Connecting to an Elasticsearch cluster

Configure all the cluster security groups to allow incoming traffic from any IP on ports 443 (Kibana GUI and Kibana API) and 9200 (Elasticsearch). To do this, create the following rules for incoming traffic:

• Port range: 443, 9200
• Protocol: TCP
• Source: CIDR
• CIDR blocks: 0.0.0.0/0

A separate rule is created for each port.

mkdir -p ~/.elasticsearch && \
wget "https://storage.yandexcloud.net/cloud-certs/CA.pem" \
     --output-document ~/.elasticsearch/root.crt && \
chmod 0600 ~/.elasticsearch/root.crt

The certificate is saved to the ~/.elasticsearch/root.crt file.

If a host with the Data node role is assigned a public IP address:

1. Before connecting, install the SSL certificate in your browser's trusted root certificate store (instructions for Mozilla Firefox).
2. In your browser, go to one of the addresses:
   • https://c-<Elasticsearch_cluster_ID>.rw.mdb.yandexcloud.net, if a public IP address is assigned to all hosts with this role. You can get the cluster ID with a list of clusters in the folder.
   • https://<FQDN_of_any_Data_Node_host_with_public_IP>.mdb.yandexcloud.net.
3. Enter your username and password.

If no host with the Data node role is assigned a public IP address:

1. Create a Linux VM in the same network as the cluster.

2. Connect to the virtual machine over SSH.

3. Install the dependencies:

   sudo apt update && sudo apt install -y nginx ssl-cert
   

4. Copy the downloaded SSL certificate to the /etc/nginx/ directory :

   sudo cp ~/.elasticsearch/root.crt /etc/nginx/root.crt
   

5. Edit the NGINX default configuration file, for example, like this:

   /etc/nginx/sites-available/default

   upstream es-datanodes {
      server <FQDN_of_Data_Node_host_1>:443;
      ...
      server <FQDN_of_Data_Node_host_N>:443;
   }
   
   server {
      listen 443 ssl;
   
      ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
      ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
   
      server_name _;
   
      location / {
   
          proxy_pass https://es-datanodes;
   
          proxy_ssl_trusted_certificate /etc/nginx/root.crt;
          proxy_ssl_session_reuse on;
      }
   }
   

   You can also use the proxy_pass directive with a special FQDN:

   proxy_pass https://c-<Elasticsearch_cluster_ID>.rw.mdb.yandexcloud.net.
   

   Warning

   This configuration file example uses a self-signed snakeoil certificate from the ssl-cert package. It is not safe to use this certificate in a real cluster. Instead of the self-signed certificate, specify the path to your public and private SSL certificate keys in the ssl_certificate and ssl_certificate_key directives.

6. Restart NGINX:

   sudo systemctl restart nginx
   

7. Add the certificate specified in the ssl_certificate directive to the browser's trusted root certificate store (instructions for Mozilla Firefox).

8. In your browser, open https://<VM_public_IP_address>.

9. Enter your username and password.