代码之家 › 专栏 › 技术社区 › Héctor

在“provisioner”块上的AWS EC2实例上运行Hashicorp Vault服务器

hashicorp-vault terraform amazon-ec2 amazon-web-services

3

Héctor · 技术社区 · 6 年前

我正在创建一个AWS实例,并试图在创建时运行一个Vault服务器。我的问题是创建过程永远不会结束,因为服务器没有在后台运行。这是我的配置:

resource "aws_instance" "web" {
  ami           = "ami-466768ac"
  instance_type = "t2.micro"
  key_name = "my_key"

  tags {
    Name = "Vault"
  }

  provisioner "remote-exec" {

    connection {
      type        = "ssh"
      agent       = false
      user        = "ec2-user"
      private_key = "${file("/path/to/my_key")}"
    }

    inline = [
      "curl -O https://releases.hashicorp.com/vault/0.10.4/vault_0.10.4_linux_amd64.zip",
      "unzip vault_0.10.4_linux_amd64.zip",
      "./vault server -dev -dev-listen-address=0.0.0.0:8200"
    ]
  }

}

基本上,我是通过 curl 运行开发服务器。服务器实际上正在运行(我在终端日志中看到),但实例创建(由Terraform)从未完成:

aws_instance.web: Still creating... (40s elapsed)
aws_instance.web: Still creating... (50s elapsed)
aws_instance.web: Still creating... (1m0s elapsed)
aws_instance.web: Still creating... (1m10s elapsed)
aws_instance.web: Still creating... (1m20s elapsed)
aws_instance.web: Still creating... (1m30s elapsed)
...

我试着加上 & 在starting Vault server命令的末尾,为了不阻止shell,但在我执行此操作时,将创建实例,但实际上并没有启动Vault server。

如何在创建实例时以后台模式启动服务器?

编辑

我也试过 nohup :

nohup ./vault server -dev -dev-listen-address=0.0.0.0:8200

但当terraform完成时服务器不会启动。。。

2 回复 | 直到 6 年前

1

2

Héctor 6 年前

最后,正如@StephenKing在评论中告诉我的,我创建了一个systemd服务。这是我的配置:

resource "aws_instance" "web" {
  ami           = "ami-466768ac"
  instance_type = "t2.micro"
  key_name = "my_key"

  tags {
    Name = "Vault"
  }

  //upload vault.service file (systemd unit)
  provisioner "file" {
    connection {
      type        = "ssh"
      agent       = false
      user        = "ec2-user"
      private_key = "${file("/path/to/my/key")}"
    }
    source = "./vault.service"
    destination = "/home/ec2-user/vault.service"
  }

  //download vault and start service
  provisioner "remote-exec" {
    connection {
      type        = "ssh"
      agent       = false
      user        = "ec2-user"
      private_key = "${file("/path/to/my/key")}"
    }
    inline = [
      "curl -O https://releases.hashicorp.com/vault/0.10.4/vault_0.10.4_linux_amd64.zip",
      "unzip vault_0.10.4_linux_amd64.zip",
      "sudo mv /home/ec2-user/vault.service /etc/systemd/system/",
      "sudo systemctl start vault.service"
    ]
  }

}

保险库服务

[Unit]
Description=Vault dev server

[Service]
ExecStart=/home/ec2-user/vault server -dev -dev-listen-address=0.0.0.0:8200

2

1

ydaetskcoR 6 年前

这并不是一个特定于Terraform的东西,如果你用SSH连接到一个实例并运行你的命令,当进程在前台时你会看到它被阻塞,如果你通过添加 & 在命令结束时,您将退出退出SSH会话。

这里的解决方案是 nohup 这样,Vault服务器进程将忽略 HUP (或挂起)在会话存在时触发的信号。

所以你应该把命令改成:

...
    inline = [
      "curl -O https://releases.hashicorp.com/vault/0.10.4/vault_0.10.4_linux_amd64.zip",
      "unzip vault_0.10.4_linux_amd64.zip",
      "nohup ./vault server -dev -dev-listen-address=0.0.0.0:8200 &"
    ]
...