#创建es用户 [root@k8s-master ~]# useradd es #设置es用户密码 [root@k8s-master ~]# passwd es #解压文件 [root@k8s-master ~]# tar -xf elasticsearch-8.11.3-linux-x86_64.tar.gz -C /usr/local/ #创建证书目录 [root@k8s-master ~]# mkdir /usr/local/elasticsearch-8.11.3/config/certs #修改文件拥有者 [root@k8s-master local]# chown -R es:es /usr/local/elasticsearch-8.11.3/
==================================================================================================== ##在第一台服务器节点node1设置集群多节点通信密钥 #切换用户 [root@k8s-master local]# su - es #签发ca证书 [es@k8s-master elasticsearch-8.11.3]$ ./bin/elasticsearch-certutil ca warning: ignoring JAVA_HOME=/usr/local/jdk1.8.0_221; using bundled JDK ... Please enter the desired output file [elastic-stack-ca.p12]: 【回车】 Enter password for elastic-stack-ca.p12 :【回车】
#用ca证书签发节点证书 [es@k8s-master elasticsearch-8.11.3]$ ./bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12 warning: ignoring JAVA_HOME=/usr/local/jdk1.8.0_221; using bundled JDK ... Enter password forCA (elastic-stack-ca.p12) :【回车】 Please enter the desired output file [elastic-certificates.p12]:【回车】 Enter password for elastic-certificates.p12 :【回车】 Certificates written to /usr/local/elasticsearch-8.11.3/elastic-certificates.p12 ... For client applications, you may only need to copy the CA certificate and configure the client to trust this certificate. #将生成证书文件移动至config/certs/目录中 [es@k8s-master elasticsearch-8.11.3]$ mv elastic-* config/certs/
#已存在ca证书路径 Please enter the full pathname to the Certificate Authority that you wish to use for signing your new http certificate. This can be in PKCS#12 (.p12), JKS (.jks) orPEM (.crt, .key, .pem) format. CA Path: /usr/local/elasticsearch-8.11.3/config/certs/elastic-stack-ca.p12 #输入已存在证书密码，没有 Password for elastic-stack-ca.p12:【回车】 #证书有效时间 For how long should your certificate be valid? [5y] 5y ... #是否每个节点都需要生成 Generate a certificate per node? [y/N]n #输入集群所有节点主机名 Enter all the hostnames that you need, one per line. When you are done, press <ENTER> once more to move on to the next step. master node1 node2 You entered the following hostnames. - master - node1 - node2 Is this correct [Y/n]y #输入集群所有节点ip地址 Enter all the IP addresses that you need, one per line. When you are done, press <ENTER> once more to move on to the next step. 10.1.7.20 10.1.7.21 10.1.7.22 You entered the following IP addresses. - 10.1.7.20 - 10.1.7.21 - 10.1.7.22 Is this correct [Y/n]y #是否修改证书配置 Do you wish to change any of these options? [y/N]n #输入密码 If you wish to use a blank password, simply press <enter> at the prompt below. Provide a password for the "http.p12" file: [<ENTER> for none]【回车】 #证书文件保存位置 What filename should be used for the output zip file? [/usr/local/elasticsearch-8.11.3/elasticsearch-ssl-http.zip]【回车】 Zip file written to /usr/local/elasticsearch-8.11.3/elasticsearch-ssl-http.zip #解压缩刚生成得证书zip文件 [es@k8s-master elasticsearch-8.11.3]$ unzip elasticsearch-ssl-http.zip Archive: elasticsearch-ssl-http.zip creating: elasticsearch/ inflating: elasticsearch/README.txt inflating: elasticsearch/http.p12 ... #移动解压后得文件至config/certs/目录中 [es@k8s-master elasticsearch-8.11.3]$ mv elasticsearch/http.p12 kibana/elasticsearch-ca.pem config/certs/
#解压文件到指定目录 [root@k8s-node2 ~]# tar -zxf kibana-8.11.3-linux-x86_64.tar.gz -C /usr/local/
#在ES服务器中生成证书 [root@k8s-node2 bin]# pwd /usr/local/elasticsearch-8.11.3/bin [root@k8s-node2 bin]# cd ^C [root@k8s-node2 bin]# ./elasticsearch-certutil csr -name kibana -dns 10.1.74.22 This tool assists you in the generation of X.509 certificates and certificate ... Please enter the desired output file [csr-bundle.zip]:【回车】
wechat
