Elasticseach api keys are not enabled

女爷i 2022-11-30 04:17 176阅读 0赞

通过kibina创建api keys测试时，提示我没有开启：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2JvYm96YWk4Ng_size_16_color_FFFFFF_t_70][]

解决方案如下：

1、开启，在elasticsearch.yml中添加配置：

xpack.security.authc.api_key.enabled: true

2、因为api\_key比较敏感，需要TSL加密传输，因此我们还需要配置加密，首先生成证书，在elasticsearch执行目录bin下运行elasticsearch-certgen：./elasticsearch-certgen

![format_png][]

3、解压zip，把crt、key分别拷贝到es的config、kibina的config下（zip中有两个证书，一个ca根证书、一个当前设备相关，这里我们使用ca根证书），elasticsearch.yml配置：

#
    xpack.security.enabled: true
    xpack.security.transport.ssl.enabled: true
    xpack.security.transport.ssl.verification_mode: certificate
    xpack.security.transport.ssl.key: ca.key
    xpack.security.transport.ssl.certificate: ca.crt
    xpack.security.transport.ssl.certificate_authorities: [ "ca.crt" ]
    
    #浏览器访问
    xpack.security.http.ssl.enabled: true
    xpack.security.http.ssl.key:  ca.key
    xpack.security.http.ssl.certificate: ca.crt
    xpack.security.http.ssl.certificate_authorities: [ "ca.crt" ]

4、配置kibina.yml

############
    elasticsearch.username: "elastic"
    elasticsearch.password: "123456"
    
    ###
    elasticsearch.ssl.certificateAuthorities: ["ca.crt"]
    elasticsearch.ssl.verificationMode: certificate
    elasticsearch.hosts: ["https://127.0.0.1:9200"]
    
    
    ###浏览器访问kibina
    server.ssl.enabled: true
    server.ssl.certificate: "ca.crt"
    server.ssl.key: "ca.key"

5、重启es、kibina，再次执行：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2JvYm96YWk4Ng_size_16_color_FFFFFF_t_70 1][]

PS：我得kibina管理页面，一直没有API keys菜单，只有用户和角色管理菜单，不知道为什么，有谁知道原因可以告诉我下：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2JvYm96YWk4Ng_size_16_color_FFFFFF_t_70 2][]

正常情况显示：

![å¨è¿éæå¥å¾çæè¿°][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2N1aTg4NDY1OA_size_16_color_FFFFFF_t_70]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2JvYm96YWk4Ng_size_16_color_FFFFFF_t_70]: /images/20221124/6933fbf1cbf840ae87d270740847d4c6.png
[format_png]: /images/20221124/f1247dd072cf4be79a593878705280c7.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2JvYm96YWk4Ng_size_16_color_FFFFFF_t_70 1]: /images/20221124/e27e502e17074792843c31478490aeed.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2JvYm96YWk4Ng_size_16_color_FFFFFF_t_70 2]: /images/20221124/e0a276ba559d41a0b2bad4b10e4313ff.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2N1aTg4NDY1OA_size_16_color_FFFFFF_t_70]: /images/20221124/bf74aa6ca939426d819563b67b98e0dd.png