anchor.diff:  
   ==== elasticsearch
   
  -TIP: https://github.com/helm/charts/tree/master/stable/elasticsearch
  -
  -[source,bash]
  -----
  -# TBD 使用PVC
  -
  -helm install --name dew-elasticsearch stable/elasticsearch --namespace devops \
  -    --set image.tag="6.6.1" \
  -    --set cluster.name=dew-elasticsearch \
  -    --set client.ingress.enabled=true \
  -    --set client.ingress.user=elasticsearch \
  -    --set client.ingress.password=Dew\!123456 \
  -    --set client.ingress.hosts={es.dew.ms} \
  -    --set master.exposeHttp=true \
  -    --set master.persistence.enabled=true \
  -    --set master.persistence.size=200Gi \
  -    --set data.exposeHttp=true \
  -    --set data.persistence.enabled=true \
  -    --set data.persistence.size=200Gi
  -----
  +TIP: https://github.com/elastic/helm-charts/blob/master/elasticsearch 注意仔细查看各参数设值的说明。
  +
  +[source,bash]
  +----
  +
  +# 在NFS服务器上加上文件路径,并创建需要的目录
  +
  +vi /etc/exports
  +
  +/data/nfs/elasticsearch    *(rw,sync,no_root_squash,no_all_squash)
  +# 重启NFS
  +systemctl restart nfs-server
  +# 查看结果
  +showmount -e localhost
  +
  +# 创建PV，PV可以加上和helm安装时一致的label,以便和PVC绑定，例： app: dew-elasticsearch-client
  +app=dew-elasticsearch-client
  +size=100Gi
  +# 请根据replicas的个数来决定下面PV的创建个数
  +for i in {0..1}; do
  +cat <<EOF | kubectl -n devops apply -f -
  +apiVersion: v1
  +kind: PersistentVolume
  +metadata:
  +  labels:
  +    app: ${app}
  +  name: ${app}-${i}
  +spec:
  +  capacity:
  +    storage: ${size}
  +  accessModes:
  +    - ReadWriteOnce
  +  persistentVolumeReclaimPolicy: Recycle
  +  nfs:
  +    path: /data/nfs/elasticsearch/${app}-${i}
  +    server: 10.200.131.182
  +EOF
  +done
  +
  +# TIP：如果pod没有启动成功，报错和路径权限问题有关，可尝试给PV的存储路径添加权限,如：
  +chmod 777 /data/nfs/elasticsearch
  +
  +# 使用helm安装
  +helm repo add elastic https://helm.elastic.co
  +
  +helm install --name dew-elasticsearch elastic/elasticsearch --namespace devops \
  +    --set imageTag=6.6.1 \
  +    --set clusterName=dew-elasticsearch \
  +    --set nodeGroup=client \
  +    --set masterService=dew-elasticsearch-client \
  +    --set replicas=2 \
  +    --set minimumMasterNodes=2 \
  +    --set volumeClaimTemplate.storageClassName="" \
  +    --set volumeClaimTemplate.resources.requests.storage=200Gi \
  +    --set volumeClaimTemplate.selector.matchlabels."app"="dew-elasticsearch-client" \
  +    --set fsGroup=0 \
  +    --set clusterHealthCheckParams="" \
  +    --set ingress.enabled=true \
  +    --set ingress.hosts={elasticsearch.dew.ms}
  +
  +    # pod调度相关配置,请根据需要进行设值
  +    --set nodeSelector."tag"="devops" \
  +    --set tolerations[0].key="key" \
  +    --set tolerations[0].operator="Equal" \
  +    --set tolerations[0].value="value" \
  +    --set tolerations[0].effect="NoSchedule"
  +
  +    # 若使用xpack security,请加上以下参数
  +    --set-string extraEnvs[0]."name"="xpack\.security\.enabled" \
  +    --set-string extraEnvs[0]."value"="true" \
  +    --set-string extraEnvs[1]."name"="xpack\.security\.authc\.accept_default_password" \
  +    --set-string extraEnvs[1]."value"="true" \
  +    --set-string extraEnvs[2]."name"="ELASTIC_USERNAME" \
  +    --set-string extraEnvs[2]."value"="elastic" \
  +    --set-string extraEnvs[3]."name"="ELASTIC_PASSWORD" \
  +    --set-string extraEnvs[3]."value"="123456"
  +
  +    xpack安装相关文档说明：https://github.com/elastic/helm-charts/blob/master/elasticsearch/README.md#security
  +
  +    * 开启xpack security的简单例子：
  +      . 进入容器内部
  +        kubectl exec -it dew-elasticsearch-client-0 -n devops /bin/sh
  +      . 激活30天试用license
  +        curl -H "Content-Type:application/json" -XPOST  http://localhost:9200/_xpack/license/start_trial?acknowledge=true
  +      . 修改密码：
  +        bin/elasticsearch-setup-passwords interactive
  +      . 测试：
  +        curl -u elastic -XGET 'localhost:9200/_cat/health?v&pretty'
  +
  +----
  +
  +TIP: 其他elasticsearch的helm chart : https://github.com/helm/charts/tree/master/stable/elasticsearch
  +
  +==== fluentd
  +
  +TIP: https://github.com/kiwigrid/helm-charts/tree/master/charts/fluentd-elasticsearch +
  +     https://kiwigrid.github.io/
  +
  +[source,bash]
  +----
  +helm repo add kiwigrid https://kiwigrid.github.io
  +
  +# 不使用代理要加上  --set image.repository=registry.cn-hangzhou.aliyuncs.com/google_containers/fluentd-elasticsearch
  +helm install kiwigrid/fluentd-elasticsearch --name dew-fluentd-es --namespace devops \
  +    --set elasticsearch.host=dew-elasticsearch-client \
  +    --set elasticsearch.logstash_prefix=logstash \
  +    # 若 ES 启用 xpack 的 security，加上以下参数
  +    --set elasticsearch.user=elastic \
  +    --set elasticsearch.password=123456
  +    # Prometheus 相关设置(需配合prometheus-operator使用)
  +    --set service.type=ClusterIP \
  +    --set service.ports[0].name="monitor-agent" \
  +    --set service.ports[0].port=24231 \
  +    --set prometheusRule.enabled=true \
  +    --set prometheusRule.prometheusNamespace=devops \
  +    --set prometheusRule.labels.app=prometheus-operator \
  +    --set prometheusRule.labels.release=dew-prometheus-operator \
  +    --set serviceMonitor.enabled=true \
  +    --set serviceMonitor.labels.release=dew-prometheus-operator
  +    # 不使用代理要加上
  +    --set image.repository=registry.cn-hangzhou.aliyuncs.com/google_containers/fluentd-elasticsearch
  +
  +    # pod调度相关配置,请根据实际需要进行设值
  +    --set nodeSelector."tag"="devops" \
  +    --set tolerations[0].key="key" \
  +    --set tolerations[0].operator="Equal" \
  +    --set tolerations[0].value="value" \
  +    --set tolerations[0].effect="NoSchedule"
  +----
  +
   
   ==== kibana
   
  
positive.code:     | sed "s/namespace: observability/namespace: devops/g" \
      | kubectl create -f -
  
  cat <<EOF | kubectl apply -n devops -f -
  apiVersion: jaegertracing.io/v1
  kind: Jaeger
  metadata:
    name: jaeger
  spec:
    strategy: production
    storage:
      type: elasticsearch
      options:
        es:
          server-urls: http://dew-elasticsearch-client:9200
  EOF
  
  cat <<EOF | kubectl -n devops apply -f -
  apiVersion: extensions/v1beta1
  kind: Ingress
  metadata:
    annotations:
      kubernetes.io/ingress.class: nginx
    name: jaeger-prod-query
  spec:
    rules:
      - host: jaeger.dew.ms
  
negative.code: 
  [source,bash]
  ----
  
  # 在NFS服务器上加上文件路径,并创建需要的目录
  
  vi /etc/exports
  
  /data/nfs/kibana    *(rw,sync,no_root_squash,no_all_squash)
  # 重启NFS
  systemctl restart nfs-server
  # 查看结果
  showmount -e localhost
  
  使用PVC
  apps=("kibana")
  size=10Gi
  
  for i in ${apps[@]};do
  cat <<EOF | kubectl -n devops apply -f -
  apiVersion: v1
  kind: PersistentVolumeClaim
  metadata:
    labels:
      app: ${i}
    name: dew-${i}
  spec:
    accessModes:
      - ReadWriteOnce
    resources:
      requests:
        storage: ${size}
    selector:
      matchLabels:
        app: ${i}
  ---
  apiVersion: v1
  kind: PersistentVolume
  metadata:
    labels:
      app: ${i}
    name: dew-${i}
  spec:
    capacity:
      storage: ${size}
    accessModes:
      - ReadWriteOnce
    persistentVolumeReclaimPolicy: Recycle
    nfs:
      path: /data/nfs/${apps}
      server: 10.200.131.182
  EOF
  done
  
  helm install --name dew-kibana  stable/kibana  --namespace devops \
      --set image.tag="6.6.1" \
      --set env."ELASTICSEARCH_URL"="http://dew-elasticsearch-client:9200" \
      --set service.internalPort=5601 \
      --set ingress.enabled=true,ingress.hosts={kibana.dew.ms} \
      --set-string ingress.annotations."kubernetes\.io/ingress\.class"=nginx \
      --set-string ingress.annotations."kubernetes\.io/tls-acme"="true" \
      --set ingress.tls[0].hosts={kibana.dew.ms},ingress.tls[0].secretName=kibana-certs \
      --set dashboardImport.enabled=true \
      --set dashboardImport.dashboards."k8s"="https://raw.githubusercontent.com/monotek/kibana-dashboards/master/k8s-fluentd-elasticsearch.json" \
      --set serviceAccount.create=true,serviceAccountName=kibana \
      --set plugins.enabled=true \
      --set persistentVolumeClaim.enabled=true \
      --set persistentVolumeClaim.existingClaim=true \
      --set securityContext.enabled=true \
      --set securityContext.allowPrivilegeEscalation=true \
      --set securityContext.runAsUser=0 \
      --set securityContext.fsGroup=0
  
      # pod调度相关配置，请根据实际情况设值
      --set nodeSelector."tag"="devops" \
      --set tolerations[0].key="key" \
      --set tolerations[0].operator="Equal" \
      --set tolerations[0].value="value" \
      --set tolerations[0].effect="NoSchedule" \
      --set affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].key="key" \
      --set affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].operator=In \
      --set affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].values[0]=target-host-name \
  
      # xpack security相关参数：
      --set image.repository=docker.elastic.co/kibana/kibana \
      --set env."XPACK_SECURITY_ENABLED"="true" \
      --set env."ELASTICSEARCH_USERNAME"="kibana" \
      --set env."ELASTICSEARCH_PASSWORD"="dew123456" \
      --set dashboardImport.xpackauth.enabled=true \
      --set dashboardImport.xpackauth.username=kibana\
      --set dashboardImport.xpackauth.password=dew123456
  
  ----
  
  ==== jaeger
  