如何在 K8S 中启动 Elasticsearch 时禁用它的身份验证？

Question

我正在 K8S 中启动 Elasticsearch 集群，下面是规范文件。它无法启动 pod，并出现以下错误。我正在尝试禁用身份验证并希望在没有任何凭据的情况下连接到集群。但这阻止了我这样做。它说该配置是内部使用的。我设置此设置的正确方法是什么？

Warning  ReconciliationError      84s                elasticsearch-controller              Failed to apply spec change: adjust resources: adjust discovery config: Operation cannot be fulfilled on elasticsearches.elasticsearch.k8s.elastic.co "datasource": the object has been modified; please apply your changes to the latest version and try again
  Normal   AssociationStatusChange  1s (x16 over 86s)  es-monitoring-association-controller  Association status changed from [] to []
  Warning  Validation               1s (x20 over 84s)  elasticsearch-controller              [spec.nodeSets[0].config.xpack.security.enabled: Forbidden: Configuration setting is reserved for internal use. User-configured use is unsupported, spec.nodeSets[0].config.xpack.security.http.ssl.enabled: Forbidden: Configuration setting is reserved for internal use. User-configured use is unsupported, spec.nodeSets[0].config.xpack.security.transport.ssl.enabled: Forbidden: Configuration setting is reserved for internal use. User-configured use is unsupported]

apiVersion: elasticsearch.k8s.elastic.co/v1
kind: Elasticsearch
metadata:
  name: datasource
spec:
  version: 7.14.0
  nodeSets:
  - name: node
    count: 2
    config:
      node.store.allow_mmap: false
      xpack.security.http.ssl.enabled: false
      xpack.security.transport.ssl.enabled: false
      xpack.security.enabled: false
    volumeClaimTemplates:
    - metadata:
        name: elasticsearch-data
      spec:
        accessModes:
          - ReadWriteOnce
        storageClassName: ebs-sc
        resources:
          requests:
            storage: 1024Gi

Answer 1

你可以试试这个： https://discuss.elastic.co/t/cannot-disable-tls-and-security-in-eks/222335/2

我已经测试过，它对我来说工作正常，没有任何问题：

cat <<EOF | kubectl apply -f -
apiVersion: elasticsearch.k8s.elastic.co/v1
kind: Elasticsearch
metadata:
  name: quickstart
spec:
  version: 7.15.0
  nodeSets:
  - name: default
    count: 1
    config:
      node.master: true
      node.data: true
      node.ingest: true
      node.store.allow_mmap: false
      xpack.security.authc:
          anonymous:
            username: anonymous
            roles: superuser
            authz_exception: false
EOF

要禁用基本身份验证：

https://www.elastic.co/guide/en/elasticsearch/reference/7.14/anonymous-access.html

要禁用 SSL 自签名证书：

https://www.elastic.co/guide/en/cloud-on-k8s/0.9/k8s-accessing-elastic-services.html#k8s-disable-tls

Answer 2

上面的答案不再有效，因为 ECK 操作员阻止了它。唯一的方法是将其设置为环境变量，如下所示：

    environment:
      - xpack.security.enabled=false
      - xpack.security.transport.ssl.enabled=false
      - xpack.security.http.ssl.enabled=false