Security on Youqing Han - DevOps Engineer

Production Network Planning on Alibaba Cloud: Security Best Practices

ihanyouqing#gmail.com (#->@) (Youqing Han) — Tue, 02 Sep 2025 00:00:00 +0000

Introduction

Designing a secure production network on Alibaba Cloud requires careful planning and adherence to security best practices. This guide provides a comprehensive approach to network architecture that balances security, performance, and operational efficiency while meeting compliance requirements.

Network Architecture Overview

A well-designed production network on Alibaba Cloud should implement defense-in-depth principles with multiple security layers, proper network segmentation, and comprehensive monitoring.

High-Level Network Architecture

Mermaid Diagram

Rendering diagram...

VPC Design and Network Segmentation

VPC Architecture with Multiple Subnets

Mermaid Diagram

Rendering diagram...

Network Security Zones

Mermaid Diagram

Rendering diagram...

Security Group Configuration

Security Group Rules Matrix

Mermaid Diagram

Rendering diagram...

Load Balancer and Traffic Flow

Multi-Tier Load Balancing Architecture

Mermaid Diagram

Rendering diagram...

Load Balancer Health Check Flow

Mermaid Diagram

Rendering diagram...

Network Security Implementation

Firewall Rules and Network ACLs

Mermaid Diagram

Rendering diagram...

VPN and Direct Connection Setup

Mermaid Diagram

Rendering diagram...

Monitoring and Logging Architecture

Network Monitoring Stack

Mermaid Diagram

Rendering diagram...

Security Incident Response Flow

Mermaid Diagram

Rendering diagram...

Compliance and Governance

Network Security Compliance Framework

Mermaid Diagram

Rendering diagram...

Disaster Recovery and Business Continuity

Multi-Region Disaster Recovery Setup

Mermaid Diagram

Rendering diagram...

Implementation Checklist

Phase 1: Foundation Setup

Create VPC with proper CIDR blocks
Design subnet architecture for multi-AZ deployment
Configure route tables and internet gateways
Set up NAT gateways for private subnets

Phase 2: Security Implementation

Configure security groups with least privilege access
Implement network ACLs for additional layer of security
Set up Web Application Firewall (WAF)
Configure DDoS protection services

Phase 3: Load Balancing and High Availability

Deploy Server Load Balancer (SLB) instances
Configure health checks and auto-scaling
Implement cross-zone load balancing
Set up SSL/TLS termination

Phase 4: Monitoring and Compliance

Enable VPC Flow Logs
Configure Cloud Monitor for network metrics
Set up log collection and analysis
Implement alerting and incident response

Phase 5: Testing and Validation

Conduct security penetration testing
Validate disaster recovery procedures
Test compliance requirements
Document network architecture and procedures

Best Practices Summary

Security Principles

Defense in Depth: Implement multiple security layers
Least Privilege: Grant minimum necessary access
Zero Trust: Verify every connection and request
Continuous Monitoring: Real-time threat detection
Regular Updates: Keep security configurations current

Network Design Principles

Segmentation: Separate networks by function and security requirements
Redundancy: Design for high availability across multiple AZs
Scalability: Plan for future growth and expansion
Performance: Optimize for latency and throughput
Compliance: Meet industry and regulatory standards

Conclusion

Designing a secure production network on Alibaba Cloud requires careful consideration of security, performance, and operational requirements. By following the architectural patterns and best practices outlined in this guide, organizations can build robust, secure, and compliant network infrastructures that support their business objectives while maintaining the highest security standards.

CentOS下Nginx配置地理访问控制：限制仅允许特定地区/国家访问

ihanyouqing#gmail.com (#->@) (Youqing Han) — Mon, 01 Sep 2025 10:00:00 +0800

概述

需求来自某好友某生产环境，有古老的应用运行于远古的操作系统之上，年久失修，无人维护。某日，或老板/或领导/或客户，心血来潮提出一些需求，比如根据访问者的地理位置来限制对网站或API的访问。以应对以下场景：

合规性要求（如GDPR、数据本地化）
许可证限制（某些服务仅在特定国家可用）
安全防护（阻止来自特定地区的恶意流量）
业务需求（仅服务特定市场）

本文将详细介绍在CentOS系统上配置Nginx实现地理访问控制的多种方法。

方法一：使用Nginx GeoIP模块（推荐）

注意：CentOS 7兼容性

在CentOS 7上，默认的Nginx包可能不包含GeoIP模块。如果遇到模块缺失问题，请参考以下解决方案：

检查现有Nginx是否支持GeoIP：

nginx -V 2>&1 | grep -o with-http_geoip_module

如果支持，直接使用；如果不支持，选择以下方案之一：
- 使用防火墙规则（方法二）
- 使用第三方服务（方法三）
- 重新编译Nginx（见下方安装步骤）

1. 安装GeoIP模块

# 安装EPEL仓库
sudo yum install -y epel-release

# 安装GeoIP工具和数据库
yum -y install GeoIP GeoIP-devel GeoIP-data.noarch GeoIP geoipupdate geoipupdate-cron

# 检查Nginx是否已安装GeoIP模块
nginx -V 2>&1 | grep -o with-http_geoip_module

# 如果没有GeoIP模块，需要重新编译Nginx
# 安装编译依赖
sudo yum groupinstall -y "Development Tools"
sudo yum install -y pcre-devel zlib-devel openssl-devel libxml2-devel libxslt-devel gd-devel perl-devel perl-ExtUtils-Embed

# 安装Google perftools（如果启用该模块）
sudo yum install -y gperftools gperftools-devel

# 下载Nginx源码并编译（如果需要）
wget http://nginx.org/download/nginx-1.28.0.tar.gz
tar -xvf nginx-1.28.0.tar.gz
cd nginx-1.28.0

# 参数从原 nginx -V 中获取，追加 --with-http_geoip_module 
./configure --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-compat --with-debug --with-file-aio --with-google_perftools_module --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_degradation_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_image_filter_module=dynamic --with-http_mp4_module --with-http_perl_module=dynamic --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-http_xslt_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-stream_ssl_preread_module --with-threads --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E' --with-http_geoip_module 

make && sudo make install

# 检查Nginx是否支持GeoIP模块
/usr/sbin/nginx -V 2>&1 | grep -o with-http_geoip_module

2. 下载MaxMind GeoIP数据库

# # 创建目录
# sudo mkdir -pv /usr/share/GeoIP

# # 下载GeoIP2数据库（需要Nginx支持geoip2模块）
# wget -P /usr/share/GeoIP https://github.com/P3TERX/GeoLite.mmdb/raw/download/GeoLite2-ASN.mmdb
# wget -P /usr/share/GeoIP https://github.com/P3TERX/GeoLite.mmdb/raw/download/GeoLite2-Country.mmdb
# wget -P /usr/share/GeoIP https://github.com/P3TERX/GeoLite.mmdb/raw/download/GeoLite2-City.mmdb
# ln -s /usr/share/GeoIP/GeoLite2-Country.mmdb /usr/share/GeoIP/GeoLite2-Country.dat

# 验证数据库文件
ls -la /usr/share/GeoIP/
geoiplookup 8.8.8.8

3. 配置Nginx

在/etc/nginx/nginx.conf中添加：

Kubernetes Best Practices for Production

ihanyouqing#gmail.com (#->@) (Youqing Han) — Fri, 22 Aug 2025 00:00:00 +0000

Introduction

Kubernetes has become the de facto standard for container orchestration in production environments. However, running Kubernetes in production requires careful planning, proper configuration, and adherence to best practices. This comprehensive guide covers essential practices for deploying and managing Kubernetes clusters in production environments.

Security Best Practices

1. RBAC and Access Control

Implement proper Role-Based Access Control (RBAC) to ensure least privilege access.

# ClusterRole for application developers
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: app-developer
rules:
  - apiGroups: [""]
    resources: ["pods", "services", "configmaps", "secrets"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["apps"]
    resources: ["deployments", "replicasets"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["networking.k8s.io"]
    resources: ["ingresses"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

---
# ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: app-developer-binding
subjects:
  - kind: ServiceAccount
    name: app-developer
    namespace: production
roleRef:
  kind: ClusterRole
  name: app-developer
  apiGroup: rbac.authorization.k8s.io

---
# ServiceAccount
apiVersion: v1
kind: ServiceAccount
metadata:
  name: app-developer
  namespace: production

2. Network Policies

Implement network policies to control pod-to-pod communication.