elasticsearch配置searchguard后java连接的配置

pom

    com.floragunn
    search-guard-ssl
    2.4.6.21

@Bean
public TransportClient initClient() throws UnknownHostException {
    log.info("初始化 elasticsearch client");
    String tmp = System.getProperty("java.io.tmpdir");
    log.info("tmp：{}", tmp);
    String keystore = tmp + File.separator + "keystore.jks";
    String truststore = tmp + File.separator + "truststore.jks";
    try (InputStream ksInput = new ClassPathResource("ca/keystore.jks").getInputStream();
         InputStream tsInput = new ClassPathResource("ca/truststore.jks").getInputStream();
         FileOutputStream keystoreStream = new FileOutputStream(keystore);
         FileOutputStream truststoreStream = new FileOutputStream(truststore)) {
        IOUtils.copy(ksInput, keystoreStream);
        IOUtils.copy(tsInput, truststoreStream);
    } catch (IOException e) {
        log.error("写入jks文件异常：{}", e);
    }
    Settings settings = Settings.builder()
            .put("path.home", ".")
            .put("cluster.name", esClusterName)
            .put(SSLConfigConstants.SEARCHGUARD_SSL_HTTP_ENABLED, true)
            .put(SSLConfigConstants.SEARCHGUARD_SSL_TRANSPORT_KEYSTORE_FILEPATH, keystore)
            .put(SSLConfigConstants.SEARCHGUARD_SSL_TRANSPORT_TRUSTSTORE_FILEPATH, truststore)
            .put(SSLConfigConstants.SEARCHGUARD_SSL_TRANSPORT_KEYSTORE_PASSWORD, "KEYSTORE密码")
            .put(SSLConfigConstants.SEARCHGUARD_SSL_TRANSPORT_TRUSTSTORE_PASSWORD, "TRUSTSTORE密码")
            .put("searchguard.ssl.transport.enforce_hostname_verification", false)
            .build();

    TransportClient client = TransportClient
                .builder()
                .settings(settings)
                .addPlugin(SearchGuardSSLPlugin.class)
                .build();

    String[] addresses = esAddress.split(",");
    for (String add : addresses) {
        TransportAddress address = new InetSocketTransportAddress(InetAddress.getByName(add.split(":")[0]), Integer.parseInt(add.split(":")[1]));
        client.addTransportAddress(address);
    }
    return client;
}

两个证书的目录

为什么每次都要建在临时目录下，因为是在docker里面，我也不清楚在什么地方，而keystore和truststore必须是绝对路径

addresses的结构是这种：ip:端口,ip:端口

参考文献

1. https://search-guard.com/searchguard-elasicsearch-transport-clients/
2. https://github.com/floragunncom/search-guard/issues/53