文檔版本V1.0 編寫日期2026?09?05 部署環(huán)境Docker Swarm RocketMQ版本5.3.0 Dashboard版本1.0.1 集群架構(gòu)1×NameServer 3×Broker節(jié)點(diǎn) Dashboard控制臺開啟ACL權(quán)限控制說明本文所有 IP、AccessKey/SecretKey 均為演示示例切勿直接用于生產(chǎn)環(huán)境部署時(shí)請?zhí)鎿Q為自己服務(wù)器真實(shí) IP并重新設(shè)置高強(qiáng)度賬號密碼。環(huán)境Docker Swarm 集群RocketMQ 版本5.3.0Dashboard 版本1.0.1 架構(gòu)1×NameServer 3×Broker 節(jié)點(diǎn) Dashboard開啟 ACL 權(quán)限管控。??重要坑點(diǎn)提醒Docker Swarm 的 config 是只讀掛載mqadmin updateAclConfig熱更新 ACL 不會生效修改 ACL 必須重建 config重新 deploy stack。一、環(huán)境概述本次部署采用Docker Swarm Stack方式部署RocketMQ5.3.0集群。部署節(jié)點(diǎn)主機(jī)名mq?docker?node主機(jī)IP192.168.10.38私有鏡像倉庫地址192.168.10.74:7080/library/集群組件清單NameServer1個實(shí)例RocketMQ注冊中心Broker?a / broker?b / broker?c3個Broker服務(wù)節(jié)點(diǎn)RocketMQ?Dashboard可視化管理控制臺安全特性開啟ACL訪問權(quán)限控制區(qū)分管理員賬號、業(yè)務(wù)賬號。??重要提醒Docker Swarm的config配置為只讀掛載不支持mqadmin工具熱更新ACL配置。修改ACL配置必須重建config重新部署stack才能生效。 ?提示本文所有IP、賬號密碼均為示例實(shí)際部署請自行修改為自己環(huán)境的信息。二、端口規(guī)劃所有端口均為TCP協(xié)議防火墻需要放行宿主機(jī)對應(yīng)端口。組件名稱容器內(nèi)部端口宿主機(jī)映射端口說明NameServer98769111MQ注冊中心客戶端連接地址Broker?a91109110消息broker節(jié)點(diǎn)aBroker?b91089108消息broker節(jié)點(diǎn)bBroker?c91099109消息broker節(jié)點(diǎn)cDashboard控制臺80809114web管理頁面訪問端口三、部署前置條件Docker Swarm集群已經(jīng)完成初始化mq?docker?node節(jié)點(diǎn)已經(jīng)加入swarm集群。部署節(jié)點(diǎn)可以正常訪問私有鏡像倉庫192.168.10.74:7080能夠拉取鏡像。服務(wù)器防火墻/安全組開放端口9111、9110、9108、9109、9114。服務(wù)器時(shí)間同步容器掛載/etc/localtime保證容器與宿主機(jī)時(shí)間一致。四、前期準(zhǔn)備工作4.1 創(chuàng)建Docker外部存儲卷本方案全部使用external外部存儲卷數(shù)據(jù)獨(dú)立于容器刪除服務(wù)不會丟失業(yè)務(wù)數(shù)據(jù)。執(zhí)行下面命令創(chuàng)建存儲卷docker volume create rmqnamesrv_logs docker volume create rmqbroker_a_store docker volume create rmqbroker_a_logs docker volume create rmqbroker_b_store docker volume create rmqbroker_b_logs docker volume create rmqbroker_c_store docker volume create rmqbroker_c_logs docker volume create dashboard_data4.2 準(zhǔn)備配置文件在宿主機(jī)新建工作目錄將下面5個文件保存到此目錄文件名嚴(yán)格保持一致。4.2.1 plain_acl.yml ACL權(quán)限配置文件文件名plain_acl.ymlglobalWhiteRemoteAddresses: - 127.0.0.1 - 192.168.10.* accounts: #管理帳號 - accessKey: mq_admin secretKey: Admin123456 admin: true whiteRemoteAddress: # 業(yè)務(wù)帳號 mq_biz - accessKey: mq_biz secretKey: Biz654321 whiteRemoteAddress: admin: false defaultTopicPerm: SUB defaultGroupPerm: SUB topicPerms: - BIZ_TOPICPUB|SUB groupPerms: - BIZ_TOPICPUB|SUB賬號說明mq_admin管理員賬號用于Dashboard登錄、mqadmin運(yùn)維命令。mq_biz業(yè)務(wù)賬號僅對BIZ_TOPIC主題具備發(fā)布、訂閱權(quán)限。??生產(chǎn)環(huán)境務(wù)必修改AccessKey、SecretKey不要直接使用示例密碼。4.2.2 mq53broker?a.conf broker?a配置文件名mq53broker?a.conf# 集群與節(jié)點(diǎn)名稱 brokerClusterName DefaultCluster brokerName broker-a # 改成你的服務(wù)器實(shí)際IP brokerIP1 192.168.10.38 brokerVipEnablefalse namesrvAddr rmqnamesrv:9876 listenPort 9110 aclEnabletrue #此處配置項(xiàng)只需要一個就行配置兩個是為了兼容不同的版本 aclFile/home/rocketmq/rocketmq-5.3.0/conf/plain_acl.yml aclPlainConfigFile/home/rocketmq/rocketmq-5.3.0/conf/plain_acl.yml4.2.3 mq53broker?b.conf broker?b配置文件名mq53broker?b.conf# 集群與節(jié)點(diǎn)名稱 brokerClusterName DefaultCluster brokerName broker-b # 改成你的服務(wù)器實(shí)際IP brokerIP1 192.168.10.38 brokerVipEnablefalse namesrvAddr rmqnamesrv:9876 listenPort 9108 aclEnabletrue #此處配置項(xiàng)只需要一個就行配置兩個是為了兼容不同的版本 aclFile/home/rocketmq/rocketmq-5.3.0/conf/plain_acl.yml aclPlainConfigFile/home/rocketmq/rocketmq-5.3.0/conf/plain_acl.yml4.2.4 mq53broker?c.conf broker?c配置文件名mq53broker?c.conf# 集群與節(jié)點(diǎn)名稱 brokerClusterName DefaultCluster brokerName broker-c # 改成你的服務(wù)器實(shí)際IP brokerIP1 192.168.10.38 brokerVipEnablefalse namesrvAddr rmqnamesrv:9876 listenPort 9109 aclEnabletrue #此處配置項(xiàng)只需要一個就行配置兩個是為了兼容不同的版本 aclFile/home/rocketmq/rocketmq-5.3.0/conf/plain_acl.yml aclPlainConfigFile/home/rocketmq/rocketmq-5.3.0/conf/plain_acl.yml4.2.5 mq53topics.txt Topic腳本文件文件名mq53topics.txt可以為空文件用于shell腳本批量創(chuàng)建topic如果不需要腳本創(chuàng)建topic直接新建空白文件即可。4.3 創(chuàng)建Docker Swarm Config配置對象進(jìn)入配置文件存放目錄執(zhí)行命令將本地文件上傳為swarm外部config對象docker config create plain_acl.yml plain_acl.yml docker config create mq53broker-a.conf mq53broker?a.conf docker config create mq53broker-b.conf mq53broker?b.conf docker config create mq53broker-c.conf mq53broker?c.conf docker config create mq53topics.txt mq53topics.txt修改配置文件通用流程修改宿主機(jī)本地配置文件刪除舊config對象docker config rm 配置名使用docker config create重新創(chuàng)建重新執(zhí)行docker stack deploy更新服務(wù)。五、Docker?Compose Stack編排文件文件名docker?compose?rmq53.ymlversion: 3.4 services: rmqnamesrv: image: 192.168.10.74:7080/library/rocketmq:5.3.0 command: sh mqnamesrv environment: - JAVA_OPT_EXT-Xms256M -Xmx256M -Xmn128M deploy: replicas: 1 # 改為 any進(jìn)程無論何種退出碼都拉起長期自愈 restart_policy: condition: any delay: 16s placement: constraints: - node.hostname mq?docker?node ports: - published: 9111 target: 9876 protocol: tcp mode: host volumes: - rmqnamesrv_logs:/home/rocketmq/rocketmq-5.3.0/logs - /etc/localtime:/etc/localtime:ro networks: - rocketmq rmqbroker-a: image: 192.168.10.74:7080/library/rocketmq:5.3.0 deploy: replicas: 1 restart_policy: condition: any delay: 16s placement: constraints: - node.hostname mq?docker?node ports: - published: 9110 target: 9110 protocol: tcp mode: host configs: - source: mq53broker-a.conf target: /home/rocketmq/rocketmq-5.3.0/conf/mq53broker-a.conf # 注意swarm config 只讀掛載mqadmin updateAclConfig 熱更新會失敗 # 改 ACL 只能 docker config create 新版本后重新 deploy - source: plain_acl.yml target: /home/rocketmq/rocketmq-5.3.0/conf/plain_acl.yml - source: mq53topics.txt target: /home/rocketmq/rocketmq-5.3.0/bin/mq53topics.txt command: sh mqbroker -c /home/rocketmq/rocketmq-5.3.0/conf/mq53broker-a.conf environment: - NAMESRV_ADDRrmqnamesrv:9876 - JAVA_OPT_EXT-Xms512M -Xmx512M -Xmn192M # swarm stack deploy 會忽略 depends_onbroker 自行重連 namesrv保留僅為可讀性 depends_on: - rmqnamesrv volumes: - rmqbroker_a_store:/home/rocketmq/rocketmq-5.3.0/store - rmqbroker_a_logs:/home/rocketmq/rocketmq-5.3.0/logs - /etc/localtime:/etc/localtime:ro networks: - rocketmq rmqbroker-b: image: 192.168.10.74:7080/library/rocketmq:5.3.0 deploy: replicas: 1 restart_policy: condition: any delay: 16s placement: constraints: - node.hostname mq?docker?node ports: - published: 9108 target: 9108 protocol: tcp mode: host configs: - source: mq53broker-b.conf target: /home/rocketmq/rocketmq-5.3.0/conf/mq53broker-b.conf - source: plain_acl.yml target: /home/rocketmq/rocketmq-5.3.0/conf/plain_acl.yml command: sh mqbroker -c /home/rocketmq/rocketmq-5.3.0/conf/mq53broker-b.conf environment: - NAMESRV_ADDRrmqnamesrv:9876 - JAVA_OPT_EXT-Xms512M -Xmx512M -Xmn192M depends_on: - rmqnamesrv volumes: - rmqbroker_b_store:/home/rocketmq/rocketmq-5.3.0/store - rmqbroker_b_logs:/home/rocketmq/rocketmq-5.3.0/logs - /etc/localtime:/etc/localtime:ro networks: - rocketmq rmqbroker-c: image: 192.168.10.74:7080/library/rocketmq:5.3.0 deploy: replicas: 1 restart_policy: condition: any delay: 16s placement: constraints: - node.hostname mq?docker?node ports: - published: 9109 target: 9109 protocol: tcp mode: host configs: - source: mq53broker-c.conf target: /home/rocketmq/rocketmq-5.3.0/conf/mq53broker-c.conf - source: plain_acl.yml target: /home/rocketmq/rocketmq-5.3.0/conf/plain_acl.yml command: sh mqbroker -c /home/rocketmq/rocketmq-5.3.0/conf/mq53broker-c.conf environment: - NAMESRV_ADDRrmqnamesrv:9876 - JAVA_OPT_EXT-Xms512M -Xmx512M -Xmn192M depends_on: - rmqnamesrv volumes: - rmqbroker_c_store:/home/rocketmq/rocketmq-5.3.0/store - rmqbroker_c_logs:/home/rocketmq/rocketmq-5.3.0/logs - /etc/localtime:/etc/localtime:ro networks: - rocketmq dashboard: image: 192.168.10.74:7080/library/rocketmq-dashboard:1.0.1 deploy: replicas: 1 restart_policy: condition: any delay: 16s placement: constraints: - node.hostname mq?docker?node networks: - rocketmq depends_on: - rmqnamesrv ports: - published: 9114 target: 8080 protocol: tcp mode: host environment: - JAVA_OPTS-Drocketmq.namesrv.addrrmqnamesrv:9876 - JAVA_OPT_EXT-Xms256M -Xmx256M -Xmn128M - rocketmq.config.accessKeymq_admin - rocketmq.config.secretKeyAdmin123456 - rocketmq.config.isVIPChannelfalse - rocketmq.config.loginRequiredtrue # 登錄用戶loginRequiredtrue默認(rèn)存在容器內(nèi)文件重建容器即丟失 # 若在頁面上維護(hù)過用戶/角色建議按實(shí)際 dataPath 掛卷持久化 volumes: - dashboard_data:/tmp/rocketmq-console/data - /etc/localtime:/etc/localtime:ro networks: rocketmq: volumes: rmqnamesrv_logs: external: true rmqbroker_a_store: external: true rmqbroker_a_logs: external: true rmqbroker_b_store: external: true rmqbroker_b_logs: external: true rmqbroker_c_store: external: true rmqbroker_c_logs: external: true dashboard_data: external: true configs: plain_acl.yml: external: true mq53broker-a.conf: external: true mq53broker-b.conf: external: true mq53broker-c.conf: external: true mq53topics.txt: external: true六、集群部署啟動6.1 執(zhí)行部署命令將上面docker?compose?rmq53.yml放到工作目錄執(zhí)行部署棧命名為rmq53docker stack deploy -c docker?compose?rmq53.yml rmq536.2 查看集群服務(wù)狀態(tài)docker stack services rmq53輸出列表中所有服務(wù)的REPLICAS列顯示1/1代表實(shí)例啟動成功。如果狀態(tài)不為1/1使用docker service logs 服務(wù)名查看服務(wù)日志排查啟動異常。七、Dashboard控制臺訪問訪問地址http://192.168.10.38:9114項(xiàng)目參數(shù)值A(chǔ)ccessKeymq_adminSecretKeyAdmin123456說明dashboard開啟登錄鑒權(quán)使用ACL管理員賬號登錄頁面上創(chuàng)建的用戶角色數(shù)據(jù)保存在dashboard_data外部卷實(shí)現(xiàn)持久化。 ??實(shí)際部署替換為自己服務(wù)器IP同時(shí)修改賬號密碼。八、業(yè)務(wù)客戶端接入配置客戶端連接NameServer地址192.168.10.38:9111業(yè)務(wù)賬號mq_biz參數(shù)accessKeymq_biz secretKeyBiz654321權(quán)限說明業(yè)務(wù)賬號僅允許對BIZ_TOPIC主題進(jìn)行消息發(fā)布PUB、消息訂閱SUB。九、日常運(yùn)維操作手冊9.1 修改ACL權(quán)限配置流程?重要swarm config只讀掛載mqadmin updateAclConfig熱更新命令不會生效。 完整修改步驟修改宿主機(jī)本地plain_acl.yml配置刪除舊config對象docker config rm plain_acl.yml重新創(chuàng)建configdocker config create plain_acl.yml plain_acl.yml更新stack使配置生效docker stack deploy -c docker?compose?rmq53.yml rmq539.2 JVM內(nèi)存參數(shù)調(diào)整說明組件默認(rèn)JVM參數(shù)NameServer-Xms256M -Xmx256M -Xmn128MBroker-Xms512M -Xmx512M -Xmn192MDashboard-Xms256M -Xmx256M -Xmn128M修改方式修改docker?compose?rmq53.yml文件中JAVA_OPT_EXT環(huán)境變量重新執(zhí)行docker stack deploy即可更新JVM參數(shù)。9.3 集群停止、重啟操作停止集群數(shù)據(jù)卷、config配置全部保留業(yè)務(wù)數(shù)據(jù)不會丟失docker stack rm rmq53停止后重新啟動集群直接再次執(zhí)行部署命令即可docker stack deploy -c docker?compose?rmq53.yml rmq539.4 資源清理命令謹(jǐn)慎執(zhí)行執(zhí)行后數(shù)據(jù)丟失清理config配置對象docker config rm plain_acl.yml mq53broker-a.conf mq53broker-b.conf mq53broker-c.conf mq53topics.txt??清理存儲卷消息、日志全部刪除生產(chǎn)環(huán)境嚴(yán)禁隨意執(zhí)行docker volume rm rmqnamesrv_logs rmqbroker_a_store rmqbroker_a_logs rmqbroker_b_store rmqbroker_b_logs rmqbroker_c_store rmqbroker_c_logs dashboard_data十、常見問題與注意事項(xiàng)depends_on不生效問題Docker Swarm stack會忽略yaml中的depends_on依賴配置。Broker服務(wù)內(nèi)部會自動循環(huán)重試連接NameServer不需要等待nameServer完全啟動。ACL權(quán)限不生效確認(rèn)broker.conf配置中aclEnabletrue確認(rèn)plain_acl.yml已經(jīng)通過docker config重新創(chuàng)建并且stack已經(jīng)重新deploy確認(rèn)客戶端傳入accessKey、secretKey正確。客戶端連接失敗檢查防火墻端口放行確認(rèn)brokerIP1配置為宿主機(jī)真實(shí)IP不要使用127.0.0.1確認(rèn)NameServer連接地址填寫宿主機(jī)9111端口。數(shù)據(jù)持久化說明所有消息存儲、日志、dashboard用戶數(shù)據(jù)全部使用external外部volume執(zhí)行docker stack rm rmq53不會刪除volume只有手動執(zhí)行docker volume rm才會刪除數(shù)據(jù)。安全風(fēng)險(xiǎn)提示本文檔中AccessKey、SecretKey、IP均為演示示例生產(chǎn)環(huán)境部署務(wù)必修改賬號密碼、修改為實(shí)際服務(wù)器IP不要直接復(fù)制示例配置直接上線。總結(jié)本方案使用 Docker Swarm 外部 config 存放配置文件外部 volume 持久化消息與日志刪除 stack 不會丟失業(yè)務(wù)數(shù)據(jù)swarm config 只讀特性ACL 無法熱更新修改權(quán)限配置需要重建 config生產(chǎn)環(huán)境務(wù)必修改示例 IP、accessKey、secretKey做好防火墻端口管控可根據(jù)服務(wù)器內(nèi)存調(diào)整 JVM 的JAVA_OPT_EXT參數(shù)優(yōu)化性能。具體實(shí)施操作步驟另外附帶批量topic創(chuàng)建腳本【中間件部署】基于DockerSwarm的RocketMQ5.3.0集群部署含ACL權(quán)限控制與Dashboard監(jiān)控的微服務(wù)消息隊(duì)列實(shí)施方案資源-CSDN下載https://download.csdn.net/download/zhaojun917/93394051