使用客户端证书和Docker

时间：2016-05-09 18:37:20

标签： spring docker spring-cloud netflix-eureka netflix-ribbon

我要求我的微服务使用双向ssl。每个微服务都是一个Spring Boot应用程序，注释为：

@SpringBootApplication
@EnableFeignClients
@EnableDiscoveryClient
@EnableZuulProxy
public class Application {
    public static void main(String[] args) {
        SpringApplication.run(Application.class, args);
    }
}

每个yml都有类似于eureka / ribbon的配置：

eureka:
    client:
        service-url:
          defaultZone: ${EUREKA_CLIENT_SERVICEURL_PROTOCOL:http}://${EUREKA_CLIENT_SERVICEURL_HOST:192.168.99.100}:${EUREKA_CLIENT_SERVICEURL_PORT:8761}/eureka/
    instance:
        secure-virtual-host-name: ${spring.application.name}
        prefer-ip-address: true
        non-secure-port-enabled: ${EUREKA_NON_SECURE_PORT_ENABLED:false}
        secure-port-enabled: ${EUREKA_SECURE_PORT_ENABLED:true}
        secure-port: ${server.port}
ribbon:
    IsSecure: true
    eureka:
        enabled: true

每个微服务都有一个控制器，可以为各种功能公开rest api。

当一个微服务需要调用另一个微服务端点时，我试图通过为该微服务创建一个客户端接口来实现：

@FeignClient(name = "user", configuration = FeignConfiguration.class, url = "https://user")
public interface UserClient {
    @RequestMapping(method = RequestMethod.GET, value = "/test")
    String testUser();
}

这是FeignConfiguration：

@Configuration
public class FeignConfiguration {

    @Bean
    public Feign.Builder feignBuilder(){
        Client trustSSLSockets = new    Client.Default(TrustingSSLSocketFactory.get(), null);
        return Feign.builder().client(trustSSLSockets);
    }

    @Bean
    Logger.Level feignLoggerLevel() {
        return Logger.Level.FULL;
    }

    @Bean
    public Contract feignContract() {
        return new feign.Contract.Default();
    }

}

TrustingSSLSocketFactory类是从https://github.com/Netflix/feign/blob/master/core/src/test/java/feign/client/TrustingSSLSocketFactory.java复制并使用我的客户端证书/密码修改的。

用户微服务以及其他配置的安全性配置为：

server:
    port: ${DOCKER_SERVER_PORT:28443}
      ssl:
          key-store: ${KEYSTORE_FILE:classpath:keystore.p12}
          key-store-password: ${KEYSTORE_PASSWORD:abc123}
          key-store-type: ${KEYSTORE_TYPE:PKCS12}
          trust-store: ${TRUSTSTORE_FILE:classpath:trust.jks}
          trust-store-password: ${TRUSTSTORE_PASSWORD:abc123}
          trust-store-type: ${TRUSTSTORE_TYPE:JKS}
          client-auth: ${CLIENT_AUTH_REQUIRED:want}

要调用客户端，我只需注入客户端，并将其称为任何其他接口。

@RestController
public class MyController {

@Autowired
UserClient userClient;

@RequestMapping(value = "/testUser",
        method = RequestMethod.GET,
        produces = MediaType.APPLICATION_JSON_VALUE)
    public String testUser() {
        return userClient.testUser();
    }
}

用户微服务具有一个返回简单回复的测试端点。

当UserClient尝试与用户主机建立连接时，我收到UnknownHostException。我可能没有正确地实现这一点，并希望得到一些指导。

gateway-ms_1   | 2016-05-09 16:22:19.294 DEBUG 1 --- [qtp351251459-24]     c.n.zuul.http.HttpServletRequestWrapper  : Path = null
gateway-ms_1   | 2016-05-09 16:22:19.294 DEBUG 1 --- [qtp351251459-24] c.n.zuul.http.HttpServletRequestWrapper  : Transfer-Encoding = null
gateway-ms_1   | 2016-05-09 16:22:19.294 DEBUG 1 --- [qtp351251459-24] c.n.zuul.http.HttpServletRequestWrapper  : Content-Encoding = null
gateway-ms_1   | 2016-05-09 16:22:19.295 DEBUG 1 --- [qtp351251459-24] c.n.zuul.http.HttpServletRequestWrapper  : Content-Length header = -1
gateway-ms_1   | 2016-05-09 16:22:19.297 DEBUG 1 --- [qtp351251459-24] c.n.loadbalancer.ZoneAwareLoadBalancer   : Zone aware logic disabled or there is only one zone
gateway-ms_1   | 2016-05-09 16:22:19.298 DEBUG 1 --- [qtp351251459-24] c.n.loadbalancer.LoadBalancerContext     : register using LB returned Server: 172.17.0.4:28443 for request /testUser
gateway-ms_1   | 2016-05-09 16:22:19.298 DEBUG 1 --- [qtp351251459-24] com.netflix.niws.client.http.RestClient  : RestClient sending new Request(GET: ) https://172.17.0.4:28443/testUser
gateway-ms_1   | 2016-05-09 16:22:19.300 DEBUG 1 --- [qtp351251459-24] c.n.http4.MonitoredConnectionManager     : Get connection: {s}->https://172.17.0.4:28443, timeout = 3000
gateway-ms_1   | 2016-05-09 16:22:19.300 DEBUG 1 --- [qtp351251459-24] com.netflix.http4.NamedConnectionPool    : [{s}->https://172.17.0.4:28443] total kept alive: 1, total issued: 0, total allocated: 1 out of 200
gateway-ms_1   | 2016-05-09 16:22:19.300 DEBUG 1 --- [qtp351251459-24] com.netflix.http4.NamedConnectionPool    : Getting free connection [{s}->https://172.17.0.4:28443][null]
gateway-ms_1   | 2016-05-09 16:22:19.300 DEBUG 1 --- [qtp351251459-24] com.netflix.http4.NFHttpClient           : Stale connection check
gateway-ms_1   | 2016-05-09 16:22:19.305 DEBUG 1 --- [qtp351251459-24] com.netflix.http4.NFHttpClient           : Attempt 1 to execute request
register-ms_1    | 2016-05-09 16:22:19.312 DEBUG 1 --- [qtp376795121-24] com.jdh.register.clients.UserClient       : [UserClient#testUser] ---> GET https://user/test HTTP/1.1
register-ms_1    | 2016-05-09 16:22:19.313 DEBUG 1 --- [qtp376795121-24] com.jdh.register.clients.UserClient       : [UserClient#testUser] ---> END HTTP (0-byte body)
register-ms_1    | 2016-05-09 16:22:19.422 DEBUG 1 --- [qtp376795121-24] com.jdh.register.clients.UserClient       : [UserClient#testUser] <--- ERROR UnknownHostException: user (109ms)
register-ms_1    | 2016-05-09 16:22:19.426 DEBUG 1 --- [qtp376795121-24] com.jdh.register.clients.UserClient       : [UserClient#testUser] java.net.UnknownHostException: user
register-ms_1    |  at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:184)
register-ms_1    |  at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392)
register-ms_1    |  at java.net.Socket.connect(Socket.java:589)
register-ms_1    |  at sun.net.NetworkClient.doConnect(NetworkClient.java:175)
register-ms_1    |  at sun.net.www.http.HttpClient.openServer(HttpClient.java:432)
register-ms_1    |  at sun.net.www.http.HttpClient.openServer(HttpClient.java:527)
register-ms_1    |  at sun.net.www.protocol.https.HttpsClient.<init>(HttpsClient.java:275)
register-ms_1    |  at sun.net.www.protocol.https.HttpsClient.New(HttpsClient.java:371)
register-ms_1    |  at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.getNewHttpClient(AbstractDelegateHttpsURLConnection.java:191)
register-ms_1    |  at sun.net.www.protocol.http.HttpURLConnection.plainConnect0(HttpURLConnection.java:1104)
register-ms_1    |  at sun.net.www.protocol.http.HttpURLConnection.plainConnect(HttpURLConnection.java:998)
register-ms_1    |  at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:177)
register-ms_1    |  at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1512)
evice-ms_1    |     at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1440)

1 个答案:

答案 0 :(得分：3)

假装i=1 while True: a=(a+b)%d if(a==c): break i+=1 print(i) 是注入色带的地方。通过创建自己的客户端，您已选择不使用功能区，因此功能区无法解析Client。

这就是我们创建负载均衡器客户端的方式

http://user/...

此外，通过使用@Bean @ConditionalOnMissingBean public Client feignClient(CachingSpringLoadBalancerFactory cachingFactory, SpringClientFactory clientFactory) { return new LoadBalancerFeignClient(new Client.Default(null, null), cachingFactory, clientFactory); } ，您选择不使用Spring MVC注释，例如feign.Contract.Default()，并默认使用假注释。

相关问题
最新问题