在数字化时代，数据处理与分析至关重要，Elasticsearch 作为强大的搜索与分析引擎，备受青睐。而通过容器化 Helm 部署，能让其部署与管理更加便捷高效，下面就为你揭开这一技术的神秘面纱。

下载ES Chart包

1、有外网主机下载ES Chart包并推送到Harbor仓库

# 添加helm repo源
$ helm repo add elastic https://helm.elastic.co
"elastic" has been added to your repositories

# 下载ES Chart包
$ helm pull elastic/elasticsearch --version 7.17.3

# 推送到私有Harbor仓库
$ helm push elasticsearch-7.17.3.tgz oci://core.jiaxzeng.com/pluginsPushed: core.jiaxzeng.com/plugins/elasticsearch:7.17.3
Digest: sha256:08adccbb261287f8b7515c3595f7748992b473dbbae0475ca0b6b17535d3ea81

2、kubernetes集群master节点下载Chart包

$ sudo helm pull oci://core.jiaxzeng.com/plugins/elasticsearch --version 7.17.3 --untar --untardir /etc/kubernetes/addons/
Pulled: core.jiaxzeng.com/plugins/elasticsearch:7.17.3
Digest: sha256:08adccbb261287f8b7515c3595f7748992b473dbbae0475ca0b6b17535d3ea81

ES部署配置

生成ES证书

1. 启动制作ES证书容器

$ sudo docker run --name generates-es-certs -d core.jiaxzeng.com/library/elasticsearch/elasticsearch:7.17.3 tail -f /dev/null
ce8b86b4d1eab443a8c629f2c46c8c7e018140233cded03e6253e153a4ef3752

1. 生成CA证书

$ sudo docker exec -it generates-es-certs elasticsearch-certutil ca --out /tmp/elastic-stack-ca.p12 --pass ''
This tool assists you in the generation of X.509 certificates and certificate
signing requests for use with SSL/TLS in the Elastic stack.

The 'ca' mode generates a new 'certificate authority'
This will create a new X.509 certificate and private key that can be used
to sign certificate when running in 'cert' mode.

Use the 'ca-dn' option if you wish to configure the 'distinguished name'
of the certificate authority

By default the 'ca' mode produces a single PKCS#12 output file which holds:
    * The CA certificate
    * The CA's private key

If you elect to generate PEM format certificates (the -pem option), then the output will
be a zip file containing individual files for the CA certificate and private key

1. 生成服务证书

$ sudo docker exec -it generates-es-certs elasticsearch-certutil cert --ca /tmp/elastic-stack-ca.p12 --ca-pass '' --out /tmp/elastic-certificates.p12 --pass ''
This tool assists you in the generation of X.509 certificates and certificate
signing requests for use with SSL/TLS in the Elastic stack.

The 'cert' mode generates X.509 certificate and private keys.
    * By default, this generates a single certificate and key for use
       on a single instance.
    * The '-multiple' option will prompt you to enter details for multiple
       instances and will generate a certificate and key for each one
    * The '-in' option allows for the certificate generation to be automated by describing
       the details of each instance in a YAML file

    * An instance is any piece of the Elastic Stack that requires an SSL certificate.
      Depending on your configuration, Elasticsearch, Logstash, Kibana, and Beats
      may all require a certificate and private key.
    * The minimum required value for each instance is a name. This can simply be the
      hostname, which will be used as the Common Name of the certificate. A full
      distinguished name may also be used.
    * A filename value may be required for each instance. This is necessary when the
      name would result in an invalid file or directory name. The name provided here
      is used as the directory name (within the zip) and the prefix for the key and
      certificate files. The filename is required if you are prompted and the name
      is not displayed in the prompt.
    * IP addresses and DNS names are optional. Multiple values can be specified as a
      comma separated string. If no IP addresses or DNS names are provided, you may
      disable hostname verification in your SSL configuration.

    * All certificates generated by this tool will be signed by a certificate authority (CA)
      unless the --self-signed command line option is specified.
      The tool can automatically generate a new CA for you, or you can provide your own with
      the --ca or --ca-cert command line options.

By default the 'cert' mode produces a single PKCS#12 output file which holds:
    * The instance certificate
    * The private key for the instance certificate
    * The CA certificate

If you specify any of the following options:
    * -pem (PEM formatted output)
    * -keep-ca-key (retain generated CA key)
    * -multiple (generate multiple certificates)
    * -in (generate certificates from an input file)
then the output will be be a zip file containing individual certificate/key files


Certificates written to /tmp/elastic-certificates.p12

This file should be properly secured as it contains the private key for
your instance.

This file is a self contained file and can be copied and used 'as is'
For each Elastic product that you wish to configure, you should copy
this '.p12' file to the relevant configuration directory
and then follow the SSL configuration instructions in the product guide.

For client applications, you may only need to copy the CA certificate and
configure the client to trust this certificate.

1. 拷贝证书

$ sudo docker cp generates-es-certs:/tmp/elastic-certificates.p12 /tmp/

1. 将证书存放在secret上

$ kubectl -n obs-system create secret generic elastic-certificates --from-file=/tmp/elastic-certificates.p12
secret/elastic-certificates created

❝

-n 参数修改实际的部署命名空间。