docker 部署Elasticsearch-权限认证(单节点)

浅浅的花香味﹌ 2023-01-20 08:29 396阅读 0赞

# 一、概述 #

## 插件选择 ##

官方资料：[https://www.elastic.co/guide/en/elasticsearch/plugins/current/security.html][https_www.elastic.co_guide_en_elasticsearch_plugins_current_security.html]

### **官方插件 X-Pack** ###

X-Pack 插件在 docker 镜像中默认已安装，不过 X-Pack 中的 Security 模块需要付费才能使用，所以弃用这个插件。

*  付费用户相关资料： [Security Settings in Elasticsearch][]

### **社区插件 Readonly REST** ###

Readonly REST 是 Elasticsearch 原生 REST API 的高性能权限控制插件。

*  官网地址：[https://readonlyrest.com/][https_readonlyrest.com]
 *  Github 地址：[https://github.com/sscarduzio/elasticsearch-readonlyrest-plugin][https_github.com_sscarduzio_elasticsearch-readonlyrest-plugin]
 *  文档地址：[https://github.com/beshu-tech/readonlyrest-docs/blob/master/elasticsearch.md][https_github.com_beshu-tech_readonlyrest-docs_blob_master_elasticsearch.md]

## 环境说明 ##

操作系统：centos 7.6

docker版本：19.03.12

ip地址：192.168.31.190

配置：1核2g

# 二、构建镜像 #

本文使用readonlyrest 插件来构建一个 Elasticsearch 镜像

## 下载插件 ##

这里使用最新版本，目前为：7.12.1

访问官方下载地址：[https://readonlyrest.com/download/][https_readonlyrest.com_download]

![ac239d69d6b2e78aef305ab33aa29ea1.png][]

注意：这里选择免费版本，指定版本为7.12.1，输入一个邮箱地址。这个邮箱地址可以是你的常用邮箱，比如QQ，163，新浪都可以。

点击GET IT NOW，就会收到一封邮件

![d5e9ffe8a4132c97f568a70d7d6b6c67.png][]

点击邮件内容中的Download就会开启下载，这里我们会得到一个文件readonlyrest-1.29.0\_es7.12.1.zip

## 编辑dockerfile ##

登录到centos 7.6服务器，新建目录/opt/elasticsearch\_7.12.1\_security，将readonlyrest-1.29.0\_es7.12.1.zip上传到此目录。

目录结构如下：

./
    ├── dockerfile
    ├── readonlyrest-1.29.0_es7.12.1.zip
    └── readonlyrest.yml

dockerfile

FROM elasticsearch:7.12.1
    
    COPY readonlyrest-1.29.0_es7.12.1.zip /plugins/readonlyrest-1.29.0_es7.12.1.zip
    
    RUN sh -c 'echo -e "y" | /usr/share/elasticsearch/bin/elasticsearch-plugin install -b file:///plugins/readonlyrest-1.29.0_es7.12.1.zip'
    COPY readonlyrest.yml /usr/share/elasticsearch/config/readonlyrest.yml

readonlyrest.yml

readonlyrest:
        access_control_rules:
        - name: "Require HTTP Basic Auth"
          type: allow
          auth_key: admin:Passw0rd

说明，这里指定用户名：admin，密码：Passw0rd

**请根据实际情况修改**

## 构建镜像 ##

cd /opt/elasticsearch_7.12.1_security
    docker build -t elasticsearch:security-7.12.1 .

# 三、部署Elasticsearch #

参考官方文档：[https://www.elastic.co/guide/en/elasticsearch/reference/7.12/docker.html][https_www.elastic.co_guide_en_elasticsearch_reference_7.12_docker.html]

修改文件 /etc/sysctl.conf

增加一行

vm.max_map_count=262144

刷新参数

sysctl -p

## 启动Elasticsearch ##

docker run -d --name=elasticsearch \
      -p 9200:9200 -p 9300:9300 \
      -e "discovery.type=single-node" \
      -e "xpack.security.enabled=false" \
      -e "TZ=Asia/Shanghai" \
      elasticsearch:security-7.12.1

注意：启动时，一定要设置 xpack.security.enabled=false，否则启动会报错

uncaught exception in thread [main]
    java.lang.IllegalArgumentException: Cannot have more than one plugin implementing a REST wrapper
        at org.elasticsearch.action.ActionModule.<init>(ActionModule.java:448)
        at org.elasticsearch.node.Node.<init>(Node.java:575)
        at org.elasticsearch.node.Node.<init>(Node.java:278)
        at org.elasticsearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:217)
        at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:217)
        at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:397)
        at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159)
        at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:150)
        at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:75)
        at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:116)
        at org.elasticsearch.cli.Command.main(Command.java:79)
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:115)
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:81)
    For complete error details, refer to the log at /usr/share/elasticsearch/logs/docker-cluster.log

持久化存储的文件夹

mkdir -p /data/elk7/elasticsearch
    docker cp elasticsearch:/usr/share/elasticsearch /data/elk7/
    chmod g+rwx -R /data/elk7/elasticsearch
    chgrp 1000 -R /data/elk7/elasticsearch

注意：由于docker运行中的elasticsearch用户id是1000，所以这里也设置1000

删除elasticsearch

docker rm -f elasticsearch

挂载目录方式启动

docker run -d --name=elasticsearch \
      -p 9200:9200 -p 9300:9300 \
      -e "discovery.type=single-node" \
      -e "xpack.security.enabled=false" \
      -e "TZ=Asia/Shanghai" \
      -v /usr/share/elasticsearch:/data/elk7/elasticsearch \
      -e "ES_JAVA_OPTS=-Xms512m -Xmx512m" \
      elasticsearch:security-7.12.1

**注意：关于ES\_JAVA\_OPTS参数，堆内存一般设置为内存的一半，请根据实际情况修改。**

## 验证权限 ##

不使用账号密码请求 API，请求失败

[root@centos7 ~]# curl 127.0.0.1:9200/_cat/nodes
    {
         "error":{
         "root_cause":[{
         "reason":"forbidden","due_to":["OPERATION_NOT_ALLOWED"]}],"reason":"forbidden","due_to":["OPERATION_NOT_ALLOWED"],"status":401}}

使用账号密码请求 API，请求成功

[root@centos7 ~]# curl -u admin:Passw0rd 127.0.0.1:9200/_cat/nodes
    172.17.0.2 20 93 0 0.00 0.01 0.05 cdfhilmrstw * f74fd2ea4785

## 补充知识点 ##

Kibana 连接 Elasticsearch

docker run -d \
     --name kibana \
     --link elasticsearch:elasticsearch \
     -e "ELASTICSEARCH_USERNAME=admin" \
     -e "ELASTICSEARCH_PASSWORD=Passw0rd" \
     -e "TZ=Asia/Shanghai" \
     -p 5601:5601 \
     kibana:7.12.1

*  Kibana Docker 部署文档：[https://www.elastic.co/guide/en/kibana/current/docker.html][https_www.elastic.co_guide_en_kibana_current_docker.html]
 *  Kibana 配置文档：[https://www.elastic.co/guide/en/kibana/current/settings.html][https_www.elastic.co_guide_en_kibana_current_settings.html]

本文参考链接：

[https://www.jianshu.com/p/d6a54b498283][https_www.jianshu.com_p_d6a54b498283]

[https://blog.csdn.net/JISOOLUO/article/details/104739013][https_blog.csdn.net_JISOOLUO_article_details_104739013]

[https_www.elastic.co_guide_en_elasticsearch_plugins_current_security.html]: https://links.jianshu.com/go?to=https%3A%2F%2Fwww.elastic.co%2Fguide%2Fen%2Felasticsearch%2Fplugins%2Fcurrent%2Fsecurity.html
[Security Settings in Elasticsearch]: https://links.jianshu.com/go?to=https%3A%2F%2Fwww.elastic.co%2Fguide%2Fen%2Felasticsearch%2Freference%2F6.6%2Fsecurity-settings.html
[https_readonlyrest.com]: https://links.jianshu.com/go?to=https%3A%2F%2Freadonlyrest.com%2F
[https_github.com_sscarduzio_elasticsearch-readonlyrest-plugin]: https://links.jianshu.com/go?to=https%3A%2F%2Fgithub.com%2Fsscarduzio%2Felasticsearch-readonlyrest-plugin
[https_github.com_beshu-tech_readonlyrest-docs_blob_master_elasticsearch.md]: https://links.jianshu.com/go?to=https%3A%2F%2Fgithub.com%2Fbeshu-tech%2Freadonlyrest-docs%2Fblob%2Fmaster%2Felasticsearch.md
[https_readonlyrest.com_download]: https://readonlyrest.com/download/
[ac239d69d6b2e78aef305ab33aa29ea1.png]: /images/20221021/9e9f8d441f9b4031a1a272443846f8c4.png
[d5e9ffe8a4132c97f568a70d7d6b6c67.png]: /images/20221021/cad7ea72bb3f4588b0e170ef3f1bbb1d.png
[https_www.elastic.co_guide_en_elasticsearch_reference_7.12_docker.html]: https://www.elastic.co/guide/en/elasticsearch/reference/7.12/docker.html
[https_www.elastic.co_guide_en_kibana_current_docker.html]: https://links.jianshu.com/go?to=https%3A%2F%2Fwww.elastic.co%2Fguide%2Fen%2Fkibana%2Fcurrent%2Fdocker.html
[https_www.elastic.co_guide_en_kibana_current_settings.html]: https://links.jianshu.com/go?to=https%3A%2F%2Fwww.elastic.co%2Fguide%2Fen%2Fkibana%2Fcurrent%2Fsettings.html
[https_www.jianshu.com_p_d6a54b498283]: https://www.jianshu.com/p/d6a54b498283
[https_blog.csdn.net_JISOOLUO_article_details_104739013]: https://blog.csdn.net/JISOOLUO/article/details/104739013