Commit dbbf22a1 authored by Jared Tan's avatar Jared Tan Committed by Gao Hongtao
Browse files

support es https ssl config. (#3370) 

* support es https ssl config.

* update

* update docs.

* refactoring var name.

* fix

* update docs.

* add config in es section.

* fix logical.
parent 2a2679ee

docs/en/setup/backend/backend-storage.md

+30 −0
Original line number Diff line number Diff line
@@ -39,6 +39,8 @@ storage: 
    # nameSpace: ${SW_NAMESPACE:""}

    # user: ${SW_ES_USER:""} # User needs to be set when Http Basic authentication is enabled

    # password: ${SW_ES_PASSWORD:""} # Password to be set when Http Basic authentication is enabled

    #trustStorePath: ${SW_SW_STORAGE_ES_SSL_JKS_PATH:""}

    #trustStorePass: ${SW_SW_STORAGE_ES_SSL_JKS_PASS:""}

    clusterNodes: ${SW_STORAGE_ES_CLUSTER_NODES:localhost:9200}

    protocol: ${SW_STORAGE_ES_HTTP_PROTOCOL:"http"}

    indexShardsNumber: ${SW_STORAGE_ES_INDEX_SHARDS_NUMBER:2}
@@ -54,6 +56,34 @@ storage: 
    concurrentRequests: ${SW_STORAGE_ES_CONCURRENT_REQUESTS:2} # the number of concurrent requests

```



### ElasticSearch 6 With Https SSL Encrypting communications.



example: 



```yaml

storage:

  elasticsearch:

    # nameSpace: ${SW_NAMESPACE:""}

    user: ${SW_ES_USER:""} # User needs to be set when Http Basic authentication is enabled

    password: ${SW_ES_PASSWORD:""} # Password to be set when Http Basic authentication is enabled

    clusterNodes: ${SW_STORAGE_ES_CLUSTER_NODES:localhost:443}

    trustStorePath: ${SW_SW_STORAGE_ES_SSL_JKS_PATH:"../es_keystore.jks"}

    trustStorePass: ${SW_SW_STORAGE_ES_SSL_JKS_PASS:""}

    protocol: ${SW_STORAGE_ES_HTTP_PROTOCOL:"https"}

    indexShardsNumber: ${SW_STORAGE_ES_INDEX_SHARDS_NUMBER:2}

    indexReplicasNumber: ${SW_STORAGE_ES_INDEX_REPLICAS_NUMBER:0}

    # Those data TTL settings will override the same settings in core module.

    recordDataTTL: ${SW_STORAGE_ES_RECORD_DATA_TTL:7} # Unit is day

    otherMetricsDataTTL: ${SW_STORAGE_ES_OTHER_METRIC_DATA_TTL:45} # Unit is day

    monthMetricsDataTTL: ${SW_STORAGE_ES_MONTH_METRIC_DATA_TTL:18} # Unit is month

    # Batch process setting, refer to https://www.elastic.co/guide/en/elasticsearch/client/java-api/5.5/java-docs-bulk-processor.html

    bulkActions: ${SW_STORAGE_ES_BULK_ACTIONS:2000} # Execute the bulk every 2000 requests

    bulkSize: ${SW_STORAGE_ES_BULK_SIZE:20} # flush the bulk every 20mb

    flushInterval: ${SW_STORAGE_ES_FLUSH_INTERVAL:10} # flush the bulk every 10 seconds whatever the number of requests

    concurrentRequests: ${SW_STORAGE_ES_CONCURRENT_REQUESTS:2} # the number of concurrent requests

```





### Data TTL

TTL in ElasticSearch overrides the settings of core, read [ElasticSearch section in TTL document](ttl.md#elasticsearch-6-storage-ttl)

oap-server/server-library/library-client/src/main/java/org/apache/skywalking/oap/server/library/client/Client.java

+1 −1
Original line number Diff line number Diff line
@@ -25,7 +25,7 @@ import java.io.IOException; 
 */

public interface Client {



    void connect() throws IOException;

    void connect() throws Exception;



    void shutdown() throws IOException;

}

oap-server/server-library/library-client/src/main/java/org/apache/skywalking/oap/server/library/client/elasticsearch/ElasticSearchClient.java

+42 −10
Original line number Diff line number Diff line
@@ -23,12 +23,21 @@ import com.google.gson.Gson; 
import com.google.gson.JsonArray;

import com.google.gson.JsonObject;

import java.io.IOException;

import java.io.InputStream;

import java.io.InputStreamReader;

import java.nio.file.Files;

import java.nio.file.Paths;

import java.security.KeyManagementException;

import java.security.KeyStore;

import java.security.KeyStoreException;

import java.security.NoSuchAlgorithmException;

import java.security.cert.CertificateException;

import java.util.ArrayList;

import java.util.Collections;

import java.util.LinkedList;

import java.util.List;

import java.util.Map;

import javax.net.ssl.SSLContext;

import org.apache.commons.lang3.StringUtils;

import org.apache.http.HttpEntity;

import org.apache.http.HttpHost;
@@ -44,6 +53,8 @@ import org.apache.http.client.methods.HttpPut; 
import org.apache.http.entity.ContentType;

import org.apache.http.impl.client.BasicCredentialsProvider;

import org.apache.http.nio.entity.NStringEntity;

import org.apache.http.ssl.SSLContextBuilder;

import org.apache.http.ssl.SSLContexts;

import org.apache.skywalking.oap.server.library.client.Client;

import org.elasticsearch.action.admin.indices.create.CreateIndexRequest;

import org.elasticsearch.action.admin.indices.create.CreateIndexResponse;
@@ -84,30 +95,50 @@ public class ElasticSearchClient implements Client { 
    public static final String TYPE = "type";

    private final String clusterNodes;

    private final String protocol;

    private final String trustStorePath;

    private final String trustStorePass;

    private final String namespace;

    private final String user;

    private final String password;

    protected RestHighLevelClient client;



    public ElasticSearchClient(String clusterNodes, String protocol, String namespace, String user, String password) {

    public ElasticSearchClient(String clusterNodes, String protocol, String trustStorePath, String trustStorePass,

        String namespace, String user, String password) {

        this.clusterNodes = clusterNodes;

        this.protocol = protocol;

        this.namespace = namespace;

        this.user = user;

        this.password = password;

        this.trustStorePath = trustStorePath;

        this.trustStorePass = trustStorePass;

    }



    @Override public void connect() throws IOException {

    @Override

    public void connect() throws IOException, KeyStoreException, NoSuchAlgorithmException, KeyManagementException, CertificateException {

        List<HttpHost> pairsList = parseClusterNodes(clusterNodes);

        RestClientBuilder builder;

        if (StringUtils.isNotBlank(user) && StringUtils.isNotBlank(password)) {

            final CredentialsProvider credentialsProvider = new BasicCredentialsProvider();

            credentialsProvider.setCredentials(AuthScope.ANY, new UsernamePasswordCredentials(user, password));



            if (StringUtils.isBlank(trustStorePath)) {

                builder = RestClient.builder(pairsList.toArray(new HttpHost[0]))

                    .setHttpClientConfigCallback(httpClientBuilder -> httpClientBuilder.setDefaultCredentialsProvider(credentialsProvider));

            } else {

                KeyStore truststore = KeyStore.getInstance("jks");

                try (InputStream is = Files.newInputStream(Paths.get(trustStorePath))) {

                    truststore.load(is, trustStorePass.toCharArray());

                }

                SSLContextBuilder sslBuilder = SSLContexts.custom()

                    .loadTrustMaterial(truststore, null);

                final SSLContext sslContext = sslBuilder.build();

                builder = RestClient.builder(pairsList.toArray(new HttpHost[0]))

                    .setHttpClientConfigCallback(httpClientBuilder -> httpClientBuilder.setDefaultCredentialsProvider(credentialsProvider).setSSLContext(sslContext));

            }

        } else {

            builder = RestClient.builder(pairsList.toArray(new HttpHost[0]));

        }



        client = new RestHighLevelClient(builder);

        client.ping();

    }
@@ -163,9 +194,10 @@ public class ElasticSearchClient implements Client { 
    }



    /**

     * If your indexName is retrieved from elasticsearch through {@link #retrievalIndexByAliases(String)} or some other method and it already contains namespace.

     * Then you should delete the index by this method, this method will no longer concatenate namespace.

     *

     * If your indexName is retrieved from elasticsearch through {@link #retrievalIndexByAliases(String)} or some other

     * method and it already contains namespace. Then you should delete the index by this method, this method will no

     * longer concatenate namespace.

     * <p>

     * https://github.com/apache/skywalking/pull/3017

     */

    public boolean deleteByIndexName(String indexName) throws IOException {
@@ -173,9 +205,9 @@ public class ElasticSearchClient implements Client { 
    }



    /**

     * If your indexName is obtained from metadata or configuration and without namespace.

     * Then you should delete the index by this method, this method automatically concatenates namespace.

     *

     * If your indexName is obtained from metadata or configuration and without namespace. Then you should delete the

     * index by this method, this method automatically concatenates namespace.

     * <p>

     * https://github.com/apache/skywalking/pull/3017

     */

    public boolean deleteByModelName(String modelName) throws IOException {

oap-server/server-library/library-client/src/test/java/org/apache/skywalking/oap/server/library/client/elasticsearch/ITElasticSearchClient.java

+19 −9
Original line number Diff line number Diff line
@@ -18,9 +18,13 @@ 


package org.apache.skywalking.oap.server.library.client.elasticsearch;



import com.google.gson.*;

import java.io.*;

import java.util.*;

import com.google.gson.Gson;

import com.google.gson.JsonObject;

import java.io.IOException;

import java.io.InputStreamReader;

import java.util.HashMap;

import java.util.List;

import java.util.Map;

import java.util.concurrent.TimeUnit;

import org.apache.commons.lang3.StringUtils;

import org.apache.http.client.methods.HttpGet;
@@ -29,13 +33,19 @@ import org.elasticsearch.action.bulk.BulkProcessor; 
import org.elasticsearch.action.get.GetResponse;

import org.elasticsearch.action.index.IndexRequest;

import org.elasticsearch.action.search.SearchResponse;

import org.elasticsearch.client.*;

import org.elasticsearch.common.xcontent.*;

import org.elasticsearch.client.Response;

import org.elasticsearch.client.RestHighLevelClient;

import org.elasticsearch.common.xcontent.XContentBuilder;

import org.elasticsearch.common.xcontent.XContentFactory;

import org.elasticsearch.index.query.QueryBuilders;

import org.elasticsearch.search.builder.SearchSourceBuilder;

import org.junit.*;

import org.junit.After;

import org.junit.Assert;

import org.junit.Before;

import org.junit.Test;

import org.powermock.reflect.Whitebox;

import org.slf4j.*;

import org.slf4j.Logger;

import org.slf4j.LoggerFactory;



/**

 * @author peng-yongsheng
@@ -57,10 +67,10 @@ public class ITElasticSearchClient { 
    }



    @Before

    public void before() throws IOException {

    public void before() throws Exception {

        final String esAddress = System.getProperty("elastic.search.address");

        final String esProtocol = System.getProperty("elastic.search.protocol");

        client = new ElasticSearchClient(esAddress, esProtocol, namespace, "test", "test");

        client = new ElasticSearchClient(esAddress, esProtocol, "", "", namespace, "test", "test");

        client.connect();

    }

oap-server/server-starter/src/main/assembly/application.yml

+2 −0
Original line number Diff line number Diff line
@@ -74,6 +74,8 @@ storage: 
#    nameSpace: ${SW_NAMESPACE:""}

#    clusterNodes: ${SW_STORAGE_ES_CLUSTER_NODES:localhost:9200}

#    protocol: ${SW_STORAGE_ES_HTTP_PROTOCOL:"http"}

#    trustStorePath: ${SW_SW_STORAGE_ES_SSL_JKS_PATH:"../es_keystore.jks"}

#    trustStorePass: ${SW_SW_STORAGE_ES_SSL_JKS_PASS:""}

#    user: ${SW_ES_USER:""}

#    password: ${SW_ES_PASSWORD:""}

#    indexShardsNumber: ${SW_STORAGE_ES_INDEX_SHARDS_NUMBER:2}