adrien
/
rvn_tp22
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

initial commit

This commit is contained in:
ADRN 2023-12-11 13:08:38 +01:00
commit c095a35519
4 changed files with 532 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
README.md Normal file
View File

@ -0,0 +1,21 @@
# RVN - TP2.2 : Ordonnancement de services sur une grappe
1. Provisionner des VMs **sur notre WAN** avec [Vagrant](https://developer.hashicorp.com/vagrant/docs)
2. Déployer un cluster [Consul](https://developer.hashicorp.com/consul/docs)
3. Déployer un service avec Docker et le surveiller avec Consul
4. Déployer des services avec [Nomad](https://developer.hashicorp.com/nomad/docs)
## 1. Provisionner des VMs
| Continent| IP sur continent | IP VM |
|--------- | ------------------ | ---------------- |
| Amerique | `10.13.1.3/24` | `10.13.1.31/24` |
| Europe | `10.13.2.1/24` | `10.13.2.11/24` |
| Asie | `10.13.3.4/24` | `10.13.3.41/24` |
Vous pouvez vous inspirer de :
* [./Vagrantfile](./Vagrantfile)
* [./install_nomad_consul.sh](./install_nomad_consul.sh)

119
Vagrantfile vendored Normal file
View File

@ -0,0 +1,119 @@
# -*- mode: ruby -*-
# vi: set ft=ruby :
# Provisioning
$script = <<-'SCRIPT'
echo "## Provisioning VM ##"
echo "Installing dependencies..."
sudo apt-get update
sudo apt-get install -y unzip curl jq dnsutils
echo "Determining Consul version to install ..."
CHECKPOINT_URL="https://checkpoint-api.hashicorp.com/v1/check"
if [ -z "$CONSUL_VERSION" ]; then
CONSUL_VERSION=$(curl -s "${CHECKPOINT_URL}"/consul | jq .current_version | tr -d '"')
fi
if [ -z "$NOMAD_VERSION" ]; then
NOMAD_VERSION=$(curl -s "${CHECKPOINT_URL}"/nomad | jq .current_version | tr -d '"')
fi
echo "Fetching Consul version ${CONSUL_VERSION} ..."
cd /tmp/
curl -s https://releases.hashicorp.com/consul/${CONSUL_VERSION}/consul_${CONSUL_VERSION}_linux_amd64.zip -o consul.zip
echo "Installing Consul version ${CONSUL_VERSION} ..."
unzip consul.zip
sudo chmod +x consul
sudo mv consul /usr/bin/consul
sudo mkdir /etc/consul.d
sudo chmod a+w /etc/consul.d
echo "Fetching Nomad version ${NOMAD_VERSION} ..."
cd /tmp/
curl -s https://releases.hashicorp.com/nomad/${NOMAD_VERSION}/nomad_${NOMAD_VERSION}_linux_amd64.zip -o nomad.zip
echo "Installing Nomad version ${NOMAD_VERSION} ..."
unzip nomad.zip
sudo chmod +x nomad
sudo mv nomad /usr/bin/nomad
sudo mkdir /etc/nomad.d
sudo chmod a+w /etc/nomad.d
SCRIPT
# Specify a Consul version
CONSUL_VERSION = ENV['CONSUL_VERSION']
Vagrant.configure("2") do |config|
config.vm.define "rvn11" do |rvn11|
rvn11.vm.box = "ubuntu/lunar64"
rvn11.vm.hostname = "rvn11.machine.local"
rvn11.vm.network "public_network", ip: "172.24.1.1/16", bridge: "tap0"
end
#config.vm.define "rvn12" do |rvn12|
# rvn12.vm.box = "ubuntu/lunar64"
# rvn12.vm.hostname = "rvn12.machine.local"
# rvn12.vm.network "public_network", ip: "172.24.1.2", bridge: "tap0"
#end
config.vm.provision "shell",
inline: $script,
env: {'CONSUL_VERSION' => CONSUL_VERSION}
config.vm.box_check_update = false
# Create a forwarded port mapping which allows access to a specific port
# within the machine from a port on the host machine. In the example below,
# accessing "localhost:8080" will access port 80 on the guest machine.
# NOTE: This will enable public access to the opened port
# config.vm.network "forwarded_port", guest: 80, host: 8080
# Create a forwarded port mapping which allows access to a specific port
# within the machine from a port on the host machine and only allow access
# via 127.0.0.1 to disable public access
# config.vm.network "forwarded_port", guest: 80, host: 8080, host_ip: "127.0.0.1"
# Create a private network, which allows host-only access to the machine
# using a specific IP.
# config.vm.network "private_network", ip: "192.168.33.10"
# Create a public network, which generally matched to bridged network.
# Bridged networks make the machine appear as another physical device on
# your network.
# config.vm.network "public_network"
# Share an additional folder to the guest VM. The first argument is
# the path on the host to the actual folder. The second argument is
# the path on the guest to mount the folder. And the optional third
# argument is a set of non-required options.
# config.vm.synced_folder "../data", "/vagrant_data"
# Disable the default share of the current code directory. Doing this
# provides improved isolation between the vagrant box and your host
# by making sure your Vagrantfile isn't accessable to the vagrant box.
# If you use this you may want to enable additional shared subfolders as
# shown above.
# config.vm.synced_folder ".", "/vagrant", disabled: true
# Provider-specific configuration so you can fine-tune various
# backing providers for Vagrant. These expose provider-specific options.
# Example for VirtualBox:
#
# config.vm.provider "virtualbox" do |vb|
# # Display the VirtualBox GUI when booting the machine
# vb.gui = true
#
# # Customize the amount of memory on the VM:
# vb.memory = "1024"
# end
#
# View the documentation for the provider you are using for more
# information on available options.
# Enable provisioning with a shell script. Additional provisioners such as
# Ansible, Chef, Docker, Puppet and Salt are also available. Please see the
# documentation for more information about their specific syntax and use.
# config.vm.provision "shell", inline: <<-SHELL
# apt-get update
# apt-get install -y apache2
# SHELL
end

221
garage.hcl Normal file
View File

@ -0,0 +1,221 @@
job "garage" {
datacenters = [ "dc1" ]
type = "system"
priority = 80
update {
max_parallel = 10
min_healthy_time = "60s"
}
group "garage" {
network {
port "s3" { static = 3900 }
port "rpc" { static = 3901 }
port "web" { static = 3902 }
port "admin" { static = 3903 }
port "k2v" { static = 3904 }
}
update {
max_parallel = 10
min_healthy_time = "30s"
healthy_deadline = "5m"
}
task "server" {
driver = "docker"
config {
image = "dxflrs/garage:v0.9.0"
command = "/garage"
args = [ "server" ]
network_mode = "host"
volumes = [
"/mnt/storage/garage/data:/data",
"/mnt/ssd/garage/meta:/meta",
"secrets/garage.toml:/etc/garage.toml",
"secrets:/etc/garage",
]
logging {
type = "journald"
}
}
template {
data = file("../config/garage.toml")
destination = "secrets/garage.toml"
}
template {
data = "{{ key \"secrets/consul/consul-ca.crt\" }}"
destination = "secrets/consul-ca.crt"
}
template {
data = "{{ key \"secrets/consul/consul-client.crt\" }}"
destination = "secrets/consul-client.crt"
}
template {
data = "{{ key \"secrets/consul/consul-client.key\" }}"
destination = "secrets/consul-client.key"
}
resources {
memory = 1000
memory_max = 3000
cpu = 1000
}
kill_timeout = "20s"
restart {
interval = "30m"
attempts = 10
delay = "15s"
mode = "delay"
}
#### Configuration for service ports: admin port (internal use only)
service {
port = "admin"
address_mode = "host"
name = "garage-admin"
# Check that Garage is alive and answering TCP connections
check {
type = "tcp"
interval = "60s"
timeout = "5s"
check_restart {
limit = 3
grace = "90s"
ignore_warnings = false
}
}
}
#### Configuration for service ports: externally available ports (API, web)
service {
tags = [
"garage_api",
"tricot garage.deuxfleurs.fr",
"tricot *.garage.deuxfleurs.fr",
"tricot-site-lb",
]
port = "s3"
address_mode = "host"
name = "garage-api"
# Check 1: Garage is alive and answering TCP connections
check {
name = "garage-api-live"
type = "tcp"
interval = "60s"
timeout = "5s"
check_restart {
limit = 3
grace = "90s"
ignore_warnings = false
}
}
# Check 2: Garage is in a healthy state and requests should be routed here
check {
name = "garage-api-healthy"
port = "admin"
type = "http"
path = "/health"
interval = "60s"
timeout = "5s"
}
}
service {
tags = [
"garage-web",
"tricot * 1",
"tricot-add-header Strict-Transport-Security max-age=63072000; includeSubDomains; preload",
"tricot-add-header X-Frame-Options SAMEORIGIN",
"tricot-add-header X-XSS-Protection 1; mode=block",
"tricot-add-header X-Content-Type-Options nosniff",
"tricot-on-demand-tls-ask http://garage-admin.service.prod.consul:3903/check",
"tricot-site-lb",
]
port = "web"
address_mode = "host"
name = "garage-web"
# Check 1: Garage is alive and answering TCP connections
check {
name = "garage-web-live"
type = "tcp"
interval = "60s"
timeout = "5s"
check_restart {
limit = 3
grace = "90s"
ignore_warnings = false
}
}
# Check 2: Garage is in a healthy state and requests should be routed here
check {
name = "garage-web-healthy"
port = "admin"
type = "http"
path = "/health"
interval = "60s"
timeout = "5s"
}
}
service {
tags = [
"garage-redirect-dummy",
"tricot www.deuxfleurs.fr 2",
"tricot osuny.org 2",
"tricot www.degrowth.net 2",
"tricot-add-redirect www.deuxfleurs.fr deuxfleurs.fr 301",
"tricot-add-redirect osuny.org www.osuny.org 301",
"tricot-add-redirect www.degrowth.net degrowth.net 301",
]
name = "garage-redirect-dummy"
address_mode = "host"
port = "web"
on_update = "ignore"
}
service {
tags = [
"garage_k2v",
"tricot k2v.deuxfleurs.fr",
"tricot-site-lb",
]
port = "k2v"
address_mode = "host"
name = "garage-k2v"
# Check 1: Garage is alive and answering TCP connections
check {
name = "garage-k2v-live"
type = "tcp"
interval = "60s"
timeout = "5s"
check_restart {
limit = 3
grace = "90s"
ignore_warnings = false
}
}
# Check 2: Garage is in a healthy state and requests should be routed here
check {
name = "garage-k2v-healthy"
port = "admin"
type = "http"
path = "/health"
interval = "60s"
timeout = "5s"
}
}
}
}
}

171
install_nomad_consul.sh Normal file
View File

@ -0,0 +1,171 @@
#!/usr/bin/env bash
if [ -z "$BIND_ADDR" ]; then
BIND_ADDR=$(ip -4 -br addr show dev ip0 | awk '{print $NF}' | awk -F "/" '{print $1}' )
fi
if [ -z "$NODE_NAME" ]; then
read -p "Provide node_name: " NODE_NAME
fi
#read -p "node_name='$NODE_NAME', BIND_ADDR='$BIND_ADDR', ok?"
### CONSUL ###
echo "Installing dependencies..."
sudo apt-get update
sudo apt-get install -y unzip curl jq dnsutils
if [ ! -f /usr/bin/consul ]; then
CHECKPOINT_URL="https://checkpoint-api.hashicorp.com/v1/check"
if [ -z "$CONSUL_VERSION" ]; then
CONSUL_VERSION=$(curl -s "${CHECKPOINT_URL}"/consul | jq .current_version | tr -d '"')
fi
echo "Fetching Consul version ${CONSUL_VERSION} ..."
cd /tmp/
curl -s https://releases.hashicorp.com/consul/${CONSUL_VERSION}/consul_${CONSUL_VERSION}_linux_amd64.zip -o consul.zip
echo "Installing Consul version ${CONSUL_VERSION} ..."
unzip consul.zip
sudo chmod +x consul
sudo mv consul /usr/bin/consul
fi
# useradd : -U create a group same as username, -r system user
sudo mkdir /etc/consul.d
sudo chmod a+w /etc/consul.d
sudo useradd -Urd /var/consul/ consul
sudo mkdir -p /var/consul/data
sudo chown -R consul /var/consul/data
cat <<EOF | sudo tee /etc/consul.d/consul.hcl
node_name = "$NODE_NAME"
advertise_addr = "$BIND_ADDR"
bind_addr = "$BIND_ADDR"
server = true
bootstrap_expect = 3
# Generated by `consul keygen`
encrypt = "fMVZvH42OjraXuJhrPPLV+4XZpbcJjq32LoDFm1BgLs="
retry_join = [
"10.0.1.1",
"10.0.1.2",
"10.0.1.3"
]
ui_config {
enabled = true
}
datacenter = "dc1"
data_dir = "/var/consul/data"
log_level = "INFO"
client_addr = "127.0.0.1"
connect {
enabled = true
}
EOF
cat <<'EOF' | sudo tee /etc/systemd/system/consul.service
[Unit]
Description="HashiCorp Consul - A service mesh solution"
Documentation=https://www.consul.io/
Requires=network-online.target
After=network-online.target
ConditionFileNotEmpty=/etc/consul.d/consul.hcl
[Service]
EnvironmentFile=-/etc/consul.d/consul.env
User=consul
Group=consul
ExecStart=/usr/bin/consul agent -config-dir=/etc/consul.d/
ExecReload=/bin/kill --signal HUP ${MAINPID}
KillMode=process
KillSignal=SIGTERM
Restart=on-failure
LimitNOFILE=65536
[Install]
WantedBy=multi-user.target
EOF
### NOMAD
if [ ! -f /usr/bin/nomad ]; then
if [ -z "$NOMAD_VERSION" ]; then
NOMAD_VERSION=$(curl -s "${CHECKPOINT_URL}"/nomad | jq .current_version | tr -d '"')
fi
echo "Fetching Nomad version ${NOMAD_VERSION} ..."
cd /tmp/
curl -s https://releases.hashicorp.com/nomad/${NOMAD_VERSION}/nomad_${NOMAD_VERSION}_linux_amd64.zip -o nomad.zip
echo "Installing Nomad version ${NOMAD_VERSION} ..."
unzip nomad.zip
sudo chmod +x nomad
sudo mv nomad /usr/bin/nomad
fi
# useradd : -U create a group same as username, -r system user
sudo mkdir /etc/nomad.d
sudo chmod a+w /etc/nomad.d
sudo useradd -Urd /var/nomad/ nomad
sudo mkdir -p /var/nomad/data
sudo chown -R nomad /var/nomad/data
cat <<EOF | sudo tee /etc/nomad.d/nomad.hcl
name = "$NODE_NAME"
bind_addr = "0.0.0.0"
#addresses {
# http = "127.0.0.1 $BIND_ADDR"
#}
#advertise {
# http = "127.0.0.1 $BIND_ADDR"
#}
server {
enabled = true
bootstrap_expect = 3
encrypt = "ESPWsUrvhho/BiwwKO9aftrniw+P3FUw5yvmeYHeQv8="
server_join {
retry_join = [
"10.0.1.1",
"10.0.1.2",
"10.0.1.3"
]
}
}
consul {
address = "$BIND_ADDR:8500"
}
datacenter = "dc1"
data_dir = "/var/nomad/data"
log_level = "INFO"
EOF
cat <<'EOF' | sudo tee /etc/systemd/system/nomad.service
[Unit]
Description="HashiCorp nomad"
Documentation=https://www.nomadproject.io/docs/
Requires=network-online.target
Wants=consul.service
After=consul.service
ConditionFileNotEmpty=/etc/nomad.d/nomad.hcl
[Service]
EnvironmentFile=-/etc/nomad.d/nomad.env
User=nomad
Group=nomad
ExecStart=/usr/bin/nomad agent -config /etc/nomad.d/
ExecReload=/bin/kill --signal HUP ${MAINPID}
KillMode=process
KillSignal=SIGTINT
Restart=on-failure
LimitNOFILE=65536
OOMScoreAdjust=-1000
[Install]
WantedBy=multi-user.target
EOF
### START SERVICES
sudo systemctl daemon-reload
sudo systemctl restart consul.service
sudo systemctl restart nomad.service