1. Deploying Jumpserver

You need a StorageClass ready in advance to store Jumpserver’s data. Besides the database mentioned below, each component — jms-core, jms-web, jms-koko, jms-lion, jms-chen — also needs a PV for storage.

1.1 Deploying MySQL

Refer to https://github.com/shaowenchen/ops-hub/blob/main/database/mysql8.yaml to deploy MySQL.

You need to adjust the StorageClass field to a value available in your cluster.

1.2 Deploying Redis

Refer to https://github.com/shaowenchen/ops-hub/blob/main/database/redis7.yaml to deploy Redis.

You need to adjust the StorageClass field to a value available in your cluster.

3. Deploying Jumpserver

• Add the Helm repository

1
2

helm repo add jumpserver https://jumpserver.github.io/helm-charts
helm repo update

• Modify values.yaml

https://github.com/jumpserver/helm-charts/blob/main/charts/jumpserver/values.yaml

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

global:
  storageClass: ""

externalDatabase:
  engine: mysql
  host:
  port:
  user:
  password:
  database:

externalRedis:
  host:
  port:
  password: ""

The main things to change here are global.storageClass, externalDatabase, and externalRedis.

If your cluster restricts access to Docker Hub, you also need to modify imageRegistry and imageOwner. Alternatively, you can download the latest release from https://github.com/jumpserver/helm-charts/releases and, after extracting it, change the image addresses to your own private registry.

• Install Jumpserver

1

helm install jms-k8s jumpserver/jumpserver -n jumpserver -f values.yaml

Uninstall command

1

helm uninstall jms-k8s -n jumpserver

• Add an access entry point

If you access it via NodePort, then besides changing jumpserver-jms-web to the NodePort type, you also need to add the environment variable DOMAINS to jumpserver-jms-core to allow the new access entry point; otherwise you will see the following message:

1
2
3

配置文件有问题，无法登录，请联系管理员或查看最新文档
如果你是管理员，可以更新配置文件解决，设置配置项
DOMAINS=x.x.x.x:x

Edit jumpserver-jms-core:

1

kubectl -n jumpserver edit deployments.apps jms-k8s-jumpserver-jms-core

Add the environment variable:

1
2

- name: DOMAINS
  value: x.x.x.x:x

• First access

On first access you need to reset the admin user’s password, which is ChangeMe. After logging in, you will be prompted to change the password.

2. Importing Resources

2.1 Adding a Node

Click 【Asset Management - Asset List】 on the left side of the page, right-click the root node Default, and create a new node.

A node is really just a way to group assets. Here we create a new node and name it worker.

2.2 Creating an Account for Accessing Hosts

Click 【Account Templates】 on the left side of the page to create a privileged user root.

2.3 Adding Hosts with a Script

• Set environment variables

1
2

export JUMPSERVER="http://x.x.x.x:x"
export JUMPSERVER_PASSWORD="xxx"

• Get the Token

1
2
3
4
5

curl -X POST "${JUMPSERVER}/api/v1/authentication/auth/" \
-H 'Content-Type: application/json' \
-d "{\"username\": \"admin\", \"password\": \"${JUMPSERVER_PASSWORD}\"}"

{"token":"xxx"}

• Set the Token

1

export JUMPSERVER_TOKEN="xxx"

• Set the group and template account to import

Click 【Account Templates】 on the left side of the page, find the root account, and click into it to see the account template’s id.

1

export JUMPSERVER_ACCOUNT_ID="xxx"

1
2
3
4

export GROUP_NAME="worker"
curl -s -H "Authorization: Bearer $JUMPSERVER_TOKEN" "$JUMPSERVER/api/v1/assets/nodes/" | jq -r --arg GROUP_NAME "$GROUP_NAME" '.[] | select(.name==$GROUP_NAME) | .id'

xxx

Set GROUP_ID

1

export GROUP_ID="xxx"

• Write the script

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

create_host() {
    HOST_NAME="$1"
    IP="$2"

    data=$(cat <<EOF
{
    "name": "$HOST_NAME",
    "address": "$IP",
    "platform": "1",
    "protocols": [{"name": "ssh", "port": 22}],
    "is_active": true,
    "nodes": ["$GROUP_ID"],
    "accounts": [{"template": "$JUMPSERVER_ACCOUNT_ID"}]
}
EOF
    )

    response=$(curl -s -X POST \
        -H "Authorization: Bearer $JUMPSERVER_TOKEN" \
        -H "Content-Type: application/json" \
        -d "$data" \
        "$JUMPSERVER/api/v1/assets/hosts/")

    echo "Result: $response"
}

• Create a host

1

create_host "x.x.x.x" "x.x.x.x"

2.4 Adding Hosts in Bulk

1
2
3

kubectl get nodes -o wide | awk 'NR>1 {print $6}' | grep -v "<none>" | while read ip; do
    create_host $ip $ip
done

2.5 Resetting the admin Password

• Enter the jumpserver core container

1

kubectl -n jumpserver exec -it jms-k8s-jumpserver-jms-core-676b986bdd-6bpp8  -- bash

• Reset the password

1

cd /opt/jumpserver/apps

1

python manage.py changepassword admin

3 Granting Users Access

Three objects are involved here:

• Users
• Assets — hosts, databases, clusters, and other resources
• Authorization rules between users and assets

To authorize a single user, proceed as follows:

1. Add the user under 【User Management - User List】
2. Add an authorization rule under 【Authorization Management - Asset Authorization】

When creating an authorization rule, just select a user and select an asset.

To authorize multiple users, create a user group, add the users to it, and then authorize the group.

To authorize a large batch of resources, put those resources under a single node and then authorize the user for that node.

4. References

• https://docs.jumpserver.org/zh/master/install/setup_by_fast/