跳至主要內容

Consul集群部署

Salmon2026/1/15大约 4 分钟Consul集群高可用

Consul 集群部署

一、集群架构

1.1 架构概述

1.2 节点角色

角色说明数量建议
Server存储数据，参与 Raft 共识3 或 5
Client转发请求，本地缓存每台应用服务器
Leader处理写请求1（自动选举）
Follower复制数据，处理读请求N-1

二、环境准备

2.1 服务器规划

节点IP角色配置
consul-1192.168.1.10Server2C4G
consul-2192.168.1.11Server2C4G
consul-3192.168.1.12Server2C4G

2.2 端口开放

# 防火墙配置
firewall-cmd --permanent --add-port=8300/tcp  # Server RPC
firewall-cmd --permanent --add-port=8301/tcp  # LAN Serf
firewall-cmd --permanent --add-port=8301/udp
firewall-cmd --permanent --add-port=8302/tcp  # WAN Serf
firewall-cmd --permanent --add-port=8302/udp
firewall-cmd --permanent --add-port=8500/tcp  # HTTP API
firewall-cmd --permanent --add-port=8600/tcp  # DNS
firewall-cmd --permanent --add-port=8600/udp
firewall-cmd --reload

三、Server 配置

3.1 节点 1 配置

// /etc/consul.d/server.json
{
  "datacenter": "dc1",
  "node_name": "consul-1",
  "data_dir": "/opt/consul/data",
  "log_level": "INFO",
  "server": true,
  "bootstrap_expect": 3,
  "bind_addr": "192.168.1.10",
  "client_addr": "0.0.0.0",
  "retry_join": ["192.168.1.11", "192.168.1.12"],
  "ui_config": {
    "enabled": true
  },
  "connect": {
    "enabled": true
  },
  "performance": {
    "raft_multiplier": 1
  }
}

3.2 节点 2 配置

{
  "datacenter": "dc1",
  "node_name": "consul-2",
  "data_dir": "/opt/consul/data",
  "log_level": "INFO",
  "server": true,
  "bootstrap_expect": 3,
  "bind_addr": "192.168.1.11",
  "client_addr": "0.0.0.0",
  "retry_join": ["192.168.1.10", "192.168.1.12"],
  "ui_config": {
    "enabled": true
  }
}

3.3 节点 3 配置

{
  "datacenter": "dc1",
  "node_name": "consul-3",
  "data_dir": "/opt/consul/data",
  "log_level": "INFO",
  "server": true,
  "bootstrap_expect": 3,
  "bind_addr": "192.168.1.12",
  "client_addr": "0.0.0.0",
  "retry_join": ["192.168.1.10", "192.168.1.11"],
  "ui_config": {
    "enabled": true
  }
}

四、启动集群

4.1 创建 Systemd 服务

# /etc/systemd/system/consul.service
[Unit]
Description=Consul Service Discovery Agent
Documentation=https://www.consul.io/
After=network-online.target
Wants=network-online.target

[Service]
Type=notify
User=consul
Group=consul
ExecStart=/usr/local/bin/consul agent -config-dir=/etc/consul.d/
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
KillSignal=SIGTERM
Restart=on-failure
RestartSec=5
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

4.2 启动服务

# 在所有节点执行
systemctl daemon-reload
systemctl enable consul
systemctl start consul

# 检查状态
systemctl status consul

4.3 验证集群

# 查看成员
consul members

# 输出示例
Node      Address            Status  Type    Build   Protocol  DC   Partition  Segment
consul-1  192.168.1.10:8301  alive   server  1.15.0  2         dc1  default    <all>
consul-2  192.168.1.11:8301  alive   server  1.15.0  2         dc1  default    <all>
consul-3  192.168.1.12:8301  alive   server  1.15.0  2         dc1  default    <all>

# 查看 Leader
consul operator raft list-peers

五、Client 配置

5.1 Client 配置文件

// /etc/consul.d/client.json
{
  "datacenter": "dc1",
  "node_name": "app-server-1",
  "data_dir": "/opt/consul/data",
  "log_level": "INFO",
  "server": false,
  "bind_addr": "192.168.1.100",
  "client_addr": "127.0.0.1",
  "retry_join": ["192.168.1.10", "192.168.1.11", "192.168.1.12"]
}

5.2 Docker 部署 Client

# docker-compose.yml
version: '3'
services:
  consul-client:
    image: consul:latest
    command: agent -retry-join=192.168.1.10 -retry-join=192.168.1.11
    environment:
      - CONSUL_BIND_INTERFACE=eth0
    network_mode: host

六、高可用配置

6.1 Raft 配置优化

{
  "performance": {
    "raft_multiplier": 1,
    "rpc_hold_timeout": "7s"
  },
  "raft_protocol": 3,
  "raft_snapshot_threshold": 8192,
  "raft_snapshot_interval": "30s"
}

6.2 自动 Pilot 配置

{
  "autopilot": {
    "cleanup_dead_servers": true,
    "last_contact_threshold": "200ms",
    "max_trailing_logs": 250,
    "server_stabilization_time": "10s"
  }
}

七、TLS 安全配置

7.1 生成证书

# 创建 CA
consul tls ca create

# 创建 Server 证书
consul tls cert create -server -dc dc1

# 创建 Client 证书
consul tls cert create -client -dc dc1

7.2 TLS 配置

{
  "tls": {
    "defaults": {
      "ca_file": "/etc/consul.d/certs/consul-agent-ca.pem",
      "cert_file": "/etc/consul.d/certs/dc1-server-consul-0.pem",
      "key_file": "/etc/consul.d/certs/dc1-server-consul-0-key.pem",
      "verify_incoming": true,
      "verify_outgoing": true
    },
    "internal_rpc": {
      "verify_server_hostname": true
    }
  }
}

八、备份与恢复

8.1 快照备份

# 创建快照
consul snapshot save backup.snap

# 定时备份脚本
#!/bin/bash
DATE=$(date +%Y%m%d_%H%M%S)
consul snapshot save /backup/consul_${DATE}.snap
find /backup -name "consul_*.snap" -mtime +7 -delete

8.2 恢复快照

# 恢复快照
consul snapshot restore backup.snap

8.3 自动备份配置

# crontab
0 */6 * * * /usr/local/bin/consul snapshot save /backup/consul_$(date +\%Y\%m\%d_\%H\%M\%S).snap

九、扩容与缩容

9.1 添加 Server 节点

# 1. 配置新节点
# 2. 启动新节点（会自动加入）
consul agent -config-dir=/etc/consul.d/

# 3. 验证
consul members
consul operator raft list-peers

9.2 移除 Server 节点

# 1. 优雅离开
consul leave

# 2. 强制移除（节点故障时）
consul operator raft remove-peer -address="192.168.1.12:8300"

9.3 替换故障节点

# 1. 移除故障节点
consul operator raft remove-peer -address="故障节点IP:8300"

# 2. 添加新节点
# 配置新节点并启动

十、监控告警

10.1 健康检查脚本

#!/bin/bash
# check_consul.sh

# 检查 Leader
LEADER=$(consul operator raft list-peers | grep leader | wc -l)
if [ "$LEADER" -ne 1 ]; then
    echo "CRITICAL: No leader elected"
    exit 2
fi

# 检查节点数量
SERVERS=$(consul members | grep server | grep alive | wc -l)
if [ "$SERVERS" -lt 3 ]; then
    echo "WARNING: Only $SERVERS servers alive"
    exit 1
fi

echo "OK: Consul cluster healthy"
exit 0

10.2 Prometheus 监控

# prometheus.yml
scrape_configs:
  - job_name: 'consul'
    metrics_path: '/v1/agent/metrics'
    params:
      format: ['prometheus']
    static_configs:
      - targets: ['192.168.1.10:8500', '192.168.1.11:8500', '192.168.1.12:8500']

十一、总结

最近更新:
贡献者: Salmon