Advanced configuration

This section covers the following topics:

Use APM Agent central configuration ¶

APM Agent configuration management [7.5.1] allows you to configure your APM Agents centrally from the Kibana APM app. To use this feature, the APM Server needs to be configured with connection details of the Kibana instance. If Kibana is managed by ECK, you can simply add a kibanaRef attribute to the APM Server specification:

			cat <<EOF | kubectl apply -f -
apiVersion: apm.k8s.elastic.co/v1
kind: ApmServer
metadata:
  name: apm-server-quickstart
  namespace: default
spec:
  version: 8.16.1
  count: 1
  elasticsearchRef:
    name: quickstart
  kibanaRef:
    name: quickstart
EOF

Starting with version 8.0.0 you will also need to ensure that your Kibana instance has the following configuration:

			apiVersion: kibana.k8s.elastic.co/v1
kind: Kibana
config:
  xpack.fleet.packages:
  - name: apm
    version: latest

Customize the APM Server configuration ¶

To customize the configuration of the APM Server, use the config element in the specification:

			apiVersion: apm.k8s.elastic.co/v1
kind: ApmServer
metadata:
  name: apm-server-quickstart
  namespace: default
spec:
  version: 8.16.1
  count: 1
  config:
    output:
      elasticsearch:
        headers:
          X-My-Header: Just an example of a custom settings
  elasticsearchRef:
    name: quickstart

Note

The configuration items you provide always override the ones that are generated by the operator.

Specify secure settings for your APM Server ¶

The APM Server keystore can be used to store sensitive settings in the APM Server configuration. ECK can automatically manage the APM Server keystore in the Pods.

  1. Create a secret with the secret settings:
    			kubectl create secret generic apm-secret-settings --from-literal=ES_PASSWORD=asecretpassword
  2. In the spec.secureSettings section, add a reference to the secret you previously created.
    			apiVersion: apm.k8s.elastic.co/v1
kind: ApmServer
metadata:
  name: apm-server-quickstart
  namespace: default
spec:
  version: 8.16.1
  count: 1
  secureSettings:
  - secretName: apm-secret-settings
  config:
    output:
      elasticsearch:
        password: "${ES_PASSWORD}"
  3. Reference the key in the APM Server configuration, as described in the Secrets keystore for secure settings.

Reference an existing Elasticsearch cluster ¶

Now that you know how to use the APM keystore and customize the server configuration, you can manually configure a secured connection to an existing Elasticsearch cluster.

  1. Create a secret with the Elasticsearch CA. You need to store the certificate authority of the Elasticsearch cluster in a secret:
    			kubectl create secret generic es-ca --from-file=tls.crt=elasticsearch-ca.crt

    Note

    The elasticsearch-ca.crt file must contain the CA certificate of the Elasticsearch cluster you want to use with the APM Server.
  2. Mount this secret using the Pod template, and reference the file in the config of the APM Server. Here is a complete example with a password stored in the Keystore, as described in the previous section:
    			apiVersion: apm.k8s.elastic.co/v1
kind: ApmServer
metadata:
  name: apm-server-quickstart
  namespace: default
spec:
  version: 8.16.1
  count: 1
  secureSettings:
  - secretName: apm-secret-settings
  config:
    output:
      elasticsearch:
        hosts: ["my-own-elasticsearch-cluster:9200"]
        username: elastic
        password: "${ES_PASSWORD}"
        protocol: "https"
        ssl.certificate_authorities: ["/usr/share/apm-server/config/elasticsearch-ca/tls.crt"]
  podTemplate:
    spec:
      containers:
      - name: apm-server
        volumeMounts:
        - mountPath: /usr/share/apm-server/config/elasticsearch-ca
          name: elasticsearch-ca
          readOnly: true
      volumes:
      - name: elasticsearch-ca
        secret:
          defaultMode: 420
          optional: false
          secretName: es-ca 1
    1. This is the secret that holds the Elasticsearch CA cert

TLS certificates ¶

By default the operator manages a private CA and generates a self-signed certificate used to secure the communication between APM agents and the server.

This behavior and the relevant configuration is identical to what is done for Elasticsearch and Kibana. Check Setting up your own certificate for more information on how to use your own certificate to configure the TLS endpoint of the APM Server.

For more details on how to configure the APM agents to work with custom certificates, check the APM agents documentation.