AWS EKS部署Easysearch企业级搜索引擎实践指南

1. 为什么选择 AWS EKS 部署 Easysearch在当今数据爆炸的时代企业级搜索引擎已成为处理海量数据的核心基础设施。Easysearch 作为一款高性能、可扩展的分布式搜索引擎能够满足企业对实时数据检索和分析的严苛需求。而 AWS EKSElastic Kubernetes Service作为托管式 Kubernetes 服务为 Easysearch 的部署提供了理想的运行环境。选择 EKS 部署 Easysearch 主要基于以下考量弹性扩展能力EKS 可以轻松实现 Easysearch 集群的横向扩展应对业务高峰期的搜索请求激增高可用性保障AWS 全球基础设施为 Easysearch 提供了跨可用区的容灾能力运维简化EKS 托管了 Kubernetes 控制平面大幅降低了运维复杂度生态整合EKS 与 AWS 其他服务如 EBS、ALB无缝集成便于构建完整的搜索解决方案2. 部署前的环境准备2.1 AWS 账户与权限配置在开始部署前需要确保拥有一个 AWS Global 账户并配置适当的权限。建议创建一个专门用于 EKS 管理的 IAM 用户并授予以下权限策略AmazonEKSClusterPolicyAmazonEKSServicePolicyAmazonEKSWorkerNodePolicyAmazonEC2ContainerRegistryReadOnly提示在生产环境中建议遵循最小权限原则仅授予必要的权限。2.2 本地工具安装部署过程需要以下命令行工具请确保在本地环境推荐 Linux 或 macOS中提前安装AWS CLI- AWS 命令行工具curl https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip -o awscliv2.zip unzip awscliv2.zip sudo ./aws/installkubectl- Kubernetes 集群管理工具curl -O https://s3.us-west-2.amazonaws.com/amazon-eks/1.30.2/2024-07-12/bin/linux/amd64/kubectl chmod x ./kubectl sudo mv ./kubectl /usr/local/bin/eksctl- EKS 集群管理工具curl --silent --location https://github.com/weaveworks/eksctl/releases/latest/download/eksctl_$(uname -s)_amd64.tar.gz | tar xz -C /tmp sudo mv /tmp/eksctl /usr/local/binHelm- Kubernetes 包管理工具curl https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | bash验证所有工具安装成功aws --version kubectl version --short --client eksctl version helm version3. 创建和配置 EKS 集群3.1 集群规划与网络设计在创建 EKS 集群前需要仔细规划集群配置。以下是一个典型的 EKS 集群配置示例保存为 cluster-config.yamlapiVersion: eksctl.io/v1alpha5 kind: ClusterConfig metadata: name: easysearch-prod region: ap-northeast-1 version: 1.30 vpc: cidr: 10.0.0.0/16 subnets: private: ap-northeast-1a: { id: subnet-0123456789abcdef0 } ap-northeast-1c: { id: subnet-0123456789abcdef1 } ap-northeast-1d: { id: subnet-0123456789abcdef2 } nodeGroups: - name: ng-1 instanceType: m5.2xlarge desiredCapacity: 3 minSize: 2 maxSize: 6 volumeSize: 50 labels: { role: worker } tags: k8s.io/cluster-autoscaler/enabled: true k8s.io/cluster-autoscaler/easysearch-prod: owned关键配置说明节点类型选择 m5.2xlarge8vCPU, 32GB内存平衡计算和内存需求存储配置每个节点分配50GB EBS卷用于系统和工作负载自动扩展配置集群自动扩展策略应对负载变化创建集群eksctl create cluster -f cluster-config.yaml3.2 存储与网络插件配置Easysearch 需要持久化存储和数据卷因此需要配置 EBS CSI 驱动eksctl utils associate-iam-oidc-provider \ --cluster easysearch-prod \ --approve eksctl create iamserviceaccount \ --name ebs-csi-controller-sa \ --namespace kube-system \ --cluster easysearch-prod \ --attach-policy-arn arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy \ --approve eksctl create addon \ --name aws-ebs-csi-driver \ --cluster easysearch-prod \ --service-account-role-arn arn:aws:iam::${ACCOUNT_ID}:role/AmazonEKS_EBS_CSI_DriverRole \ --force验证 EBS CSI 驱动安装kubectl get pods -n kube-system | grep ebs-csi4. 部署 Easysearch 服务4.1 安装 Easysearch Operator使用 Helm 安装 Easysearch Operator 简化部署helm repo add infinilabs https://helm.infinilabs.com helm repo update helm install easysearch-operator infinilabs/easysearch-operator \ --namespace easysearch \ --create-namespace \ --version 1.6.04.2 配置 Easysearch 集群创建自定义资源配置文件 easysearch-cluster.yamlapiVersion: easysearch.infinilabs.com/v1alpha1 kind: Easysearch metadata: name: production namespace: easysearch spec: version: 1.6.0 replicas: 3 storage: storageClassName: gp2 size: 100Gi resources: requests: cpu: 2 memory: 8Gi limits: cpu: 4 memory: 16Gi config: es_config: cluster.routing.allocation.disk.threshold_enabled: false discovery.type: single-node部署 Easysearch 集群kubectl apply -f easysearch-cluster.yaml4.3 验证部署状态检查 Pod 状态kubectl get pods -n easysearch -l appEasysearch测试 Easysearch 服务连通性kubectl exec -n easysearch production-easysearch-0 -- \ curl -sS -k -u admin:admin https://localhost:92005. 配置访问与负载均衡5.1 部署 AWS Load Balancer Controllereksctl create iamserviceaccount \ --clustereasysearch-prod \ --namespacekube-system \ --nameaws-load-balancer-controller \ --attach-policy-arnarn:aws:iam::${ACCOUNT_ID}:policy/AWSLoadBalancerControllerIAMPolicy \ --approve helm install aws-load-balancer-controller eks/aws-load-balancer-controller \ -n kube-system \ --set clusterNameeasysearch-prod \ --set serviceAccount.createfalse \ --set serviceAccount.nameaws-load-balancer-controller5.2 配置 Ingress 暴露服务创建 ingress.yaml 文件apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: easysearch-ingress namespace: easysearch annotations: alb.ingress.kubernetes.io/scheme: internet-facing alb.ingress.kubernetes.io/target-type: ip alb.ingress.kubernetes.io/listen-ports: [{HTTPS:443}] alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:region:account-id:certificate/cert-id spec: ingressClassName: alb rules: - host: search.example.com http: paths: - path: / pathType: Prefix backend: service: name: production-easysearch port: number: 9200应用 Ingress 配置kubectl apply -f ingress.yaml6. 运维与监控配置6.1 设置集群自动扩展配置 Cluster Autoscaler 自动调整节点数量helm repo add autoscaler https://kubernetes.github.io/autoscaler helm install cluster-autoscaler autoscaler/cluster-autoscaler \ --namespace kube-system \ --set autoDiscovery.clusterNameeasysearch-prod \ --set awsRegionap-northeast-1 \ --set extraArgs.balance-similar-node-groupstrue \ --set extraArgs.skip-nodes-with-system-podsfalse6.2 配置 Prometheus 监控使用 kube-prometheus-stack 监控 Easysearchhelm repo add prometheus-community https://prometheus-community.github.io/helm-charts helm install kube-prometheus-stack prometheus-community/kube-prometheus-stack \ --namespace monitoring \ --create-namespace \ --set prometheus.prometheusSpec.serviceMonitorSelectorNilUsesHelmValuesfalse创建 Easysearch 的 ServiceMonitorapiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: easysearch-monitor namespace: easysearch labels: release: kube-prometheus-stack spec: endpoints: - port: http path: /_prometheus/metrics interval: 30s selector: matchLabels: app: Easysearch7. 性能优化与安全加固7.1 Easysearch 性能调优在 values.yaml 中添加以下优化配置config: es_config: thread_pool.search.size: 8 thread_pool.search.queue_size: 1000 indices.queries.cache.size: 10% indices.fielddata.cache.size: 30% bootstrap.memory_lock: true7.2 安全加固措施启用 TLS 加密tls: enabled: true selfSigned: true certSecret: easysearch-cert配置网络策略networkPolicy: enabled: true ingress: - from: - podSelector: matchLabels: app: console ports: - port: 9200 protocol: TCP定期备份策略backup: enabled: true schedule: 0 2 * * * s3: bucket: easysearch-backups region: ap-northeast-18. 故障排查与常见问题8.1 Pod 无法启动常见原因及解决方案资源不足检查节点资源使用情况kubectl describe nodes调整资源请求/限制或扩展节点存储卷问题检查 PVC 状态kubectl get pvc -n easysearch验证 StorageClass 配置是否正确镜像拉取失败检查镜像地址和权限kubectl describe pod pod-name8.2 性能下降排查步骤检查节点资源使用kubectl top nodes kubectl top pods -n easysearch分析 Easysearch 线程池状态kubectl exec -n easysearch production-easysearch-0 -- \ curl -sS -k -u admin:admin https://localhost:9200/_cat/thread_pool?v检查磁盘 I/O 性能kubectl exec -n easysearch production-easysearch-0 -- \ apt-get update apt-get install -y iostat iostat -dx 1 58.3 连接问题诊断验证服务发现kubectl exec -it -n easysearch production-easysearch-0 -- \ curl -k -u admin:admin https://production-easysearch.easysearch.svc.cluster.local:9200/_cluster/health?pretty检查网络策略kubectl describe networkpolicy -n easysearch测试负载均衡器连通性curl -v -k https://search.example.com