secret-header.yaml

apiVersion: v1
kind: Secret
metadata:
  name: secret-headers
  namespace: elasticsearch-demo-app
stringData:
  token: "x-kubevirt-export-token:d2URaNJNFBvae3786OlT"

snap-export.yaml

apiVersion: export.kubevirt.io/v1alpha1
kind: VirtualMachineExport
metadata:
    name: es-master00
    namespace: elasticsearch-demo-app
spec:
  source:
    apiGroup: snapshot.kubevirt.io
    kind: VirtualMachineSnapshot
    name: snapshot-urban-mockingbird

vm.yaml

---
apiVersion: cdi.kubevirt.io/v1beta1
kind: DataVolume
metadata:
    name: es-master00-data
    namespace: elasticsearch-demo-app
spec:
    preallocation: false
    source:
        http:
            url: https://virt-exportproxy-openshift-cnv.apps.kvcluster1.apps.development.wels.home/api/export.kubevirt.io/v1alpha1/namespaces/elasticsearch-demo-app/virtualmachineexports/es-master00/volumes/es-master00-es-master00-data/disk.img.gz 
            certConfigMap: router-cert
            secretExtraHeaders:
            - secret-headers
    storage:
        resources:
            requests:
                storage: 10Gi
    storageClassName: lvms-vg1
---
apiVersion: cdi.kubevirt.io/v1beta1
kind: DataVolume
metadata:
    name: es-master00
    namespace: elasticsearch-demo-app
spec:
    preallocation: false
    source:
        http:
            url: https://virt-exportproxy-openshift-cnv.apps.kvcluster1.apps.development.wels.home/api/export.kubevirt.io/v1alpha1/namespaces/elasticsearch-demo-app/virtualmachineexports/es-master00/volumes/es-master00-es-master00/disk.img.gz
            certConfigMap: router-cert
            secretExtraHeaders:
            - secret-headers
    storage:
        resources:
            requests:
                storage: 10Gi
    storageClassName: lvms-vg1
---
apiVersion: kubevirt.io/v1
kind: VirtualMachine
metadata:
  name: es-master00
  namespace: elasticsearch-demo-app
  labels:
    app.kubernetes.io/part-of: elasticsearch
spec:
  running: true
  template:
    metadata:
      annotations:
        vm.kubevirt.io/os: rhel9
        vm.kubevirt.io/workload: server
      labels:
        app: elasticsearch
        node: es-master00
        elasticsearch: master
    spec:
      domain:
        cpu:
          cores: 2
          sockets: 1
          threads: 2
        devices:
          disks:
            - bootOrder: 1
              disk:
                bus: virtio
              name: rootdisk
            - disk:
                bus: virtio
              name: cloudinitdisk
            - disk:
                bus: virtio
              name: elasticsearch-yaml
              serial: 00yaml
            - disk:
                bus: virtio
              name: install-scripts
              serial: 0000sh
            - disk:
                bus: virtio
              name: letsencrypt
              serial: 00cert
            - disk:
                bus: virtio
              name: data
              serial: datadisk
          interfaces:
            - masquerade: {}
              model: virtio
              name: default
        resources:
          requests:
            memory: 2Gi
      networks:
        - name: default
          pod: {}
      terminationGracePeriodSeconds: 180
      volumes:
        - dataVolume:
            name: es-master00
          name: rootdisk
        - dataVolume:
            name: es-master00-data
          name: data
        - cloudInitNoCloud:
            userData: |-
              #cloud-config
              hostname: es-master00
              runcmd: 
                - mount /dev/disk/by-id/virtio-0000sh /mnt/
                - bash /mnt/system.sh
                - bash /mnt/elasticsearch.sh
                - umount /mnt
              user: elasticsearch
              password: redhat
              chpasswd: { expire: False }
              ssh_authorized_keys:
               - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQ0AJQlTvgiScYT+9bZUkBcnyg346jkag10isxaU5vy8TG9Jt+9jwQMOa21Quj0UPz5HxbXNBu2kRrU+2KUJEeCZU/hwKBuXRYWIND110yJCSQZKpQhiD/gmtY8B7pPnJSSrWf+e47X8XDRiuABPwbpK2vKdjx71abEGQTKHow2IXpzgF46k70YqKIowbvU0VCuCEQnCRSxmjg2A8mYQez0Z7cW9J9LUbI7JuOoE9b9U33oDauUcj3QhQzttllSgV0ma58Qha+kjR1+71RrVCrI+5+PoPbnlh5/J6NjxEVhu9rndkaprY7QhbAOfCqgr4XM35hxtyFtL66YNi4vREom9n/TZXQI0w6ojRlzd1d4na5U1IiJw+AS3tAMXnpgBIVR1mvmyd8OF2VHS2iOOk9ApCs/Vuq5k200cE2jeptuppNLaSD21TjpK6Bz60kXPrz+cjQwvU8rsE8P95M24kDgVztrY3yKEGy+1lBRoMaWpbImh3B5LQL3vKT0bkBxWE= awels@awels.wels.home
          name: cloudinitdisk
        - configMap:
            name: es-master00-conf
          name: elasticsearch-yaml
        - configMap:
            name: install-scripts
          name: install-scripts
        - secret:
            secretName: letsencrypt
          name: letsencrypt
---
apiVersion: v1
data:
  ca.crt: |
    -----BEGIN CERTIFICATE-----
    MIIDEDCCAfigAwIBAgIIYDk8lk7f4sowDQYJKoZIhvcNAQELBQAwJjESMBAGA1UE
    CxMJb3BlbnNoaWZ0MRAwDgYDVQQDEwdyb290LWNhMB4XDTIzMDUwMzE0NTQyOVoX
    DTMzMDQzMDE0NTQyOVowJjESMBAGA1UECxMJb3BlbnNoaWZ0MRAwDgYDVQQDEwdy
    b290LWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyF1AUUpNBBZ9
    KnaIEAVKEDL+CVH27DmMWED8ZU5tTtY1+dh7GUjCjKaej4207ZYdSrot0lMewqIF
    R5jdN7fmnhJPPjHKE4yqtkCQE5BoUKX+syuJZO6bZMbUZKpAU3rq+GsA5YoA+aLw
    DIew4mc7e/WwOGkH7eykL1OYld1YnZmEn3XlNmRJ4MtjacXizXmPJTrJk9Z0SQVs
    U4AFhzx4+8xI5H5fbG1gx2GqwrYz6Ovr7W0lIE9G3NY5oOFjakdzlDSzl5NC+Aa7
    6r2f9RH9UDhk8yKKBjsuIfS7ePXAMaSXcmGepwwu1TDFZAqWnBH3fcTzfIV+Oqlj
    wTXVD/juwwIDAQABo0IwQDAOBgNVHQ8BAf8EBAMCAqQwDwYDVR0TAQH/BAUwAwEB
    /zAdBgNVHQ4EFgQU9Z4HnhamuBiN9On0cQav6L92OkkwDQYJKoZIhvcNAQELBQAD
    ggEBALD5YbuJSI+mJJEgoXMam6rsE2omWOtimCd5dejoXYRX2Mu3IfgX6Xd6rjIU
    /9PSsQW1gPLKpGENBtKijj81XrUQZWkr6WPVVon6zB3KGUmbGirAjzI8n7AYAQn2
    0I8zPwDvHd2Y2wkzoMZM+SzNv+gKzNIN12Ojr1dCjmALaczCRDJbHNafrK7BvyW4
    DG8UO1SZRueckgPTH6Bk4NC9mbXmqx5mSGt1THF09OvUjjBESHP8f71vE1Scpg9a
    c2AdW86lbW4ZidsfifaLGcj8aBd5JJCDAKr55U9S6Z71ouTSKRAp0PyT8gWS/d2b
    MXWMj/PsWLWc0kldBPxdz4GlxMU=
    -----END CERTIFICATE-----
kind: ConfigMap
metadata:
  name: router-cert
  namespace: elasticsearch-demo-app
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: es-master00-conf
  namespace: elasticsearch-demo-app
data:
  elasticsearch.conf: |-
    cluster.name: demo
    node.name: es-master00
    node.roles: [ master, data ]
    network.host: _site_
    network.publish_host: es-master00.elasticsearch-demo-app.svc.cluster.local
    discovery.seed_hosts: ["es-master00"]
    cluster.initial_master_nodes: ["es-master00"]
    path.data: /srv/elasticsearch
    path.logs: /var/log/elasticsearch
    xpack.security.enabled: false
    xpack.security.transport.ssl.enabled: false
    xpack.security.http.ssl.enabled: false
  jvm.options: |-
    -Xms1024m
    -Xmx1024m
    -XX:+DisableExplicitGC
    -XX:+UseParallelGC
    -XX:+AlwaysPreTouch
    -server
    -Djava.awt.headless=true
    -Dfile.encoding=UTF-8
    -Djna.nosys=true
    -Djdk.io.permissionsUseCanonicalPath=true
    -Dio.netty.noUnsafe=true
    -Dio.netty.noKeySetOptimization=true
    -Dlog4j.shutdownHookEnabled=false
    -Dlog4j2.disable.jmx=true
    -Dlog4j.skipJansi=true
    -XX:+HeapDumpOnOutOfMemoryError
immutable: false
---
apiVersion: v1
kind: Secret
metadata:
  creationTimestamp: null
  name: letsencrypt
  namespace: elasticsearch-demo-app
---
apiVersion: v1
data:
  demo.id_rsa: LS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUFBQkc1dmJtVUFBQUFFYm05dVpRQUFBQUFBQUFBQkFBQUJsd0FBQUFkemMyZ3RjbgpOaEFBQUFBd0VBQVFBQUFZRUEwTkFDVUpVNzRJa25HRS92VzJWSkFYSjhvTitPbzVHb05kSXJNV2xPYjh2RXh2U2Jmdlk4CkVERG10dFVMbzlGRDgrUjhXMXpRYnRwRWExUHRpbENSSGdtVlA0Y0NnYmwwV0ZpRFE5ZGRNaVFra0dTcVVJWWcvNEpyV1AKQWU2VDV5VWtxMW4vbnVPMS9GdzBZcmdBVDhHNlN0cnluWThlOVdteEJrRXloNk1OaUY2YzRCZU9wTzlHS2lpS01HNzFORgpRcmdoRUp3a1VzWm80TmdQSm1FSHM5R2UzRnZTZlMxR3lPeWJqcUJQVy9WTjk2QTJybEhJOTBJVU03YlpaVW9GZEptdWZFCklXdnBJMGRmdTlVYTFRcXlQdWZqNkQyNTVZZWZ5ZWpZOFJGWWJ2YTUzWkdxYTJPMElXd0Rud3FvSytGek4rWWNiY2hiUysKdW1EWXVMMFJLSnZaLzAyVjBDTk1PcUkwWmMzZFhlSjJ1Vk5TSWljUGdFdDdRREY1NllBU0ZVZFpyNXNuZkRoZGxSMHRvagpqcFBRS1FyUDFicXVaTnROSEJObzNxYmJxYVRTMmtnOXRVNDZTdWdjK3RKRno2OC9uSTBNTDFQSzdCUEQvZVROdUpBNEZjCjdhMk44aWhCc3Z0WlFVYURHbHFXeUpvZHdlUzBDOTd5azlHNUFjVmhBQUFGa0J3SjY4a2NDZXZKQUFBQUIzTnphQzF5YzIKRUFBQUdCQU5EUUFsQ1ZPK0NKSnhoUDcxdGxTUUZ5ZktEZmpxT1JxRFhTS3pGcFRtL0x4TWIwbTM3MlBCQXc1cmJWQzZQUgpRL1BrZkZ0YzBHN2FSR3RUN1lwUWtSNEpsVCtIQW9HNWRGaFlnMFBYWFRJa0pKQmtxbENHSVArQ2ExandIdWsrY2xKS3RaCi81N2p0ZnhjTkdLNEFFL0J1a3JhOHAyUEh2VnBzUVpCTW9lakRZaGVuT0FYanFUdlJpb29pakJ1OVRSVUs0SVJDY0pGTEcKYU9EWUR5WmhCN1BSbnR4YjBuMHRSc2pzbTQ2Z1QxdjFUZmVnTnE1UnlQZENGRE8yMldWS0JYU1pybnhDRnI2U05IWDd2VgpHdFVLc2o3bjQrZzl1ZVdIbjhubzJQRVJXRzcydWQyUnFtdGp0Q0ZzQTU4S3FDdmhjemZtSEczSVcwdnJwZzJMaTlFU2liCjJmOU5sZEFqVERxaU5HWE4zVjNpZHJsVFVpSW5ENEJMZTBBeGVlbUFFaFZIV2ErYkozdzRYWlVkTGFJNDZUMENrS3o5VzYKcm1UYlRSd1RhTjZtMjZtazB0cElQYlZPT2tyb0hQclNSYyt2UDV5TkRDOVR5dXdUdy8za3piaVFPQlhPMnRqZklvUWJMNwpXVUZHZ3hwYWxzaWFIY0hrdEF2ZThwUFJ1UUhGWVFBQUFBTUJBQUVBQUFHQUNIaE0ybWREUWl5dUNQUVh4R3IyVnMyd1g4CnpScExHSzA0Rmo2U0dFREtXRStpdXFod1dHa3RnNDg0cEVGUEFFYnB5Q1dDa0tvZ1I1S1ZWWDJhTENVQ2Z1c0RYOHZ3cisKWjNyOCtyL1RTRU81Qy9aWlc0elA3UzFRSExwdUMrTlJrSG1oVVF6bFFlNmZsS0tBV2VBRWplWi9JN29jZlFFZitvZzVWdgpidkJlamRLRit5ZXV6STA4R1FldDhLQlU1K1ltSWFUVDh0ZTFkbG9sYUJQdEJKYkxJckJ5Q0pDRFRSbmVMTnZkcE9LRysvCkt0L2Z6VVd2VTRBN0FPSUEyQi8wSFVXTVJGKzV0bm92N3FQOEgramR4UHFXV002YlpBcC84dGVzbEFIblNyYzVHdEZPU0sKS2RrRy9wdlh1VmRiWEpOc1FRcGIvekRLVVBwa1BBMzRxZE5qOHRMaWlPOW1pMktEL0Z4Q1J2K0FnTUdpWVpqVlNPdjZCNgo4YnVPd3RDdTZaWlY3YVRiZzRQZE1LQWwxK0hzdnZlTkYzMEx1U0dHemF3RHlXejdSUFNnWGp5eVdyQ2sxZGRKcVY0WnlDCmZETE51U0VYbjREWE1EVHVIWHZVTXVpTVc5b3NPOXUzenlmNjhUa0hjaUgxTmptUWhmNHNTQkhZRi9IeEpSeGhTRkFBQUEKd0VQN3EyUUlaMVl2WGNlbFByZG1wU2dQUWlXWDM5VFFwMEhwTHVIanFZZXJtOWFQb0lhZDlYcksrb0h0MnJ1N3RNMEYvZgpsbmh2M3pkQ0xsMXd2RC9SWi9OZFBObXdQMjE1VVFCU2RQS2w5VEVUakNOUmJQQ0hxSGFUS3FYck1heEtKQVpoY01MM0p1CnVWVTJXa2NQZTlqWmdFdDVZbEg5NERvWHVWNjByVG5yd29sckpZYld4UGcxdnQxL1BSZWx1by9wc2tHamc2SG4zUUFLM0UKWWdwUU1IbWU2ZUV5bHorenRDOCtQSGlTUTViNXQ2YkY2dVd2aTAxYnZpZjhrdUZ3QUFBTUVBNmpSdVYrMzlmeEhFMEpyWgpnSWVUV0ltVFFxbWk5MFYzZW5CWmM5WGdtM0tpdU83OFUrZlRGdGQxeVhjNjlXZWR2eWJtUVk2djdYbDNDRDMrVTJRaXNJClRpMTFkc3BybUt4Vm1LUGZDYkRBWWI1eUh4Qi9hWlNiM0RSYWE2WXpWekhIVHJwQVpZSkpJQ1ZwVlgxMFl1ZEY0U1dwT28KcjIvZnlqempWVlNaUGMzQ0lvVUJjRkdtN2RnSlFRODdicXNibUZUdG1FZUMwNE9aTUc0eHpsTVlqOE9hL2tlK3p4OEVuUApYVUFna2UrMWp3SGhGOHlDY3lNbVlnSnA4Ri9Sd0xBQUFBd1FEa1BxVnRDVlFoOG1yQVVaR04xWHpRNGlJbkNyTWVaU1JvCmRMdGpnZnJuOFBFOWdtMENQTHZBQm1UK21BM1RuQlNqYlF4SVdmN0RLOCs4MmRmOStEUjJEK1QwZjNFeXNIdDd0ZTdESlcKQzBxZm44MWJLUVJwcDMrKzJoUVRrVnJFT25FaGx1UnoySitwVjl4STVOYlJtRnIwNDdXZ09KZTRIdGhTaFhtWjJISHFJRwp5K1B5SjFaNDRwNHhKRXM2bWhZZ0o0czQzU1Ewem9HVmc4MkQ3dlNFYUN2QTJSa0NmRERzWlhIR0w4R05reXRMenUrME5KCnhVem9CalBKR28yOE1BQUFBVllYZGxiSE5BWVhkbGJITXVkMlZzY3k1b2IyMWxBUUlEQkFVRwotLS0tLUVORCBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0K
kind: Secret
metadata:
  creationTimestamp: null
  name: id-rsa
  namespace: elasticsearch-demo-app
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: install-scripts
  namespace: elasticsearch-demo-app
data:
  elasticsearch.sh: |-
    cat << EOF > /etc/yum.repos.d/elastic.repo
    [elasticsearch]
    name=Elasticsearch repository for 8.x packages
    baseurl=https://artifacts.elastic.co/packages/8.x/yum
    gpgcheck=1
    gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
    enabled=0
    autorefresh=1
    type=rpm-md
    EOF
    update-crypto-policies --set DEFAULT:SHA1
    rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
    dnf install -y --enablerepo=elasticsearch elasticsearch-8.7.0
    update-crypto-policies --set DEFAULT
    systemctl daemon-reload
    mkdir -p /srv/elasticsearch/config
    mkdir -p /srv/elasticsearch/data
    chown elasticsearch:elasticsearch /srv/elasticsearch -R
    mkfs.xfs /dev/disk/by-id/virtio-datadisk
    config=$(ls -1 /dev/disk/by-id/virtio-00yaml)
    mount $config /srv/elasticsearch/config
    mount /dev/disk/by-id/virtio-datadisk /srv/elasticsearch/data
    echo "$config /srv/elasticsearch/config iso9660 defaults 0 0" >> /etc/fstab
    echo '/dev/disk/by-id/virtio-datadisk /srv/elasticsearch/data   xfs defaults 0 0' >> /etc/fstab
    mv /etc/elasticsearch/elasticsearch.yml /etc/elasticsearch/elasticsearch.yml.org
    mv /etc/elasticsearch/jvm.options       /etc/elasticsearch/jvm.options.org
    ln -sf /srv/elasticsearch/config/elasticsearch.conf /etc/elasticsearch/elasticsearch.yml
    ln -sf /srv/elasticsearch/config/jvm.options        /etc/elasticsearch/jvm.options
    systemctl enable elasticsearch --now
  system.sh: |-
    cert=$(ls -1 /dev/disk/by-id/virtio-00cert)
    mount $cert /etc/cockpit/ws-certs.d/
    if [ -f "/etc/cockpit/ws-certs.d/tls.crt" ]; then echo "$cert /etc/cockpit/ws-certs.d/ xfs defaults 0 0" >> /etc/fstab;
    else umount $cert; fi
    systemctl enable cockpit.socket --now
immutable: false
---