feat: 重构项目脚本结构和文档
docs: 添加API和部署文档 refactor: 重新组织脚本目录结构 fix: 修复Nomad配置中的region设置 chore: 移除过期节点相关配置 test: 更新MCP服务器测试脚本 build: 更新Makefile以适配新脚本路径
This commit is contained in:
38
deployment/ansible/files/podman-driver.hcl
Normal file
38
deployment/ansible/files/podman-driver.hcl
Normal file
@@ -0,0 +1,38 @@
|
||||
client {
|
||||
enabled = true
|
||||
# 配置七姐妹服务器地址
|
||||
servers = [
|
||||
"100.116.158.95:4647", # bj-semaphore
|
||||
"100.81.26.3:4647", # ash1d
|
||||
"100.103.147.94:4647", # ash2e
|
||||
"100.90.159.68:4647", # ch2
|
||||
"100.86.141.112:4647", # ch3
|
||||
"100.98.209.50:4647", # bj-onecloud1
|
||||
"100.120.225.29:4647" # de
|
||||
]
|
||||
host_volume "fnsync" {
|
||||
path = "/mnt/fnsync"
|
||||
read_only = false
|
||||
}
|
||||
# 禁用Docker驱动，只使用Podman
|
||||
options {
|
||||
"driver.raw_exec.enable" = "1"
|
||||
"driver.exec.enable" = "1"
|
||||
}
|
||||
plugin_dir = "/opt/nomad/plugins"
|
||||
}
|
||||
|
||||
# 配置Podman驱动
|
||||
plugin "podman" {
|
||||
config {
|
||||
volumes {
|
||||
enabled = true
|
||||
}
|
||||
logging {
|
||||
type = "journald"
|
||||
}
|
||||
gc {
|
||||
container = true
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,10 +1,10 @@
|
||||
[nomad_servers]
|
||||
# 服务器节点 (7个服务器节点)
|
||||
bj-semaphore ansible_host=100.116.158.95 ansible_user=root
|
||||
ash1d.global ansible_host=100.81.26.3 ansible_user=ben ansible_password=3131 ansible_become_password=3131
|
||||
ash2e.global ansible_host=100.103.147.94 ansible_user=ben ansible_password=3131 ansible_become_password=3131
|
||||
ch2.global ansible_host=100.90.159.68 ansible_user=ben ansible_password=3131 ansible_become_password=3131
|
||||
ch3.global ansible_host=100.86.141.112 ansible_user=ben ansible_password=3131 ansible_become_password=3131
|
||||
#本机，不操作bj-semaphore ansible_host=100.116.158.95 ansible_user=root ansible_password=3131 ansible_become_password=3131
|
||||
ash1d ansible_host=100.81.26.3 ansible_user=ben ansible_password=3131 ansible_become_password=3131
|
||||
ash2e ansible_host=100.103.147.94 ansible_user=ben ansible_password=3131 ansible_become_password=3131
|
||||
ch2 ansible_host=100.90.159.68 ansible_user=ben ansible_password=3131 ansible_become_password=3131
|
||||
ch3 ansible_host=100.86.141.112 ansible_user=ben ansible_password=3131 ansible_become_password=3131
|
||||
onecloud1 ansible_host=100.98.209.50 ansible_user=ben ansible_password=3131 ansible_become_password=3131
|
||||
de ansible_host=100.120.225.29 ansible_user=ben ansible_password=3131 ansible_become_password=3131
|
||||
|
||||
@@ -12,6 +12,10 @@ de ansible_host=100.120.225.29 ansible_user=ben ansible_password=3131 ansible_be
|
||||
# 客户端节点
|
||||
master ansible_host=100.117.106.136 ansible_user=ben ansible_password=3131 ansible_become_password=3131 ansible_port=60022
|
||||
ash3c ansible_host=100.116.80.94 ansible_user=ben ansible_password=3131 ansible_become_password=3131
|
||||
browser ansible_host=100.116.112.45 ansible_user=ben ansible_password=3131 ansible_become_password=3131
|
||||
influxdb1 ansible_host=100.116.80.94 ansible_user=ben ansible_password=3131 ansible_become_password=3131
|
||||
hcp1 ansible_host=100.97.62.111 ansible_user=root ansible_password=3131 ansible_become_password=3131
|
||||
warden ansible_host=100.122.197.112 ansible_user=ben ansible_password=3131 ansible_become_password=3131
|
||||
|
||||
[nomad_nodes:children]
|
||||
nomad_servers
|
||||
@@ -25,9 +29,3 @@ mount_point=/mnt/fnsync
|
||||
|
||||
# Ansible配置
|
||||
ansible_ssh_common_args='-o StrictHostKeyChecking=no'
|
||||
|
||||
[browser]
|
||||
browser ansible_host=browser ansible_user=ben ansible_password=3131 ansible_become_password=3131
|
||||
|
||||
[browser:vars]
|
||||
ansible_ssh_common_args='-o StrictHostKeyChecking=no'
|
||||
@@ -3,8 +3,8 @@ dev1 ansible_host=dev1 ansible_user=ben ansible_become=yes ansible_become_pass=3
|
||||
dev2 ansible_host=dev2 ansible_user=ben ansible_become=yes ansible_become_pass=3131
|
||||
|
||||
[oci_kr]
|
||||
ch2 ansible_host=ch2 ansible_user=ben ansible_become=yes ansible_become_pass=3131
|
||||
ch3 ansible_host=ch3 ansible_user=ben ansible_become=yes ansible_become_pass=3131
|
||||
#ch2 ansible_host=ch2 ansible_user=ben ansible_become=yes ansible_become_pass=3131 # 过期节点，已移除 (2025-09-30)
|
||||
#ch3 ansible_host=ch3 ansible_user=ben ansible_become=yes ansible_become_pass=3131 # 过期节点，已移除 (2025-09-30)
|
||||
|
||||
[oci_us]
|
||||
ash1d ansible_host=ash1d ansible_user=ben ansible_become=yes ansible_become_pass=3131
|
||||
@@ -47,7 +47,7 @@ postgresql ansible_host=postgresql ansible_user=root ansible_become=yes ansible_
|
||||
influxdb ansible_host=influxdb1 ansible_user=root ansible_become=yes ansible_become_pass=313131
|
||||
warden ansible_host=warden ansible_user=ben ansible_become=yes ansible_become_pass=3131
|
||||
[semaphore]
|
||||
semaphoressh ansible_host=localhost ansible_user=root ansible_become=yes ansible_become_pass=313131 ansible_ssh_pass=313131
|
||||
#semaphoressh ansible_host=localhost ansible_user=root ansible_become=yes ansible_become_pass=313131 ansible_ssh_pass=313131 # 过期节点，已移除 (2025-09-30)
|
||||
|
||||
[alpine]
|
||||
#Alpine Linux containers using apk package manager
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
[target_nodes]
|
||||
master ansible_host=master ansible_port=60022 ansible_user=ben ansible_become=yes ansible_become_pass=3131
|
||||
ash3c ansible_host=ash3c ansible_user=ben ansible_become=yes ansible_become_pass=3131
|
||||
master ansible_host=100.117.106.136 ansible_port=60022 ansible_user=ben ansible_become=yes ansible_become_pass=3131
|
||||
ash3c ansible_host=100.116.80.94 ansible_user=ben ansible_become=yes ansible_become_pass=3131
|
||||
semaphore ansible_host=100.116.158.95 ansible_user=ben ansible_become=yes ansible_become_pass=3131
|
||||
|
||||
[target_nodes:vars]
|
||||
ansible_ssh_common_args='-o StrictHostKeyChecking=no'
|
||||
14
deployment/ansible/inventories/production/nomad-clients.ini
Normal file
14
deployment/ansible/inventories/production/nomad-clients.ini
Normal file
@@ -0,0 +1,14 @@
|
||||
# Nomad 客户端节点配置
|
||||
# 此文件包含需要配置为Nomad客户端的6个节点
|
||||
|
||||
[nomad_clients]
|
||||
bj-hcp1 ansible_host=bj-hcp1 ansible_user=root ansible_password=313131 ansible_become_password=313131
|
||||
bj-influxdb ansible_host=bj-influxdb ansible_user=root ansible_password=313131 ansible_become_password=313131
|
||||
bj-warden ansible_host=bj-warden ansible_user=ben ansible_password=3131 ansible_become_password=3131
|
||||
bj-hcp2 ansible_host=bj-hcp2 ansible_user=root ansible_password=313131 ansible_become_password=313131
|
||||
kr-master ansible_host=master ansible_port=60022 ansible_user=ben ansible_password=3131 ansible_become_password=3131
|
||||
us-ash3c ansible_host=ash3c ansible_user=ben ansible_password=3131 ansible_become_password=3131
|
||||
|
||||
[nomad_clients:vars]
|
||||
ansible_ssh_common_args='-o StrictHostKeyChecking=no'
|
||||
client_ip="{{ ansible_host }}"
|
||||
50
deployment/ansible/onecloud1_nomad.hcl
Normal file
50
deployment/ansible/onecloud1_nomad.hcl
Normal file
@@ -0,0 +1,50 @@
|
||||
datacenter = "dc1"
|
||||
data_dir = "/opt/nomad/data"
|
||||
plugin_dir = "/opt/nomad/plugins"
|
||||
log_level = "INFO"
|
||||
name = "onecloud1"
|
||||
|
||||
bind_addr = "100.98.209.50"
|
||||
|
||||
addresses {
|
||||
http = "100.98.209.50"
|
||||
rpc = "100.98.209.50"
|
||||
serf = "100.98.209.50"
|
||||
}
|
||||
|
||||
ports {
|
||||
http = 4646
|
||||
rpc = 4647
|
||||
serf = 4648
|
||||
}
|
||||
|
||||
server {
|
||||
enabled = true
|
||||
bootstrap_expect = 3
|
||||
retry_join = ["100.81.26.3", "100.103.147.94", "100.90.159.68", "100.86.141.112", "100.98.209.50", "100.120.225.29"]
|
||||
}
|
||||
|
||||
client {
|
||||
enabled = false
|
||||
}
|
||||
|
||||
plugin "nomad-driver-podman" {
|
||||
config {
|
||||
socket_path = "unix:///run/podman/podman.sock"
|
||||
volumes {
|
||||
enabled = true
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
consul {
|
||||
address = "100.117.106.136:8500,100.116.80.94:8500,100.122.197.112:8500" # master, ash3c, warden
|
||||
}
|
||||
|
||||
vault {
|
||||
enabled = true
|
||||
address = "http://100.117.106.136:8200,http://100.116.80.94:8200,http://100.122.197.112:8200" # master, ash3c, warden
|
||||
token = "hvs.A5Fu4E1oHyezJapVllKPFsWg"
|
||||
create_from_role = "nomad-cluster"
|
||||
tls_skip_verify = true
|
||||
}
|
||||
@@ -1,9 +1,20 @@
|
||||
---
|
||||
- name: 配置Nomad客户端节点
|
||||
hosts: nomad_nodes:!semaphore
|
||||
hosts: nomad_clients
|
||||
become: yes
|
||||
vars:
|
||||
nomad_config_dir: /etc/nomad.d
|
||||
client_ip: "{{ ansible_host }}"
|
||||
|
||||
# Nomad节点名称（带地理位置前缀）
|
||||
client_name: >-
|
||||
{%- if inventory_hostname == 'influxdb1' -%}us-influxdb
|
||||
{%- elif inventory_hostname == 'master' -%}kr-master
|
||||
{%- elif inventory_hostname == 'hcp1' -%}bj-hcp1
|
||||
{%- elif inventory_hostname == 'hcp2' -%}bj-hcp2
|
||||
{%- elif inventory_hostname == 'warden' -%}bj-warden
|
||||
{%- else -%}{{ inventory_hostname }}
|
||||
{%- endif -%}
|
||||
|
||||
tasks:
|
||||
- name: 创建Nomad配置目录
|
||||
@@ -14,42 +25,9 @@
|
||||
group: root
|
||||
mode: '0755'
|
||||
|
||||
- name: 复制Nomad客户端配置
|
||||
copy:
|
||||
content: |
|
||||
datacenter = "dc1"
|
||||
data_dir = "/opt/nomad/data"
|
||||
log_level = "INFO"
|
||||
bind_addr = "0.0.0.0"
|
||||
|
||||
server {
|
||||
enabled = false
|
||||
}
|
||||
|
||||
client {
|
||||
enabled = true
|
||||
servers = ["100.116.158.95:4647"]
|
||||
host_volume "fnsync" {
|
||||
path = "/mnt/fnsync"
|
||||
read_only = false
|
||||
}
|
||||
}
|
||||
|
||||
addresses {
|
||||
http = "{{ ansible_host }}"
|
||||
rpc = "{{ ansible_host }}"
|
||||
serf = "{{ ansible_host }}"
|
||||
}
|
||||
|
||||
advertise {
|
||||
http = "{{ ansible_host }}:4646"
|
||||
rpc = "{{ ansible_host }}:4647"
|
||||
serf = "{{ ansible_host }}:4648"
|
||||
}
|
||||
|
||||
consul {
|
||||
address = "100.116.158.95:8500"
|
||||
}
|
||||
- name: 复制Nomad客户端配置模板
|
||||
template:
|
||||
src: ../templates/nomad-client.hcl
|
||||
dest: "{{ nomad_config_dir }}/nomad.hcl"
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
@@ -0,0 +1,104 @@
|
||||
---
|
||||
- name: 配置Nomad客户端节点
|
||||
hosts: target_nodes
|
||||
become: yes
|
||||
vars:
|
||||
nomad_config_dir: /etc/nomad.d
|
||||
|
||||
tasks:
|
||||
- name: 创建Nomad配置目录
|
||||
file:
|
||||
path: "{{ nomad_config_dir }}"
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
|
||||
- name: 复制Nomad客户端配置
|
||||
copy:
|
||||
content: |
|
||||
datacenter = "dc1"
|
||||
data_dir = "/opt/nomad/data"
|
||||
log_level = "INFO"
|
||||
bind_addr = "0.0.0.0"
|
||||
|
||||
server {
|
||||
enabled = false
|
||||
}
|
||||
|
||||
client {
|
||||
enabled = true
|
||||
# 配置七姐妹服务器地址
|
||||
servers = [
|
||||
"100.116.158.95:4647", # bj-semaphore
|
||||
"100.81.26.3:4647", # ash1d
|
||||
"100.103.147.94:4647", # ash2e
|
||||
"100.90.159.68:4647", # ch2
|
||||
"100.86.141.112:4647", # ch3
|
||||
"100.98.209.50:4647", # bj-onecloud1
|
||||
"100.120.225.29:4647" # de
|
||||
]
|
||||
host_volume "fnsync" {
|
||||
path = "/mnt/fnsync"
|
||||
read_only = false
|
||||
}
|
||||
# 禁用Docker驱动，只使用Podman
|
||||
options {
|
||||
"driver.raw_exec.enable" = "1"
|
||||
"driver.exec.enable" = "1"
|
||||
}
|
||||
}
|
||||
|
||||
# 配置Podman插件目录
|
||||
plugin_dir = "/opt/nomad/plugins"
|
||||
|
||||
addresses {
|
||||
http = "{{ ansible_host }}"
|
||||
rpc = "{{ ansible_host }}"
|
||||
serf = "{{ ansible_host }}"
|
||||
}
|
||||
|
||||
advertise {
|
||||
http = "{{ ansible_host }}:4646"
|
||||
rpc = "{{ ansible_host }}:4647"
|
||||
serf = "{{ ansible_host }}:4648"
|
||||
}
|
||||
|
||||
consul {
|
||||
address = "100.116.158.95:8500"
|
||||
}
|
||||
|
||||
# 配置Podman驱动
|
||||
plugin "podman" {
|
||||
config {
|
||||
volumes {
|
||||
enabled = true
|
||||
}
|
||||
logging {
|
||||
type = "journald"
|
||||
}
|
||||
gc {
|
||||
container = true
|
||||
}
|
||||
}
|
||||
}
|
||||
dest: "{{ nomad_config_dir }}/nomad.hcl"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: 启动Nomad服务
|
||||
systemd:
|
||||
name: nomad
|
||||
state: restarted
|
||||
enabled: yes
|
||||
daemon_reload: yes
|
||||
|
||||
- name: 检查Nomad服务状态
|
||||
command: systemctl status nomad
|
||||
register: nomad_status
|
||||
changed_when: false
|
||||
|
||||
- name: 显示Nomad服务状态
|
||||
debug:
|
||||
var: nomad_status.stdout_lines
|
||||
@@ -0,0 +1,104 @@
|
||||
---
|
||||
- name: 配置Nomad客户端节点
|
||||
hosts: target_nodes
|
||||
become: yes
|
||||
vars:
|
||||
nomad_config_dir: /etc/nomad.d
|
||||
|
||||
tasks:
|
||||
- name: 创建Nomad配置目录
|
||||
file:
|
||||
path: "{{ nomad_config_dir }}"
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
|
||||
- name: 复制Nomad客户端配置
|
||||
copy:
|
||||
content: |
|
||||
datacenter = "dc1"
|
||||
data_dir = "/opt/nomad/data"
|
||||
log_level = "INFO"
|
||||
bind_addr = "0.0.0.0"
|
||||
|
||||
server {
|
||||
enabled = false
|
||||
}
|
||||
|
||||
client {
|
||||
enabled = true
|
||||
# 配置七姐妹服务器地址
|
||||
servers = [
|
||||
"100.116.158.95:4647", # bj-semaphore
|
||||
"100.81.26.3:4647", # ash1d
|
||||
"100.103.147.94:4647", # ash2e
|
||||
"100.90.159.68:4647", # ch2
|
||||
"100.86.141.112:4647", # ch3
|
||||
"100.98.209.50:4647", # bj-onecloud1
|
||||
"100.120.225.29:4647" # de
|
||||
]
|
||||
host_volume "fnsync" {
|
||||
path = "/mnt/fnsync"
|
||||
read_only = false
|
||||
}
|
||||
# 禁用Docker驱动，只使用Podman
|
||||
options {
|
||||
"driver.raw_exec.enable" = "1"
|
||||
"driver.exec.enable" = "1"
|
||||
}
|
||||
}
|
||||
|
||||
# 配置Podman插件目录
|
||||
plugin_dir = "/opt/nomad/plugins"
|
||||
|
||||
addresses {
|
||||
http = "{{ ansible_host }}"
|
||||
rpc = "{{ ansible_host }}"
|
||||
serf = "{{ ansible_host }}"
|
||||
}
|
||||
|
||||
advertise {
|
||||
http = "{{ ansible_host }}:4646"
|
||||
rpc = "{{ ansible_host }}:4647"
|
||||
serf = "{{ ansible_host }}:4648"
|
||||
}
|
||||
|
||||
consul {
|
||||
address = "100.116.158.95:8500"
|
||||
}
|
||||
|
||||
# 配置Podman驱动
|
||||
plugin "podman" {
|
||||
config {
|
||||
volumes {
|
||||
enabled = true
|
||||
}
|
||||
logging {
|
||||
type = "journald"
|
||||
}
|
||||
gc {
|
||||
container = true
|
||||
}
|
||||
}
|
||||
}
|
||||
dest: "{{ nomad_config_dir }}/nomad.hcl"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: 启动Nomad服务
|
||||
systemd:
|
||||
name: nomad
|
||||
state: restarted
|
||||
enabled: yes
|
||||
daemon_reload: yes
|
||||
|
||||
- name: 检查Nomad服务状态
|
||||
command: systemctl status nomad
|
||||
register: nomad_status
|
||||
changed_when: false
|
||||
|
||||
- name: 显示Nomad服务状态
|
||||
debug:
|
||||
var: nomad_status.stdout_lines
|
||||
105
deployment/ansible/playbooks/deploy-korean-nodes.yml
Normal file
105
deployment/ansible/playbooks/deploy-korean-nodes.yml
Normal file
@@ -0,0 +1,105 @@
|
||||
---
|
||||
- name: 部署韩国节点Nomad配置
|
||||
hosts: ch2,ch3
|
||||
become: yes
|
||||
gather_facts: no
|
||||
vars:
|
||||
nomad_config_dir: "/etc/nomad.d"
|
||||
nomad_config_file: "{{ nomad_config_dir }}/nomad.hcl"
|
||||
source_config_dir: "/root/mgmt/infrastructure/configs/server"
|
||||
|
||||
tasks:
|
||||
- name: 获取主机名短名称（去掉后缀）
|
||||
set_fact:
|
||||
short_hostname: "{{ inventory_hostname | regex_replace('\\$', '') }}"
|
||||
|
||||
- name: 确保 Nomad 配置目录存在
|
||||
file:
|
||||
path: "{{ nomad_config_dir }}"
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
|
||||
- name: 部署 Nomad 配置文件到韩国节点
|
||||
copy:
|
||||
src: "{{ source_config_dir }}/nomad-{{ short_hostname }}.hcl"
|
||||
dest: "{{ nomad_config_file }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
backup: yes
|
||||
notify: restart nomad
|
||||
|
||||
- name: 检查 Nomad 二进制文件位置
|
||||
shell: which nomad || find /usr -name nomad 2>/dev/null | head -1
|
||||
register: nomad_binary_path
|
||||
failed_when: nomad_binary_path.stdout == ""
|
||||
|
||||
- name: 创建/更新 Nomad systemd 服务文件
|
||||
copy:
|
||||
dest: "/etc/systemd/system/nomad.service"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
content: |
|
||||
[Unit]
|
||||
Description=Nomad
|
||||
Documentation=https://www.nomadproject.io/
|
||||
Requires=network-online.target
|
||||
After=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=notify
|
||||
User=root
|
||||
Group=root
|
||||
ExecStart={{ nomad_binary_path.stdout }} agent -config=/etc/nomad.d/nomad.hcl
|
||||
ExecReload=/bin/kill -HUP $MAINPID
|
||||
KillMode=process
|
||||
Restart=on-failure
|
||||
LimitNOFILE=65536
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
notify: restart nomad
|
||||
|
||||
- name: 确保 Nomad 数据目录存在
|
||||
file:
|
||||
path: "/opt/nomad/data"
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
|
||||
- name: 重新加载 systemd daemon
|
||||
systemd:
|
||||
daemon_reload: yes
|
||||
|
||||
- name: 启用并启动 Nomad 服务
|
||||
systemd:
|
||||
name: nomad
|
||||
enabled: yes
|
||||
state: started
|
||||
|
||||
- name: 等待 Nomad 服务启动
|
||||
wait_for:
|
||||
port: 4646
|
||||
host: "{{ ansible_host }}"
|
||||
delay: 5
|
||||
timeout: 30
|
||||
ignore_errors: yes
|
||||
|
||||
- name: 显示 Nomad 服务状态
|
||||
command: systemctl status nomad
|
||||
register: nomad_status
|
||||
changed_when: false
|
||||
|
||||
- name: 显示 Nomad 服务状态信息
|
||||
debug:
|
||||
var: nomad_status.stdout_lines
|
||||
|
||||
handlers:
|
||||
- name: restart nomad
|
||||
systemd:
|
||||
name: nomad
|
||||
state: restarted
|
||||
@@ -0,0 +1,105 @@
|
||||
---
|
||||
- name: 部署韩国节点Nomad配置
|
||||
hosts: ch2,ch3
|
||||
become: yes
|
||||
gather_facts: no
|
||||
vars:
|
||||
nomad_config_dir: "/etc/nomad.d"
|
||||
nomad_config_file: "{{ nomad_config_dir }}/nomad.hcl"
|
||||
source_config_dir: "/root/mgmt/infrastructure/configs/server"
|
||||
|
||||
tasks:
|
||||
- name: 获取主机名短名称（去掉.global后缀）
|
||||
set_fact:
|
||||
short_hostname: "{{ inventory_hostname | regex_replace('\\.global$', '') }}"
|
||||
|
||||
- name: 确保 Nomad 配置目录存在
|
||||
file:
|
||||
path: "{{ nomad_config_dir }}"
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
|
||||
- name: 部署 Nomad 配置文件到韩国节点
|
||||
copy:
|
||||
src: "{{ source_config_dir }}/nomad-{{ short_hostname }}.hcl"
|
||||
dest: "{{ nomad_config_file }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
backup: yes
|
||||
notify: restart nomad
|
||||
|
||||
- name: 检查 Nomad 二进制文件位置
|
||||
shell: which nomad || find /usr -name nomad 2>/dev/null | head -1
|
||||
register: nomad_binary_path
|
||||
failed_when: nomad_binary_path.stdout == ""
|
||||
|
||||
- name: 创建/更新 Nomad systemd 服务文件
|
||||
copy:
|
||||
dest: "/etc/systemd/system/nomad.service"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
content: |
|
||||
[Unit]
|
||||
Description=Nomad
|
||||
Documentation=https://www.nomadproject.io/
|
||||
Requires=network-online.target
|
||||
After=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=notify
|
||||
User=root
|
||||
Group=root
|
||||
ExecStart={{ nomad_binary_path.stdout }} agent -config=/etc/nomad.d/nomad.hcl
|
||||
ExecReload=/bin/kill -HUP $MAINPID
|
||||
KillMode=process
|
||||
Restart=on-failure
|
||||
LimitNOFILE=65536
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
notify: restart nomad
|
||||
|
||||
- name: 确保 Nomad 数据目录存在
|
||||
file:
|
||||
path: "/opt/nomad/data"
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
|
||||
- name: 重新加载 systemd daemon
|
||||
systemd:
|
||||
daemon_reload: yes
|
||||
|
||||
- name: 启用并启动 Nomad 服务
|
||||
systemd:
|
||||
name: nomad
|
||||
enabled: yes
|
||||
state: started
|
||||
|
||||
- name: 等待 Nomad 服务启动
|
||||
wait_for:
|
||||
port: 4646
|
||||
host: "{{ ansible_host }}"
|
||||
delay: 5
|
||||
timeout: 30
|
||||
ignore_errors: yes
|
||||
|
||||
- name: 显示 Nomad 服务状态
|
||||
command: systemctl status nomad
|
||||
register: nomad_status
|
||||
changed_when: false
|
||||
|
||||
- name: 显示 Nomad 服务状态信息
|
||||
debug:
|
||||
var: nomad_status.stdout_lines
|
||||
|
||||
handlers:
|
||||
- name: restart nomad
|
||||
systemd:
|
||||
name: nomad
|
||||
state: restarted
|
||||
@@ -0,0 +1,105 @@
|
||||
---
|
||||
- name: 部署韩国节点Nomad配置
|
||||
hosts: ch2,ch3
|
||||
become: yes
|
||||
gather_facts: no
|
||||
vars:
|
||||
nomad_config_dir: "/etc/nomad.d"
|
||||
nomad_config_file: "{{ nomad_config_dir }}/nomad.hcl"
|
||||
source_config_dir: "/root/mgmt/infrastructure/configs/server"
|
||||
|
||||
tasks:
|
||||
- name: 获取主机名短名称（去掉后缀）
|
||||
set_fact:
|
||||
short_hostname: "{{ inventory_hostname | regex_replace('\\$', '') }}"
|
||||
|
||||
- name: 确保 Nomad 配置目录存在
|
||||
file:
|
||||
path: "{{ nomad_config_dir }}"
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
|
||||
- name: 部署 Nomad 配置文件到韩国节点
|
||||
copy:
|
||||
src: "{{ source_config_dir }}/nomad-{{ short_hostname }}.hcl"
|
||||
dest: "{{ nomad_config_file }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
backup: yes
|
||||
notify: restart nomad
|
||||
|
||||
- name: 检查 Nomad 二进制文件位置
|
||||
shell: which nomad || find /usr -name nomad 2>/dev/null | head -1
|
||||
register: nomad_binary_path
|
||||
failed_when: nomad_binary_path.stdout == ""
|
||||
|
||||
- name: 创建/更新 Nomad systemd 服务文件
|
||||
copy:
|
||||
dest: "/etc/systemd/system/nomad.service"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
content: |
|
||||
[Unit]
|
||||
Description=Nomad
|
||||
Documentation=https://www.nomadproject.io/
|
||||
Requires=network-online.target
|
||||
After=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=notify
|
||||
User=root
|
||||
Group=root
|
||||
ExecStart={{ nomad_binary_path.stdout }} agent -config=/etc/nomad.d/nomad.hcl
|
||||
ExecReload=/bin/kill -HUP $MAINPID
|
||||
KillMode=process
|
||||
Restart=on-failure
|
||||
LimitNOFILE=65536
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
notify: restart nomad
|
||||
|
||||
- name: 确保 Nomad 数据目录存在
|
||||
file:
|
||||
path: "/opt/nomad/data"
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
|
||||
- name: 重新加载 systemd daemon
|
||||
systemd:
|
||||
daemon_reload: yes
|
||||
|
||||
- name: 启用并启动 Nomad 服务
|
||||
systemd:
|
||||
name: nomad
|
||||
enabled: yes
|
||||
state: started
|
||||
|
||||
- name: 等待 Nomad 服务启动
|
||||
wait_for:
|
||||
port: 4646
|
||||
host: "{{ ansible_host }}"
|
||||
delay: 5
|
||||
timeout: 30
|
||||
ignore_errors: yes
|
||||
|
||||
- name: 显示 Nomad 服务状态
|
||||
command: systemctl status nomad
|
||||
register: nomad_status
|
||||
changed_when: false
|
||||
|
||||
- name: 显示 Nomad 服务状态信息
|
||||
debug:
|
||||
var: nomad_status.stdout_lines
|
||||
|
||||
handlers:
|
||||
- name: restart nomad
|
||||
systemd:
|
||||
name: nomad
|
||||
state: restarted
|
||||
@@ -0,0 +1,33 @@
|
||||
---
|
||||
- name: 分发SSH公钥到Nomad客户端节点
|
||||
hosts: nomad_clients
|
||||
become: yes
|
||||
vars:
|
||||
ssh_public_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMSUUfma8FKEFvH8Nq65XM2PZ9kitfgv1q727cKV9y5Z houzhongxu@seekkey.tech"
|
||||
|
||||
tasks:
|
||||
- name: 确保 .ssh 目录存在
|
||||
file:
|
||||
path: "/home/{{ ansible_user }}/.ssh"
|
||||
state: directory
|
||||
owner: "{{ ansible_user }}"
|
||||
group: "{{ ansible_user }}"
|
||||
mode: '0700'
|
||||
|
||||
- name: 添加SSH公钥到 authorized_keys
|
||||
lineinfile:
|
||||
path: "/home/{{ ansible_user }}/.ssh/authorized_keys"
|
||||
line: "{{ ssh_public_key }}"
|
||||
create: yes
|
||||
owner: "{{ ansible_user }}"
|
||||
group: "{{ ansible_user }}"
|
||||
mode: '0600'
|
||||
|
||||
- name: 验证SSH公钥已添加
|
||||
command: cat "/home/{{ ansible_user }}/.ssh/authorized_keys"
|
||||
register: ssh_key_check
|
||||
changed_when: false
|
||||
|
||||
- name: 显示SSH公钥内容
|
||||
debug:
|
||||
var: ssh_key_check.stdout_lines
|
||||
32
deployment/ansible/playbooks/distribute-ssh-keys.yml
Normal file
32
deployment/ansible/playbooks/distribute-ssh-keys.yml
Normal file
@@ -0,0 +1,32 @@
|
||||
---
|
||||
- name: 分发SSH公钥到新节点
|
||||
hosts: browser,influxdb1,hcp1,warden
|
||||
become: yes
|
||||
vars:
|
||||
ssh_public_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMSUUfma8FKEFvH8Nq65XM2PZ9kitfgv1q727cKV9y5Z houzhongxu@seekkey.tech"
|
||||
|
||||
tasks:
|
||||
- name: 确保 .ssh 目录存在
|
||||
file:
|
||||
path: "/root/.ssh"
|
||||
state: directory
|
||||
mode: '0700'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: 添加SSH公钥到 authorized_keys
|
||||
copy:
|
||||
content: "{{ ssh_public_key }}"
|
||||
dest: "/root/.ssh/authorized_keys"
|
||||
mode: '0600'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: 验证SSH公钥已添加
|
||||
command: cat /root/.ssh/authorized_keys
|
||||
register: ssh_key_check
|
||||
changed_when: false
|
||||
|
||||
- name: 显示SSH公钥内容
|
||||
debug:
|
||||
var: ssh_key_check.stdout_lines
|
||||
43
deployment/ansible/playbooks/fix-nomad-region-config.yml
Normal file
43
deployment/ansible/playbooks/fix-nomad-region-config.yml
Normal file
@@ -0,0 +1,43 @@
|
||||
---
|
||||
- name: 修复 Nomad 服务器 region 配置
|
||||
hosts: nomad_servers
|
||||
become: yes
|
||||
vars:
|
||||
nomad_config_dir: /etc/nomad.d
|
||||
|
||||
tasks:
|
||||
- name: 备份当前 Nomad 配置
|
||||
copy:
|
||||
src: "{{ nomad_config_dir }}/nomad.hcl"
|
||||
dest: "{{ nomad_config_dir }}/nomad.hcl.backup.{{ ansible_date_time.epoch }}"
|
||||
remote_src: yes
|
||||
ignore_errors: yes
|
||||
|
||||
- name: 更新 Nomad 配置文件以添加 region 设置
|
||||
blockinfile:
|
||||
path: "{{ nomad_config_dir }}/nomad.hcl"
|
||||
insertafter: '^datacenter = '
|
||||
block: |
|
||||
region = "dc1"
|
||||
marker: "# {mark} Ansible managed region setting"
|
||||
notify: restart nomad
|
||||
|
||||
- name: 更新节点名称以移除 .global 后缀（如果存在）
|
||||
replace:
|
||||
path: "{{ nomad_config_dir }}/nomad.hcl"
|
||||
regexp: 'name = "(.*)\.global(.*)"'
|
||||
replace: 'name = "\1\2"'
|
||||
notify: restart nomad
|
||||
|
||||
- name: 确保 retry_join 使用正确的 IP 地址
|
||||
replace:
|
||||
path: "{{ nomad_config_dir }}/nomad.hcl"
|
||||
regexp: 'retry_join = \[(.*)\]'
|
||||
replace: 'retry_join = ["100.81.26.3", "100.103.147.94", "100.90.159.68", "100.116.158.95", "100.98.209.50", "100.120.225.29"]'
|
||||
notify: restart nomad
|
||||
|
||||
handlers:
|
||||
- name: restart nomad
|
||||
systemd:
|
||||
name: nomad
|
||||
state: restarted
|
||||
@@ -0,0 +1,87 @@
|
||||
---
|
||||
- name: Configure Nomad Podman Driver
|
||||
hosts: target_nodes
|
||||
become: yes
|
||||
tasks:
|
||||
- name: Create backup directory
|
||||
file:
|
||||
path: /etc/nomad.d/backup
|
||||
state: directory
|
||||
mode: '0755'
|
||||
|
||||
- name: Backup current nomad.hcl
|
||||
copy:
|
||||
src: /etc/nomad.d/nomad.hcl
|
||||
dest: "/etc/nomad.d/backup/nomad.hcl.bak.{{ ansible_date_time.iso8601 }}"
|
||||
remote_src: yes
|
||||
|
||||
- name: Create plugin directory
|
||||
file:
|
||||
path: /opt/nomad/plugins
|
||||
state: directory
|
||||
owner: nomad
|
||||
group: nomad
|
||||
mode: '0755'
|
||||
|
||||
- name: Create symlink for podman driver
|
||||
file:
|
||||
src: /usr/bin/nomad-driver-podman
|
||||
dest: /opt/nomad/plugins/nomad-driver-podman
|
||||
state: link
|
||||
|
||||
- name: Copy podman driver configuration
|
||||
copy:
|
||||
src: ../../files/podman-driver.hcl
|
||||
dest: /etc/nomad.d/podman-driver.hcl
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Remove existing plugin_dir configuration
|
||||
lineinfile:
|
||||
path: /etc/nomad.d/nomad.hcl
|
||||
regexp: '^plugin_dir = "/opt/nomad/data/plugins"'
|
||||
state: absent
|
||||
|
||||
- name: Configure Nomad to use Podman driver
|
||||
blockinfile:
|
||||
path: /etc/nomad.d/nomad.hcl
|
||||
marker: "# {mark} ANSIBLE MANAGED BLOCK - PODMAN DRIVER"
|
||||
block: |
|
||||
plugin_dir = "/opt/nomad/plugins"
|
||||
|
||||
plugin "podman" {
|
||||
config {
|
||||
volumes {
|
||||
enabled = true
|
||||
}
|
||||
logging {
|
||||
type = "journald"
|
||||
}
|
||||
gc {
|
||||
container = true
|
||||
}
|
||||
}
|
||||
}
|
||||
register: nomad_config_result
|
||||
|
||||
- name: Restart nomad service
|
||||
systemd:
|
||||
name: nomad
|
||||
state: restarted
|
||||
enabled: yes
|
||||
|
||||
- name: Wait for nomad to start
|
||||
wait_for:
|
||||
port: 4646
|
||||
delay: 10
|
||||
timeout: 60
|
||||
|
||||
- name: Check nomad status
|
||||
command: nomad node status
|
||||
register: nomad_status
|
||||
changed_when: false
|
||||
|
||||
- name: Display nomad status
|
||||
debug:
|
||||
var: nomad_status.stdout_lines
|
||||
86
deployment/ansible/playbooks/restore-hosts-file.yml
Normal file
86
deployment/ansible/playbooks/restore-hosts-file.yml
Normal file
@@ -0,0 +1,86 @@
|
||||
---
|
||||
- name: 恢复客户端节点的/etc/hosts文件
|
||||
hosts: nomad_clients
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- name: 删除添加的主机名解析条目
|
||||
lineinfile:
|
||||
path: /etc/hosts
|
||||
regexp: "^100\\.116\\.158\\.95\\s"
|
||||
state: absent
|
||||
|
||||
- name: 删除添加的主机名解析条目
|
||||
lineinfile:
|
||||
path: /etc/hosts
|
||||
regexp: "^100\\.81\\.26\\.3\\s"
|
||||
state: absent
|
||||
|
||||
- name: 删除添加的主机名解析条目
|
||||
lineinfile:
|
||||
path: /etc/hosts
|
||||
regexp: "^100\\.103\\.147\\.94\\s"
|
||||
state: absent
|
||||
|
||||
- name: 删除添加的主机名解析条目
|
||||
lineinfile:
|
||||
path: /etc/hosts
|
||||
regexp: "^100\\.90\\.159\\.68\\s"
|
||||
state: absent
|
||||
|
||||
- name: 删除添加的主机名解析条目
|
||||
lineinfile:
|
||||
path: /etc/hosts
|
||||
regexp: "^100\\.86\\.141\\.112\\s"
|
||||
state: absent
|
||||
|
||||
- name: 删除添加的主机名解析条目
|
||||
lineinfile:
|
||||
path: /etc/hosts
|
||||
regexp: "^100\\.98\\.209\\.50\\s"
|
||||
state: absent
|
||||
|
||||
- name: 删除添加的主机名解析条目
|
||||
lineinfile:
|
||||
path: /etc/hosts
|
||||
regexp: "^100\\.120\\.225\\.29\\s"
|
||||
state: absent
|
||||
|
||||
- name: 删除添加的主机名解析条目
|
||||
lineinfile:
|
||||
path: /etc/hosts
|
||||
regexp: "^100\\.117\\.106\\.136\\s"
|
||||
state: absent
|
||||
|
||||
- name: 删除添加的主机名解析条目
|
||||
lineinfile:
|
||||
path: /etc/hosts
|
||||
regexp: "^100\\.116\\.80\\.94\\s"
|
||||
state: absent
|
||||
|
||||
- name: 删除添加的主机名解析条目
|
||||
lineinfile:
|
||||
path: /etc/hosts
|
||||
regexp: "^100\\.116\\.112\\.45\\s"
|
||||
state: absent
|
||||
|
||||
- name: 删除添加的主机名解析条目
|
||||
lineinfile:
|
||||
path: /etc/hosts
|
||||
regexp: "^100\\.97\\.62\\.111\\s"
|
||||
state: absent
|
||||
|
||||
- name: 删除添加的主机名解析条目
|
||||
lineinfile:
|
||||
path: /etc/hosts
|
||||
regexp: "^100\\.122\\.197\\.112\\s"
|
||||
state: absent
|
||||
|
||||
- name: 显示恢复后的/etc/hosts文件内容
|
||||
command: cat /etc/hosts
|
||||
register: hosts_content
|
||||
changed_when: false
|
||||
|
||||
- name: 显示/etc/hosts文件内容
|
||||
debug:
|
||||
var: hosts_content.stdout_lines
|
||||
50
deployment/ansible/playbooks/update-hosts-file.yml
Normal file
50
deployment/ansible/playbooks/update-hosts-file.yml
Normal file
@@ -0,0 +1,50 @@
|
||||
---
|
||||
- name: 更新客户端节点的/etc/hosts文件
|
||||
hosts: nomad_clients
|
||||
become: yes
|
||||
vars:
|
||||
hosts_entries:
|
||||
- ip: "100.116.158.95"
|
||||
hostnames: ["semaphore", "bj-semaphore"]
|
||||
- ip: "100.81.26.3"
|
||||
hostnames: ["ash1d"]
|
||||
- ip: "100.103.147.94"
|
||||
hostnames: ["ash2e"]
|
||||
- ip: "100.90.159.68"
|
||||
hostnames: ["ch2"]
|
||||
- ip: "100.86.141.112"
|
||||
hostnames: ["ch3"]
|
||||
- ip: "100.98.209.50"
|
||||
hostnames: ["onecloud1", "bj-onecloud1"]
|
||||
- ip: "100.120.225.29"
|
||||
hostnames: ["de"]
|
||||
- ip: "100.117.106.136"
|
||||
hostnames: ["master"]
|
||||
- ip: "100.116.80.94"
|
||||
hostnames: ["ash3c", "influxdb1"]
|
||||
- ip: "100.116.112.45"
|
||||
hostnames: ["browser"]
|
||||
- ip: "100.97.62.111"
|
||||
hostnames: ["hcp1", "bj-hcp1"]
|
||||
- ip: "100.122.197.112"
|
||||
hostnames: ["warden"]
|
||||
|
||||
tasks:
|
||||
- name: 添加主机名解析到/etc/hosts文件
|
||||
lineinfile:
|
||||
path: /etc/hosts
|
||||
line: "{{ item.ip }} {{ item.hostnames | join(' ') }}"
|
||||
create: yes
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
loop: "{{ hosts_entries }}"
|
||||
|
||||
- name: 显示更新后的/etc/hosts文件内容
|
||||
command: cat /etc/hosts
|
||||
register: hosts_content
|
||||
changed_when: false
|
||||
|
||||
- name: 显示/etc/hosts文件内容
|
||||
debug:
|
||||
var: hosts_content.stdout_lines
|
||||
31
deployment/ansible/playbooks/update-nomad-server-config.yml
Normal file
31
deployment/ansible/playbooks/update-nomad-server-config.yml
Normal file
@@ -0,0 +1,31 @@
|
||||
---
|
||||
- name: Update Nomad server configuration
|
||||
hosts: nomad_servers
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- name: Backup current Nomad configuration
|
||||
copy:
|
||||
src: /etc/nomad.d/nomad.hcl
|
||||
dest: /etc/nomad.d/nomad.hcl.bak
|
||||
remote_src: yes
|
||||
|
||||
- name: Generate Nomad configuration for each server
|
||||
template:
|
||||
src: ../templates/nomad-server.hcl.j2
|
||||
dest: /etc/nomad.d/nomad.hcl
|
||||
vars:
|
||||
server_name: "{{ inventory_hostname }}"
|
||||
server_ip: "{{ ansible_host }}"
|
||||
|
||||
- name: Restart Nomad service
|
||||
systemd:
|
||||
name: nomad
|
||||
state: restarted
|
||||
|
||||
- name: Wait for Nomad to be ready
|
||||
wait_for:
|
||||
port: 4646
|
||||
host: "{{ ansible_host }}"
|
||||
delay: 10
|
||||
timeout: 60
|
||||
@@ -1,39 +1,76 @@
|
||||
datacenter = "dc1"
|
||||
data_dir = "/opt/nomad/data"
|
||||
plugin_dir = "/opt/nomad/plugins"
|
||||
log_level = "INFO"
|
||||
name = "{{ client_name }}"
|
||||
|
||||
# 使用Tailscale网络，但绑定到本地接口
|
||||
bind_addr = "0.0.0.0"
|
||||
bind_addr = "{{ client_ip }}"
|
||||
|
||||
addresses {
|
||||
http = "{{ client_ip }}"
|
||||
rpc = "{{ client_ip }}"
|
||||
serf = "{{ client_ip }}"
|
||||
}
|
||||
|
||||
advertise {
|
||||
http = "{{ client_ip }}:4646"
|
||||
rpc = "{{ client_ip }}:4647"
|
||||
serf = "{{ client_ip }}:4648"
|
||||
}
|
||||
|
||||
ports {
|
||||
http = 4646
|
||||
rpc = 4647
|
||||
serf = 4648
|
||||
}
|
||||
|
||||
server {
|
||||
enabled = false
|
||||
}
|
||||
|
||||
# 启用客户端模式，支持混合存储
|
||||
client {
|
||||
enabled = true
|
||||
servers = ["100.116.158.95:4647"]
|
||||
# 配置七仙女服务器地址，使用短名
|
||||
servers = [
|
||||
"semaphore:4647", # bj-semaphore
|
||||
"ash1d:4647", # ash1d
|
||||
"ash2e:4647", # ash2e
|
||||
"ch2:4647", # ch2
|
||||
"ch3:4647", # ch3
|
||||
"onecloud1:4647", # bj-onecloud1
|
||||
"de:4647" # de
|
||||
]
|
||||
|
||||
# 配置host volumes
|
||||
host_volume "fnsync" {
|
||||
path = "/mnt/fnsync"
|
||||
read_only = false
|
||||
}
|
||||
|
||||
# 禁用Docker驱动，只使用Podman
|
||||
options {
|
||||
"driver.raw_exec.enable" = "1"
|
||||
"driver.exec.enable" = "1"
|
||||
}
|
||||
}
|
||||
|
||||
# 指定Tailscale地址用于通信
|
||||
addresses {
|
||||
http = "{{ ansible_host }}"
|
||||
rpc = "{{ ansible_host }}"
|
||||
serf = "{{ ansible_host }}"
|
||||
}
|
||||
|
||||
advertise {
|
||||
http = "{{ ansible_host }}:4646"
|
||||
rpc = "{{ ansible_host }}:4647"
|
||||
serf = "{{ ansible_host }}:4648"
|
||||
plugin "nomad-driver-podman" {
|
||||
config {
|
||||
socket_path = "unix:///run/podman/podman.sock"
|
||||
volumes {
|
||||
enabled = true
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
consul {
|
||||
address = "100.116.158.95:8500"
|
||||
address = "master:8500,ash3c:8500,warden:8500"
|
||||
}
|
||||
|
||||
vault {
|
||||
enabled = true
|
||||
address = "http://master:8200,http://ash3c:8200,http://warden:8200"
|
||||
token = "hvs.A5Fu4E1oHyezJapVllKPFsWg"
|
||||
create_from_role = "nomad-cluster"
|
||||
tls_skip_verify = true
|
||||
}
|
||||
50
deployment/ansible/templates/nomad-server.hcl.j2
Normal file
50
deployment/ansible/templates/nomad-server.hcl.j2
Normal file
@@ -0,0 +1,50 @@
|
||||
datacenter = "dc1"
|
||||
data_dir = "/opt/nomad/data"
|
||||
plugin_dir = "/opt/nomad/plugins"
|
||||
log_level = "INFO"
|
||||
name = "{{ server_name }}"
|
||||
|
||||
bind_addr = "{{ server_ip }}"
|
||||
|
||||
addresses {
|
||||
http = "{{ server_ip }}"
|
||||
rpc = "{{ server_ip }}"
|
||||
serf = "{{ server_ip }}"
|
||||
}
|
||||
|
||||
ports {
|
||||
http = 4646
|
||||
rpc = 4647
|
||||
serf = 4648
|
||||
}
|
||||
|
||||
server {
|
||||
enabled = true
|
||||
bootstrap_expect = 3
|
||||
retry_join = ["semaphore", "ash1d", "ash2e", "ch2", "ch3", "onecloud1", "de"]
|
||||
}
|
||||
|
||||
client {
|
||||
enabled = false
|
||||
}
|
||||
|
||||
plugin "nomad-driver-podman" {
|
||||
config {
|
||||
socket_path = "unix:///run/podman/podman.sock"
|
||||
volumes {
|
||||
enabled = true
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
consul {
|
||||
address = "master:8500,ash3c:8500,warden:8500"
|
||||
}
|
||||
|
||||
vault {
|
||||
enabled = true
|
||||
address = "http://master:8200,http://ash3c:8200,http://warden:8200"
|
||||
token = "hvs.A5Fu4E1oHyezJapVllKPFsWg"
|
||||
create_from_role = "nomad-cluster"
|
||||
tls_skip_verify = true
|
||||
}
|
||||
69
deployment/ansible/update_ch2_nomad.yml
Normal file
69
deployment/ansible/update_ch2_nomad.yml
Normal file
@@ -0,0 +1,69 @@
|
||||
---
|
||||
- name: Update Nomad configuration for ch2 server
|
||||
hosts: ch2
|
||||
become: yes
|
||||
tasks:
|
||||
- name: Backup original nomad.hcl
|
||||
copy:
|
||||
src: /etc/nomad.d/nomad.hcl
|
||||
dest: /etc/nomad.d/nomad.hcl.bak
|
||||
remote_src: yes
|
||||
|
||||
- name: Update nomad.hcl with retry_join configuration
|
||||
copy:
|
||||
content: |
|
||||
datacenter = "dc1"
|
||||
data_dir = "/opt/nomad/data"
|
||||
plugin_dir = "/opt/nomad/plugins"
|
||||
log_level = "INFO"
|
||||
name = "ch2"
|
||||
|
||||
bind_addr = "100.90.159.68"
|
||||
|
||||
addresses {
|
||||
http = "100.90.159.68"
|
||||
rpc = "100.90.159.68"
|
||||
serf = "100.90.159.68"
|
||||
}
|
||||
|
||||
ports {
|
||||
http = 4646
|
||||
rpc = 4647
|
||||
serf = 4648
|
||||
}
|
||||
|
||||
server {
|
||||
enabled = true
|
||||
retry_join = ["100.81.26.3:4648", "100.103.147.94:4648", "100.86.141.112:4648", "100.120.225.29:4648", "100.98.209.50:4648", "100.116.158.95:4648"]
|
||||
}
|
||||
|
||||
client {
|
||||
enabled = false
|
||||
}
|
||||
|
||||
plugin "nomad-driver-podman" {
|
||||
config {
|
||||
socket_path = "unix:///run/podman/podman.sock"
|
||||
volumes {
|
||||
enabled = true
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
consul {
|
||||
address = "100.117.106.136:8500,100.116.80.94:8500,100.122.197.112:8500" # master, ash3c, warden
|
||||
}
|
||||
|
||||
vault {
|
||||
enabled = true
|
||||
address = "http://100.117.106.136:8200,http://100.116.80.94:8200,http://100.122.197.112:8200" # master, ash3c, warden
|
||||
token = "hvs.A5Fu4E1oHyezJapVllKPFsWg"
|
||||
create_from_role = "nomad-cluster"
|
||||
tls_skip_verify = true
|
||||
}
|
||||
dest: /etc/nomad.d/nomad.hcl
|
||||
|
||||
- name: Restart Nomad service
|
||||
systemd:
|
||||
name: nomad
|
||||
state: restarted
|
||||
69
deployment/ansible/update_ch2_nomad_name.yml
Normal file
69
deployment/ansible/update_ch2_nomad_name.yml
Normal file
@@ -0,0 +1,69 @@
|
||||
---
|
||||
- name: Update Nomad configuration for ch2 server with correct name
|
||||
hosts: ch2
|
||||
become: yes
|
||||
tasks:
|
||||
- name: Backup original nomad.hcl
|
||||
copy:
|
||||
src: /etc/nomad.d/nomad.hcl
|
||||
dest: /etc/nomad.d/nomad.hcl.bak2
|
||||
remote_src: yes
|
||||
|
||||
- name: Update nomad.hcl with correct name and retry_join configuration
|
||||
copy:
|
||||
content: |
|
||||
datacenter = "dc1"
|
||||
data_dir = "/opt/nomad/data"
|
||||
plugin_dir = "/opt/nomad/plugins"
|
||||
log_level = "INFO"
|
||||
name = "ch2"
|
||||
|
||||
bind_addr = "100.90.159.68"
|
||||
|
||||
addresses {
|
||||
http = "100.90.159.68"
|
||||
rpc = "100.90.159.68"
|
||||
serf = "100.90.159.68"
|
||||
}
|
||||
|
||||
ports {
|
||||
http = 4646
|
||||
rpc = 4647
|
||||
serf = 4648
|
||||
}
|
||||
|
||||
server {
|
||||
enabled = true
|
||||
retry_join = ["100.81.26.3:4648", "100.103.147.94:4648", "100.86.141.112:4648", "100.120.225.29:4648", "100.98.209.50:4648", "100.116.158.95:4648"]
|
||||
}
|
||||
|
||||
client {
|
||||
enabled = false
|
||||
}
|
||||
|
||||
plugin "nomad-driver-podman" {
|
||||
config {
|
||||
socket_path = "unix:///run/podman/podman.sock"
|
||||
volumes {
|
||||
enabled = true
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
consul {
|
||||
address = "100.117.106.136:8500,100.116.80.94:8500,100.122.197.112:8500" # master, ash3c, warden
|
||||
}
|
||||
|
||||
vault {
|
||||
enabled = true
|
||||
address = "http://100.117.106.136:8200,http://100.116.80.94:8200,http://100.122.197.112:8200" # master, ash3c, warden
|
||||
token = "hvs.A5Fu4E1oHyezJapVllKPFsWg"
|
||||
create_from_role = "nomad-cluster"
|
||||
tls_skip_verify = true
|
||||
}
|
||||
dest: /etc/nomad.d/nomad.hcl
|
||||
|
||||
- name: Restart Nomad service
|
||||
systemd:
|
||||
name: nomad
|
||||
state: restarted
|
||||
@@ -0,0 +1,69 @@
|
||||
---
|
||||
- name: Update Nomad configuration for ch2 server with correct name
|
||||
hosts: ch2
|
||||
become: yes
|
||||
tasks:
|
||||
- name: Backup original nomad.hcl
|
||||
copy:
|
||||
src: /etc/nomad.d/nomad.hcl
|
||||
dest: /etc/nomad.d/nomad.hcl.bak2
|
||||
remote_src: yes
|
||||
|
||||
- name: Update nomad.hcl with correct name and retry_join configuration
|
||||
copy:
|
||||
content: |
|
||||
datacenter = "dc1"
|
||||
data_dir = "/opt/nomad/data"
|
||||
plugin_dir = "/opt/nomad/plugins"
|
||||
log_level = "INFO"
|
||||
name = "ch2"
|
||||
|
||||
bind_addr = "100.90.159.68"
|
||||
|
||||
addresses {
|
||||
http = "100.90.159.68"
|
||||
rpc = "100.90.159.68"
|
||||
serf = "100.90.159.68"
|
||||
}
|
||||
|
||||
ports {
|
||||
http = 4646
|
||||
rpc = 4647
|
||||
serf = 4648
|
||||
}
|
||||
|
||||
server {
|
||||
enabled = true
|
||||
retry_join = ["100.81.26.3:4648", "100.103.147.94:4648", "100.86.141.112:4648", "100.120.225.29:4648", "100.98.209.50:4648", "100.116.158.95:4648"]
|
||||
}
|
||||
|
||||
client {
|
||||
enabled = false
|
||||
}
|
||||
|
||||
plugin "nomad-driver-podman" {
|
||||
config {
|
||||
socket_path = "unix:///run/podman/podman.sock"
|
||||
volumes {
|
||||
enabled = true
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
consul {
|
||||
address = "100.117.106.136:8500,100.116.80.94:8500,100.122.197.112:8500" # master, ash3c, warden
|
||||
}
|
||||
|
||||
vault {
|
||||
enabled = true
|
||||
address = "http://100.117.106.136:8200,http://100.116.80.94:8200,http://100.122.197.112:8200" # master, ash3c, warden
|
||||
token = "hvs.A5Fu4E1oHyezJapVllKPFsWg"
|
||||
create_from_role = "nomad-cluster"
|
||||
tls_skip_verify = true
|
||||
}
|
||||
dest: /etc/nomad.d/nomad.hcl
|
||||
|
||||
- name: Restart Nomad service
|
||||
systemd:
|
||||
name: nomad
|
||||
state: restarted
|
||||
@@ -0,0 +1,69 @@
|
||||
---
|
||||
- name: Update Nomad configuration for ch2 server with correct name
|
||||
hosts: ch2
|
||||
become: yes
|
||||
tasks:
|
||||
- name: Backup original nomad.hcl
|
||||
copy:
|
||||
src: /etc/nomad.d/nomad.hcl
|
||||
dest: /etc/nomad.d/nomad.hcl.bak2
|
||||
remote_src: yes
|
||||
|
||||
- name: Update nomad.hcl with correct name and retry_join configuration
|
||||
copy:
|
||||
content: |
|
||||
datacenter = "dc1"
|
||||
data_dir = "/opt/nomad/data"
|
||||
plugin_dir = "/opt/nomad/plugins"
|
||||
log_level = "INFO"
|
||||
name = "ch2"
|
||||
|
||||
bind_addr = "100.90.159.68"
|
||||
|
||||
addresses {
|
||||
http = "100.90.159.68"
|
||||
rpc = "100.90.159.68"
|
||||
serf = "100.90.159.68"
|
||||
}
|
||||
|
||||
ports {
|
||||
http = 4646
|
||||
rpc = 4647
|
||||
serf = 4648
|
||||
}
|
||||
|
||||
server {
|
||||
enabled = true
|
||||
retry_join = ["100.81.26.3:4648", "100.103.147.94:4648", "100.86.141.112:4648", "100.120.225.29:4648", "100.98.209.50:4648", "100.116.158.95:4648"]
|
||||
}
|
||||
|
||||
client {
|
||||
enabled = false
|
||||
}
|
||||
|
||||
plugin "nomad-driver-podman" {
|
||||
config {
|
||||
socket_path = "unix:///run/podman/podman.sock"
|
||||
volumes {
|
||||
enabled = true
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
consul {
|
||||
address = "100.117.106.136:8500,100.116.80.94:8500,100.122.197.112:8500" # master, ash3c, warden
|
||||
}
|
||||
|
||||
vault {
|
||||
enabled = true
|
||||
address = "http://100.117.106.136:8200,http://100.116.80.94:8200,http://100.122.197.112:8200" # master, ash3c, warden
|
||||
token = "hvs.A5Fu4E1oHyezJapVllKPFsWg"
|
||||
create_from_role = "nomad-cluster"
|
||||
tls_skip_verify = true
|
||||
}
|
||||
dest: /etc/nomad.d/nomad.hcl
|
||||
|
||||
- name: Restart Nomad service
|
||||
systemd:
|
||||
name: nomad
|
||||
state: restarted
|
||||
69
deployment/ansible/update_ch2_nomad_name_final.yml
Normal file
69
deployment/ansible/update_ch2_nomad_name_final.yml
Normal file
@@ -0,0 +1,69 @@
|
||||
---
|
||||
- name: Update Nomad configuration for ch2 server with correct name format
|
||||
hosts: ch2
|
||||
become: yes
|
||||
tasks:
|
||||
- name: Backup original nomad.hcl
|
||||
copy:
|
||||
src: /etc/nomad.d/nomad.hcl
|
||||
dest: /etc/nomad.d/nomad.hcl.bak3
|
||||
remote_src: yes
|
||||
|
||||
- name: Update nomad.hcl with correct name format and retry_join configuration
|
||||
copy:
|
||||
content: |
|
||||
datacenter = "dc1"
|
||||
data_dir = "/opt/nomad/data"
|
||||
plugin_dir = "/opt/nomad/plugins"
|
||||
log_level = "INFO"
|
||||
name = "ch2"
|
||||
|
||||
bind_addr = "100.90.159.68"
|
||||
|
||||
addresses {
|
||||
http = "100.90.159.68"
|
||||
rpc = "100.90.159.68"
|
||||
serf = "100.90.159.68"
|
||||
}
|
||||
|
||||
ports {
|
||||
http = 4646
|
||||
rpc = 4647
|
||||
serf = 4648
|
||||
}
|
||||
|
||||
server {
|
||||
enabled = true
|
||||
retry_join = ["100.81.26.3:4648", "100.103.147.94:4648", "100.86.141.112:4648", "100.120.225.29:4648", "100.98.209.50:4648", "100.116.158.95:4648"]
|
||||
}
|
||||
|
||||
client {
|
||||
enabled = false
|
||||
}
|
||||
|
||||
plugin "nomad-driver-podman" {
|
||||
config {
|
||||
socket_path = "unix:///run/podman/podman.sock"
|
||||
volumes {
|
||||
enabled = true
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
consul {
|
||||
address = "100.117.106.136:8500,100.116.80.94:8500,100.122.197.112:8500" # master, ash3c, warden
|
||||
}
|
||||
|
||||
vault {
|
||||
enabled = true
|
||||
address = "http://100.117.106.136:8200,http://100.116.80.94:8200,http://100.122.197.112:8200" # master, ash3c, warden
|
||||
token = "hvs.A5Fu4E1oHyezJapVllKPFsWg"
|
||||
create_from_role = "nomad-cluster"
|
||||
tls_skip_verify = true
|
||||
}
|
||||
dest: /etc/nomad.d/nomad.hcl
|
||||
|
||||
- name: Restart Nomad service
|
||||
systemd:
|
||||
name: nomad
|
||||
state: restarted
|
||||
@@ -0,0 +1,69 @@
|
||||
---
|
||||
- name: Update Nomad configuration for ch2 server with correct name format
|
||||
hosts: ch2
|
||||
become: yes
|
||||
tasks:
|
||||
- name: Backup original nomad.hcl
|
||||
copy:
|
||||
src: /etc/nomad.d/nomad.hcl
|
||||
dest: /etc/nomad.d/nomad.hcl.bak3
|
||||
remote_src: yes
|
||||
|
||||
- name: Update nomad.hcl with correct name format and retry_join configuration
|
||||
copy:
|
||||
content: |
|
||||
datacenter = "dc1"
|
||||
data_dir = "/opt/nomad/data"
|
||||
plugin_dir = "/opt/nomad/plugins"
|
||||
log_level = "INFO"
|
||||
name = "ch2"
|
||||
|
||||
bind_addr = "100.90.159.68"
|
||||
|
||||
addresses {
|
||||
http = "100.90.159.68"
|
||||
rpc = "100.90.159.68"
|
||||
serf = "100.90.159.68"
|
||||
}
|
||||
|
||||
ports {
|
||||
http = 4646
|
||||
rpc = 4647
|
||||
serf = 4648
|
||||
}
|
||||
|
||||
server {
|
||||
enabled = true
|
||||
retry_join = ["100.81.26.3:4648", "100.103.147.94:4648", "100.86.141.112:4648", "100.120.225.29:4648", "100.98.209.50:4648", "100.116.158.95:4648"]
|
||||
}
|
||||
|
||||
client {
|
||||
enabled = false
|
||||
}
|
||||
|
||||
plugin "nomad-driver-podman" {
|
||||
config {
|
||||
socket_path = "unix:///run/podman/podman.sock"
|
||||
volumes {
|
||||
enabled = true
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
consul {
|
||||
address = "100.117.106.136:8500,100.116.80.94:8500,100.122.197.112:8500" # master, ash3c, warden
|
||||
}
|
||||
|
||||
vault {
|
||||
enabled = true
|
||||
address = "http://100.117.106.136:8200,http://100.116.80.94:8200,http://100.122.197.112:8200" # master, ash3c, warden
|
||||
token = "hvs.A5Fu4E1oHyezJapVllKPFsWg"
|
||||
create_from_role = "nomad-cluster"
|
||||
tls_skip_verify = true
|
||||
}
|
||||
dest: /etc/nomad.d/nomad.hcl
|
||||
|
||||
- name: Restart Nomad service
|
||||
systemd:
|
||||
name: nomad
|
||||
state: restarted
|
||||
@@ -0,0 +1,69 @@
|
||||
---
|
||||
- name: Update Nomad configuration for ch2 server with correct name format
|
||||
hosts: ch2
|
||||
become: yes
|
||||
tasks:
|
||||
- name: Backup original nomad.hcl
|
||||
copy:
|
||||
src: /etc/nomad.d/nomad.hcl
|
||||
dest: /etc/nomad.d/nomad.hcl.bak3
|
||||
remote_src: yes
|
||||
|
||||
- name: Update nomad.hcl with correct name format and retry_join configuration
|
||||
copy:
|
||||
content: |
|
||||
datacenter = "dc1"
|
||||
data_dir = "/opt/nomad/data"
|
||||
plugin_dir = "/opt/nomad/plugins"
|
||||
log_level = "INFO"
|
||||
name = "ch2"
|
||||
|
||||
bind_addr = "100.90.159.68"
|
||||
|
||||
addresses {
|
||||
http = "100.90.159.68"
|
||||
rpc = "100.90.159.68"
|
||||
serf = "100.90.159.68"
|
||||
}
|
||||
|
||||
ports {
|
||||
http = 4646
|
||||
rpc = 4647
|
||||
serf = 4648
|
||||
}
|
||||
|
||||
server {
|
||||
enabled = true
|
||||
retry_join = ["100.81.26.3:4648", "100.103.147.94:4648", "100.86.141.112:4648", "100.120.225.29:4648", "100.98.209.50:4648", "100.116.158.95:4648"]
|
||||
}
|
||||
|
||||
client {
|
||||
enabled = false
|
||||
}
|
||||
|
||||
plugin "nomad-driver-podman" {
|
||||
config {
|
||||
socket_path = "unix:///run/podman/podman.sock"
|
||||
volumes {
|
||||
enabled = true
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
consul {
|
||||
address = "100.117.106.136:8500,100.116.80.94:8500,100.122.197.112:8500" # master, ash3c, warden
|
||||
}
|
||||
|
||||
vault {
|
||||
enabled = true
|
||||
address = "http://100.117.106.136:8200,http://100.116.80.94:8200,http://100.122.197.112:8200" # master, ash3c, warden
|
||||
token = "hvs.A5Fu4E1oHyezJapVllKPFsWg"
|
||||
create_from_role = "nomad-cluster"
|
||||
tls_skip_verify = true
|
||||
}
|
||||
dest: /etc/nomad.d/nomad.hcl
|
||||
|
||||
- name: Restart Nomad service
|
||||
systemd:
|
||||
name: nomad
|
||||
state: restarted
|
||||
@@ -1,133 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Consul备份脚本
|
||||
# 此脚本用于创建Consul的快照备份，并管理备份文件
|
||||
|
||||
set -e
|
||||
|
||||
# 配置参数
|
||||
CONSUL_ADDR=${CONSUL_ADDR:-"http://localhost:8500"}
|
||||
BACKUP_DIR=${BACKUP_DIR:-"/backups/consul"}
|
||||
RETAIN_DAYS=${RETAIN_DAYS:-7}
|
||||
DATE=$(date +%Y%m%d_%H%M%S)
|
||||
|
||||
# 创建备份目录
|
||||
mkdir -p "$BACKUP_DIR"
|
||||
|
||||
echo "Consul备份脚本"
|
||||
echo "==============="
|
||||
echo "Consul地址: $CONSUL_ADDR"
|
||||
echo "备份目录: $BACKUP_DIR"
|
||||
echo "保留天数: $RETAIN_DAYS"
|
||||
echo "备份时间: $DATE"
|
||||
echo ""
|
||||
|
||||
# 检查Consul连接
|
||||
check_consul_connection() {
|
||||
echo "检查Consul连接..."
|
||||
if curl -s "$CONSUL_ADDR/v1/status/leader" > /dev/null; then
|
||||
echo "✓ Consul连接正常"
|
||||
else
|
||||
echo "✗ 无法连接到Consul，请检查Consul服务是否运行"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# 创建快照备份
|
||||
create_snapshot() {
|
||||
echo "创建Consul快照备份..."
|
||||
|
||||
SNAPSHOT_FILE="${BACKUP_DIR}/consul-snapshot-${DATE}.snap"
|
||||
|
||||
# 使用Consul API创建快照
|
||||
if curl -s "${CONSUL_ADDR}/v1/snapshot" > "$SNAPSHOT_FILE"; then
|
||||
echo "✓ 快照备份创建成功: $SNAPSHOT_FILE"
|
||||
|
||||
# 显示快照信息
|
||||
echo "快照信息:"
|
||||
consul snapshot inspect "$SNAPSHOT_FILE" 2>/dev/null || echo " (需要安装consul客户端以查看快照信息)"
|
||||
else
|
||||
echo "✗ 快照备份创建失败"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# 清理旧备份
|
||||
cleanup_old_backups() {
|
||||
echo "清理${RETAIN_DAYS}天前的备份..."
|
||||
|
||||
# 查找并删除旧备份文件
|
||||
if find "$BACKUP_DIR" -name "consul-snapshot-*.snap" -mtime +$RETAIN_DAYS -delete; then
|
||||
echo "✓ 旧备份清理完成"
|
||||
else
|
||||
echo " 没有找到需要清理的旧备份"
|
||||
fi
|
||||
}
|
||||
|
||||
# 列出所有备份
|
||||
list_backups() {
|
||||
echo ""
|
||||
echo "当前备份列表:"
|
||||
echo "============="
|
||||
|
||||
if [ -d "$BACKUP_DIR" ] && [ "$(ls -A "$BACKUP_DIR")" ]; then
|
||||
ls -lah "$BACKUP_DIR"/consul-snapshot-*.snap | awk '{print $5, $6, $7, $8, $9}'
|
||||
else
|
||||
echo " 没有找到备份文件"
|
||||
fi
|
||||
}
|
||||
|
||||
# 验证备份
|
||||
verify_backup() {
|
||||
echo ""
|
||||
echo "验证备份..."
|
||||
|
||||
LATEST_BACKUP=$(ls -t "$BACKUP_DIR"/consul-snapshot-*.snap | head -n 1)
|
||||
|
||||
if [ -n "$LATEST_BACKUP" ]; then
|
||||
echo "验证最新备份: $LATEST_BACKUP"
|
||||
|
||||
# 检查文件大小
|
||||
FILE_SIZE=$(du -h "$LATEST_BACKUP" | cut -f1)
|
||||
echo "备份文件大小: $FILE_SIZE"
|
||||
|
||||
# 检查文件是否为空
|
||||
if [ -s "$LATEST_BACKUP" ]; then
|
||||
echo "✓ 备份文件不为空"
|
||||
else
|
||||
echo "✗ 备份文件为空"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# 尝试检查快照元数据
|
||||
if consul snapshot inspect "$LATEST_BACKUP" > /dev/null 2>&1; then
|
||||
echo "✓ 备份文件格式正确"
|
||||
else
|
||||
echo "✗ 备份文件格式错误"
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
echo "✗ 没有找到备份文件"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# 主函数
|
||||
main() {
|
||||
check_consul_connection
|
||||
create_snapshot
|
||||
cleanup_old_backups
|
||||
list_backups
|
||||
verify_backup
|
||||
|
||||
echo ""
|
||||
echo "✓ 备份流程完成!"
|
||||
echo ""
|
||||
echo "使用说明:"
|
||||
echo "1. 可以通过cron定期运行此脚本: 0 2 * * * /path/to/backup_consul.sh"
|
||||
echo "2. 恢复备份使用: consul snapshot restore /path/to/consul-snapshot-YYYYMMDD_HHMMSS.snap"
|
||||
echo "3. 查看备份内容: consul snapshot inspect /path/to/consul-snapshot-YYYYMMDD_HHMMSS.snap"
|
||||
}
|
||||
|
||||
# 执行主函数
|
||||
main "$@"
|
||||
@@ -1,217 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Consul 变量和存储配置示例脚本
|
||||
# 此脚本展示了如何配置Consul的变量和存储功能
|
||||
|
||||
set -e
|
||||
|
||||
# 配置参数
|
||||
CONSUL_ADDR=${CONSUL_ADDR:-"http://localhost:8500"}
|
||||
ENVIRONMENT=${ENVIRONMENT:-"dev"}
|
||||
PROVIDER=${PROVIDER:-"oracle"}
|
||||
REGION=${REGION:-"kr"}
|
||||
|
||||
echo "Consul 变量和存储配置示例"
|
||||
echo "========================="
|
||||
echo "Consul 地址: $CONSUL_ADDR"
|
||||
echo "环境: $ENVIRONMENT"
|
||||
echo "提供商: $PROVIDER"
|
||||
echo "区域: $REGION"
|
||||
echo ""
|
||||
|
||||
# 检查Consul连接
|
||||
check_consul_connection() {
|
||||
echo "检查Consul连接..."
|
||||
if curl -s "$CONSUL_ADDR/v1/status/leader" > /dev/null; then
|
||||
echo "✓ Consul连接正常"
|
||||
else
|
||||
echo "✗ 无法连接到Consul，请检查Consul服务是否运行"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# 配置应用变量
|
||||
configure_app_variables() {
|
||||
echo "配置应用变量..."
|
||||
|
||||
# 应用基本信息
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/app/name" -d "my-application"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/app/version" -d "1.0.0"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/app/environment" -d "$ENVIRONMENT"
|
||||
|
||||
# 特性开关
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/features/new_ui" -d "true"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/features/advanced_analytics" -d "false"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/features/beta_features" -d "true"
|
||||
|
||||
echo "✓ 应用变量配置完成"
|
||||
}
|
||||
|
||||
# 配置数据库变量
|
||||
configure_database_variables() {
|
||||
echo "配置数据库变量..."
|
||||
|
||||
# 数据库连接信息
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/database/host" -d "db.example.com"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/database/port" -d "5432"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/database/name" -d "myapp_db"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/database/ssl_mode" -d "require"
|
||||
|
||||
# 数据库连接池配置
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/database/max_connections" -d "100"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/database/min_connections" -d "10"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/database/connection_timeout" -d "30s"
|
||||
|
||||
echo "✓ 数据库变量配置完成"
|
||||
}
|
||||
|
||||
# 配置缓存变量
|
||||
configure_cache_variables() {
|
||||
echo "配置缓存变量..."
|
||||
|
||||
# Redis配置
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/cache/host" -d "redis.example.com"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/cache/port" -d "6379"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/cache/password" -d "secure_password"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/cache/db" -d "0"
|
||||
|
||||
# 缓存策略
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/cache/ttl" -d "3600"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/cache/max_memory" -d "2gb"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/cache/eviction_policy" -d "allkeys-lru"
|
||||
|
||||
echo "✓ 缓存变量配置完成"
|
||||
}
|
||||
|
||||
# 配置消息队列变量
|
||||
configure_messaging_variables() {
|
||||
echo "配置消息队列变量..."
|
||||
|
||||
# RabbitMQ配置
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/messaging/host" -d "rabbitmq.example.com"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/messaging/port" -d "5672"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/messaging/username" -d "myapp"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/messaging/password" -d "secure_password"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/messaging/vhost" -d "/myapp"
|
||||
|
||||
# 队列配置
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/messaging/queue_name" -d "tasks"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/messaging/exchange" -d "myapp_exchange"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/messaging/routing_key" -d "task.#"
|
||||
|
||||
echo "✓ 消息队列变量配置完成"
|
||||
}
|
||||
|
||||
# 配置云服务提供商变量
|
||||
configure_provider_variables() {
|
||||
echo "配置云服务提供商变量..."
|
||||
|
||||
if [ "$PROVIDER" = "oracle" ]; then
|
||||
# Oracle Cloud配置
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/$PROVIDER/$region/tenancy_ocid" -d "ocid1.tenancy.oc1..aaaaaaaayourtenancyocid"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/$PROVIDER/$region/user_ocid" -d "ocid1.user.oc1..aaaaaaaayouruserocid"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/$PROVIDER/$region/fingerprint" -d "your-fingerprint"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/$PROVIDER/$region/region" -d "$REGION"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/$PROVIDER/$region/compartment_id" -d "ocid1.compartment.oc1..aaaaaaaayourcompartmentid"
|
||||
elif [ "$PROVIDER" = "aws" ]; then
|
||||
# AWS配置
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/$PROVIDER/$region/access_key" -d "your-access-key"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/$PROVIDER/$region/secret_key" -d "your-secret-key"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/$PROVIDER/$region/region" -d "$REGION"
|
||||
elif [ "$PROVIDER" = "gcp" ]; then
|
||||
# GCP配置
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/$PROVIDER/$region/project_id" -d "your-project-id"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/$PROVIDER/$region/region" -d "$REGION"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/$PROVIDER/$region/credentials_path" -d "/path/to/service-account.json"
|
||||
elif [ "$PROVIDER" = "digitalocean" ]; then
|
||||
# DigitalOcean配置
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/$PROVIDER/$region/token" -d "your-do-token"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/$PROVIDER/$region/region" -d "$REGION"
|
||||
fi
|
||||
|
||||
echo "✓ 云服务提供商变量配置完成"
|
||||
}
|
||||
|
||||
# 配置存储相关变量
|
||||
configure_storage_variables() {
|
||||
echo "配置存储相关变量..."
|
||||
|
||||
# 快照配置
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/storage/snapshot/enabled" -d "true"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/storage/snapshot/interval" -d "24h"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/storage/snapshot/retain" -d "30"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/storage/snapshot/name" -d "consul-snapshot-{{.Timestamp}}"
|
||||
|
||||
# 备份配置
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/storage/backup/enabled" -d "true"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/storage/backup/interval" -d "6h"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/storage/backup/retain" -d "7"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/storage/backup/name" -d "consul-backup-{{.Timestamp}}"
|
||||
|
||||
# 数据目录配置
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/storage/data_dir" -d "/opt/consul/data"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/storage/raft_dir" -d "/opt/consul/raft"
|
||||
|
||||
# Autopilot配置
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/storage/autopilot/cleanup_dead_servers" -d "true"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/storage/autopilot/last_contact_threshold" -d "200ms"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/storage/autopilot/max_trailing_logs" -d "250"
|
||||
curl -X PUT "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/storage/autopilot/server_stabilization_time" -d "10s"
|
||||
|
||||
echo "✓ 存储相关变量配置完成"
|
||||
}
|
||||
|
||||
# 显示配置结果
|
||||
display_configuration() {
|
||||
echo ""
|
||||
echo "配置结果:"
|
||||
echo "========="
|
||||
|
||||
echo "应用配置:"
|
||||
curl -s "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/app/?recurse" | jq -r '.[] | "\(.Key): \(.Value | @base64d)"' 2>/dev/null || echo " (需要安装jq以查看格式化输出)"
|
||||
|
||||
echo ""
|
||||
echo "数据库配置:"
|
||||
curl -s "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/database/?recurse" | jq -r '.[] | "\(.Key): \(.Value | @base64d)"' 2>/dev/null || echo " (需要安装jq以查看格式化输出)"
|
||||
|
||||
echo ""
|
||||
echo "缓存配置:"
|
||||
curl -s "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/cache/?recurse" | jq -r '.[] | "\(.Key): \(.Value | @base64d)"' 2>/dev/null || echo " (需要安装jq以查看格式化输出)"
|
||||
|
||||
echo ""
|
||||
echo "消息队列配置:"
|
||||
curl -s "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/messaging/?recurse" | jq -r '.[] | "\(.Key): \(.Value | @base64d)"' 2>/dev/null || echo " (需要安装jq以查看格式化输出)"
|
||||
|
||||
echo ""
|
||||
echo "云服务提供商配置:"
|
||||
curl -s "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/$PROVIDER/?recurse" | jq -r '.[] | "\(.Key): \(.Value | @base64d)"' 2>/dev/null || echo " (需要安装jq以查看格式化输出)"
|
||||
|
||||
echo ""
|
||||
echo "存储配置:"
|
||||
curl -s "$CONSUL_ADDR/v1/kv/config/$ENVIRONMENT/storage/?recurse" | jq -r '.[] | "\(.Key): \(.Value | @base64d)"' 2>/dev/null || echo " (需要安装jq以查看格式化输出)"
|
||||
}
|
||||
|
||||
# 主函数
|
||||
main() {
|
||||
check_consul_connection
|
||||
configure_app_variables
|
||||
configure_database_variables
|
||||
configure_cache_variables
|
||||
configure_messaging_variables
|
||||
configure_provider_variables
|
||||
configure_storage_variables
|
||||
display_configuration
|
||||
|
||||
echo ""
|
||||
echo "✓ 所有变量和存储配置已完成!"
|
||||
echo ""
|
||||
echo "使用说明:"
|
||||
echo "1. 在Terraform中使用consul_keys数据源获取这些配置"
|
||||
echo "2. 在应用程序中使用Consul客户端库读取这些配置"
|
||||
echo "3. 使用Consul UI查看和管理这些配置"
|
||||
echo ""
|
||||
echo "配置文件位置: /root/mgmt/docs/setup/consul_variables_and_storage_guide.md"
|
||||
}
|
||||
|
||||
# 执行主函数
|
||||
main "$@"
|
||||
@@ -1,143 +0,0 @@
|
||||
#!/bin/bash
|
||||
# 部署Vault集群的脚本
|
||||
|
||||
# 检查并安装Vault
|
||||
if ! which vault >/dev/null; then
|
||||
echo "==== 安装Vault ===="
|
||||
VAULT_VERSION="1.20.4"
|
||||
wget -q https://releases.hashicorp.com/vault/${VAULT_VERSION}/vault_${VAULT_VERSION}_linux_amd64.zip
|
||||
unzip -q vault_${VAULT_VERSION}_linux_amd64.zip
|
||||
sudo mv vault /usr/local/bin/
|
||||
rm vault_${VAULT_VERSION}_linux_amd64.zip
|
||||
fi
|
||||
|
||||
export PATH=$PATH:/usr/local/bin
|
||||
|
||||
set -e
|
||||
|
||||
echo "===== 开始部署Vault集群 ====="
|
||||
|
||||
# 目录定义
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
ROOT_DIR="$(dirname "$SCRIPT_DIR")"
|
||||
ANSIBLE_DIR="$ROOT_DIR/playbooks"
|
||||
JOBS_DIR="$ROOT_DIR/components/vault/jobs"
|
||||
|
||||
# 颜色定义
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
RED='\033[0;31m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
# 函数定义
|
||||
log_info() {
|
||||
echo -e "${GREEN}[INFO]${NC} $1"
|
||||
}
|
||||
|
||||
log_warn() {
|
||||
echo -e "${YELLOW}[WARN]${NC} $1"
|
||||
}
|
||||
|
||||
log_error() {
|
||||
echo -e "${RED}[ERROR]${NC} $1"
|
||||
}
|
||||
|
||||
# 检查命令是否存在
|
||||
check_command() {
|
||||
if ! command -v $1 &> /dev/null; then
|
||||
log_error "$1 命令未找到，请先安装"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# 检查必要的命令
|
||||
check_command ansible-playbook
|
||||
check_command nomad
|
||||
check_command vault
|
||||
|
||||
# 步骤1: 使用Ansible安装Vault
|
||||
log_info "步骤1: 使用Ansible安装Vault..."
|
||||
ansible-playbook -i "$ANSIBLE_DIR/inventories/production/vault.ini" "$ANSIBLE_DIR/playbooks/install/install_vault.yml"
|
||||
|
||||
# 步骤2: 部署Vault Nomad作业
|
||||
log_info "步骤2: 部署Vault Nomad作业..."
|
||||
nomad job run "$JOBS_DIR/vault-cluster-exec.nomad"
|
||||
|
||||
# 等待Nomad作业部署完成
|
||||
log_info "等待Nomad作业部署完成..."
|
||||
sleep 10
|
||||
|
||||
# 检查Nomad作业状态
|
||||
nomad_status=$(nomad job status vault-cluster-exec | grep Status | head -1 | awk '{print $2}')
|
||||
if [ "$nomad_status" != "running" ]; then
|
||||
log_warn "Vault Nomad作业状态不是'running'，当前状态: $nomad_status"
|
||||
log_info "请检查Nomad作业状态: nomad job status vault-cluster-exec"
|
||||
fi
|
||||
|
||||
# 步骤3: 检查Vault状态并初始化（如果需要）
|
||||
log_info "步骤3: 检查Vault状态..."
|
||||
export VAULT_ADDR='http://127.0.0.1:8200'
|
||||
|
||||
# 等待Vault启动
|
||||
log_info "等待Vault启动..."
|
||||
for i in {1..30}; do
|
||||
if curl -s "$VAULT_ADDR/v1/sys/health" > /dev/null; then
|
||||
break
|
||||
fi
|
||||
echo -n "."
|
||||
sleep 2
|
||||
done
|
||||
echo ""
|
||||
|
||||
# 检查Vault是否已初始化
|
||||
init_status=$(curl -s "$VAULT_ADDR/v1/sys/health" | grep -o '"initialized":[^,}]*' | cut -d ':' -f2)
|
||||
if [ "$init_status" = "false" ]; then
|
||||
log_info "Vault未初始化，正在初始化..."
|
||||
|
||||
# 初始化Vault并保存密钥
|
||||
mkdir -p "$ROOT_DIR/security/secrets/vault"
|
||||
vault operator init -key-shares=5 -key-threshold=3 -format=json > "$ROOT_DIR/security/secrets/vault/init_keys.json"
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
log_info "Vault初始化成功，解封密钥和根令牌已保存到 $ROOT_DIR/security/secrets/vault/init_keys.json"
|
||||
log_warn "请确保安全保存这些密钥！"
|
||||
|
||||
# 提取解封密钥
|
||||
unseal_key1=$(cat "$ROOT_DIR/security/secrets/vault/init_keys.json" | grep -o '"unseal_keys_b64":\[\([^]]*\)' | sed 's/"unseal_keys_b64":\[//g' | tr ',' '\n' | sed 's/"//g' | head -1)
|
||||
unseal_key2=$(cat "$ROOT_DIR/security/secrets/vault/init_keys.json" | grep -o '"unseal_keys_b64":\[\([^]]*\)' | sed 's/"unseal_keys_b64":\[//g' | tr ',' '\n' | sed 's/"//g' | head -2 | tail -1)
|
||||
unseal_key3=$(cat "$ROOT_DIR/security/secrets/vault/init_keys.json" | grep -o '"unseal_keys_b64":\[\([^]]*\)' | sed 's/"unseal_keys_b64":\[//g' | tr ',' '\n' | sed 's/"//g' | head -3 | tail -1)
|
||||
|
||||
# 解封Vault
|
||||
log_info "正在解封Vault..."
|
||||
vault operator unseal "$unseal_key1"
|
||||
vault operator unseal "$unseal_key2"
|
||||
vault operator unseal "$unseal_key3"
|
||||
|
||||
log_info "Vault已成功解封"
|
||||
else
|
||||
log_error "Vault初始化失败"
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
log_info "Vault已初始化"
|
||||
|
||||
# 检查Vault是否已解封
|
||||
sealed_status=$(curl -s "$VAULT_ADDR/v1/sys/health" | grep -o '"sealed":[^,}]*' | cut -d ':' -f2)
|
||||
if [ "$sealed_status" = "true" ]; then
|
||||
log_warn "Vault已初始化但仍处于密封状态，请手动解封"
|
||||
log_info "使用以下命令解封Vault:"
|
||||
log_info "export VAULT_ADDR='http://127.0.0.1:8200'"
|
||||
log_info "vault operator unseal <解封密钥1>"
|
||||
log_info "vault operator unseal <解封密钥2>"
|
||||
log_info "vault operator unseal <解封密钥3>"
|
||||
else
|
||||
log_info "Vault已初始化且已解封，可以正常使用"
|
||||
fi
|
||||
fi
|
||||
|
||||
# 显示Vault状态
|
||||
log_info "Vault状态:"
|
||||
vault status
|
||||
|
||||
log_info "===== Vault集群部署完成 ====="
|
||||
log_info "请在其他节点上运行解封操作，确保集群完全可用"
|
||||
@@ -1,122 +0,0 @@
|
||||
#!/bin/bash
|
||||
# Vault集群初始化和解封脚本
|
||||
|
||||
set -e
|
||||
|
||||
echo "===== Vault集群初始化 ====="
|
||||
|
||||
# 颜色定义
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
RED='\033[0;31m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
# 函数定义
|
||||
log_info() {
|
||||
echo -e "${GREEN}[INFO]${NC} $1"
|
||||
}
|
||||
|
||||
log_warn() {
|
||||
echo -e "${YELLOW}[WARN]${NC} $1"
|
||||
}
|
||||
|
||||
log_error() {
|
||||
echo -e "${RED}[ERROR]${NC} $1"
|
||||
}
|
||||
|
||||
# 检查Vault命令是否存在
|
||||
if ! command -v vault &> /dev/null; then
|
||||
log_error "Vault命令未找到，请先安装Vault"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# 设置Vault地址为master节点
|
||||
export VAULT_ADDR='http://100.117.106.136:8200'
|
||||
|
||||
# 等待Vault启动
|
||||
log_info "等待Vault启动..."
|
||||
for i in {1..30}; do
|
||||
if curl -s "$VAULT_ADDR/v1/sys/health" > /dev/null; then
|
||||
break
|
||||
fi
|
||||
echo -n "."
|
||||
sleep 2
|
||||
done
|
||||
echo ""
|
||||
|
||||
# 检查Vault是否已初始化
|
||||
init_status=$(curl -s "$VAULT_ADDR/v1/sys/health" | grep -o '"initialized":[^,}]*' | cut -d ':' -f2)
|
||||
if [ "$init_status" = "false" ]; then
|
||||
log_info "Vault未初始化，正在初始化..."
|
||||
|
||||
# 初始化Vault并保存密钥到安全目录
|
||||
vault operator init -key-shares=5 -key-threshold=3 -format=json > /root/mgmt/security/secrets/vault/init_keys.json
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
log_info "Vault初始化成功"
|
||||
log_warn "重要：请立即将以下文件安全备份并分发给不同管理员"
|
||||
log_warn "密钥文件位置: /root/mgmt/security/secrets/vault/init_keys.json"
|
||||
|
||||
# 显示关键信息但不显示完整密钥
|
||||
unseal_keys_count=$(cat /root/mgmt/security/secrets/vault/init_keys.json | grep -o '"unseal_keys_b64":\[\([^]]*\)' | sed 's/"unseal_keys_b64":\[//g' | tr ',' '\n' | wc -l)
|
||||
root_token=$(cat /root/mgmt/security/secrets/vault/init_keys.json | grep -o '"root_token":"[^"]*"' | cut -d '"' -f4)
|
||||
|
||||
log_info "生成了 $unseal_keys_count 个解封密钥，需要其中任意 3 个来解封Vault"
|
||||
log_info "根令牌已生成（请安全保管）"
|
||||
|
||||
# 提取解封密钥用于自动解封
|
||||
unseal_key1=$(cat /root/mgmt/security/secrets/vault/init_keys.json | grep -o '"unseal_keys_b64":\[\([^]]*\)' | sed 's/"unseal_keys_b64":\[//g' | tr ',' '\n' | sed 's/"//g' | head -1)
|
||||
unseal_key2=$(cat /root/mgmt/security/secrets/vault/init_keys.json | grep -o '"unseal_keys_b64":\[\([^]]*\)' | sed 's/"unseal_keys_b64":\[//g' | tr ',' '\n' | sed 's/"//g' | head -2 | tail -1)
|
||||
unseal_key3=$(cat /root/mgmt/security/secrets/vault/init_keys.json | grep -o '"unseal_keys_b64":\[\([^]]*\)' | sed 's/"unseal_keys_b64":\[//g' | tr ',' '\n' | sed 's/"//g' | head -3 | tail -1)
|
||||
|
||||
# 解封所有节点
|
||||
log_info "正在解封所有Vault节点..."
|
||||
|
||||
# 解封master节点
|
||||
export VAULT_ADDR='http://100.117.106.136:8200'
|
||||
vault operator unseal "$unseal_key1"
|
||||
vault operator unseal "$unseal_key2"
|
||||
vault operator unseal "$unseal_key3"
|
||||
|
||||
# 解封ash3c节点
|
||||
export VAULT_ADDR='http://100.116.80.94:8200'
|
||||
vault operator unseal "$unseal_key1"
|
||||
vault operator unseal "$unseal_key2"
|
||||
vault operator unseal "$unseal_key3"
|
||||
|
||||
# 解封warden节点
|
||||
export VAULT_ADDR='http://100.122.197.112:8200'
|
||||
vault operator unseal "$unseal_key1"
|
||||
vault operator unseal "$unseal_key2"
|
||||
vault operator unseal "$unseal_key3"
|
||||
|
||||
log_info "所有Vault节点已成功解封"
|
||||
log_warn "请确保将密钥文件安全备份到多个位置，并按照安全策略分发给不同管理员"
|
||||
log_info "根令牌: $root_token"
|
||||
|
||||
# 显示Vault状态
|
||||
log_info "Vault集群状态:"
|
||||
export VAULT_ADDR='http://100.117.106.136:8200'
|
||||
vault status
|
||||
else
|
||||
log_error "Vault初始化失败"
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
log_info "Vault已初始化"
|
||||
|
||||
# 检查Vault是否已解封
|
||||
sealed_status=$(curl -s "$VAULT_ADDR/v1/sys/health" | grep -o '"sealed":[^,}]*' | cut -d ':' -f2)
|
||||
if [ "$sealed_status" = "true" ]; then
|
||||
log_warn "Vault已初始化但仍处于密封状态，请手动解封"
|
||||
log_info "使用以下命令解封Vault:"
|
||||
log_info "export VAULT_ADDR='http://<节点IP>:8200'"
|
||||
log_info "vault operator unseal <解封密钥1>"
|
||||
log_info "vault operator unseal <解封密钥2>"
|
||||
log_info "vault operator unseal <解封密钥3>"
|
||||
else
|
||||
log_info "Vault已初始化且已解封，可以正常使用"
|
||||
fi
|
||||
fi
|
||||
|
||||
log_info "===== Vault集群初始化和解封完成 ====="
|
||||
@@ -1,122 +0,0 @@
|
||||
#!/bin/bash
|
||||
# Vault开发环境初始化脚本
|
||||
|
||||
set -e
|
||||
|
||||
echo "===== Vault开发环境初始化 ====="
|
||||
|
||||
# 颜色定义
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
RED='\033[0;31m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
# 函数定义
|
||||
log_info() {
|
||||
echo -e "${GREEN}[INFO]${NC} $1"
|
||||
}
|
||||
|
||||
log_warn() {
|
||||
echo -e "${YELLOW}[WARN]${NC} $1"
|
||||
}
|
||||
|
||||
log_error() {
|
||||
echo -e "${RED}[ERROR]${NC} $1"
|
||||
}
|
||||
|
||||
# 检查Vault命令是否存在
|
||||
if ! command -v vault &> /dev/null; then
|
||||
log_error "Vault命令未找到，请先安装Vault"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# 设置Vault地址为master节点
|
||||
export VAULT_ADDR='http://100.117.106.136:8200'
|
||||
|
||||
# 等待Vault启动
|
||||
log_info "等待Vault启动..."
|
||||
for i in {1..30}; do
|
||||
if curl -s "$VAULT_ADDR/v1/sys/health" > /dev/null; then
|
||||
break
|
||||
fi
|
||||
echo -n "."
|
||||
sleep 2
|
||||
done
|
||||
echo ""
|
||||
|
||||
# 检查Vault是否已初始化
|
||||
init_status=$(curl -s "$VAULT_ADDR/v1/sys/health" | grep -o '"initialized":[^,}]*' | cut -d ':' -f2)
|
||||
if [ "$init_status" = "false" ]; then
|
||||
log_info "Vault未初始化，正在初始化..."
|
||||
|
||||
# 初始化Vault并保存密钥到开发目录
|
||||
vault operator init -key-shares=1 -key-threshold=1 -format=json > /root/mgmt/security/secrets/vault/dev/init_keys.json
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
log_info "Vault初始化成功（开发模式）"
|
||||
log_warn "注意：这是开发模式，仅使用1个解封密钥"
|
||||
log_warn "生产环境请使用5个密钥中的3个阈值"
|
||||
|
||||
# 显示密钥信息
|
||||
unseal_key=$(cat /root/mgmt/security/secrets/vault/dev/init_keys.json | grep -o '"unseal_keys_b64":\["[^"]*"' | cut -d '"' -f4)
|
||||
root_token=$(cat /root/mgmt/security/secrets/vault/dev/init_keys.json | grep -o '"root_token":"[^"]*"' | cut -d '"' -f4)
|
||||
|
||||
log_info "解封密钥: $unseal_key"
|
||||
log_info "根令牌: $root_token"
|
||||
|
||||
# 自动解封所有节点
|
||||
log_info "正在自动解封所有Vault节点..."
|
||||
|
||||
# 解封master节点
|
||||
export VAULT_ADDR='http://100.117.106.136:8200'
|
||||
vault operator unseal "$unseal_key"
|
||||
|
||||
# 解封ash3c节点
|
||||
export VAULT_ADDR='http://100.116.80.94:8200'
|
||||
vault operator unseal "$unseal_key"
|
||||
|
||||
# 解封warden节点
|
||||
export VAULT_ADDR='http://100.122.197.112:8200'
|
||||
vault operator unseal "$unseal_key"
|
||||
|
||||
log_info "所有Vault节点已成功解封"
|
||||
|
||||
# 显示Vault状态
|
||||
log_info "Vault集群状态:"
|
||||
export VAULT_ADDR='http://100.117.106.136:8200'
|
||||
vault status
|
||||
|
||||
# 保存环境变量以便后续使用
|
||||
echo "export VAULT_ADDR='http://100.117.106.136:8200'" > /root/mgmt/security/secrets/vault/dev/vault_env.sh
|
||||
echo "export VAULT_TOKEN='$root_token'" >> /root/mgmt/security/secrets/vault/dev/vault_env.sh
|
||||
log_info "环境变量已保存到: /root/mgmt/security/secrets/vault/dev/vault_env.sh"
|
||||
|
||||
log_warn "开发环境提示："
|
||||
log_warn "1. 请勿在生产环境中使用此配置"
|
||||
log_warn "2. 生产环境应使用5个密钥中的3个阈值"
|
||||
log_warn "3. 密钥应分发给不同管理员保管"
|
||||
else
|
||||
log_error "Vault初始化失败"
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
log_info "Vault已初始化"
|
||||
|
||||
# 检查Vault是否已解封
|
||||
sealed_status=$(curl -s "$VAULT_ADDR/v1/sys/health" | grep -o '"sealed":[^,}]*' | cut -d ':' -f2)
|
||||
if [ "$sealed_status" = "true" ]; then
|
||||
log_warn "Vault已初始化但仍处于密封状态"
|
||||
log_info "请使用以下命令解封:"
|
||||
log_info "export VAULT_ADDR='http://<节点IP>:8200'"
|
||||
log_info "vault operator unseal <解封密钥>"
|
||||
else
|
||||
log_info "Vault已初始化且已解封，可以正常使用"
|
||||
|
||||
# 显示Vault状态
|
||||
log_info "Vault集群状态:"
|
||||
export VAULT_ADDR='http://100.117.106.136:8200'
|
||||
vault status
|
||||
fi
|
||||
fi
|
||||
|
||||
log_info "===== Vault开发环境初始化完成 ====="
|
||||
@@ -1,193 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Nomad 集群领导者发现与访问脚本
|
||||
# 此脚本自动发现当前 Nomad 集群领导者并执行相应命令
|
||||
|
||||
# 默认服务器列表（可根据实际情况修改）
|
||||
SERVERS=(
|
||||
"100.116.158.95" # bj-semaphore.global
|
||||
"100.81.26.3" # ash1d.global
|
||||
"100.103.147.94" # ash2e.global
|
||||
"100.90.159.68" # ch2.global
|
||||
"100.86.141.112" # ch3.global
|
||||
"100.98.209.50" # bj-onecloud1.global
|
||||
"100.120.225.29" # de.global
|
||||
)
|
||||
|
||||
# 超时设置（秒）
|
||||
TIMEOUT=5
|
||||
|
||||
# 颜色输出
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
# 打印帮助信息
|
||||
function show_help() {
|
||||
echo "Nomad 集群领导者发现与访问脚本"
|
||||
echo ""
|
||||
echo "用法: $0 [选项] [nomad命令]"
|
||||
echo ""
|
||||
echo "选项:"
|
||||
echo " -h, --help 显示此帮助信息"
|
||||
echo " -s, --server IP 指定初始服务器IP"
|
||||
echo " -t, --timeout SECS 设置超时时间（默认: $TIMEOUT 秒）"
|
||||
echo " -l, --list-servers 列出所有配置的服务器"
|
||||
echo " -c, --check-leader 仅检查领导者，不执行命令"
|
||||
echo ""
|
||||
echo "示例:"
|
||||
echo " $0 node status # 使用自动发现的领导者查看节点状态"
|
||||
echo " $0 -s 100.116.158.95 job status # 指定初始服务器查看作业状态"
|
||||
echo " $0 -c # 仅检查当前领导者"
|
||||
echo ""
|
||||
}
|
||||
|
||||
# 列出所有配置的服务器
|
||||
function list_servers() {
|
||||
echo -e "${YELLOW}配置的服务器列表:${NC}"
|
||||
for server in "${SERVERS[@]}"; do
|
||||
echo " - $server"
|
||||
done
|
||||
}
|
||||
|
||||
# 发现领导者
|
||||
function discover_leader() {
|
||||
local initial_server=$1
|
||||
|
||||
# 如果指定了初始服务器，先尝试使用它
|
||||
if [ -n "$initial_server" ]; then
|
||||
echo -e "${YELLOW}尝试从服务器 $initial_server 发现领导者...${NC}" >&2
|
||||
leader=$(curl -s --max-time $TIMEOUT "http://${initial_server}:4646/v1/status/leader" 2>/dev/null | sed 's/"//g')
|
||||
if [ -n "$leader" ] && [ "$leader" != "" ]; then
|
||||
# 将RPC端口(4647)替换为HTTP端口(4646)
|
||||
leader=$(echo "$leader" | sed 's/:4647$/:4646/')
|
||||
echo -e "${GREEN}发现领导者: $leader${NC}" >&2
|
||||
echo "$leader"
|
||||
return 0
|
||||
fi
|
||||
echo -e "${RED}无法从 $initial_server 获取领导者信息${NC}" >&2
|
||||
fi
|
||||
|
||||
# 遍历所有服务器尝试发现领导者
|
||||
echo -e "${YELLOW}遍历所有服务器寻找领导者...${NC}" >&2
|
||||
for server in "${SERVERS[@]}"; do
|
||||
echo -n " 检查 $server ... " >&2
|
||||
leader=$(curl -s --max-time $TIMEOUT "http://${server}:4646/v1/status/leader" 2>/dev/null | sed 's/"//g')
|
||||
if [ -n "$leader" ] && [ "$leader" != "" ]; then
|
||||
# 将RPC端口(4647)替换为HTTP端口(4646)
|
||||
leader=$(echo "$leader" | sed 's/:4647$/:4646/')
|
||||
echo -e "${GREEN}成功${NC}" >&2
|
||||
echo -e "${GREEN}发现领导者: $leader${NC}" >&2
|
||||
echo "$leader"
|
||||
return 0
|
||||
else
|
||||
echo -e "${RED}失败${NC}" >&2
|
||||
fi
|
||||
done
|
||||
|
||||
echo -e "${RED}无法发现领导者，请检查集群状态${NC}" >&2
|
||||
return 1
|
||||
}
|
||||
|
||||
# 解析命令行参数
|
||||
INITIAL_SERVER=""
|
||||
CHECK_LEADER_ONLY=false
|
||||
NOMAD_COMMAND=()
|
||||
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case $1 in
|
||||
-h|--help)
|
||||
show_help
|
||||
exit 0
|
||||
;;
|
||||
-s|--server)
|
||||
INITIAL_SERVER="$2"
|
||||
shift 2
|
||||
;;
|
||||
-t|--timeout)
|
||||
TIMEOUT="$2"
|
||||
shift 2
|
||||
;;
|
||||
-l|--list-servers)
|
||||
list_servers
|
||||
exit 0
|
||||
;;
|
||||
-c|--check-leader)
|
||||
CHECK_LEADER_ONLY=true
|
||||
shift
|
||||
;;
|
||||
*)
|
||||
NOMAD_COMMAND+=("$1")
|
||||
shift
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
# 主逻辑
|
||||
echo -e "${YELLOW}Nomad 集群领导者发现与访问脚本${NC}" >&2
|
||||
echo "==================================" >&2
|
||||
|
||||
# 发现领导者
|
||||
LEADER=$(discover_leader "$INITIAL_SERVER")
|
||||
if [ $? -ne 0 ]; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# 提取领导者IP和端口
|
||||
LEADER_IP=$(echo "$LEADER" | cut -d':' -f1)
|
||||
LEADER_PORT=$(echo "$LEADER" | cut -d':' -f2)
|
||||
|
||||
# 如果仅检查领导者，则退出
|
||||
if [ "$CHECK_LEADER_ONLY" = true ]; then
|
||||
echo -e "${GREEN}当前领导者: $LEADER${NC}" >&2
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# 如果没有指定命令，显示交互式菜单
|
||||
if [ ${#NOMAD_COMMAND[@]} -eq 0 ]; then
|
||||
echo -e "${YELLOW}未指定命令，请选择要执行的操作:${NC}" >&2
|
||||
echo "1) 查看节点状态" >&2
|
||||
echo "2) 查看作业状态" >&2
|
||||
echo "3) 查看服务器成员" >&2
|
||||
echo "4) 查看集群状态" >&2
|
||||
echo "5) 自定义命令" >&2
|
||||
echo "0) 退出" >&2
|
||||
|
||||
read -p "请输入选项 (0-5): " choice
|
||||
|
||||
case $choice in
|
||||
1) NOMAD_COMMAND=("node" "status") ;;
|
||||
2) NOMAD_COMMAND=("job" "status") ;;
|
||||
3) NOMAD_COMMAND=("server" "members") ;;
|
||||
4) NOMAD_COMMAND=("operator" "raft" "list-peers") ;;
|
||||
5)
|
||||
read -p "请输入完整的 Nomad 命令: " -a NOMAD_COMMAND
|
||||
;;
|
||||
0) exit 0 ;;
|
||||
*)
|
||||
echo -e "${RED}无效选项${NC}" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
|
||||
# 执行命令
|
||||
echo -e "${YELLOW}执行命令: nomad ${NOMAD_COMMAND[*]} -address=http://${LEADER}${NC}" >&2
|
||||
nomad "${NOMAD_COMMAND[@]}" -address="http://${LEADER}"
|
||||
|
||||
# 检查命令执行结果
|
||||
if [ $? -eq 0 ]; then
|
||||
echo -e "${GREEN}命令执行成功${NC}" >&2
|
||||
else
|
||||
echo -e "${RED}命令执行失败，可能需要重新发现领导者${NC}" >&2
|
||||
echo -e "${YELLOW}尝试重新发现领导者...${NC}" >&2
|
||||
NEW_LEADER=$(discover_leader)
|
||||
if [ $? -eq 0 ] && [ "$NEW_LEADER" != "$LEADER" ]; then
|
||||
echo -e "${YELLOW}领导者已更改，重新执行命令...${NC}" >&2
|
||||
nomad "${NOMAD_COMMAND[@]}" -address="http://${NEW_LEADER}"
|
||||
else
|
||||
echo -e "${RED}无法恢复，请检查集群状态${NC}" >&2
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
@@ -1,261 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Consul 变量和存储配置脚本
|
||||
# 用于增强Consul集群功能
|
||||
|
||||
set -e
|
||||
|
||||
# 颜色输出
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
# 日志函数
|
||||
log_info() {
|
||||
echo -e "${GREEN}[INFO]${NC} $1"
|
||||
}
|
||||
|
||||
log_warn() {
|
||||
echo -e "${YELLOW}[WARN]${NC} $1"
|
||||
}
|
||||
|
||||
log_error() {
|
||||
echo -e "${RED}[ERROR]${NC} $1"
|
||||
}
|
||||
|
||||
# 默认Consul地址
|
||||
CONSUL_ADDR=${CONSUL_ADDR:-"http://localhost:8500"}
|
||||
|
||||
# 检查Consul连接
|
||||
check_consul() {
|
||||
log_info "检查Consul连接..."
|
||||
if curl -s "${CONSUL_ADDR}/v1/status/leader" > /dev/null; then
|
||||
log_info "Consul连接正常"
|
||||
return 0
|
||||
else
|
||||
log_error "无法连接到Consul: ${CONSUL_ADDR}"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# 配置Consul变量
|
||||
setup_variables() {
|
||||
log_info "配置Consul变量..."
|
||||
|
||||
# 环境变量
|
||||
ENVIRONMENT=${ENVIRONMENT:-"dev"}
|
||||
|
||||
# 创建基础配置结构
|
||||
log_info "创建基础配置结构..."
|
||||
|
||||
# 应用配置
|
||||
curl -s -X PUT "${CONSUL_ADDR}/v1/kv/config/${ENVIRONMENT}/app/name" -d "my-application" > /dev/null
|
||||
curl -s -X PUT "${CONSUL_ADDR}/v1/kv/config/${ENVIRONMENT}/app/version" -d "1.0.0" > /dev/null
|
||||
curl -s -X PUT "${CONSUL_ADDR}/v1/kv/config/${ENVIRONMENT}/app/environment" -d "${ENVIRONMENT}" > /dev/null
|
||||
|
||||
# 数据库配置
|
||||
curl -s -X PUT "${CONSUL_ADDR}/v1/kv/config/${ENVIRONMENT}/database/host" -d "db.example.com" > /dev/null
|
||||
curl -s -X PUT "${CONSUL_ADDR}/v1/kv/config/${ENVIRONMENT}/database/port" -d "5432" > /dev/null
|
||||
curl -s -X PUT "${CONSUL_ADDR}/v1/kv/config/${ENVIRONMENT}/database/name" -d "myapp_db" > /dev/null
|
||||
|
||||
# 缓存配置
|
||||
curl -s -X PUT "${CONSUL_ADDR}/v1/kv/config/${ENVIRONMENT}/cache/host" -d "redis.example.com" > /dev/null
|
||||
curl -s -X PUT "${CONSUL_ADDR}/v1/kv/config/${ENVIRONMENT}/cache/port" -d "6379" > /dev/null
|
||||
|
||||
# 消息队列配置
|
||||
curl -s -X PUT "${CONSUL_ADDR}/v1/kv/config/${ENVIRONMENT}/mq/host" -d "mq.example.com" > /dev/null
|
||||
curl -s -X PUT "${CONSUL_ADDR}/v1/kv/config/${ENVIRONMENT}/mq/port" -d "5672" > /dev/null
|
||||
|
||||
# 特性开关
|
||||
curl -s -X PUT "${CONSUL_ADDR}/v1/kv/config/${ENVIRONMENT}/features/new_ui" -d "true" > /dev/null
|
||||
curl -s -X PUT "${CONSUL_ADDR}/v1/kv/config/${ENVIRONMENT}/features/advanced_analytics" -d "false" > /dev/null
|
||||
|
||||
log_info "Consul变量配置完成"
|
||||
}
|
||||
|
||||
# 配置Consul存储
|
||||
setup_storage() {
|
||||
log_info "配置Consul存储..."
|
||||
|
||||
# 创建存储配置
|
||||
# 注意：这些配置需要在Consul配置文件中启用相应的存储后端
|
||||
|
||||
# 持久化存储配置
|
||||
curl -s -X PUT "${CONSUL_ADDR}/v1/kv/storage/consul/data_dir" -d "/opt/consul/data" > /dev/null
|
||||
curl -s -X PUT "${CONSUL_ADDR}/v1/kv/storage/consul/raft_dir" -d "/opt/consul/raft" > /dev/null
|
||||
|
||||
# 快照配置
|
||||
curl -s -X PUT "${CONSUL_ADDR}/v1/kv/storage/consul/snapshot_enabled" -d "true" > /dev/null
|
||||
curl -s -X PUT "${CONSUL_ADDR}/v1/kv/storage/consul/snapshot_interval" -d "24h" > /dev/null
|
||||
curl -s -X PUT "${CONSUL_ADDR}/v1/kv/storage/consul/snapshot_retention" -d "30" > /dev/null
|
||||
|
||||
# 备份配置
|
||||
curl -s -X PUT "${CONSUL_ADDR}/v1/kv/storage/consul/backup_enabled" -d "true" > /dev/null
|
||||
curl -s -X PUT "${CONSUL_ADDR}/v1/kv/storage/consul/backup_interval" -d "6h" > /dev/null
|
||||
curl -s -X PUT "${CONSUL_ADDR}/v1/kv/storage/consul/backup_retention" -d "7" > /dev/null
|
||||
|
||||
# 自动清理配置
|
||||
curl -s -X PUT "${CONSUL_ADDR}/v1/kv/storage/consul/autopilot/cleanup_dead_servers" -d "true" > /dev/null
|
||||
curl -s -X PUT "${CONSUL_ADDR}/v1/kv/storage/consul/autopilot/last_contact_threshold" -d "200ms" > /dev/null
|
||||
curl -s -X PUT "${CONSUL_ADDR}/v1/kv/storage/consul/autopilot/max_trailing_logs" -d "250" > /dev/null
|
||||
curl -s -X PUT "${CONSUL_ADDR}/v1/kv/storage/consul/autopilot/server_stabilization_time" -d "10s" > /dev/null
|
||||
curl -s -X PUT "${CONSUL_ADDR}/v1/kv/storage/consul/autopilot/redundancy_zone_tag" -d "" > /dev/null
|
||||
curl -s -X PUT "${CONSUL_ADDR}/v1/kv/storage/consul/autopilot/disable_upgrade_migration" -d "false" > /dev/null
|
||||
curl -s -X PUT "${CONSUL_ADDR}/v1/kv/storage/consul/autopilot/upgrade_version_tag" -d "" > /dev/null
|
||||
|
||||
log_info "Consul存储配置完成"
|
||||
}
|
||||
|
||||
# 创建Consul配置文件
|
||||
create_consul_config() {
|
||||
log_info "创建Consul配置文件..."
|
||||
|
||||
# 创建配置目录
|
||||
mkdir -p /root/mgmt/components/consul/configs
|
||||
|
||||
# 创建基础配置文件
|
||||
cat > /root/mgmt/components/consul/configs/consul.hcl << EOF
|
||||
# Consul 基础配置
|
||||
data_dir = "/opt/consul/data"
|
||||
raft_dir = "/opt/consul/raft"
|
||||
|
||||
# 启用UI
|
||||
ui_config {
|
||||
enabled = true
|
||||
}
|
||||
|
||||
# 数据中心配置
|
||||
datacenter = "dc1"
|
||||
|
||||
# 服务器配置
|
||||
server = true
|
||||
bootstrap_expect = 3
|
||||
|
||||
# 客户端地址
|
||||
client_addr = "0.0.0.0"
|
||||
|
||||
# 绑定地址
|
||||
bind_addr = "{{ GetInterfaceIP `eth0` }}"
|
||||
|
||||
# 广告地址
|
||||
advertise_addr = "{{ GetInterfaceIP `eth0` }}"
|
||||
|
||||
# 端口配置
|
||||
ports {
|
||||
dns = 8600
|
||||
http = 8500
|
||||
https = -1
|
||||
grpc = 8502
|
||||
grpc_tls = 8503
|
||||
serf_lan = 8301
|
||||
serf_wan = 8302
|
||||
server = 8300
|
||||
}
|
||||
|
||||
# 连接其他节点
|
||||
retry_join = ["100.117.106.136", "100.116.80.94", "100.122.197.112"]
|
||||
|
||||
# 启用服务发现
|
||||
enable_service_script = true
|
||||
|
||||
# 启用脚本检查
|
||||
enable_script_checks = true
|
||||
|
||||
# 启用本地脚本检查
|
||||
enable_local_script_checks = true
|
||||
|
||||
# 性能调优
|
||||
performance {
|
||||
raft_multiplier = 1
|
||||
}
|
||||
|
||||
# 日志配置
|
||||
log_level = "INFO"
|
||||
enable_syslog = false
|
||||
log_file = "/var/log/consul/consul.log"
|
||||
|
||||
# 自动加密
|
||||
encrypt = "YourEncryptionKeyHere"
|
||||
|
||||
# 重用端口
|
||||
reconnect_timeout = "30s"
|
||||
reconnect_timeout_wan = "30s"
|
||||
|
||||
# 会话TTL
|
||||
session_ttl_min = "10s"
|
||||
|
||||
# 自动清理
|
||||
autopilot {
|
||||
cleanup_dead_servers = true
|
||||
last_contact_threshold = "200ms"
|
||||
max_trailing_logs = 250
|
||||
server_stabilization_time = "10s"
|
||||
redundancy_zone_tag = ""
|
||||
disable_upgrade_migration = false
|
||||
upgrade_version_tag = ""
|
||||
}
|
||||
|
||||
# 快照配置
|
||||
snapshot {
|
||||
enabled = true
|
||||
interval = "24h"
|
||||
retain = 30
|
||||
name = "consul-snapshot-{{.Timestamp}}"
|
||||
}
|
||||
|
||||
# 备份配置
|
||||
backup {
|
||||
enabled = true
|
||||
interval = "6h"
|
||||
retain = 7
|
||||
name = "consul-backup-{{.Timestamp}}"
|
||||
}
|
||||
EOF
|
||||
|
||||
log_info "Consul配置文件创建完成: /root/mgmt/components/consul/configs/consul.hcl"
|
||||
}
|
||||
|
||||
# 显示配置
|
||||
show_config() {
|
||||
log_info "显示Consul变量配置..."
|
||||
echo "=========================================="
|
||||
curl -s "${CONSUL_ADDR}/v1/kv/config/${ENVIRONMENT:-dev}/?recurse" | jq -r '.[] | "\(.Key): \(.Value | @base64d)"'
|
||||
echo "=========================================="
|
||||
|
||||
log_info "显示Consul存储配置..."
|
||||
echo "=========================================="
|
||||
curl -s "${CONSUL_ADDR}/v1/kv/storage/?recurse" | jq -r '.[] | "\(.Key): \(.Value | @base64d)"'
|
||||
echo "=========================================="
|
||||
}
|
||||
|
||||
# 主函数
|
||||
main() {
|
||||
log_info "开始配置Consul变量和存储..."
|
||||
|
||||
# 检查Consul连接
|
||||
check_consul
|
||||
|
||||
# 配置变量
|
||||
setup_variables
|
||||
|
||||
# 配置存储
|
||||
setup_storage
|
||||
|
||||
# 创建配置文件
|
||||
create_consul_config
|
||||
|
||||
# 显示配置
|
||||
show_config
|
||||
|
||||
log_info "Consul变量和存储配置完成"
|
||||
|
||||
# 提示下一步
|
||||
log_info "下一步操作:"
|
||||
log_info "1. 重启Consul服务以应用新配置"
|
||||
log_info "2. 验证配置是否生效"
|
||||
log_info "3. 根据需要调整配置参数"
|
||||
}
|
||||
|
||||
# 执行主函数
|
||||
main "$@"
|
||||
@@ -1,32 +0,0 @@
|
||||
#!/bin/bash
|
||||
# 显示开发环境Vault密钥信息
|
||||
|
||||
echo "===== Vault开发环境密钥信息 ====="
|
||||
|
||||
# 检查密钥文件是否存在
|
||||
if [ ! -f "/root/mgmt/security/secrets/vault/dev/init_keys.json" ]; then
|
||||
echo "错误：Vault密钥文件不存在"
|
||||
echo "请先运行初始化脚本：/root/mgmt/deployment/scripts/init_vault_dev.sh"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# 显示密钥信息
|
||||
echo "Vault开发环境密钥信息："
|
||||
echo "----------------------------------------"
|
||||
|
||||
# 提取并显示解封密钥
|
||||
unseal_key=$(cat /root/mgmt/security/secrets/vault/dev/init_keys.json | grep -o '"unseal_keys_b64":\["[^"]*"' | cut -d '"' -f4)
|
||||
echo "解封密钥: $unseal_key"
|
||||
|
||||
# 提取并显示根令牌
|
||||
root_token=$(cat /root/mgmt/security/secrets/vault/dev/init_keys.json | grep -o '"root_token":"[^"]*"' | cut -d '"' -f4)
|
||||
echo "根令牌: $root_token"
|
||||
|
||||
echo "----------------------------------------"
|
||||
echo "环境变量设置命令："
|
||||
echo "export VAULT_ADDR='http://100.117.106.136:8200'"
|
||||
echo "export VAULT_TOKEN='$root_token'"
|
||||
|
||||
echo ""
|
||||
echo "注意：这是开发环境配置，仅用于测试目的"
|
||||
echo "生产环境请遵循安全策略文档中的建议"
|
||||
@@ -1,275 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Traefik部署测试脚本
|
||||
# 用于测试Traefik在Nomad集群中的部署和功能
|
||||
|
||||
set -e
|
||||
|
||||
# 颜色定义
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
# 日志函数
|
||||
log_info() {
|
||||
echo -e "${GREEN}[INFO]${NC} $1"
|
||||
}
|
||||
|
||||
log_warn() {
|
||||
echo -e "${YELLOW}[WARN]${NC} $1"
|
||||
}
|
||||
|
||||
log_error() {
|
||||
echo -e "${RED}[ERROR]${NC} $1"
|
||||
}
|
||||
|
||||
# 检查Nomad集群状态
|
||||
check_nomad_cluster() {
|
||||
log_info "检查Nomad集群状态..."
|
||||
|
||||
# 使用我们之前创建的领导者发现脚本
|
||||
if [ -f "/root/mgmt/scripts/nomad-leader-discovery.sh" ]; then
|
||||
chmod +x /root/mgmt/scripts/nomad-leader-discovery.sh
|
||||
LEADER_INFO=$(/root/mgmt/scripts/nomad-leader-discovery.sh -c 2>&1)
|
||||
log_info "Nomad领导者信息: $LEADER_INFO"
|
||||
else
|
||||
log_warn "未找到Nomad领导者发现脚本，使用默认方式检查"
|
||||
nomad server members 2>/dev/null || log_error "无法连接到Nomad集群"
|
||||
fi
|
||||
}
|
||||
|
||||
# 检查Consul集群状态
|
||||
check_consul_cluster() {
|
||||
log_info "检查Consul集群状态..."
|
||||
|
||||
consul members 2>/dev/null || log_error "无法连接到Consul集群"
|
||||
|
||||
# 检查Consul领导者
|
||||
CONSUL_LEADER=$(curl -s http://127.0.0.1:8500/v1/status/leader)
|
||||
if [ -n "$CONSUL_LEADER" ]; then
|
||||
log_info "Consul领导者: $CONSUL_LEADER"
|
||||
else
|
||||
log_error "无法获取Consul领导者信息"
|
||||
fi
|
||||
}
|
||||
|
||||
# 部署Traefik
|
||||
deploy_traefik() {
|
||||
log_info "部署Traefik..."
|
||||
|
||||
# 检查作业文件是否存在
|
||||
if [ ! -f "/root/mgmt/jobs/traefik.nomad" ]; then
|
||||
log_error "Traefik作业文件不存在: /root/mgmt/jobs/traefik.nomad"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# 部署作业
|
||||
nomad run /root/mgmt/jobs/traefik.nomad
|
||||
|
||||
# 等待部署完成
|
||||
log_info "等待Traefik部署完成..."
|
||||
sleep 10
|
||||
|
||||
# 检查作业状态
|
||||
nomad status traefik
|
||||
}
|
||||
|
||||
# 检查Traefik状态
|
||||
check_traefik_status() {
|
||||
log_info "检查Traefik状态..."
|
||||
|
||||
# 检查作业状态
|
||||
JOB_STATUS=$(nomad job status traefik -json | jq -r '.Status')
|
||||
if [ "$JOB_STATUS" == "running" ]; then
|
||||
log_info "Traefik作业状态: $JOB_STATUS"
|
||||
else
|
||||
log_error "Traefik作业状态异常: $JOB_STATUS"
|
||||
return 1
|
||||
fi
|
||||
|
||||
# 检查分配状态
|
||||
ALLOCATIONS=$(nomad job allocs traefik | tail -n +3 | head -n -1 | awk '{print $1}')
|
||||
for alloc in $ALLOCATIONS; do
|
||||
alloc_status=$(nomad alloc status $alloc -json | jq -r '.ClientStatus')
|
||||
if [ "$alloc_status" == "running" ]; then
|
||||
log_info "分配 $alloc 状态: $alloc_status"
|
||||
else
|
||||
log_error "分配 $alloc 状态异常: $alloc_status"
|
||||
fi
|
||||
done
|
||||
|
||||
# 检查服务注册
|
||||
log_info "检查Consul中的服务注册..."
|
||||
consul catalog services | grep traefik && log_info "Traefik服务已注册到Consul" || log_warn "Traefik服务未注册到Consul"
|
||||
}
|
||||
|
||||
# 测试Traefik功能
|
||||
test_traefik_functionality() {
|
||||
log_info "测试Traefik功能..."
|
||||
|
||||
# 获取Traefik服务地址
|
||||
TRAEFIK_ADDR=$(consul catalog service traefik | jq -r '.[0].ServiceAddress' 2>/dev/null)
|
||||
if [ -z "$TRAEFIK_ADDR" ]; then
|
||||
log_warn "无法从Consul获取Traefik地址，使用本地地址"
|
||||
TRAEFIK_ADDR="127.0.0.1"
|
||||
fi
|
||||
|
||||
# 测试API端点
|
||||
log_info "测试Traefik API端点..."
|
||||
if curl -s http://$TRAEFIK_ADDR:8080/ping > /dev/null; then
|
||||
log_info "Traefik API端点响应正常"
|
||||
else
|
||||
log_error "Traefik API端点无响应"
|
||||
fi
|
||||
|
||||
# 测试仪表板
|
||||
log_info "测试Traefik仪表板..."
|
||||
if curl -s http://$TRAEFIK_ADDR:8080/dashboard/ > /dev/null; then
|
||||
log_info "Traefik仪表板可访问"
|
||||
else
|
||||
log_error "无法访问Traefik仪表板"
|
||||
fi
|
||||
|
||||
# 测试HTTP入口点
|
||||
log_info "测试HTTP入口点..."
|
||||
if curl -s -I http://$TRAEFIK_ADDR:80 | grep -q "Location: https://"; then
|
||||
log_info "HTTP到HTTPS重定向正常工作"
|
||||
else
|
||||
log_warn "HTTP到HTTPS重定向可能未正常工作"
|
||||
fi
|
||||
}
|
||||
|
||||
# 创建测试服务
|
||||
create_test_service() {
|
||||
log_info "创建测试服务..."
|
||||
|
||||
# 创建一个简单的测试服务作业文件
|
||||
cat > /tmp/test-service.nomad << EOF
|
||||
job "test-web" {
|
||||
datacenters = ["dc1"]
|
||||
type = "service"
|
||||
|
||||
group "web" {
|
||||
count = 1
|
||||
|
||||
network {
|
||||
port "http" {
|
||||
to = 8080
|
||||
}
|
||||
}
|
||||
|
||||
task "nginx" {
|
||||
driver = "podman"
|
||||
|
||||
config {
|
||||
image = "nginx:alpine"
|
||||
ports = ["http"]
|
||||
}
|
||||
|
||||
resources {
|
||||
cpu = 100
|
||||
memory = 64
|
||||
}
|
||||
|
||||
service {
|
||||
name = "test-web"
|
||||
port = "http"
|
||||
tags = [
|
||||
"traefik.enable=true",
|
||||
"traefik.http.routers.test-web.rule=Host(`test-web.service.consul`)",
|
||||
"traefik.http.routers.test-web.entrypoints=https"
|
||||
]
|
||||
|
||||
check {
|
||||
type = "http"
|
||||
path = "/"
|
||||
interval = "10s"
|
||||
timeout = "2s"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
# 部署测试服务
|
||||
nomad run /tmp/test-service.nomad
|
||||
|
||||
# 等待服务启动
|
||||
sleep 15
|
||||
|
||||
# 测试服务是否可通过Traefik访问
|
||||
log_info "测试服务是否可通过Traefik访问..."
|
||||
if curl -s -H "Host: test-web.service.consul" http://$TRAEFIK_ADDR:80 | grep -q "Welcome to nginx"; then
|
||||
log_info "测试服务可通过Traefik正常访问"
|
||||
else
|
||||
log_error "无法通过Traefik访问测试服务"
|
||||
fi
|
||||
}
|
||||
|
||||
# 清理测试资源
|
||||
cleanup_test_resources() {
|
||||
log_info "清理测试资源..."
|
||||
|
||||
# 停止测试服务
|
||||
nomad job stop test-web 2>/dev/null || true
|
||||
nomad job purge test-web 2>/dev/null || true
|
||||
|
||||
# 停止Traefik
|
||||
nomad job stop traefik 2>/dev/null || true
|
||||
nomad job purge traefik 2>/dev/null || true
|
||||
|
||||
# 删除临时文件
|
||||
rm -f /tmp/test-service.nomad
|
||||
|
||||
log_info "清理完成"
|
||||
}
|
||||
|
||||
# 主函数
|
||||
main() {
|
||||
case "${1:-all}" in
|
||||
"check")
|
||||
check_nomad_cluster
|
||||
check_consul_cluster
|
||||
;;
|
||||
"deploy")
|
||||
deploy_traefik
|
||||
;;
|
||||
"status")
|
||||
check_traefik_status
|
||||
;;
|
||||
"test")
|
||||
test_traefik_functionality
|
||||
;;
|
||||
"test-service")
|
||||
create_test_service
|
||||
;;
|
||||
"cleanup")
|
||||
cleanup_test_resources
|
||||
;;
|
||||
"all")
|
||||
check_nomad_cluster
|
||||
check_consul_cluster
|
||||
deploy_traefik
|
||||
check_traefik_status
|
||||
test_traefik_functionality
|
||||
create_test_service
|
||||
log_info "所有测试完成"
|
||||
;;
|
||||
*)
|
||||
echo "用法: $0 {check|deploy|status|test|test-service|cleanup|all}"
|
||||
echo " check - 检查集群状态"
|
||||
echo " deploy - 部署Traefik"
|
||||
echo " status - 检查Traefik状态"
|
||||
echo " test - 测试Traefik功能"
|
||||
echo " test-service - 创建并测试示例服务"
|
||||
echo " cleanup - 清理测试资源"
|
||||
echo " all - 执行所有步骤（默认）"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
# 执行主函数
|
||||
main "$@"
|
||||
@@ -1,50 +0,0 @@
|
||||
#!/bin/bash
|
||||
# Vault开发环境使用示例
|
||||
|
||||
echo "===== Vault开发环境使用示例 ====="
|
||||
|
||||
# 设置环境变量
|
||||
source /root/mgmt/security/secrets/vault/dev/vault_env.sh
|
||||
|
||||
echo "1. 检查Vault状态"
|
||||
vault status
|
||||
|
||||
echo ""
|
||||
echo "2. 写入示例密钥值"
|
||||
vault kv put secret/myapp/config username="devuser" password="devpassword" database="devdb"
|
||||
|
||||
echo ""
|
||||
echo "3. 读取示例密钥值"
|
||||
vault kv get secret/myapp/config
|
||||
|
||||
echo ""
|
||||
echo "4. 列出密钥路径"
|
||||
vault kv list secret/myapp/
|
||||
|
||||
echo ""
|
||||
echo "5. 创建示例策略"
|
||||
cat > /tmp/dev-policy.hcl << EOF
|
||||
# 开发环境示例策略
|
||||
path "secret/*" {
|
||||
capabilities = ["create", "read", "update", "delete", "list"]
|
||||
}
|
||||
|
||||
path "sys/mounts" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
EOF
|
||||
|
||||
vault policy write dev-policy /tmp/dev-policy.hcl
|
||||
|
||||
echo ""
|
||||
echo "6. 创建有限权限令牌"
|
||||
vault token create -policy=dev-policy
|
||||
|
||||
echo ""
|
||||
echo "7. 启用并配置其他密钥引擎示例"
|
||||
echo "启用数据库密钥引擎："
|
||||
echo "vault secrets enable database"
|
||||
|
||||
echo ""
|
||||
echo "===== Vault开发环境示例完成 ====="
|
||||
echo "注意：这些命令仅用于开发测试，请勿在生产环境中使用相同配置"
|
||||
Reference in New Issue
Block a user