【k8s实践】部署Squid

在Docker和k8s中部署Squid实践

原创

已于 2024-12-08 14:36:18 修改 · 1.5k 阅读

4 ·

CC 4.0 BY-SA版权

文章标签：

#squid

于 2024-10-17 17:32:24 首次发布

前言

动手实践，在k8s中部署Squid，步骤如下:

先在Docker环境中运行Squid, 准备好Squid镜像。
再搭建一个k8s环境，把上一步的docker镜像传进来，再创建对应k8s资源，完成Squid的部署

准备环境

两台Linux VM:

一台Centos/RHEL/RockyLinux 7/8/9，安装Docker, 构建Squid的Docker镜像
一台RockyLinux 9, 用于运行k8s, 部署Squid

1. 在Docker环境中运行Squid, 准备Squid镜像

安装Docker

参考: 安装Docker

准备Squid主配置文件squid.conf

基于rockylinux 9.3的镜像, 通过yum install方式安装Squid, 默认主配置文件路径在容器中的/etc/squid/squid.conf
使用默认的squid.conf, 无法在容器中正常启动Squid。需要额外添加如下配置，以squid用户启动:

cache_effective_user squid
cache_effective_group squid
cache_log /var/log/squid/cache.log
access_log /var/log/squid/access.log squid

你可以在rocky9.3的容器里装一个squid，把/etc/squid/squid.conf拷出来，再添加以上配置; 或者直接使用如下的squid.conf

#
# Recommended minimum configuration:
#

# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
acl localnet src 0.0.0.1-0.255.255.255  # RFC 1122 "this" network (LAN)
acl localnet src 10.0.0.0/8     # RFC 1918 local private network (LAN)
acl localnet src 100.64.0.0/10      # RFC 6598 shared address space (CGN)
acl localnet src 169.254.0.0/16     # RFC 3927 link-local (directly plugged) machines
acl localnet src 172.16.0.0/12      # RFC 1918 local private network (LAN)
acl localnet src 192.168.0.0/16     # RFC 1918 local private network (LAN)
acl localnet src fc00::/7           # RFC 4193 local private network range
acl localnet src fe80::/10          # RFC 4291 link-local (directly plugged) machines

acl SSL_ports port 443
acl Safe_ports port 80      # http
acl Safe_ports port 21      # ftp
acl Safe_ports port 443     # https
acl Safe_ports port 70      # gopher
acl Safe_ports port 210     # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280     # http-mgmt
acl Safe_ports port 488     # gss-http
acl Safe_ports port 591     # filemaker
acl Safe_ports port 777     # multiling http

#
# Recommended minimum Access Permission confi