1. Deploy the Ingress Controller Check the Kubernetes version 1 2 3 4 kubectl version --short Client Version: v1.21.4 Server Version: v1.21.4 Find a compatible Nginx Ingress version Helm Chart version Highest available Helm Chart version Compatible K8s version 3.x.x 3.36.0 1.16+ 4.x.x 4.4.2 1.19+ Reference: https://github.com/kubernetes/ingress-nginx Install the Nginx Ingress Controller 1 2 3 helm upgrade --install ingress-nginx ingress-nginx \ --repo https://kubernetes.

1. Host Service Ports 1 2 iptables -I INPUT -p tcp --dport 80 -j DROP iptables -I INPUT -p tcp -s 1.2.3.4 --dport 80 -j ACCEPT This allows only 1.2.3.4 to access port 80 on the local host. 2. Docker Service Ports For services started like docker run -d -p 80:80 shaowenchen/demo:whoami, the method above does not work; the rule has to be added to the DOCKER-USER chain.

1. Authentication and Authorization Problems Brought by Heterogeneous Systems Enterprise systems can be divided into the following types: Commercial software you purchase, such as JumpServer Open-source software, such as Kibana and Grafana Software developed in-house, such as an application management platform One thing worth clarifying here: authentication and authorization are two different functions:

1. Self-signing a *.docker.io Domain Certificate 1.1 Creating a CA Certificate Generate the CA certificate private key 1 openssl genrsa -out ca.key 4096 Generate the CA certificate 1 2 3 4 openssl req -x509 -new -nodes -sha512 -days 3650 \ -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=chenshaowen.com" \ -key ca.key \ -out ca.crt 1.2 Creating a *.

By default, Kubernetes certificates need to be renewed once a year. Below is a record of one certificate renewal process. 1. Check the Certificates Check the certificate expiration time on a master node: 1 kubeadm certs check-expiration On older cluster versions this command errors out; use: kubeadm alpha certs check-expiration