228 lines
5.5 KiB
Markdown
228 lines
5.5 KiB
Markdown
好的，我会为你整理两份完整的 Markdown 文档。第一份是 **K8s 上部署 Elasticsearch 集群**（ECK + iSCSI 静态 PVC）的文档，第二份是 **从旧 Docker ES 迁移数据到新集群**（使用 elasticdump）的文档。
|
||
|
||
---
|
||
|
||
# 文档一：在 Kubernetes 上使用 ECK 部署 Elasticsearch 集群（含 iSCSI 持久化存储）
|
||
|
||
## 1. 环境
|
||
|
||
- Kubernetes 集群
|
||
- TrueNAS，已创建三个 iSCSI LUN 并映射到 K8s 节点
|
||
- 自定义 Elasticsearch 镜像（包含所需插件IK），推送到私有仓库
|
||
|
||
## 2. 存储准备（iSCSI 静态 PV）
|
||
|
||
### 2.1 在 TrueNAS 上配置 iSCSI
|
||
|
||
创建三个 Zvol，每个对应一个 ES 节点：
|
||
- `es-node-1`
|
||
- `es-node-2`
|
||
- `es-node-3`
|
||
|
||
为每个 Zvol 创建 iSCSI Target，并获取 IQN（例如 `iqn.2005-10.org.freenas.ctl:es-node-1`）
|
||
|
||
### 2.2 在所有 K8s 节点上安装 iSCSI initiator
|
||
|
||
```bash
|
||
# CentOS9
|
||
sudo dnf install -y iscsi-initiator-utils
|
||
sudo systemctl enable --now iscsid
|
||
```
|
||
|
||
### 2.3 创建 PV 和 PVC
|
||
|
||
**PV 示例**（`pv-es-node-1.yaml`）：
|
||
|
||
```yaml
|
||
apiVersion: v1
|
||
kind: PersistentVolume
|
||
metadata:
|
||
name: es-node-1-pv
|
||
spec:
|
||
capacity:
|
||
storage: 150Gi
|
||
volumeMode: Filesystem
|
||
accessModes:
|
||
- ReadWriteOnce
|
||
persistentVolumeReclaimPolicy: Retain
|
||
iscsi:
|
||
targetPortal: 192.168.1.14:3260
|
||
iqn: iqn.2005-10.org.freenas.ctl:es-node-1
|
||
lun: 0
|
||
fsType: ext4
|
||
readOnly: false
|
||
```
|
||
|
||
同样创建 `es-node-2-pv` 和 `es-node-3-pv`。
|
||
|
||
**PVC 示例**（`eck-pvcs.yaml`）：
|
||
|
||
```yaml
|
||
apiVersion: v1
|
||
kind: PersistentVolumeClaim
|
||
metadata:
|
||
name: elasticsearch-data-es-k8s-es-default-0
|
||
namespace: es
|
||
spec:
|
||
accessModes: [ "ReadWriteOnce" ]
|
||
volumeName: es-node-1-pv
|
||
resources:
|
||
requests:
|
||
storage: 150Gi
|
||
---
|
||
apiVersion: v1
|
||
kind: PersistentVolumeClaim
|
||
metadata:
|
||
name: elasticsearch-data-es-k8s-es-default-1
|
||
namespace: es
|
||
spec:
|
||
accessModes: [ "ReadWriteOnce" ]
|
||
volumeName: es-node-2-pv
|
||
resources:
|
||
requests:
|
||
storage: 150Gi
|
||
---
|
||
apiVersion: v1
|
||
kind: PersistentVolumeClaim
|
||
metadata:
|
||
name: elasticsearch-data-es-k8s-es-default-2
|
||
namespace: es
|
||
spec:
|
||
accessModes: [ "ReadWriteOnce" ]
|
||
volumeName: es-node-3-pv
|
||
resources:
|
||
requests:
|
||
storage: 150Gi
|
||
|
||
```
|
||
|
||
应用：
|
||
|
||
```bash
|
||
kubectl create namespace es
|
||
kubectl apply -f pv-es-node-1.yaml -f pv-es-node-2.yaml -f pv-es-node-3.yaml
|
||
kubectl apply -f eck-pvcs.yaml
|
||
```
|
||
|
||
## 3. 安装 ECK Operator
|
||
|
||
```bash
|
||
kubectl create -f https://download.elastic.co/downloads/eck/2.13.0/crds.yaml
|
||
kubectl apply -f https://download.elastic.co/downloads/eck/2.13.0/operator.yaml
|
||
kubectl get pods -n elastic-system
|
||
```
|
||
|
||
## 4. 部署 Elasticsearch 集群
|
||
|
||
创建 `elasticsearch.yaml`：
|
||
|
||
```yaml
|
||
apiVersion: elasticsearch.k8s.elastic.co/v1
|
||
kind: Elasticsearch
|
||
metadata:
|
||
name: es-k8s
|
||
namespace: es
|
||
spec:
|
||
version: 8.16.6
|
||
image: harbor.boyiqd.cn/elastic/elasticsearch-ik:8.16.6
|
||
http:
|
||
tls:
|
||
selfSignedCertificate:
|
||
disabled: false
|
||
service:
|
||
spec:
|
||
type: NodePort
|
||
ports:
|
||
- name: https
|
||
port: 9200
|
||
targetPort: 9200
|
||
nodePort: 30200
|
||
nodeSets:
|
||
- name: default
|
||
count: 3
|
||
config:
|
||
node.store.allow_mmap: false
|
||
# 仅当需要 Reindex 跨集群时配置白名单，此处可不配
|
||
podTemplate:
|
||
spec:
|
||
securityContext:
|
||
runAsUser: 1000
|
||
runAsGroup: 0
|
||
fsGroup: 0
|
||
runAsNonRoot: true
|
||
volumes:
|
||
- name: host-time
|
||
hostPath:
|
||
path: /etc/localtime
|
||
type: ''
|
||
containers:
|
||
- name: elasticsearch
|
||
securityContext:
|
||
runAsUser: 1000
|
||
runAsNonRoot: true
|
||
env:
|
||
- name: ES_JAVA_OPTS
|
||
value: "-Xms8g -Xmx8g"
|
||
- name: ELASTIC_PASSWORD
|
||
valueFrom:
|
||
secretKeyRef:
|
||
name: es-elastic-user
|
||
key: elastic
|
||
resources:
|
||
requests:
|
||
memory: "8Gi"
|
||
cpu: "4"
|
||
limits:
|
||
memory: "14Gi"
|
||
cpu: "4"
|
||
volumeMounts:
|
||
- name: host-time
|
||
mountPath: /etc/localtime
|
||
readOnly: true
|
||
volumeClaimTemplates:
|
||
- metadata:
|
||
name: elasticsearch-data
|
||
spec:
|
||
accessModes: [ "ReadWriteOnce" ]
|
||
resources:
|
||
requests:
|
||
storage: 150Gi
|
||
```
|
||
|
||
**说明**：
|
||
- `image` 指向自己构建的包含 IK 插件的镜像。
|
||
- `runAsUser: 1000` 确保 ES 进程用户权限。
|
||
- 挂载宿主机时区文件 `/etc/localtime` 使容器内使用正确时区。
|
||
- `volumeClaimTemplates` 名称必须为 `elasticsearch-data`，ECK 会自动创建 PVC `elasticsearch-data-es-k8s-es-default-0` 等。我们已预先创建同名 PVC 并绑定到 iSCSI PV，ECK 会直接使用它们。
|
||
|
||
## 5. 创建访问密码 Secret（可选）
|
||
|
||
ECK 会自动生成一个名为 `es-k8s-es-elastic-user` 的 Secret，密码随机。如果你想固定密码，可预先创建：
|
||
|
||
```bash
|
||
kubectl create secret generic es-elastic-user -n es --from-literal=elastic=your_password
|
||
```
|
||
|
||
## 6. 部署集群
|
||
|
||
```bash
|
||
kubectl apply -f elasticsearch.yaml
|
||
kubectl get pods -n es -w
|
||
```
|
||
|
||
等待所有 Pod 状态为 `Running`，`READY 1/1`。
|
||
|
||
## 7. 验证集群
|
||
|
||
```bash
|
||
# 获取密码（如果使用自动生成的）
|
||
PASSWORD=$(kubectl get secret es-k8s-es-elastic-user -n es -o go-template='{{.data.elastic | base64decode}}')
|
||
|
||
# 端口转发测试
|
||
kubectl port-forward -n es service/es-k8s-es-http 9200:9200 &
|
||
curl -k -u elastic:$PASSWORD "https://localhost:9200/_cluster/health?pretty"
|
||
```
|
||
|
||
预期输出 `"status" : "green"`。
|
||
|
||
--- |