public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-25 12:38:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

added content for setting up a bastion host and declaring external IP addresses

Browse Source
This commit is contained in:
Mark Bishop
2018-09-19 14:33:05 -07:00
parent 9aee0adaf4
commit bb3c98f726
4 changed files with 65 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/rancher/v2.x/en/installation/air-gap-installation/_index.md
+4 -2
View File
@@ -6,9 +6,11 @@ In environments where security is high priority, you can set up Rancher in an ai
## Prerequisites
Rancher supports air gap installs using a private registry. You must have your own private registry or other means of distributing docker images to your machine. If you need help with creating a private registry, please refer to the [Docker documentation for private registries](https://docs.docker.com/registry/).
- Rancher supports air gap installs using a private registry. You must have your own private registry or other means of distributing docker images to your machine. If you need help with creating a private registry, please refer to the [Docker documentation for private registries](https://docs.docker.com/registry/).
In every [release](https://github.com/rancher/rancher/releases), we provide you with the needed Docker images and scripts to mirror those images to your own registry. The Docker images are used when nodes are added to a cluster, or when you enable features like pipelines or logging.
In every [release](https://github.com/rancher/rancher/releases), we provide you with the needed Docker images and scripts to mirror those images to your own registry. The Docker images are used when nodes are added to a cluster, or when you enable features like pipelines or logging.
- **Installation Option:** Before beginning your air gap installation, choose whether your want it to be a [single-node install]({{< baseurl >}}/rancher/v2.x/en/installation/single-node) or a [high availability install]({{< baseurl >}}/rancher/v2.x/en/installation/ha). View your chosen configuration's introduction notes along with Rancher's [node requirements]({{< baseurl >}}/rancher/v2.x/en/installation/requirements).
## Caveats
content/rancher/v2.x/en/installation/air-gap-installation/install-rancher/_index.md
+59
View File
@@ -36,6 +36,8 @@ To install Rancher in a high availability configuration within an air gap enviro
When you get to [Create the rancher-cluster.yml File]({{< baseurl >}}/rancher/v2.x/en/installation/ha/kubernetes-rke/#create-the-rancher-cluster-yml-file), replace its code sample with the one below, which adds the `private registries` block:
>**Note:** When declaring the `address` for each of your air gap nodes, use its external IP address.
```yaml
nodes:
- address: 18.222.121.187
@@ -60,6 +62,63 @@ nodes:
is_default: true
```
#### Optional: Run RKE Through Bastion Host
When setting up an air gap environment, it may be useful to run RKE through a [bastion host]({{< baseurl >}}/rke/v0.1.x/en/config-options/bastion-host/). This configuration can be helpful if you want to keep your RKE config (`rancher-cluster.yml`) or SSH keys on your local machine. Use of a bastion host requires it to be accessible from both the Internet and your air gap nodes over port 22.
**Port Requirements:**
| Port | Outgoing Host | Incoming Host |
| ------ | -------------- | ----------------- |
| 22 TCP | local RKE host | bastion host |
| 22 TCP | bastion host | each air gap node |
To enable running RKE through a bastion server, add the following sample to `rancher-cluster.yml`:
```yaml
bastion_host:
address: 18.224.54.35 # public IP of the bastion server
user: rancher
port: 22
ssh_key_path: /path/to/ssh/key
```
>**Note:** When declaring the `address` for each of your air gap nodes and bastion host, use its external IP address.
**Example in context:**
```yaml
bastion_host:
address: 18.224.54.35 # public IP of the bastion server
user: rancher
port: 22
ssh_key_path: /home/user/.ssh/id_rsa
nodes:
- address: 18.222.121.187
internal_address: 172.31.7.22
user: rancher
role: [ "controlplane", "etcd", "worker" ]
ssh_key_file: /home/user/.ssh/id_rsa
- address: 18.220.193.254
internal_address: 172.31.13.132
user: rancher
role: [ "controlplane", "etcd", "worker" ]
ssh_key_file: /home/user/.ssh/id_rsa
- address: 13.59.83.89
internal_address: 172.31.3.216
user: rancher
role: [ "controlplane", "etcd", "worker" ]
ssh_key_file: /home/user/.ssh/id_rsa
private_registries:
- url: my_registry.example.com
user: rancher
password: "*********"
is_default: true
```
After adding the bastion host to `rancher-cluster.yml`, running `rke up` provisions the Kubernetes cluster through the bastion server, and provides the resulting `kube_config`. However, it's important to note that as your nodes are not accessible by public IP, the machine from which you run `kubectl` in later steps must be able to access your air gapped nodes at the addresses provided. Due to this requirement, you may need to move the resulting `kube_config` after its creation.
### Initialize Helm Using Private Registry
When you get to [Helm Init]({{< baseurl >}}/rancher/v2.x/en/installation/ha/helm-init/#helm-init), add your private registry in the step to initialize Helm, as shown below:
content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md
+1 -1
View File
@@ -42,7 +42,7 @@ There are three options for the source of the certificate.
2. `letsEncrypt` - Use [LetsEncrypt](https://letsencrypt.org/) to issue a cert.
3. `secret` - Configure a Kubernetes Secret with your certificate files.
<br\>
<br/>
#### (Default) Rancher Generated Certificates
content/rancher/v2.x/en/installation/ha/kubernetes-rke/_index.md
+1 -1
View File
@@ -11,7 +11,7 @@ Using the sample below create the `rancher-cluster.yml` file. Replace the IP Add
> **Notes:**
>
>- Air Gap User? [Add a private registry section]({{< baseurl >}}/rancher/v2.x/en/installation/air-gap-installation/install-rancher/#add-private-registry-to-rke-yaml) to the sample below.
>- Air Gap User? [Add a private registry section]({{< baseurl >}}/rancher/v2.x/en/installation/air-gap-installation/install-rancher/#add-private-registry-to-rke-yaml) to the sample below. Optionally, if you want to run RKE through a bastion host you have set up, you can [add one]({{< baseurl >}}/rancher/v2.x/en/installation/air-gap-installation/install-rancher/#optional-run-rke-through-bastion-host) to `rancher-cluster.yml`.
>- If your node has public and internal addresses, it is recommended to set the `internal_address:` so Kubernetes will use it for intra-cluster communication. Some services like AWS EC2 require setting the `internal_address:` if you want to use self-referencing security groups or firewalls.