ElasticSearch 与 Kibana 的 Helm Chart 模板是 ES 官方 Github 获取的，它的 Github 地址为 https://github.com/elastic/helm-charts 可以访问该地址了解更多信息。

这里只介绍下如何使用 Helm 安装 ElasticSearch 与 Kibana 应用。

环境以及版本信息

软件 版本
Kubernetes 1.17.2
Elasticsearch 7.10.1
Kibana 7.10.1

项目部署在Kubernetes中的elastic命名空间下 kubectl create ns elastic

添加Elastic仓库

（1）、添加Elastic仓库

  1. helm repo add elastic https://helm.elastic.co
  2. helm repo update

（2）、将Elastic Chart包下载到本地

  1. helm pull elastic/elasticsearch

配置ES集群证书

（1）、下载镜像

  1. docker pull docker.elastic.co/elasticsearch/elasticsearch:7.10.1

（2）、制作证书

  1. # 运行容器生成证书
  2. $ docker run --name elastic-charts-certs -i -w /app docker.elastic.co/elasticsearch/elasticsearch:7.10.1 /bin/sh -c  \
  3.   "elasticsearch-certutil ca --out /app/elastic-stack-ca.p12 --pass '' && \
  4.     elasticsearch-certutil cert --name security-master --dns \
  5.     security-master --ca /app/elastic-stack-ca.p12 --pass '' --ca-pass '' --out /app/elastic-certificates.p12"
  7. # 从容器中将生成的证书拷贝出来
  8. $ docker cp elastic-charts-certs:/app/elastic-certificates.p12 ./ 
  10. # 删除容器
  11. $ docker rm -f elastic-charts-certs
  13. # 将 pcks12 中的信息分离出来，写入文件
  14. $ openssl pkcs12 -nodes -passin pass:'' -in elastic-certificates.p12 -out elastic-certificate.pem

（3）、添加证书到Kubernetes

  1. $ kubectl create secret -n elastic generic elastic-certificates --from-file=elastic-certificates.p12
  2. $ kubectl create secret -n elastic generic elastic-certificate-pem --from-file=elastic-certificate.pem

（4）、设置集群用户名和密码

  1. $ kubectl create secret -n elastic generic elastic-credentials \
  2.   --from-literal=username=elastic --from-literal=password=elastic@123456

部署ES

（1）、创建Elastic master、data、client节点的配置文件
es-master-values.yaml

  1. # ============设置集群名称============
  2. ## 设置集群名称
  3. clusterName: "elasticsearch"
  4. ## 设置节点名称
  5. nodeGroup: "master"
  6. ## 设置角色
  7. roles:
  8.   master: "true"
  9.   ingest: "false"
  10.   data: "false"
  12. # ============镜像配置============
  13. ## 指定镜像与镜像版本
  14. image: "docker.elastic.co/elasticsearch/elasticsearch"
  15. imageTag: "7.10.1"
  16. ## 副本数
  17. replicas: 1
  19. # ============资源配置============
  20. ## JVM 配置参数
  21. esJavaOpts: "-Xmx1g -Xms1g"
  22. ## 部署资源配置(生成环境一定要设置大些)
  23. resources:
  24.   requests:
  25.     cpu: "1000m"
  26.     memory: "1Gi"
  27.   limits:
  28.     cpu: "1000m"
  29.     memory: "1Gi"
  30. ## 数据持久卷配置
  31. persistence:
  32.   enabled: true
  33. ## 存储数据大小配置
  34. volumeClaimTemplate:
  35.   storageClassName: managed-nfs-storage 
  36.   accessModes: [ "ReadWriteOnce" ]
  37.   resources:
  38.     requests:
  39.       storage: 5Gi
  41. # ============安全配置============
  42. ## 设置协议，可配置为 http、https
  43. protocol: http
  44. ## 证书挂载配置，这里我们挂入上面创建的证书
  45. secretMounts:
  46.   - name: elastic-certificates
  47.     secretName: elastic-certificates
  48.     path: /usr/share/elasticsearch/config/certs
  49. ## 允许您在/usr/share/elasticsearch/config/中添加任何自定义配置文件,例如 elasticsearch.yml
  50. ## ElasticSearch 7.x 默认安装了 x-pack 插件，部分功能免费，这里我们配置下
  51. ## 下面注掉的部分为配置 https 证书，配置此部分还需要配置 helm 参数 protocol 值改为 https
  52. esConfig:
  53.   elasticsearch.yml: |
  54.     xpack.security.enabled: true
  55.     xpack.security.transport.ssl.enabled: true
  56.     xpack.security.transport.ssl.verification_mode: certificate
  57.     xpack.security.transport.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
  58.     xpack.security.transport.ssl.truststore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
  59.     # xpack.security.http.ssl.enabled: true
  60.     # xpack.security.http.ssl.truststore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
  61.     # xpack.security.http.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
  62. ## 环境变量配置，这里引入上面设置的用户名、密码 secret 文件
  63. extraEnvs:
  64.   - name: ELASTIC_USERNAME
  65.     valueFrom:
  66.       secretKeyRef:
  67.         name: elastic-credentials
  68.         key: username
  69.   - name: ELASTIC_PASSWORD
  70.     valueFrom:
  71.       secretKeyRef:
  72.         name: elastic-credentials
  73.         key: password
  75. # ============调度配置============
  76. ## 设置调度策略
  77. ## - hard：只有当有足够的节点时 Pod 才会被调度，并且它们永远不会出现在同一个节点上
  78. ## - soft：尽最大努力调度
  79. antiAffinity: "hard"
  80. ## 容忍配置（一般 kubernetes master 或其它设置污点的节点，只有指定容忍才能进行调度，如果测试环境只有三个节点，则可以开启在 master 节点安装应用）
  81. #tolerations: 
  82. #  - operator: "Exists"  ##容忍全部污点

es-data-values.yaml

  1. # ============设置集群名称============
  2. ## 设置集群名称
  3. clusterName: "elasticsearch"
  4. ## 设置节点名称
  5. nodeGroup: "data"
  6. ## 设置角色
  7. roles:
  8.   master: "false"
  9.   ingest: "true"
  10.   data: "true"
  12. # ============镜像配置============
  13. ## 指定镜像与镜像版本
  14. image: "docker.elastic.co/elasticsearch/elasticsearch"
  15. imageTag: "7.10.1"
  16. ## 副本数
  17. replicas: 1
  19. # ============资源配置============
  20. ## JVM 配置参数
  21. esJavaOpts: "-Xmx1g -Xms1g"
  22. ## 部署资源配置(生成环境一定要设置大些)
  23. resources:
  24.   requests:
  25.     cpu: "1000m"
  26.     memory: "2Gi"
  27.   limits:
  28.     cpu: "1000m"
  29.     memory: "2Gi"
  30. ## 数据持久卷配置
  31. persistence:
  32.   enabled: true
  33. ## 存储数据大小配置
  34. volumeClaimTemplate:
  35.   storageClassName: managed-nfs-storage 
  36.   accessModes: [ "ReadWriteOnce" ]
  37.   resources:
  38.     requests:
  39.       storage: 10Gi
  41. # ============安全配置============
  42. ## 设置协议，可配置为 http、https
  43. protocol: http
  44. ## 证书挂载配置，这里我们挂入上面创建的证书
  45. secretMounts:
  46.   - name: elastic-certificates
  47.     secretName: elastic-certificates
  48.     path: /usr/share/elasticsearch/config/certs
  49. ## 允许您在/usr/share/elasticsearch/config/中添加任何自定义配置文件,例如 elasticsearch.yml
  50. ## ElasticSearch 7.x 默认安装了 x-pack 插件，部分功能免费，这里我们配置下
  51. ## 下面注掉的部分为配置 https 证书，配置此部分还需要配置 helm 参数 protocol 值改为 https
  52. esConfig:
  53.   elasticsearch.yml: |
  54.     xpack.security.enabled: true
  55.     xpack.security.transport.ssl.enabled: true
  56.     xpack.security.transport.ssl.verification_mode: certificate
  57.     xpack.security.transport.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
  58.     xpack.security.transport.ssl.truststore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
  59.     # xpack.security.http.ssl.enabled: true
  60.     # xpack.security.http.ssl.truststore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
  61.     # xpack.security.http.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
  62. ## 环境变量配置，这里引入上面设置的用户名、密码 secret 文件
  63. extraEnvs:
  64.   - name: ELASTIC_USERNAME
  65.     valueFrom:
  66.       secretKeyRef:
  67.         name: elastic-credentials
  68.         key: username
  69.   - name: ELASTIC_PASSWORD
  70.     valueFrom:
  71.       secretKeyRef:
  72.         name: elastic-credentials
  73.         key: password
  75. # ============调度配置============
  76. ## 设置调度策略
  77. ## - hard：只有当有足够的节点时 Pod 才会被调度，并且它们永远不会出现在同一个节点上
  78. ## - soft：尽最大努力调度
  79. antiAffinity: "hard"
  80. ## 容忍配置（一般 kubernetes master 或其它设置污点的节点，只有指定容忍才能进行调度，如果测试环境只有三个节点，则可以开启在 master 节点安装应用）
  81. #tolerations: 
  82. #  - operator: "Exists"  ##容忍全部污点

es-client-values.yaml

  1. # ============设置集群名称============
  2. ## 设置集群名称
  3. clusterName: "elasticsearch"
  4. ## 设置节点名称
  5. nodeGroup: "client"
  6. ## 设置角色
  7. roles:
  8.   master: "false"
  9.   ingest: "false"
  10.   data: "false"
  12. # ============镜像配置============
  13. ## 指定镜像与镜像版本
  14. image: "docker.elastic.co/elasticsearch/elasticsearch"
  15. imageTag: "7.10.1"
  16. ## 副本数
  17. replicas: 1
  19. # ============资源配置============
  20. ## JVM 配置参数
  21. esJavaOpts: "-Xmx1g -Xms1g"
  22. ## 部署资源配置(生成环境一定要设置大些)
  23. resources:
  24.   requests:
  25.     cpu: "1000m"
  26.     memory: "1Gi"
  27.   limits:
  28.     cpu: "1000m"
  29.     memory: "1Gi"
  30. ## 数据持久卷配置
  31. persistence:
  32.   enabled: false
  34. # ============安全配置============
  35. ## 设置协议，可配置为 http、https
  36. protocol: http
  37. ## 证书挂载配置，这里我们挂入上面创建的证书
  38. secretMounts:
  39.   - name: elastic-certificates
  40.     secretName: elastic-certificates
  41.     path: /usr/share/elasticsearch/config/certs
  42. ## 允许您在/usr/share/elasticsearch/config/中添加任何自定义配置文件,例如 elasticsearch.yml
  43. ## ElasticSearch 7.x 默认安装了 x-pack 插件，部分功能免费，这里我们配置下
  44. ## 下面注掉的部分为配置 https 证书，配置此部分还需要配置 helm 参数 protocol 值改为 https
  45. esConfig:
  46.   elasticsearch.yml: |
  47.     xpack.security.enabled: true
  48.     xpack.security.transport.ssl.enabled: true
  49.     xpack.security.transport.ssl.verification_mode: certificate
  50.     xpack.security.transport.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
  51.     xpack.security.transport.ssl.truststore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
  52.     # xpack.security.http.ssl.enabled: true
  53.     # xpack.security.http.ssl.truststore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
  54.     # xpack.security.http.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
  55. ## 环境变量配置，这里引入上面设置的用户名、密码 secret 文件
  56. extraEnvs:
  57.   - name: ELASTIC_USERNAME
  58.     valueFrom:
  59.       secretKeyRef:
  60.         name: elastic-credentials
  61.         key: username
  62.   - name: ELASTIC_PASSWORD
  63.     valueFrom:
  64.       secretKeyRef:
  65.         name: elastic-credentials
  66.         key: password

（2）、创建应用

  1. # 创建Master节点
  2. $ helm install elasticsearch-master -f es-master-values.yaml --namespace elastic --version 7.10.1 elasticsearch
  3. # 创建Data节点
  4. $ helm install elasticsearch-data -f es-data-values.yaml --namespace elastic --version 7.10.1 elasticsearch
  5. # 创建Client节点
  6. $ helm install elasticsearch-client -f es-client-values.yaml --namespace elastic --version 7.10.1 elasticsearch

部署kibana

（1）、下载kibana的chart包

  1. $ helm pull elastic/kibana

（2）、添加kibana配置文件
values.yaml

  1. ---
  2. elasticsearchHosts: "http://elasticsearch-client:9200"
  3. replicas: 1
  4. extraEnvs:
  5.   - name: 'ELASTICSEARCH_USERNAME'
  6.     valueFrom:
  7.       secretKeyRef:
  8.         name: elastic-credentials
  9.         key: username
  10.   - name: 'ELASTICSEARCH_PASSWORD'
  11.     valueFrom:
  12.       secretKeyRef:
  13.         name: elastic-credentials
  14.         key: password
  15. envFrom: []
  16. secretMounts: []
  17. image: "docker.elastic.co/kibana/kibana"
  18. imageTag: "7.10.1"
  19. imagePullPolicy: "IfNotPresent"
  20. labels: {}
  21. podAnnotations: {}
  22. resources:
  23.   requests:
  24.     cpu: "1000m"
  25.     memory: "2Gi"
  26.   limits:
  27.     cpu: "1000m"
  28.     memory: "2Gi"
  29. protocol: http
  30. serverHost: "0.0.0.0"
  31. healthCheckPath: "/app/kibana"
  32. kibanaConfig: 
  33.   kibana.yml: |
  34.     i18n.locale: "zh-CN"
  35. podSecurityContext:
  36.   fsGroup: 1000
  37. securityContext:
  38.   capabilities:
  39.     drop:
  40.     - ALL
  41.   runAsNonRoot: true
  42.   runAsUser: 1000
  43. serviceAccount: ""
  44. priorityClassName: ""
  45. httpPort: 5601
  46. extraContainers: ""
  47. extraInitContainers: ""
  48. updateStrategy:
  49.   type: "Recreate"
  50. service:
  51.   type: ClusterIP
  52.   loadBalancerIP: ""
  53.   port: 5601
  54.   nodePort: ""
  55.   labels: {}
  56.   annotations: {}
  57.   loadBalancerSourceRanges: []
  58.   httpPortName: http
  59. ingress:
  60.   enabled: true
  61.   annotations: {}
  62.   path: /
  63.   hosts:
  64.     - kibana-test.xxx.com 
  65.   tls: []
  66. readinessProbe:
  67.   failureThreshold: 3
  68.   initialDelaySeconds: 10
  69.   periodSeconds: 10
  70.   successThreshold: 3
  71.   timeoutSeconds: 5
  72. imagePullSecrets: []
  73. nodeSelector: {}
  74. tolerations: []
  75. affinity: {}
  76. nameOverride: ""
  77. fullnameOverride: ""
  78. lifecycle: {}

（3）、部署kibana

  1. $ helm install kibana -n elastic kibana

待所以pod变成running，即可通过kibana进行访问。
image.png