elasticsearch—在https通道上接收到明文http流量，正在关闭连接

我已经在我的k8s集群上部署了eck（使用helm），我正在尝试按照文档安装elasticsearch。https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-deploy-elasticsearch.html
我已经对外公开了service/elasticsearch prod es http，这样我就可以从我的k8s集群外部连接到它。但是，正如您所看到的，当我尝试从curl或浏览器连接到它时，我收到一个错误“502 bad gateway”错误。

curl elasticsearch.dev.geeiq.com
<html>
<head><title>502 Bad Gateway</title></head>
<body>
<center><h1>502 Bad Gateway</h1></center>
</body>
</html>

检查pod（elasticsearch-prod-es-default-0）后，我可以看到以下消息重复出现。
{“type”：“server”，“timestamp”：“2021-04-27t13:12:20048z”，“level”：“warn”，“component”：“o.e.x.s.t.n.securitynetty4httpservertransport”，“cluster.name”：“elasticsearch prod”，“node.name”：“elasticsearch-prod-es-default-0”，“message”：“https通道上接收的明文http流量，正在关闭连接netty4httpchannel{localaddress=/10.0.5.81:9200，remoteaddress=/10.0.3.50:46380}，“cluster.uuid”：“t0mrfv7kregqhxw9dvm3vw”，“node.id”：“ncyaitdmsqgzra3lapsc6g”}
你能帮助我理解为什么会发生这种情况以及如何解决它吗？
我怀疑这与我的tls配置有关，因为当我禁用tls时，我可以从外部连接到它而不会出现问题。但是在生产环境中，我认为保持tls的启用很重要？
仅供参考，我可以端口转发服务，并连接到它与curl使用-k标志。
我试过的
我已经尝试将我的域添加到这里描述的部分https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-http-settings-tls-sans.html#k8s-elasticsearch http服务san
我曾尝试使用openssl生成自签名证书，但没有成功。尝试本地连接将返回以下错误消息。
curl-u“密码”https://localhost：9200“curl:（60）ssl证书问题：无法在此处获取本地颁发者证书详细信息：https://curl.haxx.se/docs/sslcerts.html curl无法验证服务器的合法性，因此无法建立到它的安全连接。要了解更多关于这种情况以及如何解决它，请访问上述网页。
我已尝试使用该工具生成证书https://www.elastic.co/guide/en/elasticsearch/reference/7.9/configuring-tls.html#tls-运输
bin/elasticsearch certutil ca bin/elasticsearch certutil cert--ca elastic-stack-ca.12--pem
然后使用生成的.crt和.key创建了一个kubectl秘密 elastic-tls-cert . 但是再次使用不带-k的localhost会产生以下错误：
curl--cacert cacert.pem-u“弹性：$password”-xget”https://localhost：9200“curl:（60）ssl证书问题：无法在此处获取本地颁发者证书详细信息：https://curl.haxx.se/docs/sslcerts.html curl无法验证服务器的合法性，因此无法建立到它的安全连接。要了解更多关于这种情况以及如何解决它，请访问上述网页。
ElasticSearch.yml


# This sample sets up an Elasticsearch cluster with 3 nodes.

apiVersion: elasticsearch.k8s.elastic.co/v1
kind: Elasticsearch
metadata:
  name: elasticsearch-prod
  namespace: elastic-system
spec:
  version: 7.12.0
  nodeSets:
  - name: default
    config:
      # most Elasticsearch configuration parameters are possible to set, e.g: node.attr.attr_name: attr_value
      node.roles: ["master", "data", "ingest", "ml"]
      # this allows ES to run on nodes even if their vm.max_map_count has not been increased, at a performance cost
      node.store.allow_mmap: false
      xpack.security.enabled: true
    podTemplate:
      metadata:
        labels:
          # additional labels for pods
          foo: bar
      spec:
        nodeSelector: 
          geeiq/node-type: ops

        # this changes the kernel setting on the node to allow ES to use mmap
        # if you uncomment this init container you will likely also want to remove the
        # "node.store.allow_mmap: false" setting above
        # initContainers:
        # - name: sysctl
        #   securityContext:
        #     privileged: true
        #   command: ['sh', '-c', 'sysctl -w vm.max_map_count=262144']
        ###
        # uncomment the line below if you are using a service mesh such as linkerd2 that uses service account tokens for pod identification.
        # automountServiceAccountToken: true
        containers:
        - name: elasticsearch
          # specify resource limits and requests
          resources:
            limits:
              memory: 4Gi
              cpu: 1
          env:
          - name: ES_JAVA_OPTS
            value: "-Xms2g -Xmx2g"
    count: 3
  #   # request 2Gi of persistent data storage for pods in this topology element
    volumeClaimTemplates:
    - metadata:
        name: elasticsearch-data
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 250Gi
        storageClassName: elasticsearch
  # # inject secure settings into Elasticsearch nodes from k8s secrets references
  # secureSettings:
  # - secretName: ref-to-secret
  # - secretName: another-ref-to-secret
  #   # expose only a subset of the secret keys (optional)
  #   entries:
  #   - key: value1
  #     path: newkey # project a key to a specific path (optional)
  http:
    service:
      spec:
        # expose this cluster Service with a LoadBalancer
        type: NodePort
    tls:
      selfSignedCertificate:
        # add a list of SANs into the self-signed HTTP certificate
        subjectAltNames:
        # - ip: 192.168.1.2
        # - ip: 192.168.1.3
        - dns: elasticsearch.dev.geeiq.com
        - dns: localhost
      # certificate:
      #   # provide your own certificate
      #   secretName: elastic-tls-cert

kubectl版本

Client Version: version.Info{Major:"1", Minor:"20", GitVersion:"v1.20.4", GitCommit:"e87da0bd6e03ec3fea7933c4b5263d151aafd07c", GitTreeState:"clean", BuildDate:"2021-02-18T16:12:00Z", GoVersion:"go1.15.8", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"19+", GitVersion:"v1.19.6-eks-49a6c0", GitCommit:"49a6c0bf091506e7bafcdb1b142351b69363355a", GitTreeState:"clean", BuildDate:"2020-12-23T22:10:21Z", GoVersion:"go1.15.5", Compiler:"gc", Platform:"linux/amd64"}

舵手名单

NAME                NAMESPACE       REVISION    UPDATED                                 STATUS      CHART               APP VERSION
elastic-operator    elastic-system  1           2021-04-26 11:18:02.286692269 +0100 BST deployed    eck-operator-1.5.0  1.5.0

资源

pod/elastic-operator-0                1/1     Running   0          4h58m   10.0.5.142   ip-10-0-5-71.us-east-2.compute.internal    <none>           <none>
pod/elasticsearch-prod-es-default-0   1/1     Running   0          9m5s    10.0.5.81    ip-10-0-5-71.us-east-2.compute.internal    <none>           <none>
pod/elasticsearch-prod-es-default-1   1/1     Running   0          9m5s    10.0.1.128   ip-10-0-1-207.us-east-2.compute.internal   <none>           <none>
pod/elasticsearch-prod-es-default-2   1/1     Running   0          9m5s    10.0.5.60    ip-10-0-5-71.us-east-2.compute.internal    <none>           <none>

NAME                                      TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)          AGE    SELECTOR
service/elastic-operator-webhook          ClusterIP   172.20.218.208   <none>        443/TCP          26h    app.kubernetes.io/instance=elastic-operator,app.kubernetes.io/name=elastic-operator
service/elasticsearch-prod-es-default     ClusterIP   None             <none>        9200/TCP         9m5s   common.k8s.elastic.co/type=elasticsearch,elasticsearch.k8s.elastic.co/cluster-name=elasticsearch-prod,elasticsearch.k8s.elastic.co/statefulset-name=elasticsearch-prod-es-default
service/elasticsearch-prod-es-http        NodePort    172.20.229.173   <none>        9200:30604/TCP   9m6s   common.k8s.elastic.co/type=elasticsearch,elasticsearch.k8s.elastic.co/cluster-name=elasticsearch-prod
service/elasticsearch-prod-es-transport   ClusterIP   None             <none>        9300/TCP         9m6s   common.k8s.elastic.co/type=elasticsearch,elasticsearch.k8s.elastic.co/cluster-name=elasticsearch-prod

aws alb入口控制器

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: elastic-ingress
  namespace: elastic-system
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/group.name: "<redacted>"
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP":80,"HTTPS": 443}]'
    alb.ingress.kubernetes.io/certificate-arn: <redacted>
    alb.ingress.kubernetes.io/tags: Environment=prod,Team=dev
    alb.ingress.kubernetes.io/healthcheck-path: /health
    alb.ingress.kubernetes.io/healthcheck-interval-seconds: '300'
    alb.ingress.kubernetes.io/load-balancer-attributes: access_logs.s3.enabled=true,access_logs.s3.bucket=geeiq-aws-ingress-logs,access_logs.s3.prefix=dev-ingress
spec:
  rules:
    - host: elasticsearch.dev.geeiq.com
      http:
        paths:
          - path: /*
            pathType: Prefix
            backend:
              service:
                name: elasticsearch-prod-es-http
                port:
                  number: 9200
    # - host: kibana.dev.geeiq.com
    #   http:
    #     paths:
    #       - path: /*
    #         pathType: Prefix
    #         backend:
    #           service:
    #             name: kibana-prod-kb-http
    #             port:
    #               number: 5601

elasticsearch—在https通道上接收到明文http流量，正在关闭连接

暂无答案！

相关问题

热门标签

最新问答