1助琐、環(huán)境配置：

2蒸殿、克隆版本庫

實(shí)際上，在官方的git版本庫中已自帶了許多自動化部署腳本，在 apisix/utils/中边坤，可以使用其進(jìn)行自動化部署挺庞。

# 使用碼云（國內(nèi)版本庫）加速下載
cd /data/softwares && \
git clone git@gitee.com:iresty/apisix.git

image.png

3、安裝依賴

1）安裝 openresty

1. 安裝依賴庫

yum install -y curl git gcc glibc gcc-c++ openssl-devel pcre-devel yum-utils

2. 安裝openresty以及openssl 依賴

yum-config-manager --add-repo https://openresty.org/package/fedora/openresty.repo && \
yum install -y openresty openresty-openssl111-devel

3. 軟鏈至標(biāo)準(zhǔn)目錄

使用yum安裝舅踪，默認(rèn)安裝路徑在/usr/local/openresty 纽甘，將其軟鏈到標(biāo)準(zhǔn)目錄 /data/applications，方便統(tǒng)一管理

ln -s /usr/local/openresty /data/applications

2）安裝 ETCD

1. 下載二進(jìn)制包

注意 2.6 版本的apisix只支持 3.4x 的 etcd

cd /data/softwares && \
wget -c https://github.com/etcd-io/etcd/releases/download/v3.4.13/etcd-v3.4.13-linux-amd64.tar.gz && \
tar xf etcd-v3.4.13-linux-amd64.tar.gz && \
cd etcd-v3.4.13-linux-amd64 && \
cp etcd* /usr/local/bin && \
mkdir -p /data/etcd/{conf,data,log}

2. 配置文件

編輯文件抽碌，路徑: /data/etcd/conf/etcd.conf 悍赢，文件內(nèi)容如下：

#[Member]
#ETCD_CORS=""
ETCD_DATA_DIR="/data/etcd/data"
#ETCD_WAL_DIR=""
ETCD_LISTEN_PEER_URLS="http://192.168.3.224:2380"
ETCD_LISTEN_CLIENT_URLS="http://192.168.3.224:2379"
#ETCD_MAX_SNAPSHOTS="5"
#ETCD_MAX_WALS="5"
ETCD_NAME="node1"
#ETCD_SNAPSHOT_COUNT="100000"
#ETCD_HEARTBEAT_INTERVAL="100"
#ETCD_ELECTION_TIMEOUT="1000"
#ETCD_QUOTA_BACKEND_BYTES="0"
#ETCD_MAX_REQUEST_BYTES="1572864"
#ETCD_GRPC_KEEPALIVE_MIN_TIME="5s"
#ETCD_GRPC_KEEPALIVE_INTERVAL="2h0m0s"
#ETCD_GRPC_KEEPALIVE_TIMEOUT="20s"


#[Clustering]
ETCD_INITIAL_ADVERTISE_PEER_URLS="http://192.168.3.224:2380"
ETCD_ADVERTISE_CLIENT_URLS="http://192.168.3.224:2379"
#ETCD_DISCOVERY=""
#ETCD_DISCOVERY_FALLBACK="proxy"
#ETCD_DISCOVERY_PROXY=""
#ETCD_DISCOVERY_SRV=""
ETCD_INITIAL_CLUSTER="node1=http://192.168.3.224:2380"
#ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
#ETCD_INITIAL_CLUSTER_STATE="new"
#ETCD_STRICT_RECONFIG_CHECK="true"
#ETCD_ENABLE_V2="true"
#
#[Proxy]
#ETCD_PROXY="off"
#ETCD_PROXY_FAILURE_WAIT="5000"
#ETCD_PROXY_REFRESH_INTERVAL="30000"
#ETCD_PROXY_DIAL_TIMEOUT="1000"
#ETCD_PROXY_WRITE_TIMEOUT="5000"
#ETCD_PROXY_READ_TIMEOUT="0"
#
#[Security]
#ETCD_CERT_FILE=""
#ETCD_KEY_FILE=""
#ETCD_CLIENT_CERT_AUTH="false"
#ETCD_TRUSTED_CA_FILE=""
#ETCD_AUTO_TLS="false"
#ETCD_PEER_CERT_FILE=""
#ETCD_PEER_KEY_FILE=""
#ETCD_PEER_CLIENT_CERT_AUTH="false"
#ETCD_PEER_TRUSTED_CA_FILE=""
#ETCD_PEER_AUTO_TLS="false"
#
#[Logging]
#ETCD_DEBUG="false"
#ETCD_LOG_PACKAGE_LEVELS=""
#ETCD_LOG_OUTPUT="default"
#
#[Unsafe]
#ETCD_FORCE_NEW_CLUSTER="false"
#
#[Version]
#ETCD_VERSION="false"
#ETCD_AUTO_COMPACTION_RETENTION="0"
#
#[Profiling]
#ETCD_ENABLE_PPROF="false"
#ETCD_METRICS="basic"
#
#[Auth]
#ETCD_AUTH_TOKEN="simple"

3.配置日志

文件路徑: /etc/rsyslog.d/etcd.conf , 新增文件决瞳，編輯以下內(nèi)容

if $programname == 'etcd' then /data/etcd/log/etcd.log
& stop

重啟 rsyslog

systemctl restart rsyslog.service 

4. 注冊systemd

文件路徑: /usr/lib/systemd/system/etcd.service, 新增文件，編譯以下內(nèi)容

[Unit]
Description=Etcd Server
After=network.target
After=network-online.target
Wants=network-online.target

[Service]
Type=notify
WorkingDirectory=/data/etcd
EnvironmentFile=/data/etcd/conf/etcd.conf

# set GOMAXPROCS to number of processors
ExecStart=/bin/bash -c "GOMAXPROCS=$(nproc) /usr/local/bin/etcd"

Restart=on-failure
LimitNOFILE=65536
StandardOutput=syslog
StandardError=syslog
SyslogIdentifier=etcd # without any quote

[Install]
WantedBy=multi-user.target

注意：ETCD3.4x 版本會自動讀取環(huán)境變量的參數(shù)左权，所以EnvironmentFile文件中有的參數(shù)皮胡，不需要再次在ExecStart啟動參數(shù)中添加，二選一赏迟，如同時配置屡贺，會觸發(fā)以下類似報錯是因。

image-20210616164807096.png

啟動服務(wù)

systemctl daemon-reload && \
systemctl enable etcd.service && \
systemctl start etcd.service 

3）安裝 LuaRocks

apisix 自帶了一鍵安裝LuaRocks腳本linux-install-luarocks.sh锌杀，可以直接使用甩栈，但是需要配合yum安裝或者apisix自帶的自動安裝 openresty 腳本linux-install-openresty.sh使用，其默認(rèn)識別openresty安裝路徑為 /usr/local/openresty

1. 自動腳本安裝

curl https://raw.githubusercontent.com/apache/apisix/master/utils/linux-install-luarocks.sh -sL | bash -

腳本內(nèi)容：

#!/usr/bin/env bash
#
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

# you might need sudo to run this script
if [ -z ${OPENRESTY_PREFIX} ]; then
    OPENRESTY_PREFIX="/usr/local/openresty"
fi

wget https://github.com/luarocks/luarocks/archive/v3.4.0.tar.gz
tar -xf v3.4.0.tar.gz
cd luarocks-3.4.0 || exit

OR_BIN="$OPENRESTY_PREFIX/bin/openresty"
OR_VER=$($OR_BIN -v 2>&1 | awk -F '/' '{print $2}' | awk -F '.' '{print $1"."$2}')
if [[ -e $OR_BIN && "$OR_VER" == 1.19 ]]; then
    WITH_LUA_OPT="--with-lua=${OPENRESTY_PREFIX}/luajit"
else
    # For old version OpenResty, we still need to install LuaRocks with Lua
    WITH_LUA_OPT=
fi

./configure $WITH_LUA_OPT \
    > build.log 2>&1 || (cat build.log && exit 1)

make build > build.log 2>&1 || (cat build.log && exit 1)
sudo make install > build.log 2>&1 || (cat build.log && exit 1)
cd .. || exit
rm -rf luarocks-3.4.0

mkdir ~/.luarocks || true

# OpenResty 1.17.8 or higher version uses openssl111 as the openssl dirname.
OPENSSL_PREFIX=${OPENRESTY_PREFIX}/openssl
if [ -d ${OPENRESTY_PREFIX}/openssl111 ]; then
    OPENSSL_PREFIX=${OPENRESTY_PREFIX}/openssl111
fi

luarocks config variables.OPENSSL_LIBDIR ${OPENSSL_PREFIX}/lib
luarocks config variables.OPENSSL_INCDIR ${OPENSSL_PREFIX}/include

2.編譯安裝LuaRocks

由于也會存在已經(jīng)安裝有openresty的情況糕再，比如我們已事先安裝有 openresty 1.15.8.3 版本量没，下面介紹下使用自定義安裝LuaRocks的方法。

1.19新版本的 openresty 已可以直接集成 luarocks突想，而之前的舊版本仍需要手動安裝luarocks殴蹄。

1?? 下載解壓 LuaRocks 源碼包

cd /data/softwares/ && \
wget -c https://github.com/luarocks/luarocks/archive/v3.4.0.tar.gz && \
tar xf v3.4.0.tar.gz 

2?? 集成openresty的luajit

cd /data/softwares/luarocks-3.4.0 && \
./configure --prefix=/data/applications/openresty/luajit --with-lua=/data/applications/openresty/luajit --lua-suffix=jit --with-lua-include=/data/applications/openresty/luajit/include/luajit-2.1 

3?? 編譯安裝

make build && \
make install

4?? 添加環(huán)境變量

vim /etc/profile.d/luarocks.sh
# 添加以下內(nèi)容
export LUAROCK_HOME=/data/applications/openresty/luajit/bin
export PATH=${PATH}:${LUAROCK_HOME}

source /etc/profile.d/luarocks.sh 

5?? 驗(yàn)證安裝

luarocks

image-20210615142621225.png

3. luarocks 加載 openssl（升級openssl）

1?? 編譯zlib 1.2.11

cd /data/softwares && \
wget -c http://www.zlib.net/fossils/zlib-1.2.11.tar.gz && \
tar xf zlib-1.2.11.tar.gz && \
cd zlib-1.2.11 && \
./configure --prefix=/usr/local/zlib && \
make && make install

2?? 安裝 OpenSSL 1.1.1

只用 openresty 官方提供的repo源可以直接安裝

yum install yum-utils && \
yum-config-manager --add-repo https://openresty.org/package/centos/openresty.repo && \
yum install -y openresty-openssl111-devel && \
ln -s /usr/local/openresty/openssl111 /usr/local/openssl && \
make && make install

3?? 修改openssl編譯文件

vim /data/softwares/openresty-1.15.8.3/bundle/nginx-1.15.8/auto/lib/openssl/conf
# 將里面的所有“.openssl”刪除，在刪之前你可以看到其所在行表示的是一個路徑猾担，記得將“/”也刪掉

4?? 重新編譯 openresty 并加載最新openssl

添加 --with-zlib=/data/softwares/zlib-1.2.8 --with-openssl=--with-openssl=/usr/local/openssl

mkdir -p /data/conf/nginx/bak && \ 
cp /data/applications/openresty/nginx/conf/nginx.conf /data/conf/nginx/bak && \
cd /data/softwares/openresty-1.15.8.3 && \
./configure -j2 --prefix=/data/applications/openresty --with-pcre-jit --with-ipv6 --with-http_stub_status_module --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_sub_module --with-http_gzip_static_module --with-pcre --with-stream=dynamic --with-http_flv_module --add-module=/data/softwares/ngx_http_geoip2_module --add-module=/data/softwares/nginx_upstream_check_module --with-zlib=/data/softwares/zlib-1.2.11 --with-openssl=/usr/local/openssl && \
make -j2 && \
make install

image-20210615184153826.png

5?? luarocks 加載 openssl

luarocks config variables.OPENSSL_LIBDIR /usr/local/openssl/lib && \
luarocks config variables.OPENSSL_LIBDIR /usr/local/openssl/include 

4袭灯、部署apisix

1）安裝

1. 下載rpm包

cd /data/softwares && \
wget -c https://github.com/apache/apisix/releases/download/2.6/apisix-2.6-0.x86_64.rpm

2. 安裝apisix

yum localinstall -y apisix-2.6-0.x86_64.rpm

3. 軟鏈至標(biāo)準(zhǔn)目錄

使用yum安裝，默認(rèn)安裝路徑在/usr/local/apisix垒探，將其軟鏈到標(biāo)準(zhǔn)目錄 /data/applications妓蛮，方便統(tǒng)一管理

ln -s /usr/local/apisix /data/applications

2）配置

1. 配置etcd地址

文件地址: /data/applications/apisix/conf/config.yaml，修改etcd 配置

#
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# If you want to set the specified configuration value, you can set the new
# in this file. For example if you want to specify the etcd address:
#
etcd:
    host:
      - "http://192.168.3.224:2379"

# To configure via environment variables, you can use `${{VAR}}` syntax. For instance:
#
# etcd:
#     host:
#       - "http://${{ETCD_HOST}}:2379"
#
# And then run `export ETCD_HOST=$your_host` before `make init`.
#
# If the configured environment variable can't be found, an error will be thrown.
apisix:
  admin_key:
    - name: "admin"
      key: edd1c9f034335f136f87ad84b625c8f1  # using fixed API token has security risk, please update it when you deploy to production environment
      role: admin

2. 修改 apisix內(nèi)置 nginx.conf（選項）

文件路徑: /data/applications/apisix/conf/nginx.conf圾叼，目的在于開放外部訪問限制蛤克，生產(chǎn)環(huán)境不推薦

sed -i '/deny/d' /data/applications/apisix/conf/nginx.conf && \
sed -i '/allow/d' /data/applications/apisix/conf/nginx.conf 

3. 修改啟動服務(wù)

文件路徑: /data/applications/apisix/apisix/cli/ops.lua， 取消 reload 方法中的init（初始化 nginx.conf）

local function reload(env)
    -- reinit nginx.conf
    -- init(env) 注釋掉該行

    local test_cmd = env.openresty_args .. [[ -t -q ]]
    -- When success,
    -- On linux, os.execute returns 0,
    -- On macos, os.execute returns 3 values: true, exit, 0, and we need the first.
    local test_ret = execute((test_cmd))
    if (test_ret == 0 or test_ret == true) then
        local cmd = env.openresty_args .. [[ -s reload]]
        execute(cmd)
        return
    end

    print("test openresty failed")
end

3）啟動

1. 修改systemd

文件路徑: /usr/lib/systemd/system/apisix.service夷蚊，增加 Restart 選項

[Unit]
Description=apisix
Conflicts=apisix.service
After=network-online.target

[Service]
Type=forking
WorkingDirectory=/usr/local/apisix
ExecStart=/usr/bin/apisix start
ExecStop=/usr/bin/apisix stop
ExecReload=/usr/bin/apisix reload
Restart=always

2. 啟動服務(wù)

systemctl daemon-reload && \
systemctl enable apisix.service && \
systemctl start apisix.service

4）驗(yàn)證

1. get請求調(diào)用 restful_api

鑒權(quán)key位于文件/data/applications/apisix/conf/config.yaml中构挤，apisix ==> admin_key

curl -s "http://127.0.0.1:9080/apisix/admin/services/" -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' | jq .

正常返回如下:

{
  "count":"1",
  "action":"get",
  "node":{
    "key":"/apisix/services",
    "nodes":{},
    "dir":true
  }
}

5、安裝 apisix dashboard

1）安裝

1. 下載rpm包

cd /data/softwares && \
wget -c https://github.com/apache/apisix-dashboard/releases/download/v2.7/apisix-dashboard-2.7-0.x86_64.rpm 

2. 安裝 dashboard

使用yum安裝惕鼓，默認(rèn)安裝路徑在/usr/local/apisix/dashboard

yum localinstall -y apisix-dashboard-2.7-0.x86_64.rpm 

2）配置

1. 修改 allow_list 和 etcd 配置

• allow_list 添加 0.0.0.0/0 （白名單筋现，按需添加）
• etcd 修改 192.168.3.224:2379

#
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

# yamllint disable rule:comments-indentation
conf:
  listen:
    # host: 127.0.0.1     # the address on which the `Manager API` should listen.
                          # The default value is 0.0.0.0, if want to specify, please enable it.
                          # This value accepts IPv4, IPv6, and hostname.
    port: 9000            # The port on which the `Manager API` should listen.

  # ssl:
  #   host: 127.0.0.1     # the address on which the `Manager API` should listen for HTTPS.
                          # The default value is 0.0.0.0, if want to specify, please enable it.
  #   port: 9001            # The port on which the `Manager API` should listen for HTTPS.
  #   cert: "/tmp/cert/example.crt" # Path of your SSL cert.
  #   key:  "/tmp/cert/example.key"  # Path of your SSL key.

  allow_list:             # If we don't set any IP list, then any IP access is allowed by default.
    - 127.0.0.1           # The rules are checked in sequence until the first match is found.
    - 0.0.0.0/0
    - ::1                 # In this example, access is allowed only for IPv4 network 127.0.0.1, and for IPv6 network ::1.
                          # It also support CIDR like 192.168.1.0/24 and 2001:0db8::/32
  etcd:
    endpoints:            # supports defining multiple etcd host addresses for an etcd cluster
      - 192.168.3.224:2379
                          # yamllint disable rule:comments-indentation
                          # etcd basic auth info
    # username: "root"    # ignore etcd username if not enable etcd auth
    # password: "123456"  # ignore etcd password if not enable etcd auth
    mtls:
      key_file: ""          # Path of your self-signed client side key
      cert_file: ""         # Path of your self-signed client side cert
      ca_file: ""           # Path of your self-signed ca cert, the CA is used to sign callers' certificates
    # prefix: /apisix       # apisix config's prefix in etcd, /apisix by default
  log:
    error_log:
      level: warn       # supports levels, lower to higher: debug, info, warn, error, panic, fatal
      file_path:
        logs/error.log  # supports relative path, absolute path, standard output
                        # such as: logs/error.log, /tmp/logs/error.log, /dev/stdout, /dev/stderr
    access_log:
      file_path:
        logs/access.log  # supports relative path, absolute path, standard output
                         # such as: logs/access.log, /tmp/logs/access.log, /dev/stdout, /dev/stderr
                         # log example: 2020-12-09T16:38:09.039+0800    INFO    filter/logging.go:46    /apisix/admin/routes/r1 {"status": 401, "host": "127.0.0.1:9000", "query": "asdfsafd=adf&a=a", "requestId": "3d50ecb8-758c-46d1-af5b-cd9d1c820156", "latency": 0, "remoteIP": "127.0.0.1", "method": "PUT", "errs": []}
  max_cpu: 0             # supports tweaking with the number of OS threads are going to be used for parallelism. Default value: 0 [will use max number of available cpu cores considering hyperthreading (if any)]. If the value is negative, is will not touch the existing parallelism profile.

authentication:
  secret:
    secret              # secret for jwt token generation.
                        # NOTE: Highly recommended to modify this value to protect `manager api`.
                        # if it's default value, when `manager api` start, it will generate a random string to replace it.
  expire_time: 3600     # jwt token expire time, in second
  users:                # yamllint enable rule:comments-indentation
    - username: admin   # username and password for login `manager api`
      password: admin
    - username: user
      password: user

plugins:                          # plugin list (sorted in alphabetical order)
  - api-breaker
  - authz-keycloak
  - basic-auth
  - batch-requests
  - consumer-restriction
  - cors
  # - dubbo-proxy
  - echo
  # - error-log-logger
  # - example-plugin
  - fault-injection
  - grpc-transcode
  - hmac-auth
  - http-logger
  - ip-restriction
  - jwt-auth
  - kafka-logger
  - key-auth
  - limit-conn
  - limit-count
  - limit-req
  # - log-rotate
  # - node-status
  - openid-connect
  - prometheus
  - proxy-cache
  - proxy-mirror
  - proxy-rewrite
  - redirect
  - referer-restriction
  - request-id
  - request-validation
  - response-rewrite
  - serverless-post-function
  - serverless-pre-function
  # - skywalking
  - sls-logger
  - syslog
  - tcp-logger
  - udp-logger
  - uri-blocker
  - wolf-rbac
  - zipkin
  - server-info
  - traffic-split

3）啟動

1. 注冊systemd

文件路徑: /usr/lib/systemd/system/apisix.service, 新增文件，編譯以下內(nèi)容

[Unit]
Description=apisix dashboard
After=network-online.target
After=apisix.service
Wants=apisix.service

[Service]
Type=forking
WorkingDirectory=/usr/local/apisix/dashboard

ExecStart=/bin/bash -c "/usr/bin/manager-api start -p /usr/local/apisix/dashboard/"
ExecStop=/usr/bin/manager-api stop
Restart=always

2. 啟動服務(wù)

systemctl daemon-reload && \
systemctl enable apisix-dashboard.service && \
systemctl start apisix-dashboard.service 

4）驗(yàn)證

訪問: http://192.168.3.224:9000箱歧，默認(rèn)用戶名密碼都是admin 矾飞，可在配置文件 /data/applications/apisix/dashboard/conf/conf.yaml 中定義，authentication ==> users

image-20210616180044576.png