在EC2部署Elasticsearch集群遇ElasticsearchSecurityException错误求助

启动EC2上的Elasticsearch集群时遇到以下错误：

org.elasticsearch.ElasticsearchSecurityException: invalid configuration for xpack.security.transport.ssl - [xpack.security.transport.ssl.enabled] is not set, but the following settings have been configured in elasticsearch.yml : [xpack.security.transport.ssl.keystore.secure_password,xpack.security.transport.ssl.truststore.secure_password]

用于引导集群的脚本：

"#!/bin/bash",
"sudo yum update -y",
"sudo yum install java-1.8.0 -y",
"sudo rpm -i https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-${var.elastic_version}-x86_64.rpm",
"sudo systemctl daemon-reload",
"sudo systemctl enable elasticsearch.service",
"sudo chmod -R 777 /etc/elasticsearch",
"sudo sed -i 's@-Xms1g@-Xms${aws_instance.elastic_datanodes[count.index].root_block_device[0].volume_size / 2}g@g' /etc/elasticsearch/jvm.options",
"sudo sed -i 's@-Xmx1g@-Xmx${aws_instance.elastic_datanodes[count.index].root_block_device[0].volume_size / 2}g@g' /etc/elasticsearch/jvm.options",
# "sudo sed -i 's/#network.host: 192.168.0.1/network.host: 0.0.0.0/g' /etc/elasticsearch/elasticsearch.yml",
"sudo rm /etc/elasticsearch/elasticsearch.yml",
"sudo cp elasticsearch.yml /etc/elasticsearch/elasticsearch.yml",
"sudo systemctl start elasticsearch.service"

elasticsearch.yml配置：

# ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
#       Before you set out to tweak and tune the configuration, make sure you
#       understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please consult the documentation for further information on configuration options:
# https://www.elastic.co/guide/en/elasticsearch/reference/index.html
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
cluster.name: ${cluster_name}
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
node.name: ${node_name}
#
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
path.data: /var/lib/elasticsearch
#
# Path to log files:
#
path.logs: /var/log/elasticsearch
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
#bootstrap.memory_lock: true
#
# Make sure that the heap size is set to about half the memory available
# on the system and that the owner of the process is allowed to use this
# limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
network.host: ${node}
#
# Set a custom port for HTTP:
#
http.port: 9200
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#

discovery.seed_hosts:
%{ for seed_host in seed_hosts ~}
  - "${seed_host}"
%{ endfor ~}

#
# Bootstrap the cluster using an initial set of master-eligible nodes:
#

cluster.initial_master_nodes:
%{ for master_node in initial_master_nodes ~}
  - "${master_node}"
%{ endfor ~}

node.roles: [data, master]
#
# For more information, consult the discovery and cluster formation module documentation.
#
# ---------------------------------- Gateway -----------------------------------
#
# Block initial recovery after a full cluster restart until N nodes are started:
#
#gateway.recover_after_nodes: 3
#
# For more information, consult the gateway module documentation.
#
# ---------------------------------- Various -----------------------------------
#
# Require explicit names when deleting indices:
#
#action.destructive_requires_name: true

请问该错误产生的原因是什么？我可以通过禁用所有安全设置来规避，但出于安全考虑我不愿这么做。

错误原因 #

问题出在Elasticsearch的X-Pack安全配置逻辑：你已经配置了Transport SSL的密钥库/信任库密码参数，但没有显式启用Transport SSL功能。Elasticsearch要求，只要配置了Transport SSL的具体参数（如密码），就必须明确开启该功能，否则会判定配置无效，阻止集群启动。

解决方案 #

要保留安全设置并解决问题，需要在elasticsearch.yml中补充完整的Transport SSL配置：

1. 显式启用Transport SSL：

   xpack.security.transport.ssl.enabled: true
   

2. 补充密钥库和信任库的文件路径（如果尚未配置）：

   xpack.security.transport.ssl.keystore.path: /etc/elasticsearch/elasticsearch-certificates.p12
   xpack.security.transport.ssl.truststore.path: /etc/elasticsearch/elasticsearch-certificates.p12
   

   注意：替换为你实际生成的证书文件路径，所有集群节点都需要同步这份证书文件。

3. 确保X-Pack安全模块处于启用状态（默认已启用，可显式声明）：

   xpack.security.enabled: true
   

完整的安全配置示例片段：

xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.keystore.path: elasticsearch-certificates.p12
xpack.security.transport.ssl.keystore.secure_password: your_keystore_password
xpack.security.transport.ssl.truststore.path: elasticsearch-certificates.p12
xpack.security.transport.ssl.truststore.secure_password: your_truststore_password
xpack.security.transport.ssl.verification_mode: certificate

额外注意事项：

• 所有集群节点的Transport SSL配置必须完全一致，包括证书文件、密码和验证模式。
• 证书文件需要设置正确的权限，确保Elasticsearch进程能读取：

  sudo chown elasticsearch:elasticsearch /etc/elasticsearch/elasticsearch-certificates.p12
  sudo chmod 600 /etc/elasticsearch/elasticsearch-certificates.p12
  

修改配置后重启Elasticsearch服务即可正常启动集群。

内容的提问来源于stack exchange，提问作者James Stonehill