在 Linux on IBM Z and LinuxONE 上创建一个 Elasticsearch 数据存储

确保已准备好联机和脱机主机以从外部存储库中拉取映像。 此外，请确保已添加 Helm 存储库。

有关详细信息，请参阅 “准备安装数据存储操作员 ”。

置顶的 Helm Chart 或操作程序版本需要以下映像。

表 1. 运算符版本和图像标签

平台	操作程序版本	Helm Chart 版本	带有标记的图像
Linux® on IBM Z® and LinuxONE	3.4.1	3.4.1	artifact-public.instana.io/self-hosted-images/3rd-party/operator/elasticsearch: 3.4.1_v0.34.0 artifact-public.instana.io/self-hosted-images/3rd-party/datastore/elasticsearch: 8.18.6_v0.24.0

完成以下步骤以安装 Elasticsearch 数据存储器。

1. 创建 instana-elastic 名称空间。

   kubectl create namespace instana-elastic
    

2. 创建服务 elasticsearch 账户。

   kubectl create serviceaccount elasticsearch -n instana-elastic
    

3. 为 instana-elastic 名称空间创建映像拉取私钥。 使用您自己的下载密钥更新 <download_key> 值。

   kubectl create secret docker-registry instana-registry --namespace instana-elastic \
   --docker-username=_ \
   --docker-password=<download_key> \
   --docker-server=artifact-public.instana.io
    

4. 创建 custom_values.yaml 并指定容差和亲和力。 如果文件已创建，请跳过此步骤。

   tolerations:
   - key: node.instana.io/monitor
     operator: Equal
     effect: NoSchedule
     value: "true"
   affinity:
     nodeAffinity:
       requiredDuringSchedulingIgnoredDuringExecution:
         nodeSelectorTerms:
           - matchExpressions:
               - key: node-role.kubernetes.io/monitor
                 operator: In
                 values:
                 - "true"
    

5. 安装 Elasticsearch 操作程序。

   helm install elastic-operator instana/eck-operator -n instana-elastic --version=3.4.1 --set image.repository=artifact-public.instana.io/self-hosted-images/3rd-party/operator/elasticsearch --set image.tag=3.4.1_v0.34.0 --set imagePullSecrets[0].name=instana-registry -f custom_values.yaml
    

6. 创建一个名为 YAML 的文件，例如 elastic.yaml，其中包含 Elasticsearch 配置。

   apiVersion: elasticsearch.k8s.elastic.co/v1
   kind: Elasticsearch
   metadata:
     name: instana
   spec:
     image: artifact-public.instana.io/self-hosted-images/3rd-party/datastore/elasticsearch:8.18.6_v0.24.0
     version: 8.18.6
     nodeSets:
       - name: default
         count: 3
         config:
           node.roles:
             - master
             - ingest
             - data
           node.store.allow_mmap: false
           xpack.ml.enabled: false
         podTemplate:
           spec:
             serviceAccountName: elasticsearch
             imagePullSecrets:
               - name: instana-registry
             affinity:
                nodeAffinity:
                  requiredDuringSchedulingIgnoredDuringExecution:
                    nodeSelectorTerms:
                      - matchExpressions:
                          - key: node-role.kubernetes.io/monitor
                            operator: In
                            values:
                            - "true"
             tolerations:
               - key: node.instana.io/monitor
                 operator: Equal
                 effect: NoSchedule
                 value: "true"
             # Add the following securityContext snippet for Kubernetes offerings other than OCP.
             # securityContext:
             #   fsGroup: 1000
             #   runAsGroup: 1000
             #   runAsUser: 1000
         volumeClaimTemplates:
           - metadata:
               name: elasticsearch-data # Do not change this name unless you set up a volume mount for the data path.
             spec:
               accessModes:
                 - ReadWriteOnce
               resources:
                 requests:
                   storage: 20Gi
     http:
       tls:
         selfSignedCertificate:
           disabled: true
    

7. 完成 部署和验证 Elasticsearch (联机和脱机)中的步骤。

如果在 准备安装时尚未从外部注册表中拉取 Elasticsearch 映像，那么可以立即拉取这些映像。 在防御主机上运行以下命令。 然后，将这些图像复制到位于物理隔离环境中的 Instana 主机上。

docker pull artifact-public.instana.io/self-hosted-images/3rd-party/operator/elasticsearch:3.4.1_v0.34.0
docker pull artifact-public.instana.io/self-hosted-images/3rd-party/datastore/elasticsearch:8.18.6_v0.24.0
         

请在您的 Instana 主机上完成以下步骤。

1. 将映像重新标记到内部映像注册表。

    docker tag artifact-public.instana.io/self-hosted-images/3rd-party/operator/elasticsearch:3.4.1_v0.34.0 <internal-image-registry>/elasticsearch/eck-operator:3.4.1_v0.34.0
    docker tag artifact-public.instana.io/self-hosted-images/3rd-party/datastore/elasticsearch:8.18.6_v0.24.0 <internal-image-registry>/elasticsearch/elasticsearch:8.18.6_v0.24.0
                  

2. 将映像推送到防御主机上的内部映像注册表。

    docker push <internal-image-registry>/operator/elasticsearch:3.4.1_v0.34.0
    docker push <internal-image-registry>/datastore/elasticsearch:8.18.6_v0.24.0
                  

3. 为 Elasticsearch 实例创建 instana-elastic 名称空间。

   kubectl create namespace instana-elastic
    

4. 创建服务 elasticsearch 账户。

   kubectl create serviceaccount elasticsearch -n instana-elastic
    

5. 可选：如果内部图像注册表需要身份验证，请创建图像拉取密钥。

   kubectl create secret docker-registry <secret_name> --namespace instana-elastic \
   --docker-username=<registry_username> \
   --docker-password=<registry_password> \
   --docker-server=<internal-image-registry>:<internal-image-registry-port> \
   --docker-email=<registry_email>
    

6. 创建 custom_values.yaml 并指定容差和亲和力。 如果文件已创建，请跳过此步骤。

   tolerations:
   - key: node.instana.io/monitor
     operator: Equal
     effect: NoSchedule
     value: "true"
   affinity:
     nodeAffinity:
       requiredDuringSchedulingIgnoredDuringExecution:
         nodeSelectorTerms:
           - matchExpressions:
               - key: node-role.kubernetes.io/monitor
                 operator: In
                 values:
                 - "true"
    

7. 安装 Elasticsearch 操作程序。 如果您在上一步中创建了图像拉取秘密，请在以下命令中添加 --set imagePullSecrets[0].name="<internal-image-registry-pull-secret>" 。

   helm install elastic-operator eck-operator-3.4.1.tgz -n instana-elastic --version=3.4.1 --set image.repository=<internal-image-registry>/operator/elasticsearch --set image.tag=3.4.1_v0.34.0 -f custom_values.yaml
    

8. 创建一个名为 YAML 的文件，例如 elasticsearch.yaml，其中包含 Elasticsearch 配置。

   apiVersion: elasticsearch.k8s.elastic.co/v1
   kind: Elasticsearch
   metadata:
     name: instana
   spec:
     image: <internal-image-registry>/elasticsearch/elasticsearch:8.18.6_v0.24.0
     version: 8.18.6
     nodeSets:
       - name: default
         count: 3
         config:
           node.roles:
             - master
             - ingest
             - data
           node.store.allow_mmap: false
           xpack.ml.enabled: false
         podTemplate:
           spec:
             serviceAccountName: elasticsearch
             imagePullSecrets:
               - name: <internal-image-registry-pull-secret>
             nodeAffinity:
               requiredDuringSchedulingIgnoredDuringExecution:
                 nodeSelectorTerms:
                   - matchExpressions:
                       - key: node-role.kubernetes.io/monitor
                         operator: In
                         values:
                         - "true"
             tolerations:
               - key: node.instana.io/monitor
                 operator: Equal
                 effect: NoSchedule
                 value: "true"
             # Add the following securityContext snippet for Kubernetes offerings other than OCP.
             # securityContext:
             #   fsGroup: 1000
             #   runAsGroup: 1000
             #   runAsUser: 1000
         volumeClaimTemplates:
           - metadata:
               name: elasticsearch-data # Do not change this name unless you set up a volume mount for the data path.
             spec:
               accessModes:
                 - ReadWriteOnce
               resources:
                 requests:
                   storage: 20Gi
     http:
       tls:
         selfSignedCertificate:
           disabled: true
    

9. 完成 部署和验证 Elasticsearch (联机和脱机)中的步骤。

要部署 Elasticsearch 实例并创建数据存储器，请完成以下步骤:

1. 部署 Elasticsearch。 缺省情况下，将使用随机生成的密码创建名为 elastic 的用户。

   kubectl apply -f elastic.yaml -n instana-elastic
   kubectl wait elasticsearch/instana --for=condition=ReconciliationComplete --timeout=300s -n instana-elastic
    

2. 检索密码。

   kubectl get secret instana-es-elastic-user -n instana-elastic -o go-template='{{.data.elastic | base64decode}}' && echo
    

3. 将检索到的密码存储在 config.yaml 中，如以下代码段中所示。 将 <RETRIEVED_FROM_SECRET> 替换为您在上一步骤中获取的密码。

   datastoreConfigs:
     ...
     elasticsearchConfig:
       adminUser: elastic
       adminPassword: <RETRIEVED_FROM_SECRET>
       user: elastic
       password: <RETRIEVED_FROM_SECRET>
     ...
    

4. 验证 Elasticsearch 操作程序部署。

    kubectl get all -n instana-elastic
    

   如果成功部署了 Elasticsearch 操作程序，那么命令输出会将操作程序状态显示为 Running ，如以下示例中所示:

    NAME                       READY   STATUS    RESTARTS      AGE
    pod/elastic-operator-0     1/1     Running   1 (10m ago)   10m
    pod/instana-es-default-0   1/1     Running   0             6m44s
    pod/instana-es-default-1   1/1     Running   0             6m44s
    pod/instana-es-default-2   1/1     Running   0             6m44s
   
    NAME                               TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)    AGE
    service/elastic-operator-webhook   ClusterIP   192.168.1.41    <none>        443/TCP    10m
    service/instana-es-default         ClusterIP   None            <none>        9200/TCP   6m46s
    service/instana-es-http            ClusterIP   192.168.1.111   <none>        9200/TCP   6m48s
    service/instana-es-internal-http   ClusterIP   192.168.1.196   <none>        9200/TCP   6m48s
    service/instana-es-transport       ClusterIP   None            <none>        9300/TCP   6m48s
   
    NAME                                  READY   AGE
    statefulset.apps/elastic-operator     1/1     10m
    statefulset.apps/instana-es-default   3/3     6m48s
    

5. 请确保 Pod 已调度到目标节点上。

   kubectl get pods -n instana-elastic -o wide
    

   以下示例展示了输出结果。

   NAME                   READY   STATUS    RESTARTS   AGE   IP              NODE                                  NOMINATED NODE   READINESS GATES
   elastic-operator-0     1/1     Running   1          22d   10.254.12.202   worker0.instana-odf5.cp.fyre.ibm.com   <none>           <none>
   instana-es-default-0   1/1     Running   0          34h   10.254.16.137   worker1.instana-odf5.cp.fyre.ibm.com   <none>           <none>
   instana-es-default-1   1/1     Running   0          34h   10.254.24.101   worker2.instana-odf5.cp.fyre.ibm.com   <none>           <none>
   instana-es-default-2   1/1     Running   0          34h   10.254.20.186   worker3.instana-odf5.cp.fyre.ibm.com   <none>           <none>