<p>I want to enable the security features of ElasticSearch and according to <a href="https://www.elastic.co/guide/en/elasticsearch/reference/7.17/security-minimal-setup.html" rel="nofollow noreferrer">this</a> tutorial I need to add <code>xpack.security.enabled: true</code> to elasticsearch.yml to do so.</p>
<p>I tried doing this by adding the following command:</p>
<pre><code> command:
   - &quot;sh&quot;
   - &quot;-c&quot;
   - &quot;echo 'xpack.security.enabled: true &gt;&gt; /usr/share/elasticsearch/config/elasticsearch.yml&quot;
</code></pre>
<p>But this put the pod into a CrashLoopBackOff. At first I thought this was because the elasticsearch.yml file did not exist at this point, but when I changed the command to:</p>
<pre><code> command:
   - &quot;sh&quot;
   - &quot;-c&quot;
   - &quot;cat /usr/share/elasticsearch/config/elasticsearch.yml&quot;
</code></pre>
<p>I could see with <code>kubectl logs &lt;pod-name&gt;</code> that it does exist and contains the following lines:</p>
<pre><code>cluster.name: &quot;docker-cluster&quot;
network.host: 0.0.0.0
</code></pre>
<p>Strangely, even if I use a very simple command like <code>ls</code> I always get the CrashLoopBackOff.</p>
<p>This is the complete manifest file of the ElasticSearch StatefulSet:</p>
<pre><code>apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: es-cluster
  namespace: efk-stack
spec:
  serviceName: elasticsearch
  replicas: 3
  selector:
    matchLabels:
      app: elasticsearch
  template:
    metadata:
      labels:
        app: elasticsearch
    spec:
      containers:
      - name: elasticsearch
        image: docker.elastic.co/elasticsearch/elasticsearch:7.17.10
        command:
            - &quot;sh&quot;
            - &quot;-c&quot;
            - &quot;cat /usr/share/elasticsearch/config/elasticsearch.yml&quot;
        resources:
            limits:
              cpu: 1000m
            requests:
              cpu: 100m
        ports:
        - containerPort: 9200
          name: rest
          protocol: TCP
        - containerPort: 9300
          name: inter-node
          protocol: TCP
        volumeMounts:
        - name: data
          mountPath: /usr/share/elasticsearch/data
        env:
          - name: cluster.name
            value: k8s-logs
          - name: node.name
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          - name: discovery.seed_hosts
            value: &quot;es-cluster-0.elasticsearch,es-cluster-1.elasticsearch,es-cluster-2.elasticsearch&quot;
          - name: cluster.initial_master_nodes
            value: &quot;es-cluster-0,es-cluster-1,es-cluster-2&quot;
          - name: ES_JAVA_OPTS
            value: &quot;-Xms512m -Xmx512m&quot;
      initContainers:
      - name: fix-permissions
        image: busybox
        command: [&quot;sh&quot;, &quot;-c&quot;, &quot;chown -R 1000:1000 /usr/share/elasticsearch/data&quot;]
        securityContext:
          privileged: true
        volumeMounts:
        - name: data
          mountPath: /usr/share/elasticsearch/data
      - name: increase-vm-max-map
        image: busybox
        command: [&quot;sysctl&quot;, &quot;-w&quot;, &quot;vm.max_map_count=262144&quot;]
        securityContext:
          privileged: true
      - name: increase-fd-ulimit
        image: busybox
        command: [&quot;sh&quot;, &quot;-c&quot;, &quot;ulimit -n 65536&quot;]
        securityContext:
          privileged: true
  volumeClaimTemplates:
  - metadata:
      name: data
      labels:
        app: elasticsearch
    spec:
      accessModes: [ &quot;ReadWriteOnce&quot; ]
      resources:
        requests:
          storage: 3Gi
</code></pre>

Jens Voorpyl
<p>If I understand you correctly, you main goal is simply to edit the <code>/usr/share/elasticsearch/config/elasticsearch.yml</code> file and then have elastisearch start up as normal?</p>
<p>I that case a ConfigMap and a VolumeMount are your friend.</p>
<p>TL;DR: Create a ConfigMap with the <em>entire</em> contents that you want in <code>elasticsearch.yml</code> (i.e. not just the part you want to add) and mount that as a volume at <code>/usr/share/elasticsearch/config/elasticsearch.yml</code>. This will overwrite the file at startup.</p>
<p>As follows:</p>
<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
  name: my-configmap
  namespace: efk-stack
data:
  elasticsearch.yml: |-
    foo: bar
    baz: foo
    xpack.security.enabled: true    
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: es-cluster
  namespace: efk-stack
spec:
  serviceName: elasticsearch
  replicas: 3
  selector:
    matchLabels:
      app: elasticsearch
  template:
    metadata:
      labels:
        app: elasticsearch
    spec:

      ### added:
      volumes:
        - name: my-configmap
          configMap:
            name: my-configmap
      containers:
      - name: elasticsearch
        image: docker.elastic.co/elasticsearch/elasticsearch:7.17.10

        ## removed so that default startup command is used
        # command:
        #     - &quot;sh&quot;
        #     - &quot;-c&quot;
        #    - &quot;cat /usr/share/elasticsearch/config/elasticsearch.yml&quot;

        resources:
            limits:
              cpu: 1000m
            requests:
              cpu: 100m
        ports:
        - containerPort: 9200
          name: rest
          protocol: TCP
        - containerPort: 9300
          name: inter-node
          protocol: TCP
        volumeMounts:
        - name: data
          mountPath: /usr/share/elasticsearch/data

        ## added
        - name: my-configmap
          subPath: elasticsearch.yml 
          readOnly: true
          mountPath: /usr/share/elasticsearch/config/elasticsearch.yml
          
        env:
          - name: cluster.name
            value: k8s-logs
          - name: node.name
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          - name: discovery.seed_hosts
            value: &quot;es-cluster-0.elasticsearch,es-cluster-1.elasticsearch,es-cluster-2.elasticsearch&quot;
          - name: cluster.initial_master_nodes
            value: &quot;es-cluster-0,es-cluster-1,es-cluster-2&quot;
          - name: ES_JAVA_OPTS
            value: &quot;-Xms512m -Xmx512m&quot;
      initContainers:
      - name: fix-permissions
        image: busybox
        command: [&quot;sh&quot;, &quot;-c&quot;, &quot;chown -R 1000:1000 /usr/share/elasticsearch/data&quot;]
        securityContext:
          privileged: true
        volumeMounts:
        - name: data
          mountPath: /usr/share/elasticsearch/data
      - name: increase-vm-max-map
        image: busybox
        command: [&quot;sysctl&quot;, &quot;-w&quot;, &quot;vm.max_map_count=262144&quot;]
        securityContext:
          privileged: true
      - name: increase-fd-ulimit
        image: busybox
        command: [&quot;sh&quot;, &quot;-c&quot;, &quot;ulimit -n 65536&quot;]
        securityContext:
          privileged: true
  volumeClaimTemplates:
  - metadata:
      name: data
      labels:
        app: elasticsearch
    spec:
      accessModes: [ &quot;ReadWriteOnce&quot; ]
      resources:
        requests:
          storage: 3Gi
</code></pre>
