基础设施/consul服务发现

[kaybinwong]

1、配置集群参数

apiVersion: v1
data:
  boostrap.json: |
    {
	"acl_datacenter": "shenzhen",
	"acl_master_token": "b1gs3883cr3t",
	"acl_default_policy": "deny",
	"acl_down_policy": "extend-cache"
    }
kind: ConfigMap
metadata:
  name: consul-defaults
  namespace: kube-system

acl_datacenter: 集群名
acl_default_policy: 默认策略，禁止任何操作
acl_master_token: 集群管理token，这里还有其他几个token需要我们注意一下。

简单来说，
cl_master_token有最高权限，一般用来管理集群；
acl_token是默认权限，用于当一些没有带token的请求想要请求consul获取数据的时候所给的权限；acl_agent_token 是用于Client或Server交互的时使用的令牌。

2、使用helm安装consul

Replicas: 3
ImageTag: "1.4.2"
ImagePullPolicy: "IfNotPresent"

HttpPort: 8500
RpcPort: 8400
SerflanPort: 8301
SerflanUdpPort: 8301
SerfwanPort: 8302
SerfwanUdpPort: 8302
ServerPort: 8300
ConsulDnsPort: 8600

Resources: {}

priorityClassName: ""

Storage: "1Gi"
StorageClass: ""

## Needed for 0.8.0 and later IF all consul containers are spun up
## on the same machine. Without this they all generate the same
## host id.
DisableHostNodeId: false

## Datacenter name for consul. If not supplied, will use the consul
## default 'dc1'
DatacenterName: 'shenzhen'

## predefined value for gossip key.
## Will use a generated random alpha numeric if not provided
## GossipKey: '9aZ&8Ir*'

ConsulConfig: 
#  - type: secret
#    name: consul-defaults
  - type: configMap
    name: consul-defaults

## Enable Consul Web UI
##
ui:
  enabled: true
## Create dedicated UI service
##
uiService:
  enabled: true
  type: "ClusterIP"
  annotations: {}

## Create an Ingress for the Web UI
uiIngress:
  enabled: true
  annotations: 
    kubernetes.io/ingress.class: traefik
#   traefik.ingress.kubernetes.io/auth-secret: consul-auth
#   traefik.ingress.kubernetes.io/auth-type: basic
  labels: {}
  hosts: 
  - svc-center-v1.seedland.cc
  tls: {}

3、创建agent token

curl --request PUT --header "X-Consul-Token: b1gs3113cr3t" --data '{
  "Name": "Agent Token",
  "Type": "client",
  "Rules": "node \"\" { policy = \"write\" } service \"\" { policy = \"read\" }"
}' http://svc-center-v1.seedland.cc/v1/acl/create

{
    "ID": "19d10d98-4d24-a60c-2b98-8afdfb2d3a0f"
}

4、更新配置参数

apiVersion: v1
data:
  boostrap.json: |
     {
	"acl_datacenter": "shenzhen",
	"acl_master_token": "b1gs3883cr3t",
	"acl_default_policy": "deny",
	"acl_down_policy": "extend-cache",
        "acl_agent_token": "19d10d98-4d24-a60c-2b98-8afdfb2d3a0f"
    }
kind: ConfigMap
metadata:
  name: consul-defaults
  namespace: kube-system

5、等待集群重启

......
2019/02/27 08:38:49 [INFO] serf: EventMemberUpdate: consul-2
2019/02/27 08:38:50 [INFO] serf: EventMemberUpdate: consul-2.shenzhen
2019/02/27 08:38:50 [DEBUG] raft-net: 10.233.104.52:8300 accepted connection from: 10.233.118.52:37104
2019/02/27 08:41:51 [INFO] serf: EventMemberUpdate: consul-1
2019/02/27 08:41:51 [INFO] serf: EventMemberUpdate: consul-1.shenzhen

6、使用token登录ui

7、根据不同项目分配不同策略