Conversation
Signed-off-by: Bonusree <bonusree@appscode.com>
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 34002560 | Triggered | Curl Username Password | ae060c6 | docs/guides/elasticsearch/reconfigure/elasticsearch-combined.md | View secret |
| 34003980 | Triggered | Curl Username Password | 2d6ff73 | docs/guides/elasticsearch/reconfigure/elasticsearch-topology.md | View secret |
| 34005569 | Triggered | Curl Username Password | 0d107bb | docs/guides/elasticsearch/tls/elasticsearch-combined.md | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secrets safely. Learn here the best practices.
- Revoke and rotate these secrets.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
|
Visit the preview URL for this PR (updated for commit b023fbe): https://kubedb-v2-hugo--pr886-es-liydm7o6.web.app (expires Tue, 23 Jun 2026 10:54:12 GMT) 🔥 via Firebase Hosting GitHub Action 🌎 Sign: 0f29ae8ae0bd54a99bf2b223b6833be47acd5943 |
Signed-off-by: Bonusree <bonusree@appscode.com>
Signed-off-by: Bonusree <bonusree@appscode.com>
Signed-off-by: Bonusree <bonusree@appscode.com>
📝 WalkthroughWalkthroughFixes an incorrect auth Secret name reference in the Druid RotateAuth guide. Adds two new Elasticsearch documentation sections: a Reconfigure section (overview plus combined and topology cluster tutorials) and a TLS/SSL section (overview plus combined and topology cluster tutorials), each covering prerequisite setup, deployment, verification, and cleanup. Updates a GitOps guide example to align with the new reconfiguration pattern. ChangesDruid RotateAuth Fix
Elasticsearch Reconfigure Documentation
Elasticsearch TLS/SSL Documentation
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (3)
docs/guides/elasticsearch/tls/overview.md (1)
13-23: ⚡ Quick winUse more descriptive link text instead of "[here]".
Per markdown style guide (MD059), link text should clearly describe the destination. Replace generic "[here]" with descriptive text like the actual page/section being linked.
♻️ Proposed fixes for link descriptiveness
- > New to KubeDB? Please start [here](/docs/README.md). + > New to KubeDB? Please start with our [README](/docs/README.md). - **Prerequisite :** To configure TLS/SSL in `Elasticsearch`, `KubeDB` uses `cert-manager` to issue certificates. So first you have to make sure that the cluster has `cert-manager` installed. To install `cert-manager` in your cluster following steps [here](https://cert-manager.io/docs/installation/kubernetes/). + **Prerequisite :** To configure TLS/SSL in `Elasticsearch`, `KubeDB` uses `cert-manager` to issue certificates. So first you have to make sure that the cluster has `cert-manager` installed. To install `cert-manager` in your cluster following the [official cert-manager installation guide](https://cert-manager.io/docs/installation/kubernetes/). - - `Issuer/ClusterIssuer`: Issuers, and ClusterIssuers represent certificate authorities (CAs) that are able to generate signed certificates by honoring certificate signing requests. All cert-manager certificates require a referenced issuer that is in a ready condition to attempt to honor the request. You can learn more details [here](https://cert-manager.io/docs/concepts/issuer/). + - `Issuer/ClusterIssuer`: Issuers and ClusterIssuers represent certificate authorities (CAs) that can generate signed certificates by honoring certificate signing requests. All cert-manager certificates require a referenced issuer in a ready condition to attempt to honor the request. You can learn more details in the [cert-manager Issuer concepts guide](https://cert-manager.io/docs/concepts/issuer/). - - `Certificate`: `cert-manager` has the concept of Certificates that define a desired x509 certificate which will be renewed and kept up to date. You can learn more details [here](https://cert-manager.io/docs/concepts/certificate/). + - `Certificate`: `cert-manager` has the concept of Certificates that define a desired x509 certificate which will be renewed and kept up to date. You can learn more details in the [cert-manager Certificate concepts guide](https://cert-manager.io/docs/concepts/certificate/).This also addresses the LanguageTool style suggestions: "able to" → "can" and "that is in a ready condition" → "in a ready condition" for clarity.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/guides/elasticsearch/tls/overview.md` around lines 13 - 23, Replace all generic "[here]" link text with descriptive alternatives that clearly indicate the destination content. In the first paragraph, change "[here]" linking to the KubeDB README to something descriptive like "KubeDB documentation" or "getting started guide". Replace "[here]" in the cert-manager installation link with "cert-manager installation documentation". For the Issuer CRD explanation, replace "[here]" with "Issuer and ClusterIssuer concepts documentation", and simultaneously change "able to" to "can" and "that is in a ready condition" to "in a ready condition" for clarity. For the Certificate CRD explanation, replace "[here]" with "Certificate concepts documentation" to maintain consistency and descriptiveness throughout the guide.Source: Linters/SAST tools
docs/guides/elasticsearch/tls/elasticsearch-topology.md (1)
13-13: ⚡ Quick winUse more descriptive link text instead of "[here]".
Per markdown style guide (MD059), replace generic "[here]" with descriptive link text at lines 13, 25, and 252.
♻️ Proposed fixes for link descriptiveness
- > New to KubeDB? Please start [here](/docs/README.md). + > New to KubeDB? Please start with our [README](/docs/README.md). - - Now, install KubeDB cli on your workstation and KubeDB operator in your cluster following the steps [here](/docs/setup/README.md). + - Now, install KubeDB cli on your workstation and KubeDB operator in your cluster following the [setup guide](/docs/setup/README.md). - - Different Elasticsearch topology clustering modes [here](/docs/guides/elasticsearch/clustering/topology-cluster/hot-warm-cold-cluster/index.md). + - Different Elasticsearch [topology clustering modes](/docs/guides/elasticsearch/clustering/topology-cluster/hot-warm-cold-cluster/index.md).Also address LanguageTool suggestion at line 236:
- From the above output, we can see that we are able to connect to the Elasticsearch topology cluster using the TLS configuration. + From the above output, we can see that we can connect to the Elasticsearch topology cluster using the TLS configuration.Also applies to: 25-25, 252-255
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/guides/elasticsearch/tls/elasticsearch-topology.md` at line 13, Replace all instances of generic "[here]" link text with more descriptive, context-specific text throughout the markdown file. In the line 13 area where it says "Please start [here]", use descriptive text that indicates what starting there involves (such as "KubeDB introduction" or similar). Similarly, update the "[here]" instances at lines 25 and 252-255 with link text that specifically describes what the reader will find by following each link, making each link's purpose clear without requiring readers to infer from context.Source: Linters/SAST tools
docs/guides/elasticsearch/tls/elasticsearch-combined.md (1)
13-13: ⚡ Quick winUse more descriptive link text instead of "[here]".
Per markdown style guide (MD059), replace generic "[here]" with descriptive link text at lines 13, 25, and 233.
♻️ Proposed fixes for link descriptiveness
- > New to KubeDB? Please start [here](/docs/README.md). + > New to KubeDB? Please start with our [README](/docs/README.md). - - Now, install KubeDB cli on your workstation and KubeDB operator in your cluster following the steps [here](/docs/setup/README.md). + - Now, install KubeDB cli on your workstation and KubeDB operator in your cluster following the [setup guide](/docs/setup/README.md). - - Monitor your Elasticsearch database with KubeDB using [out-of-the-box Prometheus operator](/docs/guides/elasticsearch/monitoring/using-prometheus-operator.md). + - Monitor your Elasticsearch database with KubeDB using the [Prometheus operator integration guide](/docs/guides/elasticsearch/monitoring/using-prometheus-operator.md).Also address LanguageTool suggestion at line 217:
- From the above output, we can see that we are able to connect to the Elasticsearch cluster using the TLS configuration. + From the above output, we can see that we can connect to the Elasticsearch cluster using the TLS configuration.Also applies to: 25-25, 233-236
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/guides/elasticsearch/tls/elasticsearch-combined.md` at line 13, Replace the generic link text "[here]" with more descriptive text that explains the destination or purpose of the link across all affected locations in the file docs/guides/elasticsearch/tls/elasticsearch-combined.md. At line 13, replace the link text in the phrase about starting with KubeDB documentation with something descriptive about the README/getting started guide. At line 25, apply the same principle to replace the generic "[here]" with text that describes what the linked content contains. At lines 233-236, do the same for any generic "[here]" link text in that section. Ensure each link text clearly communicates what the reader will find at the destination rather than using the generic placeholder.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/guides/druid/rotate-auth/guide.md`:
- Line 377: The YAML file
`docs/guides/druid/rotate-auth/yamls/Druid-rotate-auth-user.yaml` contains an
incorrect Secret name reference at line 13. Update the Secret name from
`sample-druid-auth-user` to `druid-quickstart-auth-user` to match the Secret
creation instructions provided in the guide, ensuring the DruidOpsRequest will
correctly reference an existing Secret when users apply the manifest.
In `@docs/guides/elasticsearch/reconfigure/elasticsearch-combined.md`:
- Line 119: Replace hardcoded Elasticsearch credentials with the environment
variable pattern across both tutorial files to improve security and
documentation consistency. In
docs/guides/elasticsearch/reconfigure/elasticsearch-combined.md at lines 119,
312, and 374, replace the hardcoded password `X4gzeLWqUHKMoQT7` with
`$ELASTIC_USER_PASSWORD` in the curl command user parameter. In
docs/guides/elasticsearch/reconfigure/elasticsearch-topology.md at line 498,
replace the hardcoded password `X4am_*ihVy~M)m0j` with `$ELASTIC_USER_PASSWORD`
to match the pattern used elsewhere in that file. Additionally, add a
prerequisite instruction section at the beginning of both documentation files
that shows users how to export the environment variable using kubectl to
retrieve the actual password from the cluster secret.
In `@docs/guides/elasticsearch/tls/elasticsearch-topology.md`:
- Line 196: The grep command in the elasticsearch-topology.md file contains a
typo in the search pattern. On line 196, the grep pattern `xpack.securit` is
incomplete and missing the final 'y'. Change this to `xpack.security` to match
the correct Elasticsearch configuration parameter name. This will ensure the
grep command returns the expected output for the tutorial verification step
instead of returning no results.
---
Nitpick comments:
In `@docs/guides/elasticsearch/tls/elasticsearch-combined.md`:
- Line 13: Replace the generic link text "[here]" with more descriptive text
that explains the destination or purpose of the link across all affected
locations in the file docs/guides/elasticsearch/tls/elasticsearch-combined.md.
At line 13, replace the link text in the phrase about starting with KubeDB
documentation with something descriptive about the README/getting started guide.
At line 25, apply the same principle to replace the generic "[here]" with text
that describes what the linked content contains. At lines 233-236, do the same
for any generic "[here]" link text in that section. Ensure each link text
clearly communicates what the reader will find at the destination rather than
using the generic placeholder.
In `@docs/guides/elasticsearch/tls/elasticsearch-topology.md`:
- Line 13: Replace all instances of generic "[here]" link text with more
descriptive, context-specific text throughout the markdown file. In the line 13
area where it says "Please start [here]", use descriptive text that indicates
what starting there involves (such as "KubeDB introduction" or similar).
Similarly, update the "[here]" instances at lines 25 and 252-255 with link text
that specifically describes what the reader will find by following each link,
making each link's purpose clear without requiring readers to infer from
context.
In `@docs/guides/elasticsearch/tls/overview.md`:
- Around line 13-23: Replace all generic "[here]" link text with descriptive
alternatives that clearly indicate the destination content. In the first
paragraph, change "[here]" linking to the KubeDB README to something descriptive
like "KubeDB documentation" or "getting started guide". Replace "[here]" in the
cert-manager installation link with "cert-manager installation documentation".
For the Issuer CRD explanation, replace "[here]" with "Issuer and ClusterIssuer
concepts documentation", and simultaneously change "able to" to "can" and "that
is in a ready condition" to "in a ready condition" for clarity. For the
Certificate CRD explanation, replace "[here]" with "Certificate concepts
documentation" to maintain consistency and descriptiveness throughout the guide.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 034236f6-acb9-4a20-ba58-d73a836f94a7
⛔ Files ignored due to path filters (2)
docs/images/elasticsearch/es-reconfigure.svgis excluded by!**/*.svgdocs/images/elasticsearch/es-tls.svgis excluded by!**/*.svg
📒 Files selected for processing (9)
docs/guides/druid/rotate-auth/guide.mddocs/guides/elasticsearch/reconfigure/_index.mddocs/guides/elasticsearch/reconfigure/elasticsearch-combined.mddocs/guides/elasticsearch/reconfigure/elasticsearch-topology.mddocs/guides/elasticsearch/reconfigure/overview.mddocs/guides/elasticsearch/tls/_index.mddocs/guides/elasticsearch/tls/elasticsearch-combined.mddocs/guides/elasticsearch/tls/elasticsearch-topology.mddocs/guides/elasticsearch/tls/overview.md
| secretRef: | ||
| kind: Secret | ||
| name: sample-druid-auth-user | ||
| name: druid-quickstart-auth-user |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify the YAML artifact file contains the correct Secret name
if grep -q "sample-druid-auth-user" docs/guides/druid/rotate-auth/yamls/Druid-rotate-auth-user.yaml; then
echo "❌ FOUND: YAML artifact still references old Secret name 'sample-druid-auth-user'"
grep -n "sample-druid-auth-user" docs/guides/druid/rotate-auth/yamls/Druid-rotate-auth-user.yaml
else
echo "✓ YAML artifact correctly updated to 'druid-quickstart-auth-user'"
grep -n "druid-quickstart-auth-user" docs/guides/druid/rotate-auth/yamls/Druid-rotate-auth-user.yaml
fiRepository: kubedb/docs
Length of output: 174
Update YAML artifact to use correct Secret name.
The YAML file docs/guides/druid/rotate-auth/yamls/Druid-rotate-auth-user.yaml still references sample-druid-auth-user (line 13), but the guide instructs users to create a secret named druid-quickstart-auth-user. When users execute the kubectl apply command, they will reference a non-existent Secret, causing the DruidOpsRequest to fail.
Update line 13 in the YAML file from name: sample-druid-auth-user to name: druid-quickstart-auth-user.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/guides/druid/rotate-auth/guide.md` at line 377, The YAML file
`docs/guides/druid/rotate-auth/yamls/Druid-rotate-auth-user.yaml` contains an
incorrect Secret name reference at line 13. Update the Secret name from
`sample-druid-auth-user` to `druid-quickstart-auth-user` to match the Secret
creation instructions provided in the guide, ensuring the DruidOpsRequest will
correctly reference an existing Secret when users apply the manifest.
| Exec into the Elasticsearch pod and query the cluster settings to see the configuration: | ||
|
|
||
| ```bash | ||
| $ kubectl exec -it -n demo es-combined-0 -c elasticsearch -- curl -k -XGET "https://localhost:9200/_nodes/settings?filter_path=nodes.*.settings.indices&pretty" --user "elastic:X4gzeLWqUHKMoQT7" | grep max_clause_count |
There was a problem hiding this comment.
Unify credential handling across reconfigure tutorials — use environment variables instead of hardcoded passwords.
Both tutorial files contain hardcoded credentials in curl commands, creating a security and documentation hygiene concern. The topology cluster file demonstrates the correct pattern ($ELASTIC_USER_PASSWORD) in most commands, but combined cluster uses hardcoded values throughout, and topology has one inconsistency at line 498. Standardize all tutorials to use the environment variable pattern.
docs/guides/elasticsearch/reconfigure/elasticsearch-combined.md#L119-L119: Replace hardcodedX4gzeLWqUHKMoQT7with$ELASTIC_USER_PASSWORDin lines 119, 312, and 374.docs/guides/elasticsearch/reconfigure/elasticsearch-topology.md#L498-L498: Replace hardcodedX4am_*ihVy~M)m0jwith$ELASTIC_USER_PASSWORDto match the pattern used elsewhere in the same file.
Both files should also include a prerequisite instruction to export the password variable:
export ELASTIC_USER_PASSWORD=$(kubectl get secret -n demo <es-name>-elastic-cred -o jsonpath='{.data.password}' | base64 -d)🧰 Tools
🪛 Betterleaks (1.5.0)
[high] 119-119: Discovered a potential basic authorization token provided in a curl command, which could compromise the curl accessed resource.
(curl-auth-user)
📍 Affects 2 files
docs/guides/elasticsearch/reconfigure/elasticsearch-combined.md#L119-L119(this comment)docs/guides/elasticsearch/reconfigure/elasticsearch-topology.md#L498-L498
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/guides/elasticsearch/reconfigure/elasticsearch-combined.md` at line 119,
Replace hardcoded Elasticsearch credentials with the environment variable
pattern across both tutorial files to improve security and documentation
consistency. In docs/guides/elasticsearch/reconfigure/elasticsearch-combined.md
at lines 119, 312, and 374, replace the hardcoded password `X4gzeLWqUHKMoQT7`
with `$ELASTIC_USER_PASSWORD` in the curl command user parameter. In
docs/guides/elasticsearch/reconfigure/elasticsearch-topology.md at line 498,
replace the hardcoded password `X4am_*ihVy~M)m0j` with `$ELASTIC_USER_PASSWORD`
to match the pattern used elsewhere in that file. Additionally, add a
prerequisite instruction section at the beginning of both documentation files
that shows users how to export the environment variable using kubectl to
retrieve the actual password from the cluster secret.
|
|
||
| ```bash | ||
| $ kubectl exec -n demo es-topology-tls-master-0 -c elasticsearch -- \ | ||
| cat /usr/share/elasticsearch/config/elasticsearch.yml | grep -A 2 -i xpack.securit |
There was a problem hiding this comment.
Fix grep command typo that will cause verification to fail.
Line 196 has an incomplete grep pattern: xpack.securit (missing final 'y'). This will cause the command to return no output, making the tutorial verification step fail. Compare to the combined cluster guide (line 176), which correctly uses xpack.security.
🔧 Fix the grep pattern
- $ kubectl exec -n demo es-topology-tls-master-0 -c elasticsearch -- \
- cat /usr/share/elasticsearch/config/elasticsearch.yml | grep -A 2 -i xpack.securit
+ $ kubectl exec -n demo es-topology-tls-master-0 -c elasticsearch -- \
+ cat /usr/share/elasticsearch/config/elasticsearch.yml | grep -A 2 -i xpack.security📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| cat /usr/share/elasticsearch/config/elasticsearch.yml | grep -A 2 -i xpack.securit | |
| $ kubectl exec -n demo es-topology-tls-master-0 -c elasticsearch -- \ | |
| cat /usr/share/elasticsearch/config/elasticsearch.yml | grep -A 2 -i xpack.security |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/guides/elasticsearch/tls/elasticsearch-topology.md` at line 196, The
grep command in the elasticsearch-topology.md file contains a typo in the search
pattern. On line 196, the grep pattern `xpack.securit` is incomplete and missing
the final 'y'. Change this to `xpack.security` to match the correct
Elasticsearch configuration parameter name. This will ensure the grep command
returns the expected output for the tutorial verification step instead of
returning no results.
Signed-off-by: Bonusree <bonusree@appscode.com>
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
docs/guides/elasticsearch/gitops/gitops.md (1)
344-355:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winUse
elasticsearch.ymlconsistently in the reconfigure example.The Secret block is correct, but the prose still says
user.conf. That mismatch will mislead readers and breaks the documented Elasticsearch reconfigure contract, where the config lives underelasticsearch.yml.Suggested fix
-At first, we will create a secret containing `user.conf` file with required configuration settings. +At first, we will create a secret containing an `elasticsearch.yml` file with the required configuration settings.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/guides/elasticsearch/gitops/gitops.md` around lines 344 - 355, The prose text at the beginning of the Secret example block incorrectly references "user.conf" when describing the configuration file, but the YAML configuration below it correctly uses "elasticsearch.yml" as the key name. Update the introductory sentence to say "elasticsearch.yml" instead of "user.conf" so the documentation text matches the actual configuration example and maintains consistency with Elasticsearch configuration conventions.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@docs/guides/elasticsearch/gitops/gitops.md`:
- Around line 344-355: The prose text at the beginning of the Secret example
block incorrectly references "user.conf" when describing the configuration file,
but the YAML configuration below it correctly uses "elasticsearch.yml" as the
key name. Update the introductory sentence to say "elasticsearch.yml" instead of
"user.conf" so the documentation text matches the actual configuration example
and maintains consistency with Elasticsearch configuration conventions.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: bf9e146e-5c8f-45e0-a074-ee2248aaf95c
📒 Files selected for processing (3)
docs/guides/elasticsearch/gitops/gitops.mddocs/guides/elasticsearch/tls/elasticsearch-combined.mddocs/guides/elasticsearch/tls/elasticsearch-topology.md
✅ Files skipped from review due to trivial changes (2)
- docs/guides/elasticsearch/tls/elasticsearch-combined.md
- docs/guides/elasticsearch/tls/elasticsearch-topology.md
Summary by CodeRabbit