elasticsearch 集群权限管理

---

elasticsearch 集群权限管理

 

*****************************

ssl 配置：官网链接

 

cluster 基础版本使用x-pack功能，需要开启ssl，如不开启会报错：

Transport SSL must be enabled if security is enabled on a [basic] license. 
Please set [xpack.security.transport.ssl.enabled] to [true] 
or disable security by setting [xpack.security.enabled] to [false]

 

*************************

 elasticsearch-certutil：官网链接

 

            

参数说明

ca：生成ca证书

cert：根据ca生成的证书创建X.509证书

csr：生成csrs，ca、cert、csr不可同时使用

 

--ca-dn：ca证书的名称

--ca-pass：使用的ca证书密码

 

--name：文件的名称，ca的文件名成默认为elastic-stack-ca.p12，cert的文件名称默认为elastic-certificates.p12

--out：文件输出位置

--pass：文件密码，PKCS#12格式的证书可使用空密码，--pass ""

--days：证书的有效时间

--perm：证书的格式，默认为PKCS#12，使用该选项后为pem

 

*************************

生成相关证书

 

ca证书

elasticsearch-certutil ca --pass "123456" --out /usr/share/elasticsearch/source/elastic-stack-ca.p12


******************
 X.509 certificates

elasticsearch-certutil cert --ca-pass "123456"  --ca /usr/share/elasticsearch/source/elastic-stack-ca.p12 --out /usr/share/elasticsearch/source/elastic-certificates.p12 --pass ""

将elastic-stack-ca.p12、elastic-certificates.p12保存备用

 

 

*****************************

创建cluster

 

配置文件

http.host: 0.0.0.0
network.host: 0.0.0.0

node.name: node-1
node.master: true
node.data: true

http.cors.enabled: true
http.cors.allow-origin: "*"

cluster.initial_master_nodes: ["node-1","node-2","node-3"]
discovery.seed_hosts: ["172.18.0.90","172.18.0.91","172.18.0.92"]

xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate 
xpack.security.transport.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12

 

创建容器

docker run -it -d --net fixed --ip 172.18.0.90 -p 9201:9200 -p 9301:9300 \
-e ES_JAVA_OPTS="-Xms512m -Xmx512m"  \
-v /usr/elasticsearch/security/cluster/source:/usr/share/elasticsearch/config/certs \
-v /usr/elasticsearch/security/cluster/node-1/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml \
--name es-node-1 elasticsearch:7.5.1

docker run -it -d --net fixed --ip 172.18.0.91 -p 9202:9200 -p 9302:9300 \
-e ES_JAVA_OPTS="-Xms512m -Xmx512m"  \
-v /usr/elasticsearch/security/cluster/source:/usr/share/elasticsearch/config/certs \
-v /usr/elasticsearch/security/cluster/node-2/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml \
--name es-node-2 elasticsearch:7.5.1

docker run -it -d --net fixed --ip 172.18.0.92 -p 9203:9200 -p 9303:9300 \
-e ES_JAVA_OPTS="-Xms512m -Xmx512m"  \
-v /usr/elasticsearch/security/cluster/source:/usr/share/elasticsearch/config/certs \
-v /usr/elasticsearch/security/cluster/node-3/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml \
--name es-node-3 elasticsearch:7.5.1

 

为内置用户设置密码

                     

 

查看集群节点

                    

 

 

*****************************

kibana 连接集群

 

配置文件

server.name: kibana
server.host: "0"

elasticsearch.username: kibana
elasticsearch.password: "123456"
elasticsearch.hosts: [ "http://172.18.0.90:9200","http://172.18.0.91:9200","http://172.18.0.92:9200"]

xpack.security.encryptionKey: "12345678qwertyui1qaz2wsx3edc4rfv"
xpack.monitoring.ui.container.elasticsearch.enabled: true

 

创建容器

docker run -it --net fixed --ip 172.18.0.64 -p 5602:5601 \
-v /usr/elasticsearch/security/single2/config/kibana.yml:/usr/share/kibana/config/kibana.yml \
--name kibana3 docker.elastic.co/kibana/kibana:7.5.1

后续操作同单机权限管理