docker部署升级方式

项目中间件升级以及安全加固，这里记录一下，有需要的同学可以参考下
需要升级内容：elasticsearch、kibana、ik分词器
准备工作：下载ik分词器6.8.4版本放入elasticearch插件dir

elasticsearch升级

elasticserach 配置 dir
[root@localhost elasticsearch]# ls /docker/elasticsearch
config  data  logs  plugins
docker 配置 dir
[root@localhost elastic]# ls /opt/elastic/
elastic.yml1. 进入elasticearch插件 dir
cd /docker/elasticsearch/plugins/ik2. 修改插件对应版本号
vim plugin-descriptor.properties
elasticsearch.version=6.8.43. 修改midleware.yml
vim midleware.yml
elasticsearch:image: elasticsearch:6.8.4 //原镜像版本6.6.0environment:TZ: Asia/Shanghai    volumes:- /docker/elasticsearch/data:/usr/share/elasticsearch/data- /docker/elasticsearch/config:/usr/share/elasticsearch/config- /docker/elasticsearch/plugins:/usr/share/elasticsearch/plugins- /etc/localtime:/etc/localtimecontainer_name: elasticsearchnetwork_mode: hostrestart: alwaysdocker-compose -f /opt/midleware/midleware.yml down \ docker stop elasticsearch 关闭容器
docker-compose -f /opt/midleware/midleware.yml up -d \ docker start elasticsearch 启动容器
elasticsearch升级ok

kibana升级

kibana配置 dir
[root@localhost opt]# ls /docker/kibana/
config  data
docker配置 dir
[root@localhost kibana]# ls /opt/kibana/
kibana.yml修改kibana.yml
vim kibana.yml
kibana:image: kibana:6.8.4 //原版本6.6.0environment:TZ: Asia/Shanghaivolumes:- /docker/kibana/data:/usr/share/kibana/data- /docker/kibana/config:/usr/share/kibana/config- /etc/localtime:/etc/localtime      container_name: kibananetwork_mode: "host"restart: always
docker-compose -f /opt/kibana/kibana.yml down \ docker stop kibana 关闭容器
docker-compose -f /opt/kibana/kibana.yml up -d \ docker start kibana 启动容器
kibana升级ok

elasticsearch 添加安全验证

添加x-pack验证
vim /docker/elasticsearch/config/elasticsearch.yml
cluster.name: "elasticsearch"
http.port: 9201
transport.tcp.port: 9301
network.host: 0.0.0.0
http.cors.enabled: true
http.cors.allow-origin: "*"
# add x-pack验证
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true重启容器
docker restart elasticsearch
进入容器
docker exec -it elasticsearch bash
容器内部elastic
[root@localhost elasticsearch]# ls
LICENSE.txt  README.textile  config  lib   modules
NOTICE.txt   bin             data    logs  pluginsbin/elasticsearch-setup-passwords指令 help
[root@localhost elasticsearch]# bin/elasticsearch-setup-passwords --help
Sets the passwords for reserved usersCommands
--------
auto - Uses randomly generated passwords
interactive - Uses passwords entered by a userNon-option arguments:
command              Option         Description
------         -----------
-h, --help     show help
-s, --silent   show minimal output
-v, --verbose  show verbose outputbin/elasticsearch-setup-passwords interactive --设置密码Enter password for [elastic]:
Reenter password for [elastic]:
Enter password for [apm_system]:
Reenter password for [apm_system]:
Enter password for [kibana]:
Reenter password for [kibana]:
Enter password for [logstash_system]:
Reenter password for [logstash_system]:
Enter password for [beats_system]:
Reenter password for [beats_system]:
Enter password for [remote_monitoring_user]:
Reenter password for [remote_monitoring_user]:
Changed password for user [apm_system]
Changed password for user [kibana]
Changed password for user [logstash_system]
Changed password for user [beats_system]
Changed password for user [remote_monitoring_user]
Changed password for user [elastic]测试连接
curl --user elastic:passwd localhost:9201

kibana添加安全验证

配置文件中添加连接elastic的用户密码
vim /docker/kibana/config/kibana.yml
[root@localhost opt]# cat /docker/kibana/config/kibana.yml
---
# Default Kibana configuration from kibana-docker.server.name: kibana
server.host: "0"
elasticsearch.url: http://localhost:9201
xpack.monitoring.ui.container.elasticsearch.enabled: false
# add elastic用户密码
elasticsearch.username: "elastic"
elasticsearch.password: "passwd"docker restart kibana 重启容器
访问:localhost:5601  user --kibana passwd --passwd

注：


1. 索引状态为red时设置密码失败率极大
2. 进入容器后检查esticsearch-keystore这个文件是否存在，如果有直接设置密码，如果没有可以调用
[root@localhost elasticsearch]# bin/elasticsearch-keystore create
bin/elasticsearch-keystore指令 help
[root@localhost elasticsearch]# bin/elasticsearch-keystore --help
A tool for managing settings stored in the elasticsearch keystoreCommands
--------
create - Creates a new elasticsearch keystore
list - List entries in the keystore
add - Add a string setting to the keystore
add-file - Add a file setting to the keystore
remove - Remove a setting from the keystore
upgrade - Upgrade the keystore formatNon-option arguments:
command              Option         Description
------         -----------
-h, --help     show help
-s, --silent   show minimal output
-v, --verbose  show verbose output
3. 如果要已经创建过密码了，想要重新创建，执行
bin/elasticsearch-setup-passwords interactive --设置密码
可能会出现如下内容：
Possible causes include:* The password for the 'elastic' user has already been changed on this cluster* Your elasticsearch node is running against a different keystore* This tool used the keystore at /usr/share/elasticsearch/config/elasticsearch.keystore
这要如何解决呢
删除创建密码时生成的密码索引就ok了
curl -XDELETE -u user:passwd http://localhsot:9201/.security-6
然后就可以愉快的重新创建了
4. 如果密码忘了的话可以把x-pack验证关掉
# close x-pack验证
#xpack.security.enabled: true
#xpack.security.transport.ssl.enabled: true
重启es，查到密码索引删除即可，然后就可以重新设置新密码了
curl -XGET http://localhost/_cat/indices
.security-6这个即是密码索引(可能其他版本是其他的，不过应该都是 .security-*类似这样的名称)

elasticsearch 自定义添加用户方式：

1. 在docker 配置 dir中添加 users 、user_roles俩目录
[root@localhost opt]# echo > /docker/elastic/users
[root@localhost opt]# echo > /docker/elastic/users_roles
2. 启动进入容器
[root@localhost opt]# docker start elsaticsearch
[root@localhost opt]# docker exec -it elsaticsearch bash
3. 查看自定义用户相关命令
[root@localhost elasticsearch]# bin/elasticsearch-users -h
Manages elasticsearch file usersCommands
--------
useradd - Adds a file user
userdel - Deletes a file based user
passwd - Changes the password of an existing file based user
roles - Edit roles of an existing user
list - List existing file based users and their corresponding rolesNon-option arguments:
command              Option         Description
------         -----------
-h, --help     show help
-s, --silent   show minimal output
-v, --verbose  show verbose output
4. 查看elastic用户角色名称
[root@localhost elasticsearch]# bin/elasticsearch-setup-passwords interactive -v
Running with configuration path: /usr/share/elasticsearch/configs interactive -v Testing if bootstrap password is valid for http://192.168.2.211:19200/_xpack/security/_authenticate?pretty
{"username" : "elastic","roles" : ["superuser"],"full_name" : null,"email" : null,"metadata" : {"_reserved" : true},"enabled" : true,"authentication_realm" : {"name" : "reserved","type" : "reserved"},"lookup_realm" : {"name" : "reserved","type" : "reserved"}
}Checking cluster health: http://192.168.2.211:19200/_cluster/health?pretty
{"cluster_name" : "qgs-elasticsearch","status" : "green","timed_out" : false,"number_of_nodes" : 1,"number_of_data_nodes" : 1,"active_primary_shards" : 3,"active_shards" : 3,"relocating_shards" : 0,"initializing_shards" : 0,"unassigned_shards" : 0,"delayed_unassigned_shards" : 0,"number_of_pending_tasks" : 0,"number_of_in_flight_fetch" : 0,"task_max_waiting_in_queue_millis" : 0,"active_shards_percent_as_number" : 100.0
}Initiating the setup of passwords for reserved users elastic,apm_system,kibana,logstash_system,beats_system,remote_monitoring_user.
You will be prompted to enter passwords as the process progresses.
Please confirm that you would like to continue [y/N]
4. 创建用户
[root@localhost elasticsearch]# bin/elasticsearch-users useradd admin --创建用户
[root@localhost elasticsearch]# bin/elasticsearch-users roles admin -a superuser--添加角色
curl -u admin:admin localhost:9201/_cat/indices?v --测试访问
5. 密码修改
[root@localhost elasticsearch]# bin/elasticsearch-users passwd admin --修改admin用户密码

ok～.～

elasticsearch6.8.4-docker部署升级方式以及安全加密相关推荐

Centos8安装英伟达显卡驱动并通过docker部署深度学习环境
20201107 - 每个人的机器和实际需要的环境都不一样,本文只是提供了在自己实验室centos8上的部署过程,部署过程中,没有什么问题.请谨慎参考本篇文章,以免浪费宝贵时间. 0. 引言之前的时 ...
又到了上云时刻啦！！！阿里云 Docker部署SpringBoot项目方便测试的部署方式
又到了上云时刻啦!!!阿里云 Docker部署SpringBoot项目方便测试的部署方式部署思路: 具体步骤: 1.打成jar 2.上传到服务器 3.启动JDK容器 4.进入JDK 容器启动项 ...
docker部署jar包的几种方式
docker部署jar包的几种方式前言使用Dockerfile手动打包jar 简单打包运行进化:可复用容器究极进化:jdk镜像直接创建可服用容器超究极进化:maven插件打包(不推荐) 无聊 ...
go项目部署：docker部署go项目直接运行二进制文件部署（两种方式进行部署）
go项目部署:docker部署go项目&直接运行二进制文件部署引言:之前断断续续的接触到项目部署,一直没有详细的了解部署,于是最近就好好的专研一下项目的部署,前期准备:一个自己或者别人的具有 ...
Docker 部署SpringBoot项目不香吗？
点击上方"方志朋",选择"设为星标" 回复"666"获取新整理的面试文章作者:流星007 链接:toutiao.com/i68433912 ...
通过 Docker 部署 Redis 6.x 集群
点击上方好好学java ,选择星标公众号重磅资讯,干货,第一时间送达今日推荐:推荐19个github超牛逼项目!个人原创100W +访问量博客:点击前往,查看更多作者:超级小豆丁 http: ...
Docker 部署不香吗？
点击上方"朱小厮的博客",选择"设为星标" 后台回复"书",获取来源:22j.co/ef5f 目录 docker介绍安装docker U ...
docker部署springboot_创建SpringBoot项目部署到docker全过程
目录 docker 介绍安装 docker Ubuntu 安装 docker CentOS 安装 docker 通过脚本安装拉取 java 环境创建 springboot 项目打包 sprin ...
Redis 集群搭建（三）：Docker 部署 Redis + Sentinel 高可用集群
Redis 集群搭建(三):Docker 部署 Redis + Sentinel 高可用集群前言建议官方译文什么是 Sentinel? Sentinel 优点 Redis 配置文件 maste ...

elasticsearch6.8.4-docker部署升级方式以及安全加密

docker部署升级方式

elasticsearch6.8.4-docker部署升级方式以及安全加密相关推荐

最新文章

热门文章