如何使用dockerized OpenSearch的安全配置?

Question

我有一个专用服务器在Docker中运行OpenSearch。我正在使用没有仪表板的示例配置:

version: '3'
services:
opensearch-node1: # This is also the hostname of the container within the Docker network (i.e. https://opensearch-node1/)
image: opensearchproject/opensearch:latest # Specifying the latest available image - modify if you want a specific version
container_name: opensearch-node1
environment:
- cluster.name=opensearch-cluster # Name the cluster
- node.name=opensearch-node1 # Name the node that will run in this container
- discovery.seed_hosts=opensearch-node1,opensearch-node2 # Nodes to look for when discovering the cluster
- cluster.initial_cluster_manager_nodes=opensearch-node1,opensearch-node2 # Nodes eligible to serve as cluster manager
- bootstrap.memory_lock=true # Disable JVM heap memory swapping
- "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m" # Set min and max JVM heap sizes to at least 50% of system RAM
ulimits:
memlock:
soft: -1 # Set memlock to unlimited (no soft or hard limit)
hard: -1
nofile:
soft: 65536 # Maximum number of open files for the opensearch user - set to at least 65536
hard: 65536
volumes:
- opensearch-data1:/usr/share/opensearch/data # Creates volume called opensearch-data1 and mounts it to the container
ports:
- 9200:9200 # REST API
- 9600:9600 # Performance Analyzer
networks:
- opensearch-net # All of the containers will join the same Docker bridge network
opensearch-node2:
image: opensearchproject/opensearch:latest # This should be the same image used for opensearch-node1 to avoid issues
container_name: opensearch-node2
environment:
- cluster.name=opensearch-cluster
- node.name=opensearch-node2
- discovery.seed_hosts=opensearch-node1,opensearch-node2
- cluster.initial_cluster_manager_nodes=opensearch-node1,opensearch-node2
- bootstrap.memory_lock=true
- "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m"
ulimits:
memlock:
soft: -1
hard: -1
nofile:
soft: 65536
hard: 65536
volumes:
- opensearch-data2:/usr/share/opensearch/data
networks:
- opensearch-net

volumes:
opensearch-data1:
opensearch-data2:
networks:
opensearch-net:

OpenSearch正在使用SSL(据我所知自签名)。当我试图从外部本地查询curl:

curl -XGET https://127.0.0.1:9200 -u 'admin:admin' -v

显示错误:

curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to 127.0.0.1:9200 

怎么了?如何使用安全版本的OpenSearch?

Answer 1

在"开始跨集群复制"中可以看到，所有的curl都是用-k完成的，以绕过证书检查。

甚至opensearch-project/OpenSearchissue 1633 ("为opensearch发行版提供证书管理工具")包含一个脚本:

To access your secured cluster open https://<hostname>:<HTTP port>
and log in with admin/admin.  
Example:
curl -k https://localhost:9200 -u admin:admin
(Ignore the SSL certificate warning because we installed self-signed certificates)

---

但是您也可以遵循"生成自签名证书"解决此问题的文档页:

如果您的组织没有访问证书颁发机构(CA)的权限，并且希望将OpenSearch用于非演示目的，您可以使用OpenSSL生成自己的自签名证书。

它包括创建一个自签名证书，但也一个管理证书。

可以添加证书文件到opensearch.yml