Skip to content

Latest commit

 

History

History
157 lines (134 loc) · 4.52 KB

README.md

File metadata and controls

157 lines (134 loc) · 4.52 KB
Raw

Dockin Ops - Dockin Operation service

License

English | 中文

Dockin operation and maintenance management system is a safe operation and maintenance management service that optimizes exec execution performance and supports command authority management

For more Dockin components, please visit https://github.com/WeBankFinTech/Dockin

Architecture

Quick Guide

1. Preparation

  • k8s cluster
  • Deploy Docking rm in advance, opserver needs to call rm interface to get information
  • Prepare redis, you can quickly run redis with the following command:
docker run -p 6379:6379 -d redis:latest redis-server
  • Plan to deploy opserver server, record the ip

2. Compile

2.1 Dockin-opserver

  • Modify the configuration file application.yaml, the main thing to note is the address of rm
rm-address: http://127.0.0.1:10002/rmController # RM access address
batch-timeout: 5000
http-port: 8084 # listening port of opserver
cmd-filter-type: blacklist
while-list-update-time: 60000
limits:
  exec-forbidden:
    -vi
  file-max-size: 1000
  upload-file-max-size: 500
  download-file-max-size: 4000
  vi-file-max-size: 10
  k8s-qos: 40
  k8s-burst: 60
opagent-port: 8085 # listening port of opagent
redis:
  expiration: 120000
accounts: # User information of opserver, currently configured in the configuration file
  -account:
      user-name: app
      passwd: passwd
  • Compile: execute the following command
make

2.2 Dockin-opsctl

  • Modify opserver access address
# File to be modified: internal/common/url.go, change the constant RemoteHost to the ip and port corresponding to opserver
const RemoteHost = "127.0.0.1:8084"
  • Compile: execute the make command
make

2.3 Dockin-opagent

  • Modify the configuration file application.yaml, the access address of rm should be noted
app:
  rm:
    api: http://127.0.0.1:10002/rmController # RM access address
  container:
    ticker: 30
  http:
    port: 8085
  debug:
    port: 10102
  ims:
    logroot: /data/logs/
  docker:
    sock: unix:///var/run/docker.sock
  qos:
    path: /data/cgroup
  logs:
    cmd-white-list:
      -grep
      -zgrep
      -cat
      -head
      -tail
      -awk
      -uniq
      -sort
      -ls
    cmd-timeout: 5000
    max-file-size: 3000
    max-line: 1000
    root: /data/logs/
  • Compile and package opagent to docker image
make docker-build

3. Installation And Running

3.1 dockin-opagent

  1. Opagent runs in the k8s cluster as a daemonSet. You can directly refer to the daemonSet sample in the internal/docs directory of the project, modify the corresponding mirror information and apply it directly to the k8s cluster.

3.2 dockin-opagent

  1. Export the configuration file of the k8s cluster that needs to be managed, place it in the configs/cluster directory, and add a dockin section on the basis of the original configuration file. The example is shown below. Please see the corresponding notes for those who need attention:
apiVersion: v1
clusters:
-cluster: # The access address and name of the cluster can be declared multiple
    insecure-skip-tls-verify: true
    server: https://127.0.0.1:6443
  name: kubernetes
contexts: # Context information, mainly used to correspond to the above cluster information, set up some configurations
-context:
    cluster: kubernetes # cluster name, corresponding to the cluster name in the cluster section
    namespace: test # Use the namespace of the configuration operation
    user: kubernetes-readonly-user # The user used to access the cluster
  name: readonly-user
current-context: readonly-user # Context used by default
kind: Config
preferences: {}
users:
-name: kubernetes-readonly-user # User information, corresponding to the user in the context section
  user:
    password: your_password # User password
    username: readonly-user # username
dockin: # Additional custom configuration, the user declares the rules applicable to the cluster and the corresponding cluster id, and declares the default whitelist
  cluster-id: test
  rule: test
  whitelist:
    -127.0.0.1
  1. Upload the start.sh, configs directories and compiled executable files in the project to the server, and execute the following commands:
sh start.sh

3.3 dockin-opsctl

  • Copy the executable file to the server to use it, use the following command to view the help:
dockin-opsctl -h