在增加一个 k8s 部署方式，最好添加到官网文档中

# 本地做了个demo

## 前提条件
- mysql 版本大于等于 8.0
- redis 版本大于等于7.0

## 实战
- 制作 镜像
```
# 自定义 topiam 配置文件
[root@tools topiam-installer-v2.0.0]# cat topiam.properties
# mysql config
spring.datasource.url=jdbc:mysql://${MYSQL_HOST}:${MYSQL_PORT}/${MYSQL_DATABASE}?serverTimezone=GMT%2B8&useUnicode=true&characterEncoding=UTF-8&autoReconnect=true&useSSL=false&allowPublicKeyRetrieval=true&rewriteBatchedStatements=true
spring.datasource.username=${MYSQL_USERNAME}
spring.datasource.password=${MYSQL_PASSWORD}
# redis config
spring.data.redis.host=${REDIS_HOST}
spring.data.redis.port=${REDIS_PORT}
spring.data.redis.password=${REDIS_PASSWORD}
spring.data.redis.database=${REDIS_DATABASE}

# 编写docker镜像文件
[root@tools topiam-installer-v2.0.0]# cat Dockerfile
FROM registry.cn-hangzhou.aliyuncs.com/topiam/topiam-ce:2.0.0
RUN mkdir -p /opt/topiam/conf
COPY ./topiam.properties /opt/topiam/conf/topiam.properties

# 打包镜像
[root@tools topiam-installer-v2.0.0]# docker build -t registry.cn-hangzhou.aliyuncs.com/topiam/topiam-ce:v1.0.0 .

# 保存镜像
[root@tools topiam-installer-v2.0.0]# docker save -o topiam-ce-customize.tag.gz registry.cn-hangzhou.aliyuncs.com/topiam/topiam-ce:v1.0.0
```

- 编写 k8s yaml 配置文件
```
[root@master2 topiam]# cat topiam.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: topiam-server
spec:
  replicas: 1
  selector:
    matchLabels:
      app: topiam-server
  template:
    metadata:
      labels:
        app: topiam-server
    spec:
      containers:
      - name: topiam-server
        image: registry.cn-hangzhou.aliyuncs.com/topiam/topiam-ce:v1.0.0
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 1898
          protocol: TCP
        env:
        - name: MYSQL_HOST
          value: mycluster-mysql-headless
        - name: MYSQL_PORT
          value: "3306"
        - name: MYSQL_DATABASE
          value: topiam
        - name: MYSQL_USERNAME
          value: root
        - name: MYSQL_PASSWORD
          value: 'Yztx@2023'
        - name: REDIS_HOST
          value: 192.168.5.121
        - name: REDIS_PORT
          value: "6379"
        - name: REDIS_PASSWORD
          value: 'Yztx@2023'
        - name: REDIS_DATABASE
          value: "0"
        livenessProbe:
          httpGet:
            path: /actuator/health
            port: 1898
          initialDelaySeconds: 20
          periodSeconds: 20
          timeoutSeconds: 10
          failureThreshold: 60
        readinessProbe:
          httpGet:
            path: /actuator/health
            port: 1898
          initialDelaySeconds: 20
          periodSeconds: 20
          timeoutSeconds: 10
          failureThreshold: 60  
      restartPolicy: Always
      dnsPolicy: ClusterFirst

---
apiVersion: v1
kind: Service
metadata:
  name: topiam-server-svc-nodeport
spec:
  selector:
    app: topiam-server
  ports:
    - protocol: TCP
      port: 80
      targetPort: 1898
      nodePort: 60001
  type: NodePort
```

- 在 mysql  topiam 数据库
```
# 更新root密码，并且希望该密码对从任何 IP 地址连接的 root 用户（即 root@%）生效
ALTER USER 'root'@'%' IDENTIFIED WITH mysql_native_password BY 'Yztx@2023';
FLUSH PRIVILEGES;

# 调整 root@% 用户的权限，可以使用 GRANT 和 REVOKE 语句。例如，如果你想授予 root@% 用户对所有数据库的所有权限：
GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' WITH GRANT OPTION;
FLUSH PRIVILEGES;

# 创建 topiam 数据库 并设置排序规则
CREATE DATABASE topiam CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
```

- 启动
```
[root@master2 topiam]# kubectl apply -f topiam.yaml
```

- 测试
```
[root@master2 topiam]# kubectl get svc
NAME                         TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)                                                  AGE
external-secrets-webhook     ClusterIP   10.233.37.135   <none>        443/TCP                                                  5d23h
kubernetes                   ClusterIP   10.233.0.1      <none>        443/TCP                                                  12d
mycluster-mysql              ClusterIP   10.233.51.178   <none>        3306/TCP                                                 6d3h
mycluster-mysql-headless     ClusterIP   None            <none>        3306/TCP,3601/TCP,9104/TCP,3501/TCP,50001/TCP,9901/TCP   6d3h
topiam-server-svc-nodeport   NodePort    10.233.27.69    <none>        80:60001/TCP                                             18m
vault                        ClusterIP   10.233.36.153   <none>        8200/TCP,8201/TCP                                        5d23h
vault-active                 ClusterIP   10.233.11.103   <none>        8200/TCP,8201/TCP                                        5d23h
vault-agent-injector-svc     ClusterIP   10.233.7.183    <none>        443/TCP                                                  5d23h
vault-internal               ClusterIP   None            <none>        8200/TCP,8201/TCP                                        5d23h
vault-standby                ClusterIP   10.233.35.99    <none>        8200/TCP,8201/TCP                                        5d23h
vault-ui                     NodePort    10.233.52.182   <none>        8200:28865/TCP                                           5d23h
[root@master2 topiam]#
```
- 访问地址 : http://目标服务器IP地址:服务运行端口
- 登录用户名: admin
- 默认密码: topiam.cn

![输入图片说明](https://foruda.gitee.com/images/1735636785969636758/7e3a6d51_5348805.png "屏幕截图")

GVP TOPIAM 身份安全/topiam-eiam

内容风险标识

评论 (0)

GVPTOPIAM 身份安全/topiam-eiam

内容风险标识