consul的ACL配置

爱被打了一巴掌 2022-06-02 10:37 347阅读 0赞

\[1\] consul的查询

下载后，启动 consul agent -dev

查询服务：

DNS方式：dig @127.0.0.1 -p 8600 web.service.consul SRV

Http方式：curl http://localhost:8500/v1/catalog/service/consul

dig @127.0.0.1 -p 8600 consul-conf-client.service.consul SRV
    
    ; <<>> DiG 9.9.7-P3 <<>> @127.0.0.1 -p 8600 consul-conf-client.service.consul SRV
    ; (1 server found)

\-----

curl http://localhost:8500/v1/catalog/service/consul
    [
        {
            "ID": "bff31206-a6f5-9027-faac-b6ad65b92d5d",
            "Node": "sunkaixiangdeMacBook-Pro.local",
            "Address": "127.0.0.1",
            "Datacenter": "dc1",
            "ServiceID": "consul",
            "ServiceName": "consul",
        }
    ]

查询节点

dig @127.0.0.1 -p 8600 sunkaixiangdeMacBook-Pro.local.node.consul
    
    ; <<>> DiG 9.9.7-P3 <<>> @127.0.0.1 -p 8600 sunkaixiangdeMacBook-Pro.local.node.consul
    ; (1 server found)

curl 127.0.0.1:8500/v1/catalog/nodes

查询kv值

curl http://localhost:8500/v1/kv/test

# consul ACL配置使用 #

启动server

./consul agent -server -bootstrap-expect=1 -data-dir=/home/sunkx/22/consul-data -node=agent-one -bind=192.168.1.101 -config-dir=/home/sunkx/22/consul-config -client 0.0.0.0 -ui

启动slave

consul agent -advertise 192.168.1.100 -data-dir=Users/sunkaixiang/pro/consul-templet/consul-data -config-dir=/Users/sunkaixiang/pro/consul-templet/consul-config  -node=agent-two -bind=192.168.1.100 -join 192.168.1.101

查看成员

./consul members
    Node       Address             Status  Type    Build  Protocol  DC   Segment
    agent-one  192.168.1.101:8301  alive   server  1.0.2  2         dc1  <all>
    agent-two  192.168.1.100:8301  alive   client  1.0.2  2         dc1  <default>

Http api使用  
consul http api可用于操作nodes, services, checks, configuration等等的CRUD( create, read, update and delete)。  
查看成员：

$ curl  http://192.168.1.101:8500/v1/agent/members
    [{"Name":"agent-one","Addr":"192.168.1.101","Port":8301,..},
    {"Name":"agent-two","Addr":"192.168.1.100","Port":8301,..}..]

配置acl

1.server服务器

在 config-dir目录下新建文件acl.json

{
    	"datacenter": "datacenter-tag",
    	"acl_datacenter": "datacenter-tag",
    	"acl_master_token": "16c5413b-276c-45ab-9b0e-9664126f1161",
    	"acl_default_policy": "deny",
    	"server": true,
    	"log_level": "DEBUG",
    	"bootstrap_expect": 1,
            "client_addr": "0.0.0.0"
    }

这里的 acl\_master\_token可以由  uuidgen | awk '\{print tolower ( $0 ) \}' 生成。

启动server ,在acl里面把  [16c5413b-276c-45ab-9b0e-9664126f1161][]   填写到token里，然后关闭。就可看到node,services相关的信息。

2.新建client-token

create一个ACL，命名为client，rules里面写规则，规则其实比较简单，规则对象有：agent、event、key、keyring、node、operator、query、service、session。规则权限有：read、write、deny。

将右上角生成的token拷贝出来，在client机器192.168.1.100上的consul-dir目录中的acl.json中写上：

{
      "datacenter": "datacenter-tag",
      "acl_datacenter": "datacenter-tag",
      "acl_token": "2e7c81a9-2150-91ca-824a-998cbc8eb03c",
      "server":false,
       "log_level": "DEBUG",
       "client_addr": "0.0.0.0"
    }

注意两边的datacenter和acl\_datacenter保持一致。  
然后启动client:

consul agent -advertise 192.168.1.100  -data-dir=/Users/sunkaixiang/pro/consul-templet/consul-data -config-dir=/Users/sunkaixiang/pro/consul-templet/consul-config -node=agent-two -bind=192.168.1.100 -join 192.168.1.101 -rejoin -node-id=$(uuidgen | awk '{print tolower($0)}')

此时：  
![SouthEast][]

静默启动：

nohup consul agent -advertise 192.168.1.100 -data-dir=/Users/sunkaixiang/pro/consul-templet/consul-data -config-dir=/Users/sunkaixiang/pro/consul-templet/consul-config -node=agent-two -bind=192.168.1.100 -join 192.168.1.101 -rejoin -node-id=$(uuidgen | awk '{print tolower($0)}') &

查看成员：

./consul members -token=16c5413b-276c-45ab-9b0e-9664126f1161
    Node       Address             Status  Type    Build  Protocol  DC              Segment
    agent-one  192.168.1.101:8301  alive   server  1.0.2  2         datacenter-tag  <all>
    agent-two  10.211.55.5:8301    failed  client  1.0.2  2         datacenter-tag  <default>

要加上token  
此时再用程序去连接consul会报错：

OperationException(statusCode=403, statusMessage='Forbidden', statusContent='Permission denied')

如何配置？

@Value("${consul.token:${CONSUL_TOKEN:${spring.cloud.consul.token:${SPRING_CLOUD_CONSUL_TOKEN:}}}}")
        private String aclToken;

https://www.consul.io/docs/guides/acl.html

http://www.jishux.com/plus/view-692181-1.html

http://blog.csdn.net/u010046908/article/details/61916389

[16c5413b-276c-45ab-9b0e-9664126f1161]: http://127.0.0.1:8500/v1/acl/create?token=16c5413b-276c-45ab-9b0e-9664126f1161
[consul_ACL_ - _1_ _ linux_Python_linux]: /images/20220602/d8e31f59622345daaa341ae1f04e1f48.png
[consul_ACL_ - _2_ _ linux_Python_linux]: /images/20220602/bc36b4cc3e914ea5aa1eb4a729533288.png
[consul_ACL_ - _3_ _ linux_Python_linux]: /images/20220602/e8dd7fd96caa47979472752898d380b6.png
[SouthEast]: /images/20220602/8640748ec8634e088a2a74748cc1ad8b.png