Rancher 部署带有密码认证 Elasticsearch 服务

Rancher 部署带有密码认证 Elasticsearch 服务

1. 工作负载部署

1. 镜像地址

   172.22.149.31:18888/library/elasticsearch:7.6.2
   

2. 端口映射 NodePort

   9200 -> 31627(随机)
   

3. 环境变量

   node.name=es1
   network.host=0.0.0.0
   discovery.type=single-node
   

4. 配置映射

   新建配置映射，内容如下：

   xpack.security.enabled: true
   xpack.license.self_generated.type: basic
   xpack.security.transport.ssl.enabled: true
   

   

   在数据卷中添加配置映射，如下图：

   

5. 持久化数据目录

   创建 pvc 用于映射 data 目录和 logs 目录，否则数据无法持久化

   

6. 解决挂载目录权限问题

   通过 pvc 挂载的 data 和 logs 目录的所有者是 root, 但是启动容器服务是 elasticsearch 用户，没有写入日志的权限，所以需要修改属主。

   • 修改入口命令为 /bin/bash

     

   • 进入容器命令行

     修改 data 和 log 文件夹属主为 elasticsearch

     chown -R elasticsearch /usr/share/elasticsearch/data
     chown -R elasticsearch /usr/share/elasticsearch/logs
     

     退出容器，将入口命令清空，重启容器

7. 保存启动

   其他配置保持默认即可，启动工作负载，查看日志是否正常。

   

2. 用户密码配置

工作负载启动没有问题后，进入容器命令行，输入下面命令配置密码：

./bin/elasticsearch-setup-passwords  interactive

共 6 个用户，每个用户都需要配置密码，配置完成即可

[5f68784b4-h57lw elasticsearch]# ./bin/elasticsearch-setup-passwords  interactive
Initiating the setup of passwords for reserved users elastic,apm_system,kibana,logstash_system,beats_system,remote_monitoring_user.
You will be prompted to enter passwords as the process progresses.
Please confirm that you would like to continue [y/N]y

Enter password for [elastic]: 
Reenter password for [elastic]: 
Enter password for [apm_system]: 
Reenter password for [apm_system]: 
Enter password for [kibana]: 
Reenter password for [kibana]: 
Enter password for [logstash_system]: 
Reenter password for [logstash_system]: 
Enter password for [beats_system]: 
Reenter password for [beats_system]: 
Enter password for [remote_monitoring_user]: 
Reenter password for [remote_monitoring_user]: 
Changed password for user [apm_system]
Changed password for user [kibana]
Changed password for user [logstash_system]
Changed password for user [beats_system]
Changed password for user [remote_monitoring_user]
Changed password for user [elastic]
[root@elasticsearch-55f68784b4-h57lw elasticsearch]#