部署es
先决条件：
es-7.7.1.tar #es镜像包 docker load -i es-7.7.1.tar
kibana-7.7.1.tar #kibana镜像包 docker load -i kibana-7.7.1.tar
如果没有可以使用docker 下载
docker pull docker.elastic.co/kibana/kibana:7.7.1
docker pull docker.elastic.co/elasticsearch/elasticsearch:7.7.1
已存在命名空间
efk
K8S：v1.23.17
helm ：v3.+
helm-charts-7.7.zip #git上面直接找历史tag 直接下载zip包就行了
已有存储卷：nfs-stogis #自己创建的存储类

登录10.200.9.10服务器
执行命令：

cd /opt
mkdir es

执行命令：

cd es

将helm-charts-7.7.zip放置 /opt/es目录下
执行命令：

cd /opt/es

执行命令：

unzip helm-charts-7.7.1.zip

执行命令：

cd /opt/es/helm-charts

查看镜像是否存在
执行命令：docker images

docker.elastic.co/kibana/kibana:7.7.1
docker.elastic.co/elasticsearch/elasticsearch:7.7.1

上传镜像到harbor

docker tag [tagname] harbor:8008/public/elasticsearch:7.7.1
docker tag [tagname] harbor:8008/public/kibana:7.7.1
docker push harbor:8008/public/elasticsearch:7.7.1
docker push harbor:8008/public/kibana:7.7.1

创建ES集群所需要的yaml文件
es-data-values.yaml
es-client-values.yaml
es-master-values.yaml
es-kibana-values.yaml
按照当前环境修改集群yaml文件

镜像配置

指定镜像与镜像版本

image: "harbor:8008/public/elasticsearch"
imageTag: "7.7.1"
imagePullPolicy: "IfNotPresent"

副本数

replicas: 1

存储数据大小配置

volumeClaimTemplate:
  storageClassName: nfs-storage
  accessModes: [ "ReadWriteOnce" ]
  resources:
    requests:
      storage: 5Gi

JVM 配置参数

esJavaOpts: “-Xmx128m -Xms128m” #根据环境配置，太大了Pod容易起不来

运行容器生成证书

docker run --name elastic-charts-certs -i -w /app harbor:8008/public/elasticsearch:7.7.1 /bin/sh -c  \
  "elasticsearch-certutil ca --out /app/elastic-stack-ca.p12 --pass '' && \
    elasticsearch-certutil cert --name security-master --dns \
    security-master --ca /app/elastic-stack-ca.p12 --pass '' --ca-pass '' --out /app/elastic-certificates.p12"

从容器中将生成的证书拷贝出来

docker cp elastic-charts-certs:/app/elastic-certificates.p12 ./ 

删除容器

docker rm -f elastic-charts-certs

将 pcks12 中的信息分离出来，写入文件

openssl pkcs12 -nodes -passin pass:'' -in elastic-certificates.p12 -out elastic-certificate.pem

添加证书

#创建ES 集群 专属命名空间

kubectl create ns efk# 添加证书
kubectl create secret generic elastic-certificates --from-file=elastic-certificates.p12  -n efk 
kubectl create secret generic elastic-certificate-pem --from-file=elastic-certificate.pem  -n efk  

#设置集群用户名密码，用户名不建议修改,登录kibana需要

kubectl create secret generic elastic-credentials \--from-literal=username=elastic --from-literal=password=elastic123456  -n efk

分别安装 ElasticSearch Master、ElasticSearch Data、ElasticSearch Client
部署（在安装 Master 节点后 Pod 启动时候会抛出异常，就绪探针探活失败，这是个正常现象。在执行安装 Data 节点后 Master 节点 Pod 就会恢复正常。）

helm install elasticsearch-master . -f es-master-values.yaml -n efk
helm install elasticsearch-data . -f es-data-values.yaml -n efk
helm install elasticsearch-client . -f es-client-values.yaml -n efk

查看pod

kubectl get pods -n efk

查看pod日志

kubectl logs elasticsearch-master-0 -n efk
kubectl logs elasticsearch-data-0 -n efk
kubectl logs elasticsearch-client-0 -n efk
kubectl describe pod elasticsearch-master-0 -n efk
kubectl describe pod elasticsearch-data-0 -n efk
kubectl describe pod elasticsearch-client-0 -n efk

因为本人重复尝试运行，导致挂载目录出现很多es的文件夹，如果启动失败出现以下错误

{"type": "server", "timestamp": "2023-08-15T06:59:22,042Z", "level": "ERROR", "component": "o.e.b.ElasticsearchUncaughtExceptionHandler", "cluster.name": "elasticsearch", "node.name": "elasticsearch-data-0", "message": "uncaught exception in thread [main]",
"stacktrace": ["org.elasticsearch.bootstrap.StartupException: ElasticsearchException[failed to bind service]; nested: IndexFormatTooNewException[Format version is not supported (resource BufferedChecksumIndexInput(SimpleFSIndexInput(path="/usr/share/elasticsearch/data/nodes/0/_state/segments_2"))): 10 (needs to be between 7 and 9)];",
"at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:174) ~[elasticsearch-7.7.1.jar:7.7.1]",
"at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:161) ~[elasticsearch-7.7.1.jar:7.7.1]",
"at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) ~[elasticsearch-7.7.1.jar:7.7.1]",
"at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:127) ~[elasticsearch-cli-7.7.1.jar:7.7.1]",
"at org.elasticsearch.cli.Command.main(Command.java:90) ~[elasticsearch-cli-7.7.1.jar:7.7.1]",
"at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:126) ~[elasticsearch-7.7.1.jar:7.7.1]",
"at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92) ~[elasticsearch-7.7.1.jar:7.7.1]",
"Caused by: org.elasticsearch.ElasticsearchException: failed to bind service",
"at org.elasticsearch.node.Node.(Node.java:638) ~[elasticsearch-7.7.1.jar:7.7.1]",
"at org.elasticsearch.node.Node.(Node.java:264) ~[elasticsearch-7.7.1.jar:7.7.1]",
"at org.elasticsearch.bootstrap.Bootstrap$5.(Bootstrap.java:227) ~[elasticsearch-7.7.1.jar:7.7.1]",
"at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:227) ~[elasticsearch-7.7.1.jar:7.7.1]",
"at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:393) ~[elasticsearch-7.7.1.jar:7.7.1]",
"at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:170) ~[elasticsearch-7.7.1.jar:7.7.1]",
"... 6 more",
"Caused by: org.apache.lucene.index.IndexFormatTooNewException: Format version is not supported (resource BufferedChecksumIndexInput(SimpleFSIndexInput(path="/usr/share/elasticsearch/data/nodes/0/_state/segments_2"))): 10 (needs to be between 7 and 9)",

原因是挂载目录内有陈旧挂在卷需要删除，最好是把pvc和pv,挂载目录中存在的陈旧挂载卷都删除掉重新执行helm install

卸载

helm uninstall elasticsearch-master -n efk
helm uninstall elasticsearch-data -n efk
helm uninstall elasticsearch-client -n efk

安装kibana

helm install kibana . -f es-kibana-values.yaml -n efk

查看pod

kubectl get pods -n efk

查看pod日志

kubectl logs elasticsearch-master-0 -n efk

访问地址：http://xx.xxx.x.xx:30601/
输入上面配置的用户名 elastic
密码 elastic123456
进行登录