Elasticsearch Cluster deployed with docker, ansible, and authentication - docker

Question

This is going to be an odd post with how basic it is, but I'm stuck. I have turned this docker-compose file into an ansible job that spins up the cluster:
version: '2.2'
services:
es01:
image: docker.elastic.co/elasticsearch/elasticsearch:7.9.2
container_name: es01
environment:
- node.name=es01
- cluster.name=es-docker-cluster
- discovery.seed_hosts=es02,es03
- cluster.initial_master_nodes=es01,es02,es03
- bootstrap.memory_lock=true
- "ES_JAVA_OPTS=-Xms512m -Xmx512m"
ulimits:
memlock:
soft: -1
hard: -1
volumes:
- data01:/usr/share/elasticsearch/data
ports:
- 9200:9200
networks:
- elastic
es02:
image: docker.elastic.co/elasticsearch/elasticsearch:7.9.2
container_name: es02
environment:
- node.name=es02
- cluster.name=es-docker-cluster
- discovery.seed_hosts=es01,es03
- cluster.initial_master_nodes=es01,es02,es03
- bootstrap.memory_lock=true
- "ES_JAVA_OPTS=-Xms512m -Xmx512m"
ulimits:
memlock:
soft: -1
hard: -1
volumes:
- data02:/usr/share/elasticsearch/data
networks:
- elastic
es03:
image: docker.elastic.co/elasticsearch/elasticsearch:7.9.2
container_name: es03
environment:
- node.name=es03
- cluster.name=es-docker-cluster
- discovery.seed_hosts=es01,es02
- cluster.initial_master_nodes=es01,es02,es03
- bootstrap.memory_lock=true
- "ES_JAVA_OPTS=-Xms512m -Xmx512m"
ulimits:
memlock:
soft: -1
hard: -1
volumes:
- data03:/usr/share/elasticsearch/data
networks:
- elastic
volumes:
data01:
driver: local
data02:
driver: local
data03:
driver: local
networks:
elastic:
driver: bridge
The problem is when I add security to the cluster, then the cluster returns a master_not_discovered_exception. All I'm adding extra to es01 is xpack.security.enabled: true, ELASTIC_PASSWORD: "password"
and xpack.security.transport.ssl.enabled: true
Any idea where to go from here?

Answer 1

Adding
xpack.security.transport.ssl.enabled: true
requires you first to generate and add certificates to the services in order to encrypt inter-node communication. There are several steps to go:
Get some certificates, at least generate SSL certificates by you own
Distribute certificates to all nodes via volumes
Configure the certificates and passwords via keystore
Please have a look at the general documentation of encrypting communications and then the docker relevant steps you need to go.
Just for the case you don't want to encrypt the inter-node communication but the http-endpoint (rest-api), that´s what
xpack.security.http.ssl.enabled: true
is made for. The procedure to get this working is very similar to the previous one and covered by the mentioned docs.