# Custom kibana settings in ECK **URL:** \ **Category:** Elastic Cloud on Kubernetes (ECK)\ **Created:** [October 2, 2019, 4:31pm UTC](https://discuss.elastic.co/t/custom-kibana-settings-in-eck/202006 "2019-10-02T16:31:26Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Mike\_Eklund](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mike_eklund/32/45030_2.png) [@Mike\_Eklund](https://discuss.elastic.co/u/Mike_Eklund)\ **Post date:** [October 2, 2019, 4:31pm UTC](https://discuss.elastic.co/t/custom-kibana-settings-in-eck/202006/1 "2019-10-02T16:31:26Z")
It appears that you have to do manual configuration of ES if you want to change items in the kibana.yml such as elasticsearch.requestHeadersWhitelist? is this correct and we cant use elasticsearchRef to do all the username and cert stuff for us? ---
**Author:** ![pebrc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pebrc/32/101790_2.png) [@pebrc](https://discuss.elastic.co/u/pebrc)\ **Post date:** [October 2, 2019, 7:57pm UTC](https://discuss.elastic.co/t/custom-kibana-settings-in-eck/202006/2 "2019-10-02T19:57:17Z")
Yes, you can combine both. We merge the settings you specify in the `config` section with the settings we derive from the `elasticsearchRef` ```auto apiVersion: kibana.k8s.elastic.co/v1alpha1 kind: Kibana metadata: name: kibana-sample spec: version: 7.4.0 nodeCount: 1 config: elasticsearch.requestHeadersWhitelist: - authorization # or whatever you want here elasticsearchRef: name: "elasticsearch-sample" ``` In this example ECK takes care of the username, password, Elasticsearch URL and certificate authority setup but you can set a custom request header whitelist. ---
**Author:** ![Mike\_Eklund](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mike_eklund/32/45030_2.png) [@Mike\_Eklund](https://discuss.elastic.co/u/Mike_Eklund)\ **Post date:** [October 2, 2019, 10:06pm UTC](https://discuss.elastic.co/t/custom-kibana-settings-in-eck/202006/3 "2019-10-02T22:06:34Z")
missed that it was config: and not elasticsearch: Thanks!! ---
**Author:** ![SamuelBramm](https://avatars.discourse-cdn.com/v4/letter/s/5e9695/32.png) [@SamuelBramm](https://discuss.elastic.co/u/SamuelBramm)\ **Post date:** [February 5, 2020, 10:58am UTC](https://discuss.elastic.co/t/custom-kibana-settings-in-eck/202006/4 "2020-02-05T10:58:37Z")
Hi, I'm having a similar problem. I followed the guideline and created some custom configurations, but unfortunately they are not merged. ``` apiVersion: kibana.k8s.elastic.co/v1 kind: Kibana metadata: name: kibana namespace: default labels: k8s-app: kibana spec: version: 7.5.2 count: 1 config: xpack.security.enabled: - true xpack.security.audit.enabled: - true elasticsearch.username: - elastic elasticsearch.ssl.certificateAuthorities: - /etc/certs/ca.crt xpack.monitoring.kibana.collection.enabled: - false xpack.monitoring.ui.container.elasticsearch.enabled: false elasticsearchRef: name: "***" ... ``` When I have a look at the created config via kubectl I get different values: ``` [user@host]$ kubectl exec -it kibana -- cat config/kibana.yml elasticsearch: hosts: - https://***:9200 password: *** ssl: certificateAuthorities: /etc/certs/ca.crt verificationMode: certificate username: elastic server: host: "0" name: kibana ssl: certificate: /mnt/elastic-internal/http-certs/tls.crt enabled: true key: /mnt/elastic-internal/http-certs/tls.key xpack: monitoring: ui: container: elasticsearch: enabled: true security: audit: enabled: true enabled: true ``` Is this a known problem or did I do something wrong in my configuration file? Greetings, Samuel ---
**Author:** ![pebrc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pebrc/32/101790_2.png) [@pebrc](https://discuss.elastic.co/u/pebrc)\ **Post date:** [February 5, 2020, 12:59pm UTC](https://discuss.elastic.co/t/custom-kibana-settings-in-eck/202006/5 "2020-02-05T12:59:11Z")
> [@SamuelBramm](#): > > ```auto > xpack.security.enabled: > - true > xpack.security.audit.enabled: > - true > elasticsearch.username: > - elastic > > ``` Probably unrelated but these settings values should not be arrays, but single values. For example: ```auto xpack.security.audit.enabled: true ``` As to why the values are not propagated correctly into the pod: First, just to double check are we looking at the correct pod? > [@SamuelBramm](#): > > kubectl exec -it kibana -- cat config/kibana.yml because I would expect the pod to be named something like `kibana-kb-SOME_HASH` If it is the correct pod, we could double check if the reconciliation actually went through and updated the configuration. For that it would be worth checking the operator logs as described here: > **[Troubleshoot ECK | Elastic Cloud on Kubernetes \[2.10\] | Elastic](https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-troubleshooting.html#k8s-get-eck-logs)** ---
**Author:** ![SamuelBramm](https://avatars.discourse-cdn.com/v4/letter/s/5e9695/32.png) [@SamuelBramm](https://discuss.elastic.co/u/SamuelBramm)\ **Post date:** [February 5, 2020, 1:43pm UTC](https://discuss.elastic.co/t/custom-kibana-settings-in-eck/202006/6 "2020-02-05T13:43:47Z")
Hi Peter, Thanks for getting back to me. Yes the podname is corrent (I sanatized the -kb-SOME\_HASH) to make it more readable. I also tried setting the values to single values as you suggested but there is no change in the behavior. ``` config: xpack.security.enabled: true xpack.security.audit.enabled: true elasticsearch.username: elastic elasticsearch.ssl.certificateAuthorities: - /etc/certs/ca.crt xpack.monitoring.kibana.collection.enabled: false xpack.monitoring.ui.container.elasticsearch.enabled: false ``` Below you can find the operator logs (only errors) which show up when recreating the kibana instance. After this the error messages just keep repeating themselves. There might be a rather obvious reason("User-configured use is unsupported") , why I can not set the parameters. If this is the case, how am I supposed to set other values? ``` {"level":"error","@timestamp":"2020-02-05T13:34:26.968Z","logger":"controller runtime.controller","message":"Reconciler error","ver":"1.0.0-6881438d","controller":"kibana association-controller","request":"default/secmon-kibana","error":"Operation cannot be fulfilled on kibanas.kibana.k8s.elastic.co \"secmon-kibana\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/go-logr/zapr.(*zapLogger).Error\n\t/go/pkg/mod/github.com/go-logr/zapr@v0.1.0/zapr.go:128\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.4.0/pkg/internal/controller/controller.go:258\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.4.0/pkg/internal/controller/controller.go:232\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).worker\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.4.0/pkg/internal/controller/controller.go:211\nk8s.io/apimachinery/pkg/util/wait.JitterUntil.func1\n\t/go/pkg/mod/k8s.io apimachinery@v0.0.0-20191028221656-72ed19daf4bb/pkg/util/wait/wait.go:152\nk8s.io apimachinery/pkg/util/wait.JitterUntil\n\t/go/pkg/mod/k8s.io/apimachinery@v0.0.0-20191028221656-72ed19daf4bb/pkg/util/wait/wait.go:153\nk8s.io/apimachinery/pkg/util/wait.Until\n\t/go/pkg/mod/k8s.io/apimachinery@v0.0.0-20191028221656-72ed19daf4bb/pkg/util/wait/wait.go:88"} {"level":"info","@timestamp":"2020-02-05T13:34:28.054Z","logger":"elasticsearch-controller","message":"Elasticsearch manifest has warnings. Proceed at your own risk. [spec.nodeSets[0].config.xpack.security.enabled: Forbidden: Configuration setting is reserved for internal use. User-configured use is unsupported, spec.nodeSets[0].config.xpack.security.http.ssl.enabled: Forbidden: Configuration setting is reserved for internal use. User-configured use is unsupported, spec.nodeSets[0].config.xpack.security.transport.ssl.enabled: Forbidden: Configuration setting is reserved for internal use. User-configured use is unsupported, spec.nodeSets[0].config.xpack.security.transport.ssl.verification_mode: Forbidden: Configuration setting is reserved for internal use. User-configured use is unsupported, spec.nodeSets[1].config.xpack.security.enabled: Forbidden: Configuration setting is reserved for internal use. User-configured use is unsupported, spec.nodeSets[1].config.xpack.security.http.ssl.enabled: Forbidden: Configuration setting is reserved for internal use. User-configured use is unsupported, spec.nodeSets[1].config.xpack.security.transport.ssl.enabled: Forbidden: Configuration setting is reserved for internal use. User-configured use is unsupported, spec.nodeSets[1].config.xpack.security.transport.ssl.verification_mode: Forbidden: Configuration setting is reserved for internal use. User-configured use is unsupported]","ver":"1.0.0-6881438d","namespace":"default","es_name":"secmon"} {"level":"error","@timestamp":"2020-02-05T13:34:29.999Z","logger":"controller-runtime.controller","message":"Reconciler error","ver":"1.0.0-6881438d","controller":"kibana-controller","request":"default/secmon-kibana","error":"Deployment.apps \"secmon-kibana-kb\" is invalid: spec.template.spec.containers[0].image: Required value","errorCauses":[{"error":"Deployment.apps \"secmon-kibana-kb\" is invalid: spec.template.spec.containers[0].image: Required value"}],"stacktrace":"github.com/go-logr/zapr.(*zapLogger).Error\n\t/go/pkg/mod/github.com/go-logr/zapr@v0.1.0/zapr.go:128\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.4.0/pkg/internal/controller/controller.go:258\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.4.0/pkg/internal/controller/controller.go:232\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).worker\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.4.0/pkg/internal/controller/controller.go:211\nk8s.io/apimachinery/pkg/util/wait.JitterUntil.func1\n\t/go/pkg/mod/k8s.io/apimachinery@v0.0.0-20191028221656-72ed19daf4bb/pkg/util/wait/wait.go:152\nk8s.io/apimachinery/pkg/util/wait.JitterUntil\n\t/go/pkg/mod/k8s.io/apimachinery@v0.0.0-20191028221656-72ed19daf4bb/pkg/util/wait/wait.go:153\nk8s.io/apimachinery/pkg/util/wait.Until\n\t/go/pkg/mod/k8s.io/apimachinery@v0.0.0-20191028221656-72ed19daf4bb/pkg/util/wait/wait.go:88"} ``` Greetings Samuel ---
**Author:** ![pebrc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pebrc/32/101790_2.png) [@pebrc](https://discuss.elastic.co/u/pebrc)\ **Post date:** [February 5, 2020, 2:09pm UTC](https://discuss.elastic.co/t/custom-kibana-settings-in-eck/202006/7 "2020-02-05T14:09:15Z")
> [@SamuelBramm](#): > > There might be a rather obvious reason("User-configured use is unsupported") , why I can not set the parameters. If this is the case, how am I supposed to set other values? These are just warnings and are referring to your Elasticsearch configuration, where you are apparently overriding values that we consider managed by ECK itself (see [Settings managed by ECK | Elastic Cloud on Kubernetes [2.10] | Elastic](https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-reserved-settings.html)) If you want to set your own settings in the `config` section you can just do that, no need to include all the settings internally managed by ECK. ECK will merge your settings with the settings it generates internally, where your settings take precedence over anything set by ECK. As to why you Kibana configuration does not line up with what you have in your manifest: > [@SamuelBramm](#): > > {"level":"error","@timestamp":"2020-02-05T13:34:29.999Z","logger":"controller-runtime.controller","message":"Reconciler error","ver":"1.0.0-6881438d","controller":"kibana-controller","request":"default/secmon-kibana","error":"Deployment.apps "secmon-kibana-kb" is invalid: spec.template.spec.containers[0].image: Required value","errorCauses":[{"error":"Deployment.apps "secmon-kibana-kb" is invalid: spec.template.spec.containers[0].image: Required value"}],"stacktrace":"[github.com/go-logr/zapr.(\*zapLogger).Error](http://github.com/go-logr/zapr.(*zapLogger).Error)\n\t/go/pkg/mod/github.com/go-logr/zapr@v0.1.0/zapr.go:128\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(\*Controller).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.4.0/pkg/internal/controller/controller.go:258\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(\*Controller).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.4.0/pkg/internal/controller/controller.go:232\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(\*Controller).worker\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.4.0/pkg/internal/controller/controller.go:211\nk8s.io/apimachinery/pkg/util/wait.JitterUntil.func1\n\t/go/pkg/mod/k8s.io/apimachinery@v0.0.0-20191028221656-72ed19daf4bb/pkg/util/wait/wait.go:152\nk8s.io/apimachinery/pkg/util/wait.JitterUntil\n\t/go/pkg/mod/k8s.io/apimachinery@v0.0.0-20191028221656-72ed19daf4bb/pkg/util/wait/wait.go:153\nk8s.io/apimachinery/pkg/util/wait.Until\n\t/go/pkg/mod/k8s.io/apimachinery@v0.0.0-20191028221656-72ed19daf4bb/pkg/util/wait/wait.go:88"} This seems relevant as it indicates that ECK was not able to update your Kibana deployment. So you are still seeing an old version of the deployment. Are you by any chance setting an empty Docker `image` or overriding the `podTemplate` for the Kibana deployment, in any way? ---
**Author:** ![SamuelBramm](https://avatars.discourse-cdn.com/v4/letter/s/5e9695/32.png) [@SamuelBramm](https://discuss.elastic.co/u/SamuelBramm)\ **Post date:** [February 5, 2020, 2:40pm UTC](https://discuss.elastic.co/t/custom-kibana-settings-in-eck/202006/8 "2020-02-05T14:40:24Z")
> [@pebrc](#): > > This seems relevant as it indicates that ECK was not able to update your Kibana deployment. So you are still seeing an old version of the deployment. Are you by any chance setting an empty Docker `image` or overriding the `podTemplate` for the Kibana deployment, in any way? That might have been the problem. I destroyed every manually and now it seems to work fine. Thanks for helping out. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 4, 2022, 7:27am UTC](https://discuss.elastic.co/t/custom-kibana-settings-in-eck/202006/9 "2022-11-04T07:27:46Z")