operator raft

该命令包含一组管理集成 Raft 存储后端的子命令。

Usage: vault operator raft <subcommand> [options] [args]

 This command groups subcommands for operators interacting with the Vault
 integrated Raft storage backend. Most users will not need to interact with these
 commands. Here are a few examples of the Raft operator commands:

Subcommands:
    join           Joins a node to the Raft cluster
    list-peers     Returns the Raft peer set
    remove-peer    Removes a node from the Raft cluster
    snapshot       Restores and saves snapshots from the Raft cluster

join

该命令用于加入一个新节点作为 Raft 集群的节点。要成功加入一个集群,集群中必须至少有一个成员。如果正在使用 Shamir 封印,则在加入过程前后需要提供解封密钥,具体过程取决于它是否专用于高可用模式。

如果将 storage 设置为 raft,解封前必须加入集群,并且必须提供 leader-api-addr 参数。如果将 ha_storage 设置为 raft,加入集群前必须先解封节点,且不得提供 leader-api-addr

Usage: vault operator raft join [options] <leader-api-addr>

  Join the current node as a peer to the Raft cluster by providing the address
  of the Raft leader node.

      $ vault operator raft join "http://127.0.0.2:8200"

join 命令还允许使用 cloud auto-join 配置,而不是静态 IP 地址或主机名。设置后,Vault 将尝试根据提供的自动加入配置自动发现和解析潜在的领导者地址。

Vault 使用 go-discover 来支持自动加入功能。相关详细信息,请参阅 go-discover README

默认情况下,Vault 将尝试使用 HTTPS 协议和 8200 端口访问发现的对等点。管理员可以分别通过 --auto-join-scheme--auto-join-port 命令行标志覆盖这些设置。

Usage: vault operator raft join [options] <auto-join-configuration>
  Join the current node as a peer to the Raft cluster by providing cloud auto-join
  metadata configuration.
    $ vault operator raft join "provider=aws region=eu-west-1 ..."

参数

operator raft join 命令可以使用一下标志:

  • -leader-ca-cert (string: "") - 与 Raft 领导者通信使用的 CA 证书
  • -leader-client-cert (string: "") - 与 Raft 领导者进行身份验证所使用的客户端证书
  • -leader-client-key (string: "") - 与 Raft 领导者进行身份验证所使用的客户端密钥
  • -non-voter (bool: false)(企业版专用) - 该标志用于使服务器不参与 Raft 投票,只接收数据复制流。在需要对服务器进行大量读取的情况下,这可用于为集群增加读取可扩展性。默认值为 false-retry (bool: false) - 失败时不断重试加入 Raft 集群。默认值为 false

list-peers

该命令用于列出 Raft 集群中的节点集合。

Usage: vault operator raft list-peers

  Provides the details of all the peers in the Raft cluster.

      $ vault operator raft list-peers

输出样例

{
 ...
  "data": {
    "config": {
      "index": 62,
      "servers": [
        {
          "address": "127.0.0.2:8201",
          "leader": true,
          "node_id": "node1",
          "protocol_version": "3",
          "voter": true
        },
        {
          "address": "127.0.0.4:8201",
          "leader": false,
          "node_id": "node3",
          "protocol_version": "3",
          "voter": true
        }
      ]
    }
  }
}

remove-peer

该命令从 Raft 集群中删除一个节点。在某些情况下,即使服务器不再存在并且集群已经知晓这一情况,在 Raft 配置中也可能会留下该节点,此命令可用于删除故障服务器,使其不再影响 Raft 仲裁。

Usage: vault operator raft remove-peer <server_id>

  Removes a node from the Raft cluster.

      $ vault operator raft remove-peer node1

snapshot

该命令提供了一组与集成 Raft 存储后端的快照功能交互的子命令。有两个子命令:saverestore

Usage: vault operator raft snapshot <subcommand> [options] [args]

  This command groups subcommands for operators interacting with the snapshot
  functionality of the integrated Raft storage backend.

Subcommands:
    restore    Installs the provided snapshot, returning the cluster to the state defined in it
    save       Saves a snapshot of the current state of the Raft cluster into a file

snapshot save

为 Vault 数据创建一份快照。快照可以将 Vault 数据精准还原到快照被创建的那个时刻。

Usage: vault operator raft snapshot save <snapshot_file>

  Saves a snapshot of the current state of the Raft cluster into a file.

      $ vault operator raft snapshot save raft.snap

注意,当仅将 ha_storage 设置为 raft 时无法使用快照。

snapshot restore

还原 vault operator raft snapshot save 命令保存的快照。

Usage: vault operator raft snapshot restore <snapshot_file>

  Installs the provided snapshot, returning the cluster to the state defined in it.

      $ vault operator raft snapshot restore raft.snap

autopilot

该命令提供了一组与集成 Raft 存储后端的自动驾驶功能交互的子命令。支持三个子命令:get-configset-configstate

有关自动驾驶仪功能的更详细概述,请参阅相关基本概念页面。

Usage: vault operator raft autopilot <subcommand> [options] [args]

This command groups subcommands for operators interacting with the autopilot
functionality of the integrated Raft storage backend.

Subcommands:
    get-config    Returns the configuration of the autopilot subsystem under integrated storage
    set-config    Modify the configuration of the autopilot subsystem under integrated storage
    state         Displays the state of the raft cluster under integrated storage as seen by autopilot

autopilot state

显示自动驾驶所观察到的集成存储下 Raft 集群的状态。它显示自动驾驶认为集群是否健康,以及有多少个节点发生故障将会导致集群变得不健康(“Failure Tolerance”)。

状态包括按 nodeID 和 IP 地址列出的所有服务器的列表。 Last Index 指示每个节点上的状态与领导者的状态有多接近。

一个节点可以具有“leader”、“voter”和“non-voter”的状态。

Usage: vault operator raft autopilot state

  Displays the state of the raft cluster under integrated storage as seen by autopilot.

    $ vault operator raft autopilot state

输出样例

Healthy:                      true
Failure Tolerance:            1
Leader:                       raft1
Voters:
   raft1
   raft2
   raft3
Servers:
   raft1
      Name:            raft1
      Address:         127.0.0.1:8201
      Status:          leader
      Node Status:     alive
      Healthy:         true
      Last Contact:    0s
      Last Term:       3
      Last Index:      38
   raft2
      Name:            raft2
      Address:         127.0.0.2:8201
      Status:          voter
      Node Status:     alive
      Healthy:         true
      Last Contact:    2.514176729s
      Last Term:       3
      Last Index:      38

autopilot get-config

返回集成存储下自动驾驶子系统的配置。

Usage: vault operator raft autopilot get-config

  Returns the configuration of the autopilot subsystem under integrated storage.

    $ vault operator raft autopilot get-config

autopilot set-config

修改集成存储的自动驾驶子系统的配置:

Usage: vault operator raft autopilot set-config [options]

  Modify the configuration of the autopilot subsystem under integrated storage.

      $ vault operator raft autopilot set-config -server-stabilization-time 10s

该命令可以使用以下标志:

  • cleanup-dead-servers (bool) - 控制是否定期或在新服务器加入时从 Raft 集群节点列表中删除死服务器。这要求设置 min-quorum
  • last-contact-threshold (string) - 限制在多久没有联系过领导者节点后服务节点可被认为不健康
  • dead-server-last-contact-threshold (string) - 限制在多久没有联系过领导者节点后服务节点可被认为故障。只有在设置了 cleanup_dead_servers 标志时才有用
  • max-trailing-logs (int) - 服务实例的 Raft 记录落后于领导者多少条时可以被认为不健康
  • min-quorum (int) - 集群在清理死服务器前集群需要保持的最小节点数。该值至少为 3。只适用于投票节点
  • server-stabilization-time (string) - 服务器在成为投票者之前必须处于稳定、健康状态的最短时间。在此之前,它将作为集群中的对等节点可见,但作为非投票者,这意味着它不可参加仲裁

results matching ""

    No results matching ""