wangbo
971540a2a4
新增 WireGuard 全互联、三 server embedded-etcd K3s、CloudNativePG 双实例、Barman OSS 备份、双 NGINX、Kubernetes Secret/RBAC 与本地旧文件按严格 24 小时清理。 新增维护窗口数据迁移、digest 固定滚动发布、应用回滚、跨节点文件 E2E、节点和数据库故障演练、CNPG 恢复与 etcd 快照验收脚本；洛杉矶仅作为带 NoSchedule 污点的仲裁节点。 所有生产 Secret 只在执行时从 0600 本地环境和旧生产容器导入，仓库不保存凭据；公网入口保持人工 DNS 故障切换边界。 验证：bash -n、ShellCheck、kubectl kustomize、Node 语法检查、Secret 扫描、OSS put/head/delete 实测。
50 lines
1.9 KiB
Bash
Executable File
50 lines
1.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
|
|
# shellcheck source=scripts/cluster/common.sh
|
|
source "$script_dir/common.sh"
|
|
|
|
load_cluster_env
|
|
hosts=("$CLUSTER_NINGBO_HOST" "$CLUSTER_HONGKONG_HOST" "$CLUSTER_LOS_ANGELES_HOST")
|
|
|
|
for host in "${hosts[@]}"; do
|
|
echo "[firewall] hardening K3s ports on $host"
|
|
cluster_ssh "$host" 'bash -s' <<'REMOTE'
|
|
set -euo pipefail
|
|
[[ -d /sys/class/net/wg0 ]] || { echo 'wg0 is unavailable' >&2; exit 1; }
|
|
public_interface=$(ip -o route get 1.1.1.1 | awk '{ for (i = 1; i <= NF; i++) if ($i == "dev") { print $(i + 1); exit } }')
|
|
[[ $public_interface =~ ^[A-Za-z0-9._-]+$ && $public_interface != wg0 ]] || {
|
|
echo 'cannot determine public interface' >&2
|
|
exit 1
|
|
}
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
if ! command -v netfilter-persistent >/dev/null 2>&1; then
|
|
apt-get update -qq
|
|
apt-get install -y -qq iptables-persistent
|
|
fi
|
|
ensure_rule() {
|
|
if ! iptables -C INPUT "$@" 2>/dev/null; then
|
|
iptables -I INPUT 1 "$@"
|
|
fi
|
|
}
|
|
ensure_rule -i wg0 -s 10.77.0.0/24 -p tcp -m multiport \
|
|
--dports 2379,2380,6443,10250 -m comment --comment easyai-k3s-private -j ACCEPT
|
|
ensure_rule -i wg0 -s 10.77.0.0/24 -p udp --dport 8472 \
|
|
-m comment --comment easyai-flannel-private -j ACCEPT
|
|
ensure_rule -i wg0 -s 10.77.0.0/24 -p tcp --dport 30000:32767 \
|
|
-m comment --comment easyai-nodeport-private -j ACCEPT
|
|
ensure_rule -i "$public_interface" -p udp --dport 51820 \
|
|
-m comment --comment easyai-wireguard-public -j ACCEPT
|
|
ensure_rule -i "$public_interface" -p tcp -m multiport \
|
|
--dports 2379,2380,6443,10250 -m comment --comment easyai-k3s-public-drop -j DROP
|
|
ensure_rule -i "$public_interface" -p udp --dport 8472 \
|
|
-m comment --comment easyai-flannel-public-drop -j DROP
|
|
ensure_rule -i "$public_interface" -p tcp --dport 30000:32767 \
|
|
-m comment --comment easyai-nodeport-public-drop -j DROP
|
|
netfilter-persistent save >/dev/null
|
|
REMOTE
|
|
done
|
|
|
|
echo 'node_network_hardening=PASS nodes=3'
|