Add security example

helpers/matrix.yml

@@ -23,6 +23,7 @@ FILEBEAT_SUITE:
 METRICBEAT_SUITE:
   - default
   - oss
+  - security
   - 6.x
 KUBERNETES_VERSION:
   - '1.11'

metricbeat/examples/security/Makefile

@@ -0,0 +1,17 @@
+default: test
+
+include ../../../helpers/examples.mk
+
+RELEASE := helm-metricbeat-security
+GOSS_SELECTOR = release=$(RELEASE),app=helm-metricbeat-security-metricbeat
+
+install:
+	helm upgrade --wait --timeout=600 --install $(RELEASE) --values values.yaml ../../
+
+purge:
+	helm del --purge $(RELEASE)
+
+test-metrics:
+	 GOSS_FILE=goss-metrics.yaml make goss GOSS_SELECTOR=release=$(RELEASE),app=helm-metricbeat-security-metricbeat-metrics
+
+test: install goss test-metrics

metricbeat/examples/security/test/goss-metrics.yaml

@@ -0,0 +1,51 @@
+port:
+  tcp:5066:
+    listening: true
+    ip:
+    - '127.0.0.1'
+
+mount:
+  /usr/share/metricbeat/data:
+    exists: true
+  /usr/share/metricbeat/kube-state-metrics-metricbeat.yml:
+    exists: true
+    opts:
+      - ro
+
+user:
+  metricbeat:
+    exists: true
+    uid: 1000
+    gid: 1000
+
+http:
+  https://security-master:9200/_cat/indices:
+    status: 200
+    timeout: 2000
+    body:
+      - 'metricbeat-7.0.1'
+    allow-insecure: true
+    username: '{{ .Env.ELASTICSEARCH_USERNAME }}'
+    password: '{{ .Env.ELASTICSEARCH_PASSWORD }}'
+  https://security-master:9200/_search?q=metricset.name:state_deployment:
+    status: 200
+    timeout: 2000
+    body:
+      - 'metricbeat-7.0.1'
+    allow-insecure: true
+    username: '{{ .Env.ELASTICSEARCH_USERNAME }}'
+    password: '{{ .Env.ELASTICSEARCH_PASSWORD }}'
+
+file:
+  /usr/share/metricbeat/metricbeat.yml:
+    exists: true
+    contains:
+      - 'add_kubernetes_metadata'
+      - 'output.elasticsearch'
+
+command:
+  cd /usr/share/metricbeat && metricbeat test output:
+    exit-status: 0
+    stdout:
+      - 'elasticsearch: https://security-master:9200'
+      - 'version: 7.0.1'

metricbeat/examples/security/test/goss.yaml

@@ -0,0 +1,57 @@
+port:
+  tcp:5066:
+    listening: true
+    ip:
+    - '127.0.0.1'
+
+mount:
+  /usr/share/metricbeat/data:
+    exists: true
+  /run/docker.sock:
+    exists: true
+  /var/lib/docker/containers:
+    exists: true
+    opts:
+      - ro
+  /usr/share/metricbeat/metricbeat.yml:
+    exists: true
+    opts:
+      - ro
+
+user:
+  metricbeat:
+    exists: true
+    uid: 1000
+    gid: 1000
+
+http:
+  https://security-master:9200/_cat/indices:
+    status: 200
+    timeout: 2000
+    body:
+      - 'metricbeat-7.0.1'
+    allow-insecure: true
+    username: '{{ .Env.ELASTICSEARCH_USERNAME }}'
+    password: '{{ .Env.ELASTICSEARCH_PASSWORD }}'
+  https://security-master:9200/_search?q=metricset.name:container:
+    status: 200
+    timeout: 2000
+    body:
+      - 'metricbeat-7.0.1'
+    allow-insecure: true
+    username: '{{ .Env.ELASTICSEARCH_USERNAME }}'
+    password: '{{ .Env.ELASTICSEARCH_PASSWORD }}'
+
+file:
+  /usr/share/metricbeat/metricbeat.yml:
+    exists: true
+    contains:
+      - 'add_kubernetes_metadata'
+      - 'output.elasticsearch'
+
+command:
+  cd /usr/share/metricbeat && metricbeat test output:
+    exit-status: 0
+    stdout:
+      - 'elasticsearch: https://security-master:9200'
+      - 'version: 7.0.1'

metricbeat/examples/security/values.yaml

@@ -0,0 +1,87 @@
+metricbeatConfig:
+  metricbeat.yml: |
+    system:
+      hostfs: /hostfs
+    metricbeat.modules:
+    - module: kubernetes
+      metricsets:
+        - container
+        - node
+        - pod
+        - system
+        - volume
+      period: 10s
+      hosts: ["localhost:10255"]
+      processors:
+      - add_kubernetes_metadata:
+          in_cluster: true
+    - module: kubernetes
+      enabled: true
+      metricsets:
+        - event
+    - module: system
+      period: 10s
+      metricsets:
+        - cpu
+        - load
+        - memory
+        - network
+        - process
+        - process_summary
+      processes: ['.*']
+      process.include_top_n:
+        by_cpu: 5
+        by_memory: 5
+    - module: system
+      period: 1m
+      metricsets:
+        - filesystem
+        - fsstat
+      processors:
+      - drop_event.when.regexp:
+          system.filesystem.mount_point: '^/(sys|cgroup|proc|dev|etc|host|lib)($|/)'
+
+    output.elasticsearch:
+      username: '${ELASTICSEARCH_USERNAME}'
+      password: '${ELASTICSEARCH_PASSWORD}'
+      protocol: https
+      hosts: ["security-master:9200"]
+      ssl.certificate_authorities:
+        - /usr/share/metricbeat/config/certs/elastic-certificate.pem
+
+  kube-state-metrics-metricbeat.yml: |
+    metricbeat.modules:
+    - module: kubernetes
+      enabled: true
+      metricsets:
+        - state_node
+        - state_deployment
+        - state_replicaset
+        - state_pod
+        - state_container
+      period: 10s
+      hosts: ["${KUBE_STATE_METRICS_HOSTS:kube-state-metrics:8080}"]
+    output.elasticsearch:
+      username: '${ELASTICSEARCH_USERNAME}'
+      password: '${ELASTICSEARCH_PASSWORD}'
+      protocol: https
+      hosts: ["security-master:9200"]
+      ssl.certificate_authorities:
+        - /usr/share/metricbeat/config/certs/elastic-certificate.pem
+
+secretMounts:
+  - name: elastic-certificate-pem
+    secretName: elastic-certificate-pem
+    path: /usr/share/metricbeat/config/certs
+
+extraEnvs:
+  - name: 'ELASTICSEARCH_USERNAME'
+    valueFrom:
+      secretKeyRef:
+        name: elastic-credentials
+        key: username
+  - name: 'ELASTICSEARCH_PASSWORD'
+    valueFrom:
+      secretKeyRef:
+        name: elastic-credentials
+        key: password