Skip to content

Commit 67151cc

Browse files
eedugoneedugon
committed
reviewing suggestions applied
1 parent 7b30283 commit 67151cc

File tree

3 files changed

+42
-37
lines changed

3 files changed

+42
-37
lines changed

‎deploy-manage/remote-clusters/_snippets/eck_rcs_connect_intro.md‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,5 @@
1-
On the local deployment, add the remote ECK cluster using {{kib}} or the {{es}} API.
2-
3-
::::{note}
4-
When configuring the remote cluster connection:
1+
On the local deployment, add the remote ECK cluster using {{kib}} or the {{es}} API with the following connection settings:
52

63
* **Remote address**: Use the FQDN or IP address of the LoadBalancer service, or similar resource, you created to expose the remote cluster server interface (for API key-based authentication) or the transport interface (for TLS certificate-based authentication).
74

85
* **TLS server name**: You can try leaving this field empty first. If the connection fails, and your environment is presenting the ECK-managed certificates during the TLS handshake, use `<cluster-name>-es-remote-cluster.<namespace>.svc` as the server name. For example, for a cluster named `quickstart` in the `default` namespace, use `quickstart-es-remote-cluster.default.svc`.
9-
::::
10-

‎deploy-manage/remote-clusters/_snippets/eck_rcs_expose.md‎

Lines changed: 36 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,52 @@
1-
When the remote cluster server is enabled, ECK automatically creates a Kubernetes service named `<cluster-name>-es-remote-cluster` that exposes the server internally on port `9443`:
1+
When the remote cluster server is enabled, ECK automatically creates a Kubernetes service named `<cluster-name>-es-remote-cluster` that exposes the server internally on port `9443`.
22

3-
```sh
4-
quickstart-es-remote-cluster ClusterIP None <none> 9443/TCP 4h13m
5-
```
3+
To allow clusters running outside your Kubernetes environment to connect to this {{es}} cluster, you must expose this service externally. The way to expose this service depends on your ECK version.
4+
5+
::::{applies-switch}
66

7-
To allow other clusters running outside your Kubernetes environment to connect, you must expose this service externally. As of ECK {{version.eck}}, you cannot customize the service that ECK generates for the remote cluster interface, but you can create your own `LoadBalancer` service, `Ingress` object, or use another method available in your environment.
7+
:::{applies-item} eck: ga 3.0
88

9-
For example, the following command creates a service named `quickstart-es-remote-cluster-lb`, similar to the managed `quickstart-es-remote-cluster` but of type `LoadBalancer`.
9+
In ECK 3.2 and earlier you cannot customize the service that ECK generates for the remote cluster interface, but you can create your own `LoadBalancer` service, `Ingress` object, or use another method available in your environment.
10+
11+
For example, for a cluster named `quickstart`, the following command creates a separate `LoadBalancer` service named `quickstart-es-remote-cluster-lb`, pointing to the ECK-managed service `quickstart-es-remote-cluster`:
1012

1113
```sh
1214
kubectl expose service quickstart-es-remote-cluster \
1315
--name=quickstart-es-remote-cluster-lb \
1416
--type=LoadBalancer \ <1>
1517
--port=9443 --target-port=9443
1618
```
17-
1819
1. On cloud providers that support external load balancers, setting the type to `LoadBalancer` provisions a load balancer for your service. Alternatively, expose the service `<cluster-name>-es-remote-cluster` through one of the Kubernetes Ingress controllers that support TCP services.
1920

21+
:::
2022

21-
:::{admonition} About exposing the service and TLS certificates
22-
When exposing the remote cluster service, determine which TLS certificate will be presented to clients and whether a certificate authority (CA) is required to establish trust. This depends on how traffic to port `9443` is routed in your environment and which component terminates the TLS connection:
23-
24-
* **{{es}} TLS termination**
25-
26-
If the connection reaches the {{es}} Pods without intermediate TLS termination, the {{es}} nodes present transport certificates managed by ECK. The local cluster must therefore trust these certificates by including the ECK-managed transport CA, which you can retrieve in the next section.
27-
28-
This setup is typical when using standard `LoadBalancer` services provided by most cloud providers.
29-
30-
* **External TLS termination**
23+
:::{applies-item} eck: ga 3.3
24+
25+
Starting in ECK 3.3, you can customize the service used for the remote cluster interface directly in the {{es}} resource. This allows you to choose the `Service` type or apply any supported `spec` fields without creating a separate Kubernetes Service.
26+
27+
For example, the manifest below configures the remote cluster service as a `LoadBalancer`:
28+
29+
```yaml
30+
apiVersion: elasticsearch.k8s.elastic.co/v1
31+
kind: Elasticsearch
32+
metadata:
33+
name: <cluster-name>
34+
namespace: <namespace>
35+
spec:
36+
version: 9.2.1
37+
remoteClusterServer:
38+
enabled: true
39+
service:
40+
type: LoadBalancer <1>
41+
nodeSets:
42+
- name: default
43+
count: 3
44+
...
45+
...
46+
```
47+
1. On cloud providers that support external load balancers, setting the type to `LoadBalancer` provisions a load balancer for your service. Alternatively, expose the service `<cluster-name>-es-remote-cluster` through one of the Kubernetes Ingress controllers that support TCP services.
3148

32-
If the connection to port `9443` of your {{es}} cluster is handled by an external load balancer, Ingress controller, or another proxy that performs SSL termination with its own certificates, use the CA associated with that component if it's signed by a private CA.
33-
34-
If the external TLS termination uses a publicly trusted certificate, no additional CA is needed.
49+
You can also configure other service types (such as `NodePort`) or attach annotations required by your environment.
3550
:::
51+
::::
3652

‎deploy-manage/remote-clusters/_snippets/eck_rcs_retrieve_ca.md‎

Lines changed: 5 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,17 @@
11
The certificate authority (CA) used by ECK to issue certificates for the remote cluster server interface is stored in the `ca.crt` key of the secret named `<cluster_name>-es-transport-certs-public`.
22

3-
If the external connections reach the {{es}} Pods on port `9443` without any intermediate TLS termination, you must retrieve this CA, as it will be required in the local cluster configuration to establish trust.
3+
If the external connections reach the {{es}} Pods on port `9443` without any intermediate TLS termination, you need to retrieve this CA because it will be required in the local cluster configuration to establish trust.
44

5-
For example, to save the transport CA certificate of a cluster named `quickstart` into a local file, run the following command:
5+
If TLS is terminated by any intermediate component and the certificate presented is not the ECK-managed one, use the CA associated with that component, or omit the CA entirely if it uses a publicly trusted certificate.
6+
7+
To save the transport CA certificate of a cluster named `quickstart` into a local file, run the following command:
68

79
```sh
810
kubectl get secret quickstart-es-transport-certs-public \
911
-o go-template='{{index .data "ca.crt" | base64decode}}' > eck_transport_ca.crt
1012
```
1113

12-
You can verify that the file contains a valid CA certificate by running the following command:
13-
14-
```bash
15-
openssl x509 -in eck_transport_ca.crt -noout -text
16-
```
17-
1814
::::{important}
19-
ECK-managed CA certificates are automatically rotated after one year by default, but you can [configure](/deploy-manage/deploy/cloud-on-k8s/configure-eck.md) a different validity period.
20-
21-
When the CA certificate is rotated, ensure that this CA is updated in all environments where it's used to preserve trust.
15+
ECK-managed CA certificates are automatically rotated after one year by default, but you can [configure](/deploy-manage/deploy/cloud-on-k8s/configure-eck.md) a different validity period. When the CA certificate is rotated, ensure that this CA is updated in all environments where it's used to preserve trust.
2216
::::
2317

0 commit comments

Comments
 (0)