feat: 添加MCP服务器测试套件和Kali Linux测试支持
refactor(consul): 将Consul集群作业文件移动到components目录 refactor(vault): 将Vault集群作业文件移动到components目录 refactor(nomad): 将Nomad NFS卷作业文件移动到components目录 fix(ssh): 修复浏览器主机的SSH密钥认证配置 fix(ansible): 更新Ansible配置以支持SSH密钥认证 test: 添加全面的MCP服务器测试脚本和报告 test: 添加Kali Linux测试套件和健康检查 test: 添加自动化测试运行脚本 docs: 更新README以包含测试说明和经验教训 docs: 添加Vault部署指南和测试文档 chore: 更新Makefile添加测试相关命令
This commit is contained in:
@@ -1,94 +0,0 @@
|
||||
job "vault-cluster" {
|
||||
datacenters = ["dc1"]
|
||||
type = "service"
|
||||
|
||||
group "vault-servers" {
|
||||
count = 3
|
||||
|
||||
constraint {
|
||||
attribute = "${node.unique.name}"
|
||||
operator = "regexp"
|
||||
value = "(warden|ash3c|master)"
|
||||
}
|
||||
|
||||
task "vault" {
|
||||
driver = "podman"
|
||||
|
||||
config {
|
||||
image = "hashicorp/vault:latest"
|
||||
ports = ["api", "cluster"]
|
||||
|
||||
# 确保容器在退出时不会自动重启
|
||||
command = "vault"
|
||||
args = [
|
||||
"server",
|
||||
"-config=/vault/config/vault.hcl"
|
||||
]
|
||||
|
||||
# 容器网络设置
|
||||
network_mode = "host"
|
||||
|
||||
# 安全设置
|
||||
cap_add = ["IPC_LOCK"]
|
||||
}
|
||||
|
||||
template {
|
||||
data = <<EOH
|
||||
storage "consul" {
|
||||
address = "127.0.0.1:8500"
|
||||
path = "vault/"
|
||||
token = "{{ with secret "consul/creds/vault" }}{{ .Data.token }}{{ end }}"
|
||||
}
|
||||
|
||||
listener "tcp" {
|
||||
address = "0.0.0.0:8200"
|
||||
tls_disable = 1 # 生产环境应启用TLS
|
||||
}
|
||||
|
||||
api_addr = "http://{{ env "NOMAD_IP_api" }}:8200"
|
||||
cluster_addr = "http://{{ env "NOMAD_IP_cluster" }}:8201"
|
||||
|
||||
ui = true
|
||||
disable_mlock = true
|
||||
EOH
|
||||
destination = "vault/config/vault.hcl"
|
||||
}
|
||||
|
||||
volume_mount {
|
||||
volume = "vault-data"
|
||||
destination = "/vault/data"
|
||||
read_only = false
|
||||
}
|
||||
|
||||
resources {
|
||||
cpu = 500
|
||||
memory = 1024
|
||||
|
||||
network {
|
||||
mbits = 10
|
||||
port "api" { static = 8200 }
|
||||
port "cluster" { static = 8201 }
|
||||
}
|
||||
}
|
||||
|
||||
service {
|
||||
name = "vault"
|
||||
port = "api"
|
||||
|
||||
check {
|
||||
name = "vault-health"
|
||||
type = "http"
|
||||
path = "/v1/sys/health"
|
||||
interval = "10s"
|
||||
timeout = "2s"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
volume "vault-data" {
|
||||
type = "host"
|
||||
read_only = false
|
||||
source = "vault-data"
|
||||
}
|
||||
}
|
||||
}
|
||||
117
docs/vault/vault_deployment_guide.md
Normal file
117
docs/vault/vault_deployment_guide.md
Normal file
@@ -0,0 +1,117 @@
|
||||
# Vault 通过 Nomad 部署指南
|
||||
|
||||
本文档提供了使用 Nomad 的 exec 驱动部署 HashiCorp Vault 的详细步骤，类似于 Consul 的部署方式。
|
||||
|
||||
## 部署架构
|
||||
|
||||
- **驱动方式**：使用 Nomad 的 `exec` 驱动
|
||||
- **节点分布**：在三个节点上部署（kr-master、us-ash3c、bj-warden）
|
||||
- **存储后端**：使用本地 Consul 作为存储后端
|
||||
- **网络设置**：API 端口为 8200，集群通信端口为 8201
|
||||
|
||||
## 自动部署方法
|
||||
|
||||
我们提供了一个自动化脚本来简化部署过程。该脚本会：
|
||||
|
||||
1. 使用 Ansible 在所有节点上安装 Vault
|
||||
2. 通过 Nomad 部署 Vault 服务
|
||||
3. 初始化和解封 Vault（如果需要）
|
||||
|
||||
### 使用自动部署脚本
|
||||
|
||||
```bash
|
||||
# 确保脚本有执行权限
|
||||
chmod +x scripts/deploy_vault.sh
|
||||
|
||||
# 运行部署脚本
|
||||
./scripts/deploy_vault.sh
|
||||
```
|
||||
|
||||
脚本执行完成后，Vault 将在主节点上初始化并解封。您需要在其他节点上手动执行解封操作。
|
||||
|
||||
## 手动部署步骤
|
||||
|
||||
如果您想手动部署，请按照以下步骤操作：
|
||||
|
||||
### 1. 安装 Vault
|
||||
|
||||
使用 Ansible 在所有节点上安装 Vault：
|
||||
|
||||
```bash
|
||||
ansible-playbook -i configuration/inventories/production/vault.ini configuration/playbooks/install/install_vault.yml
|
||||
```
|
||||
|
||||
### 2. 部署 Vault 服务
|
||||
|
||||
使用 Nomad 部署 Vault 服务：
|
||||
|
||||
```bash
|
||||
nomad job run jobs/vault-cluster-exec.nomad
|
||||
```
|
||||
|
||||
### 3. 初始化 Vault
|
||||
|
||||
在一个节点上初始化 Vault：
|
||||
|
||||
```bash
|
||||
export VAULT_ADDR='http://127.0.0.1:8200'
|
||||
vault operator init -key-shares=5 -key-threshold=3
|
||||
```
|
||||
|
||||
请安全保存生成的解封密钥和根令牌！
|
||||
|
||||
### 4. 解封 Vault
|
||||
|
||||
在每个节点上解封 Vault：
|
||||
|
||||
```bash
|
||||
export VAULT_ADDR='http://127.0.0.1:8200'
|
||||
vault operator unseal <解封密钥1>
|
||||
vault operator unseal <解封密钥2>
|
||||
vault operator unseal <解封密钥3>
|
||||
```
|
||||
|
||||
## 验证部署
|
||||
|
||||
验证 Vault 状态：
|
||||
|
||||
```bash
|
||||
export VAULT_ADDR='http://127.0.0.1:8200'
|
||||
vault status
|
||||
```
|
||||
|
||||
## 配置文件说明
|
||||
|
||||
### Nomad 作业文件
|
||||
|
||||
`jobs/vault-cluster-exec.nomad` 定义了 Vault 服务的 Nomad 作业配置，使用 exec 驱动在三个节点上部署 Vault。
|
||||
|
||||
### Ansible Playbook
|
||||
|
||||
`configuration/playbooks/install/install_vault.yml` 负责在目标节点上安装 Vault 软件包和创建必要的目录结构。
|
||||
|
||||
## 故障排除
|
||||
|
||||
### Vault 无法启动
|
||||
|
||||
- 检查 Nomad 作业状态：`nomad job status vault-cluster-exec`
|
||||
- 检查 Nomad 分配日志：`nomad alloc logs <allocation_id>`
|
||||
- 确保 Consul 正在运行：`consul members`
|
||||
|
||||
### Vault 无法解封
|
||||
|
||||
- 确保使用正确的解封密钥
|
||||
- 检查 Vault 状态：`vault status`
|
||||
- 检查 Consul 中的 Vault 数据：`consul kv get -recurse vault/`
|
||||
|
||||
## 后续步骤
|
||||
|
||||
成功部署 Vault 后，您可能需要：
|
||||
|
||||
1. 配置访问策略
|
||||
2. 启用密钥引擎
|
||||
3. 与 Nomad 集成
|
||||
4. 配置审计日志
|
||||
5. 设置自动解封机制（生产环境）
|
||||
|
||||
请参考 `docs/vault/vault_setup_guide.md` 获取更多信息。
|
||||
Reference in New Issue
Block a user