Posts

修改 etcd 证书 备份旧的 etcd 证书 [root@enxe etcd]# cd /etc/ssl/etcd/ [root@enxe etcd]# ls ssl [root@enxe etcd]# cp -r ssl ssl-bak [root@enxe etcd]# [root@enxe etcd]# ls ssl ssl-bak 查看旧的etcd中包含的IP及DNS [root@enxe etcd]# openssl x509 -in /etc/ssl/etcd/ssl/node-enxe.pem -noout -text|grep DNS DNS:enxe, DNS:etcd, DNS:etcd.kube-system, DNS:etcd.kube-system.svc, DNS:etcd.kube-system.svc.cluster.local, DNS:lb.kubesphere.local, DNS:localhost, IP Address:127.0.0.1, IP Address:0:0:0:0:0:0:0:1, IP Address:192.168.31.4 删除旧的证书 rm -f /etc/ssl/etcd/ssl/* 编写配置文件 cat > /etc/ssl/etcd/ssl/openssl.conf <<EOF [req] req_extensions = v3_req distinguished_name = req_distinguished_name [req_distinguished_name] [ v3_req ] basicConstraints = CA:FALSE keyUsage = nonRepudiation, digitalSignature, keyEncipherment subjectAltName = @alt_names [ ssl_client ] extendedKeyUsage = clientAuth, serverAuth basicConstraints = CA:FALSE subjectKeyIdentifier=hash authorityKeyIdentifier=keyid,issuer subjectAltName = @alt_names [ v3_ca ] basicConstraints = CA:TRUE keyUsage = nonRepudiation, digitalSignature, keyEncipherment subjectAltName = @alt_names authorityKeyIdentifier=keyid:always,issuer [alt_names] DNS....

K8s通过IP添加外部服务 在KubeSphere v3.x中是支持通过IP添加外部服务的（但这不是标准做法） 在KubeSphere v4.x中以不支持通过IP添加，仅支持域名 要想通过IP添加外部服务只能通过 EndPoints+无头服务的方式 # 创建MySQL端点 cat << EOF | kubectl apply -f - apiVersion: v1 kind: Endpoints metadata: name: mysql namespace: db subsets: - addresses: - ip: 10.0.2.10 #外部服务对应的IP ports: - port: 3306 EOF # 创建MySQL无头服务 cat << EOF | kubectl apply -f - apiVersion: v1 kind: Service metadata: name: mysql namespace: db spec: clusterIP: None ports: - name: mysql port: 3306 targetPort: 3306 EOF

异常现象 集群中某个节点etcd无法启动，其他节点正常 systemctl status etcd ● etcd.service - etcd Loaded: loaded (/etc/systemd/system/etcd.service; enabled; vendor preset: disabled) Active: activating (auto-restart) (Result: exit-code) since Thu 2025-09-18 09:59:47 CST; 7s ago Process: 7427 ExecStart=/usr/local/bin/etcd (code=exited, status=2) Main PID: 7427 (code=exited, status=2) Sep 18 09:59:47 k8s-master1 systemd[1]: etcd.service: main process exited, code=exited, status=2/INVALIDARGUMENT Sep 18 09:59:47 k8s-master1 systemd[1]: Failed to start etcd. Sep 18 09:59:47 k8s-master1 systemd[1]: Unit etcd.service entered failed state. Sep 18 09:59:47 k8s-master1 systemd[1]: etcd....

CentOS SSH 防护配置 fail2ban 是一个 Python 写的安全工具，能够监控日志文件并在检测到可疑行为时（如连续 SSH 登录失败）自动封禁 IP。 安装 fail2ban sudo yum install epel-release -y sudo yum install fail2ban -y 配置 SSH 防护规则 创建配置文件（不要直接修改 jail.conf）： sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local 然后编辑： sudo vi /etc/fail2ban/jail.local 找到 [sshd] 相关配置部分，确保以下内容存在并启用： [sshd] enabled = true port = ssh logpath = %(sshd_log)s maxretry = 5 findtime = 600 bantime = 3600 含义如下： maxretry=5：5 次密码错误 findtime=600：在 600 秒（10 分钟）内出现以上错误 bantime=3600：封禁时间 1 小时（单位为秒） 启动并设置开机启动 sudo systemctl enable fail2ban sudo systemctl start fail2ban 查看当前被封的 IP（可选）...

K8s Cert-Manager 证书申请 手动申请证书 namespace=<项目名称> domain=<申请证书的域名> domain_name=$(echo ${domain} | sed 's/\./-/g') # 在需要使用证书的项目（namespace）下创建Certificate 这里以 kubesphere-system 为例 cat <<EOF | kubectl apply -f - apiVersion: cert-manager.io/v1 kind: Certificate metadata: name: cert-${domain_name} namespace: ${namespace} spec: secretName: tls-${domain_name} commonName: dnsNames: - "*.${domain}" issuerRef: name: letsencrypt-prod kind: ClusterIssuer EOF # 等待几分钟后查看证书 READY 状态 watch -n 1 "kubectl get certificate -n ${namespace}" Ingress自动证书 kind: Ingress apiVersion: networking.k8s.io/v1 metadata: name: docs-jsecode-com namespace: docs annotations: cert-manager.io/cluster-issuer: letsencrypt-prod kubesphere....