Project: KubeDB by AppsCode (App Definition and Development / Database)
File: disable-xpack.md

title: Disable X-Pack menu: docs_{{ .version }}: identifier: es-disable-x-pack name: Disable X-Pack parent: es-x-pack weight: 30 menuname: docs{{ .version }} sectionmenuid: guides New to KubeDB? Please start . You data is precious. Definitely, you will not want to leave your production database unprotected. Hence, KubeDB automates Elasticsearch X-Pack configuration. It provides you authentication, authorization and TLS security. However, you can disable X-Pack security. You have to set `spec.disableSecurity` field of Elasticsearch object to `true`. This tutorial will show you how to disable X-Pack security for Elasticsearch database in KubeDB. At first, you need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. If you do not already have a cluster, you can create one by using . Now, install KubeDB cli on your workstation and KubeDB operator in your cluster following the steps . To keep things isolated, this tutorial uses a separate namespace called `demo` throughout this tutorial. ```bash $ kubectl create ns demo namespace/demo created $ kubectl get ns demo NAME STATUS AGE demo Active 5s ``` Note: YAML files used in this tutorial are stored in folder in GitHub repository . To deploy with X-Pack, you need to use an `ElasticsearchVersion` where `X-Pack` is used as `authPlugin`. Here, we are going to use ElasticsearchVersion `7.3.2`. To change authPlugin, it is recommended to create another `ElasticsearchVersion` CRD. Then, use that `ElasticsearchVersion` to install an Elasticsearch without authentication, or with other authPlugin. ```bash $ kubectl get elasticsearchversions 7.3.2 -o yaml ``` ```yaml apiVersion: catalog.kubedb.com/v1alpha1 kind: ElasticsearchVersion metadata: name: xpack-8.11.1 spec: authPlugin: SearchGuard db: image: kubedb/elasticsearch:7.9.3-searchguard distribution: SearchGuard exporter: image: kubedb/elasticsearch_exporter:1.1.0 initContainer: image: kubedb/toybox:0.8.4 yqImage: kubedb/elasticsearch-init:7.9.3-searchguard podSecurityPolicies: databasePolicyName: elasticsearch-db stash: addon: backupTask: name: elasticsearch-backup-7.3.2 params: name: args value: --match=^(?![.])(?!searchguard).+ restoreTask: name: elasticsearch-restore-7.3.2 version: 7.9.3 ``` In order to disable X-Pack, you have to set `spec.disableSecurity` field of `Elasticsearch` object to `true`. Below is the YAML of `Elasticsearch` object that will be created in this tutorial. ```yaml apiVersion: kubedb.com/v1alpha2 kind: Elasticsearch metadata: name: es-xpack-disabled namespace: demo spec: version: xpack-8.11.1 disableSecurity: true storage: storageClassName: "standard" accessModes: ReadWriteOnce resources: requests: storage: 1Gi ``` Let's create the Elasticsearch object, ```bash $ kubectl create -f https://github.com/kubedb/docs/raw/{{< param "info.version" >}}/docs/examples/elasticsearch/x-pack/es-xpack-disabled.yaml elasticsearch.kubedb.com/es-xpack-disabled created ``` Wait for Elasticsearch to be ready, ```bash $ kubectl get es -n demo es-xpack-disabled NAME VERSION STATUS AGE es-xpack-disabled

Running 6m14s ``` As we have disabled X-Pack security, we no longer require username and password to connect with our Elasticsearch database. At first, forward port 9200 of `es-xpack-disabled-0` pod. Run following command in a separate terminal, ```bash $ kubectl port-forward -n demo es-xpack-disabled-0 9200 Forwarding from 127.0.0.1:9200 -> 9200 Forwarding from [::1]:9200 -> 9200 ``` Now, we can connect with the database at `localhost:9200`. Let's check health of our Elasticsearch database. ```bash $ curl "localhost:9200/_cluster/health?pretty" ``` ```json { "cluster_name" : "es-xpack-disabled", "status" : "green", "timed_out" : false, "numberofnodes" : 1, "numberofdata_nodes" : 1, "activeprimaryshards" : 0, "active_shards" : 0, "relocating_shards" : 0, "initializing_shards" : 0, "unassigned_shards" : 0, "delayedunassignedshards" : 0, "numberofpending_tasks" : 0, "numberofinflightfetch" : 0, "taskmaxwaitinginqueue_millis" : 0, "activeshardspercentasnumber" : 100.0 } ``` Additionally, to query the settings about xpack, ```json $ curl "localhost:9200/nodes/all/settings?pretty" { "_nodes" : { "total" : 1, "successful" : 1, "failed" : 0 }, "cluster_name" : "es-xpack-disabled", "nodes" : { "GpHq4kaERoq843zXupmA" : { "name" : "es-xpack-disabled-0", "transport_address" : "10.244.1.7:9300", "host" : "10.244.1.7", "ip" : "10.244.1.7", "version" : "7.3.2", "build_flavor" : "default", "build_type" : "docker", "build_hash" : "1c1faf1", "roles" : [ "ingest", "master", "data" ], "attributes" : { "ml.machine_memory" : "16683249664", "xpack.installed" : "true", "ml.maxopenjobs" : "20" }, "settings" : { "cluster" : { "initialmasternodes" : "es-xpack-disabled-0", "name" : "es-xpack-disabled", "election" : { "strategy" : "supportsvotingonly" } }, "node" : { "name" : "es-xpack-disabled-0", "attr" : { "xpack" : { "installed" : "true" }, "ml" : { "machine_memory" : "16683249664", "maxopenjobs" : "20" } }, "data" : "true", "ingest" : "true", "master" : "true" }, "path" : { "logs" : "/usr/share/elasticsearch/logs", "home" : "/usr/share/elasticsearch" }, "discovery" : { "seed_hosts" : "es-xpack-disabled-master" }, "client" : { "type" : "node" }, "http" : { "type" : "security4", "type.default" : "netty4" }, "transport" : { "type" : "security4", "features" : { "x-pack" : "true" }, "type.default" : "netty4" }, "network" : { "host" : "0.0.0.0" } } } } } ``` Here, `xpack.security.enabled` is set to `false`. As a result, `xpack` security configurations are missing from the node settings. To cleanup the Kubernetes resources created by this tutorial, run: ```bash kubectl patch -n demo es/es-xpack-disabled -p '{"spec":{"terminationPolicy":"WipeOut"}}' --type="merge" kubectl delete -n demo es/es-xpack-disabled kubectl delete ns demo ``` Learn how to . Learn how to generate . Want to hack on KubeDB? Check our .