【譯】Consul 1.4：多資料中心服務網路
NOV 14 2018 THE CONSUL TEAM
我們很高興地宣佈HashiCorp Consul1.4將將可廣泛使用。Consul 是一個分散式服務網格, 可用於在任何執行平臺以及公共或私有云之間的連線、安全和配置服務。此版本引入了一個完全重新設計的 ACL系統和第一個具有多資料中心支援的企業級Consul Connect 功能。特別感謝我們積極的社群成員在 RC期間提供的寶貴反饋。
ofollow,noindex">立即下載
Consul Connect 將可廣泛使用 (GA)
我們在今年6月推出了Connect功能, 使Consul 能夠對流量進行細分, 並使用基於 TLS 的方法構建零信任網路。自最初發布以來, Consul團隊一直專注於 production hardening 和擴充套件生態系統整合。我們很高興地宣佈Connect在此版本中將可廣泛使用。
ACL 重新設計
對 Consul 的 ACL 系統進行了重新設計, 以簡化操作和管理。這一變化涵蓋了幾個不同的領域。
Tokens 和 政策
現在可以使用公共儲存器 ID 檢索和修改 Token, 這些 ID 不同於用於授權向 Consul 發出請求的祕密 ID ( API 互動中 token )。這樣可以更安全地管理 ACL Token。
還添加了一個策略資料模型, 該模型可應用於許多Token並可集中管理。這使操作員一箇中心位置。可以為一組應用程式、業務單元或其他分組更新特定策略, 並且本次更新將應用於在該策略下建立的所有 Token。
UI
Consul web UI 允許對 Token 和策略進行全面管理。
CLI
新的 ACL 系統包括一個新的 CLI 來管理 Token、策略和升級。這即可用於自動化也可用於手動管理。
在此示例中, 將建立一個新策略, 然後是附加到該策略的 Token。
$ consul acl policy create -name "example" -description "Example policy" -rules @rules.hcl
ID:ca44555b-a2d8-94de-d763-88caffdaf11f
Name:example
Description:Example policy
Datacenters:
Rules:
service_prefix "marketing-" {
policy = "read"
}
$ consul acl token create -description "www-app" -policy-id ca44555b
AccessorID:986193b5-e2b5-eb26-6264-b524ea60cc6d
SecretID:ec15675e-2999-d789-832e-8c4794daa8d7
Description:www-app
Local:false
Create Time:2018-10-22 15:33:39.01789 -0400 EDT
Policies:
ca44555b-a2d8-94de-d763-88caffdaf11f - example
複製程式碼
訪問ACL command 文件, 瞭解完整的示例及所有可用命令。
升級
我們設計了這個新系統, 允許來自舊 ACL 系統的就地升級, 舊系統將在自動遷移的同時為啟用 ACL 的 clusters 的當前 API Token 保留相容性。閱讀完整的升級指南.
多資料中心服務細分 (企業版功能)
Consul 企業版增加了一個新的主要功能, 以擴充套件 connect 的功能, 使其超出單個群集用例的範圍。Consul connect 現在支援在資料中心之間的意圖複製和聯合證書管理。這允許在任何資料中心的源服務和目標服務之間進行安全、授權的連線。意圖的實時複製還可確保將一致的安全策略應用於服務, 無論服務駐留在原地或遷移到何處。
其他增強功能
除了新的 UI外, 此版本還提供了新的特性、增強功能和bug修復。其中一些主要功能特性包括:
- 新的
consul debug命令, 該命令收集有關目標代理和群集的資訊, 以幫助解決 incidents 和除錯問題 - dns 支援字首查詢, 例如
lb-*以匹配服務lb-001或lb-service-007
瞭解更多資訊
欲瞭解更多資訊, 請訪問Consul 專案頁面。我們希望你喜歡 Consul 1.4!
---
【原文】Consul 1.4: Multi-Data Center Service Mesh
NOV 14 2018 THE CONSUL TEAM
We are excited to announce the general availability ofHashiCorp Consul 1.4. Consul is a distributed service mesh to connect, secure, and configure services across any runtime platform and public or private cloud. This release introduces a completely redesigned ACL system and the first enterprise Consul Connect feature with multi-data center support. A special thanks to our active community members for their valuable feedback during the RC period.
Consul Connect General Availability (GA)
We introduced theConnect feature in June this year, which enabled Consul to segment traffic and use a TLS-based approach to do zero trust networking. Since the initial release, the Consul team has focused on production hardening and expanding the ecosystem integration. We are pleased to announce the general availability of Connect in this release.
ACL Redesign
The ACL system in Consul has been redesigned to simplify operations and management. This change covered several different areas.
Tokens & Policies
Tokens can now be retrieved and modified using public accessor IDs, which are different than the secret ID ( token in API interactions) used for authorizing requests to Consul. This allows for more secure management of ACL tokens.
A policy data model was also added, which can be applied to many tokens and managed centrally. This gives operators a central place to update a specific policy for a set of applications, business unit, or other groupings that will apply to all tokens created under that policy.
UI
The Consul web UI allows for full management of tokens and policies.
image
CLI
The new ACL system includes a new CLI to manage tokens, policies, and upgrades. This can be used in automation or for manual management.
In this example, a new policy is created, followed by a token which is attached to that policy.
$ consul acl policy create -name "example" -description "Example policy" -rules @rules.hcl
ID:ca44555b-a2d8-94de-d763-88caffdaf11f
Name:example
Description:Example policy
Datacenters:
Rules:
service_prefix "marketing-" {
policy = "read"
}
$ consul acl token create -description "www-app" -policy-id ca44555b
AccessorID:986193b5-e2b5-eb26-6264-b524ea60cc6d
SecretID:ec15675e-2999-d789-832e-8c4794daa8d7
Description:www-app
Local:false
Create Time:2018-10-22 15:33:39.01789 -0400 EDT
Policies:
ca44555b-a2d8-94de-d763-88caffdaf11f - example
複製程式碼
Visit the ACL command documentation for a full set of examples and all the commands available.
Upgrading
We've designed this new system to allow for in-place upgrades coming from the old ACL system that will automatically migrate while retaining compatibility for current API tokens for clusters where ACLs are enabled. Read thefull upgrade guide.
Multi-Data Center Service Segmentation (Enterprise Feature)
Consul Enterprise added a new major feature to extend Connect's capabilities beyond the single cluster use case.Consul Connect now supports replication of intentions and federated certificate management between data centers. This allows secure, authorized connections between source and destination services in any data center. The real-time replication of intentions also ensures that consistent security policies are applied to a service regardless of where it resides or migrates to.
Other Enhancements
In addition to the new UI, this release also delivers new features, enhancements and bug fixes. Some of the major features include:
- A new
consul debugcommand which gathers information about the target agent and cluster to help resolve incidents and debug issues - DNS supports prefix lookups, such as
lb-*to match serviceslb-001orlb-service-007