consul的ACL配置

[1] consul的查询

下载后，启动 consul agent -dev

查询服务：

DNS方式：dig @127.0.0.1 -p 8600 web.service.consul SRV

Http方式：curl http://localhost:8500/v1/catalog/service/consul

dig @127.0.0.1 -p 8600 consul-conf-client.service.consul SRV

; <<>> DiG 9.9.7-P3 <<>> @127.0.0.1 -p 8600 consul-conf-client.service.consul SRV
; (1 server found)

-----

curl http://localhost:8500/v1/catalog/service/consul
[
    {
        "ID": "bff31206-a6f5-9027-faac-b6ad65b92d5d",
        "Node": "sunkaixiangdeMacBook-Pro.local",
        "Address": "127.0.0.1",
        "Datacenter": "dc1",
        "ServiceID": "consul",
        "ServiceName": "consul",
    }
]

查询节点

dig @127.0.0.1 -p 8600 sunkaixiangdeMacBook-Pro.local.node.consul

; <<>> DiG 9.9.7-P3 <<>> @127.0.0.1 -p 8600 sunkaixiangdeMacBook-Pro.local.node.consul
; (1 server found)

curl 127.0.0.1:8500/v1/catalog/nodes

查询kv值

curl http://localhost:8500/v1/kv/test

consul ACL配置使用

启动server

./consul agent -server -bootstrap-expect=1 -data-dir=/home/sunkx/22/consul-data -node=agent-one -bind=192.168.1.101 -config-dir=/home/sunkx/22/consul-config -client 0.0.0.0 -ui

启动slave

consul agent -advertise 192.168.1.100 -data-dir=Users/sunkaixiang/pro/consul-templet/consul-data -config-dir=/Users/sunkaixiang/pro/consul-templet/consul-config  -node=agent-two -bind=192.168.1.100 -join 192.168.1.101

查看成员

./consul members
Node       Address             Status  Type    Build  Protocol  DC   Segment
agent-one  192.168.1.101:8301  alive   server  1.0.2  2         dc1  <all>
agent-two  192.168.1.100:8301  alive   client  1.0.2  2         dc1  <default>

Http api使用
consul http api可用于操作nodes, services, checks, configuration等等的CRUD( create, read, update and delete)。
查看成员：

$ curl  http://192.168.1.101:8500/v1/agent/members
[{"Name":"agent-one","Addr":"192.168.1.101","Port":8301,..},
{"Name":"agent-two","Addr":"192.168.1.100","Port":8301,..}..]

配置acl

1.server服务器

在 config-dir目录下新建文件acl.json

{
	"datacenter": "datacenter-tag",
	"acl_datacenter": "datacenter-tag",
	"acl_master_token": "16c5413b-276c-45ab-9b0e-9664126f1161",
	"acl_default_policy": "deny",
	"server": true,
	"log_level": "DEBUG",
	"bootstrap_expect": 1,
        "client_addr": "0.0.0.0"
}

这里的 acl_master_token可以由  uuidgen | awk '{print tolower ( $0 ) }' 生成。

启动server ,在acl里面把  16c5413b-276c-45ab-9b0e-9664126f1161   填写到token里，然后关闭。就可看到node,services相关的信息。

2.新建client-token

create一个ACL，命名为client，rules里面写规则，规则其实比较简单，规则对象有：agent、event、key、keyring、node、operator、query、service、session。规则权限有：read、write、deny。

我这就只添加了一个名称，其他为空。

将右上角生成的token拷贝出来，在client机器192.168.1.100上的consul-dir目录中的acl.json中写上：

{
  "datacenter": "datacenter-tag",
  "acl_datacenter": "datacenter-tag",
  "acl_token": "2e7c81a9-2150-91ca-824a-998cbc8eb03c",
  "server":false,
   "log_level": "DEBUG",
   "client_addr": "0.0.0.0"
}

注意两边的datacenter和acl_datacenter保持一致。
然后启动client:

consul agent -advertise 192.168.1.100  -data-dir=/Users/sunkaixiang/pro/consul-templet/consul-data -config-dir=/Users/sunkaixiang/pro/consul-templet/consul-config -node=agent-two -bind=192.168.1.100 -join 192.168.1.101 -rejoin -node-id=$(uuidgen | awk '{print tolower($0)}') 

此时：

静默启动：

nohup consul agent -advertise 192.168.1.100 -data-dir=/Users/sunkaixiang/pro/consul-templet/consul-data -config-dir=/Users/sunkaixiang/pro/consul-templet/consul-config -node=agent-two -bind=192.168.1.100 -join 192.168.1.101 -rejoin -node-id=$(uuidgen | awk '{print tolower($0)}') &

查看成员：

./consul members -token=16c5413b-276c-45ab-9b0e-9664126f1161
Node       Address             Status  Type    Build  Protocol  DC              Segment
agent-one  192.168.1.101:8301  alive   server  1.0.2  2         datacenter-tag  <all>
agent-two  10.211.55.5:8301    failed  client  1.0.2  2         datacenter-tag  <default>

要加上token
此时再用程序去连接consul会报错：

OperationException(statusCode=403, statusMessage='Forbidden', statusContent='Permission denied')

如何配置？

@Value("${consul.token:${CONSUL_TOKEN:${spring.cloud.consul.token:${SPRING_CLOUD_CONSUL_TOKEN:}}}}")
    private String aclToken;

https://www.consul.io/docs/guides/acl.html

http://www.jishux.com/plus/view-692181-1.html

http://blog.csdn.net/u010046908/article/details/61916389