简单集群搭建：
- node-1：10.230.22.101
- node-2：10.230.22.102
- node-3：10.230.22.103
目录规划：
. |-- bin | |-- schema | |-- start-es.sh | |-- start-kibana.sh | |-- stop-es.sh | `-- sync |-- data -> /data/es-data |-- logs |-- sbin |-- support | |-- elasticsearch-7.10.2 | |-- es -> elasticsearch-7.10.2 | |-- kibana -> kibana-7.10.2-linux-x86_64 | |-- kibana-7.10.2-linux-x86_64 | |-- logstash -> logstash-7.10.2 | `-- logstash-7.10.2 `-- sync
node-1 配置 elasticsearch.yml：
cluster.name: crm node.name: node-1 node.attr.rack: r1 path.data: /home/es/data path.logs: /home/es/logs network.host: 192.168.22.101 http.port: 9200 discovery.seed_hosts: ["192.168.22.101", "192.168.22.102", "192.168.22.103"] cluster.initial_master_nodes: ["192.168.22.101", "192.168.22.102", "192.168.22.103"]
node-2 配置 elasticsearch.yml：
cluster.name: crm node.name: node-2 node.attr.rack: r1 path.data: /home/es/data path.logs: /home/es/logs network.host: 192.168.22.102 http.port: 9200 discovery.seed_hosts: ["192.168.22.101", "192.168.22.102", "192.168.22.103"] cluster.initial_master_nodes: ["192.168.22.101", "192.168.22.102", "192.168.22.103"]
node-3 配置 elasticsearch.yml：
cluster.name: crm node.name: node-3 node.attr.rack: r1 path.data: /home/es/data path.logs: /home/es/logs network.host: 192.168.22.103 http.port: 9200 discovery.seed_hosts: ["192.168.22.101", "192.168.22.102", "192.168.22.103"] cluster.initial_master_nodes: ["192.168.22.101", "192.168.22.102", "192.168.22.103"]
查看集群状态：
es@hn-zz-crmcache05 ~ $ curl -XGET 'http://192.168.22.101:9200/_cat/nodes?v' ip heap.percent ram.percent cpu load_1m load_5m load_15m node.role master name 192.168.22.101 4 8 0 0.38 0.32 0.30 cdhilmrstw * node-1 192.168.22.102 5 7 0 0.25 0.19 0.22 cdhilmrstw - node-2 192.168.22.103 5 7 0 0.25 0.19 0.22 cdhilmrstw - node-3
配置 ES 集群间 TLS 和身份验证：
1.生成证书
es 集群通过证书来安全的组成集群：
在主节点elastic_node2上配置TLS,以下命令生成证书到我们指定的位置：
es@hn-zz-crmsearch02 ~ $ ~/support/es/bin/elasticsearch-certutil cert -out /home/es/support/es/config/elastic-certificates.p12 -pass "" This tool assists you in the generation of X.509 certificates and certificate signing requests for use with SSL/TLS in the Elastic stack. The 'cert' mode generates X.509 certificate and private keys. * By default, this generates a single certificate and key for use on a single instance. * The '-multiple' option will prompt you to enter details for multiple instances and will generate a certificate and key for each one * The '-in' option allows for the certificate generation to be automated by describing the details of each instance in a YAML file * An instance is any piece of the Elastic Stack that requires an SSL certificate. Depending on your configuration, Elasticsearch, Logstash, Kibana, and Beats may all require a certificate and private key. * The minimum required value for each instance is a name. This can simply be the hostname, which will be used as the Common Name of the certificate. A full distinguished name may also be used. * A filename value may be required for each instance. This is necessary when the name would result in an invalid file or directory name. The name provided here is used as the directory name (within the zip) and the prefix for the key and certificate files. The filename is required if you are prompted and the name is not displayed in the prompt. * IP addresses and DNS names are optional. Multiple values can be specified as a comma separated string. If no IP addresses or DNS names are provided, you may disable hostname verification in your SSL configuration. * All certificates generated by this tool will be signed by a certificate authority (CA). * The tool can automatically generate a new CA for you, or you can provide your own with the -ca or -ca-cert command line options. By default the 'cert' mode produces a single PKCS#12 output file which holds: * The instance certificate * The private key for the instance certificate * The CA certificate If you specify any of the following options: * -pem (PEM formatted output) * -keep-ca-key (retain generated CA key) * -multiple (generate multiple certificates) * -in (generate certificates from an input file) then the output will be be a zip file containing individual certificate/key files Certificates written to /home/es/support/es/config/elastic-certificates.p12 This file should be properly secured as it contains the private key for your instance. This file is a self contained file and can be copied and used 'as is' For each Elastic product that you wish to configure, you should copy this '.p12' file to the relevant configuration directory and then follow the SSL configuration instructions in the product guide.
2.复制证书到其它节点：
scp /home/es/support/es/config/elastic-certificates.p12 es@192.168.22.102:/home/es/support/es/config scp /home/es/support/es/config/elastic-certificates.p12 es@192.168.22.103:/home/es/support/es/config
3.修改配置文件开启 TLS 集群通信认证
xpack.security.enabled: true xpack.license.self_generated.type: basic xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification_mode: certificate xpack.security.transport.ssl.keystore.path: /home/es/support/es/config/elastic-certificates.p12 xpack.security.transport.ssl.truststore.path: /home/es/support/es/config/elastic-certificates.p12
4.重启节点后，查看日志确认集群已组成
[2021-03-08T19:45:30,568][INFO ][o.e.l.LicenseService ] [node-10] license [ffd6dc5c-3bfa-400a-bc43-56d67316d81b] mode [basic] - valid [2021-03-08T19:45:30,570][INFO ][o.e.x.s.s.SecurityStatusChangeListener] [node-1] Active license is now [BASIC]; Security is enabled [2021-03-08T19:45:30,575][INFO ][o.e.g.GatewayService ] [node-1] recovered [0] indices into cluster_state
5. 这个时候使用 curl 命令会失败的，因为集群通信认证了以后，我们再去 curl 访问是会询问账号的，以下示例:
es@hn-xt-crmsearch03 ~ $ curl -XGET 'http://192.168.22.101:9200/_cat/nodes?pretty=true' { "error" : { "root_cause" : [ { "type" : "security_exception", "reason" : "missing authentication credentials for REST request [/_cat/nodes?pretty=true]", "header" : { "WWW-Authenticate" : "Basic realm="security" charset="UTF-8"" } } ], "type" : "security_exception", "reason" : "missing authentication credentials for REST request [/_cat/nodes?pretty=true]", "header" : { "WWW-Authenticate" : "Basic realm="security" charset="UTF-8"" } }, "status" : 401 } es@hn-xt-crmsearch03 ~ $
为 elasticsearch 集群配置密码：
- 生成随机密码: ~/support/es/bin/elasticsearch-setup-passwords auto
- 自定义密码: ~/support/es/bin/elasticsearch-setup-passwords interactive
这里用自定义密码做示例：
es@hn-zz-crmcache05 ~ $ ~/support/es/bin/elasticsearch-setup-passwords interactive Initiating the setup of passwords for reserved users elastic,apm_system,kibana,kibana_system,logstash_system,beats_system,remote_monitoring_user. You will be prompted to enter passwords as the process progresses. Please confirm that you would like to continue [y/N]y Enter password for [elastic]: Reenter password for [elastic]: Enter password for [apm_system]: Reenter password for [apm_system]: Enter password for [kibana_system]: Reenter password for [kibana_system]: Enter password for [logstash_system]: Reenter password for [logstash_system]: Enter password for [beats_system]: Reenter password for [beats_system]: Enter password for [remote_monitoring_user]: Reenter password for [remote_monitoring_user]: Changed password for user [apm_system] Changed password for user [kibana_system] Changed password for user [kibana] Changed password for user [logstash_system] Changed password for user [beats_system] Changed password for user [remote_monitoring_user] Changed password for user [elastic]
验证集群的可用性：
es@hn-zz-crmcache05 ~ $ curl -u elastic:123456 -XGET 'http://192.168.22.101:9200/_cat/nodes?pretty=true' 192.168.22.101 2 7 0 0.22 0.21 0.25 cdhilmrstw * node-1 192.168.22.102 2 8 0 0.09 0.18 0.22 cdhilmrstw - node-2 192.168.22.103 2 8 0 0.04 0.15 0.21 cdhilmrstw - node-3
修改密码：
当为 elastic 设置完一次密码后，再次执行相同的命令：
es@hn-zz-crmcache05 ~ $ ~/support/es/bin/elasticsearch-setup-passwords interactive
报错：
Failed to authenticate user 'elastic' against http://172.16.xxx.xxx:9200/_security/_authenticate?pretty Possible causes include: * The password for the 'elastic' user has already been changed on this cluster * Your elasticsearch node is running against a different keystore This tool used the keystore at /usr/local/elasticsearch-7.2.0/config/elasticsearch.keystore ERROR: Failed to verify bootstrap password
解决办法：删除 .security-7 索引，然后重新执行上面命令即可，不用重启集群。