Jumpserver使用手册

收录于 Linux

2022-05-10 约 621 字预计阅读 3 分钟

概述

堡垒机4A模型

安装

需求配置

4核/16G,推荐200G以上硬盘。主要用来存储审计录像，审计录像每小时大约为10M，按每天操作4小时并且保留30天计算为127GB。

虚拟机方式

直接安装官网链接:https://docs.jumpserver.org/zh/master/install/setup_by_fast/ -> 在线安装 -> 手动部署

k8s方式

官网链接：https://docs.jumpserver.org/zh/master/install/setup_by_fast/ -> 在线安装 -> helm

部署外置MySQL

简化流程，采用单节点部署

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
apiVersion: v1
kind: Secret
metadata:
  name: mysql-pass
  namespace: jumpserver
type: Opaque
data:
  rootpassword: "dl50WkRlYmNTQmhrRU5CIw=="
---
apiVersion: v1
kind: Service
metadata:
  name: mysql-for-jumpserver
  namespace: jumpserver
  labels:
    app: mysql
spec:
  ports:
  - protocol: TCP
    port: 3306
    targetPort: 3306
  selector:
    app: mysql
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: mysql-pv-claim
  namespace: jumpserver
  labels:
    app: mysql
spec:
  storageClassName: rbd-immediate
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: mysql-for-jumpserver
  namespace: jumpserver
  labels:
    app: mysql
spec:
  selector:
    matchLabels:
      app: mysql
  template:
    metadata:
      labels:
        app: mysql
    spec:
      containers:
      - image: reg.kolla.org/library/mysql:5.7.39
        name: mysql
        livenessProbe:
          exec:
            command:
            - /bin/bash
            - -c
            - 'mysqladmin ping -p${MYSQL_ROOT_PASSWORD}'
          initialDelaySeconds: 30
          timeoutSeconds: 1
          periodSeconds: 10
        readinessProbe:
          exec:
            command:
            - /bin/bash
            - -c
            - 'mysql -p${MYSQL_ROOT_PASSWORD} -e "SELECT 1"'
          initialDelaySeconds: 60
          periodSeconds: 10
          timeoutSeconds: 1
        lifecycle:
          postStart:
            exec:
              command: ["/bin/sh","-c","rm -rf /var/lib/mysql/lost+found"]
        env:
        - name: MYSQL_ROOT_PASSWORD
          valueFrom:
            secretKeyRef:
              name: mysql-pass
              key: rootpassword
        ports:
        - containerPort: 3306
          name: mysql
        volumeMounts:
        - name: mysql-persistent-storage
          mountPath: /var/lib/mysql
      volumes:
      - name: mysql-persistent-storage
        persistentVolumeClaim:
          claimName: mysql-pv-claim

等Pod处于Ready状态后，进入Pod创建Databasejumpserver: create database jumpserver default charset 'utf8' collate 'utf8_bin';

部署外置Redis

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
apiVersion: v1
kind: ConfigMap
metadata:
  name: redis-for-jumpserver-config
  namespace: jumpserver
data:
  redis.conf: |
    bind 0.0.0.0
    protected-mode yes
    tcp-backlog 1024
    requirepass "sw@1Wq(jN"
    timeout 0
    tcp-keepalive 300
    databases 16
    stop-writes-on-bgsave-error yes
    rdbcompression yes
    rdbchecksum yes
    dbfilename dump.rdb
    rdb-del-sync-files no
    dir /var/lib/redis
    oom-score-adj no
    oom-score-adj-values 0 200 800
    disable-thp yes
    appendonly yes
    appendfilename "appendonly.aof"
    appendfsync everysec    
---
apiVersion: v1
kind: Service
metadata:
  name: redis-for-jumpserver
  namespace: jumpserver
  labels:
    app: redis
spec:
  ports:
  - protocol: TCP
    port: 6379
    targetPort: 6379
  selector:
    app: redis
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: redis-pv-claim
  namespace: jumpserver
  labels:
    app: redis
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 20Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: redis-for-jumpserver
  namespace: jumpserver
  labels:
    app: redis
spec:
  selector:
    matchLabels:
      app: redis
  template:
    metadata:
      labels:
        app: redis
    spec:
      containers:
      - image: reg.kolla.org/library/redis:7.0.4
        name: redis
        command: ["redis-server"]
        args: 
        - /opt/redis.conf
        ports:
        - containerPort: 6379
          name: redis
        volumeMounts:
        - name: redis-persistent-storage
          mountPath: /var/lib/redis
        - name: config
          mountPath: "/opt"
      volumes:
      - name: redis-persistent-storage
        persistentVolumeClaim:
          claimName: redis-pv-claim
      - name: config
        configMap:
          name: redis-for-jumpserver-config
          items:
          - key: redis.conf
            path: redis.conf

安装jumpserver

添加helm仓库:helm repo add jumpserver https://jumpserver.github.io/helm-charts
下载jumpserver的chart文件:helm pull jumpserver/jumpserver --untar
按需修改values.yaml
1. 推送镜像到内网仓库
2. 修改ReadWriteMany->ReadWriteOnce,如果storageclass支持多读多写可不做修改。审计视频存储于
3. 按需添加资源限制
4. ingress实现若不是使用的nginx-ingress，则按需修改

在values.yaml同级目录执行安装: helm install jumpserver . -n jumpserver -f value.yaml