From d3b36cf63da8436fee4fdba1602903ae001d9f62 Mon Sep 17 00:00:00 2001 From: wangbo Date: Sat, 1 Aug 2026 09:51:03 +0800 Subject: [PATCH] =?UTF-8?q?fix(cluster):=20=E4=BF=9D=E7=95=99=E6=B7=B1?= =?UTF-8?q?=E5=9C=B3=E5=8E=9F=E6=9C=89=20UFW=20=E9=98=B2=E7=81=AB=E5=A2=99?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 移除会与 UFW 冲突的 iptables-persistent 安装，改由 UFW 持久化 WireGuard、kubelet、Flannel 和 NodePort 规则。\n\n预检新增 UFW 已安装且处于 active 的硬门禁，避免包管理器切换防火墙后保留 DROP 默认策略并中断远程接入。\n\n已通过 bash -n、ShellCheck 和差异检查。 --- docs/operations/k3s-ha-runbook.md | 3 +- scripts/cluster/add-shenzhen-worker-node.sh | 36 +++++++++------------ 2 files changed, 17 insertions(+), 22 deletions(-) diff --git a/docs/operations/k3s-ha-runbook.md b/docs/operations/k3s-ha-runbook.md index 60a17fd..4bb4016 100644 --- a/docs/operations/k3s-ha-runbook.md +++ b/docs/operations/k3s-ha-runbook.md @@ -21,7 +21,8 @@ CloudNativePG；洛杉矶只作为 K3s server/etcd 仲裁节点，并带 本地 `.env.local` 只保存 `AI_GATEWAY_SHENZHEN_HOST` 和 SSH 接入密码，必须保持 `0600` 且 不得进入 Git。深圳已有宿主机服务时，接入脚本保留其公开端口，只封锁 K3s API、kubelet、 -VXLAN 和除既有 `31058` 外的 NodePort 公网入口。 +VXLAN 和除既有 `31058` 外的 NodePort 公网入口。深圳防火墙继续由原有 UFW 管理，接入脚本 +禁止安装与 UFW 冲突的 `iptables-persistent`；UFW 未安装或未启用时必须在预检阶段停止。 生产上线前的双节点高媒体负载、Worker 强杀和 P24/P28/P32 容量搜索见 [生产同构验收模式与高媒体压力测试](production-acceptance.md)。 diff --git a/scripts/cluster/add-shenzhen-worker-node.sh b/scripts/cluster/add-shenzhen-worker-node.sh index e6d86f5..94460b1 100755 --- a/scripts/cluster/add-shenzhen-worker-node.sh +++ b/scripts/cluster/add-shenzhen-worker-node.sh @@ -50,6 +50,8 @@ available_bytes=$(df -B1 --output=avail / | tail -n 1 | tr -d ' ') (( available_bytes >= 20 * 1024 * 1024 * 1024 )) timedatectl show -p NTPSynchronized --value | grep -Fxq yes [[ ! -e /etc/rancher/k3s/config.yaml || -f /etc/rancher/k3s/config.yaml ]] +command -v ufw >/dev/null +ufw status | grep -Fqx 'Status: active' printf 'shenzhen_worker_preflight=PASS cpu=%s memory_available_mib=%s disk_available_gib=%s\n' \ "$(nproc)" "$((available_kib / 1024))" "$((available_bytes / 1024 / 1024 / 1024))" REMOTE @@ -230,28 +232,20 @@ node-taint: - easyai.io/worker-only=true:NoSchedule EOF chmod 0600 /etc/rancher/k3s/config.yaml /etc/rancher/k3s/registries.yaml -export DEBIAN_FRONTEND=noninteractive -if ! command -v netfilter-persistent >/dev/null 2>&1; then - apt-get update -qq - apt-get install -y -qq iptables-persistent -fi -ensure_rule() { - if ! iptables -C INPUT "$@" 2>/dev/null; then iptables -I INPUT 1 "$@"; fi -} public_interface=$(ip -o route get 1.1.1.1 | awk '{for(i=1;i<=NF;i++) if($i=="dev"){print $(i+1); exit}}') -ensure_rule -i wg0 -s 10.77.0.0/24 -p tcp -m multiport --dports 6443,10250 \ - -m comment --comment easyai-k3s-private -j ACCEPT -ensure_rule -i wg0 -s 10.77.0.0/24 -p udp --dport 8472 \ - -m comment --comment easyai-flannel-private -j ACCEPT -ensure_rule -i "$public_interface" -p tcp -m multiport --dports 6443,10250 \ - -m comment --comment easyai-k3s-public-drop -j DROP -ensure_rule -i "$public_interface" -p udp --dport 8472 \ - -m comment --comment easyai-flannel-public-drop -j DROP -ensure_rule -i "$public_interface" -p tcp --dport 30000:31057 \ - -m comment --comment easyai-nodeport-public-drop-low -j DROP -ensure_rule -i "$public_interface" -p tcp --dport 31059:32767 \ - -m comment --comment easyai-nodeport-public-drop-high -j DROP -netfilter-persistent save >/dev/null +command -v ufw >/dev/null +ufw status | grep -Fqx 'Status: active' +ufw allow in on wg0 from 10.77.0.0/24 to any port 10250 proto tcp comment easyai-kubelet-private >/dev/null +ufw allow in on wg0 from 10.77.0.0/24 to any port 8472 proto udp comment easyai-flannel-private >/dev/null +ufw deny in on "$public_interface" to any port 6443 proto tcp comment easyai-k3s-api-public-deny >/dev/null +ufw deny in on "$public_interface" to any port 10250 proto tcp comment easyai-kubelet-public-deny >/dev/null +ufw deny in on "$public_interface" to any port 8472 proto udp comment easyai-flannel-public-deny >/dev/null +for protocol in tcp udp; do + ufw deny in on "$public_interface" to any port 30000:31057 proto "$protocol" \ + comment easyai-nodeport-public-deny-low >/dev/null + ufw deny in on "$public_interface" to any port 31059:32767 proto "$protocol" \ + comment easyai-nodeport-public-deny-high >/dev/null +done install_script=$(mktemp) trap 'rm -f -- "$install_script"' EXIT curl -fsSL https://get.k3s.io -o "$install_script"