前言

本文中使用StatefulSet 方式部署 Elasticsearch 集群，并且開啟X-Pack 安全認(rèn)證，存儲使用的是NFS，屬于一個初學(xué)者自己探索的方案，如果有比較好的方案，還請不吝評論賜教。
版本說明：

• Kubernetes v1.25.6 – v1.26.4
• Elasticsearch, Kibana 7.13.3
• NFS Subdir External Provisioner

前置環(huán)境
需要安裝好Kubernetes 集群，并且配置了存儲類(StorageClass)。

一、部署Elasticsearch集群

1. 創(chuàng)建配置文件

elastic-worker-ns.yaml

apiVersion: v1           # 創(chuàng)建命名空間
kind: Namespace
metadata:
  labels:
    app: es7-cluster
    kubernetes.io/name: "Elasticsearch"
  name: elastic-worker

es7-cluster.yaml

---
apiVersion: v1             # 創(chuàng)建service 文件用于內(nèi)部通訊
kind: Service
metadata:
  name: es7-headless
  namespace: elastic-worker
  labels:
    app: es7-cluster
    kubernetes.io/cluster-service: "true"
    addonmanager.kubernetes.io/mode: Reconcile
    kubernetes.io/name: "Elasticsearch"
spec:
  clusterIP: None
  publishNotReadyAddresses: true
  ports:
  - name: rest-api
    port: 9200
    targetPort: 9200
  - name: inter-node
    port: 9300
    targetPort: 9300
  selector:
    app: es7-cluster
---
apiVersion: v1             
kind: ServiceAccount
metadata:
  name: es7-cluster
  namespace: elastic-worker
  labels:
    app: es7-cluster
    kubernetes.io/cluster-service: "true"
    addonmanager.kubernetes.io/mode: Reconcile
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: es7-cluster
  namespace: elastic-worker
  labels:
    app: es7-cluster
    kubernetes.io/cluster-service: "true"
    addonmanager.kubernetes.io/mode: Reconcile
rules:
- apiGroups:
  - ""
  resources:
  - "services"
  - "namespaces"
  - "endpoints"
  verbs:
  - "get"
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: es7-cluster
  namespace: elastic-worker
  labels:
    app: es7-cluster
    kubernetes.io/cluster-service: "true"
    addonmanager.kubernetes.io/mode: Reconcile
subjects:
- kind: ServiceAccount
  name: es7-cluster
  namespace: kube-system
  apiGroup: ""
roleRef:
  kind: ClusterRole
  name: es7-cluster
  apiGroup: ""
---
apiVersion: apps/v1             # 創(chuàng)建有狀態(tài)的服務(wù)
kind: StatefulSet
metadata:
  name: es7-cluster
  namespace: elastic-worker
  labels:
    app: es7-cluster
    kubernetes.io/cluster-service: "true"
    addonmanager.kubernetes.io/mode: Reconcile
    srv: srv-elasticsearch
spec:
  serviceName: es7-headless
  replicas: 3
  selector:
    matchLabels:
      app: es7-cluster
      kubernetes.io/cluster-service: "true"
  template:
    metadata:
      labels:
        app: es7-cluster
        kubernetes.io/cluster-service: "true"
    spec:
      serviceAccountName: es7-cluster
      containers:         # 主容器
      - name: elasticsearch
        image: registry.cn-hangzhou.aliyuncs.com/greatmap/elasticsearch:7.13.3-p12    # 自定義鏡像，下邊會詳細(xì)說明
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 9200
          name: rest-api
          protocol: TCP
        - containerPort: 9300
          name: inter-node
          protocol: TCP
        volumeMounts:
        - name: data
          mountPath: /usr/share/elasticsearch/data
        - name: localtime
          readOnly: true
          mountPath: /etc/localtime
        env:
        - name: cluster.name
          value: "es7-cluster"
        - name: node.name
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: discovery.zen.minimum_master_nodes
          value: "2"
        - name: discovery.seed_hosts
          value: "es7-headless"
        - name: cluster.initial_master_nodes
          value: "es7-cluster-0,es7-cluster-1,es7-cluster-2"
        - name: ES_JAVA_OPTS
          value: "-Xms1g -Xmx1g"
        - name: xpack.security.enabled    # X-Pack 安全認(rèn)證
          value: "true"
        - name: xpack.security.transport.ssl.enabled
          value: "true"
        - name: xpack.security.transport.ssl.verification_mode  # 證書校驗類型
          value: "certificate"
        - name: xpack.security.transport.ssl.keystore.path    # 證書路徑
          value: "elastic-certificates.p12"
        - name: xpack.security.transport.ssl.truststore.path
          value: "elastic-certificates.p12"
        - name: xpack.monitoring.ui.container.elasticsearch.enabled   # 生成并提供與容器相關(guān)的監(jiān)控數(shù)據(jù)，待驗證
          value: "true"
        #- name: reindex.remote.whitelist        # 設(shè)置同步白名單，可以用來數(shù)據(jù)遷移
        #  value: "192.168.10.13:9200"
      initContainers:        # 初始化容器
      - name: fix-permissions
        image: busybox
        imagePullPolicy: IfNotPresent
        command: ["sh", "-c", "chown -R 1000:1000 /usr/share/elasticsearch/data"]
        securityContext:
          privileged: true
        volumeMounts:
        - name: data
          mountPath: /usr/share/elasticsearch/data
        - name: localtime
          readOnly: true
          mountPath: /etc/localtime
      - name: increase-vm-max-map
        image: busybox
        imagePullPolicy: IfNotPresent
        command: ["sysctl", "-w", "vm.max_map_count=262144"]
        securityContext:
          privileged: true
      - name: increase-fd-ulimit
        image: busybox
        imagePullPolicy: IfNotPresent
        command: ["sh", "-c", "ulimit -n 65536"]
      volumes:
      - name: localtime
        hostPath:
          path: /etc/localtime
          type: ''
  volumeClaimTemplates:   
  - metadata:
      name: data
    spec:
      accessModes: [ "ReadWriteMany" ]
      # 使用的存儲類名稱，需要配置一個有效的存儲類
      storageClassName: "managed-nfs-storage"
      resources:
        requests:
          storage: 2Gi

2. 部署Elasticsearch集群

kubectl create -f es7-cluster.yaml

3. 相關(guān)說明

• 單節(jié)點模式只開啟xpack.security.enabled 既可以，但是集群模式通信就需要用到證書；
• 只開啟xpack.security.enabled 在重新apply 時會失敗，提示xpack.security.transport.ssl.enabled 為 false 請設(shè)置為 true；
• 再開啟xpack.security.transport.ssl.enabled 需要生成且配置證書路徑，但是查找相關(guān)資料都是啟動后生成證書，再啟動容器；在k8s 中 pod 會無限重啟，沒辦法生成證書；
• 顧此自定義鏡像將證書直接打到鏡像里，使用Dockerfile進(jìn)行構(gòu)建
• 證書校驗類型：full、certificate、none；默認(rèn)值為“ full ”；

如何生成證書：

# 使用docker 運(yùn)行elasticsearch容器
docker run -it --rm elasticsearch:7.13.3  bash
# 生成證書
./bin/elasticsearch-certutil cert -out config/elastic-certificates.p12 -pass ""

將證書保存到本地，再通過Dockerfile重新封裝鏡像

FROM elasticsearch:7.13.3
LABEL maintainer="YZEQIANG <yinzeqiang66@126.com>"
COPY elastic-certificates.p12 /usr/share/elasticsearch/config/
RUN  chown 1000:0 /usr/share/elasticsearch/config/elastic-certificates.p12
EXPOSE 9200 9300
CMD ["eswrapper"]

阿里云倉庫：(支持x86_64、arm64)

docker pull registry.cn-hangzhou.aliyuncs.com/greatmap/elasticsearch:7.13.3-p12

4. 設(shè)置密碼

進(jìn)入到任意節(jié)點

kubectl exec -it -n elastic-worker pods/es7-cluster-1  -- bash

./bin/elasticsearch-setup-passwords interactive
Initiating the setup of passwords for reserved users elastic,apm_system,kibana,kibana_system,logstash_system,beats_system,remote_monitoring_user.
You will be prompted to enter passwords as the process progresses.
Please confirm that you would like to continue [y/N]y

# interactive 手動設(shè)置密碼（Stack123），如果是auto，自動隨機(jī)生成密碼
Enter password for [elastic]: 
Reenter password for [elastic]: 
Enter password for [apm_system]: 
Reenter password for [apm_system]: 
Enter password for [kibana_system]: 
Reenter password for [kibana_system]: 
Enter password for [logstash_system]: 
Reenter password for [logstash_system]: 
Enter password for [beats_system]: 
Reenter password for [beats_system]: 
Enter password for [remote_monitoring_user]: 
Reenter password for [remote_monitoring_user]: 

5. 將es集群對外暴露

es7-external.yaml

apiVersion: v1             # 創(chuàng)建service 文件用于內(nèi)部通訊
kind: Service
metadata:
  name: es7-external
  namespace: elastic-worker
  labels:
    app: es7-cluster
spec:
  type: NodePort
  ports:
  - name: rest-api
    port: 9200
    protocol: TCP
    targetPort: 9200
    nodePort: 30920
  selector:
    app: es7-cluster

6. 外部連接驗證

使用的是edge擴(kuò)展插件
https://microsoftedge.microsoft.com/addons/detail/elasticvue/geifniocjfnfilcbeloeidajlfmhdlgo?hl=zh-CN

二、部署Kibana

1. 創(chuàng)建配置文件

kibana.yaml

apiVersion: v1
kind: Service
metadata:
  name: kibana
  namespace: elastic-worker
  labels:
    k8s-app: kibana
    kubernetes.io/cluster-service: "true"
    addonmanager.kubernetes.io/mode: Reconcile
    kubernetes.io/name: "Kibana"
    srv: srv-kibana
spec:
  type: NodePort
  ports:
  - port: 5601
    nodePort: 30000
    protocol: TCP
    targetPort: ui
  selector:
    k8s-app: kibana
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: kibana
  namespace: elastic-worker
  labels:
    k8s-app: kibana
    kubernetes.io/cluster-service: "true"
    addonmanager.kubernetes.io/mode: Reconcile
    srv: srv-kibana
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: kibana
  template:
    metadata:
      labels:
        k8s-app: kibana
    spec:
      containers:
      - name: kibana
        image: kibana:7.13.3
        volumeMounts:
        - name: kibana-config
          mountPath: /usr/share/kibana/config/kibana.yml
          readOnly: true
          subPath: kibana.yml
        ports:
        - containerPort: 5601
          name: ui
          protocol: TCP
      volumes:
      - name: kibana-config
        configMap:
          name: kibana
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: kibana
  namespace: elastic-worker
  labels:
    k8s-app: kibana
data:
  kibana.yml: |-
  
    server.name: kibana
    server.host: "0.0.0.0"
    elasticsearch.hosts: [ "http://es7-headless:9200" ]
    elasticsearch.username: "elastic"
    elasticsearch.password: "Stack123"
    monitoring.ui.container.elasticsearch.enabled: true
    i18n.locale: "zh-CN"
    kibana.index: ".kibana"

2. 部署Kibana

kubectl apply -f kibana.yaml

3. 訪問驗證

http://ip:port

參考文檔：文章來源地址http://www.zghlxwxcb.cn/news/detail-505299.html

• ECK官方文檔
• Kibana 將語言設(shè)置為中文
• ElasticSearch7.X啟動X-Pack
• k8s 部署ELK并設(shè)置用戶名密碼
• Kubernetes 之 StorageClass 資源(NFS)
• k8s 部署生產(chǎn)級 elasticsearch+kibana 步驟
• k8s部署 elfk 7.x + X-Pack，使用ConfigMap方式

到了這里，關(guān)于k8s部署Elasticsearch集群+Kibana方案--開啟X-Pack 安全認(rèn)證的文章就介紹完了。如果您還想了解更多內(nèi)容，請在右上角搜索TOY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！