es账号密码加解密和是否开启账号密码解耦，支持不需要加解密也可以用账号密码连接、新增支持证书从外部读取

cf-framework/cf-spring-boot-starter-elasticsearch/src/main/java/com/cf/imes/framework/es/config/ChenfengElasticsearchAutoConfiguration.java

@@ -1,5 +1,8 @@
 package com.cf.imes.framework.es.config;
 
+import cn.hutool.core.io.FileUtil;
+import cn.hutool.core.text.CharSequenceUtil;
+import cn.hutool.core.util.ObjectUtil;
 import co.elastic.clients.elasticsearch.ElasticsearchAsyncClient;
 import co.elastic.clients.elasticsearch.ElasticsearchClient;
 import co.elastic.clients.json.jackson.JacksonJsonpMapper;
@@ -26,12 +29,13 @@ import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.boot.context.properties.EnableConfigurationProperties;
 import org.springframework.context.annotation.Bean;
-import org.springframework.core.io.ClassPathResource;
 import org.springframework.util.StringUtils;
 
 import javax.net.ssl.SSLContext;
 import java.io.IOException;
 import java.io.InputStream;
+import java.nio.file.Path;
+import java.nio.file.Paths;
 import java.security.KeyManagementException;
 import java.security.KeyStore;
 import java.security.KeyStoreException;
@@ -95,25 +99,7 @@ public class ChenfengElasticsearchAutoConfiguration {
     @Bean
     @ConditionalOnProperty(name = "chenfeng.encrypt.enable", havingValue = "true")
     public RestClient getAuthRestClient(EsProperties properties) {
-        // 配置账号密码
+        return getRestClient(properties, true);
-        final CredentialsProvider credentialsProvider = new BasicCredentialsProvider();
-        credentialsProvider.setCredentials(AuthScope.ANY,
-                new UsernamePasswordCredentials(AesUtils.decrypt(properties.getUsername(), publicKey), AesUtils.decrypt(properties.getPassword(), publicKey)));
-        RestClientBuilder.HttpClientConfigCallback httpClientConfigCallback = httpClientBuilder -> {
-            // 设置账号密码、连接信息
-            HttpAsyncClientBuilder httpAsyncClientBuilder = httpClientBuilder.setDefaultCredentialsProvider(credentialsProvider)
-                    .setDefaultRequestConfig(RequestConfig.custom()
-                            .setConnectTimeout(properties.getConnectionTimeout().toSecondsPart())
-                            .setSocketTimeout(properties.getSocketTimeout().toSecondsPart())
-                            .setConnectionRequestTimeout(properties.getConnectionRequestTimeout().toSecondsPart())
-                            .build());
-            if (properties.isSecurityHttpSslEnable()) {
-                // 开启ssl配置连接证书
-                httpAsyncClientBuilder.setSSLContext(buildSSLContext()).setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE);
-            }
-            return httpAsyncClientBuilder;
-        };
-        return RestClient.builder(toHttpHost(properties.getUris(), properties.isSecurityHttpSslEnable())).setHttpClientConfigCallback(httpClientConfigCallback).build();
     }
 
     /**
@@ -125,31 +111,62 @@ public class ChenfengElasticsearchAutoConfiguration {
     @Bean
     @ConditionalOnProperty(name = "chenfeng.encrypt.enable", havingValue = "false", matchIfMissing = true)
     public RestClient getRestClient(EsProperties properties) {
-        return RestClient.builder(toHttpHost(properties.getUris(), properties.isSecurityHttpSslEnable())).setRequestConfigCallback(requestConfigBuilder -> {
+        return getRestClient(properties, false);
-            requestConfigBuilder.setConnectTimeout(properties.getConnectionTimeout().toSecondsPart());
+    }
-            requestConfigBuilder.setSocketTimeout(properties.getSocketTimeout().toSecondsPart());
+
-            requestConfigBuilder.setConnectionRequestTimeout(properties.getConnectionRequestTimeout().toSecondsPart());
+    /**
-            return requestConfigBuilder;
+     * 动态获取es client连接
-        }).build();
+     *
+     * @param properties  配置
+     * @param needDecrypt 敏感信息是否需要解密
+     * @return
+     */
+    private RestClient getRestClient(EsProperties properties, boolean needDecrypt) {
+        // 配置账号密码
+        CredentialsProvider credentialsProvider;
+        String username = properties.getUsername();
+        String password = properties.getPassword();
+        if (CharSequenceUtil.isAllNotEmpty(username, password)) {
+            credentialsProvider = new BasicCredentialsProvider();
+            credentialsProvider.setCredentials(AuthScope.ANY,
+                    new UsernamePasswordCredentials(needDecrypt ? AesUtils.decrypt(username, publicKey) : username, needDecrypt ? AesUtils.decrypt(password, publicKey) : password));
+        } else {
+            credentialsProvider = null;
+        }
+        RestClientBuilder.HttpClientConfigCallback httpClientConfigCallback = httpClientBuilder -> {
+            // 设置账号密码、连接信息
+            HttpAsyncClientBuilder httpAsyncClientBuilder = httpClientBuilder
+                    .setDefaultRequestConfig(RequestConfig.custom()
+                            .setConnectTimeout(properties.getConnectionTimeout().toSecondsPart())
+                            .setSocketTimeout(properties.getSocketTimeout().toSecondsPart())
+                            .setConnectionRequestTimeout(properties.getConnectionRequestTimeout().toSecondsPart())
+                            .build());
+            if (ObjectUtil.isNotNull(credentialsProvider)) {
+                httpAsyncClientBuilder.setDefaultCredentialsProvider(credentialsProvider);
+            }
+            if (properties.isSecurityHttpSslEnable()) {
+                // 开启ssl配置连接证书
+                httpAsyncClientBuilder.setSSLContext(buildSSLContext(properties.getCertificatePath())).setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE);
+            }
+            return httpAsyncClientBuilder;
+        };
+        return RestClient.builder(toHttpHost(properties.getUris(), properties.isSecurityHttpSslEnable())).setHttpClientConfigCallback(httpClientConfigCallback).build();
     }
 
     /**
      * 构建ssl请求信息
      *
+     * @param certificatePath 证书地址
      * @return
      */
-    private SSLContext buildSSLContext() {
+    private SSLContext buildSSLContext(String certificatePath) {
         SSLContext sslContext = null;
         try {
-            ClassPathResource resource = new ClassPathResource("http_ca.crt");
+            Path trustStorePath = Paths.get(certificatePath);
-            CertificateFactory factory = CertificateFactory.getInstance("X.509");
-            Certificate trustedCa;
-            try (InputStream is = resource.getInputStream()) {
-                trustedCa = factory.generateCertificate(is);
-            }
             KeyStore trustStore = KeyStore.getInstance("pkcs12");
-            trustStore.load(null, null);
+            try (InputStream is = FileUtil.getInputStream(trustStorePath)) {
-            trustStore.setCertificateEntry("ca", trustedCa);
+                trustStore.load(is, "elastic".toCharArray());
+            }
             SSLContextBuilder sslContextBuilder = SSLContexts.custom()
                     .loadTrustMaterial(trustStore, null);
             sslContext = sslContextBuilder.build();

cf-framework/cf-spring-boot-starter-elasticsearch/src/main/java/com/cf/imes/framework/es/config/EsProperties.java

@@ -42,6 +42,8 @@ public class EsProperties {
 
     private boolean securityHttpSslEnable = false;
 
+    private String certificatePath;
+
     public String getUris() {
         return uris;
     }
@@ -105,4 +107,12 @@ public class EsProperties {
     public void setConnectionRequestTimeout(Duration connectionRequestTimeout) {
         this.connectionRequestTimeout = connectionRequestTimeout;
     }
+
+    public String getCertificatePath() {
+        return certificatePath;
+    }
+
+    public void setCertificatePath(String certificatePath) {
+        this.certificatePath = certificatePath;
+    }
 }

cf-module-prod-executor/cf-module-prod-executor-biz/src/main/resources/application-dev.yaml

@@ -70,6 +70,10 @@ spring:
     bootstrap-servers: 127.0.0.1:9092 # 指定 Kafka Broker 地址，可以设置多个，以逗号分隔
   elasticsearch:
     uris: 192.168.1.205:9200
+    security-http-ssl-enable: false
+    username: elastic
+    password: admin.
+
 --- #################### 定时任务相关配置 ####################
 xxl:
   job:

cf-module-system/cf-module-system-biz/src/main/resources/application-dev.yaml

@@ -70,6 +70,10 @@ spring:
     bootstrap-servers: 127.0.0.1:9092 # 指定 Kafka Broker 地址，可以设置多个，以逗号分隔
   elasticsearch:
     uris: 192.168.1.205:9200
+    security-http-ssl-enable: false
+    username: elastic
+    password: admin.
+
 --- #################### 定时任务相关配置 ####################
 xxl:
   job: