手把手教你把 SafeLine 落地到云原生环境

### 反馈内容

# 手把手教你把 SafeLine 落地到云原生环境

## 核心一览

- [Sealos 一键构建 k8s 环境](#sealos-一键构建-k8s-环境)
- [部署 LongHorn 云原生分布式存储](#部署-longhorn-云原生分布式存储)
- [部署 Ingress Nginx 控制器](#部署-ingress-nginx-控制器)
- [部署 CertManager 控制器](#部署-certmanager-控制器)
- [部署 SafeLine](#部署-safeline)
- [配置 WAF](#配置-waf)

## SealOS 一键构建 k8s 环境

### 环境信息

|IP|主机名|操作系统|功能作用|数据盘|
|-|-|-|-|-|
|192.168.20.253|/|/|lb||
|192.168.20.101|silkdo-1|Anolis 8.8|master+longhorn|/dev/vdc|
|192.168.20.102|silkdo-2|Anolis 8.8|master+longhorn|/dev/vdc|
|192.168.20.103|silkdo-3|Anolis 8.8|master+longhorn|/dev/vdc|
|192.168.20.104|silkdo-4|Anolis 8.8|worker||
|192.168.20.105|silkdo-5|Anolis 8.8|worker||
|192.168.20.106|silkdo-6|Anolis 8.8|worker||
|192.168.20.107|silkdo-7|Anolis 8.8|worker||
|192.168.20.108|silkdo-8|Anolis 8.8|worker||
|192.168.20.109|silkdo-8|Anolis 8.8|worker||

### 安装 Sealos

```bash
sudo cat > /etc/yum.repos.d/labring.repo << EOF
[fury]
name=labring Yum Repo
baseurl=https://yum.fury.io/labring/
enabled=1
gpgcheck=0
EOF
sudo yum clean all
sudo yum install -y sealos
```

> [Sealos 命令说明](https://docs.sealos.io/zh-Hans/docs/lifecycle-management/reference/sealos/commands/)

### 配置clusterfile

```bash
sealos gen \
  --masters 192.168.20.101,192.168.20.102,192.168.20.103 \
  --nodes 192.168.20.104,192.168.20.105,192.168.20.106,192.168.20.107,192.168.20.108,192.168.20.109 \
  --pk ~/.ssh/id_rsa \
  labring/kubernetes:v1.25.11 \
  labring/nerdctl:v1.2.1 \
  labring/helm:v3.12.0 \
  labring/cilium:v1.13.0
  > clusterfile

# 替换国内镜像源
sed -i '/^ImageRepository/ s|""|"registry.aliyuncs.com/google_containers"|' clusterfile
```

### 配置负载均衡

我这里的云平台提供 LB 服务，但我又不想让 SVC 使用 LoadBalancer，所以，我这里只配置了 80、443、6443 三个端口，其中 80、443 是给 Ingress Nginx 准备的，6443 是给 APIServer 做负载用的。

另外，如果你需要在集群外访问 APIServer，则需要把负载 IP 也添加到 CertSANs 列表中。

```bash
# CertSANs 添加 lb/vip
sed -i '/^  CertSANs/a\  - 192.168.20.253' clusterfile
```

#### 自定义 CIDR

[如上](#配置clusterfile)，我这里计划用 Cilium 作为 CNI 插件，看 clusterfile 配置可以知道 Sealos 部署的 k8s 集群，默认 PodSubnet 是 100.64.0.0/10，而 [Cilium 对应的 clusterPoolIPv4PodCIDR 默认为 10.0.0.0/8](https://github.com/cilium/cilium/blob/main/install/kubernetes/cilium/README.md#values)，所以，我们需要自定义 cilium Operator 的 clusterPoolIPv4PodCIDR 也为 100.64.0.0/10。

```bash
cat > Kubefile <<EOF
FROM labring/cilium:v1.13.0

CMD ["cp opt/cilium /usr/bin/","cp opt/hubble /usr/bin/","cilium install --chart-directory charts/cilium --helm-set kubeProxyReplacement=strict,k8sServiceHost=apiserver.cluster.local,k8sServicePort=6443,ipam.operator.clusterPoolIPv4PodCIDR=100.64.0.0/10"]
EOF

sealos build -t labring/cilium:v1.13.0-amd64 --platform linux/amd64 -f Kubefile .
```

### 安装 Kubernetes 集群

```bash
# 部署 Kubernetes
sealos apply -f clusterfile
```

至此，我们姑且认为您已经按照上述步骤完成 k8s 集群的安装。

## 部署 LongHorn 云原生分布式存储

### 磁盘挂载

[如上](#环境信息)，我这里规划三个 master 节点作为存储节点，并且磁盘都是 `/dev/vdc`

```bash
DISK=vdc
for i in `seq 1 3`;do cat <<-EOF | ssh 192.168.20.10$i;done
    echo "=========="
    hostname
    parted -s /dev/${DISK} mklabel gpt
    parted -s /dev/${DISK} mkpart p ext4 0 100%
    mkfs.ext4 -F /dev/${DISK}1
    sed -i '/longhorn/d' /etc/fstab
    echo "/dev/${DISK}1 /var/lib/longhorn ext4 defaults 0 0" >> /etc/fstab
    mkdir /var/lib/longhorn
    mount -a
    df -h /var/lib/longhorn
EOF
```

### 安装依赖

#### 安装 iSCSI

```bash
cat <<-'EOF' | kubectl apply -f -
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: longhorn-iscsi-installation
  # namespace: longhorn-system
  labels:
    app: longhorn-iscsi-installation
  annotations:
    command: &cmd OS=$(grep "ID_LIKE" /etc/os-release | cut -d '=' -f 2); if [[ "${OS}" == *"debian"* ]]; then sudo apt-get update -q -y && sudo apt-get install -q -y open-iscsi && sudo systemctl -q enable iscsid && sudo systemctl start iscsid; elif [[ "${OS}" == *"suse"* ]]; then sudo zypper --gpg-auto-import-keys -q refresh && sudo zypper --gpg-auto-import-keys -q install -y open-iscsi && sudo systemctl -q enable iscsid && sudo systemctl start iscsid; else sudo yum makecache -q -y && sudo yum --setopt=tsflags=noscripts install -q -y iscsi-initiator-utils && echo "InitiatorName=$(/sbin/iscsi-iname)" > /etc/iscsi/initiatorname.iscsi && sudo systemctl -q enable iscsid && sudo systemctl start iscsid; fi && if [ $? -eq 0 ]; then echo "iscsi install successfully"; else echo "iscsi install failed error code $?"; fi
spec:
  selector:
    matchLabels:
      app: longhorn-iscsi-installation
  template:
    metadata:
      labels:
        app: longhorn-iscsi-installation
    spec:
      tolerations:
      - key: node-role.kubernetes.io/control-plane
        operator: Exists
        effect: NoSchedule
      - key: node-role.kubernetes.io/master
        operator: Exists
        effect: NoSchedule
      hostNetwork: true
      hostPID: true
      initContainers:
      - name: iscsi-installation
        command:
          - nsenter
          - --mount=/proc/1/ns/mnt
          - --
          - bash
          - -c
          - *cmd
        image: hub.silkdo.com/library/alpine:3.12
        securityContext:
          privileged: true
      containers:
      - name: sleep
        image: registry.cn-beijing.aliyuncs.com/kubesphereio/pause:3.5
  updateStrategy:
    type: RollingUpdate
EOF
```

#### 安装 NFSv4 客户端

```bash
cat <<-'EOF' | kubectl apply -f -
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: longhorn-nfs-installation
  # namespace: longhorn-system
  labels:
    app: longhorn-nfs-installation
  annotations:
    command: &cmd OS=$(grep "ID_LIKE" /etc/os-release | cut -d '=' -f 2); if [[ "${OS}" == *"debian"* ]]; then sudo apt-get update -q -y && sudo apt-get install -q -y nfs-common; elif [[ "${OS}" == *"suse"* ]]; then sudo zypper --gpg-auto-import-keys -q refresh && sudo zypper --gpg-auto-import-keys -q install -y nfs-client; else sudo yum makecache -q -y && sudo yum --setopt=tsflags=noscripts install -q -y nfs-utils; fi && if [ $? -eq 0 ]; then echo "nfs install successfully"; else echo "nfs install failed error code $?"; fi
spec:
  selector:
    matchLabels:
      app: longhorn-nfs-installation
  template:
    metadata:
      labels:
        app: longhorn-nfs-installation
    spec:
      tolerations:
      - key: node-role.kubernetes.io/control-plane
        operator: Exists
        effect: NoSchedule
      - key: node-role.kubernetes.io/master
        operator: Exists
        effect: NoSchedule
      hostNetwork: true
      hostPID: true
      initContainers:
      - name: nfs-installation
        command:
          - nsenter
          - --mount=/proc/1/ns/mnt
          - --
          - bash
          - -c
          - *cmd
        image: hub.silkdo.com/library/alpine:3.12
        securityContext:
          privileged: true
      containers:
      - name: sleep
        image: registry.cn-beijing.aliyuncs.com/kubesphereio/pause:3.5
  updateStrategy:
    type: RollingUpdate
EOF
```

### 添加标签

```bash
kubectl label nodes silkdo-1 node.longhorn.io/create-default-disk=true
kubectl label nodes silkdo-2 node.longhorn.io/create-default-disk=true
kubectl label nodes silkdo-3 node.longhorn.io/create-default-disk=true
```

> [在标记节点上创建默认磁盘](https://longhorn.io/docs/1.5.1/references/settings/#create-default-disk-on-labeled-nodes)

### 部署 LongHorn

```bash
helm repo add longhorn https://charts.longhorn.io && helm repo update longhorn


cat <<-'EOF' | helm -n longhorn-system upgrade -i longhorn longhorn/longhorn --version v1.4.3 --create-namespace -f - 
image:
  longhorn:
    engine:
      repository: uhub.service.ucloud.cn/silkdo/longhornio/longhorn-engine
    manager:
      repository: uhub.service.ucloud.cn/silkdo/longhornio/longhorn-manager
    ui:
      repository: uhub.service.ucloud.cn/silkdo/longhornio/longhorn-ui
    instanceManager:
      repository: uhub.service.ucloud.cn/silkdo/longhornio/longhorn-instance-manager
    shareManager:
      repository: uhub.service.ucloud.cn/silkdo/longhornio/longhorn-share-manager
    backingImageManager:
      repository: uhub.service.ucloud.cn/silkdo/longhornio/backing-image-manager
    supportBundleKit:
      repository: uhub.service.ucloud.cn/silkdo/longhornio/support-bundle-kit
  csi:
    attacher:
      repository: uhub.service.ucloud.cn/silkdo/longhornio/csi-attacher
    provisioner:
      repository: uhub.service.ucloud.cn/silkdo/longhornio/csi-provisioner
    nodeDriverRegistrar:
      repository: uhub.service.ucloud.cn/silkdo/longhornio/csi-node-driver-registrar
    resizer:
      repository: uhub.service.ucloud.cn/silkdo/longhornio/csi-resizer
    snapshotter:
      repository: uhub.service.ucloud.cn/silkdo/longhornio/csi-snapshotter
    livenessProbe:
      repository: uhub.service.ucloud.cn/silkdo/longhornio/livenessprobe

service:
  ui:
    type: NodePort
    nodePort: 30890

defaultSettings:
  allowRecurringJobWhileVolumeDetached: true
  createDefaultDiskLabeledNodes: true
  replicaAutoBalance: "best-effort"
  taintToleration: "node-role.kubernetes.io/control-plane:NoSchedule;node-role.kubernetes.io/master:NoSchedule"
  priorityClass: "high-priority"
  nodeDownPodDeletionPolicy: "delete-both-statefulset-and-deployment-pod"
  concurrentAutomaticEngineUpgradePerNodeLimit: "5"

longhornManager:
  tolerations:
  - key: node-role.kubernetes.io/control-plane
    operator: Exists
    effect: NoSchedule
  - key: node-role.kubernetes.io/master
    operator: Exists
    effect: NoSchedule
longhornDriver:
  tolerations:
  - key: node-role.kubernetes.io/control-plane
    operator: Exists
    effect: NoSchedule
  - key: node-role.kubernetes.io/master
    operator: Exists
    effect: NoSchedule

longhornUI:
  tolerations:
  - key: node-role.kubernetes.io/control-plane
    operator: Exists
    effect: NoSchedule
  - key: node-role.kubernetes.io/master
    operator: Exists
    effect: NoSchedule
  nodeSelector:
    node.longhorn.io/create-default-disk: "true"

longhornConversionWebhook:
  tolerations:
  - key: node-role.kubernetes.io/control-plane
    operator: Exists
    effect: NoSchedule
  - key: node-role.kubernetes.io/master
    operator: Exists
    effect: NoSchedule
  nodeSelector:
    node.longhorn.io/create-default-disk: "true"

longhornAdmissionWebhook:
  tolerations:
  - key: node-role.kubernetes.io/control-plane
    operator: Exists
    effect: NoSchedule
  - key: node-role.kubernetes.io/master
    operator: Exists
    effect: NoSchedule
  nodeSelector:
    node.longhorn.io/create-default-disk: "true"

longhornRecoveryBackend:
  tolerations:
  - key: node-role.kubernetes.io/control-plane
    operator: Exists
    effect: NoSchedule
  - key: node-role.kubernetes.io/master
    operator: Exists
    effect: NoSchedule
  nodeSelector:
    node.longhorn.io/create-default-disk: "true"

enablePSP: false
EOF
```

### 验证

```bash
cat <<-EOF | kubectl apply -f -
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: rwo
spec:
  storageClassName: longhorn
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi

---
kind: Pod
apiVersion: v1
metadata:
  name: rwo
spec:
  containers:
  - name: busybox
    image: busybox
    command:
    - sleep
    - "3600"
    volumeMounts:
    - name: rwo
      mountPath: "/pv-data"
      readOnly: false
  volumes:
  - name: rwo
    persistentVolumeClaim:
      claimName: rwo

---
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: rwx
spec:
  storageClassName: longhorn
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 1Gi

---
kind: Pod
apiVersion: v1
metadata:
  name: rwx
spec:
  containers:
  - name: busybox
    image: busybox
    command:
    - sleep
    - "3600"
    volumeMounts:
    - name: rwx
      mountPath: "/pv-data"
      readOnly: false
  volumes:
  - name: rwx
    persistentVolumeClaim:
      claimName: rwx
EOF
```

至此，我们姑且认为您已经按照上述步骤完成 LongHorn 的安装。

## 部署 Ingress Nginx 控制器

前面说过，我不打算使用 Loadbalancer，因为它的代价实在是太高了，但也不想让用户访问时多加一个端口，所以，准备使用 hostNetwork 参数暴露宿主机上的 80 和 443 端口，配合 pod 亲和性和反亲和性，将 Ingress Nginx 的 pod 固定在三个 master 节点上，再利用上述负载均衡让 Ingress 可以暴露在互联网。

```bash
VERSION=4.7.1

curl -L https://ghproxy.com/https://github.com/kubernetes/ingress-nginx/releases/download/helm-chart-${VERSION}/ingress-nginx-${VERSION}.tgz -o ~/.cache/helm/repository/ingress-nginx-${VERSION}.tgz

cat << EOF | helm -n ingress-nginx upgrade -i ingress-nginx ~/.cache/helm/repository/ingress-nginx-${VERSION}.tgz --create-namespace -f -
controller:
  image:
    registry: uhub.service.ucloud.cn/silkdo/registry.k8s.io
    digest: 
    digestChroot: 
  config:
  dnsPolicy: ClusterFirstWithHostNet
  reportNodeInternalIp: true
  watchIngressWithoutClass: true
  hostNetwork: true
  hostPort:
    enabled: false
    ports:
      http: 80
      https: 443
  ingressClassResource:
    default: true
  publishService:
    enabled: false
  kind: Deployment
  updateStrategy:
    rollingUpdate:
      maxSurge: 0
      maxUnavailable: 1
    type: RollingUpdate
  tolerations:
    - key: node-role.kubernetes.io/control-plane
      operator: Exists
      effect: NoSchedule
    - key: node-role.kubernetes.io/master
      operator: Exists
      effect: NoSchedule
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchExpressions:
          - key: node-role.kubernetes.io/control-plane
            operator: Exists
  replicaCount: 3
  service:
    enabled: true
  opentelemetry:
    enabled: true
    image: uhub.service.ucloud.cn/silkdo/registry.k8s.io/ingress-nginx/opentelemetry:v20230527
    containerSecurityContext:
      allowPrivilegeEscalation: false
  admissionWebhooks:
    enabled: true
    patch:
      enabled: true
      image:
        registry: uhub.service.ucloud.cn/silkdo/registry.k8s.io
        digest: 
      tolerations:
        - key: node-role.kubernetes.io/control-plane
          operator: Exists
          effect: NoSchedule
        - key: node-role.kubernetes.io/master
          operator: Exists
          effect: NoSchedule
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: node-role.kubernetes.io/control-plane
                operator: Exists
defaultBackend:
  enabled: true
  name: defaultbackend
  image:
    registry: uhub.service.ucloud.cn/silkdo/registry.k8s.io
    digest: 
  updateStrategy:
    rollingUpdate:
      maxSurge: 0
      maxUnavailable: 1
    type: RollingUpdate
  tolerations:
    - key: node-role.kubernetes.io/control-plane
      operator: Exists
      effect: NoSchedule
    - key: node-role.kubernetes.io/master
      operator: Exists
      effect: NoSchedule
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchExpressions:
          - key: node-role.kubernetes.io/control-plane
            operator: Exists
    podAntiAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
      - labelSelector:
          matchExpressions:
          - key: app.kubernetes.io/component
            operator: In
            values:
            - default-backend
        topologyKey: kubernetes.io/hostname
  replicaCount: 3
EOF
```

## 部署 CertManager 控制器

> 单纯为了获取免费 SSL 证书

```bash
VERSION=1.12.2

curl -L https://charts.jetstack.io/charts/cert-manager-v${VERSION}.tgz -o ~/.cache/helm/repository/cert-manager-v${VERSION}.tgz

cat <<-'EOF' | helm -n cert-manager upgrade -i cert-manager ~/.cache/helm/repository/cert-manager-v${VERSION}.tgz --create-namespace -f -
installCRDs: true

strategy:
  type: RollingUpdate
  rollingUpdate:
    maxSurge: 0
    maxUnavailable: 1

image:
  repository: uhub.service.ucloud.cn/silkdo/quay.io/jetstack/cert-manager-controller

extraEnv:
  TZ: Asia/Shanghai
tolerations:
- key: node-role.kubernetes.io/control-plane
  operator: Exists
  effect: NoSchedule
- key: node-role.kubernetes.io/master
  operator: Exists
  effect: NoSchedule
affinity:
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
      nodeSelectorTerms:
      - matchExpressions:
        - key: node-role.kubernetes.io/control-plane
          operator: Exists

prometheus:
  enabled: true
  servicemonitor:
    enabled: true
    endpointAdditionalProperties:
      relabelings:
      - replacement: base
        targetLabel: group

webhook:
  image:
    repository: uhub.service.ucloud.cn/silkdo/quay.io/jetstack/cert-manager-webhook

cainjector:
  image:
    repository: uhub.service.ucloud.cn/silkdo/quay.io/jetstack/cert-manager-cainjector

acmesolver:
  image:
    repository: uhub.service.ucloud.cn/silkdo/quay.io/jetstack/cert-manager-acmesolver

startupapicheck:
  image:
    repository: uhub.service.ucloud.cn/silkdo/quay.io/jetstack/cert-manager-ctl
EOF
```

## 部署 SafeLine

### Helm 部署 SafeLine

```bash
git clone https://github.com/jangrui/SafeLine safeline

cat <<EOF | helm -n safeline upgrade -i safeline safeline/helm --create-namespace -f -
database:
  type: internal
  internal:
    image:
      registry: uhub.service.ucloud.cn/silkdo/library

redis:
  type: internal
  internal:
    image:
      registry: uhub.service.ucloud.cn/silkdo/library

management:
  image:
    registry: uhub.service.ucloud.cn/silkdo

detector:
  image:
    registry: uhub.service.ucloud.cn/silkdo

mario:
  image:
    registry: uhub.service.ucloud.cn/silkdo

tengine:
  image:
    registry: uhub.service.ucloud.cn/silkdo
EOF
```

> 配置 registry：国内镜像加速。只是把 SafeLine 官方的镜像上传到了 Ucloud 镜像仓库。

### 创建一个 HTTP01 类型的 ACME 发行者

```bash
cat <<-'EOF' | kubectl apply -f -
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: waf.silkdo.com
  namespace: safeline
spec:
  acme:
    email: admin@jangrui.com
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: waf.silkdo.com.tls
    solvers:
    - http01:
        ingress:
          class: nginx
EOF
```

### 创建 Ingress

```bash
cat <<-'EOF' | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: waf.silkdo.com
  namespace: safeline
  annotations:
    cert-manager.io/issuer: "waf.silkdo.com"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/service-upstreamtrue: "true"
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
spec:
  ingressClassName: nginx
  rules:
  - host: waf.silkdo.com
    http:
      paths:
      - path: /
        pathType: ImplementationSpecific
        backend:
          service:
            name: safeline-mgt-api
            port: 
              number: 1443
  tls:
  - hosts:
    - waf.silkdo.com
    secretName: waf.silkdo.com.tls
EOF
```

> 此处省略 DNS 解析过程，默认认为您的域名已经做好 DNS 解析。

至此，您可以通过域名访问直接访问 SafeLine 的管理后台；另一种方法，也可以通过 NodePort 的形式去访问。

## 配置 WAF

既然 SafeLine 已经安装好了 ，那么把我们的域名交给 WAF 去防护肯定是首选了。

### 添加人机验证

![人机验证](https://cdn.jsdelivr.net/gh/jangrui/images@main/2023/09/04/161001.png)

> 这里单纯为了一眼看出下面配置的网站是经过 WAF 防护的。

### 配置防护站点

我们这里直接把刚才的 waf.silkdo.com 作为要防护站点。

![waf website](https://cdn.jsdelivr.net/gh/jangrui/images@main/2023/09/04/160106.png)

刚才我们已经给 SafeLine 添加了一个 Ingress，但后端 SVC 用的是 safeline-mgt-api，而现在，我们需要 Ingress 也经过 WAF 防护，此时只需要稍作修改，把 Ingress 的后端 SVC 改成 safeline-tengine 即可。

```bash
cat <<-'EOF' | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: waf.silkdo.com
  namespace: safeline
  annotations:
    cert-manager.io/issuer: "waf.silkdo.com"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/service-upstreamtrue: "true"
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
spec:
  ingressClassName: nginx
  rules:
  - host: waf.silkdo.com
    http:
      paths:
      - path: /
        pathType: ImplementationSpecific
        backend:
          service:
            name: safeline-tengine
            port: 
              number: 80
  tls:
  - hosts:
    - waf.silkdo.com
    secretName: waf.silkdo.com.tls
EOF
```

> 别忘了 SVC 端口也需要跟着变动。

![验证](https://cdn.jsdelivr.net/gh/jangrui/images@main/2023/09/04/163051.png)

现在，打开一个无痕窗口，访问你的域名，出现上图，说明你的 WAF 成功生效，至此，Safeline 落地到云原生环境完结。


Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

手把手教你把 SafeLine 落地到云原生环境 #284

反馈内容

手把手教你把 SafeLine 落地到云原生环境

核心一览

SealOS 一键构建 k8s 环境

环境信息

安装 Sealos

配置clusterfile

配置负载均衡

自定义 CIDR

安装 Kubernetes 集群

部署 LongHorn 云原生分布式存储

磁盘挂载

安装依赖

安装 iSCSI

安装 NFSv4 客户端

添加标签

部署 LongHorn

验证

部署 Ingress Nginx 控制器

部署 CertManager 控制器

部署 SafeLine

Helm 部署 SafeLine

创建一个 HTTP01 类型的 ACME 发行者

创建 Ingress

配置 WAF

添加人机验证

配置防护站点

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

IP	主机名	操作系统	功能作用	数据盘
192.168.20.253	/	/	lb
192.168.20.101	silkdo-1	Anolis 8.8	master+longhorn	/dev/vdc
192.168.20.102	silkdo-2	Anolis 8.8	master+longhorn	/dev/vdc
192.168.20.103	silkdo-3	Anolis 8.8	master+longhorn	/dev/vdc
192.168.20.104	silkdo-4	Anolis 8.8	worker
192.168.20.105	silkdo-5	Anolis 8.8	worker
192.168.20.106	silkdo-6	Anolis 8.8	worker
192.168.20.107	silkdo-7	Anolis 8.8	worker
192.168.20.108	silkdo-8	Anolis 8.8	worker
192.168.20.109	silkdo-8	Anolis 8.8	worker

Uh oh!

手把手教你把 SafeLine 落地到云原生环境 #284

Description

反馈内容

手把手教你把 SafeLine 落地到云原生环境

核心一览

SealOS 一键构建 k8s 环境

环境信息

安装 Sealos

配置clusterfile

配置负载均衡

自定义 CIDR

安装 Kubernetes 集群

部署 LongHorn 云原生分布式存储

磁盘挂载

安装依赖

安装 iSCSI

安装 NFSv4 客户端

添加标签

部署 LongHorn

验证

部署 Ingress Nginx 控制器

部署 CertManager 控制器

部署 SafeLine

Helm 部署 SafeLine

创建一个 HTTP01 类型的 ACME 发行者

创建 Ingress

配置 WAF

添加人机验证

配置防护站点

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions