本頁面說明如何部署 Kf Cloud Service Broker，並使用該服務佈建或解除佈建後端資源。 Google Cloud 請參閱概念和架構，進一步瞭解 Kf Cloud Service Broker。
建立環境變數
Linux
export PROJECT_ID=YOUR_PROJECT_ID export CLUSTER_PROJECT_ID=YOUR_PROJECT_ID export CLUSTER_NAME=kf-cluster export INSTANCE_NAME=cloud-service-broker export COMPUTE_REGION=us-central1
Windows Powershell
Set-Variable -Name PROJECT_ID -Value YOUR_PROJECT_ID Set-Variable -Name CLUSTER_PROJECT_ID -Value YOUR_PROJECT_ID Set-Variable -Name CLUSTER_NAME -Value kf-cluster Set-Variable -Name INSTANCE_NAME -Value cloud-service-broker Set-Variable -Name COMPUTE_REGION -Value us-central1
設定 Kf Cloud Service Broker 資料庫
建立 MySQL 適用的 Cloud SQL 執行個體。
gcloud sql instances create ${INSTANCE_NAME} --cpu=2 --memory=7680MB --require-ssl --region=${COMPUTE_REGION}在 MySQL 適用的 Cloud SQL 執行個體中建立名為
servicebroker的資料庫。gcloud sql databases create servicebroker -i ${INSTANCE_NAME}建立 Kf Cloud Service Broker 使用的使用者名稱和密碼。
gcloud sql users create csbuser -i ${INSTANCE_NAME} --password=csbpassword
為 Kf Cloud Service Broker 設定 Google 服務帳戶 (GSA)
建立 Google 服務帳戶。
gcloud iam service-accounts create csb-${CLUSTER_NAME}-sa \ --project=${CLUSTER_PROJECT_ID} \ --description="GSA for CSB at ${CLUSTER_NAME}" \ --display-name="csb-${CLUSTER_NAME}"將
roles/cloudsql.client權限授予服務帳戶。這項設定是透過 Cloud SQL 驗證 Proxy 將 Kf Cloud Service Broker Pod 連線至 MySQL 適用的 Cloud SQL 執行個體時所需。gcloud projects add-iam-policy-binding ${CLUSTER_PROJECT_ID} \ --member="serviceAccount:csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com" \ --role="roles/cloudsql.client"將其他 Google Cloud 權限授予服務帳戶。
gcloud projects add-iam-policy-binding ${CLUSTER_PROJECT_ID} \ --member="serviceAccount:csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com" \ --role="roles/compute.networkUser"gcloud projects add-iam-policy-binding ${CLUSTER_PROJECT_ID} \ --member="serviceAccount:csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com" \ --role="roles/cloudsql.admin"gcloud projects add-iam-policy-binding ${CLUSTER_PROJECT_ID} \ --member="serviceAccount:csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com" \ --role="roles/redis.admin"驗證權限。
gcloud projects get-iam-policy ${CLUSTER_PROJECT_ID} \ --filter='bindings.members:serviceAccount:"CSB_SERVICE_ACCOUNT_NAME"' \ --flatten="bindings[].members"
為 Kf Cloud Service Broker 設定 Workload Identity
將 Google 服務帳戶繫結至 Kubernetes 服務帳戶。
gcloud iam service-accounts add-iam-policy-binding "csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com" \ --project=${CLUSTER_PROJECT_ID} \ --role="roles/iam.workloadIdentityUser" \ --member="serviceAccount:${CLUSTER_PROJECT_ID}.svc.id.goog[kf-csb/csb-user]"驗證繫結。
gcloud iam service-accounts get-iam-policy "csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com" \ --project=${CLUSTER_PROJECT_ID}
設定 Kubernetes 密鑰，與 Kf 雲端服務代理程式共用設定
建立 config.yml 檔案。
cat << EOF >> ./config.yml gcp: credentials: "" project: ${CLUSTER_PROJECT_ID}db: host: 127.0.0.1 password: csbpassword user: csbuser tls: false api: user: servicebroker password: password EOF建立
kf-csb命名空間。kubectl create ns kf-csb建立 Kubernetes 密鑰。
kubectl create secret generic csb-secret --from-file=config.yml -n kf-csb
安裝 Kf 雲端服務代理程式
下載
kf-csb.yml。gcloud storage cp gs://kf-releases/csb/v1.0.0/kf-csb.yaml /tmp/kf-csb.yaml編輯
/tmp/kf-csb.yaml，並將預留位置替換為最終值。在下方範例中，我們使用sed。sed -i "s|<GSA_NAME>|csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com|g" /tmp/kf-csb.yamlsed -i "s|<INSTANCE_CONNECTION_NAME>|${CLUSTER_PROJECT_ID}:${COMPUTE_REGION}:${INSTANCE_NAME}|g" /tmp/kf-csb.yamlsed -i "s|<DB_PORT>|3306|g" /tmp/kf-csb.yaml為 Kf 雲端服務代理程式套用 yaml。
kubectl apply -f /tmp/kf-csb.yaml確認 Kf 雲端服務代理程式安裝狀態。
kubectl get pods -n kf-csb
建立服務代理程式
kf create-service-broker cloud-service-broker servicebroker password http://csb-controller.kf-csb/驗證安裝
查看市集提供的服務。
kf marketplace如果一切安裝和設定都正確無誤，您應該會看到以下畫面：
$ kf marketplace
Broker Name Namespace Description
cloud-service-broker csb-google-bigquery A fast, economical and fully managed data warehouse for large-scale data analytics.
cloud-service-broker csb-google-dataproc Dataproc is a fully-managed service for running Apache Spark and Apache Hadoop clusters in a simpler, more cost-efficient way.
cloud-service-broker csb-google-mysql Mysql is a fully managed service for the Google Cloud Platform.
cloud-service-broker csb-google-postgres PostgreSQL is a fully managed service for the Google Cloud Platform.
cloud-service-broker csb-google-redis Cloud Memorystore for Redis is a fully managed Redis service for the Google Cloud Platform.
cloud-service-broker csb-google-spanner Fully managed, scalable, relational database service for regional and global application data.
cloud-service-broker csb-google-stackdriver-trace Distributed tracing service
cloud-service-broker csb-google-storage-bucket Google Cloud Storage that uses the Terraform back-end and grants service accounts IAM permissions directly on the bucket.
後續步驟
- 使用春季音樂指南測試 Kf 雲端服務代理程式。
清除所用資源
刪除 cloud-service-broker。
kf delete-service-broker cloud-service-broker刪除 CSB 元件。
kubectl delete ns kf-csb刪除 Kf 雲端服務代理程式 Cloud SQL for MySQL 執行個體。
gcloud sql instances delete ${INSTANCE_NAME} --project=${CLUSTER_PROJECT_ID}移除身分與存取權管理政策繫結。
gcloud projects remove-iam-policy-binding ${CLUSTER_PROJECT_ID} \ --member='serviceAccount:csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com' \ --role=roles/cloudsql.clientgcloud projects remove-iam-policy-binding ${CLUSTER_PROJECT_ID} \ --member='serviceAccount:csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com' \ --role=roles/compute.networkUsergcloud projects remove-iam-policy-binding ${CLUSTER_PROJECT_ID} \ --member='serviceAccount:csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com' \ --role=roles/redis.admin移除 GSA。
gcloud iam service-accounts delete csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com \ --project=${CLUSTER_PROJECT_ID}