kubernetes离线部署jumpserver开源堡垒机

已于 2023-04-23 14:33:34 修改
阅读量635 收藏 1
点赞数
分类专栏： kubernetes 文章标签： kubernetes 开源 运维 容器
于 2023-04-21 15:17:03 首次发布
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/zhangkangren/article/details/130289537
版权

堡垒机介绍可以看官方网站：https://kuboard.cn/

此文档只是部署

前提条件：此文档两个部署在192.168.17.80，可以通过查找更改成自己的。

1、mysql 5.7 mariadb 10.2

2、redis 5
镜像1
镜像2
镜像3
下载镜像

docker pull jumpserver/core:v3.1.2
docker pull jumpserver/koko:v3.1.2
docker pull jumpserver/lion:v3.1.2
docker pull jumpserver/magnus:v3.1.2
docker pull jumpserver/web:v3.1.2

1、创建Namespace

apiVersion: v1
kind: Namespace
metadata:
  labels:
    kubernetes.io/metadata.name: jumpserver
  name: jumpserver

2、创建ConfigMap

---
apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    app.jumpserver.org/name: jms-web
    app.kubernetes.io/instance: jms-k8s
    app.kubernetes.io/name: jumpserver
    app.kubernetes.io/version: v3.1.2
  name: jms-k8s-jumpserver-jms-web
  namespace: jumpserver
data:
  default.conf: |
    server {
        listen 80;
        server_name  _;
        server_tokens off;

        client_max_body_size 4096m;  # 录像及文件上传大小限制

        location /ui/ {
            try_files $uri / /index.html;
            alias /opt/lina/;
        }
        location /luna/ {
            try_files $uri / /index.html;
            alias /opt/luna/;
        }
        location /download/ {
            alias /opt/download/;
        }
        location /media/replay/ {
            add_header Content-Encoding gzip;
            root /opt/jumpserver/data/;
        }
        location /static/ {
            root /opt/jumpserver/data/;
        }
        location /koko/ {
            proxy_pass http://jms-k8s-jumpserver-jms-koko:5000;
            proxy_buffering off;
            proxy_http_version 1.1;
            proxy_request_buffering off;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_ignore_client_abort on;
            proxy_connect_timeout 600;
            proxy_send_timeout 600;
            proxy_read_timeout 600;
            send_timeout 6000;
        }
        location /lion/ {
            proxy_pass http://jms-k8s-jumpserver-jms-lion:8081;
            proxy_buffering off;
            proxy_http_version 1.1;
            proxy_request_buffering off;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $http_connection;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_ignore_client_abort on;
            proxy_connect_timeout 600;
            proxy_send_timeout 600;
            proxy_read_timeout 600;
            send_timeout 6000;
        }
        location /ws/ {
            proxy_pass http://jms-k8s-jumpserver-jms-core:8080;
            proxy_buffering off;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }
        location ~ ^/(core|api|media)/ {
            proxy_pass http://jms-k8s-jumpserver-jms-core:8080;
            proxy_buffering off;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }
        location / {
            rewrite ^/(.*)$ /ui/$1 last;
        }
    }
---
apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    app.jumpserver.org/name: jms-core
    app.kubernetes.io/instance: jms-k8s
    app.kubernetes.io/name: jumpserver
    app.kubernetes.io/version: v3.1.2
  name: jms-k8s-jumpserver-jms-core
  namespace: jumpserver
data:
  config.yml: ''

3、创建PVC

---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:

    k8s.kuboard.cn/pvcType: Dynamic
  name: jms-k8s-jumpserver-jms-core-data
  namespace: jumpserver
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 10Gi
  storageClassName: ceph
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:

    k8s.kuboard.cn/pvcType: Dynamic
  name: jms-k8s-jumpserver-jms-core-logs
  namespace: jumpserver
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 10Gi
  storageClassName: ceph
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:

    k8s.kuboard.cn/pvcType: Dynamic
  name: jms-k8s-jumpserver-jms-koko-data
  namespace: jumpserver
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 10Gi
  storageClassName: ceph
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:

    k8s.kuboard.cn/pvcType: Dynamic
  name: jms-k8s-jumpserver-jms-lion-data
  namespace: jumpserver
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 10Gi
  storageClassName: ceph
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:

    k8s.kuboard.cn/pvcType: Dynamic
  name: jms-k8s-jumpserver-jms-magnus-data
  namespace: jumpserver
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 10Gi
  storageClassName: ceph
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:

    k8s.kuboard.cn/pvcType: Dynamic
  name: jms-k8s-jumpserver-jms-web-logs
  namespace: jumpserver
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 10Gi
  storageClassName: ceph

4、创建celery Deployment

---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.jumpserver.org/name: jms-celery
  name: jms-k8s-jumpserver-jms-celery
  namespace: jumpserver
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app.jumpserver.org/name: jms-core
      app.kubernetes.io/instance: jms-k8s
      app.kubernetes.io/name: jumpserver
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      labels:
        app.jumpserver.org/name: jms-core
        app.kubernetes.io/instance: jms-k8s
        app.kubernetes.io/name: jumpserver
    spec:
      containers:
        - args:
            - start
            - task
          env:
            - name: SECRET_KEY
              value: B3f2w8P2PfxIAS7s4URrD9YmSbtqX4vXdPUL217kL9XPUOWrmy
            - name: BOOTSTRAP_TOKEN
              value: 7Q11Vz6R2J6BLAdO
            - name: DEBUG
              value: 'false'
            - name: LOG_LEVEL
              value: ERROR
            - name: HTTP_LISTEN_PORT
              value: '8080'
            - name: DB_ENGINE
              value: mysql
            - name: DB_HOST
              value: 192.168.17.80
            - name: DB_PORT
              value: '3306'
            - name: DB_USER
              value: jumpserver
            - name: DB_PASSWORD
              value: '123456'
            - name: DB_NAME
              value: jumpserver
            - name: REDIS_HOST
              value: 192.168.17.80
            - name: REDIS_PORT
              value: '6379'
            - name: REDIS_PASSWORD
              value: '123456'
            - name: MAGNUS_MYSQL_PORT
              value: '33061'
            - name: MAGNUS_MARIADB_PORT
              value: '33062'
            - name: MAGNUS_REDIS_PORT
              value: '63790'
            - name: MAGNUS_POSTGRESQL_PORT
              value: '54320'
            - name: MAGNUS_ORACLE_PORTS
              value: 30000-30100
            - name: SESSION_EXPIRE_AT_BROWSER_CLOSE
              value: 'true'
          image: '192.168.17.40/jumpserver/core:v3.1.2'
          imagePullPolicy: IfNotPresent
          livenessProbe:
            exec:
              command:
                - /bin/bash
                - /opt/jumpserver/utils/check_celery.sh
            failureThreshold: 3
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          name: jms-celery
          resources: {}
          securityContext: {}
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
            - mountPath: /opt/jumpserver/config.yml
              name: jms-core-config
              subPath: config.yml
            - mountPath: /opt/jumpserver/data
              name: jms-core-data
            - mountPath: /opt/jumpserver/logs
              name: jms-core-logs
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      serviceAccount: default
      serviceAccountName: default
      terminationGracePeriodSeconds: 30
      volumes:
        - configMap:
            defaultMode: 420
            name: jms-k8s-jumpserver-jms-core
          name: jms-core-config
        - name: jms-core-data
          persistentVolumeClaim:
            claimName: jms-k8s-jumpserver-jms-core-data
        - name: jms-core-logs
          persistentVolumeClaim:
            claimName: jms-k8s-jumpserver-jms-core-logs

5、创建core

5.1 Deployment

---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.jumpserver.org/name: jms-core
    app.kubernetes.io/instance: jms-k8s
    app.kubernetes.io/name: jumpserver
    app.kubernetes.io/version: v3.1.2
    k8s.kuboard.cn/name: jms-k8s-jumpserver-jms-core
  name: jms-k8s-jumpserver-jms-core
  namespace: jumpserver
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app.jumpserver.org/name: jms-core
      app.kubernetes.io/instance: jms-k8s
      app.kubernetes.io/name: jumpserver
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      labels:
        app.jumpserver.org/name: jms-core
        app.kubernetes.io/instance: jms-k8s
        app.kubernetes.io/name: jumpserver
    spec:
      containers:
        - args:
            - start
            - web
          env:
            - name: SECRET_KEY
              value: B3f2w8P2PfxIAS7s4URrD9YmSbtqX4vXdPUL217kL9XPUOWrmy
            - name: BOOTSTRAP_TOKEN
              value: 7Q11Vz6R2J6BLAdO
            - name: DEBUG
              value: 'false'
            - name: LOG_LEVEL
              value: ERROR
            - name: HTTP_LISTEN_PORT
              value: '8080'
            - name: DB_ENGINE
              value: mysql
            - name: DB_HOST
              value: 192.168.17.80
            - name: DB_PORT
              value: '3306'
            - name: DB_USER
              value: jumpserver
            - name: DB_PASSWORD
              value: '123456'
            - name: DB_NAME
              value: jumpserver
            - name: REDIS_HOST
              value: 192.168.17.80
            - name: REDIS_PORT
              value: '6379'
            - name: REDIS_PASSWORD
              value: '123456'
            - name: MAGNUS_MYSQL_PORT
              value: '33061'
            - name: MAGNUS_MARIADB_PORT
              value: '33062'
            - name: MAGNUS_REDIS_PORT
              value: '63790'
            - name: MAGNUS_POSTGRESQL_PORT
              value: '54320'
            - name: MAGNUS_ORACLE_PORTS
              value: 30000-30100
            - name: SESSION_EXPIRE_AT_BROWSER_CLOSE
              value: 'true'
          image: '192.168.17.40/jumpserver/core:v3.1.2'
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 30
            httpGet:
              path: /api/health/
              port: web
              scheme: HTTP
            initialDelaySeconds: 20
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          name: jms-core
          ports:
            - containerPort: 8080
              name: web
              protocol: TCP
          readinessProbe:
            failureThreshold: 30
            httpGet:
              path: /api/health/
              port: web
              scheme: HTTP
            initialDelaySeconds: 20
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          resources: {}
          securityContext: {}
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
            - mountPath: /opt/jumpserver/config.yml
              name: jms-core-config
              subPath: config.yml
            - mountPath: /opt/jumpserver/data
              name: jms-core-data
            - mountPath: /opt/jumpserver/logs
              name: jms-core-logs
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      serviceAccount: default
      serviceAccountName: default
      terminationGracePeriodSeconds: 30
      volumes:
        - configMap:
            defaultMode: 420
            name: jms-k8s-jumpserver-jms-core
          name: jms-core-config
        - name: jms-core-data
          persistentVolumeClaim:
            claimName: jms-k8s-jumpserver-jms-core-data
        - name: jms-core-logs
          persistentVolumeClaim:
            claimName: jms-k8s-jumpserver-jms-core-logs

5.2 Service

---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.jumpserver.org/name: jms-core
    app.kubernetes.io/instance: jms-k8s
    app.kubernetes.io/name: jumpserver
    app.kubernetes.io/version: v3.1.2
  name: jms-k8s-jumpserver-jms-core
  namespace: jumpserver
spec:
  internalTrafficPolicy: Cluster
  ipFamilies:
    - IPv4
  ipFamilyPolicy: SingleStack
  ports:
    - name: web
      port: 8080
      protocol: TCP
      targetPort: web
  selector:
    app.jumpserver.org/name: jms-core
    app.kubernetes.io/instance: jms-k8s
    app.kubernetes.io/name: jumpserver
  sessionAffinity: ClientIP
  sessionAffinityConfig:
    clientIP:
      timeoutSeconds: 10800
  type: ClusterIP

6、创建koko

6.1 Deployment

---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.jumpserver.org/name: jms-koko
    app.kubernetes.io/instance: jms-k8s
    app.kubernetes.io/name: jumpserver
    app.kubernetes.io/version: v3.1.2
  name: jms-k8s-jumpserver-jms-koko
  namespace: jumpserver
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app.jumpserver.org/name: jms-koko
      app.kubernetes.io/instance: jms-k8s
      app.kubernetes.io/name: jumpserver
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      labels:
        app.jumpserver.org/name: jms-koko
        app.kubernetes.io/instance: jms-k8s
        app.kubernetes.io/name: jumpserver
    spec:
      containers:
        - env:
            - name: CORE_HOST
              value: 'http://jms-k8s-jumpserver-jms-core:8080'
            - name: BOOTSTRAP_TOKEN
              value: 7Q11Vz6R2J6BLAdO
            - name: LOG_LEVEL
              value: ERROR
            - name: SSHD_PORT
              value: '2222'
            - name: HTTPD_PORT
              value: '5000'
            - name: REUSE_CONNECTION
              value: 'false'
            - name: SHARE_ROOM_TYPE
              value: redis
            - name: REDIS_HOST
              value: 192.168.17.80
            - name: REDIS_PORT
              value: '6379'
            - name: REDIS_PASSWORD
              value: '123456'
          image: '192.168.17.40/jumpserver/koko:v3.1.2'
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 30
            httpGet:
              path: /koko/health/
              port: web
              scheme: HTTP
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          name: jms-koko
          ports:
            - containerPort: 5000
              name: web
              protocol: TCP
            - containerPort: 2222
              name: ssh
              protocol: TCP
          readinessProbe:
            failureThreshold: 30
            httpGet:
              path: /koko/health/
              port: web
              scheme: HTTP
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          resources: {}
          securityContext:
            privileged: true
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
            - mountPath: /opt/koko/data
              name: jms-koko-data
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      serviceAccount: default
      serviceAccountName: default
      terminationGracePeriodSeconds: 30
      volumes:
        - name: jms-koko-data
          persistentVolumeClaim:
            claimName: jms-k8s-jumpserver-jms-koko-data

6.2 Service

---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.jumpserver.org/name: jms-koko
    app.kubernetes.io/instance: jms-k8s
    app.kubernetes.io/name: jumpserver
    app.kubernetes.io/version: v3.1.2
  name: jms-k8s-jumpserver-jms-koko
  namespace: jumpserver
spec:
  internalTrafficPolicy: Cluster
  ipFamilies:
    - IPv4
  ipFamilyPolicy: SingleStack
  ports:
    - name: web
      port: 5000
      protocol: TCP
      targetPort: web
    - name: ssh
      port: 2222
      protocol: TCP
      targetPort: ssh
  selector:
    app.jumpserver.org/name: jms-koko
    app.kubernetes.io/instance: jms-k8s
    app.kubernetes.io/name: jumpserver
  sessionAffinity: ClientIP
  sessionAffinityConfig:
    clientIP:
      timeoutSeconds: 10800
  type: ClusterIP

7、创建lion

7.1 Deployment

---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.jumpserver.org/name: jms-lion
    app.kubernetes.io/instance: jms-k8s
    app.kubernetes.io/name: jumpserver
    app.kubernetes.io/version: v3.1.2
  name: jms-k8s-jumpserver-jms-lion
  namespace: jumpserver
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app.jumpserver.org/name: jms-lion
      app.kubernetes.io/instance: jms-k8s
      app.kubernetes.io/name: jumpserver
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      labels:
        app.jumpserver.org/name: jms-lion
        app.kubernetes.io/instance: jms-k8s
        app.kubernetes.io/name: jumpserver
    spec:
      containers:
        - env:
            - name: CORE_HOST
              value: 'http://jms-k8s-jumpserver-jms-core:8080'
            - name: BOOTSTRAP_TOKEN
              value: 7Q11Vz6R2J6BLAdO
            - name: LOG_LEVEL
              value: ERROR
            - name: HTTPD_PORT
              value: '8081'
            - name: SHARE_ROOM_TYPE
              value: redis
            - name: REDIS_HOST
              value: 192.168.17.80
            - name: REDIS_PORT
              value: '6379'
            - name: REDIS_PASSWORD
              value: '123456'
            - name: JUMPSERVER_ENABLE_FONT_SMOOTHING
              value: 'true'
          image: '192.168.17.40/jumpserver/lion:v3.1.2'
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 30
            httpGet:
              path: /lion/health/
              port: web
              scheme: HTTP
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          name: jms-lion
          ports:
            - containerPort: 8081
              name: web
              protocol: TCP
          readinessProbe:
            failureThreshold: 30
            httpGet:
              path: /lion/health/
              port: web
              scheme: HTTP
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          resources: {}
          securityContext: {}
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
            - mountPath: /opt/lion/data
              name: jms-lion-data
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      serviceAccount: default
      serviceAccountName: default
      terminationGracePeriodSeconds: 30
      volumes:
        - name: jms-lion-data
          persistentVolumeClaim:
            claimName: jms-k8s-jumpserver-jms-lion-data

7.2 Service

---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.jumpserver.org/name: jms-lion
    app.kubernetes.io/instance: jms-k8s
    app.kubernetes.io/name: jumpserver
    app.kubernetes.io/version: v3.1.2
  name: jms-k8s-jumpserver-jms-lion
  namespace: jumpserver
spec:
  internalTrafficPolicy: Cluster
  ipFamilies:
    - IPv4
  ipFamilyPolicy: SingleStack
  ports:
    - name: web
      port: 8081
      protocol: TCP
      targetPort: web
  selector:
    app.jumpserver.org/name: jms-lion
    app.kubernetes.io/instance: jms-k8s
    app.kubernetes.io/name: jumpserver
  sessionAffinity: ClientIP
  sessionAffinityConfig:
    clientIP:
      timeoutSeconds: 10800
  type: ClusterIP

8、创建magnus

8.1 Deployment

---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.jumpserver.org/name: jms-magnus
    app.kubernetes.io/instance: jms-k8s
    app.kubernetes.io/name: jumpserver
    app.kubernetes.io/version: v3.1.2
  name: jms-k8s-jumpserver-jms-magnus
  namespace: jumpserver
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app.jumpserver.org/name: jms-magnus
      app.kubernetes.io/instance: jms-k8s
      app.kubernetes.io/name: jumpserver
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      labels:
        app.jumpserver.org/name: jms-magnus
        app.kubernetes.io/instance: jms-k8s
        app.kubernetes.io/name: jumpserver
    spec:
      containers:
        - env:
            - name: CORE_HOST
              value: 'http://jms-k8s-jumpserver-jms-core:8080'
            - name: BOOTSTRAP_TOKEN
              value: 7Q11Vz6R2J6BLAdO
            - name: LOG_LEVEL
              value: ERROR
            - name: MAGNUS_MYSQL_PORT
              value: '33061'
            - name: MAGNUS_MARIADB_PORT
              value: '33062'
            - name: MAGNUS_REDIS_PORT
              value: '63790'
            - name: MAGNUS_POSTGRESQL_PORT
              value: '54320'
            - name: MAGNUS_ORACLE_PORTS
              value: 30000-30100
          image: '192.168.17.40/jumpserver/magnus:v3.1.2'
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 30
            periodSeconds: 10
            successThreshold: 1
            tcpSocket:
              port: 9090
            timeoutSeconds: 1
          name: jms-magnus
          ports:
            - containerPort: 33061
              name: mysql
              protocol: TCP
            - containerPort: 33062
              name: mariadb
              protocol: TCP
            - containerPort: 63790
              name: redis
              protocol: TCP
            - containerPort: 54320
              name: postgresql
              protocol: TCP
            - containerPort: 30000
              name: oracle-30000
              protocol: TCP
            - containerPort: 30001
              name: oracle-30001
              protocol: TCP
            - containerPort: 30002
              name: oracle-30002
              protocol: TCP
            - containerPort: 30003
              name: oracle-30003
              protocol: TCP
            - containerPort: 30004
              name: oracle-30004
              protocol: TCP
            - containerPort: 30005
              name: oracle-30005
              protocol: TCP
            - containerPort: 30006
              name: oracle-30006
              protocol: TCP
            - containerPort: 30007
              name: oracle-30007
              protocol: TCP
            - containerPort: 30008
              name: oracle-30008
              protocol: TCP
            - containerPort: 30009
              name: oracle-30009
              protocol: TCP
            - containerPort: 30010
              name: oracle-30010
              protocol: TCP
            - containerPort: 30011
              name: oracle-30011
              protocol: TCP
            - containerPort: 30012
              name: oracle-30012
              protocol: TCP
            - containerPort: 30013
              name: oracle-30013
              protocol: TCP
            - containerPort: 30014
              name: oracle-30014
              protocol: TCP
            - containerPort: 30015
              name: oracle-30015
              protocol: TCP
            - containerPort: 30016
              name: oracle-30016
              protocol: TCP
            - containerPort: 30017
              name: oracle-30017
              protocol: TCP
            - containerPort: 30018
              name: oracle-30018
              protocol: TCP
            - containerPort: 30019
              name: oracle-30019
              protocol: TCP
            - containerPort: 30020
              name: oracle-30020
              protocol: TCP
            - containerPort: 30021
              name: oracle-30021
              protocol: TCP
            - containerPort: 30022
              name: oracle-30022
              protocol: TCP
            - containerPort: 30023
              name: oracle-30023
              protocol: TCP
            - containerPort: 30024
              name: oracle-30024
              protocol: TCP
            - containerPort: 30025
              name: oracle-30025
              protocol: TCP
            - containerPort: 30026
              name: oracle-30026
              protocol: TCP
            - containerPort: 30027
              name: oracle-30027
              protocol: TCP
            - containerPort: 30028
              name: oracle-30028
              protocol: TCP
            - containerPort: 30029
              name: oracle-30029
              protocol: TCP
            - containerPort: 30030
              name: oracle-30030
              protocol: TCP
            - containerPort: 30031
              name: oracle-30031
              protocol: TCP
            - containerPort: 30032
              name: oracle-30032
              protocol: TCP
            - containerPort: 30033
              name: oracle-30033
              protocol: TCP
            - containerPort: 30034
              name: oracle-30034
              protocol: TCP
            - containerPort: 30035
              name: oracle-30035
              protocol: TCP
            - containerPort: 30036
              name: oracle-30036
              protocol: TCP
            - containerPort: 30037
              name: oracle-30037
              protocol: TCP
            - containerPort: 30038
              name: oracle-30038
              protocol: TCP
            - containerPort: 30039
              name: oracle-30039
              protocol: TCP
            - containerPort: 30040
              name: oracle-30040
              protocol: TCP
            - containerPort: 30041
              name: oracle-30041
              protocol: TCP
            - containerPort: 30042
              name: oracle-30042
              protocol: TCP
            - containerPort: 30043
              name: oracle-30043
              protocol: TCP
            - containerPort: 30044
              name: oracle-30044
              protocol: TCP
            - containerPort: 30045
              name: oracle-30045
              protocol: TCP
            - containerPort: 30046
              name: oracle-30046
              protocol: TCP
            - containerPort: 30047
              name: oracle-30047
              protocol: TCP
            - containerPort: 30048
              name: oracle-30048
              protocol: TCP
            - containerPort: 30049
              name: oracle-30049
              protocol: TCP
            - containerPort: 30050
              name: oracle-30050
              protocol: TCP
            - containerPort: 30051
              name: oracle-30051
              protocol: TCP
            - containerPort: 30052
              name: oracle-30052
              protocol: TCP
            - containerPort: 30053
              name: oracle-30053
              protocol: TCP
            - containerPort: 30054
              name: oracle-30054
              protocol: TCP
            - containerPort: 30055
              name: oracle-30055
              protocol: TCP
            - containerPort: 30056
              name: oracle-30056
              protocol: TCP
            - containerPort: 30057
              name: oracle-30057
              protocol: TCP
            - containerPort: 30058
              name: oracle-30058
              protocol: TCP
            - containerPort: 30059
              name: oracle-30059
              protocol: TCP
            - containerPort: 30060
              name: oracle-30060
              protocol: TCP
            - containerPort: 30061
              name: oracle-30061
              protocol: TCP
            - containerPort: 30062
              name: oracle-30062
              protocol: TCP
            - containerPort: 30063
              name: oracle-30063
              protocol: TCP
            - containerPort: 30064
              name: oracle-30064
              protocol: TCP
            - containerPort: 30065
              name: oracle-30065
              protocol: TCP
            - containerPort: 30066
              name: oracle-30066
              protocol: TCP
            - containerPort: 30067
              name: oracle-30067
              protocol: TCP
            - containerPort: 30068
              name: oracle-30068
              protocol: TCP
            - containerPort: 30069
              name: oracle-30069
              protocol: TCP
            - containerPort: 30070
              name: oracle-30070
              protocol: TCP
            - containerPort: 30071
              name: oracle-30071
              protocol: TCP
            - containerPort: 30072
              name: oracle-30072
              protocol: TCP
            - containerPort: 30073
              name: oracle-30073
              protocol: TCP
            - containerPort: 30074
              name: oracle-30074
              protocol: TCP
            - containerPort: 30075
              name: oracle-30075
              protocol: TCP
            - containerPort: 30076
              name: oracle-30076
              protocol: TCP
            - containerPort: 30077
              name: oracle-30077
              protocol: TCP
            - containerPort: 30078
              name: oracle-30078
              protocol: TCP
            - containerPort: 30079
              name: oracle-30079
              protocol: TCP
            - containerPort: 30080
              name: oracle-30080
              protocol: TCP
            - containerPort: 30081
              name: oracle-30081
              protocol: TCP
            - containerPort: 30082
              name: oracle-30082
              protocol: TCP
            - containerPort: 30083
              name: oracle-30083
              protocol: TCP
            - containerPort: 30084
              name: oracle-30084
              protocol: TCP
            - containerPort: 30085
              name: oracle-30085
              protocol: TCP
            - containerPort: 30086
              name: oracle-30086
              protocol: TCP
            - containerPort: 30087
              name: oracle-30087
              protocol: TCP
            - containerPort: 30088
              name: oracle-30088
              protocol: TCP
            - containerPort: 30089
              name: oracle-30089
              protocol: TCP
            - containerPort: 30090
              name: oracle-30090
              protocol: TCP
            - containerPort: 30091
              name: oracle-30091
              protocol: TCP
            - containerPort: 30092
              name: oracle-30092
              protocol: TCP
            - containerPort: 30093
              name: oracle-30093
              protocol: TCP
            - containerPort: 30094
              name: oracle-30094
              protocol: TCP
            - containerPort: 30095
              name: oracle-30095
              protocol: TCP
            - containerPort: 30096
              name: oracle-30096
              protocol: TCP
            - containerPort: 30097
              name: oracle-30097
              protocol: TCP
            - containerPort: 30098
              name: oracle-30098
              protocol: TCP
            - containerPort: 30099
              name: oracle-30099
              protocol: TCP
            - containerPort: 30100
              name: oracle-30100
              protocol: TCP
          readinessProbe:
            failureThreshold: 30
            periodSeconds: 10
            successThreshold: 1
            tcpSocket:
              port: 9090
            timeoutSeconds: 1
          resources: {}
          securityContext: {}
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
            - mountPath: /opt/magnus/data
              name: jms-magnus-data
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      serviceAccount: default
      serviceAccountName: default
      terminationGracePeriodSeconds: 30
      
      volumes:
        - name: jms-magnus-data
          persistentVolumeClaim:
            claimName: jms-k8s-jumpserver-jms-magnus-data

8.2 Service

---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.jumpserver.org/name: jms-magnus
    app.kubernetes.io/instance: jms-k8s
    app.kubernetes.io/name: jumpserver
    app.kubernetes.io/version: v3.1.2
  name: jms-k8s-jumpserver-jms-magnus
  namespace: jumpserver
spec:
  internalTrafficPolicy: Cluster
  ipFamilies:
    - IPv4
  ipFamilyPolicy: SingleStack
  ports:
    - name: mysql
      port: 33061
      protocol: TCP
      targetPort: mysql
    - name: mariadb
      port: 33062
      protocol: TCP
      targetPort: mariadb
    - name: redis
      port: 63790
      protocol: TCP
      targetPort: redis
  selector:
    app.jumpserver.org/name: jms-magnus
    app.kubernetes.io/instance: jms-k8s
    app.kubernetes.io/name: jumpserver
  sessionAffinity: ClientIP
  sessionAffinityConfig:
    clientIP:
      timeoutSeconds: 10800
  type: ClusterIP

9、创建web

9.1 Deployment

---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.jumpserver.org/name: jms-web
    app.kubernetes.io/instance: jms-k8s
    app.kubernetes.io/name: jumpserver
    app.kubernetes.io/version: v3.1.2
  name: jms-k8s-jumpserver-jms-web
  namespace: jumpserver
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app.jumpserver.org/name: jms-web
      app.kubernetes.io/instance: jms-k8s
      app.kubernetes.io/name: jumpserver
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      labels:
        app.jumpserver.org/name: jms-web
        app.kubernetes.io/instance: jms-k8s
        app.kubernetes.io/name: jumpserver
    spec:
      containers:
        - image: '192.168.17.40/jumpserver/web:v3.1.2'
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 30
            httpGet:
              path: /api/health/
              port: web
              scheme: HTTP
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          name: jms-web
          ports:
            - containerPort: 80
              name: web
              protocol: TCP
          readinessProbe:
            failureThreshold: 30
            httpGet:
              path: /api/health/
              port: web
              scheme: HTTP
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          resources: {}
          securityContext: {}
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
            - mountPath: /etc/nginx/sites-enabled/jms.conf
              name: jms-web-config
              subPath: default.conf
            - mountPath: /opt/jumpserver/data
              name: jms-core-data
            - mountPath: /var/log/nginx
              name: jms-web-logs
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      serviceAccount: default
      serviceAccountName: default
      terminationGracePeriodSeconds: 30
      volumes:
        - configMap:
            defaultMode: 420
            name: jms-k8s-jumpserver-jms-web
          name: jms-web-config
        - name: jms-core-data
          persistentVolumeClaim:
            claimName: jms-k8s-jumpserver-jms-core-data
        - name: jms-web-logs
          persistentVolumeClaim:
            claimName: jms-k8s-jumpserver-jms-web-logs

9.2 Service

---
apiVersion: v1
kind: ---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.jumpserver.org/name: jms-web
    app.kubernetes.io/instance: jms-k8s
    app.kubernetes.io/name: jumpserver
    app.kubernetes.io/version: v3.1.2
  name: jms-k8s-jumpserver-jms-web
  namespace: jumpserver
spec:
  internalTrafficPolicy: Cluster
  ipFamilies:
    - IPv4
  ipFamilyPolicy: SingleStack
  ports:
    - name: web
      port: 80
      protocol: TCP
      targetPort: web
  selector:
    app.jumpserver.org/name: jms-web
    app.kubernetes.io/instance: jms-k8s
    app.kubernetes.io/name: jumpserver
  sessionAffinity: ClientIP
  sessionAffinityConfig:
    clientIP:
      timeoutSeconds: 10800
  type: ClusterIP
metadata:
  labels:
    app.jumpserver.org/name: jms-web
    app.kubernetes.io/instance: jms-k8s
    app.kubernetes.io/name: jumpserver
    app.kubernetes.io/version: v3.1.2
  name: jms-k8s-jumpserver-jms-web
  namespace: jumpserver
spec:
  internalTrafficPolicy: Cluster
  ipFamilies:
    - IPv4
  ipFamilyPolicy: SingleStack
  ports:
    - name: web
      port: 80
      protocol: TCP
      targetPort: web
  selector:
    app.jumpserver.org/name: jms-web
    app.kubernetes.io/instance: jms-k8s
    app.kubernetes.io/name: jumpserver
  sessionAffinity: ClientIP
  sessionAffinityConfig:
    clientIP:
      timeoutSeconds: 10800
  type: ClusterIP

10、ingress

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/configuration-snippet: |
      proxy_set_header Upgrade "websocket";
      proxy_set_header Connection "Upgrade";
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    nginx.ingress.kubernetes.io/force-ssl-redirect: 'true'
    nginx.ingress.kubernetes.io/proxy-body-size: 4096m
  labels:
    app.kubernetes.io/instance: jms-k8s
    app.kubernetes.io/name: jumpserver
    app.kubernetes.io/version: v3.1.2
    helm.sh/chart: jumpserver-3.1.2
  name: jms-k8s-jumpserver-ingress
  namespace: jumpserver
spec:
  ingressClassName: nginx
  rules:
    - host: k8s.jms
      http:
        paths:
          - backend:
              service:
                name: jms-k8s-jumpserver-jms-web
                port:
                  number: 80
            path: /
            pathType: Prefix
藏经老曾
关注
  • 0
    点赞
  • 踩
  • 1
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
专栏目录
K8S安装Jumpserver
彼岸吖的博客
04-11 1559
目录 一.Jumpserver介绍 二.安装Jumpserver K8S安装Jumpserver 源码安装Jumpserver 一.Jumpserver介绍 JumpServer 是全球首款开源的堡垒机，使用 GNU GPL v3.0 开源协议，是符合 4A 规范的运维安全审计系统。 JumpServer 使用 Python / Django 为主进行开发，遵循 Web 2.0 规范，配备了业界领先的 Web Terminal 方案，交互界面美观、用户体验好。 JumpServer 采纳
k8s集群部署jumpserver v3.3.1(helm)
qq_31292011的博客
12-11 1335
ReadWriteMany #注意，这里用ceph做动态存储的把这个参数改成ReadWriteOnce （单机访问，不然创建出来会报错，pvc），不止这里，下面还有。volume.beta.kubernetes.io/storage-class: "managed-nfs-storage" #这里改成自己的动态存储名。imageRegistry: "docker.io" # 千万别听他的用国内的，那真是一点都下载不下来。
Docker部署常见应用之企业级堡垒机JumpServer
最新发布
weixin_44585288的博客
06-09 998
Jumpserver 是中国一个开源的堡垒机系统，它是符合 4A（认证、授权、审计、资产管理）规范的专业运维安全审计系统。文章对Jumpserver做了一个简单介绍， 同时分别使用了Docker与Docker-Compose两种方式做了部署。
堡垒机软件有哪些
贺浦力特的博客
04-11 3304
堡垒机软件
K8S系列文章之 开源的堡垒机 jumpserver
Coder_Boy_的博客
08-06 1201
一、jumpserver作为一款开源的堡垒机，不管是企业还是个人，我觉得都是比较合适的，而且使用也比较简单。五、最后在说一下，可以使用堡垒机的2222端口，通过账号连接，也是比较方便的。资产添加不用细讲，主要是配置过程，举个例子，适用window系统，配置方式。四、jumpserver很不错的一个堡垒机/跳板机。目前没有看到3版本的，3版本的功能更加强大，可以官网学习一下。其他的资产和应用这里不讲，主要弄一下k8s的管理。1、安装，直接docker不是就行。a、在master节点，进行。
JumpServer离线部署
DBA小林的博客
10-02 2126
JumpServer离线部署
分享一款开源堡垒机-jumpserver
热门推荐
KH_FC的博客
01-07 1万+
JumpServer是由FIT2CLOUD（飞致远）公司旗下一款开源的堡垒机，这款也是全球首款开源的堡垒机，使用 GNU GPL v2.0 开源协议，是符合 4A 规范的运维安全审计系统，使用 Python 开发，遵循 Web 2.0 规范，配备了业界领先的 Web Terminal 方案，交互界面美观、用户体验好，同时采纳分布式架构，支持多机房跨区域部署以及横向扩展，无资产数量及并发限制。这款开源堡垒机不但提供了社区开源版本并且还提供了企业使用的企业版本，企业版功能更加强大。 飞致远官网地址：https:
kubernetes离线部署jumpserver开源堡垒机3
04-23
堡垒机介绍可以看官方网站：https://kuboard.cn/ 此文档只是部署 前提条件：此文档两个部署在192.168.17.80，可以通过查找更改成自己的。 1、mysql 5.7 mariadb 10.2 2、redis 5 下载镜像
kubernetes离线部署jumpserver开源堡垒机2
04-23
堡垒机介绍可以看官方网站：https://kuboard.cn/ 此文档只是部署 前提条件：此文档两个部署在192.168.17.80，可以通过查找更改成自己的。 1、mysql 5.7 mariadb 10.2 2、redis 5 下载镜像
Jumpserver开源堡垒机 v2.28.21.zip
03-25
总结，Jumpserver开源堡垒机v2.28.21是企业运维管理的理想选择，它的功能强大且易于部署，能有效提升运维安全性和审计能力。通过深入理解和合理应用，企业可以构建更加稳健、可控的IT环境，降低运维风险，提高运维...
jumpserver离线安装包v2.10.4.tar.gz
06-27
jumpserver安装需要使用github，将tar包下载方便离线安装
## Jumpserver开源堡垒机
09-21
## Jumpserver开源堡垒机 ###Description: Jumpserver官方版是一款由python编写开源的跳板机(堡垒机)系统，实现了跳板机应有的功能。基于ssh协议来管理，客户端无需安装agent。 Jumpserver开源堡垒机支持常见...
使用docker部署JumpServer堡垒机
极客海哥
04-27 4635
一、安装Docker 1.安装需要的软件包， yum-util 提供yum-config-manager功能，另两个是devicemapper驱动依赖 yum install -y yum-utils device-mapper-persistent-data lvm2 2.设置yum源 yum-config-manager --add-repo http://download.docker.com/linux/centos/docker-ce.repo（中央仓库） yum-config-manager
开源堡垒机jumpserver的搭建与使用
时光
09-24 6335
目录 一. 准备 Python3 和 Python 虚拟环境 二. 安装 Jumpserver 三. 安装 SSH Server 和 WebSocket Server: Coco 四. 安装 Web Terminal 前端: Luna 五. 安装 Windows 支持组件(如果不需要管理 windows 资产, 可以直接跳过这一步) 六. 配置 Nginx 整合各组件 七.J...
python、golang开发堡垒机系统
。。
12-15 1081
堡垒机系统的关键在于通过网页上连接服务器，因此在此记录下方案。 开始想用python实现后端，用过flask + paramiko + flask-socketio方案，尝试下来发现性能不行，ssh延迟比较大。 后来改成了fastapi + asyncssh，效果还行。 因为公司内用golang多些，最终用Gin框架来实现后端。 rdp协议连接用了Guacamole。 前端用了vue + xterm + socketio
k8s部署jumpserver跳板机系统
浅抒流年的博客
06-09 3182
随着公司本地测试环境虚出来的服务器越来越多，所以近日用k8s部署了jumpserver跳板机系统来管理这些虚机，主要涉及到4个文件。 1.因为涉及到回放录像需要保存的问题，所以采用nfs来创建pvc声明，挂载到容器中响应的目录中 pvc声明配置如下： jumpserver-pvc.yaml apiVersion: v1 kind: PersistentVolumeClaim metadata: name: jumpserver-datadir namespace: omc annotations
OpenStack容器网络项目Kuryr（libnetwork）
iqifenxia的博客
11-01 408
1
Docker CE/EE 原生支持Kubernetes
CSDN云计算
10-18 8116
在今天的 DockerCon EU (2017) 上，Solomon宣布Docker 将原生支持 Kubernetes，也就是说 Kubernetes 将和 Swarm 一样作为 Docker 平台的编排管理系统。这包括Docker EE、Docker CE以及Docker for Mac/Windows等全平台的支持。 Docker for Mac/Wi

“相关推荐”对你有帮助么？

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值