docker-compose, 如何分享音量

Question

I'm trying to replicate https://www.elastic.co/guide/en/elasticsearch/reference/7.x/configuring-tls-docker.html

The example shows how to turn on ssl for ES cluster with docker. it's running the instances in one machine

I am running docker container on multiple hosts and having trouble sharing the volume for certificate

relevant parts are

// create certification files and save in certs volume // create-certs.yml

 services:
   create_certs:
     image: docker.elastic.co/elasticsearch/elasticsearch:${VERSION}
     container_name: create_certs
     command: >
       bash -c '
         yum install -y -q -e 0 unzip;
         if [[ ! -f /certs/bundle.zip ]]; then
           bin/elasticsearch-certutil cert --silent --pem --in config/certificates/instances.yml -out /certs/bundle.zip;
           unzip /certs/bundle.zip -d /certs;
         fi;
         chown -R 1000:0 /certs
       '
     working_dir: /usr/share/elasticsearch
     volumes:
       - certs:/certs
       - .:/usr/share/elasticsearch/config/certificates
     # networks:
     #   - elastic

 volumes:
   certs:
     driver: local

 # networks:
 #   elastic:
 #     driver: bridge

docker-compose.yml

version: '2.2'
services:
  es0001:
    image: docker.elastic.co/elasticsearch/elasticsearch:${VERSION}
    container_name: es0001
    environment:
      - node.name=es0001
      - cluster.name=es-docker-cluster
      - discovery.seed_hosts=es0002,es0003
      - cluster.initial_master_nodes=es0001,es0002,es0003
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
      - ELASTIC_PASSWORD=$ELASTIC_PASSWORD
      - xpack.license.self_generated.type=trial # <1>
      - xpack.security.enabled=true
      - xpack.security.http.ssl.enabled=true # <2>
      - xpack.security.http.ssl.key=$CERTS_DIR/es0001/es0001.key
      - xpack.security.http.ssl.certificate_authorities=$CERTS_DIR/ca/ca.crt
      - xpack.security.http.ssl.certificate=$CERTS_DIR/es0001/es0001.crt
      - xpack.security.transport.ssl.enabled=true # <3>
      - xpack.security.transport.ssl.verification_mode=certificate # <4>
      - xpack.security.transport.ssl.certificate_authorities=$CERTS_DIR/ca/ca.crt
      - xpack.security.transport.ssl.certificate=$CERTS_DIR/es0001/es0001.crt
      - xpack.security.transport.ssl.key=$CERTS_DIR/es0001/es0001.key
      - http.port=9500
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - data01:/usr/share/elasticsearch/data
      - certs:$CERTS_DIR
    ports:
      - 9500:9500
    networks:
      - elastic

    healthcheck:
      test: curl --cacert $CERTS_DIR/ca/ca.crt -s https://localhost:9500 >/dev/null; if [[ $$? == 52 ]]; then echo 0; else echo 1; fi
      interval: 30s
      timeout: 10s
      retries: 5

  es0002:
    image: docker.elastic.co/elasticsearch/elasticsearch:${VERSION}
    container_name: es0002
    environment:
      - node.name=es0002
      - cluster.name=es-docker-cluster
      - discovery.seed_hosts=es0001,es0003
      - cluster.initial_master_nodes=es0001,es0002,es0003
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
      - ELASTIC_PASSWORD=$ELASTIC_PASSWORD
      - xpack.license.self_generated.type=trial
      - xpack.security.enabled=true
      - xpack.security.http.ssl.enabled=true
      - xpack.security.http.ssl.key=$CERTS_DIR/es0002/es0002.key
      - xpack.security.http.ssl.certificate_authorities=$CERTS_DIR/ca/ca.crt
      - xpack.security.http.ssl.certificate=$CERTS_DIR/es0002/es0002.crt
      - xpack.security.transport.ssl.enabled=true
      - xpack.security.transport.ssl.verification_mode=certificate
      - xpack.security.transport.ssl.certificate_authorities=$CERTS_DIR/ca/ca.crt
      - xpack.security.transport.ssl.certificate=$CERTS_DIR/es0002/es0002.crt
      - xpack.security.transport.ssl.key=$CERTS_DIR/es0002/es0002.key
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - data02:/usr/share/elasticsearch/data
      - certs:$CERTS_DIR
    networks:
      - elastic

  es0003:
    image: docker.elastic.co/elasticsearch/elasticsearch:${VERSION}
    container_name: es0003
    environment:
      - node.name=es0003
      - cluster.name=es-docker-cluster
      - discovery.seed_hosts=es0001,es0002
      - cluster.initial_master_nodes=es0001,es0002,es0003
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
      - ELASTIC_PASSWORD=$ELASTIC_PASSWORD
      - xpack.license.self_generated.type=trial
      - xpack.security.enabled=true
      - xpack.security.http.ssl.enabled=true
      - xpack.security.http.ssl.key=$CERTS_DIR/es0003/es0003.key
      - xpack.security.http.ssl.certificate_authorities=$CERTS_DIR/ca/ca.crt
      - xpack.security.http.ssl.certificate=$CERTS_DIR/es0003/es0003.crt
      - xpack.security.transport.ssl.enabled=true
      - xpack.security.transport.ssl.verification_mode=certificate
      - xpack.security.transport.ssl.certificate_authorities=$CERTS_DIR/ca/ca.crt
      - xpack.security.transport.ssl.certificate=$CERTS_DIR/es0003/es0003.crt
      - xpack.security.transport.ssl.key=$CERTS_DIR/es0003/es0003.key
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - data03:/usr/share/elasticsearch/data
      - certs:$CERTS_DIR
    networks:
      - elastic
  kib01:
    image: docker.elastic.co/kibana/kibana:${VERSION}
    container_name: kib01
    depends_on: {"es0001": {"condition": "service_healthy"}}
    ports:
      - 5601:5601
    environment:
      SERVERNAME: localhost
      ELASTICSEARCH_URL: https://es0001:9500
      ELASTICSEARCH_HOSTS: https://es0001:9500
      ELASTICSEARCH_USERNAME: kibana
      ELASTICSEARCH_PASSWORD: $ELASTIC_PASSWORD
      ELASTICSEARCH_SSL_CERTIFICATEAUTHORITIES: $CERTS_DIR/ca/ca.crt
      SERVER_SSL_ENABLED: "true"
      SERVER_SSL_KEY: $CERTS_DIR/kib01/kib01.key
      SERVER_SSL_CERTIFICATE: $CERTS_DIR/kib01/kib01.crt
    volumes:
      - certs:$CERTS_DIR
    networks:
      - elastic
volumes:
  data01:
    driver: local
  data02:
    driver: local
  data03:
    driver: local
  certs:
    driver: local

networks:
  elastic:
    driver: bridge

I get a feeling that driver: local for certs: means the volume exists localy.. and can't be shared among containers across multiple hosts.

Please correct me if I'm wrong

Answer 1

The volumes are indeed local(one local volume on each node that has a container mounting that volume).

One option is to create a NFS that is reachable by all your nodes and declare the volume with type: nfs . This way, each node will still create a local volume, but all the local volumes will read/write to the same location:

volumes:
    certs:
      driver: local
      driver_opts:
        type: nfs
        o: nfsvers=4,addr=<NFS-ServerIpAddress>,rw
        device: ":/directory-on-nfs"