wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.9.3-linux-x86_64.tar.gz

tar xf elasticsearch-7.9.3-linux-x86_64.tar.gz -C /app/

vim /etc/sysctl.conf
vm.max_map_count=655360
net.ipv4.tcp_syncookies=1
net.ipv4.tcp_tw_reuse=1
net.ipv4.tcp_tw_recycle=1
net.ipv4.tcp_fin_timeout=30
net.ipv4.ip_forward=1
sysctl -p  #修改完执行使其生效

vim /etc/security/limits.conf
#新增内容如下：
*    soft    nofile    655360
*    hard    nofile    655360
*    soft    memlock    unlimited
*    hard    memlock    unlimited
*    soft    nproc    65535
*    hard    nproc    65535
*    -    as    unlimited

useradd es && chown -R es.es /app/elasticsearch-7.9.3

[es@k8s-node1 elasticsearch-7.9.3]$ egrep -v "#|^$" config/jvm.options|head -2
-Xms2g
-Xmx2g

[es@k8s-node1 elasticsearch-7.9.3]$ egrep -v "#|^$" bin/elasticsearch|head -2
export JAVA_HOME=/app/elasticsearch-7.9.3/jdk  #所有节点都配置一样
export PATH=$JAVA_HOME/bin:$PATH

[es@k8s-node1 elasticsearch-7.9.3]$ egrep -v "#|^$" config/elasticsearch.yml 
cluster.name: es-cluster #集群名称
node.name: node1  #节点名称
network.host: 192.168.29.175
http.port: 45000
transport.tcp.port: 45001
discovery.seed_hosts: ["192.168.29.175", "192.168.29.176", "192.168.29.182"] #集群主机列表
cluster.initial_master_nodes: ["192.168.29.175", "192.168.29.176", "192.168.29.182"] #可以被集群选举成主节点的成员列表
gateway.recover_after_nodes: 1
bootstrap.memory_lock: true
bootstrap.system_call_filter : false
http.cors.enabled : true
http.cors.allow-origin : "*"
http.cors.allow-methods : OPTIONS, HEAD, GET, POST, PUT, DELETE
http.cors.allow-headers : X-Requested-With,X-Auth-Token,Content-Type, Content-Length
#开启x-pack安全验证
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: elastic-certificates.p12
#path.data: /path/to/data  #数据存储路径
#path.logs: /path/to/logs  #ES日志存储路径

scp -rp elasticsearch-7.9.3 192.168.29.176:/app/
scp -rp elasticsearch-7.9.3 192.168.29.182:/app/

useradd es && chown -R es.es /app/elasticsearch-7.9.3

[es@k8s-node1 elasticsearch-7.9.3]$ /app/elasticsearch-7.9.3/bin/elasticsearch-certutil cert -out config/elastic-certificates.p12 -pass ""
future versions of Elasticsearch will require Java 11; your Java version from [/app/jdk1.8.0_181/jre] does not meet this requirement
This tool assists you in the generation of X.509 certificates and certificate
signing requests for use with SSL/TLS in the Elastic stack.

The ‘cert‘ mode generates X.509 certificate and private keys.
    * By default, this generates a single certificate and key for use
       on a single instance.
    * The ‘-multiple‘ option will prompt you to enter details for multiple
       instances and will generate a certificate and key for each one
    * The ‘-in‘ option allows for the certificate generation to be automated by describing
       the details of each instance in a YAML file

    * An instance is any piece of the Elastic Stack that requires an SSL certificate.
      Depending on your configuration, Elasticsearch, Logstash, Kibana, and Beats
      may all require a certificate and private key.
    * The minimum required value for each instance is a name. This can simply be the
      hostname, which will be used as the Common Name of the certificate. A full
      distinguished name may also be used.
    * A filename value may be required for each instance. This is necessary when the
      name would result in an invalid file or directory name. The name provided here
      is used as the directory name (within the zip) and the prefix for the key and
      certificate files. The filename is required if you are prompted and the name
      is not displayed in the prompt.
    * IP addresses and DNS names are optional. Multiple values can be specified as a
      comma separated string. If no IP addresses or DNS names are provided, you may
      disable hostname verification in your SSL configuration.

    * All certificates generated by this tool will be signed by a certificate authority (CA).
    * The tool can automatically generate a new CA for you, or you can provide your own with the
         -ca or -ca-cert command line options.

By default the ‘cert‘ mode produces a single PKCS#12 output file which holds:
    * The instance certificate
    * The private key for the instance certificate
    * The CA certificate

If you specify any of the following options:
    * -pem (PEM formatted output)
    * -keep-ca-key (retain generated CA key)
    * -multiple (generate multiple certificates)
    * -in (generate certificates from an input file)
then the output will be be a zip file containing individual certificate/key files


Certificates written to /app/elasticsearch-7.9.3/config/elastic-certificates.p12

This file should be properly secured as it contains the private key for 
your instance.

This file is a self contained file and can be copied and used ‘as is‘
For each Elastic product that you wish to configure, you should copy
this ‘.p12‘ file to the relevant configuration directory
and then follow the SSL configuration instructions in the product guide.

scp -rp elastic-certificates.p12 192.168.29.176:/app/elasticsearch-7.9.3/config/
scp -rp elastic-certificates.p12 192.168.29.182:/app/elasticsearch-7.9.3/config/

su -c ‘/app/elasticsearch-7.9.3/bin/elasticsearch -d‘ es

[root@k8s-node1 config]# /app/elasticsearch-7.9.3/bin/elasticsearch-setup-passwords interactive
future versions of Elasticsearch will require Java 11; your Java version from [/app/jdk1.8.0_181/jre] does not meet this requirement
Initiating the setup of passwords for reserved users elastic,apm_system,kibana,kibana_system,logstash_system,beats_system,remote_monitoring_user.
You will be prompted to enter passwords as the process progresses.
Please confirm that you would like to continue [y/N]y


Enter password for [elastic]: 
Reenter password for [elastic]: 
Enter password for [apm_system]: 
Reenter password for [apm_system]: 
Enter password for [kibana_system]: 
Reenter password for [kibana_system]: 
Enter password for [logstash_system]: 
Reenter password for [logstash_system]: 
Enter password for [beats_system]: 
Reenter password for [beats_system]: 
Enter password for [remote_monitoring_user]: 
Reenter password for [remote_monitoring_user]: 
Changed password for user [apm_system]
Changed password for user [kibana_system]
Changed password for user [kibana]
Changed password for user [logstash_system]
Changed password for user [beats_system]
Changed password for user [remote_monitoring_user]
Changed password for user [elastic]

curl -XPUT  -u elastic:elastic -H "Content-Type: application/json" http://192.168.29.175:45000/_cluster/settings -d ‘{"transient": {"cluster": {"max_shards_per_node":10000}}}‘
{"acknowledged":true,"persistent":{},"transient":{"cluster":{"max_shards_per_node":"10000"}}}[root@k8s-node1 config]#

[root@k8s-node1 config]# curl -u elastic:elastic http://192.168.29.175:45000/_cat/health?v
epoch      timestamp cluster    status node.total node.data shards pri relo init unassign pending_tasks max_task_wait_time active_shards_percent
1617093117 08:31:57  es-cluster green           3         3      2   1    0    0        0             0                  -                100.0%