elasticsearch - Elasticsearch Helm chart 上的HTTPS

Question

我正在尝试在Elasticsearch上设置基本身份验证。我发现还需要设置SSL证书。
在本文之后:https://pimwiddershoven.nl/entry/deploy-a-secure-instance-of-elasticsearch-on-kubernetes
使用Helm在Kubernetes上启动集群并运行
但是发送时

curl -H "Authorization: Basic ZWxsdfasdfiojoijQw==" https://localhost:9200

它给像这样的错误

curl: (60) SSL certificate problem: self signed certificate in certificate chain
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

但是当使用 curl insecure模式或 -k发送请求时，它工作正常并且可以看到集群运行状况
这是由于自签名证书。我想念什么吗？
官方 Helm 图还建议了生成证书并添加到集群的相同方法。
https://github.com/elastic/helm-charts/tree/master/elasticsearch/examples/security
更新:

Elastic.yaml

protocol: https

esConfig:
  elasticsearch.yml: |
    xpack.security.enabled: true
    xpack.security.transport.ssl.enabled: true
    xpack.security.transport.ssl.verification_mode: certificate
    xpack.security.transport.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
    xpack.security.transport.ssl.truststore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
    xpack.security.http.ssl.enabled: true
    xpack.security.http.ssl.truststore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
    xpack.security.http.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
    xpack.security.authc.realms.native.local.order: 0

extraEnvs:
  - name: ELASTIC_PASSWORD
    valueFrom:
      secretKeyRef:
        name: elastic-credentials
        key: password
  - name: ELASTIC_USERNAME
    valueFrom:
      secretKeyRef:
        name: elastic-credentials
        key: username

secretMounts:
  - name: elastic-certificates
    secretName: elastic-certificates
    path: /usr/share/elasticsearch/config/certs

Answer 1

如果您尝试在Kubernetes svc上设置HTTPS并将其用作DNS，那么如果没有curl -k或--insecure，它将无法正常工作
除非并且直到您没有适当的DNS且无法解决域名时，否则您必须仅使用不安全模式。
使用正确的域名并生成证书，它将像魅力一样工作。
但是，为了进行验证，您还可以执行以下操作:

curl --cacert $path_to_certificate https://host_ip:9200

简易解决方案
您可以在ES群集之前使用nginx并在那里终止SSL并将HTTP请求发送到ES。而直到nginx的域都将具有HTTPS SSL / TLS。
如果您只想使用仅HTTP的基本身份验证(用户名/密码)

esConfig:
  elasticsearch.yml: |
    xpack.security.enabled: true
    xpack.security.transport.ssl.enabled: true
    xpack.security.transport.ssl.verification_mode: certificate
    xpack.security.transport.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
    xpack.security.transport.ssl.truststore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12