Kubernetes部署consul集群

概述

Consul 集群（三个节点）部署方式使用 StatefulSet

Consul 集群成员之间使用TLS进行安全通信 TLS and encryption keys

先决条件

　　主节点需要安装以下工具：cfssl 、 cfssljson、consul

# cfssl cfssljson 安装教程
wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64
chmod a+x cfssl_linux-amd64 cfssljson_linux-amd64 cfssl-certinfo_linux-amd64
mv cfssl_linux-amd64 /usr/local/bin/cfssl
mv cfssljson_linux-amd64 /usr/local/bin/cfssljson
mv cfssl-certinfo_linux-amd64 /usr/bin/cfssl-certinfo

# consul 安装教程（一般下载比较慢，可以使用文章底部百度云盘下载地址—）
wget https://releases.hashicorp.com/consul/1.7.1/consul_1.7.1_linux_amd64.zip
unzip consul_1.7.1_linux_amd64.zip
mv consul /usr/local/bin/

 

 

---

克隆 Github 项目

git clone https://github.com/kelseyhightower/consul-on-kubernetes.git

cd consul-on-kubernetes

生成 TLS 证书

cfssl gencert -initca ca/ca-csr.json | cfssljson -bare ca

cfssl gencert \
  -ca=ca.pem \
  -ca-key=ca-key.pem \
  -config=ca/ca-config.json \
  -profile=default \
  ca/consul-csr.json | cfssljson -bare consul

生成 Consul Gossip 加密密钥

GOSSIP_ENCRYPTION_KEY=$(consul keygen)

创建 Consul 集群Secret 和 Configmap

kubectl create secret generic consul \
  --from-literal="gossip-encryption-key=${GOSSIP_ENCRYPTION_KEY}" \
  --from-file=ca.pem \
  --from-file=consul.pem \
  --from-file=consul-key.pem

kubectl create configmap consul --from-file=configs/server.json

创建 Consul 集群 Persistent Volume

mkdir -p /data/pv/consul-0 /data/pv/consul-1 /data/pv/consul-2

vim consul-pv.yaml　　　　# 内容如下

kubectl create -f consul-pv.yaml 

apiVersion: v1
kind: PersistentVolume
metadata:
  labels:
    app: data-consul-0
  name: data-consul-0
spec:
  capacity:
    storage: 10Gi
  volumeMode: Filesystem
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Recycle
  hostPath:
    path: /data/pv/consul-0
---
apiVersion: v1
kind: PersistentVolume
metadata:
  labels:
    app: data-consul-1
  name: data-consul-1
spec:
  capacity:
    storage: 10Gi
  volumeMode: Filesystem
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Recycle
  hostPath:
    path: /data/pv/consul-1
---
apiVersion: v1
kind: PersistentVolume
metadata:
  labels:
    app: data-consul-2
  name: data-consul-2
spec:
  capacity:
    storage: 10Gi
  volumeMode: Filesystem
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Recycle
  hostPath:
    path: /data/pv/consul-2

consul-pv.yaml