From 9cb13ea9a9ae58825d9ea99f818e76b90957040b Mon Sep 17 00:00:00 2001 From: Bitnami Bot Date: Thu, 4 Jun 2026 22:45:00 +0200 Subject: [PATCH] [bitnami/elasticsearch] Release 9.4.1-debian-12-r6 (#94317) Signed-off-by: Bitnami Bot --- .../elasticsearch/9.4/debian-12/Dockerfile | 8 +- ...53.2-1-linux-amd64-debian-12.tar.gz.sha256 | 1 - ...53.2-1-linux-arm64-debian-12.tar.gz.sha256 | 1 - ...53.2-2-linux-amd64-debian-12.tar.gz.sha256 | 1 + ...53.2-2-linux-arm64-debian-12.tar.gz.sha256 | 1 + .../opt/bitnami/scripts/elasticsearch-env.sh | 2 + .../opt/bitnami/scripts/libelasticsearch.sh | 10 +- bitnami/elasticsearch/README.md | 123 +++++++++--------- 8 files changed, 79 insertions(+), 68 deletions(-) delete mode 100644 bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/yq-4.53.2-1-linux-amd64-debian-12.tar.gz.sha256 delete mode 100644 bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/yq-4.53.2-1-linux-arm64-debian-12.tar.gz.sha256 create mode 100644 bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/yq-4.53.2-2-linux-amd64-debian-12.tar.gz.sha256 create mode 100644 bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/yq-4.53.2-2-linux-arm64-debian-12.tar.gz.sha256 diff --git a/bitnami/elasticsearch/9.4/debian-12/Dockerfile b/bitnami/elasticsearch/9.4/debian-12/Dockerfile index 1451ae1f4aef..0cd64ee32dcd 100644 --- a/bitnami/elasticsearch/9.4/debian-12/Dockerfile +++ b/bitnami/elasticsearch/9.4/debian-12/Dockerfile @@ -9,7 +9,7 @@ ARG JAVA_EXTRA_SECURITY_DIR="/bitnami/java/extra-security" ARG TARGETARCH LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bookworm" \ - org.opencontainers.image.created="2026-05-27T16:43:15Z" \ + org.opencontainers.image.created="2026-06-04T19:53:51Z" \ org.opencontainers.image.description="Application packaged by Broadcom, Inc." \ org.opencontainers.image.documentation="https://github.com/bitnami/containers/tree/main/bitnami/elasticsearch/README.md" \ org.opencontainers.image.source="https://github.com/bitnami/containers/tree/main/bitnami/elasticsearch" \ @@ -31,7 +31,7 @@ RUN --mount=type=secret,id=downloads_url,env=SECRET_DOWNLOADS_URL \ DOWNLOADS_URL=${SECRET_DOWNLOADS_URL:-${DOWNLOADS_URL}} ; \ mkdir -p /tmp/bitnami/pkg/cache/ ; cd /tmp/bitnami/pkg/cache/ || exit 1 ; \ COMPONENTS=( \ - "yq-4.53.2-1-linux-${OS_ARCH}-debian-12" \ + "yq-4.53.2-2-linux-${OS_ARCH}-debian-12" \ "java-21.0.11-11-2-linux-${OS_ARCH}-debian-12" \ "elasticsearch-9.4.1-1-linux-${OS_ARCH}-debian-12" \ ) ; \ @@ -54,9 +54,9 @@ RUN /opt/bitnami/scripts/elasticsearch/postunpack.sh RUN /opt/bitnami/scripts/java/postunpack.sh ENV APP_VERSION="9.4.1" \ BITNAMI_APP_NAME="elasticsearch" \ - IMAGE_REVISION="5" \ + IMAGE_REVISION="6" \ JAVA_HOME="/opt/bitnami/java" \ - LD_LIBRARY_PATH="/opt/bitnami/elasticsearch/jdk/lib:/opt/bitnami/elasticsearch/jdk/lib/server:$LD_LIBRARY_PATH" + LD_LIBRARY_PATH="/opt/bitnami/elasticsearch/jdk/lib:/opt/bitnami/elasticsearch/jdk/lib/server" EXPOSE 9200 9300 diff --git a/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/yq-4.53.2-1-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/yq-4.53.2-1-linux-amd64-debian-12.tar.gz.sha256 deleted file mode 100644 index f2543765be33..000000000000 --- a/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/yq-4.53.2-1-linux-amd64-debian-12.tar.gz.sha256 +++ /dev/null @@ -1 +0,0 @@ -b7241b4121e1304b74a5e04db2d4e8d1db6aca71a65987d8c79836e5235cb927 yq-4.53.2-1-linux-amd64-debian-12.tar.gz diff --git a/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/yq-4.53.2-1-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/yq-4.53.2-1-linux-arm64-debian-12.tar.gz.sha256 deleted file mode 100644 index fe49d01f636f..000000000000 --- a/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/yq-4.53.2-1-linux-arm64-debian-12.tar.gz.sha256 +++ /dev/null @@ -1 +0,0 @@ -ba312982d2ba0a320c116b4db0e0ef2518813be9a948a29bc9c3e05951049da9 yq-4.53.2-1-linux-arm64-debian-12.tar.gz diff --git a/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/yq-4.53.2-2-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/yq-4.53.2-2-linux-amd64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..cea7cc8dd3e4 --- /dev/null +++ b/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/yq-4.53.2-2-linux-amd64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +50c03f2f9671fe23dcfac131f65db3f1dce7bb6b60d6b081735868079621ce5b yq-4.53.2-2-linux-amd64-debian-12.tar.gz diff --git a/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/yq-4.53.2-2-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/yq-4.53.2-2-linux-arm64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..0897c4064078 --- /dev/null +++ b/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/yq-4.53.2-2-linux-arm64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +3a0017dcc84cbb89bede3f7ec7b38e7b32fa9e8e93a3f074bd101e9f487255db yq-4.53.2-2-linux-arm64-debian-12.tar.gz diff --git a/bitnami/elasticsearch/9.4/debian-12/rootfs/opt/bitnami/scripts/elasticsearch-env.sh b/bitnami/elasticsearch/9.4/debian-12/rootfs/opt/bitnami/scripts/elasticsearch-env.sh index 6955b8fc28da..21fe6dd6ac97 100644 --- a/bitnami/elasticsearch/9.4/debian-12/rootfs/opt/bitnami/scripts/elasticsearch-env.sh +++ b/bitnami/elasticsearch/9.4/debian-12/rootfs/opt/bitnami/scripts/elasticsearch-env.sh @@ -80,6 +80,7 @@ elasticsearch_env_vars=( ELASTICSEARCH_HTTP_TLS_NODE_KEY_LOCATION ELASTICSEARCH_HTTP_TLS_CA_CERT_LOCATION ELASTICSEARCH_ENABLE_FIPS_MODE + ELASTICSEARCH_FIPS_REQUIRED_PROVIDERS ELASTICSEARCH_PASSWD_HASH_ALGORITHM ELASTICSEARCH_KEYS ES_JAVA_HOME @@ -255,6 +256,7 @@ export DB_HTTP_TLS_NODE_KEY_LOCATION="$ELASTICSEARCH_HTTP_TLS_NODE_KEY_LOCATION" export ELASTICSEARCH_HTTP_TLS_CA_CERT_LOCATION="${ELASTICSEARCH_HTTP_TLS_CA_CERT_LOCATION:-$DB_CA_CERT_LOCATION}" export DB_HTTP_TLS_CA_CERT_LOCATION="$ELASTICSEARCH_HTTP_TLS_CA_CERT_LOCATION" export ELASTICSEARCH_ENABLE_FIPS_MODE="${ELASTICSEARCH_ENABLE_FIPS_MODE:-false}" +export ELASTICSEARCH_FIPS_REQUIRED_PROVIDERS="${ELASTICSEARCH_FIPS_REQUIRED_PROVIDERS:-}" export ELASTICSEARCH_PASSWD_HASH_ALGORITHM="${ELASTICSEARCH_PASSWD_HASH_ALGORITHM:-}" export ELASTICSEARCH_KEYS="${ELASTICSEARCH_KEYS:-}" export JAVA_HOME="${BITNAMI_ROOT_DIR}/java" diff --git a/bitnami/elasticsearch/9.4/debian-12/rootfs/opt/bitnami/scripts/libelasticsearch.sh b/bitnami/elasticsearch/9.4/debian-12/rootfs/opt/bitnami/scripts/libelasticsearch.sh index ec9c0afcc3f7..3bf77eca900f 100644 --- a/bitnami/elasticsearch/9.4/debian-12/rootfs/opt/bitnami/scripts/libelasticsearch.sh +++ b/bitnami/elasticsearch/9.4/debian-12/rootfs/opt/bitnami/scripts/libelasticsearch.sh @@ -771,7 +771,15 @@ elasticsearch_initialize() { ! is_boolean_yes "$DB_SKIP_TRANSPORT_TLS" && elasticsearch_transport_tls_configuration if is_boolean_yes "$ELASTICSEARCH_ENABLE_FIPS_MODE"; then elasticsearch_conf_set xpack.security.fips_mode.enabled "true" - elasticsearch_conf_set xpack.security.authc.password_hashing.algorithm "${ELASTICSEARCH_PASSWD_HASH_ALGORITHM:-pbkdf2}" + # Disable autoconfiguration — required for FIPS compliance (new installs) + elasticsearch_conf_set xpack.security.autoconfiguration.enabled "false" + # pbkdf2_stretch is the recommended FIPS-compliant stored password hashing algorithm + elasticsearch_conf_set xpack.security.authc.password_hashing.algorithm "${ELASTICSEARCH_PASSWD_HASH_ALGORITHM:-pbkdf2_stretch}" + # Optionally enforce specific FIPS security providers (ES 8.13+) + if ! is_empty_value "${ELASTICSEARCH_FIPS_REQUIRED_PROVIDERS:-}"; then + read -r -a fips_providers <<< "$(tr ',' ' ' <<< "$ELASTICSEARCH_FIPS_REQUIRED_PROVIDERS")" + elasticsearch_conf_set xpack.security.fips_mode.required_providers "${fips_providers[@]}" + fi fi fi # Latest Elasticseach releases install x-pack-ml by default. Since we have faced some issues with this library on certain platforms, diff --git a/bitnami/elasticsearch/README.md b/bitnami/elasticsearch/README.md index d7720a4418a4..caf103dd7d75 100644 --- a/bitnami/elasticsearch/README.md +++ b/bitnami/elasticsearch/README.md @@ -89,67 +89,68 @@ The following tables list the main variables you can set. #### Customizable environment variables -| Name | Description | Default Value | -|---------------------------------------------------|------------------------------------------------------------------------------------------------------------------------|------------------------------------------------| -| `ELASTICSEARCH_CERTS_DIR` | Path to certificates folder. | `${DB_CONF_DIR}/certs` | -| `ELASTICSEARCH_DATA_DIR_LIST` | Comma, semi-colon or space separated list of directories to use for data storage | `nil` | -| `ELASTICSEARCH_BIND_ADDRESS` | Elasticsearch bind address | `nil` | -| `ELASTICSEARCH_ADVERTISED_HOSTNAME` | Elasticsearch advertised hostname, used for publish | `nil` | -| `ELASTICSEARCH_CLUSTER_HOSTS` | Elasticsearch cluster hosts | `nil` | -| `ELASTICSEARCH_CLUSTER_MASTER_HOSTS` | Elasticsearch cluster master hosts | `nil` | -| `ELASTICSEARCH_CLUSTER_NAME` | Elasticsearch cluster name | `nil` | -| `ELASTICSEARCH_HEAP_SIZE` | Elasticsearch heap size | `1024m` | -| `ELASTICSEARCH_MAX_ALLOWED_MEMORY_PERCENTAGE` | Elasticsearch maximum allowed memory percentage | `100` | -| `ELASTICSEARCH_MAX_ALLOWED_MEMORY` | Elasticsearch maximum allowed memory amount (in megabytes) | `nil` | -| `ELASTICSEARCH_MAX_TIMEOUT` | Elasticsearch maximum init timeout | `60` | -| `ELASTICSEARCH_LOCK_ALL_MEMORY` | Sets bootstrap.memory_lock parameter | `no` | -| `ELASTICSEARCH_DISABLE_JVM_HEAP_DUMP` | Disable JVM Heap dump | `no` | -| `ELASTICSEARCH_DISABLE_GC_LOGS` | Disable GC logs | `no` | -| `ELASTICSEARCH_IS_DEDICATED_NODE` | If false, Elasticsearch will be configured with all the roles, deploy as dedicated node using DB_NODE_ROLES. | `no` | -| `ELASTICSEARCH_MINIMUM_MASTER_NODES` | Minimum number of master nodes | `nil` | -| `ELASTICSEARCH_NODE_NAME` | Elasticsearch node name | `nil` | -| `ELASTICSEARCH_FS_SNAPSHOT_REPO_PATH` | Elasticsearch repo path to restore snapshots from system repository | `nil` | -| `ELASTICSEARCH_NODE_ROLES` | Comma-separated list of Elasticsearch roles. If empty, will be deployed as a coordinating-only node. | `nil` | -| `ELASTICSEARCH_PLUGINS` | List of Elasticsearch plugins to activate | `nil` | -| `ELASTICSEARCH_TRANSPORT_PORT_NUMBER` | Elasticsearch node port number | `9300` | -| `ELASTICSEARCH_HTTP_PORT_NUMBER` | Elasticsearch port | `9200` | -| `ELASTICSEARCH_ACTION_DESTRUCTIVE_REQUIRES_NAME` | Enable action destructive requires name | `nil` | -| `ELASTICSEARCH_ENABLE_SECURITY` | Enable Elasticsearch security settings. | `false` | -| `ELASTICSEARCH_PASSWORD` | Password for "elastic" user. | `nil` | -| `ELASTICSEARCH_TLS_VERIFICATION_MODE` | Elasticsearch TLS verification mode in transport layer. | `full` | -| `ELASTICSEARCH_TLS_USE_PEM` | Configure Security settings using PEM certificates. | `false` | -| `ELASTICSEARCH_KEYSTORE_PASSWORD` | Password for the Elasticsearch keystore containing the certificates or password-protected PEM key. | `nil` | -| `ELASTICSEARCH_TRUSTSTORE_PASSWORD` | Password for the Elasticsearch truststore. | `nil` | -| `ELASTICSEARCH_KEY_PASSWORD` | Password for the Elasticsearch node PEM key. | `nil` | -| `ELASTICSEARCH_KEYSTORE_LOCATION` | Path to Keystore | `${DB_CERTS_DIR}/elasticsearch.keystore.jks` | -| `ELASTICSEARCH_TRUSTSTORE_LOCATION` | Path to Truststore. | `${DB_CERTS_DIR}/elasticsearch.truststore.jks` | -| `ELASTICSEARCH_NODE_CERT_LOCATION` | Path to PEM node certificate. | `${DB_CERTS_DIR}/tls.crt` | -| `ELASTICSEARCH_NODE_KEY_LOCATION` | Path to PEM node key. | `${DB_CERTS_DIR}/tls.key` | -| `ELASTICSEARCH_CA_CERT_LOCATION` | Path to CA certificate. | `${DB_CERTS_DIR}/ca.crt` | -| `ELASTICSEARCH_SKIP_TRANSPORT_TLS` | Skips transport layer TLS configuration. Useful when deploying single-node clusters. | `false` | -| `ELASTICSEARCH_TRANSPORT_TLS_USE_PEM` | Configure transport layer TLS settings using PEM certificates. | `$DB_TLS_USE_PEM` | -| `ELASTICSEARCH_TRANSPORT_TLS_KEYSTORE_PASSWORD` | Password for the Elasticsearch transport layer TLS keystore containing the certificates or password-protected PEM key. | `$DB_KEYSTORE_PASSWORD` | -| `ELASTICSEARCH_TRANSPORT_TLS_TRUSTSTORE_PASSWORD` | Password for the Elasticsearch transport layer TLS truststore. | `$DB_TRUSTSTORE_PASSWORD` | -| `ELASTICSEARCH_TRANSPORT_TLS_KEY_PASSWORD` | Password for the Elasticsearch transport layer TLS node PEM key. | `$DB_KEY_PASSWORD` | -| `ELASTICSEARCH_TRANSPORT_TLS_KEYSTORE_LOCATION` | Path to Keystore for transport layer TLS. | `$DB_KEYSTORE_LOCATION` | -| `ELASTICSEARCH_TRANSPORT_TLS_TRUSTSTORE_LOCATION` | Path to Truststore for transport layer TLS. | `$DB_TRUSTSTORE_LOCATION` | -| `ELASTICSEARCH_TRANSPORT_TLS_NODE_CERT_LOCATION` | Path to PEM node certificate for transport layer TLS. | `$DB_NODE_CERT_LOCATION` | -| `ELASTICSEARCH_TRANSPORT_TLS_NODE_KEY_LOCATION` | Path to PEM node key for transport layer TLS. | `$DB_NODE_KEY_LOCATION` | -| `ELASTICSEARCH_TRANSPORT_TLS_CA_CERT_LOCATION` | Path to CA certificate for transport layer TLS. | `$DB_CA_CERT_LOCATION` | -| `ELASTICSEARCH_ENABLE_REST_TLS` | Enable TLS encryption for REST API communications. | `true` | -| `ELASTICSEARCH_HTTP_TLS_USE_PEM` | Configure HTTP TLS settings using PEM certificates. | `$DB_TLS_USE_PEM` | -| `ELASTICSEARCH_HTTP_TLS_KEYSTORE_PASSWORD` | Password for the Elasticsearch HTTP TLS keystore containing the certificates or password-protected PEM key. | `$DB_KEYSTORE_PASSWORD` | -| `ELASTICSEARCH_HTTP_TLS_TRUSTSTORE_PASSWORD` | Password for the Elasticsearch HTTP TLS truststore. | `$DB_TRUSTSTORE_PASSWORD` | -| `ELASTICSEARCH_HTTP_TLS_KEY_PASSWORD` | Password for the Elasticsearch HTTP TLS node PEM key. | `$DB_KEY_PASSWORD` | -| `ELASTICSEARCH_HTTP_TLS_KEYSTORE_LOCATION` | Path to Keystore for HTTP TLS. | `$DB_KEYSTORE_LOCATION` | -| `ELASTICSEARCH_HTTP_TLS_TRUSTSTORE_LOCATION` | Path to Truststore for HTTP TLS. | `$DB_TRUSTSTORE_LOCATION` | -| `ELASTICSEARCH_HTTP_TLS_NODE_CERT_LOCATION` | Path to PEM node certificate for HTTP TLS. | `$DB_NODE_CERT_LOCATION` | -| `ELASTICSEARCH_HTTP_TLS_NODE_KEY_LOCATION` | Path to PEM node key for HTTP TLS. | `$DB_NODE_KEY_LOCATION` | -| `ELASTICSEARCH_HTTP_TLS_CA_CERT_LOCATION` | Path to CA certificate for HTTP TLS. | `$DB_CA_CERT_LOCATION` | -| `ELASTICSEARCH_ENABLE_FIPS_MODE` | Enables FIPS mode of operation | `false` | -| `ELASTICSEARCH_PASSWD_HASH_ALGORITHM` | Password hashing algorithm | `nil` | -| `ELASTICSEARCH_KEYS` | Comma-separated list of key=value to be added to the Elasticsearch keystore | `nil` | -| `ES_JAVA_HOME` | Elasticsearch supported Java installation folder. | `${JAVA_HOME}` | +| Name | Description | Default Value | +|---------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------|------------------------------------------------| +| `ELASTICSEARCH_CERTS_DIR` | Path to certificates folder. | `${DB_CONF_DIR}/certs` | +| `ELASTICSEARCH_DATA_DIR_LIST` | Comma, semi-colon or space separated list of directories to use for data storage | `nil` | +| `ELASTICSEARCH_BIND_ADDRESS` | Elasticsearch bind address | `nil` | +| `ELASTICSEARCH_ADVERTISED_HOSTNAME` | Elasticsearch advertised hostname, used for publish | `nil` | +| `ELASTICSEARCH_CLUSTER_HOSTS` | Elasticsearch cluster hosts | `nil` | +| `ELASTICSEARCH_CLUSTER_MASTER_HOSTS` | Elasticsearch cluster master hosts | `nil` | +| `ELASTICSEARCH_CLUSTER_NAME` | Elasticsearch cluster name | `nil` | +| `ELASTICSEARCH_HEAP_SIZE` | Elasticsearch heap size | `1024m` | +| `ELASTICSEARCH_MAX_ALLOWED_MEMORY_PERCENTAGE` | Elasticsearch maximum allowed memory percentage | `100` | +| `ELASTICSEARCH_MAX_ALLOWED_MEMORY` | Elasticsearch maximum allowed memory amount (in megabytes) | `nil` | +| `ELASTICSEARCH_MAX_TIMEOUT` | Elasticsearch maximum init timeout | `60` | +| `ELASTICSEARCH_LOCK_ALL_MEMORY` | Sets bootstrap.memory_lock parameter | `no` | +| `ELASTICSEARCH_DISABLE_JVM_HEAP_DUMP` | Disable JVM Heap dump | `no` | +| `ELASTICSEARCH_DISABLE_GC_LOGS` | Disable GC logs | `no` | +| `ELASTICSEARCH_IS_DEDICATED_NODE` | If false, Elasticsearch will be configured with all the roles, deploy as dedicated node using DB_NODE_ROLES. | `no` | +| `ELASTICSEARCH_MINIMUM_MASTER_NODES` | Minimum number of master nodes | `nil` | +| `ELASTICSEARCH_NODE_NAME` | Elasticsearch node name | `nil` | +| `ELASTICSEARCH_FS_SNAPSHOT_REPO_PATH` | Elasticsearch repo path to restore snapshots from system repository | `nil` | +| `ELASTICSEARCH_NODE_ROLES` | Comma-separated list of Elasticsearch roles. If empty, will be deployed as a coordinating-only node. | `nil` | +| `ELASTICSEARCH_PLUGINS` | List of Elasticsearch plugins to activate | `nil` | +| `ELASTICSEARCH_TRANSPORT_PORT_NUMBER` | Elasticsearch node port number | `9300` | +| `ELASTICSEARCH_HTTP_PORT_NUMBER` | Elasticsearch port | `9200` | +| `ELASTICSEARCH_ACTION_DESTRUCTIVE_REQUIRES_NAME` | Enable action destructive requires name | `nil` | +| `ELASTICSEARCH_ENABLE_SECURITY` | Enable Elasticsearch security settings. | `false` | +| `ELASTICSEARCH_PASSWORD` | Password for "elastic" user. | `nil` | +| `ELASTICSEARCH_TLS_VERIFICATION_MODE` | Elasticsearch TLS verification mode in transport layer. | `full` | +| `ELASTICSEARCH_TLS_USE_PEM` | Configure Security settings using PEM certificates. | `false` | +| `ELASTICSEARCH_KEYSTORE_PASSWORD` | Password for the Elasticsearch keystore containing the certificates or password-protected PEM key. | `nil` | +| `ELASTICSEARCH_TRUSTSTORE_PASSWORD` | Password for the Elasticsearch truststore. | `nil` | +| `ELASTICSEARCH_KEY_PASSWORD` | Password for the Elasticsearch node PEM key. | `nil` | +| `ELASTICSEARCH_KEYSTORE_LOCATION` | Path to Keystore | `${DB_CERTS_DIR}/elasticsearch.keystore.jks` | +| `ELASTICSEARCH_TRUSTSTORE_LOCATION` | Path to Truststore. | `${DB_CERTS_DIR}/elasticsearch.truststore.jks` | +| `ELASTICSEARCH_NODE_CERT_LOCATION` | Path to PEM node certificate. | `${DB_CERTS_DIR}/tls.crt` | +| `ELASTICSEARCH_NODE_KEY_LOCATION` | Path to PEM node key. | `${DB_CERTS_DIR}/tls.key` | +| `ELASTICSEARCH_CA_CERT_LOCATION` | Path to CA certificate. | `${DB_CERTS_DIR}/ca.crt` | +| `ELASTICSEARCH_SKIP_TRANSPORT_TLS` | Skips transport layer TLS configuration. Useful when deploying single-node clusters. | `false` | +| `ELASTICSEARCH_TRANSPORT_TLS_USE_PEM` | Configure transport layer TLS settings using PEM certificates. | `$DB_TLS_USE_PEM` | +| `ELASTICSEARCH_TRANSPORT_TLS_KEYSTORE_PASSWORD` | Password for the Elasticsearch transport layer TLS keystore containing the certificates or password-protected PEM key. | `$DB_KEYSTORE_PASSWORD` | +| `ELASTICSEARCH_TRANSPORT_TLS_TRUSTSTORE_PASSWORD` | Password for the Elasticsearch transport layer TLS truststore. | `$DB_TRUSTSTORE_PASSWORD` | +| `ELASTICSEARCH_TRANSPORT_TLS_KEY_PASSWORD` | Password for the Elasticsearch transport layer TLS node PEM key. | `$DB_KEY_PASSWORD` | +| `ELASTICSEARCH_TRANSPORT_TLS_KEYSTORE_LOCATION` | Path to Keystore for transport layer TLS. | `$DB_KEYSTORE_LOCATION` | +| `ELASTICSEARCH_TRANSPORT_TLS_TRUSTSTORE_LOCATION` | Path to Truststore for transport layer TLS. | `$DB_TRUSTSTORE_LOCATION` | +| `ELASTICSEARCH_TRANSPORT_TLS_NODE_CERT_LOCATION` | Path to PEM node certificate for transport layer TLS. | `$DB_NODE_CERT_LOCATION` | +| `ELASTICSEARCH_TRANSPORT_TLS_NODE_KEY_LOCATION` | Path to PEM node key for transport layer TLS. | `$DB_NODE_KEY_LOCATION` | +| `ELASTICSEARCH_TRANSPORT_TLS_CA_CERT_LOCATION` | Path to CA certificate for transport layer TLS. | `$DB_CA_CERT_LOCATION` | +| `ELASTICSEARCH_ENABLE_REST_TLS` | Enable TLS encryption for REST API communications. | `true` | +| `ELASTICSEARCH_HTTP_TLS_USE_PEM` | Configure HTTP TLS settings using PEM certificates. | `$DB_TLS_USE_PEM` | +| `ELASTICSEARCH_HTTP_TLS_KEYSTORE_PASSWORD` | Password for the Elasticsearch HTTP TLS keystore containing the certificates or password-protected PEM key. | `$DB_KEYSTORE_PASSWORD` | +| `ELASTICSEARCH_HTTP_TLS_TRUSTSTORE_PASSWORD` | Password for the Elasticsearch HTTP TLS truststore. | `$DB_TRUSTSTORE_PASSWORD` | +| `ELASTICSEARCH_HTTP_TLS_KEY_PASSWORD` | Password for the Elasticsearch HTTP TLS node PEM key. | `$DB_KEY_PASSWORD` | +| `ELASTICSEARCH_HTTP_TLS_KEYSTORE_LOCATION` | Path to Keystore for HTTP TLS. | `$DB_KEYSTORE_LOCATION` | +| `ELASTICSEARCH_HTTP_TLS_TRUSTSTORE_LOCATION` | Path to Truststore for HTTP TLS. | `$DB_TRUSTSTORE_LOCATION` | +| `ELASTICSEARCH_HTTP_TLS_NODE_CERT_LOCATION` | Path to PEM node certificate for HTTP TLS. | `$DB_NODE_CERT_LOCATION` | +| `ELASTICSEARCH_HTTP_TLS_NODE_KEY_LOCATION` | Path to PEM node key for HTTP TLS. | `$DB_NODE_KEY_LOCATION` | +| `ELASTICSEARCH_HTTP_TLS_CA_CERT_LOCATION` | Path to CA certificate for HTTP TLS. | `$DB_CA_CERT_LOCATION` | +| `ELASTICSEARCH_ENABLE_FIPS_MODE` | Enables FIPS mode of operation | `false` | +| `ELASTICSEARCH_FIPS_REQUIRED_PROVIDERS` | Comma-separated list of required FIPS security providers to enforce at startup (e.g. "BCFIPS,BCJSSE"). Requires ES 8.13+. | `nil` | +| `ELASTICSEARCH_PASSWD_HASH_ALGORITHM` | Password hashing algorithm | `nil` | +| `ELASTICSEARCH_KEYS` | Comma-separated list of key=value to be added to the Elasticsearch keystore | `nil` | +| `ES_JAVA_HOME` | Elasticsearch supported Java installation folder. | `${JAVA_HOME}` | #### Read-only environment variables