diff --git a/efk_cluster/elasticsearch-cluster.yaml b/efk_cluster/elasticsearch-cluster.yaml
index e44db66..8598c64 100644
--- a/efk_cluster/elasticsearch-cluster.yaml
+++ b/efk_cluster/elasticsearch-cluster.yaml
@@ -91,7 +91,7 @@ spec:
         - name: cluster.initial_master_nodes
           value: "elasticsearch-0"
         - name: xpack.security.enabled
-          value: "true"
+          value: "false"
         - name: xpack.security.transport.ssl.enabled
           value: "false"  # 禁用 transport SSL
         - name: ELASTIC_PASSWORD
@@ -180,7 +180,7 @@ spec:
         - name: cluster.initial_master_nodes
           value: "elasticsearch-0"
         - name: xpack.security.enabled
-          value: "true"
+          value: "false"
         - name: xpack.security.transport.ssl.enabled
           value: "false"  # 禁用 transport SSL
         - name: ELASTIC_PASSWORD
@@ -189,7 +189,7 @@ spec:
               name: elasticsearch-secret
               key: elastic_password
         - name: ES_JAVA_OPTS
-          value: "-Xms2g -Xmx4g"
+          value: "-Xms4g -Xmx4g"
         - name: node.roles
           value: "[data]"
         - name: node.attr.data-tier
@@ -269,7 +269,7 @@ spec:
         - name: cluster.initial_master_nodes
           value: "elasticsearch-0"
         - name: xpack.security.enabled
-          value: "true"
+          value: "false"
         - name: xpack.security.transport.ssl.enabled
           value: "false"  # 禁用 transport SSL
         - name: ELASTIC_PASSWORD
@@ -278,7 +278,7 @@ spec:
               name: elasticsearch-secret
               key: elastic_password
         - name: ES_JAVA_OPTS
-          value: "-Xms2g -Xmx4g"
+          value: "-Xms4g -Xmx4g"
         - name: node.roles
           value: "[data]"
         - name: node.attr.data-tier
diff --git a/efk_cluster/kibana-cluster.yaml b/efk_cluster/kibana-cluster.yaml
new file mode 100644
index 0000000..1cf1544
--- /dev/null
+++ b/efk_cluster/kibana-cluster.yaml
@@ -0,0 +1,41 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kibana
+  namespace: efk
+  labels:
+    app: kibana
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: kibana
+  template:
+    metadata:
+      labels:
+        app: kibana
+    spec:
+      containers:
+        - name: kibana
+          image: docker.elastic.co/kibana/kibana:8.8.0
+          ports:
+            - containerPort: 5601
+          env:
+            - name: ELASTICSEARCH_HOSTS
+              value: "http://elasticsearch-0.elasticsearch-service.efk.svc.cluster.local:9200"  # 直接连接 master 节点
+            - name: ELASTICSEARCH_USERNAME
+              value: "elastic"
+            - name: ELASTICSEARCH_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: elasticsearch-secret
+                  key: elastic_password
+            - name: XPACK_SECURITY_ENCRYPTIONKEY
+              value: "a_secure_random_string_of_32_characters"
+            - name: XPACK_ENCRYPTEDSAVEDOBJECTS_ENCRYPTIONKEY
+              value: "another_secure_random_string_of_32_characters"
+            - name: XPACK_REPORTING_ENCRYPTIONKEY
+              value: "yet_another_secure_random_string_of_32_characters"
+            - name: ELASTICSEARCH_SERVICEACCOUNTTOKEN
+              value: "AAEAAWVsYXN0aWMva2liYW5hL215"
+
diff --git a/efk_cluster/kibana-deployment.yaml b/efk_cluster/kibana-deployment.yaml
index 1e49872..01eac2a 100644
--- a/efk_cluster/kibana-deployment.yaml
+++ b/efk_cluster/kibana-deployment.yaml
@@ -30,4 +30,4 @@ spec:
             - name: XPACK_REPORTING_ENCRYPTIONKEY
               value: "yet_another_secure_random_string_of_32_characters"
             - name: ELASTICSEARCH_SERVICEACCOUNTTOKEN
-              value: "AAEAAWVsYXN0aWMva2liYW5hL215LXRva2VuOmd3ZG9idU5kVEM2b3BLRUJDS2g5YVE"
+              value: "AAEAAWVsYXN0aWMva2liYW5hL215LXRva2VuOnlWd28tb2JZVDBxS05KaVNHQ21mSUE"