es6.8.5集群部署(使用x-pack ssl方式)

Posted hxlasky

tags:

篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了es6.8.5集群部署(使用x-pack ssl方式)相关的知识,希望对你有一定的参考价值。

安装步骤(6.8.5使用x-pack ssl方式)

1.1 环境部署

数据库部署

节点

ip

角色

Host01

192.168.1.134

 

Host02

192.168.1.135

 

Host03

192.168.1.85

 

 

 

 

 

 

 

 

1.2 安装java

安装java,确保版本在1.8以上

[root@localhost ~]# java -version

java version "1.8.0_151"

Java(TM) SE Runtime Environment (build 1.8.0_151-b12)

Java HotSpot(TM) 64-Bit Server VM (build 25.151-b12, mixed mode)

安装部署省略

 

每台机器上都需要安装

 

1.3 创建非root用户

因为es不能在root用户下启动,所以需要创建非root用户,我这里创建crate用户

#useradd yeemiao

 

 

1.4 配置非root用户(yeemiao)环境变量

 

[crate@localhost ~]$ more .bash_profile

# .bash_profile

 

# Get the aliases and functions

if [ -f ~/.bashrc ]; then

        . ~/.bashrc

fi

 

# User specific environment and startup programs

JAVA_HOME=/usr/local/jdk1.8.0_151

PATH=$JAVA_HOME/bin:$PATH:$HOME/bin

 

export PATH

[crate@local

 

 

1.5 /etc/security/limits.conf修改和sysctl修改

在该文件最后面添加如下两项,然后退出重新登录

*        hard    nofile           65536

*        soft    nofile           65536

 

 

[root@localhost /]# sysctl -w vm.max_map_count=262144

 

1.6 下载安装介质

下载地址:https://www.elastic.co/downloads/elasticsearch,我这里下载的是 elasticsearch-6.8.5.tar.gz

 

 

1.7 解压安装

每台机器都要进行安装

[root@localhost soft]# tar -xvf elasticsearch-6.8.5.tar.gz [root@localhost soft]# mv elasticsearch-6.8.5 /home/yeemiao/elasticsearch685_jq

[root@localhost soft]# cd /home/yeemiao

[root@localhost yeemiao]# chown -R yeemiao.yeemiao ./elasticsearch685_jq

 

1.8 创建相关目录

每台机器上都要执行

[root@localhost yeemiao]# su - yeemiao

[yeemiao@localhost ~]$ cd elasticsearch685_jq

[yeemiao@localhost elasticsearch685_jq]$ mkdir data

 

该目录用于存放数据文件

 

 

1.9 修改配置文件

 

 

 

 

 

 

 

vi /home/yeemiao/elasticsearch685_jq/config/elasticsearch.yml

 

cluster.name: jq685

node.name: node-135

path.data: /home/yeemiao/elasticsearch685_jq/data

path.logs: /home/yeemiao/elasticsearch685_jq/logs

network.host: 192.168.1.135

http.port: 29200

discovery.zen.ping.unicast.hosts: ["192.168.1.134", "192.168.1.135","192.168.1.85"]

discovery.zen.minimum_master_nodes: 2

 

将配置文件scp到另外的机器,然后相应修改红色部分

node.name分别修改为node-134和node-85

network.host分别修改为对应机器的ip地址

 

1.10 JVM配置

每台机器都要设置

 

由于Elasticsearch是Java开发的,所以可以通过/etc/elasticsearch/jvm.options配置文件来设定JVM的相关设定。如果没有特殊需求按默认即可。

不过其中还是有两项最重要的-Xmx1g与-Xms1gJVM的最大最小内存。如果太小会导致Elasticsearch刚刚启动就立刻停止。太大会拖慢系统本身

 

 

1.11 设置内存大小

每台机器都要设置

 

vi /home/yeemiao/elasticsearch/bin/elasticsearch

export ES_HEAP_SIZE=4g

 

 

 

同时在配置文件elasticsearch.yml中添加如下项目:

bootstrap.mlockall: true

 

 

 

 

 

1.12 启动

每台机器都要启动

[root@localhost opt]# su - yeemiao

[yeemiao@localhost bin]$ cd /home/yeemiao/elasticsearch685_jq/bin

[yeemiao@localhost bin]$./elasticsearch –d

 

 

1.13 x-pack设置elasticsearch安全访问

es6.8已经可以免费使用xpack了,所以不需要进行破解即可使用了

1.13.1  在任意一台机器上执行elasticsearch-certgen

我这里在192.168.1.134这台机器上执行

[yeemiao@localhost bin]$ ./elasticsearch-certgen

Please enter the desired output file [certificate-bundle.zip]: cert.zip

Enter instance name: jq685

Enter name for directories and files [jq685]: elasticsearch

Enter IP Addresses for instance (comma-separated if more than one) []: 192.168.1.134,192.168.1.135,192.168.1.85

Enter DNS names for instance (comma-separated if more than one) []: node-134,node-135,node-85

Would you like to specify another instance? Press ‘y‘ to continue entering instance information:

Certificates written to /home/yeemiao/elasticsearch685_jq/bin/cert.zip

 

This file should be properly secured as it contains the private keys for all

instances and the certificate authority.

 

After unzipping the file, there will be a directory for each instance containing

the certificate and private key. Copy the certificate, key, and CA certificate

to the configuration directory of the Elastic product that they will be used for

and follow the SSL configuration instructions in the product guide.

 

For client applications, you may only need to copy the CA certificate and

configure the client to trust this certificate.

 

 

 

Enter instance name: jq685 ##这里的实例名称可以自定义设置

 

Enter name for directories and files [jq685]: elasticsearch ##这个是ssl相应文件的目录,可以自定义指定

 

Enter IP Addresses for instance (comma-separated if more than one) []: 192.168.1.134,192.168.1.135,192.168.1.85  ##每个节点的ip

 

Enter DNS names for instance (comma-separated if more than one) []: node-134,node-135,node-85 ##节点名称,配置文件里的node-name定义的值

 

 

 

 

1.13.2  将压缩文件cert.zip分别拷贝到三台机器

将压缩文件cert.zip分别拷贝纸三台机器的 /home/yeemiao/elasticsearch685_jq文件夹下并解压,生成ca和elasticsearch并修改配置文件elasticsearch.yml

 

 

 

 

[yeemiao@localhost config]$ scp cert.zip yeemiao@192.168.1.135:/home/yeemiao/elasticsearch685_jq/config/

[yeemiao@localhost config]$ scp cert.zip yeemiao@192.168.1.85:/home/yeemiao/elasticsearch685_jq/config/

解压

bash-4.2$ cd /home/yeemiao/elasticsearch685_jq/config/

bash-4.2$ unzip cert.zip

 

1.13.3  修改配置文件

每台机器上的配置文件在最后面添加如下内容:

xpack.security.enabled: true

xpack.security.transport.ssl.enabled: true

xpack.ssl.key: elasticsearch/elasticsearch.key

xpack.ssl.certificate: elasticsearch/elasticsearch.crt

xpack.ssl.certificate_authorities: ca/ca.crt

 

 

1.13.4  重新启动

 

 

1.13.5  设置密码

在其中一台机器上执行,我这里在192.168.1.134这台机器上执行,我这里密码全部设置为elastic

[yeemiao@localhost bin]$ ./elasticsearch-setup-passwords interactive

Initiating the setup of passwords for reserved users elastic,apm_system,kibana,logstash_system,beats_system,remote_monitoring_user.

You will be prompted to enter passwords as the process progresses.

Please confirm that you would like to continue [y/N]y

 

 

Enter password for [elastic]:

Reenter password for [elastic]:

Enter password for [apm_system]:

Reenter password for [apm_system]:

Enter password for [kibana]:

Reenter password for [kibana]:

Enter password for [logstash_system]:

Reenter password for [logstash_system]:

Enter password for [beats_system]:

Reenter password for [beats_system]:

Enter password for [remote_monitoring_user]:

Reenter password for [remote_monitoring_user]:

Changed password for user [apm_system]

Changed password for user [kibana]

Changed password for user [logstash_system]

Changed password for user [beats_system]

Changed password for user [remote_monitoring_user]

Changed password for user [elastic]

 

 

 

1.14 验证

curl -u elastic:elastic ‘http://192.168.1.134:29200/_cat/nodes?v‘

curl -u elastic:elastic ‘http://192.168.1.135:29200/_cat/nodes?v‘

curl -u elastic:elastic ‘http://192.168.1.85:29200/_cat/nodes?v‘

curl -u elastic:elastic ‘http://192.168.1.134:29200/_cat/health?v‘

以上是关于es6.8.5集群部署(使用x-pack ssl方式)的主要内容,如果未能解决你的问题,请参考以下文章

ElasticSearch 集群与x-pack监控集群分开部署

elasticsearch + kibana + x-pack + logstash_集群部署安装

10、es集群开启x-pack安全验证

在 K8S 上部署 ELK 7.14 集群实现采集容器日志

Elastic Search添加X-Pack插件后,head无法访问的问题

es-kibana集群搭建(7.3版本带x-pack)