apmserver.yml

apiVersion: apm.k8s.elastic.co/v1
kind: ApmServer
metadata:
  name: MyAPMServer
  labels:
    app: apmserver
    component: eck
spec:
  version: 8.11.3
  count: 3
  secureSettings:
    - secretName: <name>-es-elastic-user
  config:
    output:
      elasticsearch:
        hosts: ["https://<name>-es-internal-http.default:9200"]
        username: elastic
        password: "${elastic}"
        protocol: "https"
        ssl.certificate_authorities:
          ["/usr/share/apm-server/config/elasticsearch-ca/tls.crt"]
  podTemplate:
    spec:
      containers:
        - name: apm-server
          env:
            - name: apm-server.ssl.enabled
              value: "true"
            - name: apm-server.ssl.certificate
              value: "/usr/share/apm-server/config/tls.crt"
            - name: apm-server.ssl.key
              value: "/usr/share/apm-server/config/tls.key"
          volumeMounts:
            - name: elasticsearch-ca
              mountPath: /usr/share/apm-server/config/elasticsearch-ca
              readOnly: true
            - name: tls-crt
              mountPath: /usr/share/apm-server/config/tls.crt
              subPath: tls.crt
              readOnly: true
            - name: tls-key
              mountPath: /usr/share/apm-server/config/tls.key
              subPath: tls.key
              readOnly: true
      volumes:
        - name: elasticsearch-ca
          secret:
            secretName: elasticsearch-eck-ca # This is the secret that holds the Elasticsearch CA cert
            defaultMode: 420
            optional: false
        - name: tls-crt
          secret:
            defaultMode: 420
            optional: false
            secretName: apm-internal-cert # This is the secret that holds the Elasticsearch CA cert
            items:
              - key: tls.crt
                path: tls.crt
        - name: tls-key
          secret:
            defaultMode: 420
            optional: false
            secretName: apm-internal-cert # This is the secret that holds the Elasticsearch CA cert
            items:
              - key: tls.key
                path: tls.key