Elasticsearch on Kubernetes 运维面试题

# ECK Operator 安装
kubectl create -f https://download.elastic.co/downloads/eck/2.16.1/crds.yaml
kubectl apply -f https://download.elastic.co/downloads/eck/2.16.1/operator.yaml

# ECK CRD 列表
kubectl api-resources --api-group elasticsearch.k8s.elastic.co
# NAME                 SHORTNAMES   APIGROUP                     NAMESPACED   KIND
# agents                            agent.k8s.elastic.co         true         Agent
# apmservers                        apm.k8s.elastic.co           true         ApmServer
# beats                             beat.k8s.elastic.co          true         Beat
# elasticsearches       es          elasticsearch.k8s.elastic.co true         Elasticsearch
# enterprisesearches    ents        enterprisesearch.k8s.elastic.co true      EnterpriseSearch
# kibanas               kb          kibana.k8s.elastic.co        true         Kibana
# logstashes            ls          logstash.k8s.elastic.co      true         Logstash
# elasticmapsservers    ems         maps.k8s.elastic.co          true         ElasticMapsServer

apiVersion: elasticsearch.k8s.elastic.co/v1
kind: Elasticsearch
metadata:
  name: production
spec:
  version: 8.17.0
  nodeSets:
    # Master 专用节点池
    - name: master
      count: 3
      config:
        node.roles: ["master"]
        node.store.allow_mmap: false
      podTemplate:
        spec:
          containers:
            - name: elasticsearch
              resources:
                requests:
                  memory: "2Gi"
                  cpu: "1"
                limits:
                  memory: "2Gi"
                  cpu: "2"
      volumeClaimTemplates:
        - metadata:
            name: elasticsearch-data
          spec:
            accessModes: ["ReadWriteOnce"]
            resources:
              requests:
                storage: 10Gi

    # Data Hot 节点池
    - name: data-hot
      count: 6
      config:
        node.roles: ["data_hot"]
        node.attr.data: "hot"
      podTemplate:
        spec:
          containers:
            - name: elasticsearch
              resources:
                requests:
                  memory: "16Gi"
                  cpu: "4"
                limits:
                  memory: "16Gi"
                  cpu: "8"
      volumeClaimTemplates:
        - metadata:
            name: elasticsearch-data
          spec:
            accessModes: ["ReadWriteOnce"]
            storageClassName: "ssd"
            resources:
              requests:
                storage: 1Ti

    # Ingest 节点池
    - name: ingest
      count: 2
      config:
        node.roles: ["ingest"]
      podTemplate:
        spec:
          containers:
            - name: elasticsearch
              resources:
                requests:
                  memory: "4Gi"
                  cpu: "2"
                limits:
                  memory: "4Gi"
                  cpu: "4"

// ILM Policy — Hot -> Warm -> Cold -> Delete
PUT _ilm/policy/logs-policy
{
  "policy": {
    "phases": {
      "hot": {
        "min_age": "0ms",
        "actions": {
          "rollover": {
            "max_primary_shard_size": "50gb",
            "max_age": "1d"
          },
          "set_priority": { "priority": 100 }
        }
      },
      "warm": {
        "min_age": "3d",
        "actions": {
          "allocate": {
            "require": { "data": "warm" }
          },
          "forcemerge": { "max_num_segments": 1 },
          "shrink": { "number_of_shards": 1 },
          "set_priority": { "priority": 50 }
        }
      },
      "cold": {
        "min_age": "30d",
        "actions": {
          "allocate": {
            "require": { "data": "cold" }
          },
          "searchable_snapshot": {
            "snapshot_repository": "s3-backup"
          },
          "set_priority": { "priority": 0 }
        }
      },
      "delete": {
        "min_age": "90d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

# ECK — 热温冷节点配置
apiVersion: elasticsearch.k8s.elastic.co/v1
kind: Elasticsearch
spec:
  nodeSets:
    - name: hot
      count: 3
      config:
        node.roles: ["data_hot"]
        node.attr.data: "hot"
      volumeClaimTemplates:
        - spec:
            storageClassName: "ssd"
            resources:
              requests:
                storage: 500Gi
    - name: warm
      count: 3
      config:
        node.roles: ["data_warm"]
        node.attr.data: "warm"
      volumeClaimTemplates:
        - spec:
            storageClassName: "hdd"
            resources:
              requests:
                storage: 2Ti
    - name: cold
      count: 2
      config:
        node.roles: ["data_cold"]
        node.attr.data: "cold"
      volumeClaimTemplates:
        - spec:
            storageClassName: "hdd"
            resources:
              requests:
                storage: 5Ti

apiVersion: kibana.k8s.elastic.co/v1
kind: Kibana
metadata:
  name: production
spec:
  version: 8.17.0
  count: 2
  elasticsearchRef:
    name: production
    namespace: elastic-stack
  config:
    server.publicBaseUrl: https://kibana.example.com
    xpack.fleet.agents.elasticsearch.hosts:
      - https://production-es-http:9200
  podTemplate:
    spec:
      containers:
        - name: kibana
          resources:
            requests:
              memory: 2Gi
              cpu: 1
            limits:
              memory: 4Gi
              cpu: 2
  http:
    tls:
      selfSignedCertificate:
        disabled: true
# Ingress 暴露
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: kibana-ingress
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  tls:
    - hosts:
        - kibana.example.com
      secretName: kibana-tls
  rules:
    - host: kibana.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: production-kb-http
                port:
                  number: 5601

# Dashboard 导入导出
# 导出
curl -X POST "https://kibana.example.com/api/saved_objects/_export" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{ "type": "dashboard", "includeReferencesDeep": true }' \
  -o dashboards.ndjson

# 导入
curl -X POST "https://kibana.example.com/api/saved_objects/_import?overwrite=true" \
  -H "kbn-xsrf: true" \
  --form file=@dashboards.ndjson

# Filebeat Sidecar — 采集应用日志
apiVersion: beat.k8s.elastic.co/v1beta1
kind: Beat
metadata:
  name: app-filebeat
spec:
  type: filebeat
  version: 8.17.0
  elasticsearchRef:
    name: production
  config:
    filebeat.inputs:
      - type: container
        paths:
          - /var/log/containers/*.log
        processors:
          - add_kubernetes_metadata:
              host: ${NODE_NAME}
              matchers:
                - logs_path:
                    logs_path: "/var/log/containers/"
    output.elasticsearch:
      hosts: ["${ECK_ES_HOSTS}"]
      username: "${ECK_ES_USER}"
      password: "${ECK_ES_PASSWORD}"
  daemonSet:
    podTemplate:
      spec:
        serviceAccountName: filebeat
        containers:
          - name: filebeat
            securityContext:
              runAsUser: 0
            volumeMounts:
              - name: varlog
                mountPath: /var/log
            env:
              - name: NODE_NAME
                valueFrom:
                  fieldRef:
                    fieldPath: spec.nodeName
        volumes:
          - name: varlog
            hostPath:
              path: /var/log

# Metricbeat — 采集 ES 集群指标
apiVersion: beat.k8s.elastic.co/v1beta1
kind: Beat
metadata:
  name: metricbeat
spec:
  type: metricbeat
  version: 8.17.0
  elasticsearchRef:
    name: production
  kibanaRef:
    name: production
  config:
    metricbeat.modules:
      - module: elasticsearch
        metricsets: ["node", "node_stats", "index", "cluster_stats"]
        period: 10s
        hosts: ["https://${ECK_ES_HOSTS}:9200"]
        username: "${ECK_ES_USER}"
        password: "${ECK_ES_PASSWORD}"
        ssl.verification_mode: "certificate"
      - module: kubernetes
        metricsets: ["node", "system", "pod", "container", "volume"]
        period: 10s
        host: ${NODE_NAME}
    output.elasticsearch:
      hosts: ["https://${ECK_ES_HOSTS}:9200"]
      username: "${ECK_ES_USER}"
      password: "${ECK_ES_PASSWORD}"
  deployment:
    podTemplate:
      spec:
        serviceAccountName: metricbeat

apiVersion: apm.k8s.elastic.co/v1
kind: ApmServer
metadata:
  name: production
spec:
  version: 8.17.0
  count: 3
  elasticsearchRef:
    name: production
  kibanaRef:
    name: production
  config:
    apm-server:
      host: "0.0.0.0:8200"
      secret_token: "${APM_SECRET_TOKEN}"
      rum:
        enabled: true
        allow_origins: ["https://app.example.com"]
        source_mapping:
          cache.expiration: 5m
          index_pattern: "apm-*-sourcemap*"
      sampling:
        tail:
          enabled: true
          interval: 1m
          policies:
            - sample_rate: 0.1
            - sample_rate: 1.0
              trace.name: "checkout"
  http:
    tls:
      selfSignedCertificate:
        disabled: true
  podTemplate:
    spec:
      containers:
        - name: apm-server
          resources:
            requests:
              memory: 512Mi
              cpu: 500m
            limits:
              memory: 1Gi
              cpu: 1

// Java APM Agent 配置示例
// -javaagent:elastic-apm-agent.jar \
//   -Delastic.apm.server_url=https://apm.example.com \
//   -Delastic.apm.secret_token=${APM_SECRET_TOKEN} \
//   -Delastic.apm.service_name=order-service \
//   -Delastic.apm.environment=production \
//   -Delastic.apm.application_packages=com.example.order

# 完整 Elastic Stack 部署示例
# Elasticsearch
apiVersion: elasticsearch.k8s.elastic.co/v1
kind: Elasticsearch
metadata:
  name: production
  namespace: elastic-stack
spec:
  version: 8.17.0
  nodeSets:
    - name: default
      count: 3
      config:
        node.store.allow_mmap: false
      volumeClaimTemplates:
        - metadata:
            name: elasticsearch-data
          spec:
            resources:
              requests:
                storage: 200Gi

# Kibana
apiVersion: kibana.k8s.elastic.co/v1
kind: Kibana
metadata:
  name: production
  namespace: elastic-stack
spec:
  version: 8.17.0
  count: 1
  elasticsearchRef:
    name: production

# APM Server
apiVersion: apm.k8s.elastic.co/v1
kind: ApmServer
metadata:
  name: production
  namespace: elastic-stack
spec:
  version: 8.17.0
  count: 2
  elasticsearchRef:
    name: production

# Filebeat DaemonSet
apiVersion: beat.k8s.elastic.co/v1beta1
kind: Beat
metadata:
  name: filebeat
  namespace: elastic-stack
spec:
  type: filebeat
  version: 8.17.0
  elasticsearchRef:
    name: production
  kibanaRef:
    name: production
  config:
    filebeat.inputs:
      - type: container
        paths: ["/var/log/containers/*.log"]
    output.elasticsearch:
      hosts: ["https://${ECK_ES_HOSTS}:9200"]
  daemonSet: {}

# 完整生产环境配置示例
apiVersion: elasticsearch.k8s.elastic.co/v1
kind: Elasticsearch
metadata:
  name: production
  namespace: elastic-stack
spec:
  version: 8.17.0
  updateStrategy:
    changeBudget:
      maxUnavailable: 1

  # Master 节点池
  nodeSets:
    - name: master
      count: 3
      config:
        node.roles: ["master"]
        node.store.allow_mmap: false
        xpack.security.authc.accept_default_password: false
      podTemplate:
        spec:
          initContainers:
            - name: sysctl
              securityContext:
                privileged: true
              command:
                - sysctl
                - -w
                - vm.max_map_count=262144
          containers:
            - name: elasticsearch
              env:
                - name: ES_JAVA_OPTS
                  value: "-Xms2g -Xmx2g"
              resources:
                requests:
                  memory: 4Gi
                  cpu: 1
                limits:
                  memory: 4Gi
                  cpu: 2
      volumeClaimTemplates:
        - metadata:
            name: elasticsearch-data
          spec:
            accessModes: ["ReadWriteOnce"]
            resources:
              requests:
                storage: 20Gi

    # Data Hot 节点池
    - name: data-hot
      count: 6
      config:
        node.roles: ["data_hot", "data_content"]
        node.attr.data: "hot"
        node.store.allow_mmap: false
        # 慢查询日志
        index.search.slowlog.threshold.query.warn: 5s
        index.search.slowlog.threshold.query.info: 2s
        index.indexing.slowlog.threshold.index.warn: 5s
      podTemplate:
        spec:
          initContainers:
            - name: sysctl
              securityContext:
                privileged: true
              command: ["sysctl", "-w", "vm.max_map_count=262144"]
          containers:
            - name: elasticsearch
              env:
                - name: ES_JAVA_OPTS
                  value: "-Xms16g -Xmx16g"
              resources:
                requests:
                  memory: 32Gi
                  cpu: 8
                limits:
                  memory: 32Gi
                  cpu: 8
              readinessProbe:
                exec:
                  command:
                    - bash
                    - -c
                    - |
                      curl -s -k -u "elastic:${ELASTIC_PASSWORD}" https://localhost:9200/_cluster/health?local=true | grep -q '"status":"green"'
                initialDelaySeconds: 120
                periodSeconds: 30
      volumeClaimTemplates:
        - metadata:
            name: elasticsearch-data
          spec:
            accessModes: ["ReadWriteOnce"]
            storageClassName: "ssd"
            resources:
              requests:
                storage: 1Ti

    # Ingest 节点池
    - name: ingest
      count: 2
      config:
        node.roles: ["ingest"]
      podTemplate:
        spec:
          containers:
            - name: elasticsearch
              env:
                - name: ES_JAVA_OPTS
                  value: "-Xms4g -Xmx4g"
              resources:
                requests:
                  memory: 8Gi
                  cpu: 2
                limits:
                  memory: 8Gi
                  cpu: 4

  # TLS 安全配置
  http:
    tls:
      selfSignedCertificate:
        disabled: true
      certificate:
        secretName: es-http-tls
  transport:
    tls:
      certificate:
        secretName: es-transport-tls

  # 监控集成
  monitoring:
    metrics:
      elasticsearchRefs:
        - name: production
    logs:
      elasticsearchRefs:
        - name: production

# Network Policy — 限制 ES Pod 通信范围
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: es-network-policy
  namespace: elastic-stack
spec:
  podSelector:
    matchLabels:
      elasticsearch.k8s.elastic.co/cluster-name: production
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - podSelector: {}
        - namespaceSelector:
            matchLabels:
              name: monitoring
      ports:
        - protocol: TCP
          port: 9200
        - protocol: TCP
          port: 9300
  egress:
    - to:
        - podSelector:
            matchLabels:
              elasticsearch.k8s.elastic.co/cluster-name: production
      ports:
        - protocol: TCP
          port: 9300