feat(elastic-operator): add ESO support via common chart

- Add common iits chart dependency, opt-in via common.externalSecret.enabled
- Bump curl image used by backup job 8.12.1 → 8.13.0
- Add helm-unittest coverage
- add values.schema.json
- add ESO external-secret mode for elastic users and backup
- rewrite changelog to "Keep a changelog" format.

---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Alexander Hoeft <alexander.hoeft@iits-consulting.de>

Author: 3 people

charts/common/.helmignore

@@ -1,44 +1,84 @@
 # Changelog
 
-## Chart Versions
+All notable changes to this chart will be documented in this file.
 
-### 9.3.7
-- Changed elastic stack (appVersion) to version 9.3.7
+## [9.4.0] - 2026-08-19
+
+### Added
+- ESO mode via the IITS `common` chart: setting `common.externalSecret.enabled=true` replaces the bash `generate-passwords` Job and the static basic-auth Secrets with a single ExternalSecrets `Password` generator plus a per-user push/pull round-trip against a configurable secret store (Vault). Disabled by default, so existing installs are unaffected.
+- Dependency on the IITS `common` chart `0.4.0`.
+- `common.externalSecret.secretStore` to point all ESO resources at a `ClusterSecretStore`/`SecretStore` (defaults to `kind: ClusterSecretStore`, `name: vault`).
+- Per-user Vault mapping through `auth.users.<user>.path` and optional `auth.users.<user>.property` (pack multiple users into one Vault secret).
+- `generatePasswords.spec` to configure the password generation policy (`length`, `digits`, `symbols`, `noUpper`, `allowRepeat`); `length` also feeds the bash job default.
+- `generatePasswords.refreshInterval` to control how often the per-user push/pull secrets reconcile in ESO mode.
+- ESO support for backup secure settings via `backup.path`: secure settings are pulled from Vault instead of being inlined.
+- `values.schema.json` for values validation, plus template-side `validation.yaml` guarding ESO configuration.
+- Helm unit tests covering elasticsearch, elasticsearch-users, external-secrets, generate-passwords, backup secure-settings, and validation.
+- `MIGRATION.md` section documenting how to migrate an existing install to ESO mode (pre-seeding Vault, preconditions, verification, and rollback).
+
+### Changed
+- The Filebeat/Kibana `checksum/users` annotation that triggers a rollout on user-credential changes now adapts to the mode. In non-ESO mode it keeps the previous behavior (hashes the rendered Kubernetes user Secret). In ESO mode there is no Helm-generated Secret, so it hashes the `auth.users` values instead.
+- Moved OTC volume helpers into `_helpers.tpl`.
+
+> **Note:** In ESO mode the `checksum/users` annotation is derived from chart values, not from the live secret content. Because passwords round-trip through Vault, changing a password directly in Vault will **not** roll Filebeat/Kibana. The pods keep using the previously injected value until they are restarted by another means (e.g. a chart value change or a manual rollout).
+
+### [9.3.7] - 2026-08-11
+
+### Changed
+- elastic stack (appVersion) to version 9.3.7
 - Update serverTransport ingress CR to new version
 
-### 9.3.5
-- Changed operator version to 3.4.0
-- Changed elastic stack (appVersion) to version 9.3.5
+## [9.3.5] - 2026-06-23
+
+### Changed
+- Updated the ECK operator (`eck-operator`) to `3.4.0`.
+- Updated the Elastic stack (`appVersion`) to `9.3.5`.
+
+## [9.3.3] - 2026-05-04
+
+### Changed
+- Updated the ECK operator (`eck-operator`) to `3.3.2`.
+- Updated the Elastic stack (`appVersion`) to `9.3.3`.
 
-### 9.3.3
-- Changed operator version to 3.3.2
-- Changed elastic stack (appVersion) to version 9.3.3
+## [9.0.5-bitnamilegacy] - 2025-10-13
 
-### 9.0.5-bitnamilegacy
+### Changed
+- Switched the Bitnami image used by the password-generation job to `docker.io/bitnamilegacy/kubectl` (temporary solution to keep the chart functional; migrate to another image in a later release).
 
-- Changed Bitnami image for password generation job to `docker.io/bitnamilegacy/kubectl` (temporary solution to keep chart functional, migrate to other image in a later release)
+## [9.0.1] - 2025-05-28
 
-### BREAKING CHANGE 9.0.1
+### Changed
+- [BREAKING] Updated the Elastic stack (`appVersion`) to `9.0.1`.
 
-- app version update to 9.0.1
+> **Important:** The upgrade to `9.x` requires a specific upgrade path (the latest upgrade path can be found [here](https://www.elastic.co/docs/deploy-manage/upgrade/prepare-to-upgrade#prepare-upgrade-from-8.x)). Before installing `9.0.0`, you must first update to `8.18.1`, otherwise the upgrade will fail. Use version `8.18.1-fb-migr-filestream` from our stack for an easy upgrade.
 
-> Important: The upgrade to version 9.x requires a specific upgrade path (the latest upgrade path can be found [here](https://www.elastic.co/docs/deploy-manage/upgrade/prepare-to-upgrade#prepare-upgrade-from-8.x)). Before installing version 9.0.0, a version update to 8.18.1 must be made, otherwise the upgrade will fail. Use version "8.18.1-fb-migr-filestream" from our stack for easy upgrading.
+## [8.18.1-fb-migr-filestream] - 2025-05-28
 
-### 8.18.1-fb-migr-filestream
+### Added
+- Added the Filebeat `filestream` input and set the `take_over` tag as part of the migration from the deprecated `container` input.
 
-> Important: In preparation for the upgrade to version 9.0.0, this update must be installed as part of the upgrade path. Otherwise Filebeat will not be functional after upgrading to v9.0.0.
+### Changed
+- The `container` input for Filebeat was deprecated in `7.16` and is fully disabled in `9.0.0` (see [elastic/beats#42295](https://github.com/elastic/beats/pull/42295)). Following the official [migration guide](https://www.elastic.co/docs/reference/beats/filebeat/migrate-to-filestream), the `take_over` tag lets Filebeat separate logs created by the `container` input from the `filestream` input, avoiding errors and duplicated data. In `9.0.0` the `take_over` tag will be removed to complete the migration.
 
-The `container` input for Filebeat was deprecated in version `7.16` and is completely disabled by version `9.0.0` (see [#42295](https://github.com/elastic/beats/pull/42295)).
-Following the official [migration guide](https://www.elastic.co/docs/reference/beats/filebeat/migrate-to-filestream), in preparation for the migration from `container` input to `filestream`, a specific tag `take_over` must be set, so Filebeat can separate logs created by the container input from the filestream input. Otherwise an error is thrown and data may be duplicated.
+> **Important:** In preparation for the upgrade to `9.0.0`, this update must be installed as part of the upgrade path. Otherwise Filebeat will not be functional after upgrading to `9.0.0`.
 
-- this Helm chart version adds the `filestream` input and sets the `take_over` tag as part of the migration
-- in version `9.0.0` the `take_over` tag will be removed to complete the migration
+## [8.18.1-fb-tolerations] - 2025-05-14
 
-### 8.18.1-fb-tolerations
+### Fixed
+- Fixed a bug that caused tolerations rendering to fail for Filebeat.
 
-- fixed a bug in the Helm chart that caused tolerations rendering to fail for Filebeat
+## [8.18.1] - 2025-05-07
 
-### 8.18.1
+### Changed
+- Updated the Elastic stack (`appVersion`) to `8.18.1`.
+- Updated the Elastic operator to `3.0.0` in preparation for the `appVersion` upgrade to `9.0.0`.
 
-- app version update to 8.18.1
-- elastic operator update to 3.0.0 in preparation for app version upgrade to 9.0.0
+[9.4.0]: https://github.com/iits-consulting/charts/compare/elastic-operator-9.3.7...elastic-operator-9.4.0
+[9.3.7]: https://github.com/iits-consulting/charts/compare/elastic-operator-9.3.5...elastic-operator-9.3.7
+[9.3.5]: https://github.com/iits-consulting/charts/compare/elastic-operator-9.3.3...elastic-operator-9.3.5
+[9.3.3]: https://github.com/iits-consulting/charts/compare/elastic-operator-9.0.5-bitnamilegacy...elastic-operator-9.3.3
+[9.0.5-bitnamilegacy]: https://github.com/iits-consulting/charts/compare/elastic-operator-9.0.1...elastic-operator-9.0.5-bitnamilegacy
+[9.0.1]: https://github.com/iits-consulting/charts/compare/elastic-operator-8.18.1-fb-migr-filestream...elastic-operator-9.0.1
+[8.18.1-fb-migr-filestream]: https://github.com/iits-consulting/charts/compare/elastic-operator-8.18.1-fb-tolerations...elastic-operator-8.18.1-fb-migr-filestream
+[8.18.1-fb-tolerations]: https://github.com/iits-consulting/charts/compare/elastic-operator-8.18.1...elastic-operator-8.18.1-fb-tolerations
+[8.18.1]: https://github.com/iits-consulting/charts/releases/tag/elastic-operator-8.18.1

charts/elastic-operator/.trivyignore

@@ -2,5 +2,8 @@ dependencies:
 - name: eck-operator
   repository: https://helm.elastic.co
   version: 3.4.0
-digest: sha256:b4787630154471f65ceeb12f65fa24616eab9470e61e089b8e656e42f05f74f1
-generated: "2026-06-15T15:20:27.865783+02:00"
+- name: common
+  repository: https://charts.iits.tech
+  version: 0.4.0
+digest: sha256:fd1b8c5dfa8ced4da0918e1d484db7f18efa2273ffb0b0caa8b60f71ba750243
+generated: "2026-06-23T13:59:30.065706+02:00"

charts/elastic-operator/Changelog.md

@@ -1,11 +1,14 @@
 apiVersion: v2
 name: elastic-operator
-version: 9.3.7
-appVersion: 9.3.7
+version: 9.4.0
+appVersion: 9.4.0
 dependencies:
   - name: eck-operator
     repository: https://helm.elastic.co
     version: 3.4.0
+  - name: common
+    repository: "https://charts.iits.tech"
+    version: 0.4.0
 description: |
   Elasticsearch + filebeat + kibana with default common used indexes and Index Lifecycle Management.
   It comes also with a backup functionality. This is the version using ECK-operator to deploy and monitor the stack.

charts/elastic-operator/Chart.lock

@@ -62,4 +62,4 @@ Generally updates should just work in-place. But:
   * **Template:** `elasticsearch-data-{{ $.Release.Name }}-es-default-{{ $i }}`
   * `elasticsearch-data-elastic-operator-es-default-0` (using default values)
   * `elasticsearch-data-elastic-operator-es-default-1` (using default values)
-  
+  

charts/elastic-operator/Chart.yaml

@@ -1,6 +1,6 @@
 # elastic-operator
 
-![Version: 9.3.7](https://img.shields.io/badge/Version-9.3.7-informational?style=flat-square) ![AppVersion: 9.3.7](https://img.shields.io/badge/AppVersion-9.3.7-informational?style=flat-square)
+![Version: 9.4.0](https://img.shields.io/badge/Version-9.4.0-informational?style=flat-square) ![AppVersion: 9.4.0](https://img.shields.io/badge/AppVersion-9.4.0-informational?style=flat-square)
 
 Elasticsearch + filebeat + kibana with default common used indexes and Index Lifecycle Management.
 It comes also with a backup functionality. This is the version using ECK-operator to deploy and monitor the stack.
@@ -9,6 +9,7 @@ It comes also with a backup functionality. This is the version using ECK-operato
 
 | Repository | Name | Version |
 |------------|------|---------|
+| https://charts.iits.tech | common | 0.4.0 |
 | https://helm.elastic.co | eck-operator | 3.4.0 |
 
 ## Values
@@ -34,11 +35,11 @@ It comes also with a backup functionality. This is the version using ECK-operato
 | auth.roles.custom_filebeat.indices[0].privileges[3] | string | `"view_index_metadata"` |  |
 | auth.roles.custom_filebeat.indices[0].privileges[4] | string | `"manage_follow_index"` |  |
 | auth.users.custom_elastalert.existingPassword | string | `""` |  |
-| auth.users.custom_elastalert.roles[0] | string | `"custom_elastalert"` |  |
+| auth.users.custom_elastalert.roles | list | `["custom_elastalert"]` | Required, if common.externalSecret.enabled. path: "REPLACE_ME" |
 | auth.users.custom_filebeat.existingPassword | string | `""` |  |
-| auth.users.custom_filebeat.roles[0] | string | `"custom_filebeat"` |  |
+| auth.users.custom_filebeat.roles | list | `["custom_filebeat"]` | field within the vault secret to read/write (default "password"). Override to pack several users into one vault secret distinguished by property. property: "filebeat_password" |
 | auth.users.custom_kibana_guest.existingPassword | string | `""` |  |
-| auth.users.custom_kibana_guest.roles[0] | string | `"viewer"` |  |
+| auth.users.custom_kibana_guest.roles | list | `["viewer"]` | Required, if common.externalSecret.enabled. path: "REPLACE_ME" |
 | backup.enabled | bool | `false` |  |
 | backup.image.repository | string | `"docker.io/curlimages/curl"` |  |
 | backup.image.tag | string | `"8.13.0"` |  |
@@ -53,8 +54,10 @@ It comes also with a backup functionality. This is the version using ECK-operato
 | backup.repoName | string | `"elastic-backups"` |  |
 | backup.repoType | string | `"s3"` | for Azure blob storage use "azure" |
 | backup.repositorySettings | string | `nil` |  |
-| backup.secureSettings | string | `nil` |  |
+| backup.secureSettings | string | `nil` | vault path for the secure settings, used only in ESO mode (common.externalSecret.enabled). The settings below are then pulled from this path instead of being inlined. path: "REPLACE_ME" In ESO mode (common.externalSecret.enabled) the value of each setting is the vault property to read (remoteKey), not the literal secret — leave empty to default the property to the setting name. |
 | backup.tolerations | list | `[]` |  |
+| common.externalSecret.enabled | bool | `false` | Enable ESO mode. When true, the bash generate-passwords job and the static basic-auth Secrets are replaced by a single Password generator plus a per-user push/pull round-trip against the secretStore below. Per-user vault paths come from auth.users.<user>.path. |
+| common.externalSecret.secretStore | object | `{"kind":"ClusterSecretStore","name":"vault"}` | Sets the Store for all externalSecret resources from common chart |
 | eck-operator.securityContext.seccompProfile.type | string | `"RuntimeDefault"` |  |
 | elasticsearch.config.cluster.max_shards_per_node | int | `30000` |  |
 | elasticsearch.config.http.max_header_size | string | `"16kb"` |  |
@@ -149,17 +152,20 @@ It comes also with a backup functionality. This is the version using ECK-operato
 | filebeat.volumes[1].hostPath.path | string | `"/var/log"` |  |
 | filebeat.volumes[1].hostPath.type | string | `""` |  |
 | filebeat.volumes[1].name | string | `"varlog"` |  |
-| generatePasswords.enabled | bool | `true` |  |
+| generatePasswords.deletionPolicy | string | `"Delete"` | ESO mode only: defines if secrets pushed to the secretStore are deleted or kept in the provider after the ESO pushSecret is deleted. |
+| generatePasswords.enabled | bool | `true` | Generate user passwords. In non-ESO mode this toggles the bash generate-passwords job. In ESO mode (common.externalSecret.enabled) it toggles the Password generator + push: true generates and round-trips through vault; false is BYO (pull-only, passwords pre-seeded in vault). |
 | generatePasswords.image.repository | string | `"docker.io/bitnamilegacy/kubectl"` |  |
 | generatePasswords.image.tag | string | `"1.32.4"` |  |
 | generatePasswords.image.userId | int | `100` |  |
 | generatePasswords.nodeSelector | object | `{}` |  |
+| generatePasswords.refreshInterval | string | `"1h"` | ESO mode only: how often the per-user push/pull secrets reconcile. Leave empty to use the common chart's per-resource defaults (push "1h", pull "1m"). |
 | generatePasswords.secrets[0].key | string | `"password"` |  |
 | generatePasswords.secrets[0].name | string | `"{{ .Release.Name }}-user-custom-kibana-guest"` |  |
 | generatePasswords.secrets[1].key | string | `"password"` |  |
 | generatePasswords.secrets[1].name | string | `"{{ .Release.Name }}-user-custom-filebeat"` |  |
 | generatePasswords.secrets[2].key | string | `"password"` |  |
 | generatePasswords.secrets[2].name | string | `"{{ .Release.Name }}-user-custom-elastalert"` |  |
+| generatePasswords.spec | object | `{"allowRepeat":true,"digits":5,"length":32,"noUpper":false,"symbols":0}` | Password generation policy. In ESO mode (common.externalSecret.enabled) this maps directly to the shared ExternalSecrets Password generator spec; length also feeds the bash job default. |
 | generatePasswords.tolerations | list | `[]` |  |
 | ilm.image.repository | string | `"docker.io/curlimages/curl"` |  |
 | ilm.image.tag | string | `"8.13.0"` |  |

charts/elastic-operator/MIGRATION.md

@@ -1,3 +1,50 @@
+# Upgrade to Version 9.4.0
+## Migrating to ESO mode (chart `9.4.0+`)
+
+When `common.externalSecret.enabled: true`, vault becomes canonical for user passwords (and, when `backup.enabled`, for backup credentials). The bash `generate-passwords` Job and the Helm-rendered basic-auth Secrets are replaced by a single ExternalSecrets `Password` generator plus a per-user push/pull round-trip against the store in `common.externalSecret.secretStore`.
+
+### Preconditions
+
+* External Secrets Operator (ESO) is installed
+* A `ClusterSecretStore` (or `SecretStore`) for vault exists, referenced via `common.externalSecret.secretStore.{kind,name}`
+* Remove any `auth.users.<user>.existingPassword` values — they have no effect in ESO mode (vault is canonical) and the chart refuses to render while they are set.
+
+### User passwords
+
+Each user under `auth.users` is round-tripped through vault:
+
+* `auth.users.<user>.path` — vault secret path for that user (**required** in ESO mode).
+* `auth.users.<user>.property` — field within that vault secret (default `password`); override it to pack several users into one vault secret.
+* The Kubernetes Secret key stays `password` (the filebeat/kibana env refs depend on it).
+
+To preserve existing passwords across the flip, pre-seed vault first; otherwise the `Password` generator produces new values on first sync.
+
+1. For each user in `auth.users`, write the existing password to `auth.users.<user>.path` in vault, under the field from `auth.users.<user>.property` (or `password` if unset).
+2. Flip `common.externalSecret.enabled: true` and sync.
+
+With `generatePasswords.enabled: true`, the PushSecret uses `updatePolicy: IfNotExists`, so pre-seeded vault values survive (a rebuild never rotates them) and the ExternalSecret pulls them back into the K8s Secret. With `generatePasswords.enabled: false` the generator and push are skipped (pull-only / BYO), so passwords **must** be pre-seeded in vault by an external owner.
+
+With Argo's default `prune: true` + `selfHeal: true`, the old Helm-rendered Secret is pruned and ESO recreates it automatically — expect a small gap during reconciliation.
+
+### Backup credentials (when `backup.enabled`)
+
+Backup credentials are externally managed (e.g. Terraform), so backup is pull-only — there is no push/round-trip for it. In ESO mode:
+
+* `backup.path` — vault path the backup secure-settings secret is pulled from (**required** when `backup.secureSettings` is set).
+* `backup.secureSettings.<setting>` — the value is now the vault **property name** to read, not the literal secret; leave it empty to default the property to the setting name. The legacy `${vault:...}` webhook syntax is rejected.
+* `backup.repositorySettings.<key>` — these are not pulled from vault in ESO mode; replace any `${vault:...}` placeholders with the literal hardcoded value (the legacy webhook syntax is rejected).
+* `cce.elasticsearch.volumes[].{id,az,kmsId}` — a PersistentVolume cannot source values from a Secret, so set these as plain literals, not `${vault:...}` placeholders.
+
+### Verify post-upgrade
+
+* `kubectl get pushsecret,externalsecret -n <ns>` — all `Synced`
+* ECK-managed Elasticsearch reaches `Ready`
+* Downstream consumers (filebeat, falco, etc.) continue authenticating
+
+### Rolling back
+
+Set `common.externalSecret.enabled: false` and re-sync — chart reverts to the bash `generate-passwords` Job + Helm-rendered Secrets path. ESO CRs are pruned by Argo; the K8s Secrets they created stay until pruned or replaced by the Helm-rendered ones.
+
 # Upgrade to Version 9.3.7
 from 9.3.5
 

charts/elastic-operator/README.md

@@ -1,3 +1,12 @@
+{{- define "elasticOperator.elasticSearch.users.checksum" -}}
+{{- if .Values.common.externalSecret.enabled }}
+{{- .Values.auth.users | toYaml | sha256sum | substr 0 50 }}
+{{- else }}
+{{- include (print $.Template.BasePath "/eks-stack/elasticsearch-users.yaml") $ | sha256sum | substr 0 50 }}
+{{- end }}
+{{- end -}}
+
+{{/* Elasticsearch data volumeClaimTemplate for OTC/CCE everest-provisioned storage */}}
 {{- define "template.otcPVC" -}}
 metadata:
   name: elasticsearch-data # See: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-volume-claim-templates.html#k8s_specifying_the_volume_claim_settings