1. Base Packages Kubernetes version ≥ 1.18 socat Required conntrack Required ebtables Optional, but recommended ipset Optional, but recommended ipvsadm Optional, but recommended 1 apt-get -y install socat conntrack ebtables ipset ipvsadm 2. Port Requirements 2.1 Base Node Services Service Protocol Action Start Port End Port Comment ssh TCP allow 22 22 Node remote management docker TCP allow 2375 2376 Docker remote communication etcd TCP allow 2379 2380 etcd cluster communication 2.

1. Deploying Jumpserver You need a StorageClass ready in advance to store Jumpserver’s data. Besides the database mentioned below, each component — jms-core, jms-web, jms-koko, jms-lion, jms-chen — also needs a PV for storage. 1.1 Deploying MySQL Refer to https://github.com/shaowenchen/ops-hub/blob/main/database/mysql8.yaml to deploy MySQL. You need to adjust the StorageClass field

1. What Falco Is Falco is a cloud-native runtime security project contributed to the CNCF by Sysdig. Falco implements an extensible event rule filtering engine. Through a series of operations — capturing events, matching security rules, and producing alert notifications — it can surface security problems in a system. The events come from system calls, and it also supports an ebpf probe; the rules are open source [1] and you can define your own extensions [2].

1. Self-signing a *.docker.io Domain Certificate 1.1 Creating a CA Certificate Generate the CA certificate private key 1 openssl genrsa -out ca.key 4096 Generate the CA certificate 1 2 3 4 openssl req -x509 -new -nodes -sha512 -days 3650 \ -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=chenshaowen.com" \ -key ca.key \ -out ca.crt 1.2 Creating a *.

1. Steps to Add a Key 1.1 Generate an SSH Key on the Client There are two key formats: Old format, the private key begins with -----BEGIN RSA PRIVATE KEY----- 1 ssh-keygen -m PEM -t rsa -b 4096 -C "mail@chenshaowen.com" New format, the private key begins with -----BEGIN OPENSSH PRIVATE KEY----- 1 ssh-keygen -t rsa -b 4096 -C "mail@chenshaowen.