如何在不通过 tls 传递 -k 的情况下卷曲 elasticsearch kubernetes 运算符？

Question

您好 ElasticSearch 冠军，

我在 Kubernetes 上从 https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-quickstart.html 部署了 EK。

如果没有 -k 选项，我无法卷曲 ElasticSearch！

curl --cacert ca-bundle.crt -u "elastic:9sg8q9h4tncvdl2srqiptn9z" "https://10.4.1.14:9200"

    curl: (60) Peer's certificate issuer has been marked as not trusted by the user.
    More details here: http://curl.haxx.se/docs/sslcerts.html

        curl performs SSL certificate verification by default, using a "bundle"
         of Certificate Authority (CA) public keys (CA certs). If the default
         bundle file isn't adequate, you can specify an alternate file
         using the --cacert option.
        If this HTTPS server uses a certificate signed by a CA represented in
         the bundle, the certificate verification probably failed due to a
         problem with the certificate (it might be expired, or the name might
         not match the domain name in the URL).
        If you'd like to turn off curl's verification of the certificate, use
         the -k (or --insecure) option.
        [root@quickstart-es-default-0 certs]#

Answer 1

如果您无法在没有 -k 选项的情况下使用 curl 连接弹性搜索。

即curl --cacert public-http.crt -u "elastic:9sg8q9h4tncvdl2srq9ptn9z" "https://35.193.165.24:9200"

注意：上面的 public-http.crt 是 clustername 中的 ca.crt(CA) >>--es-http-certs-public 喜欢 quickstart-es-http-certs-public secret(kubectl get secrets -all-namespaces)

这可以通过在 kind:Elasticsearch 清单中传递运行 curl 命令的 kubernetes cluster-IP/loadbalancer/server-hostname(DNS) 来解决在 subjectAltNames 下如下所示：

cat <<EOF | kubectl apply -f 
apiVersion: elasticsearch.k8s.elastic.co/v1
kind: Elasticsearch
metadata:
  name: quickstart
spec:
  version: 7.6.2
  nodeSets:
  - name: default
    count: 1
    config:
      node.master: true
      node.data: true
      node.ingest: true
      node.store.allow_mmap: false
  http:
    tls:
      selfSignedCertificate:
        subjectAltNames:
        - ip: 10.4.0.16
        - dns: logstash
        - ip: 10.4.0.14
        - ip: 10.8.0.117 
        - ip: 35.193.165.24
        - dns: localhost
EOF

================================================ =============================

root@logstash:/certificates/espod# curl --cacert public-http.crt -u "elastic:9sg8q9h4tncvdl2srq9ptn9z"  "https://35.193.165.24:9200"
{
  "name" : "quickstart-es-default-0",
  "cluster_name" : "quickstart",
  "cluster_uuid" : "H-ftq8B7Q6e4Swuq6mfDew",
  "version" : {
    "number" : "7.6.2",
    "build_flavor" : "default",
    "build_type" : "docker",
    "build_hash" : "ef48eb35cf30adf4db14086e8aabd07ef6fb113f",
    "build_date" : "2020-03-26T06:34:37.794943Z",
    "build_snapshot" : false,
    "lucene_version" : "8.4.0",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"

}

更多参考资料：

1. https://www.elastic.co/guide/en/logstash/7.7/ls-security.html#ls-http-ssl

2. https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-tls-certificates.html