从0搭建nacos单点、集群
| 主机IP | 主机名 |
|---|---|
| 10.0.0.91 | elk91 |
| 10.0.0.92 | elk92 |
| 10.0.0.93 | elk93 |
nacos单机部署使用内置数据库
1.下载解压nacos
[root@elk91 ~]# wget https://github.com/alibaba/nacos/releases/download/2.5.1/nacos-server-2.5.1.tar.gz
[root@elk91 ~]# tar xf nacos-server-2.5.1.tar.gz -C /usr/local
2.启动nacos单机版
[root@elk91 ~]# /usr/local/nacos/bin/startup.sh -m standalone
#查看日志
[root@elk91 ~]# tail -100f /usr/local/nacos/logs/start.out
#如下字样即为成功
,--.
,--.'|
,--,: : | Nacos 2.5.1
,`--.'`| ' : ,---. Running in stand alone mode, All function modules
| : : | | ' ,'\ .--.--. Port: 8848
: | \ | : ,--.--. ,---. / / | / / ' Pid: 58224
| : ' '; | / \ / \. ; ,. :| : /`./ Console: http://10.0.0.91:8848/nacos/index.html
' ' ;. ;.--. .-. | / / '' | |: :| : ;_
| | | \ | \__\/: . .. ' / ' | .; : \ \ `. https://nacos.io
' : | ; .' ," .--.; |' ; :__| : | `----. \
| | '`--' / / ,. |' | '.'|\ \ / / /`--' /
' : | ; : .' \ : : `----' '--'. /
; |.' | , .-./\ \ / `--'---'
'---' `--`---' `----'
2025-03-18 09:40:05,502 INFO Tomcat initialized with port(s): 8848 (http)
4.访问nacos的WebUI
http://10.0.0.91:8848/nacos/
Nacos启动脚本编写
1.编写启动脚本
cat > /lib/systemd/system/nacos.service <<EOF
[Unit]
Description=nacos.service
After=network.target
[Service]
Type=forking
Environment=JAVA_HOME=/usr/share/elasticsearch/jdk
ExecStart=/usr/local/nacos/bin/startup.sh -m standalone
ExecStop=/usr/local/nacos/bin/shutdown.sh
[Install]
WantedBy=multi-user.target
EOF
2.配置开机自启动
[root@elk91 ~]# systemctl daemon-reload
[root@elk91 ~]# systemctl enable --now nacos.service
[root@elk91 ~]# ss -ntl | grep 8848
LISTEN 0 100 *:8848 *:*
在93节点部署数据库
#安装软件包
[root@elk93 ~]# wget https://dev.mysql.com/get/Downloads/MySQL-8.4/mysql-8.4.4-linux-glibc2.28-x86_64.tar.xz
[root@elk93 ~]# tar xf mysql-8.4.4-linux-glibc2.28-x86_64.tar.xz -C /usr/local/
#准备启动脚本并授权
[root@elk93 ~]# cp /usr/local/mysql-8.4.4-linux-glibc2.28-x86_64/support-files/mysql.server /etc/init.d/
[root@elk93 ~]# egrep "^basedir=|^datadir=" /etc/init.d/mysql.server
basedir=/usr/local/mysql844
datadir=/var/lib/mysql
[root@elk93 ~]# useradd -m mysql
[root@elk93 ~]# install -d /var/lib/mysql -o mysql -g mysql
[root@elk93 ~]# ll /var/lib/mysql/ -d
drwxr-xr-x 2 mysql mysql 4096 Mar 13 09:52 /var/lib/mysql/
#准备配置文件
[root@elk93 ~]# cat /etc/my.cnf
[mysqld]
basedir=/usr/local/mysql844
datadir=/var/lib/mysql
socket=/tmp/mysql80.sock
port=3306
[client]
socket=/tmp/mysql80.sock
#启动MySQL服务
[root@elk93 ~]# cat /etc/profile.d/mysql.sh
#!/bin/bash
export MYSQL_HOME=/usr/local/mysql844
export PATH=$PATH:$MYSQL_HOME/bin
[root@elk93 ~]# source /etc/profile.d/mysql.sh
[root@elk93 ~]# ln -svf /usr/local/mysql-8.4.4-linux-glibc2.28-x86_64/ /usr/local/mysql844
[root@elk93 ~]# mysqld --initialize-insecure --user=mysql --datadir=/var/lib/mysql --basedir=/usr/local/mysql844
[root@elk93 ~]# /etc/init.d/mysql.server start
[root@elk93 ~]# ss -ntl | grep 3306
LISTEN 0 151 *:3306 *:*
LISTEN 0 70 *:33060 *:*
nacos配置MySQL作为数据源
1.停止刚刚启动的nacos服务
root@elk91:~# /usr/local/nacos/bin/shutdown.sh
The nacosServer(40151) is running...
Send shutdown request to nacosServer(40151) OK
2.拷贝nacos的SQL初始化语句
[root@elk91 ~]# scp /usr/local/nacos/conf/mysql-schema.sql 10.0.0.93:~
3.创建用户并授权，导入SQL语句
[root@elk93 ~]# mysql
mysql> CREATE DATABASE nacos;
mysql> CREATE USER nacos IDENTIFIED WITH mysql_native_password by 'dingzhiyan';
mysql> GRANT ALL ON nacos.* TO nacos;
[root@elk93 ~]# mysql nacos < mysql-schema.sql
4.修改nacos的配置文件
[root@elk91 ~]# vim /usr/local/nacos/conf/application.properties
# 修改nacos的访问站点
server.servlet.contextPath=/
...
# 指定数据库的类型是MySQL
spring.sql.init.platform=mysql
# 数据库的数量，官方写的是1，此处我也写1.
db.num=1
# 指定数据库的主机，端口，数据库及相关参数。
db.url.0=jdbc:mysql://10.0.0.93:3306/nacos?characterEncoding=utf8&connectTimeout=1000&socketTimeout=3000&autoReconnect=true&useUnic ode=true&useSSL=false&serverTimezone=Asia/Shanghai
# 指定数据库的用户名
db.user.0=nacos
# 指定数据库的密码
db.password.0=dingzhiyan
5.重启nacos
[root@elk91 ~]# systemctl restart nacos.service
6.访问nacos的WebUI
http://10.0.0.91:8848/
7.写入配置信息观察MySQL数据库是否有数据存储
#在此查询，应有刚刚写入的信息
mysql> SELECT * FROM config_info;
nacos配置认证功能及RBAC实战
1.nacos认证概述
Nacos是一个内部微服务组件，需要在可信的内部网络中运行，不可暴露在公网环境，防止带来安全风险。
Nacos提供简单的鉴权实现，为防止业务错用的弱鉴权体系，不是防止恶意攻击的强鉴权体系。
如果运行在不可信的网络环境或者有强鉴权诉求，请参考官方简单实现做替换增强。
参考链接:
https://nacos.io/zh-cn/docs/auth.html
2.生成toke的值
自定义密钥时，推荐将配置项设置为Base64编码的字符串，且原始密钥长度不得低于32字符。
[root@elk91 ~]# openssl rand -base64 33
428Gjk5EGkADiPC+577iPOH49V1lGzDSN+gW8ggvUOyo
3.修改Nacos的配置文件
[root@elk91 ~]# tail -5 /usr/local/nacos/conf/application.properties
nacos.core.auth.system.type=nacos
#启用认证功能
nacos.core.auth.enabled=true
#设置 Nacos 服务器的身份验证密钥
nacos.core.auth.server.identity.key=yinzhengjie
#设置 Nacos 服务器的身份验证值
nacos.core.auth.server.identity.value=yinzhengjie
nacos.core.auth.plugin.nacos.token.secret.key=428Gjk5EGkADiPC+577iPOH49V1lGzDSN+gW8ggvUOyo
4.重启nacos
[root@elk91 ~]# systemctl restart nacos.service
5.登录测试
6.设置初始密码登录
- 若使用默认设置，默认用户名密码均为nacos
nacos集群基于haproxy实现高可用实战
1.在单点的配置上修改配置文件
[root@elk91 ~]# cat /usr/local/nacos/conf/cluster.conf
10.0.0.91:8848
10.0.0.92:8848
10.0.0.93:8848
2.拷贝nacos程序
[root@elk91 ~]# scp -r /usr/local/nacos/ 10.0.0.92:/usr/local/
[root@elk91 ~]# scp -r /usr/local/nacos/ 10.0.0.93:/usr/local/
3.停止单点的nacos
[root@elk91 ~]# systemctl disable --now nacos.service
4.所有节点以集群的方式启动
①所有节点启动
/usr/local/nacos/bin/startup.sh -p embedded
注：默认就是以集群的方式启动，此处的-p直接指定了以集群方式启动
②访问验证
http://10.0.0.91:8848/#/clusterManagement
http://10.0.0.92:8848/#/clusterManagement
http://10.0.0.93:8848/#/clusterManagement
5.所有节点配置haproxy实现负载均衡
①修改内核参数
echo net.ipv4.ip_nonlocal_bind = 1 >> /etc/sysctl.d/nacos.conf
sysctl -f /etc/sysctl.d/nacos.conf
sysctl -q net.ipv4.ip_nonlocal_bind
②安装配置haproxy
apt -y install haproxy
③修改haproxy的配置文件
[root@elk91 ~]# tail -13 /etc/haproxy/haproxy.cfg
listen status
mode http
bind 0.0.0.0:9999
stats enable
log global
stats uri /ruok
stats auth admin:dingzhiyan
listen nacos
bind 10.0.0.66:18848
server elk91 10.0.0.91:8848 check
server elk92 10.0.0.92:8848 check
server elk93 10.0.0.93:8848 check
[root@elk91 ~]# scp /etc/haproxy/haproxy.cfg 10.0.0.92:/etc/haproxy
[root@elk91 ~]# scp /etc/haproxy/haproxy.cfg 10.0.0.93:/etc/haproxy
6.配置抢占式keepalived实现高可用
①在三台服务器上安装配置keepalived实现高可用
apt -y install keepalived
②修改keepalived的配置文件
[root@elk91 ~]# cat /etc/keepalived/keepalived.conf
! Configuration File for keepalived
global_defs {
router_id 10.0.0.91
}
vrrp_script chk_haproxy {
script "killall -0 haproxy"
interval 2
weight -20
}
vrrp_instance VI_1 {
state MASTER
interface eth0
virtual_router_id 251
priority 100
advert_int 1
mcast_src_ip 10.0.0.91
nopreempt
authentication {
auth_type PASS
auth_pass dingzhiyan
}
track_script {
chk_haproxy
}
virtual_ipaddress {
10.0.0.66
}
}
[root@elk91 ~]#
[root@elk92 ~]# cat /etc/keepalived/keepalived.conf
! Configuration File for keepalived
global_defs {
router_id 10.0.0.92
}
vrrp_script chk_haproxy {
script "killall -0 haproxy"
interval 2
weight -20
}
vrrp_instance VI_1 {
state BACKUP
interface eth0
virtual_router_id 251
priority 80
advert_int 1
mcast_src_ip 10.0.0.92
nopreempt
authentication {
auth_type PASS
auth_pass dingzhiyan
}
track_script {
chk_haproxy
}
virtual_ipaddress {
10.0.0.66
}
}
[root@elk92 ~]#
[root@elk93 ~]# cat /etc/keepalived/keepalived.conf
! Configuration File for keepalived
global_defs {
router_id 10.0.0.93
}
vrrp_script chk_haproxy {
script "killall -0 haproxy"
interval 2
weight -20
}
vrrp_instance VI_1 {
state BACKUP
interface eth0
virtual_router_id 251
priority 60
advert_int 1
mcast_src_ip 10.0.0.93
nopreempt
authentication {
auth_type PASS
auth_pass yinzhengjie
}
track_script {
chk_haproxy
}
virtual_ipaddress {
10.0.0.66
}
}
③重启keepalived服务使得配置生效
[root@elk91 ~]# systemctl enable --now keepalived
[root@elk92 ~]# systemctl enable --now keepalived
[root@elk93 ~]# systemctl enable --now keepalived
⑤启动haproxy负载均衡器
systemctl restart haproxy.service
ss -ntl | grep 18848
LISTEN 0 4096 10.0.0.66:18848 0.0.0.0:*
7.访问测试验证
http://10.0.0.66:18848/#/login
8.验证高可用
[root@elk91 ~]# systemctl stop keepalived
本文来自博客园，作者：丁志岩，转载请注明原文链接：https://www.cnblogs.com/dezyan/p/18797054
浙公网安备 33010602011771号