Skip to content

reconfigure and tls for es#886

Open
Bonusree wants to merge 6 commits into
masterfrom
es
Open

reconfigure and tls for es#886
Bonusree wants to merge 6 commits into
masterfrom
es

Conversation

@Bonusree

@Bonusree Bonusree commented Jun 15, 2026

Copy link
Copy Markdown
Contributor

Summary by CodeRabbit

  • Documentation
    • Fixed Druid RotateAuth documentation example to reference the correct auth Secret.
    • Added/expanded Elasticsearch reconfiguration guides for both Combined and Topology clusters, including validation and reconfiguration (replacement and merge/apply approaches).
    • Added Elasticsearch TLS/SSL guides for both Combined and Topology clusters, including cert-manager setup and verification steps.
    • Introduced new overview pages covering Elasticsearch reconfiguration and TLS/SSL workflows.

Signed-off-by: Bonusree <bonusree@appscode.com>
@gitguardian

gitguardian Bot commented Jun 15, 2026

Copy link
Copy Markdown

⚠️ GitGuardian has uncovered 3 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request
GitGuardian id GitGuardian status Secret Commit Filename
34002560 Triggered Curl Username Password ae060c6 docs/guides/elasticsearch/reconfigure/elasticsearch-combined.md View secret
34003980 Triggered Curl Username Password 2d6ff73 docs/guides/elasticsearch/reconfigure/elasticsearch-topology.md View secret
34005569 Triggered Curl Username Password 0d107bb docs/guides/elasticsearch/tls/elasticsearch-combined.md View secret
🛠 Guidelines to remediate hardcoded secrets
  1. Understand the implications of revoking this secret by investigating where it is used in your code.
  2. Replace and store your secrets safely. Learn here the best practices.
  3. Revoke and rotate these secrets.
  4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider


🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.

@github-actions

github-actions Bot commented Jun 15, 2026

Copy link
Copy Markdown

Visit the preview URL for this PR (updated for commit b023fbe):

https://kubedb-v2-hugo--pr886-es-liydm7o6.web.app

(expires Tue, 23 Jun 2026 10:54:12 GMT)

🔥 via Firebase Hosting GitHub Action 🌎

Sign: 0f29ae8ae0bd54a99bf2b223b6833be47acd5943

Bonusree added 3 commits June 15, 2026 17:33
Signed-off-by: Bonusree <bonusree@appscode.com>
Signed-off-by: Bonusree <bonusree@appscode.com>
Signed-off-by: Bonusree <bonusree@appscode.com>
@Bonusree Bonusree requested a review from fr-sarker June 16, 2026 06:21
Signed-off-by: Bonusree <bonusree@appscode.com>
@coderabbitai

coderabbitai Bot commented Jun 16, 2026

Copy link
Copy Markdown

Review Change Stack

📝 Walkthrough

Walkthrough

Fixes an incorrect auth Secret name reference in the Druid RotateAuth guide. Adds two new Elasticsearch documentation sections: a Reconfigure section (overview plus combined and topology cluster tutorials) and a TLS/SSL section (overview plus combined and topology cluster tutorials), each covering prerequisite setup, deployment, verification, and cleanup. Updates a GitOps guide example to align with the new reconfiguration pattern.

Changes

Druid RotateAuth Fix

Layer / File(s) Summary
Secret name correction
docs/guides/druid/rotate-auth/guide.md
Two lines updated to reference druid-quickstart-auth-user instead of sample-druid-auth-user in both the DruidOpsRequest YAML example and the kubectl describe output excerpt.

Elasticsearch Reconfigure Documentation

Layer / File(s) Summary
Section index, overview, and GitOps example update
docs/guides/elasticsearch/reconfigure/_index.md, docs/guides/elasticsearch/reconfigure/overview.md, docs/guides/elasticsearch/gitops/gitops.md
Navigation index added with menu weight 55; overview documents the full reconfiguration lifecycle (halt → apply/merge config → restart PetSet pods → resume) and the five spec.configuration sub-fields for ElasticsearchOpsRequest with type: Reconfigure. GitOps guide example updated to use Elasticsearch YAML-based configuration Secret format.
Combined cluster tutorial
docs/guides/elasticsearch/reconfigure/elasticsearch-combined.md
Full guide: deploy combined cluster with initial custom config secret, verify settings, reconfigure via configSecret replacement (4096), verify, reconfigure again via applyConfig merge (8192), verify, clean up.
Topology cluster tutorial
docs/guides/elasticsearch/reconfigure/elasticsearch-topology.md
Full guide: deploy topology cluster with role-scoped config secret, verify per-role initial settings, reconfigure via new secret, verify updated per-role values, reconfigure via applyConfig merge, verify, clean up.

Elasticsearch TLS/SSL Documentation

Layer / File(s) Summary
Section index and overview
docs/guides/elasticsearch/tls/_index.md, docs/guides/elasticsearch/tls/overview.md
Navigation index added with menu weight 70; overview documents cert-manager prerequisites, enableSSL/tls.issuerRef/tls.certificates CRD fields, generated certificate secret contents (ca.crt, tls.crt, tls.key), and the provisioning flow across KubeDB operators and cert-manager.
Combined cluster TLS tutorial
docs/guides/elasticsearch/tls/elasticsearch-combined.md
End-to-end guide: generate CA, create cert-manager Issuer, deploy Elasticsearch with enableSSL: true, verify client certificate secret and pod config for transport/HTTP TLS, run HTTPS health check, clean up.
Topology cluster TLS tutorial
docs/guides/elasticsearch/tls/elasticsearch-topology.md
End-to-end guide: same Issuer setup, topology cluster manifest with enableSSL: true and role definitions, readiness wait, client cert secret inspection, master-node exec to confirm elasticsearch.yml transport/HTTP TLS settings, HTTPS health check, clean up.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐇 Hippity-hop through the YAML maze,
A secret was wrong — now the name is straight!
New TLS guides bloom like spring flowers in haze,
Reconfigure docs land with topology and weight.
The rabbit reviewed every curl and each cert,
And hopped away happy, not once getting hurt! 🌸

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name Status Explanation Resolution
Title check ❓ Inconclusive The title 'reconfigure and tls for es' partially refers to the changeset but is overly vague and abbreviated, using non-standard terminology ('es' instead of 'Elasticsearch'). Expand the title to be more descriptive and complete, such as 'Add Elasticsearch reconfiguration and TLS/SSL encryption guides' for clarity and professionalism.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch es

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🧹 Nitpick comments (3)
docs/guides/elasticsearch/tls/overview.md (1)

13-23: ⚡ Quick win

Use more descriptive link text instead of "[here]".

Per markdown style guide (MD059), link text should clearly describe the destination. Replace generic "[here]" with descriptive text like the actual page/section being linked.

♻️ Proposed fixes for link descriptiveness
- > New to KubeDB? Please start [here](/docs/README.md).
+ > New to KubeDB? Please start with our [README](/docs/README.md).

- **Prerequisite :** To configure TLS/SSL in `Elasticsearch`, `KubeDB` uses `cert-manager` to issue certificates. So first you have to make sure that the cluster has `cert-manager` installed. To install `cert-manager` in your cluster following steps [here](https://cert-manager.io/docs/installation/kubernetes/).
+ **Prerequisite :** To configure TLS/SSL in `Elasticsearch`, `KubeDB` uses `cert-manager` to issue certificates. So first you have to make sure that the cluster has `cert-manager` installed. To install `cert-manager` in your cluster following the [official cert-manager installation guide](https://cert-manager.io/docs/installation/kubernetes/).

- - `Issuer/ClusterIssuer`: Issuers, and ClusterIssuers represent certificate authorities (CAs) that are able to generate signed certificates by honoring certificate signing requests. All cert-manager certificates require a referenced issuer that is in a ready condition to attempt to honor the request. You can learn more details [here](https://cert-manager.io/docs/concepts/issuer/).
+ - `Issuer/ClusterIssuer`: Issuers and ClusterIssuers represent certificate authorities (CAs) that can generate signed certificates by honoring certificate signing requests. All cert-manager certificates require a referenced issuer in a ready condition to attempt to honor the request. You can learn more details in the [cert-manager Issuer concepts guide](https://cert-manager.io/docs/concepts/issuer/).

- - `Certificate`: `cert-manager` has the concept of Certificates that define a desired x509 certificate which will be renewed and kept up to date. You can learn more details [here](https://cert-manager.io/docs/concepts/certificate/).
+ - `Certificate`: `cert-manager` has the concept of Certificates that define a desired x509 certificate which will be renewed and kept up to date. You can learn more details in the [cert-manager Certificate concepts guide](https://cert-manager.io/docs/concepts/certificate/).

This also addresses the LanguageTool style suggestions: "able to" → "can" and "that is in a ready condition" → "in a ready condition" for clarity.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/guides/elasticsearch/tls/overview.md` around lines 13 - 23, Replace all
generic "[here]" link text with descriptive alternatives that clearly indicate
the destination content. In the first paragraph, change "[here]" linking to the
KubeDB README to something descriptive like "KubeDB documentation" or "getting
started guide". Replace "[here]" in the cert-manager installation link with
"cert-manager installation documentation". For the Issuer CRD explanation,
replace "[here]" with "Issuer and ClusterIssuer concepts documentation", and
simultaneously change "able to" to "can" and "that is in a ready condition" to
"in a ready condition" for clarity. For the Certificate CRD explanation, replace
"[here]" with "Certificate concepts documentation" to maintain consistency and
descriptiveness throughout the guide.

Source: Linters/SAST tools

docs/guides/elasticsearch/tls/elasticsearch-topology.md (1)

13-13: ⚡ Quick win

Use more descriptive link text instead of "[here]".

Per markdown style guide (MD059), replace generic "[here]" with descriptive link text at lines 13, 25, and 252.

♻️ Proposed fixes for link descriptiveness
- > New to KubeDB? Please start [here](/docs/README.md).
+ > New to KubeDB? Please start with our [README](/docs/README.md).

- - Now, install KubeDB cli on your workstation and KubeDB operator in your cluster following the steps [here](/docs/setup/README.md).
+ - Now, install KubeDB cli on your workstation and KubeDB operator in your cluster following the [setup guide](/docs/setup/README.md).

- - Different Elasticsearch topology clustering modes [here](/docs/guides/elasticsearch/clustering/topology-cluster/hot-warm-cold-cluster/index.md).
+ - Different Elasticsearch [topology clustering modes](/docs/guides/elasticsearch/clustering/topology-cluster/hot-warm-cold-cluster/index.md).

Also address LanguageTool suggestion at line 236:

- From the above output, we can see that we are able to connect to the Elasticsearch topology cluster using the TLS configuration.
+ From the above output, we can see that we can connect to the Elasticsearch topology cluster using the TLS configuration.

Also applies to: 25-25, 252-255

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/guides/elasticsearch/tls/elasticsearch-topology.md` at line 13, Replace
all instances of generic "[here]" link text with more descriptive,
context-specific text throughout the markdown file. In the line 13 area where it
says "Please start [here]", use descriptive text that indicates what starting
there involves (such as "KubeDB introduction" or similar). Similarly, update the
"[here]" instances at lines 25 and 252-255 with link text that specifically
describes what the reader will find by following each link, making each link's
purpose clear without requiring readers to infer from context.

Source: Linters/SAST tools

docs/guides/elasticsearch/tls/elasticsearch-combined.md (1)

13-13: ⚡ Quick win

Use more descriptive link text instead of "[here]".

Per markdown style guide (MD059), replace generic "[here]" with descriptive link text at lines 13, 25, and 233.

♻️ Proposed fixes for link descriptiveness
- > New to KubeDB? Please start [here](/docs/README.md).
+ > New to KubeDB? Please start with our [README](/docs/README.md).

- - Now, install KubeDB cli on your workstation and KubeDB operator in your cluster following the steps [here](/docs/setup/README.md).
+ - Now, install KubeDB cli on your workstation and KubeDB operator in your cluster following the [setup guide](/docs/setup/README.md).

- - Monitor your Elasticsearch database with KubeDB using [out-of-the-box Prometheus operator](/docs/guides/elasticsearch/monitoring/using-prometheus-operator.md).
+ - Monitor your Elasticsearch database with KubeDB using the [Prometheus operator integration guide](/docs/guides/elasticsearch/monitoring/using-prometheus-operator.md).

Also address LanguageTool suggestion at line 217:

- From the above output, we can see that we are able to connect to the Elasticsearch cluster using the TLS configuration.
+ From the above output, we can see that we can connect to the Elasticsearch cluster using the TLS configuration.

Also applies to: 25-25, 233-236

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/guides/elasticsearch/tls/elasticsearch-combined.md` at line 13, Replace
the generic link text "[here]" with more descriptive text that explains the
destination or purpose of the link across all affected locations in the file
docs/guides/elasticsearch/tls/elasticsearch-combined.md. At line 13, replace the
link text in the phrase about starting with KubeDB documentation with something
descriptive about the README/getting started guide. At line 25, apply the same
principle to replace the generic "[here]" with text that describes what the
linked content contains. At lines 233-236, do the same for any generic "[here]"
link text in that section. Ensure each link text clearly communicates what the
reader will find at the destination rather than using the generic placeholder.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/guides/druid/rotate-auth/guide.md`:
- Line 377: The YAML file
`docs/guides/druid/rotate-auth/yamls/Druid-rotate-auth-user.yaml` contains an
incorrect Secret name reference at line 13. Update the Secret name from
`sample-druid-auth-user` to `druid-quickstart-auth-user` to match the Secret
creation instructions provided in the guide, ensuring the DruidOpsRequest will
correctly reference an existing Secret when users apply the manifest.

In `@docs/guides/elasticsearch/reconfigure/elasticsearch-combined.md`:
- Line 119: Replace hardcoded Elasticsearch credentials with the environment
variable pattern across both tutorial files to improve security and
documentation consistency. In
docs/guides/elasticsearch/reconfigure/elasticsearch-combined.md at lines 119,
312, and 374, replace the hardcoded password `X4gzeLWqUHKMoQT7` with
`$ELASTIC_USER_PASSWORD` in the curl command user parameter. In
docs/guides/elasticsearch/reconfigure/elasticsearch-topology.md at line 498,
replace the hardcoded password `X4am_*ihVy~M)m0j` with `$ELASTIC_USER_PASSWORD`
to match the pattern used elsewhere in that file. Additionally, add a
prerequisite instruction section at the beginning of both documentation files
that shows users how to export the environment variable using kubectl to
retrieve the actual password from the cluster secret.

In `@docs/guides/elasticsearch/tls/elasticsearch-topology.md`:
- Line 196: The grep command in the elasticsearch-topology.md file contains a
typo in the search pattern. On line 196, the grep pattern `xpack.securit` is
incomplete and missing the final 'y'. Change this to `xpack.security` to match
the correct Elasticsearch configuration parameter name. This will ensure the
grep command returns the expected output for the tutorial verification step
instead of returning no results.

---

Nitpick comments:
In `@docs/guides/elasticsearch/tls/elasticsearch-combined.md`:
- Line 13: Replace the generic link text "[here]" with more descriptive text
that explains the destination or purpose of the link across all affected
locations in the file docs/guides/elasticsearch/tls/elasticsearch-combined.md.
At line 13, replace the link text in the phrase about starting with KubeDB
documentation with something descriptive about the README/getting started guide.
At line 25, apply the same principle to replace the generic "[here]" with text
that describes what the linked content contains. At lines 233-236, do the same
for any generic "[here]" link text in that section. Ensure each link text
clearly communicates what the reader will find at the destination rather than
using the generic placeholder.

In `@docs/guides/elasticsearch/tls/elasticsearch-topology.md`:
- Line 13: Replace all instances of generic "[here]" link text with more
descriptive, context-specific text throughout the markdown file. In the line 13
area where it says "Please start [here]", use descriptive text that indicates
what starting there involves (such as "KubeDB introduction" or similar).
Similarly, update the "[here]" instances at lines 25 and 252-255 with link text
that specifically describes what the reader will find by following each link,
making each link's purpose clear without requiring readers to infer from
context.

In `@docs/guides/elasticsearch/tls/overview.md`:
- Around line 13-23: Replace all generic "[here]" link text with descriptive
alternatives that clearly indicate the destination content. In the first
paragraph, change "[here]" linking to the KubeDB README to something descriptive
like "KubeDB documentation" or "getting started guide". Replace "[here]" in the
cert-manager installation link with "cert-manager installation documentation".
For the Issuer CRD explanation, replace "[here]" with "Issuer and ClusterIssuer
concepts documentation", and simultaneously change "able to" to "can" and "that
is in a ready condition" to "in a ready condition" for clarity. For the
Certificate CRD explanation, replace "[here]" with "Certificate concepts
documentation" to maintain consistency and descriptiveness throughout the guide.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 034236f6-acb9-4a20-ba58-d73a836f94a7

📥 Commits

Reviewing files that changed from the base of the PR and between fc50286 and 2477c1c.

⛔ Files ignored due to path filters (2)
  • docs/images/elasticsearch/es-reconfigure.svg is excluded by !**/*.svg
  • docs/images/elasticsearch/es-tls.svg is excluded by !**/*.svg
📒 Files selected for processing (9)
  • docs/guides/druid/rotate-auth/guide.md
  • docs/guides/elasticsearch/reconfigure/_index.md
  • docs/guides/elasticsearch/reconfigure/elasticsearch-combined.md
  • docs/guides/elasticsearch/reconfigure/elasticsearch-topology.md
  • docs/guides/elasticsearch/reconfigure/overview.md
  • docs/guides/elasticsearch/tls/_index.md
  • docs/guides/elasticsearch/tls/elasticsearch-combined.md
  • docs/guides/elasticsearch/tls/elasticsearch-topology.md
  • docs/guides/elasticsearch/tls/overview.md

secretRef:
kind: Secret
name: sample-druid-auth-user
name: druid-quickstart-auth-user

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify the YAML artifact file contains the correct Secret name
if grep -q "sample-druid-auth-user" docs/guides/druid/rotate-auth/yamls/Druid-rotate-auth-user.yaml; then
  echo "❌ FOUND: YAML artifact still references old Secret name 'sample-druid-auth-user'"
  grep -n "sample-druid-auth-user" docs/guides/druid/rotate-auth/yamls/Druid-rotate-auth-user.yaml
else
  echo "✓ YAML artifact correctly updated to 'druid-quickstart-auth-user'"
  grep -n "druid-quickstart-auth-user" docs/guides/druid/rotate-auth/yamls/Druid-rotate-auth-user.yaml
fi

Repository: kubedb/docs

Length of output: 174


Update YAML artifact to use correct Secret name.

The YAML file docs/guides/druid/rotate-auth/yamls/Druid-rotate-auth-user.yaml still references sample-druid-auth-user (line 13), but the guide instructs users to create a secret named druid-quickstart-auth-user. When users execute the kubectl apply command, they will reference a non-existent Secret, causing the DruidOpsRequest to fail.

Update line 13 in the YAML file from name: sample-druid-auth-user to name: druid-quickstart-auth-user.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/guides/druid/rotate-auth/guide.md` at line 377, The YAML file
`docs/guides/druid/rotate-auth/yamls/Druid-rotate-auth-user.yaml` contains an
incorrect Secret name reference at line 13. Update the Secret name from
`sample-druid-auth-user` to `druid-quickstart-auth-user` to match the Secret
creation instructions provided in the guide, ensuring the DruidOpsRequest will
correctly reference an existing Secret when users apply the manifest.

Exec into the Elasticsearch pod and query the cluster settings to see the configuration:

```bash
$ kubectl exec -it -n demo es-combined-0 -c elasticsearch -- curl -k -XGET "https://localhost:9200/_nodes/settings?filter_path=nodes.*.settings.indices&pretty" --user "elastic:X4gzeLWqUHKMoQT7" | grep max_clause_count

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Unify credential handling across reconfigure tutorials — use environment variables instead of hardcoded passwords.

Both tutorial files contain hardcoded credentials in curl commands, creating a security and documentation hygiene concern. The topology cluster file demonstrates the correct pattern ($ELASTIC_USER_PASSWORD) in most commands, but combined cluster uses hardcoded values throughout, and topology has one inconsistency at line 498. Standardize all tutorials to use the environment variable pattern.

  • docs/guides/elasticsearch/reconfigure/elasticsearch-combined.md#L119-L119: Replace hardcoded X4gzeLWqUHKMoQT7 with $ELASTIC_USER_PASSWORD in lines 119, 312, and 374.
  • docs/guides/elasticsearch/reconfigure/elasticsearch-topology.md#L498-L498: Replace hardcoded X4am_*ihVy~M)m0j with $ELASTIC_USER_PASSWORD to match the pattern used elsewhere in the same file.

Both files should also include a prerequisite instruction to export the password variable:

export ELASTIC_USER_PASSWORD=$(kubectl get secret -n demo <es-name>-elastic-cred -o jsonpath='{.data.password}' | base64 -d)
🧰 Tools
🪛 Betterleaks (1.5.0)

[high] 119-119: Discovered a potential basic authorization token provided in a curl command, which could compromise the curl accessed resource.

(curl-auth-user)

📍 Affects 2 files
  • docs/guides/elasticsearch/reconfigure/elasticsearch-combined.md#L119-L119 (this comment)
  • docs/guides/elasticsearch/reconfigure/elasticsearch-topology.md#L498-L498
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/guides/elasticsearch/reconfigure/elasticsearch-combined.md` at line 119,
Replace hardcoded Elasticsearch credentials with the environment variable
pattern across both tutorial files to improve security and documentation
consistency. In docs/guides/elasticsearch/reconfigure/elasticsearch-combined.md
at lines 119, 312, and 374, replace the hardcoded password `X4gzeLWqUHKMoQT7`
with `$ELASTIC_USER_PASSWORD` in the curl command user parameter. In
docs/guides/elasticsearch/reconfigure/elasticsearch-topology.md at line 498,
replace the hardcoded password `X4am_*ihVy~M)m0j` with `$ELASTIC_USER_PASSWORD`
to match the pattern used elsewhere in that file. Additionally, add a
prerequisite instruction section at the beginning of both documentation files
that shows users how to export the environment variable using kubectl to
retrieve the actual password from the cluster secret.


```bash
$ kubectl exec -n demo es-topology-tls-master-0 -c elasticsearch -- \
cat /usr/share/elasticsearch/config/elasticsearch.yml | grep -A 2 -i xpack.securit

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Fix grep command typo that will cause verification to fail.

Line 196 has an incomplete grep pattern: xpack.securit (missing final 'y'). This will cause the command to return no output, making the tutorial verification step fail. Compare to the combined cluster guide (line 176), which correctly uses xpack.security.

🔧 Fix the grep pattern
- $ kubectl exec -n demo es-topology-tls-master-0 -c elasticsearch -- \
-                                       cat /usr/share/elasticsearch/config/elasticsearch.yml | grep -A 2 -i xpack.securit
+ $ kubectl exec -n demo es-topology-tls-master-0 -c elasticsearch -- \
+                                       cat /usr/share/elasticsearch/config/elasticsearch.yml | grep -A 2 -i xpack.security
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
cat /usr/share/elasticsearch/config/elasticsearch.yml | grep -A 2 -i xpack.securit
$ kubectl exec -n demo es-topology-tls-master-0 -c elasticsearch -- \
cat /usr/share/elasticsearch/config/elasticsearch.yml | grep -A 2 -i xpack.security
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/guides/elasticsearch/tls/elasticsearch-topology.md` at line 196, The
grep command in the elasticsearch-topology.md file contains a typo in the search
pattern. On line 196, the grep pattern `xpack.securit` is incomplete and missing
the final 'y'. Change this to `xpack.security` to match the correct
Elasticsearch configuration parameter name. This will ensure the grep command
returns the expected output for the tutorial verification step instead of
returning no results.

Signed-off-by: Bonusree <bonusree@appscode.com>

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
docs/guides/elasticsearch/gitops/gitops.md (1)

344-355: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Use elasticsearch.yml consistently in the reconfigure example.

The Secret block is correct, but the prose still says user.conf. That mismatch will mislead readers and breaks the documented Elasticsearch reconfigure contract, where the config lives under elasticsearch.yml.

Suggested fix
-At first, we will create a secret containing `user.conf` file with required configuration settings.
+At first, we will create a secret containing an `elasticsearch.yml` file with the required configuration settings.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/guides/elasticsearch/gitops/gitops.md` around lines 344 - 355, The prose
text at the beginning of the Secret example block incorrectly references
"user.conf" when describing the configuration file, but the YAML configuration
below it correctly uses "elasticsearch.yml" as the key name. Update the
introductory sentence to say "elasticsearch.yml" instead of "user.conf" so the
documentation text matches the actual configuration example and maintains
consistency with Elasticsearch configuration conventions.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@docs/guides/elasticsearch/gitops/gitops.md`:
- Around line 344-355: The prose text at the beginning of the Secret example
block incorrectly references "user.conf" when describing the configuration file,
but the YAML configuration below it correctly uses "elasticsearch.yml" as the
key name. Update the introductory sentence to say "elasticsearch.yml" instead of
"user.conf" so the documentation text matches the actual configuration example
and maintains consistency with Elasticsearch configuration conventions.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: bf9e146e-5c8f-45e0-a074-ee2248aaf95c

📥 Commits

Reviewing files that changed from the base of the PR and between 2477c1c and b023fbe.

📒 Files selected for processing (3)
  • docs/guides/elasticsearch/gitops/gitops.md
  • docs/guides/elasticsearch/tls/elasticsearch-combined.md
  • docs/guides/elasticsearch/tls/elasticsearch-topology.md
✅ Files skipped from review due to trivial changes (2)
  • docs/guides/elasticsearch/tls/elasticsearch-combined.md
  • docs/guides/elasticsearch/tls/elasticsearch-topology.md

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant