{"id":377597,"date":"2024-05-30T21:00:44","date_gmt":"2024-05-30T21:00:44","guid":{"rendered":"http:\/\/savepearlharbor.com\/?p=377597"},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-29T21:00:00","slug":"","status":"publish","type":"post","link":"https:\/\/savepearlharbor.com\/?p=377597","title":{"rendered":"Vault HA + Consul HA + k8s<\/span>"},"content":{"rendered":"
<\/div>\n
\n
\n
\n
\n

\u0412 \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u043a\u0430\u0437\u0430\u043d \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 HashiCorp Vault \u0441 \u0441\u0432\u044f\u0437\u043a\u0435 \u0441 Consul, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u0441\u0442\u0443\u043f\u0430\u0435\u0442 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435\u043c \u0434\u043b\u044f Vault, \u0432 HA \u0440\u0435\u0436\u0438\u043c\u0435 \u0441 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u043c tls \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0432 Kubernetes \u043a\u043b\u0430\u0441\u0442\u0435\u0440.
\u0418\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435:
— Kubernetes \u043a\u043b\u0430\u0441\u0442\u0435\u0440 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 yandex)
— \u0412 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d nginx ingress controller, \u0432 \u0441\u0442\u0430\u0442\u044c\u0435 \u043a\u043b\u0430\u0441\u0441 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d \u043a\u0430\u043a\u00a0nginx-internal
— <\/em><\/strong>\u0414\u043b\u044f UI \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0442 TLS\/SSL \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b.
— \u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d helm 3
— \u0435\u0441\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0443 \u0447\u0435\u0440\u0435\u0437 kubectl \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430.
— \u0435\u0441\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c docker \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440<\/p>\n

\u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 Consul<\/h3>\n

\u0421\u043a\u0430\u0447\u0430\u0442\u044c \u0438\u0441\u0445\u043e\u0434\u043d\u0438\u043a\u0438 \u0447\u0430\u0440\u0442\u043e\u0432 consul-k8s https:\/\/github.com\/hashicorp\/consul-k8s\/tree\/main\/charts\/consul<\/a><\/p>\n

\u041b\u0438\u0431\u043e \u0447\u0435\u0440\u0435\u0437 helm, \u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f \u0438\u0437 \u0420\u043e\u0441\u0441\u0438\u0438 \u0441\u0435\u0439\u0447\u0430\u0441 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d:<\/p>\n

$ helm repo add hashicorp https:\/\/helm.releases.hashicorp.com $ helm pull hashicorp\/consul<\/code><\/pre>\n
\u0421\u043e\u0437\u0434\u0430\u0442\u044c\u00a0<\/strong>namespace<\/code>:<\/strong><\/p>\n
$ kubectl create namespace consul<\/code><\/pre>\n
\u0421\u043e\u0437\u0434\u0430\u0442\u044c secret \u0434\u043b\u044f ssl<\/strong>\u00a0\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u0434\u043b\u044f ingress \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430.<\/p>\n
\u0414\u043e\u043f\u0443\u0441\u0442\u0438\u043c \u0443 \u0432\u0430\u0441 \u0435\u0441\u0442\u044c ssl \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u043e\u0442\u00a0https:\/\/letsencrypt.org\/<\/a>\u00a0:
\u0421\u043e\u0437\u0434\u0430\u0442\u044c \u0444\u0430\u0438\u043b\u00a0secret-tls-consul.yaml<\/code>\u00a0:<\/p>\n
apiVersion: v1 kind: Secret metadata:   name: secret-tls data:   tls.crt: <tls.crt base64>   tls.key: <tls.key base64> type: kubernetes.io\/tls<\/code><\/pre>\n
\u0433\u0434\u0435:
\u0432\u043c\u0435\u0441\u0442\u043e <tls.crt base64> \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0437\u0430\u043d\u0430\u0447\u0435\u043d\u0438\u0435:
$ cat fullchain1.pem | base64 -w0<\/code>
\u0432\u043c\u0435\u0441\u0442\u043e <tls.key base64> \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435:
$ cat privkey1.pem | base64 -w0<\/code><\/p>\n
\u041f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0439 \u043c\u0430\u043d\u0438\u0444\u0435\u0441\u0442:<\/p>\n
$ kubectl -n consul apply -f secret-tls-consul.yaml<\/code><\/pre>\n
\u0421\u043e\u0437\u0434\u0430\u0442\u044c \u0444\u0430\u0438\u043b\u00a0<\/strong>values-work.yaml<\/code>\u00a0\u0433\u0434\u0435 \u043f\u0435\u0440\u0435\u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435:<\/p>\n
global:   enabled: true   logLevel: \"info\"   logJSON: true   datacenter: vault-storage   gossipEncryption:     autoGenerate: false     secretName: consul-consul-gossip-encryption-key     secretKey: key   tls:     enabled: true     enableAutoEncrypt: true   server:   enabled: \"-\"   replicas: 3   storage: 5Gi   storageClass: yc-network-ssd   connect: true   client:   enabled: false   connectInject:   enabled: false   ui:   enabled: \"-\"   service:     enabled: true   ingress:     enabled: true       annotations: |       \"nginx.ingress.kubernetes.io\/backend-protocol\": \"HTTPS\"       ingressClassName: nginx-internal     pathType: Prefix       hosts:     - host: consul.k8s.domain.com       tls:       - secretName: secret-tls         hosts:           - consul.k8s.domain.com<\/code><\/pre>\n
\u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u043c\u043e\u043c\u0435\u043d\u0442\u044b \u0444\u0430\u0439\u043b\u0430:<\/strong>
gossipEncryption<\/code>\u00a0: \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u043c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435, \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u043c \u0438\u043c\u044f \u0441\u0435\u043a\u0440\u0435\u0442\u0430, \u0433\u0434\u0435 \u0431\u0443\u0434\u0435\u0442 \u0445\u0440\u0430\u043d\u0438\u0442\u044c\u0441\u044f \u043a\u043b\u044e\u0447. \u0421\u0430\u043c \u043a\u043b\u044e\u0447 \u0441\u043e\u0437\u0434\u0430\u0435\u0442\u0441\u044f \u0442\u0430\u043a (<KeyString> \u043d\u0443\u0436\u043d\u043e\u00a0\u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c<\/a>):<\/p>\n
$ docker run --rm -ti --entrypoint=\/bin\/sh hashicorp\/consul:latest \/ # consul keygen <KeyString><\/code><\/pre>\n
$ kubectl -n consul create secret generic \\      consul-consul-gossip-encryption-key --from-literal=key=<KeyString><\/code><\/pre>\n
replicas: 3<\/code>: \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0440\u0435\u043f\u043b\u0438\u043a, \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u0442\u044c \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043d\u043e\u0434 \u0432 k8s \u043b\u0438\u0431\u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d \u0430\u0432\u0442\u043e\u0441\u043a\u0435\u0439\u043b\u0438\u043d\u0433
storageClass: yc-network-ssd<\/code>\u00a0— \u043e\u0434\u0438\u043d \u0438\u0437 \u043a\u043b\u0430\u0441\u0441\u043e\u0432 \u0432 yandex. \u041e\u0441\u0442\u0440\u043e\u0436\u043d\u043e, \u0443 \u043d\u0435\u0433\u043e RECLAIMPOLICY=Delete, \u044d\u0442\u043e \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u0435\u0441\u043b\u0438 \u0443\u0434\u0430\u043b\u0438\u0442\u044c pvc, \u0442\u043e \u0434\u0438\u0441\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u0443\u0434\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u043d, \u0442\u043e\u0436\u0435 \u0431\u0443\u0434\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d.
enableAutoEncrypt: true<\/code>: \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u044d\u0442\u043e\u0439 \u0441\u0442\u0440\u043e\u0447\u043a\u0435 \u0431\u0443\u0434\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u043d \u0441\u0430\u043c\u043e\u043f\u043e\u0434\u043f\u0438\u0441\u043d\u043e\u0439 CA (\u0441\u0435\u043a\u0440\u0435\u0442\u044b:\u00a0consul-consul-ca-cert,consul-consul-ca-key<\/code>), \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u043a\u0430\u0442 \u0438 \u043a\u043b\u044e\u0447 \u0434\u043b\u044f \u0441\u0430\u043c\u043e\u0433\u043e consul (\u0441\u0435\u043a\u0440\u0435\u0442: consul-consul-server-cert).<\/p>\n
\u041c\u043e\u0436\u043d\u043e \u043f\u043e\u043f\u0440\u043e\u0431\u043e\u0432\u0430\u0442\u044c \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c:<\/strong><\/p>\n
$ helm -n consul upgrade --install consul -f values-work.yaml .\/consul-1.3.1<\/code><\/pre>\n
\u0433\u0434\u0435 .\/consul-1.3.1 — \u043f\u0430\u043f\u043a\u0430 \u0441 \u0447\u0430\u0440\u0442\u043e\u043c consul<\/p>\n
$ kubectl -n consul get pods,pvc NAME                         READY   STATUS    RESTARTS   AGE pod\/consul-consul-server-0   1\/1     Running   0          30m pod\/consul-consul-server-1   1\/1     Running   0          30m pod\/consul-consul-server-2   1\/1     Running   0          30m  NAME                                                       STATUS   persistentvolumeclaim\/data-consul-consul-consul-server-0   Bound    persistentvolumeclaim\/data-consul-consul-consul-server-1   Bound    persistentvolumeclaim\/data-consul-consul-consul-server-2   Bound<\/code><\/pre>\n
\u0421\u0430\u043c\u043e\u043f\u043e\u0434\u043f\u0438\u0441\u043d\u044b\u0435 SSL:<\/strong>
\u041f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u043e\u043f\u0446\u0438\u0438\u00a0enableAutoEncrypt: true<\/em><\/strong>\u00a0\u0421\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f consul \u0441\u043e\u0437\u0434\u0430\u0435\u0442\u0441\u044f \u0441\u0440\u043e\u043a\u043e\u043c \u043d\u0430 \u0434\u0432\u0430 \u0433\u043e\u0434\u0430, \u0447\u0442\u043e\u0431\u044b \u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u043e\u043c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043f\u0435\u0440\u0438\u043e\u0434\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u0435\u0440\u0435\u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c \u0441\u0430\u043c consul. \u041a \u0442\u043e\u043c\u0443 \u0436\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u043e\u0442 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0435\u0433\u043e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f, \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u0442\u0430\u043a\u043e\u0439:<\/p>\n
Issuer: C = US, ST = CA, L = San Francisco, street = 101 Second Street, postalCode = 94105, O = HashiCorp Inc., CN = Consul Agent CA<\/code><\/pre>\n
\u041d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0441\u0432\u043e\u0439 CA \u0438 \u0441\u0432\u043e\u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b, \u0437\u0430\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438, \u0438\u043b\u0438 \u0432\u0437\u044f\u0442\u044c \u0443\u0436\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435:<\/p>\n
$ openssl genrsa -out rootCA.key 4096 $ openssl req -x509 -new -key rootCA.key -days 10000 -out rootCA.crt ........ Country Name (2 letter code) [AU]:RU State or Province Name (full name) [Some-State]:Moscow Locality Name (eg, city) []:Moscow Organization Name (eg, company) [Internet Widgits Pty Ltd]:Domain LTD Organizational Unit Name (eg, section) []:devops Common Name (e.g. server FQDN or YOUR name) []: Email Address []:devops@domain.com<\/code><\/pre>\n
\u0421\u043e\u0437\u0434\u0430\u0442\u044c \u0444\u0430\u0438\u043b\u00a0consul.conf<\/strong>:<\/p>\n
[req] default_bits = 4096 prompt = no default_md = sha256   req_extensions = v3_req distinguished_name = dn   [dn] C = RU ST = Moscow L = Moscow CN = server.vault-storage.consul   [ v3_req ] basicConstraints = CA:FALSE keyUsage = nonRepudiation, digitalSignature, keyEncipherment<\/code><\/pre>\n
\u0421\u043e\u0437\u0434\u0430\u0442\u044c \u0444\u0430\u0438\u043b\u00a0consul.ext<\/strong>:<\/p>\n
subjectAltName=DNS:consul-consul-server, DNS:*.consul-consul-server, DNS:*.consul-consul-server.consul, DNS:consul-consul-server.consul, DNS:*.consul-consul-server.consul.svc, DNS:consul-consul-server.consul.svc, DNS:*.server.vault-storage.consul, DNS:server.vault-storage.consul, DNS:localhost, IP:127.0.0.1<\/code><\/pre>\n
\u0421\u043f\u0438\u0441\u043e\u043a \u044d\u0442\u0438\u0445\u00a0subjectAltName<\/strong>\u00a0\u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0434\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u0432 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043d \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.<\/p>\n
\u0421\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u043b\u044e\u0447 \u0438 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u0442\u044c\/\u043f\u043e\u0434\u043f\u0438\u0441\u0430\u0442\u044c \u0441\u0435\u0440\u0442\u0438\u0444\u043a\u0430\u0442:<\/p>\n
$ openssl genrsa -out consul.key 4096   $ openssl req -new \\     -key consul.key \\     -out consul.csr \\     -config consul.conf   $ openssl x509 -req \\     -in consul.csr \\     -CA rootCA.crt -CAkey rootCA.key \\     -CAcreateserial -out consul.crt \\     -extfile consul.ext \\     -days 5000<\/code><\/pre>\n
\u0421\u043e\u0437\u0434\u0430\u0442\u044c \u0441\u0435\u043a\u0440\u0435\u0442\u044b \u0441 \u044d\u0442\u0438\u043c\u0438 \u043a\u043b\u044e\u0447\u043e\u043c \u0441 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\u043c\u0438:<\/p>\n
$ kubectl -n consul create secret generic root-ca --from-file=tls.crt=rootCA.crt $ kubectl -n consul create secret tls consul --key consul.key --cert consul.crt<\/code><\/pre>\n
\u041f\u043e\u043c\u0435\u043d\u044f\u0442\u044c\u00a0values-work.yaml<\/code>\u00a0\u0434\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u044d\u0442\u0438\u0445 \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432:<\/p>\n
global:   enabled: true   logLevel: \"info\"   logJSON: true   datacenter: vault-storage   gossipEncryption:     autoGenerate: false     secretName: consul-consul-gossip-encryption-key     secretKey: key   tls:     enabled: true     enableAutoEncrypt: false     caCert:       # The name of the Kubernetes secret.       secretName: root-ca       # The key of the Kubernetes secret.       secretKey: tls.crt     verify: true   server:   enabled: \"-\"   replicas: 3   storage: 5Gi   storageClass: yc-network-ssd   connect: true   serverCert:     # The name of the Vault secret that holds the PEM encoded server certificate.     # @type: string     secretName: consul   client:   enabled: false   connectInject:   enabled: false   ui:   enabled: \"-\"   service:     enabled: true   ingress:     enabled: true       annotations: |       \"nginx.ingress.kubernetes.io\/backend-protocol\": \"HTTPS\"       ingressClassName: nginx-internal     pathType: Prefix       hosts:     - host: consul.k8s.domain.com       tls:       - secretName: secret-tls         hosts:           - consul.k8s.domain.com<\/code><\/pre>\n
\u0423\u0434\u0430\u043b\u0438\u0442\u044c \u043d\u0435\u043d\u0443\u0436\u043d\u044b\u0435 \u0441\u0435\u043a\u0440\u0435\u0442\u044b \u0438 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441 \u043d\u043e\u0432\u044b\u043c\u0438 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u043c\u0438:<\/p>\n
$ kubectl -n consul delete secrets consul-consul-ca-cert consul-consul-ca-key consul-consul-server-cert $ helm -n consul upgrade --install consul -f values-work.yaml .\/consul-1.3.1<\/code><\/pre>\n
\u0423\u0434\u0430\u043b\u0438\u0442\u044c \u0432\u0441\u0435 \u043f\u043e\u0434\u044b consul, \u0442\u0430\u043a \u043a\u0430\u043a \u0438\u0437-\u0437\u0430 \u043d\u043e\u0432\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432, \u043e\u043d\u0438 \u043d\u0435 \u0441\u043c\u043e\u0433\u0443\u0442 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u0442\u044c \u0434\u0440\u0443\u0433 \u0441 \u0434\u0440\u0443\u0433\u043e\u043c:<\/p>\n
$ kubectl -n consul delete pods --all<\/code><\/pre>\n
\u0417\u0430\u043a\u0440\u044b\u0442\u044c \u0442\u043e\u043a\u0435\u043d\u043e\u043c UI consul<\/strong><\/p>\n
\u041f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e\u00a0values-work.yaml \u043a \u0432\u0438\u0434\u0443:<\/code><\/p>\n
global:   enabled: true   logLevel: \"info\"   logJSON: true   datacenter: vault-storage   gossipEncryption:     autoGenerate: false     secretName: consul-consul-gossip-encryption-key     secretKey: key   tls:     enabled: true     enableAutoEncrypt: false     caCert:       # The name of the Kubernetes secret.       secretName: root-ca       # The key of the Kubernetes secret.       secretKey: tls.crt     verify: true   server:   enabled: \"-\"   replicas: 3   storage: 5Gi   storageClass: yc-network-ssd   connect: true   serverCert:     # The name of the Vault secret that holds the PEM encoded server certificate.     # @type: string     secretName: consul     extraConfig: |         {           \"addresses\": {             \"http\": \"0.0.0.0\"           },           \"acl\": {             \"enabled\": true,             \"default_policy\": \"deny\",             \"down_policy\": \"extend-cache\",             \"enable_token_persistence\": true           }         }   client:   enabled: false   connectInject:   enabled: false   ui:   enabled: \"-\"   service:     enabled: true   ingress:     enabled: true       annotations: |       \"nginx.ingress.kubernetes.io\/backend-protocol\": \"HTTPS\"       ingressClassName: nginx-internal     pathType: Prefix       hosts:     - host: consul.k8s.domain.com       tls:       - secretName: secret-tls         hosts:           - consul.k8s.domain.com<\/code><\/pre>\n
\u041f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c\/\u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c:<\/p>\n
$ helm -n consul upgrade --install consul -f values-work.yaml .\/consul-1.3.1 <\/code><\/pre>\n
\u0414\u043e\u0436\u0434\u0430\u0442\u044c\u0441\u044f \u043f\u043e\u043a\u0430 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0443\u0441\u0442\u044f\u0442\u0441\u044f \u0432\u0441\u0435 \u043f\u043e\u0434\u044b, \u0438 \u0431\u0443\u0434\u0435\u0442 \u0432\u044b\u0431\u0440\u0430\u043d \u043b\u0438\u0434\u0435\u0440 — \u043c\u043e\u0436\u043d\u043e \u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u043f\u043e \u043b\u043e\u0433\u0430\u043c:<\/p>\n
$ kubectl -n consul logs consul-consul-server-2 -f<\/code><\/pre>\n
\u0417\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u044e bootstrap \u0442\u043e\u043a\u0435\u043d\u0430:<\/p>\n
$ kubectl -n consul exec -ti consul-consul-server-0 -- sh -c \"consul acl bootstrap | grep -i secretid\" Defaulted container \"consul\" out of: consul, locality-init (init) SecretID:         <bootstrap token string><\/code><\/pre>\n
\u0422\u043e\u043a\u0435\u043d (SecretID) \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u043c \u043c\u0435\u0441\u0442\u0435.<\/p>\n
\u0427\u0435\u0440\u0435\u0437 web \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0447\u0442\u043e \u0432\u0441\u0435 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442: \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0439 \u0442\u043e\u043a\u0435\u043d.<\/p>\n
\u0412\u0430\u0436\u043d\u044b\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u0434\u043b\u044f \u0434\u0438\u0430\u0433\u043d\u043e\u0441\u0442\u0438\u043a\u0438, \u0435\u0441\u043b\u0438 \u0447\u0442\u043e-\u0442\u043e \u043f\u043e\u0448\u043b\u043e \u043d\u0435 \u0442\u0430\u043a<\/strong>
\u0412 \u043c\u043e\u0435\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u0432 \u043b\u043e\u0433\u0430\u0445 \u0431\u044b\u043b\u0430 \u043e\u0448\u0438\u0431\u043a\u0430, \u0447\u0442\u043e \u043d\u0435\u0442 \u043a\u043b\u044e\u0447\u0430 \u0434\u043b\u044f \u0434\u0435\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439. \u041d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0435:<\/p>\n
$ kubectl -n consul exec -ti consul-consul-server-0 -- \\             cat \/consul\/data\/serf\/local.keyring [\"<KeyString>\"]<\/code><\/pre>\n
\u041a\u043b\u044e\u0447 \u0434\u043e\u043b\u0436\u0435\u043d \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u044c\u0441\u044f \u0432 \u0441\u043f\u0438\u0441\u043a\u0435 \u0432\u0441\u0435\u0445 \u044d\u0442\u0438\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 (\u0432 \u043a\u0430\u0436\u0434\u043e\u043c \u043f\u043e\u0434\u0435). \u042d\u0442\u043e \u0442\u043e\u0442 \u0441\u0430\u043c\u044b\u0439 \u043a\u043b\u044e\u0447 \u0438\u0437 \u0441\u0435\u043a\u0440\u0435\u0442\u0430\u00a0consul-consul-gossip-encryption-key<\/code>, \u0437\u0434\u0435\u0441\u044c \u043e\u043d \u0431\u0443\u0434\u0435\u0442 \u0443\u043a\u0430\u0437\u0430\u043d \u0431\u0435\u0437 base64 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u043a\u0438.<\/p>\n
\u0421\u043e\u0437\u0434\u0430\u0442\u044c \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0443 \u0438 \u0442\u043e\u043a\u0435\u043d \u0434\u043b\u044f Vault:<\/strong><\/p>\n
\"\u0421\u043e\u0437\u0434\u0430\u043d\u0438\u0435<\/p>\n
\u0421\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u041f\u043e\u043b\u0438\u0442\u0438\u043a\u0438<\/figcaption><\/div>\n<\/figure>\n
\"\u0421\u043e\u0437\u0434\u0430\u043d\u0438\u0435<\/p>\n
\u0421\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u0422\u043e\u043a\u0435\u043d\u0430 \u0432 \u0441\u0432\u044f\u0437\u043a\u0435 \u0441 \u041f\u043e\u043b\u0438\u0442\u0438\u043a\u043e\u0439<\/figcaption><\/div>\n<\/figure>\n
\u0422\u043e\u043a\u0435\u043d \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f \u0434\u0430\u043b\u0435\u0435.<\/p>\n
\u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 Vault<\/h3>\n
\u0421\u043e\u0437\u0434\u0430\u0442\u044c tls\/ssl \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b<\/strong><\/p>\n
\u0421\u043e\u0437\u0434\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b:
vault.conf:<\/p>\n
[req] default_bits = 4096 prompt = no default_md = sha256   req_extensions = v3_req distinguished_name = dn   [dn] C = RU ST = Russia L = Moscow CN = vault-server-tls.vault.svc   [ v3_req ] basicConstraints = CA:FALSE keyUsage = nonRepudiation, digitalSignature, keyEncipherment<\/code><\/pre>\n
vault.ext:<\/p>\n
subjectAltName=DNS:vault,DNS:localhost,DNS:vault-0.vault-internal,DNS:vault-1.vault-internal,DNS:vault-2.vault-internal,IP:127.0.0.1<\/code><\/pre>\n
\u0421\u043e\u0437\u0434\u0430\u0442\u044c \u043a\u043b\u044e\u0447 \u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u043a\u0430\u0442:<\/p>\n
$ openssl genrsa -out vault.key 4096   $ openssl req -new \\     -key vault.key \\     -out vault.csr \\     -config vault.conf   $ openssl x509 -req \\     -in vault.csr \\     -CA rootCA.crt -CAkey rootCA.key \\     -CAcreateserial -out vault.crt \\     -extfile vault.ext \\     -days 5000<\/code><\/pre>\n
\u0413\u0434\u0435 rootCA.key \u0438 rootCA.crt — \u043a\u043b\u044e\u0447 \u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u043a\u0430\u0442 CA \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 consul<\/p>\n
\u0421\u043e\u0437\u0434\u0430\u0442\u044c secret-\u044b \u0438\u0437 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432:<\/p>\n
$ kubectl create ns vault $ kubectl -n vault create secret tls vault --key vault.key --cert vault.crt $ kubectl -n vault create secret generic root-ca --from-file=tls.crt=rootCA.crt<\/code><\/pre>\n
\u0421\u043a\u0430\u0447\u0430\u0442\u044c \u0441 github \u0438\u0441\u0445\u043e\u0434\u043d\u0438\u043a\u0438 helm \u0434\u043b\u044f Vault<\/strong>\u00a0https:\/\/github.com\/hashicorp\/vault-helm.git<\/a><\/p>\n
\u0421\u043e\u0437\u0434\u0430\u0442\u044c secret \u0434\u043b\u044f ssl<\/strong>\u00a0\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u0434\u043b\u044f ingress \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430.<\/p>\n
\u0414\u043e\u043f\u0443\u0441\u0442\u0438\u043c \u0443 \u0432\u0430\u0441 \u0435\u0441\u0442\u044c ssl \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u043e\u0442\u00a0https:\/\/letsencrypt.org\/<\/a>\u00a0:
\u0421\u043e\u0437\u0434\u0430\u0442\u044c \u0444\u0430\u0438\u043b\u00a0secret-tls-vault.yaml<\/code>\u00a0:<\/p>\n
apiVersion: v1 kind: Secret metadata:   name: secret-tls data:   tls.crt: <tls.crt base64>   tls.key: <tls.key base64> type: kubernetes.io\/tls<\/code><\/pre>\n
\u0433\u0434\u0435:
\u0432\u043c\u0435\u0441\u0442\u043e <tls.crt base64> \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0437\u0430\u043d\u0430\u0447\u0435\u043d\u0438\u0435:
$ cat fullchain1.pem | base64 -w0<\/code>
\u0432\u043c\u0435\u0441\u0442\u043e <tls.key base64> \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435:
$ cat privkey1.pem | base64 -w0<\/code><\/p>\n
\u041f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0439 \u043c\u0430\u043d\u0438\u0444\u0435\u0441\u0442:<\/p>\n
$ kubectl -n vault apply -f secret-tls-vault.yaml<\/code><\/pre>\n
\u0421\u043e\u0437\u0434\u0430\u0442\u044c \u0444\u0430\u0438\u043b values-work.yaml,\u00a0<\/strong>\u0433\u0434\u0435 \u043f\u0435\u0440\u0435\u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f:<\/p>\n
global:   tlsDisable: false   server:   standalone:     enabled: false   dataStorage:     enabled: false   extraEnvironmentVars:     VAULT_CACERT: \/vault\/userconfig\/root-ca\/tls.crt   extraVolumes:     - type: secret       name: root-ca     - type: secret       name: vault   ha:     enabled: true     replicas: 3     config: |       ui = true       listener \"tcp\" {         tls_disable = 0         address = \"[::]:8200\"         cluster_address = \"[::]:8201\"         tls_cert_file = \"\/vault\/userconfig\/vault\/tls.crt\"         tls_key_file = \"\/vault\/userconfig\/vault\/tls.key\"       }       storage \"consul\" {         path = \"vault\"         address = \"consul-consul-server.consul.svc:8501\"         scheme = \"https\"         tls_ca_file = \"\/vault\/userconfig\/root-ca\/tls.crt\"         token = \"<vault-token>\"       }       service_registration \"kubernetes\" {}     ingress:     enabled: yes     annotations:       nginx.ingress.kubernetes.io\/backend-protocol: \"HTTPS\"       ingressClassName: nginx-internal       hosts:       - host: vault.k8s.domain.com     tls:       - secretName: secret-tls         hosts:           - vault.k8s.domain.com   injector:   enabled: false   ui:   enabled: false<\/code><\/pre>\n
\u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u043c\u043e\u043c\u0435\u043d\u0442\u044b \u0444\u0430\u0439\u043b\u0430:<\/strong><\/p>\n
tls_disable = 0<\/code>: \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430
token = \"<vault-token>\":<\/code> \u0442\u043e\u043a\u0435\u043d, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u0441\u043e\u0437\u0434\u0430\u043d \u0432 Consul \u0434\u043b\u044f Vault.
address = \"consul-consul-server.consul.svc:8501\"<\/code>: \u0438\u043c\u044f\u00a0consul-consul-server.consul.svc<\/em>\u00a0\u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u0442\u044c \u043f\u0440\u043e\u043f\u0438\u0441\u0430\u043d\u043e \u0432 ssl \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0435 \u0434\u043b\u044f consul.<\/p>\n
\u0423\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c:<\/p>\n
$ helm upgrade -n vault --install vault -f values-work.yaml .\/vault-0.27.0<\/code><\/pre>\n
\u0417\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e<\/strong>, \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u043a\u043b\u044e\u0447\u0435\u0439 \u0438 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u0434\u043b\u044f \u043a\u043b\u044e\u0447\u0435\u0439 \u0434\u043b\u044f unseal:<\/p>\n
$ kubectl -n vault exec -ti vault-0 -- \/bin\/sh \/ $ vault operator init -key-shares=3 -key-threshold=2<\/code><\/pre>\n
\u0421\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u043a\u043b\u044e\u0447\u0438 \u0438 \u0442\u043e\u043a\u0435\u043d root \u0432 \u043d\u0430\u0434\u0435\u0436\u043d\u043e\u043c \u043c\u0435\u0441\u0442\u0435!<\/strong><\/p>\n
\u0420\u0430\u0441\u043f\u0435\u0447\u0430\u0442\u0430\u0442\u044c \u043a\u0430\u0436\u0434\u044b\u0439 \u043f\u043e\u0434 Vault \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0440\u0430\u0437 (\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 -key-threshold):<\/p>\n
$ kubectl -n vault exec -ti vault-0 -- \/bin\/sh \/ $ vault operator unseal Unseal Key (will be hidden): Key                Value ---                ----- Seal Type          shamir Initialized        true Sealed             true Total Shares       3 Threshold          2 Unseal Progress    1\/2 Unseal Nonce       cb2c64c9-ca57-0c98-2141-e99235f05853 Version            1.15.2 Build Date         2023-11-06T11:33:28Z Storage Type       consul HA Enabled         true<\/code><\/pre>\n
\u0423\u0441\u043f\u0435\u0448\u043d\u044b\u043c \u0438\u0442\u043e\u0433\u043e\u043c \u0431\u0443\u0434\u0435\u0442 \u0442\u0430\u043a\u043e\u0439 \u0432\u044b\u0432\u043e\u0434 \u0434\u043b\u044f \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u043f\u043e\u0434\u0430:<\/p>\n
$ kubectl -n vault exec -ti vault-0 -- vault status Key                      Value ---                      ----- Recovery Seal Type       shamir Initialized              true Sealed                   false Total Recovery Shares    3 Threshold                2 Version                  1.15.2 Build Date               2023-11-06T11:33:28Z Storage Type             consul Cluster Name             vault-cluster-51496cc6 Cluster ID               b77b3b96-9bfa-11a9-21b9-bcdc331bfe00 HA Enabled               true<\/code><\/pre>\n
\u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0447\u0435\u0440\u0435\u0437 UI<\/p>\n
\u041c\u043e\u0436\u043d\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f!<\/em><\/strong><\/p>\n
\u0414\u043b\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e Unseal \u0437\u0434\u0435\u0441\u044c \u043d\u0430 \u0425\u0430\u0431\u0440\u0435 \u0435\u0441\u0442\u044c \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0437\u0430\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u0442\u0430\u0442\u0435\u0439. \u041f\u043e\u0432\u0442\u043e\u0440\u044f\u0442\u044c \u0438\u0445 \u043d\u0435\u0442 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438.<\/p>\n<\/p>\n<\/div>\n<\/div>\n<\/div>\n
<\/div>\n

 \u0441\u0441\u044b\u043b\u043a\u0430 \u043d\u0430 \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b \u0441\u0442\u0430\u0442\u044c\u0438  https:\/\/habr.com\/ru\/articles\/818509\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
<\/div>\n
\n
\n
\n
\n
\u0412 \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u043a\u0430\u0437\u0430\u043d \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 HashiCorp Vault \u0441 \u0441\u0432\u044f\u0437\u043a\u0435 \u0441 Consul, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u0441\u0442\u0443\u043f\u0430\u0435\u0442 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435\u043c \u0434\u043b\u044f Vault, \u0432 HA \u0440\u0435\u0436\u0438\u043c\u0435 \u0441 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u043c tls \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0432 Kubernetes \u043a\u043b\u0430\u0441\u0442\u0435\u0440.
\u0418\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435:
— Kubernetes \u043a\u043b\u0430\u0441\u0442\u0435\u0440 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 yandex)
— \u0412 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d nginx ingress controller, \u0432 \u0441\u0442\u0430\u0442\u044c\u0435 \u043a\u043b\u0430\u0441\u0441 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d \u043a\u0430\u043a\u00a0nginx-internal
— <\/em><\/strong>\u0414\u043b\u044f UI \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0442 TLS\/SSL \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b.
— \u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d helm 3
— \u0435\u0441\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0443 \u0447\u0435\u0440\u0435\u0437 kubectl \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430.
— \u0435\u0441\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c docker \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440<\/p>\n
\u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 Consul<\/h3>\n
\u0421\u043a\u0430\u0447\u0430\u0442\u044c \u0438\u0441\u0445\u043e\u0434\u043d\u0438\u043a\u0438 \u0447\u0430\u0440\u0442\u043e\u0432 consul-k8s https:\/\/github.com\/hashicorp\/consul-k8s\/tree\/main\/charts\/consul<\/a><\/p>\n
\u041b\u0438\u0431\u043e \u0447\u0435\u0440\u0435\u0437 helm, \u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f \u0438\u0437 \u0420\u043e\u0441\u0441\u0438\u0438 \u0441\u0435\u0439\u0447\u0430\u0441 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d:<\/p>\n
$ helm repo add hashicorp https:\/\/helm.releases.hashicorp.com $ helm pull hashicorp\/consul<\/code><\/pre>\n
\u0421\u043e\u0437\u0434\u0430\u0442\u044c\u00a0<\/strong>namespace<\/code>:<\/strong><\/p>\n
$ kubectl create namespace consul<\/code><\/pre>\n
\u0421\u043e\u0437\u0434\u0430\u0442\u044c secret \u0434\u043b\u044f ssl<\/strong>\u00a0\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u0434\u043b\u044f ingress \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430.<\/p>\n
\u0414\u043e\u043f\u0443\u0441\u0442\u0438\u043c \u0443 \u0432\u0430\u0441 \u0435\u0441\u0442\u044c ssl \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u043e\u0442\u00a0https:\/\/letsencrypt.org\/<\/a>\u00a0:
\u0421\u043e\u0437\u0434\u0430\u0442\u044c \u0444\u0430\u0438\u043b\u00a0secret-tls-consul.yaml<\/code>\u00a0:<\/p>\n
apiVersion: v1 kind: Secret metadata:   name: secret-tls data:   tls.crt: <tls.crt base64>   tls.key: <tls.key base64> type: kubernetes.io\/tls<\/code><\/pre>\n
\u0433\u0434\u0435:
\u0432\u043c\u0435\u0441\u0442\u043e <tls.crt base64> \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0437\u0430\u043d\u0430\u0447\u0435\u043d\u0438\u0435:
$ cat fullchain1.pem | base64 -w0<\/code>
\u0432\u043c\u0435\u0441\u0442\u043e <tls.key base64> \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435:
$ cat privkey1.pem | base64 -w0<\/code><\/p>\n
\u041f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0439 \u043c\u0430\u043d\u0438\u0444\u0435\u0441\u0442:<\/p>\n
$ kubectl -n consul apply -f secret-tls-consul.yaml<\/code><\/pre>\n
\u0421\u043e\u0437\u0434\u0430\u0442\u044c \u0444\u0430\u0438\u043b\u00a0<\/strong>values-work.yaml<\/code>\u00a0\u0433\u0434\u0435 \u043f\u0435\u0440\u0435\u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435:<\/p>\n
global:   enabled: true   logLevel: \"info\"   logJSON: true   datacenter: vault-storage   gossipEncryption:     autoGenerate: false     secretName: consul-consul-gossip-encryption-key     secretKey: key   tls:     enabled: true     enableAutoEncrypt: true   server:   enabled: \"-\"   replicas: 3   storage: 5Gi   storageClass: yc-network-ssd   connect: true   client:   enabled: false   connectInject:   enabled: false   ui:   enabled: \"-\"   service:     enabled: true   ingress:     enabled: true       annotations: |       \"nginx.ingress.kubernetes.io\/backend-protocol\": \"HTTPS\"       ingressClassName: nginx-internal     pathType: Prefix       hosts:     - host: consul.k8s.domain.com       tls:       - secretName: secret-tls         hosts:           - consul.k8s.domain.com<\/code><\/pre>\n
\u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u043c\u043e\u043c\u0435\u043d\u0442\u044b \u0444\u0430\u0439\u043b\u0430:<\/strong>
gossipEncryption<\/code>\u00a0: \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u043c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435, \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u043c \u0438\u043c\u044f \u0441\u0435\u043a\u0440\u0435\u0442\u0430, \u0433\u0434\u0435 \u0431\u0443\u0434\u0435\u0442 \u0445\u0440\u0430\u043d\u0438\u0442\u044c\u0441\u044f \u043a\u043b\u044e\u0447. \u0421\u0430\u043c \u043a\u043b\u044e\u0447 \u0441\u043e\u0437\u0434\u0430\u0435\u0442\u0441\u044f \u0442\u0430\u043a (<KeyString> \u043d\u0443\u0436\u043d\u043e\u00a0\u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c<\/a>):<\/p>\n
$ docker run --rm -ti --entrypoint=\/bin\/sh hashicorp\/consul:latest \/ # consul keygen <KeyString><\/code><\/pre>\n
$ kubectl -n consul create secret generic \\      consul-consul-gossip-encryption-key --from-literal=key=<KeyString><\/code><\/pre>\n
replicas: 3<\/code>: \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0440\u0435\u043f\u043b\u0438\u043a, \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u0442\u044c \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043d\u043e\u0434 \u0432 k8s \u043b\u0438\u0431\u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d \u0430\u0432\u0442\u043e\u0441\u043a\u0435\u0439\u043b\u0438\u043d\u0433
storageClass: yc-network-ssd<\/code>\u00a0— \u043e\u0434\u0438\u043d \u0438\u0437 \u043a\u043b\u0430\u0441\u0441\u043e\u0432 \u0432 yandex. \u041e\u0441\u0442\u0440\u043e\u0436\u043d\u043e, \u0443 \u043d\u0435\u0433\u043e RECLAIMPOLICY=Delete, \u044d\u0442\u043e \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u0435\u0441\u043b\u0438 \u0443\u0434\u0430\u043b\u0438\u0442\u044c pvc, \u0442\u043e \u0434\u0438\u0441\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u0443\u0434\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u043d, \u0442\u043e\u0436\u0435 \u0431\u0443\u0434\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d.
enableAutoEncrypt: true<\/code>: \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u044d\u0442\u043e\u0439 \u0441\u0442\u0440\u043e\u0447\u043a\u0435 \u0431\u0443\u0434\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u043d \u0441\u0430\u043c\u043e\u043f\u043e\u0434\u043f\u0438\u0441\u043d\u043e\u0439 CA (\u0441\u0435\u043a\u0440\u0435\u0442\u044b:\u00a0consul-consul-ca-cert,consul-consul-ca-key<\/code>), \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u043a\u0430\u0442 \u0438 \u043a\u043b\u044e\u0447 \u0434\u043b\u044f \u0441\u0430\u043c\u043e\u0433\u043e consul (\u0441\u0435\u043a\u0440\u0435\u0442: consul-consul-server-cert).<\/p>\n
\u041c\u043e\u0436\u043d\u043e \u043f\u043e\u043f\u0440\u043e\u0431\u043e\u0432\u0430\u0442\u044c \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c:<\/strong><\/p>\n
$ helm -n consul upgrade --install consul -f values-work.yaml .\/consul-1.3.1<\/code><\/pre>\n
\u0433\u0434\u0435 .\/consul-1.3.1 — \u043f\u0430\u043f\u043a\u0430 \u0441 \u0447\u0430\u0440\u0442\u043e\u043c consul<\/p>\n
$ kubectl -n consul get pods,pvc NAME                         READY   STATUS    RESTARTS   AGE pod\/consul-consul-server-0   1\/1     Running   0          30m pod\/consul-consul-server-1   1\/1     Running   0          30m pod\/consul-consul-server-2   1\/1     Running   0          30m  NAME                                                       STATUS   persistentvolumeclaim\/data-consul-consul-consul-server-0   Bound    persistentvolumeclaim\/data-consul-consul-consul-server-1   Bound    persistentvolumeclaim\/data-consul-consul-consul-server-2   Bound<\/code><\/pre>\n
\u0421\u0430\u043c\u043e\u043f\u043e\u0434\u043f\u0438\u0441\u043d\u044b\u0435 SSL:<\/strong>
\u041f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u043e\u043f\u0446\u0438\u0438\u00a0enableAutoEncrypt: true<\/em><\/strong>\u00a0\u0421\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f consul \u0441\u043e\u0437\u0434\u0430\u0435\u0442\u0441\u044f \u0441\u0440\u043e\u043a\u043e\u043c \u043d\u0430 \u0434\u0432\u0430 \u0433\u043e\u0434\u0430, \u0447\u0442\u043e\u0431\u044b \u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u043e\u043c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043f\u0435\u0440\u0438\u043e\u0434\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u0435\u0440\u0435\u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c \u0441\u0430\u043c consul. \u041a \u0442\u043e\u043c\u0443 \u0436\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u043e\u0442 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0435\u0433\u043e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f, \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u0442\u0430\u043a\u043e\u0439:<\/p>\n
Issuer: C = US, ST = CA, L = San Francisco, street = 101 Second Street, postalCode = 94105, O = HashiCorp Inc., CN = Consul Agent CA<\/code><\/pre>\n
\u041d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0441\u0432\u043e\u0439 CA \u0438 \u0441\u0432\u043e\u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b, \u0437\u0430\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438, \u0438\u043b\u0438 \u0432\u0437\u044f\u0442\u044c \u0443\u0436\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435:<\/p>\n
$ openssl genrsa -out rootCA.key 4096 $ openssl req -x509 -new -key rootCA.key -days 10000 -out rootCA.crt ........ Country Name (2 letter code) [AU]:RU State or Province Name (full name) [Some-State]:Moscow Locality Name (eg, city) []:Moscow Organization Name (eg, company) [Internet Widgits Pty Ltd]:Domain LTD Organizational Unit Name (eg, section) []:devops Common Name (e.g. server FQDN or YOUR name) []: Email Address []:devops@domain.com<\/code><\/pre>\n
\u0421\u043e\u0437\u0434\u0430\u0442\u044c \u0444\u0430\u0438\u043b\u00a0consul.conf<\/strong>:<\/p>\n
[req] default_bits = 4096 prompt = no default_md = sha256   req_extensions = v3_req distinguished_name = dn   [dn] C = RU ST = Moscow L = Moscow CN = server.vault-storage.consul   [ v3_req ] basicConstraints = CA:FALSE keyUsage = nonRepudiation, digitalSignature, keyEncipherment<\/code><\/pre>\n
\u0421\u043e\u0437\u0434\u0430\u0442\u044c \u0444\u0430\u0438\u043b\u00a0consul.ext<\/strong>:<\/p>\n
subjectAltName=DNS:consul-consul-server, DNS:*.consul-consul-server, DNS:*.consul-consul-server.consul, DNS:consul-consul-server.consul, DNS:*.consul-consul-server.consul.svc, DNS:consul-consul-server.consul.svc, DNS:*.server.vault-storage.consul, DNS:server.vault-storage.consul, DNS:localhost, IP:127.0.0.1<\/code><\/pre>\n
\u0421\u043f\u0438\u0441\u043e\u043a \u044d\u0442\u0438\u0445\u00a0subjectAltName<\/strong>\u00a0\u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0434\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u0432 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043d \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.<\/p>\n
\u0421\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u043b\u044e\u0447 \u0438 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u0442\u044c\/\u043f\u043e\u0434\u043f\u0438\u0441\u0430\u0442\u044c \u0441\u0435\u0440\u0442\u0438\u0444\u043a\u0430\u0442:<\/p>\n
$ openssl genrsa -out consul.key 4096   $ openssl req -new \\     -key consul.key \\     -out consul.csr \\     -config consul.conf   $ openssl x509 -req \\     -in consul.csr \\     -CA rootCA.crt -CAkey rootCA.key \\     -CAcreateserial -out consul.crt \\     -extfile consul.ext \\     -days 5000<\/code><\/pre>\n
\u0421\u043e\u0437\u0434\u0430\u0442\u044c \u0441\u0435\u043a\u0440\u0435\u0442\u044b \u0441 \u044d\u0442\u0438\u043c\u0438 \u043a\u043b\u044e\u0447\u043e\u043c \u0441 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\u043c\u0438:<\/p>\n
$ kubectl -n consul create secret generic root-ca --from-file=tls.crt=rootCA.crt $ kubectl -n consul create secret tls consul --key consul.key --cert consul.crt<\/code><\/pre>\n
\u041f\u043e\u043c\u0435\u043d\u044f\u0442\u044c\u00a0values-work.yaml<\/code>\u00a0\u0434\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u044d\u0442\u0438\u0445 \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432:<\/p>\n
global:   enabled: true   logLevel: \"info\"   logJSON: true   datacenter: vault-storage   gossipEncryption:     autoGenerate: false     secretName: consul-consul-gossip-encryption-key     secretKey: key   tls:     enabled: true     enableAutoEncrypt: false     caCert:       # The name of the Kubernetes secret.       secretName: root-ca       # The key of the Kubernetes secret.       secretKey: tls.crt     verify: true   server:   enabled: \"-\"   replicas: 3   storage: 5Gi   storageClass: yc-network-ssd   connect: true   serverCert:     # The name of the Vault secret that holds the PEM encoded server certificate.     # @type: string     secretName: consul   client:   enabled: false   connectInject:   enabled: false   ui:   enabled: \"-\"   service:     enabled: true   ingress:     enabled: true       annotations: |       \"nginx.ingress.kubernetes.io\/backend-protocol\": \"HTTPS\"       ingressClassName: nginx-internal     pathType: Prefix       hosts:     - host: consul.k8s.domain.com       tls:       - secretName: secret-tls         hosts:           - consul.k8s.domain.com<\/code><\/pre>\n
\u0423\u0434\u0430\u043b\u0438\u0442\u044c \u043d\u0435\u043d\u0443\u0436\u043d\u044b\u0435 \u0441\u0435\u043a\u0440\u0435\u0442\u044b \u0438 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441 \u043d\u043e\u0432\u044b\u043c\u0438 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u043c\u0438:<\/p>\n
$ kubectl -n consul delete secrets consul-consul-ca-cert consul-consul-ca-key consul-consul-server-cert $ helm -n consul upgrade --install consul -f values-work.yaml .\/consul-1.3.1<\/code><\/pre>\n
\u0423\u0434\u0430\u043b\u0438\u0442\u044c \u0432\u0441\u0435 \u043f\u043e\u0434\u044b consul, \u0442\u0430\u043a \u043a\u0430\u043a \u0438\u0437-\u0437\u0430 \u043d\u043e\u0432\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432, \u043e\u043d\u0438 \u043d\u0435 \u0441\u043c\u043e\u0433\u0443\u0442 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u0442\u044c \u0434\u0440\u0443\u0433 \u0441 \u0434\u0440\u0443\u0433\u043e\u043c:<\/p>\n
$ kubectl -n consul delete pods --all<\/code><\/pre>\n
\u0417\u0430\u043a\u0440\u044b\u0442\u044c \u0442\u043e\u043a\u0435\u043d\u043e\u043c UI consul<\/strong><\/p>\n
\u041f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e\u00a0values-work.yaml \u043a \u0432\u0438\u0434\u0443:<\/code><\/p>\n
global:   enabled: true   logLevel: \"info\"   logJSON: true   datacenter: vault-storage   gossipEncryption:     autoGenerate: false     secretName: consul-consul-gossip-encryption-key     secretKey: key   tls:     enabled: true     enableAutoEncrypt: false     caCert:       # The name of the Kubernetes secret.       secretName: root-ca       # The key of the Kubernetes secret.       secretKey: tls.crt     verify: true   server:   enabled: \"-\"   replicas: 3   storage: 5Gi   storageClass: yc-network-ssd   connect: true   serverCert:     # The name of the Vault secret that holds the PEM encoded server certificate.     # @type: string     secretName: consul     extraConfig: |         {           \"addresses\": {             \"http\": \"0.0.0.0\"           },           \"acl\": {             \"enabled\": true,             \"default_policy\": \"deny\",             \"down_policy\": \"extend-cache\",             \"enable_token_persistence\": true           }         }   client:   enabled: false   connectInject:   enabled: false   ui:   enabled: \"-\"   service:     enabled: true   ingress:     enabled: true       annotations: |       \"nginx.ingress.kubernetes.io\/backend-protocol\": \"HTTPS\"       ingressClassName: nginx-internal     pathType: Prefix       hosts:     - host: consul.k8s.domain.com       tls:       - secretName: secret-tls         hosts:           - consul.k8s.domain.com<\/code><\/pre>\n
\u041f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c\/\u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c:<\/p>\n
$ helm -n consul upgrade --install consul -f values-work.yaml .\/consul-1.3.1 <\/code><\/pre>\n
\u0414\u043e\u0436\u0434\u0430\u0442\u044c\u0441\u044f \u043f\u043e\u043a\u0430 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0443\u0441\u0442\u044f\u0442\u0441\u044f \u0432\u0441\u0435 \u043f\u043e\u0434\u044b, \u0438 \u0431\u0443\u0434\u0435\u0442 \u0432\u044b\u0431\u0440\u0430\u043d \u043b\u0438\u0434\u0435\u0440 — \u043c\u043e\u0436\u043d\u043e \u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u043f\u043e \u043b\u043e\u0433\u0430\u043c:<\/p>\n
$ kubectl -n consul logs consul-consul-server-2 -f<\/code><\/pre>\n
\u0417\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u044e bootstrap \u0442\u043e\u043a\u0435\u043d\u0430:<\/p>\n
$ kubectl -n consul exec -ti consul-consul-server-0 -- sh -c \"consul acl bootstrap | grep -i secretid\" Defaulted container \"consul\" out of: consul, locality-init (init) SecretID:         <bootstrap token string><\/code><\/pre>\n
\u0422\u043e\u043a\u0435\u043d (SecretID) \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u043c \u043c\u0435\u0441\u0442\u0435.<\/p>\n
\u0427\u0435\u0440\u0435\u0437 web \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0447\u0442\u043e \u0432\u0441\u0435 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442: \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0439 \u0442\u043e\u043a\u0435\u043d.<\/p>\n
\u0412\u0430\u0436\u043d\u044b\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u0434\u043b\u044f \u0434\u0438\u0430\u0433\u043d\u043e\u0441\u0442\u0438\u043a\u0438, \u0435\u0441\u043b\u0438 \u0447\u0442\u043e-\u0442\u043e \u043f\u043e\u0448\u043b\u043e \u043d\u0435 \u0442\u0430\u043a<\/strong>
\u0412 \u043c\u043e\u0435\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u0432 \u043b\u043e\u0433\u0430\u0445 \u0431\u044b\u043b\u0430 \u043e\u0448\u0438\u0431\u043a\u0430, \u0447\u0442\u043e \u043d\u0435\u0442 \u043a\u043b\u044e\u0447\u0430 \u0434\u043b\u044f \u0434\u0435\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439. \u041d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0435:<\/p>\n
$ kubectl -n consul exec -ti consul-consul-server-0 -- \\             cat \/consul\/data\/serf\/local.keyring [\"<KeyString>\"]<\/code><\/pre>\n
\u041a\u043b\u044e\u0447 \u0434\u043e\u043b\u0436\u0435\u043d \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u044c\u0441\u044f \u0432 \u0441\u043f\u0438\u0441\u043a\u0435 \u0432\u0441\u0435\u0445 \u044d\u0442\u0438\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 (\u0432 \u043a\u0430\u0436\u0434\u043e\u043c \u043f\u043e\u0434\u0435). \u042d\u0442\u043e \u0442\u043e\u0442 \u0441\u0430\u043c\u044b\u0439 \u043a\u043b\u044e\u0447 \u0438\u0437 \u0441\u0435\u043a\u0440\u0435\u0442\u0430\u00a0consul-consul-go<\/code><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-377597","post","type-post","status-publish","format-standard","hentry"],"_links":{"self":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts\/377597","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=377597"}],"version-history":[{"count":0,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts\/377597\/revisions"}],"wp:attachment":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=377597"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=377597"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=377597"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}