mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-25 04:28:15 +00:00
move lb in with nodes, add chart-options and troubleshooting
This commit is contained in:
Jason Greathouse
@@ -29,8 +29,7 @@ The following CLI tools are required for this install. Please make sure these to
|
||||
|
||||
## Installation Outline
|
||||
|
||||
1. [Provision Nodes]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/nodes/)
|
||||
1. [Configure Load Balancer]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/)
|
||||
1. [Create Nodes and Load Balancer]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/create-nodes-and-load-balancer/)
|
||||
1. [Install Kubernetes with RKE]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rke/)
|
||||
1. [Initialize Helm (tiller)]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/helm/)
|
||||
1. [Install Rancher]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rancher/)
|
||||
|
||||
+20
-3
@@ -1,9 +1,11 @@
|
||||
---
|
||||
title: 1 - Provision Nodes
|
||||
title: 1 - Create Nodes and Load Balancer
|
||||
weight: 276
|
||||
---
|
||||
|
||||
Use your provider of choice to provision 3 nodes for RKE. You will need to provide SSH credentials and DNS/IP address for your nodes to RKE.
|
||||
Use your provider of choice to provision 3 nodes and a Load Balancer endpoint for your RKE install.
|
||||
|
||||
You will need to provide SSH credentials and DNS/IP address for your nodes to RKE.
|
||||
|
||||
### Host Requirements
|
||||
|
||||
@@ -11,7 +13,7 @@ Use your provider of choice to provision 3 nodes for RKE. You will need to provi
|
||||
|
||||
{{< requirements_os >}}<br/>
|
||||
|
||||
#### Hardware
|
||||
#### Nodes
|
||||
|
||||
{{< requirements_hardware >}}<br/>
|
||||
|
||||
@@ -46,3 +48,18 @@ In addition to the ports listed above these ports must be open between nodes.
|
||||
| tcp | 2379-2380 | etcd |
|
||||
| udp | 8472 | overlay networking |
|
||||
| tcp | 10250 | kubelet |
|
||||
<br/>
|
||||
|
||||
### Load Balancer
|
||||
|
||||
RKE will configure an Ingress-Controller pod, on each of your nodes. The ingress controller pods are bound to ports 80 and 443 tcp on the host network and are the entry point for https traffic to the Rancher server.
|
||||
|
||||
Configure a load balancer as a basic Layer 4 tcp forwarder. The exact configuration will vary depending on your environment.
|
||||
|
||||
#### Examples
|
||||
|
||||
* [Amazon NLB]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/create-nodes-and-load-balancer/nlb)
|
||||
|
||||
<br/>
|
||||
|
||||
### [Next: Install Kubernetes with RKE]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rke/)
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: 4 - Initialize Helm (Install tiller)
|
||||
title: 3 - Initialize Helm (Install tiller)
|
||||
weight: 276
|
||||
---
|
||||
|
||||
@@ -40,23 +40,29 @@ kubectl -n kube-system create secret docker-registry regcred \
|
||||
Update the ServiceAccount to include the imagePullSecret. Pods created with this ServiceAccount will automatically have the imagePullSecret added to their manifest.
|
||||
|
||||
```
|
||||
kubectl -n kube-system patch serviceaccount default -p '{\"imagePullSecrets\": [{\"name\": \"regcred\"}]}'
|
||||
kubectl -n kube-system patch serviceaccount tiller -p \
|
||||
'{"imagePullSecrets": [{"name\": "regcred"}]}'
|
||||
```
|
||||
|
||||
##### Helm Init with `--tiller-image` option
|
||||
##### `--tiller-image` option
|
||||
|
||||
Add the --tiller-image option to the `helm init` command.
|
||||
|
||||
```
|
||||
helm init --service-account tiller --tiller-image registry.example.com/kubernetes-helm/tiller:v2.9.1
|
||||
--tiller-image reg.example.com/kubernetes-helm/tiller:v2.9.1
|
||||
```
|
||||
|
||||
</p>
|
||||
</details>
|
||||
|
||||
##### Helm init
|
||||
|
||||
`helm init` installs the `tiller` service in the `kube-system` namespace on your cluster.
|
||||
|
||||
```
|
||||
helm init --service-account tiller
|
||||
```
|
||||
|
||||
> NOTE: This `tiller` install has full cluster access, which should be acceptable if the cluster is dedicated to Rancher server. Check out the [helm docs](https://docs.helm.sh/using_helm/#role-based-access-control) for restricting `tiller` access to suit your security requirements.
|
||||
|
||||
|
||||
[Next: Install Rancher]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rancher/)
|
||||
### [Next: Install Rancher]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rancher/)
|
||||
@@ -1,17 +0,0 @@
|
||||
---
|
||||
title: 2 - Configure Load Balancer
|
||||
weight: 276
|
||||
---
|
||||
|
||||
Choose a hostname that you will use to access Rancher and Create a DNS record to point at your load balancer endpoint.
|
||||
|
||||
### Load Balancer
|
||||
|
||||
RKE will configure a Kubernetes ingress controller pod to listen on ports 80 and 443 tcp on each one of your nodes.
|
||||
|
||||
Configure your load balancer as a basic Layer 4 tcp forwarder. The exact configuration will vary depending on your environment.
|
||||
|
||||
#### Examples
|
||||
|
||||
* [Amazon NLB]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/nlb)
|
||||
* [Round Robin DNS]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/rrdns)
|
||||
@@ -1,35 +0,0 @@
|
||||
---
|
||||
title: Round Robin DNS
|
||||
weight: 277
|
||||
---
|
||||
|
||||
If you don't have load balancers available in your environment, you can substitute with a Round Robin DNS entry.
|
||||
|
||||
Create multiple `A` records for the same DNS endpoint. Your DNS server will rotate the IP addresses when queried.
|
||||
|
||||
You can use tools like `dig` or `nslookup` to see all the records.
|
||||
|
||||
```
|
||||
$ dig rancher.example.com
|
||||
|
||||
; <<>> DiG 9.11.3-1ubuntu1.1-Ubuntu <<>> rancher.example.com
|
||||
;; global options: +cmd
|
||||
;; Got answer:
|
||||
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28524
|
||||
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1
|
||||
|
||||
;; OPT PSEUDOSECTION:
|
||||
; EDNS: version: 0, flags:; udp: 1280
|
||||
;; QUESTION SECTION:
|
||||
;rancher.example.com. IN A
|
||||
|
||||
;; ANSWER SECTION:
|
||||
rancher.example.com. 300 IN A 18.188.33.133
|
||||
rancher.example.com. 300 IN A 13.58.200.233
|
||||
rancher.example.com. 300 IN A 18.217.100.233
|
||||
|
||||
;; Query time: 60 msec
|
||||
;; SERVER: 192.168.5.1#53(192.168.5.1)
|
||||
;; WHEN: Tue Jul 03 20:04:50 CDT 2018
|
||||
;; MSG SIZE rcvd: 104
|
||||
```
|
||||
@@ -1,15 +1,14 @@
|
||||
---
|
||||
title: 5 - Install Rancher
|
||||
title: 4 - Install Rancher
|
||||
weight: 276
|
||||
---
|
||||
|
||||
Rancher installation is now managed using the Helm package manager for Kubernetes. Use `helm` to install the prerequisite and Rancher charts.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
### Add the Chart Repo
|
||||
|
||||
Add the Rancher chart repository.
|
||||
Use `helm repo add` to add the Rancher chart repository.
|
||||
|
||||
```
|
||||
helm repo add rancher-stable https://releases.rancher.com/server-charts/stable
|
||||
@@ -17,7 +16,7 @@ helm repo add rancher-stable https://releases.rancher.com/server-charts/stable
|
||||
|
||||
### Install `cert-manager`
|
||||
|
||||
Rancher relies on [cert-manager](https://github.com/kubernetes/charts/tree/master/stable/cert-manager) from the Kubernetes Helm Stable catalog to issue self-signed or LetsEncrypt certificates.
|
||||
Rancher relies on [cert-manager](https://github.com/kubernetes/charts/tree/master/stable/cert-manager) from the Kubernetes Helm "stable" catalog to issue self-signed or LetsEncrypt certificates.
|
||||
|
||||
Install `cert-manager` from the Helm stable catalog.
|
||||
|
||||
@@ -25,7 +24,7 @@ Install `cert-manager` from the Helm stable catalog.
|
||||
helm install stable/cert-manager --name cert-manager --namespace kube-system
|
||||
```
|
||||
|
||||
## Installing Rancher
|
||||
### Choose your SSL Configuration
|
||||
|
||||
Rancher server is designed to be "secure by default" and requires SSL/TLS configuration.
|
||||
|
||||
@@ -35,7 +34,9 @@ There are three options for the source of the certificate.
|
||||
* `letsEncrypt` - Use [LetsEncrypt](https://letsencrypt.org/) to issue a cert.
|
||||
* `secret` - Configure a Kubernetes Secret with your certificate files.
|
||||
|
||||
### (Default) Rancher Generated Certificates
|
||||
<br\>
|
||||
|
||||
#### (Default) Rancher Generated Certificates
|
||||
|
||||
The default is to use the Rancher to generate a CA and use the `cert-manager` to issue the certificate for access to the Rancher server interface.
|
||||
|
||||
@@ -46,7 +47,7 @@ helm install rancher-stable/rancher --name rancher --namespace cattle-system \
|
||||
--set hostname=rancher.my.org
|
||||
```
|
||||
|
||||
### LetsEncrypt
|
||||
#### LetsEncrypt
|
||||
|
||||
Use LetsEncrypt's free service to issue trusted SSL certs. This configuration uses http validation so the Load Balancer must have a Public DNS record and be accessible from the internet.
|
||||
|
||||
@@ -61,7 +62,7 @@ helm install rancher-stable/rancher --name rancher --namespace cattle-system \
|
||||
|
||||
> LetsEncrypt ProTip: The default `production` environment only allows you to register a name 5 times in a week. If you're rebuilding a bunch of times, use `--set letsEncrypt.environment=staging` until you have you're confident your config is right.
|
||||
|
||||
### Certificates from Files (Kubernetes Secret)
|
||||
#### Certificates from Files (Kubernetes Secret)
|
||||
|
||||
Create Kubernetes Secrets from your own certificates for Rancher to use.
|
||||
|
||||
@@ -77,63 +78,18 @@ helm install rancher-stable/rancher --name rancher --namespace cattle-system \
|
||||
--set ingress.tls.source=secret
|
||||
```
|
||||
|
||||
Now that Rancher is running, see [Adding TLS Secrets](#Adding-TLS-Secrets) to publish the certificate files so Rancher and the Ingress Controller can use them.
|
||||
Now that Rancher is running, see [Adding TLS Secrets]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rancher/tls-secrets) to publish the certificate files so Rancher and the Ingress Controller can use them.
|
||||
|
||||
## Adding TLS Secrets
|
||||
### Advanced Configurations
|
||||
|
||||
Kubernetes will create all the objects and services for Rancher, but it will not become available until we populate the `tls-rancher-ingress` secret in the `cattle-system` namespace with the certificate and key.
|
||||
The Rancher chart configuration has many options for customizing the install to suit your specific environment. Here are some common advanced scenarios.
|
||||
|
||||
Combine the server certificate followed by the intermediate cert chain your CA provided into a file named `tls.crt`. Copy your key into a file name `tls.key`.
|
||||
* [Private Docker Image Registry/Air Gap Network]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rancher/chart-options/#Private-or-Air-Gap-Registry)
|
||||
|
||||
Use `kubectl` with the `tls` type to create the secrets.
|
||||
See the [Chart Options]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rancher/chart-options) for the full list of options.
|
||||
|
||||
```
|
||||
kubectl -n cattle-system create secret tls tls-rancher-ingress --cert=./tls.crt --key=./tls.key
|
||||
```
|
||||
### Finishing Up
|
||||
|
||||
### Private CA Signed - Additional Steps
|
||||
That's it you should have a functional Rancher server. Point a browser at the hostname you picked and you should be greeted by the colorful login page.
|
||||
|
||||
If you are using a private CA, Rancher will need to have a copy of the CA cert to include when generating agent configs.
|
||||
|
||||
Copy the CA cert into a file named `cacerts.pem` and use `kubectl` to create the `tls-ca` secret in the `cattle-system` namespace.
|
||||
|
||||
```
|
||||
kubectl -n cattle-system create secret generic tls-ca --from-file=cacerts.pem
|
||||
```
|
||||
|
||||
## Common Chart Options
|
||||
|
||||
| Option | Default Value | Description |
|
||||
| --- | --- | --- |
|
||||
| `hostname` | " " | `string` - the Fully Qualified Domain Name for your Rancher Server |
|
||||
| `ingress.tls.source` | "rancher" | `string` - Where to get the cert for the ingress. - "rancher, letsEncrypt, secret" |
|
||||
| `letsEncrypt.email` | " " | `string` - Your email address |
|
||||
| `letsEncrypt.environment` | "production" | `string` - Valid options: "staging, production" |
|
||||
| `privateCA` | false | `bool` - Set to true if your cert is signed by a private CA |
|
||||
|
||||
## Advanced Options
|
||||
|
||||
| Option | Default Value | Description |
|
||||
| --- | --- | --- |
|
||||
| `debug` | false | `bool` - set debug flag on rancher server |
|
||||
| `imagePullSecrets` | [] | `list` - list of names of Secret resource containing private registry credentials |
|
||||
| `resources` | {} | `map` - rancher pod resource requests & limits |
|
||||
| `rancherImage` | "rancher/rancher" | `string` - rancher image source |
|
||||
| `rancherImageTag` | same as chart version | `string` - rancher/rancher image tag |
|
||||
|
||||
## Private or Air Gap Registry
|
||||
|
||||
You can point to a private registry for an "Air Gap" install.
|
||||
|
||||
### Create Registry Secret
|
||||
|
||||
Create a Registry secret in the `cattle-system` namespace. Check out the [Kubernetes Docs](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/) for more info.
|
||||
|
||||
### Registry Options
|
||||
|
||||
Add the `rancherImage` to point to your private registry image and `imagePullSecrets` to your install command.
|
||||
|
||||
```
|
||||
--set rancherImage=private.reg.org:5000/rancher/rancher \
|
||||
--set imagePullSecrets[0].name=secretName
|
||||
```
|
||||
Doesn't Work? Take a look at the [Troubleshooting]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rancher/troubleshooting) Page
|
||||
|
||||
+53
@@ -0,0 +1,53 @@
|
||||
---
|
||||
title: Chart Options
|
||||
weight: 276
|
||||
---
|
||||
|
||||
### Common Options
|
||||
|
||||
| Option | Default Value | Description |
|
||||
| --- | --- | --- |
|
||||
| `hostname` | " " | `string` - the Fully Qualified Domain Name for your Rancher Server |
|
||||
| `ingress.tls.source` | "rancher" | `string` - Where to get the cert for the ingress. - "rancher, letsEncrypt, secret" |
|
||||
| `letsEncrypt.email` | " " | `string` - Your email address |
|
||||
| `letsEncrypt.environment` | "production" | `string` - Valid options: "staging, production" |
|
||||
| `privateCA` | false | `bool` - Set to true if your cert is signed by a private CA |
|
||||
|
||||
<br/>
|
||||
|
||||
### Advanced Options
|
||||
|
||||
| Option | Default Value | Description |
|
||||
| --- | --- | --- |
|
||||
| `debug` | false | `bool` - set debug flag on rancher server |
|
||||
| `imagePullSecrets` | [] | `list` - list of names of Secret resource containing private registry credentials |
|
||||
| `resources` | {} | `map` - rancher pod resource requests & limits |
|
||||
| `rancherImage` | "rancher/rancher" | `string` - rancher image source |
|
||||
| `rancherImageTag` | same as chart version | `string` - rancher/rancher image tag |
|
||||
|
||||
<br/>
|
||||
|
||||
### Private or Air Gap Registry
|
||||
|
||||
You can point to a private registry for an "Air Gap" install.
|
||||
|
||||
#### Create Registry Secret
|
||||
|
||||
Use `kubectl` to create a docker-registry secret in the `cattle-system` namespace.
|
||||
|
||||
```
|
||||
kubectl -n cattle-system create secret docker-registry regcred \
|
||||
--docker-server="reg.example.com:5000" \
|
||||
--docker-username=<user> \
|
||||
--docker-password=<password> \
|
||||
--docker-email=<email>
|
||||
```
|
||||
|
||||
#### Registry Options
|
||||
|
||||
Add the `rancherImage` to point to your private registry image and `imagePullSecrets` to your install command.
|
||||
|
||||
```
|
||||
--set rancherImage=reg.example.com:5000/rancher/rancher \
|
||||
--set imagePullSecrets[0].name=regcred
|
||||
```
|
||||
@@ -0,0 +1,26 @@
|
||||
---
|
||||
title: Adding TLS Secrets
|
||||
weight: 276
|
||||
---
|
||||
|
||||
Kubernetes will create all the objects and services for Rancher, but it will not become available until we populate the `tls-rancher-ingress` secret in the `cattle-system` namespace with the certificate and key.
|
||||
|
||||
Combine the server certificate followed by the intermediate cert chain your CA provided into a file named `tls.crt`. Copy your key into a file name `tls.key`.
|
||||
|
||||
Use `kubectl` with the `tls` type to create the secrets.
|
||||
|
||||
```
|
||||
kubectl -n cattle-system create secret tls tls-rancher-ingress \
|
||||
--cert=./tls.crt \
|
||||
--key=./tls.key
|
||||
```
|
||||
|
||||
### Private CA Signed - Additional Steps
|
||||
|
||||
If you are using a private CA, Rancher will need to have a copy of the CA cert to include when generating agent configs.
|
||||
|
||||
Copy the CA cert into a file named `cacerts.pem` and use `kubectl` to create the `tls-ca` secret in the `cattle-system` namespace.
|
||||
|
||||
```
|
||||
kubectl -n cattle-system create secret generic tls-ca --from-file=cacerts.pem
|
||||
```
|
||||
+5
@@ -0,0 +1,5 @@
|
||||
---
|
||||
title: Troubleshooting
|
||||
weight: 276
|
||||
---
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: 3 - Install Kubernetes with RKE
|
||||
title: 2 - Install Kubernetes with RKE
|
||||
weight: 276
|
||||
---
|
||||
|
||||
@@ -72,3 +72,5 @@ NAME STATUS ROLES AGE VER
|
||||
165.227.116.167 Ready controlplane,etcd,worker 11m v1.10.1
|
||||
165.227.127.226 Ready controlplane,etcd,worker 11m v1.10.1
|
||||
```
|
||||
|
||||
### [Next: Initialize Helm]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/helm/)
|
||||
Reference in New Issue
Block a user