public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-25 04:28:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

improvements to single node install procedures

Browse Source
This commit is contained in:
Mark Bishop
2018-05-14 11:04:09 -07:00
committed by Mark Bishop
parent 22f0dc05cc
commit 88b831ef85
7 changed files with 62 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/rancher/v2.x/en/docs/_index.md → content/rancher/v2.x/en/home/_index.md
+1 -1
View File
@@ -1,5 +1,5 @@
---
title: Docs
title: Home
aliases: [/rancher/v2.x/en/]
weight: 1
---
content/rancher/v2.x/en/docs/architecture/_index.md → content/rancher/v2.x/en/home/architecture/_index.md
View File
content/rancher/v2.x/en/docs/overview/_index.md → content/rancher/v2.x/en/home/overview/_index.md
View File
content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md
+21 -19
View File
@@ -14,12 +14,23 @@ For development environments, we recommend installing Rancher by running a singl
Installation of Rancher on a single node with an external load balancer involves multiple procedures. Review this overview to learn about each procedure you need to complete.
1. [Provision Linux Host](#part-1-provision-linux-host)
Provision a single Linux host to launch your {{< product >}} Server.
2. [Choose an SSL Option and Install Rancher](#part-2-choose-an-ssl-option-and-install-rancher)
Choose an SSL option for Rancher communication encryption. After choosing an option, run the command that accompanies it to deploy Rancher.
3. [Configure Load Balancer](#part-3-configure-load-balancer)
Setup a load balancer to direct communications with Rancher and your Kubernetes cluster.
4. **For those using a certificate signed by a recognized CA:**
[Remove Default Certificates](#part-4-remove-default-certificates)
If you chose [Option B](#option-b-bring-your-own-certificate-signed-by-recognized-ca) as your SSL option, log into the Rancher UI and remove the certificates that Rancher automatically generates.
## Part 1—Provision Linux Host
@@ -49,18 +60,11 @@ You can choose from the following scenarios:
If you elect to use a self-signed certificate to encrypt communication, you must install the certificate on your load balancer (which you'll do later) and your Rancher container. Run the docker command to deploy Rancher, pointing it toward your certificate.
**Before you Start:**
Create a self-signed certificate.
- The certificate files must be in [PEM format](#ssl-faq-troubleshooting).
- The certificate files must be in base64.
| Type | Location in container |
| ---------------------------- | ---------------------------: |
| CA certificates file | /etc/rancher/ssl/cacerts.pem |
>**Prerequisites:**
>Create a self-signed certificate.
>
>- The certificate files must be in [PEM format](#ssl-faq-troubleshooting).
>- The certificate files must be in base64.
**To Install Rancher Using a Self-Signed Cert:**
@@ -76,13 +80,11 @@ docker run -d -p 80:80 -p 443:443 \
If your cluster is public facing, it's best to use a certificate signed by a recognized CA.
**Before you Start:**
Obtain a certificate signed by a recognized CA, like GoDaddy or DigiCert.
- The certificate files must be in [PEM format](#ssl-faq-troubleshooting).
- The certificate files must be in base64.
>**Prerequisites:**
>Create a self-signed certificate.
>
>- The certificate files must be in [PEM format](#ssl-faq-troubleshooting).
>- The certificate files must be in base64.
**To Install Rancher Using a Cert Signed by a Recognized CA:**
content/rancher/v2.x/en/installation/single-node-install/_index.md
+23 -36
View File
@@ -14,8 +14,13 @@ For development environments, we recommend installing Rancher by running a singl
Installation of Rancher on a single node involves multiple procedures. Review this overview to learn about each procedure you need to complete.
1. [Provision Linux Host](#part-1-provision-linux-host)
Provision a single Linux host to launch your {{< product >}} Server.
2. [Choose an SSL Option and Install Rancher](#part-2-choose-an-ssl-option-and-install-rancher)
Choose an SSL option for Rancher communication encryption. After choosing an option, run the command that accompanies it to deploy Rancher.
## Part 1—Provision Linux Host
Provision a single Linux host to launch your {{< product >}} Server.
@@ -57,22 +62,13 @@ If you install Rancher without specifying your own certificate, Rancher generate
Your Rancher install can use a self-signed certificate that you provide to encrypt communications.
**Before You Start:**
>**Prerequisites:**
>Create a self-signed certificate.
>
>- The certificate files must be in [PEM format](#ssl-faq-troubleshooting).
>- The certificate files must be in base64.
>- Make sure that your certificate file includes all the intermediate certificates in the chain. The order of certificates in this case is your own certificate first, followed by the intermediates. For an example, refer to the [SSL FAQ / Troubleshooting](#ssl-faq-troubleshooting).
Create a self-signed Certificate.
- The certificate files must be in [PEM format](#ssl-faq-troubleshooting).
- The certificate files must be in base64.
- Make sure that your certificate file includes all the intermediate certificates in the chain. The order of certificates in this case is your own certificate first, followed by the intermediates. For an example, refer to the [SSL FAQ / Troubleshooting](#ssl-faq-troubleshooting).
| Type | Location in container |
| ---------------------------- | ---------------------------: |
| Certificate file | /etc/rancher/ssl/cert.pem |
| Certificate key file | /etc/rancher/ssl/key.pem |
| CA certificates file | /etc/rancher/ssl/cacerts.pem |
<br/>
**To Install Rancher Using a Self-Signed Cert:**
@@ -94,21 +90,12 @@ If you're publishing your app publically, you should ideally be using a certific
**Before You Start:**
Obtain a certificate signed by a recognized CA, like GoDaddy or DigiCert.
- The certificate files must be in [PEM format](#ssl-faq-troubleshooting).
- The certificate files must be in base64.
- Make sure that the container includes your certificate file and the key file.
In this case, mounting an additional CA certificate file is unnecessary because the cert is signed by a recognized CA.
| Type | Location in container |
| ---------------------------- | ---------------------------: |
| Certificate file | /etc/rancher/ssl/cert.pem |
| Certificate key file | /etc/rancher/ssl/key.pem |
>**Prerequisites:**
>Create a self-signed certificate.
>
>- The certificate files must be in [PEM format](#ssl-faq-troubleshooting).
>- The certificate files must be in base64.
>- Make sure that the container includes your certificate file and the key file. In this case, mounting an additional CA certificate file is unnecessary because the cert is signed by a recognized CA.
**To Install Rancher Using a Certificate Signed by a Recognized CA:**
@@ -123,12 +110,12 @@ After obtaining your certificate, run the Docker command to deploy Rancher, poin
### Option D—Let's Encrypt Certificate
Rancher supports Let's Encrypt certificates. Let's Encrypt uses an **http-01 challenge** to verify that you have control over your domain. You can confirm that you control the domain by pointing the hostname that you want to use for Rancher access (for example, `rancher.mydomain.com`) to the IP of the machine it is running on. You can bind the hostname to the IP address by creating an A record in DNS.
Rancher supports Let's Encrypt certificates. Let's Encrypt uses an http-01 challenge to verify that you have control over your domain. You can confirm that you control the domain by pointing the hostname that you want to use for Rancher access (for example, `rancher.mydomain.com`) to the IP of the machine it is running on. You can bind the hostname to the IP address by creating an A record in DNS.
**Before You Start:**
- Create a record in your DNS that binds your Linux host IP address to the hostname that you want to use for Rancher access (`rancher.mydomain.com` for example).
- Open port `TCP/80` on your Linux host. The Let's Encrypt **http-01 challenge** can come from any source IP address, so port `TCP/80` needs to be open to all IP addresses.
>**Prerequisites:**
>
>- Create a record in your DNS that binds your Linux host IP address to the hostname that you want to use for Rancher access (`rancher.mydomain.com` for example).
>- Open port `TCP/80` on your Linux host. The Let's Encrypt http-01 challenge can come from any source IP address, so port `TCP/80` must be open to all IP addresses.
**To Install Rancher Using a Let's Encrypt Certificate:**
@@ -141,7 +128,7 @@ Run the following commands from your Linux host.
docker run -d -p 80:80 -p 443:443 rancher/rancher --acme-domain rancher.mydomain.com
```
>**Remember:** Let's Encrypt provides rate limits for requesting new certificates, so limit how often you create or destroy the container. For more information, see [Let's Encrypt documentation on rate limits](https://letsencrypt.org/docs/rate-limits/).
>**Remember:** Let's Encrypt provides rate limits for requesting new certificates. Therefore, limit how often you create or destroy the container. For more information, see [Let's Encrypt documentation on rate limits](https://letsencrypt.org/docs/rate-limits/).
2. Install Rancher
layouts/shortcodes/note_server-tags.html
+5 -4
View File
@@ -1,7 +1,8 @@
<blockquote>
<p><strong>Note:</strong></p>
<ul>
<li><code>rancher/rancher</code> is hosted on <a href="https://hub.docker.com/r/rancher/rancher/tags/">DockerHub</a>. If you don't have access to DockerHub, or you are installing Rancher without an internet connection, refer to <a href="/rancher/v2.x/en/installation/air-gap-installation/">Air Gap Installation</a>.</li>
<li>For a list of other Rancher Server tags available, refer to <a href="/rancher/v2.x/en/installation/server-tags/">Rancher Server Tags</a>.</li>
</ul>
<p>The <code>rancher/rancher</code> container is hosted on <a href="https://hub.docker.com/r/rancher/rancher/tags/">DockerHub</a>. If you don't have access to DockerHub, or you are installing Rancher without an Internet connection, refer to <a href="/rancher/v2.x/en/installation/air-gap-installation/">Air Gap Installation</a>.</p>
<p><strong>Note:</strong></p>
<p>For a list of other Rancher Server tags available, refer to <a href="/rancher/v2.x/en/installation/server-tags/">Rancher Server Tags</a>.</p>
</blockquote>
layouts/shortcodes/ssl_faq.html
+12 -8
View File
@@ -1,9 +1,13 @@
<h3>How do I know if my certificates are in PEM format?</h3>
<p>You can recognize the PEM format by:</p>
<p><strong>Starting with:</strong> <code>-----BEGIN CERTIFICATE-----</code></p>
<p><strong>Ending with:</strong> <code>-----END CERTIFICATE-----</code></p>
<p><strong>Example of a PEM certificate</strong></p>
<p>You can recognize the PEM format by the following traits:</p>
<ul>
<li>The file begins with the following header:<br/> <code>-----BEGIN CERTIFICATE-----</code></li>
<li>The header is followed by a long string of characters. Like, really long.</li>
<li>The file ends with a footer:<br/> <code>-----END CERTIFICATE-----</code></li>
</ul>
<p><strong>PEM Certificate Example:</strong></p>
<pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4">
----BEGIN CERTIFICATE-----
@@ -13,22 +17,22 @@ VWQqljhfacYPgp8KJUJENQ9h5hZ2nSCrI+W00Jcw4QcEdCI8HL5wmg==
-----END CERTIFICATE-----
</pre>
<h3>What is the order of certificates in case I want to add my intermediate(s)?</h3>
<h3>What is the order of certificates if I want to add my intermediate(s)?</h3>
<p>The order of adding certificates is as follows:</p>
<pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4">
-----BEGIN CERTIFICATE-----
(Your certificate)
%YOUR_CERTIFICATE%
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(Your intermediate certificate)
%YOUR_INTERMEDIATE_CERTIFICATE%
-----END CERTIFICATE-----
</pre>
<h3>How do I validate my certificate chain?</h3>
<p>You can validate the certificate chain by using the <code>openssl</code> binary. If the output of the command (see the command example below) ends with <code>Verify return code: 0 (ok)</code>, your certificate chain is valid. The <code>ca.pem</code> file should be the same as you supplied to the <code>rancher/rancher</code> container. When using a certificate signed by a well known Certificate Authority, you can omit the <code>-CAfile</code> parameter.</p>
<p>You can validate the certificate chain by using the <code>openssl</code> binary. If the output of the command (see the command example below) ends with <code>Verify return code: 0 (ok)</code>, your certificate chain is valid. The <code>ca.pem</code> file must be the same as you added to the <code>rancher/rancher</code> container. When using a certificate signed by a recognized Certificate Authority, you can omit the <code>-CAfile</code> parameter.</p>
<p><strong>Command</strong></p>
<pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4">