文檔版本V1.0 編寫日期2026?09?05 部署環(huán)境Docker Swarm RocketMQ版本5.3.0 Dashboard版本1.0.1 集群架構(gòu)1×NameServer 3×Broker節(jié)點(diǎn) Dashboard控制臺(tái)開(kāi)啟ACL權(quán)限控制說(shuō)明本文所有 IP、AccessKey/SecretKey 均為演示示例切勿直接用于生產(chǎn)環(huán)境部署時(shí)請(qǐng)?zhí)鎿Q為自己服務(wù)器真實(shí) IP并重新設(shè)置高強(qiáng)度賬號(hào)密碼。環(huán)境Docker Swarm 集群RocketMQ 版本5.3.0Dashboard 版本1.0.1 架構(gòu)1×NameServer 3×Broker 節(jié)點(diǎn) Dashboard開(kāi)啟 ACL 權(quán)限管控。??重要坑點(diǎn)提醒Docker Swarm 的 config 是只讀掛載mqadmin updateAclConfig熱更新 ACL 不會(huì)生效修改 ACL 必須重建 config重新 deploy stack。一、環(huán)境概述本次部署采用Docker Swarm Stack方式部署RocketMQ5.3.0集群。部署節(jié)點(diǎn)主機(jī)名mq?docker?node主機(jī)IP192.168.10.38私有鏡像倉(cāng)庫(kù)地址192.168.10.74:7080/library/集群組件清單NameServer1個(gè)實(shí)例RocketMQ注冊(cè)中心Broker?a / broker?b / broker?c3個(gè)Broker服務(wù)節(jié)點(diǎn)RocketMQ?Dashboard可視化管理控制臺(tái)安全特性開(kāi)啟ACL訪問(wèn)權(quán)限控制區(qū)分管理員賬號(hào)、業(yè)務(wù)賬號(hào)。??重要提醒Docker Swarm的config配置為只讀掛載不支持mqadmin工具熱更新ACL配置。修改ACL配置必須重建config重新部署stack才能生效。 ?提示本文所有IP、賬號(hào)密碼均為示例實(shí)際部署請(qǐng)自行修改為自己環(huán)境的信息。二、端口規(guī)劃所有端口均為TCP協(xié)議防火墻需要放行宿主機(jī)對(duì)應(yīng)端口。組件名稱容器內(nèi)部端口宿主機(jī)映射端口說(shuō)明NameServer98769111MQ注冊(cè)中心客戶端連接地址Broker?a91109110消息broker節(jié)點(diǎn)aBroker?b91089108消息broker節(jié)點(diǎn)bBroker?c91099109消息broker節(jié)點(diǎn)cDashboard控制臺(tái)80809114web管理頁(yè)面訪問(wèn)端口三、部署前置條件Docker Swarm集群已經(jīng)完成初始化mq?docker?node節(jié)點(diǎn)已經(jīng)加入swarm集群。部署節(jié)點(diǎn)可以正常訪問(wèn)私有鏡像倉(cāng)庫(kù)192.168.10.74:7080能夠拉取鏡像。服務(wù)器防火墻/安全組開(kāi)放端口9111、9110、9108、9109、9114。服務(wù)器時(shí)間同步容器掛載/etc/localtime保證容器與宿主機(jī)時(shí)間一致。四、前期準(zhǔn)備工作4.1 創(chuàng)建Docker外部存儲(chǔ)卷本方案全部使用external外部存儲(chǔ)卷數(shù)據(jù)獨(dú)立于容器刪除服務(wù)不會(huì)丟失業(yè)務(wù)數(shù)據(jù)。執(zhí)行下面命令創(chuàng)建存儲(chǔ)卷docker volume create rmqnamesrv_logs docker volume create rmqbroker_a_store docker volume create rmqbroker_a_logs docker volume create rmqbroker_b_store docker volume create rmqbroker_b_logs docker volume create rmqbroker_c_store docker volume create rmqbroker_c_logs docker volume create dashboard_data4.2 準(zhǔn)備配置文件在宿主機(jī)新建工作目錄將下面5個(gè)文件保存到此目錄文件名嚴(yán)格保持一致。4.2.1 plain_acl.yml ACL權(quán)限配置文件文件名plain_acl.ymlglobalWhiteRemoteAddresses: - 127.0.0.1 - 192.168.10.* accounts: #管理帳號(hào) - accessKey: mq_admin secretKey: Admin123456 admin: true whiteRemoteAddress: # 業(yè)務(wù)帳號(hào) mq_biz - accessKey: mq_biz secretKey: Biz654321 whiteRemoteAddress: admin: false defaultTopicPerm: SUB defaultGroupPerm: SUB topicPerms: - BIZ_TOPICPUB|SUB groupPerms: - BIZ_TOPICPUB|SUB賬號(hào)說(shuō)明mq_admin管理員賬號(hào)用于Dashboard登錄、mqadmin運(yùn)維命令。mq_biz業(yè)務(wù)賬號(hào)僅對(duì)BIZ_TOPIC主題具備發(fā)布、訂閱權(quán)限。??生產(chǎn)環(huán)境務(wù)必修改AccessKey、SecretKey不要直接使用示例密碼。4.2.2 mq53broker?a.conf broker?a配置文件名mq53broker?a.conf# 集群與節(jié)點(diǎn)名稱 brokerClusterName DefaultCluster brokerName broker-a # 改成你的服務(wù)器實(shí)際IP brokerIP1 192.168.10.38 brokerVipEnablefalse namesrvAddr rmqnamesrv:9876 listenPort 9110 aclEnabletrue #此處配置項(xiàng)只需要一個(gè)就行配置兩個(gè)是為了兼容不同的版本 aclFile/home/rocketmq/rocketmq-5.3.0/conf/plain_acl.yml aclPlainConfigFile/home/rocketmq/rocketmq-5.3.0/conf/plain_acl.yml4.2.3 mq53broker?b.conf broker?b配置文件名mq53broker?b.conf# 集群與節(jié)點(diǎn)名稱 brokerClusterName DefaultCluster brokerName broker-b # 改成你的服務(wù)器實(shí)際IP brokerIP1 192.168.10.38 brokerVipEnablefalse namesrvAddr rmqnamesrv:9876 listenPort 9108 aclEnabletrue #此處配置項(xiàng)只需要一個(gè)就行配置兩個(gè)是為了兼容不同的版本 aclFile/home/rocketmq/rocketmq-5.3.0/conf/plain_acl.yml aclPlainConfigFile/home/rocketmq/rocketmq-5.3.0/conf/plain_acl.yml4.2.4 mq53broker?c.conf broker?c配置文件名mq53broker?c.conf# 集群與節(jié)點(diǎn)名稱 brokerClusterName DefaultCluster brokerName broker-c # 改成你的服務(wù)器實(shí)際IP brokerIP1 192.168.10.38 brokerVipEnablefalse namesrvAddr rmqnamesrv:9876 listenPort 9109 aclEnabletrue #此處配置項(xiàng)只需要一個(gè)就行配置兩個(gè)是為了兼容不同的版本 aclFile/home/rocketmq/rocketmq-5.3.0/conf/plain_acl.yml aclPlainConfigFile/home/rocketmq/rocketmq-5.3.0/conf/plain_acl.yml4.2.5 mq53topics.txt Topic腳本文件文件名mq53topics.txt可以為空文件用于shell腳本批量創(chuàng)建topic如果不需要腳本創(chuàng)建topic直接新建空白文件即可。4.3 創(chuàng)建Docker Swarm Config配置對(duì)象進(jìn)入配置文件存放目錄執(zhí)行命令將本地文件上傳為swarm外部config對(duì)象docker config create plain_acl.yml plain_acl.yml docker config create mq53broker-a.conf mq53broker?a.conf docker config create mq53broker-b.conf mq53broker?b.conf docker config create mq53broker-c.conf mq53broker?c.conf docker config create mq53topics.txt mq53topics.txt修改配置文件通用流程修改宿主機(jī)本地配置文件刪除舊config對(duì)象docker config rm 配置名使用docker config create重新創(chuàng)建重新執(zhí)行docker stack deploy更新服務(wù)。五、Docker?Compose Stack編排文件文件名docker?compose?rmq53.ymlversion: 3.4 services: rmqnamesrv: image: 192.168.10.74:7080/library/rocketmq:5.3.0 command: sh mqnamesrv environment: - JAVA_OPT_EXT-Xms256M -Xmx256M -Xmn128M deploy: replicas: 1 # 改為 any進(jìn)程無(wú)論何種退出碼都拉起長(zhǎng)期自愈 restart_policy: condition: any delay: 16s placement: constraints: - node.hostname mq?docker?node ports: - published: 9111 target: 9876 protocol: tcp mode: host volumes: - rmqnamesrv_logs:/home/rocketmq/rocketmq-5.3.0/logs - /etc/localtime:/etc/localtime:ro networks: - rocketmq rmqbroker-a: image: 192.168.10.74:7080/library/rocketmq:5.3.0 deploy: replicas: 1 restart_policy: condition: any delay: 16s placement: constraints: - node.hostname mq?docker?node ports: - published: 9110 target: 9110 protocol: tcp mode: host configs: - source: mq53broker-a.conf target: /home/rocketmq/rocketmq-5.3.0/conf/mq53broker-a.conf # 注意swarm config 只讀掛載mqadmin updateAclConfig 熱更新會(huì)失敗 # 改 ACL 只能 docker config create 新版本后重新 deploy - source: plain_acl.yml target: /home/rocketmq/rocketmq-5.3.0/conf/plain_acl.yml - source: mq53topics.txt target: /home/rocketmq/rocketmq-5.3.0/bin/mq53topics.txt command: sh mqbroker -c /home/rocketmq/rocketmq-5.3.0/conf/mq53broker-a.conf environment: - NAMESRV_ADDRrmqnamesrv:9876 - JAVA_OPT_EXT-Xms512M -Xmx512M -Xmn192M # swarm stack deploy 會(huì)忽略 depends_onbroker 自行重連 namesrv保留僅為可讀性 depends_on: - rmqnamesrv volumes: - rmqbroker_a_store:/home/rocketmq/rocketmq-5.3.0/store - rmqbroker_a_logs:/home/rocketmq/rocketmq-5.3.0/logs - /etc/localtime:/etc/localtime:ro networks: - rocketmq rmqbroker-b: image: 192.168.10.74:7080/library/rocketmq:5.3.0 deploy: replicas: 1 restart_policy: condition: any delay: 16s placement: constraints: - node.hostname mq?docker?node ports: - published: 9108 target: 9108 protocol: tcp mode: host configs: - source: mq53broker-b.conf target: /home/rocketmq/rocketmq-5.3.0/conf/mq53broker-b.conf - source: plain_acl.yml target: /home/rocketmq/rocketmq-5.3.0/conf/plain_acl.yml command: sh mqbroker -c /home/rocketmq/rocketmq-5.3.0/conf/mq53broker-b.conf environment: - NAMESRV_ADDRrmqnamesrv:9876 - JAVA_OPT_EXT-Xms512M -Xmx512M -Xmn192M depends_on: - rmqnamesrv volumes: - rmqbroker_b_store:/home/rocketmq/rocketmq-5.3.0/store - rmqbroker_b_logs:/home/rocketmq/rocketmq-5.3.0/logs - /etc/localtime:/etc/localtime:ro networks: - rocketmq rmqbroker-c: image: 192.168.10.74:7080/library/rocketmq:5.3.0 deploy: replicas: 1 restart_policy: condition: any delay: 16s placement: constraints: - node.hostname mq?docker?node ports: - published: 9109 target: 9109 protocol: tcp mode: host configs: - source: mq53broker-c.conf target: /home/rocketmq/rocketmq-5.3.0/conf/mq53broker-c.conf - source: plain_acl.yml target: /home/rocketmq/rocketmq-5.3.0/conf/plain_acl.yml command: sh mqbroker -c /home/rocketmq/rocketmq-5.3.0/conf/mq53broker-c.conf environment: - NAMESRV_ADDRrmqnamesrv:9876 - JAVA_OPT_EXT-Xms512M -Xmx512M -Xmn192M depends_on: - rmqnamesrv volumes: - rmqbroker_c_store:/home/rocketmq/rocketmq-5.3.0/store - rmqbroker_c_logs:/home/rocketmq/rocketmq-5.3.0/logs - /etc/localtime:/etc/localtime:ro networks: - rocketmq dashboard: image: 192.168.10.74:7080/library/rocketmq-dashboard:1.0.1 deploy: replicas: 1 restart_policy: condition: any delay: 16s placement: constraints: - node.hostname mq?docker?node networks: - rocketmq depends_on: - rmqnamesrv ports: - published: 9114 target: 8080 protocol: tcp mode: host environment: - JAVA_OPTS-Drocketmq.namesrv.addrrmqnamesrv:9876 - JAVA_OPT_EXT-Xms256M -Xmx256M -Xmn128M - rocketmq.config.accessKeymq_admin - rocketmq.config.secretKeyAdmin123456 - rocketmq.config.isVIPChannelfalse - rocketmq.config.loginRequiredtrue # 登錄用戶loginRequiredtrue默認(rèn)存在容器內(nèi)文件重建容器即丟失 # 若在頁(yè)面上維護(hù)過(guò)用戶/角色建議按實(shí)際 dataPath 掛卷持久化 volumes: - dashboard_data:/tmp/rocketmq-console/data - /etc/localtime:/etc/localtime:ro networks: rocketmq: volumes: rmqnamesrv_logs: external: true rmqbroker_a_store: external: true rmqbroker_a_logs: external: true rmqbroker_b_store: external: true rmqbroker_b_logs: external: true rmqbroker_c_store: external: true rmqbroker_c_logs: external: true dashboard_data: external: true configs: plain_acl.yml: external: true mq53broker-a.conf: external: true mq53broker-b.conf: external: true mq53broker-c.conf: external: true mq53topics.txt: external: true六、集群部署啟動(dòng)6.1 執(zhí)行部署命令將上面docker?compose?rmq53.yml放到工作目錄執(zhí)行部署棧命名為rmq53docker stack deploy -c docker?compose?rmq53.yml rmq536.2 查看集群服務(wù)狀態(tài)docker stack services rmq53輸出列表中所有服務(wù)的REPLICAS列顯示1/1代表實(shí)例啟動(dòng)成功。如果狀態(tài)不為1/1使用docker service logs 服務(wù)名查看服務(wù)日志排查啟動(dòng)異常。七、Dashboard控制臺(tái)訪問(wèn)訪問(wèn)地址http://192.168.10.38:9114項(xiàng)目參數(shù)值A(chǔ)ccessKeymq_adminSecretKeyAdmin123456說(shuō)明dashboard開(kāi)啟登錄鑒權(quán)使用ACL管理員賬號(hào)登錄頁(yè)面上創(chuàng)建的用戶角色數(shù)據(jù)保存在dashboard_data外部卷實(shí)現(xiàn)持久化。 ??實(shí)際部署替換為自己服務(wù)器IP同時(shí)修改賬號(hào)密碼。八、業(yè)務(wù)客戶端接入配置客戶端連接NameServer地址192.168.10.38:9111業(yè)務(wù)賬號(hào)mq_biz參數(shù)accessKeymq_biz secretKeyBiz654321權(quán)限說(shuō)明業(yè)務(wù)賬號(hào)僅允許對(duì)BIZ_TOPIC主題進(jìn)行消息發(fā)布PUB、消息訂閱SUB。九、日常運(yùn)維操作手冊(cè)9.1 修改ACL權(quán)限配置流程?重要swarm config只讀掛載mqadmin updateAclConfig熱更新命令不會(huì)生效。 完整修改步驟修改宿主機(jī)本地plain_acl.yml配置刪除舊config對(duì)象docker config rm plain_acl.yml重新創(chuàng)建configdocker config create plain_acl.yml plain_acl.yml更新stack使配置生效docker stack deploy -c docker?compose?rmq53.yml rmq539.2 JVM內(nèi)存參數(shù)調(diào)整說(shuō)明組件默認(rèn)JVM參數(shù)NameServer-Xms256M -Xmx256M -Xmn128MBroker-Xms512M -Xmx512M -Xmn192MDashboard-Xms256M -Xmx256M -Xmn128M修改方式修改docker?compose?rmq53.yml文件中JAVA_OPT_EXT環(huán)境變量重新執(zhí)行docker stack deploy即可更新JVM參數(shù)。9.3 集群停止、重啟操作停止集群數(shù)據(jù)卷、config配置全部保留業(yè)務(wù)數(shù)據(jù)不會(huì)丟失docker stack rm rmq53停止后重新啟動(dòng)集群直接再次執(zhí)行部署命令即可docker stack deploy -c docker?compose?rmq53.yml rmq539.4 資源清理命令謹(jǐn)慎執(zhí)行執(zhí)行后數(shù)據(jù)丟失清理config配置對(duì)象docker config rm plain_acl.yml mq53broker-a.conf mq53broker-b.conf mq53broker-c.conf mq53topics.txt??清理存儲(chǔ)卷消息、日志全部刪除生產(chǎn)環(huán)境嚴(yán)禁隨意執(zhí)行docker volume rm rmqnamesrv_logs rmqbroker_a_store rmqbroker_a_logs rmqbroker_b_store rmqbroker_b_logs rmqbroker_c_store rmqbroker_c_logs dashboard_data十、常見(jiàn)問(wèn)題與注意事項(xiàng)depends_on不生效問(wèn)題Docker Swarm stack會(huì)忽略yaml中的depends_on依賴配置。Broker服務(wù)內(nèi)部會(huì)自動(dòng)循環(huán)重試連接NameServer不需要等待nameServer完全啟動(dòng)。ACL權(quán)限不生效確認(rèn)broker.conf配置中aclEnabletrue確認(rèn)plain_acl.yml已經(jīng)通過(guò)docker config重新創(chuàng)建并且stack已經(jīng)重新deploy確認(rèn)客戶端傳入accessKey、secretKey正確?？蛻舳诉B接失敗檢查防火墻端口放行確認(rèn)brokerIP1配置為宿主機(jī)真實(shí)IP不要使用127.0.0.1確認(rèn)NameServer連接地址填寫宿主機(jī)9111端口。數(shù)據(jù)持久化說(shuō)明所有消息存儲(chǔ)、日志、dashboard用戶數(shù)據(jù)全部使用external外部volume執(zhí)行docker stack rm rmq53不會(huì)刪除volume只有手動(dòng)執(zhí)行docker volume rm才會(huì)刪除數(shù)據(jù)。安全風(fēng)險(xiǎn)提示本文檔中AccessKey、SecretKey、IP均為演示示例生產(chǎn)環(huán)境部署務(wù)必修改賬號(hào)密碼、修改為實(shí)際服務(wù)器IP不要直接復(fù)制示例配置直接上線?？偨Y(jié)本方案使用 Docker Swarm 外部 config 存放配置文件外部 volume 持久化消息與日志刪除 stack 不會(huì)丟失業(yè)務(wù)數(shù)據(jù)swarm config 只讀特性ACL 無(wú)法熱更新修改權(quán)限配置需要重建 config生產(chǎn)環(huán)境務(wù)必修改示例 IP、accessKey、secretKey做好防火墻端口管控可根據(jù)服務(wù)器內(nèi)存調(diào)整 JVM 的JAVA_OPT_EXT參數(shù)優(yōu)化性能。具體實(shí)施操作步驟另外附帶批量topic創(chuàng)建腳本【中間件部署】基于DockerSwarm的RocketMQ5.3.0集群部署含ACL權(quán)限控制與Dashboard監(jiān)控的微服務(wù)消息隊(duì)列實(shí)施方案資源-CSDN下載https://download.csdn.net/download/zhaojun917/93394051