Tribe nodes act as a federated client across multiple clusters. When using tribe nodes with secured clusters, all clusters must have X-Pack security enabled and share the same security configuration (users, roles, user-role mappings, SSL/TLS CA). The tribe node itself also must be configured to grant access to actions and indices on all of the connected clusters, as security checks on incoming requests are primarily done on the tribe node itself.
Support for tribe nodes in Kibana was added in v5.2.
To use a tribe node with secured clusters:
- Install X-Pack on the tribe node and every node in each connected cluster.
Enable message authentication globally. Generate a system key on one node and copy it to the tribe node and every other node in each of the connected clusters.
For message authentication to work properly across multiple clusters, the tribe node and all of the connected clusters must share the same system key. X-Pack security reads the system key from
Enable encryption globally. To encrypt communications, you must enable enable SSL/TLS on every node.
To simplify SSL/TLS configuration, use the same certificate authority to generate certificates for all connected clusters.
Configure the tribe in the tribe node’s
elasticsearch.ymlfile. You must specify each cluster that is a part of the tribe and configure discovery and encryption settings per cluster. For example, the following configuration adds two clusters to the tribe:
tribe: on_conflict: prefer_cluster1 c1: cluster.name: cluster1 discovery.zen.ping.unicast.hosts: [ "cluster1-node1:9300", "cluster1-node2:9300"] xpack.ssl.key: /home/es/config/x-pack/es-tribe-01.key xpack.ssl.certificate: /home/es/config/x-pack/es-tribe-01.crt xpack.ssl.certificate_authorities: [ "/home/es/config/x-pack/ca.crt" ] xpack.security.transport.ssl.enabled: true xpack.security.http.ssl.enabled: true c2: cluster.name: cluster2 discovery.zen.ping.unicast.hosts: [ "cluster2-node1:9300", "cluster2-node2:9300"] xpack.ssl.key: /home/es/config/x-pack/es-tribe-01.key xpack.ssl.certificate: /home/es/config/x-pack/es-tribe-01.crt xpack.ssl.certificate_authorities: [ "/home/es/config/x-pack/ca.crt" ] xpack.security.transport.ssl.enabled: true xpack.security.http.ssl.enabled: true
Configure the same index privileges for your users on all nodes, including the tribe node. The nodes in each cluster must grant access to indices in other connected clusters as well as their own.
For example, let’s assume
cluster2each have a indices
index2. To enable a user to submit a request through the tribe node to search both clusters:
On the tribe node and both clusters, define a
tribe_userrole that has read access to
tribe_user: indices: 'index*': search
tribe_userrole to a user on the tribe node and both clusters. For example, run the following command on each node to create
my_tribe_userand assign the
./bin/shield/users useradd my_tribe_user -p password -r tribe_user
Each cluster needs to have its own users with admin privileges. You cannot perform administration tasks such as create index through the tribe node, you must send the request directly to the appropriate cluster.
To enable selected users to retrieve merged cluster state information for the tribe from the tribe node, grant them the cluster
monitorprivilege on the tribe node. For example, you could create a
tribe_monitorrole that assigns the
tribe_monitor: cluster: monitor
- Start the tribe node. If you’ve made configuration changes to the nodes in the connected clusters, they also need to be restarted.