feat: 重构项目脚本结构和文档
docs: 添加API和部署文档 refactor: 重新组织脚本目录结构 fix: 修复Nomad配置中的region设置 chore: 移除过期节点相关配置 test: 更新MCP服务器测试脚本 build: 更新Makefile以适配新脚本路径
This commit is contained in:
17
docs/API.md
Normal file
17
docs/API.md
Normal file
@@ -0,0 +1,17 @@
|
||||
# API 文档
|
||||
|
||||
## MCP 服务器 API
|
||||
|
||||
### Qdrant MCP 服务器
|
||||
|
||||
- **端口**: 3000
|
||||
- **协议**: HTTP/JSON-RPC
|
||||
- **功能**: 向量搜索和文档管理
|
||||
|
||||
### 主要端点
|
||||
|
||||
- `/search` - 搜索文档
|
||||
- `/add` - 添加文档
|
||||
- `/delete` - 删除文档
|
||||
|
||||
更多详细信息请参考各 MCP 服务器的源码。
|
||||
23
docs/DEPLOYMENT.md
Normal file
23
docs/DEPLOYMENT.md
Normal file
@@ -0,0 +1,23 @@
|
||||
# 部署文档
|
||||
|
||||
## 快速开始
|
||||
|
||||
1. 环境设置
|
||||
```bash
|
||||
make setup
|
||||
```
|
||||
|
||||
2. 初始化服务
|
||||
```bash
|
||||
./scripts/setup/init/init-vault-dev.sh
|
||||
./scripts/deployment/consul/deploy-consul-cluster-kv.sh
|
||||
```
|
||||
|
||||
3. 启动 MCP 服务器
|
||||
```bash
|
||||
./scripts/mcp/tools/start-mcp-server.sh
|
||||
```
|
||||
|
||||
## 详细部署步骤
|
||||
|
||||
请参考各组件的具体部署脚本和配置文件。
|
||||
248
docs/SCRIPTS.md
Normal file
248
docs/SCRIPTS.md
Normal file
@@ -0,0 +1,248 @@
|
||||
# 脚本文档
|
||||
|
||||
本文档自动生成，包含项目中所有脚本的说明。
|
||||
|
||||
## 脚本列表
|
||||
|
||||
### scripts/ci-cd/build/generate-docs.sh
|
||||
|
||||
**描述**: 文档生成脚本
|
||||
自动生成项目文档
|
||||
颜色定义
|
||||
|
||||
**用法**: 请查看脚本内部说明
|
||||
|
||||
### scripts/ci-cd/quality/lint.sh
|
||||
|
||||
**描述**: 代码质量检查脚本
|
||||
检查脚本语法、代码风格等
|
||||
颜色定义
|
||||
|
||||
|
||||
### scripts/ci-cd/quality/security-scan.sh
|
||||
|
||||
**描述**: 安全扫描脚本
|
||||
扫描代码中的安全问题和敏感信息
|
||||
颜色定义
|
||||
|
||||
|
||||
### scripts/deployment/consul/consul-variables-example.sh
|
||||
|
||||
**描述**: Consul 变量和存储配置示例脚本
|
||||
此脚本展示了如何配置Consul的变量和存储功能
|
||||
配置参数
|
||||
|
||||
|
||||
### scripts/deployment/consul/deploy-consul-cluster-kv.sh
|
||||
|
||||
**描述**: Consul集群部署脚本 - 遵循最佳变量命名规范
|
||||
此脚本将部署一个完全遵循 config/{environment}/{provider}/{region_or_service}/{key} 格式的Consul集群
|
||||
配置参数
|
||||
|
||||
|
||||
### scripts/deployment/vault/deploy-vault.sh
|
||||
|
||||
**描述**: 部署Vault集群的脚本
|
||||
检查并安装Vault
|
||||
|
||||
|
||||
### scripts/deployment/vault/vault-dev-example.sh
|
||||
|
||||
**描述**: Vault开发环境使用示例
|
||||
设置环境变量
|
||||
|
||||
|
||||
### scripts/deployment/vault/vault-dev-quickstart.sh
|
||||
|
||||
**描述**: Vault开发环境快速开始指南
|
||||
1. 设置环境变量
|
||||
|
||||
|
||||
### scripts/mcp/configs/sync-all-configs.sh
|
||||
|
||||
**描述**: 链接所有MCP配置文件的脚本
|
||||
该脚本将所有IDE和AI助手的MCP配置链接到NFS共享的配置文件
|
||||
检查NFS配置文件是否存在
|
||||
|
||||
|
||||
### scripts/mcp/tools/start-mcp-server.sh
|
||||
|
||||
**描述**: 设置环境变量
|
||||
启动MCP服务器
|
||||
|
||||
|
||||
### scripts/setup/config/generate-consul-config.sh
|
||||
|
||||
**描述**: Consul配置生成脚本
|
||||
此脚本使用Consul模板从KV存储生成最终的Consul配置文件
|
||||
配置参数
|
||||
|
||||
|
||||
### scripts/setup/config/setup-consul-cluster-variables.sh
|
||||
|
||||
**描述**: Consul变量配置脚本 - 遵循最佳命名规范
|
||||
此脚本将Consul集群配置存储到Consul KV中，遵循 config/{environment}/{provider}/{region_or_service}/{key} 格式
|
||||
配置参数
|
||||
|
||||
|
||||
### scripts/setup/config/setup-consul-variables-and-storage.sh
|
||||
|
||||
**描述**: Consul 变量和存储配置脚本
|
||||
用于增强Consul集群功能
|
||||
颜色输出
|
||||
|
||||
|
||||
### scripts/setup/environment/setup-environment.sh
|
||||
|
||||
**描述**: 环境设置脚本
|
||||
用于设置开发环境的必要组件和依赖
|
||||
颜色定义
|
||||
|
||||
|
||||
### scripts/setup/init/init-vault-cluster.sh
|
||||
|
||||
**描述**: Vault集群初始化和解封脚本
|
||||
颜色定义
|
||||
|
||||
|
||||
### scripts/setup/init/init-vault-dev-api.sh
|
||||
|
||||
**描述**: 通过API初始化Vault开发环境（无需本地vault命令）
|
||||
颜色定义
|
||||
|
||||
|
||||
### scripts/setup/init/init-vault-dev.sh
|
||||
|
||||
**描述**: Vault开发环境初始化脚本
|
||||
颜色定义
|
||||
|
||||
|
||||
### scripts/testing/infrastructure/test-nomad-config.sh
|
||||
|
||||
**描述**: 测试Nomad配置文件
|
||||
|
||||
|
||||
### scripts/testing/infrastructure/test-traefik-deployment.sh
|
||||
|
||||
**描述**: Traefik部署测试脚本
|
||||
用于测试Traefik在Nomad集群中的部署和功能
|
||||
颜色定义
|
||||
|
||||
**用法**: 请查看脚本内部说明
|
||||
|
||||
### scripts/testing/integration/verify-vault-consul-integration.sh
|
||||
|
||||
**描述**: 验证Vault与Consul集成状态
|
||||
颜色定义
|
||||
|
||||
|
||||
### scripts/testing/mcp/test_direct_search.sh
|
||||
|
||||
**描述**: 创建一个简单的Python脚本来测试search_documents方法
|
||||
|
||||
|
||||
### scripts/testing/mcp/test_local_mcp_servers.sh
|
||||
|
||||
**描述**: 测试当前环境中的MCP服务器
|
||||
检查当前环境中是否有MCP配置
|
||||
|
||||
|
||||
### scripts/testing/mcp/test_mcp_interface.sh
|
||||
|
||||
**描述**: 测试MCP服务器在实际MCP接口中的调用
|
||||
|
||||
|
||||
### scripts/testing/mcp/test_mcp_search_final.sh
|
||||
|
||||
**描述**: 先添加一个文档
|
||||
|
||||
|
||||
### scripts/testing/mcp/test_mcp_servers.sh
|
||||
|
||||
**描述**: 测试MCP服务器脚本
|
||||
|
||||
|
||||
### scripts/testing/mcp/test_qdrant_ollama_tools.sh
|
||||
|
||||
**描述**: 测试search_documents工具
|
||||
|
||||
|
||||
### scripts/testing/mcp/test_qdrant_ollama_tools_fixed.sh
|
||||
|
||||
**描述**: 测试search_documents工具（不带filter参数）
|
||||
|
||||
|
||||
### scripts/testing/mcp/test_search_documents.sh
|
||||
|
||||
**描述**: 先添加一个文档
|
||||
|
||||
|
||||
### scripts/testing/run_all_tests.sh
|
||||
|
||||
**描述**: MCP服务器测试运行器
|
||||
自动运行所有MCP服务器测试脚本
|
||||
颜色定义
|
||||
|
||||
|
||||
### scripts/testing/test-runner.sh
|
||||
|
||||
**描述**: 项目测试快速执行脚本
|
||||
从项目根目录快速运行所有MCP服务器测试
|
||||
颜色定义
|
||||
|
||||
|
||||
### scripts/utilities/backup/backup-all.sh
|
||||
|
||||
**描述**: 全量备份脚本
|
||||
备份所有重要的配置和数据
|
||||
颜色定义
|
||||
|
||||
|
||||
### scripts/utilities/backup/backup-consul.sh
|
||||
|
||||
**描述**: Consul备份脚本
|
||||
此脚本用于创建Consul的快照备份，并管理备份文件
|
||||
配置参数
|
||||
|
||||
|
||||
### scripts/utilities/helpers/fix-alpine-cgroups-systemd.sh
|
||||
|
||||
**描述**: Alternative script to fix cgroup configuration using systemd approach
|
||||
Check if running as root
|
||||
|
||||
|
||||
### scripts/utilities/helpers/fix-alpine-cgroups.sh
|
||||
|
||||
**描述**: Script to fix cgroup configuration for container runtime in Alpine Linux
|
||||
Check if running as root
|
||||
|
||||
|
||||
### scripts/utilities/helpers/manage-vault-consul.sh
|
||||
|
||||
**描述**: Vault与Consul集成管理脚本
|
||||
颜色定义
|
||||
函数定义
|
||||
|
||||
**用法**: 请查看脚本内部说明
|
||||
|
||||
### scripts/utilities/helpers/nomad-leader-discovery.sh
|
||||
|
||||
**描述**: Nomad 集群领导者发现与访问脚本
|
||||
此脚本自动发现当前 Nomad 集群领导者并执行相应命令
|
||||
默认服务器列表（可根据实际情况修改）
|
||||
|
||||
**用法**: 请查看脚本内部说明
|
||||
|
||||
### scripts/utilities/helpers/show-vault-dev-keys.sh
|
||||
|
||||
**描述**: 显示开发环境Vault密钥信息
|
||||
检查密钥文件是否存在
|
||||
|
||||
|
||||
### scripts/utilities/maintenance/cleanup-global-config.sh
|
||||
|
||||
**描述**: Nomad Global 配置清理脚本
|
||||
此脚本用于移除配置文件中的 .global 后缀
|
||||
颜色输出
|
||||
|
||||
|
||||
@@ -25,6 +25,96 @@ config/{environment}/{provider}/{region_or_service}/{key}
|
||||
- **region_or_service**: 区域或服务名称，如 `kr`、`us`、`sgp` 等
|
||||
- **key**: 具体的配置键名，如 `token`、`tenancy_ocid`、`user_ocid` 等
|
||||
|
||||
### Consul集群配置变量
|
||||
|
||||
Consul集群自身配置也应遵循上述命名规范。以下是一些关键配置变量的示例：
|
||||
|
||||
#### 集群基本配置
|
||||
```
|
||||
config/dev/consul/cluster/data_dir
|
||||
config/dev/consul/cluster/raft_dir
|
||||
config/dev/consul/cluster/datacenter
|
||||
config/dev/consul/cluster/bootstrap_expect
|
||||
config/dev/consul/cluster/log_level
|
||||
config/dev/consul/cluster/encrypt_key
|
||||
```
|
||||
|
||||
#### 节点配置
|
||||
```
|
||||
config/dev/consul/nodes/master/ip
|
||||
config/dev/consul/nodes/ash3c/ip
|
||||
config/dev/consul/nodes/warden/ip
|
||||
```
|
||||
|
||||
#### 网络配置
|
||||
```
|
||||
config/dev/consul/network/client_addr
|
||||
config/dev/consul/network/bind_interface
|
||||
config/dev/consul/network/advertise_interface
|
||||
```
|
||||
|
||||
#### 端口配置
|
||||
```
|
||||
config/dev/consul/ports/dns
|
||||
config/dev/consul/ports/http
|
||||
config/dev/consul/ports/https
|
||||
config/dev/consul/ports/grpc
|
||||
config/dev/consul/ports/grpc_tls
|
||||
config/dev/consul/ports/serf_lan
|
||||
config/dev/consul/ports/serf_wan
|
||||
config/dev/consul/ports/server
|
||||
```
|
||||
|
||||
#### 服务发现配置
|
||||
```
|
||||
config/dev/consul/service/enable_script_checks
|
||||
config/dev/consul/service/enable_local_script_checks
|
||||
config/dev/consul/service/enable_service_script
|
||||
```
|
||||
|
||||
#### 性能配置
|
||||
```
|
||||
config/dev/consul/performance/raft_multiplier
|
||||
```
|
||||
|
||||
#### 日志配置
|
||||
```
|
||||
config/dev/consul/log/enable_syslog
|
||||
config/dev/consul/log/log_file
|
||||
```
|
||||
|
||||
#### 连接配置
|
||||
```
|
||||
config/dev/consul/connection/reconnect_timeout
|
||||
config/dev/consul/connection/reconnect_timeout_wan
|
||||
config/dev/consul/connection/session_ttl_min
|
||||
```
|
||||
|
||||
#### Autopilot配置
|
||||
```
|
||||
config/dev/consul/autopilot/cleanup_dead_servers
|
||||
config/dev/consul/autopilot/last_contact_threshold
|
||||
config/dev/consul/autopilot/max_trailing_logs
|
||||
config/dev/consul/autopilot/server_stabilization_time
|
||||
config/dev/consul/autopilot/disable_upgrade_migration
|
||||
```
|
||||
|
||||
#### 快照配置
|
||||
```
|
||||
config/dev/consul/snapshot/enabled
|
||||
config/dev/consul/snapshot/interval
|
||||
config/dev/consul/snapshot/retain
|
||||
config/dev/consul/snapshot/name
|
||||
```
|
||||
|
||||
#### 备份配置
|
||||
```
|
||||
config/dev/consul/backup/enabled
|
||||
config/dev/consul/backup/interval
|
||||
config/dev/consul/backup/retain
|
||||
config/dev/consul/backup/name
|
||||
```
|
||||
|
||||
### 示例配置
|
||||
|
||||
#### 应用配置
|
||||
@@ -119,6 +209,186 @@ pair, _, _ := kv.Get("config/dev/app/name", nil)
|
||||
appName := string(pair.Value)
|
||||
```
|
||||
|
||||
## 部署遵循最佳变量命名规范的Consul集群
|
||||
|
||||
为了确保Consul集群完全遵循最佳变量命名规范，我们提供了一套完整的部署方案。
|
||||
|
||||
### 部署流程
|
||||
|
||||
1. **设置Consul变量**: 使用脚本将所有Consul集群配置存储到Consul KV中
|
||||
2. **生成配置文件**: 使用Consul模板从KV存储动态生成配置文件
|
||||
3. **部署集群**: 使用Nomad部署使用动态配置的Consul集群
|
||||
|
||||
### 部署脚本
|
||||
|
||||
我们提供了以下脚本来简化部署过程：
|
||||
|
||||
#### setup_consul_cluster_variables.sh
|
||||
此脚本将Consul集群配置存储到Consul KV中，遵循 `config/{environment}/{provider}/{region_or_service}/{key}` 格式。
|
||||
|
||||
```bash
|
||||
# 设置Consul集群变量
|
||||
./deployment/scripts/setup_consul_cluster_variables.sh
|
||||
```
|
||||
|
||||
#### generate_consul_config.sh
|
||||
此脚本使用Consul模板从KV存储生成最终的Consul配置文件。
|
||||
|
||||
```bash
|
||||
# 生成Consul配置文件
|
||||
./deployment/scripts/generate_consul_config.sh
|
||||
```
|
||||
|
||||
#### deploy_consul_cluster_kv.sh
|
||||
此脚本是一个综合部署脚本，执行完整的部署流程。
|
||||
|
||||
```bash
|
||||
# 部署遵循最佳变量命名规范的Consul集群
|
||||
./deployment/scripts/deploy_consul_cluster_kv.sh
|
||||
```
|
||||
|
||||
### 配置模板
|
||||
|
||||
我们提供了Consul配置模板文件 `consul.hcl.tmpl`，使用Consul模板语法从KV存储中动态获取配置：
|
||||
|
||||
```hcl
|
||||
# 基础配置
|
||||
data_dir = "{{ keyOrDefault `config/dev/consul/cluster/data_dir` `/opt/consul/data` }}"
|
||||
raft_dir = "{{ keyOrDefault `config/dev/consul/cluster/raft_dir` `/opt/consul/raft` }}"
|
||||
|
||||
# 启用UI
|
||||
ui_config {
|
||||
enabled = {{ keyOrDefault `config/dev/consul/ui/enabled` `true` }}
|
||||
}
|
||||
|
||||
# 服务器配置
|
||||
server = true
|
||||
bootstrap_expect = {{ keyOrDefault `config/dev/consul/cluster/bootstrap_expect` `3` }}
|
||||
|
||||
# 网络配置
|
||||
client_addr = "{{ keyOrDefault `config/dev/consul/nodes/master/ip` `100.117.106.136` }}"
|
||||
bind_addr = "{{ keyOrDefault `config/dev/consul/nodes/master/ip` `100.117.106.136` }}"
|
||||
advertise_addr = "{{ keyOrDefault `config/dev/consul/nodes/master/ip` `100.117.106.136` }}"
|
||||
|
||||
# 集群连接 - 从KV获取其他节点IP
|
||||
retry_join = [
|
||||
"{{ keyOrDefault `config/dev/consul/nodes/ash3c/ip` `100.116.80.94` }}",
|
||||
"{{ keyOrDefault `config/dev/consul/nodes/warden/ip` `100.122.197.112` }}"
|
||||
]
|
||||
```
|
||||
|
||||
### Nomad作业配置
|
||||
|
||||
我们提供了完全遵循最佳变量命名规范的Nomad作业配置文件 `consul-cluster-kv.nomad`，该文件使用Consul模板从KV存储动态获取配置：
|
||||
|
||||
```hcl
|
||||
task "consul" {
|
||||
driver = "exec"
|
||||
|
||||
# 使用模板从Consul KV获取配置
|
||||
template {
|
||||
data = <<EOF
|
||||
# Consul配置文件 - 从KV存储动态获取
|
||||
# 遵循 config/{environment}/{provider}/{region_or_service}/{key} 格式
|
||||
|
||||
# 基础配置
|
||||
data_dir = "{{ keyOrDefault `config/dev/consul/cluster/data_dir` `/opt/consul/data` }}"
|
||||
raft_dir = "{{ keyOrDefault `config/dev/consul/cluster/raft_dir` `/opt/consul/raft` }}"
|
||||
|
||||
# 服务器配置
|
||||
server = true
|
||||
bootstrap_expect = {{ keyOrDefault `config/dev/consul/cluster/bootstrap_expect` `3` }}
|
||||
|
||||
# 网络配置
|
||||
client_addr = "{{ keyOrDefault `config/dev/consul/nodes/master/ip` `100.117.106.136` }}"
|
||||
bind_addr = "{{ keyOrDefault `config/dev/consul/nodes/master/ip` `100.117.106.136` }}"
|
||||
advertise_addr = "{{ keyOrDefault `config/dev/consul/nodes/master/ip` `100.117.106.136` }}"
|
||||
|
||||
# 集群连接 - 从KV获取其他节点IP
|
||||
retry_join = [
|
||||
"{{ keyOrDefault `config/dev/consul/nodes/ash3c/ip` `100.116.80.94` }}",
|
||||
"{{ keyOrDefault `config/dev/consul/nodes/warden/ip` `100.122.197.112` }}"
|
||||
]
|
||||
EOF
|
||||
destination = "local/consul.hcl"
|
||||
}
|
||||
|
||||
config {
|
||||
command = "consul"
|
||||
args = [
|
||||
"agent",
|
||||
"-config-dir=local"
|
||||
]
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### 验证部署
|
||||
|
||||
部署完成后，可以通过以下方式验证Consul集群是否正确遵循了最佳变量命名规范：
|
||||
|
||||
1. **检查Consul KV中的配置**:
|
||||
```bash
|
||||
# 检查Consul集群配置
|
||||
curl -s http://localhost:8500/v1/kv/config/dev/consul/?keys | jq '.'
|
||||
```
|
||||
|
||||
2. **验证Consul集群状态**:
|
||||
```bash
|
||||
# 检查集群leader
|
||||
curl -s http://localhost:8500/v1/status/leader
|
||||
|
||||
# 检查集群节点
|
||||
curl -s http://localhost:8500/v1/status/peers
|
||||
```
|
||||
|
||||
3. **验证配置文件**:
|
||||
```bash
|
||||
# 验证生成的配置文件语法
|
||||
consul validate /root/mgmt/components/consul/configs/consul.hcl
|
||||
```
|
||||
|
||||
### 动态更新配置
|
||||
|
||||
使用这种部署方式，您可以动态更新Consul集群配置，而无需重新部署整个集群：
|
||||
|
||||
1. **更新Consul KV中的配置**:
|
||||
```bash
|
||||
# 更新日志级别
|
||||
curl -X PUT http://localhost:8500/v1/kv/config/dev/consul/cluster/log_level -d "DEBUG"
|
||||
|
||||
# 更新快照间隔
|
||||
curl -X PUT http://localhost:8500/v1/kv/config/dev/consul/snapshot/interval -d "12h"
|
||||
```
|
||||
|
||||
2. **重新生成配置文件**:
|
||||
```bash
|
||||
# 重新生成配置文件
|
||||
./deployment/scripts/generate_consul_config.sh
|
||||
```
|
||||
|
||||
3. **重新加载Consul配置**:
|
||||
```bash
|
||||
# 重新加载Consul配置
|
||||
consul reload
|
||||
```
|
||||
|
||||
### 环境隔离
|
||||
|
||||
通过使用环境变量和不同的配置路径，您可以轻松实现不同环境的隔离：
|
||||
|
||||
```bash
|
||||
# 开发环境
|
||||
ENVIRONMENT=dev ./deployment/scripts/setup_consul_cluster_variables.sh
|
||||
|
||||
# 生产环境
|
||||
ENVIRONMENT=prod ./deployment/scripts/setup_consul_cluster_variables.sh
|
||||
```
|
||||
|
||||
这样，不同环境的配置将存储在不同的路径下：
|
||||
- 开发环境: `config/dev/consul/...`
|
||||
- 生产环境: `config/prod/consul/...`
|
||||
|
||||
## 存储(Storage)配置
|
||||
|
||||
### 持久化存储
|
||||
|
||||
183
docs/vault-consul-integration.md
Normal file
183
docs/vault-consul-integration.md
Normal file
@@ -0,0 +1,183 @@
|
||||
# Vault与Consul集成配置指南
|
||||
|
||||
## 1. 概述
|
||||
|
||||
本文档详细说明了Vault与Consul的集成配置，包括架构设计、配置参数和管理操作。
|
||||
|
||||
## 2. 集成架构
|
||||
|
||||
### 2.1 架构图
|
||||
```
|
||||
+------------------+
|
||||
| Vault Client |
|
||||
+------------------+
|
||||
|
|
||||
+------------------+
|
||||
| Vault Server |
|
||||
| (3个节点集群) |
|
||||
+------------------+
|
||||
|
|
||||
+------------------+
|
||||
| Consul Backend |
|
||||
| (3个节点集群) |
|
||||
+------------------+
|
||||
```
|
||||
|
||||
### 2.2 节点分布
|
||||
- **Vault节点**：
|
||||
- master节点: 100.117.106.136
|
||||
- ash3c节点: 100.116.80.94
|
||||
- warden节点: 100.122.197.112
|
||||
|
||||
- **Consul节点**：
|
||||
- master节点: 100.117.106.136
|
||||
- ash3c节点: 100.116.80.94
|
||||
- warden节点: 100.122.197.112
|
||||
|
||||
## 3. 配置详情
|
||||
|
||||
### 3.1 Vault配置文件
|
||||
每个Vault节点的配置文件位于：`/opt/nomad/data/vault/config/vault.hcl`
|
||||
|
||||
```hcl
|
||||
storage "consul" {
|
||||
address = "<本地Consul地址>:8500"
|
||||
path = "vault/"
|
||||
}
|
||||
|
||||
listener "tcp" {
|
||||
address = "0.0.0.0:8200"
|
||||
tls_disable = 1
|
||||
}
|
||||
|
||||
api_addr = "http://<节点IP>:8200"
|
||||
cluster_addr = "http://<节点IP>:8201"
|
||||
|
||||
ui = true
|
||||
disable_mlock = true
|
||||
```
|
||||
|
||||
### 3.2 Consul配置
|
||||
Consul作为Vault的存储后端，存储了所有Vault的持久化数据，包括：
|
||||
- 密钥材料
|
||||
- 策略信息
|
||||
- 审计日志
|
||||
- 集群状态
|
||||
|
||||
## 4. 集成验证
|
||||
|
||||
### 4.1 验证命令
|
||||
```bash
|
||||
# 检查Vault状态
|
||||
vault status
|
||||
|
||||
# 检查Consul成员
|
||||
consul members
|
||||
|
||||
# 检查Consul中的Vault数据
|
||||
curl http://<consul_addr>:8500/v1/kv/vault/?recurse | jq .
|
||||
```
|
||||
|
||||
### 4.2 验证脚本
|
||||
```bash
|
||||
# 运行完整验证
|
||||
/root/mgmt/deployment/scripts/verify_vault_consul_integration.sh
|
||||
```
|
||||
|
||||
## 5. 管理操作
|
||||
|
||||
### 5.1 日常管理
|
||||
```bash
|
||||
# 显示状态
|
||||
/root/mgmt/deployment/scripts/manage_vault_consul.sh status
|
||||
|
||||
# 健康检查
|
||||
/root/mgmt/deployment/scripts/manage_vault_consul.sh health
|
||||
|
||||
# 验证集成
|
||||
/root/mgmt/deployment/scripts/manage_vault_consul.sh verify
|
||||
```
|
||||
|
||||
### 5.2 监控操作
|
||||
```bash
|
||||
# 实时监控
|
||||
/root/mgmt/deployment/scripts/manage_vault_consul.sh monitor
|
||||
|
||||
# 数据备份
|
||||
/root/mgmt/deployment/scripts/manage_vault_consul.sh backup
|
||||
```
|
||||
|
||||
## 6. 故障排除
|
||||
|
||||
### 6.1 常见问题
|
||||
|
||||
#### 6.1.1 Vault无法连接Consul
|
||||
**问题**：Vault启动失败，日志显示无法连接Consul
|
||||
**解决方案**：
|
||||
1. 检查Consul服务是否运行：`consul members`
|
||||
2. 检查网络连接：`curl http://<consul_addr>:8500/v1/status/leader`
|
||||
3. 验证Vault配置中的Consul地址是否正确
|
||||
|
||||
#### 6.1.2 Vault数据丢失
|
||||
**问题**：Vault无法读取之前存储的数据
|
||||
**解决方案**：
|
||||
1. 检查Consul中的数据：`curl http://<consul_addr>:8500/v1/kv/vault/?keys`
|
||||
2. 验证Consul集群状态：`consul members`
|
||||
3. 如有必要，从备份恢复数据
|
||||
|
||||
### 6.2 日志查看
|
||||
```bash
|
||||
# 查看Vault日志
|
||||
nomad alloc logs -address=http://100.116.158.95:4646 <vault_allocation_id>
|
||||
|
||||
# 查看Consul日志
|
||||
nomad alloc logs -address=http://100.116.158.95:4646 <consul_allocation_id>
|
||||
```
|
||||
|
||||
## 7. 安全考虑
|
||||
|
||||
### 7.1 数据加密
|
||||
- Consul中的Vault数据默认已加密
|
||||
- 网络传输使用TLS加密（生产环境）
|
||||
|
||||
### 7.2 访问控制
|
||||
- Vault使用令牌进行访问控制
|
||||
- Consul使用ACL策略进行访问控制
|
||||
|
||||
### 7.3 备份策略
|
||||
- 定期备份Consul中的Vault数据
|
||||
- 备份文件应加密存储
|
||||
- 遵循3-2-1备份原则
|
||||
|
||||
## 8. 性能优化
|
||||
|
||||
### 8.1 Consul调优
|
||||
- 调整Consul的存储后端性能参数
|
||||
- 监控Consul集群的健康状态
|
||||
- 定期清理过期的会话
|
||||
|
||||
### 8.2 Vault调优
|
||||
- 调整Vault的缓存设置
|
||||
- 监控Vault的性能指标
|
||||
- 优化密钥引擎的使用
|
||||
|
||||
## 9. 升级维护
|
||||
|
||||
### 9.1 版本升级
|
||||
1. 先升级Consul集群
|
||||
2. 再升级Vault集群
|
||||
3. 验证集成状态
|
||||
|
||||
### 9.2 滚动更新
|
||||
使用Nomad进行滚动更新，确保服务不中断：
|
||||
```bash
|
||||
nomad job run -address=http://100.116.158.95:4646 /path/to/updated/job.nomad
|
||||
```
|
||||
|
||||
## 10. 相关文档
|
||||
|
||||
- [Vault官方文档](https://www.vaultproject.io/docs)
|
||||
- [Consul官方文档](https://www.consul.io/docs)
|
||||
- [Nomad官方文档](https://www.nomadproject.io/docs)
|
||||
- Vault开发环境指南
|
||||
- Vault安全策略文档
|
||||
Reference in New Issue
Block a user