Medulla

Medulla is a streamlined web admin interface designed for managing Elasticsearch and OpenSearch clusters. Its lightweight design, encapsulated in a single ~10 MB static binary, facilitates multi-cluster management with essential features like built-in Role-Based Access Control (RBAC), LDAP authentication, and audit logging.

Core Features

• Clusters Overview: View cluster health, version, node statistics, indices, documents, and unassigned shards at a glance. Includes a cluster switcher accessible on every page.
• Detailed Node Stats: Access metrics on heap, disk, and CPU usage, along with a visual shard allocation grid. Analyze unassigned shards with insights on their causes.
• Index Management: Perform various operations such as creating, deleting, opening, closing, refreshing, and force-merging indices, alongside configuration settings and mappings.
• Aliases & Templates: Manage index aliases and templates efficiently, with capabilities to create, list, update, and delete through a user-friendly JSON editor.
• Snapshots Management: Handle snapshot repositories, allowing for creation, restoration, and deletion of snapshots.
• Cluster Settings: Browse and edit persistent, transient, and default cluster settings with a reset option.
• Analysis Tools: Utilize a built-in playground for analyzing and testing various analyzers and tokenizers.
• RESTful Console: Execute unrestricted requests with permission controls in place, ensuring only authorized users can access certain functionalities.
• Flavors Supported: Seamless detection and support for Elasticsearch 7, Elasticsearch 8, and OpenSearch clusters.

Design Philosophy

Medulla is built with security and efficiency in mind, deliberately minimizing dependencies to reduce the attack surface. The application does not rely on JavaScript, ensuring server-rendered HTML pages operate under a strict Content Security Policy (CSP). It utilizes Go's standard library for most functions and features a minimal dependency list:

This design ensures a reduced vulnerability profile:

• Medulla operates without a traditional database, using a single YAML configuration file and stateless sessions to maintain low overhead.
• The application runs in a FROM scratch container setup, minimizing additional tooling and dependencies.

Security

Medulla implements a robust security model, including:

• Session management with HttpOnly, SameSite=Lax, and Secure attributes enabled by default.
• Extensive audit logging for every login attempt and state-changing request.
• Interpolation for sensitive data directly from environment variables, ensuring minimal exposure in configuration files.

Demo Instructions

A simple command allows for local testing with a preconfigured setup:

docker-compose up -d --build

Access the demo at http://localhost:8080 and log in with the provided user credentials to explore the feature set.

Configuration Examples

An example configuration for Medulla can be defined as follows:

clusters:
  - name: prod
    url: https://es-prod:9200
    auth: {type: basic, username: medulla, password: "${ES_PASSWORD}"}
roles:
  admin: {clusters: ["*"], permissions: [admin]}
local_users:
  - {name: admin, password: "${ADMIN_PASSWORD}", roles: [admin]}
session:
  secret: "${SESSION_SECRET}"

Production Deployment

For deploying Medulla in a Kubernetes environment, a Helm chart is available for streamlined installation and configuration, complete with best practices for security and management.

Contribution Guidelines

Contributions are welcomed, including bug reports and feature requests. When proposing changes, ensure to adhere to the dependency philosophy to maintain Medulla's lightweight structure.

Medulla provides an efficient and secure solution for managing Elasticsearch and OpenSearch clusters, combining rich features with an emphasis on simplicity and security.