consul 도커 클러스터링, ACL 정책, 권한 설정 (clustering consul in docker)

consul 도커 클러스터링, ACL 정책, 권한 설정 (clustering consul in docker)

 

 

• 도커 네트워크 생성 (수동)

docker network create consul-network

• consul 도커 명령어 (sh내 파일 실행)

docker run -d --name consul-server1 --network consul-network -p 8201:8201 -p 8201:8201/udp -p 8301:8301 -p 8401:8401 -p 8501:8501 -p 8601:8601 -p 8621:8621 -p 8701:8701 -v %cd%/server1.hcl:/consul/config/server1.hcl consul:latest agent -config-file /consul/config/server1.hcl

docker run -d --name consul-server2 --network consul-network -p 8202:8202 -p 8202:8202/udp -p 8302:8302 -p 8402:8402 -p 8502:8502 -p 8602:8602 -p 8622:8622 -p 8702:8702  -v %cd%/server2.hcl:/consul/config/server2.hcl consul:latest agent -config-file /consul/config/server2.hcl

docker run -d --name consul-server3 --network consul-network -p 8203:8203 -p 8203:8203/udp -p 8303:8303 -p 8403:8403 -p 8503:8503 -p 8603:8603 -p 8623:8623 -p 8703:8703 -v %cd%/server3.hcl:/consul/config/server3.hcl consul:latest agent -config-file /consul/config/server3.hcl

 

 

 

설정 파일 작성 내용

server1.hcl

datacenter = "hybrid"
data_dir = "./data1"
log_level = "INFO"
server = true
bootstrap_expect = 2
node_name = "server1"
bind_addr = "0.0.0.0"
retry_join = ["consul-server2:8702", "consul-server3:8703",  "consul-server1:8701"]

acl = {
  enabled = true
  default_policy = "deny"
  enable_token_persistence = true
}

ports {
  http = 8501
  grpc = 8601
  server = 8401
  grpc_tls = 8621
  serf_wan = 8301
  serf_lan = 8701
  dns = 8201

}

 

server2.hcl

datacenter = "hybrid"
data_dir = "./data2"
log_level = "INFO"
server = true
bootstrap_expect = 2
node_name = "server2"
bind_addr = "0.0.0.0"
retry_join = ["consul-server2:8702", "consul-server3:8703",  "consul-server1:8701"]

acl = {
  enabled = true
  default_policy = "deny"
  enable_token_persistence = true
}

ports {
  http = 8502
  grpc = 8602
  server = 8402
  grpc_tls = 8622
  serf_wan = 8302
  serf_lan = 8702
  dns = 8202

}

 

server3.hcl

datacenter = "hybrid"
data_dir = "./data3"
log_level = "INFO"
server = true
bootstrap_expect = 2
node_name = "server3"
bind_addr = "0.0.0.0"

retry_join =["consul-server2:8702", "consul-server3:8703",  "consul-server1:8701"]
acl = {
  enabled = true
  default_policy = "deny"
  enable_token_persistence = true
}

ports {
  http = 8503
  grpc = 8603
  server = 8403
  grpc_tls = 8623
  serf_wan = 8303
  serf_lan = 8703
  dns = 8203
}

→ 3개 중 2개가 죽어도 일정 시간 리더 선출을 통해 다시 작동

 

consul 을 shell 에서 실행하는 경우

#!/bin/sh

docker run -d --name consul-server \
  -p 8201:8201 \
  -p 8201:8201/udp \
  -p 8301:8301 \
  -p 8401:8401 \
  -p 8501:8501 \
  -p 8601:8601 \
  -p 8621:8621 \
  -p 8701:8701 \
  -v $(pwd)/server1.hcl:/consul/config/server1.hcl \
  consul:latest agent -config-file /consul/config/server1.hcl

 

 

- consul client

docker run -d --name consul-client --network consul-network -p 8204:8204 -p 8204:8204/udp -p 8304:8304 -p 8404:8404 -p 8504:8504 -p 8604:8604 -p 8624:8624 -p 8704:8704 -v %cd%/client.hcl:/consul/config/client.hcl consul:latest agent -config-file /consul/config/client.hcl

 

 

datacenter = "hybrid"
data_dir = "./client"
log_level = "INFO"
server = false

node_name = "client"
bind_addr = "0.0.0.0"
client_addr = "0.0.0.0"

retry_join = ["consul-server2:8702", "consul-server1:8701","consul-server3:8703"]

ports {
  http = 8504
  grpc = 8604
  server = 8404
  grpc_tls = 8624
  serf_wan = 8304
  serf_lan = 8704
  dns = 8204
}

 

 

 

 

• 실행 완료

로그 확인

docker logs

 

 

 

---

 

• 부트 스트랩 생성 (최상위 권한 같은 거임)

server1,2,3 중 터미널을 열어 부트스트랩 명령어 실행 (docker exec -it 콘테이너이름 sh)

consul acl bootstrap -http-addr=127.0.0.1:8501

(시크릿 id가 토큰임)

 

 

acl 정책 파일 생성

cat << EOF > kv-policy.hcl
key_prefix "kv/" {
  policy = "write"
}
key_prefix "kv/" {
  policy = "read"
}
EOF

 

 

 

acl 정책 생성

consul acl policy create -http-addr=127.0.0.1:8501 -token <token> -name kv-policy -rules @kv-policy.hcl

 

 

acl 정책에 대한 토큰 생성

consul acl token create -http-addr=127.0.0.1:8501 -token <token> -description "kv token" -policy-name kv-policy

 

 

• 테스트

consul kv put -http-addr 127.0.0.1:8504 -token <token> hi bye

127.0.0.1:8504 ← 클라이언트 http 포트