---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: prometheus-elasticsearch-exporter
  labels:
    app: prometheus-elasticsearch-exporter
spec:
  replicas: 1
  selector:
    matchLabels:
      app: prometheus-elasticsearch-exporter
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: prometheus-elasticsearch-exporter
    spec:
      serviceAccountName: default
      restartPolicy: Always
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
      containers:
        - name: exporter
          env:
            - name: ES_USERNAME
              value: elastic
            - name: ES_PASSWORD
              valueFrom:
                secretKeyRef:
                  key: elastic
                  name: elk-es-elastic-user
          image: "quay.io/prometheuscommunity/elasticsearch-exporter:v1.3.0"
          imagePullPolicy: IfNotPresent
          command: ["elasticsearch_exporter",
                    "--log.format=logfmt",
                    "--log.level=info",
                    "--es.uri=https://elk-es-http.logging.svc:9200",
                    "--es.all",
                    "--es.indices",
                    "--es.indices_settings",
                    "--es.indices_mappings",
                    "--es.shards",
                    "--es.snapshots",
                    "--es.timeout=30s",
                    "--es.ssl-skip-verify",
                    "--es.ca=/usr/share/elasticsearch-exporter/config/certs/ca.crt",
                    "--web.listen-address=:9108",
                    "--web.telemetry-path=/metrics"]
          securityContext:
            capabilities:
              drop:
                - SETPCAP
                - MKNOD
                - AUDIT_WRITE
                - CHOWN
                - NET_RAW
                - DAC_OVERRIDE
                - FOWNER
                - FSETID
                - KILL
                - SETGID
                - SETUID
                - NET_BIND_SERVICE
                - SYS_CHROOT
                - SETFCAP
            readOnlyRootFilesystem: true
          resources:
            {}
          ports:
            - containerPort: 9108
              name: http
          livenessProbe:
            httpGet:
              path: /healthz
              port: http
            initialDelaySeconds: 5
            timeoutSeconds: 5
            periodSeconds: 5
          readinessProbe:
            httpGet:
              path: /healthz
              port: http
            initialDelaySeconds: 1
            timeoutSeconds: 5
            periodSeconds: 5
          lifecycle:
            preStop:
              exec:
                command: ["/bin/bash", "-c", "sleep 20"]
          volumeMounts:
            - name: ca-certs
              mountPath: /usr/share/elasticsearch-exporter/config/certs
      volumes:
        - name: ca-certs
          secret:
            secretName: elk-es-http-certs-public
