183 lines
4.2 KiB
Markdown
183 lines
4.2 KiB
Markdown
# Vault与Consul集成配置指南
|
||
|
||
## 1. 概述
|
||
|
||
本文档详细说明了Vault与Consul的集成配置，包括架构设计、配置参数和管理操作。
|
||
|
||
## 2. 集成架构
|
||
|
||
### 2.1 架构图
|
||
```
|
||
+------------------+
|
||
| Vault Client |
|
||
+------------------+
|
||
|
|
||
+------------------+
|
||
| Vault Server |
|
||
| (3个节点集群) |
|
||
+------------------+
|
||
|
|
||
+------------------+
|
||
| Consul Backend |
|
||
| (3个节点集群) |
|
||
+------------------+
|
||
```
|
||
|
||
### 2.2 节点分布
|
||
- **Vault节点**：
|
||
- master节点: 100.117.106.136
|
||
- ash3c节点: 100.116.80.94
|
||
- warden节点: 100.122.197.112
|
||
|
||
- **Consul节点**：
|
||
- master节点: 100.117.106.136
|
||
- ash3c节点: 100.116.80.94
|
||
- warden节点: 100.122.197.112
|
||
|
||
## 3. 配置详情
|
||
|
||
### 3.1 Vault配置文件
|
||
每个Vault节点的配置文件位于：`/opt/nomad/data/vault/config/vault.hcl`
|
||
|
||
```hcl
|
||
storage "consul" {
|
||
address = "<本地Consul地址>:8500"
|
||
path = "vault/"
|
||
}
|
||
|
||
listener "tcp" {
|
||
address = "0.0.0.0:8200"
|
||
tls_disable = 1
|
||
}
|
||
|
||
api_addr = "http://<节点IP>:8200"
|
||
cluster_addr = "http://<节点IP>:8201"
|
||
|
||
ui = true
|
||
disable_mlock = true
|
||
```
|
||
|
||
### 3.2 Consul配置
|
||
Consul作为Vault的存储后端，存储了所有Vault的持久化数据，包括：
|
||
- 密钥材料
|
||
- 策略信息
|
||
- 审计日志
|
||
- 集群状态
|
||
|
||
## 4. 集成验证
|
||
|
||
### 4.1 验证命令
|
||
```bash
|
||
# 检查Vault状态
|
||
vault status
|
||
|
||
# 检查Consul成员
|
||
consul members
|
||
|
||
# 检查Consul中的Vault数据
|
||
curl http://<consul_addr>:8500/v1/kv/vault/?recurse | jq .
|
||
```
|
||
|
||
### 4.2 验证脚本
|
||
```bash
|
||
# 运行完整验证
|
||
/root/mgmt/deployment/scripts/verify_vault_consul_integration.sh
|
||
```
|
||
|
||
## 5. 管理操作
|
||
|
||
### 5.1 日常管理
|
||
```bash
|
||
# 显示状态
|
||
/root/mgmt/deployment/scripts/manage_vault_consul.sh status
|
||
|
||
# 健康检查
|
||
/root/mgmt/deployment/scripts/manage_vault_consul.sh health
|
||
|
||
# 验证集成
|
||
/root/mgmt/deployment/scripts/manage_vault_consul.sh verify
|
||
```
|
||
|
||
### 5.2 监控操作
|
||
```bash
|
||
# 实时监控
|
||
/root/mgmt/deployment/scripts/manage_vault_consul.sh monitor
|
||
|
||
# 数据备份
|
||
/root/mgmt/deployment/scripts/manage_vault_consul.sh backup
|
||
```
|
||
|
||
## 6. 故障排除
|
||
|
||
### 6.1 常见问题
|
||
|
||
#### 6.1.1 Vault无法连接Consul
|
||
**问题**：Vault启动失败，日志显示无法连接Consul
|
||
**解决方案**：
|
||
1. 检查Consul服务是否运行：`consul members`
|
||
2. 检查网络连接：`curl http://<consul_addr>:8500/v1/status/leader`
|
||
3. 验证Vault配置中的Consul地址是否正确
|
||
|
||
#### 6.1.2 Vault数据丢失
|
||
**问题**：Vault无法读取之前存储的数据
|
||
**解决方案**：
|
||
1. 检查Consul中的数据：`curl http://<consul_addr>:8500/v1/kv/vault/?keys`
|
||
2. 验证Consul集群状态：`consul members`
|
||
3. 如有必要，从备份恢复数据
|
||
|
||
### 6.2 日志查看
|
||
```bash
|
||
# 查看Vault日志
|
||
nomad alloc logs -address=http://100.116.158.95:4646 <vault_allocation_id>
|
||
|
||
# 查看Consul日志
|
||
nomad alloc logs -address=http://100.116.158.95:4646 <consul_allocation_id>
|
||
```
|
||
|
||
## 7. 安全考虑
|
||
|
||
### 7.1 数据加密
|
||
- Consul中的Vault数据默认已加密
|
||
- 网络传输使用TLS加密（生产环境）
|
||
|
||
### 7.2 访问控制
|
||
- Vault使用令牌进行访问控制
|
||
- Consul使用ACL策略进行访问控制
|
||
|
||
### 7.3 备份策略
|
||
- 定期备份Consul中的Vault数据
|
||
- 备份文件应加密存储
|
||
- 遵循3-2-1备份原则
|
||
|
||
## 8. 性能优化
|
||
|
||
### 8.1 Consul调优
|
||
- 调整Consul的存储后端性能参数
|
||
- 监控Consul集群的健康状态
|
||
- 定期清理过期的会话
|
||
|
||
### 8.2 Vault调优
|
||
- 调整Vault的缓存设置
|
||
- 监控Vault的性能指标
|
||
- 优化密钥引擎的使用
|
||
|
||
## 9. 升级维护
|
||
|
||
### 9.1 版本升级
|
||
1. 先升级Consul集群
|
||
2. 再升级Vault集群
|
||
3. 验证集成状态
|
||
|
||
### 9.2 滚动更新
|
||
使用Nomad进行滚动更新，确保服务不中断：
|
||
```bash
|
||
nomad job run -address=http://100.116.158.95:4646 /path/to/updated/job.nomad
|
||
```
|
||
|
||
## 10. 相关文档
|
||
|
||
- [Vault官方文档](https://www.vaultproject.io/docs)
|
||
- [Consul官方文档](https://www.consul.io/docs)
|
||
- [Nomad官方文档](https://www.nomadproject.io/docs)
|
||
- Vault开发环境指南
|
||
- Vault安全策略文档 |