mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-28 14:08:55 +00:00
commiting progress
This commit is contained in:
Mark Bishop
@@ -5,3 +5,6 @@ aliases:
|
|||||||
- /rancher/v2.x/en/installation/after-installation/
|
- /rancher/v2.x/en/installation/after-installation/
|
||||||
---
|
---
|
||||||
This section contains information about how to create backups of your Rancher data and how to restore them in a disaster scenario.
|
This section contains information about how to create backups of your Rancher data and how to restore them in a disaster scenario.
|
||||||
|
|
||||||
|
- For single node backup instructions, see
|
||||||
|
- for high-availability backup instructions, see
|
||||||
|
|||||||
@@ -2,67 +2,69 @@
|
|||||||
title: High Availability Installation with External Load Balancer
|
title: High Availability Installation with External Load Balancer
|
||||||
weight: 276
|
weight: 276
|
||||||
---
|
---
|
||||||
This set of instructions creates a new Kubernetes cluster that's dedicated to running Rancher in a high-availability (HA) configuration. This procedure walks you through setting up a 3-node cluster using the Rancher Kubernetes Engine (RKE). The cluster's sole purpose is running pods for Rancher. The setup is based on:
|
This set of instructions creates a new Kubernetes cluster that's dedicated to running Rancher in a high-availability (HA) configuration. This procedure walks you through setup of a 3-node cluster using the Rancher Kubernetes Engine (RKE). The cluster's sole purpose is running pods for Rancher. The setup is based on:
|
||||||
|
|
||||||
- Layer 7 Loadbalancer with SSL termination (HTTPS)
|
- Layer 7 Loadbalancer with SSL termination (HTTPS)
|
||||||
- NGINX Ingress controller (HTTP)
|
- NGINX Ingress controller (HTTP)
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Overview
|
## Installation Outline
|
||||||
|
|
||||||
1. [Provision Linux Hosts](#part-1-provision-linux-hosts)
|
Installation of Rancher in a high-availability configuration involves multiple procedures. Review this outline to learn about each procedure you need to complete.
|
||||||
|
|
||||||
|
1. [Provision Linux Hosts](#1-provision-linux-hosts)
|
||||||
|
|
||||||
Provision three Linux hosts to serve as your Kubernetes cluster.
|
Provision three Linux hosts to serve as your Kubernetes cluster.
|
||||||
|
|
||||||
2. [Configure Load Balancer](#part-2-configure-load-balancer)
|
2. [Configure Load Balancer](#2-configure-load-balancer)
|
||||||
|
|
||||||
Configure your load balancer to have a highly available single point of entry to your Rancher cluster.
|
Configure your load balancer to have a highly available single point of entry to your Rancher cluster.
|
||||||
|
|
||||||
3. [Configure DNS](#part-3-configure-dns)
|
3. [Configure DNS](#3-configure-dns)
|
||||||
|
|
||||||
Make your setup accessible using a DNS name by configuring the DNS to point to your loadbalancer.
|
Make your setup accessible using a DNS name by configuring the DNS to point to your loadbalancer.
|
||||||
|
|
||||||
4. [Download RKE](#part-4-download-rke)
|
4. [Download RKE](#4-download-rke)
|
||||||
|
|
||||||
Rancher Kubernetes Engine (RKE) is a fast, versatile Kubernetes installer that you can use to install Kubernetes on your Linux hosts.
|
RKE is a fast, versatile Kubernetes installer that you can use to install Kubernetes on your Linux hosts.
|
||||||
|
|
||||||
5. [Download Config File Template](#part-5-download-config-file-template)
|
5. [Download RKE Config File Template](#5-download-config-file-template)
|
||||||
|
|
||||||
RKE uses a `.yml` config file to install and configure your Kubernetes cluster. Download one of our config file templates to get started.
|
RKE uses a `.yml` config file to install and configure your Kubernetes cluster. Download one of our RKE config file templates to get started.
|
||||||
|
|
||||||
6. [Configure Nodes](#part-6-configure-nodes)
|
6. [Configure Nodes](#6-configure-nodes)
|
||||||
|
|
||||||
Configure the **Nodes** section of the template.
|
Configure the **Nodes** section of the RKE config template.
|
||||||
|
|
||||||
7. [Configure Certificates](#part-7-configure-certificates)
|
7. [Configure Certificates](#7-configure-certificates)
|
||||||
|
|
||||||
Configure the **Certificates** part of the template too.
|
Configure the **Certificates** part of the template too.
|
||||||
|
|
||||||
8. [Configure FQDN](#part-8-configure-fqdn)
|
8. [Configure FQDN](#8-configure-fqdn)
|
||||||
|
|
||||||
You guessed it. Configure the **FQDN** part of the template.
|
And the **FQDN** part.
|
||||||
|
|
||||||
9. [Backup Your YAML File](#part-9-backup-your-yaml-file)
|
9. [Backup Your RKE Config File](#9-backup-your-rke-config-file)
|
||||||
|
|
||||||
After you've completed configuration of the config file template, back the config file up in a safe place. You can reuse this file for upgrades later.
|
After you've completed configuration of the RKE config file: 1. it's no longer a template, since you'll be using it, and 2. you should backup the RKE config file to a safe place. You can reuse this file for upgrades later.
|
||||||
|
|
||||||
10. [Run RKE](#part-10-run-rke)
|
10. [Run RKE](#10-run-rke)
|
||||||
|
|
||||||
Run RKE to deploy Rancher to your cluster.
|
Run RKE to deploy Rancher to your cluster.
|
||||||
|
|
||||||
11. [Backup Config File](#part-11-backup-config-file)
|
11. [Backup Auto-Generated Config File](#11-backup-auto-generated-config-file)
|
||||||
|
|
||||||
During installation, RKE generates a config file that you'll use later for upgrades. Back it up to a safe location.
|
During installation, RKE generates a config file that you'll use later for upgrades. Back it up to a safe location.
|
||||||
|
|
||||||
12. **For those using a certificate signed by a recognized CA:**
|
12. **For those using a certificate signed by a recognized CA:**
|
||||||
|
|
||||||
[Remove Default Certificates](#part-12-remove-default-certificates)
|
[Remove Default Certificates](#12-remove-default-certificates)
|
||||||
|
|
||||||
If you chose [Option B](#option-b-bring-your-own-certificate-signed-by-recognized-ca) as your SSL option, log into the Rancher UI and remove the certificates that Rancher automatically generates.
|
If you chose [Option B](#option-b-bring-your-own-certificate-signed-by-recognized-ca) as your SSL option, log into the Rancher UI and remove the certificates that Rancher automatically generates.
|
||||||
|
|
||||||
|
<br/>
|
||||||
## Part 1-Provision Linux Hosts
|
## 1. Provision Linux Hosts
|
||||||
|
|
||||||
Before you install Rancher, confirm you meet the host requirements. Provision 3 new Linux hosts using the requirements below.
|
Before you install Rancher, confirm you meet the host requirements. Provision 3 new Linux hosts using the requirements below.
|
||||||
|
|
||||||
@@ -76,7 +78,7 @@ Before you install Rancher, confirm you meet the host requirements. Provision 3
|
|||||||
|
|
||||||
{{< requirements_ports >}}
|
{{< requirements_ports >}}
|
||||||
|
|
||||||
## Part 2-Configure Load Balancer
|
## 2. Configure Load Balancer
|
||||||
|
|
||||||
When using a load balancer in front of Rancher, there's no need for the container to redirect port communication from port 80 or port 443. By passing the header `X-Forwarded-Proto: https`, this redirect is disabled. This is the expected configuration when terminating SSL externally.
|
When using a load balancer in front of Rancher, there's no need for the container to redirect port communication from port 80 or port 443. By passing the header `X-Forwarded-Proto: https`, this redirect is disabled. This is the expected configuration when terminating SSL externally.
|
||||||
|
|
||||||
@@ -99,215 +101,235 @@ We have example configurations for the following load balancers:
|
|||||||
|
|
||||||
* [Amazon ALB]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install-external-lb/alb)
|
* [Amazon ALB]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install-external-lb/alb)
|
||||||
|
|
||||||
## Part 3-Configure DNS
|
## 3. Configure DNS
|
||||||
|
|
||||||
Choose a fully qualified domain name (FQDN) you want to use to access Rancher (something like `rancher.yourdomain.com`).<br/><br/>You need to create a DNS A record, pointing to the IP address of your [Load Balancer](#part-2-configure-load-balancer). If the DNS A record is created, you can validate if it's setup correctly by running `nslookup rancher.yourdomain.com`. It should return the IP address of your [Load Balancer](#part-2-configure-load-balancer) like in the example below.
|
Choose a fully qualified domain name (FQDN) that you want to use access Rancher (something like `rancher.yourdomain.com`).<br/><br/>
|
||||||
|
|
||||||
```
|
1. Log into your DNS server a create a `DNS A` record that points to the IP address of your [load balancer](#2-configure-load-balancer).
|
||||||
$ nslookup rancher.yourdomain.com
|
|
||||||
Server: your_nameserver_ip
|
|
||||||
Address: your_nameserver_ip#53
|
|
||||||
|
|
||||||
Non-authoritative answer:
|
2. Validate that the `DNS A` is working correctly. Run the following command from any terminal, replacing `HOSTNAME.DOMAIN.COM` with your chosen FQDN:
|
||||||
Name: rancher.yourdomain.com
|
|
||||||
Address: ip_of_loadbalancer
|
|
||||||
```
|
|
||||||
|
|
||||||
## Part 4-Download RKE
|
`nslookup HOSTNAME.DOMAIN.COM`
|
||||||
|
|
||||||
Rancher Kubernetes Engine (RKE) is a fast, versatile Kubernetes installer that you can use to install Kubernetes on your Linux hosts. We will be using RKE to setup our cluster and run Rancher.
|
**Step Result:** Terminal displays output similar to the following:
|
||||||
|
|
||||||
From your workstation, open a web browser and navigate to our [RKE Releases](https://github.com/rancher/rke/releases/latest) page. Download the latest RKE installer applicable to your Operating System:
|
```
|
||||||
|
$ nslookup rancher.yourdomain.com
|
||||||
|
Server: YOUR_HOSTNAME_IP_ADDRESS
|
||||||
|
Address: YOUR_HOSTNAME_IP_ADDRESS#53
|
||||||
|
|
||||||
* **MacOS**: `rke_darwin-amd64`
|
Non-authoritative answer:
|
||||||
* **Linux**: `rke_linux-amd64`
|
Name: rancher.yourdomain.com
|
||||||
|
Address: HOSTNAME.DOMAIN.COM
|
||||||
|
```
|
||||||
|
|
||||||
Make the RKE binary that you just downloaded executable. Open Terminal, change directory to the location of the RKE binary, and then run the following command:
|
<br/>
|
||||||
|
|
||||||
```
|
## 4. Download RKE
|
||||||
# MacOS
|
|
||||||
$ chmod +x rke_darwin-amd64
|
|
||||||
# Linux
|
|
||||||
$ chmod +x rke_linux-amd64
|
|
||||||
```
|
|
||||||
|
|
||||||
Confirm that RKE is now executable by running the following command:
|
RKE is a fast, versatile Kubernetes installer that you can use to install Kubernetes on your Linux hosts. We will be using RKE to setup our cluster and run Rancher.
|
||||||
|
|
||||||
```
|
1. From your workstation, open a web browser and navigate to our [RKE Releases](https://github.com/rancher/rke/releases/latest) page. Download the latest RKE installer applicable to your Operating System:
|
||||||
# MacOS
|
|
||||||
$ ./rke_darwin-amd64 -version
|
|
||||||
# Linux
|
|
||||||
$ ./rke_linux-amd64 -version
|
|
||||||
```
|
|
||||||
|
|
||||||
**Result:** You receive output similar to what follows:
|
- **MacOS**: `rke_darwin-amd64`
|
||||||
```
|
- **Linux**: `rke_linux-amd64`
|
||||||
rke version v<N.N.N>
|
- **Windows**: `rke_windows-amd64.exe`
|
||||||
```
|
|
||||||
|
|
||||||
## Part 5-Download Config File Template
|
2. Make the RKE binary that you just downloaded executable. Open Terminal, change directory to the location of the RKE binary, and then run one of the commands below.
|
||||||
|
|
||||||
|
>**Using Windows?**
|
||||||
|
>The file is already an executable. Skip to [Download Config File Template](#5-download-config-file-template).
|
||||||
|
|
||||||
|
```
|
||||||
|
# MacOS
|
||||||
|
$ chmod +x rke_darwin-amd64
|
||||||
|
# Linux
|
||||||
|
$ chmod +x rke_linux-amd64
|
||||||
|
```
|
||||||
|
|
||||||
|
3. Confirm that RKE is now executable by running the following command:
|
||||||
|
|
||||||
|
```
|
||||||
|
# MacOS
|
||||||
|
$ ./rke_darwin-amd64 -version
|
||||||
|
# Linux
|
||||||
|
$ ./rke_linux-amd64 -version
|
||||||
|
```
|
||||||
|
|
||||||
|
**Step Result:** You receive output similar to what follows:
|
||||||
|
```
|
||||||
|
rke version v<N.N.N>
|
||||||
|
```
|
||||||
|
|
||||||
|
## 5. Download RKE Config File Template
|
||||||
|
|
||||||
RKE uses a `.yml` config file to install and configure your Kubernetes cluster. There are 2 templates to choose from, depending on the SSL certificate you want to use.
|
RKE uses a `.yml` config file to install and configure your Kubernetes cluster. There are 2 templates to choose from, depending on the SSL certificate you want to use.
|
||||||
|
|
||||||
1. Download one of following templates, depending on the SSL certificate you're using.
|
1. Download one of following templates, depending on the SSL certificate you're using.
|
||||||
|
|
||||||
- [Template for using Self Signed Certificate (3-node-externalssl-certificate.yml)](https://raw.githubusercontent.com/rancher/rancher/58e695b51096b1f404188379cea6f6a35aea9e4c/rke-templates/3-node-externalssl-certificate.yml)
|
- [Template for self-signed certificate<br/> `3-node-externalssl-certificate.yml`](https://raw.githubusercontent.com/rancher/rancher/58e695b51096b1f404188379cea6f6a35aea9e4c/rke-templates/3-node-externalssl-certificate.yml)
|
||||||
- [Template for using Certificate Signed By A Recognized Certificate Authority (3-node-externalssl-recognizedca.yml)](https://raw.githubusercontent.com/rancher/rancher/58e695b51096b1f404188379cea6f6a35aea9e4c/rke-templates/3-node-externalssl-recognizedca.yml)
|
- [Template for certificate signed by recognized CA<br/> `3-node-externalssl-recognizedca.yml`](https://raw.githubusercontent.com/rancher/rancher/58e695b51096b1f404188379cea6f6a35aea9e4c/rke-templates/3-node-externalssl-recognizedca.yml)
|
||||||
|
|
||||||
2. Rename the file to `rancher-cluster.yml`.
|
2. Rename the file to `rancher-cluster.yml`.
|
||||||
|
|
||||||
## Part 6-Configure Nodes
|
## 6. Configure Nodes
|
||||||
|
|
||||||
Once you have the `rancher-cluster.yml` config file template, edit the nodes section to point toward your Linux hosts.
|
Once you have the `rancher-cluster.yml` config file template, edit the nodes section to point toward your Linux hosts.
|
||||||
|
|
||||||
Open `rancher-cluster.yml` in your favorite text editor.
|
1. Open `rancher-cluster.yml` in your favorite text editor.
|
||||||
|
|
||||||
Update the `nodes` section with the information of your [Linux hosts](#provision-linux-hosts)
|
2. Update the `nodes` section with the information of your [Linux hosts](#provision-linux-hosts).
|
||||||
|
|
||||||
For each node in your cluster, update the following placeholders:
|
For each node in your cluster, update the following placeholders: `IP_ADDRESS_X` and `USER`.
|
||||||
|
|
||||||
- `<IP>`: The IP address or hostname of the node.
|
|
||||||
- `<USER>`: The username to use to setup a SSH connection to the node. If the user is not the `root` user, make sure the user has access to the Docker socket. This can be tested by logging in on the node as the configured user and run `docker ps`.
|
|
||||||
- `<SSHKEY_FILE>`: The path of the SSH private key file used to authenticate to the node.
|
|
||||||
|
|
||||||
**Example nodes section YAML**
|
|
||||||
|
|
||||||
```
|
```
|
||||||
nodes:
|
nodes:
|
||||||
- address: 1.1.1.1
|
- address: IP_ADDRESS_1
|
||||||
user: root
|
# THE IP ADDRESS OR HOSTNAME OF THE NODE
|
||||||
|
user: USER
|
||||||
|
# USER WITH ADMIN ACCESS. USUALLY `root`
|
||||||
role: [controlplane,etcd,worker]
|
role: [controlplane,etcd,worker]
|
||||||
ssh_key_path: ~/.ssh/id_rsa
|
ssh_key_path: ~/.ssh/id_rsa
|
||||||
- address: 2.2.2.2
|
# PATH TO SSH KEY THAT AUTHENTICATES ON YOUR WORKSTATION
|
||||||
user: root
|
# USUALLY THE VALUE ABOVE
|
||||||
|
- address: IP_ADDRESS_2
|
||||||
|
user: USER
|
||||||
role: [controlplane,etcd,worker]
|
role: [controlplane,etcd,worker]
|
||||||
ssh_key_path: ~/.ssh/id_rsa
|
ssh_key_path: ~/.ssh/id_rsa
|
||||||
- address: 3.3.3.3
|
- address: IP_ADDRESS_3
|
||||||
user: root
|
user: USER
|
||||||
role: [controlplane,etcd,worker]
|
role: [controlplane,etcd,worker]
|
||||||
ssh_key_path: ~/.ssh/id_rsa
|
ssh_key_path: ~/.ssh/id_rsa
|
||||||
```
|
```
|
||||||
|
|
||||||
## Part 7-Configure certificates
|
## 7. Configure Certificates
|
||||||
|
|
||||||
Certificates can be configured by using base64 encoded strings in the config file. The base64 encoded string can be generated using the following command:
|
For security purposes, SSL (Secure Sockets Layer) is required when using Rancher. SSL secures all Rancher network communication, like when you login or interact with a cluster.
|
||||||
|
|
||||||
- **MacOS**: `cat FILENAME| base64`
|
Choose from the following options:
|
||||||
- **Linux**: `cat FILENAME | base64 -w0`
|
|
||||||
- **Windows**: `certutil -encode FILENAME FILENAME.base64`
|
|
||||||
|
|
||||||
### Option A-Self Signed Certificate
|
- [Option A—Bring Your Own Certificate: Self-Signed](#option-a-bring-your-own-certificate-self-signed)
|
||||||
|
- [Option B—Bring Your Own Certificate: Signed by Recognized CA](#option-b-bring-your-own-certificate-signed-by-recognized-ca)
|
||||||
|
|
||||||
>**Note:**
|
### Option A—Bring Your Own Certificate: Self-Signed
|
||||||
> If you are using Certificate Signed By A Recognized Certificate Authority, [click here](#option-b-certificate-signed-by-a-recognized-certificate-authority) to proceed.
|
|
||||||
|
|
||||||
If you are using a Self Signed Certificate, you will need to generate a base64 encoded string for your CA certificate file.
|
>**Prerequisites:**
|
||||||
|
>Create a self-signed certificate.
|
||||||
|
>
|
||||||
|
>- The certificate files must be in [PEM format](#pem).
|
||||||
|
>- The certificate files must be encoded in [base64](#base64).
|
||||||
|
>- In your certificate file, include all intermediate certificates in the chain. Order your certificates with your certificate first, followed by the intermediates. For an example, see [SSL FAQ / Troubleshooting](#cert-order).
|
||||||
|
|
||||||
In the `kind: Secret` with `name: cattle-keys-server`:
|
1. In `kind: Secret` with `name: cattle-keys-ingress`:
|
||||||
|
|
||||||
* Replace `<BASE64_CA>` with the base64 encoded string of the CA Certificate file (usually called `ca.pem` or `ca.crt`)
|
* Replace `<BASE64_CA>` with the base64 encoded string of the CA Certificate file (usually called `ca.pem` or `ca.crt`)
|
||||||
|
|
||||||
After replacing the value, the file should look like the example below (the base64 encoded string should be different):
|
>**Note:**
|
||||||
|
> The base64 encoded string should be on the same line as `cacerts.pem`, without any newline at the beginning, in between or at the end.
|
||||||
|
|
||||||
>**Note:**
|
**Result:** After replacing the values, the file should look like the example below (the base64 encoded strings should be different):
|
||||||
> The base64 encoded string should be on the same line as `cacerts.pem`, without any newline at the beginning, in between or at the end.
|
|
||||||
|
|
||||||
```
|
```
|
||||||
---
|
---
|
||||||
apiVersion: v1
|
apiVersion: v1
|
||||||
kind: Secret
|
kind: Secret
|
||||||
metadata:
|
metadata:
|
||||||
name: cattle-keys-server
|
name: cattle-keys-server
|
||||||
namespace: cattle-system
|
namespace: cattle-system
|
||||||
type: Opaque
|
type: Opaque
|
||||||
data:
|
data:
|
||||||
cacerts.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNvRENDQVlnQ0NRRHVVWjZuMEZWeU16QU5CZ2txaGtpRzl3MEJBUXNGQURBU01SQXdEZ1lEVlFRRERBZDAKWlhOMExXTmhNQjRYRFRFNE1EVXdOakl4TURRd09Wb1hEVEU0TURjd05USXhNRFF3T1Zvd0VqRVFNQTRHQTFVRQpBd3dIZEdWemRDMWpZVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFNQmpBS3dQCndhRUhwQTdaRW1iWWczaTNYNlppVmtGZFJGckJlTmFYTHFPL2R0RUdmWktqYUF0Wm45R1VsckQxZUlUS3UzVHgKOWlGVlV4Mmo1Z0tyWmpwWitCUnFiZ1BNbk5hS1hocmRTdDRtUUN0VFFZdGRYMVFZS0pUbWF5NU45N3FoNTZtWQprMllKRkpOWVhHWlJabkdMUXJQNk04VHZramF0ZnZOdmJ0WmtkY2orYlY3aWhXanp2d2theHRUVjZlUGxuM2p5CnJUeXBBTDliYnlVcHlad3E2MWQvb0Q4VUtwZ2lZM1dOWmN1YnNvSjhxWlRsTnN6UjVadEFJV0tjSE5ZbE93d2oKaG41RE1tSFpwZ0ZGNW14TU52akxPRUc0S0ZRU3laYlV2QzlZRUhLZTUxbGVxa1lmQmtBZWpPY002TnlWQUh1dApuay9DMHpXcGdENkIwbkVDQXdFQUFUQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFHTCtaNkRzK2R4WTZsU2VBClZHSkMvdzE1bHJ2ZXdia1YxN3hvcmlyNEMxVURJSXB6YXdCdFJRSGdSWXVtblVqOGo4T0hFWUFDUEthR3BTVUsKRDVuVWdzV0pMUUV0TDA2eTh6M3A0MDBrSlZFZW9xZlVnYjQrK1JLRVJrWmowWXR3NEN0WHhwOVMzVkd4NmNOQQozZVlqRnRQd2hoYWVEQmdma1hXQWtISXFDcEsrN3RYem9pRGpXbi8walI2VDcrSGlaNEZjZ1AzYnd3K3NjUDIyCjlDQVZ1ZFg4TWpEQ1hTcll0Y0ZINllBanlCSTJjbDhoSkJqa2E3aERpVC9DaFlEZlFFVFZDM3crQjBDYjF1NWcKdE03Z2NGcUw4OVdhMnp5UzdNdXk5bEthUDBvTXl1Ty82Tm1wNjNsVnRHeEZKSFh4WTN6M0lycGxlbTNZQThpTwpmbmlYZXc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
cacerts.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNvRENDQVlnQ0NRRHVVWjZuMEZWeU16QU5CZ2txaGtpRzl3MEJBUXNGQURBU01SQXdEZ1lEVlFRRERBZDAKWlhOMExXTmhNQjRYRFRFNE1EVXdOakl4TURRd09Wb1hEVEU0TURjd05USXhNRFF3T1Zvd0VqRVFNQTRHQTFVRQpBd3dIZEdWemRDMWpZVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFNQmpBS3dQCndhRUhwQTdaRW1iWWczaTNYNlppVmtGZFJGckJlTmFYTHFPL2R0RUdmWktqYUF0Wm45R1VsckQxZUlUS3UzVHgKOWlGVlV4Mmo1Z0tyWmpwWitCUnFiZ1BNbk5hS1hocmRTdDRtUUN0VFFZdGRYMVFZS0pUbWF5NU45N3FoNTZtWQprMllKRkpOWVhHWlJabkdMUXJQNk04VHZramF0ZnZOdmJ0WmtkY2orYlY3aWhXanp2d2theHRUVjZlUGxuM2p5CnJUeXBBTDliYnlVcHlad3E2MWQvb0Q4VUtwZ2lZM1dOWmN1YnNvSjhxWlRsTnN6UjVadEFJV0tjSE5ZbE93d2oKaG41RE1tSFpwZ0ZGNW14TU52akxPRUc0S0ZRU3laYlV2QzlZRUhLZTUxbGVxa1lmQmtBZWpPY002TnlWQUh1dApuay9DMHpXcGdENkIwbkVDQXdFQUFUQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFHTCtaNkRzK2R4WTZsU2VBClZHSkMvdzE1bHJ2ZXdia1YxN3hvcmlyNEMxVURJSXB6YXdCdFJRSGdSWXVtblVqOGo4T0hFWUFDUEthR3BTVUsKRDVuVWdzV0pMUUV0TDA2eTh6M3A0MDBrSlZFZW9xZlVnYjQrK1JLRVJrWmowWXR3NEN0WHhwOVMzVkd4NmNOQQozZVlqRnRQd2hoYWVEQmdma1hXQWtISXFDcEsrN3RYem9pRGpXbi8walI2VDcrSGlaNEZjZ1AzYnd3K3NjUDIyCjlDQVZ1ZFg4TWpEQ1hTcll0Y0ZINllBanlCSTJjbDhoSkJqa2E3aERpVC9DaFlEZlFFVFZDM3crQjBDYjF1NWcKdE03Z2NGcUw4OVdhMnp5UzdNdXk5bEthUDBvTXl1Ty82Tm1wNjNsVnRHeEZKSFh4WTN6M0lycGxlbTNZQThpTwpmbmlYZXc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||||
```
|
```
|
||||||
|
|
||||||
### Option B-Certificate Signed By A Recognized Certificate Authority
|
### Option B—Bring Your Own Certificate: Signed by Recognized CA
|
||||||
|
|
||||||
If you are using a Certificate Signed By A Recognized Certificate Authority, you don't need to perform any step in this part.
|
If you are using a Certificate Signed By A Recognized Certificate Authority, you don't need to perform any step in this part.
|
||||||
|
|
||||||
## Part 8-Configure FQDN
|
## 8. Configure FQDN
|
||||||
|
|
||||||
There is 1 reference to `<FQDN>` in the config file. This needs to be replaced with the FQDN chosen in [Configure DNS](#part-3-configure-dns).
|
There is one reference to `<FQDN>` in the RKE config file. Replace this reference with the FQDN you chose in in [3. Configure DNS](#part-3-configure-dns).
|
||||||
|
|
||||||
In the `kind: Ingress` with `name: cattle-ingress-http`:
|
1. Open `rancher-cluster.yml`.
|
||||||
|
|
||||||
* Replace `<FQDN>` with the FQDN chosen in [Configure DNS](#part-3-configure-dns).
|
2. In the `kind: Ingress` with `name: cattle-ingress-http:`
|
||||||
|
|
||||||
After replacing `<FQDN>` with the FQDN chosen in [Configure DNS](#part-3-configure-dns), the file should look like the example below (`rancher.yourdomain.com` is the FQDN used in this example):
|
Replace `<FQDN>` with the FQDN chosen in [3. Configure DNS](#3-configure-dns).
|
||||||
|
|
||||||
```
|
**Step Result:** After replacing the values, the file should look like the example below (the base64 encoded strings should be different):
|
||||||
---
|
|
||||||
apiVersion: extensions/v1beta1
|
|
||||||
kind: Ingress
|
|
||||||
metadata:
|
|
||||||
namespace: cattle-system
|
|
||||||
name: cattle-ingress-http
|
|
||||||
annotations:
|
|
||||||
nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
|
|
||||||
nginx.ingress.kubernetes.io/proxy-read-timeout: "1800" # Max time in seconds for ws to remain shell window open
|
|
||||||
nginx.ingress.kubernetes.io/proxy-send-timeout: "1800" # Max time in seconds for ws to remain shell window open
|
|
||||||
spec:
|
|
||||||
rules:
|
|
||||||
- host: rancher.yourdomain.com
|
|
||||||
http:
|
|
||||||
paths:
|
|
||||||
- backend:
|
|
||||||
serviceName: cattle-service
|
|
||||||
servicePort: 80
|
|
||||||
```
|
|
||||||
|
|
||||||
Save the `.yml` file and close it.
|
```
|
||||||
|
apiVersion: extensions/v1beta1
|
||||||
|
kind: Ingress
|
||||||
|
metadata:
|
||||||
|
namespace: cattle-system
|
||||||
|
name: cattle-ingress-http
|
||||||
|
annotations:
|
||||||
|
nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
|
||||||
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "1800" # Max time in seconds for ws to remain shell window open
|
||||||
|
nginx.ingress.kubernetes.io/proxy-send-timeout: "1800" # Max time in seconds for ws to remain shell window open
|
||||||
|
spec:
|
||||||
|
rules:
|
||||||
|
- host: rancher.yourdomain.com
|
||||||
|
http:
|
||||||
|
paths:
|
||||||
|
- backend:
|
||||||
|
serviceName: cattle-service
|
||||||
|
servicePort: 80
|
||||||
|
```
|
||||||
|
|
||||||
## Part 9-Backup Your YAML File
|
|
||||||
|
|
||||||
After you close your `.yml` file, back it up to a secure location. You can use this file again when it's time to upgrade Rancher.
|
3. Save the file and close it.
|
||||||
|
|
||||||
## Part 10-Run RKE
|
## 9. Backup Your RKE Config File
|
||||||
|
|
||||||
|
After you close your RKE config file, `rancher-cluster.yml`, back it up to a secure location. You can use this file again when it's time to upgrade Rancher.
|
||||||
|
|
||||||
|
## 10. Run RKE
|
||||||
|
|
||||||
All configuration is in place to run RKE. You can do this by running the `rke up` command and using the `--config` parameter to point to your config file.
|
All configuration is in place to run RKE. You can do this by running the `rke up` command and using the `--config` parameter to point to your config file.
|
||||||
|
|
||||||
From your workstation, make sure `rancher-cluster.yml` and the downloaded `rke` binary are in the same directory.
|
1. From your workstation, make sure `rancher-cluster.yml` and the downloaded `rke` binary are in the same directory.
|
||||||
|
|
||||||
Open a Terminal instance. Change to the directory that contains your config file and `rke`.
|
2. Open a Terminal instance. Change to the directory that contains your config file and `rke`.
|
||||||
|
|
||||||
**Example:**
|
3. Enter one of the `rke up` commands listen below.
|
||||||
|
|
||||||
```
|
```
|
||||||
# MacOS
|
# MacOS
|
||||||
./rke_darwin-amd64 up --config rancher-cluster.yml
|
./rke_darwin-amd64 up --config rancher-cluster.yml
|
||||||
# Linux
|
# Linux
|
||||||
./rke_linux-amd64 up --config rancher-cluster.yml
|
./rke_linux-amd64 up --config rancher-cluster.yml
|
||||||
```
|
```
|
||||||
|
|
||||||
The output should be similar to the snippet below:
|
**Step Result:** The output should be similar to the snippet below:
|
||||||
|
|
||||||
```
|
```
|
||||||
INFO[0000] Building Kubernetes cluster
|
INFO[0000] Building Kubernetes cluster
|
||||||
INFO[0000] [dialer] Setup tunnel for host [1.1.1.1]
|
INFO[0000] [dialer] Setup tunnel for host [1.1.1.1]
|
||||||
INFO[0000] [network] Deploying port listener containers
|
INFO[0000] [network] Deploying port listener containers
|
||||||
INFO[0000] [network] Pulling image [alpine:latest] on host [1.1.1.1]
|
INFO[0000] [network] Pulling image [alpine:latest] on host [1.1.1.1]
|
||||||
...
|
...
|
||||||
INFO[0101] Finished building Kubernetes cluster successfully
|
INFO[0101] Finished building Kubernetes cluster successfully
|
||||||
```
|
```
|
||||||
|
|
||||||
## Part 11-Backup Config File
|
## 11. Backup Auto-Generated Config File
|
||||||
|
|
||||||
During installation, RKE generates a config file named `kube_config_rancher-cluster.yml` in the same directory as the RKE binary. Copy this file and back it up to a safe location. You'll use this file later when upgrading Rancher Server.
|
During installation, RKE automatically generates a config file named `kube_config_rancher-cluster.yml` in the same directory as the RKE binary. Copy this file and back it up to a safe location. You'll use this file later when upgrading Rancher Server.
|
||||||
|
|
||||||
## Part 12-Remove Default Certificates
|
## 12. Remove Default Certificates
|
||||||
|
|
||||||
**For those using a certificate signed by a recognized CA:**
|
**For those using a certificate signed by a recognized CA:**
|
||||||
|
|
||||||
>**Note:** If you're using a self-signed certificate, you don't have to complete this part. Continue to [What's Next?](#what-s-next).
|
>**Note:** If you're using a self-signed certificate, you don't have to complete this procedure. Continue to [What's Next?](#what-s-next)
|
||||||
|
|
||||||
By default, Rancher automatically generates self-signed certificates for itself after installation. However, since you've provided your own certificates, you must disable the certificates that Rancher generated for itself.
|
By default, Rancher automatically generates self-signed certificates for itself after installation. However, since you've provided your own certificates, you must disable the certificates that Rancher generated for itself.
|
||||||
|
|
||||||
**To Remove the Default Certificates:**
|
**To Remove the Default Certificates:**
|
||||||
|
|
||||||
1. Log into Rancher.
|
1. Log into Rancher.
|
||||||
|
|
||||||
2. Select **Settings** > **cacerts**.
|
2. Select **Settings** > **cacerts**.
|
||||||
|
|
||||||
3. Choose `Edit` and remove the contents. Then click `Save`.
|
3. Choose `Edit` and remove the contents. Then click `Save`.
|
||||||
|
|
||||||
## What's Next?
|
## What's Next?
|
||||||
|
|||||||
@@ -158,7 +158,7 @@ Choose a fully qualified domain name (FQDN) that you want to use access Rancher
|
|||||||
|
|
||||||
1. Log into your DNS server a create a `DNS A` record that points to the IP address of your [load balancer](#2-configure-load-balancer).
|
1. Log into your DNS server a create a `DNS A` record that points to the IP address of your [load balancer](#2-configure-load-balancer).
|
||||||
|
|
||||||
2. Validate that the `DNS A` si working correctly. Run the following command from any terminal, replacing `HOSTNAME.DOMAIN.COM` with your chosen FQDN:
|
2. Validate that the `DNS A` is working correctly. Run the following command from any terminal, replacing `HOSTNAME.DOMAIN.COM` with your chosen FQDN:
|
||||||
|
|
||||||
`nslookup HOSTNAME.DOMAIN.COM`
|
`nslookup HOSTNAME.DOMAIN.COM`
|
||||||
|
|
||||||
@@ -212,19 +212,20 @@ RKE is a fast, versatile Kubernetes installer that you can use to install Kubern
|
|||||||
rke version v<N.N.N>
|
rke version v<N.N.N>
|
||||||
```
|
```
|
||||||
|
|
||||||
## 5. Download Config File Template
|
## 5. Download RKE Config File Template
|
||||||
|
|
||||||
RKE uses a `.yml` config file to install and configure your Kubernetes cluster. There are 2 templates to choose from, depending on the SSL certificate you want to use.
|
RKE uses a `.yml` config file to install and configure your Kubernetes cluster. There are 2 templates to choose from, depending on the SSL certificate you want to use.
|
||||||
|
|
||||||
1. Download one of following templates, depending on the SSL certificate you're using.
|
1. Download one of following templates, depending on the SSL certificate you're using.
|
||||||
|
|
||||||
- [Template for self-signed certifcate<br/> `3-node-certificate.yml`](https://raw.githubusercontent.com/rancher/rancher/e9d29b3f3b9673421961c68adf0516807d1317eb/rke-templates/3-node-certificate.yml)
|
- [Template for self-signed certificate<br/> `3-node-certificate.yml`](https://raw.githubusercontent.com/rancher/rancher/e9d29b3f3b9673421961c68adf0516807d1317eb/rke-templates/3-node-certificate.yml)
|
||||||
- [Template for certificate signed by recognized CA<br/> `3-node-certificate-recognizedca.yml`](https://raw.githubusercontent.com/rancher/rancher/e9d29b3f3b9673421961c68adf0516807d1317eb/rke-templates/3-node-certificate-recognizedca.yml)
|
- [Template for certificate signed by recognized CA<br/> `3-node-certificate-recognizedca.yml`](https://raw.githubusercontent.com/rancher/rancher/e9d29b3f3b9673421961c68adf0516807d1317eb/rke-templates/3-node-certificate-recognizedca.yml)
|
||||||
|
|
||||||
2. Rename the file to `rancher-cluster.yml`.
|
2. Rename the file to `rancher-cluster.yml`.
|
||||||
|
|
||||||
## 6. Configure Nodes
|
## 6. Configure Nodes
|
||||||
|
|
||||||
Once you have the `.yml` config file template, edit the nodes section to point toward your Linux hosts.
|
Once you have the `rancher-cluster.yml` config file template, edit the nodes section to point toward your Linux hosts.
|
||||||
|
|
||||||
1. Open `rancher-cluster.yml` in your favorite text editor.
|
1. Open `rancher-cluster.yml` in your favorite text editor.
|
||||||
|
|
||||||
@@ -344,13 +345,13 @@ data:
|
|||||||
|
|
||||||
## 8. Configure FQDN
|
## 8. Configure FQDN
|
||||||
|
|
||||||
There are 2 references to `<FQDN>` in the config file. Both need to be replaced with the FQDN chosen in [Configure DNS](#3-configure-dns).
|
There are two references to `<FQDN>` in the config file (one in this step and one in the next). Both need to be replaced with the FQDN chosen in [Configure DNS](#3-configure-dns).
|
||||||
|
|
||||||
In the `kind: Ingress` with `name: cattle-ingress-http`:
|
In the `kind: Ingress` with `name: cattle-ingress-http`:
|
||||||
|
|
||||||
* Replace `<FQDN>` with the FQDN chosen in [Configure DNS](#3-configure-dns).
|
* Replace `<FQDN>` with the FQDN chosen in [Configure DNS](#3-configure-dns).
|
||||||
|
|
||||||
After replacing `<FQDN>` wit the FQDN chosen in [Configure DNS](#3-configure-dns), the file should look like the example below (`rancher.yourdomain.com` is the FQDN used in this example):
|
After replacing `<FQDN>` with the FQDN chosen in [Configure DNS](#3-configure-dns), the file should look like the example below (`rancher.yourdomain.com` is the FQDN used in this example):
|
||||||
|
|
||||||
```
|
```
|
||||||
---
|
---
|
||||||
@@ -381,7 +382,7 @@ Save the `.yml` file and close it.
|
|||||||
|
|
||||||
## 9. Backup Your YAML File
|
## 9. Backup Your YAML File
|
||||||
|
|
||||||
After you close your `.yml` file, back it up to a secure location. You can use this file again when it's time to upgrade Rancher.
|
After you close your `.yml` file, back it up to a secure location. You can use this file again when it's time to upgrade Rancher.
|
||||||
|
|
||||||
## 10. Run RKE
|
## 10. Run RKE
|
||||||
|
|
||||||
|
|||||||
@@ -41,4 +41,6 @@ Coming Soon
|
|||||||
|
|
||||||
Coming Soon
|
Coming Soon
|
||||||
|
|
||||||
<!-- ## Launching a Catalog App -->
|
## Launching a Catalog App
|
||||||
|
|
||||||
|
Coming Soon
|
||||||
|
|||||||
Reference in New Issue
Block a user