创建集群认证

kubectl run es-certutil -n es -it --rm   --image=docker.elastic.co/elasticsearch/elasticsearch:8.10.0 -- bash #进入容器执行

bin/elasticsearch-certutil ca --pem --out config/certs/elastic-stack-ca.zip

config/certs/elastic-stack-ca.zip

mkdir -p config/certs/ca

unzip config/certs/elastic-stack-ca.zip -d config/certs/ca

生成后，新建立一个连接，从容器中拷贝出来，如果退出容器这个容器会自动删除的

cat > /usr/share/elasticsearch/instances.yml <<EOF

instances:

  - name: es-0

    dns:

      - es-0.es.es.svc.cluster.local

      - es-0.es   #es-0为statefulset中pod名称，es为无头服务svc名称

    ip:

      - 127.0.0.1

  - name: es-1

    dns:

      - es-1.es.es.svc.cluster.local

      - es-1.es

    ip:

      - 127.0.0.1

  - name: es-2

    dns:

      - es-2.es.es.svc.cluster.local

      - es-2.es

    ip:

      - 127.0.0.1

EOF



kubectl cp es/es-certutil:/usr/share/elasticsearch/config/certs/es-certs.zip /root/es-certs.zip

kubectl cp es/es-certutil:/usr/share/elasticsearch/config/certs/ca/ca /root/ca

bin/elasticsearch-certutil cert \

  --pem \

  --in instances.yml \

  --out config/certs/es-certs.zip \

  --ca-cert config/certs/ca/ca.crt \

  --ca-key config/certs/ca/ca.key

#创建secret用于挂载到pod

kubectl create secret generic es-certs -n es   --from-file=ca.crt=ca/ca.crt   --from-file=es-0.crt=es-0/es-0.crt   --from-file=es-0.key=es-0/es-0.key   --from-file=es-1.crt=es-1/es-1.crt   --from-file=es-1.key=es-1/es-1.key   --from-file=es-2.crt=es-2/es-2.crt   --from-file=es-2.key=es-2/es-2.key

配置文件部署

cat es_config.yaml 

apiVersion: v1

kind: ConfigMap

metadata:

  name: es-config

  namespace: es

data:

  elasticsearch.yml: |-

    cluster.name: es-cluster

    node.name: ${HOSTNAME}

    network.host: 0.0.0.0



    discovery.seed_hosts: ["es-0.es", "es-1.es", "es-2.es"]

    cluster.initial_master_nodes: ["es-0", "es-1", "es-2"]



    path.data: /usr/share/elasticsearch/data

    path.logs: /usr/share/elasticsearch/logs

    xpack.security.enabled: true

    xpack.security.transport.ssl.enabled: true

    xpack.security.transport.ssl.verification_mode: certificate

    xpack.security.transport.ssl.key: /usr/share/elasticsearch/config/certs/${HOSTNAME}.key

    xpack.security.transport.ssl.certificate: /usr/share/elasticsearch/config/certs/${HOSTNAME}.crt

    xpack.security.transport.ssl.certificate_authorities: [ "/usr/share/elasticsearch/config/certs/ca.crt" ]

    xpack.security.http.ssl.enabled: true

    xpack.security.http.ssl.key: /usr/share/elasticsearch/config/certs/${HOSTNAME}.key

    xpack.security.http.ssl.certificate: /usr/share/elasticsearch/config/certs/${HOSTNAME}.crt

    xpack.security.http.ssl.certificate_authorities: [ "/usr/share/elasticsearch/config/certs/ca.crt" ]

es存储部署

cat es_storageclass.yaml 

apiVersion: storage.k8s.io/v1

kind: StorageClass

metadata:  

  name: local-storage

provisioner: kubernetes.io/no-provisioner

volumeBindingMode: WaitForFirstConsumer





---



cat es_pv.yaml 

apiVersion: v1

kind: PersistentVolume

metadata:

  name: local-pv-node1

spec: 

  capacity:

    storage: 10Gi

  volumeMode: Filesystem

  accessModes:

  - ReadWriteOnce

  persistentVolumeReclaimPolicy: Retain

  storageClassName: local-storage

  local:

    path: /data/elasticsearch-data

  nodeAffinity:

    required:

      nodeSelectorTerms:

      - matchExpressions:

        - key: kubernetes.io/hostname

          operator: In

          values:

          - slave01

---

apiVersion: v1

kind: PersistentVolume

metadata:

  name: local-pv-node2

spec:

  capacity:

    storage: 10Gi

  volumeMode: Filesystem

  accessModes:

  - ReadWriteOnce

  persistentVolumeReclaimPolicy: Retain

  storageClassName: local-storage

  local:

    path: /data/elasticsearch-data

  nodeAffinity:

    required:

      nodeSelectorTerms:

      - matchExpressions:

        - key: kubernetes.io/hostname

          operator: In

          values:

          - slave02

---

apiVersion: v1

kind: PersistentVolume

metadata:

  name: local-pv-node3

spec:

  capacity:

    storage: 10Gi

  volumeMode: Filesystem

  accessModes:

  - ReadWriteOnce

  persistentVolumeReclaimPolicy: Retain

  storageClassName: local-storage

  local:

    path: /data/elasticsearch-data

  nodeAffinity:

    required:

      nodeSelectorTerms:

      - matchExpressions:

        - key: kubernetes.io/hostname

          operator: In

          values:

          - master

无头服务部署

cat es_state.yaml 

apiVersion: apps/v1

kind: StatefulSet

metadata:

  name: es

  namespace: es

spec:

  serviceName: "es"

  replicas: 3

  selector:

    matchLabels:

      app: es

  template:

    metadata:

      labels:

        app: es

    spec:

      securityContext:   #pod级别的默认运行用户以及组等

        runAsUser: 1000  #以uid为1000运行进程

        runAsGroup: 1000 #以gid1000运行

        fsGroup: 1000   #将挂载卷中的文件的属组设为1000

      containers:

      - name: es

        image: docker.elastic.co/elasticsearch/elasticsearch:8.10.0

        ports:

        - containerPort: 9200

          name: http

        - containerPort: 9300

          name: transport  #节点之前通信端口

        env:

        - name: ES_JAVA_OPTS

          value: "-Xms1g  -Xmx1g"

        resources:

          requests:

            memory: 2Gi

            cpu: 1

          limits:

            memory: 2Gi

            cpu: 2

        volumeMounts:

        - name: es-data

          mountPath: /usr/share/elasticsearch/data

        - name: es-config

          mountPath: /usr/share/elasticsearch/config/elasticsearch.yml

          subPath: elasticsearch.yml

        - name: certs

          mountPath: /usr/share/elasticsearch/config/certs 

      volumes:

      - name: es-config

        configMap:

          name: es-config

          items:

          - key: elasticsearch.yml

            path: elasticsearch.yml

      - name: certs

        secret:

          secretName: es-certs

  volumeClaimTemplates:

  - metadata:

      name: es-data

    spec:

      accessModes: ["ReadWriteOnce"]

      storageClassName: local-storage

      resources:

        requests:

          storage: 10Gi

---

apiVersion: v1

kind: Service

metadata:

  name: es

  namespace: es

spec:

  clusterIP: None

  ports:

  - port: 9200

    name: http

  - port: 9300

    name: transport

  selector:

    app: es

配置外部访问

cat es_svc1.yaml

apiVersion: v1

kind: Service

metadata:

  name: es-clusterip

  namespace: es

spec:

  selector:

    app: es

  ports:

    - ports: 9200

      targetPort: 9200

      name: http

  type: ClusterIP

---

apiVersion: networking.k8s.io/v1

kind: Ingress

metadata:

  name: es-ingress

  namespace: es

  annotations:

    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"

    nginx.ingress.kubernetes.io/ssl-passthrough: "true"

spec:

  #ingressClassname: nginx

  ingressClassName: nginx 

  rules:

  - host: es.example.com

    http:

      paths:

      - path: /

        pathType: Prefix

        backend:

          service:

            name: es-clusterip

            port:

              number: 9200