
263+
WantedBy=default.target
202264
----
203265

204266
[discrete]
205267
[[air-gapped-elastic-artifact-registry-example]]
206268
=== Appendix B - Elastic Artifact Registry
207269

208-
tbd
270+
The following example script downloads artifacts from the internet to be later served as a private Elastic Package Registry.
271+
272+
[source,shell]
273+
----
274+
#!/usr/bin/env bash
275+
set -o nounset -o errexit -o pipefail
276+
277+
STACK_VERSION=8.4.3
278+
ARTIFACT_DOWNLOADS_BASE_URL=https://artifacts.elastic.co/downloads
279+
280+
DOWNLOAD_BASE_DIR=${DOWNLOAD_BASE_DIR:?"Make sure to set DOWNLOAD_BASE_DIR when running this script"}
281+
282+
COMMON_PACKAGE_PREFIXES="apm-server/apm-server beats/auditbeat/auditbeat beats/elastic-agent/elastic-agent beats/filebeat/filebeat beats/heartbeat/heartbeat beats/metricbeat/metricbeat beats/osquerybeat/osquerybeat beats/packetbeat/packetbeat cloudbeat/cloudbeat endpoint-dev/endpoint-security fleet-server/fleet-server"
283+
284+
WIN_ONLY_PACKAGE_PREFIXES="beats/winlogbeat/winlogbeat"
285+
286+
RPM_PACKAGES="beats/elastic-agent/elastic-agent"
287+
DEB_PACKAGES="beats/elastic-agent/elastic-agent"
288+
289+
function download_packages() {
290+
local url_suffix="$1"
291+
local package_prefixes="$2"
292+
293+
local _url_suffixes="$url_suffix ${url_suffix}.sha512 ${url_suffix}.asc"
294+
local _pkg_dir=""
295+
local _dl_url=""
296+
297+
for _download_prefix in $package_prefixes; do
298+
for _pkg_url_suffix in $_url_suffixes; do
299+
_pkg_dir=$(dirname ${DOWNLOAD_BASE_DIR}/${_download_prefix})
300+
_dl_url="${ARTIFACT_DOWNLOADS_BASE_URL}/${_download_prefix}-${_pkg_url_suffix}"
301+
(mkdir -p $_pkg_dir && cd $_pkg_dir && curl -O "$_dl_url")
302+
done
303+
done
304+
}
305+
306+
# and we download
307+
for _os in linux windows; do
308+
case "$_os" in
309+
linux)
310+
PKG_URL_SUFFIX="${STACK_VERSION}-${_os}-x86_64.tar.gz"
311+
;;
312+
windows)
313+
PKG_URL_SUFFIX="${STACK_VERSION}-${_os}-x86_64.zip"
314+
;;
315+
*)
316+
echo "[ERROR] Something happened"
317+
exit 1
318+
;;
319+
esac
320+
321+
download_packages "$PKG_URL_SUFFIX" "$COMMON_PACKAGE_PREFIXES"
322+
323+
if [[ "$_os" = "windows" ]]; then
324+
download_packages "$PKG_URL_SUFFIX" "$WIN_ONLY_PACKAGE_PREFIXES"
325+
fi
326+
327+
if [[ "$_os" = "linux" ]]; then
328+
download_packages "${STACK_VERSION}-x86_64.rpm" "$RPM_PACKAGES"
329+
download_packages "${STACK_VERSION}-amd64.deb" "$DEB_PACKAGES"
330+
fi
331+
done
332+
333+
334+
## selinux tweaks
335+
# semanage fcontext -a -t "httpd_sys_content_t" '/opt/elastic-packages(/.*)?'
336+
# restorecon -Rv /opt/elastic-packages
337+
338+
----
339+
340+
The following is an example NGINX configuration for running a web server for the Elastic Artifact Registry.
341+
342+
[source,shell]
343+
----
344+
user nginx;
345+
worker_processes 2;
346+
347+
error_log /var/log/nginx/error.log notice;
348+
pid /var/run/nginx.pid;
349+
350+
events {
351+
worker_connections 1024;
352+
}
353+
354+
http {
355+
include /etc/nginx/mime.types;
356+
default_type application/octet-stream;
357+
358+
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
359+
'$status $body_bytes_sent "$http_referer" '
360+
'"$http_user_agent" "$http_x_forwarded_for"';
361+
362+
access_log /var/log/nginx/access.log main;
363+
sendfile on;
364+
keepalive_timeout 65;
365+
366+
server {
367+
listen 9080 default_server;
368+
server_name _;
369+
root /opt/elastic-packages;
370+
371+
location / {
372+
373+
}
374+
}
375+
376+
}
377+
378+
----
209379

210380
[discrete]
211381
[[air-gapped-epr-kubernetes-example]]
212382
=== Appendix C - EPR Kubernetes Deployment
213383

384+
The following is a sample EPR Kubernetes deployment YAML file.
385+
386+
[source,yaml]
387+
----
388+
apiVersion: apps/v1
389+
kind: Deployment
390+
metadata:
391+
name: elastic-package-registry
392+
namespace: default
393+
labels:
394+
app: elastic-package-registry
395+
spec:
396+
replicas: 1
397+
selector:
398+
matchLabels:
399+
app: elastic-package-registry
400+
template:
401+
metadata:
402+
name: elastic-package-registry
403+
labels:
404+
app: elastic-package-registry
405+
spec:
406+
containers:
407+
- name: epr
408+
image: docker.elastic.co/package-registry/distribution:8.6.1
409+
ports:
410+
- containerPort: 8080
411+
name: http
412+
livenessProbe:
413+
tcpSocket:
414+
port: 8080
415+
initialDelaySeconds: 20
416+
periodSeconds: 30
417+
resources:
418+
requests:
419+
cpu: 125m
420+
memory: 128Mi
421+
limits:
422+
cpu: 1000m
423+
memory: 512Mi
424+
env:
425+
- name: EPR_ADDRESS
426+
value: "0.0.0.0:8080"
427+
---
428+
apiVersion: v1
429+
kind: Service
430+
metadata:
431+
labels:
432+
app: elastic-package-registry
433+
name: elastic-package-registry
434+
spec:
435+
ports:
436+
- port: 80
437+
name: http
438+
protocol: TCP
439+
targetPort: http
440+
selector:
441+
app: elastic-package-registry
442+
----
443+
214444
[discrete]
215445
[[air-gapped-agent-integration-guide]]
216446
=== Appendix D - Agent Integration Guide
217447

218-
tbd
448+
When configuring any integration in {agent}, you need to set up integration settings within whatever policy is ultimately assigned to that agent.
219449

220450
[discrete]
221451
[[air-gapped-agent-integration-terminology]]
222452
==== D.1. Terminology
223453

224-
tbd
454+
Note the following terms and definitions:
455+
456+
Integration::
457+
A variety of optional capabilities that can be deployed on top of the {stack}. refer to link:https://www.elastic.co/integrations/[Integrations] to learn more.
458+
459+
Agent integration::
460+
The integrations that require {agent} to run. For example, the Sample Data integration requires only {es} and {kib} and consists of dashboards, data, and related objects, but the APM integration not only has some {es} objects, but also needs {agent} to run the APM Server.
461+
462+
Package::
463+
A set of dependencies (such as dashboards, scripts, and others) for a given integration that, typically, needs to be retrieved from the <<air-gapped-elastic-package-registry,Elastic Package Registry>> before an integration can be correctly installed and configured.
464+
465+
Agent policy::
466+
A configuration for the {agent} that may include one or more {agent} integrations, and configurations for each of those integrations.
225467

226468
[discrete]
227469
[[air-gapped-agent-integration-configure]]
228470
==== D.2. How to configure
229471

230-
tbd
472+
There are three ways to configure {agent} integrations:
473+
474+
* <<air-gapped-agent-integration-configure-kibana>>
475+
* <<air-gapped-agent-integration-configure-yml>>
476+
* <<air-gapped-agent-integration-configure-fleet-api>>
231477

232478
[discrete]
233479
[[air-gapped-agent-integration-configure-kibana]]
234-
==== D.2.1. Using {kib} UI
480+
==== D.2.1. Using the {kib} UI
235481

236482
tbd
237483

238484
[discrete]
239485
[[air-gapped-agent-integration-configure-yml]]
240-
==== D.2.2. Using `kibana.yml` config file
486+
==== D.2.2. Using the `kibana.yml` config file
241487

242488
tbd
243489

244490
[discrete]
245491
[[air-gapped-agent-integration-configure-fleet-api]]
246-
==== D.2.3. Using {kib} {fleet} API
492+
==== D.2.3. Using the {kib} {fleet} API
247493

248494
tbd
249495

0 commit comments

Comments
 (0)