ืคึผืจืึธื”ืึธืกื˜ืขืจ > ื‘ืœืึธื’ > ืึทื“ืžื™ื ื™ืกื˜ืจืึทืฆื™ืข > ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ืึท ื ืึธืžืึทื“ ืงื ื•ื™ืœ ื ื™ืฆืŸ ืงืึธื ืกื•ืœ ืื•ืŸ ื™ื ื˜ืึทื’ืจื™ื™ื˜ื™ื ื’ ืžื™ื˜ Gitlab

ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ืึท ื ืึธืžืึทื“ ืงื ื•ื™ืœ ื ื™ืฆืŸ ืงืึธื ืกื•ืœ ืื•ืŸ ื™ื ื˜ืึทื’ืจื™ื™ื˜ื™ื ื’ ืžื™ื˜ Gitlab

ื”ืงื“ืžื”

ืœืขืฆื˜ื ืก, ื“ื™ ืคึผืึธืคึผื•ืœืึทืจื™ื˜ืขื˜ ืคื•ืŸ Kubernetes ืื™ื– ืจืึทืคึผืึทื“ืœื™ ื’ืจืึธื•ื™ื ื’ - ืžืขืจ ืื•ืŸ ืžืขืจ ืคึผืจืึทื“ื–ืฉืขืงืก ื™ืžืคึผืœืึทืžืขื ื™ื ื’ ืขืก. ืื™ืš ื”ืึธื‘ ื’ืขื•ื•ืึธืœื˜ ืึธื ืจื™ืจืŸ ืึทืŸ ืึธืจืงืขืกื˜ืจืึทื˜ืึธืจ ื•ื•ื™ Nomad: ืขืก ืื™ื– ื’ืื ืฅ ืคึฟืึทืจ ืคึผืจืึทื“ื–ืฉืขืงืก ื•ื•ืึธืก ื ื•ืฆืŸ ืฉื•ื™ืŸ ืื ื“ืขืจืข ืกืึทืœื•ืฉืึทื ื– ืคื•ืŸ HashiCorp, ืœืžืฉืœ, Vault ืื•ืŸ Consul, ืื•ืŸ ื“ื™ ืคึผืจืึทื“ื–ืฉืขืงืก ื–ื™ืš ื–ืขื ืขืŸ ื ื™ืฉื˜ ืงืึธืžืคึผืœื™ืฆื™ืจื˜ ืื™ืŸ ื˜ืขืจืžื™ื ืขืŸ ืคื•ืŸ ื™ื ืคืจืึทืกื˜ืจืึทืงื˜ืฉืขืจ. ื“ืขืจ ืžืึทื˜ืขืจื™ืึทืœ ื•ื•ืขื˜ ืึทื ื˜ื”ืึทืœื˜ืŸ ืื™ื ืกื˜ืจื•ืงืฆื™ืขืก ืคึฟืึทืจ ื™ื ืกื˜ืึธืœื™ื ื’ ื ืึธืžืึทื“, ืงืึทืžื‘ื™ื™ื ื™ื ื’ ืฆื•ื•ื™ื™ ื ืึธื•ื“ื– ืื™ืŸ ืึท ืงื ื•ื™ืœ, ืื•ืŸ ื™ื ื˜ืึทื’ืจื™ื™ื˜ื™ื ื’ ื ืึธืžืึทื“ ืžื™ื˜ ื’ื™ื˜ืœืึทื‘.

ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ืึท ื ืึธืžืึทื“ ืงื ื•ื™ืœ ื ื™ืฆืŸ ืงืึธื ืกื•ืœ ืื•ืŸ ื™ื ื˜ืึทื’ืจื™ื™ื˜ื™ื ื’ ืžื™ื˜ Gitlab

ื˜ืขืกื˜ ืฉื˜ื™ื™ืŸ

ื ื‘ื™ืกืœ ื•ื•ืขื’ืŸ ื“ื™ ืคึผืจืึธื‘ืข ื‘ืึทื ืง: ื“ืจื™ื™ ื•ื•ื™ืจื˜ื•ืึทืœ ืกืขืจื•ื•ืขืจืก ื–ืขื ืขืŸ ื’ืขื ื™ืฆื˜ ืžื™ื˜ ื“ื™ ืงืขืจืึทืงื˜ืขืจื™ืกื˜ื™ืงืก ืคื•ืŸ 2 ืงืคึผื•, 4 ื‘ืึทืจืึทืŸ, 50 ื’ื‘ ืกืกื“, ืคึฟืึทืจืื™ื™ื ื™ืงื˜ืข ืื™ืŸ ืึท ืคึผืจืึธืกื˜ ื”ื™ื’ืข ื ืขืฅ. ื–ื™ื™ืขืจ ื ืขืžืขืŸ ืื•ืŸ IP ืึทื“ืจืขืกืขืก:

  1. nomad-livelinux-01: ืงืกื ื•ืžืงืก
  2. nomad-livelinux-02: ืงืกื ื•ืžืงืก
  3. consul-livelinux-01: ืงืกื ื•ืžืงืก

ื™ื ืกื˜ืึทืœื™ืจื•ื ื’ ืคื•ืŸ ื ืึธืžืึทื“, ืงืึธื ืกื•ืœ. ืฉืึทืคึฟืŸ ืึท ื ืึธืžืึทื“ ืงื ื•ื™ืœ

ื–ืืœ ืก ืึธื ื”ื™ื™ื‘ืŸ ืžื™ื˜ ื“ื™ ื™ืงืขืจื“ื™ืง ื™ื ืกื˜ืึทืœื™ืจื•ื ื’. ื›ืึธื˜ืฉ ื“ื™ ืกืขื˜ืึทืคึผ ืื™ื– ืคึผืฉื•ื˜, ืื™ืš ื•ื•ืขืœ ื‘ืึทืฉืจื™ื™ึทื‘ืŸ ืขืก ืคึฟืึทืจ ื“ื™ ืึธืจื ื˜ืœืขื›ืงื™ื™ึทื˜ ืคื•ืŸ ื“ืขื ืึทืจื˜ื™ืงืœ: ืขืก ืื™ื– ื’ืขื•ื•ืขืŸ ื™ืกืขื ืฉืึทืœื™ ื‘ืืฉืืคืŸ ืคึฟื•ืŸ ื“ืจืึทืคืฅ ืื•ืŸ ื”ืขืจื•ืช ืคึฟืึทืจ ืฉื ืขืœ ืึทืงืกืขืก ื•ื•ืขืŸ ื“ืืจืฃ.

ืื™ื™ื“ืขืจ ืžื™ืจ ืึธื ื”ื™ื™ื‘ืŸ ืคื™ืจ, ืžื™ืจ ื•ื•ืขืœืŸ ื“ื™ืกืงื•ื˜ื™ืจืŸ ื“ื™ ื˜ืขืึธืจืขื˜ื™ืฉ ื˜ื™ื™ืœ, ื•ื•ื™ื™ึทืœ ืื™ืŸ ื“ืขื ื‘ื™ื ืข ืขืก ืื™ื– ื•ื•ื™ื›ื˜ื™ืง ืฆื• ืคึฟืึทืจืฉื˜ื™ื™ืŸ ื“ื™ ืฆื•ืงื•ื ืคึฟื˜ ืกื˜ืจื•ืงื˜ื•ืจ.

ืžื™ืจ ื”ืึธื‘ืŸ ืฆื•ื•ื™ื™ ื ืึธื•ืžืึทื“ ื ืึธื•ื“ื– ืื•ืŸ ืžื™ืจ ื•ื•ื™ืœืŸ ืฆื• ืคืึทืจื‘ื™ื ื“ืŸ ื–ื™ื™ ืื™ืŸ ืึท ืงื ื•ื™ืœ, ืื•ืŸ ืื™ืŸ ื“ืขืจ ืฆื•ืงื•ื ืคึฟื˜ ืžื™ืจ ื•ื•ืขืœืŸ ืื•ื™ืš ื“ืึทืจืคึฟืŸ ืึธื˜ืึทืžืึทื˜ื™ืง ืงื ื•ื™ืœ ืกืงื™ื™ืœื™ื ื’ - ืคึฟืึทืจ ื“ืขื ืžื™ืจ ื“ืึทืจืคึฟืŸ ืงืึธื ืกื•ืœ. ืžื™ื˜ ื“ืขื ื’ืขืฆื™ื™ึทื’, ืงืœืึทืกื˜ืขืจื™ื ื’ ืื•ืŸ ืึทื“ื™ื ื’ ื ื™ื™ึท ื ืึธื•ื“ื– ื•ื•ืขืจื˜ ืึท ื–ื™ื™ืขืจ ืคึผืฉื•ื˜ ืึทืจื‘ืขื˜: ื“ื™ ื‘ืืฉืืคืŸ ื ืึธืžืึทื“ ื ืึธื“ืข ืงืึทื ืขืงืฅ ืฆื• ื“ื™ ืงืึธื ืกื•ืœ ืึทื’ืขื ื˜ ืื•ืŸ ื“ืขืจื ืึธืš ืงืึทื ืขืงืฅ ืฆื• ื“ื™ ื™ื’ื–ื™ืกื˜ื™ื ื’ ื ืึธืžืึทื“ ืงื ื•ื™ืœ. ื“ืขืจื™ื‘ืขืจ, ืื™ืŸ ื“ื™ ืึธื ื”ื™ื™ื‘ ืžื™ืจ ื•ื•ืขืœืŸ ื™ื ืกื˜ืึทืœื™ืจืŸ ื“ื™ ืงืึธื ืกื•ืœ ืกืขืจื•ื•ืขืจ, ืงืึทื ืคื™ื’ื™ืขืจ ื™ืงืขืจื“ื™ืง http ื“ืขืจืœื•ื™ื‘ืขื ื™ืฉ ืคึฟืึทืจ ื“ื™ ื•ื•ืขื‘ ื˜ืึทืคืœื™ืข (ืขืก ืื™ื– ืึธืŸ ื“ืขืจืœื•ื™ื‘ืขื ื™ืฉ ื“ื•ืจืš ืคืขืœื™ืงื™ื™ึทื˜ ืื•ืŸ ืงืขื ืขืŸ ื–ื™ื™ืŸ ืึทืงืกืขืกื˜ ืื™ืŸ ืึท ืคื•ื ื“ืจื•ื™ืกื ื“ื™ืง ืึทื“ืจืขืก), ื•ื•ื™ ื’ืขื–ื•ื ื˜ ื•ื•ื™ ื“ื™ ืงืึธื ืกื•ืœ ืื’ืขื ื˜ืŸ ื–ื™ืš ืื•ื™ืฃ ื ืึธืžืึทื“ ืกืขืจื•ื•ืขืจืก, ื ืึธืš ื•ื•ืึธืก ืžื™ืจ ื•ื•ืขืœืŸ ื ืึธืจ ื’ื™ื™ื  ื•ื•ื™ื™ึทื˜ืขืจ ืฆื• ื ืึธืžืึทื“.

ื™ื ืกื˜ืึธืœื™ื ื’ ื“ื™ ืžื›ืฉื™ืจื™ื ืคื•ืŸ HashiCorp ืื™ื– ื–ื™ื™ืขืจ ืคึผืฉื•ื˜: ื™ืกืขื ืฉืึทืœื™, ืžื™ืจ ื ืึธืจ ืžืึทืš ื“ื™ ื‘ื™ื™ื ืขืจื™ ื˜ืขืงืข ืฆื• ื“ื™ ื‘ื™ืŸ ื•ื•ืขื’ื•ื•ื™ื™ึทื–ืขืจ, ืฉื˜ืขืœืŸ ื“ื™ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ื˜ืขืงืข ืคื•ืŸ โ€‹โ€‹ื“ื™ ื’ืขืฆื™ื™ึทื’ ืื•ืŸ ืฉืึทืคึฟืŸ ื“ื™ ืกืขืจื•ื•ื™ืก ื˜ืขืงืข.

ืืจืืคืงืืคื™ืข ื“ื™ ืงืึธื ืกื•ืœ ื‘ื™ื™ื ืขืจื™ ื˜ืขืงืข ืื•ืŸ ืึทื ืคึผืึทืง ืขืก ืื™ืŸ ื“ืขืจ ื‘ืึทื ื™ืฆืขืจ 'ืก ื”ื™ื™ื ื•ื•ืขื’ื•ื•ื™ื™ึทื–ืขืจ:

root@consul-livelinux-01:~# wget https://releases.hashicorp.com/consul/1.5.0/consul_1.5.0_linux_amd64.zip
root@consul-livelinux-01:~# unzip consul_1.5.0_linux_amd64.zip
root@consul-livelinux-01:~# mv consul /usr/local/bin/

ืื™ืฆื˜ ืžื™ืจ ื”ืึธื‘ืŸ ืึท ืคืึทืจื˜ื™ืง ืงืึธื ืกื•ืœ ื‘ื™ื™ื ืขืจื™ ืคึฟืึทืจ ื•ื•ื™ื™ึทื˜ืขืจ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ.

ืฆื• ืึทืจื‘ืขื˜ืŸ ืžื™ื˜ ืงืึธื ืกื•ืœ, ืžื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ืฉืึทืคึฟืŸ ืึท ื™ื™ื ืฆื™ืง ืฉืœื™ืกืœ ืžื™ื˜ ื“ื™ ืงื™ื™ื’ืขืŸ ื‘ืึทืคึฟืขืœ:

root@consul-livelinux-01:~# consul keygen

ืœืึธืžื™ืจ ืคืึธืจื–ืขืฆืŸ ืฆื• ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ื“ื™ ืงืึธื ืกื•ืœ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ, ืงืจื™ื™ื™ื˜ื™ื ื’ ืึท ื•ื•ืขื’ื•ื•ื™ื™ึทื–ืขืจ /etc/consul.d/ ืžื™ื˜ ื“ื™ ืคืืœื’ืขื ื“ืข ืกื˜ืจื•ืงื˜ื•ืจ:

/etc/consul.d/
โ”œโ”€โ”€ bootstrap
โ”‚   โ””โ”€โ”€ config.json

ื“ื™ ื‘ืึธืึธื˜ืกื˜ืจืึทืคึผ ื•ื•ืขื’ื•ื•ื™ื™ึทื–ืขืจ ื•ื•ืขื˜ ืึทื ื˜ื”ืึทืœื˜ืŸ ืึท ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ื˜ืขืงืข config.json - ืื™ืŸ ืขืก ืžื™ืจ ืฉื˜ืขืœืŸ ื“ื™ ืงืึธื ืกื•ืœ ืกืขื˜ื˜ื™ื ื’ืก. ื–ื™ื™ึทืŸ ืื™ื ื”ืึทืœื˜:

{
"bootstrap": true,
"server": true,
"datacenter": "dc1",
"data_dir": "/var/consul",
"encrypt": "your-key",
"log_level": "INFO",
"enable_syslog": true,
"start_join": ["172.30.0.15"]
}

ื–ืืœ ืก ืงื•ืง ื‘ื™ื™ึท ื“ื™ ื”ื•ื™ืคึผื˜ ื“ื™ื™ืจืขืงื˜ื™ื•ื•ื– ืื•ืŸ ื–ื™ื™ืขืจ ืžื™ื ื™ื ื’ื– ืกืขืคึผืขืจืึทื˜ืœื™:

  • ืฉื˜ื™ื•ื•ืœ: ืืžืช. ืžื™ืจ ื’ืขื‘ืŸ ืึธื˜ืึทืžืึทื˜ื™ืง ืึทื“ื™ืฉืึทืŸ ืคื•ืŸ ื ื™ื™ึท ื ืึธื•ื“ื– ืื•ื™ื‘ ื–ื™ื™ ื–ืขื ืขืŸ ืงืึธื ื ืขืงื˜ืขื“. ืื™ืš ื˜ืึธืŸ ืึทื– ืžื™ืจ ื˜ืึธืŸ ื ื™ื˜ ืึธื ื•ื•ื™ื™ึทื–ืŸ ื“ืึธ ื“ื™ ืคึผื™ื ื˜ืœืขืš ื ื•ืžืขืจ ืคื•ืŸ ื“ืขืจื•ื•ืึทืจื˜ ื ืึธื•ื“ื–.
  • ืฉืœื™ื—: ืืžืช. ื’ืขื‘ืŸ ืกืขืจื•ื•ืขืจ ืžืึธื“ืข. ืงืึธื ืกื•ืœ ืื•ื™ืฃ ื“ืขื ื•ื•ื™ืจื˜ื•ืึทืœ ืžืึทืฉื™ืŸ ื•ื•ืขื˜ ื–ื™ื™ืŸ ื“ืขืจ ื‘ืœื•ื™ื– ืกืขืจื•ื•ืขืจ ืื•ืŸ ื‘ืขืœ ืื™ืŸ ื“ืขื ืžืึธืžืขื ื˜, ื“ื™ VM ืคื•ืŸ Nomad ื•ื•ืขื˜ ื–ื™ื™ืŸ ื“ื™ ืงืœื™ื™ืึทื ืฅ.
  • datacenter: dc1. ืกืคึผืขืฆื™ืคื™ืฆื™ืจืŸ ื“ื™ ื ืึธืžืขืŸ ืคื•ืŸ ื“ื™ ื“ืึทื˜ืŸ ืฆืขื ื˜ืขืจ ืฆื• ืฉืึทืคึฟืŸ ื“ืขื ืงื ื•ื™ืœ. ืขืก ืžื•ื–ืŸ ื–ื™ื™ืŸ ื™ื™ื“ืขื ื™ืงืึทืœ ืื•ื™ืฃ ื‘ื™ื™ื“ืข ืงืœื™ื™ืึทื ืฅ ืื•ืŸ ืกืขืจื•ื•ืขืจืก.
  • ืขื ืงืจื™ืคึผื˜: ื“ื™ื™ืŸ ืฉืœื™ืกืœ. ื“ืขืจ ืฉืœื™ืกืœ, ื•ื•ืึธืก ืžื•ื–ืŸ ืื•ื™ืš ื–ื™ื™ืŸ ื™ื™ื ืฆื™ืง ืื•ืŸ ื’ืœื™ื™ึทื›ืŸ ืื•ื™ืฃ ืึทืœืข ืงืœื™ื™ืึทื ืฅ ืื•ืŸ ืกืขืจื•ื•ืขืจืก. ื“ื–ืฉืขื ืขืจื™ื™ื˜ืึทื“ ืžื™ื˜ ื“ื™ ืงืึธื ืกื•ืœ ืงื™ื™ื’ืขืŸ ื‘ืึทืคึฟืขืœ.
  • start_join. ืื™ืŸ ื“ืขืจ ืจืฉื™ืžื” ืžื™ืจ ืึธื ื•ื•ื™ื™ึทื–ืŸ ืึท ืจืฉื™ืžื” ืคื•ืŸ IP ืึทื“ืจืขืกืขืก ืฆื• ื•ื•ืึธืก ื“ื™ ืงืฉืจ ื•ื•ืขื˜ ื–ื™ื™ืŸ ื’ืขืžืื›ื˜. ื“ืขืจืฐืฒ ืœ ืœืื– ืŸ ืžื™ ืจ ื ื ืจ ืื•ื ื“ื–ืข ืจ ืืฒื’ืขื ืข ื ืื“ืจืขืก .

ืื™ืŸ ื“ืขื ืคื•ื ื˜ ืžื™ืจ ืงืขื ืขืŸ ืœื•ื™ืคืŸ ืงืึธื ืกื•ืœ ื ื™ืฆืŸ ื“ื™ ื‘ืึทืคึฟืขืœืŸ ืฉื•ืจื”:

root@consul-livelinux-01:~# /usr/local/bin/consul agent -config-dir /etc/consul.d/bootstrap -ui

ื“ืึธืก ืื™ื– ืึท ื’ื•ื˜ ื•ื•ืขื’ ืฆื• ื“ื™ื‘ื•ื’ ืื™ืฆื˜, ืึธื‘ืขืจ, ืื™ืจ ื•ื•ืขื˜ ื ื™ืฉื˜ ืงืขื ืขืŸ ืฆื• ื ื•ืฆืŸ ื“ืขื ืื•ืคึฟืŸ ืื•ื™ืฃ ืึท ืึธื ื’ืึธื™ื ื’ ื™ืงืขืจ ืคึฟืึทืจ ืงืœืึธืจ ื•ื•ื™ ื“ืขืจ ื˜ืึธื’ ืกื™ื‘ื•ืช. ืœืึธืžื™ืจ ืฉืึทืคึฟืŸ ืึท ืกืขืจื•ื•ื™ืก ื˜ืขืงืข ืฆื• ืคื™ืจืŸ ืงืึธื ืกื•ืœ ื“ื•ืจืš ืกื™ืกื˜ืขืž:

root@consul-livelinux-01:~# nano /etc/systemd/system/consul.service

ืื™ื ื”ืึทืœื˜ ืคื•ืŸ ื“ื™ consul.service ื˜ืขืงืข: 

[Unit]
Description=Consul Startup process
After=network.target
 
[Service]
Type=simple
ExecStart=/bin/bash -c '/usr/local/bin/consul agent -config-dir /etc/consul.d/bootstrap -ui' 
TimeoutStartSec=0
 
[Install]
WantedBy=default.target

ืงืึทื˜ืขืจ ืงืึธื ืกื•ืœ ื“ื•ืจืš systemctl:

root@consul-livelinux-01:~# systemctl start consul

ืœืึธืžื™ืจ ืงืึธื ื˜ืจืึธืœื™ืจืŸ: ืื•ื ื“ื–ืขืจ ื“ื™ื ืกื˜ ืžื•ื–ืŸ ื–ื™ื™ืŸ ืคืœื™ืกื ื“ื™ืง, ืื•ืŸ ื“ื•ืจืš ืขืงืกืึทืงื™ื•ื˜ื™ื ื’ ื“ื™ ืงืึธื ืกื•ืœ ืžื™ื˜ื’ืœื™ื“ืขืจ ื‘ืึทืคึฟืขืœ ืžื™ืจ ื–ืึธืœ ื–ืขืŸ ืื•ื ื“ื–ืขืจ ืกืขืจื•ื•ืขืจ:

root@consul-livelinux:/etc/consul.d# consul members
consul-livelinux    172.30.0.15:8301  alive   server  1.5.0  2         dc1  <all>

ื•ื•ื™ื™ึทื˜ืขืจ ื‘ื™ื ืข: ื™ื ืกื˜ืึธืœื™ื ื’ Nginx ืื•ืŸ ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ืคึผืจืึทืงืกื™ืกื™ื ื’ ืื•ืŸ ื”ื˜ื˜ืคึผ ื“ืขืจืœื•ื™ื‘ืขื ื™ืฉ. ืžื™ืจ ื™ื ืกื˜ืึทืœื™ืจืŸ nginx ื“ื•ืจืš ื“ื™ ืคึผืขืงืœ ืคืึทืจื•ื•ืึทืœื˜ืขืจ ืื•ืŸ ืื™ืŸ ื“ื™ /etc/nginx/sites-enabled ื•ื•ืขื’ื•ื•ื™ื™ึทื–ืขืจ ืžื™ืจ ืžืึทื›ืŸ ืึท ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ื˜ืขืงืข consul.conf ืžื™ื˜ ื“ื™ ืคืืœื’ืขื ื“ืข ืื™ื ื”ืึทืœื˜:

upstream consul-auth {
    server localhost:8500;
}

server {

    server_name consul.doman.name;
    
    location / {
      proxy_pass http://consul-auth;
      proxy_set_header Host $host;
      auth_basic_user_file /etc/nginx/.htpasswd;
      auth_basic "Password-protected Area";
    }
}

ื“ื• ื–ืืœืกื˜ ื ื™ืฉื˜ ืคืึทืจื’ืขืกืŸ ืฆื• ืฉืึทืคึฟืŸ ืึท .htpasswd ื˜ืขืงืข ืื•ืŸ ื“ื–ืฉืขื ืขืจื™ื™ื˜ ืึท ื ืืžืขืŸ ืื•ืŸ ืคึผืึทืจืึธืœ ืคึฟืึทืจ ืขืก. ื“ืขืจ ื ื•ืžืขืจ ืื™ื– ืคืืจืœืื ื’ื˜ ืึทื–ื•ื™ ืึทื– ื“ื™ ื•ื•ืขื‘ ื˜ืึทืคืœื™ืข ืื™ื– ื ื™ื˜ ื‘ืืจืขื›ื˜ื™ื’ื˜ ืคึฟืึทืจ ืึทืœืขืžืขืŸ ื•ื•ืืก ืงืขืŸ ืื•ื ื“ื–ืขืจ ืคืขืœื“. ืึธื‘ืขืจ, ื•ื•ืขืŸ ืื™ืจ ืฉื˜ืขืœืŸ ืึทืจื•ื™ืฃ ื’ื™ื˜ืœืึทื‘, ืžื™ืจ ื•ื•ืขืœืŸ ื”ืึธื‘ืŸ ืฆื• ืคืึทืจืœืึธื–ืŸ ื“ืขื - ืึทื ื“ืขืจืฉ ืžื™ืจ ื•ื•ืขืœืŸ ื ื™ืฉื˜ ืงืขื ืขืŸ ืฆื• ืฆืขื•ื•ื™ืงืœืขืŸ ืื•ื ื“ื–ืขืจ ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ืฆื• Nomad. ืื™ืŸ ืžื™ื™ืŸ ืคึผืจื•ื™ืขืงื˜, ื‘ื™ื™ื“ืข ื’ื™ื˜ืœืึทื‘ ืื•ืŸ ื ืึธืžืึทื“ ื–ืขื ืขืŸ ื‘ืœื•ื™ื– ืื•ื™ืฃ ื“ื™ ื’ืจื•ื™ ื•ื•ืขื‘, ืึทื–ื•ื™ ืขืก ืื™ื– ื ื™ื˜ ืึทื–ืึท ืคึผืจืึธื‘ืœืขื ื“ืึธ.

ืื•ื™ืฃ ื“ื™ ืจื•ืขืŸ ืฆื•ื•ื™ื™ ืกืขืจื•ื•ืขืจืก ืžื™ืจ ื™ื ืกื˜ืึทืœื™ืจืŸ ืงืึธื ืกื•ืœ ืื’ืขื ื˜ืŸ ืœื•ื™ื˜ ื“ื™ ืคืืœื’ืขื ื“ืข ื™ื ืกื˜ืจืึทืงืฉืึทื ื–. ืžื™ืจ ืื™ื‘ืขืจื—ื–ืจืŸ ื“ื™ ืกื˜ืขืคึผืก ืžื™ื˜ ื“ื™ ื‘ื™ื™ื ืขืจื™ ื˜ืขืงืข:

root@nomad-livelinux-01:~# wget https://releases.hashicorp.com/consul/1.5.0/consul_1.5.0_linux_amd64.zip
root@nomad-livelinux-01:~# unzip consul_1.5.0_linux_amd64.zip
root@nomad-livelinux-01:~# mv consul /usr/local/bin/

ืœื•ื™ื˜ ืึทื ืึทืœืึทื“ื–ืฉื™ ืžื™ื˜ ื“ื™ ืคืจื™ืขืจื“ื™ืงืข ืกืขืจื•ื•ืขืจ, ืžื™ืจ ืžืึทื›ืŸ ืึท ื•ื•ืขื’ื•ื•ื™ื™ึทื–ืขืจ ืคึฟืึทืจ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ื˜ืขืงืขืก /etc/consul.d ืžื™ื˜ ื“ื™ ืคืืœื’ืขื ื“ืข ืกื˜ืจื•ืงื˜ื•ืจ:

/etc/consul.d/
โ”œโ”€โ”€ client
โ”‚   โ””โ”€โ”€ config.json

ืื™ื ื”ืึทืœื˜ ืคื•ืŸ ื“ื™ config.json ื˜ืขืงืข:

{
    "datacenter": "dc1",
    "data_dir": "/opt/consul",
    "log_level": "DEBUG",
    "node_name": "nomad-livelinux-01",
    "server": false,
    "encrypt": "your-private-key",
    "domain": "livelinux",
    "addresses": {
      "dns": "127.0.0.1",
      "https": "0.0.0.0",
      "grpc": "127.0.0.1",
      "http": "127.0.0.1"
    },
    "bind_addr": "172.30.0.5", # ะปะพะบะฐะปัŒะฝั‹ะน ะฐะดั€ะตั ะฒะผ
    "start_join": ["172.30.0.15"], # ัƒะดะฐะปะตะฝะฝั‹ะน ะฐะดั€ะตั ะบะพะฝััƒะป ัะตั€ะฒะตั€ะฐ
    "ports": {
      "dns": 53
     }

ื”ื™ื˜ ื“ื™ ืขื ื“ืขืจื•ื ื’ืขืŸ ืื•ืŸ ืžืึทืš ืื•ื™ืฃ ืฆื• ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ื“ื™ ืกืขืจื•ื•ื™ืก ื˜ืขืงืข, ื–ื™ื™ืŸ ืื™ื ื”ืึทืœื˜:

/etc/systemd/system/consul.service:

[Unit]
Description="HashiCorp Consul - A service mesh solution"
Documentation=https://www.consul.io/
Requires=network-online.target
After=network-online.target

[Service]
User=root
Group=root
ExecStart=/usr/local/bin/consul agent -config-dir=/etc/consul.d/client
ExecReload=/usr/local/bin/consul reload
KillMode=process
Restart=on-failure

[Install]
WantedBy=multi-user.target

ืžื™ืจ ืงืึทื˜ืขืจ ืงืึธื ืกื•ืœ ืื•ื™ืฃ ื“ื™ ืกืขืจื•ื•ืขืจ. ืื™ืฆื˜, ื ืึธืš ืงืึทื˜ืขืจ, ืžื™ืจ ื–ืึธืœ ื–ืขืŸ ื“ื™ ืงืึทื ืคื™ื’ื™ืขืจื“ ื“ื™ื ืกื˜ ืื™ืŸ nsul ืžื™ื˜ื’ืœื™ื“ืขืจ. ื“ืึธืก ื•ื•ืขื˜ ืžื™ื™ื ืขืŸ ืึทื– ืขืก ืื™ื– ื”ืฆืœื—ื” ืงืึธื ื ืขืงื˜ืขื“ ืฆื• ื“ืขื ืงื ื•ื™ืœ ื•ื•ื™ ืึท ืงืœื™ืขื ื˜. ืื™ื‘ืขืจื—ื–ืจืŸ ื“ื™ ื–ืขืœื‘ืข ืื•ื™ืฃ ื“ื™ ืจื’ืข ืกืขืจื•ื•ืขืจ ืื•ืŸ ื“ืขืจื ืึธืš ืžื™ืจ ืงืขื ืขืŸ ืึธื ื”ื™ื™ื‘ืŸ ื™ื ืกื˜ืึธืœื™ื ื’ ืื•ืŸ ืงืึทื ืคื™ื’ื™ืขืจ ื ืึธืžืึทื“.

ืžืขืจ ื“ื™ื˜ื™ื™ืœื“ ื™ื ืกื˜ืึทืœื™ืจื•ื ื’ ืคื•ืŸ Nomad ืื™ื– ื“ื™ืกืงืจื™ื™ื‘ื“ ืื™ืŸ ื–ื™ื™ืŸ ื‘ืึทืึทืžื˜ืขืจ ื“ืึทืงื™ื•ืžืขื ื˜ื™ื™ืฉืึทืŸ. ืขืก ื–ืขื ืขืŸ ืฆื•ื•ื™ื™ ื˜ืจืื“ื™ืฆื™ืื ืขืœืŸ ื™ื™ึทื ืžืึธื ื˜ื™ืจื•ื ื’ ืžืขื˜ื”ืึธื“ืก: ื“ืึทื•ื ืœืึธื•ื“ื™ื ื’ ืึท ื‘ื™ื™ื ืขืจื™ ื˜ืขืงืข ืื•ืŸ ืงืึทืžืคึผื™ื™ืœื™ื ื’ ืคึฟื•ืŸ ืžืงื•ืจ. ืื™ืš ื•ื•ืขืœ ืงืœื™ื™ึทื‘ืŸ ื“ื™ ืขืจืฉื˜ืขืจ ืื•ืคึฟืŸ.

ื˜ืึธืŸ: ื“ื™ ืคึผืจื•ื™ืขืงื˜ ืื™ื– ื“ืขื•ื•ืขืœืึธืคึผื™ื ื’ ื–ื™ื™ืขืจ ื’ืขืฉื•ื•ื™ื ื“, ื ื™ื™ึท ื“ืขืจื”ื™ื™ึทื ื˜ื™ืงื•ื ื’ืขืŸ ื–ืขื ืขืŸ ืึธืคื˜ ื‘ืืคืจื™ื™ื˜. ื˜ืึธืžืขืจ ืึท ื ื™ื™ึทืข ื•ื•ืขืจืกื™ืข ื•ื•ืขื˜ ื–ื™ื™ืŸ ืจืขืœืขืึทืกืขื“ ื•ื•ืขืŸ ื“ืขืจ ืึทืจื˜ื™ืงืœ ืื™ื– ื’ืขืขื ื“ื™ืงื˜. ื“ืขืจื™ื‘ืขืจ, ืื™ื™ื“ืขืจ ืœื™ื™ืขื ืขืŸ, ืื™ืš ืจืขืงืึธืžืขื ื“ื™ืจืŸ ืงืึธื ื˜ืจืึธืœื™ืจืŸ ื“ื™ ืงืจืึทื ื˜ ื•ื•ืขืจืกื™ืข ืคื•ืŸ โ€‹โ€‹Nomad ืื™ืŸ ื“ืขื ืžืึธืžืขื ื˜ ืื•ืŸ ื“ืึทื•ื ืœืึธื•ื“ื™ื ื’ ืขืก. 

root@nomad-livelinux-01:~# wget https://releases.hashicorp.com/nomad/0.9.1/nomad_0.9.1_linux_amd64.zip
root@nomad-livelinux-01:~# unzip nomad_0.9.1_linux_amd64.zip
root@nomad-livelinux-01:~# mv nomad /usr/local/bin/
root@nomad-livelinux-01:~# nomad -autocomplete-install
root@nomad-livelinux-01:~# complete -C /usr/local/bin/nomad nomad
root@nomad-livelinux-01:~# mkdir /etc/nomad.d

ื ืึธืš ืึทื ืคึผืึทืงื™ื ื’, ืžื™ืจ ื•ื•ืขืœืŸ ื‘ืึทืงื•ืžืขืŸ ืึท ื ืึธืžืึทื“ ื‘ื™ื™ื ืขืจื™ ื˜ืขืงืข ื•ื•ื™ื™ื™ื ื’ 65 ืžืขื’ืื‘ื™ื™ื˜ืŸ - ืขืก ืžื•ื–ืŸ ื–ื™ื™ืŸ ืืจื™ื‘ืขืจื’ืขืคืืจืŸ ืฆื• /usr/local/bin.

ืœืึธืžื™ืจ ืžืึทื›ืŸ ืึท ื“ืึทื˜ืŸ ื•ื•ืขื’ื•ื•ื™ื™ึทื–ืขืจ ืคึฟืึทืจ ื ืึธืžืึทื“ ืื•ืŸ ืจืขื“ืึทื’ื™ืจืŸ ื–ื™ื™ืŸ ืกืขืจื•ื•ื™ืก ื˜ืขืงืข (ืขืก ื•ื•ืขื˜ ืžื™ืกื˜ืึธืžืข ื ื™ืฉื˜ ืขืงืกื™ืกื˜ื™ืจืŸ ืื™ืŸ ื“ื™ ืึธื ื”ื™ื™ื‘):

root@nomad-livelinux-01:~# mkdir --parents /opt/nomad
root@nomad-livelinux-01:~# nano /etc/systemd/system/nomad.service

ืคึผืึทืคึผ ื“ื™ ืคืืœื’ืขื ื“ืข ืฉื•ืจื•ืช ื“ืึธืจื˜:

[Unit]
Description=Nomad
Documentation=https://nomadproject.io/docs/
Wants=network-online.target
After=network-online.target

[Service]
ExecReload=/bin/kill -HUP $MAINPID
ExecStart=/usr/local/bin/nomad agent -config /etc/nomad.d
KillMode=process
KillSignal=SIGINT
LimitNOFILE=infinity
LimitNPROC=infinity
Restart=on-failure
RestartSec=2
StartLimitBurst=3
StartLimitIntervalSec=10
TasksMax=infinity

[Install]
WantedBy=multi-user.target

ืึธื‘ืขืจ, ืžื™ืจ ื”ืึธื‘ืŸ ืงื™ื™ืŸ ื™ื™ึทืœืŸ ืฆื• ืงืึทื˜ืขืจ ื ืึธืžืึทื“ - ืžื™ืจ ื”ืึธื‘ืŸ ื ื™ืฉื˜ ื ืึธืš ื‘ืืฉืืคืŸ ื–ื™ื™ืŸ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ื˜ืขืงืข:

root@nomad-livelinux-01:~# mkdir --parents /etc/nomad.d
root@nomad-livelinux-01:~# chmod 700 /etc/nomad.d
root@nomad-livelinux-01:~# nano /etc/nomad.d/nomad.hcl
root@nomad-livelinux-01:~# nano /etc/nomad.d/server.hcl

ื“ื™ ืœืขืฆื˜ ื•ื•ืขื’ื•ื•ื™ื™ึทื–ืขืจ ืกื˜ืจื•ืงื˜ื•ืจ ื•ื•ืขื˜ ื–ื™ื™ืŸ ื•ื•ื™ ื’ื™ื™ื˜:

/etc/nomad.d/
โ”œโ”€โ”€ nomad.hcl
โ””โ”€โ”€ server.hcl

ื“ื™ nomad.hcl ื˜ืขืงืข ื–ืึธืœ ืึทื ื˜ื”ืึทืœื˜ืŸ ื“ื™ ืคืืœื’ืขื ื“ืข ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ:

datacenter = "dc1"
data_dir = "/opt/nomad"

ืื™ื ื”ืึทืœื˜ ืคื•ืŸ ื“ื™ server.hcl ื˜ืขืงืข:

server {
  enabled = true
  bootstrap_expect = 1
}

consul {
  address             = "127.0.0.1:8500"
  server_service_name = "nomad"
  client_service_name = "nomad-client"
  auto_advertise      = true
  server_auto_join    = true
  client_auto_join    = true
}

bind_addr = "127.0.0.1" 

advertise {
  http = "172.30.0.5"
}

client {
  enabled = true
}

ื“ื• ื–ืืœืกื˜ ื ื™ืฉื˜ ืคืึทืจื’ืขืกืŸ ืฆื• ื˜ื•ื™ืฉืŸ ื“ื™ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ื˜ืขืงืข ืื•ื™ืฃ ื“ื™ ืจื’ืข ืกืขืจื•ื•ืขืจ - ื“ืึธืจื˜ ืื™ืจ ื•ื•ืขื˜ ื“ืึทืจืคึฟืŸ ืฆื• ื˜ื•ื™ืฉืŸ ื“ื™ ื•ื•ืขืจื˜ ืคื•ืŸ ื“ื™ ื”ื˜ื˜ืคึผ ื“ื™ืจืขืงื˜ื™ื•ื•.

ื“ื™ ืœืขืฆื˜ืข ื–ืึทืš ืื™ืŸ ื“ืขื ื‘ื™ื ืข ืื™ื– ืฆื• ืงืึทื ืคื™ื’ื™ืขืจ Nginx ืคึฟืึทืจ ืคึผืจืึทืงืกื™ื™ื ื’ ืื•ืŸ ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ื”ื˜ื˜ืคึผ ื“ืขืจืœื•ื™ื‘ืขื ื™ืฉ. ืื™ื ื”ืึทืœื˜ ืคื•ืŸ ื“ื™ nomad.conf ื˜ืขืงืข:

upstream nomad-auth {
        server 172.30.0.5:4646;
}

server {

        server_name nomad.domain.name;
        
        location / {
	        proxy_pass http://nomad-auth;
	        proxy_set_header Host $host;
	        auth_basic_user_file /etc/nginx/.htpasswd;
		   auth_basic "Password-protected Area";
        }
        
}

ืื™ืฆื˜ ืžื™ืจ ืงืขื ืขืŸ ืึทืงืกืขืก ื“ื™ ื•ื•ืขื‘ ื˜ืึทืคืœื™ืข ื“ื•ืจืš ืึท ืคื•ื ื“ืจื•ื™ืกื ื“ื™ืง ื ืขืฅ. ืคืึทืจื‘ื™ื ื“ืŸ ืื•ืŸ ื’ื™ื™ืŸ ืฆื• ื“ื™ ืกืขืจื•ื•ืขืจืก ื‘ืœืึทื˜:

ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ืึท ื ืึธืžืึทื“ ืงื ื•ื™ืœ ื ื™ืฆืŸ ืงืึธื ืกื•ืœ ืื•ืŸ ื™ื ื˜ืึทื’ืจื™ื™ื˜ื™ื ื’ ืžื™ื˜ Gitlab
ื‘ื™ืœื“ 1. ืจืฉื™ืžื” ืคื•ืŸ ืกืขืจื•ื•ืขืจืก ืื™ืŸ ื“ื™ ื ืึธืžืึทื“ ืงื ื•ื™ืœ

ื‘ื™ื™ื“ืข ืกืขืจื•ื•ืขืจืก ื–ืขื ืขืŸ ื”ืฆืœื—ื” ื’ืขื•ื•ื™ื–ืŸ ืื™ืŸ ื“ื™ ื˜ืึทืคืœื™ืข, ืžื™ืจ ื•ื•ืขืœืŸ ื–ืขืŸ ื“ื™ ื–ืขืœื‘ืข ื–ืึทืš ืื™ืŸ ื“ืขืจ ืจืขื–ื•ืœื˜ืึทื˜ ืคื•ืŸ ื“ื™ ื ืึธื•ืžืึทื“ ื ืึธื“ืข ืกื˜ืึทื˜ื•ืก ื‘ืึทืคึฟืขืœ:

ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ืึท ื ืึธืžืึทื“ ืงื ื•ื™ืœ ื ื™ืฆืŸ ืงืึธื ืกื•ืœ ืื•ืŸ ื™ื ื˜ืึทื’ืจื™ื™ื˜ื™ื ื’ ืžื™ื˜ Gitlab
ื‘ื™ืœื“ 2. ืจืขื–ื•ืœื˜ืึทื˜ ืคื•ืŸ ื“ื™ ื ืึธื•ืžืึทื“ ื ืึธื“ืข ืกื˜ืึทื˜ื•ืก ื‘ืึทืคึฟืขืœ

ื•ื•ืึธืก ื•ื•ืขื’ืŸ ืงืึธื ืกื•ืœ? ื–ืืœ ืก ื‘ืึทืงื•ืžืขืŸ ืึท ืงื•ืง. ื’ื™ื™ืŸ ืฆื• ื“ื™ ืงืึทื ืกืึทืœ ืงืึธื ื˜ืจืึธืœ ื˜ืึทืคืœื™ืข ืฆื• ื“ื™ ื ืึธื•ื“ื– ื‘ืœืึทื˜:
ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ืึท ื ืึธืžืึทื“ ืงื ื•ื™ืœ ื ื™ืฆืŸ ืงืึธื ืกื•ืœ ืื•ืŸ ื™ื ื˜ืึทื’ืจื™ื™ื˜ื™ื ื’ ืžื™ื˜ Gitlab
ื‘ื™ืœื“ 3. ืจืฉื™ืžื” ืคื•ืŸ ื ืึธื•ื“ื– ืื™ืŸ ื“ื™ ืงืึธื ืกื•ืœ ืงื ื•ื™ืœ

ืื™ืฆื˜ ืžื™ืจ ื”ืึธื‘ืŸ ืึท ืฆื•ื’ืขื’ืจื™ื™ื˜ ื ืึธืžืึทื“ ืืจื‘ืขื˜ืŸ ืื™ืŸ ืงืึทื ื“ื–ืฉืึทื ื’ืงืฉืึทืŸ ืžื™ื˜ ืงืึธื ืกื•ืœ. ืื™ืŸ ื“ื™ ืœืขืฆื˜ืข ื‘ื™ื ืข, ืžื™ืจ ื•ื•ืขืœืŸ ื‘ืึทืงื•ืžืขืŸ ืฆื• ื“ืขื ืฉืคึผืึทืก ื˜ื™ื™ืœ: ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ื“ื™ ืขืงืกืคึผืจืขืก ืคื•ืŸ ื“ืึธืงืงืขืจ ืงืึทื ื˜ื™ื™ื ืขืจื– ืคึฟื•ืŸ Gitlab ืฆื• Nomad, ืื•ืŸ ืื•ื™ืš ืจืขื“ืŸ ื•ื•ืขื’ืŸ ืขื˜ืœืขื›ืข ืคื•ืŸ โ€‹โ€‹โ€‹โ€‹ื“ื™ ืื ื“ืขืจืข ืึธืคึผืฉื™ื™ื“ื ื“ื™ืง ืคึฟืขื™ึดืงื™ื™ื˜ืŸ.

ืฉืึทืคึฟืŸ ื’ื™ื˜ืœืึทื‘ ืจืึทื ืขืจ

ืฆื• ืฆืขื•ื•ื™ืงืœืขืŸ ื“ืึธืงืงืขืจ ื‘ื™ืœื“ืขืจ ืฆื• Nomad, ืžื™ืจ ื•ื•ืขืœืŸ ื ื•ืฆืŸ ืึท ื‘ืึทื–ื•ื ื“ืขืจ ืจืึทื ืขืจ ืžื™ื˜ ื“ื™ Nomad ื‘ื™ื™ื ืขืจื™ ื˜ืขืงืข ื™ืŸ (ื“ืึธ, ื“ื•ืจืš ื“ืขื ื•ื•ืขื’, ืžื™ืจ ืงืขื ืขืŸ ื˜ืึธืŸ ืืŸ ืื ื“ืขืจ ืฉื˜ืจื™ืš ืคื•ืŸ Hashicorp ืึทืคึผืœืึทืงื™ื™ืฉืึทื ื– - ื™ื ื“ื™ื•ื•ื™ื“ื–ืฉื•ืึทืœื™ ื–ื™ื™ ื–ืขื ืขืŸ ืึท ืื™ื™ืŸ ื‘ื™ื™ื ืขืจื™ ื˜ืขืงืข). ืฆื•ืคึฟืขืœื™ืงืขืจ ืขืก ืฆื• ื“ื™ ืจืึทื ืขืจ ื•ื•ืขื’ื•ื•ื™ื™ึทื–ืขืจ. ืœืึธืžื™ืจ ืžืึทื›ืŸ ืึท ืคึผืฉื•ื˜ Dockerfile ืคึฟืึทืจ ืขืก ืžื™ื˜ ื“ื™ ืคืืœื’ืขื ื“ืข ืื™ื ื”ืึทืœื˜:


FROM alpine:3.9
RUN apk add --update --no-cache libc6-compat gettext
COPY nomad /usr/local/bin/nomad

ืื™ืŸ ื“ืขืจ ื–ืขืœื‘ื™ืงืขืจ ืคึผืจื•ื™ืขืงื˜ ืžื™ืจ ืžืึทื›ืŸ .gitlab-ci.yml:

variables:
  DOCKER_IMAGE: nomad/nomad-deploy
  DOCKER_REGISTRY: registry.domain.name
 

stages:
  - build

build:
  stage: build
  image: ${DOCKER_REGISTRY}/nomad/alpine:3
  script:
    - tag=${DOCKER_REGISTRY}/${DOCKER_IMAGE}:latest
    - docker build --pull -t ${tag} -f Dockerfile .
    - docker push ${tag}

ื•ื•ื™ ืึท ืจืขื–ื•ืœื˜ืึทื˜, ืžื™ืจ ื•ื•ืขืœืŸ ื”ืึธื‘ืŸ ืึท ื‘ื ื™ืžืฆื ื‘ื™ืœื“ ืคื•ืŸ ื“ื™ ื ืึธืžืึทื“ ืจืึทื ืขืจ ืื™ืŸ ื“ื™ ื’ื™ื˜ืœืึทื‘ ืจืขื’ื™ืกื˜ืจื™, ืื™ืฆื˜ ืžื™ืจ ืงืขื ืขืŸ ื’ื™ื™ืŸ ื’ืœื™ื™ึทืš ืฆื• ื“ื™ ืคึผืจื•ื™ืขืงื˜ ืจื™ืคึผืึทื–ืึทื˜ืึธืจื™, ืฉืึทืคึฟืŸ ืึท ืจืขืจื  - ืœื™ื ื™ืข ืื•ืŸ ืงืึทื ืคื™ื’ื™ืขืจ ื“ื™ ื ืึธืžืึทื“ ืึทืจื‘ืขื˜.

ืคึผืจืึธื™ืขืงื˜ ืกืขื˜ืึทืคึผ

ืœืึธืžื™ืจ ืึธื ื”ื™ื™ื‘ืŸ ืžื™ื˜ ื“ื™ ืึทืจื‘ืขื˜ ื˜ืขืงืข ืคึฟืึทืจ ื ืึธืžืึทื“. ืžื™ื™ึทืŸ ืคึผืจื•ื™ืขืงื˜ ืื™ืŸ ื“ืขื ืึทืจื˜ื™ืงืœ ื•ื•ืขื˜ ื–ื™ื™ืŸ ื’ืึทื ืฅ ืคึผืจื™ืžื™ื˜ื™ื•ื•: ืขืก ื•ื•ืขื˜ ืฆื•ื ื•ื™ืคืฉื˜ืขืœื  ื–ื™ืš ืคื•ืŸ ืื™ื™ืŸ ืึทืจื‘ืขื˜. ื“ืขืจ ืื™ื ื”ืึทืœื˜ ืคื•ืŸ .gitlab-ci ื•ื•ืขื˜ ื–ื™ื™ืŸ ื•ื•ื™ ื’ื™ื™ื˜:

variables:
  NOMAD_ADDR: http://nomad.address.service:4646
  DOCKER_REGISTRY: registry.domain.name
  DOCKER_IMAGE: example/project

stages:
  - build
  - deploy

build:
  stage: build
  image: ${DOCKER_REGISTRY}/nomad-runner/alpine:3
  script:
    - tag=${DOCKER_REGISTRY}/${DOCKER_IMAGE}:${CI_COMMIT_SHORT_SHA}
    - docker build --pull -t ${tag} -f Dockerfile .
    - docker push ${tag}


deploy:
  stage: deploy
  image: registry.example.com/nomad/nomad-runner:latest
  script:
    - envsubst '${CI_COMMIT_SHORT_SHA}' < project.nomad > job.nomad
    - cat job.nomad
    - nomad validate job.nomad
    - nomad plan job.nomad || if [ $? -eq 255 ]; then exit 255; else echo "success"; fi
    - nomad run job.nomad
  environment:
    name: production
  allow_failure: false
  when: manual

ื“ืึธ ื“ื™ ื“ื™ืคึผืœื•ื™ืžืึทื ื˜ ืึทืงืขืจื– ืžืึทื ื™ื•ืึทืœื™, ืึธื‘ืขืจ ืื™ืจ ืงืขื ืขืŸ ืงืึทื ืคื™ื’ื™ืขืจ ืขืก ืฆื• ื˜ื•ื™ืฉืŸ ื“ื™ ืื™ื ื”ืึทืœื˜ ืคื•ืŸ ื“ื™ ืคึผืจื•ื™ืขืงื˜ ื•ื•ืขื’ื•ื•ื™ื™ึทื–ืขืจ. ืจืขืจื  - ืœื™ื ื™ืข ื‘ืืฉื˜ื™ื™ื˜ ืคื•ืŸ ืฆื•ื•ื™ื™ ืกื˜ืึทื’ืขืก: ื‘ื™ืœื“ ืคึฟืึทืจื–ืึทืžืœื•ื ื’ ืื•ืŸ ื–ื™ื™ึทืŸ ื“ื™ืคึผืœื•ื™ืžืึทื ื˜ ืฆื• ื ืึธืžืึทื“. ืื™ืŸ ื“ืขืจ ืขืจืฉื˜ืขืจ ื‘ื™ื ืข, ืžื™ืจ ืึทืกืขืžื‘ืึทืœ ืึท ื“ืึธืงืงืขืจ ื‘ื™ืœื“ ืื•ืŸ ืฉื˜ื•ืคึผืŸ ืขืก ืื™ืŸ ืื•ื ื“ื–ืขืจ ืจืขื’ื™ืกื˜ืจื™, ืื•ืŸ ืื™ืŸ ื“ื™ ืจื’ืข, ืžื™ืจ ืงืึทื˜ืขืจ ืื•ื ื“ื–ืขืจ ืึทืจื‘ืขื˜ ืื™ืŸ ื ืึธืžืึทื“. 

job "monitoring-status" {
    datacenters = ["dc1"]
    migrate {
        max_parallel = 3
        health_check = "checks"
        min_healthy_time = "15s"
        healthy_deadline = "5m"
    }

    group "zhadan.ltd" {
        count = 1
        update {
            max_parallel      = 1
            min_healthy_time  = "30s"
            healthy_deadline  = "5m"
            progress_deadline = "10m"
            auto_revert       = true
        }
        task "service-monitoring" {
            driver = "docker"

            config {
                image = "registry.domain.name/example/project:${CI_COMMIT_SHORT_SHA}"
                force_pull = true
                auth {
                    username = "gitlab_user"
                    password = "gitlab_password"
                }
                port_map {
                    http = 8000
                }
            }
            resources {
                network {
                    port "http" {}
                }
            }
        }
    }
}

ื‘ื™ื˜ืข ื˜ืึธืŸ ืึทื– ืื™ืš ื”ืึธื‘ืŸ ืึท ืคึผืจื™ื•ื•ืึทื˜ ืจืขื’ื™ืกื˜ืจื™ ืื•ืŸ ืฆื• ื”ืฆืœื—ื” ืฆื™ืขืŸ ืึท ื“ืึธืงืงืขืจ ื‘ื™ืœื“ ืื™ืš ื“ืึทืจืคึฟืŸ ืฆื• ืงืœืึธืฅ ืื™ืŸ ืฆื• ืขืก. ื“ืขืจ ื‘ืขืกื˜ืขืจ ืœื™ื™ื–ื•ื ื’ ืื™ืŸ ื“ืขื ืคืึทืœ ืื™ื– ืฆื• ืึทืจื™ื™ึทืŸ ืึท ืœืึธื’ื™ืŸ ืื•ืŸ ืคึผืึทืจืึธืœ ืื™ืŸ ื•ื•ืึธืœื˜ ืื•ืŸ ื“ืขืžืึธืœื˜ ื•ื™ืกืฉื˜ื™ืžืขืŸ ืขืก ืžื™ื˜ ื ืึธืžืึทื“. ื ืึธืžืึทื“ ื ืึทื˜ื™ื•ื•ืขืœื™ ืฉื˜ื™ืฆื˜ ื•ื•ืึธืœื˜. ืึธื‘ืขืจ ืขืจืฉื˜ืขืจ, ืœืึธื–ืŸ ืื•ื ื“ื– ื™ื ืกื˜ืึทืœื™ืจืŸ ื“ื™ ื ื™ื™ื˜ื™ืง ืคึผืึทืœืึทืกื™ื– ืคึฟืึทืจ ื ืึธืžืึทื“ ืื™ืŸ ื•ื•ืึธืœื˜ ื–ื™ืš; ื–ื™ื™ ืงืขื ืขืŸ ื–ื™ื™ืŸ ื“ืึทื•ื ืœืึธื•ื“ื™ื“:

# Download the policy and token role
$ curl https://nomadproject.io/data/vault/nomad-server-policy.hcl -O -s -L
$ curl https://nomadproject.io/data/vault/nomad-cluster-role.json -O -s -L

# Write the policy to Vault
$ vault policy write nomad-server nomad-server-policy.hcl

# Create the token role with Vault
$ vault write /auth/token/roles/nomad-cluster @nomad-cluster-role.json

ืื™ืฆื˜, ื ืึธืš ื‘ืืฉืืคืŸ ื“ื™ ื ื™ื™ื˜ื™ืง ืคึผืึทืœืึทืกื™ื–, โ€‹โ€‹ืžื™ืจ ื•ื•ืขืœืŸ ืœื™ื™ื’ืŸ ื™ื ืึทื’ืจื™ื™ืฉืึทืŸ ืžื™ื˜ ื•ื•ืึธืœื˜ ืื™ืŸ ื“ื™ ืึทืจื‘ืขื˜ ื‘ืœืึธืง ืื™ืŸ ื“ื™ job.nomad ื˜ืขืงืข:

vault {
  enabled = true
  address = "https://vault.domain.name:8200"
  token = "token"
}

ืื™ืš ื ื•ืฆืŸ ื“ืขืจืœื•ื™ื‘ืขื ื™ืฉ ื“ื•ืจืš ืกื™ืžืขืŸ ืื•ืŸ ืคืึทืจืฉืจื™ื™ึทื‘ืŸ ืขืก ื’ืœื™ื™ืš ื“ืึธ, ืขืก ืื™ื– ืื•ื™ืš ื“ื™ ืึธืคึผืฆื™ืข ืฆื• ืกืคึผืขืฆื™ืคื™ืฆื™ืจืŸ ื“ื™ ืกื™ืžืขืŸ ื•ื•ื™ ืึท ื•ื•ืขืจื™ืึทื‘ืึทืœ ื•ื•ืขืŸ ืกื˜ืึทืจื˜ื™ื ื’ ื ืึธื•ืžืึทื“ ืึทื’ืขื ื˜:

$ VAULT_TOKEN=<token> nomad agent -config /path/to/config

ืื™ืฆื˜ ืžื™ืจ ืงืขื ืขืŸ ื ื•ืฆืŸ ื“ื™ ืฉืœื™ืกืœืขืŸ ืžื™ื˜ ื•ื•ืึธืœื˜. ื“ืขืจ ืคึผืจื™ื ืฆื™ืคึผ ืคื•ืŸ ืึธืคึผืขืจืึทืฆื™ืข ืื™ื– ืคึผืฉื•ื˜: ืžื™ืจ ืžืึทื›ืŸ ืึท ื˜ืขืงืข ืื™ืŸ ื ืึธืžืึทื“ ืึทืจื‘ืขื˜ ื•ื•ืึธืก ื•ื•ืขื˜ ืงืจืึธื ื“ื™ ื•ื•ืึทืœื•ืขืก ืคื•ืŸ ื•ื•ืขืจื™ืึทื‘ืึทืœื–, ืœืžืฉืœ:

template {
                data = <<EOH
{{with secret "secrets/pipeline-keys"}}
REGISTRY_LOGIN="{{ .Data.REGISTRY_LOGIN }}"
REGISTRY_PASSWORD="{{ .Data.REGISTRY_LOGIN }}{{ end }}"

EOH
    destination = "secrets/service-name.env"
    env = true
}

ืžื™ื˜ ื“ืขื ืคึผืฉื•ื˜ ืฆื•ื’ืึทื ื’, ืื™ืจ ืงืขื ืขืŸ ืงืึทื ืคื™ื’ื™ืขืจ ื“ื™ ืขืงืกืคึผืจืขืก ืคื•ืŸ ืงืึทื ื˜ื™ื™ื ืขืจื– ืฆื• ื“ื™ ื ืึธืžืึทื“ ืงื ื•ื™ืœ ืื•ืŸ ืึทืจื‘ืขื˜ ืžื™ื˜ ืื™ื ืื™ืŸ ื“ืขืจ ืฆื•ืงื•ื ืคึฟื˜. ืื™ืš ื•ื•ืขืœ ื–ืึธื’ืŸ ืึทื– ืื™ืŸ ืขื˜ืœืขื›ืข ืžืึธืก ืื™ืš ืกื™ืžืคึผืึทื˜ื™ื™ื– ืžื™ื˜ ื ืึธืžืึทื“ - ืขืก ืื™ื– ืžืขืจ ืคึผืึทืกื™ืง ืคึฟืึทืจ ืงืœื™ื™ืŸ ืคึผืจืึทื“ื–ืฉืขืงืก ื•ื•ื• ืงื•ื‘ืขืจื ืขื˜ืขืก ืงืขื ืขืŸ ืึธื ืžืึทื›ืŸ ื ืึธืš ืงืึทืžืคึผืœืขืงืกื™ื˜ื™ ืื•ืŸ ื•ื•ืขื˜ ื ื™ืฉื˜ ืคืึทืจืฉื˜ื™ื™ืŸ ื–ื™ื™ึทืŸ ืคื•ืœ ืคึผืึธื˜ืขื ืฆื™ืขืœ. ืคึผืœื•ืก, Nomad ืื™ื– ื’ืื ืฅ ืคึฟืึทืจ ื‘ื™ื’ื™ื ืขืจื– - ืขืก ืื™ื– ื’ืจื™ื ื’ ืฆื• ื™ื ืกื˜ืึทืœื™ืจืŸ ืื•ืŸ ืงืึทื ืคื™ื’ื™ืขืจ. ืึธื‘ืขืจ, ื•ื•ืขืŸ ื˜ืขืกื˜ื™ื ื’ ืื•ื™ืฃ ืขื˜ืœืขื›ืข ืคึผืจืึทื“ื–ืฉืขืงืก, ืื™ืš ื˜ืจืขืคืŸ ืึท ืคึผืจืึธื‘ืœืขื ืžื™ื˜ ื–ื™ื™ึทืŸ ืคืจื™ ื•ื•ืขืจืกื™ืขืก - ืคื™ืœืข ื™ืงืขืจื“ื™ืง ืคืึทื ื’ืงืฉืึทื ื– ื–ืขื ืขืŸ ืคืฉื•ื˜ ื ื™ืฉื˜ ื“ืึธืจื˜ ืึธื“ืขืจ ื–ื™ื™ ื˜ืึธืŸ ื ื™ืฉื˜ ืึทืจื‘ืขื˜ืŸ ืจื™ื›ื˜ื™ืง. ืึธื‘ืขืจ, ืื™ืš ื’ืœื•ื™ื‘ืŸ ืึทื– Nomad ื•ื•ืขื˜ ืคืึธืจื–ืขืฆืŸ ืฆื• ืึทื ื˜ื•ื•ื™ืงืœืขืŸ ืื•ืŸ ืื™ืŸ ื“ืขืจ ืฆื•ืงื•ื ืคึฟื˜ ืขืก ื•ื•ืขื˜ ืงืจื™ื’ืŸ ื“ื™ ืคืึทื ื’ืงืฉืึทื ื– ื•ื•ืึธืก ืึทืœืขืžืขืŸ ื“ืึทืจืฃ.

ืžื—ื‘ืจ: Ilya Andreev, ืขื“ื™ื˜ื™ื“ ื“ื•ืจืš ืึทืœืขืงืกื™ื™ ื–ืฉืึทื“ืึทืŸ ืื•ืŸ ื“ื™ ืœื™ื™ื•ื• ืœื™ื ื•ืงืก ืžืึทื ืฉืึทืคึฟื˜


ืžืงื•ืจ: www.habr.com

ืœื™ื™ื’ืŸ ืึท ื‘ืึทืžืขืจืงื•ื ื’