Files
doc-exports/docs/css/umn/css_01_0158.html
zhengxiu 2125539080 css umn 25.1.0 version
Reviewed-by: Pruthi, Vineet <vineet.pruthi@t-systems.com>
Co-authored-by: zhengxiu <zhengxiu@huawei.com>
Co-committed-by: zhengxiu <zhengxiu@huawei.com>
2025-07-04 09:10:17 +00:00

116 lines
22 KiB
HTML

<a name="css_01_0158"></a><a name="css_01_0158"></a>
<h1 class="topictitle1">Changing the Security Mode of an Elasticsearch Cluster</h1>
<div id="body0000001410060261"><p id="css_01_0158__en-us_topic_0000001410060261_p19544632102712">This topic describes how to change the security mode of an existing cluster.</p>
<div class="section" id="css_01_0158__en-us_topic_0000001410060261_section9571330173113"><h4 class="sectiontitle">Scenario</h4><div class="p" id="css_01_0158__en-us_topic_0000001410060261_p158091614123613">You can create a cluster by choosing its security mode and web protocol (HTTP or HTTPS). For details about the differences between clusters of different security mode settings (including HTTP/HTTPS), see <a href="#css_01_0158__en-us_topic_0000001410060261_table198661437165914">Table 1</a>.
<div class="tablenoborder"><a name="css_01_0158__en-us_topic_0000001410060261_table198661437165914"></a><a name="en-us_topic_0000001410060261_table198661437165914"></a><table cellpadding="4" cellspacing="0" summary="" id="css_01_0158__en-us_topic_0000001410060261_table198661437165914" frame="border" border="1" rules="all"><caption><b>Table 1 </b>Cluster security modes</caption><thead align="left"><tr id="css_01_0158__css_01_0379_css_01_0380_row1882494514112"><th align="left" class="cellrowborder" colspan="2" valign="top" id="mcps1.3.2.2.2.2.5.1.1"><p id="css_01_0158__css_01_0379_css_01_0380_p0824145101119">Cluster Type</p>
</th>
<th align="left" class="cellrowborder" valign="top" id="mcps1.3.2.2.2.2.5.1.2"><p id="css_01_0158__css_01_0379_css_01_0380_p3824545161116">Description</p>
</th>
<th align="left" class="cellrowborder" valign="top" id="mcps1.3.2.2.2.2.5.1.3"><p id="css_01_0158__css_01_0379_css_01_0380_p19824184571117">Characteristics</p>
</th>
</tr>
</thead>
<tbody><tr id="css_01_0158__css_01_0379_css_01_0380_row382415456118"><td class="cellrowborder" valign="top" width="10%" headers="mcps1.3.2.2.2.2.5.1.1 "><p id="css_01_0158__css_01_0379_p154179414203">Non-security mode cluster</p>
</td>
<td class="cellrowborder" valign="top" width="20%" headers="mcps1.3.2.2.2.2.5.1.1 "><p id="css_01_0158__css_01_0379_css_01_0380_p18824445131110">Cluster for which the security mode is disabled</p>
</td>
<td class="cellrowborder" valign="top" width="35%" headers="mcps1.3.2.2.2.2.5.1.2 "><p id="css_01_0158__css_01_0379_css_01_0380_p12824114561119">With such a cluster, access to the cluster will require no user authentication, and data will be transmitted in plaintext using HTTP. Make sure the customer is in a secure environment, and do not expose the cluster access interface to the public network.</p>
</td>
<td class="cellrowborder" valign="top" width="35%" headers="mcps1.3.2.2.2.2.5.1.3 "><p id="css_01_0158__css_01_0379_css_01_0380_en-us_topic_0000001410060261_p7867123745914">This type of cluster is mostly used for internal services and testing.</p>
<ul id="css_01_0158__css_01_0379_css_01_0380_ul87801447174218"><li id="css_01_0158__css_01_0379_css_01_0380_li978074716423">Advantage: simple and easy to access.</li><li id="css_01_0158__css_01_0379_css_01_0380_li1878011473427">Disadvantage: poor security as anyone can access it.</li></ul>
</td>
</tr>
<tr id="css_01_0158__css_01_0379_css_01_0380_row1382494518113"><td class="cellrowborder" rowspan="2" valign="top" width="10%" headers="mcps1.3.2.2.2.2.5.1.1 "><p id="css_01_0158__css_01_0379_p136722051122012">Security-mode cluster</p>
</td>
<td class="cellrowborder" valign="top" width="20%" headers="mcps1.3.2.2.2.2.5.1.1 "><p id="css_01_0158__css_01_0379_css_01_0380_p1482494513117">Cluster in security mode + HTTP</p>
</td>
<td class="cellrowborder" valign="top" width="35%" headers="mcps1.3.2.2.2.2.5.1.2 "><p id="css_01_0158__css_01_0379_css_01_0380_p1282404517113">A security-mode cluster requires user authentication. It supports access control and data encryption, and it uses HTTP to transmit data in plaintext. Make sure the customer is in a secure environment, and do not expose the cluster access interface to the public network.</p>
</td>
<td class="cellrowborder" valign="top" width="35%" headers="mcps1.3.2.2.2.2.5.1.3 "><p id="css_01_0158__css_01_0379_css_01_0380_en-us_topic_0000001410060261_p7867337165912">Access control by user permissions is supported. This type of cluster is suitable for workloads that are particularly performance-demanding.</p>
<ul id="css_01_0158__css_01_0379_css_01_0380_ul149328416439"><li id="css_01_0158__css_01_0379_css_01_0380_li993294134314">Advantage: User authentication improves cluster security. HTTP-based access ensures high performance of the cluster.</li><li id="css_01_0158__css_01_0379_css_01_0380_li109325434320">Disadvantage: The cluster cannot be accessed from the public network.</li></ul>
</td>
</tr>
<tr id="css_01_0158__css_01_0379_css_01_0380_row182416454111"><td class="cellrowborder" valign="top" headers="mcps1.3.2.2.2.2.5.1.1 "><p id="css_01_0158__css_01_0379_css_01_0380_p3824445111118">Cluster in security mode + HTTPS</p>
</td>
<td class="cellrowborder" valign="top" headers="mcps1.3.2.2.2.2.5.1.1 "><p id="css_01_0158__css_01_0379_css_01_0380_p1375182731616">A security-mode cluster requires user authentication. It supports access control and data encryption, and it uses HTTPS to encrypt communication and enhance data security.</p>
</td>
<td class="cellrowborder" valign="top" headers="mcps1.3.2.2.2.2.5.1.2 "><p id="css_01_0158__css_01_0379_css_01_0380_en-us_topic_0000001410060261_p5867153717599">This type of cluster is suitable where there is a high security standard and public network access is required.</p>
<ul id="css_01_0158__css_01_0379_css_01_0380_ul1151712715437"><li id="css_01_0158__css_01_0379_css_01_0380_li19517167144318">Advantage: User authentication improves cluster security, and HTTPS-based secure communication allows for secure public network access.</li><li id="css_01_0158__css_01_0379_css_01_0380_li551713774316">Disadvantage: HTTPS encrypts nearly all information sent between server and client, causing a read performance loss of around 20%.</li></ul>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="p" id="css_01_0158__p194031716165212"><a href="#css_01_0158__table11800123345617">Table 2</a> lists the options you have when it comes to changing the security model of a cluster.
<div class="tablenoborder"><a name="css_01_0158__table11800123345617"></a><a name="table11800123345617"></a><table cellpadding="4" cellspacing="0" summary="" id="css_01_0158__table11800123345617" frame="border" border="1" rules="all"><caption><b>Table 2 </b>Security mode change scenarios</caption><thead align="left"><tr id="css_01_0158__row1280073312560"><th align="left" class="cellrowborder" valign="top" width="60%" id="mcps1.3.2.3.2.2.3.1.1"><p id="css_01_0158__p17800333195611">Scenario</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="40%" id="mcps1.3.2.3.2.2.3.1.2"><p id="css_01_0158__p7800133311569">Details</p>
</th>
</tr>
</thead>
<tbody><tr id="css_01_0158__row4800123312564"><td class="cellrowborder" valign="top" width="60%" headers="mcps1.3.2.3.2.2.3.1.1 "><p id="css_01_0158__p1800113311564">Change a cluster from non-security mode to security mode + HTTP.</p>
</td>
<td class="cellrowborder" rowspan="2" valign="top" width="40%" headers="mcps1.3.2.3.2.2.3.1.2 "><p id="css_01_0158__p199519143588"><a href="#css_01_0158__en-us_topic_0000001410060261_section17593143823914">Switching from the Non-Security Mode to Security Mode</a></p>
</td>
</tr>
<tr id="css_01_0158__row16800183345614"><td class="cellrowborder" valign="top" headers="mcps1.3.2.3.2.2.3.1.1 "><p id="css_01_0158__p3800163311569">Change a cluster from non-security mode to security mode + HTTPS.</p>
</td>
</tr>
<tr id="css_01_0158__row480014335560"><td class="cellrowborder" valign="top" width="60%" headers="mcps1.3.2.3.2.2.3.1.1 "><p id="css_01_0158__p15800203365612">Change a cluster from security mode + HTTP to non-security mode.</p>
</td>
<td class="cellrowborder" rowspan="2" valign="top" width="40%" headers="mcps1.3.2.3.2.2.3.1.2 "><p id="css_01_0158__p34935168588"><a href="#css_01_0158__en-us_topic_0000001410060261_section93951219134016">Switching from the Security to Non-Security Mode</a></p>
</td>
</tr>
<tr id="css_01_0158__row180011334564"><td class="cellrowborder" valign="top" headers="mcps1.3.2.3.2.2.3.1.1 "><p id="css_01_0158__p15800733125611">Change a cluster from security mode + HTTPS to non-security mode.</p>
</td>
</tr>
<tr id="css_01_0158__row38006332562"><td class="cellrowborder" valign="top" width="60%" headers="mcps1.3.2.3.2.2.3.1.1 "><p id="css_01_0158__p1780043312561">Change a cluster from security mode + HTTP to security mode + HTTPS.</p>
</td>
<td class="cellrowborder" rowspan="2" valign="top" width="40%" headers="mcps1.3.2.3.2.2.3.1.2 "><p id="css_01_0158__p1818020186584"><a href="#css_01_0158__en-us_topic_0000001410060261_section672993904118">Switching the Protocol of Security Clusters</a></p>
</td>
</tr>
<tr id="css_01_0158__row13800133315562"><td class="cellrowborder" valign="top" headers="mcps1.3.2.3.2.2.3.1.1 "><p id="css_01_0158__p1680113311561">Change a cluster from security mode + HTTPS to security mode + HTTP.</p>
</td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
<div class="section" id="css_01_0158__en-us_topic_0000001410060261_section11686944145218"><h4 class="sectiontitle">Prerequisites</h4><ul id="css_01_0158__en-us_topic_0000001410060261_ul1591084613458"><li id="css_01_0158__en-us_topic_0000001410060261_li110618485457">You are advised to back up data before changing the cluster security mode.</li><li id="css_01_0158__en-us_topic_0000001410060261_li13362154154518">The target cluster is available and has no tasks in progress.</li><li id="css_01_0158__li07881748144417">Check whether load balancing is enabled for the cluster. If yes, disable load balancing for the cluster. Enable load balancing again after the security mode is changed. This prevents errors in accessing the cluster through the load balancer during the change.</li></ul>
</div>
<div class="section" id="css_01_0158__en-us_topic_0000001410060261_section1328991532319"><h4 class="sectiontitle">Constraints</h4><ul id="css_01_0158__en-us_topic_0000001410060261_ul16442162515506"><li id="css_01_0158__en-us_topic_0000001410060261_li8140123023317">Only clusters (whose version is 6.5.4 or later) created after November 2022 support security mode changing.</li><li id="css_01_0158__en-us_topic_0000001410060261_li1442425195012">A cluster automatically restarts when its security mode is being changed. Services are interrupted during the restart. The authentication mode for invoking the cluster will change after the restart, and client configurations need to be adjusted accordingly.</li><li id="css_01_0158__en-us_topic_0000001410060261_li14261172715014">If a cluster has already opened the Kibana session box, a session error message will be displayed after you change the cluster security mode. In this case, clear the cache and open Kibana again.</li><li id="css_01_0158__li1899842373517">Disabling security mode for a cluster clears the security account. The cleared account cannot be restored.</li></ul>
</div>
<div class="section" id="css_01_0158__en-us_topic_0000001410060261_section17593143823914"><a name="css_01_0158__en-us_topic_0000001410060261_section17593143823914"></a><a name="en-us_topic_0000001410060261_section17593143823914"></a><h4 class="sectiontitle">Switching from the Non-Security Mode to Security Mode</h4><p id="css_01_0158__en-us_topic_0000001410060261_p1177341319142">You can change a non-security cluster to a security cluster that uses HTTP or HTTPS. After a cluster's security mode is enabled, security authentication is required for accessing the cluster.</p>
<ol id="css_01_0158__en-us_topic_0000001410060261_ol17819172318217"><li id="css_01_0158__en-us_topic_0000001410060261_li16819523122116">Log in to the <span id="css_01_0158__text27576688011169">CSS</span> management console.</li><li id="css_01_0158__li108716541501">In the navigation pane on the left, choose <strong id="css_01_0158__b157911043420">Clusters</strong> &gt; <strong id="css_01_0158__b178491664428">Elasticsearch</strong>. The Elasticsearch cluster management page is displayed.</li><li id="css_01_0158__en-us_topic_0000001285669680_li17735636141417">Choose <strong id="css_01_0158__b13569956192213">More</strong> &gt; <strong id="css_01_0158__b1056995616220">Modify Configuration</strong> in the <strong id="css_01_0158__b14570456162215">Operation</strong> column of the target cluster. The <strong id="css_01_0158__b1057045652216">Modify Configuration</strong> page is displayed.</li><li id="css_01_0158__en-us_topic_0000001410060261_li38201323122119">Choose the <strong id="css_01_0158__en-us_topic_0000001410060261_b19925203184618">Configure Security Mode</strong> tab.</li><li id="css_01_0158__en-us_topic_0000001410060261_li17820423172118">Enable the security mode. Enter and confirm the administrator password of the cluster.<div class="fignone" id="css_01_0158__en-us_topic_0000001410060261_fig19444818202516"><span class="figcap"><b>Figure 1 </b>Enabling the security mode</span><br><span><img id="css_01_0158__image849123981615" src="en-us_image_0000001965497265.png"></span></div>
</li><li id="css_01_0158__en-us_topic_0000001410060261_li28901330102310">Enable or disable <strong id="css_01_0158__en-us_topic_0000001410060261_b11879175354816">HTTPS Access</strong>.<ul id="css_01_0158__en-us_topic_0000001410060261_ul279622852614"><li id="css_01_0158__en-us_topic_0000001410060261_li37961728102613">If you enable <strong id="css_01_0158__en-us_topic_0000001410060261_b197602414212">HTTPS Access</strong>: The HTTPS protocol is used to encrypt cluster communication and you can configure public networks to access the cluster.</li><li id="css_01_0158__en-us_topic_0000001410060261_li157967286260">If you disable <strong id="css_01_0158__en-us_topic_0000001410060261_b06221513211">HTTPS Access</strong>: The HTTP protocol is used and you cannot configure public networks to access the cluster.</li></ul>
</li><li id="css_01_0158__en-us_topic_0000001410060261_li1049844911124">Click <strong id="css_01_0158__en-us_topic_0000001410060261_b1089016512220">Submit</strong>. Confirm the information and the cluster list page is displayed.<p id="css_01_0158__en-us_topic_0000001410060261_p10384125013121">The <strong id="css_01_0158__en-us_topic_0000001410060261_b20975949153215">Task Status</strong> of the cluster is <strong id="css_01_0158__en-us_topic_0000001410060261_b1487195193314">The security mode is changing</strong>. When the cluster status changes to <strong id="css_01_0158__en-us_topic_0000001410060261_b1968615201335">Available</strong>, the security mode has been successfully changed.</p>
</li></ol>
</div>
<div class="section" id="css_01_0158__en-us_topic_0000001410060261_section93951219134016"><a name="css_01_0158__en-us_topic_0000001410060261_section93951219134016"></a><a name="en-us_topic_0000001410060261_section93951219134016"></a><h4 class="sectiontitle">Switching from the Security to Non-Security Mode</h4><p id="css_01_0158__en-us_topic_0000001410060261_p1244611277217">You can change a security cluster that uses HTTP or HTTPS to a non-security cluster. After a cluster's security mode is disabled, security authentication is no longer required for accessing the cluster.</p>
<div class="notice" id="css_01_0158__en-us_topic_0000001410060261_note1352401151217"><span class="noticetitle"><img src="public_sys-resources/notice_3.0-en-us.png"> </span><div class="noticebody"><ul id="css_01_0158__en-us_topic_0000001410060261_ul1093191512125"><li id="css_01_0158__en-us_topic_0000001410060261_li15854114381519">Clusters in non-security mode can be accessed without security authentication, and HTTP protocol is used to transmit data. Ensure the security of the cluster access environment and do not expose the access interface to the public network.</li><li id="css_01_0158__en-us_topic_0000001410060261_li65711117191219">During the switchover from the security mode to the non-security mode, the indexes of the original security cluster will be deleted. Back up data before disabling the security mode.</li><li id="css_01_0158__en-us_topic_0000001410060261_li1555864144318">If a security cluster has been bound to a public IP address, unbind it before changing the security mode.</li><li id="css_01_0158__en-us_topic_0000001410060261_li139235391391">If a security cluster has enabled Kibana public network access, disable it before changing the security mode.</li></ul>
</div></div>
<ol id="css_01_0158__en-us_topic_0000001410060261_ol676642155415"><li id="css_01_0158__en-us_topic_0000001410060261_li2766221105411">Log in to the <span id="css_01_0158__text76062315811169">CSS</span> management console.</li><li id="css_01_0158__en-us_topic_0000001410060261_li0766142135415">In the navigation pane on the left, choose <strong id="css_01_0158__en-us_topic_0000001410060261_b1825320168343">Clusters</strong>. On the displayed <strong id="css_01_0158__en-us_topic_0000001410060261_b52591016173410">Clusters</strong> page, locate the target cluster and choose <strong id="css_01_0158__en-us_topic_0000001410060261_b11260216153412">More</strong> &gt; <strong id="css_01_0158__en-us_topic_0000001410060261_b92608161344">Modify Configuration</strong> in the <strong id="css_01_0158__en-us_topic_0000001410060261_b12260101618345">Operation</strong> column.</li><li id="css_01_0158__en-us_topic_0000001410060261_li27661021165417">Choose the <strong id="css_01_0158__en-us_topic_0000001410060261_b14121219193417">Configure Security Mode</strong> tab.</li><li id="css_01_0158__en-us_topic_0000001410060261_li2766121175411">Disable the security mode.<div class="fignone" id="css_01_0158__en-us_topic_0000001410060261_fig207661521145417"><span class="figcap"><b>Figure 2 </b>Disabling the security mode</span><br><span><img id="css_01_0158__image5561510141718" src="en-us_image_0000001938378044.png"></span></div>
</li><li id="css_01_0158__en-us_topic_0000001410060261_li108851643182214">Click <strong id="css_01_0158__en-us_topic_0000001410060261_b18847022498">Submit</strong>. In the displayed dialog box, confirm the information. The cluster list page is displayed.<p id="css_01_0158__en-us_topic_0000001410060261_p118851443172217">The <strong id="css_01_0158__en-us_topic_0000001410060261_b10853102653411">Task Status</strong> of the cluster is <strong id="css_01_0158__en-us_topic_0000001410060261_b138601226183414">The security mode is changing</strong>. When the cluster status changes to <strong id="css_01_0158__en-us_topic_0000001410060261_b1986062653417">Available</strong>, the security mode has been successfully changed.</p>
</li></ol>
</div>
<div class="section" id="css_01_0158__en-us_topic_0000001410060261_section672993904118"><a name="css_01_0158__en-us_topic_0000001410060261_section672993904118"></a><a name="en-us_topic_0000001410060261_section672993904118"></a><h4 class="sectiontitle">Switching the Protocol of Security Clusters</h4><p id="css_01_0158__en-us_topic_0000001410060261_p11519334184514">You can change the protocol of a security cluster.</p>
<div class="notice" id="css_01_0158__en-us_topic_0000001410060261_note16388188112418"><span class="noticetitle"><img src="public_sys-resources/notice_3.0-en-us.png"> </span><div class="noticebody"><p id="css_01_0158__en-us_topic_0000001410060261_p55071813162419">If a security cluster has been bound to a public IP address, you need to unbind it before changing HTTPS protocol to HTTP.</p>
</div></div>
<ol id="css_01_0158__en-us_topic_0000001410060261_ol386122354519"><li id="css_01_0158__en-us_topic_0000001410060261_li168611623144513">Log in to the <span id="css_01_0158__text68532131611169">CSS</span> management console.</li><li id="css_01_0158__en-us_topic_0000001410060261_li786119236450">In the navigation pane on the left, choose <strong id="css_01_0158__en-us_topic_0000001410060261_b222101354">Clusters</strong>. On the displayed <strong id="css_01_0158__en-us_topic_0000001410060261_b202820043517">Clusters</strong> page, locate the target cluster and choose <strong id="css_01_0158__en-us_topic_0000001410060261_b10288011356">More</strong> &gt; <strong id="css_01_0158__en-us_topic_0000001410060261_b102990173510">Modify Configuration</strong> in the <strong id="css_01_0158__en-us_topic_0000001410060261_b19291008355">Operation</strong> column.</li><li id="css_01_0158__en-us_topic_0000001410060261_li7861122374512">Choose the <strong id="css_01_0158__en-us_topic_0000001410060261_b1890424113352">Configure Security Mode</strong> tab.</li><li id="css_01_0158__en-us_topic_0000001410060261_li14861172354515">Enable or disable <strong id="css_01_0158__en-us_topic_0000001410060261_b46038511460">HTTPS Access</strong>.<div class="fignone" id="css_01_0158__en-us_topic_0000001410060261_fig1816320165512"><span class="figcap"><b>Figure 3 </b>Configuring the protocol</span><br><span><img id="css_01_0158__image12647191420187" src="en-us_image_0000001938218688.png"></span></div>
<ul id="css_01_0158__en-us_topic_0000001410060261_ul10601539145613"><li id="css_01_0158__en-us_topic_0000001410060261_li1360143919568">If you enable <strong id="css_01_0158__en-us_topic_0000001410060261_b6600123694614">HTTPS Access</strong>:<p id="css_01_0158__en-us_topic_0000001410060261_p184401359201216">HTTPS protocol is used to encrypt cluster communication and you can configure public network access.</p>
</li><li id="css_01_0158__en-us_topic_0000001410060261_li1981112610592">If you disable <strong id="css_01_0158__en-us_topic_0000001410060261_b844645516467">HTTPS Access</strong>: An alarm message is displayed. Click <strong id="css_01_0158__en-us_topic_0000001410060261_b981723194911">OK</strong> to disable the function.<p id="css_01_0158__en-us_topic_0000001410060261_p143701279595">Cluster communication is no longer encrypted and the public network access function cannot be enabled.</p>
</li></ul>
</li><li id="css_01_0158__en-us_topic_0000001410060261_li193794820231">Click <strong id="css_01_0158__en-us_topic_0000001410060261_b153991851134920">Submit</strong>. Confirm the information and the cluster list page is displayed.<p id="css_01_0158__en-us_topic_0000001410060261_p13791811235">The <strong id="css_01_0158__en-us_topic_0000001410060261_b1826525113813">Task Status</strong> of the cluster is <strong id="css_01_0158__en-us_topic_0000001410060261_b122721951188">The security mode is changing</strong>. When the cluster status changes to <strong id="css_01_0158__en-us_topic_0000001410060261_b72721251283">Available</strong>, the security mode has been successfully changed.</p>
</li></ol>
</div>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="css_01_0009.html">Managing Elasticsearch Clusters</a></div>
</div>
</div>