Building OpenSSL RPM Package Tutorial

安装依赖和工具

```bash
yum groupinstall -y 'Development Tools'
yum install -y rpm-build rpmlint rpmdevtools gcc gcc-c++ make perl perl-WWW-Curl
```

生成打包目录

```bash
rpmdev-setuptree
```


- BUILD：源码解压后存放的目录
- RPMS：制作完成后的RPM存放目录
- SOURCES：存放源文件，配置文件，补丁文件等放置的目录
- SPECS：存放SPEC文件，制作RPM包的目录
- SRPMS：src格式的RPM包目录
- BUILDROOT：虚拟安装目录，在整个install的过程中临时安装到此目录，把这个目录当做根来使用。所有在这个目录下的文件才是真正的目录文件，最后SPEC文件中有清理阶段，这个目录下的内容将被删除。

下载源码包

```bash
wget --no-check-certificate https://www.openssl.org/source/openssl-3.3.1.tar.gz
```


拷贝源码包到相应目录

```bash
mv openssl-3.3.1.tar.gz  /root/rpmbuild/SOURCES/
```

创建openssl.spec文件

```
cat << EOF > /root/rpmbuild/SPECS/openssl.spec
Summary: OpenSSL 3.3.1
Name: openssl
Version: %{?version}%{!?version:3.3.1}
Release: 1%{?dist}
Obsoletes: %{name} <= %{version}
Provides: %{name} = %{version}
URL: https://www.openssl.org/
License: GPLv2+

Source: https://www.openssl.org/source/%{name}-%{version}.tar.gz

BuildRequires: make gcc perl perl-WWW-Curl
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
%global openssldir /usr/openssl

%description
OpenSSL RPM for version 3.3.1 

%package devel
Summary: Development files for programs which will use the openssl library
Group: Development/Libraries
Requires: %{name} = %{version}-%{release}

%description devel
OpenSSL RPM for version 3.3.1  (development package)

%prep
%setup -q

%build
./config --prefix=%{openssldir} --openssldir=%{openssldir}
make

%install
[ "%{buildroot}" != "/" ] && %{__rm} -rf %{buildroot}
%make_install

mkdir -p %{buildroot}%{_bindir}
mkdir -p %{buildroot}%{_libdir}
ln -sf %{openssldir}/lib64/libssl.so.3 %{buildroot}%{_libdir}
ln -sf %{openssldir}/lib64/libcrypto.so.3 %{buildroot}%{_libdir}
ln -sf %{openssldir}/bin/openssl %{buildroot}%{_bindir}

%clean
[ "%{buildroot}" != "/" ] && %{__rm} -rf %{buildroot}

%files
%{openssldir}
%defattr(-,root,root)
/usr/bin/openssl
/usr/lib64/libcrypto.so.3
/usr/lib64/libssl.so.3

%files devel
%{openssldir}/include/*
%defattr(-,root,root)

%post -p /sbin/ldconfig

%postun -p /sbin/ldconfig
EOF
```

构建RPM

```bash
rpmbuild -bb --nodebuginfo /root/rpmbuild/SPECS/openssl.spec
```

安装openssl-3.3.1-1.el8.bclinux.x86_64.rpm

```bash
yum -y remove openssl
rpm -ivh /root/rpmbuild/RPMS/x86_64/openssl-3.3.1-1.el8.bclinux.x86_64.rpm --nodeps
openssl version
```


SPEC文件说明：

- Name: 软件包的名称，在后面的变量中即可使用%{name}的方式引用
- Summary: 软件包的内容
- Version: 软件的实际版本号，例如：1.12.1等，后面可使用%{version}引用
- Release: 发布序列号，例如：1%{?dist}，标明第几次打包，后面可使用%{release}引用
- Group: 软件分组，建议使用：Applications/System
- License: 软件授权方式GPLv2
- Source: 源码包，可以带多个用Source1、Source2等源，后面也可以用%{source1}、%{source2}引用
- BuildRoot: 这个是安装或编译时使用的临时目录，即模拟安装完以后生成的文件目录：%_topdir/BUILDROOT 后面可使用$RPM_BUILD_ROOT 方式引用。
- URL: 软件的URI
- Vendor: 打包组织或者人员
- Patch: 补丁源码，可使用Patch1、Patch2等标识多个补丁，使用%patch0或%{patch0}引用
- Prefix: %{_prefix} 这个主要是为了解决今后安装rpm包时，并不一定把软件安装到rpm中打包的目录的情况。这样，必须在这里定义该标识，并在编写%install脚本的时候引用，才能实现rpm安装时重新指定位置的功能
- Prefix: %{_sysconfdir} 这个原因和上面的一样，但由于%{_prefix}指/usr，而对于其他的文件，例如/etc下的配置文件，则需要用%{_sysconfdir}标识
- Requires: 该rpm包所依赖的软件包名称，可以用>=或<=表示大于或小于某一特定版本，例如：
  libxxx-devel >= 1.1.1 openssl-devel 。 注意：“>=”号两边需用空格隔开，而不同软件名称也用空格分开
- %description: 软件的详细说明
- %define: 预定义的变量，例如定义日志路径: _logpath /var/log/weblog
- %prep: 预备参数，通常为 %setup -q
- %build: 编译参数 ./configure --user=nginx --group=nginx --prefix=/usr/local/nginx/……
- %install: 安装步骤,此时需要指定安装路径，创建编译时自动生成目录，复制配置文件至所对应的目录中
- %pre: 安装前需要做的任务，如：创建用户
- %post: 安装后需要做的任务 如：自动启动的任务
- %preun: 卸载前需要做的任务 如：停止任务
- %postun: 卸载后需要做的任务 如：删除用户，删除/备份业务数据
- %clean: 清除上次编译生成的临时文件，就是上文提到的虚拟目录
- %files: 设置文件属性，包含编译文件需要生成的目录、文件以及分配所对应的权限
- %changelog: 修改历史

Building OpenSSL RPM Package

Building OpenSSH RPM Package Tutoial

安装依赖和工具

```bash
yum groupinstall -y "Development Tools"
yum install -y imake rpm-build pam-devel krb5-devel zlib-devel libXt-devel libX11-devel gtk2-devel perl perl-IPC-Cmd openssl-devel
```

生成打包目录

```bash
rpmdev-setuptree
```

下载源码

```bash
wget --no-check-certificate https://src.fedoraproject.org/repo/pkgs/openssh/x11-ssh-askpass-1.2.4.1.tar.gz/8f2e41f3f7eaa8543a2440454637f3c3/x11-ssh-askpass-1.2.4.1.tar.gz
wget --no-check-certificate https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-10.0p1.tar.gz
#wget --no-check-certificate https://www.openssl.org/source/openssl-3.3.1.tar.gz
```

拷贝源码包到相应目录

```bash
cp openssh-10.0p1.tar.gz /root/rpmbuild/SOURCES
#cp openssl-3.3.1.tar.gz /root/rpmbuild/SOURCES
cp x11-ssh-askpass-1.2.4.1.tar.gz /root/rpmbuild/SOURCES
```

复制openssh.spec文件

```bash
tar zxf openssh-10.0p1.tar.gz
cp openssh-10.0p1/contrib/redhat/openssh.spec /root/rpmbuild/SPECS/
```

制作RPM

```bash
rpmbuild -ba --nodebuginfo ~/rpmbuild/SPECS/openssh.spec
```

报错：

error: Installed (but unpackaged) file(s) found:   /usr/libexec/openssh/sshd-auth  

RPM build errors:    Installed (but unpackaged) file(s) found:   /usr/libexec/openssh/sshd-auth

```
%attr(0755,root,root) %{_libexecdir}/openssh/sshd-auth 
# 添加到~/rpmbuild/SPECS/openssh.spec文件371行下面
366 %files server
367 %defattr(-,root,root)
368 %dir %attr(0111,root,root) %{_var}/empty/sshd
369 %attr(0755,root,root) %{_sbindir}/sshd
370 %attr(0755,root,root) %{_libexecdir}/openssh/sshd-session
371 %attr(0755,root,root) %{_libexecdir}/openssh/sftp-server
372 %attr(0755,root,root) %{_libexecdir}/openssh/sshd-auth
373 %attr(0644,root,root) %{_mandir}/man8/sshd.8*
374 %attr(0644,root,root) %{_mandir}/man5/moduli.5*
375 %attr(0644,root,root) %{_mandir}/man5/sshd_config.5*
376 %attr(0644,root,root) %{_mandir}/man8/sftp-server.8*
377 %attr(0755,root,root) %dir %{_sysconfdir}/ssh
378 %attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/sshd_config
379 %attr(0600,root,root) %config(noreplace) /etc/pam.d/sshd
380 %attr(0755,root,root) %config /etc/rc.d/init.d/sshd
381 %endif
```

安装

```bash
cd /root/rpmbuild/RPMS/x86_64/
# 开启2个TTY后
yum localinstall openssh-*.rpm
```

默认关闭selinux时，重启sshd

```bash
chmod 600 /etc/ssh/ssh_host*key && systemctl restart sshd
```

查看版本

```
ssh -V
```

##### openssh-10.0p2

无法登录

```bash
cp /etc/pam.d/sshd /etc/pam.d/sshd.bak
```

```bash
cat > /etc/pam.d/sshd <<EOF
auth       substack     password-auth
auth       include      postlogin
account    required     pam_sepermit.so
account    required     pam_nologin.so
account    include      password-auth
password   include      password-auth
session    required     pam_selinux.so close
session    required     pam_loginuid.so
session    required     pam_selinux.so open env_params
session    required     pam_namespace.so
session    optional     pam_keyinit.so force revoke
session    optional     pam_motd.so
session    include      password-auth
session    include      postlogin
EOF
```

```bash
systemctl restart sshd
```


Building OpenSSH RPM Package

### 集群升级

[升级 kubeadm 集群 |Kubernetes](https://v1-33.docs.kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/)

yum仓库替换版本号，集群所有节点

```
sed -i 's/v1.32/v1.33/g' /etc/yum.repos.d/kubernetes.repo
```

### Master节点

**更新 kubeadm**

```
yum install -y kubeadm-'1.33.4-*' --disableexcludes=kubernetes
```

**检查升级计划**

```
kubeadm upgrade plan
```

**执行升级命令**

```
kubeadm upgrade apply v1.33.4
```

```
[root@k8s-master ~]# kubeadm upgrade apply v1.33.4
[upgrade] Reading configuration from the "kubeadm-config" ConfigMap in namespace "kube-system"...
[upgrade] Use 'kubeadm init phase upload-config --config your-config-file' to re-upload it.
[upgrade/preflight] Running preflight checks
        [WARNING SystemVerification]: cgroups v1 support is in maintenance mode, please migrate to cgroups v2
[upgrade] Running cluster health checks
[upgrade/preflight] You have chosen to upgrade the cluster version to "v1.33.4"
[upgrade/versions] Cluster version: v1.32.6
[upgrade/versions] kubeadm version: v1.33.4
[upgrade] Are you sure you want to proceed? [y/N]: y
。。。
[addons] Applied essential addon: CoreDNS
[addons] Applied essential addon: kube-proxy

[upgrade] SUCCESS! A control plane node of your cluster was upgraded to "v1.33.4".

[upgrade] Now please proceed with upgrading the rest of the nodes by following the right order.
```

```
yum install -y kubelet-'1.33.4-*' kubectl-'1.33.4-*' --disableexcludes=kubernetes
```

```
systemctl daemon-reload && systemctl restart kubelet
```

### Worker 节点

```
yum install -y kubelet-'1.33.4-*' kubectl-'1.33.4-*' --disableexcludes=kubernetes
```

```
[root@k8s-master ~]# kubectl get nodes
NAME           STATUS   ROLES           AGE   VERSION
k8s-master     Ready    control-plane   65d   v1.33.4
k8s-worker-1   Ready    worker          65d   v1.32.6
k8s-worker-2   Ready    worker          65d   v1.32.6
```

```
kubeadm upgrade node
```

```
[root@k8s-worker-1 ~]# kubeadm upgrade node
[upgrade] Reading configuration from the "kubeadm-config" ConfigMap in namespace "kube-system"...
[upgrade] Use 'kubeadm init phase upload-config --config your-config-file' to re-upload it.
[upgrade/preflight] Running pre-flight checks
        [WARNING SystemVerification]: cgroups v1 support is in maintenance mode, please migrate to cgroups v2
[upgrade/preflight] Skipping prepull. Not a control plane node.
[upgrade/control-plane] Skipping phase. Not a control plane node.
[upgrade/kubeconfig] Skipping phase. Not a control plane node.
W0829 12:35:18.060987  102454 postupgrade.go:117] Using temporary directory /etc/kubernetes/tmp/kubeadm-kubelet-config3221878225 for kubelet config. To override it set the environment variable KUBEADM_UPGRADE_DRYRUN_DIR
[upgrade] Backing up kubelet config file to /etc/kubernetes/tmp/kubeadm-kubelet-config3221878225/config.yaml
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[upgrade/kubelet-config] The kubelet configuration for this node was successfully upgraded!
[upgrade/addon] Skipping the addon/coredns phase. Not a control plane node.
[upgrade/addon] Skipping the addon/kube-proxy phase. Not a control plane node.
```

```shell
systemctl daemon-reload && systemctl restart kubelet
```

```bash
[root@k8s-master ~]# kubectl get nodes
NAME           STATUS   ROLES           AGE   VERSION
k8s-master     Ready    control-plane   65d   v1.33.4
k8s-worker-1   Ready    worker          65d   v1.33.4
k8s-worker-2   Ready    worker          65d   v1.33.4
```



集群升级

部署Kubernetes-v1.32集群