RocketMQ的Docker镜像部署(以及Dashboard的部署、ACL配置)

2023-12-21 21:32:26

RocketMQ的Docker镜像部署(以及Dashboard、ACL)

准备

  • 包含RocketMQ部署(NameServer、Broker)、Dashboard、ACL
  • 拉取镜像
    • RocketMQ$ docker pull apache/rocketmq:5.1.4
    • Dashboard$ docker pull apacherocketmq/rocketmq-dashboard:latest
  • 创建docker-network$ docker network create rocketmq-net (如果都部署在同一节点的话需要这样做)

部署 NameServer

  • 创建目录和修改权限
# 创建目录
mkdir -p /opt/soft/rocketmq-5.1.4-docker/namesrv/logs

# 修改权限,便于docker容器写入文件
chmod 777 /opt/soft/rocketmq-5.1.4-docker/namesrv/logs
  • 启动 NameServer
docker run -d --name rocketmq-namesrv \
--network rocketmq-net \
--restart=always \
-p 9876:9876 \
-v /opt/soft/rocketmq-5.1.4-docker/namesrv/logs:/home/rocketmq/logs \
-e "MAX_POSSIBLE_HEAP=100000000" \
apache/rocketmq:5.1.4 \
sh mqnamesrv

# -v /opt/soft/rocketmq-5.1.4-docker/namesrv/logs:/home/rocketmq/logs \
  • 注意:
    • Docker容器需要有对服务器目录 /opt/soft/rocketmq-5.1.4-docker/namesrv/logs 的写入权限,例如可以提前创建该目录,并设置777权限。后续的-v挂载同理。

部署 Broker

  • 拷贝NameServer容器的中的配置文件到Broker
mkdir -p /opt/soft/rocketmq-5.1.4-docker/broker/broker-a-0
docker cp <NameServer的容器ID>:/home/rocketmq/rocketmq-5.1.4/conf /opt/soft/rocketmq-5.1.4-docker/broker/broker-a-0
  • 修改Broker配置$ vim /opt/soft/rocketmq-5.1.4-docker/broker/broker-a/conf/broker.conf
# 所属集群名称
brokerClusterName = DefaultCluster
# Broker名称,Master和Slave使用相同的名称(主从关系)
brokerName = broker-a
# 0表示Master,大于0表示不同的Slave
brokerId = 0
# 删除消息的时机,默认是4点
deleteWhen = 04
# 消息持久化在磁盘上的时长(小时)
fileReservedTime = 48
# Master和Slave之间同步数据的机制:SYNC_MASTER、ASYNC_MASTER、SLAVE
brokerRole = ASYNC_MASTER
# 刷盘策略:SYNC_FLUSH 消息写入磁盘后才返回成功状态;ASYNC_FLUSH 不需要等返回成功。
flushDiskType = ASYNC_FLUSH
# 设置Broker节点所在服务器的IP地址(需要连该MQ的外网应当能访问该IP)
brokerIP1 = XXX.XXX.XXX.XXX
# NameServer地址,用分号分割,我们通过Docker的环境变量指定
# namesrvAddr = XXX.XXX.XXX.XXX:9876
# Broker 对外服务的监听端口,默认即可
# listenPort = 10911
# 是否允许 Broker 自动创建 Topic
# autoCreateTopicEnable = true
# 是否允许 Broker 自动创建 订阅组
# autoCreateSubscriptionGroup = true
# 开启鉴权
# aclEnable = true
  • 创建目录和修改权限
# 创建目录
mkdir -p /opt/soft/rocketmq-5.1.4-docker/broker/broker-a-0/conf
mkdir -p /opt/soft/rocketmq-5.1.4-docker/broker/broker-a-0/logs
mkdir -p /opt/soft/rocketmq-5.1.4-docker/broker/broker-a-0/store

# 修改权限,便于docker容器写入文件
chmod 777 /opt/soft/rocketmq-5.1.4-docker/broker/broker-a-0/conf
chmod 777 /opt/soft/rocketmq-5.1.4-docker/broker/broker-a-0/logs
chmod 777 /opt/soft/rocketmq-5.1.4-docker/broker/broker-a-0/store
  • 启动 Broker
docker run -d --name rocketmq-broker-a-0 \
--network rocketmq-net \
--restart=always \
--privileged=true \
-p 10911:10911 -p 10909:10909 \
-v /opt/soft/rocketmq-5.1.4-docker/broker/broker-a-0/conf:/home/rocketmq/rocketmq-5.1.4/conf \
-v /opt/soft/rocketmq-5.1.4-docker/broker/broker-a-0/logs:/home/rocketmq/logs \
-v /opt/soft/rocketmq-5.1.4-docker/broker/broker-a-0/store:/home/rocketmq/store \
-e "NAMESRV_ADDR=rocketmq-namesrv:9876" \
-e "MAX_POSSIBLE_HEAP=200000000" \
apache/rocketmq:5.1.4 \
sh mqbroker -c /home/rocketmq/rocketmq-5.1.4/conf/broker.conf

-e "BROKER_IP_1=10.113.75.113" \

部署 其他Broker

  • 和上面的配置类似
  • 调整 broker.conf 中的brokerName、brokerId即可
  • 如果在不同的服务器的话
    • 不用使用 --network rocketmq-net
    • -e "NAMESRV_ADDR=rocketmq-namesrv:9876"中的 rocketmq-namesrv 需要修改为对应服务器的IP
    • 后面Dashboard中的配置同理

部署 Dashboard

  • 创建目录和修改权限
mkdir -p /opt/soft/rocketmq-5.1.4-docker/console/data
chmod 777 /opt/soft/rocketmq-5.1.4-docker/console/data
  • 配置用户名和密码 $ vim /opt/soft/rocketmq-5.1.4-docker/console/data/users.properties
# This file supports hot change, any change will be auto-reloaded without Console restarting.
# Format: a user per line, username=password[,N] #N is optional, 0 (Normal User); 1 (Admin)
# Define Admin
# === 规则「用户名=密码,权限」。权限为1表示管理员,为0表示普通用户 ===
admin=admin123,1
# Define Users
# === 屏蔽下边两个账户 ==
#user1=user1
#user2=user2
  • 启动 Dashboard
# 普通
docker run -d --name rocketmq-console \
--network rocketmq-net \
--restart=always \
-p 10100:8080 \
-v /opt/soft/rocketmq-5.1.4-docker/console/data:/tmp/rocketmq-console/data \
-e "JAVA_OPTS=-Drocketmq.namesrv.addr=rocketmq-namesrv:9876 -Dcom.rocketmq.sendMessageWithVIPChannel=false -Drocketmq.config.loginRequired=true" \
apacherocketmq/rocketmq-dashboard:latest

# 当-Drocketmq.config.loginRequired为false时,则Dashboard不需要登录用户和密码
# 这里的 rocketmq-namesrv 是NameServer的地址
  • 直接访问http://<Dashboard的IP>:10100,输入前面配置的用户、密码
  • 现在已经可以正常使用了

开启 ACL

修改所有Broker节点

  • 编辑Broker配置文件,命令样例 vim /opt/soft/rocketmq-5.1.4-docker/broker/broker-a/conf/broker.conf
# 配置下面这段
# 开启鉴权
aclEnable = true
  • 编辑ACL配置文件,命令样例 vim /opt/soft/rocketmq-5.1.4-docker/broker/broker-a/conf/plain_acl.yml
globalWhiteRemoteAddresses:
  # 注释掉全局白名单,所有IP皆可访问,根据自己需求进行控制
  #- 10.10.103.*
  #- 192.168.0.*

accounts:
  - accessKey: RocketMQ
    secretKey: 12345678
    whiteRemoteAddress:
    admin: false
    defaultTopicPerm: DENY
    defaultGroupPerm: SUB
    topicPerms:
      - topicA=DENY
      - topicB=PUB|SUB
      - topicC=SUB
    groupPerms:
      # the group should convert to retry topic
      - groupA=DENY
      - groupB=PUB|SUB
      - groupC=SUB

  - accessKey: rocketmq2
    secretKey: 12345678
    whiteRemoteAddress: 192.168.1.*
    # if it is admin, it could access all resources
    admin: true

  # 添加一个给Dashboard使用的用户
  - accessKey: console
    secretKey: 12345678
    whiteRemoteAddress:
    admin: true
  • 重启Broker节点 $ docker restart <容器ID>

修改 Dashboard 启动命令

  • 移除已部署的Dashboard,样例命令 $ docker rm -f <容器ID>
  • 在启动命令中添加accessKey、secretKey
docker run -d --name rocketmq-console \
--network rocketmq-net \
--restart=always \
-p 10100:8080 \
-v /opt/soft/rocketmq-5.1.4-docker/console/data:/tmp/rocketmq-console/data \
-e "JAVA_OPTS=-Drocketmq.namesrv.addr=rocketmq-namesrv:9876 -Dcom.rocketmq.sendMessageWithVIPChannel=false -Drocketmq.config.loginRequired=true -Drocketmq.config.accessKey=console -Drocketmq.config.secretKey=12345678" \
apacherocketmq/rocketmq-dashboard:latest

参考

文章来源:https://blog.csdn.net/alionsss/article/details/135139421
本文来自互联网用户投稿,该文观点仅代表作者本人,不代表本站立场。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。