Upgrade to Pro — share decks privately, control downloads, hide ads and more …

マネージドクラウドとCの世界

Sponsored · Your Podcast. Everywhere. Effortlessly. Share. Educate. Inspire. Entertain. You do you. We'll handle the rest.
Avatar for sonod sonod
May 23, 2018

 マネージドクラウドとCの世界

HashiCorp社のConsulとマネージドクラウドのお話

Avatar for sonod

sonod

May 23, 2018
Tweet

More Decks by sonod

Other Decks in Technology

Transcript

  1. 

  2. 

  3. { "service": { { “name”: “keepalived”, “tags”: [“keepalived”], “checks”: [

    { "script”: "/usr/lib/nagios/plugins/check_procs -c 1: -a keepalived”, “interval”: "30s” } ] } } 8IBUJT$POTVM ˝LFFQBMJWFEKTPO ͜Μͳײ͡Ͱɺ+40/Ͱ$POTVMʹαʔϏεΛఆٛ͢Δͱ 
  4. # consul catalog services keepalived # dig keepalived.service.consul ;; ANSWER

    SECTION: keepalived.service.consul. 0 IN A 172.16.1.1 # curl http://127.0.0.1:8500/v1/catalog/services | jq. { "weblb-keepalived": [ "weblb-keepalived" ] } 8IBUJT$POTVM $POTVMΫϥΠΞϯτ΍%/4΍)551͔Β؆୯ʹಛఆͷαʔϏεΛݟ͚ͭΕΔΑ͏ʹͳΓ·͢ 
  5. { "service": { { “name”: “keepalived”, “tags”: [“keepalived”], “checks”: [

    { "script”: "/usr/lib/nagios/plugins/check_procs -c 1: -a keepalived”, “interval”: "30s” } ] } } 8IBUJT$POTVM ˝LFFQBMJWFEKTPO ͜Μͳײ͡Ͱɺ+40/Ͱ$POTVMʹαʔϏεΛఆٛ͢Δͱ  ͪͳΈʹ͜ͷϑΝΠϧͰ͕͢
  6. # consul agent -data-dir=/etc/consul # cat /etc/consul/keepalived.json { "service": {

    { “name”: “keepalived”, “tags”: [“keepalived”], “checks”: [ { "script”: "/usr/lib/nagios/plugins/check_procs -c 1: -a keepalived”, “interval”: "30s” } ] } } 8IBUJT$POTVM $POTVMBHFOUΛىಈ͢Δࡍʹࢦఆͨ͠σΟϨΫτϦʹ഑ஔ͠·͢  ͜ͷσΟϨΫτϦʹ഑ஔ
  7. { "service": { { “name”: “keepalived”, “tags”: [“keepalived”], “checks”: [

    { "script”: "/usr/lib/nagios/plugins/check_procs -c 1: -a keepalived”, “interval”: "30s” } ] } } 8IBUJT$POTVM ˝LFFQBMJWFEKTPO ઌఔɺʮ4FSWJDF%JTDPWFSZʯͰ࢖ͬͨ+40/ͷ࿮ઢͰׅހͬͨ෦෼ͷΑ͏ʹॻ͘͜ͱͰ࢖༻Ͱ͖·͢ ͜Ε͸/BHJPTϓϥάΠϯΛ࢖༻͍ͯ͠ΔύλʔϯʹͳΓ·͢ɻ 
  8. #BTJD"SDIJUFDUVSFPG$POTVM */5&3/&5 4FSWFS
 'PMMPXFS 4FSWFS
 -FBEFS 4FSWFS
 'PMMPXFS $MJFOU $MJFOU

    %BUBDFOUFS -"/(044*1
 5$16%1 3&1-*$"5*0/
 5$1 3&1-*$"5*0/
 5$1 31$
 5$1 31$
 5$1 -"/(044*1
 5$16%1 %BUBDFOUFS -&"%&3 '038"3%*/( 8"/(044*1
 5$16%1 3&.05&%$ '038"3%*/( 5$1 
  9. ϚωʔδυΫϥ΢υͷશମߏ੒ $POTVM
 $MJFOU $POTVM
 $MJFOU $POTVM
 $MJFOU $POTVM
 $MJFOU $POTVM


    $MJFOU $POTVM
 $MJFOU $POTVM
 $MJFOU $POTVM
 $MJFOU $POTVM
 $MJFOU $POTVM
 $MJFOU $POTVM
 $MJFOU $POTVM
 $MJFOU $POTVM
 $MJFOU $POTVM
 $MJFOU $POTVM
 $MJFOU $POTVM
 $MJFOU $POTVM
 $MJFOU $POTVM
 4FSWFS $POTVM
 4FSWFS $POTVM
 4FSWFS 3&1-*$"5*0/
 5$1 3&1-*$"5*0/
 5$1 31$
 5$1 31$
 5$1 31$
 5$1 
  10. ϚωʔδυΫϥ΢υͷશମߏ੒ $POTVM
 4FSWFS $POTVM
 4FSWFS $POTVM
 4FSWFS $POTVM
 4FSWFS $POTVM


    4FSWFS $POTVM
 4FSWFS 4UBHJOH 1SPEVDUJPO ߋʹɺ.VMUJ%BUBDFOUFSߏ੒ʹͳ͍ͬͯ·͢
 ڑ཭తʹ཭Εͨ%BUBDFOUFSͱ͔Ͱ͸ͳ͘ɺো֐ͷӨڹൣғ΍໊લղܾͷൣғΛ෼཭ͤ͞Δͨ Ίʹ࢖͍ͬͯ·͢  .VMUJ %BUBDFOUFS
  11. $POTVM%/4 $POTVM
 4FSWFS 
 $PNQVUF ྫ͑͹$PNQVUFͱݴΘΕΔϊʔυͰ͸ɺ
 ͜Μͳײ͡Ͱʮ6OCPVOE /4% $POTVMʯͰߏ੒͍ͯ͠·͢ $POTVM


    $MJFOU 6OCPVOE /4% # cat unbound.conf server: interface: 127.0.0.1 do-not-query-localhost: no stub-zone: name: "consul." stub-addr: 172.16.1.1@8600 stub-zone: name: “lolipop.jp.” stub-addr: 172.16.1.1@10053 DPOTVMͩͬͨΒ$POTVM%/4 MPMJQPQKQͩͬͨΒ/4% /BNF4FSWFS%BFNPO ໊લղܾͩ  4FSWJDF %JTDPWFSZ
  12. $POTVM%/4 $POTVMΛىಈ͢Ε͹)551΍%/4͕࢖༻ՄೳͱͳΓ·͢ͷͰɺ͜Μͳײ͡Ͱ֬ೝͰ͖·͢ # consul members Node Address Status Type Build

    Protocol DC server-1 10.11.1.1:80 alive client 0.9.0 2 dc1 # dig server-1.node.consul ;; ANSWER SECTION: server-1.node.consul. 0 IN A 10.11.1.1 # curl http://127.0.0.1:8500/v1/catalog/nodes|jq .[] 
  13. { "service": { { “name”: “keepalived”, “tags”: [“keepalived”], “checks”: [

    { "script”: "/usr/lib/nagios/plugins/check_procs -c 1: -a keepalived”, “interval”: "30s” } ] } } ˝LFFQBMJWFEKTPO αʔϏεͷ৔߹͸ɺ͜Μͳײ͡Ͱ+40/Ͱ$POTVMʹαʔϏεΛఆٛ͢Δͱ  $POTVM%/4 4FSWJDF %JTDPWFSZ
  14. # dig keepalived.service.consul
 ;; ANSWER SECTION: keepalived.service.consul. 0 IN A

    172.16.1.1
 keepalived.service.consul. 0 IN A 172.16.1.2
 ͜Μͳײ͡ͰTFSWJDF୯ҐͰͷ໊લղܾΛ͢Δ͜ͱ΋Ͱ͖·͢  $POTVM%/4 ͍ͭͮͯ 4FSWJDF %JTDPWFSZ
  15. $POTVM5FNQMBUF w (JU)VC͸ͪ͜ΒIUUQTHJUIVCDPNIBTIJDPSQDPOTVMUFNQMBUF
 w $POTVMͷঢ়ଶมԽΛ؂ࢹ͢ΔσʔϞϯ
 w $POTVMͷ,74ͷ৘ใΛ)551ܦ༝Ͱৗʹ؂ࢹ͍ͯ͠Δ
 w $POTVMͷԿ͔͠ΒͷΠϕϯτ ϊʔυͷ૿ݮ

    ͕ൃੜͨ͠ࡍʹɺςϯϓϨʔτϑΝΠϧΛ΋ͱ ʹઃఆϑΝΠϧΛ࠶࡞੒͠ίϚϯυͷ࣮ߦ σʔϞϯͷ࠶ىಈ౳ Λͯ͘͠ΕΔ  ,74UPSF )FBMUI $IFDLJOH 4FSWJDF %JTDPWFSZ
  16. $POTVM5FNQMBUF ͜Μͳ࣌ʹ࢖͍ͬͯΔ$POTVM5FNQMBUF
 Ұ൪ଟ͍ύλʔϯ͕͜͏͍ͬͨ3FWFSTF1SPYZͷ૿ݮΛࣗಈతʹ࣮ࢪ͢Δͱ͜ΖͰ͢ -PBE
 #BMBODFS 3FWFSTF 1SPYZ 3FWFSTF 1SPYZ 3FWFSTF

    1SPYZ -PBE #BMBODFS 3FWFSTF 1SPYZ 3FWFSTF 1SPYZ 3FWFSTF 1SPYZ ઃఆ͕ࣗಈͰॻ͖׵ΘΓɺ੾Γ཭͞ΕΔ ઃఆ͕ࣗಈͰॻ͖׵ΘΓɺ-PBE#BMBODFSʹ௥Ճ͞ΕΔ 3FWFSTF 1SPYZ  ˝3FWFSTF1SPYZ͕%PXO ˝ 3FWFSTF1SPYZΛ"%% 3WFSTF1SPYZΛ੾Γ཭ͨ͠ઃఆΛ࡞੒ͯ͠࠶ىಈ 3FWFSTF1SPYZΛ௥Ճͨ͠ઃఆΛ࡞੒ͯ͠࠶ىಈ ,74UPSF )FBMUI $IFDLJOH 4FSWJDF %JTDPWFSZ
  17. ͜Μͳײ͡Ͱઃఆͱ5FNQMBUFΛॻ͍ͯ഑ஔ͓͚ͯͩ͘͠Ͱউखʹ΍ͬͯ͘Ε·͢ʂศརʂ # cat keepavilved.conf.ctmpl virtual_server 172.1.1.1 80 { delay_loop 10

    lvs_sched rr lvs_method NAT protocol TCP {{range service "reverseproxy|passing"}} real_server {{.Address}} 80 { weight 1 TCP_CHECK { connect_port 80 connect_timeout 30 } }{{end}} } $POTVM5FNQMBUF ## cat config.hcl consul { address = "127.0.0.1:8500" ssl { enabled = false } } pid_file = "/var/run/consul-template/pid" template { source = "/etc/consul-template/keepalived.conf.ctmpl" destination = “/etc/keepalived/conf.d/reverseproxy.conf" command = "sudo systemctl reload keepalived" } SFWFSTFQSPYZͷαʔϏεΛ഑ྻʹͯ͠
 ͦΕΛશͯొ࿥͠·͢ ϊʔυͷ*1ΞυϨε ഑ஔͯ͠σʔϞϯΛSFMPBE ˝5FNQMBUF ˝$POTVM5FNQMBUFͷઃఆ  ,74UPSF )FBMUI $IFDLJOH 4FSWJDF %JTDPWFSZ
  18. $POTVMFYQPSUFS w (JU)VC͸ͪ͜ΒIUUQTHJUIVCDPNQSPNFUIFVTDPOTVM@FYQPSUFS w $POTVMͷαʔϏεͷঢ়ଶΛ1SPNFUIFVTʹసૹ͢ΔσʔϞϯ w ϚωʔδυΫϥ΢υͷ؂ࢹج൫͸1SPNFUIFVTΛ࢖༻͍ͯ͠·͢ͷͰɺ
 ϊʔυͷঢ়ଶ؅ཧͷͨΊʹ࢖༻͍ͯ͠·͢
 
 1SPNFUIFVTʹ͍ͭͯɿ


    ͬ͘͟Γઆ໌͢Δͱɺ༷ʑͳϝτϦΫεΛ࣌ܥྻͰ͍͍ײ͡ʹूܭɾه࿥Ͱ͖ΔπʔϧͰ͢
 ৄ͘͠͸ฐࣾVE[VSBͷ͜ͷลΓͷهࣄΛݟͯ΋Β͑Δͱྑ͍͔ͱࢥ͍·͢
 IUUQTVE[VSBIBUFOBCMPHKQFOUSZ
 IUUQTTQFBLFSEFDLDPNVE[VSBNBOBHFEDMPVEXJUIQSPNFUIFVT  ,74UPSF )FBMUI $IFDLJOH 4FSWJDF %JTDPWFSZ
  19. $POTVMFYQPSUFS .FUSJD .FBOJOH DPOTVM@VQ $POTVMͷ࠷ޙͷ2VFSZ͕੒ޭ͔ͨ͠ DPOTVM@TFSG@MBO@NFNCFST Ϋϥελʔ಺ͷϝϯόʔ਺ DPOTVM@DBUBMPH@TFSWJDFT Ϋϥελʔʹؚ·ΕΔαʔϏε਺ DPOTVM@DBUBMPH@TFSWJDF@OPEF@IFBMUIZ

    ϊʔυ্ͷαʔϏε͕ਖ਼ৗ͔ DPOTVM@IFBMUI@OPEF@TUBUVT ϊʔυʹؔ࿈෇͚ΒΕͨϔϧενΣοΫͷεςʔλε DPOTVM@IFBMUI@TFSWJDF@TUBUVT αʔϏεʹؔ࿈෇͚ΒΕͨϔϧενΣοΫͷεςʔλε શ෦Ͱ͸ͳ͍͕औಘͰ͖Δ৘ใ͸͜ͷΑ͏ͳײ͡Ͱɺ
 1SPNFUIFVTଆ͔Β΋͜ͷΑ͏ͳײ͡Ͱ֬ೝ͢Δ͜ͱ͕Ͱ͖·͢