一、前言

    上一篇《docker安装elasticsearch7.16.3集群》未配置身份认证，本篇将介绍如何给集群配置身份认证

二、配置

1、 连接集群中任意一个容器

docker exec -it 容器ID bash

2、为Elasticsearch集群创建一个证书颁发机构

bin/elasticsearch-certutil ca

3、为集群中的每个节点生成证书和私钥（过程需输入密码）

bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12

4、将生成的elastic-certificates.p12拷贝至每个es{编号}/data/cert下（此处省略winscp操作）

5、配置每个es目录下的elasticsearch.yml文件，开启认证

 

# ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
#       Before you set out to tweak and tune the configuration, make sure you
#       understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please consult the documentation for further information on configuration options:
# https://www.elastic.co/guide/en/elasticsearch/reference/index.html
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
#cluster.name: my-application
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
#node.name: node-1
#
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
#path.data: /path/to/data
#
# Path to log files:
#
#path.logs: /path/to/logs
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
#bootstrap.memory_lock: true
#
# Make sure that the heap size is set to about half the memory available
# on the system and that the owner of the process is allowed to use this
# limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
#network.host: 192.168.0.1
#network.host: 0.0.0.0
#
# Set a custom port for HTTP:
#
#http.port: 9200
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
#discovery.seed_hosts: ["host1", "host2"]
#
# Bootstrap the cluster using an initial set of master-eligible nodes:
#
#cluster.initial_master_nodes: ["node-1", "node-2"]
#
# For more information, consult the discovery and cluster formation module documentation.
#
# ---------------------------------- Gateway -----------------------------------
#
# Block initial recovery after a full cluster restart until N nodes are started:
#
#gateway.recover_after_nodes: 3
#
# For more information, consult the gateway module documentation.
#
# ---------------------------------- Various -----------------------------------
#
# Require explicit names when deleting indices:
#
#action.destructive_requires_name: true

network.host: 0.0.0.0 # 同时设置bind_host和publish_host
http.port: 9202  # rest客户端连接端口
transport.tcp.port: 9300  # 集群中节点互相通信端口
node.master: true # 设置master角色
node.data: true # 设置data角色
node.ingest: true # 设置ingest角色 在索引之前，对文档进行预处理，支持pipeline管道，相当于过滤器
node.max_local_storage_nodes: 1 
http.cors.enabled: true # 跨域配置
http.cors.allow-origin: "*" # 跨域配置

# 开启 xpack 身份验证
xpack.security.enabled: true
# 开启 ssl 认证
xpack.security.transport.ssl.enabled: true
# ssl 证书模式
xpack.security.transport.ssl.verification_mode: certificate
# 证书路径
xpack.security.transport.ssl.keystore.path: /usr/share/elasticsearch/data/cert/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: /usr/share/elasticsearch/data/cert/elastic-certificates.p12

5、如果在创建证书的过程中加了密码，需要将你的密码加入到你的Elasticsearch keystore中去。每个节点都需要（提前设置，因为启动后不太好修改）

bin/elasticsearch-keystore add xpack.security.transport.ssl.keystore.secure_password

bin/elasticsearch-keystore add xpack.security.transport.ssl.truststore.secure_password

6、替换对应es/config目录下的elasticsearch.yml

7、重新启动集群

8、连接集群中任意一个容器，设置所有账户密码

bin/elasticsearch-setup-passwords interactive

9、修改kibana.yml，并替换至/usr/kibana/config下

elasticsearch.username: "elastic"
elasticsearch.password: "123456"

参考： https://zhuanlan.zhihu.com/p/91821035