Connect an ECK-managed cluster to an external cluster or deployment

If the remote cluster is part of an Elastic Cloud Hosted deployment, the remote cluster server is enabled by default and it uses a publicly trusted certificate provided by the platform proxies. Therefore, you can skip this step.

If the remote cluster is part of an Elastic Cloud Enterprise deployment, the remote cluster server is enabled by default, and secured with TLS certificates.

Depending on the type of certificate used by the ECE proxies or load-balancing layer, the local cluster requires the associated certificate authority (CA) to establish trust:

• If your ECE proxies use publicly trusted certificates, no additional CA is required.

• If your ECE proxies use certificates signed by a private CA, retrieve the root CA from the ECE Cloud UI:

  1. In the remote ECE environment, go to Platform > Settings > TLS certificates.

  2. Under Proxy, select Show certificate chain.

  3. Click Copy root certificate and paste it into a new file. The root certificate is the last certificate shown in the chain.

  4. Save the file as .crt, and keep it available for the trust configuration on the local cluster.

If the remote cluster is managed by a different ECK operator, it must be prepared to accept incoming connections.

1. Enable the remote cluster server

   By default, the remote cluster server interface is deactivated on ECK-managed clusters. To use the API key–based security model for cross-cluster connections, you must first enable it on the remote Elasticsearch cluster by setting spec.remoteClusterServer.enabled: true:

   apiVersion: elasticsearch.k8s.elastic.co/v1
   kind: Elasticsearch
   metadata:
     name: <cluster-name>
     namespace: <namespace>
   spec:
     version: 9.2.2
     remoteClusterServer:
       enabled: true
     nodeSets:
       - name: default
         count: 3
         ...
         ...
   		

   Note

   Enabling the remote cluster server triggers a restart of the Elasticsearch cluster.

2. Expose the remote cluster server interface

   When the remote cluster server is enabled, ECK automatically creates a Kubernetes service named <cluster-name>-es-remote-cluster that exposes the server internally on port 9443.

   To allow clusters running outside your Kubernetes environment to connect to this Elasticsearch cluster, you must expose this service externally. The way to expose this service depends on your ECK version.

   ECK Planned

   You can customize how the remote cluster service is exposed by overriding its service specification directly under spec.remoteClusterServer.service in the Elasticsearch resource. By default, this service listens on port 9443.

   apiVersion: elasticsearch.k8s.elastic.co/v1
   kind: Elasticsearch
   metadata:
     name: <cluster-name>
     namespace: <namespace>
   spec:
     version: 9.2.1
     remoteClusterServer:
       enabled: true
       service:
         spec:
           type: LoadBalancer
     nodeSets:
       - name: default
         count: 3
         ...
         ...
   		

   1. On cloud providers that support external load balancers, setting the type to LoadBalancer provisions a load balancer for your service. Alternatively, expose the service <cluster-name>-es-remote-cluster through one of the Kubernetes Ingress controllers that support TCP services.

   ECK 3.0.0

   In ECK 3.2 and earlier, you can't customize the service that ECK generates for the remote cluster interface, but you can create your own LoadBalancer service, Ingress object, or use another method available in your environment.

   For example, for a cluster named quickstart, the following command creates a separate LoadBalancer service named quickstart-es-remote-cluster-lb, pointing to the ECK-managed service quickstart-es-remote-cluster:

   kubectl expose service quickstart-es-remote-cluster \
     --name=quickstart-es-remote-cluster-lb \
     --type=LoadBalancer \
     --port=9443 --target-port=9443
   		

   1. On cloud providers that support external load balancers, setting the type to LoadBalancer provisions a load balancer for your service. Alternatively, expose the service <cluster-name>-es-remote-cluster through one of the Kubernetes Ingress controllers that support TCP services.
   Warning

   If you change the service’s port, set targetPort explicitly to 9443, which is the default remote cluster server listening port. Otherwise, Kubernetes uses the same value for both fields, resulting in failed connections.

3. Retrieve the certificate authority (CA)

   The certificate authority (CA) used by ECK to issue certificates for the remote cluster server interface is stored in the ca.crt key of the secret named <cluster_name>-es-transport-certs-public.

   If the external connections reach the Elasticsearch Pods on port 9443 without any intermediate TLS termination, you need to retrieve this CA because it is required in the local cluster configuration to establish trust.

   If TLS is terminated by any intermediate component and the certificate presented is not the ECK-managed one, use the CA associated with that component, or omit the CA entirely if it uses a publicly trusted certificate.

   To save the transport CA certificate of a cluster named quickstart into a local file, run the following command:

   kubectl get secret quickstart-es-transport-certs-public \
   -o go-template='{{index .data "ca.crt" | base64decode}}' > eck_transport_ca.crt
   		

   Important

   ECK-managed CA certificates are automatically rotated after one year by default, but you can configure a different validity period. When the CA certificate is rotated, ensure that this CA is updated in all environments where it's used to preserve trust.

1. Enable and secure the remote cluster server

   1. Enable the remote cluster server on every node of the remote cluster. In elasticsearch.yml:

      1. Set remote_cluster_server.enabled to true.
      2. Configure the bind and publish address for remote cluster server traffic, for example using remote_cluster.host. Without configuring the address, remote cluster traffic can be bound to the local interface, and remote clusters running on other machines can't connect.
      3. Optionally, configure the remote server port using remote_cluster.port (defaults to 9443).

   2. Generate a certificate authority (CA) and a server certificate/key pair. On one of the nodes of the remote cluster, from the directory where Elasticsearch has been installed:

      1. Create a CA, if you don't have a CA already:

         ./bin/elasticsearch-certutil ca --pem --out=cross-cluster-ca.zip --pass CA_PASSWORD
         		

         Replace CA_PASSWORD with the password you want to use for the CA. You can remove the --pass option and its argument if you are not deploying to a production environment.

      2. Unzip the generated cross-cluster-ca.zip file. This compressed file contains the following content:

         /ca
         |_ ca.crt
         |_ ca.key
         		

      3. Generate a certificate and private key pair for the nodes in the remote cluster:

         ./bin/elasticsearch-certutil cert --out=cross-cluster.p12 --pass=CERT_PASSWORD --ca-cert=ca/ca.crt --ca-key=ca/ca.key --ca-pass=CA_PASSWORD --dns=<CLUSTER_FQDN> --ip=192.0.2.1
         		

         • Replace CA_PASSWORD with the CA password from the previous step.
         • Replace CERT_PASSWORD with the password you want to use for the generated private key.
         • Use the --dns option to specify the relevant DNS name for the certificate. You can specify it multiple times for multiple DNS.
         • Use the --ip option to specify the relevant IP address for the certificate. You can specify it multiple times for multiple IP addresses.

      4. If the remote cluster has multiple nodes, you can do one of the following:

         • Create a single wildcard certificate for all nodes.
         • Create separate certificates for each node either manually or in batch with the silent mode.

   3. On every node of the remote cluster, do the following:

      1. Copy the cross-cluster.p12 file from the earlier step to the config directory. If you didn't create a wildcard certificate, make sure you copy the correct node-specific p12 file.

      2. Add following configuration to elasticsearch.yml:

         xpack.security.remote_cluster_server.ssl.enabled: true
         xpack.security.remote_cluster_server.ssl.keystore.path: cross-cluster.p12
         		

      3. Add the SSL keystore password to the Elasticsearch keystore:

         ./bin/elasticsearch-keystore add xpack.security.remote_cluster_server.ssl.keystore.secure_password
         		

         When prompted, enter the CERT_PASSWORD from the earlier step.

   4. Restart the remote cluster.

2. Retrieve the certificate authority (CA)

   If the remote cluster server is exposed with a certificate signed by private certificate authority (CA), save the corresponding ca.crt file. It is required when configuring trust on the local cluster.