es6.8.5集群部署(使用x-pack ssl方式)

Posted 2020-12-18 hxlasky

安装步骤(6.8.5使用x-pack ssl方式)

1.1 环境部署

数据库部署

节点	ip	角色
Host01	192.168.1.134
Host02	192.168.1.135
Host03	192.168.1.85

 

 

 

 

 

 

 

1.2 安装java

安装java，确保版本在1.8以上

[root@localhost ~]# java -version

java version "1.8.0_151"

Java(TM) SE Runtime Environment (build 1.8.0_151-b12)

Java HotSpot(TM) 64-Bit Server VM (build 25.151-b12, mixed mode)

安装部署省略

 

每台机器上都需要安装

 

1.3 创建非root用户

因为es不能在root用户下启动,所以需要创建非root用户,我这里创建crate用户

#useradd yeemiao

 

 

1.4 配置非root用户(yeemiao)环境变量

 

[crate@localhost ~]$ more .bash_profile

# .bash_profile

 

# Get the aliases and functions

if [ -f ~/.bashrc ]; then

        . ~/.bashrc

fi

 

# User specific environment and startup programs

JAVA_HOME=/usr/local/jdk1.8.0_151

PATH=$JAVA_HOME/bin:$PATH:$HOME/bin

 

export PATH

[crate@local

 

 

1.5 /etc/security/limits.conf修改和sysctl修改

在该文件最后面添加如下两项，然后退出重新登录

*        hard    nofile           65536

*        soft    nofile           65536

 

 

[root@localhost /]# sysctl -w vm.max_map_count=262144

 

1.6 下载安装介质

下载地址:https://www.elastic.co/downloads/elasticsearch,我这里下载的是 elasticsearch-6.8.5.tar.gz

 

 

1.7 解压安装

每台机器都要进行安装

[root@localhost soft]# tar -xvf elasticsearch-6.8.5.tar.gz [root@localhost soft]# mv elasticsearch-6.8.5 /home/yeemiao/elasticsearch685_jq

[root@localhost soft]# cd /home/yeemiao

[root@localhost yeemiao]# chown -R yeemiao.yeemiao ./elasticsearch685_jq

 

1.8 创建相关目录

每台机器上都要执行

[root@localhost yeemiao]# su - yeemiao

[yeemiao@localhost ~]$ cd elasticsearch685_jq

[yeemiao@localhost elasticsearch685_jq]$ mkdir data

 

该目录用于存放数据文件

 

 

1.9 修改配置文件

 

 

 

 

 

 

 

vi /home/yeemiao/elasticsearch685_jq/config/elasticsearch.yml

 

cluster.name: jq685 node.name: node-135 path.data: /home/yeemiao/elasticsearch685_jq/data path.logs: /home/yeemiao/elasticsearch685_jq/logs network.host: 192.168.1.135 http.port: 29200 discovery.zen.ping.unicast.hosts: ["192.168.1.134", "192.168.1.135","192.168.1.85"] discovery.zen.minimum_master_nodes: 2

 

将配置文件scp到另外的机器，然后相应修改红色部分

node.name分别修改为node-134和node-85

network.host分别修改为对应机器的ip地址

 

1.10 JVM配置

每台机器都要设置

 

由于Elasticsearch是Java开发的，所以可以通过/etc/elasticsearch/jvm.options配置文件来设定JVM的相关设定。如果没有特殊需求按默认即可。

不过其中还是有两项最重要的-Xmx1g与-Xms1gJVM的最大最小内存。如果太小会导致Elasticsearch刚刚启动就立刻停止。太大会拖慢系统本身

 

 

1.11 设置内存大小

每台机器都要设置

 

vi /home/yeemiao/elasticsearch/bin/elasticsearch

export ES_HEAP_SIZE=4g

 

 

 

同时在配置文件elasticsearch.yml中添加如下项目:

bootstrap.mlockall: true

 

 

 

 

 

1.12 启动

每台机器都要启动

[root@localhost opt]# su - yeemiao

[yeemiao@localhost bin]$ cd /home/yeemiao/elasticsearch685_jq/bin

[yeemiao@localhost bin]$./elasticsearch –d

 

 

1.13 x-pack设置elasticsearch安全访问

es6.8已经可以免费使用xpack了,所以不需要进行破解即可使用了

1.13.1  在任意一台机器上执行elasticsearch-certgen

我这里在192.168.1.134这台机器上执行

[yeemiao@localhost bin]$ ./elasticsearch-certgen Please enter the desired output file [certificate-bundle.zip]: cert.zip Enter instance name: jq685 Enter name for directories and files [jq685]: elasticsearch Enter IP Addresses for instance (comma-separated if more than one) []: 192.168.1.134,192.168.1.135,192.168.1.85 Enter DNS names for instance (comma-separated if more than one) []: node-134,node-135,node-85 Would you like to specify another instance? Press ‘y‘ to continue entering instance information: Certificates written to /home/yeemiao/elasticsearch685_jq/bin/cert.zip   This file should be properly secured as it contains the private keys for all instances and the certificate authority.   After unzipping the file, there will be a directory for each instance containing the certificate and private key. Copy the certificate, key, and CA certificate to the configuration directory of the Elastic product that they will be used for and follow the SSL configuration instructions in the product guide.   For client applications, you may only need to copy the CA certificate and configure the client to trust this certificate.

 

 

 

Enter instance name: jq685 ##这里的实例名称可以自定义设置

 

Enter name for directories and files [jq685]: elasticsearch ##这个是ssl相应文件的目录,可以自定义指定

 

Enter IP Addresses for instance (comma-separated if more than one) []: 192.168.1.134,192.168.1.135,192.168.1.85  ##每个节点的ip

 

Enter DNS names for instance (comma-separated if more than one) []: node-134,node-135,node-85 ##节点名称,配置文件里的node-name定义的值

 

 

 

 

1.13.2  将压缩文件cert.zip分别拷贝到三台机器

将压缩文件cert.zip分别拷贝纸三台机器的 /home/yeemiao/elasticsearch685_jq文件夹下并解压，生成ca和elasticsearch并修改配置文件elasticsearch.yml

 

 

 

 

[yeemiao@localhost config]$ scp cert.zip yeemiao@192.168.1.135:/home/yeemiao/elasticsearch685_jq/config/

[yeemiao@localhost config]$ scp cert.zip yeemiao@192.168.1.85:/home/yeemiao/elasticsearch685_jq/config/

解压

bash-4.2$ cd /home/yeemiao/elasticsearch685_jq/config/

bash-4.2$ unzip cert.zip

 

1.13.3  修改配置文件

每台机器上的配置文件在最后面添加如下内容:

xpack.security.enabled: true

xpack.security.transport.ssl.enabled: true

xpack.ssl.key: elasticsearch/elasticsearch.key

xpack.ssl.certificate: elasticsearch/elasticsearch.crt

xpack.ssl.certificate_authorities: ca/ca.crt

 

 

1.13.4  重新启动

 

 

1.13.5  设置密码

在其中一台机器上执行,我这里在192.168.1.134这台机器上执行,我这里密码全部设置为elastic

[yeemiao@localhost bin]$ ./elasticsearch-setup-passwords interactive

Initiating the setup of passwords for reserved users elastic,apm_system,kibana,logstash_system,beats_system,remote_monitoring_user.

You will be prompted to enter passwords as the process progresses.

Please confirm that you would like to continue [y/N]y

 

 

Enter password for [elastic]:

Reenter password for [elastic]:

Enter password for [apm_system]:

Reenter password for [apm_system]:

Enter password for [kibana]:

Reenter password for [kibana]:

Enter password for [logstash_system]:

Reenter password for [logstash_system]:

Enter password for [beats_system]:

Reenter password for [beats_system]:

Enter password for [remote_monitoring_user]:

Reenter password for [remote_monitoring_user]:

Changed password for user [apm_system]

Changed password for user [kibana]

Changed password for user [logstash_system]

Changed password for user [beats_system]

Changed password for user [remote_monitoring_user]

Changed password for user [elastic]

 

 

 

1.14 验证

curl -u elastic:elastic ‘http://192.168.1.134:29200/_cat/nodes?v‘

curl -u elastic:elastic ‘http://192.168.1.135:29200/_cat/nodes?v‘

curl -u elastic:elastic ‘http://192.168.1.85:29200/_cat/nodes?v‘

curl -u elastic:elastic ‘http://192.168.1.134:29200/_cat/health?v‘