helmforgedev · mberlofa · Jul 4, 2026 · Jul 4, 2026 · Jul 5, 2026
diff --git a/charts/kibana/README.md b/charts/kibana/README.md
@@ -8,31 +8,30 @@ HelmForge Elasticsearch subchart support, and static encryption key support.
 
 It also includes Gateway API, dual-stack services, NetworkPolicy, PDB, External Secrets Operator integration, and focused Helm tests.
 
+NetworkPolicy supports `networkPolicy.extraEgress` for appending egress rules
+without replacing the generated DNS, Elasticsearch, and
+`networkPolicy.egress.extra` controls.
+
 ## Install
 
 ```bash
 helm repo add helmforge https://repo.helmforge.dev
 helm repo update
-helm install kibana helmforge/kibana \
-  --set elasticsearch.hosts[0]=http://elasticsearch:9200
+helm install kibana helmforge/kibana
 ```
 
 Elastic recommends running the same Elastic Stack version across Kibana and
 Elasticsearch. The default chart version targets Kibana `9.4.2`.
 
 ## HelmForge Elasticsearch Subchart
 
-The chart can deploy HelmForge Elasticsearch as an optional dependency for local
-or self-contained environments:
+The chart deploys HelmForge Elasticsearch by default so local and validation
+installs are self-contained:
 
 ```yaml
 bundledElasticsearch:
   enabled: true
 
-elasticsearch:
-  hosts:
-    - http://kibana-bundled-elasticsearch:9200
-
 bundled-elasticsearch:
   image:
     tag: "9.4.2"
@@ -56,6 +55,9 @@ encryptionKeys:
 For secured Elasticsearch clusters, use either basic auth or an Elasticsearch service account token:
 
 ```yaml
+bundledElasticsearch:
+  enabled: false
+
 elasticsearch:
   hosts:
     - https://elasticsearch:9200
@@ -98,13 +100,13 @@ gateway:
 | `image.flavor` | Image flavor: `default` or `wolfi` | `default` |
 | `image.tag` | Kibana image tag | `9.4.2` |
 | `replicaCount` | Number of Kibana replicas | `1` |
-| `elasticsearch.hosts` | Elasticsearch URLs | `[http://elasticsearch:9200]` |
-| `bundledElasticsearch.enabled` | Enable HelmForge Elasticsearch dependency | `false` |
+| `elasticsearch.hosts` | External Elasticsearch URLs used when bundled mode is disabled | `[http://elasticsearch:9200]` |
+| `bundledElasticsearch.enabled` | Enable HelmForge Elasticsearch dependency | `true` |
 | `elasticsearch.auth.type` | Elasticsearch auth mode: `none`, `basic`, `serviceAccountToken` | `none` |
 | `elasticsearch.auth.existingSecret` | Secret containing Elasticsearch credentials | `""` |
 | `elasticsearch.tls.enabled` | Configure Elasticsearch CA trust | `false` |
 | `encryptionKeys.existingSecret` | Secret containing Kibana encryption keys | `""` |
-| `waitForElasticsearch.enabled` | Wait for the first Elasticsearch endpoint before starting Kibana | `false` |
+| `waitForElasticsearch.enabled` | Wait for the first Elasticsearch endpoint before starting Kibana | `true` |
 | `service.ipFamilyPolicy` | Dual-stack ipFamilyPolicy | `null` |
 | `ingress.enabled` | Create Kubernetes Ingress | `false` |
 | `gateway.enabled` | Create Gateway API HTTPRoute | `false` |

diff --git a/charts/kibana/ci/bundled-elasticsearch-values.yaml b/charts/kibana/ci/bundled-elasticsearch-values.yaml
@@ -7,6 +7,7 @@ bundledElasticsearch:
 # (<release>-bundled-elasticsearch), so this works with any release name.
 
 bundled-elasticsearch:
+  fullnameOverride: kibana-ci-elasticsearch
   clusterProfile: dev
   image:
     tag: "9.4.2"

diff --git a/charts/kibana/ci/default-values.yaml b/charts/kibana/ci/default-values.yaml
@@ -1,7 +1,6 @@
 # SPDX-License-Identifier: Apache-2.0
-elasticsearch:
-  hosts:
-    - http://elasticsearch:9200
+bundled-elasticsearch:
+  fullnameOverride: kibana-ci-elasticsearch
 
 resources:
   requests:

diff --git a/charts/kibana/ci/dual-stack-values.yaml b/charts/kibana/ci/dual-stack-values.yaml
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: Apache-2.0
+bundled-elasticsearch:
+  fullnameOverride: kibana-ci-elasticsearch
+
 service:
   ipFamilyPolicy: PreferDualStack
-  ipFamilies:
-    - IPv4
-    - IPv6
diff --git a/charts/kibana/ci/external-secrets-values.yaml b/charts/kibana/ci/external-secrets-values.yaml
@@ -1,7 +1,6 @@
 # SPDX-License-Identifier: Apache-2.0
-elasticsearch:
-  auth:
-    type: serviceAccountToken
+bundled-elasticsearch:
+  fullnameOverride: kibana-ci-elasticsearch
 
 encryptionKeys:
   requireForMultipleReplicas: true
@@ -10,23 +9,16 @@ externalSecrets:
   enabled: true
   skipCRDCheck: true
   secretStoreRef:
-    name: cluster-secrets
+    name: helmforge-fake-store
     kind: ClusterSecretStore
   data:
-    - secretKey: service-account-token
-      remoteRef:
-        key: elastic/kibana
-        property: service-account-token
     - secretKey: xpack-security-encryption-key
       remoteRef:
-        key: elastic/kibana
-        property: security-key
+        key: test/kibana-security-encryption-key
     - secretKey: xpack-reporting-encryption-key
       remoteRef:
-        key: elastic/kibana
-        property: reporting-key
+        key: test/kibana-reporting-encryption-key
     - secretKey: xpack-encrypted-saved-objects-encryption-key
       remoteRef:
-        key: elastic/kibana
-        property: saved-objects-key
+        key: test/kibana-saved-objects-encryption-key
   dataFrom: []
diff --git a/charts/kibana/ci/gateway-api-values.yaml b/charts/kibana/ci/gateway-api-values.yaml
@@ -1,4 +1,7 @@
 # SPDX-License-Identifier: Apache-2.0
+bundled-elasticsearch:
+  fullnameOverride: kibana-ci-elasticsearch
+
 gateway:
   enabled: true
   skipCRDCheck: true

diff --git a/charts/kibana/ci/ingress-values.yaml b/charts/kibana/ci/ingress-values.yaml
@@ -1,4 +1,7 @@
 # SPDX-License-Identifier: Apache-2.0
+bundled-elasticsearch:
+  fullnameOverride: kibana-ci-elasticsearch
+
 ingress:
   enabled: true
   ingressClassName: traefik

diff --git a/charts/kibana/ci/k3d-values.yaml b/charts/kibana/ci/k3d-values.yaml
@@ -1,16 +1,12 @@
 # SPDX-License-Identifier: Apache-2.0
-elasticsearch:
-  hosts:
-    - http://elasticsearch:9200
+bundled-elasticsearch:
+  fullnameOverride: kibana-ci-elasticsearch
 
 encryptionKeys:
   securityKey: "01234567890123456789012345678901"
   reportingKey: "abcdefghijklmnopqrstuvwxyz123456"
   encryptedSavedObjectsKey: "savedobjects01234567890123456789"
 
-waitForElasticsearch:
-  enabled: true
-
 resources:
   requests:
     cpu: 100m

diff --git a/charts/kibana/ci/network-policy-values.yaml b/charts/kibana/ci/network-policy-values.yaml
@@ -1,4 +1,7 @@
 # SPDX-License-Identifier: Apache-2.0
+bundled-elasticsearch:
+  fullnameOverride: kibana-ci-elasticsearch
+
 networkPolicy:
   enabled: true
   ingress:

diff --git a/charts/kibana/ci/persistence-values.yaml b/charts/kibana/ci/persistence-values.yaml
@@ -1,4 +1,7 @@
 # SPDX-License-Identifier: Apache-2.0
+bundled-elasticsearch:
+  fullnameOverride: kibana-ci-elasticsearch
+
 persistence:
   enabled: true
   size: 1Gi
diff --git a/charts/kibana/ci/security-values.yaml b/charts/kibana/ci/security-values.yaml
@@ -1,15 +1,6 @@
 # SPDX-License-Identifier: Apache-2.0
-elasticsearch:
-  hosts:
-    - https://elasticsearch:9200
-  auth:
-    type: basic
-    username: kibana_system
-    password: "change-me-in-production"
-  tls:
-    enabled: true
-    verificationMode: certificate
-    certificateAuthoritiesSecret: elasticsearch-ca
+bundled-elasticsearch:
+  fullnameOverride: kibana-ci-elasticsearch
 
 encryptionKeys:
   securityKey: "01234567890123456789012345678901"

diff --git a/charts/kibana/ci/servicemonitor-values.yaml b/charts/kibana/ci/servicemonitor-values.yaml
@@ -1,4 +1,7 @@
 # SPDX-License-Identifier: Apache-2.0
+bundled-elasticsearch:
+  fullnameOverride: kibana-ci-elasticsearch
+
 serviceMonitor:
   enabled: true
   labels:

diff --git a/charts/kibana/ci/wolfi-values.yaml b/charts/kibana/ci/wolfi-values.yaml
@@ -1,3 +1,6 @@
 # SPDX-License-Identifier: Apache-2.0
+bundled-elasticsearch:
+  fullnameOverride: kibana-ci-elasticsearch
+
 image:
   flavor: wolfi
diff --git a/charts/kibana/docs/elasticsearch.md b/charts/kibana/docs/elasticsearch.md
@@ -1,45 +1,35 @@
 # Kibana Elasticsearch Connectivity
 
-By default, Kibana connects to an external Elasticsearch endpoint:
+By default, Kibana deploys the HelmForge Elasticsearch subchart and connects to
+its generated in-cluster Service:
 
 ```yaml
-elasticsearch:
-  hosts:
-    - http://elasticsearch:9200
+bundledElasticsearch:
+  enabled: true
 ```
 
-## HelmForge Elasticsearch Subchart
+## External Elasticsearch
 
-Enable the bundled HelmForge Elasticsearch subchart for local development or
-self-contained test environments:
+Disable the bundled dependency when connecting to a separately operated
+Elasticsearch cluster:
 
 ```yaml
 bundledElasticsearch:
-  enabled: true
-
-elasticsearch:
-  hosts:
-    - http://kibana-bundled-elasticsearch:9200
-
-bundled-elasticsearch:
-  image:
-    tag: "9.4.2"
-```
-
-When using a custom release name, set the host to the service rendered by the
-aliased dependency:
+  enabled: false
 
-```yaml
 elasticsearch:
   hosts:
-    - http://<release-name>-bundled-elasticsearch:9200
+    - http://elasticsearch:9200
 ```
 
 For production, operate Elasticsearch separately and keep the subchart disabled.
 
 ## Secured Elasticsearch
 
 ```yaml
+bundledElasticsearch:
+  enabled: false
+
 elasticsearch:
   hosts:
     - https://elasticsearch:9200

diff --git a/charts/kibana/examples/bundled-elasticsearch.yaml b/charts/kibana/examples/bundled-elasticsearch.yaml
@@ -2,10 +2,6 @@
 bundledElasticsearch:
   enabled: true
 
-elasticsearch:
-  hosts:
-    - http://kibana-bundled-elasticsearch:9200
-
 bundled-elasticsearch:
   clusterProfile: dev
   image:

diff --git a/charts/kibana/examples/production.yaml b/charts/kibana/examples/production.yaml
@@ -1,6 +1,9 @@
 # SPDX-License-Identifier: Apache-2.0
 replicaCount: 2
 
+bundledElasticsearch:
+  enabled: false
+
 elasticsearch:
   hosts:
     - https://elasticsearch:9200

diff --git a/charts/kibana/templates/NOTES.txt b/charts/kibana/templates/NOTES.txt
@@ -1,54 +1,50 @@
 {{/* SPDX-License-Identifier: Apache-2.0 */}}
-=============================================================================
 Kibana deployed successfully!
-=============================================================================
 
-ACCESS:
+1. Access
    kubectl port-forward svc/{{ include "kibana.fullname" . }} -n {{ .Release.Namespace }} 5601:{{ .Values.service.port }}
    Open: http://localhost:5601/
 
-SERVICE:
+2. Service
    Internal URL: http://{{ include "kibana.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.port }}
    Status URL: http://{{ include "kibana.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.port }}{{ include "kibana.probePath" . }}
 
-IMAGE:
+3. Image
    {{ include "kibana.image" . }}
 
-ELASTICSEARCH:
+4. Elasticsearch
    Hosts:
-{{- range .Values.elasticsearch.hosts }}
-     - {{ . }}
-{{- end }}
+{{ include "kibana.elasticsearchHosts" . | nindent 5 }}
    Auth type: {{ .Values.elasticsearch.auth.type }}
    Bundled Elasticsearch subchart: {{ ternary "enabled" "disabled" .Values.bundledElasticsearch.enabled }}
 
-CONFIGURATION:
+5. Configuration
    Persistence: {{ ternary "enabled" "disabled" .Values.persistence.enabled }}
    Wolfi image: {{ ternary "enabled" "disabled" (eq .Values.image.flavor "wolfi") }}
    ExternalSecret: {{ ternary "enabled" "disabled" .Values.externalSecrets.enabled }}
 
-NETWORKING:
+6. Networking
    Ingress: {{ ternary "enabled" "disabled" .Values.ingress.enabled }}
    Gateway API: {{ ternary "enabled" "disabled" .Values.gateway.enabled }}
    NetworkPolicy: {{ ternary "enabled" "disabled" .Values.networkPolicy.enabled }}
 
-OBSERVABILITY:
+7. Observability
    ServiceMonitor: {{ ternary "enabled" "disabled" .Values.serviceMonitor.enabled }}
 
-OPERATIONS:
+8. Operations
    Run Helm tests:
      helm test {{ .Release.Name }} -n {{ .Release.Namespace }}
 
    Inspect pods:
      kubectl get pods -n {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }}
      kubectl logs -n {{ .Release.Namespace }} deploy/{{ include "kibana.fullname" . }}
 
-SECURITY REMINDERS:
+9. Security Reminders
    1. Use static encryption keys for multiple replicas.
    2. Use Elasticsearch TLS and authentication for production clusters.
    3. Prefer ExternalSecret or existing Secrets for tokens and encryption keys.
 
-DOCUMENTATION:
+10. Documentation
    Chart: https://helmforge.dev/docs/charts/kibana
    Source: https://github.com/helmforgedev/charts/tree/main/charts/kibana
    Kibana: https://www.elastic.co/kibana

diff --git a/charts/kibana/templates/_helpers.tpl b/charts/kibana/templates/_helpers.tpl
@@ -152,6 +152,11 @@ app.kubernetes.io/part-of: helmforge
 {{- if or $auth $keys .Values.extraEnv -}}true{{- else -}}false{{- end -}}
 {{- end -}}
 
+{{- define "kibana.waitForElasticsearchEnabled" -}}
+{{- $externalPlainHTTP := and (not .Values.bundledElasticsearch.enabled) (eq .Values.elasticsearch.auth.type "none") (not .Values.elasticsearch.tls.enabled) -}}
+{{- if and .Values.waitForElasticsearch.enabled (or .Values.bundledElasticsearch.enabled $externalPlainHTTP) -}}true{{- else -}}false{{- end -}}
+{{- end -}}
+
 {{- define "kibana.probePath" -}}
 {{- $basePath := trimSuffix "/" .Values.server.basePath -}}
 {{- if $basePath -}}
@@ -166,6 +171,12 @@ app.kubernetes.io/part-of: helmforge
 {{- if and .Values.bundledElasticsearch.enabled (eq (include "kibana.bundledElasticsearchSecured" .) "true") -}}
 {{- fail "bundled Elasticsearch with security enabled (bundled-elasticsearch.security.enabled=true or clusterProfile=production-ha) is not supported in bundled mode: this chart wires only the plain-HTTP Service URL, not TLS CA verification or auth, so Kibana would connect to the wrong (https) endpoint. Use external mode instead -- set bundledElasticsearch.enabled=false and configure elasticsearch.hosts + elasticsearch.tls + elasticsearch.auth against your secured cluster." -}}
 {{- end -}}
+{{- if and .Values.bundledElasticsearch.enabled (ne $auth "none") -}}
+{{- fail "elasticsearch.auth.type must be none when bundledElasticsearch.enabled=true because the bundled dev profile is unauthenticated plain HTTP. Disable bundledElasticsearch to use external secured Elasticsearch." -}}
+{{- end -}}
+{{- if and .Values.bundledElasticsearch.enabled .Values.elasticsearch.tls.enabled -}}
+{{- fail "elasticsearch.tls.enabled must be false when bundledElasticsearch.enabled=true because the bundled dev profile is plain HTTP. Disable bundledElasticsearch to use external TLS Elasticsearch." -}}
+{{- end -}}
 {{- if not (has $auth (list "none" "basic" "serviceAccountToken")) -}}
 {{- fail "elasticsearch.auth.type must be one of: none, basic, serviceAccountToken" -}}
 {{- end -}}

diff --git a/charts/kibana/templates/deployment.yaml b/charts/kibana/templates/deployment.yaml
@@ -56,7 +56,7 @@ spec:
       priorityClassName: {{ . | quote }}
       {{- end }}
       terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
-      {{- if .Values.waitForElasticsearch.enabled }}
+      {{- if eq (include "kibana.waitForElasticsearchEnabled" .) "true" }}
       initContainers:
         - name: wait-for-elasticsearch
           image: "{{ .Values.waitForElasticsearch.image.repository }}:{{ .Values.waitForElasticsearch.image.tag }}"