elasticsearch 集群权限管理
*****************************
ssl 配置:官网链接
cluster 基础版本使用x-pack功能,需要开启ssl,如不开启会报错:
Transport SSL must be enabled if security is enabled on a [basic] license.
Please set [xpack.security.transport.ssl.enabled] to [true]
or disable security by setting [xpack.security.enabled] to [false]
*************************
elasticsearch-certutil:官网链接
参数说明
ca:生成ca证书
cert:根据ca生成的证书创建X.509证书
csr:生成csrs,ca、cert、csr不可同时使用
--ca-dn:ca证书的名称
--ca-pass:使用的ca证书密码
--name:文件的名称,ca的文件名成默认为elastic-stack-ca.p12,cert的文件名称默认为elastic-certificates.p12
--out:文件输出位置
--pass:文件密码,PKCS#12格式的证书可使用空密码,--pass ""
--days:证书的有效时间
--perm:证书的格式,默认为PKCS#12,使用该选项后为pem
*************************
生成相关证书
ca证书
elasticsearch-certutil ca --pass "123456" --out /usr/share/elasticsearch/source/elastic-stack-ca.p12
******************
X.509 certificates
elasticsearch-certutil cert --ca-pass "123456" --ca /usr/share/elasticsearch/source/elastic-stack-ca.p12 --out /usr/share/elasticsearch/source/elastic-certificates.p12 --pass ""
将elastic-stack-ca.p12、elastic-certificates.p12保存备用
*****************************
创建cluster
配置文件
http.host: 0.0.0.0
network.host: 0.0.0.0
node.name: node-1
node.master: true
node.data: true
http.cors.enabled: true
http.cors.allow-origin: "*"
cluster.initial_master_nodes: ["node-1","node-2","node-3"]
discovery.seed_hosts: ["172.18.0.90","172.18.0.91","172.18.0.92"]
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
创建容器
docker run -it -d --net fixed --ip 172.18.0.90 -p 9201:9200 -p 9301:9300 \
-e ES_JAVA_OPTS="-Xms512m -Xmx512m" \
-v /usr/elasticsearch/security/cluster/source:/usr/share/elasticsearch/config/certs \
-v /usr/elasticsearch/security/cluster/node-1/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml \
--name es-node-1 elasticsearch:7.5.1
docker run -it -d --net fixed --ip 172.18.0.91 -p 9202:9200 -p 9302:9300 \
-e ES_JAVA_OPTS="-Xms512m -Xmx512m" \
-v /usr/elasticsearch/security/cluster/source:/usr/share/elasticsearch/config/certs \
-v /usr/elasticsearch/security/cluster/node-2/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml \
--name es-node-2 elasticsearch:7.5.1
docker run -it -d --net fixed --ip 172.18.0.92 -p 9203:9200 -p 9303:9300 \
-e ES_JAVA_OPTS="-Xms512m -Xmx512m" \
-v /usr/elasticsearch/security/cluster/source:/usr/share/elasticsearch/config/certs \
-v /usr/elasticsearch/security/cluster/node-3/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml \
--name es-node-3 elasticsearch:7.5.1
为内置用户设置密码
查看集群节点
*****************************
kibana 连接集群
配置文件
server.name: kibana
server.host: "0"
elasticsearch.username: kibana
elasticsearch.password: "123456"
elasticsearch.hosts: [ "http://172.18.0.90:9200","http://172.18.0.91:9200","http://172.18.0.92:9200"]
xpack.security.encryptionKey: "12345678qwertyui1qaz2wsx3edc4rfv"
xpack.monitoring.ui.container.elasticsearch.enabled: true
创建容器
docker run -it --net fixed --ip 172.18.0.64 -p 5602:5601 \
-v /usr/elasticsearch/security/single2/config/kibana.yml:/usr/share/kibana/config/kibana.yml \
--name kibana3 docker.elastic.co/kibana/kibana:7.5.1