elasticsearch - 为什么我在使用 SSL/TLS 保护我的集群时无法绑定(bind)到 3X.XXX.X.X :[9300-9400],

Question

我在关注 this blog加密我的 Elasticsearch 集群的通信，
当我尝试使用启动 Elasticsearch 时出现以下错误
sudo systemctl 启动 Elasticsearch
我正在使用具有端口暴露 (9215) 和 (5601) 的 GCP 服务器。

[2020-10-13T02:18:40,800][WARN ][o.e.g.DanglingIndicesState] [myNode1] gateway.auto_import_dangling_indices is disabled, dangling indices will not be automatically detected or imported and must be managed manually
[2020-10-13T02:18:41,272][INFO ][o.e.n.Node               ] [myNode1] initialized
[2020-10-13T02:18:41,273][INFO ][o.e.n.Node               ] [myNode1] starting ...
[2020-10-13T02:18:41,505][ERROR][o.e.b.Bootstrap          ] [myNode1] Exception
org.elasticsearch.transport.BindTransportException: Failed to bind to 3X.XXX.X.X:[9300-9400]
        at org.elasticsearch.transport.TcpTransport.bindToPort(TcpTransport.java:408) ~[elasticsearch-7.9.2.jar:7.9.2]
        at org.elasticsearch.transport.TcpTransport.bindServer(TcpTransport.java:372) ~[elasticsearch-7.9.2.jar:7.9.2]
        at org.elasticsearch.transport.netty4.Netty4Transport.doStart(Netty4Transport.java:130) ~[?:?]
        at org.elasticsearch.xpack.core.security.transport.netty4.SecurityNetty4Transport.doStart(SecurityNetty4Transport.java:84) ~[?:?]
        at org.elasticsearch.xpack.security.transport.netty4.SecurityNetty4ServerTransport.doStart(SecurityNetty4ServerTransport.java:46) ~[?:?]
        at org.elasticsearch.common.component.AbstractLifecycleComponent.start(AbstractLifecycleComponent.java:59) ~[elasticsearch-7.9.2.jar:7.9.2]
        at org.elasticsearch.transport.TransportService.doStart(TransportService.java:233) ~[elasticsearch-7.9.2.jar:7.9.2]
        at org.elasticsearch.common.component.AbstractLifecycleComponent.start(AbstractLifecycleComponent.java:59) ~[elasticsearch-7.9.2.jar:7.9.2]
        at org.elasticsearch.node.Node.start(Node.java:778) ~[elasticsearch-7.9.2.jar:7.9.2]
        at org.elasticsearch.bootstrap.Bootstrap.start(Bootstrap.java:317) ~[elasticsearch-7.9.2.jar:7.9.2]
        at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:402) [elasticsearch-7.9.2.jar:7.9.2]
        at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:170) [elasticsearch-7.9.2.jar:7.9.2]
        at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:161) [elasticsearch-7.9.2.jar:7.9.2]
        at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) [elasticsearch-7.9.2.jar:7.9.2]
        at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:127) [elasticsearch-cli-7.9.2.jar:7.9.2]
        at org.elasticsearch.cli.Command.main(Command.java:90) [elasticsearch-cli-7.9.2.jar:7.9.2]
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:126) [elasticsearch-7.9.2.jar:7.9.2]
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92) [elasticsearch-7.9.2.jar:7.9.2]
Caused by: java.net.BindException: Cannot assign requested address
        at sun.nio.ch.Net.bind0(Native Method) ~[?:?]
        at sun.nio.ch.Net.bind(Net.java:550) ~[?:?]
        at sun.nio.ch.ServerSocketChannelImpl.bind(ServerSocketChannelImpl.java:249) ~[?:?]
        at io.netty.channel.socket.nio.NioServerSocketChannel.doBind(NioServerSocketChannel.java:134) ~[?:?]
        at io.netty.channel.AbstractChannel$AbstractUnsafe.bind(AbstractChannel.java:550) ~[?:?]
        at io.netty.channel.DefaultChannelPipeline$HeadContext.bind(DefaultChannelPipeline.java:1334) ~[?:?]
        at io.netty.channel.AbstractChannelHandlerContext.invokeBind(AbstractChannelHandlerContext.java:506) ~[?:?]
        at io.netty.channel.AbstractChannelHandlerContext.bind(AbstractChannelHandlerContext.java:491) ~[?:?]
        at io.netty.channel.DefaultChannelPipeline.bind(DefaultChannelPipeline.java:973) ~[?:?]
        at io.netty.channel.AbstractChannel.bind(AbstractChannel.java:248) ~[?:?]
        at io.netty.bootstrap.AbstractBootstrap$2.run(AbstractBootstrap.java:356) ~[?:?]
        at io.netty.util.concurrent.AbstractEventExecutor.safeExecute(AbstractEventExecutor.java:164) ~[?:?]
        at io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:472) ~[?:?]
        at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:500) ~[?:?]
        at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:989) ~[?:?]
        at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) ~[?:?]
 

似乎 elasticsearc 正在尝试连接到 [9300-9400] 范围内的端口，但由于这些端口未暴露，因此出现错误。
以下是我的/etc/elasticsearch/elasticsearch.yml 文件

# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
cluster.name: myCluster1
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
node.name: myNode1
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
bootstrap.memory_lock: true
#

# ---------------------------------- Network -----------------------------------
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
network.host: myNode1.elastic.test.com
#
# Set a custom port for HTTP:
#
http.port: 9215
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
discovery.seed_hosts: ["myNode1.elastic.test.com"]
#
# Bootstrap the cluster using an initial set of master-eligible nodes:
#
cluster.initial_master_nodes: ["myNode1"]


# ------------------------------Enabling Security ------------------------------
xpack.security.enabled: true
xpack.security.http.ssl.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.http.ssl.key: certs/myNode1.key
xpack.security.http.ssl.certificate: certs/myNode1.crt
xpack.security.http.ssl.certificate_authorities: certs/ca.crt
xpack.security.transport.ssl.key: certs/myNode1.key
xpack.security.transport.ssl.certificate: certs/myNode1.crt
xpack.security.transport.ssl.certificate_authorities: certs/ca.crt

Answer 1

9300-9400范围用于 TCP transport通信，这是节点相互通信的方式，客户端使用 进行通信HTTP ，它使用范围 9200-9299 ，或者在你的情况下，9215 .
既然你设置了network.host至0.0.0.0 ，elasticsearch 将尝试同时绑定(bind) HTTP 和 TCP 端点到您实例中的每个 IP 地址，并且它似乎无法绑定(bind)到 9300-9400 范围内的端口对于transport端点。
看起来您只有一个节点，因此您可以删除 xpack.security.transport.*配置文件中的行，您需要删除 network.host从您的配置中使用http.host相反，这将使 elasticsearch 只绑定(bind) HTTP 端点到您的3X.*.*.* ip地址，transport会绑定(bind)一个loopback地址，你还需要有discovery.type: single-node .
您的 elasticsearch.yml应该是这样的:

cluster.name: myCluster1
node.name: myNode1
bootstrap.memory_lock: true
http.host: myNode1.elastic.test.com
http.port: 9215
discovery.type: single-node
cluster.initial_master_nodes: ["myNode1"]
# security
xpack.security.enabled: true
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.key: certs/myNode1.key
xpack.security.http.ssl.certificate: certs/myNode1.crt
xpack.security.http.ssl.certificate_authorities: certs/ca.crt

如果您有多个节点或计划将来添加更多节点，则需要允许另一个端口用于节点间通信。