本次演示环境使用Jumpserver版本:v2.15.4
设置k8s节点包括1台master和1台worker;
应用部署控制管理器使用deployment;
持久化存储使用hostPath写入到NFS挂载目录。
NFS挂载方式如下:
在master配置了nfs服务,并将nfs共享目录/nfs_storage挂在到了两个节点中的/opt/nfs;
如下图所示:
yum -y install nfs-utils rpcbind
mkdir -p /opt/jumpserver/redis/data
chown -R nobody:nfsnobody /opt/jumpserver/redis/data
vi /etc/exports
/opt/jumpserver/redis/data 192.168.11.0/24(rw,sync,no_root_squash)
systemctl restart nfs
systemctl restart rpcbind
systemctl enable nfs-server
exportfs -rv
exporting 192.168.11.0/24:/opt/jumpserver/redis/data
showmount -e 127.0.0.1
/opt/jumpserver/redis/data 192.168.11.0/24
将Jumpserver安装包中的镜像一次导入到系统中,或导入到harbor中;
此次演示环境没有配置harbor,直接导入到两个k8s节点中:
cd /opt/jumpserver-offline-release-v2.15.4-amd64-92/
for i in `ls scripts/images/*.tar`; do docker load < $i; done
mkdir /opt/nfs/jumpserver/
#将conf目录提前拷贝到共享目录中
cp -r /opt/jumpserver-offline-release-v2.15.2-amd64-84/config_init /opt/nfs/jumpserver/
kubectl create -f mysql.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: mysql
namespace: jms
spec:
selector:
matchLabels:
app: mysql
replicas: 1
template:
metadata:
labels:
app: mysql
spec:
containers:
- name: mysql
args:
- --character-set-server=utf8
image: jumpserver/mysql:5
imagePullPolicy: IfNotPresent
env:
- name: DB_PORT
value: "3306"
- name: MYSQL_DATABASE
value: jumpserver
- name: MYSQL_ROOT_PASSWORD
value: "Password123@mysql"
ports:
- containerPort: 3306
protocol: TCP
volumeMounts:
- name: mysql-persistent-storage
mountPath: /var/lib/mysql
- name: config-volume
mountPath: /etc/mysql/my.cnf
volumes:
- name: config-volume
hostPath:
path: /opt/nfs/jumpserver/config_init/mysql/my.cnf
- name: mysql-persistent-storage
hostPath:
path: /opt/nfs/jumpserver/mysql/data
---
apiVersion: v1
kind: Service
metadata:
name: mysql
namespace: jms
spec:
ports:
- name: mysql
protocol: TCP
port: 3306
targetPort: 3306
nodePort: 30306
type: NodePort
selector:
app: mysql
kubectl create -f redis.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: redis
namespace: jms
spec:
selector:
matchLabels:
app: redis
replicas: 1
strategy:
type: Recreate
template:
metadata:
creationTimestamp: null
labels:
app: redis
spec:
containers:
- name: redis
args:
- redis-server
- /etc/redis.conf
- --requirepass
- redis@jumpserver@6379
env:
- name: REDIS_PASSWORD
value: redis@jumpserver@6379
- name: REDIS_PORT
value: "6379"
image: jumpserver/redis:6-alpine
imagePullPolicy: IfNotPresent
volumeMounts:
- name: redis-data
mountPath: /data
- name: redis-conf
mountPath: /etc/redis.conf
volumes:
- name: redis-conf
hostPath:
path: /opt/nfs/jumpserver/config_init/redis/redis.conf
- name: redis-data
hostPath:
path: /opt/nfs/jumpserver/redis/data
---
apiVersion: v1
kind: Service
metadata:
name: redis
namespace: jms
spec:
ports:
- name: redis
protocol: TCP
port: 6379
targetPort: 6379
type: ClusterIP
selector:
app: redis
kubectl create -f core.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: core
namespace: jms
spec:
selector:
matchLabels:
app: core
replicas: 1
strategy:
type: Recreate
template:
metadata:
creationTimestamp: null
labels:
app: core
spec:
containers:
- name: start-core
args:
- start
- web
env:
- name: VOLUME_DIR
value: /opt/jumpserver
- name: DOCKER_DIR
value: /var/lib/docker
- name: SECRET_KEY
value: OWFlYTRkNTYtMjIwNy0xYTA1LTA0MmQtMTgzNzI5ZjY2OGMy
- name: BOOTSTRAP_TOKEN
value: OWFlYTRkNTYtMjIwNy0xYTA1
- name: LOG_LEVEL
value: ERROR
- name: USE_EXTERNAL_MYSQL
value: "0"
- name: DB_HOST
value: mysql
- name: DB_PORT
value: "3306"
- name: DB_USER
value: root
- name: DB_PASSWORD
value: Password123@mysql
- name: DB_NAME
value: jumpserver
- name: USE_EXTERNAL_REDIS
value: "0"
- name: REDIS_HOST
value: redis
- name: REDIS_PORT
value: "6379"
- name: REDIS_PASSWORD
value: redis@jumpserver@6379
- name: COMPOSE_PROJECT_NAME
value: jms
- name: COMPOSE_HTTP_TIMEOUT
value: "3600"
- name: DOCKER_CLIENT_TIMEOUT
value: "3600"
- name: DOCKER_SUBNET
value: 192.168.250.0/24
- name: USE_IPV6
value: "0"
- name: DOCKER_SUBNET_IPV6
value: fc00:200::/24
- name: HTTP_PORT
value: "80"
- name: SSH_PORT
value: "2222"
- name: RDP_PORT
value: "3389"
- name: USE_LB
value: "0"
- name: HTTPS_PORT
value: "443"
- name: USE_TASK
value: "1"
- name: USE_XPACK
value: "1"
- name: SESSION_EXPIRE_AT_BROWSER_CLOSE
value: "true"
- name: CORE_HOST
value: http://core:8080
- name: CLIENT_MAX_BODY_SIZE
value: 4096m
- name: SERVER_HOSTNAME
value: ${HOSTNAME}
- name: CURRENT_VERSION
value: v2.15.4
image: jumpserver/core:v2.15.4
imagePullPolicy: IfNotPresent
tty: true
volumeMounts:
- name: core-config
mountPath: /opt/jumpserver/config.yml
- name: core-data
mountPath: /opt/jumpserver/data
- name: core-logs
mountPath: /opt/jumpserver/logs
volumes:
- name: core-config
hostPath:
path: /opt/nfs/jumpserver/config_init/core/config.yml
- name: core-data
hostPath:
path: /opt/nfs/jumpserver/core/data
- name: core-logs
hostPath:
path: /opt/nfs/jumpserver/core/logs
---
apiVersion: v1
kind: Service
metadata:
name: core
namespace: jms
spec:
ports:
- name: core-8080
protocol: TCP
port: 8080
targetPort: 8080
- name: core-8070
protocol: TCP
port: 8070
targetPort: 8070
type: ClusterIP
selector:
app: core
kubectl create -f task.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: celery
namespace: jms
spec:
selector:
matchLabels:
app: celery
replicas: 1
strategy:
type: Recreate
template:
metadata:
creationTimestamp: null
labels:
app: celery
spec:
containers:
- name: start-task
args:
- start
- task
env:
- name: VOLUME_DIR
value: /opt/jumpserver
- name: DOCKER_DIR
value: /var/lib/docker
- name: SECRET_KEY
value: OWFlYTRkNTYtMjIwNy0xYTA1LTA0MmQtMTgzNzI5ZjY2OGMy
- name: BOOTSTRAP_TOKEN
value: OWFlYTRkNTYtMjIwNy0xYTA1
- name: LOG_LEVEL
value: ERROR
- name: USE_EXTERNAL_MYSQL
value: "0"
- name: DB_HOST
value: mysql
- name: DB_PORT
value: "3306"
- name: DB_USER
value: root
- name: DB_PASSWORD
value: Password123@mysql
- name: DB_NAME
value: jumpserver
- name: USE_EXTERNAL_REDIS
value: "0"
- name: REDIS_HOST
value: redis
- name: REDIS_PORT
value: "6379"
- name: REDIS_PASSWORD
value: redis@jumpserver@6379
- name: COMPOSE_PROJECT_NAME
value: jms
- name: COMPOSE_HTTP_TIMEOUT
value: "3600"
- name: DOCKER_CLIENT_TIMEOUT
value: "3600"
- name: DOCKER_SUBNET
value: 192.168.250.0/24
- name: USE_IPV6
value: "0"
- name: DOCKER_SUBNET_IPV6
value: fc00:200::/24
- name: HTTP_PORT
value: "80"
- name: SSH_PORT
value: "2222"
- name: RDP_PORT
value: "3389"
- name: USE_LB
value: "0"
- name: HTTPS_PORT
value: "443"
- name: USE_TASK
value: "1"
- name: USE_XPACK
value: "1"
- name: SESSION_EXPIRE_AT_BROWSER_CLOSE
value: "true"
- name: CORE_HOST
value: http://core:8080
- name: CLIENT_MAX_BODY_SIZE
value: 4096m
- name: SERVER_HOSTNAME
value: ${HOSTNAME}
- name: CURRENT_VERSION
value: v2.15.4
image: jumpserver/core:v2.15.4
imagePullPolicy: IfNotPresent
tty: true
volumeMounts:
- name: core-data
mountPath: /opt/jumpserver/data
- name: core-logs
mountPath: /opt/jumpserver/logs
volumes:
- name: core-data
hostPath:
path: /opt/nfs/jumpserver/core/data
- name: core-logs
hostPath:
path: /opt/nfs/jumpserver/core/logs
---
apiVersion: v1
kind: Service
metadata:
name: celery
namespace: jms
spec:
ports:
- name: celery-8080
protocol: TCP
port: 8080
targetPort: 8080
- name: celery-8070
protocol: TCP
port: 8070
targetPort: 8070
type: ClusterIP
selector:
app: celery
kubectl create -f koko.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: koko
namespace: jms
spec:
selector:
matchLabels:
app: koko
replicas: 1
strategy:
type: Recreate
template:
metadata:
creationTimestamp: null
labels:
app: koko
spec:
containers:
- name: start-koko
env:
- name: VOLUME_DIR
value: /opt/jumpserver
- name: DOCKER_DIR
value: /var/lib/docker
- name: SECRET_KEY
value: OWFlYTRkNTYtMjIwNy0xYTA1LTA0MmQtMTgzNzI5ZjY2OGMy
- name: BOOTSTRAP_TOKEN
value: OWFlYTRkNTYtMjIwNy0xYTA1
- name: LOG_LEVEL
value: ERROR
- name: USE_EXTERNAL_MYSQL
value: "0"
- name: DB_HOST
value: mysql
- name: DB_PORT
value: "3306"
- name: DB_USER
value: root
- name: DB_PASSWORD
value: Password123@mysql
- name: DB_NAME
value: jumpserver
- name: USE_EXTERNAL_REDIS
value: "0"
- name: REDIS_HOST
value: redis
- name: REDIS_PORT
value: "6379"
- name: REDIS_PASSWORD
value: redis@jumpserver@6379
- name: COMPOSE_PROJECT_NAME
value: jms
- name: COMPOSE_HTTP_TIMEOUT
value: "3600"
- name: DOCKER_CLIENT_TIMEOUT
value: "3600"
- name: DOCKER_SUBNET
value: 192.168.250.0/24
- name: USE_IPV6
value: "0"
- name: DOCKER_SUBNET_IPV6
value: fc00:200::/24
- name: HTTP_PORT
value: "80"
- name: SSH_PORT
value: "2222"
- name: RDP_PORT
value: "3389"
- name: USE_LB
value: "0"
- name: HTTPS_PORT
value: "443"
- name: USE_TASK
value: "1"
- name: USE_XPACK
value: "1"
- name: SESSION_EXPIRE_AT_BROWSER_CLOSE
value: "true"
- name: CORE_HOST
value: http://core:8080
- name: CLIENT_MAX_BODY_SIZE
value: 4096m
- name: SERVER_HOSTNAME
value: ${HOSTNAME}
- name: CURRENT_VERSION
value: v2.15.4
image: jumpserver/koko:v2.15.4
imagePullPolicy: IfNotPresent
tty: true
volumeMounts:
- name: koko-config
mountPath: /opt/koko/config.yml
- name: koko-data
mountPath: /opt/koko/data
volumes:
- name: koko-config
hostPath:
path: /opt/nfs/jumpserver/config_init/koko/config.yml
- name: koko-data
hostPath:
path: /opt/nfs/jumpserver/koko/data
---
apiVersion: v1
kind: Service
metadata:
name: koko
namespace: jms
spec:
ports:
- name: koko-2222
protocol: TCP
port: 2222
targetPort: 2222
nodePort: 32222
- name: koko-5000
protocol: TCP
port: 5000
targetPort: 5000
type: NodePort
selector:
app: koko
kubectl create -f lion.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: lion
namespace: jms
spec:
selector:
matchLabels:
app: lion
replicas: 1
strategy:
type: Recreate
template:
metadata:
creationTimestamp: null
labels:
app: lion
spec:
containers:
- name: lion
env:
- name: VOLUME_DIR
value: /opt/jumpserver
- name: DOCKER_DIR
value: /var/lib/docker
- name: SECRET_KEY
value: OWFlYTRkNTYtMjIwNy0xYTA1LTA0MmQtMTgzNzI5ZjY2OGMy
- name: BOOTSTRAP_TOKEN
value: OWFlYTRkNTYtMjIwNy0xYTA1
- name: LOG_LEVEL
value: ERROR
- name: USE_EXTERNAL_MYSQL
value: "0"
- name: DB_HOST
value: mysql
- name: DB_PORT
value: "3306"
- name: DB_USER
value: root
- name: DB_PASSWORD
value: Password123@mysql
- name: DB_NAME
value: jumpserver
- name: USE_EXTERNAL_REDIS
value: "0"
- name: REDIS_HOST
value: redis
- name: REDIS_PORT
value: "6379"
- name: REDIS_PASSWORD
value: redis@jumpserver@6379
- name: COMPOSE_PROJECT_NAME
value: jms
- name: COMPOSE_HTTP_TIMEOUT
value: "3600"
- name: DOCKER_CLIENT_TIMEOUT
value: "3600"
- name: DOCKER_SUBNET
value: 192.168.250.0/24
- name: USE_IPV6
value: "0"
- name: DOCKER_SUBNET_IPV6
value: fc00:200::/24
- name: HTTP_PORT
value: "80"
- name: SSH_PORT
value: "2222"
- name: RDP_PORT
value: "3389"
- name: USE_LB
value: "0"
- name: HTTPS_PORT
value: "443"
- name: USE_TASK
value: "1"
- name: USE_XPACK
value: "1"
- name: SESSION_EXPIRE_AT_BROWSER_CLOSE
value: "true"
- name: CORE_HOST
value: http://core:8080
- name: CLIENT_MAX_BODY_SIZE
value: 4096m
- name: SERVER_HOSTNAME
value: ${HOSTNAME}
- name: CURRENT_VERSION
value: v2.15.4
image: jumpserver/lion:v2.15.4
imagePullPolicy: IfNotPresent
volumeMounts:
- name: lion-data
mountPath: /opt/lion/data
volumes:
- name: lion-data
hostPath:
path: /opt/nfs/jumpserver/lion/data
---
apiVersion: v1
kind: Service
metadata:
name: lion
namespace: jms
spec:
ports:
- name: lion
protocol: TCP
port: 8081
targetPort: 8081
type: ClusterIP
selector:
app: lion
kubectl create -f omnidb.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: omnidb
namespace: jms
spec:
selector:
matchLabels:
app: omnidb
replicas: 1
strategy:
type: Recreate
template:
metadata:
creationTimestamp: null
labels:
app: omnidb
spec:
containers:
- name: omnidb
env:
- name: VOLUME_DIR
value: /opt/jumpserver
- name: DOCKER_DIR
value: /var/lib/docker
- name: SECRET_KEY
value: OWFlYTRkNTYtMjIwNy0xYTA1LTA0MmQtMTgzNzI5ZjY2OGMy
- name: BOOTSTRAP_TOKEN
value: OWFlYTRkNTYtMjIwNy0xYTA1
- name: LOG_LEVEL
value: ERROR
- name: USE_EXTERNAL_MYSQL
value: "0"
- name: DB_HOST
value: mysql
- name: DB_PORT
value: "3306"
- name: DB_USER
value: root
- name: DB_PASSWORD
value: Password123@mysql
- name: DB_NAME
value: jumpserver
- name: USE_EXTERNAL_REDIS
value: "0"
- name: REDIS_HOST
value: redis
- name: REDIS_PORT
value: "6379"
- name: REDIS_PASSWORD
value: redis@jumpserver@6379
- name: COMPOSE_PROJECT_NAME
value: jms
- name: COMPOSE_HTTP_TIMEOUT
value: "3600"
- name: DOCKER_CLIENT_TIMEOUT
value: "3600"
- name: DOCKER_SUBNET
value: 192.168.250.0/24
- name: USE_IPV6
value: "0"
- name: DOCKER_SUBNET_IPV6
value: fc00:200::/24
- name: HTTP_PORT
value: "80"
- name: SSH_PORT
value: "2222"
- name: RDP_PORT
value: "3389"
- name: USE_LB
value: "0"
- name: HTTPS_PORT
value: "443"
- name: USE_TASK
value: "1"
- name: USE_XPACK
value: "1"
- name: SESSION_EXPIRE_AT_BROWSER_CLOSE
value: "true"
- name: CORE_HOST
value: http://core:8080
- name: CLIENT_MAX_BODY_SIZE
value: 4096m
- name: SERVER_HOSTNAME
value: ${HOSTNAME}
- name: CURRENT_VERSION
value: v2.15.4
image: registry.fit2cloud.com/jumpserver/omnidb:v2.15.4
imagePullPolicy: IfNotPresent
volumeMounts:
- name: omnidb-data
mountPath: /opt/omnidb/data
volumes:
- name: omnidb-data
hostPath:
path: /opt/nfs/jumpserver/omnidb/data
---
apiVersion: v1
kind: Service
metadata:
name: omnidb
namespace: jms
spec:
ports:
- name: omnidb
protocol: TCP
port: 8082
targetPort: 8082
type: ClusterIP
selector:
app: omnidb
kubectl create -f web.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: web
namespace: jms
spec:
selector:
matchLabels:
app: web
replicas: 1
strategy:
type: Recreate
template:
metadata:
creationTimestamp: null
labels:
app: web
spec:
containers:
- name: web
env:
- name: CLIENT_MAX_BODY_SIZE
value: 4096m
image: jumpserver/web:v2.15.4
imagePullPolicy: IfNotPresent
volumeMounts:
- name: web-data
mountPath: /opt/jumpserver/data
- name: web-log
mountPath: /var/log/nginx
volumes:
- name: web-log
hostPath:
path: /opt/nfs/jumpserver/nginx/log
- name: web-data
hostPath:
path: /opt/nfs/jumpserver/core/data
---
apiVersion: v1
kind: Service
metadata:
name: web
namespace: jms
spec:
ports:
- name: web
protocol: TCP
port: 80
targetPort: 80
nodePort: 32080
type: NodePort
selector:
app: web
kubectl create -f xrdp.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: xrdp
namespace: jms
spec:
selector:
matchLabels:
app: xrdp
replicas: 1
strategy:
type: Recreate
template:
metadata:
creationTimestamp: null
labels:
app: xrdp
spec:
containers:
- name: xrdp
env:
- name: VOLUME_DIR
value: /opt/jumpserver
- name: DOCKER_DIR
value: /var/lib/docker
- name: SECRET_KEY
value: OWFlYTRkNTYtMjIwNy0xYTA1LTA0MmQtMTgzNzI5ZjY2OGMy
- name: BOOTSTRAP_TOKEN
value: OWFlYTRkNTYtMjIwNy0xYTA1
- name: LOG_LEVEL
value: ERROR
- name: USE_EXTERNAL_MYSQL
value: "0"
- name: DB_HOST
value: mysql
- name: DB_PORT
value: "3306"
- name: DB_USER
value: root
- name: DB_PASSWORD
value: Password123@mysql
- name: DB_NAME
value: jumpserver
- name: USE_EXTERNAL_REDIS
value: "0"
- name: REDIS_HOST
value: redis
- name: REDIS_PORT
value: "6379"
- name: REDIS_PASSWORD
value: redis@jumpserver@6379
- name: COMPOSE_PROJECT_NAME
value: jms
- name: COMPOSE_HTTP_TIMEOUT
value: "3600"
- name: DOCKER_CLIENT_TIMEOUT
value: "3600"
- name: DOCKER_SUBNET
value: 192.168.250.0/24
- name: USE_IPV6
value: "0"
- name: DOCKER_SUBNET_IPV6
value: fc00:200::/24
- name: HTTP_PORT
value: "80"
- name: SSH_PORT
value: "2222"
- name: RDP_PORT
value: "3389"
- name: USE_LB
value: "0"
- name: HTTPS_PORT
value: "443"
- name: USE_TASK
value: "1"
- name: USE_XPACK
value: "1"
- name: SESSION_EXPIRE_AT_BROWSER_CLOSE
value: "true"
- name: CORE_HOST
value: http://core:8080
- name: CLIENT_MAX_BODY_SIZE
value: 4096m
- name: SERVER_HOSTNAME
value: ${HOSTNAME}
- name: CURRENT_VERSION
value: v2.15.4
image: registry.fit2cloud.com/jumpserver/xrdp:v2.15.4
imagePullPolicy: IfNotPresent
volumeMounts:
- name: xrdp-data
mountPath: /opt/xrdp/data
volumes:
- name: xrdp-data
hostPath:
path: /opt/nfs/jumpserver/xrdp/data
---
apiVersion: v1
kind: Service
metadata:
name: xrdp
namespace: jms
spec:
ports:
- name: xrdp
protocol: TCP
port: 3389
targetPort: 3389
nodePort: 30389
type: NodePort
selector:
app: xrdp
如需部署lb、es、monio组件,可自行根据compose目录中的compose文件编写k8s-yaml。
[root@demo-cluster-master-1 ~]# kubectl get pod,svc -n jms
NAME READY STATUS RESTARTS AGE
pod/celery-7f7967ffb4-s2v76 1/1 Running 0 148m
pod/core-65d5dff4d8-r5dqg 1/1 Running 0 150m
pod/koko-86dfcb5c4-5vlbv 1/1 Running 0 143m
pod/lion-59b765b946-fjfbq 1/1 Running 0 140m
pod/mysql-56d587b86-cc6fd 1/1 Running 0 171m
pod/omnidb-5ccd45f4bd-wctwt 1/1 Running 0 140m
pod/redis-9695cdb75-wvw8k 1/1 Running 0 162m
pod/web-79d96dc447-czhq5 1/1 Running 0 129m
pod/xrdp-9fb574dbc-x2stz 1/1 Running 0 129m
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/celery ClusterIP 172.20.244.113 <none> 8080/TCP,8070/TCP 148m
service/core ClusterIP 172.20.184.162 <none> 8080/TCP,8070/TCP 150m
service/jms-web NodePort 172.20.75.216 <none> 80:32080/TCP 135m
service/koko NodePort 172.20.195.30 <none> 2222:32222/TCP,5000:32184/TCP 144m
service/lion ClusterIP 172.20.166.129 <none> 8081/TCP 142m
service/minio ClusterIP 172.20.152.245 <none> 9000/TCP,9001/TCP 63m
service/mysql NodePort 172.20.244.21 <none> 3306:30306/TCP 171m
service/omnidb ClusterIP 172.20.87.37 <none> 8082/TCP 140m
service/redis ClusterIP 172.20.69.97 <none> 6379/TCP 162m
service/xrdp NodePort 172.20.29.225 <none> 3389:30389/TCP 137m