k8s

修改 etcd 证书 备份旧的 etcd 证书 [root@enxe etcd]# cd /etc/ssl/etcd/ [root@enxe etcd]# ls ssl [root@enxe etcd]# cp -r ssl ssl-bak [root@enxe etcd]# [root@enxe etcd]# ls ssl ssl-bak 查看旧的etcd中包含的IP及DNS [root@enxe etcd]# openssl x509 -in /etc/ssl/etcd/ssl/node-enxe.pem -noout -text|grep DNS DNS:enxe, DNS:etcd, DNS:etcd.kube-system, DNS:etcd.kube-system.svc, DNS:etcd.kube-system.svc.cluster.local, DNS:lb.kubesphere.local, DNS:localhost, IP Address:127.0.0.1, IP Address:0:0:0:0:0:0:0:1, IP Address:192.168.31.4 删除旧的证书 rm -f /etc/ssl/etcd/ssl/* 编写配置文件 cat > /etc/ssl/etcd/ssl/openssl.conf <<EOF [req] req_extensions = v3_req distinguished_name = req_distinguished_name [req_distinguished_name] [ v3_req ] basicConstraints = CA:FALSE keyUsage = nonRepudiation, digitalSignature, keyEncipherment subjectAltName = @alt_names [ ssl_client ] extendedKeyUsage = clientAuth, serverAuth basicConstraints = CA:FALSE subjectKeyIdentifier=hash authorityKeyIdentifier=keyid,issuer subjectAltName = @alt_names [ v3_ca ] basicConstraints = CA:TRUE keyUsage = nonRepudiation, digitalSignature, keyEncipherment subjectAltName = @alt_names authorityKeyIdentifier=keyid:always,issuer [alt_names] DNS....

K8s通过IP添加外部服务 在KubeSphere v3.x中是支持通过IP添加外部服务的（但这不是标准做法） 在KubeSphere v4.x中以不支持通过IP添加，仅支持域名 要想通过IP添加外部服务只能通过 EndPoints+无头服务的方式 # 创建MySQL端点 cat << EOF | kubectl apply -f - apiVersion: v1 kind: Endpoints metadata: name: mysql namespace: db subsets: - addresses: - ip: 10.0.2.10 #外部服务对应的IP ports: - port: 3306 EOF # 创建MySQL无头服务 cat << EOF | kubectl apply -f - apiVersion: v1 kind: Service metadata: name: mysql namespace: db spec: clusterIP: None ports: - name: mysql port: 3306 targetPort: 3306 EOF

异常现象 集群中某个节点etcd无法启动，其他节点正常 systemctl status etcd ● etcd.service - etcd Loaded: loaded (/etc/systemd/system/etcd.service; enabled; vendor preset: disabled) Active: activating (auto-restart) (Result: exit-code) since Thu 2025-09-18 09:59:47 CST; 7s ago Process: 7427 ExecStart=/usr/local/bin/etcd (code=exited, status=2) Main PID: 7427 (code=exited, status=2) Sep 18 09:59:47 k8s-master1 systemd[1]: etcd.service: main process exited, code=exited, status=2/INVALIDARGUMENT Sep 18 09:59:47 k8s-master1 systemd[1]: Failed to start etcd. Sep 18 09:59:47 k8s-master1 systemd[1]: Unit etcd.service entered failed state. Sep 18 09:59:47 k8s-master1 systemd[1]: etcd....

K8s Cert-Manager 证书申请 手动申请证书 namespace=<项目名称> domain=<申请证书的域名> domain_name=$(echo ${domain} | sed 's/\./-/g') # 在需要使用证书的项目（namespace）下创建Certificate 这里以 kubesphere-system 为例 cat <<EOF | kubectl apply -f - apiVersion: cert-manager.io/v1 kind: Certificate metadata: name: cert-${domain_name} namespace: ${namespace} spec: secretName: tls-${domain_name} commonName: dnsNames: - "*.${domain}" issuerRef: name: letsencrypt-prod kind: ClusterIssuer EOF # 等待几分钟后查看证书 READY 状态 watch -n 1 "kubectl get certificate -n ${namespace}" Ingress自动证书 kind: Ingress apiVersion: networking.k8s.io/v1 metadata: name: docs-jsecode-com namespace: docs annotations: cert-manager.io/cluster-issuer: letsencrypt-prod kubesphere....

Ingress ModSecurity防护 Ingress Controller 全局配置 # 编辑集群网关 添加如下配置选项 data: enable-modsecurity: "true" enable-owasp-modsecurity-crs: "true" modsecurity-snippet: | SecRuleEngine On SecRequestBodyAccess On SecResponseBodyAccess On SecAuditEngine RelevantOnly SecAuditLogParts ABIJDEFHZ # Ingress 单路由配置 kind: Ingress apiVersion: networking.k8s.io/v1 metadata: name: xxxxx namespace: tools annotations: nginx.ingress.kubernetes.io/enable-modsecurity: 'false' # 关闭 nginx.ingress.kubernetes.io/modsecurity-snippet: | SecRuleEngine On #拦截恶意请求 #SecRuleEngine DetectionOnly #仅记录，不拦截 nginx.ingress.kubernetes.io/whitelist-source-range: 'x.x.x.x' 误判处理 kind: Ingress apiVersion: networking.k8s.io/v1 metadata: namespace: xxxx annotations: nginx.ingress.kubernetes.io/modsecurity-snippet: | # 移除指定ID的规则 SecRule REQUEST_URI "@rx ^/(js|cdn)/.*\.(js|css)$" "id:1000001,phase:1,nolog,pass,ctl:ruleRemoveById=959100" 辅助调试...