BCAI/easyai-ai-gateway
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(cluster): 保留深圳原有 UFW 防火墙

Browse Source 
移除会与 UFW 冲突的 iptables-persistent 安装，改由 UFW 持久化 WireGuard、kubelet、Flannel 和 NodePort 规则。\n\n预检新增 UFW 已安装且处于 active 的硬门禁，避免包管理器切换防火墙后保留 DROP 默认策略并中断远程接入。\n\n已通过 bash -n、ShellCheck 和差异检查。
This commit is contained in:
wangbo
2026-08-01 09:51:03 +08:00
parent c63709d785
commit d3b36cf63d
2 changed files with 17 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/cluster/add-shenzhen-worker-node.sh
+15 -21
View File
@@ -50,6 +50,8 @@ available_bytes=$(df -B1 --output=avail / | tail -n 1 | tr -d ' ')
(( available_bytes >= 20 * 1024 * 1024 * 1024 ))
timedatectl show -p NTPSynchronized --value | grep -Fxq yes
[[ ! -e /etc/rancher/k3s/config.yaml || -f /etc/rancher/k3s/config.yaml ]]
command -v ufw >/dev/null
ufw status | grep -Fqx 'Status: active'
printf 'shenzhen_worker_preflight=PASS cpu=%s memory_available_mib=%s disk_available_gib=%s\n' \
"$(nproc)" "$((available_kib / 1024))" "$((available_bytes / 1024 / 1024 / 1024))"
REMOTE
@@ -230,28 +232,20 @@ node-taint:
- easyai.io/worker-only=true:NoSchedule
EOF
chmod 0600 /etc/rancher/k3s/config.yaml /etc/rancher/k3s/registries.yaml
export DEBIAN_FRONTEND=noninteractive
if ! command -v netfilter-persistent >/dev/null 2>&1; then
apt-get update -qq
apt-get install -y -qq iptables-persistent
fi
ensure_rule() {
if ! iptables -C INPUT "$@" 2>/dev/null; then iptables -I INPUT 1 "$@"; fi
}
public_interface=$(ip -o route get 1.1.1.1 | awk '{for(i=1;i<=NF;i++) if($i=="dev"){print $(i+1); exit}}')
ensure_rule -i wg0 -s 10.77.0.0/24 -p tcp -m multiport --dports 6443,10250 \
-m comment --comment easyai-k3s-private -j ACCEPT
ensure_rule -i wg0 -s 10.77.0.0/24 -p udp --dport 8472 \
-m comment --comment easyai-flannel-private -j ACCEPT
ensure_rule -i "$public_interface" -p tcp -m multiport --dports 6443,10250 \
-m comment --comment easyai-k3s-public-drop -j DROP
ensure_rule -i "$public_interface" -p udp --dport 8472 \
-m comment --comment easyai-flannel-public-drop -j DROP
ensure_rule -i "$public_interface" -p tcp --dport 30000:31057 \
-m comment --comment easyai-nodeport-public-drop-low -j DROP
ensure_rule -i "$public_interface" -p tcp --dport 31059:32767 \
-m comment --comment easyai-nodeport-public-drop-high -j DROP
netfilter-persistent save >/dev/null
command -v ufw >/dev/null
ufw status | grep -Fqx 'Status: active'
ufw allow in on wg0 from 10.77.0.0/24 to any port 10250 proto tcp comment easyai-kubelet-private >/dev/null
ufw allow in on wg0 from 10.77.0.0/24 to any port 8472 proto udp comment easyai-flannel-private >/dev/null
ufw deny in on "$public_interface" to any port 6443 proto tcp comment easyai-k3s-api-public-deny >/dev/null
ufw deny in on "$public_interface" to any port 10250 proto tcp comment easyai-kubelet-public-deny >/dev/null
ufw deny in on "$public_interface" to any port 8472 proto udp comment easyai-flannel-public-deny >/dev/null
for protocol in tcp udp; do
ufw deny in on "$public_interface" to any port 30000:31057 proto "$protocol" \
comment easyai-nodeport-public-deny-low >/dev/null
ufw deny in on "$public_interface" to any port 31059:32767 proto "$protocol" \
comment easyai-nodeport-public-deny-high >/dev/null
done
install_script=$(mktemp)
trap 'rm -f -- "$install_script"' EXIT
curl -fsSL https://get.k3s.io -o "$install_script"