mybatis-plus速查
· One min read
xml 原生转义
| 字符名称 | sql符号 | 转义字符 |
|---|---|---|
| 大于号 | > | > |
| 小于号 | < | < |
| 不等于 | <> | <> |
| 大于等于号 | >= | >= |
| 小于等于号 | <= | <= |
| 与 | & | & |
| 单引号 | ' | ' |
| 双引号 | " | " |
linux常用命令
· One min read
Rancher滚动无感知切换镜像
· 2 min read
springboot 引入依赖
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-actuator</artifactId>
</dependency>
修改配置暴露端点
server:
port: 7878
shutdown: graceful
liteflow:
rule-source: config/**/*.el.xml
# Spring
spring:
mvc:
async:
request-timeout: 30000
application:
# 应用名称
name: xxxx
main:
allow-bean-definition-overriding: true
profiles:
# 环境配置
active: @spring.profiles.active@
lifecycle:
# 优雅下线超时时间
timeout-per-shutdown-phase: 5m
# 暴露 shutdown 接口
management:
endpoint:
health:
probes:
enabled: true
# 启用 shutdown 端点
shutdown:
enabled: true
创建一个端点来从 nacos 主动下线并且停止服务
import com.alibaba.cloud.nacos.NacosDiscoveryProperties;
import com.alibaba.cloud.nacos.registry.NacosRegistration;
import com.alibaba.cloud.nacos.registry.NacosServiceRegistry;
import lombok.extern.log4j.Log4j2;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.actuate.endpoint.annotation.Endpoint;
import org.springframework.boot.actuate.endpoint.annotation.ReadOperation;
import org.springframework.stereotype.Component;
@Component
@Endpoint(id = "deregister")
@Log4j2
public class NacosServiceDeregisterEndpoint {
@Autowired
private NacosDiscoveryProperties nacosDiscoveryProperties;
@Autowired
private NacosRegistration nacosRegistration;
@Autowired
private NacosServiceRegistry nacosServiceRegistry;
/**
* 从 nacos 中主动下线，用于 k8s 滚动更新时，提前下线分流流量
*
*/
@ReadOperation
public String endpoint() {
String serviceName = nacosDiscoveryProperties.getService();
String groupName = nacosDiscoveryProperties.getGroup();
String clusterName = nacosDiscoveryProperties.getClusterName();
String ip = nacosDiscoveryProperties.getIp();
int port = nacosDiscoveryProperties.getPort();
log.info("deregister from nacos, serviceName:{}, groupName:{}, clusterName:{}, ip:{}, port:{}", serviceName, groupName, clusterName, ip, port);
log.error("nacos下线成功提示");
// 设置服务下线
nacosServiceRegistry.setStatus(nacosRegistration, "DOWN");
return "success";
}
}
rancher 配置
//设置优雅停机字段
terminationGracePeriodSeconds: 600
//设置PreStop
sh -c 'curl http://127.0.0.1:7878/actuator/deregister;sleep 30;curl -X POST http://127.0.0.1:7878/actuator/shutdown;'
//设置健康检查等探针
spec:
containers:
- image: xxx.xxx.com/xxx/xxx-xx-xxx:3.3.0
imagePullPolicy: Always
lifecycle:
preStop:
exec:
command:
- sh
- '-c'
- >-
curl http://127.0.0.1:7878/actuator/deregister;sleep 30;curl -X POST
http://127.0.0.1:7878/actuator/shutdown;
livenessProbe:
failureThreshold: 10
httpGet:
path: /actuator/health/liveness
port: 7878
scheme: HTTP
initialDelaySeconds: 10
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 10
name: zdcloud-barcode-web
ports:
- containerPort: 7878
name: 7878tcp2
protocol: TCP
readinessProbe:
failureThreshold: 10
httpGet:
path: /actuator/health/readiness
port: 7878
scheme: HTTP
initialDelaySeconds: 10
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 10
startupProbe:
failureThreshold: 30
httpGet:
path: /actuator/health/liveness
port: 7878
scheme: HTTP
initialDelaySeconds: 10
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 10
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
__active: true
resources: {}
IntelliJ IDEA 推送镜像到harbor私库
· One min read
新增插件
<dependency>
<groupId>io.fabric8</groupId>
<artifactId>docker-maven-plugin</artifactId>
<version>0.40.2</version>
</dependency>
配置
需要一台docker跳板机
<build>
<plugins>
<plugin>
<groupId>io.fabric8</groupId>
<artifactId>docker-maven-plugin</artifactId>
<version>0.40.2</version>
<configuration>
<!--认证配置,用于私有registry认证-->
<authConfig>
<username>xxx</username>
<password>xxx</password>
</authConfig>
<!-- harbor镜像仓库地址-->
<pushRegistry>https://harbor.xxx.com</pushRegistry>
<dockerHost>tcp://x.x.x.x:2375</dockerHost>
<images>
<image>
<!--推送到私有镜像仓库，镜像名需要添加仓库地址-->
<name>harbor.xxx.com/xxxxx/${project.name}:${project.version}</name>
<!--定义镜像构建行为-->
<build>
<dockerFileDir>${project.basedir}</dockerFileDir>
</build>
</image>
</images>
</configuration>
<executions>
<execution>
<id>docker-exec</id>
<!-- 绑定mvn install阶段，当执行mvn install时 就会执行docker build 和docker push-->
<phase>install</phase>
<goals>
<goal>build</goal>
<goal>push</goal>
</goals>
</execution>
</executions>
</plugin>
</plugins>
</build>
执行
mvn clean install
使用nvm管理nodeJS
· One min read
安全连接Docker的2375端口
· 5 min read
创建docker.sh文件
这里指的是linux服务器,不是本地客户机。
#!/bin/bash
#创建 Docker TLS 证书
#相关配置信息
#公网ip
export SERVER=xxxxx
#密码
export PASSWORD=xxxx
#国家
export COUNTRY=CN
#省
export STATE=xx
#城市
export CITY=wenzhou
#组织
export ORGANIZATION=xxxx
export ORGANIZATIONAL_UNIT=xxxx
export EMAIL=xxxxx
export CA_HOME=/usr/local/ca_tls
###开始生成文件###
echo "开始生成文件"
#切换到生产密钥的目录
echo "创建并切换到生产密钥的目录"
mkdir $CA_HOME
cd $CA_HOME
#生成ca私钥(使用aes256加密)
echo "生成ca私钥(使用aes256加密)"
openssl genrsa -aes256 -passout pass:$PASSWORD -out ca-key.pem 4096
#生成ca证书，填写配置信息
echo "生成ca证书，填写配置信息"
openssl req -new -x509 -passin "pass:$PASSWORD" -days 3650 -key ca-key.pem -sha256 -out ca.pem -subj "/C=$COUNTRY/ST=$STATE/L=$CITY/O=$ORGANIZATION/OU=$ORGANIZATIONAL_UNIT/CN=$SERVER/emailAddress=$EMAIL"
#生成server证书私钥文件
echo "生成server证书私钥文件"
openssl genrsa -out server-key.pem 4096
#生成server证书请求文件
echo "生成server证书请求文件"
openssl req -subj "/CN=$SERVER" -new -key server-key.pem -out server.csr
#配置白名单 你使用的是服务器Ip的话,请将前面的DNS换成IP echo subjectAltName = IP:$SERVER,IP:0.0.0.0 >> extfile.cnf
echo "配置白名单"
sh -c 'echo "subjectAltName = IP:'$SERVER',IP:0.0.0.0" >> extfile.cnf'
sh -c 'echo "extendedKeyUsage = serverAuth" >> extfile.cnf'
#使用CA证书及CA密钥以及上面的server证书请求文件进行签发，生成server自签证书
echo "使用CA证书及CA密钥以及上面的server证书请求文件进行签发，生成server自签证书"
openssl x509 -req -days 3650 -in server.csr -CA ca.pem -CAkey ca-key.pem -passin "pass:$PASSWORD" -CAcreateserial -out server-cert.pem -extfile extfile.cnf
#生成client证书RSA私钥文件
echo "生成client证书RSA私钥文件"
openssl genrsa -out key.pem 4096
#生成client证书请求文件
echo "生成client证书请求文件"
openssl req -subj "/CN=client" -new -key key.pem -out client.csr
sh -c 'echo extendedKeyUsage=clientAuth >> extfile-client.cnf'
#生成client自签证书（根据上面的client私钥文件、client证书请求文件生成）
echo "生成client自签证书（根据上面的client私钥文件、client证书请求文件生成）"
openssl x509 -req -days 3650 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem -passin "pass:$PASSWORD" -CAcreateserial -out cert.pem -extfile extfile-client.cnf
#更改密钥权限
echo "更改密钥权限0400"
chmod 0400 ca-key.pem key.pem server-key.pem
#更改密钥权限
echo "更改秘钥权限0444"
chmod 0444 ca.pem server-cert.pem cert.pem
#删除无用文件
#rm client.csr server.csr
#复制需要的文件到docker目录
echo "复制需要的文件到docker目录"
cp server-*.pem /etc/docker/
cp ca.pem /etc/docker/
echo "生成文件完成"
###生成结束###
#vim /lib/systemd/system/docker.service
#整行替换成ExecStart=/usr/bin/dockerd --tlsverify --tlscacert=/etc/docker/ca.pem --tlscert=/etc/docker/server-cert.pem --tlskey=/etc/docker/server-key.pem -H tcp://0.0.0.0:2375 -H unix:///var/run/docker.sock
#line=`sed -n '/ExecStart/=' /lib/systemd/system/docker.service`
#change="ExecStart=/usr/bin/dockerd --tlsverify --tlscacert=/usr/local/ca/ca.pem --tlscert=/usr/local/ca/server-cert.pem --tlskey=/usr/local/ca/server-key.pem -H tcp://0.0.0.0:2375 -H unix:///var/run/docker.sock/"
#sed -e ''$line's/.*$/'$change'' /lib/systemd/system/docker.service
#systemctl daemon-reload
#systemctl restart docker
#复制在客户机中将ca.pem ca-key.pem cert.pem key.pem 放在同一文件夹
#打开idea配置安全链接
运行脚本
先cd到docker.sh所在目录
sh ./docker.sh
修改docker配置
vim /lib/systemd/system/docker.service
#找到文件内 ExecStart并且替换成下面的内容
ExecStart=/usr/bin/dockerd --tlsverify --tlscacert=/etc/docker/ca.pem --tlscert=/etc/docker/server-cert.pem --tlskey=/etc/docker/server-key.pem -H tcp://0.0.0.0:2375 -H unix:///var/run/docker.sock
配置生效
systemctl daemon-reload
重启docker
systemctl restart docker
服务器上生成全部证书所在路径
/usr/local/ca_tls
下载证书到本地
1.证书已经包含了包括客户端所需要的两个证书以及服务器的证书，下载放入项目备份 2.使用idea连接docker
Idea连接docker
