Spring Boot Cloud + Hashi Consul + Connect Proxy：如何为配置配置引导程序？

Question

我正在使用最新的弹簧靴 HashiCorp Consul & Connect 进行概念验证。基本上，我想展示 webflux Web 服务如何使用 Consul 进行配置并使用 Consul 的网格进行安全通信。因此，后者正在使用以下配置，但 webflux 服务无法从 Consul 获取其配置。我假设 Spring Cloud Consul Config 的 bootstrap.yml 中的设置将是边车，但连接失败。我尝试了很多替代方案，但都遇到了死胡同。如有任何有关如何解决此问题的建议，我将不胜感激。

感谢您的帮助和时间！ 迈克

=================== 原始信息=====================

# Dependencies
extra["springCloudVersion"] = "Hoxton.SR9"
dependencies {
    implementation("org.springframework.boot:spring-boot-starter-actuator")
    implementation("org.springframework.boot:spring-boot-starter-webflux")
    implementation("com.fasterxml.jackson.module:jackson-module-kotlin")
    implementation("io.projectreactor.kotlin:reactor-kotlin-extensions")
    implementation("org.jetbrains.kotlin:kotlin-reflect")
    implementation("org.jetbrains.kotlin:kotlin-stdlib-jdk8")
    implementation("org.jetbrains.kotlinx:kotlinx-coroutines-reactor")
    implementation("org.springframework.cloud:spring-cloud-starter-consul-all")
}

# Error when the service launches in k8s
Setting Active Processor Count to 8
Calculated JVM Memory Configuration: -XX:MaxDirectMemorySize=10M -Xmx1661599K -XX:MaxMetaspaceSize=128352K -XX:ReservedCodeCacheSize=240M -Xss1M (Total Memory: 2G, Thread Count: 50, Loaded Class Count: 20247, Headroom: 0%)
Adding 138 container CA certificates to JVM truststore
Spring Cloud Bindings Enabled
Picked up JAVA_TOOL_OPTIONS: -Djava.security.properties=/layers/paketo-buildpacks_bellsoft-liberica/java-security-properties/java-security.properties -agentpath:/layers/paketo-buildpacks_bellsoft-liberica/jvmkill/jvmkill-1.16.0-RELEASE.so=printHeapHistogram=1 -XX:ActiveProcessorCount=8 -XX:MaxDirectMemorySize=10M -Xmx1661599K -XX:MaxMetaspaceSize=128352K -XX:ReservedCodeCacheSize=240M -Xss1M -Dorg.springframework.cloud.bindings.boot.enable=true
2020-11-12 01:15:15.066  INFO 1 --- [           main] trationDelegate$BeanPostProcessorChecker : Bean 'org.springframework.retry.annotation.RetryConfiguration' of type [org.springframework.retry.annotation.RetryConfiguration$$EnhancerBySpringCGLIB$$ef83abed] is not eligible for getting processed by all BeanPostProcessors (for example: not eligible for auto-proxying)
  .   ____          _            __ _ _
 /\\ / ___'_ __ _ _(_)_ __  __ _ \ \ \ \
( ( )\___ | '_ | '_| | '_ \/ _` | \ \ \ \
 \\/  ___)| |_)| | | | | || (_| |  ) ) ) )
  '  |____| .__|_| |_|_| |_\__, | / / / /
 =========|_|==============|___/=/_/_/_/
 :: Spring Boot ::        (v2.3.5.RELEASE)
2020-11-12 01:15:22.779 ERROR 1 --- [           main] o.s.c.c.c.ConsulPropertySourceLocator    : Fail fast is set and there was an error reading configuration from consul.
2020-11-12 01:15:23.783 ERROR 1 --- [           main] o.s.c.c.c.ConsulPropertySourceLocator    : Fail fast is set and there was an error reading configuration from consul.
2020-11-12 01:15:24.885 ERROR 1 --- [           main] o.s.c.c.c.ConsulPropertySourceLocator    : Fail fast is set and there was an error reading configuration from consul.
2020-11-12 01:15:26.097 ERROR 1 --- [           main] o.s.c.c.c.ConsulPropertySourceLocator    : Fail fast is set and there was an error reading configuration from consul.
2020-11-12 01:15:27.432 ERROR 1 --- [           main] o.s.c.c.c.ConsulPropertySourceLocator    : Fail fast is set and there was an error reading configuration from consul.
2020-11-12 01:15:28.900 ERROR 1 --- [           main] o.s.c.c.c.ConsulPropertySourceLocator    : Fail fast is set and there was an error reading configuration from consul.
2020-11-12 01:15:28.917 ERROR 1 --- [           main] o.s.boot.SpringApplication               : Application run failed
com.ecwid.consul.transport.TransportException: org.apache.http.conn.HttpHostConnectException: Connect to localhost:8501 [localhost/127.0.0.1] failed: Connection refused (Connection refused)

# Relevant bootstrap.yml
server:
  port: ${PORT:8080}

spring:
  application:
    name: k8sconsulwebflux
  profiles: development
  cloud:
    consul:
      # Using Consul Connect Service Mesh
      scheme: https
      host: localhost
      port: 8501

# Custom Helm Setting for Hashi Consul
global:
  name: "consul-"
  image: "consul:1.8.5"
  imageK8S: "hashicorp/consul-k8s:latest"
  domain: consul
  datacenter: csc
  gossipEncryption:
    secretName: "gossip-encryption-key"
    secretKey: "key"
  tls:
    enabled: true
    enableAutoEncrypt: true
  acls:
    manageSystemACLs: true
  lifecycleSidecarContainer:
    resources:
      requests:
        memory: "25Mi"
        cpu: "20m"
      limits:
        memory: "50Mi"
        cpu: "20m"
  imageEnvoy: "envoyproxy/envoy-alpine:v1.14.4"
server:
  replicas: 1
  bootstrapExpect: 1
  disruptionBudget:
    enabled: true
    maxUnavailable: 0
  resources:
    requests:
      memory: "100Mi"
      cpu: "100m"
    limits:
      memory: "100Mi"
      cpu: "100m"
client:
  enabled: true
  grpc: true
  resources:
    requests:
      memory: "100Mi"
      cpu: "100m"
    limits:
      memory: "100Mi"
      cpu: "100m"
  updateStrategy: |
    rollingUpdate:
      maxUnavailable: 2
    type: RollingUpdate
# Enable the Consul Web UI via a NodePort
ui:
  enabled: true
  service:
    type: 'NodePort'
syncCatalog:
  enabled: true
  default: true
  consulPrefix: "k8s-"
  k8sPrefix: "consul-"
  resources:
    requests:
      memory: "50Mi"
      cpu: "50m"
    limits:
      memory: "50Mi"
      cpu: "50m"
  logLevel: debug

# Enable Connect for secure communication between nodes
connectInject:
  enabled: true
  default: true
  resources:
    requests:
      memory: "50Mi"
      cpu: "50m"
    limits:
      memory: "50Mi"
      cpu: "50m"
  centralConfig:
    enabled: true
  sidecarProxy:
    resources:
      requests:
        memory: 100Mi
        cpu: 100m
      limits:
        memory: 100Mi
        cpu: 100m
  initContainer:
    resources:
      requests:
        memory: "25Mi"
        cpu: "50m"
      limits:
        memory: "150Mi"
        cpu: "50m"

=================== 更新信息 1 =====================

在进行 Blake 建议的更改后，我的应用程序已通过最初的问题并进入一个奇怪的 TLS/SSL 问题... Arggg！我会很感激任何建议。此时，Consul 被配置为处理 ssl 配置，所以我对这个错误感到惊讶......这个错误发生在我的 minikube“集群”和 AKS 的真实 k8s 集群中。

我已经在 gitlab 上发布了简单的概念验证演示，以防有人想仔细看看：

https://gitlab.com/abitofhelp.shared/spring-consul-proxy-k8s.git

:: Spring Boot ::        (v2.3.5.RELEASE)
2020-11-12 06:55:42.529 ERROR 1 --- [           main] o.s.c.c.c.ConsulPropertySourceLocator    : Fail fast is set and there was an error reading configuration from consul.
2020-11-12 06:55:42.541 ERROR 1 --- [           main] o.s.boot.SpringApplication               : Application run failed
com.ecwid.consul.transport.TransportException: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at com.ecwid.consul.transport.AbstractHttpTransport.executeRequest(AbstractHttpTransport.java:83) ~[consul-api-1.4.5.jar:na]

Answer 1

您首先需要将应用程序配置为连接到在 Kubernetes 工作节点而不是 localhost 上运行的本地 Consul 代理的 IP。您可以使用 Kubernetes 向下 API 将主机的 IP 作为环境变量注入您的 pod。

apiVersion: v1
kind: Pod
metadata:
  name: example-app
spec:
  containers:
    - name: example
      image: myapp
      env:
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
      command: <command to start application>

（请参阅https://www.consul.io/docs/k8s/installation/install#accessing-the-consul-http-api 了解更多信息）

然后在您的bootstrap.yaml 配置中引用这个HOST_IP 环境变量。

server:
  port: ${PORT:8080}

spring:
  application:
    name: k8sconsulwebflux
  profiles: development
  cloud:
    consul:
      # Using Consul Connect Service Mesh
      scheme: https
      host: ${HOST_IP}
      port: 8501
      # Since ACLs are enabled, you also need to include a token
      # with appropriate permissions
      config:
        acl-token: 12345678-9876-5432-1234-567898765432