ES集群索引管理工具-cerebro的部署

1、前言：

所有部署均采用docker+k8s进行，ELK集群由于是采用ECK部署，使用了TLS/SSL,HTTPS证书及BASIC认证，但cerebro官方并未对如何连接HTTPS集群做出指导，本文将从新构建cerebro镜像文件，添加ES跟证书到镜像中，后使用K8S将cerebro部署至集群中，连接ES服务进行管理；

1、导出ES集群CA根证书

mkdir -pv /k8s_yml/cerebro_bulid/certs
cp -rfp ca.crt /k8s_yml/cerebro_bulid/certs

2、制作Dockerfile文件

• vim /k8s_yml/cerebro_bulid/Dockerfile

  FROM openjdk:11-jre-slim
  
  ENV CEREBRO_VERSION 0.9.3
  
  RUN  apt-get update \
      && apt-get install -y wget \
      && rm -rf /var/lib/apt/lists/* \
      && mkdir -p /opt/cerebro/logs \
      && wget -qO- https://github.com/lmenezes/cerebro/releases/download/v${CEREBRO_VERSION}/cerebro-${CEREBRO_VERSION}.tgz \
      | tar xzv --strip-components 1 -C /opt/cerebro \
      && sed -i '/<appender-ref ref="FILE"\/>/d' /opt/cerebro/conf/logback.xml \
      && addgroup -gid 1000 cerebro \
      && adduser -gid 1000 -uid 1000 cerebro \
      && chown -R cerebro:cerebro /opt/cerebro
  
  WORKDIR /opt/cerebro
  
  COPY certs/ca.crt /opt/cerebro
  
  RUN keytool -importcert -file ca.crt -alias esca -cacerts -storepass changeit -noprompt
  
  USER cerebro
  
  ENTRYPOINT [ "/opt/cerebro/bin/cerebro" ]

3、构建基于ES根证书的镜像

cd /k8s_yml/cerebro_bulid/
docker build -t 192.168.6.33/szzt_production/cerebro:0.9.3 .
#上传到私有镜像库
docker push 192.168.6.33/szzt_production/cerebro:0.9.3

4、使用K8S进行部署

• 使用命令式对象管理方式，创建YML文件
• kubectl apply -f cerebro_deploy.yml

  apiVersion: apps/v1
  kind: Deployment
  metadata:
   name: esmng-srv
   namespace: elastic-production
  spec:
   selector:
    matchLabels:
     app: es_mng
   replicas: 1
   template:
    metadata:
     labels:
      app: es_mng
    spec:
     containers:
     - name: esmng-srv
       image: 192.168.6.33/szzt_production/cerebro:0.9.3
       ports:
       - containerPort: 9000
       env:
       #认证类型
       - name: AUTH_TYPE
         value: base
       #ES用户
       - name: BASIC_AUTH_USER
         value: elastic
       #ES密码   
       - name: BASIC_AUTH_PWD
         value: 26v7Aik1wM6Z9Mp1I8V9z4jm
       #通过传参指定ES集群地址
       command: ["/opt/cerebro/bin/cerebro", "-Dhosts.0.host=https://es-cluster-es-http.elastic-production.svc:9200"]
  ---
  apiVersion: v1
  kind: Service
  metadata:
    name: esmng-svc
    namespace: elastic-production
  spec:
    type: NodePort
    selector:
      app: es_mng
    ports:
      - name: web-http
        protocol: TCP
        port: 9000
        targetPort: 9000
        #外部访问端口
        nodePort: 30007

5、访问cerebro页面

• 查看ES集群状态-http://10.255.4.38:30007/