From 947a0b085fb169c3bbdb424c2b01306c0f724f2b Mon Sep 17 00:00:00 2001 From: Merlin-Xie Date: Thu, 16 Oct 2025 11:10:40 +0800 Subject: [PATCH] feat: init commit --- images/image1.png | Bin 0 -> 5743 bytes images/image2.png | Bin 0 -> 1663 bytes nfs系统创建指南.md | 51 ++++++++++++ rke2集群搭建指南.md | 77 ++++++++++++++++++ ssh公私钥配置.md | 8 ++ 利用scp和ssh实现中转服务器证书配置自动同步.md | 68 ++++++++++++++++ 远程节点加入指南.md | 37 +++++++++ 7 files changed, 241 insertions(+) create mode 100644 images/image1.png create mode 100644 images/image2.png create mode 100644 nfs系统创建指南.md create mode 100644 rke2集群搭建指南.md create mode 100644 ssh公私钥配置.md create mode 100644 利用scp和ssh实现中转服务器证书配置自动同步.md create mode 100644 远程节点加入指南.md diff --git a/images/image1.png b/images/image1.png new file mode 100644 index 0000000000000000000000000000000000000000..4c1984e85d2ad403472bdca4ad6fd6380d6b6e5f GIT binary patch literal 5743 zcmY*dcQ_p0(q{D`s%robm_nlZh9d$Bd24XBMEHX_E6$30RoVq`Ec0$0P6W?+m z3=4}^TvJ8SCLQZ_`pt1CakjlsLz@zI^x#mvP;^cL>L((4tLTq>B?zg@pkh}c|+jn5^X zZ`x%r@m~~hd+FDzd8ReA-%;zbi|)u%3)L|1h&{b?{5HA}g-{7t1J z9q=WT>sBuRa7%NFh36O{;w#N&+7ijveRi(WaRcH0dQr)ByzDP0Apbj|-()t)Hsc;| z4gHa2X*>Qg0g;SCX^$qnb3Wk>!g==8WV?B+B=GG8mQ_Hvx9ShfYy_;Gh*Sdpv)jV9 zdaNbkyHvJc=HEi@S0biiX2VL-{O5J|RL`kZ+!(l&y!-`(N@~h*ZlY)Py3Q};^4kvk z6^HwxGOlOI!|kj|z|pGH&T!*6X}NUg)Z@e1ibyeRgt8fj#2xaQ6}MWX)GnYdW*0}X zJX{KuCjtoj4Gv*W^5v1s(;@iM`B+f)r7ZgG+ZK0|p5PK5(+Ce9O}CVu^Y}NJ*y$48 z{H5X$J>dX7(@7yXv&^E3%yR%NCQ2E*Hm>8FMw?bpGpEh8$&8FHqOqA>dX)BV$Yv8; zdmwL)%<5&jdo$`YzJdG}lolqg{jjn%?@16t;F40O-pxlA1TgfQ6Jdq}1ia2OPQx@O zVSe8MW!rr2h`_aH6iFD$lW)COS~wO&n@07!+uAoy5^9U!S-z(NPQ+TKAN`2u_jk znJTSw_JdLe=_>oh)%Ti|&x$Gq<*NkdxgPrF^^<_R*9NxWZK=;HhrsXZh|~9~MCUoo zrq}3F6%+X4uyr}{|~rGLTA0l6<+R+Ag4F>nyiybFamxWzTvYaD4-C7L%*e zm|O34ONQ9gS&^y)<@WXa%CGDhr1Z5rBd|l?RDCT6CVD4|!eN}ArE8#uBmBU!F@e8- z#}riS$2EKwxGUyacaISo-cR10xbOq$UaaJO z`(pr{@Unlo|Ak2!{P&Us=mbBhw?OB$RO@`oE-4D^Zaa+U+@U9UjEyi>hYp*OiB;)Q z7RXrP4s<~t(U9Z&oIsv@!&%~;Z({GFB zDraTBe96pVX0eoU{)2*qIIvq1e|0QhT_j7$hTKda0P`?ktmA!$ZXf>-0@qd`eg)cJ zKZqBwxDb3hYdW`cp;2ZSF-$78czPDwgH+JjzCNa5FO-;w$MzP*Pt_yRF(?YVXi}Ht zidWzT8@?iRy-ziGSf&571cM$M0q?LU-RQ#5(ry{uz3%01oQ-6oQPjV3 zoyL3 zFeRfhpAkMfhy&+Ri~Qn1E0Gtx>-7bsT|TPtb8wkg+D8w=!gVA`MNoV#POkNfjj#=X zQ8x}Bs9B|cd~f@y<5GI4DlyEYf;FAUh0t~C)OA~jN&j>v%|ZyjxB6W%jg;i8QsOmO zw0HWq+Qi{1ZNC>4#sl_>=gK(WFb{4W2W!bQitIxhG~oK6owRNglfGiyD3F))q1a`u zxlwRJVAbk}r2VN-(|m^0T4;b=&~8K4;DyGQjy_X`*)hKXf^_>CDJOB8 zg9D+}fRL(Z;?hp_2gHa3QzWp@Cf3}#8y9DnGg+da<;Rkmcl$v>vMqS@Q7~VSj(hUz zc6j$#LFs`gW#)vzm0~8K=zdI#nhUlUGDw5-7|C=*rUrPot$*z*y^#ogNHOYz2$4j5 z$0J%W!**z6vg7(x99&eiPz8szHZqk4OL@lz&?rMBeIh9QM%^Q(XH{lc@xufAPvg zH-W{Y{0sLvBUXKSTC9bipP?&u{vrS)vB!L@#N6Hvrt?Z}UT$%Rp5u-b-C}%M0RHW% zUKHE(AHH(!gco+IgD$|k*aTgF@42mShFS6+0P(gax)1D@9c&p(|5NCH=FPK+#ZKy) zu;cFS6RkgdBph&A9CD{d_4%^tzi*h!5jBgkEd8BD77>4k)L)~{JsP;8Uj764H^9H9 zpi*HmRzCP7=hgpbPgMvGnyn{?97Z0H|MjA4vLv#H(!J3#THSxU@n&Y^4&k<0AOSr~ z)D)A?hmMH|^6p7Arl)=T%BWCa8$wWe+Q@TZC6Wp5^9ua{$XyNF91mlkzZVr2FZD$V z6-bQ9lJEkUzMbvuU=K0KXFXn~ZIg8N2y?0`F%s`eS;ySD8R&GzT>JQpYu~cX81KCb zw1@i_Z6?Os3@s(Py^hghdNpt1$@m@8XO-GToKZfXcXU6C2c>qpu|-k|*dz{+eJU&D&NQ}w^vAx1{1$^hQeBCU-!q&}F(}B!eq+e;rx9!ej*o#ci z(Lz@^xMv0Ce#7ngbz1yu@2YtERmAZ-nLuv+zNU$vrE3zg*^CO>QCvy4&&12g4ki3r_)=!t@Qr{7CkQGxshhN z($ReLJ*dmGu=B;2FgF~kU(4T_BWqw-cS`=iteDa#4#T;Kk*F%c{kSfGVUEa#?zy~s z=ZK_tzh9EUKAU_txaM%am3m@N?#%|9Ncy`R7Lfz|lL$4rM}_u z2YyznhCpQPfdNwS8*v|9E1f)aBur7-L>0)2+} zU)3GDQ9_eFw)s7PKx==m&BkXtXkMMOD7?VuL=4uNUBGzCC zU;8BUdLE=P*faL({cuYWC0Z_}pX(@#t!EmZ=N9~`t&2LTf<-S~_km9>Q!1968FNAk zbcjlof4&H+qQT!EJDTc#=xD$V>ZkY?VG*%qZC}@qQbURy(J3+cY=~s?B>QqaiTMDA z9!V>8Ya4H1y>K+RAavfwY%O`qR8)*oKlY=IHT!rgtV>Q8)B25@Njlc=<1|hm)LDxS z%O)z;^cwH+i!j44+A{E(++9~yiJ$^5vo>2Tv=E9$jc(C(4mO~mY+d%CsptcWP0S(W zOx4s$bf1*riE7?N^r;36*c*^bG4BhYuOu3zG5w5iu{B9UP;78EdbJ(HaN4%6M7W9k z)gFD|FHsX1pnI%NJzv(`wJkUZl%4EY5!g`S)UV$U@5kcK{9Q*WyTz12fc2uoJ;aZI zw0e4~D{Dk3WP4cjF&RZ3B=yxt;b#X2;6L>9SlB+ynEWPhu6#`i?1KFZf`Y2kg@4TD}ubapb{)au&Pi*;HUYJ2gr_8AlrbhahpJXb%E>@b}sj!Tb3y{F5mtEYlMQqt$% zrvHoyY4DGHA2w-FswqA(ZVl&Y#a7Q*`5tGGKwk){N%zf$BD;{XzGE}g+}OTz@~=Y} zQgb>^`M<>-IuaY`+mwfts({j6LeEIXlz63*@;ED13Vdy%9)5NQuC)67WMFjQ6NFe% z(Ovif1sUQY3|xcmopj3RC!c=RntWyRrPie3mMrCw2FgNRUI&~or^FNk1EmZ%m5K5B z@5G7y*GI@ai6$c|&o++opS-Z1MM=xqLuWjTfepq#9*Nv?2lxfkXpReSy7>6n0M>>343V9U(_y_ z8$y?_2QRjAGkVK>pD&>kdoY>opLw*-#a%FvFofY*lghwHvq&G*&!3ur3JWHp9Jl6@ z&+;iQf=I9l&$%#RQpVWy`&m`HJlkv|yRQseqsb(FI$f3`Z7ZcumX}pVA_y{ixXj#( zAMJ5Gs5CNiqZ**zIChj4TPh*=jv^QrB`ABeCMvzaEL@7`tV%@nyJ7WF;CN*av-SY{ z($?gYACVo{K~l3;AAWne37B^w@OY)pf=z`q77sfVttt3seQaRuLs{|iZhH#pfOW{j zATz)W?nJaD0J)@RHylZt>9RM#L7YlHsifKvdVl0{x4bVVZL{o*qI1@WgXnmwMT}`J z*Z?wQ^Yod6eu#^W;M~hUkl|O-2-(5&k#=T=tQS*^&d`L~wa$Qg?F}igpjNZ0!(&?c&e2XE+^lGb z7L^@;o&5ZO{EEPPj&|+t$SK=>o}DsP7kvtrF^D#r*YIm5b$j|Fy>s3A)H6CCpdYoq z1;ZaEW404ET#T2McA1NqKh%m1$G;vfek}=0T8x?4Mm%xINu@=C1A4wW7beepNVW9q zZI&h++LKSN8cGK6xvRNFnCml8`{XgTvtHxPwVq zsb5w7WQzofudh7wPk-v`GLBcBQ9P*c)x+R2&gNX8+8CeP8#ZO1$*y1OJmwlVTexi3 zH3qA=13_d9q-!oMbNl#4B$k7T?Lh=dPH@WH*8Gt@w@JSN*EJ%`Y?b#3Mb7s@oB;lz zoWctQ0kNSMFAe=RhJD2O1hMm5vawTf6?J4(^T&AHI;pZwEzw3&^MDiPJhSD&Q zejTwAA@Wr*hw#&qeNkj29yyZcJs(r9^+ucR3CBkrc&MG<!N<~ec=sx1kq&6=%HzL@UgNbU6-~*I0bRc**-!ij~PXh!q zNHEuD$CVQ&?`yb+^xR85>c{A((WEZr!4st>#d4K&*F-x7_?=xd0hWbRAZOE&*S7&< zSJc5|^uq`?HF_G6$%AN zd65RJ$TP(-HnMgk_o#A&+*y9j;PpG8ARkE4|D`sT;%3{*xfpyPm+3BDHrlw(Elt&I zs$~!L*HV$u<&6<%qzsd#P)6Ya5%;?pR?H6XM0UqCDkzVIk|)PHd!BN0K`R8^xpD zptTGVggrEqpYepFO5AXhuyMlmK{)yjaMVleZ#7f{XB3zKdL_KgV;Qv#YOAcJtagj_ zNKyxPgsz5Lj%HG_47PE1sslNHU`?XU=6pp!+8 zk1sRJCCvv;P$|%`SU6&`QK|!#0xW@lK$;zgAYS$U%1dnm^Ig3+ewJG|Wj#SIg*7j^V4c#jJn0If-)a~VNGoN?Dt4}upC-rA^N@*|J4<%^M z2LtUdyKsj07L$)V9YW(+3%ZXx)vw%kR}KyWw>r`J@Bo|^fOnz7vlDLxSH)$+ApWhu zSL(BgWGUET}l6R8xQ~zD{{!uaqy4(lyk`lbf VS6b_}e-_DDnyNY~)k?OJ{{py<5wHLN literal 0 HcmV?d00001 diff --git a/images/image2.png b/images/image2.png new file mode 100644 index 0000000000000000000000000000000000000000..a9965f7328fc041263f82dbb5d1b1b25bd8f1e66 GIT binary patch literal 1663 zcmV-_27vjAP)F*RNxZ|%=haPs?VHLfvLb13jE&p>+xJ) z%l!%s4Fj0><+aLqK5YB%X1kc0og4>gAJ26?RkmW5)G5*B8kU*I(*}f?`Io$B+O(O1fDSuF>S+U3HapuwSh#?w0*QI$hQp~ zdZPC~7)GtQqvZ!m&&_cBklx|R5(x0ouDb2KUx#rH%1`V{%+aYI#625+UtT4RgXv1Q zj7imAeOX7CF8j!(WW8l{n5EnBG?TYOqFZyh_9@}#45L=O>{Ko(jZWdY#M{U=`E_CE zklx|RWwA)l6Tcaqe7^|ax{u0e7nCO7b%Vk$==PRLDC!uc|N>T z7k(QL-(v&@%5H%qsPUGwyA&R?nH`!~Iyp4DFuUwpyLcx|Aj3~w0NRQ(L{v-Sy_S3L z>1YA7teqg$LqG)DQkk*}dLyLDYz{8m9Gy}57st_I+wxerarn;6>?Y_p7Q#7dJCUp#KdGh_bN&9ip)*QYi zT{+|cc_bz6CL?WS&iCc1f1WZ-g4FlKtW~(=D}PcT+JMguD{Nun5k}do?xeT~LMxSn z=8Z$4(ygprm_*FRE*cqJQxQDMt0?JlP?XZkS82wN0+urRvWKHx(hBboL3U19tGzPmOTqM z1{>LnyuB->Q5NCW(oN$55&BS|4>kgH=fitLm8#k$Tfh`kha8INAG{bIR$_8;xFhYCXS4UGVnLIQ{g42fS~+KZ_(zY9i?p zwwjh9yFBENT>o> z$*tifJ9=YnL$Q)4un8(G47)K&vF4%h%_1KGjTmWj=-072A%9f^U;wEC5~~;yx8q(| z`9%z(YO+PR=)c5Tnnwv@u(o!jaj#x!4-7CXN_K{LzRE)#R8;dgWgV~@v1qM;bU&gDtT`Y} za}>|5=D)O1sU@u_2}*2J zvISUSISv<)Z~t_;h`(E|JhIWs%t>RodOB<95Z&MSy4R~goZ2ZGsvaxz5p!X3p+fwx zJOyI&tDm~ybL;(r)BiGgN5{Sc^SIvc$o>w@;}uQMslW*Ze%1SRLYL_}6_^VAd中转服务器nginx反代-->wireguard-->rke2集群网关nginx + +因为有中转,tls握手需要在nginx实现一次; +因为有wireguard(自己会加密),所以tls可以终止与中转服务器nginx; + +通过搜索资料得知,这样也可以实现自动化,利用scp和ssh,创建一个pod监听tls证书生成 + +然后分成nginx需要的pem和key,连同server配置块一同上传到中转服务器 + +scp需要登录用户对文件夹有写入权限,这一点有时候比较难注意到 +因此推荐使用sudo tee的方式,这样可以在服务器配置该用户sudo某些指令不需要使用密码,ssh连接使用bash,更加方便 + + +**操作** +使用预先创建的ssh密钥或者让pod自己生成ssh密钥 + +自己创建的密钥,打包进入容器后记得设置权限(私钥600,公钥644),否则ssh-server不会使用 +上传例如这样: +``` + ssh_command = [ + "ssh", f"{NGINX_USER}@{NGINX_HOST}", + f"sudo tee {remote_file} > /dev/null" + ] +``` + +编写好脚本后在服务器运行,我使用tls-sync.yaml创建了一个pod,为了使pod有权限监听全部命名空间,需要创建一个serviceAccount并绑定pod +``` +# serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: secret-watcher + namespace: basic +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: secret-watcher-role +rules: + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "list", "watch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: secret-watcher-binding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: secret-watcher-role +subjects: + - kind: ServiceAccount + name: secret-watcher + namespace: basic + +``` +namespace替换成pod运行的位置 + +使用kubectl apply应用serviceaccount.yaml和tls-sync.yaml + +确保pod正常运行后,及时将ssh密钥处理好,然后进入容器手动进行一次ssh连接以信任并保存指纹 + +至此,监听程序正常运行 \ No newline at end of file diff --git a/远程节点加入指南.md b/远程节点加入指南.md new file mode 100644 index 0000000..746df4e --- /dev/null +++ b/远程节点加入指南.md @@ -0,0 +1,37 @@ +# 基于本地k3d创建的集群的远程节点加入操作指南 + +**准备工作** + +1、远程节点主机安装k3s + +``` +curl -sfL https://get.k3s.io | sh - +``` + +-sfl可以不要 + +2、获取节点密钥node-token + +一般k3d任意节点都有,建议server节点查看 + +在/var/lib/rancher/k3s/server/node-token + + + +**执行命令** + +``` +curl -sfL https://get.k3s.io | K3S_URL=https://:6443 K3S_TOKEN='' sh -s - agent --node-name +``` + +等待执行结束,k3s-agent服务启动成功即可 + + + + + +tips: + +执行命令这一步大概率需要梯子,如果该节点主机自己配置了vpn,那就再终端export一下就好 + +如果没有的话,参考”利用反向隧穿使用宿主机vpn“