elasticsearch配置searchguard后java连接的配置

刺骨的言语ヽ痛彻心扉 2022-04-17 00:54 214阅读 0赞

pom

<dependency>
        <groupId>com.floragunn</groupId>
        <artifactId>search-guard-ssl</artifactId>
        <version>2.4.6.21</version>
    </dependency>

@Bean
    public TransportClient initClient() throws UnknownHostException { 
        log.info("初始化 elasticsearch client");
        String tmp = System.getProperty("java.io.tmpdir");
        log.info("tmp：{}", tmp);
        String keystore = tmp + File.separator + "keystore.jks";
        String truststore = tmp + File.separator + "truststore.jks";
        try (InputStream ksInput = new ClassPathResource("ca/keystore.jks").getInputStream();
             InputStream tsInput = new ClassPathResource("ca/truststore.jks").getInputStream();
             FileOutputStream keystoreStream = new FileOutputStream(keystore);
             FileOutputStream truststoreStream = new FileOutputStream(truststore)) { 
            IOUtils.copy(ksInput, keystoreStream);
            IOUtils.copy(tsInput, truststoreStream);
        } catch (IOException e) { 
            log.error("写入jks文件异常：{}", e);
        }
        Settings settings = Settings.builder()
                .put("path.home", ".")
                .put("cluster.name", esClusterName)
                .put(SSLConfigConstants.SEARCHGUARD_SSL_HTTP_ENABLED, true)
                .put(SSLConfigConstants.SEARCHGUARD_SSL_TRANSPORT_KEYSTORE_FILEPATH, keystore)
                .put(SSLConfigConstants.SEARCHGUARD_SSL_TRANSPORT_TRUSTSTORE_FILEPATH, truststore)
                .put(SSLConfigConstants.SEARCHGUARD_SSL_TRANSPORT_KEYSTORE_PASSWORD, "KEYSTORE密码")
                .put(SSLConfigConstants.SEARCHGUARD_SSL_TRANSPORT_TRUSTSTORE_PASSWORD, "TRUSTSTORE密码")
                .put("searchguard.ssl.transport.enforce_hostname_verification", false)
                .build();
    
        TransportClient client = TransportClient
                    .builder()
                    .settings(settings)
                    .addPlugin(SearchGuardSSLPlugin.class)
                    .build();
    
        String[] addresses = esAddress.split(",");
        for (String add : addresses) { 
            TransportAddress address = new InetSocketTransportAddress(InetAddress.getByName(add.split(":")[0]), Integer.parseInt(add.split(":")[1]));
            client.addTransportAddress(address);
        }
        return client;
    }

两个证书的目录  
![在这里插入图片描述][20181110201746823.png]

为什么每次都要建在临时目录下，因为是在docker里面，我也不清楚在什么地方，而keystore和truststore必须是绝对路径

addresses的结构是这种：`ip:端口,ip:端口`

# 参考文献 #

> 1.  [https://search-guard.com/searchguard-elasicsearch-transport-clients/][https_search-guard.com_searchguard-elasicsearch-transport-clients]
> 2.  [https://github.com/floragunncom/search-guard/issues/53][https_github.com_floragunncom_search-guard_issues_53]

[20181110201746823.png]: /images/20220417/3f6af3e8f09c4202b26748a3cb743c3a.png
[https_search-guard.com_searchguard-elasicsearch-transport-clients]: https://search-guard.com/searchguard-elasicsearch-transport-clients/
[https_github.com_floragunncom_search-guard_issues_53]: https://github.com/floragunncom/search-guard/issues/53