{"id":33387,"date":"2025-04-27T11:23:14","date_gmt":"2025-04-27T03:23:14","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/33387.html"},"modified":"2025-04-27T11:23:14","modified_gmt":"2025-04-27T03:23:14","slug":"ubuntu-k8s%e9%9b%86%e7%be%a4%e5%ae%89%e5%85%a8%e5%8a%a0%e5%9b%ba%e6%96%b9%e6%a1%88","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/33387.html","title":{"rendered":"Ubuntu K8s\u96c6\u7fa4\u5b89\u5168\u52a0\u56fa\u65b9\u6848"},"content":{"rendered":"

Ubuntu K8s\u96c6\u7fa4\u5b89\u5168\u52a0\u56fa\u65b9\u6848<\/h3>\n

\u5728Ubuntu\u7cfb\u7edf\u4e0a\u90e8\u7f72Kubernetes\u96c6\u7fa4\u65f6，\u82e5\u670d\u52a1\u5668\u62e5\u6709\u5916\u7f51IP，\u9700\u91c7\u53d6\u591a\u5c42\u6b21\u5b89\u5168\u9632\u62a4\u63aa\u65bd\u4ee5\u786e\u4fdd\u96c6\u7fa4\u5b89\u5168\u3002\u672c\u65b9\u6848\u901a\u8fc7\u7cfb\u7edf\u9632\u706b\u5899\u914d\u7f6e\u3001TLS\u901a\u4fe1\u542f\u7528\u3001\u7f51\u7edc\u7b56\u7565\u5b9e\u65bd\u548cRBAC\u6743\u9650\u63a7\u5236\u56db\u4e2a\u6838\u5fc3\u5c42\u9762，\u6784\u5efa\u5b89\u5168\u7684Kubernetes\u73af\u5883\u3002\u5b89\u5168\u9632\u62a4\u4e0d\u5e94\u4ec5\u505c\u7559\u5728\u5355\u70b9\u63aa\u65bd，\u800c\u5e94\u5f62\u6210\u7eb5\u6df1\u9632\u5fa1\u4f53\u7cfb，\u4ece\u7269\u7406\u4e3b\u673a\u5230\u96c6\u7fa4\u63a7\u5236\u9762\u518d\u5230\u5e94\u7528\u5c42\u8fdb\u884c\u5168\u9762\u4fdd\u62a4\u3002\u5728\u751f\u4ea7\u73af\u5883\u4e2d，\u9700\u786e\u4fdd\u6240\u6709\u5b89\u5168\u914d\u7f6e\u5747\u7b26\u5408\u6700\u5c0f\u6743\u9650\u539f\u5219，\u5e76\u5b9a\u671f\u8fdb\u884c\u5ba1\u8ba1\u4e0e\u76d1\u63a7\u3002<\/p>\n

\u4e00\u3001\u57fa\u7840\u7cfb\u7edf\u5b89\u5168\u914d\u7f6e<\/h4>\n

Ubuntu\u670d\u52a1\u5668\u4f5c\u4e3aKubernetes\u96c6\u7fa4\u8282\u70b9，\u5176\u57fa\u7840\u7cfb\u7edf\u5b89\u5168\u81f3\u5173\u91cd\u8981\u3002\u9996\u5148，\u9700\u786e\u4fdd\u7cfb\u7edf\u65f6\u95f4\u540c\u6b65，\u8fd9\u53ef\u4ee5\u901a\u8fc7\u5b89\u88c5NTP\u670d\u52a1\u5e76\u914d\u7f6e\u53ef\u9760\u7684NTP\u670d\u52a1\u5668\u5b9e\u73b0\u3002\u5728Ubuntu\u4e0a，\u53ef\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4\u5b89\u88c5\u5e76\u914d\u7f6eNTP\u670d\u52a1：<\/p>\n

sudo<\/span> apt<\/span> update
\nsudo<\/span> apt<\/span> install<\/span> ntpdate ntp
\nsudo<\/span> ntpdate ntp1.aliyun.com<\/p>\n

\u5176\u6b21，\u5e94\u7981\u7528Swap\u529f\u80fd\u3002Kubernetes\u8981\u6c42\u6240\u6709\u8282\u70b9\u7981\u7528Swap，\u53ef\u901a\u8fc7\u7f16\u8f91\/etc\/fstab\u6587\u4ef6\u5e76\u6ce8\u91ca\u6389Swap\u884c\u5b9e\u73b0，\u7136\u540e\u6267\u884cswapoff –all\u547d\u4ee4\u3002<\/p>\n

\u7136\u540e，\u914d\u7f6e\u5bb9\u5668\u8fd0\u884c\u65f6\u73af\u5883\u3002\u5bf9\u4e8eUbuntu\u7cfb\u7edf，\u63a8\u8350\u4f7f\u7528Docker\u6216Containerd\u4f5c\u4e3a\u5bb9\u5668\u8fd0\u884c\u65f6\u3002Docker\u5b89\u88c5\u547d\u4ee4\u5982\u4e0b：<\/p>\n

sudo<\/span> apt-get<\/span> update
\nsudo<\/span> apt-get<\/span> install<\/span> docker.io<\/p>\n

Containerd\u5b89\u88c5\u547d\u4ee4\u5982\u4e0b：<\/p>\n

sudo<\/span> apt-get<\/span> update
\nsudo<\/span> apt-get<\/span> install<\/span> containerd<\/p>\n

\u6b64\u5916，\u8fd8\u9700\u8c03\u6574Linux\u5185\u6838\u53c2\u6570\u4ee5\u652f\u6301Kubernetes\u7f51\u7edc\u9700\u6c42\u3002\u5728Ubuntu\u4e0a，\u53ef\u901a\u8fc7\u4ee5\u4e0b\u547d\u4ee4\u4fee\u6539\u5185\u6838\u53c2\u6570：<\/p>\n

cat<\/span> >><\/span> \/etc\/sysctl.d\/kubernetes.conf <<<\/span>EOF
\nnet.bridge.bridge-nf-call-ip6tables = 1
\nnet.bridge.bridge-nf-call-iptables = 1
\nnet.ipv4.ip_forward = 1
\nEOF<\/span>
\nsysctl -p<\/p>\n

\u8fd9\u4e9b\u5185\u6838\u53c2\u6570\u786e\u4fdd\u4e86\u5bb9\u5668\u7f51\u7edc\u548cKubernetes\u7ec4\u4ef6\u4e4b\u95f4\u7684\u6b63\u5e38\u901a\u4fe1\u3002<\/p>\n

\u4e8c\u3001\u9632\u706b\u5899\u89c4\u5219\u914d\u7f6e<\/h4>\n

Ubuntu\u670d\u52a1\u5668\u7684\u9632\u706b\u5899\u89c4\u5219\u662f\u4fdd\u62a4\u96c6\u7fa4\u7684\u7b2c\u4e00\u9053\u9632\u7ebf，\u9700\u5bf9\u975e\u5fc5\u8981\u7aef\u53e3\u8fdb\u884c\u9650\u5236，\u4ec5\u5f00\u653eAPI Server\u7b49\u5fc5\u9700\u7aef\u53e3\u3002\u9ed8\u8ba4\u60c5\u51b5\u4e0b，UFW（Uncomplicated Firewall）\u662fUbuntu\u7684\u9ed8\u8ba4\u9632\u706b\u5899\u914d\u7f6e\u5de5\u5177，\u63d0\u4f9b\u4e86\u4e00\u4e2a\u7528\u6237\u53cb\u597d\u7684\u754c\u9762\u6765\u7ba1\u7406Linux\u7cfb\u7edf\u7684Netfilter\u9632\u706b\u5899\u3002<\/p>\n

\u9996\u5148，\u5b89\u88c5\u5e76\u542f\u7528UFW\u9632\u706b\u5899：<\/p>\n

sudo<\/span> apt<\/span> update
\nsudo<\/span> apt<\/span> install<\/span> ufw
\nsudo<\/span> ufw enable<\/span><\/p>\n

\u542f\u7528UFW\u540e，\u9ed8\u8ba4\u62d2\u7edd\u6240\u6709\u5165\u7ad9\u8fde\u63a5，\u4ec5\u5141\u8bb8\u5df2\u660e\u786e\u5141\u8bb8\u7684\u8fde\u63a5\u3002\u8fd9\u662f\u7b26\u5408\u5b89\u5168\u539f\u5219\u7684\u9ed8\u8ba4\u7b56\u7565\u3002<\/p>\n

\u9488\u5bf9Kubernetes\u96c6\u7fa4，\u9700\u5f00\u653e\u4ee5\u4e0b\u5173\u952e\u7aef\u53e3：<\/p>\n\n\u7aef\u53e3\u534f\u8bae\u7528\u9014\u8bbf\u95ee\u63a7\u5236<\/tr>\n\n\n\n\n\n\n\n
22<\/td>\nTCP<\/td>\nSSH\u7ba1\u7406<\/td>\n\u4ec5\u5141\u8bb8\u7279\u5b9aIP\u6216\u5b50\u7f51\u8bbf\u95ee<\/td>\n<\/tr>\n
6443<\/td>\nTCP<\/td>\nAPI Server<\/td>\n\u4ec5\u5141\u8bb8\u96c6\u7fa4\u5185\u8282\u70b9\u6216\u7ba1\u7406IP\u8bbf\u95ee<\/td>\n<\/tr>\n
10250<\/td>\nTCP<\/td>\nKubelet API<\/td>\n\u4ec5\u5141\u8bb8\u96c6\u7fa4\u5185\u8282\u70b9\u8bbf\u95ee<\/td>\n<\/tr>\n
10255<\/td>\nTCP<\/td>\nKubelet\u53ea\u8bfb\u7aef\u53e3<\/td>\n\u4ec5\u5141\u8bb8\u96c6\u7fa4\u5185\u8282\u70b9\u8bbf\u95ee<\/td>\n<\/tr>\n
53<\/td>\nTCP\/UDP<\/td>\nDNS\u670d\u52a1<\/td>\n\u4ec5\u5141\u8bb8\u96c6\u7fa4\u5185\u8282\u70b9\u8bbf\u95ee<\/td>\n<\/tr>\n
2379\/2380<\/td>\nTCP<\/td>\netcd\u96c6\u7fa4\u901a\u4fe1<\/td>\n\u4ec5\u5141\u8bb8\u4e3b\u8282\u70b9\u95f4\u901a\u4fe1<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u5177\u4f53UFW\u89c4\u5219\u914d\u7f6e\u793a\u4f8b\u5982\u4e0b：<\/p>\n

# \u5141\u8bb8SSH\u7ba1\u7406\u8bbf\u95ee<\/span>
\nsudo<\/span> ufw allow from 192.168<\/span>.1.0\/24 to any port 22<\/span> proto tcp<\/p>\n

# \u5141\u8bb8API Server\u8bbf\u95ee（\u4ec5\u9650\u96c6\u7fa4\u5185\u8282\u70b9）<\/span>
\nsudo<\/span> ufw allow from 10.0<\/span>.0.0\/24 to any port 6443<\/span> proto tcp<\/p>\n

# \u5141\u8bb8etcd\u96c6\u7fa4\u901a\u4fe1（\u4ec5\u9650\u4e3b\u8282\u70b9\u95f4）<\/span>
\nsudo<\/span> ufw allow from <<\/span>\u4e3b\u8282\u70b9IP1<\/span>><\/span> to any port 2379<\/span> proto tcp
\nsudo<\/span> ufw allow from <<\/span>\u4e3b\u8282\u70b9IP2<\/span>><\/span> to any port 2379<\/span> proto tcp<\/p>\n

# \u5141\u8bb8kubelet API\u8bbf\u95ee（\u4ec5\u9650\u96c6\u7fa4\u5185\u8282\u70b9）<\/span>
\nsudo<\/span> ufw allow from 10.0<\/span>.0.0\/24 to any port 10250<\/span> proto tcp<\/p>\n

# \u5141\u8bb8DNS\u670d\u52a1\u8bbf\u95ee（\u4ec5\u9650\u96c6\u7fa4\u5185\u8282\u70b9）<\/span>
\nsudo<\/span> ufw allow from 10.0<\/span>.0.0\/24 to any port 53<\/span> proto tcp
\nsudo<\/span> ufw allow from 10.0<\/span>.0.0\/24 to any port 53<\/span> proto udp<\/p>\n

# \u8bbe\u7f6e\u9ed8\u8ba4\u7b56\u7565\u4e3a\u62d2\u7edd\u6240\u6709\u5165\u7ad9\u8fde\u63a5<\/span>
\nsudo<\/span> ufw default deny incoming<\/p>\n

\u7279\u522b\u6ce8\u610f：NodePort\u670d\u52a1\u7aef\u53e3\u8303\u56f4（30000-32767）\u4ec5\u5728\u5fc5\u8981\u65f6\u5f00\u653e，\u4e14\u5efa\u8bae\u9650\u5236\u8bbf\u95ee\u6765\u6e90\u4e3a\u7279\u5b9a\u7ba1\u7406IP\u3002\u82e5\u96c6\u7fa4\u4e0d\u4f7f\u7528NodePort\u670d\u52a1，\u5e94\u5b8c\u5168\u5173\u95ed\u6b64\u7aef\u53e3\u8303\u56f4\u3002<\/p>\n

\u6700\u540e，\u4fdd\u5b58\u5e76\u5e94\u7528UFW\u89c4\u5219：<\/p>\n

sudo<\/span> ufw reload
\nsudo<\/span> ufw status numbered<\/p>\n

\u901a\u8fc7UFW\u89c4\u5219\u914d\u7f6e，\u786e\u4fdd\u4e86\u53ea\u6709\u6388\u6743\u6d41\u91cf\u624d\u80fd\u8bbf\u95ee\u670d\u52a1\u5668，\u5927\u5927\u964d\u4f4e\u4e86\u88ab\u653b\u51fb\u7684\u53ef\u80fd\u6027\u3002<\/p>\n

\u4e09\u3001TLS\u5b89\u5168\u901a\u4fe1\u914d\u7f6e<\/h4>\n

\u5728Kubernetes\u96c6\u7fa4\u4e2d，TLS\u5b89\u5168\u901a\u4fe1\u662f\u4fdd\u62a4\u63a7\u5236\u5e73\u9762\u548c\u6570\u636e\u4f20\u8f93\u7684\u5173\u952e\u673a\u5236\u3002\u5728\u521d\u59cb\u5316\u96c6\u7fa4\u65f6，\u901a\u8fc7kubeadm init\u547d\u4ee4\u542f\u7528TLS\u901a\u4fe1，\u5e76\u914d\u7f6e\u8bc1\u4e66\u7ba1\u7406\u53ca\u8bbe\u7f6etoken\u6709\u6548\u671f\u3002<\/p>\n

\u9996\u5148，\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4\u521d\u59cb\u5316\u4e3b\u8282\u70b9：<\/p>\n

sudo<\/span> kubeadm init \\\\<\/span>
\n –apiserver-advertise-address=<\/span>\u5185\u7f51IP \\\\<\/span>
\n –apiserver-cert-extra-sans=<\/span>\u5916\u7f51IP \\\\<\/span>
\n –pod-network-cidr=<\/span>10.244<\/span>.0.0\/16<\/p>\n

\u5176\u4e2d，–apiserver-cert-extra-sans\u53c2\u6570\u81f3\u5173\u91cd\u8981，\u5b83\u5141\u8bb8\u4e3aAPI Server\u8bc1\u4e66\u6dfb\u52a0\u989d\u5916\u7684Subject Alternative Name（SAN），\u786e\u4fddAPI Server\u53ef\u901a\u8fc7\u5916\u7f51IP\u6216\u57df\u540d\u5b89\u5168\u8bbf\u95ee\u3002<\/p>\n

\u521d\u59cb\u5316\u5b8c\u6210\u540e，\u7acb\u5373\u521b\u5efa\u5e26\u6709\u6548\u671f\u7684\u5f15\u5bfctoken：<\/p>\n

sudo<\/span> kubeadm token create –validity 24h –print-join-command<\/p>\n

\u5efa\u8bae\u5c06\u9ed8\u8ba4token\u6709\u6548\u671f\u8bbe\u7f6e\u4e3a24\u5c0f\u65f6，\u800c\u975e\u4f7f\u7528\u6c38\u4e45\u6709\u6548\u7684token\u3002\u8fd9\u53ef\u4ee5\u901a\u8fc7\u4fee\u6539kubeadm\u914d\u7f6e\u6587\u4ef6\u5e76\u6307\u5b9a–token-ttl\u53c2\u6570\u5b9e\u73b0\u3002<\/p>\n

\u63a5\u4e0b\u6765，\u68c0\u67e5\u8bc1\u4e66\u6709\u6548\u671f：<\/p>\n

sudo<\/span> kubeadm certs check-expiration<\/p>\n

\u63a7\u5236\u9762\u8bc1\u4e66\u9ed8\u8ba4\u6709\u6548\u671f\u4e3a1\u5e74，\u8fd9\u7b26\u5408\u751f\u4ea7\u73af\u5883\u7684\u5b89\u5168\u8981\u6c42\u3002\u82e5\u9700\u5ef6\u957f\u6709\u6548\u671f，\u53ef\u901a\u8fc7\u4fee\u6539kubeadm\u914d\u7f6e\u6587\u4ef6\u4e2d\u7684certificates.duration\u5b57\u6bb5\u5b9e\u73b0，\u4f46\u4e0d\u5efa\u8bae\u8d85\u8fc71\u5e74，\u4ee5\u964d\u4f4e\u7ef4\u62a4\u590d\u6742\u6027\u3002<\/p>\n

\u6700\u540e，\u624b\u52a8\u7eed\u7b7e\u8bc1\u4e66（\u82e5\u9700\u8981）：<\/p>\n

sudo<\/span> kubeadm certs renew all<\/p>\n

\u7eed\u7b7e\u8bc1\u4e66\u540e，\u9700\u91cd\u542f\u76f8\u5173\u7ec4\u4ef6：<\/p>\n

systemctl restart kubelet
\nkubectl delete pod -n kube-system -l k8s-app=<\/span>kube-apiserver
\nkubectl delete pod -n kube-system -l k8s-app=<\/span>kube-controller-manager
\nkubectl delete pod -n kube-system -l k8s-app=<\/span>kube-scheduler<\/p>\n

\u901a\u8fc7\u4ee5\u4e0a\u914d\u7f6e，\u786e\u4fdd\u4e86Kubernetes\u96c6\u7fa4\u5185\u90e8\u901a\u4fe1\u7684\u5b89\u5168\u6027，\u907f\u514d\u4e86\u672a\u7ecf\u52a0\u5bc6\u7684HTTP\u6d41\u91cf\u4f20\u8f93\u3002<\/p>\n

\u56db\u3001\u7f51\u7edc\u7b56\u7565\u63d2\u4ef6\u90e8\u7f72\u4e0e\u914d\u7f6e<\/h4>\n

\u90e8\u7f72\u7f51\u7edc\u7b56\u7565\u63d2\u4ef6\u5982Calico\u662f\u5b9e\u65bdPod\u95f4\u901a\u4fe1\u9650\u5236\u548c\u547d\u540d\u7a7a\u95f4\u9694\u79bb\u7684\u5173\u952e\u6b65\u9aa4\u3002Calico\u4e0d\u4ec5\u63d0\u4f9bCNI（\u5bb9\u5668\u7f51\u7edc\u63a5\u53e3）\u529f\u80fd，\u8fd8\u652f\u6301\u5f3a\u5927\u7684\u7f51\u7edc\u7b56\u7565\u529f\u80fd，\u80fd\u591f\u5b9e\u73b0\u7ec6\u7c92\u5ea6\u7684Pod\u95f4\u901a\u4fe1\u63a7\u5236\u3002<\/p>\n

\u9996\u5148，\u4e0b\u8f7dCalico\u7684YAML\u914d\u7f6e\u6587\u4ef6：<\/p>\n

curl<\/span> https:\/\/docs.projectcalico.org\/manifests\/calico.yaml -O<\/p>\n

\u7136\u540e，\u5e94\u7528Calico\u914d\u7f6e：<\/p>\n

kubectl apply -f calico.yaml<\/p>\n

\u90e8\u7f72\u5b8c\u6210\u540e，\u9a8c\u8bc1Calico\u7ec4\u4ef6\u72b6\u6001：<\/p>\n

kubectl get pods -n calico-system<\/p>\n

\u786e\u4fdd\u6240\u6709Calico Pod\u5747\u5904\u4e8eRunning\u72b6\u6001\u3002<\/p>\n

\u63a5\u4e0b\u6765，\u5b9e\u65bd\u7f51\u7edc\u7b56\u7565\u3002\u5efa\u8bae\u9996\u5148\u542f\u7528\u5168\u5c40\u62d2\u7edd\u7b56\u7565，\u4f5c\u4e3a\u5b89\u5168\u57fa\u7ebf：<\/p>\n

apiVersion<\/span>:<\/span> projectcalico.org\/v3
\nkind<\/span>:<\/span> GlobalNetworkPolicy
\nmetadata<\/span>:<\/span>
\n name<\/span>:<\/span> default–<\/span>deny
\nspec<\/span>:<\/span>
\n selector<\/span>:<\/span> all()
\n types<\/span>:<\/span>
\n –<\/span> Ingress
\n –<\/span> Egress<\/p>\n

\u5e94\u7528\u5168\u5c40\u62d2\u7edd\u7b56\u7565：<\/p>\n

kubectl apply -f global-network-policy.yaml<\/p>\n

\u7136\u540e，\u9488\u5bf9DNS\u670d\u52a1\u521b\u5efa\u4f8b\u5916\u7b56\u7565：<\/p>\n

apiVersion<\/span>:<\/span> networking.k8s.io\/v1
\nkind<\/span>:<\/span> NetworkPolicy
\nmetadata<\/span>:<\/span>
\n name<\/span>:<\/span> allow–<\/span>dns
\n namespace<\/span>:<\/span> default
\nspec<\/span>:<\/span>
\n podSelector<\/span>:<\/span> {<\/span>}<\/span>
\n policyTypes<\/span>:<\/span>
\n –<\/span> Ingress
\n ingress<\/span>:<\/span>
\n –<\/span> from<\/span>:<\/span>
\n –<\/span> namespaceSelector<\/span>:<\/span>
\n matchLabels<\/span>:<\/span>
\n name<\/span>:<\/span> kube–<\/span>system
\n –<\/span> podSelector<\/span>:<\/span>
\n matchLabels<\/span>:<\/span>
\n k8s-app<\/span>:<\/span> kube–<\/span>dns
\n ports<\/span>:<\/span>
\n –<\/span> protocol<\/span>:<\/span> TCP
\n port<\/span>:<\/span> 53<\/span>
\n –<\/span> protocol<\/span>:<\/span> UDP
\n port<\/span>:<\/span> 53<\/span><\/p>\n

\u5e94\u7528DNS\u4f8b\u5916\u7b56\u7565：<\/p>\n

kubectl apply -f dns-policy.yaml<\/p>\n

\u547d\u540d\u7a7a\u95f4\u9694\u79bb\u793a\u4f8b：\u5bf9\u4e8e\u654f\u611f\u547d\u540d\u7a7a\u95f4\u5982database，\u53ef\u521b\u5efa\u5b8c\u5168\u9694\u79bb\u7b56\u7565：<\/p>\n

apiVersion<\/span>:<\/span> networking.k8s.io\/v1
\nkind<\/span>:<\/span> NetworkPolicy
\nmetadata<\/span>:<\/span>
\n name<\/span>:<\/span> default–<\/span>deny
\n namespace<\/span>:<\/span> database
\nspec<\/span>:<\/span>
\n podSelector<\/span>:<\/span> {<\/span>}<\/span>
\n policyTypes<\/span>:<\/span>
\n –<\/span> Ingress
\n –<\/span> Egress
\n egress<\/span>:<\/span>
\n –<\/span> to<\/span>:<\/span>
\n –<\/span> ipBlock<\/span>:<\/span>
\n cidr<\/span>:<\/span> 0.0.0.0\/0
\n except<\/span>:<\/span>
\n –<\/span> ipBlock<\/span>:<\/span>
\n cidr<\/span>:<\/span> 10.0.0.0\/16
\n –<\/span> ports<\/span>:<\/span>
\n –<\/span> protocol<\/span>:<\/span> TCP
\n port<\/span>:<\/span> 53<\/span>
\n –<\/span> protocol<\/span>:<\/span> UDP
\n port<\/span>:<\/span> 53<\/span><\/p>\n

\u6b64\u7b56\u7565\u62d2\u7edd\u6240\u6709\u5165\u7ad9\u6d41\u91cf，\u5e76\u4ec5\u5141\u8bb8\u51fa\u7ad9\u6d41\u91cf\u8bbf\u95ee\u96c6\u7fa4\u5185DNS\u670d\u52a1\u3002<\/p>\n

\u7f51\u7edc\u7b56\u7565\u5b9e\u65bd\u5e94\u9075\u5faa\u5206\u9636\u6bb5\u539f\u5219：\u9996\u5148\u5728\u6d4b\u8bd5\u547d\u540d\u7a7a\u95f4\u9a8c\u8bc1\u7b56\u7565，\u786e\u8ba4\u7b56\u7565\u751f\u6548\u4e14\u4e0d\u5f71\u54cd\u6b63\u5e38\u529f\u80fd\u540e，\u518d\u9010\u6b65\u6269\u5c55\u5230\u751f\u4ea7\u73af\u5883\u3002\u907f\u514d\u56e0\u7b56\u7565\u914d\u7f6e\u9519\u8bef\u5bfc\u81f4\u96c6\u7fa4\u7f51\u7edc\u4e2d\u65ad\u3002<\/p>\n

\u4e94\u3001RBAC\u6743\u9650\u63a7\u5236\u4e0e\u5ba1\u8ba1<\/h4>\n

Kubernetes\u7684RBAC（\u57fa\u4e8e\u89d2\u8272\u7684\u8bbf\u95ee\u63a7\u5236）\u662f\u5b9e\u73b0\u6743\u9650\u6700\u5c0f\u5316\u7684\u6838\u5fc3\u673a\u5236\u3002\u901a\u8fc7Role\u3001ClusterRole\u3001RoleBinding\u548cClusterRoleBinding，\u53ef\u4e3a\u4e0d\u540c\u7528\u6237\u548c\u670d\u52a1\u8d26\u6237\u5206\u914d\u7cbe\u786e\u7684\u6743\u9650\u3002<\/p>\n

\u9996\u5148，\u4e3a\u5f00\u53d1\u4eba\u5458\u521b\u5efa\u6700\u5c0f\u6743\u9650\u89d2\u8272：<\/p>\n

apiVersion<\/span>:<\/span> rbac.authorization.k8s.io\/v1
\nkind<\/span>:<\/span> Role
\nmetadata<\/span>:<\/span>
\n namespace<\/span>:<\/span> dev–<\/span>namespace
\n name<\/span>:<\/span> dev–<\/span>namespace–<\/span>role
\nrules<\/span>:<\/span>
\n–<\/span> apiGroups<\/span>:<\/span> [<\/span>""<\/span>]<\/span>
\n resources<\/span>:<\/span> [<\/span>"pods"<\/span>,<\/span> "services"<\/span>]<\/span>
\n verbs<\/span>:<\/span> [<\/span>"get"<\/span>,<\/span> "list"<\/span>,<\/span> "create"<\/span>,<\/span> "update"<\/span>,<\/span> "delete"<\/span>]<\/span>
\n–<\/span> apiGroups<\/span>:<\/span> [<\/span>"apps"<\/span>]<\/span>
\n resources<\/span>:<\/span> [<\/span>"deployments"<\/span>]<\/span>
\n verbs<\/span>:<\/span> [<\/span>"get"<\/span>,<\/span> "list"<\/span>,<\/span> "create"<\/span>,<\/span> "update"<\/span>,<\/span> "delete"<\/span>]<\/span>
\n–<\/span> apiGroups<\/span>:<\/span> [<\/span>""<\/span>]<\/span>
\n resources<\/span>:<\/span> [<\/span>"configmaps"<\/span>]<\/span>
\n verbs<\/span>:<\/span> [<\/span>"get"<\/span>,<\/span> "list"<\/span>]<\/span><\/p>\n

\u7136\u540e，\u5c06\u89d2\u8272\u7ed1\u5b9a\u5230\u5f00\u53d1\u4eba\u5458：<\/p>\n

apiVersion<\/span>:<\/span> rbac.authorization.k8s.io\/v1
\nkind<\/span>:<\/span> RoleBinding
\nmetadata<\/span>:<\/span>
\n name<\/span>:<\/span> dev–<\/span>namespace–<\/span>binding
\n namespace<\/span>:<\/span> dev–<\/span>namespace
\nsubjects<\/span>:<\/span>
\n–<\/span> kind<\/span>:<\/span> User
\n name<\/span>:<\/span> dev–<\/span>team
\n apiGroup<\/span>:<\/span> rbac.authorization.k8s.io
\nroleRef<\/span>:<\/span>
\n kind<\/span>:<\/span> Role
\n name<\/span>:<\/span> dev–<\/span>namespace–<\/span>role
\n apiGroup<\/span>:<\/span> rbac.authorization.k8s.io<\/p>\n

\u9650\u5236\u9ed8\u8ba4\u8d26\u6237\u6743\u9650\u662f\u5173\u952e\u5b89\u5168\u63aa\u65bd\u3002\u5bf9\u4e8edefault ServiceAccount，\u53ef\u521b\u5efa\u53ea\u8bfb\u89d2\u8272：<\/p>\n

apiVersion<\/span>:<\/span> rbac.authorization.k8s.io\/v1
\nkind<\/span>:<\/span> Role
\nmetadata<\/span>:<\/span>
\n namespace<\/span>:<\/span> default
\n name<\/span>:<\/span> pod–<\/span>reader–<\/span>role
\nrules<\/span>:<\/span>
\n–<\/span> apiGroups<\/span>:<\/span> [<\/span>""<\/span>]<\/span>
\n resources<\/span>:<\/span> [<\/span>"pods"<\/span>]<\/span>
\n verbs<\/span>:<\/span> [<\/span>"get"<\/span>,<\/span> "watch"<\/span>,<\/span> "list"<\/span>]<\/span><\/p>\n

\u7136\u540e，\u5c06\u53ea\u8bfb\u89d2\u8272\u7ed1\u5b9a\u5230default ServiceAccount：<\/p>\n

apiVersion<\/span>:<\/span> rbac.authorization.k8s.io\/v1
\nkind<\/span>:<\/span> RoleBinding
\nmetadata<\/span>:<\/span>
\n name<\/span>:<\/span> read–<\/span>pods
\n namespace<\/span>:<\/span> default
\nsubjects<\/span>:<\/span>
\n–<\/span> kind<\/span>:<\/span> ServiceAccount
\n name<\/span>:<\/span> default
\n namespace<\/span>:<\/span> default
\nroleRef<\/span>:<\/span>
\n kind<\/span>:<\/span> Role
\n name<\/span>:<\/span> pod–<\/span>reader–<\/span>role
\n apiGroup<\/span>:<\/span> rbac.authorization.k8s.io<\/p>\n

\u5b9a\u671f\u5ba1\u8ba1\u96c6\u7fa4\u8d44\u6e90\u548c\u65e5\u5fd7\u662f\u5b89\u5168\u8fd0\u7ef4\u7684\u91cd\u8981\u73af\u8282\u3002\u53ef\u901a\u8fc7\u4ee5\u4e0b\u6b65\u9aa4\u542f\u7528API Server\u5ba1\u8ba1\u65e5\u5fd7：<\/p>\n

  • \u521b\u5efa\u5ba1\u8ba1\u7b56\u7565\u6587\u4ef6\/etc\/kubernetes\/audit\/audit-policy.yaml：<\/li>\n

    apiVersion<\/span>:<\/span> audit.k8s.io\/v1
    \nkind<\/span>:<\/span> Policy
    \nomitStages<\/span>:<\/span>
    \n–<\/span> "RequestReceived"<\/span>
    \nrules<\/span>:<\/span>
    \n–<\/span> level<\/span>:<\/span> RequestResponse
    \n verbs<\/span>:<\/span> [<\/span>"delete"<\/span>,<\/span> "deletecollection"<\/span>,<\/span> "patch"<\/span>,<\/span> "update"<\/span>]<\/span>
    \n–<\/span> level<\/span>:<\/span> Metadata
    \n verbs<\/span>:<\/span> [<\/span>"get"<\/span>,<\/span> "list"<\/span>,<\/span> "watch"<\/span>]<\/span>
    \n users<\/span>:<\/span> [<\/span>"system:kube-proxy"<\/span>]<\/span>
    \n–<\/span> level<\/span>:<\/span> None
    \n verbs<\/span>:<\/span> [<\/span>"watch"<\/span>]<\/span>
    \n users<\/span>:<\/span> [<\/span>"system:kube-proxy"<\/span>]<\/span>
    \n resources<\/span>:<\/span>
    \n –<\/span> group<\/span>:<\/span> ""<\/span>
    \n resources<\/span>:<\/span> [<\/span>"endpoints"<\/span>,<\/span> "services"<\/span>]<\/span>
    \n–<\/span> level<\/span>:<\/span> None
    \n userGroups<\/span>:<\/span> [<\/span>"system:authenticated"<\/span>]<\/span>
    \n nonResourceURLs<\/span>:<\/span>
    \n –<\/span> "\/api*"<\/span>
    \n –<\/span> "\/version"<\/span><\/p>\n

  • \u4fee\u6539kube-apiserver\u914d\u7f6e\u6587\u4ef6：<\/li>\n

    –<\/span> –<\/span>–<\/span>audit–<\/span>policy–<\/span>file=\/etc\/kubernetes\/audit\/audit–<\/span>policy.yaml
    \n–<\/span> –<\/span>–<\/span>audit–<\/span>log–<\/span>path=\/var\/log\/kubernetes\/audit.log
    \n–<\/span> –<\/span>–<\/span>audit–<\/span>log–<\/span>maxsize=100
    \n–<\/span> –<\/span>–<\/span>audit–<\/span>log–<\/span>maxbackup=5
    \n–<\/span> –<\/span>–<\/span>audit–<\/span>log–<\/span>maxage=30<\/p>\n

  • \u91cd\u542fkubelet\u670d\u52a1\u4f7f\u914d\u7f6e\u751f\u6548：<\/li>\n

    systemctl restart kubelet<\/p>\n

    \u5ba1\u8ba1\u65e5\u5fd7\u6587\u4ef6\u4f4d\u4e8e\/var\/log\/kubernetes\/audit.log，\u53ef\u901a\u8fc7\u4ee5\u4e0b\u547d\u4ee4\u67e5\u770b：<\/p>\n

    kubectl get –raw \/api\/v1\/namespaces\/kube-system\/pods\/kube-apiserver-<<\/span>\u8282\u70b9\u540d\u79f0><\/span>\/log?container=<\/span>kube-apiserver<\/p>\n

    \u5ba1\u8ba1\u65e5\u5fd7\u5206\u6790\u53ef\u901a\u8fc7kube-audit\u7b49\u5de5\u5177\u5b9e\u73b0\u3002\u9996\u5148\u5b89\u88c5kube-audit：<\/p>\n

    go get -u github.com\/Shopify\/kube-audit<\/p>\n

    \u7136\u540e\u5206\u6790\u5ba1\u8ba1\u65e5\u5fd7：<\/p>\n

    kube-audit -f \/var\/log\/kubernetes\/audit.log<\/p>\n

    \u5b9a\u671f\u5ba1\u8ba1\u6d41\u7a0b\u5efa\u8bae\u5305\u62ec：<\/p>\n

  • \u6bcf\u5468\u68c0\u67e5\u5ba1\u8ba1\u65e5\u5fd7\u4e2d\u7684\u654f\u611f\u64cd\u4f5c（\u5982\u8d44\u6e90\u5220\u9664\u3001\u89d2\u8272\u7ed1\u5b9a\u53d8\u66f4）\u3002<\/li>\n
  • \u6bcf\u6708\u5ba1\u67e5RBAC\u6743\u9650\u914d\u7f6e，\u786e\u4fdd\u6240\u6709\u8d26\u6237\u548c\u670d\u52a1\u8d26\u6237\u5747\u9075\u5faa\u6700\u5c0f\u6743\u9650\u539f\u5219\u3002<\/li>\n
  • \u6bcf\u5b63\u5ea6\u8fdb\u884c\u5168\u96c6\u7fa4\u5b89\u5168\u8bc4\u4f30，\u4f7f\u7528\u5de5\u5177\u5982kube-bench\u68c0\u67e5Kubernetes\u5b89\u5168\u914d\u7f6e\u3002<\/li>\n

    \u901a\u8fc7\u4ee5\u4e0a\u63aa\u65bd，\u53ef\u6709\u6548\u76d1\u63a7\u96c6\u7fa4\u4e2d\u7684\u6743\u9650\u4f7f\u7528\u60c5\u51b5，\u53ca\u65f6\u53d1\u73b0\u5e76\u963b\u6b62\u672a\u6388\u6743\u64cd\u4f5c\u3002<\/p>\n

    \u516d\u3001\u5b89\u5168\u52a0\u56fa\u7684\u6700\u4f73\u5b9e\u8df5<\/h4>\n

    \u5728Ubuntu\u4e0a\u90e8\u7f72Kubernetes\u96c6\u7fa4\u65f6，\u5e94\u9075\u5faa\u4ee5\u4e0b\u6700\u4f73\u5b89\u5168\u5b9e\u8df5：<\/p>\n

  • \n

    \u4f7f\u7528\u4e13\u7528\u7f51\u7edc：\u5c06\u96c6\u7fa4\u8282\u70b9\u90e8\u7f72\u5728\u4e13\u7528\u7f51\u7edc\u4e0a，\u907f\u514d\u76f4\u63a5\u66b4\u9732\u4e8e\u4e92\u8054\u7f51\u3002\u82e5\u5fc5\u987b\u901a\u8fc7\u5916\u7f51\u8bbf\u95eeAPI Server，\u5e94\u914d\u7f6e\u8d1f\u8f7d\u5747\u8861\u5668\u6216\u53cd\u5411\u4ee3\u7406，\u5e76\u901a\u8fc7IP\u767d\u540d\u5355\u9650\u5236\u8bbf\u95ee\u6765\u6e90\u3002<\/p>\n<\/li>\n

  • \n

    \u542f\u7528Pod\u5b89\u5168\u7b56\u7565（PSP）：\u867d\u7136Kubernetes 1.25+\u5df2\u5f03\u7528Pod\u5b89\u5168\u7b56\u7565API，\u4f46\u53ef\u901a\u8fc7\u51c6\u5165\u63a7\u5236\u5668（\u5982OPA Gatekeeper）\u5b9e\u73b0\u7c7b\u4f3c\u529f\u80fd，\u9650\u5236Pod\u7684\u7279\u6743\u64cd\u4f5c\u3002<\/p>\n<\/li>\n

  • \n

    \u4f7f\u7528\u52a0\u5bc6\u7684Secret：\u654f\u611f\u4fe1\u606f\u5982\u6570\u636e\u5e93\u5bc6\u7801\u3001API\u5bc6\u94a5\u7b49\u5e94\u4f7f\u7528Kubernetes Secret\u5b58\u50a8，\u5e76\u901a\u8fc7kubectl create secret\u547d\u4ee4\u521b\u5efa\u3002<\/p>\n<\/li>\n

  • \n

    \u5b9a\u671f\u66f4\u65b0\u7cfb\u7edf：\u4fdd\u6301Ubuntu\u7cfb\u7edf\u548cKubernetes\u7ec4\u4ef6\u7684\u6700\u65b0\u7248\u672c，\u53ca\u65f6\u4fee\u590d\u5df2\u77e5\u6f0f\u6d1e\u3002<\/p>\n<\/li>\n

  • \n

    \u4f7f\u7528\u5b89\u5168\u7684\u5bb9\u5668\u955c\u50cf：\u4ece\u53ef\u4fe1\u6765\u6e90\u83b7\u53d6\u5bb9\u5668\u955c\u50cf，\u5e76\u901a\u8fc7\u955c\u50cf\u626b\u63cf\u5de5\u5177（\u5982Trivy\u3001Clair）\u68c0\u67e5\u955c\u50cf\u5b89\u5168\u3002<\/p>\n<\/li>\n

  • \n

    \u5b9e\u65bd\u5b9a\u671f\u5907\u4efd：\u5bf9\u96c6\u7fa4\u5173\u952e\u6570\u636e（\u5982etcd\u3001\u8bc1\u4e66）\u8fdb\u884c\u5b9a\u671f\u5907\u4efd，\u786e\u4fdd\u5728\u51fa\u73b0\u5b89\u5168\u4e8b\u4ef6\u65f6\u80fd\u591f\u5feb\u901f\u6062\u590d\u3002<\/p>\n<\/li>\n

  • \n

    \u914d\u7f6e\u76d1\u63a7\u4e0e\u544a\u8b66：\u4f7f\u7528Prometheus\u548cGrafana\u76d1\u63a7\u96c6\u7fa4\u8fd0\u884c\u72b6\u6001，\u8bbe\u7f6e\u544a\u8b66\u89c4\u5219（\u5982\u5f02\u5e38API\u8c03\u7528\u3001\u8d44\u6e90\u4f7f\u7528\u5f02\u5e38）\u3002<\/p>\n<\/li>\n

  • \n

    \u4f7f\u7528\u7f51\u7edc\u7b56\u7565\u63d2\u4ef6：\u9664Calico\u5916，\u8fd8\u53ef\u8003\u8651\u4f7f\u7528Cilium\u7b49\u652f\u6301\u66f4\u590d\u6742\u7f51\u7edc\u7b56\u7565\u7684\u63d2\u4ef6，\u5b9e\u73b0\u4e1c\u897f\u5411\u6d41\u91cf\u63a7\u5236\u548c\u96f6\u4fe1\u4efb\u7f51\u7edc\u67b6\u6784\u3002<\/p>\n<\/li>\n\n\u5b89\u5168\u63aa\u65bd\u5b9e\u65bd\u6b65\u9aa4\u9884\u671f\u6548\u679c<\/tr>\n\n\n\n\n\n\n
    \u9632\u706b\u5899\u914d\u7f6e<\/td>\n\u4f7f\u7528UFW\u9650\u5236\u975e\u5fc5\u8981\u7aef\u53e3\u8bbf\u95ee<\/td>\n\u964d\u4f4e\u5916\u90e8\u653b\u51fb\u9762<\/td>\n<\/tr>\n
    TLS\u542f\u7528<\/td>\n\u901a\u8fc7kubeadm init\u914d\u7f6e\u8bc1\u4e66<\/td>\n\u786e\u4fdd\u63a7\u5236\u5e73\u9762\u901a\u4fe1\u5b89\u5168<\/td>\n<\/tr>\n
    \u7f51\u7edc\u7b56\u7565<\/td>\n\u90e8\u7f72Calico\u5e76\u914d\u7f6e\u5168\u5c40\u62d2\u7edd\u7b56\u7565<\/td>\n\u5b9e\u73b0Pod\u95f4\u901a\u4fe1\u9650\u5236\u548c\u547d\u540d\u7a7a\u95f4\u9694\u79bb<\/td>\n<\/tr>\n
    RBAC\u63a7\u5236<\/td>\n\u521b\u5efa\u6700\u5c0f\u6743\u9650\u89d2\u8272\u5e76\u5b9a\u671f\u5ba1\u8ba1<\/td>\n\u786e\u4fdd\u6743\u9650\u6700\u5c0f\u5316\u548c\u4f7f\u7528\u5408\u89c4<\/td>\n<\/tr>\n
    \u5ba1\u8ba1\u65e5\u5fd7<\/td>\n\u542f\u7528API Server\u5ba1\u8ba1\u65e5\u5fd7\u5e76\u5206\u6790<\/td>\n\u76d1\u63a7\u96c6\u7fa4\u64cd\u4f5c\u884c\u4e3a，\u53ca\u65f6\u53d1\u73b0\u5f02\u5e38<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    \u5b89\u5168\u52a0\u56fa\u662f\u4e00\u4e2a\u6301\u7eed\u7684\u8fc7\u7a0b，\u800c\u975e\u4e00\u6b21\u6027\u4efb\u52a1\u3002\u5efa\u8bae\u5efa\u7acb\u5b89\u5168\u8fd0\u7ef4\u7684SOP（\u6807\u51c6\u64cd\u4f5c\u6d41\u7a0b），\u5b9a\u671f\u66f4\u65b0\u5b89\u5168\u7b56\u7565，\u5e94\u5bf9\u4e0d\u65ad\u53d8\u5316\u7684\u5b89\u5168\u5a01\u80c1\u3002<\/p>\n

    \u4e03\u3001\u5b89\u5168\u52a0\u56fa\u540e\u7684\u96c6\u7fa4\u9a8c\u8bc1<\/h4>\n

    \u5b8c\u6210\u5b89\u5168\u52a0\u56fa\u540e，\u9700\u8fdb\u884c\u4ee5\u4e0b\u9a8c\u8bc1\u4ee5\u786e\u4fdd\u914d\u7f6e\u751f\u6548：<\/p>\n

  • \n

    \u9632\u706b\u5899\u89c4\u5219\u9a8c\u8bc1：\u4f7f\u7528ufw status\u67e5\u770b\u5f53\u524d\u89c4\u5219，\u786e\u8ba4\u4ec5\u5f00\u653e\u5fc5\u8981\u7aef\u53e3\u3002\u901a\u8fc7nc -zv <\u670d\u52a1\u5668IP> <\u7aef\u53e3>\u6d4b\u8bd5\u7aef\u53e3\u8fde\u901a\u6027，\u786e\u4fdd\u975e\u6388\u6743IP\u65e0\u6cd5\u8bbf\u95ee\u53d7\u9650\u7aef\u53e3\u3002<\/p>\n<\/li>\n

  • \n

    TLS\u901a\u4fe1\u9a8c\u8bc1：\u4f7f\u7528kubectl cluster-info\u68c0\u67e5API Server\u662f\u5426\u901a\u8fc7HTTPS\u8bbf\u95ee\u3002\u8bbf\u95eehttps:\/\/<API Server IP>:6443\u5e76\u68c0\u67e5\u8bc1\u4e66\u662f\u5426\u6709\u6548\u3002<\/p>\n<\/li>\n

  • \n

    \u7f51\u7edc\u7b56\u7565\u9a8c\u8bc1：\u521b\u5efa\u4e24\u4e2a\u6d4b\u8bd5Pod，\u5206\u522b\u4f4d\u4e8e\u4e0d\u540c\u547d\u540d\u7a7a\u95f4，\u5c1d\u8bd5\u76f8\u4e92\u8bbf\u95ee\u3002\u901a\u8fc7kubectl exec -it <pod\u540d\u79f0> — ping <\u76ee\u6807pod IP>\u6d4b\u8bd5\u901a\u4fe1\u662f\u5426\u88ab\u7b56\u7565\u963b\u6b62\u3002<\/p>\n<\/li>\n

  • \n

    RBAC\u6743\u9650\u9a8c\u8bc1：\u4f7f\u7528\u4e0d\u540c\u8d26\u6237\u5c1d\u8bd5\u6267\u884c\u654f\u611f\u64cd\u4f5c（\u5982\u521b\u5efa\u547d\u540d\u7a7a\u95f4\u3001\u5220\u9664\u8d44\u6e90），\u786e\u8ba4\u6743\u9650\u63a7\u5236\u662f\u5426\u751f\u6548\u3002<\/p>\n<\/li>\n

  • \n

    \u5ba1\u8ba1\u65e5\u5fd7\u9a8c\u8bc1：\u68c0\u67e5\u5ba1\u8ba1\u65e5\u5fd7\u6587\u4ef6\/var\/log\/kubernetes\/audit.log，\u786e\u8ba4\u5ba1\u8ba1\u4e8b\u4ef6\u662f\u5426\u88ab\u6b63\u786e\u8bb0\u5f55，\u5e76\u4f7f\u7528kube-audit\u5206\u6790\u65e5\u5fd7\u5185\u5bb9\u3002<\/p>\n<\/li>\n

    \u901a\u8fc7\u4ee5\u4e0a\u9a8c\u8bc1\u6b65\u9aa4，\u53ef\u786e\u4fdd\u5b89\u5168\u52a0\u56fa\u63aa\u65bd\u5df2\u6b63\u786e\u5b9e\u65bd，\u5e76\u4e3a\u540e\u7eed\u5b89\u5168\u8fd0\u7ef4\u5960\u5b9a\u57fa\u7840\u3002<\/p>\n

    \u516b\u3001\u7ed3\u8bba\u4e0e\u5efa\u8bae<\/h4>\n

    \u5728Ubuntu\u7cfb\u7edf\u4e0a\u90e8\u7f72Kubernetes\u96c6\u7fa4\u65f6，\u5916\u7f51IP\u7684\u5b58\u5728\u589e\u52a0\u4e86\u5b89\u5168\u98ce\u9669，\u9700\u91c7\u53d6\u591a\u5c42\u6b21\u5b89\u5168\u9632\u62a4\u63aa\u65bd\u3002\u4ece\u7cfb\u7edf\u9632\u706b\u5899\u5230TLS\u901a\u4fe1，\u518d\u5230\u7f51\u7edc\u7b56\u7565\u548cRBAC\u6743\u9650\u63a7\u5236，\u6bcf\u4e00\u5c42\u90fd\u81f3\u5173\u91cd\u8981\u3002\u751f\u4ea7\u73af\u5883\u4e2d\u5e94\u9075\u5faa\u6700\u5c0f\u6743\u9650\u539f\u5219，\u5b9a\u671f\u8fdb\u884c\u5b89\u5168\u5ba1\u8ba1\u4e0e\u76d1\u63a7，\u786e\u4fdd\u96c6\u7fa4\u5b89\u5168\u3002<\/p>\n

    \u5efa\u8bae\u5728\u90e8\u7f72Kubernetes\u96c6\u7fa4\u524d，\u5148\u5b8c\u6210\u57fa\u7840\u7cfb\u7edf\u5b89\u5168\u52a0\u56fa，\u5305\u62ec\u7981\u7528Swap\u3001\u914d\u7f6eNTP\u540c\u6b65\u65f6\u95f4\u7b49\u3002\u7136\u540e，\u901a\u8fc7UFW\u9632\u706b\u5899\u9650\u5236\u975e\u5fc5\u8981\u7aef\u53e3\u8bbf\u95ee，\u4ec5\u5f00\u653eAPI Server\u7b49\u5fc5\u9700\u7aef\u53e3\u3002\u521d\u59cb\u5316\u96c6\u7fa4\u65f6，\u542f\u7528TLS\u5b89\u5168\u901a\u4fe1，\u5e76\u8bbe\u7f6e\u5f15\u5bfctoken\u6709\u6548\u671f\u3002\u90e8\u7f72\u7f51\u7edc\u7b56\u7565\u63d2\u4ef6\u5982Calico，\u5b9e\u65bdPod\u95f4\u901a\u4fe1\u9650\u5236\u548c\u547d\u540d\u7a7a\u95f4\u9694\u79bb\u3002\u6700\u540e，\u914d\u7f6eRBAC\u6743\u9650\u63a7\u5236，\u9650\u5236\u9ed8\u8ba4\u8d26\u6237\u6743\u9650，\u5efa\u7acb\u5b9a\u671f\u5ba1\u8ba1\u4e0e\u65e5\u5fd7\u5206\u6790\u6d41\u7a0b\u3002<\/p>\n

    \u5b89\u5168\u9632\u62a4\u4e0d\u5e94\u4ec5\u505c\u7559\u5728\u914d\u7f6e\u5c42\u9762，\u800c\u5e94\u5f62\u6210\u6301\u7eed\u7684\u5b89\u5168\u8fd0\u7ef4\u6587\u5316\u3002\u5efa\u8bae\u5b9a\u671f\u53c2\u52a0\u5b89\u5168\u57f9\u8bad，\u5173\u6ce8Kubernetes\u5b89\u5168\u52a8\u6001，\u53ca\u65f6\u66f4\u65b0\u5b89\u5168\u7b56\u7565\u3002\u540c\u65f6，\u5efa\u7acb\u5b89\u5168\u4e8b\u4ef6\u54cd\u5e94\u673a\u5236，\u786e\u4fdd\u5728\u51fa\u73b0\u5b89\u5168\u95ee\u9898\u65f6\u80fd\u591f\u5feb\u901f\u5e94\u5bf9\u548c\u6062\u590d\u3002<\/p>\n

    \u8bf4\u660e：\u62a5\u544a\u5185\u5bb9\u7531\u901a\u4e49AI\u751f\u6210，\u4ec5\u4f9b\u53c2\u8003\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"

    \u6587\u7ae0\u6d4f\u89c8\u9605\u8bfb546\u6b21\uff0c\u70b9\u8d5e3\u6b21\uff0c\u6536\u85cf6\u6b21\u3002\u5728Ubuntu\u7cfb\u7edf\u4e0a\u90e8\u7f72Kubernetes\u96c6\u7fa4\u65f6\uff0c\u82e5\u670d\u52a1\u5668\u62e5\u6709\u5916\u7f51IP\uff0c\u9700\u91c7\u53d6\u591a\u5c42\u6b21\u5b89\u5168\u9632\u62a4\u63aa\u65bd\u4ee5\u786e\u4fdd\u96c6\u7fa4\u5b89\u5168\u3002\u672c\u65b9\u6848\u901a\u8fc7\u7cfb\u7edf\u9632\u706b\u5899\u914d\u7f6e\u3001TLS\u901a\u4fe1\u542f\u7528\u3001\u7f51\u7edc\u7b56\u7565\u5b9e\u65bd\u548cRBAC\u6743\u9650\u63a7\u5236\u56db\u4e2a\u6838\u5fc3\u5c42\u9762\uff0c\u6784\u5efa\u5b89\u5168\u7684Kubernetes\u73af\u5883\u3002\u5b89\u5168\u9632\u62a4\u4e0d\u5e94\u4ec5\u505c\u7559\u5728\u5355\u70b9\u63aa\u65bd\uff0c\u800c\u5e94\u5f62\u6210\u7eb5\u6df1\u9632\u5fa1\u4f53\u7cfb\uff0c\u4ece\u7269\u7406\u4e3b\u673a\u5230\u96c6\u7fa4\u63a7\u5236\u9762\u518d\u5230\u5e94\u7528\u5c42\u8fdb\u884c\u5168\u9762\u4fdd\u62a4\u3002\u5728\u751f\u4ea7\u73af\u5883\u4e2d\uff0c\u9700\u786e\u4fdd\u6240\u6709\u5b89\u5168\u914d\u7f6e\u5747\u7b26\u5408\u6700\u5c0f\u6743\u9650\u539f\u5219\uff0c\u5e76\u5b9a\u671f\u8fdb\u884c\u5ba1\u8ba1\u4e0e\u76d1\u63a7\u3002Ubuntu\u670d\u52a1\u5668\u4f5c\u4e3aKubernetes\u96c6\u7fa4\u8282\u70b9\uff0c\u5176\u57fa\u7840\u7cfb\u7edf\u5b89\u5168\u81f3\u5173\u91cd\u8981\u3002\u9996\u5148\uff0c\u9700\u786e\u4fdd\u7cfb\u7edf\u65f6\u95f4\u540c\u6b65\uff0c\u8fd9<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[120,103,61],"topic":[],"class_list":["post-33387","post","type-post","status-publish","format-standard","hentry","category-server","tag-kubernetes","tag-ubuntu","tag-61"],"yoast_head":"\nUbuntu K8s\u96c6\u7fa4\u5b89\u5168\u52a0\u56fa\u65b9\u6848 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/33387.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Ubuntu K8s\u96c6\u7fa4\u5b89\u5168\u52a0\u56fa\u65b9\u6848 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"\u6587\u7ae0\u6d4f\u89c8\u9605\u8bfb546\u6b21\uff0c\u70b9\u8d5e3\u6b21\uff0c\u6536\u85cf6\u6b21\u3002\u5728Ubuntu\u7cfb\u7edf\u4e0a\u90e8\u7f72Kubernetes\u96c6\u7fa4\u65f6\uff0c\u82e5\u670d\u52a1\u5668\u62e5\u6709\u5916\u7f51IP\uff0c\u9700\u91c7\u53d6\u591a\u5c42\u6b21\u5b89\u5168\u9632\u62a4\u63aa\u65bd\u4ee5\u786e\u4fdd\u96c6\u7fa4\u5b89\u5168\u3002\u672c\u65b9\u6848\u901a\u8fc7\u7cfb\u7edf\u9632\u706b\u5899\u914d\u7f6e\u3001TLS\u901a\u4fe1\u542f\u7528\u3001\u7f51\u7edc\u7b56\u7565\u5b9e\u65bd\u548cRBAC\u6743\u9650\u63a7\u5236\u56db\u4e2a\u6838\u5fc3\u5c42\u9762\uff0c\u6784\u5efa\u5b89\u5168\u7684Kubernetes\u73af\u5883\u3002\u5b89\u5168\u9632\u62a4\u4e0d\u5e94\u4ec5\u505c\u7559\u5728\u5355\u70b9\u63aa\u65bd\uff0c\u800c\u5e94\u5f62\u6210\u7eb5\u6df1\u9632\u5fa1\u4f53\u7cfb\uff0c\u4ece\u7269\u7406\u4e3b\u673a\u5230\u96c6\u7fa4\u63a7\u5236\u9762\u518d\u5230\u5e94\u7528\u5c42\u8fdb\u884c\u5168\u9762\u4fdd\u62a4\u3002\u5728\u751f\u4ea7\u73af\u5883\u4e2d\uff0c\u9700\u786e\u4fdd\u6240\u6709\u5b89\u5168\u914d\u7f6e\u5747\u7b26\u5408\u6700\u5c0f\u6743\u9650\u539f\u5219\uff0c\u5e76\u5b9a\u671f\u8fdb\u884c\u5ba1\u8ba1\u4e0e\u76d1\u63a7\u3002Ubuntu\u670d\u52a1\u5668\u4f5c\u4e3aKubernetes\u96c6\u7fa4\u8282\u70b9\uff0c\u5176\u57fa\u7840\u7cfb\u7edf\u5b89\u5168\u81f3\u5173\u91cd\u8981\u3002\u9996\u5148\uff0c\u9700\u786e\u4fdd\u7cfb\u7edf\u65f6\u95f4\u540c\u6b65\uff0c\u8fd9\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/33387.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2025-04-27T03:23:14+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/33387.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/33387.html\",\"name\":\"Ubuntu K8s\u96c6\u7fa4\u5b89\u5168\u52a0\u56fa\u65b9\u6848 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2025-04-27T03:23:14+00:00\",\"dateModified\":\"2025-04-27T03:23:14+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/33387.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/33387.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/33387.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Ubuntu K8s\u96c6\u7fa4\u5b89\u5168\u52a0\u56fa\u65b9\u6848\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Ubuntu K8s\u96c6\u7fa4\u5b89\u5168\u52a0\u56fa\u65b9\u6848 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/33387.html","og_locale":"zh_CN","og_type":"article","og_title":"Ubuntu K8s\u96c6\u7fa4\u5b89\u5168\u52a0\u56fa\u65b9\u6848 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"\u6587\u7ae0\u6d4f\u89c8\u9605\u8bfb546\u6b21\uff0c\u70b9\u8d5e3\u6b21\uff0c\u6536\u85cf6\u6b21\u3002\u5728Ubuntu\u7cfb\u7edf\u4e0a\u90e8\u7f72Kubernetes\u96c6\u7fa4\u65f6\uff0c\u82e5\u670d\u52a1\u5668\u62e5\u6709\u5916\u7f51IP\uff0c\u9700\u91c7\u53d6\u591a\u5c42\u6b21\u5b89\u5168\u9632\u62a4\u63aa\u65bd\u4ee5\u786e\u4fdd\u96c6\u7fa4\u5b89\u5168\u3002\u672c\u65b9\u6848\u901a\u8fc7\u7cfb\u7edf\u9632\u706b\u5899\u914d\u7f6e\u3001TLS\u901a\u4fe1\u542f\u7528\u3001\u7f51\u7edc\u7b56\u7565\u5b9e\u65bd\u548cRBAC\u6743\u9650\u63a7\u5236\u56db\u4e2a\u6838\u5fc3\u5c42\u9762\uff0c\u6784\u5efa\u5b89\u5168\u7684Kubernetes\u73af\u5883\u3002\u5b89\u5168\u9632\u62a4\u4e0d\u5e94\u4ec5\u505c\u7559\u5728\u5355\u70b9\u63aa\u65bd\uff0c\u800c\u5e94\u5f62\u6210\u7eb5\u6df1\u9632\u5fa1\u4f53\u7cfb\uff0c\u4ece\u7269\u7406\u4e3b\u673a\u5230\u96c6\u7fa4\u63a7\u5236\u9762\u518d\u5230\u5e94\u7528\u5c42\u8fdb\u884c\u5168\u9762\u4fdd\u62a4\u3002\u5728\u751f\u4ea7\u73af\u5883\u4e2d\uff0c\u9700\u786e\u4fdd\u6240\u6709\u5b89\u5168\u914d\u7f6e\u5747\u7b26\u5408\u6700\u5c0f\u6743\u9650\u539f\u5219\uff0c\u5e76\u5b9a\u671f\u8fdb\u884c\u5ba1\u8ba1\u4e0e\u76d1\u63a7\u3002Ubuntu\u670d\u52a1\u5668\u4f5c\u4e3aKubernetes\u96c6\u7fa4\u8282\u70b9\uff0c\u5176\u57fa\u7840\u7cfb\u7edf\u5b89\u5168\u81f3\u5173\u91cd\u8981\u3002\u9996\u5148\uff0c\u9700\u786e\u4fdd\u7cfb\u7edf\u65f6\u95f4\u540c\u6b65\uff0c\u8fd9","og_url":"https:\/\/www.wsisp.com\/helps\/33387.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2025-04-27T03:23:14+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"6 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/33387.html","url":"https:\/\/www.wsisp.com\/helps\/33387.html","name":"Ubuntu K8s\u96c6\u7fa4\u5b89\u5168\u52a0\u56fa\u65b9\u6848 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2025-04-27T03:23:14+00:00","dateModified":"2025-04-27T03:23:14+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/33387.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/33387.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/33387.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"Ubuntu K8s\u96c6\u7fa4\u5b89\u5168\u52a0\u56fa\u65b9\u6848"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/33387","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=33387"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/33387\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=33387"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=33387"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=33387"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=33387"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}