k8s-es-cluster7-tls.yml

apiVersion: v1
kind: Service
metadata:
  name: elasticsearch
  labels:
    app: elasticsearch
spec:
  clusterIP: None
  ports:
    - port: 9200
      name: serving
    - port: 9300
      name: node-to-node
  selector:
    app: elasticsearch
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: elasticsearch-config
data:
  elasticsearch.yml: |
    cluster.name: "docker-cluster"
    network.host: 0.0.0.0
    xpack.security.enabled: true

    xpack.security.transport.ssl.enabled: true
    xpack.security.transport.ssl.verification_mode: certificate 
    xpack.security.transport.ssl.client_authentication: required
    xpack.security.transport.ssl.keystore.path: ../data/elastic-certificates.p12
    xpack.security.transport.ssl.truststore.path: ../data/elastic-certificates.p12
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: elasticsearch
  labels:
    app: elasticsearch
spec:
  serviceName: elasticsearch
  replicas: 3
  selector:
    matchLabels:
      app: elasticsearch
  template:
    metadata:
      labels:
        app: elasticsearch
    spec:
      terminationGracePeriodSeconds: 300
      initContainers:
        - name: fix-the-volume-permission
          image: busybox
          command:
            - sh
            - -c
            - chown -R 1000:1000 /usr/share/elasticsearch/data
          securityContext:
            privileged: true
          volumeMounts:
            - name: data
              mountPath: /usr/share/elasticsearch/data
        - name: increase-the-vm-max-map-count
          image: busybox
          command:
            - sysctl
            - -w
            - vm.max_map_count=262144
          securityContext:
            privileged: true
        - name: increase-the-ulimit
          image: busybox
          command:
            - sh
            - -c
            - ulimit -n 65536
          securityContext:
            privileged: true
      containers:
        - name: elasticsearch
          image: docker.elastic.co/elasticsearch/elasticsearch:7.12.1
          securityContext:
            privileged: true
          ports:
            - containerPort: 9200
              name: http
            - containerPort: 9300
              name: tcp
          resources:
            requests:
              memory: 4Gi
            limits:
              memory: 6Gi
          env:
            - name: cluster.name
              value: elasticsearch-cluster
            - name: node.name
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: discovery.seed_hosts
              value: "elasticsearch-0.elasticsearch.elastic-stack.svc.cluster.local,elasticsearch-1.elasticsearch.elastic-stack.svc.cluster.local,elasticsearch-2.elasticsearch.elastic-stack.svc.cluster.local"
            - name: cluster.initial_master_nodes
              value: "elasticsearch-0,elasticsearch-1,elasticsearch-2"
            - name: ES_JAVA_OPTS
              value: -Xms4g -Xmx4g
          volumeMounts:
            - name: data
              mountPath: /usr/share/elasticsearch/data
            - name: elasticsearch-config
              readOnly: true
              mountPath: /usr/share/elasticsearch/config/elasticsearch.yml
              subPath: elasticsearch.yml
      volumes:
        - name: elasticsearch-config
          configMap:
            name: elasticsearch-config
            defaultMode: 420
  volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        accessModes:
          - ReadWriteOnce
        storageClassName: nfs-client
        resources:
          requests:
            storage: 10Gi
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: kibana-config
data:
  kibana.yml: |
    server.name: kibana
    server.host: "0"
    elasticsearch.username: "kibana_system"
    elasticsearch.password: "Xiaokouchangkai" # 密码需修改真实密码
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: kibana
spec:
  selector:
    matchLabels:
      app: kibana
  replicas: 1
  template:
    metadata:
      labels:
        app: kibana
    spec:
      containers:
        - name: kibana
          image: >-
            docker.elastic.co/kibana/kibana:7.12.1
          ports:
            - containerPort: 5601
          env:
            - name: ELASTICSEARCH_URL
              value: http://elasticsearch:9200
            - name: ELASTICSEARCH_HOSTS
              value: '["http://elasticsearch:9200"]'
          volumeMounts:
            - name: kibana-config
              readOnly: true
              mountPath: /usr/share/kibana/config/kibana.yml
              subPath: kibana.yml
      volumes:
        - name: kibana-config
          configMap:
            name: kibana-config
            defaultMode: 420
---
kind: Service
apiVersion: v1
metadata:
  name: kibana
  labels:
    app: kibana
spec:
  ports:
    - protocol: TCP
      port: 5601
      targetPort: 5601
  selector:
    app: kibana
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: logstash-config
data:
  logstash.conf: |-
    input {
      beats {
        port => 5044
      }

      tcp {
        port => 5000
      }
    }

    filter {
      if [log_type] in [ "test", "staging" ] {
          mutate { add_field => { "[@metadata][target_index]" => "applog-test-%{+YYYY.MM}" } }
      } else if [log_type] == "production" {
          mutate { add_field => { "[@metadata][target_index]" => "applog-prod-%{+YYYY.MM.dd}" } }
      } else {
          mutate { add_field => { "[@metadata][target_index]" => "applog-%{+YYYY}" } }
      }
      
      if [agent][type] == "filebeat" {
        mutate { rename => { "[host][name]" => "host"}}
      }
    }

    output {
      stdout { codec => rubydebug }
      elasticsearch {
        hosts => "elasticsearch:9200"
        index => "%{[@metadata][target_index]}"
        user => logstash_internal
        password => 'x-pack-test-password' #密码需修改真实密码
      }
    }
  logstash.yml: |-
    http.host: "0.0.0.0"
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: logstash
spec:
  selector:
    matchLabels:
      app: logstash
  replicas: 1
  template:
    metadata:
      labels:
        app: logstash
    spec:
      containers:
        - name: logstash
          image: >-
            docker.elastic.co/logstash/logstash:7.12.1
          ports:
            - containerPort: 5044
            - containerPort: 5000
            - containerPort: 9600
          env:
            - name: ELASTICSEARCH_URL
              value: http://elasticsearch:9200
          volumeMounts:
            - name: logstash-config
              readOnly: true
              mountPath: /usr/share/logstash/config/logstash.yml
              subPath: logstash.yml
            - name: logstash-config
              readOnly: true
              mountPath: /usr/share/logstash/pipeline/logstash.conf
              subPath: logstash.conf
      volumes:
        - name: logstash-config
          configMap:
            name: logstash-config
            defaultMode: 420
---
kind: Service
apiVersion: v1
metadata:
  name: logstash
  labels:
    app: logstash
spec:
  type: NodePort
  ports:
    - name: beats
      protocol: TCP
      port: 5044
      targetPort: 5044
      nodePort: 32663
    - name: tcp
      protocol: TCP
      port: 5000
      targetPort: 5000
  selector:
    app: logstash