I've been tinkering further with Elasticsearch on Docker, establishing a TLS connection between it and IBM BPM.
Here's my notes: -
Pull Image
Start container
es=`docker run -d -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" docker.elastic.co/elasticsearch/elasticsearch:5.6.3`
Check logs
docker logs $es -f
Upload YAML for Certgen
docker cp ~/instances.yml $es:/usr/share/elasticsearch/config
Generate Self-Signed Certificate, plus Keys
docker exec -i -t $es /bin/bash -c "/usr/share/elasticsearch/bin/x-pack/certgen -in /usr/share/elasticsearch/config/instances.yml -out /usr/share/elasticsearch/certificate-bundle.zip"
Download Certificates
docker cp $es:/usr/share/elasticsearch/certificate-bundle.zip ~
Stop Container
docker stop $es
Remove Container
docker rm $es
Extract and place certificates and key
tar xvzf ~/certificate-bundle.zip --strip-components=1 -C ~/Desktop/elasticsearch-config/x-pack ca/ca.crt
tar xvzf ~/certificate-bundle.zip --strip-components=1 -C ~/Desktop/elasticsearch-config/x-pack node1/node1.crt
tar xvzf ~/certificate-bundle.zip --strip-components=1 -C ~/Desktop/elasticsearch-config/x-pack node1/node1.key
Re-start container
Note; we're mapping ~/Desktop/elasticsearch-config as the ES config root
es=`docker run -d -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" -v /Users/davidhay/Desktop/elasticsearch-config:/usr/share/elasticsearch/config docker.elastic.co/elasticsearch/elasticsearch:5.6.3`
Check logs
docker logs $es -f
Test using Curl - on host
curl --insecure https://localhost:9200 -u elastic:changeme
Should return: -
{
"name" : "-2S40f4",
"cluster_name" : "docker-cluster",
"cluster_uuid" : "zV8P1a4FR26Q_J_h1E0QKA",
"version" : {
"number" : "5.6.3",
"build_hash" : "1a2f265",
"build_date" : "2017-10-06T20:33:39.012Z",
"build_snapshot" : false,
"lucene_version" : "6.6.1"
},
"tagline" : "You Know, for Search"
}
or similar
Test using browser
Default credentials are elastic/changeme
Should return same JSON
Test on BPM box
Hostname node1.uk.ibm.com aliased to IP address of host Mac
curl --insecure https://node1.uk.ibm.com:9200 -u elastic:changeme
{
"name" : "-2S40f4",
"cluster_name" : "docker-cluster",
"cluster_uuid" : "zV8P1a4FR26Q_J_h1E0QKA",
"version" : {
"number" : "5.6.3",
"build_hash" : "1a2f265",
"build_date" : "2017-10-06T20:33:39.012Z",
"build_snapshot" : false,
"lucene_version" : "6.6.1"
},
"tagline" : "You Know, for Search"
}
or similar
Place CA certificate on BPM box
scp ~/Desktop/elasticsearch-config/x-pack/ca.crt wasadmin@bpm86:~
Update BPM Event Emitter YAML files
vi /opt/ibm/WebSphereProfiles/Dmgr01/config/cells/PCCell1/nodes/Node1/servers/SupClusterMember1/analytics/config/BPMEventEmitter.yml
vi /opt/ibm/WebSphereProfiles/Dmgr01/config/cells/PCCell1/clusters/SupCluster/analytics/config/BPMEventEmitter.yml
ES configuration as follows: -
...
esConfiguration:
enabled: true
# The Elasticsearch index name
index: bpm-events
# Enable the following properties when Elasticsearch security is on.
username: elastic
password: changeme
httpsTrustType: CRT
trustFileLocation: /home/wasadmin/ca.crt
hostnameVerifier: false
esTaskIndex: restore_task_index
...
Synchronise Node
/opt/ibm/WebSphereProfiles/Dmgr01/bin/wsadmin.sh -lang jython -f fullSync.jy
Validate Sync
ls -al `find /opt/ibm/WebSphereProfiles -name BPMEventEmitter.yml`
-rw-r--r-- 1 wasadmin wasadmins 2793 Oct 19 16:54 /opt/ibm/WebSphereProfiles/AppSrv01/config/cells/PCCell1/clusters/SupCluster/analytics/config/BPMEventEmitter.yml
-rw-r--r-- 1 wasadmin wasadmins 2793 Oct 19 16:54 /opt/ibm/WebSphereProfiles/AppSrv01/config/cells/PCCell1/nodes/Node1/servers/SupClusterMember1/analytics/config/BPMEventEmitter.yml
-rw-r--r-- 1 wasadmin wasadmins 2762 Sep 18 08:51 /opt/ibm/WebSphereProfiles/AppSrv01/installedApps/PCCell1/BPMEventEmitter_war_De1.ear/BPMEventEmitter.war/WEB-INF/classes/BPMEventEmitter.yml
-rw-r--r-- 1 wasadmin wasadmins 2797 Oct 19 17:19 /opt/ibm/WebSphereProfiles/Dmgr01/config/cells/PCCell1/clusters/SupCluster/analytics/config/BPMEventEmitter.yml
-rw-r--r-- 1 wasadmin wasadmins 2797 Oct 19 17:19 /opt/ibm/WebSphereProfiles/Dmgr01/config/cells/PCCell1/nodes/Node1/servers/SupClusterMember1/analytics/config/BPMEventEmitter.yml
All but BPMEventEmitter_war_De1.ear version of file should be the same size/date/time
Start App
/opt/ibm/WebSphereProfiles/Dmgr01/bin/wsadmin.sh -lang jython
AdminControl.invoke('WebSphere:name=ApplicationManager,process=SupClusterMember1,platform=proxy,node=Node1,version=8.5.5.12,type=ApplicationManager,mbeanIdentifier=ApplicationManager,cell=PCCell1,spec=1.0', 'startApplication', '[BPMEventEmitter_war_De1]')
quit
Check Logs
tail -f /opt/ibm/WebSphereProfiles/AppSrv01/logs/SupClusterMember1/SystemOut.log
Note
If you see this: -
Caused by: javax.net.ssl.SSLPeerUnverifiedException: Host name '9.174.27.153' does not match the certificate subject provided by the peer (CN=node1, DC=uk, DC=ibm, DC=com)
use: -
hostnameVerifier: false
in BPMEventEmitter.yml
Backup
No comments:
Post a Comment