openseach helm部署

最新推荐文章于 2025-03-08 19:07:10 发布

燕双嘤嘤

最新推荐文章于 2025-03-08 19:07:10 发布

阅读量315

点赞数 3

分类专栏： k8s相关后端服务部署文章标签：中间件

本文链接：https://blog.youkuaiyun.com/weixin_37486553/article/details/145605805

版权

k8s相关后端服务部署专栏收录该内容

3 篇文章

订阅专栏

opensearch部署安装

前置条件

需要有opensearchproject/opensearch和busy镜像，环境中已经安装k8s和helm;文章主要内容涉及opensearch的helm部署和证书配置验证

1、opensearch证书配置

opensearch配置证书，由于jaeger中读取证书的时候默认采取更加安全的方式，默认不会读取domainName参数作为域名，因此需要将证书域名配置在SubjectAltName（对应下面命令中出现的csr.conf中的内容）中生成命令如下

首先生成root-ca.pem根证书和key

openssl genrsa -out root-key.pem  4096

openssl req -x509 -new -nodes -key root-key.pem -sha256 -days 3650 -out root-ca.pem -config csr.conf

csr.conf 内容

[req]
default_bits = 2048
prompt = no
default_md = sha256
distinguished_name = dn
req_extensions = req_ext

[dn]
C = CN
ST = tianjin
L = ceshi
O = ceshi
OU = ceshi
CN = opensearch-cluster-master

[req_ext]
subjectAltName = @alt_names

[alt_names]
DNS.1 = opensearch-cluster-master
DNS.2 = opensearch-cluster-master-0
DNS.3 = opensearch-cluster-master-1
DNS.4 = opensearch-cluster-master-2

生成客户端证书

# 生成客户端证书key
openssl genrsa -out node-key.pem 4096

# 生成客户端证书签名请求
openssl req -new -key node-key.pem -out node.csr -config csr.conf

# 使用根证书签名生成客户端证书
openssl x509 -req -in  node.csr  -CA root-ca.pem  -CAkey root-key.pem  -CAcreateserial -out node-cert.pem -days 365 -extensions req_ext -extfile csr.conf

2、将证书添加到secret中

kubectl -n xp2  create secret  generic  opensearch-secret  --from-file=node-cert.pem --from-file=node-key.pem --from-file=root-ca.pem

3、helm部署中values.yaml配置

需要修改的配置如下（下方配置均在values.yaml中）：

config相关配置，修改其中opensearch.yml中对于tls的配置

config:
  opensearch.yml: |
    cluster.name: opensearch-cluster
    plugins:
      security:
        ssl:
          transport:
            enabled: true
            pemcert_filepath: /usr/share/opensearch/data/certs/node-cert.pem
            pemkey_filepath: /usr/share/opensearch/data/certs/node-key.pem
            pemtrustedcas_filepath: /usr/share/opensearch/data/certs/root-ca.pem
            enforce_hostname_verification: false
            resolve_hostname: false
          http:
            enabled: true
            pemcert_filepath: /usr/share/opensearch/data/certs/node-cert.pem
            pemkey_filepath: /usr/share/opensearch/data/certs/node-key.pem
            pemtrustedcas_filepath: /usr/share/opensearch/data/certs/root-ca.pem
        nodes_dn:
          - "CN=opensearch-cluster-master,OU=kylin,O=kylin,L=kylin,ST=tianjin,C=CN"
          - "CN=opensearch-cluster-master-0,OU=kylin,O=kylin,L=kylin,ST=tianjin,C=CN"
          - "CN=opensearch-cluster-master-1,OU=kylin,O=kylin,L=kylin,ST=tianjin,C=CN"
          - "CN=opensearch-cluster-master-2,OU=kylin,O=kylin,L=kylin,ST=tianjin,C=CN"
        allow_unsafe_democertificates: true

extraEnvs相关配置，配置opensearch服务访问密码

extraEnvs:
  - name: OPENSEARCH_INITIAL_ADMIN_PASSWORD
    value: Kylin@2025

secretMounts相关配置，映射证书到服务中

secretMounts:
  - name: certs-volume
    secretName: opensearch-secret
    path: /usr/share/opensearch/data/certs/

镜像配置,修改成自己可以下载的或者可以访问到的相关对应镜像即可

image:
  repository: "opensearchproject/opensearch"
  # override image tag, which is .Chart.AppVersion by default
  tag: ""
  pullPolicy: "IfNotPresent"

persistence配置,配置opensearch存储，是否持久化（卸载服务数据不丢失）

persistence:
  enabled: true
  enableInitChown: false
  image: busybox
  imageTag: 1.37.0
  labels:
    enabled: false
    additionalLabels: {}
  storageClass: "nfs"
  accessModes:
    - ReadWriteOnce
  size: 8Gi
  annotations: {}

4、安装

opensearch安装，在opensearch目录下（values.yaml所在目录）

helm -n xp install opensearch .

5、验证

验证opensearch服务
下面的ip地址为ks8查询到的opensearch-cluster-master服务的ip地址命令如下

kubectl get svc -n xp2

curl https://10.77.3.213:9200 -u 'admin:ceshi@2025' --insecure

结果如下，服务正常

{
  "name" : "opensearch-cluster-master-2",
  "cluster_name" : "opensearch-cluster",
  "cluster_uuid" : "ndvHTbgmTlmmIhGbYJSHoQ",
  "version" : {
    "distribution" : "opensearch",
    "number" : "2.18.0",
    "build_type" : "tar",
    "build_hash" : "99a9a81da366173b0c2b963b26ea92e15ef34547",
    "build_date" : "2024-10-31T19:08:39.157471098Z",
    "build_snapshot" : false,
    "lucene_version" : "9.12.0",
    "minimum_wire_compatibility_version" : "7.10.0",
    "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "The OpenSearch Project: https://opensearch.org/"
}

验证证书
在hosts中添加服务名和ip映射之后执行下面命令

curl --cacert ../certs2/node-cert.pem  https://opensearch-cluster-master:9200 -u 'admin:ceshi@2025'

结果如下，证书可用

{
  "name" : "opensearch-cluster-master-2",
  "cluster_name" : "opensearch-cluster",
  "cluster_uuid" : "ndvHTbgmTlmmIhGbYJSHoQ",
  "version" : {
    "distribution" : "opensearch",
    "number" : "2.18.0",
    "build_type" : "tar",
    "build_hash" : "99a9a81da366173b0c2b963b26ea92e15ef34547",
    "build_date" : "2024-10-31T19:08:39.157471098Z",
    "build_snapshot" : false,
    "lucene_version" : "9.12.0",
    "minimum_wire_compatibility_version" : "7.10.0",
    "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "The OpenSearch Project: https://opensearch.org/"
}