部署 Kf Cloud Service Broker

本页面介绍如何部署 Kf Cloud Service Broker for Google Cloud，并使用它来预配或取消预配支持性资源。如需详细了解 Kf Cloud Service Broker，请阅读概念和架构。

创建环境变量

Linux

export PROJECT_ID=YOUR_PROJECT_ID
export CLUSTER_PROJECT_ID=YOUR_PROJECT_ID
export CLUSTER_NAME=kf-cluster
export INSTANCE_NAME=cloud-service-broker
export COMPUTE_REGION=us-central1

Windows PowerShell

Set-Variable -Name PROJECT_ID -Value YOUR_PROJECT_ID
Set-Variable -Name CLUSTER_PROJECT_ID -Value YOUR_PROJECT_ID
Set-Variable -Name CLUSTER_NAME -Value kf-cluster
Set-Variable -Name INSTANCE_NAME -Value cloud-service-broker
Set-Variable -Name COMPUTE_REGION -Value us-central1

设置 Kf Cloud Service Broker 数据库

1. 创建 Cloud SQL for MySQL 实例。

   注意：请参阅为 Cloud SQL for MySQL 创建和管理 MySQL 用户，并为默认 root 用户设置安全密码。

   gcloud sql instances create ${INSTANCE_NAME} --cpu=2 --memory=7680MB --require-ssl --region=${COMPUTE_REGION}

2. 在 Cloud SQL for MySQL 实例中创建名为 servicebroker 的数据库。

   注意：请记录数据库名称，因为后续步骤会用到它。

   gcloud sql databases create servicebroker -i ${INSTANCE_NAME}

3. 创建 Kf Cloud Service Broker 要使用的用户名和密码。

   注意：请记录这些值，因为您将在后续步骤中使用它们。

   gcloud sql users create csbuser -i ${INSTANCE_NAME} --password=csbpassword

为 Kf Cloud Service Broker 设置 Google 服务账号

1. 创建 Google 服务账号。

   gcloud iam service-accounts create csb-${CLUSTER_NAME}-sa \
     --project=${CLUSTER_PROJECT_ID} \
     --description="GSA for CSB at ${CLUSTER_NAME}" \
     --display-name="csb-${CLUSTER_NAME}"

2. 向服务账号授予 roles/cloudsql.client 权限。这是通过 Cloud SQL Auth 代理将 Kf Cloud Service Broker pod 连接到 Cloud SQL for MySQL 实例所必需的。

   gcloud projects add-iam-policy-binding ${CLUSTER_PROJECT_ID} \
     --member="serviceAccount:csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com" \
     --role="roles/cloudsql.client"

3. 向服务账号授予其他 Google Cloud 权限。

   注意：在下面的示例中，我们授予了预配 Cloud SQL for MySQL 和 Memorystore 的实例所需的 IAM 角色。您必须为此服务账号授予适当的角色，才能预配 kf marketplace 中列出的其他 Google Cloud 代管式服务的实例。

   gcloud projects add-iam-policy-binding ${CLUSTER_PROJECT_ID} \
     --member="serviceAccount:csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com" \
     --role="roles/compute.networkUser"

   gcloud projects add-iam-policy-binding ${CLUSTER_PROJECT_ID} \
     --member="serviceAccount:csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com" \
     --role="roles/cloudsql.admin"

   gcloud projects add-iam-policy-binding ${CLUSTER_PROJECT_ID} \
     --member="serviceAccount:csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com" \
     --role="roles/redis.admin"

4. 验证权限。

   警告：请将以下 YAML 中的 CSB_SERVICE_ACCOUNT_NAME 变量替换为从 csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com 解析的完整服务账号。

   gcloud projects get-iam-policy ${CLUSTER_PROJECT_ID} \
     --filter='bindings.members:serviceAccount:"CSB_SERVICE_ACCOUNT_NAME"' \
     --flatten="bindings[].members"

为 Kf Cloud Service Broker 设置 Workload Identity

1. 将 Google 服务账号与 Kubernetes 服务账号绑定。

   gcloud iam service-accounts add-iam-policy-binding "csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com" \
     --project=${CLUSTER_PROJECT_ID} \
     --role="roles/iam.workloadIdentityUser" \
     --member="serviceAccount:${CLUSTER_PROJECT_ID}.svc.id.goog[kf-csb/csb-user]"

2. 验证绑定。

   gcloud iam service-accounts get-iam-policy "csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com" \
     --project=${CLUSTER_PROJECT_ID}

设置 Kubernetes Secret 以与 Kf Cloud Service Broker 共享配置

1. 创建一个 config.yml 文件。

   注意：如有需要，请替换默认用户/密码。确保您已在创建环境变量步骤中设置 CLUSTER_PROJECT_ID。

   cat << EOF >> ./config.yml
   gcp:
     credentials: ""
     project: ${CLUSTER_PROJECT_ID}
   db:
     host: 127.0.0.1
     password: csbpassword
     user: csbuser
     tls: false
   api:
     user: servicebroker
     password: password
   EOF

2. 创建 kf-csb 命名空间。

   kubectl create ns kf-csb

3. 创建 Kubernetes Secret。

   kubectl create secret generic csb-secret --from-file=config.yml -n kf-csb

安装 Kf Cloud Service Broker

1. 下载 kf-csb.yml。

   gcloud storage cp gs://kf-releases/csb/v1.1.0/kf-csb.yaml /tmp/kf-csb.yaml

2. 修改 /tmp/kf-csb.yaml 并将占位符替换为最终值。在下面的示例中，使用 sed。

   sed -i "s|<GSA_NAME>|csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com|g" /tmp/kf-csb.yaml
   sed -i "s|<INSTANCE_CONNECTION_NAME>|${CLUSTER_PROJECT_ID}:${COMPUTE_REGION}:${INSTANCE_NAME}|g" /tmp/kf-csb.yaml
   sed -i "s|<DB_PORT>|3306|g" /tmp/kf-csb.yaml

3. 应用 Kf Cloud Service Broker 的 yaml。

   kubectl apply -f /tmp/kf-csb.yaml

4. 验证 Kf Cloud Service Broker 安装状态。

   kubectl get pods -n kf-csb

创建 Service Broker

注意：用户/密码必须与您之前在 Kubernetes Secret 步骤中输入的内容匹配。

  kf create-service-broker cloud-service-broker servicebroker password http://csb-controller.kf-csb/

验证安装

查看 Marketplace 中的可用服务。

  kf marketplace

如果一切都已正确安装和配置，您应该会看到以下内容：

  $ kf marketplace

  Broker                Name                          Namespace  Description
  cloud-service-broker  csb-google-bigquery                      A fast, economical and fully managed data warehouse for large-scale data analytics.
  cloud-service-broker  csb-google-dataproc                      Dataproc is a fully-managed service for running Apache Spark and Apache Hadoop clusters in a simpler, more cost-efficient way.
  cloud-service-broker  csb-google-mysql                         Mysql is a fully managed service for the Google Cloud Platform.
  cloud-service-broker  csb-google-postgres                      PostgreSQL is a fully managed service for the Google Cloud Platform.
  cloud-service-broker  csb-google-redis                         Cloud Memorystore for Redis is a fully managed Redis service for the Google Cloud Platform.
  cloud-service-broker  csb-google-spanner                       Fully managed, scalable, relational database service for regional and global application data.
  cloud-service-broker  csb-google-stackdriver-trace             Distributed tracing service
  cloud-service-broker  csb-google-storage-bucket                Google Cloud Storage that uses the Terraform back-end and grants service accounts IAM permissions directly on the bucket.

清理

1. 删除 cloud-service-broker。

   kf delete-service-broker cloud-service-broker

2. 删除 CSB 组件。

   kubectl delete ns kf-csb

3. 删除 Kf Cloud Service Broker Cloud SQL for MySQL 实例。

   gcloud sql instances delete ${INSTANCE_NAME} --project=${CLUSTER_PROJECT_ID}

4. 移除 IAM 政策绑定。

   gcloud projects remove-iam-policy-binding ${CLUSTER_PROJECT_ID} \
   --member='serviceAccount:csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com' \
   --role=roles/cloudsql.client

   gcloud projects remove-iam-policy-binding ${CLUSTER_PROJECT_ID} \
   --member='serviceAccount:csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com' \
   --role=roles/compute.networkUser

   gcloud projects remove-iam-policy-binding ${CLUSTER_PROJECT_ID} \
   --member='serviceAccount:csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com' \
   --role=roles/redis.admin

5. 移除 GSA。

   gcloud iam service-accounts delete csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com \
     --project=${CLUSTER_PROJECT_ID}

后续步骤

• 根据我们的 Spring Music 指南测试 Kf Cloud Service Broker。