1、生成ssl证书
该步骤仅需要在任意一台服务器上执行一次
mkdir -p /usr/local/elasticsearch/config/certs
# 运行容器
docker run -it --rm -v /usr/local/elasticsearch/config/certs:/usr/share/elasticsearch/config/certs elasticsearch:6.8.13 bash
# 进入证书保存目录
cd config/certs
elasticsearch-certutil ca
# 有输入的地方直接回车即可
elasticsearch-certutil cert --ca elastic-stack-ca.p12
# 有输入的地方还是直接回车
# 退出容器
exit
# 进入宿主机证书保存目录
cd /usr/local/elasticsearch/config/certs/
# 压缩生成的证书，这个证书需要同步给所有服务器
tar -zcvf certs.tar.gz *
2、证书配置
mkdir -p /usr/local/elasticsearch/config/certs/
# 将第一步生成的certs.tar.gz上传到服务器/usr/local/elasticsearch/config/certs/目录下
tar -xvf certs.tar.gz
3、准备配置文件elasticsearch.yml
配置文件需要修改
node.name: 节点名称，不同的节点使用不同的名称
discovery.zen.ping.unicast.hosts: 多个节点的ip列表
mkdir -p /usr/local/elasticsearch/config/
cat <<EOF | tee /usr/local/elasticsearch/config/elasticsearch.yml
cluster.name: docker-cluster
network.host: 0.0.0.0
node.name: node-1
discovery.zen.ping.unicast.hosts: ["10.0.1.212", "10.0.1.213"]
discovery.zen.minimum_master_nodes: 1
#开启x-pack插件,用于添加账号密码
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: certs/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: certs/elastic-certificates.p12
EOF
4、启动镜像
docker run -d --name elasticsearch \
-v /usr/local/elasticsearch/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml \
-v /usr/local/elasticsearch/config/certs:/usr/share/elasticsearch/config/certs \
-v /usr/local/elasticsearch/plugins:/usr/share/elasticsearch/plugins \
-v /usr/local/elasticsearch/data:/usr/share/elasticsearch/data \
-v /etc/localtime:/etc/localtime \
-e ES_JAVA_OPTS="-Xms1G -Xmx1G" \
--restart=always \
--net host \
elasticsearch:6.8.13
ES_JAVA_OPTS="-Xms1G -Xmx1G" 配置elasticsearch的运行内存
5、在需要部署的服务器上重复上面的步骤
6、配置密码
登录任意一台服务器
docker exec -it elasticsearch bash
elasticsearch-setup-passwords interactive
# 按提示重复输入你需要设置的密码
需要注意，集群添加认证后，java客户端连接时也需要配置证书
public class EsConfig {
private String userPassword;
private String clusterName;
private String isCluster;
private String host;
private int port;
@Bean
public TransportClient transportClient() throws UnknownHostException {
// 解决netty-transport版本冲突
System.setProperty("es.set.netty.runtime.available.processors", "false");
Settings.Builder builder = Settings.builder()
.put("xpack.security.user", userPassword)
.put("cluster.name", clusterName);
// 如果连接的ES集群,需要添加的配置
if ("true".equals(isCluster)) {
log.info("===> use ssl connection");
builder.put("xpack.security.transport.ssl.enabled", true)
.put("xpack.security.transport.ssl.verification_mode", "certificate")
.put("xpack.security.transport.ssl.keystore.path", "certs/elastic-certificates.p12")
.put("xpack.security.transport.ssl.truststore.path", "certs/elastic-certificates.p12");
}
return new PreBuiltXPackTransportClient(builder.build())
.addTransportAddress(new TransportAddress(InetAddress.getByName(host), port));
}
}
至此，es集群搭建就完成了
