0
0

Kubernetes1.23搭建Elasticsearch7集群（集群加密）

一、环境版本

  • Kubernetes1.23.1
  • Elasticsearch7.16.2
  • Kuboard3.3.0
  • Kibana7.16.2
  • Harbor2.4.2

1.知识点分析：
Kubernetes是Google开源的一个容器编排引擎，它支持自动化部署、大规模可伸缩、应用容器化管理。在生产环境中部署一个应用程序时，通常要部署该应用的多个实例以便对应用请求进行负载均衡。
Elasticsearch 是一个分布式、高扩展、高实时的搜索与数据分析引擎。它能很方便的使大量数据具有搜索、分析和探索的能力。充分利用Elasticsearch的水平伸缩性，能使数据在生产环境变得更有价值。
Kuboard，是一款免费的 Kubernetes 图形化管理工具，Kuboard 力图帮助用户快速在 Kubernetes 上落地微服务。
Kibana 是一款开源的数据分析和可视化平台，设计用于和 Elasticsearch 协作。可以使用 Kibana 对 Elasticsearch 索引中的数据进行搜索、查看、交互操作。您可以很方便的利用图表、表格及地图对数据进行多元化的分析和呈现。
Harbor是一个企业级私有 Registry 服务器，Harbor 提供了更好的性能和安全。提升用户使用 Registry 构建和运行环境传输镜像的效率。Harbor 支持安装在多个 Registry 节点的镜像资源复制，镜像全部保存在私有 Registry 中， 确保数据和知识产权在公司内部网络中管控。另外，Harbor 也提供了高级的安全特性，诸如用户管理，访问控制和活动审计等。

2.服务分布：
IP角色主机名pod10.111.13.2mastermaster-1es-master、es-data、es-client10.111.13.4mastermaster-2es-master、es-data、es-client10.111.13.14mastermaster-3es-master、es-data、es-client、kibana10.111.13.5nodenode-1es-data、10.111.13.41nodenode-5es-data、
(主机节点选择无要求，随意挑选5个节点给大家演示的)

二、部署kuboard

文章没写部署的参考之前文章即可：
【Kubernetes+Harbor部署参考】

1.部署kuboard 添加k8s集群
（没有镜像的小伙伴直接拉取docker pull swr.cn-east-2.myhuaweicloud.com/kuboard/kuboard:v3）

  1. docker load --input kuboard-v3.tar    //因离线部署所以需要导入
  2. #启动kuboard容器docker run -d \
  3.   --restart=unless-stopped \
  4.   --name=kuboard \
  5.   -p 8081:80/tcp \
  6.   -p 30081:10081/tcp \
  7.   -e KUBOARD_ENDPOINT="http://10.111.13.2:8081"\
  8.   -e KUBOARD_AGENT_SERVER_TCP_PORT="30081"\
  9.   -v /srv/docker/kuboard:/data \
  10.   swr.cn-east-2.myhuaweicloud.com/kuboard/kuboard:v3

访问地址：http://主机ip:8081/
用户：admin
密码：Kuboard123

2.添加k8s集群：
在这里插入图片描述
在这里插入图片描述
在这里插入图片描述
之后按照提示操作添加即可！

三、部署Elasticsearch7.16.2集群

1.创建StorageClass
（采用本地持久化存储部署）

  1. [root@master-1 es]# cat 00-sc.yaml 
  2. kind: StorageClass                #类别
  3. apiVersion: storage.k8s.io/v1
  4. metadata:
  5.   name: local-storage            #存储类名字
  6. provisioner: kubernetes.io/no-provisioner
  7. volumeBindingMode: WaitForFirstConsumer
  8. [root@master-1 es]# kubectl apply -f  00-sc.yaml

在kuboard上查看：
在这里插入图片描述
2.创建Namespace

  1. [root@master-1 es]# cat 00-ns.yaml 
  2. apiVersion: v1
  3. kind: Namespace            #类别
  4. metadata:
  5.   name: elasticsearch    #名称空间名字
  6.   labels:
  7.     app: elasticsearch
  8. [root@master-1 es]# kubectl apply -f 00-ns.yaml

在这里插入图片描述
3.创建证书
（没有镜像的小伙伴直接拉取 docker pull docker.elastic.co/elasticsearch/elasticsearch:7.16.2)

  1. #利用docker容器创建证书并拷贝到当前目录[root@master-1 es]# docker run --name es-certutil -i -w /tmp docker.elastic.co/elasticsearch/elasticsearch:7.16.2 /bin/sh -c  \"elasticsearch-certutil ca --out /tmp/es-ca.p12 --pass '' && \
  2.     elasticsearch-certutil cert --name security-master --dns \
  3.     security-master --ca /tmp/es-ca.p12 --pass '' --ca-pass '' --out /tmp/elastic-certificates.p12"[root@master-1 es]# docker cp es-certutil:/tmp/elastic-certificates.p12 ./

在这里插入图片描述
将证书创建到k8s集群里：

  1. [root@master-1 es]# kubectl -n elasticsearch create secret generic elastic-certificates --from-file=./elastic-certificates.p12

查看证书：
在这里插入图片描述
4.创建3个Master节点的PV卷

  1. [root@master-1 es]# cat 00-pv-master.yaml 
  2. apiVersion: v1
  3. kind: PersistentVolume
  4. metadata:
  5.   name: local-storage-pv-0     # pv名称
  6.   namespace: elasticsearch      # 空间名称
  7.   labels:
  8.     name: local-storage-pv-0    # 标签名
  9. spec:
  10.   capacity:
  11.     storage: 100Gi              # 容量
  12.   accessModes:
  13.   - ReadWriteOnce
  14.   persistentVolumeReclaimPolicy: Retain    # 回收策略
  15.   storageClassName: local-storage          # 关联的存储类
  16.   local:
  17.     path: /srv/esdata          # 宿主机路径。要手动在主机创建访目录
  18.   nodeAffinity:
  19.     required:
  20.       nodeSelectorTerms:        # 节点选择
  21.       - matchExpressions:
  22.         - key: kubernetes.io/hostname
  23.           operator: In
  24.           values:
  25.           - master-1            # 根据自己节点名称
  26. ---
  27. apiVersion: v1
  28. kind: PersistentVolume
  29. metadata:
  30.   name: local-storage-pv-1
  31.   namespace: elasticsearch
  32.   labels:
  33.     name: local-storage-pv-1
  34. spec:
  35.   capacity:
  36.     storage: 100Gi
  37.   accessModes:
  38.   - ReadWriteOnce
  39.   persistentVolumeReclaimPolicy: Retain
  40.   storageClassName: local-storage
  41.   local:
  42.     path: /srv/esdata 
  43.   nodeAffinity:
  44.     required:
  45.       nodeSelectorTerms:
  46.       - matchExpressions:
  47.         - key: kubernetes.io/hostname
  48.           operator: In
  49.           values:
  50.           - master-2
  51. ---
  52. apiVersion: v1
  53. kind: PersistentVolume
  54. metadata:
  55.   name: local-storage-pv-2
  56.   namespace: elasticsearch
  57.   labels:
  58.     name: local-storage-pv-2
  59. spec:
  60.   capacity:
  61.     storage: 100Gi
  62.   accessModes:
  63.   - ReadWriteOnce
  64.   persistentVolumeReclaimPolicy: Retain
  65.   storageClassName: local-storage
  66.   local:
  67.     path: /srv/esdata 
  68.   nodeAffinity:
  69.     required:
  70.       nodeSelectorTerms:
  71.       - matchExpressions:
  72.         - key: kubernetes.io/hostname
  73.           operator: In
  74.           values:
  75.           - master-3
  76. [root@master-1 es]# kubectl apply -f 00-pv-master.yaml

5.部署Master节点

  1. [root@master-1 es]# cat 01-es-master.yaml 
  2. apiVersion: apps/v1
  3. kind: StatefulSet        #适用于持久化存储集群
  4. metadata:
  5.   namespace: elasticsearch
  6.   name: elasticsearch-master
  7.   labels:
  8.     app: elasticsearch
  9.     role: master    #承担的角色
  10. spec:
  11.   serviceName: elasticsearch-master
  12.   replicas: 3#负载3
  13.   selector:
  14.     matchLabels:
  15.       app: elasticsearch
  16.       role: master
  17.   template:
  18.     metadata:
  19.       labels:
  20.         app: elasticsearch
  21.         role: master
  22.     spec:
  23.       containers:
  24.         - name: elasticsearch
  25.           image: 10.111.13.4:8080/jsjb/docker.elastic.co/elasticsearch/elasticsearch:7.16.2     #私有镜像地址
  26.           command: ["bash", "-c", "ulimit -l unlimited && sysctl -w vm.max_map_count=262144 && chown -R elasticsearch:elasticsearch /usr/share/elasticsearch/data && exec su elasticsearch docker-entrypoint.sh"]
  27.           ports:
  28.             - containerPort: 9200
  29.               name: http
  30.             - containerPort: 9300
  31.               name: transport
  32.           env:
  33.             #- name: discovery.seed_hosts#  value: "elasticsearch-master-0.elasticsearch-master,elasticsearch-master-1.elasticsearch-master,elasticsearch-master-2.elasticsearch-master"
  34.             - name: discovery.seed_hosts    #es集群host（k8s独有的集群命名规则）
  35.               value: "elasticsearch-master-0.elasticsearch-master,elasticsearch-master-1.elasticsearch-master,elasticsearch-master-2.elasticsearch-master,elasticsearch-data-0.elasticsearch-data,elasticsearch-data-1.elasticsearch-data,elasticsearch-data-2.elasticsearch-data,elasticsearch-data-3.elasticsearch-data,elasticsearch-data-4.elasticsearch-data,elasticsearch-client-0.elasticsearch-client,elasticsearch-client-1.elasticsearch-client,elasticsearch-client-2.elasticsearch-client"
  36.             - name: cluster.initial_master_nodes
  37.               value: "elasticsearch-master-0,elasticsearch-master-1,elasticsearch-master-2"
  38.             - name: ES_JAVA_OPTS
  39.               value: -Xms1G -Xmx1G            #限制jvm运行内存
  40.             - name: node.master                #主负责调度
  41.               value: "true"#特别注意打开对应的角色关闭其他角色
  42.             - name: node.ingest                #负责客户端访问
  43.               value: "false"
  44.             - name: node.data                #负责数据存储
  45.               value: "false"
  46.             - name: cluster.name
  47.               value: "elasticsearch"
  48.             - name: node.name
  49.               valueFrom:
  50.                 fieldRef:
  51.                   fieldPath: metadata.name
  52.             - name: xpack.security.enabled
  53.               value: "true"
  54.             - name: xpack.security.transport.ssl.enabled
  55.               value: "true"
  56.             - name: xpack.monitoring.collection.enabled
  57.               value: "true"
  58.             - name: xpack.security.transport.ssl.verification_mode
  59.               value: "certificate"
  60.             - name: xpack.security.transport.ssl.keystore.path
  61.               value: "/usr/share/elasticsearch/config/elastic-certificates.p12"
  62.             - name: xpack.security.transport.ssl.truststore.path
  63.               value: "/usr/share/elasticsearch/config/elastic-certificates.p12"
  65.           volumeMounts:
  66.            - mountPath: /usr/share/elasticsearch/data
  67.              name: pv-storage-elastic-master    #名字要和volumeClaimTemplates的一致
  68.            - name: elastic-certificates            #刚才创建的证书挂载到pod里
  69.              readOnly: true
  70.              mountPath: "/usr/share/elasticsearch/config/elastic-certificates.p12"
  71.              subPath: elastic-certificates.p12
  72.            - mountPath: /etc/localtime
  73.              name: localtime
  74.           securityContext:
  75.             privileged: true
  76.       volumes:
  77.       - name: elastic-certificates
  78.         secret:
  79.           secretName: elastic-certificates
  80.       - hostPath:
  81.           path: /etc/localtime
  82.         name: localtime
  84.   volumeClaimTemplates:
  85.   - metadata:
  86.       name: pv-storage-elastic-master        #volumeMounts会用到
  87.     spec:
  88.       accessModes: ["ReadWriteOnce"]
  89.       storageClassName: "local-storage"#之前创建的存储类名字
  90.       resources:
  91.         requests:
  92.           storage: 100Gi
  93. [root@master-1 es]# kubectl apply -f 01-es-master.yaml

回到kuboard查看
在这里插入图片描述

在这里插入图片描述
6.创建Data节点的PV卷

  1. [root@master-1 es]# cat 00-pv-data.yaml
  2. apiVersion: v1
  3. kind: PersistentVolume
  4. metadata:
  5.   name: local-storage-data-0     # pv名称
  6.   namespace: elasticsearch      # 空间名称
  7.   labels:
  8.     name: local-storage-data-0    # 标签名
  9. spec:
  10.   capacity:
  11.     storage: 100Gi              # 容量
  12.   accessModes:
  13.   - ReadWriteOnce
  14.   persistentVolumeReclaimPolicy: Retain    # 回收策略
  15.   storageClassName: local-storage          # 关联的存储类
  16.   local:
  17.     path: /srv/esnode-data         # 宿主机路径。要手动在主机创建访目录
  18.   nodeAffinity:
  19.     required:
  20.       nodeSelectorTerms:        # 节点选择
  21.       - matchExpressions:
  22.         - key: kubernetes.io/hostname
  23.           operator: In
  24.           values:
  25.           - master-1            # 根据自己节点名称
  26. ---
  27. apiVersion: v1
  28. kind: PersistentVolume
  29. metadata:
  30.   name: local-storage-data-1
  31.   namespace: elasticsearch
  32.   labels:
  33.     name: local-storage-data-1
  34. spec:
  35.   capacity:
  36.     storage: 100Gi
  37.   accessModes:
  38.   - ReadWriteOnce
  39.   persistentVolumeReclaimPolicy: Retain
  40.   storageClassName: local-storage
  41.   local:
  42.     path: /srv/esnode-data
  43.   nodeAffinity:
  44.     required:
  45.       nodeSelectorTerms:
  46.       - matchExpressions:
  47.         - key: kubernetes.io/hostname
  48.           operator: In
  49.           values:
  50.           - master-2
  51. ---
  52. apiVersion: v1
  53. kind: PersistentVolume
  54. metadata:
  55.   name: local-storage-data-2
  56.   namespace: elasticsearch
  57.   labels:
  58.     name: local-storage-data-2
  59. spec:
  60.   capacity:
  61.     storage: 100Gi
  62.   accessModes:
  63.   - ReadWriteOnce
  64.   persistentVolumeReclaimPolicy: Retain
  65.   storageClassName: local-storage
  66.   local:
  67.     path: /srv/esnode-data
  68.   nodeAffinity:
  69.     required:
  70.       nodeSelectorTerms:
  71.       - matchExpressions:
  72.         - key: kubernetes.io/hostname
  73.           operator: In
  74.           values:
  75.           - master-3
  76. ---
  77. apiVersion: v1
  78. kind: PersistentVolume
  79. metadata:
  80.   name: local-storage-data-3
  81.   namespace: elasticsearch
  82.   labels:
  83.     name: local-storage-data-3
  84. spec:
  85.   capacity:
  86.     storage: 100Gi
  87.   accessModes:
  88.   - ReadWriteOnce
  89.   persistentVolumeReclaimPolicy: Retain
  90.   storageClassName: local-storage
  91.   local:
  92.     path: /srv/esnode-data
  93.   nodeAffinity:
  94.     required:
  95.       nodeSelectorTerms:
  96.       - matchExpressions:
  97.         - key: kubernetes.io/hostname
  98.           operator: In
  99.           values:
  100.           - node-1
  101. ---
  102. apiVersion: v1
  103. kind: PersistentVolume
  104. metadata:
  105.   name: local-storage-data-4
  106.   namespace: elasticsearch
  107.   labels:
  108.     name: local-storage-data-4
  109. spec:
  110.   capacity:
  111.     storage: 100Gi
  112.   accessModes:
  113.   - ReadWriteOnce
  114.   persistentVolumeReclaimPolicy: Retain
  115.   storageClassName: local-storage
  116.   local:
  117.     path: /srv/esnode-data
  118.   nodeAffinity:
  119.     required:
  120.       nodeSelectorTerms:
  121.       - matchExpressions:
  122.         - key: kubernetes.io/hostname
  123.           operator: In
  124.           values:
  125.           - node-5
  126. [root@master-1 es]# kubectl apply -f 00-pv-data.yaml

7.部署Data节点
（配置文件就不解释了，同上pv）

  1. [root@master-1 es]# cat 02-es-data.yaml
  2. apiVersion: apps/v1
  3. kind: StatefulSet
  4. metadata:
  5.   namespace: elasticsearch
  6.   name: elasticsearch-data
  7.   labels:
  8.     app: elasticsearch
  9.     role: data
  10. spec:
  11.   serviceName: elasticsearch-data
  12.   replicas: 5
  13.   selector:
  14.     matchLabels:
  15.       app: elasticsearch
  16.       role: data
  17.   template:
  18.     metadata:
  19.       labels:
  20.         app: elasticsearch
  21.         role: data
  22.     spec:
  23.       containers:
  24.         - name: elasticsearch
  25.           image: 10.111.13.4:8080/jsjb/docker.elastic.co/elasticsearch/elasticsearch:7.16.2
  26.           command: ["bash", "-c", "ulimit -l unlimited && sysctl -w vm.max_map_count=262144 && chown -R elasticsearch:elasticsearch /usr/share/elasticsearch/data && exec su elasticsearch docker-entrypoint.sh"]
  27.           ports:
  28.             - containerPort: 9200
  29.               name: http
  30.             - containerPort: 9300
  31.               name: transport
  32.           env:
  33.             #- name: discovery.seed_hosts#  value: "elasticsearch-master-0.elasticsearch-master,elasticsearch-master-1.elasticsearch-master,elasticsearch-master-2.elasticsearch-master"
  34.             - name: discovery.seed_hosts
  35.               value: "elasticsearch-master-0.elasticsearch-master,elasticsearch-master-1.elasticsearch-master,elasticsearch-master-2.elasticsearch-master,elasticsearch-data-0.elasticsearch-data,elasticsearch-data-1.elasticsearch-data,elasticsearch-data-2.elasticsearch-data,elasticsearch-data-3.elasticsearch-data,elasticsearch-data-4.elasticsearch-data,elasticsearch-client-0.elasticsearch-client,elasticsearch-client-1.elasticsearch-client,elasticsearch-client-2.elasticsearch-client"
  36.             - name: cluster.initial_master_nodes
  37.               value: "elasticsearch-master-0,elasticsearch-master-1,elasticsearch-master-2"
  38.             - name: ES_JAVA_OPTS
  39.               value: -Xms1G -Xmx1G
  40.             - name: node.master
  41.               value: "false"
  42.             - name: node.ingest
  43.               value: "false"
  44.             - name: node.data
  45.               value: "true"
  46.             - name: cluster.name
  47.               value: "elasticsearch"
  48.             - name: node.name
  49.               valueFrom:
  50.                 fieldRef:
  51.                   fieldPath: metadata.name
  52.             - name: xpack.security.enabled
  53.               value: "true"
  54.             - name: xpack.security.transport.ssl.enabled
  55.               value: "true"
  56.             - name: xpack.monitoring.collection.enabled
  57.               value: "true"
  58.             - name: xpack.security.transport.ssl.verification_mode
  59.               value: "certificate"
  60.             - name: xpack.security.transport.ssl.keystore.path
  61.               value: "/usr/share/elasticsearch/config/elastic-certificates.p12"
  62.             - name: xpack.security.transport.ssl.truststore.path
  63.               value: "/usr/share/elasticsearch/config/elastic-certificates.p12"
  65.           volumeMounts:
  66.            - mountPath: /usr/share/elasticsearch/data
  67.              name: pv-storage-elastic-data
  68.            - name: elastic-certificates
  69.              readOnly: true
  70.              mountPath: "/usr/share/elasticsearch/config/elastic-certificates.p12"
  71.              subPath: elastic-certificates.p12
  72.            - mountPath: /etc/localtime
  73.              name: localtime
  74.           securityContext:
  75.             privileged: true
  76.       volumes:
  77.       - name: elastic-certificates
  78.         secret:
  79.           secretName: elastic-certificates
  80.       - hostPath:
  81.           path: /etc/localtime
  82.         name: localtime
  84.   volumeClaimTemplates:
  85.   - metadata:
  86.       name: pv-storage-elastic-data
  87.     spec:
  88.       accessModes: ["ReadWriteOnce"]
  89.       storageClassName: "local-storage"
  90.       resources:
  91.         requests:
  92.           storage: 100Gi
  93. [root@master-1 es]# kubectl apply -f 02-es-data.yaml

在这里插入图片描述
在这里插入图片描述
8.创建Client节点的PV卷

  1. [root@master-1 es]# cat 00-pv-client.yaml
  2. apiVersion: v1
  3. kind: PersistentVolume
  4. metadata:
  5.   name: local-storage-client-0     # pv名称
  6.   namespace: elasticsearch      # 空间名称
  7.   labels:
  8.     name: local-storage-client-0    # 标签名
  9. spec:
  10.   capacity:
  11.     storage: 100Gi              # 容量
  12.   accessModes:
  13.   - ReadWriteOnce
  14.   persistentVolumeReclaimPolicy: Retain    # 回收策略
  15.   storageClassName: local-storage          # 关联的存储类
  16.   local:
  17.     path: /srv/esclient-data          # 宿主机路径。要手动在主机创建访目录
  18.   nodeAffinity:
  19.     required:
  20.       nodeSelectorTerms:        # 节点选择
  21.       - matchExpressions:
  22.         - key: kubernetes.io/hostname
  23.           operator: In
  24.           values:
  25.           - master-1            # 根据自己节点名称
  26. ---
  27. apiVersion: v1
  28. kind: PersistentVolume
  29. metadata:
  30.   name: local-storage-client-1
  31.   namespace: elasticsearch
  32.   labels:
  33.     name: local-storage-client-1
  34. spec:
  35.   capacity:
  36.     storage: 100Gi
  37.   accessModes:
  38.   - ReadWriteOnce
  39.   persistentVolumeReclaimPolicy: Retain
  40.   storageClassName: local-storage
  41.   local:
  42.     path: /srv/esclient-data 
  43.   nodeAffinity:
  44.     required:
  45.       nodeSelectorTerms:
  46.       - matchExpressions:
  47.         - key: kubernetes.io/hostname
  48.           operator: In
  49.           values:
  50.           - master-2
  51. ---
  52. apiVersion: v1
  53. kind: PersistentVolume
  54. metadata:
  55.   name: local-storage-client-2
  56.   namespace: elasticsearch
  57.   labels:
  58.     name: local-storage-client-2
  59. spec:
  60.   capacity:
  61.     storage: 100Gi
  62.   accessModes:
  63.   - ReadWriteOnce
  64.   persistentVolumeReclaimPolicy: Retain
  65.   storageClassName: local-storage
  66.   local:
  67.     path: /srv/esclient-data 
  68.   nodeAffinity:
  69.     required:
  70.       nodeSelectorTerms:
  71.       - matchExpressions:
  72.         - key: kubernetes.io/hostname
  73.           operator: In
  74.           values:
  75.           - master-3
  76. [root@master-1 es]# kubectl apply -f 00-pv-client.yaml

9.部署Client节点

  1. [root@master-1 es]# cat  02-es-client.yaml
  2. apiVersion: apps/v1
  3. kind: StatefulSet
  4. metadata:
  5.   namespace: elasticsearch
  6.   name: elasticsearch-client
  7.   labels:
  8.     app: elasticsearch
  9.     role: client
  10. spec:
  11.   serviceName: elasticsearch-client
  12.   replicas: 3
  13.   selector:
  14.     matchLabels:
  15.       app: elasticsearch
  16.       role: client
  17.   template:
  18.     metadata:
  19.       labels:
  20.         app: elasticsearch
  21.         role: client
  22.     spec:
  23.       containers:
  24.         - name: elasticsearch
  25.           image: 10.111.13.4:8080/jsjb/docker.elastic.co/elasticsearch/elasticsearch:7.16.2
  26.           command: ["bash", "-c", "ulimit -l unlimited && sysctl -w vm.max_map_count=262144 && chown -R elasticsearch:elasticsearch /usr/share/elasticsearch/data && exec su elasticsearch docker-entrypoint.sh"]
  27.           ports:
  28.             - containerPort: 9200
  29.               name: http
  30.             - containerPort: 9300
  31.               name: transport
  32.           env:
  33.             #- name: discovery.seed_hosts#  value: "elasticsearch-master-0.elasticsearch-master,elasticsearch-master-1.elasticsearch-master,elasticsearch-master-2.elasticsearch-master"
  34.             - name: discovery.seed_hosts
  35.               value: "elasticsearch-master-0.elasticsearch-master,elasticsearch-master-1.elasticsearch-master,elasticsearch-master-2.elasticsearch-master,elasticsearch-data-0.elasticsearch-data,elasticsearch-data-1.elasticsearch-data,elasticsearch-data-2.elasticsearch-data,elasticsearch-data-3.elasticsearch-data,elasticsearch-data-4.elasticsearch-data,elasticsearch-client-0.elasticsearch-client,elasticsearch-client-1.elasticsearch-client,elasticsearch-client-2.elasticsearch-client"
  36.             - name: cluster.initial_master_nodes
  37.               value: "elasticsearch-master-0,elasticsearch-master-1,elasticsearch-master-2"
  38.             - name: ES_JAVA_OPTS
  39.               value: -Xms1G -Xmx1G
  40.             - name: node.master
  41.               value: "false"
  42.             - name: node.ingest
  43.               value: "true"
  44.             - name: node.data
  45.               value: "false"
  46.             - name: cluster.name
  47.               value: "elasticsearch"
  48.             - name: node.name
  49.               valueFrom:
  50.                 fieldRef:
  51.                   fieldPath: metadata.name
  52.             - name: xpack.security.enabled
  53.               value: "true"
  54.             - name: xpack.security.transport.ssl.enabled
  55.               value: "true"
  56.             - name: xpack.monitoring.collection.enabled
  57.               value: "true"
  58.             - name: xpack.security.transport.ssl.verification_mode
  59.               value: "certificate"
  60.             - name: xpack.security.transport.ssl.keystore.path
  61.               value: "/usr/share/elasticsearch/config/elastic-certificates.p12"
  62.             - name: xpack.security.transport.ssl.truststore.path
  63.               value: "/usr/share/elasticsearch/config/elastic-certificates.p12"
  65.           volumeMounts:
  66.            - mountPath: /usr/share/elasticsearch/data
  67.              name: pv-storage-elastic-client
  68.            - name: elastic-certificates
  69.              readOnly: true
  70.              mountPath: "/usr/share/elasticsearch/config/elastic-certificates.p12"
  71.              subPath: elastic-certificates.p12
  72.            - mountPath: /etc/localtime
  73.              name: localtime
  74.           securityContext:
  75.             privileged: true
  76.       volumes:
  77.       - name: elastic-certificates
  78.         secret:
  79.           secretName: elastic-certificates
  80.       - hostPath:
  81.           path: /etc/localtime
  82.         name: localtime
  84.   volumeClaimTemplates:
  85.   - metadata:
  86.       name: pv-storage-elastic-client
  87.     spec:
  88.       accessModes: ["ReadWriteOnce"]
  89.       storageClassName: "local-storage"
  90.       resources:
  91.         requests:
  92.           storage: 100Gi
  93. [root@master-1 es]# kubectl apply -f 02-es-client.yaml

在这里插入图片描述
在这里插入图片描述

10.创建Service
(用于服务发现使外部服务可以访问使用、固定clusterIP防止重启ip改变无法访问)

  1. [root@master-1 es]# cat 04-es-service.yaml
  2. apiVersion: v1
  3. kind: Service
  4. metadata:
  5.   namespace: elasticsearch
  6.   name: elasticsearch-master
  7.   labels:
  8.     app: elasticsearch
  9.     role: master
  10. spec:
  11.   selector:
  12.     app: elasticsearch
  13.     role: master
  14.   type: NodePort
  15.   ports:
  16.   - port: 9200
  17.     nodePort: 30001
  18.     targetPort: 9200
  19. ---
  20. apiVersion: v1
  21. kind: Service
  22. metadata:
  23.   namespace: elasticsearch
  24.   name: elasticsearch-data
  25.   labels:
  26.     app: elasticsearch
  27.     role: data
  28. spec:
  29.   selector:
  30.     app: elasticsearch
  31.     role: data
  32.   type: NodePort
  33.   ports:
  34.   - port: 9200
  35.     nodePort: 30002
  36.     targetPort: 9200
  37. ---
  38. apiVersion: v1
  39. kind: Service
  40. metadata:
  41.   namespace: elasticsearch
  42.   name: elasticsearch-client
  43.   labels:
  44.     app: elasticsearch
  45.     role: client
  46. spec:
  47.   selector:
  48.     app: elasticsearch
  49.     role: client
  50.   type: NodePort
  51.   ports:
  52.   - port: 9200
  53.     nodePort: 30003
  54.     targetPort: 9200

在这里插入图片描述
11.设置ES集群密码
方法1：随机密码

  1. #设置ES集群密码(如果用的auto自动获取就类似于下面随机)[root@master-1 es]# kubectl -n elasticsearch exec -it $(kubectl -n elasticsearch get pods | grep elasticsearch-master | sed -n 1p | awk '{print $1}') -- bin/elasticsearch-setup-passwords auto -b
  3. Changed password for user apm_system
  4. PASSWORD apm_system = vxko4ZwcjZm6U6PbxsGW
  6. Changed password for user kibana_system
  7. PASSWORD kibana_system = D0XzzEUsicgAWCqK0xZQ
  9. Changed password for user kibana
  10. PASSWORD kibana = D0XzzEUsicgAWCqK0xZQ
  12. Changed password for user logstash_system
  13. PASSWORD logstash_system = 4fmoXf2lofEqQtcq5wt5
  15. Changed password for user beats_system
  16. PASSWORD beats_system = fhndHgNnbgqtNRSIFbHV
  18. Changed password for user remote_monitoring_user
  19. PASSWORD remote_monitoring_user = vRkXsT9VooPz6tYOAriq
  21. Changed password for user elastic
  22. PASSWORD elastic = H8QfDUlp290CHX8L3U2Q

方法2：自定义
  通过kuboard进入master-0容器设置自定义密码：
在这里插入图片描述

  1. ./bin/elasticsearch-setup-passwords interactive

在这里插入图片描述
（回车输入自己自定义密码即可）

集群验证：

  1. curl --user elastic:xxxxx http://10.254.162.248:9200/_cluster/health?pretty

在这里插入图片描述

  1. curl --user elastic:xxxx http://10.254.162.248:9200/_cat/nodes?v

在这里插入图片描述

四、部署Kibana7.16.2

1.创建Secret

  1. #密码写elastic用户的密码（跟上面创建的要相同）
  2. kubectl -n elasticsearch create secret generic elasticsearch-password --from-literal password=xxxxx

在这里插入图片描述
2.部署Kibana
部署前打个标签，通过标签将pod部署到指定节点

  1. kubectl label node master-3 node=master-3
  1. [root@master-1 es]# cat 05-kibana.yaml
  2. apiVersion: v1
  3. kind: ConfigMap            #配置映射
  4. metadata:
  5.   namespace: elasticsearch
  6.   name: kibana-config    #映射配置名字
  7.   labels:
  8.     app: kibana
  9. data:
  10.   kibana.yml: |-
  11.     server.host: 0.0.0.0
  12.     i18n.locale: zh-CN    #中文支持
  13.     elasticsearch:        #es密码设置
  14.       hosts: ${ELASTICSEARCH_HOSTS}
  15.       username: ${ELASTICSEARCH_USER}
  16.       password: ${ELASTICSEARCH_PASSWORD}
  17. ---
  18. kind: Deployment
  19. apiVersion: apps/v1
  20. metadata:
  21.   labels:
  22.     app: kibana
  23.   name: kibana
  24.   namespace: elasticsearch
  25. spec:
  26.   replicas: 1
  27.   revisionHistoryLimit: 10
  28.   selector:
  29.     matchLabels:
  30.       app: kibana
  31.   template:
  32.     metadata:
  33.       labels:
  34.         app: kibana
  35.     spec:
  36.       nodeSelector:                #通过刚才标签下发到指定节点
  37.         node: master-3
  38.       containers:
  39.         - name: kibana
  40.           image: 10.111.13.4:8080/jsjb/kibana/kibana:7.16.2
  41.           ports:
  42.             - containerPort: 5601
  43.               protocol: TCP
  44.           env:
  45.             - name: SERVER_PUBLICBASEURL
  46.               value: "http://0.0.0.0:5601"
  47.             - name: I18N.LOCALE
  48.               value: zh-CN
  49.             - name: ELASTICSEARCH_HOSTS
  50.               value: "http://10.254.162.248:9200"
  51.             - name: ELASTICSEARCH_USER
  52.               value: "elastic"
  53.             - name: ELASTICSEARCH_PASSWORD
  54.               valueFrom:
  55.                 secretKeyRef:
  56.                   name: elasticsearch-password
  57.                   key: password
  58.             - name: xpack.encryptedSavedObjects.encryptionKey
  59.               value: "min-32-byte-long-strong-encryption-key"
  61.           volumeMounts:
  62.           - name: kibana-config
  63.             mountPath: /usr/share/kibana/config/kibana.yml
  64.             readOnly: true
  65.             subPath: kibana.yml
  66.           - mountPath: /etc/localtime
  67.             name: localtime
  68.       volumes:
  69.       - name: kibana-config    #挂在映射配置
  70.         configMap:
  71.           name: kibana-config    #映射配置的名字
  72.       - hostPath:
  73.           path: /etc/localtime
  74.         name: localtime
  75. ---
  76. kind: Service
  77. apiVersion: v1
  78. metadata:
  79.   labels:
  80.     app: kibana
  81.   name: kibana-service
  82.   namespace: elasticsearch
  83. spec:
  84.   ports:
  85.   - port: 5601
  86.     targetPort: 5601
  87.     nodePort: 30004
  88.   type: NodePort
  89.   selector:
  90.     app: kibana
  91. [root@master-1 es]# kubectl apply -f 05-kibana.yaml

在这里插入图片描述
在这里插入图片描述
Kibana上检测集群
在这里插入图片描述
在这里插入图片描述
在这里插入图片描述

五、结束语

到此Kubernetes1.23.1+Elasticsearch7.16.2+Kibana7.16.2部署完毕，部署过程中有疑问的欢迎留言提问，感谢大家一直以来的支持，点点关注收藏吧！后期推出k8s上es集群安装ik分词器教程，欢迎大家来采文呀！

标签： elasticsearch 大数据 搜索引擎
本文转载自: https://blog.csdn.net/qq_43417559/article/details/127346481
版权归原作者 cs阿坤dn 所有， 如有侵权，请联系我们删除。
登录后发布评论

“Kubernetes1.23搭建Elasticsearch7集群（集群加密）”的评论:

还没有评论
关于作者
...
overfit同步小助手
文章同步
相关阅读

网络安全法-网络运行安全

使用selenium/drissionpage时如何阻止chrome自动跳转http到https

docker desktop 里部署的Open WebUI 管理员密码忘记了的处理方法

在ubuntu20.04中搭建onsite比赛运行环境

利用开源的低代码表单设计器FcDesigner高效管理和渲染复杂表单结构

Kafka学习笔记

【前端】浏览器输入url到页面呈现发生了什么？