mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-09 10:45:48 +00:00
Merge pull request #2238 from sunilarjun/update-ingress
Update ingress-nginx pt 1
This commit is contained in:
Sunil Singh
+1
-4
@@ -10,10 +10,7 @@ Changing the default TLS settings depends on the chosen installation method.
|
||||
|
||||
## Running Rancher in a highly available Kubernetes cluster
|
||||
|
||||
When you install Rancher inside of a Kubernetes cluster, TLS is offloaded at the cluster's ingress controller. The possible TLS settings depend on the used ingress controller:
|
||||
|
||||
* nginx-ingress-controller (default for RKE2): [Default TLS Version and Ciphers](https://kubernetes.github.io/ingress-nginx/user-guide/tls/#default-tls-version-and-ciphers).
|
||||
* traefik (default for K3s): [TLS Options](https://doc.traefik.io/traefik/https/tls/#tls-options).
|
||||
When you install a Rancher managed Kubernetes cluster, TLS is offloaded at the cluster's ingress controller. Traefik is the default ingress for K3s and can be used with RKE2, refer to [TLS Options](https://doc.traefik.io/traefik/https/tls/#tls-options) for further information.
|
||||
|
||||
## Running Rancher in a single Docker container
|
||||
|
||||
|
||||
+7
-12
@@ -8,14 +8,12 @@ title: Setting up Amazon ELB Network Load Balancer
|
||||
|
||||
This how-to guide describes how to set up a Network Load Balancer (NLB) in Amazon's EC2 service that will direct traffic to multiple instances on EC2.
|
||||
|
||||
These examples show the load balancer being configured to direct traffic to three Rancher server nodes. If Rancher is installed on an RKE Kubernetes cluster, three nodes are required. If Rancher is installed on a K3s Kubernetes cluster, only two nodes are required.
|
||||
These examples show the load balancer being configured to direct traffic to three Rancher server nodes. If Rancher is installed on a K3s Kubernetes cluster, only two nodes are required.
|
||||
|
||||
This tutorial is about one possible way to set up your load balancer, not the only way. Other types of load balancers, such as a Classic Load Balancer or Application Load Balancer, could also direct traffic to the Rancher server nodes.
|
||||
|
||||
Rancher only supports using the Amazon NLB when terminating traffic in `tcp` mode for port 443 rather than `tls` mode. This is due to the fact that the NLB does not inject the correct headers into requests when terminated at the NLB. This means that if you want to use certificates managed by the Amazon Certificate Manager (ACM), you should use an ALB.
|
||||
|
||||
|
||||
|
||||
## Requirements
|
||||
|
||||
These instructions assume you have already created Linux instances in EC2. The load balancer will direct traffic to these nodes.
|
||||
@@ -26,7 +24,7 @@ Begin by creating two target groups for the **TCP** protocol, one with TCP port
|
||||
|
||||
Your first NLB configuration step is to create two target groups. Technically, only port 443 is needed to access Rancher, but it's convenient to add a listener for port 80, because traffic to port 80 will be automatically redirected to port 443.
|
||||
|
||||
Regardless of whether an NGINX Ingress or Traefik Ingress controller is used, the Ingress should redirect traffic from port 80 to port 443.
|
||||
The Traefik Ingress should redirect traffic from port 80 to port 443.
|
||||
|
||||
1. Log into the [Amazon AWS Console](https://console.aws.amazon.com/ec2/) to get started. Make sure to select the **Region** where your EC2 instances (Linux nodes) are created.
|
||||
1. Select **Services** and choose **EC2**, find the section **Load Balancing** and open **Target Groups**.
|
||||
@@ -34,7 +32,7 @@ Regardless of whether an NGINX Ingress or Traefik Ingress controller is used, th
|
||||
|
||||
:::note
|
||||
|
||||
Health checks are handled differently based on the Ingress. For details, refer to [this section.](#health-check-paths-for-nginx-ingress-and-traefik-ingresses)
|
||||
For details on Traefik Ingress health checks, refer to [this section.](#health-check-paths-for-traefik-ingresses)
|
||||
|
||||
:::
|
||||
|
||||
@@ -167,13 +165,10 @@ After AWS creates the NLB, click **Close**.
|
||||
|
||||
6. Click **Save** in the top right of the screen.
|
||||
|
||||
## Health Check Paths for NGINX Ingress and Traefik Ingresses
|
||||
## Health Check Paths for Traefik Ingresses
|
||||
|
||||
K3s and RKE Kubernetes clusters handle health checks differently because they use different Ingresses by default.
|
||||
K3s Kubernetes clusters use Traefik as the default Ingress.
|
||||
|
||||
For RKE Kubernetes clusters, NGINX Ingress is used by default, whereas for K3s Kubernetes clusters, Traefik is the default Ingress.
|
||||
The health check path is `/ping`. By default `/ping` is always matched (regardless of Host), and a response from [Traefik itself](https://docs.traefik.io/operations/ping/) is always served.
|
||||
|
||||
- **Traefik:** The health check path is `/ping`. By default `/ping` is always matched (regardless of Host), and a response from [Traefik itself](https://docs.traefik.io/operations/ping/) is always served.
|
||||
- **NGINX Ingress:** The default backend of the NGINX Ingress controller has a `/healthz` endpoint. By default `/healthz` is always matched (regardless of Host), and a response from [`ingress-nginx` itself](https://github.com/kubernetes/ingress-nginx/blob/0cbe783f43a9313c9c26136e888324b1ee91a72f/charts/ingress-nginx/values.yaml#L212) is always served.
|
||||
|
||||
To simulate an accurate health check, it is a best practice to use the Host header (Rancher hostname) combined with `/ping` or `/healthz` (for K3s or for RKE clusters, respectively) wherever possible, to get a response from the Rancher Pods, not the Ingress.
|
||||
To simulate an accurate health check, it is a best practice to use the Host header (Rancher hostname) combined with `/ping` or `/healthz` wherever possible, to get a response from the Rancher Pods, not the Ingress.
|
||||
|
||||
@@ -91,7 +91,7 @@ To use this `kubeconfig` file,
|
||||
|
||||
1. Install [kubectl,](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl) a Kubernetes command-line tool.
|
||||
2. Copy the file at `/etc/rancher/rke2/rke2.yaml` and save it to the directory `~/.kube/config` on your local machine.
|
||||
3. In the kubeconfig file, the `server` directive is defined as localhost. Configure the server as the DNS of your control-plane load balancer, on port 6443. (The RKE2 Kubernetes API Server uses port 6443, while the Rancher server will be served via the NGINX Ingress on ports 80 and 443.) Here is an example `rke2.yaml`:
|
||||
3. In the kubeconfig file, the `server` directive is defined as localhost. Configure the server as the DNS of your control-plane load balancer, on port 6443. (The RKE2 Kubernetes API Server uses port 6443, while the Rancher server will be served via the Traefik Ingress on ports 80 and 443.) Here is an example `rke2.yaml`:
|
||||
|
||||
```yml
|
||||
apiVersion: v1
|
||||
@@ -140,7 +140,8 @@ kube-system etcd-rke2-server-2 1/1 Ru
|
||||
kube-system etcd-rke2-server-3 1/1 Running 0 56s
|
||||
kube-system helm-install-rke2-canal-hs6sx 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-rke2-coredns-xmzm8 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-rke2-ingress-nginx-flwnl 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-traefik-crd-z8vsz 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-traefik-flwnl 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-rke2-metrics-server-7sggn 0/1 Completed 0 2m17s
|
||||
kube-system kube-apiserver-rke2-server-1 1/1 Running 0 116s
|
||||
kube-system kube-apiserver-rke2-server-2 1/1 Running 0 66s
|
||||
@@ -160,9 +161,8 @@ kube-system rke2-canal-swfmq 2/2 Ru
|
||||
kube-system rke2-coredns-rke2-coredns-547d5499cb-6tvwb 1/1 Running 0 92s
|
||||
kube-system rke2-coredns-rke2-coredns-547d5499cb-rdttj 1/1 Running 0 2m8s
|
||||
kube-system rke2-coredns-rke2-coredns-autoscaler-65c9bb465d-85sq5 1/1 Running 0 2m8s
|
||||
kube-system rke2-ingress-nginx-controller-69qxc 1/1 Running 0 52s
|
||||
kube-system rke2-ingress-nginx-controller-7hprp 1/1 Running 0 52s
|
||||
kube-system rke2-ingress-nginx-controller-x658h 1/1 Running 0 52s
|
||||
kube-system traefik-7c844b766f-m9p2w 1/1 Running 0 52s
|
||||
kube-system traefik-7c844b766f-s4l9k 1/1 Running 0 52s
|
||||
kube-system rke2-metrics-server-6564db4569-vdfkn 1/1 Running 0 66s
|
||||
```
|
||||
|
||||
|
||||
+1
-1
@@ -47,7 +47,7 @@ SUSE Linux may have a firewall that blocks all ports by default. In that situati
|
||||
|
||||
### Flatcar Container Linux Nodes
|
||||
|
||||
When [Launching Kubernetes with Rancher](../launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) using Flatcar Container Linux nodes, it is required to use the following configuration in the [Cluster Config File](../../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md#rke-cluster-config-file-reference)
|
||||
When [Launching Kubernetes with Rancher](../launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) using Flatcar Container Linux nodes, it is required to use the following configuration in the Cluster Config File.
|
||||
|
||||
<Tabs>
|
||||
<TabItem value="Canal">
|
||||
|
||||
+1
-11
@@ -7,14 +7,6 @@ description: Configuring an Ingress
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/kubernetes-resources-setup/load-balancer-and-ingress-controller/ingress-configuration"/>
|
||||
</head>
|
||||
|
||||
:::note
|
||||
|
||||
For Kubernetes v1.21 and up, the NGINX Ingress controller no longer runs in hostNetwork by default. It instead uses hostPorts for port 80 and port 443, so you can configure the admission webhook to be accessible only through the ClusterIP. This ensures that the webhook is only accessible from within the cluster.
|
||||
|
||||
Because of this change to the controller, the default RKE1 behavior no longer sets `hostNetwork` to `true`. However, you must set `hostNetwork` to `true` for TCP- and UDP-based Services to work. To do so, [edit](../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md#editing-clusters-with-yaml) the cluster's YAML and follow the steps in the [official RKE1 documentation](https://rke.docs.rancher.com/config-options/add-ons/ingress-controllers#configuring-network-options).
|
||||
|
||||
:::
|
||||
|
||||
## Specify a hostname to use
|
||||
|
||||
If you use this option, Ingress routes requests for a hostname to the service or workload that you specify.
|
||||
@@ -40,6 +32,4 @@ You must have an SSL certificate that Ingress can use to encrypt and decrypt com
|
||||
|
||||
## Labels and Annotations
|
||||
|
||||
Add [Labels](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/) and/or [Annotations](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/) to provide metadata for your Ingress controller.
|
||||
|
||||
For a list of annotations available for use, see the [Nginx Ingress Controller Documentation](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/).
|
||||
Please refer to the Traefik documentation for the full list of Ingress NGINX annotations that are [supported](https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/ingress-nginx/#annotations-support) and [unsupported](https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/ingress-nginx/#unsupported-annotations) by Traefik's kubernetesIngressNginx provider.
|
||||
|
||||
+5
-17
@@ -11,13 +11,11 @@ Kubernetes supports load balancing in two ways: Layer-4 Load Balancing and Layer
|
||||
|
||||
## Layer-4 Load Balancer
|
||||
|
||||
Layer-4 load balancer (or the external load balancer) forwards traffic to Nodeports. Layer-4 load balancer allows you to forward both HTTP and TCP traffic.
|
||||
|
||||
Often, the Layer-4 load balancer is supported by the underlying cloud provider, so when you deploy RKE clusters on bare-metal servers and vSphere clusters, Layer-4 load balancer is not supported. However, a single [globally managed config-map](https://kubernetes.github.io/ingress-nginx/user-guide/exposing-tcp-udp-services/) can be used to expose services on NGINX or third-party ingress.
|
||||
Layer-4 load balancer (or the external load balancer) forwards traffic to NodePorts. Layer-4 load balancer allows you to forward both HTTP and TCP traffic.
|
||||
|
||||
:::note
|
||||
|
||||
It is possible to deploy a cluster with a non-cloud load balancer, such as [MetalLB.](https://metallb.universe.tf/) However, that use case is more advanced than the Layer-4 load balancer supported by a cloud provider, and it is not configurable in Rancher or RKE.
|
||||
It is possible to deploy a cluster with a non-cloud load balancer, such as [MetalLB.](https://metallb.universe.tf/) However, that use case is more advanced than the Layer-4 load balancer supported by a cloud provider, and it is not configurable in Rancher.
|
||||
|
||||
:::
|
||||
|
||||
@@ -30,17 +28,11 @@ Cluster Deployment | Layer-4 Load Balancer Support
|
||||
Amazon EKS | Supported by AWS cloud provider
|
||||
Google GKE | Supported by GCE cloud provider
|
||||
Azure AKS | Supported by Azure cloud provider
|
||||
RKE on EC2 | Supported by AWS cloud provider
|
||||
RKE on DigitalOcean | Limited NGINX or third-party Ingress*
|
||||
RKE on vSphere | Limited NGINX or third party-Ingress*
|
||||
RKE on Custom Hosts<br/>(e.g. bare-metal servers) | Limited NGINX or third-party Ingress*
|
||||
Third-party MetalLB | Limited NGINX or third-party Ingress*
|
||||
|
||||
\* Services can be exposed through a single [globally managed config-map.](https://kubernetes.github.io/ingress-nginx/user-guide/exposing-tcp-udp-services/)
|
||||
Third-party MetalLB | third-party Ingress*
|
||||
|
||||
## Layer-7 Load Balancer
|
||||
|
||||
Layer-7 load balancer (or the ingress controller) supports host and path-based load balancing and SSL termination. Layer-7 load balancer only forwards HTTP and HTTPS traffic and therefore they listen on ports 80 and 443 only. Cloud providers such as Amazon and Google support layer-7 load balancer. In addition, RKE clusters deploys the Nginx Ingress Controller.
|
||||
Layer-7 load balancer (or the ingress controller) supports host and path-based load balancing and SSL termination. Layer-7 load balancer only forwards HTTP and HTTPS traffic and therefore they listen on ports 80 and 443 only. Cloud providers such as Amazon and Google support layer-7 load balancer.
|
||||
|
||||
### Support for Layer-7 Load Balancing
|
||||
|
||||
@@ -51,16 +43,12 @@ Cluster Deployment | Layer-7 Load Balancer Support
|
||||
Amazon EKS | Supported by AWS cloud provider
|
||||
Google GKE | Supported by GKE cloud provider
|
||||
Azure AKS | Not Supported
|
||||
RKE on EC2 | Nginx Ingress Controller
|
||||
RKE on DigitalOcean | Nginx Ingress Controller
|
||||
RKE on vSphere | Nginx Ingress Controller
|
||||
RKE on Custom Hosts<br/>(e.g. bare-metal servers) | Nginx Ingress Controller
|
||||
|
||||
### Host Names in Layer-7 Load Balancer
|
||||
|
||||
Some cloud-managed layer-7 load balancers (such as the ALB ingress controller on AWS) expose DNS addresses for ingress rules. You need to map (via CNAME) your domain name to the DNS address generated by the layer-7 load balancer.
|
||||
|
||||
Other layer-7 load balancers, such as the Google Load Balancer or Nginx Ingress Controller, directly expose one or more IP addresses. Google Load Balancer provides a single routable IP address. Nginx Ingress Controller exposes the external IP of all nodes that run the Nginx Ingress Controller. You can do either of the following:
|
||||
Other layer-7 load balancers, such as the Google Load Balancer, directly expose one or more IP addresses. Google Load Balancer provides a single routable IP address. You can do either of the following:
|
||||
|
||||
1. Configure your own DNS to map (via A records) your domain name to the IP addresses exposes by the Layer-7 load balancer.
|
||||
2. Ask Rancher to generate an xip.io host name for your ingress rule. Rancher will take one of your exposed IPs, say `a.b.c.d`, and generate a host name `<ingressname>.<namespace>.a.b.c.d.xip.io`.
|
||||
|
||||
+2
-10
@@ -42,24 +42,16 @@ As mentioned in the limitations above, the disadvantages of using a load balance
|
||||
- If you run multiple services in your cluster, you must have a load balancer for each service.
|
||||
- It can be expensive to have a load balancer for every service.
|
||||
|
||||
In contrast, when an ingress is used as the entrypoint into a cluster, the ingress can route traffic to multiple services with greater flexibility. It can map multiple HTTP requests to services without individual IP addresses for each service.
|
||||
In contrast, when an ingress is used as the entry point into a cluster, the ingress can route traffic to multiple services with greater flexibility. It can map multiple HTTP requests to services without individual IP addresses for each service.
|
||||
|
||||
Therefore, it is useful to have an ingress if you want multiple services to be exposed with the same IP address, the same Layer 7 protocol, or the same privileged node-ports: 80 and 443.
|
||||
|
||||
Ingress works in conjunction with one or more ingress controllers to dynamically route service requests. When the ingress receives a request, the ingress controller(s) in your cluster direct the request to the correct service based on service subdomains or path rules that you've configured.
|
||||
|
||||
Each Kubernetes Ingress resource corresponds roughly to a file in `/etc/nginx/sites-available/` containing a `server{}` configuration block, where requests for specific files and folders are configured.
|
||||
|
||||
Your ingress, which creates a port of entry to your cluster similar to a load balancer, can reside within your cluster or externally. Ingress and ingress controllers residing in RKE-launched clusters are powered by [Nginx](https://www.nginx.com/).
|
||||
Your ingress, which creates a port of entry to your cluster similar to a load balancer, can reside within your cluster or externally.
|
||||
|
||||
Ingress can provide other functionality as well, such as SSL termination, name-based virtual hosting, and more.
|
||||
|
||||
:::note Using Rancher in a High Availability Configuration?
|
||||
|
||||
Refrain from adding an Ingress to the `local` cluster. The Nginx Ingress Controller that Rancher uses acts as a global entry point for _all_ clusters managed by Rancher, including the `local` cluster. Therefore, when users try to access an application, your Rancher connection may drop due to the Nginx configuration being reloaded. We recommend working around this issue by deploying applications only in clusters that you launch using Rancher.
|
||||
|
||||
:::
|
||||
|
||||
- For more information on how to set up ingress in Rancher, see [Ingress](add-ingresses.md).
|
||||
- For complete information about ingress and ingress controllers, see the [Kubernetes Ingress Documentation](https://kubernetes.io/docs/concepts/services-networking/ingress/)
|
||||
- When using ingresses in a project, you can program the ingress hostname to an external DNS by setting up a Global DNS entry.
|
||||
|
||||
+2
-2
@@ -16,7 +16,7 @@ To use Rancher to install an [RKE](https://rancher.com/docs/rke/latest/en/) Kube
|
||||
|
||||
For details on configuring the Nutanix AOS node template, refer to the [Nutanix AOS node template configuration reference.](../../../../../reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/nutanix.md)
|
||||
|
||||
For details on configuring RKE Kubernetes clusters in Rancher, refer to the [cluster configuration reference.](../../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md)
|
||||
For details on configuring RKE Kubernetes clusters in Rancher, refer to the cluster configuration reference.
|
||||
|
||||
- [Preparation in Nutanix AOS](#preparation-in-nutanix-aos)
|
||||
- [Creating a Nutanix AOS Cluster](#creating-a-nutanix-aos-cluster)
|
||||
@@ -74,7 +74,7 @@ Use Rancher to create a Kubernetes cluster in Nutanix AOS.
|
||||
1. Click **Nutanix**.
|
||||
1. Enter a **Cluster Name**, then click **Continue**.
|
||||
1. Use **Member Roles** to configure user authorization for the cluster. Click **Add Member** to add users who can access the cluster. Use the **Role** drop-down to set permissions for each user.
|
||||
1. Use **Cluster Options** to choose the version of Kubernetes that will be installed, what network provider will be used, and whether you want to enable project network isolation. To see more cluster options, click on **Show advanced options**. For help configuring the cluster, refer to the [RKE cluster configuration reference.](../../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md)
|
||||
1. Use **Cluster Options** to choose the version of Kubernetes that will be installed, what network provider will be used, and whether you want to enable project network isolation. To see more cluster options, click on **Show advanced options**. For help configuring the cluster, refer to the RKE cluster configuration reference.
|
||||
1. Add one or more node pools to your cluster. Each node pool uses a node template to provision new nodes. For more information about node pools, including best practices for assigning Kubernetes roles to the nodes, see [this section.](../use-new-nodes-in-an-infra-provider.md#node-pools)
|
||||
1. Review your options to confirm they're correct. Then click **Create**.
|
||||
|
||||
|
||||
+1
-1
@@ -13,7 +13,7 @@ In order to dynamically provision storage in vSphere, the vSphere provider must
|
||||
|
||||
### Prerequisites
|
||||
|
||||
In order to provision vSphere volumes in a cluster created with the [Rancher Kubernetes Engine (RKE)](../../launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md), the [vSphere cloud provider](https://rancher.com/docs/rke/latest/en/config-options/cloud-providers/vsphere) must be explicitly enabled in the [cluster options](../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md).
|
||||
In order to provision vSphere volumes in a cluster created with [RKE2](../../launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md), the [vSphere cloud provider](https://rancher.com/docs/rke/latest/en/config-options/cloud-providers/vsphere) must be explicitly enabled in the [cluster options](../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke2-cluster-configuration.md#cloud-provider).
|
||||
|
||||
### Creating a StorageClass
|
||||
|
||||
|
||||
@@ -210,13 +210,13 @@ Certain internal Kubernetes components are scraped via a proxy deployed as part
|
||||
The following Kubernetes components are directly scraped by Prometheus:
|
||||
|
||||
- kubelet*
|
||||
- ingress-nginx**
|
||||
- Traefik**
|
||||
- coreDns/kubeDns
|
||||
- kube-api-server
|
||||
|
||||
\* You can optionally use `hardenedKubelet.enabled` to use a PushProx, but that is not the default.
|
||||
|
||||
** For RKE2 clusters, ingress-nginx is deployed by default and treated as an internal Kubernetes component.
|
||||
** For RKE2 clusters, Traefik is deployed by default and treated as an internal Kubernetes component.
|
||||
|
||||
### Scraping Metrics Based on Kubernetes Distribution
|
||||
|
||||
@@ -231,11 +231,11 @@ Metrics are scraped differently based on the Kubernetes distribution. For help w
|
||||
| etcd | rke2Etcd.enabled | kubeAdmEtcd.enabled | Not available |
|
||||
| kube-proxy | rke2Proxy.enabled | kubeAdmProxy.enabled | k3sServer.enabled |
|
||||
| kubelet | Collects metrics directly exposed by kubelet | Collects metrics directly exposed by kubelet | Collects metrics directly exposed by kubelet |
|
||||
| ingress-nginx* | Collects metrics directly exposed by kubelet, Exposed by rke2IngressNginx.enabled | Not available | Not available |
|
||||
| Traefik* | Collects metrics directly exposed by kubelet | Not available | Not available |
|
||||
| coreDns/kubeDns | Collects metrics directly exposed by coreDns/kubeDns | Collects metrics directly exposed by coreDns/kubeDns | Collects metrics directly exposed by coreDns/kubeDns |
|
||||
| kube-api-server | Collects metrics directly exposed by kube-api-server | Collects metrics directly exposed by kube-appi-server | Collects metrics directly exposed by kube-api-server |
|
||||
|
||||
\* For RKE2 clusters, ingress-nginx is deployed by default and treated as an internal Kubernetes component.
|
||||
\* For RKE2 clusters, Traefik is deployed by default and treated as an internal Kubernetes component.
|
||||
|
||||
### Terminology
|
||||
|
||||
@@ -244,6 +244,6 @@ Metrics are scraped differently based on the Kubernetes distribution. For help w
|
||||
- **etcd:** The internal Kubernetes component that is the distributed key/value store which Kubernetes uses for persistent storage of all cluster information.
|
||||
- **kube-proxy:** The internal Kubernetes component that watches the API server for pods/services changes in order to maintain the network up to date.
|
||||
- **kubelet:** The internal Kubernetes component that watches the API server for pods on a node and makes sure they are running.
|
||||
- **ingress-nginx:** An Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer.
|
||||
- **Traefik:** An Ingress controller for Kubernetes that can be used as a reverse proxy and load balancer.
|
||||
- **coreDns/kubeDns:** The internal Kubernetes component responsible for DNS.
|
||||
- **kube-api-server:** The main internal Kubernetes component that is responsible for exposing APIs for the other master components.
|
||||
|
||||
-365
@@ -1,365 +0,0 @@
|
||||
---
|
||||
title: RKE Cluster Configuration Reference
|
||||
---
|
||||
|
||||
<head>
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration"/>
|
||||
</head>
|
||||
|
||||
<EOLRKE1Warning />
|
||||
|
||||
When Rancher installs Kubernetes, it uses [RKE](../../../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) or [RKE2](https://docs.rke2.io/) as the Kubernetes distribution.
|
||||
|
||||
This section covers the configuration options that are available in Rancher for a new or existing RKE Kubernetes cluster.
|
||||
|
||||
|
||||
## Overview
|
||||
|
||||
You can configure the Kubernetes options one of two ways:
|
||||
|
||||
- [Rancher UI](#configuration-options-in-the-rancher-ui): Use the Rancher UI to select options that are commonly customized when setting up a Kubernetes cluster.
|
||||
- [Cluster Config File](#rke-cluster-config-file-reference): Instead of using the Rancher UI to choose Kubernetes options for the cluster, advanced users can create an RKE config file. Using a config file allows you to set any of the options available in an RKE installation, except for system_images configuration, by specifying them in YAML.
|
||||
|
||||
The RKE cluster config options are nested under the `rancher_kubernetes_engine_config` directive. For more information, see the section about the [cluster config file.](#rke-cluster-config-file-reference)
|
||||
|
||||
In [clusters launched by RKE](../../../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md), you can edit any of the remaining options that follow.
|
||||
|
||||
For an example of RKE config file syntax, see the [RKE documentation](https://rancher.com/docs/rke/latest/en/example-yamls/).
|
||||
|
||||
The forms in the Rancher UI don't include all advanced options for configuring RKE. For the complete reference of configurable options for RKE Kubernetes clusters in YAML, see the [RKE documentation.](https://rancher.com/docs/rke/latest/en/config-options/)
|
||||
|
||||
## Editing Clusters with a Form in the Rancher UI
|
||||
|
||||
To edit your cluster,
|
||||
|
||||
1. In the upper left corner, click **☰ > Cluster Management**.
|
||||
1. Go to the cluster you want to configure and click **⋮ > Edit Config**.
|
||||
|
||||
|
||||
## Editing Clusters with YAML
|
||||
|
||||
Instead of using the Rancher UI to choose Kubernetes options for the cluster, advanced users can create an RKE config file. Using a config file allows you to set any of the options available in an RKE installation, except for system_images configuration, by specifying them in YAML.
|
||||
|
||||
RKE clusters (also called RKE1 clusters) are edited differently than RKE2 and K3s clusters.
|
||||
|
||||
To edit an RKE config file directly from the Rancher UI,
|
||||
|
||||
1. Click **☰ > Cluster Management**.
|
||||
1. Go to the RKE cluster you want to configure. Click and click **⋮ > Edit Config**. This take you to the RKE configuration form. Note: Because cluster provisioning changed in Rancher 2.6, the **⋮ > Edit as YAML** can be used for configuring RKE2 clusters, but it can't be used for editing RKE1 configuration.
|
||||
1. In the configuration form, scroll down and click **Edit as YAML**.
|
||||
1. Edit the RKE options under the `rancher_kubernetes_engine_config` directive.
|
||||
|
||||
## Configuration Options in the Rancher UI
|
||||
|
||||
:::tip
|
||||
|
||||
Some advanced configuration options are not exposed in the Rancher UI forms, but they can be enabled by editing the RKE cluster configuration file in YAML. For the complete reference of configurable options for RKE Kubernetes clusters in YAML, see the [RKE documentation.](https://rancher.com/docs/rke/latest/en/config-options/)
|
||||
|
||||
:::
|
||||
|
||||
### Kubernetes Version
|
||||
|
||||
The version of Kubernetes installed on your cluster nodes. Rancher packages its own version of Kubernetes based on [hyperkube](https://github.com/rancher/hyperkube).
|
||||
|
||||
For more detail, see [Upgrading Kubernetes](../../../getting-started/installation-and-upgrade/upgrade-and-roll-back-kubernetes.md).
|
||||
|
||||
### Network Provider
|
||||
|
||||
The [Network Provider](https://kubernetes.io/docs/concepts/cluster-administration/networking/) that the cluster uses. For more details on the different networking providers, please view our [Networking FAQ](../../../faq/container-network-interface-providers.md).
|
||||
|
||||
:::caution
|
||||
|
||||
After you launch the cluster, you cannot change your network provider. Therefore, choose which network provider you want to use carefully, as Kubernetes doesn't allow switching between network providers. Once a cluster is created with a network provider, changing network providers would require you tear down the entire cluster and all its applications.
|
||||
|
||||
:::
|
||||
|
||||
Out of the box, Rancher is compatible with the following network providers:
|
||||
|
||||
- [Canal](https://github.com/projectcalico/canal)
|
||||
- [Flannel](https://github.com/coreos/flannel#flannel)
|
||||
- [Calico](https://docs.projectcalico.org/v3.11/introduction/)
|
||||
- [Weave](https://github.com/weaveworks/weave)
|
||||
|
||||
<DeprecationWeave />
|
||||
|
||||
:::note Notes on Weave:
|
||||
|
||||
When Weave is selected as network provider, Rancher will automatically enable encryption by generating a random password. If you want to specify the password manually, please see how to configure your cluster using a [Config File](#rke-cluster-config-file-reference) and the [Weave Network Plug-in Options](https://rancher.com/docs/rke/latest/en/config-options/add-ons/network-plugins/#weave-network-plug-in-options).
|
||||
|
||||
:::
|
||||
|
||||
### Project Network Isolation
|
||||
|
||||
If your network provider allows project network isolation, you can choose whether to enable or disable inter-project communication.
|
||||
|
||||
Project network isolation is available if you are using any RKE network plugin that supports the enforcement of Kubernetes network policies, such as Canal or the Cisco ACI plugin.
|
||||
|
||||
### Kubernetes Cloud Providers
|
||||
|
||||
You can configure a [Kubernetes cloud provider](../../../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/set-up-cloud-providers.md). If you want to use dynamically provisioned [volumes and storage](../../../how-to-guides/new-user-guides/manage-clusters/create-kubernetes-persistent-storage/create-kubernetes-persistent-storage.md) in Kubernetes, typically you must select the specific cloud provider in order to use it. For example, if you want to use Amazon EBS, you would need to select the `aws` cloud provider.
|
||||
|
||||
:::note
|
||||
|
||||
If the cloud provider you want to use is not listed as an option, you will need to use the [config file option](#rke-cluster-config-file-reference) to configure the cloud provider. Please reference the [RKE cloud provider documentation](https://rancher.com/docs/rke/latest/en/config-options/cloud-providers/) on how to configure the cloud provider.
|
||||
|
||||
:::
|
||||
|
||||
### Private Registries
|
||||
|
||||
The cluster-level private registry configuration is only used for provisioning clusters.
|
||||
|
||||
There are two main ways to set up private registries in Rancher: by setting up the [global default registry](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/global-default-private-registry.md) through the **Settings** tab in the global view, and by setting up a private registry in the advanced options in the cluster-level settings. The global default registry is intended to be used for air-gapped setups, for registries that do not require credentials. The cluster-level private registry is intended to be used in all setups in which the private registry requires credentials.
|
||||
|
||||
If your private registry requires credentials, you need to pass the credentials to Rancher by editing the cluster options for each cluster that needs to pull images from the registry.
|
||||
|
||||
The private registry configuration option tells Rancher where to pull the [system images](https://rancher.com/docs/rke/latest/en/config-options/system-images/) or [addon images](https://rancher.com/docs/rke/latest/en/config-options/add-ons/) that will be used in your cluster.
|
||||
|
||||
- **System images** are components needed to maintain the Kubernetes cluster.
|
||||
- **Add-ons** are used to deploy several cluster components, including network plug-ins, the ingress controller, the DNS provider, or the metrics server.
|
||||
|
||||
For more information on setting up a private registry for components applied during the provisioning of the cluster, see the [RKE documentation on private registries](https://rancher.com/docs/rke/latest/en/config-options/private-registries/).
|
||||
|
||||
Rancher v2.6 introduced the ability to configure [ECR registries for RKE clusters](https://rancher.com/docs/rke/latest/en/config-options/private-registries/#amazon-elastic-container-registry-ecr-private-registry-setup).
|
||||
|
||||
### Authorized Cluster Endpoint
|
||||
|
||||
Authorized Cluster Endpoint (ACE) can be used to directly access the Kubernetes API server, without requiring communication through Rancher.
|
||||
|
||||
:::note
|
||||
|
||||
ACE is available on RKE, RKE2, and K3s clusters that are provisioned or registered with Rancher. It's not available on clusters in a hosted Kubernetes provider, such as Amazon's EKS.
|
||||
|
||||
:::
|
||||
|
||||
ACE must be set up [manually](../../../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/register-existing-clusters.md#authorized-cluster-endpoint-support-for-rke2-and-k3s-clusters) on RKE2 and K3s clusters. In RKE, ACE is enabled by default in Rancher-launched Kubernetes clusters, using the IP of the node with the `controlplane` role and the default Kubernetes self-signed certificates.
|
||||
|
||||
For more detail on how an authorized cluster endpoint works and why it is used, refer to the [architecture section.](../../../reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md#4-authorized-cluster-endpoint)
|
||||
|
||||
We recommend using a load balancer with the authorized cluster endpoint. For details, refer to the [recommended architecture section.](../../rancher-manager-architecture/architecture-recommendations.md#architecture-for-an-authorized-cluster-endpoint-ace)
|
||||
|
||||
### Node Pools
|
||||
|
||||
For information on using the Rancher UI to set up node pools in an RKE cluster, refer to [this page.](../../../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/use-new-nodes-in-an-infra-provider/use-new-nodes-in-an-infra-provider.md)
|
||||
|
||||
### NGINX Ingress
|
||||
|
||||
If you want to publish your applications in a high-availability configuration, and you're hosting your nodes with a cloud-provider that doesn't have a native load-balancing feature, enable this option to use NGINX Ingress within the cluster.
|
||||
|
||||
### Metrics Server Monitoring
|
||||
|
||||
Option to enable or disable [Metrics Server](https://rancher.com/docs/rke/latest/en/config-options/add-ons/metrics-server/).
|
||||
|
||||
Each cloud provider capable of launching a cluster using RKE can collect metrics and monitor for your cluster nodes. Enable this option to view your node metrics from your cloud provider's portal.
|
||||
|
||||
You must have an existing Pod Security Policy configured before you can use this option.
|
||||
|
||||
### Docker Version on Nodes
|
||||
|
||||
Configures whether nodes are allowed to run versions of Docker that Rancher doesn't officially support.
|
||||
|
||||
If you choose to require a supported Docker version, Rancher will stop pods from running on nodes that don't have a supported Docker version installed.
|
||||
|
||||
For details on which Docker versions were tested with each Rancher version, refer to the [support maintenance terms.](https://rancher.com/support-maintenance-terms/)
|
||||
|
||||
### Docker Root Directory
|
||||
|
||||
If the nodes you are adding to the cluster have Docker configured with a non-default Docker Root Directory (default is `/var/lib/docker`), specify the correct Docker Root Directory in this option.
|
||||
|
||||
### Default Pod Security Policy
|
||||
|
||||
If you enable **Pod Security Policy Support**, use this drop-down to choose the pod security policy that's applied to the cluster.
|
||||
|
||||
### Node Port Range
|
||||
|
||||
Option to change the range of ports that can be used for [NodePort services](https://kubernetes.io/docs/concepts/services-networking/service/#nodeport). Default is `30000-32767`.
|
||||
|
||||
### Recurring etcd Snapshots
|
||||
|
||||
Option to enable or disable [recurring etcd snapshots](https://rancher.com/docs/rke/latest/en/etcd-snapshots/#etcd-recurring-snapshots).
|
||||
|
||||
### Agent Environment Variables
|
||||
|
||||
Option to set environment variables for [rancher agents](../../../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/about-rancher-agents.md). The environment variables can be set using key value pairs. If rancher agent requires use of proxy to communicate with Rancher server, `HTTP_PROXY`, `HTTPS_PROXY` and `NO_PROXY` environment variables can be set using agent environment variables.
|
||||
|
||||
### Updating ingress-nginx
|
||||
|
||||
Clusters that were created before Kubernetes 1.16 will have an `ingress-nginx` `updateStrategy` of `OnDelete`. Clusters that were created with Kubernetes 1.16 or newer will have `RollingUpdate`.
|
||||
|
||||
If the `updateStrategy` of `ingress-nginx` is `OnDelete`, you will need to delete these pods to get the correct version for your deployment.
|
||||
|
||||
### Cluster Agent Configuration and Fleet Agent Configuration
|
||||
|
||||
You can configure the scheduling fields and resource limits for the Cluster Agent and the cluster's Fleet Agent. You can use these fields to customize tolerations, affinity rules, and resource requirements. Additional tolerations are appended to a list of default tolerations and control plane node taints. If you define custom affinity rules, they override the global default affinity setting. Defining resource requirements sets requests or limits where there previously were none.
|
||||
|
||||
:::note
|
||||
|
||||
With this option, it's possible to override or remove rules that are required for the functioning of the cluster. We strongly recommend against removing or overriding these and any other affinity rules, as this may cause unwanted side effects:
|
||||
|
||||
- `affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution` for `cattle-cluster-agent`
|
||||
- `cluster-agent-default-affinity` for `cattle-cluster-agent`
|
||||
- `fleet-agent-default-affinity` for `fleet-agent`
|
||||
|
||||
:::
|
||||
|
||||
If you downgrade Rancher to v2.7.4 or below, your changes will be lost and the agents will re-deploy without your customizations. The Fleet agent will fallback to using its built-in default values when it re-deploys. If the Fleet version doesn't change during the downgrade, the re-deploy won't be immediate.
|
||||
|
||||
|
||||
## RKE Cluster Config File Reference
|
||||
|
||||
Instead of using the Rancher UI to choose Kubernetes options for the cluster, advanced users can create an RKE config file. Using a config file allows you to set any of the [options available](https://rancher.com/docs/rke/latest/en/config-options/) in an RKE installation, except for `system_images` configuration. The `system_images` option is not supported when creating a cluster with the Rancher UI or API.
|
||||
|
||||
For the complete reference for configurable options for RKE Kubernetes clusters in YAML, see the [RKE documentation.](https://rancher.com/docs/rke/latest/en/config-options/)
|
||||
|
||||
### Config File Structure in Rancher
|
||||
|
||||
RKE (Rancher Kubernetes Engine) is the tool that Rancher uses to provision Kubernetes clusters. Rancher's cluster config files used to have the same structure as [RKE config files,](https://rancher.com/docs/rke/latest/en/example-yamls/) but the structure changed so that in Rancher, RKE cluster config items are separated from non-RKE config items. Therefore, configuration for your cluster needs to be nested under the `rancher_kubernetes_engine_config` directive in the cluster config file. Cluster config files created with earlier versions of Rancher will need to be updated for this format. An example cluster config file is included below.
|
||||
|
||||
<details id="v2.3.0-cluster-config-file">
|
||||
<summary>Example Cluster Config File</summary>
|
||||
|
||||
```yaml
|
||||
#
|
||||
# Cluster Config
|
||||
#
|
||||
docker_root_dir: /var/lib/docker
|
||||
enable_cluster_alerting: false
|
||||
enable_cluster_monitoring: false
|
||||
enable_network_policy: false
|
||||
local_cluster_auth_endpoint:
|
||||
enabled: true
|
||||
#
|
||||
# Rancher Config
|
||||
#
|
||||
rancher_kubernetes_engine_config: # Your RKE template config goes here.
|
||||
addon_job_timeout: 30
|
||||
authentication:
|
||||
strategy: x509
|
||||
ignore_docker_version: true
|
||||
#
|
||||
# # Currently only nginx ingress provider is supported.
|
||||
# # To disable ingress controller, set `provider: none`
|
||||
# # To enable ingress on specific nodes, use the node_selector, eg:
|
||||
# provider: nginx
|
||||
# node_selector:
|
||||
# app: ingress
|
||||
#
|
||||
ingress:
|
||||
provider: nginx
|
||||
kubernetes_version: v1.15.3-rancher3-1
|
||||
monitoring:
|
||||
provider: metrics-server
|
||||
#
|
||||
# If you are using calico on AWS
|
||||
#
|
||||
# network:
|
||||
# plugin: calico
|
||||
# calico_network_provider:
|
||||
# cloud_provider: aws
|
||||
#
|
||||
# # To specify flannel interface
|
||||
#
|
||||
# network:
|
||||
# plugin: flannel
|
||||
# flannel_network_provider:
|
||||
# iface: eth1
|
||||
#
|
||||
# # To specify flannel interface for canal plugin
|
||||
#
|
||||
# network:
|
||||
# plugin: canal
|
||||
# canal_network_provider:
|
||||
# iface: eth1
|
||||
#
|
||||
network:
|
||||
options:
|
||||
flannel_backend_type: vxlan
|
||||
plugin: canal
|
||||
#
|
||||
# services:
|
||||
# kube-api:
|
||||
# service_cluster_ip_range: 10.43.0.0/16
|
||||
# kube-controller:
|
||||
# cluster_cidr: 10.42.0.0/16
|
||||
# service_cluster_ip_range: 10.43.0.0/16
|
||||
# kubelet:
|
||||
# cluster_domain: cluster.local
|
||||
# cluster_dns_server: 10.43.0.10
|
||||
#
|
||||
services:
|
||||
etcd:
|
||||
backup_config:
|
||||
enabled: true
|
||||
interval_hours: 12
|
||||
retention: 6
|
||||
safe_timestamp: false
|
||||
creation: 12h
|
||||
extra_args:
|
||||
election-timeout: 5000
|
||||
heartbeat-interval: 500
|
||||
gid: 0
|
||||
retention: 72h
|
||||
snapshot: false
|
||||
uid: 0
|
||||
kube_api:
|
||||
always_pull_images: false
|
||||
pod_security_policy: false
|
||||
service_node_port_range: 30000-32767
|
||||
ssh_agent_auth: false
|
||||
windows_prefered_cluster: false
|
||||
```
|
||||
</details>
|
||||
|
||||
### Default DNS provider
|
||||
|
||||
The table below indicates what DNS provider is deployed by default. See [RKE documentation on DNS provider](https://rancher.com/docs/rke/latest/en/config-options/add-ons/dns/) for more information how to configure a different DNS provider. CoreDNS can only be used on Kubernetes v1.12.0 and higher.
|
||||
|
||||
| Rancher version | Kubernetes version | Default DNS provider |
|
||||
|-------------|--------------------|----------------------|
|
||||
| v2.2.5 and higher | v1.14.0 and higher | CoreDNS |
|
||||
| v2.2.5 and higher | v1.13.x and lower | kube-dns |
|
||||
| v2.2.4 and lower | any | kube-dns |
|
||||
|
||||
## Rancher Specific Parameters in YAML
|
||||
|
||||
Besides the RKE config file options, there are also Rancher specific settings that can be configured in the Config File (YAML):
|
||||
|
||||
### docker_root_dir
|
||||
|
||||
See [Docker Root Directory](#docker-root-directory).
|
||||
|
||||
### enable_cluster_monitoring
|
||||
|
||||
Option to enable or disable [Cluster Monitoring](../../../integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md).
|
||||
|
||||
### enable_network_policy
|
||||
|
||||
Option to enable or disable Project Network Isolation.
|
||||
|
||||
Project network isolation is available if you are using any RKE network plugin that supports the enforcement of Kubernetes network policies, such as Canal or the Cisco ACI plugin.
|
||||
|
||||
### local_cluster_auth_endpoint
|
||||
|
||||
See [Authorized Cluster Endpoint](#authorized-cluster-endpoint).
|
||||
|
||||
Example:
|
||||
|
||||
```yaml
|
||||
local_cluster_auth_endpoint:
|
||||
enabled: true
|
||||
fqdn: "FQDN"
|
||||
ca_certs: |-
|
||||
-----BEGIN CERTIFICATE-----
|
||||
...
|
||||
-----END CERTIFICATE-----
|
||||
```
|
||||
|
||||
### Custom Network Plug-in
|
||||
|
||||
You can add a custom network plug-in by using the [user-defined add-on functionality](https://rancher.com/docs/rke/latest/en/config-options/add-ons/user-defined-add-ons/) of RKE. You define any add-on that you want deployed after the Kubernetes cluster is deployed.
|
||||
|
||||
There are two ways that you can specify an add-on:
|
||||
|
||||
- [In-line Add-ons](https://rancher.com/docs/rke/latest/en/config-options/add-ons/user-defined-add-ons/#in-line-add-ons)
|
||||
- [Referencing YAML Files for Add-ons](https://rancher.com/docs/rke/latest/en/config-options/add-ons/user-defined-add-ons/#referencing-yaml-files-for-add-ons)
|
||||
|
||||
For an example of how to configure a custom network plug-in by editing the `cluster.yml`, refer to the [RKE documentation.](https://rancher.com/docs/rke/latest/en/config-options/add-ons/network-plugins/custom-network-plugin-example)
|
||||
@@ -10,7 +10,7 @@ The commands/steps listed on this page can be used to check name resolution issu
|
||||
|
||||
Make sure you configured the correct kubeconfig (for example, `export KUBECONFIG=$PWD/kube_config_cluster.yml` for Rancher HA) or are using the embedded kubectl via the UI.
|
||||
|
||||
Before running the DNS checks, check the [default DNS provider](../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md#default-dns-provider) for your cluster and make sure that [the overlay network is functioning correctly](networking.md#check-if-overlay-network-is-functioning-correctly) as this can also be the reason why DNS resolution (partly) fails.
|
||||
Before running the DNS checks, make sure that [the overlay network is functioning correctly](networking.md#check-if-overlay-network-is-functioning-correctly) for your DNS provider as this can also be the reason why DNS resolution (partly) fails.
|
||||
|
||||
## Check if DNS pods are running
|
||||
|
||||
@@ -203,7 +203,7 @@ As the `kubelet` is running inside a container, the path for files located in `/
|
||||
|
||||
:::
|
||||
|
||||
See [Editing Cluster as YAML](../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md#editing-clusters-with-yaml) how to apply this change. When the provisioning of the cluster has finished, you have to remove the kube-dns pod to activate the new setting in the pod:
|
||||
See Editing Cluster as YAML how to apply this change. When the provisioning of the cluster has finished, you have to remove the kube-dns pod to activate the new setting in the pod:
|
||||
|
||||
```
|
||||
kubectl delete pods -n kube-system -l k8s-app=kube-dns
|
||||
|
||||
@@ -78,22 +78,22 @@ kubectl -n kube-system get endpoints kube-scheduler -o jsonpath='{.metadata.anno
|
||||
|
||||
## Ingress Controller
|
||||
|
||||
The default Ingress Controller is NGINX and is deployed as a DaemonSet in the `ingress-nginx` namespace. The pods are only scheduled to nodes with the `worker` role.
|
||||
The default Ingress Controller is Traefik and is deployed as a DaemonSet in the `traefik` namespace. The pods are only scheduled to nodes with the `worker` role.
|
||||
|
||||
Check if the pods are running on all nodes:
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get pods -o wide
|
||||
kubectl -n traefik get pods -o wide
|
||||
```
|
||||
|
||||
Example output:
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get pods -o wide
|
||||
kubectl -n traefik get pods -o wide
|
||||
NAME READY STATUS RESTARTS AGE IP NODE
|
||||
default-http-backend-797c5bc547-kwwlq 1/1 Running 0 17m x.x.x.x worker-1
|
||||
nginx-ingress-controller-4qd64 1/1 Running 0 14m x.x.x.x worker-1
|
||||
nginx-ingress-controller-8wxhm 1/1 Running 0 13m x.x.x.x worker-0
|
||||
traefik-4qd64 1/1 Running 0 14m x.x.x.x worker-1
|
||||
traefik-8wxhm 1/1 Running 0 13m x.x.x.x worker-0
|
||||
```
|
||||
|
||||
If a pod is unable to run (Status is not **Running**, Ready status is not showing `1/1` or you see a high count of Restarts), check the pod details, logs and namespace events.
|
||||
@@ -101,27 +101,27 @@ If a pod is unable to run (Status is not **Running**, Ready status is not showin
|
||||
### Pod details
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx describe pods -l app=ingress-nginx
|
||||
kubectl -n traefik describe pods -l app=traefik
|
||||
```
|
||||
|
||||
### Pod container logs
|
||||
|
||||
The below command can show the logs of all the pods labeled "app=ingress-nginx", but it will display only 10 lines of log because of the restrictions of the `kubectl logs` command. Refer to `--tail` of `kubectl logs -h` for more information.
|
||||
The below command can show the logs of all the pods labeled "app=traefik", but it will display only 10 lines of log because of the restrictions of the `kubectl logs` command. Refer to `--tail` of `kubectl logs -h` for more information.
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx logs -l app=ingress-nginx
|
||||
kubectl -n traefik logs -l app=traefik
|
||||
```
|
||||
|
||||
If the full log is needed, specify the pod name in the trailing command:
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx logs <pod name>
|
||||
kubectl -n traefik logs <pod name>
|
||||
```
|
||||
|
||||
### Namespace events
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get events
|
||||
kubectl -n traefik get events
|
||||
```
|
||||
|
||||
### Debug logging
|
||||
@@ -129,7 +129,7 @@ kubectl -n ingress-nginx get events
|
||||
To enable debug logging:
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx patch ds nginx-ingress-controller --type='json' -p='[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--v=5"}]'
|
||||
kubectl -n traefik patch ds traefik --type='json' -p='[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--v=5"}]'
|
||||
```
|
||||
|
||||
### Check configuration
|
||||
@@ -137,7 +137,7 @@ kubectl -n ingress-nginx patch ds nginx-ingress-controller --type='json' -p='[{"
|
||||
Retrieve generated configuration in each pod:
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get pods -l app=ingress-nginx --no-headers -o custom-columns=.NAME:.metadata.name | while read pod; do kubectl -n ingress-nginx exec $pod -- cat /etc/nginx/nginx.conf; done
|
||||
kubectl -n traefik get pods -l app=traefik --no-headers -o custom-columns=.NAME:.metadata.name | while read pod; do kubectl -n traefik exec $pod -- cat /etc/nginx/nginx.conf; done
|
||||
```
|
||||
|
||||
## Rancher agents
|
||||
|
||||
@@ -69,7 +69,7 @@ rancher rancher.yourdomain.com x.x.x.x,x.x.x.x,x.x.x.x 80, 443 2m
|
||||
When accessing your configured Rancher FQDN does not show you the UI, check the ingress controller logging to see what happens when you try to access Rancher:
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx logs -l app=ingress-nginx
|
||||
kubectl -n traefik logs -l app=traefik
|
||||
```
|
||||
|
||||
## Leader Election
|
||||
|
||||
+1
-4
@@ -6,10 +6,7 @@ title: TLS 设置
|
||||
|
||||
## 在高可用 Kubernetes 集群中运行 Rancher
|
||||
|
||||
当你在 Kubernetes 集群内安装 Rancher 时，TLS 会在集群的 Ingress Controller 上卸载。可用的 TLS 设置取决于使用的 Ingress Controller：
|
||||
|
||||
* nginx-ingress-controller（default RKE2 默认）：[默认的 TLS 版本和密码](https://kubernetes.github.io/ingress-nginx/user-guide/tls/#default-tls-version-and-ciphers)。
|
||||
* traefik（K3s 默认）：[TLS 选项](https://doc.traefik.io/traefik/https/tls/#tls-options)。
|
||||
When you install a Rancher managed Kubernetes cluster, TLS is offloaded at the cluster's ingress controller. Traefik is the default ingress for K3s and can be used with RKE2, refer to [TLS Options](https://doc.traefik.io/traefik/https/tls/#tls-options) for further information.
|
||||
|
||||
## 在单个 Docker 容器中运行 Rancher
|
||||
|
||||
|
||||
+7
-12
@@ -4,14 +4,12 @@ title: 设置 Amazon NLB 网络负载均衡器
|
||||
|
||||
本文介绍了如何在 Amazon EC2 服务中设置 Amazon NLB 网络负载均衡器，用于将流量转发到 EC2 上的多个实例中。
|
||||
|
||||
这些示例中，负载均衡器将流量转发到三个 Rancher Server 节点。如果 Rancher 安装在 RKE Kubernetes 集群上，则需要三个节点。如果 Rancher 安装在 K3s Kubernetes 集群上，则只需要两个节点。
|
||||
这些示例中，负载均衡器将流量转发到三个 Rancher Server 节点。如果 Rancher 安装在 K3s Kubernetes 集群上，则只需要两个节点。
|
||||
|
||||
本文介绍的只是配置负载均衡器的其中一种方式。其他负载均衡器如传统负载路由器（Classic Load Balancer）和应用负载路由器（Application Load Balancer），也可以将流量转发到 Rancher Server 节点。
|
||||
|
||||
Rancher 仅支持使用 Amazon NLB 以 `TCP` 模式终止 443 端口的流量，而不支持 `TLS` 模式。这试因为在 NLB 终止时，NLB 不会将正确的标头注入请求中。如果你想使用由 Amazon Certificate Manager (ACM) 托管的证书，请使用 ALB。
|
||||
|
||||
|
||||
|
||||
## 要求
|
||||
|
||||
你已在 EC2 中创建了 Linux 实例。此外，负载均衡器会把流量转发到这些节点。
|
||||
@@ -22,7 +20,7 @@ Rancher 仅支持使用 Amazon NLB 以 `TCP` 模式终止 443 端口的流量，
|
||||
|
||||
配置 NLB 的第一个步骤是创建两个目标组。一般来说，只需要端口 443 就可以访问 Rancher。但是，由于端口 80 的流量会被自动重定向到端口 443，因此，你也可以为端口 80 也添加一个监听器。
|
||||
|
||||
不管使用的是 NGINX Ingress 还是 Traefik Ingress Controller，Ingress 都应该将端口 80 的流量重定向到端口 443。以下为操作步骤：
|
||||
The Traefik Ingress should redirect traffic from port 80 to port 443.
|
||||
|
||||
1. 登录到 [Amazon AWS 控制台](https://console.aws.amazon.com/ec2/)。确保选择的**区域**是你创建 EC2 实例 （Linux 节点）的区域。
|
||||
1. 选择**服务** > **EC2**，找到**负载均衡器**并打开**目标组**。
|
||||
@@ -30,7 +28,7 @@ Rancher 仅支持使用 Amazon NLB 以 `TCP` 模式终止 443 端口的流量，
|
||||
|
||||
:::note
|
||||
|
||||
不同 Ingress 的健康检查处理方法不同。详情请参阅[本节](#nginx-ingress-和-traefik-ingress-的健康检查路径)。
|
||||
For details on Traefik Ingress health checks, refer to [this section.](#health-check-paths-for-traefik-ingresses)
|
||||
|
||||
:::
|
||||
|
||||
@@ -163,13 +161,10 @@ AWS 完成 NLB 创建后，单击**关闭**。
|
||||
|
||||
6. 单击右上角的**保存**。
|
||||
|
||||
## NGINX Ingress 和 Traefik Ingress 的健康检查路径
|
||||
## Health Check Paths for Traefik Ingresses
|
||||
|
||||
K3s 和 RKE Kubernetes 集群使用的默认 Ingress 不同，因此对应的健康检查方式也不同。
|
||||
K3s Kubernetes clusters use Traefik as the default Ingress.
|
||||
|
||||
RKE Kubernetes 集群默认使用 NGINX Ingress，而 K3s Kubernetes 集群默认使用 Traefik Ingress。
|
||||
The health check path is `/ping`. By default `/ping` is always matched (regardless of Host), and a response from [Traefik itself](https://docs.traefik.io/operations/ping/) is always served.
|
||||
|
||||
- **Traefik**：默认健康检查路径是 `/ping`。默认情况下，不管主机如何，`/ping` 总是匹配，而且 [Traefik 自身](https://docs.traefik.io/operations/ping/)总会响应。
|
||||
- **NGINX Ingress**：NGINX Ingress Controller 的默认后端有一个 `/healthz` 端点。默认情况下，不管主机如何，`/healthz` 总是匹配，而且 [`ingress-nginx` 自身](https://github.com/kubernetes/ingress-nginx/blob/0cbe783f43a9313c9c26136e888324b1ee91a72f/charts/ingress-nginx/values.yaml#L212)总会响应。
|
||||
|
||||
想要精确模拟健康检查，最好是使用 Host 标头（Rancher hostname）加上 `/ping` 或 `/healthz`（分别对应 K3s 和 RKE 集群）来获取 Rancher Pod 的响应，而不是 Ingress 的响应。
|
||||
To simulate an accurate health check, it is a best practice to use the Host header (Rancher hostname) combined with `/ping` or `/healthz` wherever possible, to get a response from the Rancher Pods, not the Ingress.
|
||||
|
||||
+5
-5
@@ -87,7 +87,7 @@ systemctl start rke2-server.service
|
||||
|
||||
1. 安装 Kubernetes 命令行工具 [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl)。
|
||||
2. 复制 `/etc/rancher/rke2/rke2.yaml` 文件并保存到本地主机的 `~/.kube/config` 目录上。
|
||||
3. 在 kubeconfig 文件中，`server` 的参数为 localhost。在端口 6443 上将服务器配置为 controlplane 负载均衡器的 DNS（RKE2 Kubernetes API Server 使用端口 6443，而 Rancher Server 将通过 NGINX Ingress 在端口 80 和 443 上提供服务。）以下是一个示例 `rke2.yaml`：
|
||||
3. 在 kubeconfig 文件中，`server` 的参数为 localhost。在端口 6443 上将服务器配置为 controlplane 负载均衡器的 DNS（RKE2 Kubernetes API Server 使用端口 6443，而 Rancher Server 将通过 Traefik Ingress 在端口 80 和 443 上提供服务。）以下是一个示例 `rke2.yaml`：
|
||||
|
||||
```yml
|
||||
apiVersion: v1
|
||||
@@ -136,7 +136,8 @@ kube-system etcd-rke2-server-2 1/1 Ru
|
||||
kube-system etcd-rke2-server-3 1/1 Running 0 56s
|
||||
kube-system helm-install-rke2-canal-hs6sx 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-rke2-coredns-xmzm8 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-rke2-ingress-nginx-flwnl 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-traefik-crd-z8vsz 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-traefik-flwnl 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-rke2-metrics-server-7sggn 0/1 Completed 0 2m17s
|
||||
kube-system kube-apiserver-rke2-server-1 1/1 Running 0 116s
|
||||
kube-system kube-apiserver-rke2-server-2 1/1 Running 0 66s
|
||||
@@ -156,9 +157,8 @@ kube-system rke2-canal-swfmq 2/2 Ru
|
||||
kube-system rke2-coredns-rke2-coredns-547d5499cb-6tvwb 1/1 Running 0 92s
|
||||
kube-system rke2-coredns-rke2-coredns-547d5499cb-rdttj 1/1 Running 0 2m8s
|
||||
kube-system rke2-coredns-rke2-coredns-autoscaler-65c9bb465d-85sq5 1/1 Running 0 2m8s
|
||||
kube-system rke2-ingress-nginx-controller-69qxc 1/1 Running 0 52s
|
||||
kube-system rke2-ingress-nginx-controller-7hprp 1/1 Running 0 52s
|
||||
kube-system rke2-ingress-nginx-controller-x658h 1/1 Running 0 52s
|
||||
kube-system traefik-7c844b766f-m9p2w 1/1 Running 0 52s
|
||||
kube-system traefik-7c844b766f-s4l9k 1/1 Running 0 52s
|
||||
kube-system rke2-metrics-server-6564db4569-vdfkn 1/1 Running 0 66s
|
||||
```
|
||||
|
||||
|
||||
+1
-1
@@ -43,7 +43,7 @@ SUSE Linux 可能有一个防火墙，默认情况下会阻止所有端口。在
|
||||
|
||||
### Flatcar Container Linux 节点
|
||||
|
||||
使用 Flatcar Container Linux 节点[通过 Rancher 启动 Kubernetes](../launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) 时，需要在 [Cluster Config 文件](../../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md#rke-集群配置文件参考)中使用如下配置：
|
||||
使用 Flatcar Container Linux 节点[通过 Rancher 启动 Kubernetes](../launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) 时，需要在 Cluster Config 文件 中使用如下配置：
|
||||
|
||||
<Tabs>
|
||||
<TabItem value="Canal">
|
||||
|
||||
+1
-11
@@ -3,14 +3,6 @@ title: Ingress 配置
|
||||
description: Ingress 配置
|
||||
---
|
||||
|
||||
:::note
|
||||
|
||||
在 Kubernetes v1.21 及更高版本中，NGINX Ingress Controller 不再默认运行在 hostNetwork 中。它改为将 hostPorts 用于端口 80 和端口 443，因此你可以将准入 Webhook 配置为只能通过 ClusterIP 访问。这确保了只能从集群内部访问 webhook。
|
||||
|
||||
由于 controller 的这一更改，默认 RKE1 配置不再将 `hostNetwork` 设置为 `true`。但是，你必须将 `hostNetwork` 设置为 `true` 才能使基于 TCP 和 UDP 的 Service 正常工作。为此，请[编辑](../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md#使用-yaml-编辑集群)集群的 YAML 并按照[官方 RKE1 文档](https://rke.docs.rancher.com/config-options/add-ons/ingress-controllers#configuring-network-options)中的步骤操作。
|
||||
|
||||
:::
|
||||
|
||||
## 指定要使用的主机名
|
||||
|
||||
如果使用此选项，Ingress 会将主机名请求路由到你指定的服务或工作负载。
|
||||
@@ -36,6 +28,4 @@ description: Ingress 配置
|
||||
|
||||
## 标签和注释
|
||||
|
||||
添加[标签](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/)和/或[注释](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)来为你的 Ingress Controller 提供元数据。
|
||||
|
||||
有关可用的注释列表，请参阅 [Nginx Ingress Controller 文档](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/)。
|
||||
Please refer to the Traefik documentation for the full list of Ingress NGINX annotations that are [supported](https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/ingress-nginx/#annotations-support) and [unsupported](https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/ingress-nginx/#unsupported-annotations) by Traefik's kubernetesIngressNginx provider.
|
||||
|
||||
+5
-15
@@ -7,13 +7,11 @@ Kubernetes 支持四层负载均衡和七层负载均衡。
|
||||
|
||||
## 四层负载均衡器
|
||||
|
||||
四层负载均衡器（或外部负载均衡器）将流量转发到 Nodeport。四层负载均衡器支持转发 HTTP 和 TCP 流量。
|
||||
|
||||
通常情况下，四层负载均衡器由底层云提供商支持，因此，如果你在裸金属服务器和 vSphere 集群上部署 RKE 集群，则不支持四层负载均衡器。但是，单个[全局管理的 config-map](https://kubernetes.github.io/ingress-nginx/user-guide/exposing-tcp-udp-services/) 可用于在 NGINX 或第三方 Ingress 上公开服务。
|
||||
Layer-4 load balancer (or the external load balancer) forwards traffic to NodePorts. Layer-4 load balancer allows you to forward both HTTP and TCP traffic.
|
||||
|
||||
:::note
|
||||
|
||||
你可以使用非云负载均衡器（例如 [MetalLB](https://metallb.universe.tf/)）来部署集群。但是，该用例比云提供商支持的四层负载均衡器更高级，而且不可以在 Rancher 或 RKE 中配置。
|
||||
It is possible to deploy a cluster with a non-cloud load balancer, such as [MetalLB.](https://metallb.universe.tf/) However, that use case is more advanced than the Layer-4 load balancer supported by a cloud provider, and it is not configurable in Rancher.
|
||||
|
||||
:::
|
||||
|
||||
@@ -26,17 +24,13 @@ Kubernetes 支持四层负载均衡和七层负载均衡。
|
||||
| Amazon EKS | 由 AWS 云提供商支持 |
|
||||
| Google GKE | 由 GCE 云提供商支持 |
|
||||
| Azure AKS | 由 Azure 云提供商支持 |
|
||||
| EC2 上的 RKE | 由 AWS 云提供商支持 |
|
||||
| DigitalOcean 上的 RKE | 受限的 NGINX 或第三方 Ingress\* |
|
||||
| vSphere 上的 RKE | 受限的 NGINX 或第三方 Ingress\* |
|
||||
| 自定义主机上的 RKE<br/>（例如裸金属服务器） | 受限的 NGINX 或第三方 Ingress\* |
|
||||
| 第三方 MetalLB | 受限的 NGINX 或第三方 Ingress\* |
|
||||
| 第三方 MetalLB | third-party Ingress\* |
|
||||
|
||||
\* 可以通过单个[全局管理的 config-map](https://kubernetes.github.io/ingress-nginx/user-guide/exposing-tcp-udp-services/) 来公开服务。
|
||||
|
||||
## 七层负载均衡器
|
||||
|
||||
七层负载均衡器（或 Ingress Controller）支持基于主机和路径的负载均衡和 SSL 终止。七层负载均衡器仅转发 HTTP 和 HTTPS 流量，因此它们仅侦听端口 80 和 443。亚马逊和谷歌等云提供商支持七层负载均衡器。此外，RKE 集群部署了 Nginx Ingress Controller。
|
||||
Layer-7 load balancer (or the ingress controller) supports host and path-based load balancing and SSL termination. Layer-7 load balancer only forwards HTTP and HTTPS traffic and therefore they listen on ports 80 and 443 only. Cloud providers such as Amazon and Google support layer-7 load balancer.
|
||||
|
||||
### 七层负载均衡支持
|
||||
|
||||
@@ -47,16 +41,12 @@ Kubernetes 支持四层负载均衡和七层负载均衡。
|
||||
| Amazon EKS | 由 AWS 云提供商支持 |
|
||||
| Google GKE | 由 GKE 云提供商支持 |
|
||||
| Azure AKS | 不支持 |
|
||||
| EC2 上的 RKE | Nginx Ingress Controller |
|
||||
| DigitalOcean 上的 RKE | Nginx Ingress Controller |
|
||||
| vSphere 上的 RKE | Nginx Ingress Controller |
|
||||
| 自定义主机上的 RKE<br/>（例如裸金属服务器） | Nginx Ingress Controller |
|
||||
|
||||
### 七层负载均衡器中的主机名
|
||||
|
||||
一些托管在云上的七层负载均衡器（例如 AWS 上的 ALB Ingress Controller）会为 Ingress 规则公开 DNS 地址。你需要（使用 CNAME）将你的域名映射到七层负载均衡器生成的 DNS 地址。
|
||||
|
||||
其他七层负载均衡器（例如 Google Load Balancer 或 Nginx Ingress Controller）会直接公开一个或多个 IP 地址。Google Load Balancer 提供了一个可路由的 IP 地址。Nginx Ingress Controller 公开了运行 Nginx Ingress Controller 的所有节点的外部 IP。你可以执行以下任一操作：
|
||||
Other layer-7 load balancers, such as the Google Load Balancer, directly expose one or more IP addresses. Google Load Balancer provides a single routable IP address. You can do either of the following:
|
||||
|
||||
1. 配置你自己的 DNS，从而（使用 A 记录）将你的域名映射到七层负载均衡器公开的 IP 地址。
|
||||
2. 让 Rancher 为你的 Ingress 规则生成一个 xip.io 主机名。Rancher 将使用你公开的其中一个 IP（假设是 `a.b.c.d`）生成一个主机名（即 `<ingressname>.<namespace>.a.b.c.d.xip.io`）。
|
||||
|
||||
+1
-9
@@ -48,18 +48,10 @@ Rancher 支持两种类型的负载均衡器：
|
||||
|
||||
Ingress 与一个或多个 Ingress Controller 一起动态路由 service 的请求。Ingress 收到请求时，集群中的 Ingress Controller 会根据你配置的 service 子域或路径规则将请求定向到正确的 service。
|
||||
|
||||
每个 Kubernetes Ingress 资源都对应一个 `/etc/nginx/sites-available/` 中的文件，其中包含一个配置对特定文件和文件夹的请求的 `server{}` 配置块。
|
||||
|
||||
Ingress 能为你的集群创建一个入口端口（与负载均衡器类似），可以位于集群的内部或外部。RKE 启动的集群中的 Ingress 和 Ingress Controller 由 [Nginx](https://www.nginx.com/) 提供支持。
|
||||
Ingress 能为你的集群创建一个入口端口（与负载均衡器类似），可以位于集群的内部或外部。
|
||||
|
||||
Ingress 还支持其他功能，例如 SSL 终止、基于名称的虚拟主机等。
|
||||
|
||||
:::note 在高可用性配置中使用 Rancher：
|
||||
|
||||
请避免将 Ingress 添加到 `local` 集群。Rancher 将 Nginx Ingress Controller 作为 Rancher 管理的 _所有_ 集群的全局入口点，其中包括 `local` 集群。因此，当用户尝试访问应用程序时，Rancher 可能会由于重新加载 Nginx 配置而断开连接。要解决这个问题，我们建议你仅在通过 Rancher 启动的集群中部署应用程序。
|
||||
|
||||
:::
|
||||
|
||||
- 有关如何在 Rancher 中设置 Ingress 的更多信息，请参阅 [Ingress](add-ingresses.md)。
|
||||
- 有关 Ingress 和 Ingress Controller 的完整信息，请参阅 [Kubernetes Ingress 文档](https://kubernetes.io/docs/concepts/services-networking/ingress/)。
|
||||
- 在项目中使用 Ingress 时，你可以通过设置全局 DNS 条目来将 Ingress 主机名编程到外部 DNS。
|
||||
|
||||
+2
-2
@@ -12,7 +12,7 @@ title: 在 Nutanix AOS 中配置 Kubernetes 集群
|
||||
|
||||
有关配置 Nutanix AOS 节点模板的详细信息，请参阅 [Nutanix AOS 节点模板配置参考](../../../../../reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/nutanix.md)。
|
||||
|
||||
有关在 Rancher 中配置 RKE Kubernetes 集群的详细信息，请参阅[集群配置参考](../../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md)。
|
||||
有关在 Rancher 中配置 RKE Kubernetes 集群的详细信息，请参阅集群配置参考。
|
||||
|
||||
- [Nutanix AOS 中的准备工作](#nutanix-aos-中的准备工作)
|
||||
- [创建 Nutanix AOS 集群](#创建-nutanix-aos-集群)
|
||||
@@ -70,7 +70,7 @@ title: 在 Nutanix AOS 中配置 Kubernetes 集群
|
||||
1. 单击 **Nutanix**。
|
||||
1. 输入**集群名称**，然后点击**继续**。
|
||||
1. 使用**成员角色**为集群配置用户授权。点击**添加成员**添加可以访问集群的用户。使用**角色**下拉菜单为每个用户设置权限。
|
||||
1. 使用**集群选项**选择要安装的 Kubernetes 版本、要使用的网络提供商，以及是否启用项目网络隔离。要查看更多集群选项，请单击**显示高级选项**。如需获取配置集群的帮助，请参阅 [RKE 集群配置参考](../../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md)。
|
||||
1. 使用**集群选项**选择要安装的 Kubernetes 版本、要使用的网络提供商，以及是否启用项目网络隔离。要查看更多集群选项，请单击**显示高级选项**。如需获取配置集群的帮助，请参阅 RKE 集群配置参考。
|
||||
1. 将一个或多个节点池添加到你的集群。每个节点池都使用节点模板来配置新节点。有关节点池的更多信息，包括为节点分配 Kubernetes 角色的最佳实践，请参阅[本节](../../../launch-kubernetes-with-rancher/use-new-nodes-in-an-infra-provider/use-new-nodes-in-an-infra-provider.md#节点池)。
|
||||
1. 检查并确认你的选项。然后单击**创建**。
|
||||
|
||||
|
||||
+1
-1
@@ -8,7 +8,7 @@ title: vSphere 存储
|
||||
|
||||
## 先决条件
|
||||
|
||||
为了在 [Rancher Kubernetes Engine (RKE)](../../launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) 集群中配置 vSphere 卷，[vSphere cloud provider](https://rancher.com/docs/rke/latest/en/config-options/cloud-providers/vsphere) 必须在[集群选项](../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md)中显式启用。
|
||||
为了在 [RKE2](../../launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) 集群中配置 vSphere 卷，[vSphere cloud provider](https://rancher.com/docs/rke/latest/en/config-options/cloud-providers/vsphere) 必须在[集群选项](../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke2-cluster-configuration.md#cloud-provider)中显式启用。
|
||||
|
||||
## 创建一个 StorageClass
|
||||
|
||||
|
||||
+5
-5
@@ -205,13 +205,13 @@ Prometheus 从称为 [exporter](https://prometheus.io/docs/instrumenting/exporte
|
||||
Prometheus 直接抓取以下 Kubernetes 组件：
|
||||
|
||||
- kubelet\*
|
||||
- ingress-nginx\*\*
|
||||
- Traefik\*\*
|
||||
- coreDns/kubeDns
|
||||
- kube-api-server
|
||||
|
||||
\* 你可以选择通过 `hardenedKubelet.enabled` 来使用 PushProx，但这不是默认设置。
|
||||
|
||||
\*\* RKE2 集群默认部署 ingress-nginx，并将其视为内部 Kubernetes 组件。
|
||||
\*\* For RKE2 clusters, Traefik is deployed by default and treated as an internal Kubernetes component.
|
||||
|
||||
|
||||
### 基于 Kubernetes 发行版抓取指标
|
||||
@@ -227,11 +227,11 @@ Prometheus 直接抓取以下 Kubernetes 组件：
|
||||
| etcd | rke2Etcd.enabled | kubeAdmEtcd.enabled | 不可用 |
|
||||
| kube-proxy | rke2Proxy.enabled | kubeAdmProxy.enabled | k3sServer.enabled |
|
||||
| kubelet | 收集 kubelet 直接公开的指标 | 收集 kubelet 直接公开的指标 | 收集 kubelet 直接公开的指标 |
|
||||
| ingress-nginx* | 收集 kubelet 直接公开的指标，由 rke2IngressNginx.enabled 公开 | 不可用 | 不可用 |
|
||||
| Traefik* | Collects metrics directly exposed by kubelet | Not available | Not available |
|
||||
| coreDns/kubeDns | 收集 coreDns/kubeDns 直接公开的指标 | 收集 coreDns/kubeDns 直接公开的指标 | 收集 coreDns/kubeDns 直接公开的指标 |
|
||||
| kube-api-server | 收集 kube-api-server 直接公开的指标 | 收集 kube-appi-server 直接公开的指标 | 收集 kube-api-server 直接公开的指标 |
|
||||
|
||||
\* RKE2 集群默认部署 ingress-nginx，并将其视为内部 Kubernetes 组件。
|
||||
\* For RKE2 clusters, Traefik is deployed by default and treated as an internal Kubernetes component.
|
||||
|
||||
### 名词解释
|
||||
|
||||
@@ -240,6 +240,6 @@ Prometheus 直接抓取以下 Kubernetes 组件：
|
||||
- **etcd**：Kubernetes 内部组件，它是 Kubernetes 用于持久存储所有集群信息的分布式键/值存储。
|
||||
- **kube-proxy**：内部 Kubernetes 组件，用于监控 API server 的 pod/service 更改以保持网络最新状态。
|
||||
- **kubelet**：内部 Kubernetes 组件，用于为 pod 监视节点上的 API server 并确保这些 pod 能运行。
|
||||
- **ingress-nginx**：用于 Kubernetes 的 Ingress controller，使用 NGINX 作为反向代理和负载均衡器。
|
||||
- **Traefik:** An Ingress controller for Kubernetes that can be used as a reverse proxy and load balancer.
|
||||
- **coreDns/kubeDns**：负责 DNS 的内部 Kubernetes 组件。
|
||||
- **kube-api-server**：负责为其他 master 组件公开 API 的主要内部 Kubernetes 组件。
|
||||
|
||||
-357
@@ -1,357 +0,0 @@
|
||||
---
|
||||
title: RKE 集群配置参考
|
||||
---
|
||||
|
||||
<EOLRKE1Warning />
|
||||
|
||||
Rancher 安装 Kubernetes 时，它使用 [RKE](../../../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) 或 [RKE2](https://docs.rke2.io/) 作为 Kubernetes 发行版。
|
||||
|
||||
本文介绍 Rancher 中可用于新的或现有的 RKE Kubernetes 集群的配置选项。
|
||||
|
||||
|
||||
## 概述
|
||||
|
||||
你可以通过以下两种方式之一来配置 Kubernetes 选项：
|
||||
|
||||
- [Rancher UI](#rancher-ui-中的配置选项)：使用 Rancher UI 来选择设置 Kubernetes 集群时常用的自定义选项。
|
||||
- [集群配置文件](#rke-集群配置文件参考)：高级用户可以创建一个 RKE 配置文件，而不是使用 Rancher UI 来为集群选择 Kubernetes 选项。配置文件可以让你使用 YAML 来指定 RKE 安装中可用的任何选项（除了 system_images 配置）。
|
||||
|
||||
RKE 集群配置选项嵌套在 `rancher_kubernetes_engine_config` 参数下。有关详细信息，请参阅[集群配置文件](#rke-集群配置文件参考)。
|
||||
|
||||
在 [RKE 启动的集群](../../../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md)中，你可以编辑任何后续剩余的选项。
|
||||
|
||||
有关 RKE 配置文件语法的示例，请参阅 [RKE 文档](https://rancher.com/docs/rke/latest/en/example-yamls/)。
|
||||
|
||||
Rancher UI 中的表单不包括配置 RKE 的所有高级选项。有关 YAML 中 RKE Kubernetes 集群的可配置选项的完整参考，请参阅 [RKE 文档](https://rancher.com/docs/rke/latest/en/config-options/)。
|
||||
|
||||
## 在 Rancher UI 中使用表单编辑集群
|
||||
|
||||
要编辑你的集群：
|
||||
|
||||
1. 在左上角，单击 **☰ > 集群管理**。
|
||||
1. 转到要配置的集群，然后单击 **⋮ > 编辑配置**。
|
||||
|
||||
|
||||
## 使用 YAML 编辑集群
|
||||
|
||||
高级用户可以创建一个 RKE 配置文件，而不是使用 Rancher UI 来为集群选择 Kubernetes 选项。配置文件可以让你使用 YAML 来指定 RKE 安装中可用的任何选项（除了 system_images 配置）。
|
||||
|
||||
RKE 集群（也称为 RKE1 集群）的编辑方式与 RKE2 和 K3s 集群不同。
|
||||
|
||||
要直接从 Rancher UI 编辑 RKE 配置文件：
|
||||
|
||||
1. 点击 **☰ > 集群管理**。
|
||||
1. 转到要配置的 RKE 集群。单击并单击 **⋮ > 编辑配置**。你将会转到 RKE 配置表单。请注意，由于集群配置在 Rancher 2.6 中发生了变更，**⋮ > 以 YAML 文件编辑**可用于配置 RKE2 集群，但不能用于编辑 RKE1 配置。
|
||||
1. 在配置表单中，向下滚动并单击**以 YAML 文件编辑**。
|
||||
1. 编辑 `rancher_kubernetes_engine_config` 参数下的 RKE 选项。
|
||||
|
||||
## Rancher UI 中的配置选项
|
||||
|
||||
:::tip
|
||||
|
||||
一些高级配置选项没有在 Rancher UI 表单中开放，但你可以通过在 YAML 中编辑 RKE 集群配置文件来启用这些选项。有关 YAML 中 RKE Kubernetes 集群的可配置选项的完整参考，请参阅 [RKE 文档](https://rancher.com/docs/rke/latest/en/config-options/)。
|
||||
|
||||
:::
|
||||
|
||||
### Kubernetes 版本
|
||||
|
||||
这指的是集群节点上安装的 Kubernetes 版本。Rancher 基于 [hyperkube](https://github.com/rancher/hyperkube) 打包了自己的 Kubernetes 版本。
|
||||
|
||||
有关更多详细信息，请参阅[升级 Kubernetes](../../../getting-started/installation-and-upgrade/upgrade-and-roll-back-kubernetes.md)。
|
||||
|
||||
### 网络提供商
|
||||
|
||||
这指的是集群使用的[网络提供商](https://kubernetes.io/docs/concepts/cluster-administration/networking/)。有关不同网络提供商的更多详细信息，请查看我们的[网络常见问题解答](../../../faq/container-network-interface-providers.md)。
|
||||
|
||||
:::caution
|
||||
|
||||
启动集群后，你无法更改网络提供商。由于 Kubernetes 不允许在网络提供商之间切换，因此，请谨慎选择要使用的网络提供商。使用网络提供商创建集群后，如果你需要更改网络提供商，你将需要拆除整个集群以及其中的所有应用。
|
||||
|
||||
:::
|
||||
|
||||
Rancher 与以下开箱即用的网络提供商兼容：
|
||||
|
||||
- [Canal](https://github.com/projectcalico/canal)
|
||||
- [Flannel](https://github.com/coreos/flannel#flannel)
|
||||
- [Calico](https://docs.projectcalico.org/v3.11/introduction/)
|
||||
- [Weave](https://github.com/weaveworks/weave)
|
||||
|
||||
:::note Weave 注意事项：
|
||||
|
||||
选择 Weave 作为网络提供商时，Rancher 将通过生成随机密码来自动启用加密。如果你想手动指定密码，请参阅使用[配置文件](#rke-集群配置文件参考)和 [Weave 网络插件选项](https://rancher.com/docs/rke/latest/en/config-options/add-ons/network-plugins/#weave-network-plug-in-options)来配置集群。
|
||||
|
||||
:::
|
||||
|
||||
### 项目网络隔离
|
||||
|
||||
如果你的网络提供商允许项目网络隔离，你可以选择启用或禁用项目间的通信。
|
||||
|
||||
如果你使用支持执行 Kubernetes 网络策略的 RKE 网络插件（例如 Canal 或 Cisco ACI 插件），则可以使用项目网络隔离。
|
||||
|
||||
### Kubernetes 云提供商
|
||||
|
||||
你可以配置 [Kubernetes 云提供商](../../../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/set-up-cloud-providers.md)。如果你想在 Kubernetes 中使用动态配置的[卷和存储](../../../how-to-guides/new-user-guides/manage-clusters/create-kubernetes-persistent-storage/create-kubernetes-persistent-storage.md)，你通常需要选择特定的云提供商。例如，如果你想使用 Amazon EBS，则需要选择 `aws` 云提供商。
|
||||
|
||||
:::note
|
||||
|
||||
如果你要使用的云提供商未作为选项列出，你需要使用[配置文件选项](#rke-集群配置文件参考)来配置云提供商。请参考 [RKE 云提供商文档](https://rancher.com/docs/rke/latest/en/config-options/cloud-providers/)来了解如何配置云提供商。
|
||||
|
||||
:::
|
||||
|
||||
### 私有镜像仓库
|
||||
|
||||
集群级别的私有镜像仓库配置仅能用于配置集群。
|
||||
|
||||
在 Rancher 中设置私有镜像仓库的主要方法有两种：通过[全局默认镜像仓库](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/global-default-private-registry.md)中的**设置**选项卡设置全局默认镜像仓库，以及在集群级别设置的高级选项中设置私有镜像仓库。全局默认镜像仓库可以用于离线设置，不需要凭证的镜像仓库。而集群级私有镜像仓库用于所有需要凭证的私有镜像仓库。
|
||||
|
||||
如果你的私有镜像仓库需要凭证，为了将凭证传递给 Rancher，你需要编辑每个需要从仓库中拉取镜像的集群的集群选项。
|
||||
|
||||
私有镜像仓库的配置选项能让 Rancher 知道要从哪里拉取用于集群的[系统镜像](https://rancher.com/docs/rke/latest/en/config-options/system-images/)或[附加组件镜像](https://rancher.com/docs/rke/latest/en/config-options/add-ons/)。
|
||||
|
||||
- **系统镜像**是维护 Kubernetes 集群所需的组件。
|
||||
- **附加组件**用于部署多个集群组件，包括网络插件、ingress controller、DNS 提供商或 metrics server。
|
||||
|
||||
有关为集群配置期间应用的组件设置私有镜像仓库的更多信息，请参阅[私有镜像仓库的 RKE 文档](https://rancher.com/docs/rke/latest/en/config-options/private-registries/)。
|
||||
|
||||
Rancher v2.6 引入了[为 RKE 集群配置 ECR 镜像仓库](https://rancher.com/docs/rke/latest/en/config-options/private-registries/#amazon-elastic-container-registry-ecr-private-registry-setup)的功能。
|
||||
|
||||
### 授权集群端点
|
||||
|
||||
授权集群端点（ACE）可用于直接访问 Kubernetes API server，而无需通过 Rancher 进行通信。
|
||||
|
||||
:::note
|
||||
|
||||
授权集群端点仅适用于 Rancher 启动的 Kubernetes 集群，即只适用于 Rancher [使用 RKE](../../../reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md#配置-kubernetes-集群的工具) 来配置的集群。它不适用于托管在 Kubernetes 提供商中的集群，例如 Amazon 的 EKS。
|
||||
|
||||
:::
|
||||
|
||||
在 Rancher 启动的 Kubernetes 集群中，它默认启用，使用具有 `controlplane` 角色的节点的 IP 和默认的 Kubernetes 自签名证书。
|
||||
|
||||
有关授权集群端点的工作原理以及使用的原因，请参阅[架构介绍](../../../reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md#4-授权集群端点)。
|
||||
|
||||
我们建议使用具有授权集群端点的负载均衡器。有关详细信息，请参阅[推荐的架构](../../rancher-manager-architecture/architecture-recommendations.md#授权集群端点架构)。
|
||||
|
||||
### 节点池
|
||||
|
||||
有关使用 Rancher UI 在 RKE 集群中设置节点池的信息，请参阅[此页面](../../../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/use-new-nodes-in-an-infra-provider/use-new-nodes-in-an-infra-provider.md)。
|
||||
|
||||
### NGINX Ingress
|
||||
|
||||
如果你想使用高可用性配置来发布应用，并且你使用没有原生负载均衡功能的云提供商来托管主机，请启用此选项以在集群中使用 NGINX Ingress。
|
||||
|
||||
### Metrics Server 监控
|
||||
|
||||
这是启用或禁用 [Metrics Server](https://rancher.com/docs/rke/latest/en/config-options/add-ons/metrics-server/) 的选项。
|
||||
|
||||
每个能够使用 RKE 启动集群的云提供商都可以收集指标并监控你的集群节点。如果启用此选项，你可以从你的云提供商门户查看你的节点指标。
|
||||
|
||||
### 节点上的 Docker 版本
|
||||
|
||||
表示是否允许节点运行 Rancher 不正式支持的 Docker 版本。
|
||||
|
||||
如果你选择使用支持的 Docker 版本，Rancher 会禁止 pod 运行在安装了不支持的 Docker 版本的节点上。
|
||||
|
||||
如需了解各个 Rancher 版本通过了哪些 Docker 版本测试，请参见[支持和维护条款](https://rancher.com/support-maintenance-terms/)。
|
||||
|
||||
### Docker 根目录
|
||||
|
||||
如果要添加到集群的节点为 Docker 配置了非默认 Docker 根目录（默认为 `/var/lib/docker`），请在此选项中指定正确的 Docker 根目录。
|
||||
|
||||
### 默认 Pod 安全策略
|
||||
|
||||
如果你启用了 **Pod 安全策略支持**，请使用此下拉菜单选择应用于集群的 pod 安全策略。
|
||||
|
||||
### 节点端口范围
|
||||
|
||||
更改可用于 [NodePort 服务](https://kubernetes.io/docs/concepts/services-networking/service/#nodeport)的端口范围的选项。默认为 `30000-32767`。
|
||||
|
||||
### 定期 etcd 快照
|
||||
|
||||
启用或禁用[定期 etcd 快照](https://rancher.com/docs/rke/latest/en/etcd-snapshots/#etcd-recurring-snapshots)的选项。
|
||||
|
||||
### Agent 环境变量
|
||||
|
||||
为 [rancher agent](../../../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/about-rancher-agents.md) 设置环境变量的选项。你可以使用键值对设置环境变量。如果 Rancher Agent 需要使用代理与 Rancher Server 通信，则可以使用 Agent 环境变量设置 `HTTP_PROXY`，`HTTPS_PROXY` 和 `NO_PROXY` 环境变量。
|
||||
|
||||
### 更新 ingress-nginx
|
||||
|
||||
使用 Kubernetes 1.16 之前版本创建的集群将具有 `OnDelete`的 `ingress-nginx` `updateStrategy`。使用 Kubernetes 1.16 或更高版本创建的集群将具有 `RollingUpdate`。
|
||||
|
||||
如果 `ingress-nginx` 的 `updateStrategy` 是 `OnDelete`，则需要删除这些 pod 以获得 deployment 正确的版本。
|
||||
|
||||
### Cluster Agent 配置和 Fleet Agent 配置
|
||||
|
||||
你可以为 Cluster Agent 和集群的 Fleet Agent 配置调度字段和资源限制。你可以使用这些字段来自定义容忍度、亲和性规则和资源要求。其他容忍度会被尾附到默认容忍度和 Control Plane 节点污点的列表中。如果你定义了自定义亲和性规则，它们将覆盖全局默认亲和性设置。定义资源要求会在以前没有的地方设置请求或限制。
|
||||
|
||||
:::note
|
||||
|
||||
有了这个选项，你可以覆盖或删除运行集群所需的规则。我们强烈建议你不要删除或覆盖这些规则和其他亲和性规则，因为这可能会导致不必要的影响：
|
||||
|
||||
- `affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution` 用于 `cattle-cluster-agent`
|
||||
- `cluster-agent-default-affinity` 用于 `cattle-cluster-agent`
|
||||
- `fleet-agent-default-affinity` 用于 `fleet-agent`
|
||||
|
||||
:::
|
||||
|
||||
如果将 Rancher 降级到 v2.7.4 或更低版本，你的更改将丢失，而且 Agent 将在没有你的自定义设置的情况下重新部署。重新部署时，Fleet Agent 将回退到使用内置默认值。如果降级期间 Fleet 版本没有更改，则不会立即重新部署。
|
||||
|
||||
|
||||
## RKE 集群配置文件参考
|
||||
|
||||
高级用户可以创建一个 RKE 配置文件，而不是使用 Rancher UI 来为集群选择 Kubernetes 选项。配置文件可以让你在 RKE 安装中设置任何[可用选项](https://rancher.com/docs/rke/latest/en/config-options/)（`system_images` 配置除外）。使用 Rancher UI 或 API 创建集群时，不支持 `system_images` 选项。
|
||||
|
||||
有关 YAML 中 RKE Kubernetes 集群的可配置选项的完整参考，请参阅 [RKE 文档](https://rancher.com/docs/rke/latest/en/config-options/)。
|
||||
|
||||
### Rancher 中的配置文件结构
|
||||
|
||||
RKE（Rancher Kubernetes Engine）是 Rancher 用来配置 Kubernetes 集群的工具。过去，Rancher 的集群配置文件与 [RKE 配置文件](https://rancher.com/docs/rke/latest/en/example-yamls/)的结构是一致的。但由于 Rancher 文件结构发生了变化，因此在 Rancher 中，RKE 集群配置项与非 RKE 配置项是分开的。所以，你的集群配置需要嵌套在集群配置文件中的 `rancher_kubernetes_engine_config` 参数下。使用早期版本的 Rancher 创建的集群配置文件需要针对这种格式进行更新。以下是一个集群配置文件示例：
|
||||
|
||||
<details id="v2.3.0-cluster-config-file">
|
||||
<summary>集群配置文件示例</summary>
|
||||
|
||||
```yaml
|
||||
#
|
||||
# Cluster Config
|
||||
#
|
||||
docker_root_dir: /var/lib/docker
|
||||
enable_cluster_alerting: false
|
||||
enable_cluster_monitoring: false
|
||||
enable_network_policy: false
|
||||
local_cluster_auth_endpoint:
|
||||
enabled: true
|
||||
#
|
||||
# Rancher Config
|
||||
#
|
||||
rancher_kubernetes_engine_config: # Your RKE template config goes here.
|
||||
addon_job_timeout: 30
|
||||
authentication:
|
||||
strategy: x509
|
||||
ignore_docker_version: true
|
||||
#
|
||||
# # 目前仅支持 Nginx ingress provider
|
||||
# # 要禁用 Ingress controller，设置 `provider: none`
|
||||
# # 要在指定节点上禁用 Ingress，使用 node_selector，例如：
|
||||
# provider: nginx
|
||||
# node_selector:
|
||||
# app: ingress
|
||||
#
|
||||
ingress:
|
||||
provider: nginx
|
||||
kubernetes_version: v1.15.3-rancher3-1
|
||||
monitoring:
|
||||
provider: metrics-server
|
||||
#
|
||||
# If you are using calico on AWS
|
||||
#
|
||||
# network:
|
||||
# plugin: calico
|
||||
# calico_network_provider:
|
||||
# cloud_provider: aws
|
||||
#
|
||||
# # To specify flannel interface
|
||||
#
|
||||
# network:
|
||||
# plugin: flannel
|
||||
# flannel_network_provider:
|
||||
# iface: eth1
|
||||
#
|
||||
# # To specify flannel interface for canal plugin
|
||||
#
|
||||
# network:
|
||||
# plugin: canal
|
||||
# canal_network_provider:
|
||||
# iface: eth1
|
||||
#
|
||||
network:
|
||||
options:
|
||||
flannel_backend_type: vxlan
|
||||
plugin: canal
|
||||
#
|
||||
# services:
|
||||
# kube-api:
|
||||
# service_cluster_ip_range: 10.43.0.0/16
|
||||
# kube-controller:
|
||||
# cluster_cidr: 10.42.0.0/16
|
||||
# service_cluster_ip_range: 10.43.0.0/16
|
||||
# kubelet:
|
||||
# cluster_domain: cluster.local
|
||||
# cluster_dns_server: 10.43.0.10
|
||||
#
|
||||
services:
|
||||
etcd:
|
||||
backup_config:
|
||||
enabled: true
|
||||
interval_hours: 12
|
||||
retention: 6
|
||||
safe_timestamp: false
|
||||
creation: 12h
|
||||
extra_args:
|
||||
election-timeout: 5000
|
||||
heartbeat-interval: 500
|
||||
gid: 0
|
||||
retention: 72h
|
||||
snapshot: false
|
||||
uid: 0
|
||||
kube_api:
|
||||
always_pull_images: false
|
||||
pod_security_policy: false
|
||||
service_node_port_range: 30000-32767
|
||||
ssh_agent_auth: false
|
||||
windows_prefered_cluster: false
|
||||
```
|
||||
</details>
|
||||
|
||||
### 默认 DNS 提供商
|
||||
|
||||
下表显示了默认部署的 DNS 提供商。有关如何配置不同 DNS 提供商的更多信息，请参阅 [DNS 提供商相关的 RKE 文档](https://rancher.com/docs/rke/latest/en/config-options/add-ons/dns/)。CoreDNS 只能在 Kubernetes v1.12.0 及更高版本上使用。
|
||||
|
||||
| Rancher 版本 | Kubernetes 版本 | 默认 DNS 提供商 |
|
||||
|-------------|--------------------|----------------------|
|
||||
| v2.2.5 及更高版本 | v1.14.0 及更高版本 | CoreDNS |
|
||||
| v2.2.5 及更高版本 | v1.13.x 及更低版本 | kube-dns |
|
||||
| v2.2.4 及更低版本 | 任意 | kube-dns |
|
||||
|
||||
## YAML 中的 Rancher 特定参数
|
||||
|
||||
除了 RKE 配置文件选项外，还有可以在配置文件 (YAML) 中配置的 Rancher 特定设置如下。
|
||||
|
||||
### docker_root_dir
|
||||
|
||||
请参阅 [Docker 根目录](#docker-根目录)。
|
||||
|
||||
### enable_cluster_monitoring
|
||||
|
||||
启用或禁用[集群监控](../../../integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md)的选项。
|
||||
|
||||
### enable_network_policy
|
||||
|
||||
启用或禁用项目网络隔离的选项。
|
||||
|
||||
如果你使用支持执行 Kubernetes 网络策略的 RKE 网络插件（例如 Canal 或 Cisco ACI 插件），则可以使用项目网络隔离。
|
||||
|
||||
### local_cluster_auth_endpoint
|
||||
|
||||
请参阅[授权集群端点](#授权集群端点)。
|
||||
|
||||
示例：
|
||||
|
||||
```yaml
|
||||
local_cluster_auth_endpoint:
|
||||
enabled: true
|
||||
fqdn: "FQDN"
|
||||
ca_certs: |-
|
||||
-----BEGIN CERTIFICATE-----
|
||||
...
|
||||
-----END CERTIFICATE-----
|
||||
```
|
||||
|
||||
### 自定义网络插件
|
||||
|
||||
你可以使用 RKE 的[用户定义的附加组件功能](https://rancher.com/docs/rke/latest/en/config-options/add-ons/user-defined-add-ons/)来添加自定义网络插件。部署 Kubernetes 集群之后，你可以定义要部署的任何附加组件。
|
||||
|
||||
有两种方法可以指定附加组件：
|
||||
|
||||
- [内嵌附加组件](https://rancher.com/docs/rke/latest/en/config-options/add-ons/user-defined-add-ons/#in-line-add-ons)
|
||||
- [为附加组件引用 YAML 文件](https://rancher.com/docs/rke/latest/en/config-options/add-ons/user-defined-add-ons/#referencing-yaml-files-for-add-ons)
|
||||
|
||||
有关如何通过编辑 `cluster.yml` 来配置自定义网络插件的示例，请参阅 [RKE 文档](https://rancher.com/docs/rke/latest/en/config-options/add-ons/network-plugins/custom-network-plugin-example)。
|
||||
+2
-2
@@ -6,7 +6,7 @@ title: DNS
|
||||
|
||||
请确保你配置了正确的 kubeconfig（例如，为 Rancher HA 配置了 `export KUBECONFIG=$PWD/kube_config_cluster.yml`）或通过 UI 使用了嵌入式 kubectl。
|
||||
|
||||
在运行 DNS 检查之前，请检查集群的[默认 DNS 提供商](../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md#默认-dns-提供商)，并确保[覆盖网络正常运行](networking.md#检查覆盖网络是否正常运行)，因为这也可能导致 DNS 解析（部分）失败。
|
||||
Before running the DNS checks, make sure that [the overlay network is functioning correctly](networking.md#check-if-overlay-network-is-functioning-correctly) for your DNS provider as this can also be the reason why DNS resolution (partly) fails.
|
||||
|
||||
## 检查 DNS pod 是否正在运行
|
||||
|
||||
@@ -199,7 +199,7 @@ services:
|
||||
|
||||
:::
|
||||
|
||||
请参阅[使用 YAML 编辑集群](../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md#使用-yaml-编辑集群)了解如何应用此修改。集群配置完成后，你必须删除 kube-dns pod 以激活 pod 中的新设置：
|
||||
请参阅使用 YAML 编辑集群了解如何应用此修改。集群配置完成后，你必须删除 kube-dns pod 以激活 pod 中的新设置：
|
||||
|
||||
```
|
||||
kubectl delete pods -n kube-system -l k8s-app=kube-dns
|
||||
|
||||
+12
-12
@@ -74,22 +74,22 @@ kubectl -n kube-system get endpoints kube-scheduler -o jsonpath='{.metadata.anno
|
||||
|
||||
## Ingress Controller
|
||||
|
||||
默认的 Ingress Controller 是 NGINX，作为 DaemonSet 部署在 `ingress-nginx` 命名空间中。Pod 仅会调度到具有 `worker` 角色的节点。
|
||||
默认的 Ingress Controller 是 Traefik，作为 DaemonSet 部署在 `traefik` 命名空间中。Pod 仅会调度到具有 `worker` 角色的节点。
|
||||
|
||||
检查 pod 是否运行在所有节点上：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get pods -o wide
|
||||
kubectl -n traefik get pods -o wide
|
||||
```
|
||||
|
||||
输出示例：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get pods -o wide
|
||||
kubectl -n traefik get pods -o wide
|
||||
NAME READY STATUS RESTARTS AGE IP NODE
|
||||
default-http-backend-797c5bc547-kwwlq 1/1 Running 0 17m x.x.x.x worker-1
|
||||
nginx-ingress-controller-4qd64 1/1 Running 0 14m x.x.x.x worker-1
|
||||
nginx-ingress-controller-8wxhm 1/1 Running 0 13m x.x.x.x worker-0
|
||||
traefik-4qd64 1/1 Running 0 14m x.x.x.x worker-1
|
||||
traefik-8wxhm 1/1 Running 0 13m x.x.x.x worker-0
|
||||
```
|
||||
|
||||
如果 pod 无法运行（即状态不是 **Running**，Ready 状态未显示 `1/1`，或者有大量 Restarts），请检查 pod 详细信息，日志和命名空间事件。
|
||||
@@ -97,27 +97,27 @@ nginx-ingress-controller-8wxhm 1/1 Running 0 13m
|
||||
### Pod 详细信息
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx describe pods -l app=ingress-nginx
|
||||
kubectl -n traefik describe pods -l app=traefik
|
||||
```
|
||||
|
||||
### Pod 容器日志
|
||||
|
||||
下面的命令可以显示所有标记为 “app=ingress-nginx” 的 pod 的日志，但是由于 `kubectl logs` 命令的限制，它只会显示 10 行日志。有关详细信息，请参阅 `kubectl logs -h` 的 `--tail`。
|
||||
下面的命令可以显示所有标记为 “app=traefik” 的 pod 的日志，但是由于 `kubectl logs` 命令的限制，它只会显示 10 行日志。有关详细信息，请参阅 `kubectl logs -h` 的 `--tail`。
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx logs -l app=ingress-nginx
|
||||
kubectl -n traefik logs -l app=traefik
|
||||
```
|
||||
|
||||
如果需要查看完整的日志，请在命令中尾随 pod 名称：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx logs <pod name>
|
||||
kubectl -n traefik logs <pod name>
|
||||
```
|
||||
|
||||
### 命名空间事件
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get events
|
||||
kubectl -n traefik get events
|
||||
```
|
||||
|
||||
### 调试日志
|
||||
@@ -125,7 +125,7 @@ kubectl -n ingress-nginx get events
|
||||
要启用调试日志：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx patch ds nginx-ingress-controller --type='json' -p='[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--v=5"}]'
|
||||
kubectl -n traefik patch ds traefik --type='json' -p='[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--v=5"}]'
|
||||
```
|
||||
|
||||
### 检查配置
|
||||
@@ -133,7 +133,7 @@ kubectl -n ingress-nginx patch ds nginx-ingress-controller --type='json' -p='[{"
|
||||
在每个 pod 中检索生成的配置：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get pods -l app=ingress-nginx --no-headers -o custom-columns=.NAME:.metadata.name | while read pod; do kubectl -n ingress-nginx exec $pod -- cat /etc/nginx/nginx.conf; done
|
||||
kubectl -n traefik get pods -l app=traefik --no-headers -o custom-columns=.NAME:.metadata.name | while read pod; do kubectl -n traefik exec $pod -- cat /etc/nginx/nginx.conf; done
|
||||
```
|
||||
|
||||
## Rancher Agents
|
||||
|
||||
+1
-1
@@ -65,7 +65,7 @@ rancher rancher.yourdomain.com x.x.x.x,x.x.x.x,x.x.x.x 80, 443 2m
|
||||
如果访问你配置的 Rancher FQDN 时没有显示 UI，请检查 Ingress Controller 日志以查看尝试访问 Rancher 时发生了什么：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx logs -l app=ingress-nginx
|
||||
kubectl -n traefik logs -l app=traefik
|
||||
```
|
||||
|
||||
## Leader 选举
|
||||
|
||||
+1
-4
@@ -6,10 +6,7 @@ title: TLS 设置
|
||||
|
||||
## 在高可用 Kubernetes 集群中运行 Rancher
|
||||
|
||||
当你在 Kubernetes 集群内安装 Rancher 时，TLS 会在集群的 Ingress Controller 上卸载。可用的 TLS 设置取决于使用的 Ingress Controller：
|
||||
|
||||
* nginx-ingress-controller（RKE1 和 RKE2 默认）：[默认的 TLS 版本和密码](https://kubernetes.github.io/ingress-nginx/user-guide/tls/#default-tls-version-and-ciphers)。
|
||||
* traefik（K3s 默认）：[TLS 选项](https://doc.traefik.io/traefik/https/tls/#tls-options)。
|
||||
When you install a Rancher managed Kubernetes cluster, TLS is offloaded at the cluster's ingress controller. Traefik is the default ingress for K3s and can be used with RKE2, refer to [TLS Options](https://doc.traefik.io/traefik/https/tls/#tls-options) for further information.
|
||||
|
||||
## 在单个 Docker 容器中运行 Rancher
|
||||
|
||||
|
||||
+7
-12
@@ -4,14 +4,12 @@ title: 设置 Amazon NLB 网络负载均衡器
|
||||
|
||||
本文介绍了如何在 Amazon EC2 服务中设置 Amazon NLB 网络负载均衡器，用于将流量转发到 EC2 上的多个实例中。
|
||||
|
||||
这些示例中，负载均衡器将流量转发到三个 Rancher Server 节点。如果 Rancher 安装在 RKE Kubernetes 集群上，则需要三个节点。如果 Rancher 安装在 K3s Kubernetes 集群上，则只需要两个节点。
|
||||
这些示例中，负载均衡器将流量转发到三个 Rancher Server 节点。如果 Rancher 安装在 K3s Kubernetes 集群上，则只需要两个节点。
|
||||
|
||||
本文介绍的只是配置负载均衡器的其中一种方式。其他负载均衡器如传统负载路由器（Classic Load Balancer）和应用负载路由器（Application Load Balancer），也可以将流量转发到 Rancher Server 节点。
|
||||
|
||||
Rancher 仅支持使用 Amazon NLB 以 `TCP` 模式终止 443 端口的流量，而不支持 `TLS` 模式。这试因为在 NLB 终止时，NLB 不会将正确的标头注入请求中。如果你想使用由 Amazon Certificate Manager (ACM) 托管的证书，请使用 ALB。
|
||||
|
||||
|
||||
|
||||
## 要求
|
||||
|
||||
你已在 EC2 中创建了 Linux 实例。此外，负载均衡器会把流量转发到这些节点。
|
||||
@@ -22,7 +20,7 @@ Rancher 仅支持使用 Amazon NLB 以 `TCP` 模式终止 443 端口的流量，
|
||||
|
||||
配置 NLB 的第一个步骤是创建两个目标组。一般来说，只需要端口 443 就可以访问 Rancher。但是，由于端口 80 的流量会被自动重定向到端口 443，因此，你也可以为端口 80 也添加一个监听器。
|
||||
|
||||
不管使用的是 NGINX Ingress 还是 Traefik Ingress Controller，Ingress 都应该将端口 80 的流量重定向到端口 443。以下为操作步骤：
|
||||
The Traefik Ingress should redirect traffic from port 80 to port 443.
|
||||
|
||||
1. 登录到 [Amazon AWS 控制台](https://console.aws.amazon.com/ec2/)。确保选择的**区域**是你创建 EC2 实例 （Linux 节点）的区域。
|
||||
1. 选择**服务** > **EC2**，找到**负载均衡器**并打开**目标组**。
|
||||
@@ -30,7 +28,7 @@ Rancher 仅支持使用 Amazon NLB 以 `TCP` 模式终止 443 端口的流量，
|
||||
|
||||
:::note
|
||||
|
||||
不同 Ingress 的健康检查处理方法不同。详情请参阅[本节](#nginx-ingress-和-traefik-ingress-的健康检查路径)。
|
||||
For details on Traefik Ingress health checks, refer to [this section.](#health-check-paths-for-traefik-ingresses)
|
||||
|
||||
:::
|
||||
|
||||
@@ -163,13 +161,10 @@ AWS 完成 NLB 创建后，单击**关闭**。
|
||||
|
||||
6. 单击右上角的**保存**。
|
||||
|
||||
## NGINX Ingress 和 Traefik Ingress 的健康检查路径
|
||||
## Health Check Paths for Traefik Ingresses
|
||||
|
||||
K3s 和 RKE Kubernetes 集群使用的默认 Ingress 不同，因此对应的健康检查方式也不同。
|
||||
K3s Kubernetes clusters use Traefik as the default Ingress.
|
||||
|
||||
RKE Kubernetes 集群默认使用 NGINX Ingress，而 K3s Kubernetes 集群默认使用 Traefik Ingress。
|
||||
The health check path is `/ping`. By default `/ping` is always matched (regardless of Host), and a response from [Traefik itself](https://docs.traefik.io/operations/ping/) is always served.
|
||||
|
||||
- **Traefik**：默认健康检查路径是 `/ping`。默认情况下，不管主机如何，`/ping` 总是匹配，而且 [Traefik 自身](https://docs.traefik.io/operations/ping/)总会响应。
|
||||
- **NGINX Ingress**：NGINX Ingress Controller 的默认后端有一个 `/healthz` 端点。默认情况下，不管主机如何，`/healthz` 总是匹配，而且 [`ingress-nginx` 自身](https://github.com/kubernetes/ingress-nginx/blob/0cbe783f43a9313c9c26136e888324b1ee91a72f/charts/ingress-nginx/values.yaml#L212)总会响应。
|
||||
|
||||
想要精确模拟健康检查，最好是使用 Host 标头（Rancher hostname）加上 `/ping` 或 `/healthz`（分别对应 K3s 和 RKE 集群）来获取 Rancher Pod 的响应，而不是 Ingress 的响应。
|
||||
To simulate an accurate health check, it is a best practice to use the Host header (Rancher hostname) combined with `/ping` or `/healthz` wherever possible, to get a response from the Rancher Pods, not the Ingress.
|
||||
|
||||
+5
-5
@@ -87,7 +87,7 @@ systemctl start rke2-server.service
|
||||
|
||||
1. 安装 Kubernetes 命令行工具 [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl)。
|
||||
2. 复制 `/etc/rancher/rke2/rke2.yaml` 文件并保存到本地主机的 `~/.kube/config` 目录上。
|
||||
3. 在 kubeconfig 文件中，`server` 的参数为 localhost。在端口 6443 上将服务器配置为 controlplane 负载均衡器的 DNS（RKE2 Kubernetes API Server 使用端口 6443，而 Rancher Server 将通过 NGINX Ingress 在端口 80 和 443 上提供服务。）以下是一个示例 `rke2.yaml`：
|
||||
3. 在 kubeconfig 文件中，`server` 的参数为 localhost。在端口 6443 上将服务器配置为 controlplane 负载均衡器的 DNS（RKE2 Kubernetes API Server 使用端口 6443，而 Rancher Server 将通过 Traefik Ingress 在端口 80 和 443 上提供服务。）以下是一个示例 `rke2.yaml`：
|
||||
|
||||
```yml
|
||||
apiVersion: v1
|
||||
@@ -136,7 +136,8 @@ kube-system etcd-rke2-server-2 1/1 Ru
|
||||
kube-system etcd-rke2-server-3 1/1 Running 0 56s
|
||||
kube-system helm-install-rke2-canal-hs6sx 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-rke2-coredns-xmzm8 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-rke2-ingress-nginx-flwnl 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-traefik-crd-z8vsz 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-traefik-flwnl 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-rke2-metrics-server-7sggn 0/1 Completed 0 2m17s
|
||||
kube-system kube-apiserver-rke2-server-1 1/1 Running 0 116s
|
||||
kube-system kube-apiserver-rke2-server-2 1/1 Running 0 66s
|
||||
@@ -156,9 +157,8 @@ kube-system rke2-canal-swfmq 2/2 Ru
|
||||
kube-system rke2-coredns-rke2-coredns-547d5499cb-6tvwb 1/1 Running 0 92s
|
||||
kube-system rke2-coredns-rke2-coredns-547d5499cb-rdttj 1/1 Running 0 2m8s
|
||||
kube-system rke2-coredns-rke2-coredns-autoscaler-65c9bb465d-85sq5 1/1 Running 0 2m8s
|
||||
kube-system rke2-ingress-nginx-controller-69qxc 1/1 Running 0 52s
|
||||
kube-system rke2-ingress-nginx-controller-7hprp 1/1 Running 0 52s
|
||||
kube-system rke2-ingress-nginx-controller-x658h 1/1 Running 0 52s
|
||||
kube-system traefik-7c844b766f-m9p2w 1/1 Running 0 52s
|
||||
kube-system traefik-7c844b766f-s4l9k 1/1 Running 0 52s
|
||||
kube-system rke2-metrics-server-6564db4569-vdfkn 1/1 Running 0 66s
|
||||
```
|
||||
|
||||
|
||||
+1
-3
@@ -36,6 +36,4 @@ description: Ingress 配置
|
||||
|
||||
## 标签和注释
|
||||
|
||||
添加[标签](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/)和/或[注释](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)来为你的 Ingress Controller 提供元数据。
|
||||
|
||||
有关可用的注释列表，请参阅 [Nginx Ingress Controller 文档](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/)。
|
||||
Please refer to the Traefik documentation for the full list of Ingress NGINX annotations that are [supported](https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/ingress-nginx/#annotations-support) and [unsupported](https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/ingress-nginx/#unsupported-annotations) by Traefik's kubernetesIngressNginx provider.
|
||||
|
||||
+8
@@ -11,6 +11,14 @@ Kubernetes 支持四层负载均衡和七层负载均衡。
|
||||
|
||||
通常情况下，四层负载均衡器由底层云提供商支持，因此，如果你在裸金属服务器和 vSphere 集群上部署 RKE 集群，则不支持四层负载均衡器。但是，单个[全局管理的 config-map](https://kubernetes.github.io/ingress-nginx/user-guide/exposing-tcp-udp-services/) 可用于在 NGINX 或第三方 Ingress 上公开服务。
|
||||
|
||||
:::warning
|
||||
|
||||
**Ingress-NGINX EOL:** The community `ingress-nginx` controller reaches End-of-Life (EOL) in March 2026. Traefik is the recommended migration path for Rancher environments.
|
||||
|
||||
Traefik includes a native Ingress NGINX provider. This allows you to migrate from NGINX without rewriting your existing Ingress objects, as Traefik will automatically interpret `nginx.ingress.kubernetes.io` annotations. If you are upgrading a cluster that is already using `ingress-nginx`, follow this [guide](https://doc.traefik.io/traefik/migrate/nginx-to-traefik/) for more information.
|
||||
|
||||
:::
|
||||
|
||||
:::note
|
||||
|
||||
你可以使用非云负载均衡器（例如 [MetalLB](https://metallb.universe.tf/)）来部署集群。但是，该用例比云提供商支持的四层负载均衡器更高级，而且不可以在 Rancher 或 RKE 中配置。
|
||||
|
||||
+8
@@ -36,6 +36,14 @@ Rancher 支持两种类型的负载均衡器：
|
||||
|
||||
## Ingress
|
||||
|
||||
:::warning
|
||||
|
||||
**Ingress-NGINX EOL:** The community `ingress-nginx` controller reaches End-of-Life (EOL) in March 2026. Traefik is the recommended migration path for Rancher environments.
|
||||
|
||||
Traefik includes a native Ingress NGINX provider. This allows you to migrate from NGINX without rewriting your existing Ingress objects, as Traefik will automatically interpret `nginx.ingress.kubernetes.io` annotations. If you are upgrading a cluster that is already using `ingress-nginx`, follow this [guide](https://doc.traefik.io/traefik/migrate/nginx-to-traefik/) for more information.
|
||||
|
||||
:::
|
||||
|
||||
如上所述，使用负载均衡器的缺点是：
|
||||
|
||||
- 每个服务负载均衡器只能处理一个 IP 地址。
|
||||
|
||||
+5
-2
@@ -206,12 +206,13 @@ Prometheus 直接抓取以下 Kubernetes 组件：
|
||||
|
||||
- kubelet\*
|
||||
- ingress-nginx\*\*
|
||||
- Traefik\*\*
|
||||
- coreDns/kubeDns
|
||||
- kube-api-server
|
||||
|
||||
\* 你可以选择通过 `hardenedKubelet.enabled` 来使用 PushProx，但这不是默认设置。
|
||||
|
||||
\*\* RKE 和 RKE2 集群默认部署 ingress-nginx，并将其视为内部 Kubernetes 组件。
|
||||
\*\* For RKE clusters, ingress-nginx is deployed by default and treated as an internal Kubernetes component. For RKE2 clusters, Traefik is deployed by default and treated as an internal Kubernetes component.
|
||||
|
||||
|
||||
### 基于 Kubernetes 发行版抓取指标
|
||||
@@ -228,10 +229,11 @@ Prometheus 直接抓取以下 Kubernetes 组件：
|
||||
| kube-proxy | rkeProxy.enabled | rke2Proxy.enabled | kubeAdmProxy.enabled | k3sServer.enabled |
|
||||
| kubelet | 收集 kubelet 直接公开的指标 | 收集 kubelet 直接公开的指标 | 收集 kubelet 直接公开的指标 | 收集 kubelet 直接公开的指标 |
|
||||
| ingress-nginx* | 收集 kubelet 直接公开的指标，由 rkeIngressNginx.enabled 公开 | 收集 kubelet 直接公开的指标，由 rke2IngressNginx.enabled 公开 | 不可用 | 不可用 |
|
||||
| Traefik* | Collects metrics directly exposed by kubelet | Collects metrics directly exposed by kubelet, Exposed by rke2IngressNginx.enabled | Not available | Not available |
|
||||
| coreDns/kubeDns | 收集 coreDns/kubeDns 直接公开的指标 | 收集 coreDns/kubeDns 直接公开的指标 | 收集 coreDns/kubeDns 直接公开的指标 | 收集 coreDns/kubeDns 直接公开的指标 |
|
||||
| kube-api-server | 收集 kube-api-server 直接公开的指标 | 收集 kube-api-server 直接公开的指标 | 收集 kube-appi-server 直接公开的指标 | 收集 kube-api-server 直接公开的指标 |
|
||||
|
||||
\* RKE 和 RKE2 集群默认部署 ingress-nginx，并将其视为内部 Kubernetes 组件。
|
||||
\* For RKE clusters, ingress-nginx is deployed by default and treated as an internal Kubernetes component. For RKE2 clusters, Traefik is deployed by default and treated as an internal Kubernetes component.
|
||||
|
||||
### 名词解释
|
||||
|
||||
@@ -241,5 +243,6 @@ Prometheus 直接抓取以下 Kubernetes 组件：
|
||||
- **kube-proxy**：内部 Kubernetes 组件，用于监控 API server 的 pod/service 更改以保持网络最新状态。
|
||||
- **kubelet**：内部 Kubernetes 组件，用于为 pod 监视节点上的 API server 并确保这些 pod 能运行。
|
||||
- **ingress-nginx**：用于 Kubernetes 的 Ingress controller，使用 NGINX 作为反向代理和负载均衡器。
|
||||
- **Traefik:** An Ingress controller for Kubernetes that can be used as a reverse proxy and load balancer.
|
||||
- **coreDns/kubeDns**：负责 DNS 的内部 Kubernetes 组件。
|
||||
- **kube-api-server**：负责为其他 master 组件公开 API 的主要内部 Kubernetes 组件。
|
||||
|
||||
+12
-12
@@ -74,22 +74,22 @@ kubectl -n kube-system get endpoints kube-scheduler -o jsonpath='{.metadata.anno
|
||||
|
||||
## Ingress Controller
|
||||
|
||||
默认的 Ingress Controller 是 NGINX，作为 DaemonSet 部署在 `ingress-nginx` 命名空间中。Pod 仅会调度到具有 `worker` 角色的节点。
|
||||
默认的 Ingress Controller 是 Traefik，作为 DaemonSet 部署在 `traefik` 命名空间中。Pod 仅会调度到具有 `worker` 角色的节点。
|
||||
|
||||
检查 pod 是否运行在所有节点上：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get pods -o wide
|
||||
kubectl -n traefik get pods -o wide
|
||||
```
|
||||
|
||||
输出示例：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get pods -o wide
|
||||
kubectl -n traefik get pods -o wide
|
||||
NAME READY STATUS RESTARTS AGE IP NODE
|
||||
default-http-backend-797c5bc547-kwwlq 1/1 Running 0 17m x.x.x.x worker-1
|
||||
nginx-ingress-controller-4qd64 1/1 Running 0 14m x.x.x.x worker-1
|
||||
nginx-ingress-controller-8wxhm 1/1 Running 0 13m x.x.x.x worker-0
|
||||
traefik-4qd64 1/1 Running 0 14m x.x.x.x worker-1
|
||||
traefik-8wxhm 1/1 Running 0 13m x.x.x.x worker-0
|
||||
```
|
||||
|
||||
如果 pod 无法运行（即状态不是 **Running**，Ready 状态未显示 `1/1`，或者有大量 Restarts），请检查 pod 详细信息，日志和命名空间事件。
|
||||
@@ -97,27 +97,27 @@ nginx-ingress-controller-8wxhm 1/1 Running 0 13m
|
||||
### Pod 详细信息
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx describe pods -l app=ingress-nginx
|
||||
kubectl -n traefik describe pods -l app=traefik
|
||||
```
|
||||
|
||||
### Pod 容器日志
|
||||
|
||||
下面的命令可以显示所有标记为 “app=ingress-nginx” 的 pod 的日志，但是由于 `kubectl logs` 命令的限制，它只会显示 10 行日志。有关详细信息，请参阅 `kubectl logs -h` 的 `--tail`。
|
||||
下面的命令可以显示所有标记为 “app=traefik” 的 pod 的日志，但是由于 `kubectl logs` 命令的限制，它只会显示 10 行日志。有关详细信息，请参阅 `kubectl logs -h` 的 `--tail`。
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx logs -l app=ingress-nginx
|
||||
kubectl -n traefik logs -l app=traefik
|
||||
```
|
||||
|
||||
如果需要查看完整的日志，请在命令中尾随 pod 名称：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx logs <pod name>
|
||||
kubectl -n traefik logs <pod name>
|
||||
```
|
||||
|
||||
### 命名空间事件
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get events
|
||||
kubectl -n traefik get events
|
||||
```
|
||||
|
||||
### 调试日志
|
||||
@@ -125,7 +125,7 @@ kubectl -n ingress-nginx get events
|
||||
要启用调试日志：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx patch ds nginx-ingress-controller --type='json' -p='[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--v=5"}]'
|
||||
kubectl -n traefik patch ds traefik --type='json' -p='[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--v=5"}]'
|
||||
```
|
||||
|
||||
### 检查配置
|
||||
@@ -133,7 +133,7 @@ kubectl -n ingress-nginx patch ds nginx-ingress-controller --type='json' -p='[{"
|
||||
在每个 pod 中检索生成的配置：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get pods -l app=ingress-nginx --no-headers -o custom-columns=.NAME:.metadata.name | while read pod; do kubectl -n ingress-nginx exec $pod -- cat /etc/nginx/nginx.conf; done
|
||||
kubectl -n traefik get pods -l app=traefik --no-headers -o custom-columns=.NAME:.metadata.name | while read pod; do kubectl -n traefik exec $pod -- cat /etc/nginx/nginx.conf; done
|
||||
```
|
||||
|
||||
## Rancher Agents
|
||||
|
||||
+1
-1
@@ -65,7 +65,7 @@ rancher rancher.yourdomain.com x.x.x.x,x.x.x.x,x.x.x.x 80, 443 2m
|
||||
如果访问你配置的 Rancher FQDN 时没有显示 UI，请检查 Ingress Controller 日志以查看尝试访问 Rancher 时发生了什么：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx logs -l app=ingress-nginx
|
||||
kubectl -n traefik logs -l app=traefik
|
||||
```
|
||||
|
||||
## Leader 选举
|
||||
|
||||
+1
-4
@@ -6,10 +6,7 @@ title: TLS 设置
|
||||
|
||||
## 在高可用 Kubernetes 集群中运行 Rancher
|
||||
|
||||
当你在 Kubernetes 集群内安装 Rancher 时，TLS 会在集群的 Ingress Controller 上卸载。可用的 TLS 设置取决于使用的 Ingress Controller：
|
||||
|
||||
* nginx-ingress-controller（RKE1 和 RKE2 默认）：[默认的 TLS 版本和密码](https://kubernetes.github.io/ingress-nginx/user-guide/tls/#default-tls-version-and-ciphers)。
|
||||
* traefik（K3s 默认）：[TLS 选项](https://doc.traefik.io/traefik/https/tls/#tls-options)。
|
||||
When you install a Rancher managed Kubernetes cluster, TLS is offloaded at the cluster's ingress controller. Traefik is the default ingress for K3s and can be used with RKE2, refer to [TLS Options](https://doc.traefik.io/traefik/https/tls/#tls-options) for further information.
|
||||
|
||||
## 在单个 Docker 容器中运行 Rancher
|
||||
|
||||
|
||||
+7
-12
@@ -4,14 +4,12 @@ title: 设置 Amazon NLB 网络负载均衡器
|
||||
|
||||
本文介绍了如何在 Amazon EC2 服务中设置 Amazon NLB 网络负载均衡器，用于将流量转发到 EC2 上的多个实例中。
|
||||
|
||||
这些示例中，负载均衡器将流量转发到三个 Rancher Server 节点。如果 Rancher 安装在 RKE Kubernetes 集群上，则需要三个节点。如果 Rancher 安装在 K3s Kubernetes 集群上，则只需要两个节点。
|
||||
这些示例中，负载均衡器将流量转发到三个 Rancher Server 节点。如果 Rancher 安装在 K3s Kubernetes 集群上，则只需要两个节点。
|
||||
|
||||
本文介绍的只是配置负载均衡器的其中一种方式。其他负载均衡器如传统负载路由器（Classic Load Balancer）和应用负载路由器（Application Load Balancer），也可以将流量转发到 Rancher Server 节点。
|
||||
|
||||
Rancher 仅支持使用 Amazon NLB 以 `TCP` 模式终止 443 端口的流量，而不支持 `TLS` 模式。这试因为在 NLB 终止时，NLB 不会将正确的标头注入请求中。如果你想使用由 Amazon Certificate Manager (ACM) 托管的证书，请使用 ALB。
|
||||
|
||||
|
||||
|
||||
## 要求
|
||||
|
||||
你已在 EC2 中创建了 Linux 实例。此外，负载均衡器会把流量转发到这些节点。
|
||||
@@ -22,7 +20,7 @@ Rancher 仅支持使用 Amazon NLB 以 `TCP` 模式终止 443 端口的流量，
|
||||
|
||||
配置 NLB 的第一个步骤是创建两个目标组。一般来说，只需要端口 443 就可以访问 Rancher。但是，由于端口 80 的流量会被自动重定向到端口 443，因此，你也可以为端口 80 也添加一个监听器。
|
||||
|
||||
不管使用的是 NGINX Ingress 还是 Traefik Ingress Controller，Ingress 都应该将端口 80 的流量重定向到端口 443。以下为操作步骤：
|
||||
The Traefik Ingress should redirect traffic from port 80 to port 443.
|
||||
|
||||
1. 登录到 [Amazon AWS 控制台](https://console.aws.amazon.com/ec2/)。确保选择的**区域**是你创建 EC2 实例 （Linux 节点）的区域。
|
||||
1. 选择**服务** > **EC2**，找到**负载均衡器**并打开**目标组**。
|
||||
@@ -30,7 +28,7 @@ Rancher 仅支持使用 Amazon NLB 以 `TCP` 模式终止 443 端口的流量，
|
||||
|
||||
:::note
|
||||
|
||||
不同 Ingress 的健康检查处理方法不同。详情请参阅[本节](#nginx-ingress-和-traefik-ingress-的健康检查路径)。
|
||||
For details on Traefik Ingress health checks, refer to [this section.](#health-check-paths-for-traefik-ingresses)
|
||||
|
||||
:::
|
||||
|
||||
@@ -163,13 +161,10 @@ AWS 完成 NLB 创建后，单击**关闭**。
|
||||
|
||||
6. 单击右上角的**保存**。
|
||||
|
||||
## NGINX Ingress 和 Traefik Ingress 的健康检查路径
|
||||
## Health Check Paths for Traefik Ingresses
|
||||
|
||||
K3s 和 RKE Kubernetes 集群使用的默认 Ingress 不同，因此对应的健康检查方式也不同。
|
||||
K3s Kubernetes clusters use Traefik as the default Ingress.
|
||||
|
||||
RKE Kubernetes 集群默认使用 NGINX Ingress，而 K3s Kubernetes 集群默认使用 Traefik Ingress。
|
||||
The health check path is `/ping`. By default `/ping` is always matched (regardless of Host), and a response from [Traefik itself](https://docs.traefik.io/operations/ping/) is always served.
|
||||
|
||||
- **Traefik**：默认健康检查路径是 `/ping`。默认情况下，不管主机如何，`/ping` 总是匹配，而且 [Traefik 自身](https://docs.traefik.io/operations/ping/)总会响应。
|
||||
- **NGINX Ingress**：NGINX Ingress Controller 的默认后端有一个 `/healthz` 端点。默认情况下，不管主机如何，`/healthz` 总是匹配，而且 [`ingress-nginx` 自身](https://github.com/kubernetes/ingress-nginx/blob/0cbe783f43a9313c9c26136e888324b1ee91a72f/charts/ingress-nginx/values.yaml#L212)总会响应。
|
||||
|
||||
想要精确模拟健康检查，最好是使用 Host 标头（Rancher hostname）加上 `/ping` 或 `/healthz`（分别对应 K3s 和 RKE 集群）来获取 Rancher Pod 的响应，而不是 Ingress 的响应。
|
||||
To simulate an accurate health check, it is a best practice to use the Host header (Rancher hostname) combined with `/ping` or `/healthz` wherever possible, to get a response from the Rancher Pods, not the Ingress.
|
||||
|
||||
+5
-5
@@ -87,7 +87,7 @@ systemctl start rke2-server.service
|
||||
|
||||
1. 安装 Kubernetes 命令行工具 [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl)。
|
||||
2. 复制 `/etc/rancher/rke2/rke2.yaml` 文件并保存到本地主机的 `~/.kube/config` 目录上。
|
||||
3. 在 kubeconfig 文件中，`server` 的参数为 localhost。在端口 6443 上将服务器配置为 controlplane 负载均衡器的 DNS（RKE2 Kubernetes API Server 使用端口 6443，而 Rancher Server 将通过 NGINX Ingress 在端口 80 和 443 上提供服务。）以下是一个示例 `rke2.yaml`：
|
||||
3. 在 kubeconfig 文件中，`server` 的参数为 localhost。在端口 6443 上将服务器配置为 controlplane 负载均衡器的 DNS（RKE2 Kubernetes API Server 使用端口 6443，而 Rancher Server 将通过 Traefik Ingress 在端口 80 和 443 上提供服务。）以下是一个示例 `rke2.yaml`：
|
||||
|
||||
```yml
|
||||
apiVersion: v1
|
||||
@@ -136,7 +136,8 @@ kube-system etcd-rke2-server-2 1/1 Ru
|
||||
kube-system etcd-rke2-server-3 1/1 Running 0 56s
|
||||
kube-system helm-install-rke2-canal-hs6sx 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-rke2-coredns-xmzm8 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-rke2-ingress-nginx-flwnl 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-traefik-crd-z8vsz 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-traefik-flwnl 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-rke2-metrics-server-7sggn 0/1 Completed 0 2m17s
|
||||
kube-system kube-apiserver-rke2-server-1 1/1 Running 0 116s
|
||||
kube-system kube-apiserver-rke2-server-2 1/1 Running 0 66s
|
||||
@@ -156,9 +157,8 @@ kube-system rke2-canal-swfmq 2/2 Ru
|
||||
kube-system rke2-coredns-rke2-coredns-547d5499cb-6tvwb 1/1 Running 0 92s
|
||||
kube-system rke2-coredns-rke2-coredns-547d5499cb-rdttj 1/1 Running 0 2m8s
|
||||
kube-system rke2-coredns-rke2-coredns-autoscaler-65c9bb465d-85sq5 1/1 Running 0 2m8s
|
||||
kube-system rke2-ingress-nginx-controller-69qxc 1/1 Running 0 52s
|
||||
kube-system rke2-ingress-nginx-controller-7hprp 1/1 Running 0 52s
|
||||
kube-system rke2-ingress-nginx-controller-x658h 1/1 Running 0 52s
|
||||
kube-system traefik-7c844b766f-m9p2w 1/1 Running 0 52s
|
||||
kube-system traefik-7c844b766f-s4l9k 1/1 Running 0 52s
|
||||
kube-system rke2-metrics-server-6564db4569-vdfkn 1/1 Running 0 66s
|
||||
```
|
||||
|
||||
|
||||
+1
-3
@@ -36,6 +36,4 @@ description: Ingress 配置
|
||||
|
||||
## 标签和注释
|
||||
|
||||
添加[标签](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/)和/或[注释](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)来为你的 Ingress Controller 提供元数据。
|
||||
|
||||
有关可用的注释列表，请参阅 [Nginx Ingress Controller 文档](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/)。
|
||||
Please refer to the Traefik documentation for the full list of Ingress NGINX annotations that are [supported](https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/ingress-nginx/#annotations-support) and [unsupported](https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/ingress-nginx/#unsupported-annotations) by Traefik's kubernetesIngressNginx provider.
|
||||
|
||||
+8
@@ -11,6 +11,14 @@ Kubernetes 支持四层负载均衡和七层负载均衡。
|
||||
|
||||
通常情况下，四层负载均衡器由底层云提供商支持，因此，如果你在裸金属服务器和 vSphere 集群上部署 RKE 集群，则不支持四层负载均衡器。但是，单个[全局管理的 config-map](https://kubernetes.github.io/ingress-nginx/user-guide/exposing-tcp-udp-services/) 可用于在 NGINX 或第三方 Ingress 上公开服务。
|
||||
|
||||
:::warning
|
||||
|
||||
**Ingress-NGINX EOL:** The community `ingress-nginx` controller reaches End-of-Life (EOL) in March 2026. Traefik is the recommended migration path for Rancher environments.
|
||||
|
||||
Traefik includes a native Ingress NGINX provider. This allows you to migrate from NGINX without rewriting your existing Ingress objects, as Traefik will automatically interpret `nginx.ingress.kubernetes.io` annotations. If you are upgrading a cluster that is already using `ingress-nginx`, follow this [guide](https://doc.traefik.io/traefik/migrate/nginx-to-traefik/) for more information.
|
||||
|
||||
:::
|
||||
|
||||
:::note
|
||||
|
||||
你可以使用非云负载均衡器（例如 [MetalLB](https://metallb.universe.tf/)）来部署集群。但是，该用例比云提供商支持的四层负载均衡器更高级，而且不可以在 Rancher 或 RKE 中配置。
|
||||
|
||||
+8
@@ -36,6 +36,14 @@ Rancher 支持两种类型的负载均衡器：
|
||||
|
||||
## Ingress
|
||||
|
||||
:::warning
|
||||
|
||||
**Ingress-NGINX EOL:** The community `ingress-nginx` controller reaches End-of-Life (EOL) in March 2026. Traefik is the recommended migration path for Rancher environments.
|
||||
|
||||
Traefik includes a native Ingress NGINX provider. This allows you to migrate from NGINX without rewriting your existing Ingress objects, as Traefik will automatically interpret `nginx.ingress.kubernetes.io` annotations. If you are upgrading a cluster that is already using `ingress-nginx`, follow this [guide](https://doc.traefik.io/traefik/migrate/nginx-to-traefik/) for more information.
|
||||
|
||||
:::
|
||||
|
||||
如上所述，使用负载均衡器的缺点是：
|
||||
|
||||
- 每个服务负载均衡器只能处理一个 IP 地址。
|
||||
|
||||
+5
-2
@@ -206,12 +206,13 @@ Prometheus 直接抓取以下 Kubernetes 组件：
|
||||
|
||||
- kubelet\*
|
||||
- ingress-nginx\*\*
|
||||
- Traefik\*\*
|
||||
- coreDns/kubeDns
|
||||
- kube-api-server
|
||||
|
||||
\* 你可以选择通过 `hardenedKubelet.enabled` 来使用 PushProx，但这不是默认设置。
|
||||
|
||||
\*\* RKE 和 RKE2 集群默认部署 ingress-nginx，并将其视为内部 Kubernetes 组件。
|
||||
\*\* For RKE clusters, ingress-nginx is deployed by default and treated as an internal Kubernetes component. For RKE2 clusters, Traefik is deployed by default and treated as an internal Kubernetes component.
|
||||
|
||||
|
||||
### 基于 Kubernetes 发行版抓取指标
|
||||
@@ -228,10 +229,11 @@ Prometheus 直接抓取以下 Kubernetes 组件：
|
||||
| kube-proxy | rkeProxy.enabled | rke2Proxy.enabled | kubeAdmProxy.enabled | k3sServer.enabled |
|
||||
| kubelet | 收集 kubelet 直接公开的指标 | 收集 kubelet 直接公开的指标 | 收集 kubelet 直接公开的指标 | 收集 kubelet 直接公开的指标 |
|
||||
| ingress-nginx* | 收集 kubelet 直接公开的指标，由 rkeIngressNginx.enabled 公开 | 收集 kubelet 直接公开的指标，由 rke2IngressNginx.enabled 公开 | 不可用 | 不可用 |
|
||||
| Traefik* | Collects metrics directly exposed by kubelet | Collects metrics directly exposed by kubelet, Exposed by rke2IngressNginx.enabled | Not available | Not available |
|
||||
| coreDns/kubeDns | 收集 coreDns/kubeDns 直接公开的指标 | 收集 coreDns/kubeDns 直接公开的指标 | 收集 coreDns/kubeDns 直接公开的指标 | 收集 coreDns/kubeDns 直接公开的指标 |
|
||||
| kube-api-server | 收集 kube-api-server 直接公开的指标 | 收集 kube-api-server 直接公开的指标 | 收集 kube-appi-server 直接公开的指标 | 收集 kube-api-server 直接公开的指标 |
|
||||
|
||||
\* RKE 和 RKE2 集群默认部署 ingress-nginx，并将其视为内部 Kubernetes 组件。
|
||||
\* For RKE clusters, ingress-nginx is deployed by default and treated as an internal Kubernetes component. For RKE2 clusters, Traefik is deployed by default and treated as an internal Kubernetes component.
|
||||
|
||||
### 名词解释
|
||||
|
||||
@@ -241,5 +243,6 @@ Prometheus 直接抓取以下 Kubernetes 组件：
|
||||
- **kube-proxy**：内部 Kubernetes 组件，用于监控 API server 的 pod/service 更改以保持网络最新状态。
|
||||
- **kubelet**：内部 Kubernetes 组件，用于为 pod 监视节点上的 API server 并确保这些 pod 能运行。
|
||||
- **ingress-nginx**：用于 Kubernetes 的 Ingress controller，使用 NGINX 作为反向代理和负载均衡器。
|
||||
- **Traefik:** An Ingress controller for Kubernetes that can be used as a reverse proxy and load balancer.
|
||||
- **coreDns/kubeDns**：负责 DNS 的内部 Kubernetes 组件。
|
||||
- **kube-api-server**：负责为其他 master 组件公开 API 的主要内部 Kubernetes 组件。
|
||||
|
||||
+12
-12
@@ -74,22 +74,22 @@ kubectl -n kube-system get endpoints kube-scheduler -o jsonpath='{.metadata.anno
|
||||
|
||||
## Ingress Controller
|
||||
|
||||
默认的 Ingress Controller 是 NGINX，作为 DaemonSet 部署在 `ingress-nginx` 命名空间中。Pod 仅会调度到具有 `worker` 角色的节点。
|
||||
默认的 Ingress Controller 是 Traefik，作为 DaemonSet 部署在 `traefik` 命名空间中。Pod 仅会调度到具有 `worker` 角色的节点。
|
||||
|
||||
检查 pod 是否运行在所有节点上：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get pods -o wide
|
||||
kubectl -n traefik get pods -o wide
|
||||
```
|
||||
|
||||
输出示例：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get pods -o wide
|
||||
kubectl -n traefik get pods -o wide
|
||||
NAME READY STATUS RESTARTS AGE IP NODE
|
||||
default-http-backend-797c5bc547-kwwlq 1/1 Running 0 17m x.x.x.x worker-1
|
||||
nginx-ingress-controller-4qd64 1/1 Running 0 14m x.x.x.x worker-1
|
||||
nginx-ingress-controller-8wxhm 1/1 Running 0 13m x.x.x.x worker-0
|
||||
traefik-4qd64 1/1 Running 0 14m x.x.x.x worker-1
|
||||
traefik-8wxhm 1/1 Running 0 13m x.x.x.x worker-0
|
||||
```
|
||||
|
||||
如果 pod 无法运行（即状态不是 **Running**，Ready 状态未显示 `1/1`，或者有大量 Restarts），请检查 pod 详细信息，日志和命名空间事件。
|
||||
@@ -97,27 +97,27 @@ nginx-ingress-controller-8wxhm 1/1 Running 0 13m
|
||||
### Pod 详细信息
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx describe pods -l app=ingress-nginx
|
||||
kubectl -n traefik describe pods -l app=traefik
|
||||
```
|
||||
|
||||
### Pod 容器日志
|
||||
|
||||
下面的命令可以显示所有标记为 “app=ingress-nginx” 的 pod 的日志，但是由于 `kubectl logs` 命令的限制，它只会显示 10 行日志。有关详细信息，请参阅 `kubectl logs -h` 的 `--tail`。
|
||||
下面的命令可以显示所有标记为 “app=traefik” 的 pod 的日志，但是由于 `kubectl logs` 命令的限制，它只会显示 10 行日志。有关详细信息，请参阅 `kubectl logs -h` 的 `--tail`。
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx logs -l app=ingress-nginx
|
||||
kubectl -n traefik logs -l app=traefik
|
||||
```
|
||||
|
||||
如果需要查看完整的日志，请在命令中尾随 pod 名称：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx logs <pod name>
|
||||
kubectl -n traefik logs <pod name>
|
||||
```
|
||||
|
||||
### 命名空间事件
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get events
|
||||
kubectl -n traefik get events
|
||||
```
|
||||
|
||||
### 调试日志
|
||||
@@ -125,7 +125,7 @@ kubectl -n ingress-nginx get events
|
||||
要启用调试日志：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx patch ds nginx-ingress-controller --type='json' -p='[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--v=5"}]'
|
||||
kubectl -n traefik patch ds traefik --type='json' -p='[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--v=5"}]'
|
||||
```
|
||||
|
||||
### 检查配置
|
||||
@@ -133,7 +133,7 @@ kubectl -n ingress-nginx patch ds nginx-ingress-controller --type='json' -p='[{"
|
||||
在每个 pod 中检索生成的配置：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get pods -l app=ingress-nginx --no-headers -o custom-columns=.NAME:.metadata.name | while read pod; do kubectl -n ingress-nginx exec $pod -- cat /etc/nginx/nginx.conf; done
|
||||
kubectl -n traefik get pods -l app=traefik --no-headers -o custom-columns=.NAME:.metadata.name | while read pod; do kubectl -n traefik exec $pod -- cat /etc/nginx/nginx.conf; done
|
||||
```
|
||||
|
||||
## Rancher Agents
|
||||
|
||||
+1
-1
@@ -65,7 +65,7 @@ rancher rancher.yourdomain.com x.x.x.x,x.x.x.x,x.x.x.x 80, 443 2m
|
||||
如果访问你配置的 Rancher FQDN 时没有显示 UI，请检查 Ingress Controller 日志以查看尝试访问 Rancher 时发生了什么：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx logs -l app=ingress-nginx
|
||||
kubectl -n traefik logs -l app=traefik
|
||||
```
|
||||
|
||||
## Leader 选举
|
||||
|
||||
+1
-4
@@ -6,10 +6,7 @@ title: TLS 设置
|
||||
|
||||
## 在高可用 Kubernetes 集群中运行 Rancher
|
||||
|
||||
当你在 Kubernetes 集群内安装 Rancher 时，TLS 会在集群的 Ingress Controller 上卸载。可用的 TLS 设置取决于使用的 Ingress Controller：
|
||||
|
||||
* nginx-ingress-controller（default RKE2 默认）：[默认的 TLS 版本和密码](https://kubernetes.github.io/ingress-nginx/user-guide/tls/#default-tls-version-and-ciphers)。
|
||||
* traefik（K3s 默认）：[TLS 选项](https://doc.traefik.io/traefik/https/tls/#tls-options)。
|
||||
When you install a Rancher managed Kubernetes cluster, TLS is offloaded at the cluster's ingress controller. Traefik is the default ingress for K3s and can be used with RKE2, refer to [TLS Options](https://doc.traefik.io/traefik/https/tls/#tls-options) for further information.
|
||||
|
||||
## 在单个 Docker 容器中运行 Rancher
|
||||
|
||||
|
||||
+7
-12
@@ -4,14 +4,12 @@ title: 设置 Amazon NLB 网络负载均衡器
|
||||
|
||||
本文介绍了如何在 Amazon EC2 服务中设置 Amazon NLB 网络负载均衡器，用于将流量转发到 EC2 上的多个实例中。
|
||||
|
||||
这些示例中，负载均衡器将流量转发到三个 Rancher Server 节点。如果 Rancher 安装在 RKE Kubernetes 集群上，则需要三个节点。如果 Rancher 安装在 K3s Kubernetes 集群上，则只需要两个节点。
|
||||
这些示例中，负载均衡器将流量转发到三个 Rancher Server 节点。如果 Rancher 安装在 K3s Kubernetes 集群上，则只需要两个节点。
|
||||
|
||||
本文介绍的只是配置负载均衡器的其中一种方式。其他负载均衡器如传统负载路由器（Classic Load Balancer）和应用负载路由器（Application Load Balancer），也可以将流量转发到 Rancher Server 节点。
|
||||
|
||||
Rancher 仅支持使用 Amazon NLB 以 `TCP` 模式终止 443 端口的流量，而不支持 `TLS` 模式。这试因为在 NLB 终止时，NLB 不会将正确的标头注入请求中。如果你想使用由 Amazon Certificate Manager (ACM) 托管的证书，请使用 ALB。
|
||||
|
||||
|
||||
|
||||
## 要求
|
||||
|
||||
你已在 EC2 中创建了 Linux 实例。此外，负载均衡器会把流量转发到这些节点。
|
||||
@@ -22,7 +20,7 @@ Rancher 仅支持使用 Amazon NLB 以 `TCP` 模式终止 443 端口的流量，
|
||||
|
||||
配置 NLB 的第一个步骤是创建两个目标组。一般来说，只需要端口 443 就可以访问 Rancher。但是，由于端口 80 的流量会被自动重定向到端口 443，因此，你也可以为端口 80 也添加一个监听器。
|
||||
|
||||
不管使用的是 NGINX Ingress 还是 Traefik Ingress Controller，Ingress 都应该将端口 80 的流量重定向到端口 443。以下为操作步骤：
|
||||
The Traefik Ingress should redirect traffic from port 80 to port 443.
|
||||
|
||||
1. 登录到 [Amazon AWS 控制台](https://console.aws.amazon.com/ec2/)。确保选择的**区域**是你创建 EC2 实例 （Linux 节点）的区域。
|
||||
1. 选择**服务** > **EC2**，找到**负载均衡器**并打开**目标组**。
|
||||
@@ -30,7 +28,7 @@ Rancher 仅支持使用 Amazon NLB 以 `TCP` 模式终止 443 端口的流量，
|
||||
|
||||
:::note
|
||||
|
||||
不同 Ingress 的健康检查处理方法不同。详情请参阅[本节](#nginx-ingress-和-traefik-ingress-的健康检查路径)。
|
||||
For details on Traefik Ingress health checks, refer to [this section.](#health-check-paths-for-traefik-ingresses)
|
||||
|
||||
:::
|
||||
|
||||
@@ -163,13 +161,10 @@ AWS 完成 NLB 创建后，单击**关闭**。
|
||||
|
||||
6. 单击右上角的**保存**。
|
||||
|
||||
## NGINX Ingress 和 Traefik Ingress 的健康检查路径
|
||||
## Health Check Paths for Traefik Ingresses
|
||||
|
||||
K3s 和 RKE Kubernetes 集群使用的默认 Ingress 不同，因此对应的健康检查方式也不同。
|
||||
K3s Kubernetes clusters use Traefik as the default Ingress.
|
||||
|
||||
RKE Kubernetes 集群默认使用 NGINX Ingress，而 K3s Kubernetes 集群默认使用 Traefik Ingress。
|
||||
The health check path is `/ping`. By default `/ping` is always matched (regardless of Host), and a response from [Traefik itself](https://docs.traefik.io/operations/ping/) is always served.
|
||||
|
||||
- **Traefik**：默认健康检查路径是 `/ping`。默认情况下，不管主机如何，`/ping` 总是匹配，而且 [Traefik 自身](https://docs.traefik.io/operations/ping/)总会响应。
|
||||
- **NGINX Ingress**：NGINX Ingress Controller 的默认后端有一个 `/healthz` 端点。默认情况下，不管主机如何，`/healthz` 总是匹配，而且 [`ingress-nginx` 自身](https://github.com/kubernetes/ingress-nginx/blob/0cbe783f43a9313c9c26136e888324b1ee91a72f/charts/ingress-nginx/values.yaml#L212)总会响应。
|
||||
|
||||
想要精确模拟健康检查，最好是使用 Host 标头（Rancher hostname）加上 `/ping` 或 `/healthz`（分别对应 K3s 和 RKE 集群）来获取 Rancher Pod 的响应，而不是 Ingress 的响应。
|
||||
To simulate an accurate health check, it is a best practice to use the Host header (Rancher hostname) combined with `/ping` or `/healthz` wherever possible, to get a response from the Rancher Pods, not the Ingress.
|
||||
|
||||
+5
-5
@@ -87,7 +87,7 @@ systemctl start rke2-server.service
|
||||
|
||||
1. 安装 Kubernetes 命令行工具 [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl)。
|
||||
2. 复制 `/etc/rancher/rke2/rke2.yaml` 文件并保存到本地主机的 `~/.kube/config` 目录上。
|
||||
3. 在 kubeconfig 文件中，`server` 的参数为 localhost。在端口 6443 上将服务器配置为 controlplane 负载均衡器的 DNS（RKE2 Kubernetes API Server 使用端口 6443，而 Rancher Server 将通过 NGINX Ingress 在端口 80 和 443 上提供服务。）以下是一个示例 `rke2.yaml`：
|
||||
3. 在 kubeconfig 文件中，`server` 的参数为 localhost。在端口 6443 上将服务器配置为 controlplane 负载均衡器的 DNS（RKE2 Kubernetes API Server 使用端口 6443，而 Rancher Server 将通过 Traefik Ingress 在端口 80 和 443 上提供服务。）以下是一个示例 `rke2.yaml`：
|
||||
|
||||
```yml
|
||||
apiVersion: v1
|
||||
@@ -136,7 +136,8 @@ kube-system etcd-rke2-server-2 1/1 Ru
|
||||
kube-system etcd-rke2-server-3 1/1 Running 0 56s
|
||||
kube-system helm-install-rke2-canal-hs6sx 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-rke2-coredns-xmzm8 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-rke2-ingress-nginx-flwnl 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-traefik-crd-z8vsz 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-traefik-flwnl 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-rke2-metrics-server-7sggn 0/1 Completed 0 2m17s
|
||||
kube-system kube-apiserver-rke2-server-1 1/1 Running 0 116s
|
||||
kube-system kube-apiserver-rke2-server-2 1/1 Running 0 66s
|
||||
@@ -156,9 +157,8 @@ kube-system rke2-canal-swfmq 2/2 Ru
|
||||
kube-system rke2-coredns-rke2-coredns-547d5499cb-6tvwb 1/1 Running 0 92s
|
||||
kube-system rke2-coredns-rke2-coredns-547d5499cb-rdttj 1/1 Running 0 2m8s
|
||||
kube-system rke2-coredns-rke2-coredns-autoscaler-65c9bb465d-85sq5 1/1 Running 0 2m8s
|
||||
kube-system rke2-ingress-nginx-controller-69qxc 1/1 Running 0 52s
|
||||
kube-system rke2-ingress-nginx-controller-7hprp 1/1 Running 0 52s
|
||||
kube-system rke2-ingress-nginx-controller-x658h 1/1 Running 0 52s
|
||||
kube-system traefik-7c844b766f-m9p2w 1/1 Running 0 52s
|
||||
kube-system traefik-7c844b766f-s4l9k 1/1 Running 0 52s
|
||||
kube-system rke2-metrics-server-6564db4569-vdfkn 1/1 Running 0 66s
|
||||
```
|
||||
|
||||
|
||||
+1
-1
@@ -43,7 +43,7 @@ SUSE Linux 可能有一个防火墙，默认情况下会阻止所有端口。在
|
||||
|
||||
### Flatcar Container Linux 节点
|
||||
|
||||
使用 Flatcar Container Linux 节点[通过 Rancher 启动 Kubernetes](../launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) 时，需要在 [Cluster Config 文件](../../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md#rke-集群配置文件参考)中使用如下配置：
|
||||
使用 Flatcar Container Linux 节点[通过 Rancher 启动 Kubernetes](../launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) 时，需要在 Cluster Config 文件 中使用如下配置：
|
||||
|
||||
<Tabs>
|
||||
<TabItem value="Canal">
|
||||
|
||||
+1
-11
@@ -3,14 +3,6 @@ title: Ingress 配置
|
||||
description: Ingress 配置
|
||||
---
|
||||
|
||||
:::note
|
||||
|
||||
在 Kubernetes v1.21 及更高版本中，NGINX Ingress Controller 不再默认运行在 hostNetwork 中。它改为将 hostPorts 用于端口 80 和端口 443，因此你可以将准入 Webhook 配置为只能通过 ClusterIP 访问。这确保了只能从集群内部访问 webhook。
|
||||
|
||||
由于 controller 的这一更改，默认 RKE1 配置不再将 `hostNetwork` 设置为 `true`。但是，你必须将 `hostNetwork` 设置为 `true` 才能使基于 TCP 和 UDP 的 Service 正常工作。为此，请[编辑](../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md#使用-yaml-编辑集群)集群的 YAML 并按照[官方 RKE1 文档](https://rke.docs.rancher.com/config-options/add-ons/ingress-controllers#configuring-network-options)中的步骤操作。
|
||||
|
||||
:::
|
||||
|
||||
## 指定要使用的主机名
|
||||
|
||||
如果使用此选项，Ingress 会将主机名请求路由到你指定的服务或工作负载。
|
||||
@@ -36,6 +28,4 @@ description: Ingress 配置
|
||||
|
||||
## 标签和注释
|
||||
|
||||
添加[标签](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/)和/或[注释](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)来为你的 Ingress Controller 提供元数据。
|
||||
|
||||
有关可用的注释列表，请参阅 [Nginx Ingress Controller 文档](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/)。
|
||||
Please refer to the Traefik documentation for the full list of Ingress NGINX annotations that are [supported](https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/ingress-nginx/#annotations-support) and [unsupported](https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/ingress-nginx/#unsupported-annotations) by Traefik's kubernetesIngressNginx provider.
|
||||
|
||||
+5
-15
@@ -7,13 +7,11 @@ Kubernetes 支持四层负载均衡和七层负载均衡。
|
||||
|
||||
## 四层负载均衡器
|
||||
|
||||
四层负载均衡器（或外部负载均衡器）将流量转发到 Nodeport。四层负载均衡器支持转发 HTTP 和 TCP 流量。
|
||||
|
||||
通常情况下，四层负载均衡器由底层云提供商支持，因此，如果你在裸金属服务器和 vSphere 集群上部署 RKE 集群，则不支持四层负载均衡器。但是，单个[全局管理的 config-map](https://kubernetes.github.io/ingress-nginx/user-guide/exposing-tcp-udp-services/) 可用于在 NGINX 或第三方 Ingress 上公开服务。
|
||||
Layer-4 load balancer (or the external load balancer) forwards traffic to NodePorts. Layer-4 load balancer allows you to forward both HTTP and TCP traffic.
|
||||
|
||||
:::note
|
||||
|
||||
你可以使用非云负载均衡器（例如 [MetalLB](https://metallb.universe.tf/)）来部署集群。但是，该用例比云提供商支持的四层负载均衡器更高级，而且不可以在 Rancher 或 RKE 中配置。
|
||||
It is possible to deploy a cluster with a non-cloud load balancer, such as [MetalLB.](https://metallb.universe.tf/) However, that use case is more advanced than the Layer-4 load balancer supported by a cloud provider, and it is not configurable in Rancher.
|
||||
|
||||
:::
|
||||
|
||||
@@ -26,17 +24,13 @@ Kubernetes 支持四层负载均衡和七层负载均衡。
|
||||
| Amazon EKS | 由 AWS 云提供商支持 |
|
||||
| Google GKE | 由 GCE 云提供商支持 |
|
||||
| Azure AKS | 由 Azure 云提供商支持 |
|
||||
| EC2 上的 RKE | 由 AWS 云提供商支持 |
|
||||
| DigitalOcean 上的 RKE | 受限的 NGINX 或第三方 Ingress\* |
|
||||
| vSphere 上的 RKE | 受限的 NGINX 或第三方 Ingress\* |
|
||||
| 自定义主机上的 RKE<br/>（例如裸金属服务器） | 受限的 NGINX 或第三方 Ingress\* |
|
||||
| 第三方 MetalLB | 受限的 NGINX 或第三方 Ingress\* |
|
||||
| 第三方 MetalLB | third-party Ingress\* |
|
||||
|
||||
\* 可以通过单个[全局管理的 config-map](https://kubernetes.github.io/ingress-nginx/user-guide/exposing-tcp-udp-services/) 来公开服务。
|
||||
|
||||
## 七层负载均衡器
|
||||
|
||||
七层负载均衡器（或 Ingress Controller）支持基于主机和路径的负载均衡和 SSL 终止。七层负载均衡器仅转发 HTTP 和 HTTPS 流量，因此它们仅侦听端口 80 和 443。亚马逊和谷歌等云提供商支持七层负载均衡器。此外，RKE 集群部署了 Nginx Ingress Controller。
|
||||
Layer-7 load balancer (or the ingress controller) supports host and path-based load balancing and SSL termination. Layer-7 load balancer only forwards HTTP and HTTPS traffic and therefore they listen on ports 80 and 443 only. Cloud providers such as Amazon and Google support layer-7 load balancer.
|
||||
|
||||
### 七层负载均衡支持
|
||||
|
||||
@@ -47,16 +41,12 @@ Kubernetes 支持四层负载均衡和七层负载均衡。
|
||||
| Amazon EKS | 由 AWS 云提供商支持 |
|
||||
| Google GKE | 由 GKE 云提供商支持 |
|
||||
| Azure AKS | 不支持 |
|
||||
| EC2 上的 RKE | Nginx Ingress Controller |
|
||||
| DigitalOcean 上的 RKE | Nginx Ingress Controller |
|
||||
| vSphere 上的 RKE | Nginx Ingress Controller |
|
||||
| 自定义主机上的 RKE<br/>（例如裸金属服务器） | Nginx Ingress Controller |
|
||||
|
||||
### 七层负载均衡器中的主机名
|
||||
|
||||
一些托管在云上的七层负载均衡器（例如 AWS 上的 ALB Ingress Controller）会为 Ingress 规则公开 DNS 地址。你需要（使用 CNAME）将你的域名映射到七层负载均衡器生成的 DNS 地址。
|
||||
|
||||
其他七层负载均衡器（例如 Google Load Balancer 或 Nginx Ingress Controller）会直接公开一个或多个 IP 地址。Google Load Balancer 提供了一个可路由的 IP 地址。Nginx Ingress Controller 公开了运行 Nginx Ingress Controller 的所有节点的外部 IP。你可以执行以下任一操作：
|
||||
Other layer-7 load balancers, such as the Google Load Balancer, directly expose one or more IP addresses. Google Load Balancer provides a single routable IP address. You can do either of the following:
|
||||
|
||||
1. 配置你自己的 DNS，从而（使用 A 记录）将你的域名映射到七层负载均衡器公开的 IP 地址。
|
||||
2. 让 Rancher 为你的 Ingress 规则生成一个 xip.io 主机名。Rancher 将使用你公开的其中一个 IP（假设是 `a.b.c.d`）生成一个主机名（即 `<ingressname>.<namespace>.a.b.c.d.xip.io`）。
|
||||
|
||||
+1
-9
@@ -48,18 +48,10 @@ Rancher 支持两种类型的负载均衡器：
|
||||
|
||||
Ingress 与一个或多个 Ingress Controller 一起动态路由 service 的请求。Ingress 收到请求时，集群中的 Ingress Controller 会根据你配置的 service 子域或路径规则将请求定向到正确的 service。
|
||||
|
||||
每个 Kubernetes Ingress 资源都对应一个 `/etc/nginx/sites-available/` 中的文件，其中包含一个配置对特定文件和文件夹的请求的 `server{}` 配置块。
|
||||
|
||||
Ingress 能为你的集群创建一个入口端口（与负载均衡器类似），可以位于集群的内部或外部。RKE 启动的集群中的 Ingress 和 Ingress Controller 由 [Nginx](https://www.nginx.com/) 提供支持。
|
||||
Ingress 能为你的集群创建一个入口端口（与负载均衡器类似），可以位于集群的内部或外部。
|
||||
|
||||
Ingress 还支持其他功能，例如 SSL 终止、基于名称的虚拟主机等。
|
||||
|
||||
:::note 在高可用性配置中使用 Rancher：
|
||||
|
||||
请避免将 Ingress 添加到 `local` 集群。Rancher 将 Nginx Ingress Controller 作为 Rancher 管理的 _所有_ 集群的全局入口点，其中包括 `local` 集群。因此，当用户尝试访问应用程序时，Rancher 可能会由于重新加载 Nginx 配置而断开连接。要解决这个问题，我们建议你仅在通过 Rancher 启动的集群中部署应用程序。
|
||||
|
||||
:::
|
||||
|
||||
- 有关如何在 Rancher 中设置 Ingress 的更多信息，请参阅 [Ingress](add-ingresses.md)。
|
||||
- 有关 Ingress 和 Ingress Controller 的完整信息，请参阅 [Kubernetes Ingress 文档](https://kubernetes.io/docs/concepts/services-networking/ingress/)。
|
||||
- 在项目中使用 Ingress 时，你可以通过设置全局 DNS 条目来将 Ingress 主机名编程到外部 DNS。
|
||||
|
||||
+2
-2
@@ -12,7 +12,7 @@ title: 在 Nutanix AOS 中配置 Kubernetes 集群
|
||||
|
||||
有关配置 Nutanix AOS 节点模板的详细信息，请参阅 [Nutanix AOS 节点模板配置参考](../../../../../reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/nutanix.md)。
|
||||
|
||||
有关在 Rancher 中配置 RKE Kubernetes 集群的详细信息，请参阅[集群配置参考](../../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md)。
|
||||
有关在 Rancher 中配置 RKE Kubernetes 集群的详细信息，请参阅集群配置参考。
|
||||
|
||||
- [Nutanix AOS 中的准备工作](#nutanix-aos-中的准备工作)
|
||||
- [创建 Nutanix AOS 集群](#创建-nutanix-aos-集群)
|
||||
@@ -70,7 +70,7 @@ title: 在 Nutanix AOS 中配置 Kubernetes 集群
|
||||
1. 单击 **Nutanix**。
|
||||
1. 输入**集群名称**，然后点击**继续**。
|
||||
1. 使用**成员角色**为集群配置用户授权。点击**添加成员**添加可以访问集群的用户。使用**角色**下拉菜单为每个用户设置权限。
|
||||
1. 使用**集群选项**选择要安装的 Kubernetes 版本、要使用的网络提供商，以及是否启用项目网络隔离。要查看更多集群选项，请单击**显示高级选项**。如需获取配置集群的帮助，请参阅 [RKE 集群配置参考](../../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md)。
|
||||
1. 使用**集群选项**选择要安装的 Kubernetes 版本、要使用的网络提供商，以及是否启用项目网络隔离。要查看更多集群选项，请单击**显示高级选项**。如需获取配置集群的帮助，请参阅 RKE 集群配置参考。
|
||||
1. 将一个或多个节点池添加到你的集群。每个节点池都使用节点模板来配置新节点。有关节点池的更多信息，包括为节点分配 Kubernetes 角色的最佳实践，请参阅[本节](../../../launch-kubernetes-with-rancher/use-new-nodes-in-an-infra-provider/use-new-nodes-in-an-infra-provider.md#节点池)。
|
||||
1. 检查并确认你的选项。然后单击**创建**。
|
||||
|
||||
|
||||
+1
-1
@@ -8,7 +8,7 @@ title: vSphere 存储
|
||||
|
||||
## 先决条件
|
||||
|
||||
为了在 [Rancher Kubernetes Engine (RKE)](../../launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) 集群中配置 vSphere 卷，[vSphere cloud provider](https://rancher.com/docs/rke/latest/en/config-options/cloud-providers/vsphere) 必须在[集群选项](../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md)中显式启用。
|
||||
为了在 [RKE2](../../launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) 集群中配置 vSphere 卷，[vSphere cloud provider](https://rancher.com/docs/rke/latest/en/config-options/cloud-providers/vsphere) 必须在[集群选项](../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke2-cluster-configuration.md#cloud-provider)中显式启用。
|
||||
|
||||
## 创建一个 StorageClass
|
||||
|
||||
|
||||
+5
-5
@@ -205,13 +205,13 @@ Prometheus 从称为 [exporter](https://prometheus.io/docs/instrumenting/exporte
|
||||
Prometheus 直接抓取以下 Kubernetes 组件：
|
||||
|
||||
- kubelet\*
|
||||
- ingress-nginx\*\*
|
||||
- Traefik\*\*
|
||||
- coreDns/kubeDns
|
||||
- kube-api-server
|
||||
|
||||
\* 你可以选择通过 `hardenedKubelet.enabled` 来使用 PushProx，但这不是默认设置。
|
||||
|
||||
\*\* RKE2 集群默认部署 ingress-nginx，并将其视为内部 Kubernetes 组件。
|
||||
\*\* For RKE2 clusters, Traefik is deployed by default and treated as an internal Kubernetes component.
|
||||
|
||||
|
||||
### 基于 Kubernetes 发行版抓取指标
|
||||
@@ -227,11 +227,11 @@ Prometheus 直接抓取以下 Kubernetes 组件：
|
||||
| etcd | rke2Etcd.enabled | kubeAdmEtcd.enabled | 不可用 |
|
||||
| kube-proxy | rke2Proxy.enabled | kubeAdmProxy.enabled | k3sServer.enabled |
|
||||
| kubelet | 收集 kubelet 直接公开的指标 | 收集 kubelet 直接公开的指标 | 收集 kubelet 直接公开的指标 |
|
||||
| ingress-nginx* | 收集 kubelet 直接公开的指标，由 rke2IngressNginx.enabled 公开 | 不可用 | 不可用 |
|
||||
| Traefik* | Collects metrics directly exposed by kubelet | Not available | Not available |
|
||||
| coreDns/kubeDns | 收集 coreDns/kubeDns 直接公开的指标 | 收集 coreDns/kubeDns 直接公开的指标 | 收集 coreDns/kubeDns 直接公开的指标 |
|
||||
| kube-api-server | 收集 kube-api-server 直接公开的指标 | 收集 kube-appi-server 直接公开的指标 | 收集 kube-api-server 直接公开的指标 |
|
||||
|
||||
\* RKE2 集群默认部署 ingress-nginx，并将其视为内部 Kubernetes 组件。
|
||||
\* For RKE2 clusters, Traefik is deployed by default and treated as an internal Kubernetes component.
|
||||
|
||||
### 名词解释
|
||||
|
||||
@@ -240,6 +240,6 @@ Prometheus 直接抓取以下 Kubernetes 组件：
|
||||
- **etcd**：Kubernetes 内部组件，它是 Kubernetes 用于持久存储所有集群信息的分布式键/值存储。
|
||||
- **kube-proxy**：内部 Kubernetes 组件，用于监控 API server 的 pod/service 更改以保持网络最新状态。
|
||||
- **kubelet**：内部 Kubernetes 组件，用于为 pod 监视节点上的 API server 并确保这些 pod 能运行。
|
||||
- **ingress-nginx**：用于 Kubernetes 的 Ingress controller，使用 NGINX 作为反向代理和负载均衡器。
|
||||
- **Traefik:** An Ingress controller for Kubernetes that can be used as a reverse proxy and load balancer.
|
||||
- **coreDns/kubeDns**：负责 DNS 的内部 Kubernetes 组件。
|
||||
- **kube-api-server**：负责为其他 master 组件公开 API 的主要内部 Kubernetes 组件。
|
||||
|
||||
-357
@@ -1,357 +0,0 @@
|
||||
---
|
||||
title: RKE 集群配置参考
|
||||
---
|
||||
|
||||
<EOLRKE1Warning />
|
||||
|
||||
Rancher 安装 Kubernetes 时，它使用 [RKE](../../../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) 或 [RKE2](https://docs.rke2.io/) 作为 Kubernetes 发行版。
|
||||
|
||||
本文介绍 Rancher 中可用于新的或现有的 RKE Kubernetes 集群的配置选项。
|
||||
|
||||
|
||||
## 概述
|
||||
|
||||
你可以通过以下两种方式之一来配置 Kubernetes 选项：
|
||||
|
||||
- [Rancher UI](#rancher-ui-中的配置选项)：使用 Rancher UI 来选择设置 Kubernetes 集群时常用的自定义选项。
|
||||
- [集群配置文件](#rke-集群配置文件参考)：高级用户可以创建一个 RKE 配置文件，而不是使用 Rancher UI 来为集群选择 Kubernetes 选项。配置文件可以让你使用 YAML 来指定 RKE 安装中可用的任何选项（除了 system_images 配置）。
|
||||
|
||||
RKE 集群配置选项嵌套在 `rancher_kubernetes_engine_config` 参数下。有关详细信息，请参阅[集群配置文件](#rke-集群配置文件参考)。
|
||||
|
||||
在 [RKE 启动的集群](../../../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md)中，你可以编辑任何后续剩余的选项。
|
||||
|
||||
有关 RKE 配置文件语法的示例，请参阅 [RKE 文档](https://rancher.com/docs/rke/latest/en/example-yamls/)。
|
||||
|
||||
Rancher UI 中的表单不包括配置 RKE 的所有高级选项。有关 YAML 中 RKE Kubernetes 集群的可配置选项的完整参考，请参阅 [RKE 文档](https://rancher.com/docs/rke/latest/en/config-options/)。
|
||||
|
||||
## 在 Rancher UI 中使用表单编辑集群
|
||||
|
||||
要编辑你的集群：
|
||||
|
||||
1. 在左上角，单击 **☰ > 集群管理**。
|
||||
1. 转到要配置的集群，然后单击 **⋮ > 编辑配置**。
|
||||
|
||||
|
||||
## 使用 YAML 编辑集群
|
||||
|
||||
高级用户可以创建一个 RKE 配置文件，而不是使用 Rancher UI 来为集群选择 Kubernetes 选项。配置文件可以让你使用 YAML 来指定 RKE 安装中可用的任何选项（除了 system_images 配置）。
|
||||
|
||||
RKE 集群（也称为 RKE1 集群）的编辑方式与 RKE2 和 K3s 集群不同。
|
||||
|
||||
要直接从 Rancher UI 编辑 RKE 配置文件：
|
||||
|
||||
1. 点击 **☰ > 集群管理**。
|
||||
1. 转到要配置的 RKE 集群。单击并单击 **⋮ > 编辑配置**。你将会转到 RKE 配置表单。请注意，由于集群配置在 Rancher 2.6 中发生了变更，**⋮ > 以 YAML 文件编辑**可用于配置 RKE2 集群，但不能用于编辑 RKE1 配置。
|
||||
1. 在配置表单中，向下滚动并单击**以 YAML 文件编辑**。
|
||||
1. 编辑 `rancher_kubernetes_engine_config` 参数下的 RKE 选项。
|
||||
|
||||
## Rancher UI 中的配置选项
|
||||
|
||||
:::tip
|
||||
|
||||
一些高级配置选项没有在 Rancher UI 表单中开放，但你可以通过在 YAML 中编辑 RKE 集群配置文件来启用这些选项。有关 YAML 中 RKE Kubernetes 集群的可配置选项的完整参考，请参阅 [RKE 文档](https://rancher.com/docs/rke/latest/en/config-options/)。
|
||||
|
||||
:::
|
||||
|
||||
### Kubernetes 版本
|
||||
|
||||
这指的是集群节点上安装的 Kubernetes 版本。Rancher 基于 [hyperkube](https://github.com/rancher/hyperkube) 打包了自己的 Kubernetes 版本。
|
||||
|
||||
有关更多详细信息，请参阅[升级 Kubernetes](../../../getting-started/installation-and-upgrade/upgrade-and-roll-back-kubernetes.md)。
|
||||
|
||||
### 网络提供商
|
||||
|
||||
这指的是集群使用的[网络提供商](https://kubernetes.io/docs/concepts/cluster-administration/networking/)。有关不同网络提供商的更多详细信息，请查看我们的[网络常见问题解答](../../../faq/container-network-interface-providers.md)。
|
||||
|
||||
:::caution
|
||||
|
||||
启动集群后，你无法更改网络提供商。由于 Kubernetes 不允许在网络提供商之间切换，因此，请谨慎选择要使用的网络提供商。使用网络提供商创建集群后，如果你需要更改网络提供商，你将需要拆除整个集群以及其中的所有应用。
|
||||
|
||||
:::
|
||||
|
||||
Rancher 与以下开箱即用的网络提供商兼容：
|
||||
|
||||
- [Canal](https://github.com/projectcalico/canal)
|
||||
- [Flannel](https://github.com/coreos/flannel#flannel)
|
||||
- [Calico](https://docs.projectcalico.org/v3.11/introduction/)
|
||||
- [Weave](https://github.com/weaveworks/weave)
|
||||
|
||||
:::note Weave 注意事项：
|
||||
|
||||
选择 Weave 作为网络提供商时，Rancher 将通过生成随机密码来自动启用加密。如果你想手动指定密码，请参阅使用[配置文件](#rke-集群配置文件参考)和 [Weave 网络插件选项](https://rancher.com/docs/rke/latest/en/config-options/add-ons/network-plugins/#weave-network-plug-in-options)来配置集群。
|
||||
|
||||
:::
|
||||
|
||||
### 项目网络隔离
|
||||
|
||||
如果你的网络提供商允许项目网络隔离，你可以选择启用或禁用项目间的通信。
|
||||
|
||||
如果你使用支持执行 Kubernetes 网络策略的 RKE 网络插件（例如 Canal 或 Cisco ACI 插件），则可以使用项目网络隔离。
|
||||
|
||||
### Kubernetes 云提供商
|
||||
|
||||
你可以配置 [Kubernetes 云提供商](../../../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/set-up-cloud-providers.md)。如果你想在 Kubernetes 中使用动态配置的[卷和存储](../../../how-to-guides/new-user-guides/manage-clusters/create-kubernetes-persistent-storage/create-kubernetes-persistent-storage.md)，你通常需要选择特定的云提供商。例如，如果你想使用 Amazon EBS，则需要选择 `aws` 云提供商。
|
||||
|
||||
:::note
|
||||
|
||||
如果你要使用的云提供商未作为选项列出，你需要使用[配置文件选项](#rke-集群配置文件参考)来配置云提供商。请参考 [RKE 云提供商文档](https://rancher.com/docs/rke/latest/en/config-options/cloud-providers/)来了解如何配置云提供商。
|
||||
|
||||
:::
|
||||
|
||||
### 私有镜像仓库
|
||||
|
||||
集群级别的私有镜像仓库配置仅能用于配置集群。
|
||||
|
||||
在 Rancher 中设置私有镜像仓库的主要方法有两种：通过[全局默认镜像仓库](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/global-default-private-registry.md)中的**设置**选项卡设置全局默认镜像仓库，以及在集群级别设置的高级选项中设置私有镜像仓库。全局默认镜像仓库可以用于离线设置，不需要凭证的镜像仓库。而集群级私有镜像仓库用于所有需要凭证的私有镜像仓库。
|
||||
|
||||
如果你的私有镜像仓库需要凭证，为了将凭证传递给 Rancher，你需要编辑每个需要从仓库中拉取镜像的集群的集群选项。
|
||||
|
||||
私有镜像仓库的配置选项能让 Rancher 知道要从哪里拉取用于集群的[系统镜像](https://rancher.com/docs/rke/latest/en/config-options/system-images/)或[附加组件镜像](https://rancher.com/docs/rke/latest/en/config-options/add-ons/)。
|
||||
|
||||
- **系统镜像**是维护 Kubernetes 集群所需的组件。
|
||||
- **附加组件**用于部署多个集群组件，包括网络插件、ingress controller、DNS 提供商或 metrics server。
|
||||
|
||||
有关为集群配置期间应用的组件设置私有镜像仓库的更多信息，请参阅[私有镜像仓库的 RKE 文档](https://rancher.com/docs/rke/latest/en/config-options/private-registries/)。
|
||||
|
||||
Rancher v2.6 引入了[为 RKE 集群配置 ECR 镜像仓库](https://rancher.com/docs/rke/latest/en/config-options/private-registries/#amazon-elastic-container-registry-ecr-private-registry-setup)的功能。
|
||||
|
||||
### 授权集群端点
|
||||
|
||||
授权集群端点（ACE）可用于直接访问 Kubernetes API server，而无需通过 Rancher 进行通信。
|
||||
|
||||
:::note
|
||||
|
||||
授权集群端点仅适用于 Rancher 启动的 Kubernetes 集群，即只适用于 Rancher [使用 RKE](../../../reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md#配置-kubernetes-集群的工具) 来配置的集群。它不适用于托管在 Kubernetes 提供商中的集群，例如 Amazon 的 EKS。
|
||||
|
||||
:::
|
||||
|
||||
在 Rancher 启动的 Kubernetes 集群中，它默认启用，使用具有 `controlplane` 角色的节点的 IP 和默认的 Kubernetes 自签名证书。
|
||||
|
||||
有关授权集群端点的工作原理以及使用的原因，请参阅[架构介绍](../../../reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md#4-授权集群端点)。
|
||||
|
||||
我们建议使用具有授权集群端点的负载均衡器。有关详细信息，请参阅[推荐的架构](../../rancher-manager-architecture/architecture-recommendations.md#授权集群端点架构)。
|
||||
|
||||
### 节点池
|
||||
|
||||
有关使用 Rancher UI 在 RKE 集群中设置节点池的信息，请参阅[此页面](../../../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/use-new-nodes-in-an-infra-provider/use-new-nodes-in-an-infra-provider.md)。
|
||||
|
||||
### NGINX Ingress
|
||||
|
||||
如果你想使用高可用性配置来发布应用，并且你使用没有原生负载均衡功能的云提供商来托管主机，请启用此选项以在集群中使用 NGINX Ingress。
|
||||
|
||||
### Metrics Server 监控
|
||||
|
||||
这是启用或禁用 [Metrics Server](https://rancher.com/docs/rke/latest/en/config-options/add-ons/metrics-server/) 的选项。
|
||||
|
||||
每个能够使用 RKE 启动集群的云提供商都可以收集指标并监控你的集群节点。如果启用此选项，你可以从你的云提供商门户查看你的节点指标。
|
||||
|
||||
### 节点上的 Docker 版本
|
||||
|
||||
表示是否允许节点运行 Rancher 不正式支持的 Docker 版本。
|
||||
|
||||
如果你选择使用支持的 Docker 版本，Rancher 会禁止 pod 运行在安装了不支持的 Docker 版本的节点上。
|
||||
|
||||
如需了解各个 Rancher 版本通过了哪些 Docker 版本测试，请参见[支持和维护条款](https://rancher.com/support-maintenance-terms/)。
|
||||
|
||||
### Docker 根目录
|
||||
|
||||
如果要添加到集群的节点为 Docker 配置了非默认 Docker 根目录（默认为 `/var/lib/docker`），请在此选项中指定正确的 Docker 根目录。
|
||||
|
||||
### 默认 Pod 安全策略
|
||||
|
||||
如果你启用了 **Pod 安全策略支持**，请使用此下拉菜单选择应用于集群的 pod 安全策略。
|
||||
|
||||
### 节点端口范围
|
||||
|
||||
更改可用于 [NodePort 服务](https://kubernetes.io/docs/concepts/services-networking/service/#nodeport)的端口范围的选项。默认为 `30000-32767`。
|
||||
|
||||
### 定期 etcd 快照
|
||||
|
||||
启用或禁用[定期 etcd 快照](https://rancher.com/docs/rke/latest/en/etcd-snapshots/#etcd-recurring-snapshots)的选项。
|
||||
|
||||
### Agent 环境变量
|
||||
|
||||
为 [rancher agent](../../../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/about-rancher-agents.md) 设置环境变量的选项。你可以使用键值对设置环境变量。如果 Rancher Agent 需要使用代理与 Rancher Server 通信，则可以使用 Agent 环境变量设置 `HTTP_PROXY`，`HTTPS_PROXY` 和 `NO_PROXY` 环境变量。
|
||||
|
||||
### 更新 ingress-nginx
|
||||
|
||||
使用 Kubernetes 1.16 之前版本创建的集群将具有 `OnDelete`的 `ingress-nginx` `updateStrategy`。使用 Kubernetes 1.16 或更高版本创建的集群将具有 `RollingUpdate`。
|
||||
|
||||
如果 `ingress-nginx` 的 `updateStrategy` 是 `OnDelete`，则需要删除这些 pod 以获得 deployment 正确的版本。
|
||||
|
||||
### Cluster Agent 配置和 Fleet Agent 配置
|
||||
|
||||
你可以为 Cluster Agent 和集群的 Fleet Agent 配置调度字段和资源限制。你可以使用这些字段来自定义容忍度、亲和性规则和资源要求。其他容忍度会被尾附到默认容忍度和 Control Plane 节点污点的列表中。如果你定义了自定义亲和性规则，它们将覆盖全局默认亲和性设置。定义资源要求会在以前没有的地方设置请求或限制。
|
||||
|
||||
:::note
|
||||
|
||||
有了这个选项，你可以覆盖或删除运行集群所需的规则。我们强烈建议你不要删除或覆盖这些规则和其他亲和性规则，因为这可能会导致不必要的影响：
|
||||
|
||||
- `affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution` 用于 `cattle-cluster-agent`
|
||||
- `cluster-agent-default-affinity` 用于 `cattle-cluster-agent`
|
||||
- `fleet-agent-default-affinity` 用于 `fleet-agent`
|
||||
|
||||
:::
|
||||
|
||||
如果将 Rancher 降级到 v2.7.4 或更低版本，你的更改将丢失，而且 Agent 将在没有你的自定义设置的情况下重新部署。重新部署时，Fleet Agent 将回退到使用内置默认值。如果降级期间 Fleet 版本没有更改，则不会立即重新部署。
|
||||
|
||||
|
||||
## RKE 集群配置文件参考
|
||||
|
||||
高级用户可以创建一个 RKE 配置文件，而不是使用 Rancher UI 来为集群选择 Kubernetes 选项。配置文件可以让你在 RKE 安装中设置任何[可用选项](https://rancher.com/docs/rke/latest/en/config-options/)（`system_images` 配置除外）。使用 Rancher UI 或 API 创建集群时，不支持 `system_images` 选项。
|
||||
|
||||
有关 YAML 中 RKE Kubernetes 集群的可配置选项的完整参考，请参阅 [RKE 文档](https://rancher.com/docs/rke/latest/en/config-options/)。
|
||||
|
||||
### Rancher 中的配置文件结构
|
||||
|
||||
RKE（Rancher Kubernetes Engine）是 Rancher 用来配置 Kubernetes 集群的工具。过去，Rancher 的集群配置文件与 [RKE 配置文件](https://rancher.com/docs/rke/latest/en/example-yamls/)的结构是一致的。但由于 Rancher 文件结构发生了变化，因此在 Rancher 中，RKE 集群配置项与非 RKE 配置项是分开的。所以，你的集群配置需要嵌套在集群配置文件中的 `rancher_kubernetes_engine_config` 参数下。使用早期版本的 Rancher 创建的集群配置文件需要针对这种格式进行更新。以下是一个集群配置文件示例：
|
||||
|
||||
<details id="v2.3.0-cluster-config-file">
|
||||
<summary>集群配置文件示例</summary>
|
||||
|
||||
```yaml
|
||||
#
|
||||
# Cluster Config
|
||||
#
|
||||
docker_root_dir: /var/lib/docker
|
||||
enable_cluster_alerting: false
|
||||
enable_cluster_monitoring: false
|
||||
enable_network_policy: false
|
||||
local_cluster_auth_endpoint:
|
||||
enabled: true
|
||||
#
|
||||
# Rancher Config
|
||||
#
|
||||
rancher_kubernetes_engine_config: # Your RKE template config goes here.
|
||||
addon_job_timeout: 30
|
||||
authentication:
|
||||
strategy: x509
|
||||
ignore_docker_version: true
|
||||
#
|
||||
# # 目前仅支持 Nginx ingress provider
|
||||
# # 要禁用 Ingress controller，设置 `provider: none`
|
||||
# # 要在指定节点上禁用 Ingress，使用 node_selector，例如：
|
||||
# provider: nginx
|
||||
# node_selector:
|
||||
# app: ingress
|
||||
#
|
||||
ingress:
|
||||
provider: nginx
|
||||
kubernetes_version: v1.15.3-rancher3-1
|
||||
monitoring:
|
||||
provider: metrics-server
|
||||
#
|
||||
# If you are using calico on AWS
|
||||
#
|
||||
# network:
|
||||
# plugin: calico
|
||||
# calico_network_provider:
|
||||
# cloud_provider: aws
|
||||
#
|
||||
# # To specify flannel interface
|
||||
#
|
||||
# network:
|
||||
# plugin: flannel
|
||||
# flannel_network_provider:
|
||||
# iface: eth1
|
||||
#
|
||||
# # To specify flannel interface for canal plugin
|
||||
#
|
||||
# network:
|
||||
# plugin: canal
|
||||
# canal_network_provider:
|
||||
# iface: eth1
|
||||
#
|
||||
network:
|
||||
options:
|
||||
flannel_backend_type: vxlan
|
||||
plugin: canal
|
||||
#
|
||||
# services:
|
||||
# kube-api:
|
||||
# service_cluster_ip_range: 10.43.0.0/16
|
||||
# kube-controller:
|
||||
# cluster_cidr: 10.42.0.0/16
|
||||
# service_cluster_ip_range: 10.43.0.0/16
|
||||
# kubelet:
|
||||
# cluster_domain: cluster.local
|
||||
# cluster_dns_server: 10.43.0.10
|
||||
#
|
||||
services:
|
||||
etcd:
|
||||
backup_config:
|
||||
enabled: true
|
||||
interval_hours: 12
|
||||
retention: 6
|
||||
safe_timestamp: false
|
||||
creation: 12h
|
||||
extra_args:
|
||||
election-timeout: 5000
|
||||
heartbeat-interval: 500
|
||||
gid: 0
|
||||
retention: 72h
|
||||
snapshot: false
|
||||
uid: 0
|
||||
kube_api:
|
||||
always_pull_images: false
|
||||
pod_security_policy: false
|
||||
service_node_port_range: 30000-32767
|
||||
ssh_agent_auth: false
|
||||
windows_prefered_cluster: false
|
||||
```
|
||||
</details>
|
||||
|
||||
### 默认 DNS 提供商
|
||||
|
||||
下表显示了默认部署的 DNS 提供商。有关如何配置不同 DNS 提供商的更多信息，请参阅 [DNS 提供商相关的 RKE 文档](https://rancher.com/docs/rke/latest/en/config-options/add-ons/dns/)。CoreDNS 只能在 Kubernetes v1.12.0 及更高版本上使用。
|
||||
|
||||
| Rancher 版本 | Kubernetes 版本 | 默认 DNS 提供商 |
|
||||
|-------------|--------------------|----------------------|
|
||||
| v2.2.5 及更高版本 | v1.14.0 及更高版本 | CoreDNS |
|
||||
| v2.2.5 及更高版本 | v1.13.x 及更低版本 | kube-dns |
|
||||
| v2.2.4 及更低版本 | 任意 | kube-dns |
|
||||
|
||||
## YAML 中的 Rancher 特定参数
|
||||
|
||||
除了 RKE 配置文件选项外，还有可以在配置文件 (YAML) 中配置的 Rancher 特定设置如下。
|
||||
|
||||
### docker_root_dir
|
||||
|
||||
请参阅 [Docker 根目录](#docker-根目录)。
|
||||
|
||||
### enable_cluster_monitoring
|
||||
|
||||
启用或禁用[集群监控](../../../integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md)的选项。
|
||||
|
||||
### enable_network_policy
|
||||
|
||||
启用或禁用项目网络隔离的选项。
|
||||
|
||||
如果你使用支持执行 Kubernetes 网络策略的 RKE 网络插件（例如 Canal 或 Cisco ACI 插件），则可以使用项目网络隔离。
|
||||
|
||||
### local_cluster_auth_endpoint
|
||||
|
||||
请参阅[授权集群端点](#授权集群端点)。
|
||||
|
||||
示例：
|
||||
|
||||
```yaml
|
||||
local_cluster_auth_endpoint:
|
||||
enabled: true
|
||||
fqdn: "FQDN"
|
||||
ca_certs: |-
|
||||
-----BEGIN CERTIFICATE-----
|
||||
...
|
||||
-----END CERTIFICATE-----
|
||||
```
|
||||
|
||||
### 自定义网络插件
|
||||
|
||||
你可以使用 RKE 的[用户定义的附加组件功能](https://rancher.com/docs/rke/latest/en/config-options/add-ons/user-defined-add-ons/)来添加自定义网络插件。部署 Kubernetes 集群之后，你可以定义要部署的任何附加组件。
|
||||
|
||||
有两种方法可以指定附加组件：
|
||||
|
||||
- [内嵌附加组件](https://rancher.com/docs/rke/latest/en/config-options/add-ons/user-defined-add-ons/#in-line-add-ons)
|
||||
- [为附加组件引用 YAML 文件](https://rancher.com/docs/rke/latest/en/config-options/add-ons/user-defined-add-ons/#referencing-yaml-files-for-add-ons)
|
||||
|
||||
有关如何通过编辑 `cluster.yml` 来配置自定义网络插件的示例，请参阅 [RKE 文档](https://rancher.com/docs/rke/latest/en/config-options/add-ons/network-plugins/custom-network-plugin-example)。
|
||||
+2
-2
@@ -6,7 +6,7 @@ title: DNS
|
||||
|
||||
请确保你配置了正确的 kubeconfig（例如，为 Rancher HA 配置了 `export KUBECONFIG=$PWD/kube_config_cluster.yml`）或通过 UI 使用了嵌入式 kubectl。
|
||||
|
||||
在运行 DNS 检查之前，请检查集群的[默认 DNS 提供商](../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md#默认-dns-提供商)，并确保[覆盖网络正常运行](networking.md#检查覆盖网络是否正常运行)，因为这也可能导致 DNS 解析（部分）失败。
|
||||
Before running the DNS checks, make sure that [the overlay network is functioning correctly](networking.md#check-if-overlay-network-is-functioning-correctly) for your DNS provider as this can also be the reason why DNS resolution (partly) fails.
|
||||
|
||||
## 检查 DNS pod 是否正在运行
|
||||
|
||||
@@ -199,7 +199,7 @@ services:
|
||||
|
||||
:::
|
||||
|
||||
请参阅[使用 YAML 编辑集群](../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md#使用-yaml-编辑集群)了解如何应用此修改。集群配置完成后，你必须删除 kube-dns pod 以激活 pod 中的新设置：
|
||||
请参阅使用 YAML 编辑集群了解如何应用此修改。集群配置完成后，你必须删除 kube-dns pod 以激活 pod 中的新设置：
|
||||
|
||||
```
|
||||
kubectl delete pods -n kube-system -l k8s-app=kube-dns
|
||||
|
||||
+12
-12
@@ -74,22 +74,22 @@ kubectl -n kube-system get endpoints kube-scheduler -o jsonpath='{.metadata.anno
|
||||
|
||||
## Ingress Controller
|
||||
|
||||
默认的 Ingress Controller 是 NGINX，作为 DaemonSet 部署在 `ingress-nginx` 命名空间中。Pod 仅会调度到具有 `worker` 角色的节点。
|
||||
默认的 Ingress Controller 是 Traefik，作为 DaemonSet 部署在 `traefik` 命名空间中。Pod 仅会调度到具有 `worker` 角色的节点。
|
||||
|
||||
检查 pod 是否运行在所有节点上：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get pods -o wide
|
||||
kubectl -n traefik get pods -o wide
|
||||
```
|
||||
|
||||
输出示例：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get pods -o wide
|
||||
kubectl -n traefik get pods -o wide
|
||||
NAME READY STATUS RESTARTS AGE IP NODE
|
||||
default-http-backend-797c5bc547-kwwlq 1/1 Running 0 17m x.x.x.x worker-1
|
||||
nginx-ingress-controller-4qd64 1/1 Running 0 14m x.x.x.x worker-1
|
||||
nginx-ingress-controller-8wxhm 1/1 Running 0 13m x.x.x.x worker-0
|
||||
traefik-4qd64 1/1 Running 0 14m x.x.x.x worker-1
|
||||
traefik-8wxhm 1/1 Running 0 13m x.x.x.x worker-0
|
||||
```
|
||||
|
||||
如果 pod 无法运行（即状态不是 **Running**，Ready 状态未显示 `1/1`，或者有大量 Restarts），请检查 pod 详细信息，日志和命名空间事件。
|
||||
@@ -97,27 +97,27 @@ nginx-ingress-controller-8wxhm 1/1 Running 0 13m
|
||||
### Pod 详细信息
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx describe pods -l app=ingress-nginx
|
||||
kubectl -n traefik describe pods -l app=traefik
|
||||
```
|
||||
|
||||
### Pod 容器日志
|
||||
|
||||
下面的命令可以显示所有标记为 “app=ingress-nginx” 的 pod 的日志，但是由于 `kubectl logs` 命令的限制，它只会显示 10 行日志。有关详细信息，请参阅 `kubectl logs -h` 的 `--tail`。
|
||||
下面的命令可以显示所有标记为 “app=traefik” 的 pod 的日志，但是由于 `kubectl logs` 命令的限制，它只会显示 10 行日志。有关详细信息，请参阅 `kubectl logs -h` 的 `--tail`。
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx logs -l app=ingress-nginx
|
||||
kubectl -n traefik logs -l app=traefik
|
||||
```
|
||||
|
||||
如果需要查看完整的日志，请在命令中尾随 pod 名称：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx logs <pod name>
|
||||
kubectl -n traefik logs <pod name>
|
||||
```
|
||||
|
||||
### 命名空间事件
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get events
|
||||
kubectl -n traefik get events
|
||||
```
|
||||
|
||||
### 调试日志
|
||||
@@ -125,7 +125,7 @@ kubectl -n ingress-nginx get events
|
||||
要启用调试日志：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx patch ds nginx-ingress-controller --type='json' -p='[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--v=5"}]'
|
||||
kubectl -n traefik patch ds traefik --type='json' -p='[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--v=5"}]'
|
||||
```
|
||||
|
||||
### 检查配置
|
||||
@@ -133,7 +133,7 @@ kubectl -n ingress-nginx patch ds nginx-ingress-controller --type='json' -p='[{"
|
||||
在每个 pod 中检索生成的配置：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get pods -l app=ingress-nginx --no-headers -o custom-columns=.NAME:.metadata.name | while read pod; do kubectl -n ingress-nginx exec $pod -- cat /etc/nginx/nginx.conf; done
|
||||
kubectl -n traefik get pods -l app=traefik --no-headers -o custom-columns=.NAME:.metadata.name | while read pod; do kubectl -n traefik exec $pod -- cat /etc/nginx/nginx.conf; done
|
||||
```
|
||||
|
||||
## Rancher Agents
|
||||
|
||||
+1
-1
@@ -65,7 +65,7 @@ rancher rancher.yourdomain.com x.x.x.x,x.x.x.x,x.x.x.x 80, 443 2m
|
||||
如果访问你配置的 Rancher FQDN 时没有显示 UI，请检查 Ingress Controller 日志以查看尝试访问 Rancher 时发生了什么：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx logs -l app=ingress-nginx
|
||||
kubectl -n traefik logs -l app=traefik
|
||||
```
|
||||
|
||||
## Leader 选举
|
||||
|
||||
+1
-4
@@ -6,10 +6,7 @@ title: TLS 设置
|
||||
|
||||
## 在高可用 Kubernetes 集群中运行 Rancher
|
||||
|
||||
当你在 Kubernetes 集群内安装 Rancher 时，TLS 会在集群的 Ingress Controller 上卸载。可用的 TLS 设置取决于使用的 Ingress Controller：
|
||||
|
||||
* nginx-ingress-controller（default RKE2 默认）：[默认的 TLS 版本和密码](https://kubernetes.github.io/ingress-nginx/user-guide/tls/#default-tls-version-and-ciphers)。
|
||||
* traefik（K3s 默认）：[TLS 选项](https://doc.traefik.io/traefik/https/tls/#tls-options)。
|
||||
When you install a Rancher managed Kubernetes cluster, TLS is offloaded at the cluster's ingress controller. Traefik is the default ingress for K3s and can be used with RKE2, refer to [TLS Options](https://doc.traefik.io/traefik/https/tls/#tls-options) for further information.
|
||||
|
||||
## 在单个 Docker 容器中运行 Rancher
|
||||
|
||||
|
||||
+7
-12
@@ -4,14 +4,12 @@ title: 设置 Amazon NLB 网络负载均衡器
|
||||
|
||||
本文介绍了如何在 Amazon EC2 服务中设置 Amazon NLB 网络负载均衡器，用于将流量转发到 EC2 上的多个实例中。
|
||||
|
||||
这些示例中，负载均衡器将流量转发到三个 Rancher Server 节点。如果 Rancher 安装在 RKE Kubernetes 集群上，则需要三个节点。如果 Rancher 安装在 K3s Kubernetes 集群上，则只需要两个节点。
|
||||
这些示例中，负载均衡器将流量转发到三个 Rancher Server 节点。如果 Rancher 安装在 K3s Kubernetes 集群上，则只需要两个节点。
|
||||
|
||||
本文介绍的只是配置负载均衡器的其中一种方式。其他负载均衡器如传统负载路由器（Classic Load Balancer）和应用负载路由器（Application Load Balancer），也可以将流量转发到 Rancher Server 节点。
|
||||
|
||||
Rancher 仅支持使用 Amazon NLB 以 `TCP` 模式终止 443 端口的流量，而不支持 `TLS` 模式。这试因为在 NLB 终止时，NLB 不会将正确的标头注入请求中。如果你想使用由 Amazon Certificate Manager (ACM) 托管的证书，请使用 ALB。
|
||||
|
||||
|
||||
|
||||
## 要求
|
||||
|
||||
你已在 EC2 中创建了 Linux 实例。此外，负载均衡器会把流量转发到这些节点。
|
||||
@@ -22,7 +20,7 @@ Rancher 仅支持使用 Amazon NLB 以 `TCP` 模式终止 443 端口的流量，
|
||||
|
||||
配置 NLB 的第一个步骤是创建两个目标组。一般来说，只需要端口 443 就可以访问 Rancher。但是，由于端口 80 的流量会被自动重定向到端口 443，因此，你也可以为端口 80 也添加一个监听器。
|
||||
|
||||
不管使用的是 NGINX Ingress 还是 Traefik Ingress Controller，Ingress 都应该将端口 80 的流量重定向到端口 443。以下为操作步骤：
|
||||
The Traefik Ingress should redirect traffic from port 80 to port 443.
|
||||
|
||||
1. 登录到 [Amazon AWS 控制台](https://console.aws.amazon.com/ec2/)。确保选择的**区域**是你创建 EC2 实例 （Linux 节点）的区域。
|
||||
1. 选择**服务** > **EC2**，找到**负载均衡器**并打开**目标组**。
|
||||
@@ -30,7 +28,7 @@ Rancher 仅支持使用 Amazon NLB 以 `TCP` 模式终止 443 端口的流量，
|
||||
|
||||
:::note
|
||||
|
||||
不同 Ingress 的健康检查处理方法不同。详情请参阅[本节](#nginx-ingress-和-traefik-ingress-的健康检查路径)。
|
||||
For details on Traefik Ingress health checks, refer to [this section.](#health-check-paths-for-traefik-ingresses)
|
||||
|
||||
:::
|
||||
|
||||
@@ -163,13 +161,10 @@ AWS 完成 NLB 创建后，单击**关闭**。
|
||||
|
||||
6. 单击右上角的**保存**。
|
||||
|
||||
## NGINX Ingress 和 Traefik Ingress 的健康检查路径
|
||||
## Health Check Paths for Traefik Ingresses
|
||||
|
||||
K3s 和 RKE Kubernetes 集群使用的默认 Ingress 不同，因此对应的健康检查方式也不同。
|
||||
K3s Kubernetes clusters use Traefik as the default Ingress.
|
||||
|
||||
RKE Kubernetes 集群默认使用 NGINX Ingress，而 K3s Kubernetes 集群默认使用 Traefik Ingress。
|
||||
The health check path is `/ping`. By default `/ping` is always matched (regardless of Host), and a response from [Traefik itself](https://docs.traefik.io/operations/ping/) is always served.
|
||||
|
||||
- **Traefik**：默认健康检查路径是 `/ping`。默认情况下，不管主机如何，`/ping` 总是匹配，而且 [Traefik 自身](https://docs.traefik.io/operations/ping/)总会响应。
|
||||
- **NGINX Ingress**：NGINX Ingress Controller 的默认后端有一个 `/healthz` 端点。默认情况下，不管主机如何，`/healthz` 总是匹配，而且 [`ingress-nginx` 自身](https://github.com/kubernetes/ingress-nginx/blob/0cbe783f43a9313c9c26136e888324b1ee91a72f/charts/ingress-nginx/values.yaml#L212)总会响应。
|
||||
|
||||
想要精确模拟健康检查，最好是使用 Host 标头（Rancher hostname）加上 `/ping` 或 `/healthz`（分别对应 K3s 和 RKE 集群）来获取 Rancher Pod 的响应，而不是 Ingress 的响应。
|
||||
To simulate an accurate health check, it is a best practice to use the Host header (Rancher hostname) combined with `/ping` or `/healthz` wherever possible, to get a response from the Rancher Pods, not the Ingress.
|
||||
|
||||
+5
-5
@@ -87,7 +87,7 @@ systemctl start rke2-server.service
|
||||
|
||||
1. 安装 Kubernetes 命令行工具 [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl)。
|
||||
2. 复制 `/etc/rancher/rke2/rke2.yaml` 文件并保存到本地主机的 `~/.kube/config` 目录上。
|
||||
3. 在 kubeconfig 文件中，`server` 的参数为 localhost。在端口 6443 上将服务器配置为 controlplane 负载均衡器的 DNS（RKE2 Kubernetes API Server 使用端口 6443，而 Rancher Server 将通过 NGINX Ingress 在端口 80 和 443 上提供服务。）以下是一个示例 `rke2.yaml`：
|
||||
3. 在 kubeconfig 文件中，`server` 的参数为 localhost。在端口 6443 上将服务器配置为 controlplane 负载均衡器的 DNS（RKE2 Kubernetes API Server 使用端口 6443，而 Rancher Server 将通过 Traefik Ingress 在端口 80 和 443 上提供服务。）以下是一个示例 `rke2.yaml`：
|
||||
|
||||
```yml
|
||||
apiVersion: v1
|
||||
@@ -136,7 +136,8 @@ kube-system etcd-rke2-server-2 1/1 Ru
|
||||
kube-system etcd-rke2-server-3 1/1 Running 0 56s
|
||||
kube-system helm-install-rke2-canal-hs6sx 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-rke2-coredns-xmzm8 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-rke2-ingress-nginx-flwnl 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-traefik-crd-z8vsz 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-traefik-flwnl 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-rke2-metrics-server-7sggn 0/1 Completed 0 2m17s
|
||||
kube-system kube-apiserver-rke2-server-1 1/1 Running 0 116s
|
||||
kube-system kube-apiserver-rke2-server-2 1/1 Running 0 66s
|
||||
@@ -156,9 +157,8 @@ kube-system rke2-canal-swfmq 2/2 Ru
|
||||
kube-system rke2-coredns-rke2-coredns-547d5499cb-6tvwb 1/1 Running 0 92s
|
||||
kube-system rke2-coredns-rke2-coredns-547d5499cb-rdttj 1/1 Running 0 2m8s
|
||||
kube-system rke2-coredns-rke2-coredns-autoscaler-65c9bb465d-85sq5 1/1 Running 0 2m8s
|
||||
kube-system rke2-ingress-nginx-controller-69qxc 1/1 Running 0 52s
|
||||
kube-system rke2-ingress-nginx-controller-7hprp 1/1 Running 0 52s
|
||||
kube-system rke2-ingress-nginx-controller-x658h 1/1 Running 0 52s
|
||||
kube-system traefik-7c844b766f-m9p2w 1/1 Running 0 52s
|
||||
kube-system traefik-7c844b766f-s4l9k 1/1 Running 0 52s
|
||||
kube-system rke2-metrics-server-6564db4569-vdfkn 1/1 Running 0 66s
|
||||
```
|
||||
|
||||
|
||||
+1
-1
@@ -43,7 +43,7 @@ SUSE Linux 可能有一个防火墙，默认情况下会阻止所有端口。在
|
||||
|
||||
### Flatcar Container Linux 节点
|
||||
|
||||
使用 Flatcar Container Linux 节点[通过 Rancher 启动 Kubernetes](../launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) 时，需要在 [Cluster Config 文件](../../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md#rke-集群配置文件参考)中使用如下配置：
|
||||
使用 Flatcar Container Linux 节点[通过 Rancher 启动 Kubernetes](../launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) 时，需要在 Cluster Config 文件 中使用如下配置：
|
||||
|
||||
<Tabs>
|
||||
<TabItem value="Canal">
|
||||
|
||||
+1
-11
@@ -3,14 +3,6 @@ title: Ingress 配置
|
||||
description: Ingress 配置
|
||||
---
|
||||
|
||||
:::note
|
||||
|
||||
在 Kubernetes v1.21 及更高版本中，NGINX Ingress Controller 不再默认运行在 hostNetwork 中。它改为将 hostPorts 用于端口 80 和端口 443，因此你可以将准入 Webhook 配置为只能通过 ClusterIP 访问。这确保了只能从集群内部访问 webhook。
|
||||
|
||||
由于 controller 的这一更改，默认 RKE1 配置不再将 `hostNetwork` 设置为 `true`。但是，你必须将 `hostNetwork` 设置为 `true` 才能使基于 TCP 和 UDP 的 Service 正常工作。为此，请[编辑](../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md#使用-yaml-编辑集群)集群的 YAML 并按照[官方 RKE1 文档](https://rke.docs.rancher.com/config-options/add-ons/ingress-controllers#configuring-network-options)中的步骤操作。
|
||||
|
||||
:::
|
||||
|
||||
## 指定要使用的主机名
|
||||
|
||||
如果使用此选项，Ingress 会将主机名请求路由到你指定的服务或工作负载。
|
||||
@@ -36,6 +28,4 @@ description: Ingress 配置
|
||||
|
||||
## 标签和注释
|
||||
|
||||
添加[标签](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/)和/或[注释](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)来为你的 Ingress Controller 提供元数据。
|
||||
|
||||
有关可用的注释列表，请参阅 [Nginx Ingress Controller 文档](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/)。
|
||||
Please refer to the Traefik documentation for the full list of Ingress NGINX annotations that are [supported](https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/ingress-nginx/#annotations-support) and [unsupported](https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/ingress-nginx/#unsupported-annotations) by Traefik's kubernetesIngressNginx provider.
|
||||
|
||||
+5
-15
@@ -7,13 +7,11 @@ Kubernetes 支持四层负载均衡和七层负载均衡。
|
||||
|
||||
## 四层负载均衡器
|
||||
|
||||
四层负载均衡器（或外部负载均衡器）将流量转发到 Nodeport。四层负载均衡器支持转发 HTTP 和 TCP 流量。
|
||||
|
||||
通常情况下，四层负载均衡器由底层云提供商支持，因此，如果你在裸金属服务器和 vSphere 集群上部署 RKE 集群，则不支持四层负载均衡器。但是，单个[全局管理的 config-map](https://kubernetes.github.io/ingress-nginx/user-guide/exposing-tcp-udp-services/) 可用于在 NGINX 或第三方 Ingress 上公开服务。
|
||||
Layer-4 load balancer (or the external load balancer) forwards traffic to NodePorts. Layer-4 load balancer allows you to forward both HTTP and TCP traffic.
|
||||
|
||||
:::note
|
||||
|
||||
你可以使用非云负载均衡器（例如 [MetalLB](https://metallb.universe.tf/)）来部署集群。但是，该用例比云提供商支持的四层负载均衡器更高级，而且不可以在 Rancher 或 RKE 中配置。
|
||||
It is possible to deploy a cluster with a non-cloud load balancer, such as [MetalLB.](https://metallb.universe.tf/) However, that use case is more advanced than the Layer-4 load balancer supported by a cloud provider, and it is not configurable in Rancher.
|
||||
|
||||
:::
|
||||
|
||||
@@ -26,17 +24,13 @@ Kubernetes 支持四层负载均衡和七层负载均衡。
|
||||
| Amazon EKS | 由 AWS 云提供商支持 |
|
||||
| Google GKE | 由 GCE 云提供商支持 |
|
||||
| Azure AKS | 由 Azure 云提供商支持 |
|
||||
| EC2 上的 RKE | 由 AWS 云提供商支持 |
|
||||
| DigitalOcean 上的 RKE | 受限的 NGINX 或第三方 Ingress\* |
|
||||
| vSphere 上的 RKE | 受限的 NGINX 或第三方 Ingress\* |
|
||||
| 自定义主机上的 RKE<br/>（例如裸金属服务器） | 受限的 NGINX 或第三方 Ingress\* |
|
||||
| 第三方 MetalLB | 受限的 NGINX 或第三方 Ingress\* |
|
||||
| 第三方 MetalLB | third-party Ingress\* |
|
||||
|
||||
\* 可以通过单个[全局管理的 config-map](https://kubernetes.github.io/ingress-nginx/user-guide/exposing-tcp-udp-services/) 来公开服务。
|
||||
|
||||
## 七层负载均衡器
|
||||
|
||||
七层负载均衡器（或 Ingress Controller）支持基于主机和路径的负载均衡和 SSL 终止。七层负载均衡器仅转发 HTTP 和 HTTPS 流量，因此它们仅侦听端口 80 和 443。亚马逊和谷歌等云提供商支持七层负载均衡器。此外，RKE 集群部署了 Nginx Ingress Controller。
|
||||
Layer-7 load balancer (or the ingress controller) supports host and path-based load balancing and SSL termination. Layer-7 load balancer only forwards HTTP and HTTPS traffic and therefore they listen on ports 80 and 443 only. Cloud providers such as Amazon and Google support layer-7 load balancer.
|
||||
|
||||
### 七层负载均衡支持
|
||||
|
||||
@@ -47,16 +41,12 @@ Kubernetes 支持四层负载均衡和七层负载均衡。
|
||||
| Amazon EKS | 由 AWS 云提供商支持 |
|
||||
| Google GKE | 由 GKE 云提供商支持 |
|
||||
| Azure AKS | 不支持 |
|
||||
| EC2 上的 RKE | Nginx Ingress Controller |
|
||||
| DigitalOcean 上的 RKE | Nginx Ingress Controller |
|
||||
| vSphere 上的 RKE | Nginx Ingress Controller |
|
||||
| 自定义主机上的 RKE<br/>（例如裸金属服务器） | Nginx Ingress Controller |
|
||||
|
||||
### 七层负载均衡器中的主机名
|
||||
|
||||
一些托管在云上的七层负载均衡器（例如 AWS 上的 ALB Ingress Controller）会为 Ingress 规则公开 DNS 地址。你需要（使用 CNAME）将你的域名映射到七层负载均衡器生成的 DNS 地址。
|
||||
|
||||
其他七层负载均衡器（例如 Google Load Balancer 或 Nginx Ingress Controller）会直接公开一个或多个 IP 地址。Google Load Balancer 提供了一个可路由的 IP 地址。Nginx Ingress Controller 公开了运行 Nginx Ingress Controller 的所有节点的外部 IP。你可以执行以下任一操作：
|
||||
Other layer-7 load balancers, such as the Google Load Balancer, directly expose one or more IP addresses. Google Load Balancer provides a single routable IP address. You can do either of the following:
|
||||
|
||||
1. 配置你自己的 DNS，从而（使用 A 记录）将你的域名映射到七层负载均衡器公开的 IP 地址。
|
||||
2. 让 Rancher 为你的 Ingress 规则生成一个 xip.io 主机名。Rancher 将使用你公开的其中一个 IP（假设是 `a.b.c.d`）生成一个主机名（即 `<ingressname>.<namespace>.a.b.c.d.xip.io`）。
|
||||
|
||||
+1
-9
@@ -48,18 +48,10 @@ Rancher 支持两种类型的负载均衡器：
|
||||
|
||||
Ingress 与一个或多个 Ingress Controller 一起动态路由 service 的请求。Ingress 收到请求时，集群中的 Ingress Controller 会根据你配置的 service 子域或路径规则将请求定向到正确的 service。
|
||||
|
||||
每个 Kubernetes Ingress 资源都对应一个 `/etc/nginx/sites-available/` 中的文件，其中包含一个配置对特定文件和文件夹的请求的 `server{}` 配置块。
|
||||
|
||||
Ingress 能为你的集群创建一个入口端口（与负载均衡器类似），可以位于集群的内部或外部。RKE 启动的集群中的 Ingress 和 Ingress Controller 由 [Nginx](https://www.nginx.com/) 提供支持。
|
||||
Ingress 能为你的集群创建一个入口端口（与负载均衡器类似），可以位于集群的内部或外部。
|
||||
|
||||
Ingress 还支持其他功能，例如 SSL 终止、基于名称的虚拟主机等。
|
||||
|
||||
:::note 在高可用性配置中使用 Rancher：
|
||||
|
||||
请避免将 Ingress 添加到 `local` 集群。Rancher 将 Nginx Ingress Controller 作为 Rancher 管理的 _所有_ 集群的全局入口点，其中包括 `local` 集群。因此，当用户尝试访问应用程序时，Rancher 可能会由于重新加载 Nginx 配置而断开连接。要解决这个问题，我们建议你仅在通过 Rancher 启动的集群中部署应用程序。
|
||||
|
||||
:::
|
||||
|
||||
- 有关如何在 Rancher 中设置 Ingress 的更多信息，请参阅 [Ingress](add-ingresses.md)。
|
||||
- 有关 Ingress 和 Ingress Controller 的完整信息，请参阅 [Kubernetes Ingress 文档](https://kubernetes.io/docs/concepts/services-networking/ingress/)。
|
||||
- 在项目中使用 Ingress 时，你可以通过设置全局 DNS 条目来将 Ingress 主机名编程到外部 DNS。
|
||||
|
||||
+1
-1
@@ -12,7 +12,7 @@ title: 在 Nutanix AOS 中配置 Kubernetes 集群
|
||||
|
||||
有关配置 Nutanix AOS 节点模板的详细信息，请参阅 [Nutanix AOS 节点模板配置参考](../../../../../reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/nutanix.md)。
|
||||
|
||||
有关在 Rancher 中配置 RKE Kubernetes 集群的详细信息，请参阅[集群配置参考](../../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md)。
|
||||
有关在 Rancher 中配置 RKE Kubernetes 集群的详细信息，请参阅集群配置参考。
|
||||
|
||||
- [Nutanix AOS 中的准备工作](#nutanix-aos-中的准备工作)
|
||||
- [创建 Nutanix AOS 集群](#创建-nutanix-aos-集群)
|
||||
|
||||
+1
-1
@@ -8,7 +8,7 @@ title: vSphere 存储
|
||||
|
||||
## 先决条件
|
||||
|
||||
为了在 [Rancher Kubernetes Engine (RKE)](../../launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) 集群中配置 vSphere 卷，[vSphere cloud provider](https://rancher.com/docs/rke/latest/en/config-options/cloud-providers/vsphere) 必须在[集群选项](../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md)中显式启用。
|
||||
为了在 [RKE2](../../launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) 集群中配置 vSphere 卷，[vSphere cloud provider](https://rancher.com/docs/rke/latest/en/config-options/cloud-providers/vsphere) 必须在[集群选项](../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke2-cluster-configuration.md#cloud-provider)中显式启用。
|
||||
|
||||
## 创建一个 StorageClass
|
||||
|
||||
|
||||
+5
-5
@@ -205,13 +205,13 @@ Prometheus 从称为 [exporter](https://prometheus.io/docs/instrumenting/exporte
|
||||
Prometheus 直接抓取以下 Kubernetes 组件：
|
||||
|
||||
- kubelet\*
|
||||
- ingress-nginx\*\*
|
||||
- Traefik\*\*
|
||||
- coreDns/kubeDns
|
||||
- kube-api-server
|
||||
|
||||
\* 你可以选择通过 `hardenedKubelet.enabled` 来使用 PushProx，但这不是默认设置。
|
||||
|
||||
\*\* RKE2 集群默认部署 ingress-nginx，并将其视为内部 Kubernetes 组件。
|
||||
\*\* For RKE2 clusters, Traefik is deployed by default and treated as an internal Kubernetes component.
|
||||
|
||||
|
||||
### 基于 Kubernetes 发行版抓取指标
|
||||
@@ -227,11 +227,11 @@ Prometheus 直接抓取以下 Kubernetes 组件：
|
||||
| etcd | rke2Etcd.enabled | kubeAdmEtcd.enabled | 不可用 |
|
||||
| kube-proxy | rke2Proxy.enabled | kubeAdmProxy.enabled | k3sServer.enabled |
|
||||
| kubelet | 收集 kubelet 直接公开的指标 | 收集 kubelet 直接公开的指标 | 收集 kubelet 直接公开的指标 |
|
||||
| ingress-nginx* | 收集 kubelet 直接公开的指标，由 rke2IngressNginx.enabled 公开 | 不可用 | 不可用 |
|
||||
| Traefik* | Collects metrics directly exposed by kubelet | Not available | Not available |
|
||||
| coreDns/kubeDns | 收集 coreDns/kubeDns 直接公开的指标 | 收集 coreDns/kubeDns 直接公开的指标 | 收集 coreDns/kubeDns 直接公开的指标 |
|
||||
| kube-api-server | 收集 kube-api-server 直接公开的指标 | 收集 kube-appi-server 直接公开的指标 | 收集 kube-api-server 直接公开的指标 |
|
||||
|
||||
\* RKE2 集群默认部署 ingress-nginx，并将其视为内部 Kubernetes 组件。
|
||||
\* For RKE2 clusters, Traefik is deployed by default and treated as an internal Kubernetes component.
|
||||
|
||||
### 名词解释
|
||||
|
||||
@@ -240,6 +240,6 @@ Prometheus 直接抓取以下 Kubernetes 组件：
|
||||
- **etcd**：Kubernetes 内部组件，它是 Kubernetes 用于持久存储所有集群信息的分布式键/值存储。
|
||||
- **kube-proxy**：内部 Kubernetes 组件，用于监控 API server 的 pod/service 更改以保持网络最新状态。
|
||||
- **kubelet**：内部 Kubernetes 组件，用于为 pod 监视节点上的 API server 并确保这些 pod 能运行。
|
||||
- **ingress-nginx**：用于 Kubernetes 的 Ingress controller，使用 NGINX 作为反向代理和负载均衡器。
|
||||
- **Traefik:** An Ingress controller for Kubernetes that can be used as a reverse proxy and load balancer.
|
||||
- **coreDns/kubeDns**：负责 DNS 的内部 Kubernetes 组件。
|
||||
- **kube-api-server**：负责为其他 master 组件公开 API 的主要内部 Kubernetes 组件。
|
||||
|
||||
-357
@@ -1,357 +0,0 @@
|
||||
---
|
||||
title: RKE 集群配置参考
|
||||
---
|
||||
|
||||
<EOLRKE1Warning />
|
||||
|
||||
Rancher 安装 Kubernetes 时，它使用 [RKE](../../../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) 或 [RKE2](https://docs.rke2.io/) 作为 Kubernetes 发行版。
|
||||
|
||||
本文介绍 Rancher 中可用于新的或现有的 RKE Kubernetes 集群的配置选项。
|
||||
|
||||
|
||||
## 概述
|
||||
|
||||
你可以通过以下两种方式之一来配置 Kubernetes 选项：
|
||||
|
||||
- [Rancher UI](#rancher-ui-中的配置选项)：使用 Rancher UI 来选择设置 Kubernetes 集群时常用的自定义选项。
|
||||
- [集群配置文件](#rke-集群配置文件参考)：高级用户可以创建一个 RKE 配置文件，而不是使用 Rancher UI 来为集群选择 Kubernetes 选项。配置文件可以让你使用 YAML 来指定 RKE 安装中可用的任何选项（除了 system_images 配置）。
|
||||
|
||||
RKE 集群配置选项嵌套在 `rancher_kubernetes_engine_config` 参数下。有关详细信息，请参阅[集群配置文件](#rke-集群配置文件参考)。
|
||||
|
||||
在 [RKE 启动的集群](../../../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md)中，你可以编辑任何后续剩余的选项。
|
||||
|
||||
有关 RKE 配置文件语法的示例，请参阅 [RKE 文档](https://rancher.com/docs/rke/latest/en/example-yamls/)。
|
||||
|
||||
Rancher UI 中的表单不包括配置 RKE 的所有高级选项。有关 YAML 中 RKE Kubernetes 集群的可配置选项的完整参考，请参阅 [RKE 文档](https://rancher.com/docs/rke/latest/en/config-options/)。
|
||||
|
||||
## 在 Rancher UI 中使用表单编辑集群
|
||||
|
||||
要编辑你的集群：
|
||||
|
||||
1. 在左上角，单击 **☰ > 集群管理**。
|
||||
1. 转到要配置的集群，然后单击 **⋮ > 编辑配置**。
|
||||
|
||||
|
||||
## 使用 YAML 编辑集群
|
||||
|
||||
高级用户可以创建一个 RKE 配置文件，而不是使用 Rancher UI 来为集群选择 Kubernetes 选项。配置文件可以让你使用 YAML 来指定 RKE 安装中可用的任何选项（除了 system_images 配置）。
|
||||
|
||||
RKE 集群（也称为 RKE1 集群）的编辑方式与 RKE2 和 K3s 集群不同。
|
||||
|
||||
要直接从 Rancher UI 编辑 RKE 配置文件：
|
||||
|
||||
1. 点击 **☰ > 集群管理**。
|
||||
1. 转到要配置的 RKE 集群。单击并单击 **⋮ > 编辑配置**。你将会转到 RKE 配置表单。请注意，由于集群配置在 Rancher 2.6 中发生了变更，**⋮ > 以 YAML 文件编辑**可用于配置 RKE2 集群，但不能用于编辑 RKE1 配置。
|
||||
1. 在配置表单中，向下滚动并单击**以 YAML 文件编辑**。
|
||||
1. 编辑 `rancher_kubernetes_engine_config` 参数下的 RKE 选项。
|
||||
|
||||
## Rancher UI 中的配置选项
|
||||
|
||||
:::tip
|
||||
|
||||
一些高级配置选项没有在 Rancher UI 表单中开放，但你可以通过在 YAML 中编辑 RKE 集群配置文件来启用这些选项。有关 YAML 中 RKE Kubernetes 集群的可配置选项的完整参考，请参阅 [RKE 文档](https://rancher.com/docs/rke/latest/en/config-options/)。
|
||||
|
||||
:::
|
||||
|
||||
### Kubernetes 版本
|
||||
|
||||
这指的是集群节点上安装的 Kubernetes 版本。Rancher 基于 [hyperkube](https://github.com/rancher/hyperkube) 打包了自己的 Kubernetes 版本。
|
||||
|
||||
有关更多详细信息，请参阅[升级 Kubernetes](../../../getting-started/installation-and-upgrade/upgrade-and-roll-back-kubernetes.md)。
|
||||
|
||||
### 网络提供商
|
||||
|
||||
这指的是集群使用的[网络提供商](https://kubernetes.io/docs/concepts/cluster-administration/networking/)。有关不同网络提供商的更多详细信息，请查看我们的[网络常见问题解答](../../../faq/container-network-interface-providers.md)。
|
||||
|
||||
:::caution
|
||||
|
||||
启动集群后，你无法更改网络提供商。由于 Kubernetes 不允许在网络提供商之间切换，因此，请谨慎选择要使用的网络提供商。使用网络提供商创建集群后，如果你需要更改网络提供商，你将需要拆除整个集群以及其中的所有应用。
|
||||
|
||||
:::
|
||||
|
||||
Rancher 与以下开箱即用的网络提供商兼容：
|
||||
|
||||
- [Canal](https://github.com/projectcalico/canal)
|
||||
- [Flannel](https://github.com/coreos/flannel#flannel)
|
||||
- [Calico](https://docs.projectcalico.org/v3.11/introduction/)
|
||||
- [Weave](https://github.com/weaveworks/weave)
|
||||
|
||||
:::note Weave 注意事项：
|
||||
|
||||
选择 Weave 作为网络提供商时，Rancher 将通过生成随机密码来自动启用加密。如果你想手动指定密码，请参阅使用[配置文件](#rke-集群配置文件参考)和 [Weave 网络插件选项](https://rancher.com/docs/rke/latest/en/config-options/add-ons/network-plugins/#weave-network-plug-in-options)来配置集群。
|
||||
|
||||
:::
|
||||
|
||||
### 项目网络隔离
|
||||
|
||||
如果你的网络提供商允许项目网络隔离，你可以选择启用或禁用项目间的通信。
|
||||
|
||||
如果你使用支持执行 Kubernetes 网络策略的 RKE 网络插件（例如 Canal 或 Cisco ACI 插件），则可以使用项目网络隔离。
|
||||
|
||||
### Kubernetes 云提供商
|
||||
|
||||
你可以配置 [Kubernetes 云提供商](../../../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/set-up-cloud-providers.md)。如果你想在 Kubernetes 中使用动态配置的[卷和存储](../../../how-to-guides/new-user-guides/manage-clusters/create-kubernetes-persistent-storage/create-kubernetes-persistent-storage.md)，你通常需要选择特定的云提供商。例如，如果你想使用 Amazon EBS，则需要选择 `aws` 云提供商。
|
||||
|
||||
:::note
|
||||
|
||||
如果你要使用的云提供商未作为选项列出，你需要使用[配置文件选项](#rke-集群配置文件参考)来配置云提供商。请参考 [RKE 云提供商文档](https://rancher.com/docs/rke/latest/en/config-options/cloud-providers/)来了解如何配置云提供商。
|
||||
|
||||
:::
|
||||
|
||||
### 私有镜像仓库
|
||||
|
||||
集群级别的私有镜像仓库配置仅能用于配置集群。
|
||||
|
||||
在 Rancher 中设置私有镜像仓库的主要方法有两种：通过[全局默认镜像仓库](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/global-default-private-registry.md)中的**设置**选项卡设置全局默认镜像仓库，以及在集群级别设置的高级选项中设置私有镜像仓库。全局默认镜像仓库可以用于离线设置，不需要凭证的镜像仓库。而集群级私有镜像仓库用于所有需要凭证的私有镜像仓库。
|
||||
|
||||
如果你的私有镜像仓库需要凭证，为了将凭证传递给 Rancher，你需要编辑每个需要从仓库中拉取镜像的集群的集群选项。
|
||||
|
||||
私有镜像仓库的配置选项能让 Rancher 知道要从哪里拉取用于集群的[系统镜像](https://rancher.com/docs/rke/latest/en/config-options/system-images/)或[附加组件镜像](https://rancher.com/docs/rke/latest/en/config-options/add-ons/)。
|
||||
|
||||
- **系统镜像**是维护 Kubernetes 集群所需的组件。
|
||||
- **附加组件**用于部署多个集群组件，包括网络插件、ingress controller、DNS 提供商或 metrics server。
|
||||
|
||||
有关为集群配置期间应用的组件设置私有镜像仓库的更多信息，请参阅[私有镜像仓库的 RKE 文档](https://rancher.com/docs/rke/latest/en/config-options/private-registries/)。
|
||||
|
||||
Rancher v2.6 引入了[为 RKE 集群配置 ECR 镜像仓库](https://rancher.com/docs/rke/latest/en/config-options/private-registries/#amazon-elastic-container-registry-ecr-private-registry-setup)的功能。
|
||||
|
||||
### 授权集群端点
|
||||
|
||||
授权集群端点（ACE）可用于直接访问 Kubernetes API server，而无需通过 Rancher 进行通信。
|
||||
|
||||
:::note
|
||||
|
||||
授权集群端点仅适用于 Rancher 启动的 Kubernetes 集群，即只适用于 Rancher [使用 RKE](../../../reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md#配置-kubernetes-集群的工具) 来配置的集群。它不适用于托管在 Kubernetes 提供商中的集群，例如 Amazon 的 EKS。
|
||||
|
||||
:::
|
||||
|
||||
在 Rancher 启动的 Kubernetes 集群中，它默认启用，使用具有 `controlplane` 角色的节点的 IP 和默认的 Kubernetes 自签名证书。
|
||||
|
||||
有关授权集群端点的工作原理以及使用的原因，请参阅[架构介绍](../../../reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md#4-授权集群端点)。
|
||||
|
||||
我们建议使用具有授权集群端点的负载均衡器。有关详细信息，请参阅[推荐的架构](../../rancher-manager-architecture/architecture-recommendations.md#授权集群端点架构)。
|
||||
|
||||
### 节点池
|
||||
|
||||
有关使用 Rancher UI 在 RKE 集群中设置节点池的信息，请参阅[此页面](../../../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/use-new-nodes-in-an-infra-provider/use-new-nodes-in-an-infra-provider.md)。
|
||||
|
||||
### NGINX Ingress
|
||||
|
||||
如果你想使用高可用性配置来发布应用，并且你使用没有原生负载均衡功能的云提供商来托管主机，请启用此选项以在集群中使用 NGINX Ingress。
|
||||
|
||||
### Metrics Server 监控
|
||||
|
||||
这是启用或禁用 [Metrics Server](https://rancher.com/docs/rke/latest/en/config-options/add-ons/metrics-server/) 的选项。
|
||||
|
||||
每个能够使用 RKE 启动集群的云提供商都可以收集指标并监控你的集群节点。如果启用此选项，你可以从你的云提供商门户查看你的节点指标。
|
||||
|
||||
### 节点上的 Docker 版本
|
||||
|
||||
表示是否允许节点运行 Rancher 不正式支持的 Docker 版本。
|
||||
|
||||
如果你选择使用支持的 Docker 版本，Rancher 会禁止 pod 运行在安装了不支持的 Docker 版本的节点上。
|
||||
|
||||
如需了解各个 Rancher 版本通过了哪些 Docker 版本测试，请参见[支持和维护条款](https://rancher.com/support-maintenance-terms/)。
|
||||
|
||||
### Docker 根目录
|
||||
|
||||
如果要添加到集群的节点为 Docker 配置了非默认 Docker 根目录（默认为 `/var/lib/docker`），请在此选项中指定正确的 Docker 根目录。
|
||||
|
||||
### 默认 Pod 安全策略
|
||||
|
||||
如果你启用了 **Pod 安全策略支持**，请使用此下拉菜单选择应用于集群的 pod 安全策略。
|
||||
|
||||
### 节点端口范围
|
||||
|
||||
更改可用于 [NodePort 服务](https://kubernetes.io/docs/concepts/services-networking/service/#nodeport)的端口范围的选项。默认为 `30000-32767`。
|
||||
|
||||
### 定期 etcd 快照
|
||||
|
||||
启用或禁用[定期 etcd 快照](https://rancher.com/docs/rke/latest/en/etcd-snapshots/#etcd-recurring-snapshots)的选项。
|
||||
|
||||
### Agent 环境变量
|
||||
|
||||
为 [rancher agent](../../../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/about-rancher-agents.md) 设置环境变量的选项。你可以使用键值对设置环境变量。如果 Rancher Agent 需要使用代理与 Rancher Server 通信，则可以使用 Agent 环境变量设置 `HTTP_PROXY`，`HTTPS_PROXY` 和 `NO_PROXY` 环境变量。
|
||||
|
||||
### 更新 ingress-nginx
|
||||
|
||||
使用 Kubernetes 1.16 之前版本创建的集群将具有 `OnDelete`的 `ingress-nginx` `updateStrategy`。使用 Kubernetes 1.16 或更高版本创建的集群将具有 `RollingUpdate`。
|
||||
|
||||
如果 `ingress-nginx` 的 `updateStrategy` 是 `OnDelete`，则需要删除这些 pod 以获得 deployment 正确的版本。
|
||||
|
||||
### Cluster Agent 配置和 Fleet Agent 配置
|
||||
|
||||
你可以为 Cluster Agent 和集群的 Fleet Agent 配置调度字段和资源限制。你可以使用这些字段来自定义容忍度、亲和性规则和资源要求。其他容忍度会被尾附到默认容忍度和 Control Plane 节点污点的列表中。如果你定义了自定义亲和性规则，它们将覆盖全局默认亲和性设置。定义资源要求会在以前没有的地方设置请求或限制。
|
||||
|
||||
:::note
|
||||
|
||||
有了这个选项，你可以覆盖或删除运行集群所需的规则。我们强烈建议你不要删除或覆盖这些规则和其他亲和性规则，因为这可能会导致不必要的影响：
|
||||
|
||||
- `affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution` 用于 `cattle-cluster-agent`
|
||||
- `cluster-agent-default-affinity` 用于 `cattle-cluster-agent`
|
||||
- `fleet-agent-default-affinity` 用于 `fleet-agent`
|
||||
|
||||
:::
|
||||
|
||||
如果将 Rancher 降级到 v2.7.4 或更低版本，你的更改将丢失，而且 Agent 将在没有你的自定义设置的情况下重新部署。重新部署时，Fleet Agent 将回退到使用内置默认值。如果降级期间 Fleet 版本没有更改，则不会立即重新部署。
|
||||
|
||||
|
||||
## RKE 集群配置文件参考
|
||||
|
||||
高级用户可以创建一个 RKE 配置文件，而不是使用 Rancher UI 来为集群选择 Kubernetes 选项。配置文件可以让你在 RKE 安装中设置任何[可用选项](https://rancher.com/docs/rke/latest/en/config-options/)（`system_images` 配置除外）。使用 Rancher UI 或 API 创建集群时，不支持 `system_images` 选项。
|
||||
|
||||
有关 YAML 中 RKE Kubernetes 集群的可配置选项的完整参考，请参阅 [RKE 文档](https://rancher.com/docs/rke/latest/en/config-options/)。
|
||||
|
||||
### Rancher 中的配置文件结构
|
||||
|
||||
RKE（Rancher Kubernetes Engine）是 Rancher 用来配置 Kubernetes 集群的工具。过去，Rancher 的集群配置文件与 [RKE 配置文件](https://rancher.com/docs/rke/latest/en/example-yamls/)的结构是一致的。但由于 Rancher 文件结构发生了变化，因此在 Rancher 中，RKE 集群配置项与非 RKE 配置项是分开的。所以，你的集群配置需要嵌套在集群配置文件中的 `rancher_kubernetes_engine_config` 参数下。使用早期版本的 Rancher 创建的集群配置文件需要针对这种格式进行更新。以下是一个集群配置文件示例：
|
||||
|
||||
<details id="v2.3.0-cluster-config-file">
|
||||
<summary>集群配置文件示例</summary>
|
||||
|
||||
```yaml
|
||||
#
|
||||
# Cluster Config
|
||||
#
|
||||
docker_root_dir: /var/lib/docker
|
||||
enable_cluster_alerting: false
|
||||
enable_cluster_monitoring: false
|
||||
enable_network_policy: false
|
||||
local_cluster_auth_endpoint:
|
||||
enabled: true
|
||||
#
|
||||
# Rancher Config
|
||||
#
|
||||
rancher_kubernetes_engine_config: # Your RKE template config goes here.
|
||||
addon_job_timeout: 30
|
||||
authentication:
|
||||
strategy: x509
|
||||
ignore_docker_version: true
|
||||
#
|
||||
# # 目前仅支持 Nginx ingress provider
|
||||
# # 要禁用 Ingress controller，设置 `provider: none`
|
||||
# # 要在指定节点上禁用 Ingress，使用 node_selector，例如：
|
||||
# provider: nginx
|
||||
# node_selector:
|
||||
# app: ingress
|
||||
#
|
||||
ingress:
|
||||
provider: nginx
|
||||
kubernetes_version: v1.15.3-rancher3-1
|
||||
monitoring:
|
||||
provider: metrics-server
|
||||
#
|
||||
# If you are using calico on AWS
|
||||
#
|
||||
# network:
|
||||
# plugin: calico
|
||||
# calico_network_provider:
|
||||
# cloud_provider: aws
|
||||
#
|
||||
# # To specify flannel interface
|
||||
#
|
||||
# network:
|
||||
# plugin: flannel
|
||||
# flannel_network_provider:
|
||||
# iface: eth1
|
||||
#
|
||||
# # To specify flannel interface for canal plugin
|
||||
#
|
||||
# network:
|
||||
# plugin: canal
|
||||
# canal_network_provider:
|
||||
# iface: eth1
|
||||
#
|
||||
network:
|
||||
options:
|
||||
flannel_backend_type: vxlan
|
||||
plugin: canal
|
||||
#
|
||||
# services:
|
||||
# kube-api:
|
||||
# service_cluster_ip_range: 10.43.0.0/16
|
||||
# kube-controller:
|
||||
# cluster_cidr: 10.42.0.0/16
|
||||
# service_cluster_ip_range: 10.43.0.0/16
|
||||
# kubelet:
|
||||
# cluster_domain: cluster.local
|
||||
# cluster_dns_server: 10.43.0.10
|
||||
#
|
||||
services:
|
||||
etcd:
|
||||
backup_config:
|
||||
enabled: true
|
||||
interval_hours: 12
|
||||
retention: 6
|
||||
safe_timestamp: false
|
||||
creation: 12h
|
||||
extra_args:
|
||||
election-timeout: 5000
|
||||
heartbeat-interval: 500
|
||||
gid: 0
|
||||
retention: 72h
|
||||
snapshot: false
|
||||
uid: 0
|
||||
kube_api:
|
||||
always_pull_images: false
|
||||
pod_security_policy: false
|
||||
service_node_port_range: 30000-32767
|
||||
ssh_agent_auth: false
|
||||
windows_prefered_cluster: false
|
||||
```
|
||||
</details>
|
||||
|
||||
### 默认 DNS 提供商
|
||||
|
||||
下表显示了默认部署的 DNS 提供商。有关如何配置不同 DNS 提供商的更多信息，请参阅 [DNS 提供商相关的 RKE 文档](https://rancher.com/docs/rke/latest/en/config-options/add-ons/dns/)。CoreDNS 只能在 Kubernetes v1.12.0 及更高版本上使用。
|
||||
|
||||
| Rancher 版本 | Kubernetes 版本 | 默认 DNS 提供商 |
|
||||
|-------------|--------------------|----------------------|
|
||||
| v2.2.5 及更高版本 | v1.14.0 及更高版本 | CoreDNS |
|
||||
| v2.2.5 及更高版本 | v1.13.x 及更低版本 | kube-dns |
|
||||
| v2.2.4 及更低版本 | 任意 | kube-dns |
|
||||
|
||||
## YAML 中的 Rancher 特定参数
|
||||
|
||||
除了 RKE 配置文件选项外，还有可以在配置文件 (YAML) 中配置的 Rancher 特定设置如下。
|
||||
|
||||
### docker_root_dir
|
||||
|
||||
请参阅 [Docker 根目录](#docker-根目录)。
|
||||
|
||||
### enable_cluster_monitoring
|
||||
|
||||
启用或禁用[集群监控](../../../integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md)的选项。
|
||||
|
||||
### enable_network_policy
|
||||
|
||||
启用或禁用项目网络隔离的选项。
|
||||
|
||||
如果你使用支持执行 Kubernetes 网络策略的 RKE 网络插件（例如 Canal 或 Cisco ACI 插件），则可以使用项目网络隔离。
|
||||
|
||||
### local_cluster_auth_endpoint
|
||||
|
||||
请参阅[授权集群端点](#授权集群端点)。
|
||||
|
||||
示例：
|
||||
|
||||
```yaml
|
||||
local_cluster_auth_endpoint:
|
||||
enabled: true
|
||||
fqdn: "FQDN"
|
||||
ca_certs: |-
|
||||
-----BEGIN CERTIFICATE-----
|
||||
...
|
||||
-----END CERTIFICATE-----
|
||||
```
|
||||
|
||||
### 自定义网络插件
|
||||
|
||||
你可以使用 RKE 的[用户定义的附加组件功能](https://rancher.com/docs/rke/latest/en/config-options/add-ons/user-defined-add-ons/)来添加自定义网络插件。部署 Kubernetes 集群之后，你可以定义要部署的任何附加组件。
|
||||
|
||||
有两种方法可以指定附加组件：
|
||||
|
||||
- [内嵌附加组件](https://rancher.com/docs/rke/latest/en/config-options/add-ons/user-defined-add-ons/#in-line-add-ons)
|
||||
- [为附加组件引用 YAML 文件](https://rancher.com/docs/rke/latest/en/config-options/add-ons/user-defined-add-ons/#referencing-yaml-files-for-add-ons)
|
||||
|
||||
有关如何通过编辑 `cluster.yml` 来配置自定义网络插件的示例，请参阅 [RKE 文档](https://rancher.com/docs/rke/latest/en/config-options/add-ons/network-plugins/custom-network-plugin-example)。
|
||||
+2
-2
@@ -6,7 +6,7 @@ title: DNS
|
||||
|
||||
请确保你配置了正确的 kubeconfig（例如，为 Rancher HA 配置了 `export KUBECONFIG=$PWD/kube_config_cluster.yml`）或通过 UI 使用了嵌入式 kubectl。
|
||||
|
||||
在运行 DNS 检查之前，请检查集群的[默认 DNS 提供商](../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md#默认-dns-提供商)，并确保[覆盖网络正常运行](networking.md#检查覆盖网络是否正常运行)，因为这也可能导致 DNS 解析（部分）失败。
|
||||
Before running the DNS checks, make sure that [the overlay network is functioning correctly](networking.md#check-if-overlay-network-is-functioning-correctly) for your DNS provider as this can also be the reason why DNS resolution (partly) fails.
|
||||
|
||||
## 检查 DNS pod 是否正在运行
|
||||
|
||||
@@ -199,7 +199,7 @@ services:
|
||||
|
||||
:::
|
||||
|
||||
请参阅[使用 YAML 编辑集群](../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md#使用-yaml-编辑集群)了解如何应用此修改。集群配置完成后，你必须删除 kube-dns pod 以激活 pod 中的新设置：
|
||||
请参阅使用 YAML 编辑集群了解如何应用此修改。集群配置完成后，你必须删除 kube-dns pod 以激活 pod 中的新设置：
|
||||
|
||||
```
|
||||
kubectl delete pods -n kube-system -l k8s-app=kube-dns
|
||||
|
||||
+12
-12
@@ -74,22 +74,22 @@ kubectl -n kube-system get endpoints kube-scheduler -o jsonpath='{.metadata.anno
|
||||
|
||||
## Ingress Controller
|
||||
|
||||
默认的 Ingress Controller 是 NGINX，作为 DaemonSet 部署在 `ingress-nginx` 命名空间中。Pod 仅会调度到具有 `worker` 角色的节点。
|
||||
默认的 Ingress Controller 是 Traefik，作为 DaemonSet 部署在 `traefik` 命名空间中。Pod 仅会调度到具有 `worker` 角色的节点。
|
||||
|
||||
检查 pod 是否运行在所有节点上：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get pods -o wide
|
||||
kubectl -n traefik get pods -o wide
|
||||
```
|
||||
|
||||
输出示例：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get pods -o wide
|
||||
kubectl -n traefik get pods -o wide
|
||||
NAME READY STATUS RESTARTS AGE IP NODE
|
||||
default-http-backend-797c5bc547-kwwlq 1/1 Running 0 17m x.x.x.x worker-1
|
||||
nginx-ingress-controller-4qd64 1/1 Running 0 14m x.x.x.x worker-1
|
||||
nginx-ingress-controller-8wxhm 1/1 Running 0 13m x.x.x.x worker-0
|
||||
traefik-4qd64 1/1 Running 0 14m x.x.x.x worker-1
|
||||
traefik-8wxhm 1/1 Running 0 13m x.x.x.x worker-0
|
||||
```
|
||||
|
||||
如果 pod 无法运行（即状态不是 **Running**，Ready 状态未显示 `1/1`，或者有大量 Restarts），请检查 pod 详细信息，日志和命名空间事件。
|
||||
@@ -97,27 +97,27 @@ nginx-ingress-controller-8wxhm 1/1 Running 0 13m
|
||||
### Pod 详细信息
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx describe pods -l app=ingress-nginx
|
||||
kubectl -n traefik describe pods -l app=traefik
|
||||
```
|
||||
|
||||
### Pod 容器日志
|
||||
|
||||
下面的命令可以显示所有标记为 “app=ingress-nginx” 的 pod 的日志，但是由于 `kubectl logs` 命令的限制，它只会显示 10 行日志。有关详细信息，请参阅 `kubectl logs -h` 的 `--tail`。
|
||||
下面的命令可以显示所有标记为 “app=traefik” 的 pod 的日志，但是由于 `kubectl logs` 命令的限制，它只会显示 10 行日志。有关详细信息，请参阅 `kubectl logs -h` 的 `--tail`。
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx logs -l app=ingress-nginx
|
||||
kubectl -n traefik logs -l app=traefik
|
||||
```
|
||||
|
||||
如果需要查看完整的日志，请在命令中尾随 pod 名称：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx logs <pod name>
|
||||
kubectl -n traefik logs <pod name>
|
||||
```
|
||||
|
||||
### 命名空间事件
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get events
|
||||
kubectl -n traefik get events
|
||||
```
|
||||
|
||||
### 调试日志
|
||||
@@ -125,7 +125,7 @@ kubectl -n ingress-nginx get events
|
||||
要启用调试日志：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx patch ds nginx-ingress-controller --type='json' -p='[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--v=5"}]'
|
||||
kubectl -n traefik patch ds traefik --type='json' -p='[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--v=5"}]'
|
||||
```
|
||||
|
||||
### 检查配置
|
||||
@@ -133,7 +133,7 @@ kubectl -n ingress-nginx patch ds nginx-ingress-controller --type='json' -p='[{"
|
||||
在每个 pod 中检索生成的配置：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get pods -l app=ingress-nginx --no-headers -o custom-columns=.NAME:.metadata.name | while read pod; do kubectl -n ingress-nginx exec $pod -- cat /etc/nginx/nginx.conf; done
|
||||
kubectl -n traefik get pods -l app=traefik --no-headers -o custom-columns=.NAME:.metadata.name | while read pod; do kubectl -n traefik exec $pod -- cat /etc/nginx/nginx.conf; done
|
||||
```
|
||||
|
||||
## Rancher Agents
|
||||
|
||||
+1
-1
@@ -65,7 +65,7 @@ rancher rancher.yourdomain.com x.x.x.x,x.x.x.x,x.x.x.x 80, 443 2m
|
||||
如果访问你配置的 Rancher FQDN 时没有显示 UI，请检查 Ingress Controller 日志以查看尝试访问 Rancher 时发生了什么：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx logs -l app=ingress-nginx
|
||||
kubectl -n traefik logs -l app=traefik
|
||||
```
|
||||
|
||||
## Leader 选举
|
||||
|
||||
+1
-4
@@ -6,10 +6,7 @@ title: TLS 设置
|
||||
|
||||
## 在高可用 Kubernetes 集群中运行 Rancher
|
||||
|
||||
当你在 Kubernetes 集群内安装 Rancher 时，TLS 会在集群的 Ingress Controller 上卸载。可用的 TLS 设置取决于使用的 Ingress Controller：
|
||||
|
||||
* nginx-ingress-controller（default RKE2 默认）：[默认的 TLS 版本和密码](https://kubernetes.github.io/ingress-nginx/user-guide/tls/#default-tls-version-and-ciphers)。
|
||||
* traefik（K3s 默认）：[TLS 选项](https://doc.traefik.io/traefik/https/tls/#tls-options)。
|
||||
When you install a Rancher managed Kubernetes cluster, TLS is offloaded at the cluster's ingress controller. Traefik is the default ingress for K3s and can be used with RKE2, refer to [TLS Options](https://doc.traefik.io/traefik/https/tls/#tls-options) for further information.
|
||||
|
||||
## 在单个 Docker 容器中运行 Rancher
|
||||
|
||||
|
||||
+7
-12
@@ -4,14 +4,12 @@ title: 设置 Amazon NLB 网络负载均衡器
|
||||
|
||||
本文介绍了如何在 Amazon EC2 服务中设置 Amazon NLB 网络负载均衡器，用于将流量转发到 EC2 上的多个实例中。
|
||||
|
||||
这些示例中，负载均衡器将流量转发到三个 Rancher Server 节点。如果 Rancher 安装在 RKE Kubernetes 集群上，则需要三个节点。如果 Rancher 安装在 K3s Kubernetes 集群上，则只需要两个节点。
|
||||
这些示例中，负载均衡器将流量转发到三个 Rancher Server 节点。如果 Rancher 安装在 K3s Kubernetes 集群上，则只需要两个节点。
|
||||
|
||||
本文介绍的只是配置负载均衡器的其中一种方式。其他负载均衡器如传统负载路由器（Classic Load Balancer）和应用负载路由器（Application Load Balancer），也可以将流量转发到 Rancher Server 节点。
|
||||
|
||||
Rancher 仅支持使用 Amazon NLB 以 `TCP` 模式终止 443 端口的流量，而不支持 `TLS` 模式。这试因为在 NLB 终止时，NLB 不会将正确的标头注入请求中。如果你想使用由 Amazon Certificate Manager (ACM) 托管的证书，请使用 ALB。
|
||||
|
||||
|
||||
|
||||
## 要求
|
||||
|
||||
你已在 EC2 中创建了 Linux 实例。此外，负载均衡器会把流量转发到这些节点。
|
||||
@@ -22,7 +20,7 @@ Rancher 仅支持使用 Amazon NLB 以 `TCP` 模式终止 443 端口的流量，
|
||||
|
||||
配置 NLB 的第一个步骤是创建两个目标组。一般来说，只需要端口 443 就可以访问 Rancher。但是，由于端口 80 的流量会被自动重定向到端口 443，因此，你也可以为端口 80 也添加一个监听器。
|
||||
|
||||
不管使用的是 NGINX Ingress 还是 Traefik Ingress Controller，Ingress 都应该将端口 80 的流量重定向到端口 443。以下为操作步骤：
|
||||
The Traefik Ingress should redirect traffic from port 80 to port 443.
|
||||
|
||||
1. 登录到 [Amazon AWS 控制台](https://console.aws.amazon.com/ec2/)。确保选择的**区域**是你创建 EC2 实例 （Linux 节点）的区域。
|
||||
1. 选择**服务** > **EC2**，找到**负载均衡器**并打开**目标组**。
|
||||
@@ -30,7 +28,7 @@ Rancher 仅支持使用 Amazon NLB 以 `TCP` 模式终止 443 端口的流量，
|
||||
|
||||
:::note
|
||||
|
||||
不同 Ingress 的健康检查处理方法不同。详情请参阅[本节](#nginx-ingress-和-traefik-ingress-的健康检查路径)。
|
||||
For details on Traefik Ingress health checks, refer to [this section.](#health-check-paths-for-traefik-ingresses)
|
||||
|
||||
:::
|
||||
|
||||
@@ -163,13 +161,10 @@ AWS 完成 NLB 创建后，单击**关闭**。
|
||||
|
||||
6. 单击右上角的**保存**。
|
||||
|
||||
## NGINX Ingress 和 Traefik Ingress 的健康检查路径
|
||||
## Health Check Paths for Traefik Ingresses
|
||||
|
||||
K3s 和 RKE Kubernetes 集群使用的默认 Ingress 不同，因此对应的健康检查方式也不同。
|
||||
K3s Kubernetes clusters use Traefik as the default Ingress.
|
||||
|
||||
RKE Kubernetes 集群默认使用 NGINX Ingress，而 K3s Kubernetes 集群默认使用 Traefik Ingress。
|
||||
The health check path is `/ping`. By default `/ping` is always matched (regardless of Host), and a response from [Traefik itself](https://docs.traefik.io/operations/ping/) is always served.
|
||||
|
||||
- **Traefik**：默认健康检查路径是 `/ping`。默认情况下，不管主机如何，`/ping` 总是匹配，而且 [Traefik 自身](https://docs.traefik.io/operations/ping/)总会响应。
|
||||
- **NGINX Ingress**：NGINX Ingress Controller 的默认后端有一个 `/healthz` 端点。默认情况下，不管主机如何，`/healthz` 总是匹配，而且 [`ingress-nginx` 自身](https://github.com/kubernetes/ingress-nginx/blob/0cbe783f43a9313c9c26136e888324b1ee91a72f/charts/ingress-nginx/values.yaml#L212)总会响应。
|
||||
|
||||
想要精确模拟健康检查，最好是使用 Host 标头（Rancher hostname）加上 `/ping` 或 `/healthz`（分别对应 K3s 和 RKE 集群）来获取 Rancher Pod 的响应，而不是 Ingress 的响应。
|
||||
To simulate an accurate health check, it is a best practice to use the Host header (Rancher hostname) combined with `/ping` or `/healthz` wherever possible, to get a response from the Rancher Pods, not the Ingress.
|
||||
|
||||
+5
-5
@@ -87,7 +87,7 @@ systemctl start rke2-server.service
|
||||
|
||||
1. 安装 Kubernetes 命令行工具 [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl)。
|
||||
2. 复制 `/etc/rancher/rke2/rke2.yaml` 文件并保存到本地主机的 `~/.kube/config` 目录上。
|
||||
3. 在 kubeconfig 文件中，`server` 的参数为 localhost。在端口 6443 上将服务器配置为 controlplane 负载均衡器的 DNS（RKE2 Kubernetes API Server 使用端口 6443，而 Rancher Server 将通过 NGINX Ingress 在端口 80 和 443 上提供服务。）以下是一个示例 `rke2.yaml`：
|
||||
3. 在 kubeconfig 文件中，`server` 的参数为 localhost。在端口 6443 上将服务器配置为 controlplane 负载均衡器的 DNS（RKE2 Kubernetes API Server 使用端口 6443，而 Rancher Server 将通过 Traefik Ingress 在端口 80 和 443 上提供服务。）以下是一个示例 `rke2.yaml`：
|
||||
|
||||
```yml
|
||||
apiVersion: v1
|
||||
@@ -136,7 +136,8 @@ kube-system etcd-rke2-server-2 1/1 Ru
|
||||
kube-system etcd-rke2-server-3 1/1 Running 0 56s
|
||||
kube-system helm-install-rke2-canal-hs6sx 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-rke2-coredns-xmzm8 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-rke2-ingress-nginx-flwnl 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-traefik-crd-z8vsz 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-traefik-flwnl 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-rke2-metrics-server-7sggn 0/1 Completed 0 2m17s
|
||||
kube-system kube-apiserver-rke2-server-1 1/1 Running 0 116s
|
||||
kube-system kube-apiserver-rke2-server-2 1/1 Running 0 66s
|
||||
@@ -156,9 +157,8 @@ kube-system rke2-canal-swfmq 2/2 Ru
|
||||
kube-system rke2-coredns-rke2-coredns-547d5499cb-6tvwb 1/1 Running 0 92s
|
||||
kube-system rke2-coredns-rke2-coredns-547d5499cb-rdttj 1/1 Running 0 2m8s
|
||||
kube-system rke2-coredns-rke2-coredns-autoscaler-65c9bb465d-85sq5 1/1 Running 0 2m8s
|
||||
kube-system rke2-ingress-nginx-controller-69qxc 1/1 Running 0 52s
|
||||
kube-system rke2-ingress-nginx-controller-7hprp 1/1 Running 0 52s
|
||||
kube-system rke2-ingress-nginx-controller-x658h 1/1 Running 0 52s
|
||||
kube-system traefik-7c844b766f-m9p2w 1/1 Running 0 52s
|
||||
kube-system traefik-7c844b766f-s4l9k 1/1 Running 0 52s
|
||||
kube-system rke2-metrics-server-6564db4569-vdfkn 1/1 Running 0 66s
|
||||
```
|
||||
|
||||
|
||||
+1
-1
@@ -43,7 +43,7 @@ SUSE Linux 可能有一个防火墙，默认情况下会阻止所有端口。在
|
||||
|
||||
### Flatcar Container Linux 节点
|
||||
|
||||
使用 Flatcar Container Linux 节点[通过 Rancher 启动 Kubernetes](../launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) 时，需要在 [Cluster Config 文件](../../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md#rke-集群配置文件参考)中使用如下配置：
|
||||
使用 Flatcar Container Linux 节点[通过 Rancher 启动 Kubernetes](../launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) 时，需要在 Cluster Config 文件 中使用如下配置：
|
||||
|
||||
<Tabs>
|
||||
<TabItem value="Canal">
|
||||
|
||||
+1
-11
@@ -3,14 +3,6 @@ title: Ingress 配置
|
||||
description: Ingress 配置
|
||||
---
|
||||
|
||||
:::note
|
||||
|
||||
在 Kubernetes v1.21 及更高版本中，NGINX Ingress Controller 不再默认运行在 hostNetwork 中。它改为将 hostPorts 用于端口 80 和端口 443，因此你可以将准入 Webhook 配置为只能通过 ClusterIP 访问。这确保了只能从集群内部访问 webhook。
|
||||
|
||||
由于 controller 的这一更改，默认 RKE1 配置不再将 `hostNetwork` 设置为 `true`。但是，你必须将 `hostNetwork` 设置为 `true` 才能使基于 TCP 和 UDP 的 Service 正常工作。为此，请[编辑](../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md#使用-yaml-编辑集群)集群的 YAML 并按照[官方 RKE1 文档](https://rke.docs.rancher.com/config-options/add-ons/ingress-controllers#configuring-network-options)中的步骤操作。
|
||||
|
||||
:::
|
||||
|
||||
## 指定要使用的主机名
|
||||
|
||||
如果使用此选项，Ingress 会将主机名请求路由到你指定的服务或工作负载。
|
||||
@@ -36,6 +28,4 @@ description: Ingress 配置
|
||||
|
||||
## 标签和注释
|
||||
|
||||
添加[标签](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/)和/或[注释](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)来为你的 Ingress Controller 提供元数据。
|
||||
|
||||
有关可用的注释列表，请参阅 [Nginx Ingress Controller 文档](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/)。
|
||||
Please refer to the Traefik documentation for the full list of Ingress NGINX annotations that are [supported](https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/ingress-nginx/#annotations-support) and [unsupported](https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/ingress-nginx/#unsupported-annotations) by Traefik's kubernetesIngressNginx provider.
|
||||
|
||||
+5
-15
@@ -7,13 +7,11 @@ Kubernetes 支持四层负载均衡和七层负载均衡。
|
||||
|
||||
## 四层负载均衡器
|
||||
|
||||
四层负载均衡器（或外部负载均衡器）将流量转发到 Nodeport。四层负载均衡器支持转发 HTTP 和 TCP 流量。
|
||||
|
||||
通常情况下，四层负载均衡器由底层云提供商支持，因此，如果你在裸金属服务器和 vSphere 集群上部署 RKE 集群，则不支持四层负载均衡器。但是，单个[全局管理的 config-map](https://kubernetes.github.io/ingress-nginx/user-guide/exposing-tcp-udp-services/) 可用于在 NGINX 或第三方 Ingress 上公开服务。
|
||||
Layer-4 load balancer (or the external load balancer) forwards traffic to NodePorts. Layer-4 load balancer allows you to forward both HTTP and TCP traffic.
|
||||
|
||||
:::note
|
||||
|
||||
你可以使用非云负载均衡器（例如 [MetalLB](https://metallb.universe.tf/)）来部署集群。但是，该用例比云提供商支持的四层负载均衡器更高级，而且不可以在 Rancher 或 RKE 中配置。
|
||||
It is possible to deploy a cluster with a non-cloud load balancer, such as [MetalLB.](https://metallb.universe.tf/) However, that use case is more advanced than the Layer-4 load balancer supported by a cloud provider, and it is not configurable in Rancher.
|
||||
|
||||
:::
|
||||
|
||||
@@ -26,17 +24,13 @@ Kubernetes 支持四层负载均衡和七层负载均衡。
|
||||
| Amazon EKS | 由 AWS 云提供商支持 |
|
||||
| Google GKE | 由 GCE 云提供商支持 |
|
||||
| Azure AKS | 由 Azure 云提供商支持 |
|
||||
| EC2 上的 RKE | 由 AWS 云提供商支持 |
|
||||
| DigitalOcean 上的 RKE | 受限的 NGINX 或第三方 Ingress\* |
|
||||
| vSphere 上的 RKE | 受限的 NGINX 或第三方 Ingress\* |
|
||||
| 自定义主机上的 RKE<br/>（例如裸金属服务器） | 受限的 NGINX 或第三方 Ingress\* |
|
||||
| 第三方 MetalLB | 受限的 NGINX 或第三方 Ingress\* |
|
||||
| 第三方 MetalLB | third-party Ingress\* |
|
||||
|
||||
\* 可以通过单个[全局管理的 config-map](https://kubernetes.github.io/ingress-nginx/user-guide/exposing-tcp-udp-services/) 来公开服务。
|
||||
|
||||
## 七层负载均衡器
|
||||
|
||||
七层负载均衡器（或 Ingress Controller）支持基于主机和路径的负载均衡和 SSL 终止。七层负载均衡器仅转发 HTTP 和 HTTPS 流量，因此它们仅侦听端口 80 和 443。亚马逊和谷歌等云提供商支持七层负载均衡器。此外，RKE 集群部署了 Nginx Ingress Controller。
|
||||
Layer-7 load balancer (or the ingress controller) supports host and path-based load balancing and SSL termination. Layer-7 load balancer only forwards HTTP and HTTPS traffic and therefore they listen on ports 80 and 443 only. Cloud providers such as Amazon and Google support layer-7 load balancer.
|
||||
|
||||
### 七层负载均衡支持
|
||||
|
||||
@@ -47,16 +41,12 @@ Kubernetes 支持四层负载均衡和七层负载均衡。
|
||||
| Amazon EKS | 由 AWS 云提供商支持 |
|
||||
| Google GKE | 由 GKE 云提供商支持 |
|
||||
| Azure AKS | 不支持 |
|
||||
| EC2 上的 RKE | Nginx Ingress Controller |
|
||||
| DigitalOcean 上的 RKE | Nginx Ingress Controller |
|
||||
| vSphere 上的 RKE | Nginx Ingress Controller |
|
||||
| 自定义主机上的 RKE<br/>（例如裸金属服务器） | Nginx Ingress Controller |
|
||||
|
||||
### 七层负载均衡器中的主机名
|
||||
|
||||
一些托管在云上的七层负载均衡器（例如 AWS 上的 ALB Ingress Controller）会为 Ingress 规则公开 DNS 地址。你需要（使用 CNAME）将你的域名映射到七层负载均衡器生成的 DNS 地址。
|
||||
|
||||
其他七层负载均衡器（例如 Google Load Balancer 或 Nginx Ingress Controller）会直接公开一个或多个 IP 地址。Google Load Balancer 提供了一个可路由的 IP 地址。Nginx Ingress Controller 公开了运行 Nginx Ingress Controller 的所有节点的外部 IP。你可以执行以下任一操作：
|
||||
Other layer-7 load balancers, such as the Google Load Balancer, directly expose one or more IP addresses. Google Load Balancer provides a single routable IP address. You can do either of the following:
|
||||
|
||||
1. 配置你自己的 DNS，从而（使用 A 记录）将你的域名映射到七层负载均衡器公开的 IP 地址。
|
||||
2. 让 Rancher 为你的 Ingress 规则生成一个 xip.io 主机名。Rancher 将使用你公开的其中一个 IP（假设是 `a.b.c.d`）生成一个主机名（即 `<ingressname>.<namespace>.a.b.c.d.xip.io`）。
|
||||
|
||||
+1
-9
@@ -48,18 +48,10 @@ Rancher 支持两种类型的负载均衡器：
|
||||
|
||||
Ingress 与一个或多个 Ingress Controller 一起动态路由 service 的请求。Ingress 收到请求时，集群中的 Ingress Controller 会根据你配置的 service 子域或路径规则将请求定向到正确的 service。
|
||||
|
||||
每个 Kubernetes Ingress 资源都对应一个 `/etc/nginx/sites-available/` 中的文件，其中包含一个配置对特定文件和文件夹的请求的 `server{}` 配置块。
|
||||
|
||||
Ingress 能为你的集群创建一个入口端口（与负载均衡器类似），可以位于集群的内部或外部。RKE 启动的集群中的 Ingress 和 Ingress Controller 由 [Nginx](https://www.nginx.com/) 提供支持。
|
||||
Ingress 能为你的集群创建一个入口端口（与负载均衡器类似），可以位于集群的内部或外部。
|
||||
|
||||
Ingress 还支持其他功能，例如 SSL 终止、基于名称的虚拟主机等。
|
||||
|
||||
:::note 在高可用性配置中使用 Rancher：
|
||||
|
||||
请避免将 Ingress 添加到 `local` 集群。Rancher 将 Nginx Ingress Controller 作为 Rancher 管理的 _所有_ 集群的全局入口点，其中包括 `local` 集群。因此，当用户尝试访问应用程序时，Rancher 可能会由于重新加载 Nginx 配置而断开连接。要解决这个问题，我们建议你仅在通过 Rancher 启动的集群中部署应用程序。
|
||||
|
||||
:::
|
||||
|
||||
- 有关如何在 Rancher 中设置 Ingress 的更多信息，请参阅 [Ingress](add-ingresses.md)。
|
||||
- 有关 Ingress 和 Ingress Controller 的完整信息，请参阅 [Kubernetes Ingress 文档](https://kubernetes.io/docs/concepts/services-networking/ingress/)。
|
||||
- 在项目中使用 Ingress 时，你可以通过设置全局 DNS 条目来将 Ingress 主机名编程到外部 DNS。
|
||||
|
||||
+2
-2
@@ -12,7 +12,7 @@ title: 在 Nutanix AOS 中配置 Kubernetes 集群
|
||||
|
||||
有关配置 Nutanix AOS 节点模板的详细信息，请参阅 [Nutanix AOS 节点模板配置参考](../../../../../reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/nutanix.md)。
|
||||
|
||||
有关在 Rancher 中配置 RKE Kubernetes 集群的详细信息，请参阅[集群配置参考](../../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md)。
|
||||
有关在 Rancher 中配置 RKE Kubernetes 集群的详细信息，请参阅集群配置参考。
|
||||
|
||||
- [Nutanix AOS 中的准备工作](#nutanix-aos-中的准备工作)
|
||||
- [创建 Nutanix AOS 集群](#创建-nutanix-aos-集群)
|
||||
@@ -70,7 +70,7 @@ title: 在 Nutanix AOS 中配置 Kubernetes 集群
|
||||
1. 单击 **Nutanix**。
|
||||
1. 输入**集群名称**，然后点击**继续**。
|
||||
1. 使用**成员角色**为集群配置用户授权。点击**添加成员**添加可以访问集群的用户。使用**角色**下拉菜单为每个用户设置权限。
|
||||
1. 使用**集群选项**选择要安装的 Kubernetes 版本、要使用的网络提供商，以及是否启用项目网络隔离。要查看更多集群选项，请单击**显示高级选项**。如需获取配置集群的帮助，请参阅 [RKE 集群配置参考](../../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md)。
|
||||
1. 使用**集群选项**选择要安装的 Kubernetes 版本、要使用的网络提供商，以及是否启用项目网络隔离。要查看更多集群选项，请单击**显示高级选项**。如需获取配置集群的帮助，请参阅 RKE 集群配置参考。
|
||||
1. 将一个或多个节点池添加到你的集群。每个节点池都使用节点模板来配置新节点。有关节点池的更多信息，包括为节点分配 Kubernetes 角色的最佳实践，请参阅[本节](../../../launch-kubernetes-with-rancher/use-new-nodes-in-an-infra-provider/use-new-nodes-in-an-infra-provider.md#节点池)。
|
||||
1. 检查并确认你的选项。然后单击**创建**。
|
||||
|
||||
|
||||
+1
-1
@@ -8,7 +8,7 @@ title: vSphere 存储
|
||||
|
||||
## 先决条件
|
||||
|
||||
为了在 [Rancher Kubernetes Engine (RKE)](../../launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) 集群中配置 vSphere 卷，[vSphere cloud provider](https://rancher.com/docs/rke/latest/en/config-options/cloud-providers/vsphere) 必须在[集群选项](../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md)中显式启用。
|
||||
为了在 [RKE2](../../launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) 集群中配置 vSphere 卷，[vSphere cloud provider](https://rancher.com/docs/rke/latest/en/config-options/cloud-providers/vsphere) 必须在[集群选项](../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke2-cluster-configuration.md#cloud-provider)中显式启用。
|
||||
|
||||
## 创建一个 StorageClass
|
||||
|
||||
|
||||
+5
-5
@@ -205,13 +205,13 @@ Prometheus 从称为 [exporter](https://prometheus.io/docs/instrumenting/exporte
|
||||
Prometheus 直接抓取以下 Kubernetes 组件：
|
||||
|
||||
- kubelet\*
|
||||
- ingress-nginx\*\*
|
||||
- Traefik\*\*
|
||||
- coreDns/kubeDns
|
||||
- kube-api-server
|
||||
|
||||
\* 你可以选择通过 `hardenedKubelet.enabled` 来使用 PushProx，但这不是默认设置。
|
||||
|
||||
\*\* RKE2 集群默认部署 ingress-nginx，并将其视为内部 Kubernetes 组件。
|
||||
\*\* For RKE2 clusters, Traefik is deployed by default and treated as an internal Kubernetes component.
|
||||
|
||||
|
||||
### 基于 Kubernetes 发行版抓取指标
|
||||
@@ -227,11 +227,11 @@ Prometheus 直接抓取以下 Kubernetes 组件：
|
||||
| etcd | rke2Etcd.enabled | kubeAdmEtcd.enabled | 不可用 |
|
||||
| kube-proxy | rke2Proxy.enabled | kubeAdmProxy.enabled | k3sServer.enabled |
|
||||
| kubelet | 收集 kubelet 直接公开的指标 | 收集 kubelet 直接公开的指标 | 收集 kubelet 直接公开的指标 |
|
||||
| ingress-nginx* | 收集 kubelet 直接公开的指标，由 rke2IngressNginx.enabled 公开 | 不可用 | 不可用 |
|
||||
| Traefik* | Collects metrics directly exposed by kubelet | Not available | Not available |
|
||||
| coreDns/kubeDns | 收集 coreDns/kubeDns 直接公开的指标 | 收集 coreDns/kubeDns 直接公开的指标 | 收集 coreDns/kubeDns 直接公开的指标 |
|
||||
| kube-api-server | 收集 kube-api-server 直接公开的指标 | 收集 kube-appi-server 直接公开的指标 | 收集 kube-api-server 直接公开的指标 |
|
||||
|
||||
\* RKE2 集群默认部署 ingress-nginx，并将其视为内部 Kubernetes 组件。
|
||||
\* For RKE2 clusters, Traefik is deployed by default and treated as an internal Kubernetes component.
|
||||
|
||||
### 名词解释
|
||||
|
||||
@@ -240,6 +240,6 @@ Prometheus 直接抓取以下 Kubernetes 组件：
|
||||
- **etcd**：Kubernetes 内部组件，它是 Kubernetes 用于持久存储所有集群信息的分布式键/值存储。
|
||||
- **kube-proxy**：内部 Kubernetes 组件，用于监控 API server 的 pod/service 更改以保持网络最新状态。
|
||||
- **kubelet**：内部 Kubernetes 组件，用于为 pod 监视节点上的 API server 并确保这些 pod 能运行。
|
||||
- **ingress-nginx**：用于 Kubernetes 的 Ingress controller，使用 NGINX 作为反向代理和负载均衡器。
|
||||
- **Traefik:** An Ingress controller for Kubernetes that can be used as a reverse proxy and load balancer.
|
||||
- **coreDns/kubeDns**：负责 DNS 的内部 Kubernetes 组件。
|
||||
- **kube-api-server**：负责为其他 master 组件公开 API 的主要内部 Kubernetes 组件。
|
||||
|
||||
-357
@@ -1,357 +0,0 @@
|
||||
---
|
||||
title: RKE 集群配置参考
|
||||
---
|
||||
|
||||
<EOLRKE1Warning />
|
||||
|
||||
Rancher 安装 Kubernetes 时，它使用 [RKE](../../../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) 或 [RKE2](https://docs.rke2.io/) 作为 Kubernetes 发行版。
|
||||
|
||||
本文介绍 Rancher 中可用于新的或现有的 RKE Kubernetes 集群的配置选项。
|
||||
|
||||
|
||||
## 概述
|
||||
|
||||
你可以通过以下两种方式之一来配置 Kubernetes 选项：
|
||||
|
||||
- [Rancher UI](#rancher-ui-中的配置选项)：使用 Rancher UI 来选择设置 Kubernetes 集群时常用的自定义选项。
|
||||
- [集群配置文件](#rke-集群配置文件参考)：高级用户可以创建一个 RKE 配置文件，而不是使用 Rancher UI 来为集群选择 Kubernetes 选项。配置文件可以让你使用 YAML 来指定 RKE 安装中可用的任何选项（除了 system_images 配置）。
|
||||
|
||||
RKE 集群配置选项嵌套在 `rancher_kubernetes_engine_config` 参数下。有关详细信息，请参阅[集群配置文件](#rke-集群配置文件参考)。
|
||||
|
||||
在 [RKE 启动的集群](../../../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md)中，你可以编辑任何后续剩余的选项。
|
||||
|
||||
有关 RKE 配置文件语法的示例，请参阅 [RKE 文档](https://rancher.com/docs/rke/latest/en/example-yamls/)。
|
||||
|
||||
Rancher UI 中的表单不包括配置 RKE 的所有高级选项。有关 YAML 中 RKE Kubernetes 集群的可配置选项的完整参考，请参阅 [RKE 文档](https://rancher.com/docs/rke/latest/en/config-options/)。
|
||||
|
||||
## 在 Rancher UI 中使用表单编辑集群
|
||||
|
||||
要编辑你的集群：
|
||||
|
||||
1. 在左上角，单击 **☰ > 集群管理**。
|
||||
1. 转到要配置的集群，然后单击 **⋮ > 编辑配置**。
|
||||
|
||||
|
||||
## 使用 YAML 编辑集群
|
||||
|
||||
高级用户可以创建一个 RKE 配置文件，而不是使用 Rancher UI 来为集群选择 Kubernetes 选项。配置文件可以让你使用 YAML 来指定 RKE 安装中可用的任何选项（除了 system_images 配置）。
|
||||
|
||||
RKE 集群（也称为 RKE1 集群）的编辑方式与 RKE2 和 K3s 集群不同。
|
||||
|
||||
要直接从 Rancher UI 编辑 RKE 配置文件：
|
||||
|
||||
1. 点击 **☰ > 集群管理**。
|
||||
1. 转到要配置的 RKE 集群。单击并单击 **⋮ > 编辑配置**。你将会转到 RKE 配置表单。请注意，由于集群配置在 Rancher 2.6 中发生了变更，**⋮ > 以 YAML 文件编辑**可用于配置 RKE2 集群，但不能用于编辑 RKE1 配置。
|
||||
1. 在配置表单中，向下滚动并单击**以 YAML 文件编辑**。
|
||||
1. 编辑 `rancher_kubernetes_engine_config` 参数下的 RKE 选项。
|
||||
|
||||
## Rancher UI 中的配置选项
|
||||
|
||||
:::tip
|
||||
|
||||
一些高级配置选项没有在 Rancher UI 表单中开放，但你可以通过在 YAML 中编辑 RKE 集群配置文件来启用这些选项。有关 YAML 中 RKE Kubernetes 集群的可配置选项的完整参考，请参阅 [RKE 文档](https://rancher.com/docs/rke/latest/en/config-options/)。
|
||||
|
||||
:::
|
||||
|
||||
### Kubernetes 版本
|
||||
|
||||
这指的是集群节点上安装的 Kubernetes 版本。Rancher 基于 [hyperkube](https://github.com/rancher/hyperkube) 打包了自己的 Kubernetes 版本。
|
||||
|
||||
有关更多详细信息，请参阅[升级 Kubernetes](../../../getting-started/installation-and-upgrade/upgrade-and-roll-back-kubernetes.md)。
|
||||
|
||||
### 网络提供商
|
||||
|
||||
这指的是集群使用的[网络提供商](https://kubernetes.io/docs/concepts/cluster-administration/networking/)。有关不同网络提供商的更多详细信息，请查看我们的[网络常见问题解答](../../../faq/container-network-interface-providers.md)。
|
||||
|
||||
:::caution
|
||||
|
||||
启动集群后，你无法更改网络提供商。由于 Kubernetes 不允许在网络提供商之间切换，因此，请谨慎选择要使用的网络提供商。使用网络提供商创建集群后，如果你需要更改网络提供商，你将需要拆除整个集群以及其中的所有应用。
|
||||
|
||||
:::
|
||||
|
||||
Rancher 与以下开箱即用的网络提供商兼容：
|
||||
|
||||
- [Canal](https://github.com/projectcalico/canal)
|
||||
- [Flannel](https://github.com/coreos/flannel#flannel)
|
||||
- [Calico](https://docs.projectcalico.org/v3.11/introduction/)
|
||||
- [Weave](https://github.com/weaveworks/weave)
|
||||
|
||||
:::note Weave 注意事项：
|
||||
|
||||
选择 Weave 作为网络提供商时，Rancher 将通过生成随机密码来自动启用加密。如果你想手动指定密码，请参阅使用[配置文件](#rke-集群配置文件参考)和 [Weave 网络插件选项](https://rancher.com/docs/rke/latest/en/config-options/add-ons/network-plugins/#weave-network-plug-in-options)来配置集群。
|
||||
|
||||
:::
|
||||
|
||||
### 项目网络隔离
|
||||
|
||||
如果你的网络提供商允许项目网络隔离，你可以选择启用或禁用项目间的通信。
|
||||
|
||||
如果你使用支持执行 Kubernetes 网络策略的 RKE 网络插件（例如 Canal 或 Cisco ACI 插件），则可以使用项目网络隔离。
|
||||
|
||||
### Kubernetes 云提供商
|
||||
|
||||
你可以配置 [Kubernetes 云提供商](../../../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/set-up-cloud-providers.md)。如果你想在 Kubernetes 中使用动态配置的[卷和存储](../../../how-to-guides/new-user-guides/manage-clusters/create-kubernetes-persistent-storage/create-kubernetes-persistent-storage.md)，你通常需要选择特定的云提供商。例如，如果你想使用 Amazon EBS，则需要选择 `aws` 云提供商。
|
||||
|
||||
:::note
|
||||
|
||||
如果你要使用的云提供商未作为选项列出，你需要使用[配置文件选项](#rke-集群配置文件参考)来配置云提供商。请参考 [RKE 云提供商文档](https://rancher.com/docs/rke/latest/en/config-options/cloud-providers/)来了解如何配置云提供商。
|
||||
|
||||
:::
|
||||
|
||||
### 私有镜像仓库
|
||||
|
||||
集群级别的私有镜像仓库配置仅能用于配置集群。
|
||||
|
||||
在 Rancher 中设置私有镜像仓库的主要方法有两种：通过[全局默认镜像仓库](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/global-default-private-registry.md)中的**设置**选项卡设置全局默认镜像仓库，以及在集群级别设置的高级选项中设置私有镜像仓库。全局默认镜像仓库可以用于离线设置，不需要凭证的镜像仓库。而集群级私有镜像仓库用于所有需要凭证的私有镜像仓库。
|
||||
|
||||
如果你的私有镜像仓库需要凭证，为了将凭证传递给 Rancher，你需要编辑每个需要从仓库中拉取镜像的集群的集群选项。
|
||||
|
||||
私有镜像仓库的配置选项能让 Rancher 知道要从哪里拉取用于集群的[系统镜像](https://rancher.com/docs/rke/latest/en/config-options/system-images/)或[附加组件镜像](https://rancher.com/docs/rke/latest/en/config-options/add-ons/)。
|
||||
|
||||
- **系统镜像**是维护 Kubernetes 集群所需的组件。
|
||||
- **附加组件**用于部署多个集群组件，包括网络插件、ingress controller、DNS 提供商或 metrics server。
|
||||
|
||||
有关为集群配置期间应用的组件设置私有镜像仓库的更多信息，请参阅[私有镜像仓库的 RKE 文档](https://rancher.com/docs/rke/latest/en/config-options/private-registries/)。
|
||||
|
||||
Rancher v2.6 引入了[为 RKE 集群配置 ECR 镜像仓库](https://rancher.com/docs/rke/latest/en/config-options/private-registries/#amazon-elastic-container-registry-ecr-private-registry-setup)的功能。
|
||||
|
||||
### 授权集群端点
|
||||
|
||||
授权集群端点（ACE）可用于直接访问 Kubernetes API server，而无需通过 Rancher 进行通信。
|
||||
|
||||
:::note
|
||||
|
||||
授权集群端点仅适用于 Rancher 启动的 Kubernetes 集群，即只适用于 Rancher [使用 RKE](../../../reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md#配置-kubernetes-集群的工具) 来配置的集群。它不适用于托管在 Kubernetes 提供商中的集群，例如 Amazon 的 EKS。
|
||||
|
||||
:::
|
||||
|
||||
在 Rancher 启动的 Kubernetes 集群中，它默认启用，使用具有 `controlplane` 角色的节点的 IP 和默认的 Kubernetes 自签名证书。
|
||||
|
||||
有关授权集群端点的工作原理以及使用的原因，请参阅[架构介绍](../../../reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md#4-授权集群端点)。
|
||||
|
||||
我们建议使用具有授权集群端点的负载均衡器。有关详细信息，请参阅[推荐的架构](../../rancher-manager-architecture/architecture-recommendations.md#授权集群端点架构)。
|
||||
|
||||
### 节点池
|
||||
|
||||
有关使用 Rancher UI 在 RKE 集群中设置节点池的信息，请参阅[此页面](../../../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/use-new-nodes-in-an-infra-provider/use-new-nodes-in-an-infra-provider.md)。
|
||||
|
||||
### NGINX Ingress
|
||||
|
||||
如果你想使用高可用性配置来发布应用，并且你使用没有原生负载均衡功能的云提供商来托管主机，请启用此选项以在集群中使用 NGINX Ingress。
|
||||
|
||||
### Metrics Server 监控
|
||||
|
||||
这是启用或禁用 [Metrics Server](https://rancher.com/docs/rke/latest/en/config-options/add-ons/metrics-server/) 的选项。
|
||||
|
||||
每个能够使用 RKE 启动集群的云提供商都可以收集指标并监控你的集群节点。如果启用此选项，你可以从你的云提供商门户查看你的节点指标。
|
||||
|
||||
### 节点上的 Docker 版本
|
||||
|
||||
表示是否允许节点运行 Rancher 不正式支持的 Docker 版本。
|
||||
|
||||
如果你选择使用支持的 Docker 版本，Rancher 会禁止 pod 运行在安装了不支持的 Docker 版本的节点上。
|
||||
|
||||
如需了解各个 Rancher 版本通过了哪些 Docker 版本测试，请参见[支持和维护条款](https://rancher.com/support-maintenance-terms/)。
|
||||
|
||||
### Docker 根目录
|
||||
|
||||
如果要添加到集群的节点为 Docker 配置了非默认 Docker 根目录（默认为 `/var/lib/docker`），请在此选项中指定正确的 Docker 根目录。
|
||||
|
||||
### 默认 Pod 安全策略
|
||||
|
||||
如果你启用了 **Pod 安全策略支持**，请使用此下拉菜单选择应用于集群的 pod 安全策略。
|
||||
|
||||
### 节点端口范围
|
||||
|
||||
更改可用于 [NodePort 服务](https://kubernetes.io/docs/concepts/services-networking/service/#nodeport)的端口范围的选项。默认为 `30000-32767`。
|
||||
|
||||
### 定期 etcd 快照
|
||||
|
||||
启用或禁用[定期 etcd 快照](https://rancher.com/docs/rke/latest/en/etcd-snapshots/#etcd-recurring-snapshots)的选项。
|
||||
|
||||
### Agent 环境变量
|
||||
|
||||
为 [rancher agent](../../../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/about-rancher-agents.md) 设置环境变量的选项。你可以使用键值对设置环境变量。如果 Rancher Agent 需要使用代理与 Rancher Server 通信，则可以使用 Agent 环境变量设置 `HTTP_PROXY`，`HTTPS_PROXY` 和 `NO_PROXY` 环境变量。
|
||||
|
||||
### 更新 ingress-nginx
|
||||
|
||||
使用 Kubernetes 1.16 之前版本创建的集群将具有 `OnDelete`的 `ingress-nginx` `updateStrategy`。使用 Kubernetes 1.16 或更高版本创建的集群将具有 `RollingUpdate`。
|
||||
|
||||
如果 `ingress-nginx` 的 `updateStrategy` 是 `OnDelete`，则需要删除这些 pod 以获得 deployment 正确的版本。
|
||||
|
||||
### Cluster Agent 配置和 Fleet Agent 配置
|
||||
|
||||
你可以为 Cluster Agent 和集群的 Fleet Agent 配置调度字段和资源限制。你可以使用这些字段来自定义容忍度、亲和性规则和资源要求。其他容忍度会被尾附到默认容忍度和 Control Plane 节点污点的列表中。如果你定义了自定义亲和性规则，它们将覆盖全局默认亲和性设置。定义资源要求会在以前没有的地方设置请求或限制。
|
||||
|
||||
:::note
|
||||
|
||||
有了这个选项，你可以覆盖或删除运行集群所需的规则。我们强烈建议你不要删除或覆盖这些规则和其他亲和性规则，因为这可能会导致不必要的影响：
|
||||
|
||||
- `affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution` 用于 `cattle-cluster-agent`
|
||||
- `cluster-agent-default-affinity` 用于 `cattle-cluster-agent`
|
||||
- `fleet-agent-default-affinity` 用于 `fleet-agent`
|
||||
|
||||
:::
|
||||
|
||||
如果将 Rancher 降级到 v2.7.4 或更低版本，你的更改将丢失，而且 Agent 将在没有你的自定义设置的情况下重新部署。重新部署时，Fleet Agent 将回退到使用内置默认值。如果降级期间 Fleet 版本没有更改，则不会立即重新部署。
|
||||
|
||||
|
||||
## RKE 集群配置文件参考
|
||||
|
||||
高级用户可以创建一个 RKE 配置文件，而不是使用 Rancher UI 来为集群选择 Kubernetes 选项。配置文件可以让你在 RKE 安装中设置任何[可用选项](https://rancher.com/docs/rke/latest/en/config-options/)（`system_images` 配置除外）。使用 Rancher UI 或 API 创建集群时，不支持 `system_images` 选项。
|
||||
|
||||
有关 YAML 中 RKE Kubernetes 集群的可配置选项的完整参考，请参阅 [RKE 文档](https://rancher.com/docs/rke/latest/en/config-options/)。
|
||||
|
||||
### Rancher 中的配置文件结构
|
||||
|
||||
RKE（Rancher Kubernetes Engine）是 Rancher 用来配置 Kubernetes 集群的工具。过去，Rancher 的集群配置文件与 [RKE 配置文件](https://rancher.com/docs/rke/latest/en/example-yamls/)的结构是一致的。但由于 Rancher 文件结构发生了变化，因此在 Rancher 中，RKE 集群配置项与非 RKE 配置项是分开的。所以，你的集群配置需要嵌套在集群配置文件中的 `rancher_kubernetes_engine_config` 参数下。使用早期版本的 Rancher 创建的集群配置文件需要针对这种格式进行更新。以下是一个集群配置文件示例：
|
||||
|
||||
<details id="v2.3.0-cluster-config-file">
|
||||
<summary>集群配置文件示例</summary>
|
||||
|
||||
```yaml
|
||||
#
|
||||
# Cluster Config
|
||||
#
|
||||
docker_root_dir: /var/lib/docker
|
||||
enable_cluster_alerting: false
|
||||
enable_cluster_monitoring: false
|
||||
enable_network_policy: false
|
||||
local_cluster_auth_endpoint:
|
||||
enabled: true
|
||||
#
|
||||
# Rancher Config
|
||||
#
|
||||
rancher_kubernetes_engine_config: # Your RKE template config goes here.
|
||||
addon_job_timeout: 30
|
||||
authentication:
|
||||
strategy: x509
|
||||
ignore_docker_version: true
|
||||
#
|
||||
# # 目前仅支持 Nginx ingress provider
|
||||
# # 要禁用 Ingress controller，设置 `provider: none`
|
||||
# # 要在指定节点上禁用 Ingress，使用 node_selector，例如：
|
||||
# provider: nginx
|
||||
# node_selector:
|
||||
# app: ingress
|
||||
#
|
||||
ingress:
|
||||
provider: nginx
|
||||
kubernetes_version: v1.15.3-rancher3-1
|
||||
monitoring:
|
||||
provider: metrics-server
|
||||
#
|
||||
# If you are using calico on AWS
|
||||
#
|
||||
# network:
|
||||
# plugin: calico
|
||||
# calico_network_provider:
|
||||
# cloud_provider: aws
|
||||
#
|
||||
# # To specify flannel interface
|
||||
#
|
||||
# network:
|
||||
# plugin: flannel
|
||||
# flannel_network_provider:
|
||||
# iface: eth1
|
||||
#
|
||||
# # To specify flannel interface for canal plugin
|
||||
#
|
||||
# network:
|
||||
# plugin: canal
|
||||
# canal_network_provider:
|
||||
# iface: eth1
|
||||
#
|
||||
network:
|
||||
options:
|
||||
flannel_backend_type: vxlan
|
||||
plugin: canal
|
||||
#
|
||||
# services:
|
||||
# kube-api:
|
||||
# service_cluster_ip_range: 10.43.0.0/16
|
||||
# kube-controller:
|
||||
# cluster_cidr: 10.42.0.0/16
|
||||
# service_cluster_ip_range: 10.43.0.0/16
|
||||
# kubelet:
|
||||
# cluster_domain: cluster.local
|
||||
# cluster_dns_server: 10.43.0.10
|
||||
#
|
||||
services:
|
||||
etcd:
|
||||
backup_config:
|
||||
enabled: true
|
||||
interval_hours: 12
|
||||
retention: 6
|
||||
safe_timestamp: false
|
||||
creation: 12h
|
||||
extra_args:
|
||||
election-timeout: 5000
|
||||
heartbeat-interval: 500
|
||||
gid: 0
|
||||
retention: 72h
|
||||
snapshot: false
|
||||
uid: 0
|
||||
kube_api:
|
||||
always_pull_images: false
|
||||
pod_security_policy: false
|
||||
service_node_port_range: 30000-32767
|
||||
ssh_agent_auth: false
|
||||
windows_prefered_cluster: false
|
||||
```
|
||||
</details>
|
||||
|
||||
### 默认 DNS 提供商
|
||||
|
||||
下表显示了默认部署的 DNS 提供商。有关如何配置不同 DNS 提供商的更多信息，请参阅 [DNS 提供商相关的 RKE 文档](https://rancher.com/docs/rke/latest/en/config-options/add-ons/dns/)。CoreDNS 只能在 Kubernetes v1.12.0 及更高版本上使用。
|
||||
|
||||
| Rancher 版本 | Kubernetes 版本 | 默认 DNS 提供商 |
|
||||
|-------------|--------------------|----------------------|
|
||||
| v2.2.5 及更高版本 | v1.14.0 及更高版本 | CoreDNS |
|
||||
| v2.2.5 及更高版本 | v1.13.x 及更低版本 | kube-dns |
|
||||
| v2.2.4 及更低版本 | 任意 | kube-dns |
|
||||
|
||||
## YAML 中的 Rancher 特定参数
|
||||
|
||||
除了 RKE 配置文件选项外，还有可以在配置文件 (YAML) 中配置的 Rancher 特定设置如下。
|
||||
|
||||
### docker_root_dir
|
||||
|
||||
请参阅 [Docker 根目录](#docker-根目录)。
|
||||
|
||||
### enable_cluster_monitoring
|
||||
|
||||
启用或禁用[集群监控](../../../integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md)的选项。
|
||||
|
||||
### enable_network_policy
|
||||
|
||||
启用或禁用项目网络隔离的选项。
|
||||
|
||||
如果你使用支持执行 Kubernetes 网络策略的 RKE 网络插件（例如 Canal 或 Cisco ACI 插件），则可以使用项目网络隔离。
|
||||
|
||||
### local_cluster_auth_endpoint
|
||||
|
||||
请参阅[授权集群端点](#授权集群端点)。
|
||||
|
||||
示例：
|
||||
|
||||
```yaml
|
||||
local_cluster_auth_endpoint:
|
||||
enabled: true
|
||||
fqdn: "FQDN"
|
||||
ca_certs: |-
|
||||
-----BEGIN CERTIFICATE-----
|
||||
...
|
||||
-----END CERTIFICATE-----
|
||||
```
|
||||
|
||||
### 自定义网络插件
|
||||
|
||||
你可以使用 RKE 的[用户定义的附加组件功能](https://rancher.com/docs/rke/latest/en/config-options/add-ons/user-defined-add-ons/)来添加自定义网络插件。部署 Kubernetes 集群之后，你可以定义要部署的任何附加组件。
|
||||
|
||||
有两种方法可以指定附加组件：
|
||||
|
||||
- [内嵌附加组件](https://rancher.com/docs/rke/latest/en/config-options/add-ons/user-defined-add-ons/#in-line-add-ons)
|
||||
- [为附加组件引用 YAML 文件](https://rancher.com/docs/rke/latest/en/config-options/add-ons/user-defined-add-ons/#referencing-yaml-files-for-add-ons)
|
||||
|
||||
有关如何通过编辑 `cluster.yml` 来配置自定义网络插件的示例，请参阅 [RKE 文档](https://rancher.com/docs/rke/latest/en/config-options/add-ons/network-plugins/custom-network-plugin-example)。
|
||||
+2
-2
@@ -6,7 +6,7 @@ title: DNS
|
||||
|
||||
请确保你配置了正确的 kubeconfig（例如，为 Rancher HA 配置了 `export KUBECONFIG=$PWD/kube_config_cluster.yml`）或通过 UI 使用了嵌入式 kubectl。
|
||||
|
||||
在运行 DNS 检查之前，请检查集群的[默认 DNS 提供商](../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md#默认-dns-提供商)，并确保[覆盖网络正常运行](networking.md#检查覆盖网络是否正常运行)，因为这也可能导致 DNS 解析（部分）失败。
|
||||
Before running the DNS checks, make sure that [the overlay network is functioning correctly](networking.md#check-if-overlay-network-is-functioning-correctly) for your DNS provider as this can also be the reason why DNS resolution (partly) fails.
|
||||
|
||||
## 检查 DNS pod 是否正在运行
|
||||
|
||||
@@ -199,7 +199,7 @@ services:
|
||||
|
||||
:::
|
||||
|
||||
请参阅[使用 YAML 编辑集群](../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md#使用-yaml-编辑集群)了解如何应用此修改。集群配置完成后，你必须删除 kube-dns pod 以激活 pod 中的新设置：
|
||||
请参阅使用 YAML 编辑集群了解如何应用此修改。集群配置完成后，你必须删除 kube-dns pod 以激活 pod 中的新设置：
|
||||
|
||||
```
|
||||
kubectl delete pods -n kube-system -l k8s-app=kube-dns
|
||||
|
||||
+12
-12
@@ -74,22 +74,22 @@ kubectl -n kube-system get endpoints kube-scheduler -o jsonpath='{.metadata.anno
|
||||
|
||||
## Ingress Controller
|
||||
|
||||
默认的 Ingress Controller 是 NGINX，作为 DaemonSet 部署在 `ingress-nginx` 命名空间中。Pod 仅会调度到具有 `worker` 角色的节点。
|
||||
默认的 Ingress Controller 是 Traefik，作为 DaemonSet 部署在 `traefik` 命名空间中。Pod 仅会调度到具有 `worker` 角色的节点。
|
||||
|
||||
检查 pod 是否运行在所有节点上：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get pods -o wide
|
||||
kubectl -n traefik get pods -o wide
|
||||
```
|
||||
|
||||
输出示例：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get pods -o wide
|
||||
kubectl -n traefik get pods -o wide
|
||||
NAME READY STATUS RESTARTS AGE IP NODE
|
||||
default-http-backend-797c5bc547-kwwlq 1/1 Running 0 17m x.x.x.x worker-1
|
||||
nginx-ingress-controller-4qd64 1/1 Running 0 14m x.x.x.x worker-1
|
||||
nginx-ingress-controller-8wxhm 1/1 Running 0 13m x.x.x.x worker-0
|
||||
traefik-4qd64 1/1 Running 0 14m x.x.x.x worker-1
|
||||
traefik-8wxhm 1/1 Running 0 13m x.x.x.x worker-0
|
||||
```
|
||||
|
||||
如果 pod 无法运行（即状态不是 **Running**，Ready 状态未显示 `1/1`，或者有大量 Restarts），请检查 pod 详细信息，日志和命名空间事件。
|
||||
@@ -97,27 +97,27 @@ nginx-ingress-controller-8wxhm 1/1 Running 0 13m
|
||||
### Pod 详细信息
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx describe pods -l app=ingress-nginx
|
||||
kubectl -n traefik describe pods -l app=traefik
|
||||
```
|
||||
|
||||
### Pod 容器日志
|
||||
|
||||
下面的命令可以显示所有标记为 “app=ingress-nginx” 的 pod 的日志，但是由于 `kubectl logs` 命令的限制，它只会显示 10 行日志。有关详细信息，请参阅 `kubectl logs -h` 的 `--tail`。
|
||||
下面的命令可以显示所有标记为 “app=traefik” 的 pod 的日志，但是由于 `kubectl logs` 命令的限制，它只会显示 10 行日志。有关详细信息，请参阅 `kubectl logs -h` 的 `--tail`。
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx logs -l app=ingress-nginx
|
||||
kubectl -n traefik logs -l app=traefik
|
||||
```
|
||||
|
||||
如果需要查看完整的日志，请在命令中尾随 pod 名称：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx logs <pod name>
|
||||
kubectl -n traefik logs <pod name>
|
||||
```
|
||||
|
||||
### 命名空间事件
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get events
|
||||
kubectl -n traefik get events
|
||||
```
|
||||
|
||||
### 调试日志
|
||||
@@ -125,7 +125,7 @@ kubectl -n ingress-nginx get events
|
||||
要启用调试日志：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx patch ds nginx-ingress-controller --type='json' -p='[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--v=5"}]'
|
||||
kubectl -n traefik patch ds traefik --type='json' -p='[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--v=5"}]'
|
||||
```
|
||||
|
||||
### 检查配置
|
||||
@@ -133,7 +133,7 @@ kubectl -n ingress-nginx patch ds nginx-ingress-controller --type='json' -p='[{"
|
||||
在每个 pod 中检索生成的配置：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get pods -l app=ingress-nginx --no-headers -o custom-columns=.NAME:.metadata.name | while read pod; do kubectl -n ingress-nginx exec $pod -- cat /etc/nginx/nginx.conf; done
|
||||
kubectl -n traefik get pods -l app=traefik --no-headers -o custom-columns=.NAME:.metadata.name | while read pod; do kubectl -n traefik exec $pod -- cat /etc/nginx/nginx.conf; done
|
||||
```
|
||||
|
||||
## Rancher Agents
|
||||
|
||||
+1
-1
@@ -65,7 +65,7 @@ rancher rancher.yourdomain.com x.x.x.x,x.x.x.x,x.x.x.x 80, 443 2m
|
||||
如果访问你配置的 Rancher FQDN 时没有显示 UI，请检查 Ingress Controller 日志以查看尝试访问 Rancher 时发生了什么：
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx logs -l app=ingress-nginx
|
||||
kubectl -n traefik logs -l app=traefik
|
||||
```
|
||||
|
||||
## Leader 选举
|
||||
|
||||
@@ -861,7 +861,6 @@ const sidebars = {
|
||||
id: "reference-guides/cluster-configuration/rancher-server-configuration/rancher-server-configuration",
|
||||
},
|
||||
items: [
|
||||
"reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration",
|
||||
"reference-guides/cluster-configuration/rancher-server-configuration/rke2-cluster-configuration",
|
||||
"reference-guides/cluster-configuration/rancher-server-configuration/k3s-cluster-configuration",
|
||||
"reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration",
|
||||
|
||||
+1
-4
@@ -10,10 +10,7 @@ Changing the default TLS settings depends on the chosen installation method.
|
||||
|
||||
## Running Rancher in a highly available Kubernetes cluster
|
||||
|
||||
When you install Rancher inside of a Kubernetes cluster, TLS is offloaded at the cluster's ingress controller. The possible TLS settings depend on the used ingress controller:
|
||||
|
||||
* nginx-ingress-controller (default for RKE1 and RKE2): [Default TLS Version and Ciphers](https://kubernetes.github.io/ingress-nginx/user-guide/tls/#default-tls-version-and-ciphers).
|
||||
* traefik (default for K3s): [TLS Options](https://doc.traefik.io/traefik/https/tls/#tls-options).
|
||||
When you install a Rancher managed Kubernetes cluster, TLS is offloaded at the cluster's ingress controller. Traefik is the default ingress for K3s and can be used with RKE2, refer to [TLS Options](https://doc.traefik.io/traefik/https/tls/#tls-options) for further information.
|
||||
|
||||
## Running Rancher in a single Docker container
|
||||
|
||||
|
||||
+7
-12
@@ -8,14 +8,12 @@ title: Setting up Amazon ELB Network Load Balancer
|
||||
|
||||
This how-to guide describes how to set up a Network Load Balancer (NLB) in Amazon's EC2 service that will direct traffic to multiple instances on EC2.
|
||||
|
||||
These examples show the load balancer being configured to direct traffic to three Rancher server nodes. If Rancher is installed on an RKE Kubernetes cluster, three nodes are required. If Rancher is installed on a K3s Kubernetes cluster, only two nodes are required.
|
||||
These examples show the load balancer being configured to direct traffic to three Rancher server nodes. If Rancher is installed on a K3s Kubernetes cluster, only two nodes are required.
|
||||
|
||||
This tutorial is about one possible way to set up your load balancer, not the only way. Other types of load balancers, such as a Classic Load Balancer or Application Load Balancer, could also direct traffic to the Rancher server nodes.
|
||||
|
||||
Rancher only supports using the Amazon NLB when terminating traffic in `tcp` mode for port 443 rather than `tls` mode. This is due to the fact that the NLB does not inject the correct headers into requests when terminated at the NLB. This means that if you want to use certificates managed by the Amazon Certificate Manager (ACM), you should use an ALB.
|
||||
|
||||
|
||||
|
||||
## Requirements
|
||||
|
||||
These instructions assume you have already created Linux instances in EC2. The load balancer will direct traffic to these nodes.
|
||||
@@ -26,7 +24,7 @@ Begin by creating two target groups for the **TCP** protocol, one with TCP port
|
||||
|
||||
Your first NLB configuration step is to create two target groups. Technically, only port 443 is needed to access Rancher, but it's convenient to add a listener for port 80, because traffic to port 80 will be automatically redirected to port 443.
|
||||
|
||||
Regardless of whether an NGINX Ingress or Traefik Ingress controller is used, the Ingress should redirect traffic from port 80 to port 443.
|
||||
The Traefik Ingress should redirect traffic from port 80 to port 443.
|
||||
|
||||
1. Log into the [Amazon AWS Console](https://console.aws.amazon.com/ec2/) to get started. Make sure to select the **Region** where your EC2 instances (Linux nodes) are created.
|
||||
1. Select **Services** and choose **EC2**, find the section **Load Balancing** and open **Target Groups**.
|
||||
@@ -34,7 +32,7 @@ Regardless of whether an NGINX Ingress or Traefik Ingress controller is used, th
|
||||
|
||||
:::note
|
||||
|
||||
Health checks are handled differently based on the Ingress. For details, refer to [this section.](#health-check-paths-for-nginx-ingress-and-traefik-ingresses)
|
||||
For details on Traefik Ingress health checks, refer to [this section.](#health-check-paths-for-traefik-ingresses)
|
||||
|
||||
:::
|
||||
|
||||
@@ -167,13 +165,10 @@ After AWS creates the NLB, click **Close**.
|
||||
|
||||
6. Click **Save** in the top right of the screen.
|
||||
|
||||
## Health Check Paths for NGINX Ingress and Traefik Ingresses
|
||||
## Health Check Paths for Traefik Ingresses
|
||||
|
||||
K3s and RKE Kubernetes clusters handle health checks differently because they use different Ingresses by default.
|
||||
K3s Kubernetes clusters use Traefik as the default Ingress.
|
||||
|
||||
For RKE Kubernetes clusters, NGINX Ingress is used by default, whereas for K3s Kubernetes clusters, Traefik is the default Ingress.
|
||||
The health check path is `/ping`. By default `/ping` is always matched (regardless of Host), and a response from [Traefik itself](https://docs.traefik.io/operations/ping/) is always served.
|
||||
|
||||
- **Traefik:** The health check path is `/ping`. By default `/ping` is always matched (regardless of Host), and a response from [Traefik itself](https://docs.traefik.io/operations/ping/) is always served.
|
||||
- **NGINX Ingress:** The default backend of the NGINX Ingress controller has a `/healthz` endpoint. By default `/healthz` is always matched (regardless of Host), and a response from [`ingress-nginx` itself](https://github.com/kubernetes/ingress-nginx/blob/0cbe783f43a9313c9c26136e888324b1ee91a72f/charts/ingress-nginx/values.yaml#L212) is always served.
|
||||
|
||||
To simulate an accurate health check, it is a best practice to use the Host header (Rancher hostname) combined with `/ping` or `/healthz` (for K3s or for RKE clusters, respectively) wherever possible, to get a response from the Rancher Pods, not the Ingress.
|
||||
To simulate an accurate health check, it is a best practice to use the Host header (Rancher hostname) combined with `/ping` or `/healthz` wherever possible, to get a response from the Rancher Pods, not the Ingress.
|
||||
|
||||
+5
-5
@@ -91,7 +91,7 @@ To use this `kubeconfig` file,
|
||||
|
||||
1. Install [kubectl,](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl) a Kubernetes command-line tool.
|
||||
2. Copy the file at `/etc/rancher/rke2/rke2.yaml` and save it to the directory `~/.kube/config` on your local machine.
|
||||
3. In the kubeconfig file, the `server` directive is defined as localhost. Configure the server as the DNS of your control-plane load balancer, on port 6443. (The RKE2 Kubernetes API Server uses port 6443, while the Rancher server will be served via the NGINX Ingress on ports 80 and 443.) Here is an example `rke2.yaml`:
|
||||
3. In the kubeconfig file, the `server` directive is defined as localhost. Configure the server as the DNS of your control-plane load balancer, on port 6443. (The RKE2 Kubernetes API Server uses port 6443, while the Rancher server will be served via the Traefik Ingress on ports 80 and 443.) Here is an example `rke2.yaml`:
|
||||
|
||||
```yml
|
||||
apiVersion: v1
|
||||
@@ -140,7 +140,8 @@ kube-system etcd-rke2-server-2 1/1 Ru
|
||||
kube-system etcd-rke2-server-3 1/1 Running 0 56s
|
||||
kube-system helm-install-rke2-canal-hs6sx 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-rke2-coredns-xmzm8 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-rke2-ingress-nginx-flwnl 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-traefik-crd-z8vsz 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-traefik-flwnl 0/1 Completed 0 2m17s
|
||||
kube-system helm-install-rke2-metrics-server-7sggn 0/1 Completed 0 2m17s
|
||||
kube-system kube-apiserver-rke2-server-1 1/1 Running 0 116s
|
||||
kube-system kube-apiserver-rke2-server-2 1/1 Running 0 66s
|
||||
@@ -160,9 +161,8 @@ kube-system rke2-canal-swfmq 2/2 Ru
|
||||
kube-system rke2-coredns-rke2-coredns-547d5499cb-6tvwb 1/1 Running 0 92s
|
||||
kube-system rke2-coredns-rke2-coredns-547d5499cb-rdttj 1/1 Running 0 2m8s
|
||||
kube-system rke2-coredns-rke2-coredns-autoscaler-65c9bb465d-85sq5 1/1 Running 0 2m8s
|
||||
kube-system rke2-ingress-nginx-controller-69qxc 1/1 Running 0 52s
|
||||
kube-system rke2-ingress-nginx-controller-7hprp 1/1 Running 0 52s
|
||||
kube-system rke2-ingress-nginx-controller-x658h 1/1 Running 0 52s
|
||||
kube-system traefik-7c844b766f-m9p2w 1/1 Running 0 52s
|
||||
kube-system traefik-7c844b766f-s4l9k 1/1 Running 0 52s
|
||||
kube-system rke2-metrics-server-6564db4569-vdfkn 1/1 Running 0 66s
|
||||
```
|
||||
|
||||
|
||||
+1
-3
@@ -40,6 +40,4 @@ You must have an SSL certificate that Ingress can use to encrypt and decrypt com
|
||||
|
||||
## Labels and Annotations
|
||||
|
||||
Add [Labels](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/) and/or [Annotations](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/) to provide metadata for your Ingress controller.
|
||||
|
||||
For a list of annotations available for use, see the [Nginx Ingress Controller Documentation](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/).
|
||||
Please refer to the Traefik documentation for the full list of Ingress NGINX annotations that are [supported](https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/ingress-nginx/#annotations-support) and [unsupported](https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/ingress-nginx/#unsupported-annotations) by Traefik's kubernetesIngressNginx provider.
|
||||
|
||||
+8
@@ -15,6 +15,14 @@ Layer-4 load balancer (or the external load balancer) forwards traffic to Nodepo
|
||||
|
||||
Often, the Layer-4 load balancer is supported by the underlying cloud provider, so when you deploy RKE clusters on bare-metal servers and vSphere clusters, Layer-4 load balancer is not supported. However, a single [globally managed config-map](https://kubernetes.github.io/ingress-nginx/user-guide/exposing-tcp-udp-services/) can be used to expose services on NGINX or third-party ingress.
|
||||
|
||||
:::warning
|
||||
|
||||
**Ingress-NGINX EOL:** The community `ingress-nginx` controller reaches End-of-Life (EOL) in March 2026. Traefik is the recommended migration path for Rancher environments.
|
||||
|
||||
Traefik includes a native Ingress NGINX provider. This allows you to migrate from NGINX without rewriting your existing Ingress objects, as Traefik will automatically interpret `nginx.ingress.kubernetes.io` annotations. If you are upgrading a cluster that is already using `ingress-nginx`, follow this [guide](https://doc.traefik.io/traefik/migrate/nginx-to-traefik/) for more information.
|
||||
|
||||
:::
|
||||
|
||||
:::note
|
||||
|
||||
It is possible to deploy a cluster with a non-cloud load balancer, such as [MetalLB.](https://metallb.universe.tf/) However, that use case is more advanced than the Layer-4 load balancer supported by a cloud provider, and it is not configurable in Rancher or RKE.
|
||||
|
||||
+9
-1
@@ -36,13 +36,21 @@ Load Balancers have a couple of limitations you should be aware of:
|
||||
|
||||
## Ingress
|
||||
|
||||
:::warning
|
||||
|
||||
**Ingress-NGINX EOL:** The community `ingress-nginx` controller reaches End-of-Life (EOL) in March 2026. Traefik is the recommended migration path for Rancher environments.
|
||||
|
||||
Traefik includes a native Ingress NGINX provider. This allows you to migrate from NGINX without rewriting your existing Ingress objects, as Traefik will automatically interpret `nginx.ingress.kubernetes.io` annotations. If you are upgrading a cluster that is already using `ingress-nginx`, follow this [guide](https://doc.traefik.io/traefik/migrate/nginx-to-traefik/) for more information.
|
||||
|
||||
:::
|
||||
|
||||
As mentioned in the limitations above, the disadvantages of using a load balancer are:
|
||||
|
||||
- Load Balancers can only handle one IP address per service.
|
||||
- If you run multiple services in your cluster, you must have a load balancer for each service.
|
||||
- It can be expensive to have a load balancer for every service.
|
||||
|
||||
In contrast, when an ingress is used as the entrypoint into a cluster, the ingress can route traffic to multiple services with greater flexibility. It can map multiple HTTP requests to services without individual IP addresses for each service.
|
||||
In contrast, when an ingress is used as the entry point into a cluster, the ingress can route traffic to multiple services with greater flexibility. It can map multiple HTTP requests to services without individual IP addresses for each service.
|
||||
|
||||
Therefore, it is useful to have an ingress if you want multiple services to be exposed with the same IP address, the same Layer 7 protocol, or the same privileged node-ports: 80 and 443.
|
||||
|
||||
|
||||
+5
-2
@@ -211,12 +211,13 @@ The following Kubernetes components are directly scraped by Prometheus:
|
||||
|
||||
- kubelet*
|
||||
- ingress-nginx**
|
||||
- Traefik**
|
||||
- coreDns/kubeDns
|
||||
- kube-api-server
|
||||
|
||||
\* You can optionally use `hardenedKubelet.enabled` to use a PushProx, but that is not the default.
|
||||
|
||||
** For RKE and RKE2 clusters, ingress-nginx is deployed by default and treated as an internal Kubernetes component.
|
||||
** For RKE clusters, ingress-nginx is deployed by default and treated as an internal Kubernetes component. For RKE2 clusters, Traefik is deployed by default and treated as an internal Kubernetes component.
|
||||
|
||||
|
||||
### Scraping Metrics Based on Kubernetes Distribution
|
||||
@@ -233,10 +234,11 @@ Metrics are scraped differently based on the Kubernetes distribution. For help w
|
||||
| kube-proxy | rkeProxy.enabled | rke2Proxy.enabled | kubeAdmProxy.enabled | k3sServer.enabled |
|
||||
| kubelet | Collects metrics directly exposed by kubelet | Collects metrics directly exposed by kubelet | Collects metrics directly exposed by kubelet | Collects metrics directly exposed by kubelet |
|
||||
| ingress-nginx* | Collects metrics directly exposed by kubelet, exposed by rkeIngressNginx.enabled | Collects metrics directly exposed by kubelet, Exposed by rke2IngressNginx.enabled | Not available | Not available |
|
||||
| Traefik* | Collects metrics directly exposed by kubelet | Collects metrics directly exposed by kubelet, Exposed by rke2IngressNginx.enabled | Not available | Not available |
|
||||
| coreDns/kubeDns | Collects metrics directly exposed by coreDns/kubeDns | Collects metrics directly exposed by coreDns/kubeDns | Collects metrics directly exposed by coreDns/kubeDns | Collects metrics directly exposed by coreDns/kubeDns |
|
||||
| kube-api-server | Collects metrics directly exposed by kube-api-server |Collects metrics directly exposed by kube-api-server | Collects metrics directly exposed by kube-appi-server | Collects metrics directly exposed by kube-api-server |
|
||||
|
||||
\* For RKE and RKE2 clusters, ingress-nginx is deployed by default and treated as an internal Kubernetes component.
|
||||
\* For RKE clusters, ingress-nginx is deployed by default and treated as an internal Kubernetes component. For RKE2 clusters, Traefik is deployed by default and treated as an internal Kubernetes component.
|
||||
|
||||
### Terminology
|
||||
|
||||
@@ -246,5 +248,6 @@ Metrics are scraped differently based on the Kubernetes distribution. For help w
|
||||
- **kube-proxy:** The internal Kubernetes component that watches the API server for pods/services changes in order to maintain the network up to date.
|
||||
- **kubelet:** The internal Kubernetes component that watches the API server for pods on a node and makes sure they are running.
|
||||
- **ingress-nginx:** An Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer.
|
||||
- **Traefik:** An Ingress controller for Kubernetes that can be used as a reverse proxy and load balancer.
|
||||
- **coreDns/kubeDns:** The internal Kubernetes component responsible for DNS.
|
||||
- **kube-api-server:** The main internal Kubernetes component that is responsible for exposing APIs for the other master components.
|
||||
|
||||
+12
-12
@@ -78,22 +78,22 @@ kubectl -n kube-system get endpoints kube-scheduler -o jsonpath='{.metadata.anno
|
||||
|
||||
## Ingress Controller
|
||||
|
||||
The default Ingress Controller is NGINX and is deployed as a DaemonSet in the `ingress-nginx` namespace. The pods are only scheduled to nodes with the `worker` role.
|
||||
The default Ingress Controller is Traefik and is deployed as a DaemonSet in the `traefik` namespace. The pods are only scheduled to nodes with the `worker` role.
|
||||
|
||||
Check if the pods are running on all nodes:
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get pods -o wide
|
||||
kubectl -n traefik get pods -o wide
|
||||
```
|
||||
|
||||
Example output:
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get pods -o wide
|
||||
kubectl -n traefik get pods -o wide
|
||||
NAME READY STATUS RESTARTS AGE IP NODE
|
||||
default-http-backend-797c5bc547-kwwlq 1/1 Running 0 17m x.x.x.x worker-1
|
||||
nginx-ingress-controller-4qd64 1/1 Running 0 14m x.x.x.x worker-1
|
||||
nginx-ingress-controller-8wxhm 1/1 Running 0 13m x.x.x.x worker-0
|
||||
traefik-4qd64 1/1 Running 0 14m x.x.x.x worker-1
|
||||
traefik-8wxhm 1/1 Running 0 13m x.x.x.x worker-0
|
||||
```
|
||||
|
||||
If a pod is unable to run (Status is not **Running**, Ready status is not showing `1/1` or you see a high count of Restarts), check the pod details, logs and namespace events.
|
||||
@@ -101,27 +101,27 @@ If a pod is unable to run (Status is not **Running**, Ready status is not showin
|
||||
### Pod details
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx describe pods -l app=ingress-nginx
|
||||
kubectl -n traefik describe pods -l app=traefik
|
||||
```
|
||||
|
||||
### Pod container logs
|
||||
|
||||
The below command can show the logs of all the pods labeled "app=ingress-nginx", but it will display only 10 lines of log because of the restrictions of the `kubectl logs` command. Refer to `--tail` of `kubectl logs -h` for more information.
|
||||
The below command can show the logs of all the pods labeled "app=traefik", but it will display only 10 lines of log because of the restrictions of the `kubectl logs` command. Refer to `--tail` of `kubectl logs -h` for more information.
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx logs -l app=ingress-nginx
|
||||
kubectl -n traefik logs -l app=traefik
|
||||
```
|
||||
|
||||
If the full log is needed, specify the pod name in the trailing command:
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx logs <pod name>
|
||||
kubectl -n traefik logs <pod name>
|
||||
```
|
||||
|
||||
### Namespace events
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get events
|
||||
kubectl -n traefik get events
|
||||
```
|
||||
|
||||
### Debug logging
|
||||
@@ -129,7 +129,7 @@ kubectl -n ingress-nginx get events
|
||||
To enable debug logging:
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx patch ds nginx-ingress-controller --type='json' -p='[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--v=5"}]'
|
||||
kubectl -n traefik patch ds traefik --type='json' -p='[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--v=5"}]'
|
||||
```
|
||||
|
||||
### Check configuration
|
||||
@@ -137,7 +137,7 @@ kubectl -n ingress-nginx patch ds nginx-ingress-controller --type='json' -p='[{"
|
||||
Retrieve generated configuration in each pod:
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx get pods -l app=ingress-nginx --no-headers -o custom-columns=.NAME:.metadata.name | while read pod; do kubectl -n ingress-nginx exec $pod -- cat /etc/nginx/nginx.conf; done
|
||||
kubectl -n traefik get pods -l app=traefik --no-headers -o custom-columns=.NAME:.metadata.name | while read pod; do kubectl -n traefik exec $pod -- cat /etc/nginx/nginx.conf; done
|
||||
```
|
||||
|
||||
## Rancher agents
|
||||
|
||||
+1
-1
@@ -69,7 +69,7 @@ rancher rancher.yourdomain.com x.x.x.x,x.x.x.x,x.x.x.x 80, 443 2m
|
||||
When accessing your configured Rancher FQDN does not show you the UI, check the ingress controller logging to see what happens when you try to access Rancher:
|
||||
|
||||
```
|
||||
kubectl -n ingress-nginx logs -l app=ingress-nginx
|
||||
kubectl -n traefik logs -l app=traefik
|
||||
```
|
||||
|
||||
## Leader Election
|
||||
|
||||
+1
-4
@@ -10,10 +10,7 @@ Changing the default TLS settings depends on the chosen installation method.
|
||||
|
||||
## Running Rancher in a highly available Kubernetes cluster
|
||||
|
||||
When you install Rancher inside of a Kubernetes cluster, TLS is offloaded at the cluster's ingress controller. The possible TLS settings depend on the used ingress controller:
|
||||
|
||||
* nginx-ingress-controller (default for RKE1 and RKE2): [Default TLS Version and Ciphers](https://kubernetes.github.io/ingress-nginx/user-guide/tls/#default-tls-version-and-ciphers).
|
||||
* traefik (default for K3s): [TLS Options](https://doc.traefik.io/traefik/https/tls/#tls-options).
|
||||
When you install a Rancher managed Kubernetes cluster, TLS is offloaded at the cluster's ingress controller. Traefik is the default ingress for K3s and can be used with RKE2, refer to [TLS Options](https://doc.traefik.io/traefik/https/tls/#tls-options) for further information.
|
||||
|
||||
## Running Rancher in a single Docker container
|
||||
|
||||
|
||||
+7
-12
@@ -8,14 +8,12 @@ title: Setting up Amazon ELB Network Load Balancer
|
||||
|
||||
This how-to guide describes how to set up a Network Load Balancer (NLB) in Amazon's EC2 service that will direct traffic to multiple instances on EC2.
|
||||
|
||||
These examples show the load balancer being configured to direct traffic to three Rancher server nodes. If Rancher is installed on an RKE Kubernetes cluster, three nodes are required. If Rancher is installed on a K3s Kubernetes cluster, only two nodes are required.
|
||||
These examples show the load balancer being configured to direct traffic to three Rancher server nodes. If Rancher is installed on a K3s Kubernetes cluster, only two nodes are required.
|
||||
|
||||
This tutorial is about one possible way to set up your load balancer, not the only way. Other types of load balancers, such as a Classic Load Balancer or Application Load Balancer, could also direct traffic to the Rancher server nodes.
|
||||
|
||||
Rancher only supports using the Amazon NLB when terminating traffic in `tcp` mode for port 443 rather than `tls` mode. This is due to the fact that the NLB does not inject the correct headers into requests when terminated at the NLB. This means that if you want to use certificates managed by the Amazon Certificate Manager (ACM), you should use an ALB.
|
||||
|
||||
|
||||
|
||||
## Requirements
|
||||
|
||||
These instructions assume you have already created Linux instances in EC2. The load balancer will direct traffic to these nodes.
|
||||
@@ -26,7 +24,7 @@ Begin by creating two target groups for the **TCP** protocol, one with TCP port
|
||||
|
||||
Your first NLB configuration step is to create two target groups. Technically, only port 443 is needed to access Rancher, but it's convenient to add a listener for port 80, because traffic to port 80 will be automatically redirected to port 443.
|
||||
|
||||
Regardless of whether an NGINX Ingress or Traefik Ingress controller is used, the Ingress should redirect traffic from port 80 to port 443.
|
||||
The Traefik Ingress should redirect traffic from port 80 to port 443.
|
||||
|
||||
1. Log into the [Amazon AWS Console](https://console.aws.amazon.com/ec2/) to get started. Make sure to select the **Region** where your EC2 instances (Linux nodes) are created.
|
||||
1. Select **Services** and choose **EC2**, find the section **Load Balancing** and open **Target Groups**.
|
||||
@@ -34,7 +32,7 @@ Regardless of whether an NGINX Ingress or Traefik Ingress controller is used, th
|
||||
|
||||
:::note
|
||||
|
||||
Health checks are handled differently based on the Ingress. For details, refer to [this section.](#health-check-paths-for-nginx-ingress-and-traefik-ingresses)
|
||||
For details on Traefik Ingress health checks, refer to [this section.](#health-check-paths-for-traefik-ingresses)
|
||||
|
||||
:::
|
||||
|
||||
@@ -167,13 +165,10 @@ After AWS creates the NLB, click **Close**.
|
||||
|
||||
6. Click **Save** in the top right of the screen.
|
||||
|
||||
## Health Check Paths for NGINX Ingress and Traefik Ingresses
|
||||
## Health Check Paths for Traefik Ingresses
|
||||
|
||||
K3s and RKE Kubernetes clusters handle health checks differently because they use different Ingresses by default.
|
||||
K3s Kubernetes clusters use Traefik as the default Ingress.
|
||||
|
||||
For RKE Kubernetes clusters, NGINX Ingress is used by default, whereas for K3s Kubernetes clusters, Traefik is the default Ingress.
|
||||
The health check path is `/ping`. By default `/ping` is always matched (regardless of Host), and a response from [Traefik itself](https://docs.traefik.io/operations/ping/) is always served.
|
||||
|
||||
- **Traefik:** The health check path is `/ping`. By default `/ping` is always matched (regardless of Host), and a response from [Traefik itself](https://docs.traefik.io/operations/ping/) is always served.
|
||||
- **NGINX Ingress:** The default backend of the NGINX Ingress controller has a `/healthz` endpoint. By default `/healthz` is always matched (regardless of Host), and a response from [`ingress-nginx` itself](https://github.com/kubernetes/ingress-nginx/blob/0cbe783f43a9313c9c26136e888324b1ee91a72f/charts/ingress-nginx/values.yaml#L212) is always served.
|
||||
|
||||
To simulate an accurate health check, it is a best practice to use the Host header (Rancher hostname) combined with `/ping` or `/healthz` (for K3s or for RKE clusters, respectively) wherever possible, to get a response from the Rancher Pods, not the Ingress.
|
||||
To simulate an accurate health check, it is a best practice to use the Host header (Rancher hostname) combined with `/ping` or `/healthz` wherever possible, to get a response from the Rancher Pods, not the Ingress.
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user