现在，任何OAuth客户端或资源服务器都应该使用纯HTTP进行配置，以便云原生平台可以代表它们管理TLS。
从你的问题来看，客户端和用户如何与Elasticsearch资源服务器交互有点不清楚。我假设你有某种应用程序在请求中发送OAuth 2.0令牌来获取Elasticsearch数据，并且你想限制Keycloak用户的访问，或者他们的一部分。

密码

为了让OIDC工作，看起来你需要使用一个像cert-manager这样的组件来发布内部证书和密钥。我记得我以前玩过这个。我使用了一个self signed issuer，然后能够像这样在Elasticsearch pod中挂载证书资源·我相信certificate resource在接近到期时会自动更新证书和密钥。

kind: Certificate
apiVersion: cert-manager.io/v1
metadata:
  name: elasticsearch-cert
spec:
  secretName: elasticsearch-pkcs12
  issuerRef:
    name: ca-issuer
    kind: Issuer
  commonName: elasticsearch-svc.default.svc
  dnsNames:
  - elasticsearch-svc
  - elasticsearch-svc.default.svc
  - elasticsearch-svc.default.svc.cluster.local
  keystores:
    pkcs12:
      create: true
      passwordSecretRef:
        name: elasticsearch-pkcs12-password
        key: password
---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: elasticsearch
  labels:
    app: elasticsearch
spec:
  replicas: 1
  selector:
    matchLabels:
      app: elasticsearch
  template:
    metadata:
      labels:
        app: elasticsearch
    spec:
      containers:
      - name: elasticsearch
        image: docker.elastic.co/elasticsearch/elasticsearch:8.4.1
        env:
          - name: discovery.type
            value: 'single-node'
          - name: xpack.security.enabled
            value: 'true'
          - name: xpack.security.autoconfiguration.enabled
            value: 'true'
          - name: xpack.security.http.ssl.enabled
            value: 'true'
          - name: xpack.security.http.ssl.keystore.path
            value: '/usr/share/elasticsearch/config/certs/keystore.p12'
          - name: xpack.security.http.ssl.keystore.password
            value: 'Password1'
          - name: xpack.security.http.ssl.certificate_authorities
            value: '/usr/share/elasticsearch/config/certs/ca.crt'
          - name: ELASTIC_PASSWORD
            value: 'Password1'
        volumeMounts:
          - name: elasticsearch-ssl-cert
            mountPath: /usr/share/elasticsearch/config/certs
            readOnly: true
      volumes:
        - name: elasticsearch-ssl-cert
          secret:
            secretName: elasticsearch-pkcs12
---
kind: Service
apiVersion: v1
metadata:
  name: elasticsearch-svc
spec:
  selector:
    app: elasticsearch
  ports:
    - protocol: "TCP"
      port: 9200

字符串
如果有很多客户端，也可以考虑在Elasticsearch前面放置一个专用的实用程序网关（如Kong或NGINX），将HTTPS路由到HTTP请求，并限制需要使用内部证书和配置信任的范围。
其他解决方案也可以显式地使用内部TLS，例如using SPIFFE to secure database connections。这些都涉及显式配置信任链，我可以看到你想最小化。