Güvenlik

# API key oluşturma (fine-grained)
curl -X POST "http://localhost:9200/_security/api_key" -H "Content-Type: application/json" -d'
{
  "name": "product-service-key",
  "expiration": "365d",
  "role_descriptors": {
    "product_writer": {
      "cluster": ["monitor"],
      "indices": [{
        "names": ["products*"],
        "privileges": ["read", "write", "create_index"],
        "field_security": {
          "grant": ["*"],
          "except": ["internal_score"]
        }
      }]
    }
  }
}'

# Role oluşturma
curl -X PUT "http://localhost:9200/_security/role/read_only_analyst" -H "Content-Type: application/json" -d'
{
  "cluster": ["monitor"],
  "indices": [{
    "names": ["orders-*", "products"],
    "privileges": ["read"],
    "query": { "term": { "region": "TR" } }
  }]
}'

# Document-level security (DLS)
curl -X PUT "http://localhost:9200/_security/role/tenant_reader" -H "Content-Type: application/json" -d'
{
  "indices": [{
    "names": ["*"],
    "privileges": ["read"],
    "query": { "template": { "source": "{ "term": { "tenant_id": "{{_user.metadata.tenant_id}}" }}" } }
  }]
}'

// Production client with API key rotation
public class SecureElasticClientFactory
{
    public ElasticsearchClient Create(string apiKey, string[] nodes)
    {
        var pool = new StaticNodePool(nodes.Select(n => new Uri(n)));
        var settings = new ElasticsearchClientSettings(pool)
            .Authentication(new ApiKey(apiKey))
            .ServerCertificateValidationCallback(CertificateValidations.AuthorityIsRoot)
            .RequestTimeout(TimeSpan.FromSeconds(10));

        return new ElasticsearchClient(settings);
    }
}

# 1. CA oluştur (bir kez)
bin/elasticsearch-certutil ca --out elastic-stack-ca.p12 --pass ""

# 2. Node sertifikaları (her node için)
bin/elasticsearch-certutil cert   --ca elastic-stack-ca.p12 --ca-pass ""   --out elastic-certificates.p12 --pass ""   --dns es-node-01,es-node-02,es-node-03   --ip 10.0.1.10,10.0.1.11,10.0.1.12

# 3. HTTP sertifikası (client-facing)
bin/elasticsearch-certutil http
# Interactive wizard:
#   Generate CSR? No
#   Use existing CA? Yes → elastic-stack-ca.p12
#   DNS names: es-cluster.internal, localhost
#   IP: 10.0.1.10
#   Output: elasticsearch-ssl-http.zip

# 4. elasticsearch.yml yapılandırması
# xpack.security.transport.ssl:
#   enabled: true
#   verification_mode: certificate
#   keystore.path: certs/elastic-certificates.p12
#   truststore.path: certs/elastic-certificates.p12
# xpack.security.http.ssl:
#   enabled: true
#   keystore.path: certs/http.p12

# 5. Keystore'a password ekle (sertifika şifreli ise)
bin/elasticsearch-keystore add xpack.security.transport.ssl.keystore.secure_password
bin/elasticsearch-keystore add xpack.security.http.ssl.keystore.secure_password

# 6. Kibana için HTTP cert kopyala
unzip elasticsearch-ssl-http.zip -d /tmp/http-certs
cp /tmp/http-certs/kibana/elasticsearch-ca.pem /etc/kibana/
# kibana.yml:
#   elasticsearch.ssl.certificateAuthorities: ["/etc/kibana/elasticsearch-ca.pem"]