added config files, updated port requirements, refined rke install and renamed file, updated h-tags, and added amazon notes for custom clusters

2026-09-25 04:28:15 +00:00 · 2018-04-28 17:02:44 -07:00
parent 1f2dcb9a65
commit 16c78bc5ac
14 changed files with 1131 additions and 248 deletions
@@ -37,6 +37,57 @@ Worker nodes are used to run the kubelet and the workload. It also runs the stor

 RKE is Rancher’s own lightweight Kubernetes installer. It works with any cloud providers, virtualization platforms, or bare metal servers. It integrates with node drivers to automatically provision nodes on AWS, Azure, DigitalOcean, vSphere, OpenStack, etc. Users can add custom nodes to the cluster by running the Rancher agent on these nodes.

+##### RKE and Amazon AWS EC2: Adding Hosts
+
+When setting up a custom cluster configured to run with an AWS cloud provider, any hosts you add to the cluster:
+
+- Must be an AWS EC2 instance.
+- Must have the following IAM policy at minimum:
+
+```
+{
+  "Effect": "Allow",
+  "Action": "ec2:Describe*",
+  "Resource": "*"
+}
+```
+In order to use Amazon Elastic Load Balancers (ELBs) and EBS with Kubernetes, the host requires the IAM role with appropriate access.
+
+**Example Policy for IAM Role**
+
+```
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": "ec2:Describe*",
+      "Resource": "*"
+    },
+    {
+      "Effect": "Allow",
+      "Action": "ec2:AttachVolume",
+      "Resource": "*"
+    },
+    {
+      "Effect": "Allow",
+      "Action": "ec2:DetachVolume",
+      "Resource": "*"
+    },
+    {
+      "Effect": "Allow",
+      "Action": ["ec2:*"],
+      "Resource": ["*"]
+    },
+    {
+      "Effect": "Allow",
+      "Action": ["elasticloadbalancing:*"],
+      "Resource": ["*"]
+    }
+  ]
+}
+```
+
 #### Cloud-Managed Kubernetes Clusters

 Rancher integrates with cloud APIs so users can provision GKE, EKS, and AKS clusters directly from Rancher. New cloud managed Kubernetes clusters will be added as they become available.
@@ -0,0 +1,223 @@
+---
+title: Option 2—Install by RKE
+weight: 275
+---
+# Install by RKE
+
+You can deploy Rancher using the Rancher Kubernetes Engine (RKE). RKE is Rancher's own fast and light-weight Kubernetes installer. Rancher installation using RKE is the best install option for two different use cases:
+
+- When installing Rancher on a Kubernettes cluster that is already running.
+
+- When you want to set up a new production Kubernettes cluster running in a high-availablity configuration.
+
+
+## Objectives
+
+We've broken installation of Rancher by RKE into a series of smaller tasks. Here's what you'll do during your RKE install.
+
+1. [Provision Linux Hosts](#provision-linux-hosts)
+
+	Begin by provisioning Linux hosts or an existing Kubernettes cluster. Make sure your hosts meet Rancher requirements.
+
+2. [Get RKE](#get-rke)
+
+	Download the RKE installer from GitHub.
+
+3. [Get YAML Template](#get-yaml-template)
+
+	During installation, the RKE uploads a `.yml` config file containing specifications for your cluster. You'll have to configure this file. We have a variety of config file templates available for download.
+
+4. [Edit YAML Template](#edit-yaml-template)
+
+	After you download a config file template, edit it according to how you want to configure Rancher and your Kubernetes cluster.
+
+5. [Run RKE](#run-rke)
+
+	Finally, run the RKE installer with it pointing toward your config file.
+
+### Provision Linux Hosts
+
+Before you install Rancher, confirm you meet the requirements.
+
+- If you want to install Rancher on a Kubernettes cluster that's already running, make sure its nodes meet the requirements below.
+
+- If you want to install Rancher on a new Kubernettes cluster in a high-availabilty configuration, provision three new Linux hosts using the requirements below.
+
+#### Requirements
+
+{{< requirements_os >}}
+
+{{< requirements_hardware >}}
+
+{{< requirements_software >}}
+
+{{< requirements_ports >}}
+
+{{< requirements_ha >}}
+
+### Get RKE
+
+Rancher Kubernetes Engine (RKE) is a fast, versatile Kubernetes installer you can use to install Kubernetes on your Linux hosts. You can download RKE from GitHub.
+
+1. From your workstation, open a web browser and navigate to [https://github.com/rancher/rke/releases](https://github.com/rancher/rke/releases). Download the latest RKE installer.
+
+2. Make the RKE binary that you just downloaded executable. Open Terminal, change directory to the location of the RKE binary, and then run the following command:
+
+    ```
+    $ chmod +x rke
+    ```
+
+    >**Note:** adjust the command for the version of RKE that you downloaded (e.g., `rke_darwin-amd64`)
+
+3.  Confirm that RKE is now executable by running the following command:
+
+    ```
+    $ ./rke -version
+    ```
+
+**Result:** You receive output similar to what follows:
+```
+rke version v<N.N.N>
+```
+
+### Get YAML Template
+
+During installation, RKE uploads a `.yml` config file to install and configure your Kubernetes cluster. Download one of the `.yml` templates that we provide to get you started. Choose a template based on how many nodes are in your cluster and the type of certificate you plan on using:
+
+- Auto-Generated Self-Signed Certifcates (i.e. SSL passthrough):
+
+	- [3-node-passthrough.yml]({{< baseurl >}}/rke-yml/3-node-passthrough.yml)
+	- [5-node-passthrough.yml]({{< baseurl >}}/rke-yml/5-node-passthrough.yml)
+	- [7-node-passthrough.yml]({{< baseurl >}}/rke-yml/7-node-passthrough.yml)
+<br/>
+<br/>
+- Bring Your Own Certificate (either CA- or Self-Signed):
+
+	- [3-node-certificate.yml]({{< baseurl >}}/rke-yml/3-node-certificate.yml)
+	- [5-node-certificate.yml]({{< baseurl >}}/rke-yml/5-node-certificate.yml)
+	- [7-node-certificate.yml]({{< baseurl >}}/rke-yml/7-node-certificate.yml)
+
+### Edit YAML Template
+
+Once you have a template, customize it to suit your needs.
+
+1. Open the `.yml` file that you just downloaded.
+
+2. Update the `nodes` section with your [Linux hosts](#provision-linux-hosts).
+
+	1. For each node in your cluster, update the following placeholders:
+
+		- `<IP>`: The IP address or hostname of the node.
+		- `<USER>`: The node root user (usually `root`).
+		- `<PEM_FILE>`: The path of the `.pem` file used to authenticate.
+
+	2. For each node in your cluster, choose what roles each node should fill. Delete any roles that aren't needed on the node.
+
+    **Example YAML**
+
+		nodes:
+		  - address: <IP> # IP to access nodes
+			user: <USER> # root user (usually 'root')
+			role: [controlplane,etcd,worker] # K8s roles for node
+			ssh_key_path: <PEM_FILE> # path to PEM file
+		  - address: <IP>
+			user: <USER>
+			role: [controlplane,etcd,worker]
+			ssh_key_path: <PEM_FILE>
+		  - address: <IP>
+			user: <USER>
+			role: [controlplane,etcd,worker]
+			ssh_key_path: <PEM_FILE>
+
+3. Scroll to `kind: Ingress`. Replace the two `<FQDN>` placeholders with the FQDN mapped to each IP address for `controlplane` and/or `worker` nodes on your DNS. On your DNS Server, each node should be added to the DNS entry for the FQDN.
+
+	**Example YAML**
+
+		spec:
+		  rules:
+		  - host: <FQDN>  # FQDN to access cattle server
+			http:
+			  paths:
+			  - backend:
+				  serviceName: cattle-service
+				  servicePort: 80
+		  tls:
+		  - secretName: cattle-keys-ingress
+			hosts:
+			- <FQDN>      # FQDN to access cattle server
+
+
+    >**Using Auto-Generated Self-Signed Certificates?**
+    >
+    >The next two steps don't apply to you. Save the `.yml` config file and continue to [Run RKE](#run-rke).
+
+4. **Bring Your Own Certificate only:** Scroll to the codeblock that follows.
+
+    ```
+    apiVersion: v1
+    kind: Secret
+    metadata:
+      name: cattle-keys-server
+      namespace: cattle-system
+    type: Opaque
+    data:
+      cert.pem: <BASE64_CRT>    # ssl cert for cattle server.
+      key.pem: <BASE64_KEY>     # ssl key for cattle server.
+      cacerts.pem: <BASE64_CA>  # CA cert used to sign cattle server cert and key
+    ```
+
+    Replace each placeholder with the applicable `.pem`.
+
+    - `<BASE64_CRT>`
+    - `<BASE64_KEY>`
+    - `<BASE64_CA>`
+
+	>**Important:**
+    >
+    >   - Each `.pem` must be in base-64: `cat <PEM_FILE> | base64`
+    >   - If you're using a self-signed certificate, the `cattle-keys-server` in this step and `cattle-keys-ingress` in the next step must use certificates and keys signed by the same CA.
+
+5. **Bring Your Own Certificate only:** Scroll to the codeblock that follows.
+
+    ```
+    apiVersion: v1
+    kind: Secret
+    metadata:
+      name: cattle-keys-ingress
+      namespace: cattle-system
+    type: Opaque
+    data:
+      tls.crt: <BASE64_CRT>  # ssl cert for ingress. If selfsigned, must be signed by same CA as cattle server
+      tls.key: <BASE64_KEY>  # ssl key for ingress. If selfsigned, must be signed by same CA as cattle server
+    ```
+
+    Replace each placeholder with the applicable `.pem`.
+
+    - `<BASE64_CRT>`
+    - `<BASE64_KEY>`
+
+
+    >**Reminder:**
+    >
+    >   - Each `.pem` must be in base-64: `cat <PEM_FILE> | base64`
+    >   If you're using a self-signed certificate, the `cattle-keys-server` from last step and `cattle-keys-ingress` from this step must use certificates and keys signed by the same CA.
+
+6. Save the `.yml` file and close it.
+
+### Run RKE
+
+Enter the command to run RKE while pointing to your `.yml` file. RKE will install Kubernetes and Rancher using your parameters.
+
+1. From your workstation, make sure your `.yml` config file and RKE are in the same directory.
+
+2. Open a Terminal instance. Change to the directory that contains your config file and RKE.
+
+3. Enter the following command, replacing the placeholder name with the name of the `.yml` config template that you used.
+
+	```
+	rke up --config <YAML_TEMPLATE>
+	```
+
+### What's Next?
+
+Log in to Rancher to make sure it deployed successfully. Open a web browser and navigate to the FQDN used earlier in this procedure.
@@ -1,5 +1,5 @@
 <div>
-	<h2>High Availablity Requirements</h2>
+	<h4>High Availablity Requirements</h4>
 	<ul>
 		<li>RKE Cluster</li>
 		<ul>
@@ -1,5 +1,5 @@
 <div>
-	<h2>Hardware Requirements</h2>
+	<h4>Hardware Requirements</h4>
 	<ul>
 		<li>Memory: 4GB</li>
 	</ul>
@@ -1,5 +1,5 @@
 <div>
-	<h2>Operating System Requirements</h2>
+	<h4>Operating System Requirements</h4>
 	<ul>
 		<li>Ubuntu 16.04 (64-bit)</li>
 		<li>Red Hat Enterprise Linux 7.5 (64-bit)</li>
@@ -1,48 +1,59 @@
 <div>
-	<h3>Master Nodes (etcd and controlplane nodes)</h3>
-	<br/>
+	<h5>Port Requirements</h5>
+	<h6>Master Nodes (etcd and controlplane nodes)</h6>
 	<table>
 	    <tr>
 	        <th>protocol</th>
-	        <th>direction</th>
 	        <th>port range</th>
 	        <th>purpose</th>
 	    </tr>
 	    <tr>
-	        <td rowspan="9">tcp</td>
-	        <td rowspan="10">inbound</td>
+	        <td>tcp</td>
 	        <td>22</td>
 	        <td>ssh server</td>
 	    </tr>
 	    <tr>
-	        <td>80</td>
-	        <td>http</td>
-	    </tr>
-	    <tr>
-	        <td>443</td>
-	        <td>https</td>
-	    </tr>
-	    <tr>
+			<td>tcp</td>
 	        <td>6443</td>
 	        <td>kubernetes api server</td>
 	    </tr>
 	    <tr>
+			<td>tcp</td>
 	        <td>2379-2380</td>
 	        <td>etcd server client api</td>
 	    </tr>
-	    <tr>
+		<tr>
+			<td>tcp</td>
 	        <td>10250</td>
 	        <td>kubelet api</td>
 	    </tr>
-	    <tr>
+		<tr>
+			<td>tcp</td>
 	        <td>10251</td>
 	        <td>scheduler</td>
 	    </tr>
-	    <tr>
+		<tr>
+			<td>tcp</td>
 	        <td>10252</td>
-	        <td>controller</td>
+	        <td>kube-controller-manager</td>
+	    </tr>
+		<tr>
+			<td>tcp</td>
+	        <td>10253</td>
+	        <td>federation</td>
+	    </tr>
+		<tr>
+			<td>tcp</td>
+	        <td>10254</td>
+	        <td>ingress</td>
+	    </tr>
+		<tr>
+			<td>tcp</td>
+	        <td>10255</td>
+	        <td>read-only kubelet api</td>
 	    </tr>
 	    <tr>
+			<td>tcp</td>
 	        <td>10256</td>
 	        <td>kubeproxy</td>
 	    </tr>
@@ -52,38 +63,65 @@
 	        <td>canal</td>
 	    </tr>
 	</table>
-	<h3>Worker Nodes</h3>
-	<br/>
+	<h6>Worker Nodes</h6>
 	<table>
 	    <tr>
-	        <td>protocol</td>
-	        <td>direction</td>
-	        <td>port range</td>
-	        <td>purpose</td>
+	        <th>protocol</th>
+	        <th>port range</th>
+	        <th>purpose</th>
 	    </tr>
 	    <tr>
-	        <td rowspan="6">tcp</td>
-	        <td rowspan="7">inbound</td>
+	        <td>tcp</td>
 	        <td>22</td>
 	        <td>ssh server</td>
 	    </tr>
 	    <tr>
+			<td>tcp</td>
 	        <td>80</td>
-	        <td>http</td>
+	        <td>ingress</td>
 	    </tr>
 	    <tr>
+			<td>tcp</td>
 	        <td>443</td>
-	        <td>https</td>
+	        <td>ingress</td>
 	    </tr>
 	    <tr>
+			<td>tcp</td>
 	        <td>10250</td>
 	        <td>kubelet api</td>
+	    </tr>
+		<tr>
+			<td>tcp</td>
+	        <td>10251</td>
+	        <td>scheduler</td>
+	    </tr>
+		<tr>
+			<td>tcp</td>
+	        <td>10252</td>
+	        <td>kube-controller-manager</td>
+	    </tr>
+		<tr>
+			<td>tcp</td>
+	        <td>10253</td>
+	        <td>federation</td>
+	    </tr>
+		<tr>
+			<td>tcp</td>
+	        <td>10254</td>
+	        <td>ingress</td>
+	    </tr>
+		<tr>
+			<td>tcp</td>
+	        <td>10255</td>
+	        <td>read-only kubelet api</td>
 	    </tr>
 	    <tr>
+			<td>tcp</td>
 	        <td>10256</td>
 	        <td>kubeproxy</td>
 	    </tr>
 	    <tr>
+			<td>tcp</td>
 	        <td>30000-32767</td>
 	        <td>nodeport services</td>
 	    </tr>
@@ -1,5 +1,5 @@
 <div>
-	<h2>Software Requestions</h2>
+	<h4>Software Requestions</h4>
 	<ul>
 		<li>
 			<p>Docker</p>
@@ -0,0 +1,137 @@
+# default k8s version: v1.8.9-rancher1-1
+# default network plugin: flannel
+nodes:
+  - address: <IP> # hostname or IP to access nodes
+    user: <USER> # root user (usually 'root')
+    role: [controlplane,etcd,worker] # K8s roles for node
+    ssh_key_path: <PEM_FILE> # path to PEM file
+  - address: <IP>
+    user: <USER>
+    role: [controlplane,etcd,worker]
+    ssh_key_path: <PEM_FILE>
+  - address: <IP>
+    user: <USER>
+    role: [etcd,worker]
+    ssh_key_path: <PEM_FILE>
+
+addons: |-
+  ---
+  kind: Namespace
+  apiVersion: v1
+  metadata:
+    name: cattle-system
+  ---
+  kind: ServiceAccount
+  apiVersion: v1
+  metadata:
+    name: cattle-admin
+    namespace: cattle-system
+  ---
+  kind: ClusterRoleBinding
+  apiVersion: rbac.authorization.k8s.io/v1
+  metadata:
+    name: cattle-crb
+    namespace: cattle-system
+  subjects:
+  - kind: ServiceAccount
+    name: cattle-admin
+    namespace: cattle-system
+  roleRef:
+    kind: ClusterRole
+    name: cluster-admin
+    apiGroup: rbac.authorization.k8s.io
+  ---
+  apiVersion: v1
+  kind: Secret
+  metadata:
+    name: cattle-keys-ingress
+    namespace: cattle-system
+  type: Opaque
+  data:
+    tls.crt: <BASE64_CRT>  # ssl cert for ingress. If selfsigned, must be signed by same CA as cattle server
+    tls.key: <BASE64_KEY>  # ssl key for ingress. If selfsigned, must be signed by same CA as cattle server
+  ---
+  apiVersion: v1
+  kind: Secret
+  metadata:
+    name: cattle-keys-server
+    namespace: cattle-system
+  type: Opaque
+  data:
+    cert.pem: <BASE64_CRT>    # ssl cert for cattle server.
+    key.pem: <BASE64_KEY>     # ssl key for cattle server.
+    cacerts.pem: <BASE64_CA>  # CA cert used to sign cattle server cert and key
+  ---
+  apiVersion: v1
+  kind: Service
+  metadata:
+    namespace: cattle-system
+    name: cattle-service
+    labels:
+      app: cattle
+  spec:
+    ports:
+    - port: 80
+      targetPort: 80
+      protocol: TCP
+      name: http
+    - port: 443
+      targetPort: 443
+      protocol: TCP
+      name: https
+    selector:
+      app: cattle
+  ---
+  apiVersion: extensions/v1beta1
+  kind: Ingress
+  metadata:
+    namespace: cattle-system
+    name: cattle-ingress-http
+    annotations:
+      nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
+      nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"   # Max time in seconds for ws to remain shell window open
+      nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"   # Max time in seconds for ws to remain shell window open
+  spec:
+    rules:
+    - host: <FQDN>  # FQDN to access cattle server
+      http:
+        paths:
+        - backend:
+            serviceName: cattle-service
+            servicePort: 80
+    tls:
+    - secretName: cattle-keys-ingress
+      hosts:
+      - <FQDN>      # FQDN to access cattle server
+  ---
+  kind: Deployment
+  apiVersion: extensions/v1beta1
+  metadata:
+    namespace: cattle-system
+    name: cattle
+  spec:
+    replicas: 1
+    template:
+      metadata:
+        labels:
+          app: cattle
+      spec:
+        serviceAccountName: cattle-admin
+        containers:
+        - image: rancher/rancher:master
+          imagePullPolicy: Always
+          name: cattle-server
+          ports:
+          - containerPort: 80
+            protocol: TCP
+          - containerPort: 443
+            protocol: TCP
+          volumeMounts:
+          - mountPath: /etc/rancher/ssl
+            name: cattle-keys-volume
+            readOnly: true
+        volumes:
+        - name: cattle-keys-volume
+          secret:
+            defaultMode: 420
+            secretName: cattle-keys-server
@@ -0,0 +1,110 @@
+# default k8s version: v1.8.9-rancher1-1
+# default network plugin: flannel
+
+nodes:
+  - address: <IP> # hostname or IP to access nodes
+    user: <USER> # root user (usually 'root')
+    role: [controlplane,etcd,worker] # K8s roles for node
+    ssh_key_path: <PEM_FILE> # path to PEM file
+  - address: <IP>
+    user: <USER>
+    role: [controlplane,etcd,worker]
+    ssh_key_path: <PEM_FILE>
+  - address: <IP>
+    user: <USER>
+    role: [etcd,worker]
+    ssh_key_path: <PEM_FILE>
+
+ingress:
+  provider: nginx
+  extra_args:
+    enable-ssl-passthrough: ""
+
+addons: |-
+  ---
+  kind: Namespace
+  apiVersion: v1
+  metadata:
+    name: cattle-system
+  ---
+  kind: ServiceAccount
+  apiVersion: v1
+  metadata:
+    name: cattle-admin
+    namespace: cattle-system
+  ---
+  kind: ClusterRoleBinding
+  apiVersion: rbac.authorization.k8s.io/v1
+  metadata:
+    name: cattle-crb
+    namespace: cattle-system
+  subjects:
+  - kind: ServiceAccount
+    name: cattle-admin
+    namespace: cattle-system
+  roleRef:
+    kind: ClusterRole
+    name: cluster-admin
+    apiGroup: rbac.authorization.k8s.io
+  ---
+  apiVersion: v1
+  kind: Service
+  metadata:
+    namespace: cattle-system
+    name: cattle-service
+    labels:
+      app: cattle
+  spec:
+    ports:
+    - port: 80
+      targetPort: 80
+      protocol: TCP
+      name: http
+    - port: 443
+      targetPort: 443
+      protocol: TCP
+      name: https
+    selector:
+      app: cattle
+  ---
+  apiVersion: extensions/v1beta1
+  kind: Ingress
+  metadata:
+    namespace: cattle-system
+    name: cattle-ingress-http
+    annotations:
+      nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
+      nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"   # Max time in seconds for ws to remain shell window open
+      nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"   # Max time in seconds for ws to remain shell window open
+      nginx.ingress.kubernetes.io/ssl-passthrough: "true"      # Enable ssl-passthrough to backend.
+  spec:
+    rules:
+    - host: <FQDN>  # FQDN to access cattle server
+      http:
+        paths:
+        - backend:
+            serviceName: cattle-service
+            servicePort: 443
+  ---
+  kind: Deployment
+  apiVersion: extensions/v1beta1
+  metadata:
+    namespace: cattle-system
+    name: cattle
+  spec:
+    replicas: 1
+    template:
+      metadata:
+        labels:
+          app: cattle
+      spec:
+        serviceAccountName: cattle-admin
+        containers:
+        - image: rancher/rancher:master
+          imagePullPolicy: Always
+          name: cattle-server
+          ports:
+          - containerPort: 80
+            protocol: TCP
+          - containerPort: 443
+            protocol: TCP
@@ -0,0 +1,145 @@
+# default k8s version: v1.8.9-rancher1-1
+# default network plugin: flannel
+nodes:
+  - address: <IP> # hostname or IP to access nodes
+    user: <USER> # root user (usually 'root')
+    role: [controlplane,etcd,worker] # K8s roles for node
+    ssh_key_path: <PEM_FILE> # path to PEM file
+  - address: <IP>
+    user: <USER>
+    role: [controlplane,etcd,worker]
+    ssh_key_path: <PEM_FILE>
+  - address: <IP>
+    user: <USER>
+    role: [etcd,worker]
+    ssh_key_path: <PEM_FILE>
+  - address: <IP>
+    user: <USER>
+    role: [etcd,worker]
+    ssh_key_path: <PEM_FILE>
+  - address: <IP>
+    user: <USER>
+    role: [etcd,worker]
+    ssh_key_path: <PEM_FILE>
+
+addons: |-
+  ---
+  kind: Namespace
+  apiVersion: v1
+  metadata:
+    name: cattle-system
+  ---
+  kind: ServiceAccount
+  apiVersion: v1
+  metadata:
+    name: cattle-admin
+    namespace: cattle-system
+  ---
+  kind: ClusterRoleBinding
+  apiVersion: rbac.authorization.k8s.io/v1
+  metadata:
+    name: cattle-crb
+    namespace: cattle-system
+  subjects:
+  - kind: ServiceAccount
+    name: cattle-admin
+    namespace: cattle-system
+  roleRef:
+    kind: ClusterRole
+    name: cluster-admin
+    apiGroup: rbac.authorization.k8s.io
+  ---
+  apiVersion: v1
+  kind: Secret
+  metadata:
+    name: cattle-keys-ingress
+    namespace: cattle-system
+  type: Opaque
+  data:
+    tls.crt: <BASE64_CRT>  # ssl cert for ingress. If selfsigned, must be signed by same CA as cattle server
+    tls.key: <BASE64_KEY>  # ssl key for ingress. If selfsigned, must be signed by same CA as cattle server
+  ---
+  apiVersion: v1
+  kind: Secret
+  metadata:
+    name: cattle-keys-server
+    namespace: cattle-system
+  type: Opaque
+  data:
+    cert.pem: <BASE64_CRT>    # ssl cert for cattle server.
+    key.pem: <BASE64_KEY>     # ssl key for cattle server.
+    cacerts.pem: <BASE64_CA>  # CA cert used to sign cattle server cert and key
+  ---
+  apiVersion: v1
+  kind: Service
+  metadata:
+    namespace: cattle-system
+    name: cattle-service
+    labels:
+      app: cattle
+  spec:
+    ports:
+    - port: 80
+      targetPort: 80
+      protocol: TCP
+      name: http
+    - port: 443
+      targetPort: 443
+      protocol: TCP
+      name: https
+    selector:
+      app: cattle
+  ---
+  apiVersion: extensions/v1beta1
+  kind: Ingress
+  metadata:
+    namespace: cattle-system
+    name: cattle-ingress-http
+    annotations:
+      nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
+      nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"   # Max time in seconds for ws to remain shell window open
+      nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"   # Max time in seconds for ws to remain shell window open
+  spec:
+    rules:
+    - host: <FQDN>  # FQDN to access cattle server
+      http:
+        paths:
+        - backend:
+            serviceName: cattle-service
+            servicePort: 80
+    tls:
+    - secretName: cattle-keys-ingress
+      hosts:
+      - <FQDN>      # FQDN to access cattle server
+  ---
+  kind: Deployment
+  apiVersion: extensions/v1beta1
+  metadata:
+    namespace: cattle-system
+    name: cattle
+  spec:
+    replicas: 1
+    template:
+      metadata:
+        labels:
+          app: cattle
+      spec:
+        serviceAccountName: cattle-admin
+        containers:
+        - image: rancher/rancher:master
+          imagePullPolicy: Always
+          name: cattle-server
+          ports:
+          - containerPort: 80
+            protocol: TCP
+          - containerPort: 443
+            protocol: TCP
+          volumeMounts:
+          - mountPath: /etc/rancher/ssl
+            name: cattle-keys-volume
+            readOnly: true
+        volumes:
+        - name: cattle-keys-volume
+          secret:
+            defaultMode: 420
+            secretName: cattle-keys-server
@@ -0,0 +1,118 @@
+# default k8s version: v1.8.9-rancher1-1
+# default network plugin: flannel
+
+nodes:
+  - address: <IP> # hostname or IP to access nodes
+    user: <USER> # root user (usually 'root')
+    role: [controlplane,etcd,worker] # K8s roles for node
+    ssh_key_path: <PEM_FILE> # path to PEM file
+  - address: <IP>
+    user: <USER>
+    role: [controlplane,etcd,worker]
+    ssh_key_path: <PEM_FILE>
+  - address: <IP>
+    user: <USER>
+    role: [etcd,worker]
+    ssh_key_path: <PEM_FILE>
+  - address: <IP>
+    user: <USER>
+    role: [etcd,worker]
+    ssh_key_path: <PEM_FILE>
+  - address: <IP>
+    user: <USER>
+    role: [etcd,worker]
+    ssh_key_path: <PEM_FILE>
+
+ingress:
+  provider: nginx
+  extra_args:
+    enable-ssl-passthrough: ""
+
+addons: |-
+  ---
+  kind: Namespace
+  apiVersion: v1
+  metadata:
+    name: cattle-system
+  ---
+  kind: ServiceAccount
+  apiVersion: v1
+  metadata:
+    name: cattle-admin
+    namespace: cattle-system
+  ---
+  kind: ClusterRoleBinding
+  apiVersion: rbac.authorization.k8s.io/v1
+  metadata:
+    name: cattle-crb
+    namespace: cattle-system
+  subjects:
+  - kind: ServiceAccount
+    name: cattle-admin
+    namespace: cattle-system
+  roleRef:
+    kind: ClusterRole
+    name: cluster-admin
+    apiGroup: rbac.authorization.k8s.io
+  ---
+  apiVersion: v1
+  kind: Service
+  metadata:
+    namespace: cattle-system
+    name: cattle-service
+    labels:
+      app: cattle
+  spec:
+    ports:
+    - port: 80
+      targetPort: 80
+      protocol: TCP
+      name: http
+    - port: 443
+      targetPort: 443
+      protocol: TCP
+      name: https
+    selector:
+      app: cattle
+  ---
+  apiVersion: extensions/v1beta1
+  kind: Ingress
+  metadata:
+    namespace: cattle-system
+    name: cattle-ingress-http
+    annotations:
+      nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
+      nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"   # Max time in seconds for ws to remain shell window open
+      nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"   # Max time in seconds for ws to remain shell window open
+      nginx.ingress.kubernetes.io/ssl-passthrough: "true"      # Enable ssl-passthrough to backend.
+  spec:
+    rules:
+    - host: <FQDN>  # FQDN to access cattle server
+      http:
+        paths:
+        - backend:
+            serviceName: cattle-service
+            servicePort: 443
+  ---
+  kind: Deployment
+  apiVersion: extensions/v1beta1
+  metadata:
+    namespace: cattle-system
+    name: cattle
+  spec:
+    replicas: 1
+    template:
+      metadata:
+        labels:
+          app: cattle
+      spec:
+        serviceAccountName: cattle-admin
+        containers:
+        - image: rancher/rancher:master
+          imagePullPolicy: Always
+          name: cattle-server
+          ports:
+          - containerPort: 80
+            protocol: TCP
+          - containerPort: 443
+            protocol: TCP
@@ -0,0 +1,153 @@
+# default k8s version: v1.8.9-rancher1-1
+# default network plugin: flannel
+nodes:
+  - address: <IP> # hostname or IP to access nodes
+    user: <USER> # root user (usually 'root')
+    role: [controlplane,etcd,worker] # K8s roles for node
+    ssh_key_path: <PEM_FILE> # path to PEM file
+  - address: <IP>
+    user: <USER>
+    role: [controlplane,etcd,worker]
+    ssh_key_path: <PEM_FILE>
+  - address: <IP>
+    user: <USER>
+    role: [etcd,worker]
+    ssh_key_path: <PEM_FILE>
+  - address: <IP>
+    user: <USER>
+    role: [etcd,worker]
+    ssh_key_path: <PEM_FILE>
+  - address: <IP>
+    user: <USER>
+    role: [etcd,worker]
+    ssh_key_path: <PEM_FILE>
+  - address: <IP>
+    user: <USER>
+    role: [etcd,worker]
+    ssh_key_path: <PEM_FILE>
+  - address: <IP>
+    user: <USER>
+    role: [etcd,worker]
+    ssh_key_path: <PEM_FILE>
+
+addons: |-
+  ---
+  kind: Namespace
+  apiVersion: v1
+  metadata:
+    name: cattle-system
+  ---
+  kind: ServiceAccount
+  apiVersion: v1
+  metadata:
+    name: cattle-admin
+    namespace: cattle-system
+  ---
+  kind: ClusterRoleBinding
+  apiVersion: rbac.authorization.k8s.io/v1
+  metadata:
+    name: cattle-crb
+    namespace: cattle-system
+  subjects:
+  - kind: ServiceAccount
+    name: cattle-admin
+    namespace: cattle-system
+  roleRef:
+    kind: ClusterRole
+    name: cluster-admin
+    apiGroup: rbac.authorization.k8s.io
+  ---
+  apiVersion: v1
+  kind: Secret
+  metadata:
+    name: cattle-keys-ingress
+    namespace: cattle-system
+  type: Opaque
+  data:
+    tls.crt: <BASE64_CRT>  # ssl cert for ingress. If selfsigned, must be signed by same CA as cattle server
+    tls.key: <BASE64_KEY>  # ssl key for ingress. If selfsigned, must be signed by same CA as cattle server
+  ---
+  apiVersion: v1
+  kind: Secret
+  metadata:
+    name: cattle-keys-server
+    namespace: cattle-system
+  type: Opaque
+  data:
+    cert.pem: <BASE64_CRT>    # ssl cert for cattle server.
+    key.pem: <BASE64_KEY>     # ssl key for cattle server.
+    cacerts.pem: <BASE64_CA>  # CA cert used to sign cattle server cert and key
+  ---
+  apiVersion: v1
+  kind: Service
+  metadata:
+    namespace: cattle-system
+    name: cattle-service
+    labels:
+      app: cattle
+  spec:
+    ports:
+    - port: 80
+      targetPort: 80
+      protocol: TCP
+      name: http
+    - port: 443
+      targetPort: 443
+      protocol: TCP
+      name: https
+    selector:
+      app: cattle
+  ---
+  apiVersion: extensions/v1beta1
+  kind: Ingress
+  metadata:
+    namespace: cattle-system
+    name: cattle-ingress-http
+    annotations:
+      nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
+      nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"   # Max time in seconds for ws to remain shell window open
+      nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"   # Max time in seconds for ws to remain shell window open
+  spec:
+    rules:
+    - host: <FQDN>  # FQDN to access cattle server
+      http:
+        paths:
+        - backend:
+            serviceName: cattle-service
+            servicePort: 80
+    tls:
+    - secretName: cattle-keys-ingress
+      hosts:
+      - <FQDN>      # FQDN to access cattle server
+  ---
+  kind: Deployment
+  apiVersion: extensions/v1beta1
+  metadata:
+    namespace: cattle-system
+    name: cattle
+  spec:
+    replicas: 1
+    template:
+      metadata:
+        labels:
+          app: cattle
+      spec:
+        serviceAccountName: cattle-admin
+        containers:
+        - image: rancher/rancher:master
+          imagePullPolicy: Always
+          name: cattle-server
+          ports:
+          - containerPort: 80
+            protocol: TCP
+          - containerPort: 443
+            protocol: TCP
+          volumeMounts:
+          - mountPath: /etc/rancher/ssl
+            name: cattle-keys-volume
+            readOnly: true
+        volumes:
+        - name: cattle-keys-volume
+          secret:
+            defaultMode: 420
+            secretName: cattle-keys-server
@@ -0,0 +1,125 @@
+# default k8s version: v1.8.9-rancher1-1
+# default network plugin: flannel
+nodes:
+  - address: <IP> # hostname or IP to access nodes
+    user: <USER> # root user (usually 'root')
+    role: [controlplane,etcd,worker] # K8s roles for node
+    ssh_key_path: <PEM_FILE> # path to PEM file
+  - address: <IP>
+    user: <USER>
+    role: [controlplane,etcd,worker]
+    ssh_key_path: <PEM_FILE>
+  - address: <IP>
+    user: <USER>
+    role: [etcd,worker]
+    ssh_key_path: <PEM_FILE>
+  - address: <IP>
+    user: <USER>
+    role: [etcd,worker]
+    ssh_key_path: <PEM_FILE>
+  - address: <IP>
+    user: <USER>
+    role: [etcd,worker]
+    ssh_key_path: <PEM_FILE>
+  - address: <IP>
+    user: <USER>
+    role: [etcd,worker]
+    ssh_key_path: <PEM_FILE>
+  - address: <IP>
+    user: <USER>
+    role: [etcd,worker]
+    ssh_key_path: <PEM_FILE>
+
+ingress:
+  provider: nginx
+  extra_args:
+    enable-ssl-passthrough: ""
+
+addons: |-
+  ---
+  kind: Namespace
+  apiVersion: v1
+  metadata:
+    name: cattle-system
+  ---
+  kind: ServiceAccount
+  apiVersion: v1
+  metadata:
+    name: cattle-admin
+    namespace: cattle-system
+  ---
+  kind: ClusterRoleBinding
+  apiVersion: rbac.authorization.k8s.io/v1
+  metadata:
+    name: cattle-crb
+    namespace: cattle-system
+  subjects:
+  - kind: ServiceAccount
+    name: cattle-admin
+    namespace: cattle-system
+  roleRef:
+    kind: ClusterRole
+    name: cluster-admin
+    apiGroup: rbac.authorization.k8s.io
+  ---
+  apiVersion: v1
+  kind: Service
+  metadata:
+    namespace: cattle-system
+    name: cattle-service
+    labels:
+      app: cattle
+  spec:
+    ports:
+    - port: 80
+      targetPort: 80
+      protocol: TCP
+      name: http
+    - port: 443
+      targetPort: 443
+      protocol: TCP
+      name: https
+    selector:
+      app: cattle
+  ---
+  apiVersion: extensions/v1beta1
+  kind: Ingress
+  metadata:
+    namespace: cattle-system
+    name: cattle-ingress-http
+    annotations:
+      nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
+      nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"   # Max time in seconds for ws to remain shell window open
+      nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"   # Max time in seconds for ws to remain shell window open
+      nginx.ingress.kubernetes.io/ssl-passthrough: "true"      # Enable ssl-passthrough to backend.
+  spec:
+    rules:
+    - host: <FQDN>  # FQDN to access cattle server
+      http:
+        paths:
+        - backend:
+            serviceName: cattle-service
+            servicePort: 443
+  ---
+  kind: Deployment
+  apiVersion: extensions/v1beta1
+  metadata:
+    namespace: cattle-system
+    name: cattle
+  spec:
+    replicas: 1
+    template:
+      metadata:
+        labels:
+          app: cattle
+      spec:
+        serviceAccountName: cattle-admin
+        containers:
+        - image: rancher/rancher:master
+          imagePullPolicy: Always
+          name: cattle-server
+          ports:
+          - containerPort: 80
+            protocol: TCP
+          - containerPort: 443
+            protocol: TCP