elasticsearch cluster 구성을 위한 인증서 생성

certificates 생성을 위한 pod 구성

kubectl run test --image=docker.elastic.co/elasticsearch/elasticsearch:{tag} -- tail -f /dev/null
kubectl exec -it pod/test -- sh

certificates 생성

dns 등록이 중요

# ca 생성
elasticsearch-certutil ca --out certs/elastic-stack-ca.p12 --pass ""

# cert 생성
elasticsearch-certutil cert --ca certs/elastic-stack-ca.p12 --ca-pass "" \
  --dns elastic-0.elastic-headless,elastic-1.elastic-headless,elastic-2.elastic-headless \
  --out certs/elastic-cluster.p12 --pass ""

certificates를 secret로 변환

# pod안의 certificates hos server로 복사
kubectl cp test:/usr/share/elasticsearch/certs/elastic-cluster.p12 certs/elastic-cluster.p12

# certificates dns 확인
keytool -list -v -keystore elastic-cluster.p12 -storetype PKCS12 -storepass ""

# secret 생성
kubectl create secret generic elastic-certificates --from-file=certs/elastic-cluster.p12 -n elastic

dns 등록 안했을 때 에러

does not contain any trusted certificate entries