From d39911370294f88c809277f00222dbe2a2d6b0a4 Mon Sep 17 00:00:00 2001 From: Jason Greathouse Date: Tue, 3 Jul 2018 20:52:41 -0500 Subject: [PATCH 01/18] helm install draft --- .../installation/ha-server-install2/_index.md | 474 +----------------- .../ha-server-install2/helm/_index.md | 22 + .../ha-server-install2/loadbalancer/_index.md | 17 + .../loadbalancer/nlb/_index.md | 172 +++++++ .../loadbalancer/rrdns/_index.md | 35 ++ .../ha-server-install2/nodes/_index.md | 48 ++ .../ha-server-install2/rke/_index.md | 73 +++ 7 files changed, 393 insertions(+), 448 deletions(-) create mode 100644 content/rancher/v2.x/en/installation/ha-server-install2/helm/_index.md create mode 100644 content/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/_index.md create mode 100644 content/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/nlb/_index.md create mode 100644 content/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/rrdns/_index.md create mode 100644 content/rancher/v2.x/en/installation/ha-server-install2/nodes/_index.md create mode 100644 content/rancher/v2.x/en/installation/ha-server-install2/rke/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/_index.md b/content/rancher/v2.x/en/installation/ha-server-install2/_index.md index 39b2eb1c572..a0ac81750bf 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install2/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install2/_index.md @@ -1,458 +1,36 @@ --- -title: High Availability Installation 2 +title: High Availability Installation weight: 275 draft: true --- -This set of instructions creates a new Kubernetes cluster that's dedicated to running Rancher in a high-availability (HA) configuration. This procedure walks you through setting up a 3-node cluster using the Rancher Kubernetes Engine (RKE). The cluster's sole purpose is running pods for Rancher. The setup is based on: -- Layer 4 load balancer (TCP) -- NGINX ingress controller with SSL termination (HTTPS) +When installed as a Deployment in a Kubernetes cluster, Rancher will take integrate with the cluster's etcd database and Kubernetes scheduling for High-Availability. + +This procedure walks you through setting up a 3-node cluster with RKE and installing the Rancher chart the Helm package manager. + +> NOTE: For the best performance, we recommend this Kubernetes cluster be dedicated only the Rancher workload. + +## Recommended Architecture + +* DNS for Rancher should resolve to a Layer 4 Load Balancer +* The Load Balancer should forward ports 80 and 443 TCP to all 3 nodes in the Kubernetes cluster. +* The ingress controller will redirect http port 80 to https and terminate SSL/TLS on port 443. +* The ingress controller will forward traffic to port 80 on the Pod in the Rancher Deployment. ![Rancher HA]({{< baseurl >}}/img/rancher/ha/rancher2ha.svg) +## Required Tools + +The following CLI tools are required for this install. Please make sure these tools installed and available in your `$PATH` + +* [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl) - Kubernetes command-line tool. +* [rke]({{< baseurl >}}docs/rke/v0.1.x/en/installation/) - Rancher Kubernetes Engine, cli for building Kubernetes clusters. +* [helm](https://docs.helm.sh/using_helm/#installing-helm) - Package management for Kubernetes. + ## Installation Outline -Installation of Rancher in a high-availability configuration involves multiple procedures. Review this outline to learn about each procedure you need to complete. - -1. [Provision Linux Hosts](#1-provision-linux-hosts) - - Provision three Linux hosts to serve as your Kubernetes cluster. - -2. [Configure Load Balancer](#2-configure-load-balancer) - - Configure your load balancer to have a highly available single point of entry to your Rancher cluster. - -3. [Configure DNS](#3-configure-dns) - - Make your setup accessible using a DNS name by configuring the DNS to point to your loadbalancer. - -4. [Download RKE](#4-download-rke) - - [RKE](https://github.com/rancher/rke/releases) is a fast, versatile Kubernetes installer that you can use to install Kubernetes on your Linux hosts. - -5. [Download RKE Config File Template](#5-download-config-file-template) - - RKE uses a YAML config file to install and configure your Kubernetes cluster. Download one of our RKE config file templates to get started. - -6. [Configure Nodes](#6-configure-nodes) - - Configure the **Nodes** section of the RKE config template. - -7. [Configure Certificates](#7-configure-certificates) - - Configure the **Certificates** part of the template too. - -8. [Configure FQDN](#8-configure-fqdn) - - And the **FQDN** part. - -9. [Back Up Your RKE Config File](#9-back-up-your-rke-config-file) - - After you've completed configuration of the RKE config file: 1. it's no longer a template since you'll be using it, and 2. you should back up the RKE config file to a safe place. You will reuse this file for upgrades later. - -10. [Run RKE](#10-run-rke) - - Run RKE to deploy Rancher to your cluster. - -11. [Back Up Auto-Generated Config File](#11-back-up-auto-generated-config-file) - - During installation, RKE generates a config file that you'll use later for upgrades. Back it up to a safe location. - -12. **For those using a certificate signed by a recognized CA:** - - [Remove Default Certificates](#12-remove-default-certificates) - - If you chose [Option B](#option-b-bring-your-own-certificate-signed-by-recognized-ca) as your SSL option, log into the Rancher UI and remove the certificates that Rancher automatically generates. - -
- -## 1. Provision Linux Hosts - -Before you install Rancher, confirm you meet the host requirements. Provision 3 new Linux hosts using the requirements below. - -### Host Requirements - -#### Operating System - -{{< requirements_os >}} - -#### Hardware - -{{< requirements_hardware >}} - -#### Software - -{{< requirements_software >}} - -{{< note_server-tags >}} - -#### Ports - -The following diagram depicts the basic port requirements for Rancher. For a comprehensive list, see [Port Requirements]({{< baseurl >}}/rancher/v2.x/en/installation/references/). - -![Basic Port Requirements]({{< baseurl >}}/img/rancher/port-communications.png) - -## 2. Configure Load Balancer - -We will be using NGINX as our Layer 4 Load Balancer (TCP). NGINX will forward all connections to one of your Rancher nodes. If you want to use Amazon NLB, you can skip this step and use [Amazon NLB configuration]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install/nlb/) - ->**Note:** -> In this configuration, the load balancer is positioned in front of your Linux hosts. The load balancer can be any host that you have available that's capable of running NGINX. -> ->One caveat: do not use one of your Rancher nodes as the load balancer. - -### A. Install NGINX - -Start by installing NGINX on your load balancer host. NGINX has packages available for all known operating systems. - -For help installing NGINX, refer to their [install documentation](https://www.nginx.com/resources/wiki/start/topics/tutorials/install/). - -### B. Create NGINX Configuration - -After installing NGINX, you need to update the NGINX config file, `nginx.conf`, with the IP addresses for your nodes. - -1. Copy and paste the code sample below into your favorite text editor. Save it as `nginx.conf`. - -2. From `nginx.conf`, replace `IP_NODE_1`, `IP_NODE_2`, and `IP_NODE_3` with the IPs of your [Linux hosts](#1-provision-linux-hosts). - - **Example NGINX config:** - ``` - worker_processes 4; - worker_rlimit_nofile 40000; - - events { - worker_connections 8192; - } - - http { - server { - listen 80; - return 301 https://$host$request_uri; - } - } - - stream { - upstream rancher_servers { - least_conn; - server IP_NODE_1:443 max_fails=3 fail_timeout=5s; - server IP_NODE_2:443 max_fails=3 fail_timeout=5s; - server IP_NODE_3:443 max_fails=3 fail_timeout=5s; - } - server { - listen 443; - proxy_pass rancher_servers; - } - } - ``` - -3. Save `nginx.conf` to your load balancer at the following path: `/etc/nginx/nginx.conf`. - -4. Load the updates to your NGINX configuration by running the following command: - - ``` - # nginx -s reload - ``` - -### Option - Run NGINX as Docker container - -Instead of installing NGINX as a package on the operating system, you can rather run it as a Docker container. Save the edited **Example NGINX config** as `/etc/nginx.conf` and run the following command to launch the NGINX container: - -``` -docker run -d --restart=unless-stopped \ - -p 80:80 -p 443:443 \ - -v /etc/nginx.conf:/etc/nginx/nginx.conf \ - nginx:1.14 -``` - -## 3. Configure DNS - -Choose a fully qualified domain name (FQDN) that you want to use to access Rancher (e.g., `rancher.yourdomain.com`).

- -1. Log into your DNS server a create a `DNS A` record that points to the IP address of your [load balancer](#2-configure-load-balancer). - -2. Validate that the `DNS A` is working correctly. Run the following command from any terminal, replacing `HOSTNAME.DOMAIN.COM` with your chosen FQDN: - - `nslookup HOSTNAME.DOMAIN.COM` - - **Step Result:** Terminal displays output similar to the following: - - ``` - $ nslookup rancher.yourdomain.com - Server: YOUR_HOSTNAME_IP_ADDRESS - Address: YOUR_HOSTNAME_IP_ADDRESS#53 - - Non-authoritative answer: - Name: rancher.yourdomain.com - Address: HOSTNAME.DOMAIN.COM - ``` - -
- -## 4. Download RKE - -RKE is a fast, versatile Kubernetes installer that you can use to install Kubernetes on your Linux hosts. We will be using RKE to setup our cluster and run Rancher. - -1. From your workstation, open a web browser and navigate to our [RKE Releases](https://github.com/rancher/rke/releases/latest) page. Download the latest RKE installer applicable to your Operating System: - - - **MacOS**: `rke_darwin-amd64` - - **Linux**: `rke_linux-amd64` - - **Windows**: `rke_windows-amd64.exe` - -2. Make the RKE binary that you just downloaded executable. Open Terminal, change directory to the location of the RKE binary, and then run one of the commands below. - - >**Using Windows?** - >The file is already an executable. Skip to [Download Config File Template](#5-download-config-file-template). - - ``` - # MacOS - $ chmod +x rke_darwin-amd64 - # Linux - $ chmod +x rke_linux-amd64 - ``` - -3. Confirm that RKE is now executable by running the following command: - - ``` - # MacOS - $ ./rke_darwin-amd64 --version - # Linux - $ ./rke_linux-amd64 --version - ``` - - **Step Result:** You receive output similar to what follows: - ``` - rke version v - ``` - -## 5. Download RKE Config File Template - -RKE uses a `.yml` config file to install and configure your Kubernetes cluster. There are 2 templates to choose from, depending on the SSL certificate you want to use. - -1. Download one of following templates, depending on the SSL certificate you're using. - - - [Template for self-signed certificate
`3-node-certificate.yml`](https://raw.githubusercontent.com/rancher/rancher/e9d29b3f3b9673421961c68adf0516807d1317eb/rke-templates/3-node-certificate.yml) - - [Template for certificate signed by recognized CA
`3-node-certificate-recognizedca.yml`](https://raw.githubusercontent.com/rancher/rancher/e9d29b3f3b9673421961c68adf0516807d1317eb/rke-templates/3-node-certificate-recognizedca.yml) - -2. Rename the file to `rancher-cluster.yml`. - -## 6. Configure Nodes - -Once you have the `rancher-cluster.yml` config file template, edit the nodes section to point toward your Linux hosts. - -1. Open `rancher-cluster.yml` in your favorite text editor. - -2. Update the `nodes` section with the information of your [Linux hosts](#provision-linux-hosts). - - For each node in your cluster, update the following placeholders: `IP_ADDRESS_X` and `USER`. - -``` -nodes: - - address: IP_ADDRESS_1 - # THE IP ADDRESS OR HOSTNAME OF THE NODE - user: USER - # USER WITH ADMIN ACCESS. USUALLY `root` - role: [controlplane,etcd,worker] - ssh_key_path: ~/.ssh/id_rsa - # PATH TO SSH KEY THAT AUTHENTICATES ON YOUR WORKSTATION - # USUALLY THE VALUE ABOVE - - address: IP_ADDRESS_2 - user: USER - role: [controlplane,etcd,worker] - ssh_key_path: ~/.ssh/id_rsa - - address: IP_ADDRESS_3 - user: USER - role: [controlplane,etcd,worker] - ssh_key_path: ~/.ssh/id_rsa -``` - -## 7. Configure Certificates - -For security purposes, SSL (Secure Sockets Layer) is required when using Rancher. SSL secures all Rancher network communication, like when you login or interact with a cluster. - -Choose from the following options: - -- [Option A—Bring Your Own Certificate: Self-Signed](#option-a-bring-your-own-certificate-self-signed) -- [Option B—Bring Your Own Certificate: Signed by Recognized CA](#option-b-bring-your-own-certificate-signed-by-recognized-ca) - -### Option A—Bring Your Own Certificate: Self-Signed - ->**Prerequisites:** ->Create a self-signed certificate. -> ->- The certificate files must be in [PEM format](#pem). ->- The certificate files must be encoded in [base64](#base64). ->- In your certificate file, include all intermediate certificates in the chain. Order your certificates with your certificate first, followed by the intermediates. For an example, see [Intermediate Certificates](#cert-order). - -1. In `kind: Secret` with `name: cattle-keys-ingress`: - - * Replace `` with the base64 encoded string of the Certificate file (usually called `cert.pem` or `domain.crt`) - * Replace `` with the base64 encoded string of the Certificate Key file (usually called `key.pem` or `domain.key`) - - >**Note:** - > The base64 encoded string should be on the same line as `tls.crt` or `tls.key`, without any newline at the beginning, in between or at the end. - - **Result:** After replacing the values, the file should look like the example below (the base64 encoded strings should be different): - -```yaml ---- - apiVersion: v1 - kind: Secret - metadata: - name: cattle-keys-ingress - namespace: cattle-system - type: Opaque - data: - tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM1RENDQWN5Z0F3SUJBZ0lKQUlHc25NeG1LeGxLTUEwR0NTcUdTSWIzRFFFQkN3VUFNQkl4RURBT0JnTlYKQkFNTUIzUmxjM1F0WTJFd0hoY05NVGd3TlRBMk1qRXdOREE1V2hjTk1UZ3dOekExTWpFd05EQTVXakFXTVJRdwpFZ1lEVlFRRERBdG9ZUzV5Ym1Ob2NpNXViRENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DCmdnRUJBTFJlMXdzekZSb2Rib2pZV05DSHA3UkdJaUVIMENDZ1F2MmdMRXNkUUNKZlcrUFEvVjM0NnQ3bSs3TFEKZXJaV3ZZMWpuY2VuWU5JSGRBU0VnU0ducWExYnhUSU9FaE0zQXpib3B0WDhjSW1OSGZoQlZETGdiTEYzUk0xaQpPM1JLTGdIS2tYSTMxZndjbU9zWGUwaElYQnpUbmxnM20vUzlXL3NTc0l1dDVwNENDUWV3TWlpWFhuUElKb21lCmpkS3VjSHFnMTlzd0YvcGVUalZrcVpuMkJHazZRaWFpMU41bldRV0pjcThTenZxTTViZElDaWlwYU9hWWQ3RFEKYWRTejV5dlF0YkxQNW4wTXpnOU43S3pGcEpvUys5QWdkWDI5cmZqV2JSekp3RzM5R3dRemN6VWtLcnZEb05JaQo0UFJHc01yclFNVXFSYjRSajNQOEJodEMxWXNDQXdFQUFhTTVNRGN3Q1FZRFZSMFRCQUl3QURBTEJnTlZIUThFCkJBTUNCZUF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdJR0NDc0dBUVVGQndNQk1BMEdDU3FHU0liM0RRRUIKQ3dVQUE0SUJBUUNKZm5PWlFLWkowTFliOGNWUW5Vdi9NZkRZVEJIQ0pZcGM4MmgzUGlXWElMQk1jWDhQRC93MgpoOUExNkE4NGNxODJuQXEvaFZYYy9JNG9yaFY5WW9jSEg5UlcvbGthTUQ2VEJVR0Q1U1k4S292MHpHQ1ROaDZ6Ci9wZTNqTC9uU0pYSjRtQm51czJheHFtWnIvM3hhaWpYZG9kMmd3eGVhTklvRjNLbHB2aGU3ZjRBNmpsQTM0MmkKVVlCZ09iN1F5KytRZWd4U1diSmdoSzg1MmUvUUhnU2FVSkN6NW1sNGc1WndnNnBTUXhySUhCNkcvREc4dElSYwprZDMxSk1qY25Fb1Rhc1Jyc1NwVmNGdXZyQXlXN2liakZyYzhienBNcE1obDVwYUZRcEZzMnIwaXpZekhwakFsCk5ZR2I2OHJHcjBwQkp3YU5DS2ErbCtLRTk4M3A3NDYwCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K - tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBdEY3WEN6TVZHaDF1aU5oWTBJZW50RVlpSVFmUUlLQkMvYUFzU3gxQUlsOWI0OUQ5ClhmanEzdWI3c3RCNnRsYTlqV09keDZkZzBnZDBCSVNCSWFlcHJWdkZNZzRTRXpjRE51aW0xZnh3aVkwZCtFRlUKTXVCc3NYZEV6V0k3ZEVvdUFjcVJjamZWL0J5WTZ4ZDdTRWhjSE5PZVdEZWI5TDFiK3hLd2k2M21uZ0lKQjdBeQpLSmRlYzhnbWlaNk4wcTV3ZXFEWDJ6QVgrbDVPTldTcG1mWUVhVHBDSnFMVTNtZFpCWWx5cnhMTytvemx0MGdLCktLbG81cGgzc05CcDFMUG5LOUMxc3MvbWZRek9EMDNzck1Xa21oTDcwQ0IxZmIydCtOWnRITW5BYmYwYkJETnoKTlNRcXU4T2cwaUxnOUVhd3l1dEF4U3BGdmhHUGMvd0dHMExWaXdJREFRQUJBb0lCQUJKYUErOHp4MVhjNEw0egpwUFd5bDdHVDRTMFRLbTNuWUdtRnZudjJBZXg5WDFBU2wzVFVPckZyTnZpK2xYMnYzYUZoSFZDUEN4N1RlMDVxClhPa2JzZnZkZG5iZFQ2RjgyMnJleVByRXNINk9TUnBWSzBmeDVaMDQwVnRFUDJCWm04eTYyNG1QZk1vbDdya2MKcm9Kd09rOEVpUHZZekpsZUd0bTAwUm1sRysyL2c0aWJsOTVmQXpyc1MvcGUyS3ZoN2NBVEtIcVh6MjlpUmZpbApiTGhBamQwcEVSMjNYU0hHR1ZqRmF3amNJK1c2L2RtbDZURDhrSzFGaUtldmJKTlREeVNXQnpPbXRTYUp1K01JCm9iUnVWWG4yZVNoamVGM1BYcHZRMWRhNXdBa0dJQWxOWjRHTG5QU2ZwVmJyU0plU3RrTGNzdEJheVlJS3BWZVgKSVVTTHM0RUNnWUVBMmNnZUE2WHh0TXdFNU5QWlNWdGhzbXRiYi9YYmtsSTdrWHlsdk5zZjFPdXRYVzkybVJneQpHcEhUQ0VubDB0Z1p3T081T1FLNjdFT3JUdDBRWStxMDJzZndwcmgwNFZEVGZhcW5QNTBxa3BmZEJLQWpmanEyCjFoZDZMd2hLeDRxSm9aelp2VkowV0lvR1ZLcjhJSjJOWGRTUVlUanZUZHhGczRTamdqNFFiaEVDZ1lFQTFBWUUKSEo3eVlza2EvS2V2OVVYbmVrSTRvMm5aYjJ1UVZXazRXSHlaY2NRN3VMQVhGY3lJcW5SZnoxczVzN3RMTzJCagozTFZNUVBzazFNY25oTTl4WE4vQ3ZDTys5b2t0RnNaMGJqWFh6NEJ5V2lFNHJPS1lhVEFwcDVsWlpUT3ZVMWNyCm05R3NwMWJoVDVZb2RaZ3IwUHQyYzR4U2krUVlEWnNFb2lFdzNkc0NnWUVBcVJLYWNweWZKSXlMZEJjZ0JycGkKQTRFalVLMWZsSjR3enNjbGFKUDVoM1NjZUFCejQzRU1YT0kvSXAwMFJsY3N6em83N3cyMmpud09mOEJSM0RBMwp6ZTRSWDIydWw4b0hGdldvdUZOTTNOZjNaNExuYXpVc0F0UGhNS2hRWGMrcEFBWGthUDJkZzZ0TU5PazFxaUNHCndvU212a1BVVE84b1ViRTB1NFZ4ZmZFQ2dZQUpPdDNROVNadUlIMFpSSitIV095enlOQTRaUEkvUkhwN0RXS1QKajVFS2Y5VnR1OVMxY1RyOTJLVVhITXlOUTNrSjg2OUZPMnMvWk85OGg5THptQ2hDTjhkOWN6enI5SnJPNUFMTApqWEtBcVFIUlpLTFgrK0ZRcXZVVlE3cTlpaHQyMEZPb3E5OE5SZDMzSGYxUzZUWDNHZ3RWQ21YSml6dDAxQ3ZHCmR4VnVnd0tCZ0M2Mlp0b0RLb3JyT2hvdTBPelprK2YwQS9rNDJBOENiL29VMGpwSzZtdmxEWmNYdUF1QVZTVXIKNXJCZjRVYmdVYndqa1ZWSFR6LzdDb1BWSjUvVUxJWk1Db1RUNFprNTZXWDk4ZE93Q3VTVFpZYnlBbDZNS1BBZApTZEpuVVIraEpnSVFDVGJ4K1dzYnh2d0FkbWErWUhtaVlPRzZhSklXMXdSd1VGOURLUEhHCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== -``` - -2. In `kind: Secret` with `name: cattle-keys-server`, replace `` with the base64 encoded string of the CA Certificate file (usually called `ca.pem` or `ca.crt`). - - >**Note:** - > The base64 encoded string should be on the same line as `cacerts.pem`, without any newline at the beginning, in between or at the end. - - - **Result:** The file should look like the example below (the base64 encoded string should be different): - ```yaml - --- - apiVersion: v1 - kind: Secret - metadata: - name: cattle-keys-server - namespace: cattle-system - type: Opaque - data: - cacerts.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNvRENDQVlnQ0NRRHVVWjZuMEZWeU16QU5CZ2txaGtpRzl3MEJBUXNGQURBU01SQXdEZ1lEVlFRRERBZDAKWlhOMExXTmhNQjRYRFRFNE1EVXdOakl4TURRd09Wb1hEVEU0TURjd05USXhNRFF3T1Zvd0VqRVFNQTRHQTFVRQpBd3dIZEdWemRDMWpZVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFNQmpBS3dQCndhRUhwQTdaRW1iWWczaTNYNlppVmtGZFJGckJlTmFYTHFPL2R0RUdmWktqYUF0Wm45R1VsckQxZUlUS3UzVHgKOWlGVlV4Mmo1Z0tyWmpwWitCUnFiZ1BNbk5hS1hocmRTdDRtUUN0VFFZdGRYMVFZS0pUbWF5NU45N3FoNTZtWQprMllKRkpOWVhHWlJabkdMUXJQNk04VHZramF0ZnZOdmJ0WmtkY2orYlY3aWhXanp2d2theHRUVjZlUGxuM2p5CnJUeXBBTDliYnlVcHlad3E2MWQvb0Q4VUtwZ2lZM1dOWmN1YnNvSjhxWlRsTnN6UjVadEFJV0tjSE5ZbE93d2oKaG41RE1tSFpwZ0ZGNW14TU52akxPRUc0S0ZRU3laYlV2QzlZRUhLZTUxbGVxa1lmQmtBZWpPY002TnlWQUh1dApuay9DMHpXcGdENkIwbkVDQXdFQUFUQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFHTCtaNkRzK2R4WTZsU2VBClZHSkMvdzE1bHJ2ZXdia1YxN3hvcmlyNEMxVURJSXB6YXdCdFJRSGdSWXVtblVqOGo4T0hFWUFDUEthR3BTVUsKRDVuVWdzV0pMUUV0TDA2eTh6M3A0MDBrSlZFZW9xZlVnYjQrK1JLRVJrWmowWXR3NEN0WHhwOVMzVkd4NmNOQQozZVlqRnRQd2hoYWVEQmdma1hXQWtISXFDcEsrN3RYem9pRGpXbi8walI2VDcrSGlaNEZjZ1AzYnd3K3NjUDIyCjlDQVZ1ZFg4TWpEQ1hTcll0Y0ZINllBanlCSTJjbDhoSkJqa2E3aERpVC9DaFlEZlFFVFZDM3crQjBDYjF1NWcKdE03Z2NGcUw4OVdhMnp5UzdNdXk5bEthUDBvTXl1Ty82Tm1wNjNsVnRHeEZKSFh4WTN6M0lycGxlbTNZQThpTwpmbmlYZXc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - ``` - -### Option B—Bring Your Own Certificate: Signed by Recognized CA - ->**Note:** -> If you are using Self Signed Certificate, [click here](#option-a-self-signed-certificate) to proceed. - -If you are using a Certificate Signed By A Recognized Certificate Authority, you will need to generate a base64 encoded string for the Certificate file and the Certificate Key file. Make sure that your certificate file includes all the [intermediate certificates](#ssl-faq-troubleshooting) in the chain, the order of certificates in this case is first your own certificate, followed by the intermediates. Please refer to the documentation of your CSP (Certificate Service Provider) to see what intermediate certificate(s) need to be included. - -In the `kind: Secret` with `name: cattle-keys-ingress`: - -* Replace `` with the base64 encoded string of the Certificate file (usually called `cert.pem` or `domain.crt`) -* Replace `` with the base64 encoded string of the Certificate Key file (usually called `key.pem` or `domain.key`) - -After replacing the values, the file should look like the example below (the base64 encoded strings should be different): - ->**Note:** -> The base64 encoded string should be on the same line as `tls.crt` or `tls.key`, without any newline at the beginning, in between or at the end. - -```yaml ---- -apiVersion: v1 -kind: Secret -metadata: - name: cattle-keys-ingress - namespace: cattle-system -type: Opaque -data: - tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM1RENDQWN5Z0F3SUJBZ0lKQUlHc25NeG1LeGxLTUEwR0NTcUdTSWIzRFFFQkN3VUFNQkl4RURBT0JnTlYKQkFNTUIzUmxjM1F0WTJFd0hoY05NVGd3TlRBMk1qRXdOREE1V2hjTk1UZ3dOekExTWpFd05EQTVXakFXTVJRdwpFZ1lEVlFRRERBdG9ZUzV5Ym1Ob2NpNXViRENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DCmdnRUJBTFJlMXdzekZSb2Rib2pZV05DSHA3UkdJaUVIMENDZ1F2MmdMRXNkUUNKZlcrUFEvVjM0NnQ3bSs3TFEKZXJaV3ZZMWpuY2VuWU5JSGRBU0VnU0ducWExYnhUSU9FaE0zQXpib3B0WDhjSW1OSGZoQlZETGdiTEYzUk0xaQpPM1JLTGdIS2tYSTMxZndjbU9zWGUwaElYQnpUbmxnM20vUzlXL3NTc0l1dDVwNENDUWV3TWlpWFhuUElKb21lCmpkS3VjSHFnMTlzd0YvcGVUalZrcVpuMkJHazZRaWFpMU41bldRV0pjcThTenZxTTViZElDaWlwYU9hWWQ3RFEKYWRTejV5dlF0YkxQNW4wTXpnOU43S3pGcEpvUys5QWdkWDI5cmZqV2JSekp3RzM5R3dRemN6VWtLcnZEb05JaQo0UFJHc01yclFNVXFSYjRSajNQOEJodEMxWXNDQXdFQUFhTTVNRGN3Q1FZRFZSMFRCQUl3QURBTEJnTlZIUThFCkJBTUNCZUF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdJR0NDc0dBUVVGQndNQk1BMEdDU3FHU0liM0RRRUIKQ3dVQUE0SUJBUUNKZm5PWlFLWkowTFliOGNWUW5Vdi9NZkRZVEJIQ0pZcGM4MmgzUGlXWElMQk1jWDhQRC93MgpoOUExNkE4NGNxODJuQXEvaFZYYy9JNG9yaFY5WW9jSEg5UlcvbGthTUQ2VEJVR0Q1U1k4S292MHpHQ1ROaDZ6Ci9wZTNqTC9uU0pYSjRtQm51czJheHFtWnIvM3hhaWpYZG9kMmd3eGVhTklvRjNLbHB2aGU3ZjRBNmpsQTM0MmkKVVlCZ09iN1F5KytRZWd4U1diSmdoSzg1MmUvUUhnU2FVSkN6NW1sNGc1WndnNnBTUXhySUhCNkcvREc4dElSYwprZDMxSk1qY25Fb1Rhc1Jyc1NwVmNGdXZyQXlXN2liakZyYzhienBNcE1obDVwYUZRcEZzMnIwaXpZekhwakFsCk5ZR2I2OHJHcjBwQkp3YU5DS2ErbCtLRTk4M3A3NDYwCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K - tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBdEY3WEN6TVZHaDF1aU5oWTBJZW50RVlpSVFmUUlLQkMvYUFzU3gxQUlsOWI0OUQ5ClhmanEzdWI3c3RCNnRsYTlqV09keDZkZzBnZDBCSVNCSWFlcHJWdkZNZzRTRXpjRE51aW0xZnh3aVkwZCtFRlUKTXVCc3NYZEV6V0k3ZEVvdUFjcVJjamZWL0J5WTZ4ZDdTRWhjSE5PZVdEZWI5TDFiK3hLd2k2M21uZ0lKQjdBeQpLSmRlYzhnbWlaNk4wcTV3ZXFEWDJ6QVgrbDVPTldTcG1mWUVhVHBDSnFMVTNtZFpCWWx5cnhMTytvemx0MGdLCktLbG81cGgzc05CcDFMUG5LOUMxc3MvbWZRek9EMDNzck1Xa21oTDcwQ0IxZmIydCtOWnRITW5BYmYwYkJETnoKTlNRcXU4T2cwaUxnOUVhd3l1dEF4U3BGdmhHUGMvd0dHMExWaXdJREFRQUJBb0lCQUJKYUErOHp4MVhjNEw0egpwUFd5bDdHVDRTMFRLbTNuWUdtRnZudjJBZXg5WDFBU2wzVFVPckZyTnZpK2xYMnYzYUZoSFZDUEN4N1RlMDVxClhPa2JzZnZkZG5iZFQ2RjgyMnJleVByRXNINk9TUnBWSzBmeDVaMDQwVnRFUDJCWm04eTYyNG1QZk1vbDdya2MKcm9Kd09rOEVpUHZZekpsZUd0bTAwUm1sRysyL2c0aWJsOTVmQXpyc1MvcGUyS3ZoN2NBVEtIcVh6MjlpUmZpbApiTGhBamQwcEVSMjNYU0hHR1ZqRmF3amNJK1c2L2RtbDZURDhrSzFGaUtldmJKTlREeVNXQnpPbXRTYUp1K01JCm9iUnVWWG4yZVNoamVGM1BYcHZRMWRhNXdBa0dJQWxOWjRHTG5QU2ZwVmJyU0plU3RrTGNzdEJheVlJS3BWZVgKSVVTTHM0RUNnWUVBMmNnZUE2WHh0TXdFNU5QWlNWdGhzbXRiYi9YYmtsSTdrWHlsdk5zZjFPdXRYVzkybVJneQpHcEhUQ0VubDB0Z1p3T081T1FLNjdFT3JUdDBRWStxMDJzZndwcmgwNFZEVGZhcW5QNTBxa3BmZEJLQWpmanEyCjFoZDZMd2hLeDRxSm9aelp2VkowV0lvR1ZLcjhJSjJOWGRTUVlUanZUZHhGczRTamdqNFFiaEVDZ1lFQTFBWUUKSEo3eVlza2EvS2V2OVVYbmVrSTRvMm5aYjJ1UVZXazRXSHlaY2NRN3VMQVhGY3lJcW5SZnoxczVzN3RMTzJCagozTFZNUVBzazFNY25oTTl4WE4vQ3ZDTys5b2t0RnNaMGJqWFh6NEJ5V2lFNHJPS1lhVEFwcDVsWlpUT3ZVMWNyCm05R3NwMWJoVDVZb2RaZ3IwUHQyYzR4U2krUVlEWnNFb2lFdzNkc0NnWUVBcVJLYWNweWZKSXlMZEJjZ0JycGkKQTRFalVLMWZsSjR3enNjbGFKUDVoM1NjZUFCejQzRU1YT0kvSXAwMFJsY3N6em83N3cyMmpud09mOEJSM0RBMwp6ZTRSWDIydWw4b0hGdldvdUZOTTNOZjNaNExuYXpVc0F0UGhNS2hRWGMrcEFBWGthUDJkZzZ0TU5PazFxaUNHCndvU212a1BVVE84b1ViRTB1NFZ4ZmZFQ2dZQUpPdDNROVNadUlIMFpSSitIV095enlOQTRaUEkvUkhwN0RXS1QKajVFS2Y5VnR1OVMxY1RyOTJLVVhITXlOUTNrSjg2OUZPMnMvWk85OGg5THptQ2hDTjhkOWN6enI5SnJPNUFMTApqWEtBcVFIUlpLTFgrK0ZRcXZVVlE3cTlpaHQyMEZPb3E5OE5SZDMzSGYxUzZUWDNHZ3RWQ21YSml6dDAxQ3ZHCmR4VnVnd0tCZ0M2Mlp0b0RLb3JyT2hvdTBPelprK2YwQS9rNDJBOENiL29VMGpwSzZtdmxEWmNYdUF1QVZTVXIKNXJCZjRVYmdVYndqa1ZWSFR6LzdDb1BWSjUvVUxJWk1Db1RUNFprNTZXWDk4ZE93Q3VTVFpZYnlBbDZNS1BBZApTZEpuVVIraEpnSVFDVGJ4K1dzYnh2d0FkbWErWUhtaVlPRzZhSklXMXdSd1VGOURLUEhHCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== -``` - -## 8. Configure FQDN - -There are two references to `` in the config file (one in this step and one in the next). Both need to be replaced with the FQDN chosen in [Configure DNS](#3-configure-dns). - -In the `kind: Ingress` with `name: cattle-ingress-http`: - -* Replace `` with the FQDN chosen in [Configure DNS](#3-configure-dns). - -After replacing `` with the FQDN chosen in [Configure DNS](#3-configure-dns), the file should look like the example below (`rancher.yourdomain.com` is the FQDN used in this example): - -```yaml - --- - apiVersion: extensions/v1beta1 - kind: Ingress - metadata: - namespace: cattle-system - name: cattle-ingress-http - annotations: - nginx.ingress.kubernetes.io/proxy-connect-timeout: "30" - nginx.ingress.kubernetes.io/proxy-read-timeout: "1800" # Max time in seconds for ws to remain shell window open - nginx.ingress.kubernetes.io/proxy-send-timeout: "1800" # Max time in seconds for ws to remain shell window open - spec: - rules: - - host: rancher.yourdomain.com - http: - paths: - - backend: - serviceName: cattle-service - servicePort: 80 - tls: - - secretName: cattle-keys-ingress - hosts: - - rancher.yourdomain.com -``` - -Save the `.yml` file and close it. - -## 9. Back Up Your RKE Config File - -After you close your `.yml` file, back it up to a secure location. You can use this file again when it's time to upgrade Rancher. - -## 10. Run RKE - -With all configuration in place, use RKE to launch Rancher. You can complete this action by running the `rke up` command and using the `--config` parameter to point toward your config file. - -1. From your workstation, make sure `rancher-cluster.yml` and the downloaded `rke` binary are in the same directory. - -2. Open a Terminal instance. Change to the directory that contains your config file and `rke`. - -3. Enter one of the `rke up` commands listen below. - -``` -# MacOS -./rke_darwin-amd64 up --config rancher-cluster.yml -# Linux -./rke_linux-amd64 up --config rancher-cluster.yml -``` - -**Step Result:** The output should be similar to the snippet below: - -``` -INFO[0000] Building Kubernetes cluster -INFO[0000] [dialer] Setup tunnel for host [1.1.1.1] -INFO[0000] [network] Deploying port listener containers -INFO[0000] [network] Pulling image [alpine:latest] on host [1.1.1.1] -... -INFO[0101] Finished building Kubernetes cluster successfully -``` - -## 11. Back Up Auto-Generated Config File - -During installation, RKE automatically generates a config file named `kube_config_rancher-cluster.yml` in the same directory as the RKE binary. Copy this file and back it up to a safe location. You'll use this file later when upgrading Rancher Server. - -## 12. Remove Default Certificates - -**For those using a certificate signed by a recognized CA:** - ->**Note:** If you're using a self-signed certificate, you don't have to complete this procedure. Continue to [What's Next?](#what-s-next) - -By default, Rancher automatically generates self-signed certificates for itself after installation. However, since you've provided your own certificates, you must disable the certificates that Rancher generated for itself. - -**To Remove the Default Certificates:** - -1. Log into Rancher. - -2. Select **Settings** > **cacerts**. - -3. Choose `Edit` and remove the contents. Then click `Save`. - -## What's Next? - -You have a couple of options: - -- Create a backup of your Rancher Server in case of a disaster scenario: [High Availablility Back Up and Restoration]({{< baseurl >}}/rancher/v2.x/en/installation/backups-and-restoration/ha-backup-and-restoration). -- Create a Kubernetes cluster: [Creating a Cluster]({{ }}/rancher/v2.x/en/tasks/clusters/creating-a-cluster/). - -
- -## FAQ and Troubleshooting - -{{< ssl_faq_ha >}} +1. [Provision Nodes]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/nodes/) +1. [Configure Load Balancer]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/) +1. [Install Kubernetes with RKE]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rke/) +1. [Initialize Helm (tiller)]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/helm/) +1. [Install Rancher]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rancher/) diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/helm/_index.md b/content/rancher/v2.x/en/installation/ha-server-install2/helm/_index.md new file mode 100644 index 00000000000..47f3839d967 --- /dev/null +++ b/content/rancher/v2.x/en/installation/ha-server-install2/helm/_index.md @@ -0,0 +1,22 @@ +--- +title: 4 - Initialize Helm (Install tiller) +weight: 276 +--- + +`helm` is the package management tool of choice for Kubernetes. `helm` `charts` provide templating syntax for Kubernetes YAML manifest documents. With `helm` we can create configurable deployments instead of just using static files. For more information about creating your own catalog of deployments, check out the docs at [https://helm.sh/](https://helm.sh/) + +## Initialize Helm on your Cluster + +`helm` installs the `tiller` service on your cluster to manage `chart` deployments. Since `rke` has RBAC enabled by default we will need to use `kubectl` to create a `serviceaccount` and `clusterrolebinding` so `tiller` can deploy to our cluster for us. + +* Create the `ServiceAccount` in the `kube-system` namespace. +* Create the `ClusterRoleBinding` to give the `tiller` account access to the cluster. +* Finally use `helm` to initialize the `tiller` service + +``` +kubectl -n kube-system create serviceaccount tiller +kubectl create clusterrolebinding tiller --clusterrole cluster-admin --serviceaccount=kube-system:tiller +helm init --service-account tiller +``` + +> NOTE: This `tiller` install has full cluster access, which should be acceptable if the cluster is dedicated to Rancher server. Check out the [helm docs](https://docs.helm.sh/using_helm/#role-based-access-control) for restricting `tiller` access to suit your security requirements. \ No newline at end of file diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/_index.md b/content/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/_index.md new file mode 100644 index 00000000000..b0481f0d287 --- /dev/null +++ b/content/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/_index.md @@ -0,0 +1,17 @@ +--- +title: 2 - Configure Load Balancer +weight: 276 +--- + +Choose a hostname that you will use to access Rancher and + +### Load Balancer + +RKE will configure a Kubernetes ingress controller pod to listen on ports 80 and 443 tcp on each one of your nodes. + +Configure your load balancer as a basic Layer 4 tcp forwarder. The exact configuration will vary depending on your environment. + +#### Examples + +* [Amazon NLB]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/nlb) +* [Round Robin DNS]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/rrdns) diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/nlb/_index.md b/content/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/nlb/_index.md new file mode 100644 index 00000000000..f6c38ac9398 --- /dev/null +++ b/content/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/nlb/_index.md @@ -0,0 +1,172 @@ +--- +title: Amazon NLB +weight: 277 +--- +## Objectives + +Configuring an Amazon NLB is a multistage process. We've broken it down into multiple tasks so that it's easy to follow. + +1. [Create Target Groups](#create-target-groups) + + Begin by creating two target groups for the **TCP** protocol, one regarding TCP port 443 and one regarding TCP port 80 (providing redirect to TCP port 443). You'll add your Linux nodes to these groups. + +2. [Register Targets](#register-targets) + + Add your Linux nodes to the target groups. + +3. [Create Your NLB](#create-your-nlb) + + Use Amazon's Wizard to create an Network Load Balancer. As part of this process, you'll add the target groups you created in **1. Create Target Groups**. + + +## Create Target Groups + +Your first NLB configuration step is to create two target groups. Technically, only port 443 is needed to access Rancher, but its convenient to add a listener for port 80 which will be redirected to port 443 automatically. The NGINX controller on the nodes will make sure that port 80 gets redirected to port 443. + +Log into the [Amazon AWS Console](https://console.aws.amazon.com/ec2/) to get started, make sure to select the **Region** where your EC2 instances (Linux nodes) are created. + +The Target Groups configuration resides in the **Load Balancing** section of the **EC2** service. Select **Services** and choose **EC2**, find the section **Load Balancing** and open **Target Groups**. + +![EC2 Load Balancing section]({{< baseurl >}}/img/rancher/ha/nlb/ec2-loadbalancing.png) + +Click **Create target group** to create the first target group, regarding TCP port 443. + +### Target Group (TCP port 443) + +Configure the first target group according to the table below. Screenshots of the configuration are shown just below the table. + +Option | Setting +--------------------------------------|------------------------------------ +Target Group Name | `rancher-tcp-443` +Protocol | `TCP` +Port | `443` +Target type | `instance` +VPC | Choose your VPC +Protocol
(Health Check) | `HTTP` +Path
(Health Check) | `/healthz` +Port (Advanced health check) | `override`,`80` +Healthy threshold (Advanced health) | `3` +Unhealthy threshold (Advanced) | `3` +Timeout (Advanced) | `6 seconds` +Interval (Advanced) | `10 second` +Success codes | `200-399` + +
+**Screenshot Target group TCP port 443 settings**
+![Target group 443]({{< baseurl >}}/img/rancher/ha/nlb/create-targetgroup-443.png) + +
+**Screenshot Target group TCP port 443 Advanced settings**
+![Target group 443 Advanced]({{< baseurl >}}/img/rancher/ha/nlb/create-targetgroup-443-advanced.png) + +
+ +Click **Create target group** to create the second target group, regarding TCP port 80. + +### Target Group (TCP port 80) + +Configure the second target group according to the table below. Screenshots of the configuration are shown just below the table. + +Option | Setting +--------------------------------------|------------------------------------ +Target Group Name | `rancher-tcp-80` +Protocol | `TCP` +Port | `80` +Target type | `instance` +VPC | Choose your VPC +Protocol
(Health Check) | `HTTP` +Path
(Health Check) | `/healthz` +Port (Advanced health check) | `traffic port` +Healthy threshold (Advanced health) | `3` +Unhealthy threshold (Advanced) | `3` +Timeout (Advanced) | `6 seconds` +Interval (Advanced) | `10 second` +Success codes | `200-399` + +
+**Screenshot Target group TCP port 80 settings**
+![Target group 80]({{< baseurl >}}/img/rancher/ha/nlb/create-targetgroup-80.png) + +
+**Screenshot Target group TCP port 80 Advanced settings**
+![Target group 80 Advanced]({{< baseurl >}}/img/rancher/ha/nlb/create-targetgroup-80-advanced.png) + +
+ +## Register Targets + +Next, add your Linux nodes to both target groups. + +Select the target group named **rancher-tcp-443**, click the tab **Targets** and choose **Edit**. + +![Edit target group 443]({{< baseurl >}}/img/rancher/ha/nlb/edit-targetgroup-443.png) + +Select the instances (Linux nodes) you want to add, and click **Add to registered**. + +
+**Screenshot Add targets to target group TCP port 443**
+ +![Add targets to target group 443]({{< baseurl >}}/img/rancher/ha/nlb/add-targets-targetgroup-443.png) + +
+**Screenshot Added targets to target group TCP port 443**
+ +![Added targets to target group 443]({{< baseurl >}}/img/rancher/ha/nlb/added-targets-targetgroup-443.png) + +When the instances are added, click **Save** on the bottom right of the screen. + +Repeat those steps, replacing **rancher-tcp-443** with **rancher-tcp-80**. The same instances need to be added as targets to this target group. + +## Create Your NLB + +Use Amazon's Wizard to create an Network Load Balancer. As part of this process, you'll add the target groups you created in [Create Target Groups](#create-target-groups). + +1. From your web browser, navigate to the [Amazon EC2 Console](https://console.aws.amazon.com/ec2/). + +2. From the navigation pane, choose **LOAD BALANCING** > **Load Balancers**. + +3. Click **Create Load Balancer**. + +4. Choose **Network Load Balancer** and click **Create**. + +5. Complete the **Step 1: Configure Load Balancer** form. + - **Basic Configuration** + + - Name: `rancher` + - Scheme: `internet-facing` + - **Listeners** + + Add the **Load Balancer Protocols** and **Load Balancer Ports** below. + - `TCP`: `443` + + - **Availability Zones** + + - Select Your **VPC** and **Availability Zones**. + +6. Complete the **Step 2: Configure Routing** form. + + - From the **Target Group** drop-down, choose **Existing target group**. + + - From the **Name** drop-down, choose `rancher-tcp-443`. + + - Open **Advanced health check settings**, and configure **Interval** to `10 seconds`. + +7. Complete **Step 3: Register Targets**. Since you registered your targets earlier, all you have to do is click **Next: Review**. + +8. Complete **Step 4: Review**. Look over the load balancer details and click **Create** when you're satisfied. + +9. After AWS creates the NLB, click **Close**. + +## Add listener to NLB for TCP port 80 + +1. Select your newly created NLB and select the **Listeners** tab. + +2. Click **Add listener**. + +3. Use `TCP`:`80` as **Protocol** : **Port** + +4. Click **Add action** and choose **Forward to...** + +5. From the **Forward to** drop-down, choose `rancher-tcp-80`. + +6. Click **Save** in the top right of the screen. diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/rrdns/_index.md b/content/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/rrdns/_index.md new file mode 100644 index 00000000000..e36aa841351 --- /dev/null +++ b/content/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/rrdns/_index.md @@ -0,0 +1,35 @@ +--- +title: Round Robin DNS +weight: 277 +--- + +If you don't have load balancers available in your environment, you can substitute with a Round Robin DNS entry. + +Create multiple `A` records for the same DNS endpoint. Your DNS server will rotate the IP addresses when queried. + +You can use tools like `dig` or `nslookup` to see all the records. + +``` +$ dig rancher.example.com + +; <<>> DiG 9.11.3-1ubuntu1.1-Ubuntu <<>> rancher.example.com +;; global options: +cmd +;; Got answer: +;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28524 +;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1 + +;; OPT PSEUDOSECTION: +; EDNS: version: 0, flags:; udp: 1280 +;; QUESTION SECTION: +;rancher.example.com. IN A + +;; ANSWER SECTION: +rancher.example.com. 300 IN A 18.188.33.133 +rancher.example.com. 300 IN A 13.58.200.233 +rancher.example.com. 300 IN A 18.217.100.233 + +;; Query time: 60 msec +;; SERVER: 192.168.5.1#53(192.168.5.1) +;; WHEN: Tue Jul 03 20:04:50 CDT 2018 +;; MSG SIZE rcvd: 104 +``` \ No newline at end of file diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/nodes/_index.md b/content/rancher/v2.x/en/installation/ha-server-install2/nodes/_index.md new file mode 100644 index 00000000000..09aea96971b --- /dev/null +++ b/content/rancher/v2.x/en/installation/ha-server-install2/nodes/_index.md @@ -0,0 +1,48 @@ +--- +title: 1 - Provision Nodes +weight: 276 +--- + +Use your provider of choice to provision 3 nodes for RKE. You will need to provide SSH credentials and DNS/IP address for your nodes to RKE. + +### Host Requirements + +#### Operating System + +{{< requirements_os >}}
+ +#### Hardware + +{{< requirements_hardware >}}
+ +#### Software + +{{< requirements_software >}} + +{{< note_server-tags >}} + +#### Ports + +##### Cluster External Ports + +These are ports that should be open between nodes and the external network for communication and management of Rancher. + +| Protocol | Ports | Description | +| --- | --- | --- | +| tcp | 22 | SSH for RKE install | +| tcp | 80 | ingress controller - redirect to https | +| tcp | 443 | ingress controller - https traffic to Rancher | +| tcp | 6443 | https to kube-api, used by kubectl and helm | +| tcp | 30000 - 32767 | Kubernetes NodePorts for k8s workloads | + +
+ +##### Additional Ports Required Between Rancher Cluster Nodes + +In addition to the ports listed above these ports must be open between nodes. + +| Protocol | Ports | Description | +| --- | --- | --- | +| tcp | 2379-2380 | etcd | +| udp | 8472 | overlay networking | +| tcp | 10250 | kubelet | diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/rke/_index.md b/content/rancher/v2.x/en/installation/ha-server-install2/rke/_index.md new file mode 100644 index 00000000000..4e98513899b --- /dev/null +++ b/content/rancher/v2.x/en/installation/ha-server-install2/rke/_index.md @@ -0,0 +1,73 @@ +--- +title: 3 - Install Kubernetes with RKE +weight: 276 +--- + +Configure the RKE `cluster.yml` and run `rke` to install Kubernetes with a HA `etcd` install. + +### Create a `cluster.yml` File + +Using the sample below create a `cluster.yml` file. Replace the IP Addresses in the `nodes` list with the IP address or DNS names of the 3 Nodes you created. + +```yaml +nodes: +- address: 165.227.114.63 + user: ubuntu + role: [controlplane,worker,etcd] +- address: 165.227.116.167 + user: ubuntu + role: [controlplane,worker,etcd] +- address: 165.227.127.226 + user: ubuntu + role: [controlplane,worker,etcd] + # internal_address: 10.10.0.1 + # ssh_key_path: /home/user/.ssh/id_rsa +``` + +#### Common RKE Options + +| Option | Description | +| --- | --- | +| `address` | The public DNS or IP address | +| `internal_address` | The private DNS or IP address for inter-cluster traffic | +| `role` | List of Kubernetes roles assigned to the node | +| `ssh_key_path` | Path to SSH private key used to authenticate to the node | +| `user` | A user that can run docker commands | + +
+ +#### Advanced Configurations + +RKE has many configuration options for customizing the install to suit your specific environment. Here are some common advanced scenarios. + +* Air Gap Network +* Private Docker Registry + +Please see the [RKE Documentation]({{< baseurl >}}docs/rke/v0.1.x/en/) for the full list of options and capabilities. + +### Run RKE + +``` +rke up --config ./cluster.yaml +``` + +### Testing your cluster + +`rke` should have created a file `kube_config_cluster.yml`. This file has the credentials for `kubectl` and `helm`. + +You can copy this file to `$HOME/.kube/config` or if you are working with multiple Kubernetes clusters, set`KUBECONFIG` environmental variable to the path of `kube_config_cluster.yml`. + +``` +export KUBECONFIG=$(pwd)/kube_config_cluster.yml +``` + +Test you connectivity with `kubectl` and see if you can get the list of nodes back. + +``` +kubectl get nodes + +NAME STATUS ROLES AGE VERSION +165.227.114.63 Ready controlplane,etcd,worker 11m v1.10.1 +165.227.116.167 Ready controlplane,etcd,worker 11m v1.10.1 +165.227.127.226 Ready controlplane,etcd,worker 11m v1.10.1 +``` From 974e265cda111b4e6fad4a22e1728f4ba43b4117 Mon Sep 17 00:00:00 2001 From: Jason Greathouse Date: Tue, 3 Jul 2018 21:17:05 -0500 Subject: [PATCH 02/18] chart install - split instead of mono page --- .../ha-server-install2/helm/_index.md | 2 +- .../ha-server-install2/rancher/_index.md | 139 ++++++++++++++++++ 2 files changed, 140 insertions(+), 1 deletion(-) create mode 100644 content/rancher/v2.x/en/installation/ha-server-install2/rancher/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/helm/_index.md b/content/rancher/v2.x/en/installation/ha-server-install2/helm/_index.md index 47f3839d967..f46f1d07a7d 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install2/helm/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install2/helm/_index.md @@ -5,7 +5,7 @@ weight: 276 `helm` is the package management tool of choice for Kubernetes. `helm` `charts` provide templating syntax for Kubernetes YAML manifest documents. With `helm` we can create configurable deployments instead of just using static files. For more information about creating your own catalog of deployments, check out the docs at [https://helm.sh/](https://helm.sh/) -## Initialize Helm on your Cluster +### Initialize Helm on your Cluster `helm` installs the `tiller` service on your cluster to manage `chart` deployments. Since `rke` has RBAC enabled by default we will need to use `kubectl` to create a `serviceaccount` and `clusterrolebinding` so `tiller` can deploy to our cluster for us. diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/rancher/_index.md b/content/rancher/v2.x/en/installation/ha-server-install2/rancher/_index.md new file mode 100644 index 00000000000..10664f65eee --- /dev/null +++ b/content/rancher/v2.x/en/installation/ha-server-install2/rancher/_index.md @@ -0,0 +1,139 @@ +--- +title: 5 - Install Rancher +weight: 276 +--- + +Rancher installation is now managed using the Helm package manager for Kubernetes. Use `helm` to install the prerequisite and Rancher charts. + +## Prerequisites + +### Add the Chart Repo + +Add the Rancher chart repository. + +``` +helm repo add rancher-stable https://releases.rancher.com/server-charts/stable +``` + +### Install `cert-manager` + +Rancher relies on [cert-manager](https://github.com/kubernetes/charts/tree/master/stable/cert-manager) from the Kubernetes Helm Stable catalog to issue self-signed or LetsEncrypt certificates. + +Install `cert-manager` from the Helm stable catalog. + +``` +helm install stable/cert-manager --name cert-manager --namespace kube-system +``` + +## Installing Rancher + +Rancher server is designed to be "secure by default" and requires SSL/TLS configuration. + +There are three options for the source of the certificate. + +* `rancher` - (Default) Use Rancher generated CA/Certificates. +* `letsEncrypt` - Use [LetsEncrypt](https://letsencrypt.org/) to issue a cert. +* `secret` - Configure a Kubernetes Secret with your certificate files. + +### (Default) Rancher Generated Certificates + +The default is to use the Rancher to generate a CA and use the `cert-manager` to issue the certificate for access to the Rancher server interface. + +The only requirement is to set the `hostname` to the DNS name you pointed at your Load Balancer. + +``` +helm install rancher-stable/rancher --name rancher --namespace cattle-system \ +--set hostname=rancher.my.org +``` + +### LetsEncrypt + +Use LetsEncrypt's free service to issue trusted SSL certs. This configuration uses http validation so the Load Balancer must have a Public DNS record and be accessible from the internet. + +Set `hostname`, `ingress.tls.source=letEncrypt` and LetsEncrypt options. + +``` +helm install rancher-stable/rancher --name rancher --namespace cattle-system \ +--set hostname=rancher.my.org \ +--set ingress.tls.source=letsEncrypt \ +--set letsEncrypt.email=me@example.org +``` + +> LetsEncrypt ProTip: The default `production` environment only allows you to register a name 5 times in a week. If you're rebuilding a bunch of times, use `--set letsEncrypt.environment=staging` until you have you're confident your config is right. + +### Certificates from Files (Kubernetes Secret) + +Create Kubernetes Secrets from your own certificates for Rancher to use. + +> NOTE: The common name for the cert will need to match the `hostname` option or the ingress controller will fail to provision the site for Rancher. + +Set `hostname` and `ingress.tls.source=secret` + +> NOTE: If you are using a Private CA signed cert, add `--set privateCA=true` + +``` +helm install rancher-stable/rancher --name rancher --namespace cattle-system \ +--set hostname=rancher.my.org \ +--set ingress.tls.source=secret +``` + +Now that Rancher is running, see [Adding TLS Secrets](#Adding-TLS-Secrets) to publish the certificate files so Rancher and the Ingress Controller can use them. + +## Adding TLS Secrets + +Kubernetes will create all the objects and services for Rancher, but it will not become available until we populate the `tls-rancher-ingress` secret in the `cattle-system` namespace with the certificate and key. + +Combine the server certificate followed by the intermediate cert chain your CA provided into a file named `tls.crt`. Copy your key into a file name `tls.key`. + +Use `kubectl` with the `tls` type to create the secrets. + +``` +kubectl -n cattle-system create secret tls tls-rancher-ingress --cert=./tls.crt --key=./tls.key +``` + +### Private CA Signed - Additional Steps + +If you are using a private CA, Rancher will need to have a copy of the CA cert to include when generating agent configs. + +Copy the CA cert into a file named `cacerts.pem` and use `kubectl` to create the `tls-ca` secret in the `cattle-system` namespace. + +``` +kubectl -n cattle-system create secret generic tls-ca --from-file=cacerts.pem +``` + +## Common Chart Options + +| Option | Default Value | Description | +| --- | --- | --- | +| `hostname` | " " | `string` - the Fully Qualified Domain Name for your Rancher Server | +| `ingress.tls.source` | "rancher" | `string` - Where to get the cert for the ingress. - "rancher, letsEncrypt, secret" | +| `letsEncrypt.email` | " " | `string` - Your email address | +| `letsEncrypt.environment` | "production" | `string` - Valid options: "staging, production" | +| `privateCA` | false | `bool` - Set to true if your cert is signed by a private CA | + +## Advanced Options + +| Option | Default Value | Description | +| --- | --- | --- | +| `debug` | false | `bool` - set debug flag on rancher server | +| `imagePullSecrets` | [] | `list` - list of names of Secret resource containing private registry credentials | +| `resources` | {} | `map` - rancher pod resource requests & limits | +| `rancherImage` | "rancher/rancher" | `string` - rancher image source | +| `rancherImageTag` | same as chart version | `string` - rancher/rancher image tag | + +## Private or Air Gap Registry + +You can point to a private registry for an "Air Gap" install. + +### Create Registry Secret + +Create a Registry secret in the `cattle-system` namespace. Check out the [Kubernetes Docs](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/) for more info. + +### Registry Options + +Add the `rancherImage` to point to your private registry image and `imagePullSecrets` to your install command. + +``` +--set rancherImage=private.reg.org:5000/rancher/rancher \ +--set imagePullSecrets[0].name=secretName +``` \ No newline at end of file From a4b89eb8c78c9ca1920f8cab96de649a320079ab Mon Sep 17 00:00:00 2001 From: Jason Greathouse Date: Thu, 5 Jul 2018 15:49:12 -0500 Subject: [PATCH 03/18] add air gap/private regsitry instructions --- .../installation/ha-server-install2/_index.md | 2 +- .../ha-server-install2/helm/_index.md | 42 ++++++++++++++++++- .../ha-server-install2/loadbalancer/_index.md | 2 +- .../ha-server-install2/rke/_index.md | 17 ++++---- 4 files changed, 52 insertions(+), 11 deletions(-) diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/_index.md b/content/rancher/v2.x/en/installation/ha-server-install2/_index.md index a0ac81750bf..164a16f3f41 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install2/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install2/_index.md @@ -24,7 +24,7 @@ This procedure walks you through setting up a 3-node cluster with RKE and instal The following CLI tools are required for this install. Please make sure these tools installed and available in your `$PATH` * [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl) - Kubernetes command-line tool. -* [rke]({{< baseurl >}}docs/rke/v0.1.x/en/installation/) - Rancher Kubernetes Engine, cli for building Kubernetes clusters. +* [rke]({{< baseurl >}}/rke/v0.1.x/en/installation/) - Rancher Kubernetes Engine, cli for building Kubernetes clusters. * [helm](https://docs.helm.sh/using_helm/#installing-helm) - Package management for Kubernetes. ## Installation Outline diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/helm/_index.md b/content/rancher/v2.x/en/installation/ha-server-install2/helm/_index.md index f46f1d07a7d..3285e1d56dd 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install2/helm/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install2/helm/_index.md @@ -16,7 +16,47 @@ weight: 276 ``` kubectl -n kube-system create serviceaccount tiller kubectl create clusterrolebinding tiller --clusterrole cluster-admin --serviceaccount=kube-system:tiller +``` + +
Additional steps for Air Gap/Private Registry +

+ +If you have an Air Gapped network extra configuration will be required. + +##### Create registry secret + +Create a registry secret in the `kube-system` namespace for the `tiller` ServiceAccount to use. + +``` +kubectl -n kube-system create secret docker-registry regcred \ +--docker-server="reg.example.com" \ +--docker-username= \ +--docker-password= \ +--docker-email= +``` + +##### Patch the ServiceAccount + +Update the ServiceAccount to include the imagePullSecret. Pods created with this ServiceAccount will automatically have the imagePullSecret added to their manifest. + +``` +kubectl -n kube-system patch serviceaccount default -p '{\"imagePullSecrets\": [{\"name\": \"regcred\"}]}' +``` + +##### Helm Init with `--tiller-image` option + +``` +helm init --service-account tiller --tiller-image registry.example.com/kubernetes-helm/tiller:v2.9.1 +``` + +

+
+ +``` helm init --service-account tiller ``` -> NOTE: This `tiller` install has full cluster access, which should be acceptable if the cluster is dedicated to Rancher server. Check out the [helm docs](https://docs.helm.sh/using_helm/#role-based-access-control) for restricting `tiller` access to suit your security requirements. \ No newline at end of file +> NOTE: This `tiller` install has full cluster access, which should be acceptable if the cluster is dedicated to Rancher server. Check out the [helm docs](https://docs.helm.sh/using_helm/#role-based-access-control) for restricting `tiller` access to suit your security requirements. + + +[Next: Install Rancher]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rancher/) \ No newline at end of file diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/_index.md b/content/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/_index.md index b0481f0d287..2ff5d972101 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/_index.md @@ -3,7 +3,7 @@ title: 2 - Configure Load Balancer weight: 276 --- -Choose a hostname that you will use to access Rancher and +Choose a hostname that you will use to access Rancher and Create a DNS record to point at your load balancer endpoint. ### Load Balancer diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/rke/_index.md b/content/rancher/v2.x/en/installation/ha-server-install2/rke/_index.md index 4e98513899b..408369f6b18 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install2/rke/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install2/rke/_index.md @@ -28,11 +28,11 @@ nodes: | Option | Description | | --- | --- | -| `address` | The public DNS or IP address | -| `internal_address` | The private DNS or IP address for inter-cluster traffic | -| `role` | List of Kubernetes roles assigned to the node | -| `ssh_key_path` | Path to SSH private key used to authenticate to the node | -| `user` | A user that can run docker commands | +| `address` | (required) The public DNS or IP address | +| `internal_address` | (optional) The private DNS or IP address for internal cluster traffic | +| `role` | (required) List of Kubernetes roles assigned to the node | +| `ssh_key_path` | (optional) Path to SSH private key used to authenticate to the node | +| `user` | (required) A user that can run docker commands |
@@ -40,10 +40,11 @@ nodes: RKE has many configuration options for customizing the install to suit your specific environment. Here are some common advanced scenarios. -* Air Gap Network -* Private Docker Registry +* [SSH Bastion/Jump Server]({{< baseurl >}}/rke/v0.1.x/en/config-options/bastion-host/) +* [System Images for Air Gap Network]({{< baseurl >}}/rke/v0.1.x/en/config-options/system-images/) +* [Private Docker Image Registry]({{< baseurl >}}/rke/v0.1.x/en/config-options/private-registries/) -Please see the [RKE Documentation]({{< baseurl >}}docs/rke/v0.1.x/en/) for the full list of options and capabilities. +Please see the [RKE Documentation]({{< baseurl >}}/rke/v0.1.x/en/) for the full list of options and capabilities. ### Run RKE From b26c0bd378bcb8b8206cbec173985611888d6c2d Mon Sep 17 00:00:00 2001 From: Jason Greathouse Date: Thu, 5 Jul 2018 17:28:16 -0500 Subject: [PATCH 04/18] move lb in with nodes, add chart-options and troubleshooting --- .../installation/ha-server-install2/_index.md | 3 +- .../_index.md | 23 +++++- .../nlb/_index.md | 0 .../ha-server-install2/helm/_index.md | 18 +++-- .../ha-server-install2/loadbalancer/_index.md | 17 ---- .../loadbalancer/rrdns/_index.md | 35 --------- .../ha-server-install2/rancher/_index.md | 78 ++++--------------- .../rancher/chart-options/_index.md | 53 +++++++++++++ .../rancher/tls-secrets/_index.md | 26 +++++++ .../rancher/troubleshooting/_index.md | 5 ++ .../ha-server-install2/rke/_index.md | 4 +- 11 files changed, 137 insertions(+), 125 deletions(-) rename content/rancher/v2.x/en/installation/ha-server-install2/{nodes => create-nodes-and-load-balancer}/_index.md (53%) rename content/rancher/v2.x/en/installation/ha-server-install2/{loadbalancer => create-nodes-and-load-balancer}/nlb/_index.md (100%) delete mode 100644 content/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/_index.md delete mode 100644 content/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/rrdns/_index.md create mode 100644 content/rancher/v2.x/en/installation/ha-server-install2/rancher/chart-options/_index.md create mode 100644 content/rancher/v2.x/en/installation/ha-server-install2/rancher/tls-secrets/_index.md create mode 100644 content/rancher/v2.x/en/installation/ha-server-install2/rancher/troubleshooting/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/_index.md b/content/rancher/v2.x/en/installation/ha-server-install2/_index.md index 164a16f3f41..02eebf2a986 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install2/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install2/_index.md @@ -29,8 +29,7 @@ The following CLI tools are required for this install. Please make sure these to ## Installation Outline -1. [Provision Nodes]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/nodes/) -1. [Configure Load Balancer]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/) +1. [Create Nodes and Load Balancer]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/create-nodes-and-load-balancer/) 1. [Install Kubernetes with RKE]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rke/) 1. [Initialize Helm (tiller)]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/helm/) 1. [Install Rancher]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rancher/) diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/nodes/_index.md b/content/rancher/v2.x/en/installation/ha-server-install2/create-nodes-and-load-balancer/_index.md similarity index 53% rename from content/rancher/v2.x/en/installation/ha-server-install2/nodes/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install2/create-nodes-and-load-balancer/_index.md index 09aea96971b..64ed0149c17 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install2/nodes/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install2/create-nodes-and-load-balancer/_index.md @@ -1,9 +1,11 @@ --- -title: 1 - Provision Nodes +title: 1 - Create Nodes and Load Balancer weight: 276 --- -Use your provider of choice to provision 3 nodes for RKE. You will need to provide SSH credentials and DNS/IP address for your nodes to RKE. +Use your provider of choice to provision 3 nodes and a Load Balancer endpoint for your RKE install. + +You will need to provide SSH credentials and DNS/IP address for your nodes to RKE. ### Host Requirements @@ -11,7 +13,7 @@ Use your provider of choice to provision 3 nodes for RKE. You will need to provi {{< requirements_os >}}
-#### Hardware +#### Nodes {{< requirements_hardware >}}
@@ -46,3 +48,18 @@ In addition to the ports listed above these ports must be open between nodes. | tcp | 2379-2380 | etcd | | udp | 8472 | overlay networking | | tcp | 10250 | kubelet | +
+ +### Load Balancer + +RKE will configure an Ingress-Controller pod, on each of your nodes. The ingress controller pods are bound to ports 80 and 443 tcp on the host network and are the entry point for https traffic to the Rancher server. + +Configure a load balancer as a basic Layer 4 tcp forwarder. The exact configuration will vary depending on your environment. + +#### Examples + +* [Amazon NLB]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/create-nodes-and-load-balancer/nlb) + +
+ +### [Next: Install Kubernetes with RKE]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rke/) \ No newline at end of file diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/nlb/_index.md b/content/rancher/v2.x/en/installation/ha-server-install2/create-nodes-and-load-balancer/nlb/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/nlb/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install2/create-nodes-and-load-balancer/nlb/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/helm/_index.md b/content/rancher/v2.x/en/installation/ha-server-install2/helm/_index.md index 3285e1d56dd..0454959b08e 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install2/helm/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install2/helm/_index.md @@ -1,5 +1,5 @@ --- -title: 4 - Initialize Helm (Install tiller) +title: 3 - Initialize Helm (Install tiller) weight: 276 --- @@ -40,23 +40,29 @@ kubectl -n kube-system create secret docker-registry regcred \ Update the ServiceAccount to include the imagePullSecret. Pods created with this ServiceAccount will automatically have the imagePullSecret added to their manifest. ``` -kubectl -n kube-system patch serviceaccount default -p '{\"imagePullSecrets\": [{\"name\": \"regcred\"}]}' +kubectl -n kube-system patch serviceaccount tiller -p \ +'{"imagePullSecrets": [{"name\": "regcred"}]}' ``` -##### Helm Init with `--tiller-image` option +##### `--tiller-image` option + +Add the --tiller-image option to the `helm init` command. ``` -helm init --service-account tiller --tiller-image registry.example.com/kubernetes-helm/tiller:v2.9.1 +--tiller-image reg.example.com/kubernetes-helm/tiller:v2.9.1 ```

+##### Helm init + +`helm init` installs the `tiller` service in the `kube-system` namespace on your cluster. + ``` helm init --service-account tiller ``` > NOTE: This `tiller` install has full cluster access, which should be acceptable if the cluster is dedicated to Rancher server. Check out the [helm docs](https://docs.helm.sh/using_helm/#role-based-access-control) for restricting `tiller` access to suit your security requirements. - -[Next: Install Rancher]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rancher/) \ No newline at end of file +### [Next: Install Rancher]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rancher/) \ No newline at end of file diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/_index.md b/content/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/_index.md deleted file mode 100644 index 2ff5d972101..00000000000 --- a/content/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/_index.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -title: 2 - Configure Load Balancer -weight: 276 ---- - -Choose a hostname that you will use to access Rancher and Create a DNS record to point at your load balancer endpoint. - -### Load Balancer - -RKE will configure a Kubernetes ingress controller pod to listen on ports 80 and 443 tcp on each one of your nodes. - -Configure your load balancer as a basic Layer 4 tcp forwarder. The exact configuration will vary depending on your environment. - -#### Examples - -* [Amazon NLB]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/nlb) -* [Round Robin DNS]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/rrdns) diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/rrdns/_index.md b/content/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/rrdns/_index.md deleted file mode 100644 index e36aa841351..00000000000 --- a/content/rancher/v2.x/en/installation/ha-server-install2/loadbalancer/rrdns/_index.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -title: Round Robin DNS -weight: 277 ---- - -If you don't have load balancers available in your environment, you can substitute with a Round Robin DNS entry. - -Create multiple `A` records for the same DNS endpoint. Your DNS server will rotate the IP addresses when queried. - -You can use tools like `dig` or `nslookup` to see all the records. - -``` -$ dig rancher.example.com - -; <<>> DiG 9.11.3-1ubuntu1.1-Ubuntu <<>> rancher.example.com -;; global options: +cmd -;; Got answer: -;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28524 -;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1 - -;; OPT PSEUDOSECTION: -; EDNS: version: 0, flags:; udp: 1280 -;; QUESTION SECTION: -;rancher.example.com. IN A - -;; ANSWER SECTION: -rancher.example.com. 300 IN A 18.188.33.133 -rancher.example.com. 300 IN A 13.58.200.233 -rancher.example.com. 300 IN A 18.217.100.233 - -;; Query time: 60 msec -;; SERVER: 192.168.5.1#53(192.168.5.1) -;; WHEN: Tue Jul 03 20:04:50 CDT 2018 -;; MSG SIZE rcvd: 104 -``` \ No newline at end of file diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/rancher/_index.md b/content/rancher/v2.x/en/installation/ha-server-install2/rancher/_index.md index 10664f65eee..5b530b2e87e 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install2/rancher/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install2/rancher/_index.md @@ -1,15 +1,14 @@ --- -title: 5 - Install Rancher +title: 4 - Install Rancher weight: 276 --- Rancher installation is now managed using the Helm package manager for Kubernetes. Use `helm` to install the prerequisite and Rancher charts. -## Prerequisites ### Add the Chart Repo -Add the Rancher chart repository. +Use `helm repo add` to add the Rancher chart repository. ``` helm repo add rancher-stable https://releases.rancher.com/server-charts/stable @@ -17,7 +16,7 @@ helm repo add rancher-stable https://releases.rancher.com/server-charts/stable ### Install `cert-manager` -Rancher relies on [cert-manager](https://github.com/kubernetes/charts/tree/master/stable/cert-manager) from the Kubernetes Helm Stable catalog to issue self-signed or LetsEncrypt certificates. +Rancher relies on [cert-manager](https://github.com/kubernetes/charts/tree/master/stable/cert-manager) from the Kubernetes Helm "stable" catalog to issue self-signed or LetsEncrypt certificates. Install `cert-manager` from the Helm stable catalog. @@ -25,7 +24,7 @@ Install `cert-manager` from the Helm stable catalog. helm install stable/cert-manager --name cert-manager --namespace kube-system ``` -## Installing Rancher +### Choose your SSL Configuration Rancher server is designed to be "secure by default" and requires SSL/TLS configuration. @@ -35,7 +34,9 @@ There are three options for the source of the certificate. * `letsEncrypt` - Use [LetsEncrypt](https://letsencrypt.org/) to issue a cert. * `secret` - Configure a Kubernetes Secret with your certificate files. -### (Default) Rancher Generated Certificates + + +#### (Default) Rancher Generated Certificates The default is to use the Rancher to generate a CA and use the `cert-manager` to issue the certificate for access to the Rancher server interface. @@ -46,7 +47,7 @@ helm install rancher-stable/rancher --name rancher --namespace cattle-system \ --set hostname=rancher.my.org ``` -### LetsEncrypt +#### LetsEncrypt Use LetsEncrypt's free service to issue trusted SSL certs. This configuration uses http validation so the Load Balancer must have a Public DNS record and be accessible from the internet. @@ -61,7 +62,7 @@ helm install rancher-stable/rancher --name rancher --namespace cattle-system \ > LetsEncrypt ProTip: The default `production` environment only allows you to register a name 5 times in a week. If you're rebuilding a bunch of times, use `--set letsEncrypt.environment=staging` until you have you're confident your config is right. -### Certificates from Files (Kubernetes Secret) +#### Certificates from Files (Kubernetes Secret) Create Kubernetes Secrets from your own certificates for Rancher to use. @@ -77,63 +78,18 @@ helm install rancher-stable/rancher --name rancher --namespace cattle-system \ --set ingress.tls.source=secret ``` -Now that Rancher is running, see [Adding TLS Secrets](#Adding-TLS-Secrets) to publish the certificate files so Rancher and the Ingress Controller can use them. +Now that Rancher is running, see [Adding TLS Secrets]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rancher/tls-secrets) to publish the certificate files so Rancher and the Ingress Controller can use them. -## Adding TLS Secrets +### Advanced Configurations -Kubernetes will create all the objects and services for Rancher, but it will not become available until we populate the `tls-rancher-ingress` secret in the `cattle-system` namespace with the certificate and key. +The Rancher chart configuration has many options for customizing the install to suit your specific environment. Here are some common advanced scenarios. -Combine the server certificate followed by the intermediate cert chain your CA provided into a file named `tls.crt`. Copy your key into a file name `tls.key`. +* [Private Docker Image Registry/Air Gap Network]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rancher/chart-options/#Private-or-Air-Gap-Registry) -Use `kubectl` with the `tls` type to create the secrets. +See the [Chart Options]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rancher/chart-options) for the full list of options. -``` -kubectl -n cattle-system create secret tls tls-rancher-ingress --cert=./tls.crt --key=./tls.key -``` +### Finishing Up -### Private CA Signed - Additional Steps +That's it you should have a functional Rancher server. Point a browser at the hostname you picked and you should be greeted by the colorful login page. -If you are using a private CA, Rancher will need to have a copy of the CA cert to include when generating agent configs. - -Copy the CA cert into a file named `cacerts.pem` and use `kubectl` to create the `tls-ca` secret in the `cattle-system` namespace. - -``` -kubectl -n cattle-system create secret generic tls-ca --from-file=cacerts.pem -``` - -## Common Chart Options - -| Option | Default Value | Description | -| --- | --- | --- | -| `hostname` | " " | `string` - the Fully Qualified Domain Name for your Rancher Server | -| `ingress.tls.source` | "rancher" | `string` - Where to get the cert for the ingress. - "rancher, letsEncrypt, secret" | -| `letsEncrypt.email` | " " | `string` - Your email address | -| `letsEncrypt.environment` | "production" | `string` - Valid options: "staging, production" | -| `privateCA` | false | `bool` - Set to true if your cert is signed by a private CA | - -## Advanced Options - -| Option | Default Value | Description | -| --- | --- | --- | -| `debug` | false | `bool` - set debug flag on rancher server | -| `imagePullSecrets` | [] | `list` - list of names of Secret resource containing private registry credentials | -| `resources` | {} | `map` - rancher pod resource requests & limits | -| `rancherImage` | "rancher/rancher" | `string` - rancher image source | -| `rancherImageTag` | same as chart version | `string` - rancher/rancher image tag | - -## Private or Air Gap Registry - -You can point to a private registry for an "Air Gap" install. - -### Create Registry Secret - -Create a Registry secret in the `cattle-system` namespace. Check out the [Kubernetes Docs](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/) for more info. - -### Registry Options - -Add the `rancherImage` to point to your private registry image and `imagePullSecrets` to your install command. - -``` ---set rancherImage=private.reg.org:5000/rancher/rancher \ ---set imagePullSecrets[0].name=secretName -``` \ No newline at end of file +Doesn't Work? Take a look at the [Troubleshooting]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rancher/troubleshooting) Page diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/rancher/chart-options/_index.md b/content/rancher/v2.x/en/installation/ha-server-install2/rancher/chart-options/_index.md new file mode 100644 index 00000000000..2ba073e5b1e --- /dev/null +++ b/content/rancher/v2.x/en/installation/ha-server-install2/rancher/chart-options/_index.md @@ -0,0 +1,53 @@ +--- +title: Chart Options +weight: 276 +--- + +### Common Options + +| Option | Default Value | Description | +| --- | --- | --- | +| `hostname` | " " | `string` - the Fully Qualified Domain Name for your Rancher Server | +| `ingress.tls.source` | "rancher" | `string` - Where to get the cert for the ingress. - "rancher, letsEncrypt, secret" | +| `letsEncrypt.email` | " " | `string` - Your email address | +| `letsEncrypt.environment` | "production" | `string` - Valid options: "staging, production" | +| `privateCA` | false | `bool` - Set to true if your cert is signed by a private CA | + +
+ +### Advanced Options + +| Option | Default Value | Description | +| --- | --- | --- | +| `debug` | false | `bool` - set debug flag on rancher server | +| `imagePullSecrets` | [] | `list` - list of names of Secret resource containing private registry credentials | +| `resources` | {} | `map` - rancher pod resource requests & limits | +| `rancherImage` | "rancher/rancher" | `string` - rancher image source | +| `rancherImageTag` | same as chart version | `string` - rancher/rancher image tag | + +
+ +### Private or Air Gap Registry + +You can point to a private registry for an "Air Gap" install. + +#### Create Registry Secret + +Use `kubectl` to create a docker-registry secret in the `cattle-system` namespace. + +``` +kubectl -n cattle-system create secret docker-registry regcred \ +--docker-server="reg.example.com:5000" \ +--docker-username= \ +--docker-password= \ +--docker-email= +``` + +#### Registry Options + +Add the `rancherImage` to point to your private registry image and `imagePullSecrets` to your install command. + +``` +--set rancherImage=reg.example.com:5000/rancher/rancher \ +--set imagePullSecrets[0].name=regcred +``` \ No newline at end of file diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/rancher/tls-secrets/_index.md b/content/rancher/v2.x/en/installation/ha-server-install2/rancher/tls-secrets/_index.md new file mode 100644 index 00000000000..50f2a4dff57 --- /dev/null +++ b/content/rancher/v2.x/en/installation/ha-server-install2/rancher/tls-secrets/_index.md @@ -0,0 +1,26 @@ +--- +title: Adding TLS Secrets +weight: 276 +--- + +Kubernetes will create all the objects and services for Rancher, but it will not become available until we populate the `tls-rancher-ingress` secret in the `cattle-system` namespace with the certificate and key. + +Combine the server certificate followed by the intermediate cert chain your CA provided into a file named `tls.crt`. Copy your key into a file name `tls.key`. + +Use `kubectl` with the `tls` type to create the secrets. + +``` +kubectl -n cattle-system create secret tls tls-rancher-ingress \ +--cert=./tls.crt \ +--key=./tls.key +``` + +### Private CA Signed - Additional Steps + +If you are using a private CA, Rancher will need to have a copy of the CA cert to include when generating agent configs. + +Copy the CA cert into a file named `cacerts.pem` and use `kubectl` to create the `tls-ca` secret in the `cattle-system` namespace. + +``` +kubectl -n cattle-system create secret generic tls-ca --from-file=cacerts.pem +``` diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/rancher/troubleshooting/_index.md b/content/rancher/v2.x/en/installation/ha-server-install2/rancher/troubleshooting/_index.md new file mode 100644 index 00000000000..b4003f2c98d --- /dev/null +++ b/content/rancher/v2.x/en/installation/ha-server-install2/rancher/troubleshooting/_index.md @@ -0,0 +1,5 @@ +--- +title: Troubleshooting +weight: 276 +--- + diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/rke/_index.md b/content/rancher/v2.x/en/installation/ha-server-install2/rke/_index.md index 408369f6b18..754fd20c72d 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install2/rke/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install2/rke/_index.md @@ -1,5 +1,5 @@ --- -title: 3 - Install Kubernetes with RKE +title: 2 - Install Kubernetes with RKE weight: 276 --- @@ -72,3 +72,5 @@ NAME STATUS ROLES AGE VER 165.227.116.167 Ready controlplane,etcd,worker 11m v1.10.1 165.227.127.226 Ready controlplane,etcd,worker 11m v1.10.1 ``` + +### [Next: Initialize Helm]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/helm/) \ No newline at end of file From 346c10ec78fb067646e04913739dedcc0d302fa7 Mon Sep 17 00:00:00 2001 From: Jason Greathouse Date: Thu, 5 Jul 2018 18:25:02 -0500 Subject: [PATCH 05/18] add troubleshooting --- .../ha-server-install2/rancher/_index.md | 2 +- .../rancher/troubleshooting/_index.md | 118 ++++++++++++++++++ 2 files changed, 119 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/rancher/_index.md b/content/rancher/v2.x/en/installation/ha-server-install2/rancher/_index.md index 5b530b2e87e..eedbc5d9d18 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install2/rancher/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install2/rancher/_index.md @@ -14,7 +14,7 @@ Use `helm repo add` to add the Rancher chart repository. helm repo add rancher-stable https://releases.rancher.com/server-charts/stable ``` -### Install `cert-manager` +### Install cert-manager Rancher relies on [cert-manager](https://github.com/kubernetes/charts/tree/master/stable/cert-manager) from the Kubernetes Helm "stable" catalog to issue self-signed or LetsEncrypt certificates. diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/rancher/troubleshooting/_index.md b/content/rancher/v2.x/en/installation/ha-server-install2/rancher/troubleshooting/_index.md index b4003f2c98d..2fce8e8d444 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install2/rancher/troubleshooting/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install2/rancher/troubleshooting/_index.md @@ -3,3 +3,121 @@ title: Troubleshooting weight: 276 --- +### Where is everything + +Most of the troubleshooting will be done on Objects in these 3 namespaces. + +* `cattle-system` - `rancher` deployment and pods. +* `ingress-nginx` - Ingress controller pods and services. +* `kube-system` - `tiller` and `cert-manager` pods. + +### "default backend - 404" + +A number of things can cause the ingress-controller not to forward traffic to your rancher instance. Most of the time its due to a bad ssl configuration. + +Things to check + +* [Is Rancher Running](#is-rancher-running) +* [Cert CN is "Kubernetes Ingress Controller Fake Certificate"](#cert-cn-is-kubernetes-ingress-controller-fake-certificate) + +### Is Rancher Running + +Use `kubectl` to check the `cattle-system` system namespace and see if the Rancher pods are in a Running state. + +``` +kubectl -n cattle-system get pods + +NAME READY STATUS RESTARTS AGE +pod/rancher-784d94f59b-vgqzh 1/1 Running 0 10m +``` + +If the state is not `Running`, run a `describe` on the pod and check the Events. + +``` +kubectl -n cattle-system describe pod + +... +Events: + Type Reason Age From Message + ---- ------ ---- ---- ------- + Normal Scheduled 11m default-scheduler Successfully assigned rancher-784d94f59b-vgqzh to localhost + Normal SuccessfulMountVolume 11m kubelet, localhost MountVolume.SetUp succeeded for volume "rancher-token-dj4mt" + Normal Pulling 11m kubelet, localhost pulling image "rancher/rancher:v2.0.4" + Normal Pulled 11m kubelet, localhost Successfully pulled image "rancher/rancher:v2.0.4" + Normal Created 11m kubelet, localhost Created container + Normal Started 11m kubelet, localhost Started container +``` + +### Checking the rancher logs + +Use `kubectl` to list the pods. + +``` +kubectl -n cattle-system get pods + +NAME READY STATUS RESTARTS AGE +pod/rancher-784d94f59b-vgqzh 1/1 Running 0 10m +``` + +Use `kubectl` and the pod name to list the logs from the pod. + +``` +kubectl -n cattle-namespace logs -f rancher-784d94f59b-vgqzh +``` + +### Cert CN is "Kubernetes Ingress Controller Fake Certificate" + +Use your browser to check the certificate details. If it says the Common Name is "Kubernetes Ingress Controller Fake Certificate", something may have gone wrong with reading or issuing your SSL cert. + +> Note: if you are using LetsEncrypt to issue certs it can sometimes take a few minuets to issue the cert. + +#### cert-manager issued certs (Rancher Generated or LetsEncrypt) + +`cert-manager` has 3 parts. + +* `cert-manager` pod in the `kube-system` namespace. +* `Issuer` object in the `cattle-system` namespace. +* `Certificate` object in the `cattle-system` namespace. + +Work backwards and do a `kubectl describe` on each object and check the events. You can track down what might be missing. + +For example there is a problem with the Issuer: + +``` +kubectl -n cattle-system describe certificate +... +Events: + Type Reason Age From Message + ---- ------ ---- ---- ------- + Warning IssuerNotReady 18s (x23 over 19m) cert-manager Issuer rancher not ready +``` + +``` +kubectl -n cattle-system describe issuer +... +Events: + Type Reason Age From Message + ---- ------ ---- ---- ------- + Warning ErrInitIssuer 19m (x12 over 19m) cert-manager Error initializing issuer: secret "tls-rancher" not found + Warning ErrGetKeyPair 9m (x16 over 19m) cert-manager Error getting keypair for CA issuer: secret "tls-rancher" not found +``` + +#### Bring Your Own SSL Certs + +Your certs get applied directly to the Ingress object in the `cattle-system` namespace. + +Check the status of the Ingress object and see if its ready. + +``` +kubectl -n cattle-system describe ingress +``` + +If its ready and the SSL is still not working you may have a malformed cert or secret. + +Check the nginx-ingress-controller logs. Because the nginx-ingress-controller has multiple containers in its pod you will need to specify the name of the container. + +``` +kubectl -n ingress-nginx logs -f nginx-ingress-controller-rfjrq nginx-ingress-controller +... +W0705 23:04:58.240571 7 backend_ssl.go:49] error obtaining PEM from secret cattle-system/tls-rancher-ingress: error retrieving secret cattle-system/tls-rancher-ingress: secret cattle-system/tls-rancher-ingress was not found +``` From 70adaa66965294c88a4cc38b733afdb260ae3b95 Mon Sep 17 00:00:00 2001 From: Jason Greathouse Date: Fri, 6 Jul 2018 11:17:14 -0500 Subject: [PATCH 06/18] remove old ha instructions and move relevent ha troubleshooting docs under install sections --- .../rancher/v2.x/en/installation/_index.md | 32 +- .../ha-server-install-external-lb/_index.md | 337 ------------- .../alb/_index.md | 94 ---- .../nginx/_index.md | 78 --- .../installation/ha-server-install/_index.md | 452 +----------------- .../create-nodes-and-load-balancer/_index.md | 8 +- .../nlb/_index.md | 0 .../helm/_index.md | 2 +- .../ha-server-install/nlb/_index.md | 172 ------- .../rancher/_index.md | 8 +- .../rancher/chart-options/_index.md | 0 .../rancher/tls-secrets/_index.md | 0 .../rancher/troubleshooting/_index.md | 0 .../rke/_index.md | 2 +- .../rke/troubleshooting}/_index.md | 16 +- .../installation/ha-server-install2/_index.md | 35 -- .../404-default-backend/_index.md | 40 -- .../installation/troubleshooting-ha/_index.md | 24 - .../generic-troubleshooting/_index.md | 145 ------ .../job-complete-status/_index.md | 54 --- 20 files changed, 59 insertions(+), 1440 deletions(-) delete mode 100644 content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md delete mode 100644 content/rancher/v2.x/en/installation/ha-server-install-external-lb/alb/_index.md delete mode 100644 content/rancher/v2.x/en/installation/ha-server-install-external-lb/nginx/_index.md rename content/rancher/v2.x/en/installation/{ha-server-install2 => ha-server-install}/create-nodes-and-load-balancer/_index.md (83%) rename content/rancher/v2.x/en/installation/{ha-server-install2 => ha-server-install}/create-nodes-and-load-balancer/nlb/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-server-install2 => ha-server-install}/helm/_index.md (96%) delete mode 100644 content/rancher/v2.x/en/installation/ha-server-install/nlb/_index.md rename content/rancher/v2.x/en/installation/{ha-server-install2 => ha-server-install}/rancher/_index.md (82%) rename content/rancher/v2.x/en/installation/{ha-server-install2 => ha-server-install}/rancher/chart-options/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-server-install2 => ha-server-install}/rancher/tls-secrets/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-server-install2 => ha-server-install}/rancher/troubleshooting/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-server-install2 => ha-server-install}/rke/_index.md (96%) rename content/rancher/v2.x/en/installation/{troubleshooting-ha/ssh-tunneling => ha-server-install/rke/troubleshooting}/_index.md (73%) delete mode 100644 content/rancher/v2.x/en/installation/ha-server-install2/_index.md delete mode 100644 content/rancher/v2.x/en/installation/troubleshooting-ha/404-default-backend/_index.md delete mode 100644 content/rancher/v2.x/en/installation/troubleshooting-ha/_index.md delete mode 100644 content/rancher/v2.x/en/installation/troubleshooting-ha/generic-troubleshooting/_index.md delete mode 100644 content/rancher/v2.x/en/installation/troubleshooting-ha/job-complete-status/_index.md diff --git a/content/rancher/v2.x/en/installation/_index.md b/content/rancher/v2.x/en/installation/_index.md index 911632a6c33..9b1b0950d68 100644 --- a/content/rancher/v2.x/en/installation/_index.md +++ b/content/rancher/v2.x/en/installation/_index.md @@ -4,38 +4,34 @@ weight: 50 --- This section contains instructions for installing Rancher in development and production environments. -Choose from the following installation options: +### Installation Options -- [Single Node Installation]({{< baseurl >}}/rancher/v2.x/en/installation/single-node-install) +- [Single Node Installation](single-node-install/) - In this simple install scenario, you install Rancher on a single Linux host. + Install Rancher on a single Linux host. -- [Single Node Installation with External Load Balancer]({{< baseurl >}}/rancher/v2.x/en/installation/single-node-install-external-lb) +- [Single Node Installation with External Load Balancer](single-node-install-external-lb/) In this scenario, you install Rancher on a single Linux host and access it using an external load balancer/proxy. -- [High Availability Installation]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install/) +- [High Availability Installation](ha-server-install/) - This install scenario creates a new Kubernetes cluster dedicated to running Rancher Server in a high-availabilty (HA) configuration. + This install scenario creates a new Kubernetes cluster dedicated to running Rancher Server in a high-availability (HA) configuration. -- [High Availability Installation with External Load Balancer]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install-external-lb) +### Advanced Install Scenarios - This install scenario creates a new Kubernetes cluster dedicated to running Rancher Server in a high-availabilty (HA) configuration. A load balancer is placed in front of the HA configuration. +- [Air Gap Installation](air-gap-installation/) -- [Air Gap Installation]({{< baseurl >}}/rancher/v2.x/en/installation/air-gap-installation/) + Required images and configuration to install Rancher Server in an environment without direct Internet access. - We also have instructions for a more specialized use case where you install Rancher Server in an environment without an Internet connection. +- [Rancher HTTP Proxy Configuration](proxy-configuration/) -This section also includes help content for Rancher configuration and maintenance. + Rancher configuration to run behind a proxy. -- [Backups and Restoration]({{< baseurl >}}/rancher/v2.x/en/installation/backups-and-restoration/) - This page lists the ports you must open to operate Rancher. +### Reference -- [Port Requirements]({{< baseurl >}}/rancher/v2.x/en/installation/references/) +- [Port Requirements](references/) - This page lists the ports you must open to operate Rancher. + List of required ports you must open to operate Rancher. -- [Rancher HTTP Proxy Configuration]({{< baseurl >}}/rancher/v2.x/en/installation/proxy-configuration/) - - If your Rancher installation runs behind a proxy, this page provides information on how to configure Rancher for your proxy. diff --git a/content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md deleted file mode 100644 index 868ce25ae97..00000000000 --- a/content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md +++ /dev/null @@ -1,337 +0,0 @@ ---- -title: High Availability Installation with External Load Balancer (HTTPS/Layer 7) -weight: 276 ---- -This set of instructions creates a new Kubernetes cluster that's dedicated to running Rancher in a high-availability (HA) configuration. This procedure walks you through setting up a 3-node cluster using the Rancher Kubernetes Engine (RKE). The cluster's sole purpose is running pods for Rancher. The setup is based on: - -- Layer 7 Loadbalancer with SSL termination (HTTPS) -- NGINX Ingress controller (HTTP) - -![Rancher HA]({{< baseurl >}}/img/rancher/ha/rancher2ha-l7.svg) - -## Installation Outline - -Installation of Rancher in a high-availability configuration involves multiple procedures. Review this outline to learn about each procedure you need to complete. - -1. [Provision Linux Hosts](#1-provision-linux-hosts) - - Provision three Linux hosts to serve as your Kubernetes cluster. - -2. [Configure Load Balancer](#2-configure-load-balancer) - - Configure your load balancer to have a highly available single point of entry to your Rancher cluster. - -3. [Configure DNS](#3-configure-dns) - - Make your setup accessible using a DNS name by configuring the DNS to point to your loadbalancer. - -4. [Download RKE](#4-download-rke) - - [RKE](https://github.com/rancher/rke/releases) is a fast, versatile Kubernetes installer that you can use to install Kubernetes on your Linux hosts. - -5. [Download RKE Config File Template](#5-download-config-file-template) - - RKE uses a YAML config file to install and configure your Kubernetes cluster. Download one of our RKE config file templates to get started. - -6. [Configure Nodes](#6-configure-nodes) - - Configure the **Nodes** section of the RKE config template. - -7. [Configure Certificates](#7-configure-certificates) - - Configure the **Certificates** part of the template too. - -8. [Configure FQDN](#8-configure-fqdn) - - And the **FQDN** part. - -9. [Back Up Your RKE Config File](#9-back-up-your-rke-config-file) - - After you've completed configuration of the RKE config file: 1. it's no longer a template since you'll be using it, and 2. you should back up the RKE config file to a safe place. You will reuse this file for upgrades later. - -10. [Run RKE](#10-run-rke) - - Run RKE to deploy Rancher to your cluster. - -11. [Back Up Auto-Generated Config File](#11-back-up-auto-generated-config-file) - - During installation, RKE generates a config file that you'll use later for upgrades. Back it up to a safe location. - -
-## 1. Provision Linux Hosts - -Before you install Rancher, confirm you meet the host requirements. Provision 3 new Linux hosts using the requirements below. - -### Requirements - -#### Operating System - -{{< requirements_os >}} - -#### Hardware - -{{< requirements_hardware >}} - -#### Software - -{{< requirements_software >}} - -{{< note_server-tags >}} - -#### Ports - -The following diagram depicts the basic port requirements for Rancher. For a comprehensive list, see [Port Requirements]({{< baseurl >}}/rancher/v2.x/en/installation/references/). - -![Basic Port Requirements]({{< baseurl >}}/img/rancher/port-communications.png) - -## 2. Configure Load Balancer - -When using a load balancer in front of Rancher, there's no need for the container to redirect port communication from port 80 or port 443. By passing the header `X-Forwarded-Proto: https`, this redirect is disabled. This is the expected configuration when terminating SSL externally. - -The load balancer has to be configured to support the following: - -* **WebSocket** connections -* **SPDY** / **HTTP/2** protocols -* Passing / setting the following headers: - -| Header | Value | Description | -|---------------------|----------------------------------------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `Host` | FQDN used to reach Rancher. | To identify the server requested by the client. | -| `X-Forwarded-Proto` | `https` | To identify the protocol that a client used to connect to the load balancer.

**Note:** If this header is present, `rancher/rancher` does not redirect HTTP to HTTPS. | -| `X-Forwarded-Port` | Port used to reach Rancher. | To identify the protocol that client used to connect to the load balancer. | -| `X-Forwarded-For` | IP of the client connection. | To identify the originating IP address of a client. | - -Health checks can be executed on the `/healthz` endpoint of the node, this will return HTTP 200. - -We have example configurations for the following load balancers: - -* [Amazon ALB configuration]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install-external-lb/alb) -* [NGINX configuration]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install-external-lb/nginx) - -## 3. Configure DNS - -Choose a fully qualified domain name (FQDN) that you want to use to access Rancher (e.g., `rancher.yourdomain.com`).

- -1. Log into your DNS server a create a `DNS A` record that points to the IP address of your [load balancer](#2-configure-load-balancer). - -2. Validate that the `DNS A` is working correctly. Run the following command from any terminal, replacing `HOSTNAME.DOMAIN.COM` with your chosen FQDN: - - `nslookup HOSTNAME.DOMAIN.COM` - - **Step Result:** Terminal displays output similar to the following: - - ``` - $ nslookup rancher.yourdomain.com - Server: YOUR_HOSTNAME_IP_ADDRESS - Address: YOUR_HOSTNAME_IP_ADDRESS#53 - - Non-authoritative answer: - Name: rancher.yourdomain.com - Address: HOSTNAME.DOMAIN.COM - ``` - -
- -## 4. Download RKE - -RKE is a fast, versatile Kubernetes installer that you can use to install Kubernetes on your Linux hosts. We will be using RKE to setup our cluster and run Rancher. - -1. From your workstation, open a web browser and navigate to our [RKE Releases](https://github.com/rancher/rke/releases/latest) page. Download the latest RKE installer applicable to your Operating System: - - - **MacOS**: `rke_darwin-amd64` - - **Linux**: `rke_linux-amd64` - - **Windows**: `rke_windows-amd64.exe` - -2. Make the RKE binary that you just downloaded executable. Open Terminal, change directory to the location of the RKE binary, and then run one of the commands below. - - >**Using Windows?** - >The file is already an executable. Skip to [Download Config File Template](#5-download-config-file-template). - - ``` - # MacOS - $ chmod +x rke_darwin-amd64 - # Linux - $ chmod +x rke_linux-amd64 - ``` - -3. Confirm that RKE is now executable by running the following command: - - ``` - # MacOS - $ ./rke_darwin-amd64 --version - # Linux - $ ./rke_linux-amd64 --version - ``` - - **Step Result:** You receive output similar to what follows: - ``` - rke version v - ``` - -## 5. Download RKE Config File Template - -RKE uses a YAML config file to install and configure your Kubernetes cluster. There are 2 templates to choose from, depending on the SSL certificate you want to use. - -1. Download one of following templates, depending on the SSL certificate you're using. - - - [Template for self-signed certificate
`3-node-externalssl-certificate.yml`](https://raw.githubusercontent.com/rancher/rancher/58e695b51096b1f404188379cea6f6a35aea9e4c/rke-templates/3-node-externalssl-certificate.yml) - - [Template for certificate signed by recognized CA
`3-node-externalssl-recognizedca.yml`](https://raw.githubusercontent.com/rancher/rancher/7f60dc3afe1b45287ac36ba6bde6f7c6e35c11fe/rke-templates/3-node-externalssl-recognizedca.yml) - -2. Rename the file to `rancher-cluster.yml`. - -## 6. Configure Nodes - -Once you have the `rancher-cluster.yml` config file template, edit the nodes section to point toward your Linux hosts. - -1. Open `rancher-cluster.yml` in your favorite text editor. - -2. Update the `nodes` section with the information of your [Linux hosts](#provision-linux-hosts). - - For each node in your cluster, update the following placeholders: `IP_ADDRESS_X` and `USER`. - -``` -nodes: - - address: IP_ADDRESS_1 - # THE IP ADDRESS OR HOSTNAME OF THE NODE - user: USER - # USER WITH ADMIN ACCESS. USUALLY `root` - role: [controlplane,etcd,worker] - ssh_key_path: ~/.ssh/id_rsa - # PATH TO SSH KEY THAT AUTHENTICATES ON YOUR WORKSTATION - # USUALLY THE VALUE ABOVE - - address: IP_ADDRESS_2 - user: USER - role: [controlplane,etcd,worker] - ssh_key_path: ~/.ssh/id_rsa - - address: IP_ADDRESS_3 - user: USER - role: [controlplane,etcd,worker] - ssh_key_path: ~/.ssh/id_rsa -``` - -## 7. Configure Certificates - -For security purposes, SSL (Secure Sockets Layer) is required when using Rancher. SSL secures all Rancher network communication, like when you login or interact with a cluster. - -Choose from the following options: - -- [Option A—Bring Your Own Certificate: Self-Signed](#option-a-bring-your-own-certificate-self-signed) -- [Option B—Bring Your Own Certificate: Signed by Recognized CA](#option-b-bring-your-own-certificate-signed-by-recognized-ca) - -### Option A—Bring Your Own Certificate: Self-Signed - ->**Prerequisites:** ->Create a self-signed certificate. -> ->- The certificate files must be in [PEM format](#pem). ->- The certificate files must be encoded in [base64](#base64). ->- In your certificate file, include all intermediate certificates in the chain. Order your certificates with your certificate first, followed by the intermediates. For an example, see [SSL FAQ / Troubleshooting](#cert-order). - -1. In `kind: Secret` with `name: cattle-keys-ingress`: - - * Replace `` with the base64 encoded string of the CA Certificate file (usually called `ca.pem` or `ca.crt`) - - >**Note:** - > The base64 encoded string should be on the same line as `cacerts.pem`, without any newline at the beginning, in between or at the end. - - **Result:** After replacing the values, the file should look like the example below (the base64 encoded strings should be different): - - ``` - --- - apiVersion: v1 - kind: Secret - metadata: - name: cattle-keys-server - namespace: cattle-system - type: Opaque - data: - cacerts.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNvRENDQVlnQ0NRRHVVWjZuMEZWeU16QU5CZ2txaGtpRzl3MEJBUXNGQURBU01SQXdEZ1lEVlFRRERBZDAKWlhOMExXTmhNQjRYRFRFNE1EVXdOakl4TURRd09Wb1hEVEU0TURjd05USXhNRFF3T1Zvd0VqRVFNQTRHQTFVRQpBd3dIZEdWemRDMWpZVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFNQmpBS3dQCndhRUhwQTdaRW1iWWczaTNYNlppVmtGZFJGckJlTmFYTHFPL2R0RUdmWktqYUF0Wm45R1VsckQxZUlUS3UzVHgKOWlGVlV4Mmo1Z0tyWmpwWitCUnFiZ1BNbk5hS1hocmRTdDRtUUN0VFFZdGRYMVFZS0pUbWF5NU45N3FoNTZtWQprMllKRkpOWVhHWlJabkdMUXJQNk04VHZramF0ZnZOdmJ0WmtkY2orYlY3aWhXanp2d2theHRUVjZlUGxuM2p5CnJUeXBBTDliYnlVcHlad3E2MWQvb0Q4VUtwZ2lZM1dOWmN1YnNvSjhxWlRsTnN6UjVadEFJV0tjSE5ZbE93d2oKaG41RE1tSFpwZ0ZGNW14TU52akxPRUc0S0ZRU3laYlV2QzlZRUhLZTUxbGVxa1lmQmtBZWpPY002TnlWQUh1dApuay9DMHpXcGdENkIwbkVDQXdFQUFUQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFHTCtaNkRzK2R4WTZsU2VBClZHSkMvdzE1bHJ2ZXdia1YxN3hvcmlyNEMxVURJSXB6YXdCdFJRSGdSWXVtblVqOGo4T0hFWUFDUEthR3BTVUsKRDVuVWdzV0pMUUV0TDA2eTh6M3A0MDBrSlZFZW9xZlVnYjQrK1JLRVJrWmowWXR3NEN0WHhwOVMzVkd4NmNOQQozZVlqRnRQd2hoYWVEQmdma1hXQWtISXFDcEsrN3RYem9pRGpXbi8walI2VDcrSGlaNEZjZ1AzYnd3K3NjUDIyCjlDQVZ1ZFg4TWpEQ1hTcll0Y0ZINllBanlCSTJjbDhoSkJqa2E3aERpVC9DaFlEZlFFVFZDM3crQjBDYjF1NWcKdE03Z2NGcUw4OVdhMnp5UzdNdXk5bEthUDBvTXl1Ty82Tm1wNjNsVnRHeEZKSFh4WTN6M0lycGxlbTNZQThpTwpmbmlYZXc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - ``` - -### Option B—Bring Your Own Certificate: Signed by Recognized CA - -If you are using a Certificate Signed By A Recognized Certificate Authority, you don't need to perform any step in this part. - -## 8. Configure FQDN - -There is one reference to `` in the RKE config file. Replace this reference with the FQDN you chose in in [3. Configure DNS](#part-3-configure-dns). - -1. Open `rancher-cluster.yml`. - -2. In the `kind: Ingress` with `name: cattle-ingress-http:` - - Replace `` with the FQDN chosen in [3. Configure DNS](#3-configure-dns). - - **Step Result:** After replacing the values, the file should look like the example below (the base64 encoded strings should be different): - - ``` - apiVersion: extensions/v1beta1 - kind: Ingress - metadata: - namespace: cattle-system - name: cattle-ingress-http - annotations: - nginx.ingress.kubernetes.io/proxy-connect-timeout: "30" - nginx.ingress.kubernetes.io/proxy-read-timeout: "1800" # Max time in seconds for ws to remain shell window open - nginx.ingress.kubernetes.io/proxy-send-timeout: "1800" # Max time in seconds for ws to remain shell window open - spec: - rules: - - host: rancher.yourdomain.com - http: - paths: - - backend: - serviceName: cattle-service - servicePort: 80 - ``` - - -3. Save the file and close it. - -## 9. Back Up Your RKE Config File - -After you close your RKE config file, `rancher-cluster.yml`, back it up to a secure location. You can use this file again when it's time to upgrade Rancher. - -## 10. Run RKE - -With all configuration in place, use RKE to launch Rancher. You can complete this action by running the `rke up` command and using the `--config` parameter to point toward your config file. - -1. From your workstation, make sure `rancher-cluster.yml` and the downloaded `rke` binary are in the same directory. - -2. Open a Terminal instance. Change to the directory that contains your config file and `rke`. - -3. Enter one of the `rke up` commands listen below. - - ``` - # MacOS - ./rke_darwin-amd64 up --config rancher-cluster.yml - # Linux - ./rke_linux-amd64 up --config rancher-cluster.yml - ``` - - **Step Result:** The output should be similar to the snippet below: - - ``` - INFO[0000] Building Kubernetes cluster - INFO[0000] [dialer] Setup tunnel for host [1.1.1.1] - INFO[0000] [network] Deploying port listener containers - INFO[0000] [network] Pulling image [alpine:latest] on host [1.1.1.1] - ... - INFO[0101] Finished building Kubernetes cluster successfully - ``` - -## 11. Back Up Auto-Generated Config File - -During installation, RKE automatically generates a config file named `kube_config_rancher-cluster.yml` in the same directory as the `rancher-cluster.yml` file. Copy this file and back it up to a safe location. You'll use this file later when upgrading Rancher Server. - -## What's Next? - -You have a couple of options: - -- Create a backup of your Rancher Server in case of a disaster scenario: [High Availablility Back Up and Restoration]({{< baseurl >}}/rancher/v2.x/en/installation/backups-and-restoration/ha-backup-and-restoration). -- Create a Kubernetes cluster: [Creating a Cluster]({{< baseurl >}}/rancher/v2.x/en/tasks/clusters/creating-a-cluster/). - -
- -## FAQ and Troubleshooting - -{{< ssl_faq_ha >}} diff --git a/content/rancher/v2.x/en/installation/ha-server-install-external-lb/alb/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-external-lb/alb/_index.md deleted file mode 100644 index 424d35bdd3f..00000000000 --- a/content/rancher/v2.x/en/installation/ha-server-install-external-lb/alb/_index.md +++ /dev/null @@ -1,94 +0,0 @@ ---- -title: Amazon ALB configuration -weight: 277 ---- -## Objectives - -Configuring an Amazon ALB is a multistage process. We've broken it down into multiple tasks so that it's easy to follow. - -1. [Create Target Group](#create-target-group) - - Begin by creating one target group for the http protocol. You'll add your Linux nodes to this group. - -2. [Register Targets](#register-targets) - - Add your Linux nodes to the target group. - -3. [Create Your ALB](#create-your-alb) - - Use Amazon's Wizard to create an Application Load Balancer. As part of this process, you'll add the target groups you created in **1. Create Target Groups**. - - -## Create Target Group - -Your first ALB configuration step is to create one target group for HTTP. - -Log into the [Amazon AWS Console](https://console.aws.amazon.com/ec2/) to get started. - -The document below will guide you through this process. Use the data in the tables below to complete the procedure. - -[Amazon Documentation: Create a Target Group](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-target-group.html) - -### Target Group (HTTP) - -Option | Setting -----------------------------|------------------------------------ -Target Group Name | `rancher-http-80` -Protocol | `HTTP` -Port | `80` -Target type | `instance` -VPC | Choose your VPC -Protocol
(Health Check) | `HTTP` -Path
(Health Check) | `/healthz` - -## Register Targets - -Next, add your Linux nodes to your target group. - -[Amazon Documentation: Register Targets with Your Target Group](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/target-group-register-targets.html) - -### Create Your ALB - -Use Amazon's Wizard to create an Application Load Balancer. As part of this process, you'll add the target group you created in [Create Target Group](#create-target-group). - -1. From your web browser, navigate to the [Amazon EC2 Console](https://console.aws.amazon.com/ec2/). - -2. From the navigation pane, choose **LOAD BALANCING** > **Load Balancers**. - -3. Click **Create Load Balancer**. - -4. Choose **Application Load Balancer**. - -5. Complete the **Step 1: Configure Load Balancer** form. - - **Basic Configuration** - - - Name: `rancher-http` - - Scheme: `internet-facing` - - IP address type: `ipv4` - - **Listeners** - - Add the **Load Balancer Protocols** and **Load Balancer Ports** below. - - `HTTP`: `80` - - `HTTPS`: `443` - - - **Availability Zones** - - - Select Your **VPC** and **Availability Zones**. - -6. Complete the **Step 2: Configure Security Settings** form. - - Configure the certificate you want to use for SSL termination. - -7. Complete the **Step 3: Configure Security Groups** form. - -8. Complete the **Step 4: Configure Routing** form. - - - From the **Target Group** drop-down, choose **Existing target group**. - - - Add target group `rancher-http-80`. - -9. Complete **Step 5: Register Targets**. Since you registered your targets earlier, all you have to do it click **Next: Review**. - -10. Complete **Step 6: Review**. Look over the load balancer details and click **Create** when you're satisfied. - -11. After AWS creates the ALB, click **Close**. diff --git a/content/rancher/v2.x/en/installation/ha-server-install-external-lb/nginx/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-external-lb/nginx/_index.md deleted file mode 100644 index 20579aa96b8..00000000000 --- a/content/rancher/v2.x/en/installation/ha-server-install-external-lb/nginx/_index.md +++ /dev/null @@ -1,78 +0,0 @@ ---- -title: NGINX configuration -weight: 277 ---- -## Install NGINX - -Start by installing NGINX on your load balancer host. NGINX has packages available for all known operating systems. - -For help installing NGINX, refer to their [install documentation](https://www.nginx.com/resources/wiki/start/topics/tutorials/install/). - -## Create NGINX Configuration - -After installing NGINX, you need to create the NGINX config file, `/etc/nginx/conf.d/rancher.conf`, with the IP addresses for your Linux nodes, chosen FQDN and location of the certificate file and certificate key file. - -1. Copy and paste the code sample below into your favorite text editor. Save it as `/etc/nginx/conf.d/rancher.conf`. - - **Example NGINX config:** - ``` - upstream rancher { - server IP_NODE_1:80; - server IP_NODE_2:80; - server IP_NODE_3:80; - } - - map $http_upgrade $connection_upgrade { - default Upgrade; - '' close; - } - - server { - listen 443 ssl http2; - server_name FQDN; - ssl_certificate /certs/fullchain.pem; - ssl_certificate_key /certs/privkey.pem; - - location / { - proxy_set_header Host $host; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_set_header X-Forwarded-Port $server_port; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_pass http://rancher; - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection $connection_upgrade; - # This allows the ability for the execute shell window to remain open for up to 15 minutes. Without this parameter, the default is 1 minute and will automatically close. - proxy_read_timeout 900s; - } - } - - server { - listen 80; - server_name FQDN; - return 301 https://$server_name$request_uri; - } - ``` - -2. In `/etc/nginx/conf.d/rancher.conf`, replace `IP_NODE_1`, `IP_NODE_2`, and `IP_NODE_3` with the IPs of your Linux hosts. -3. In `/etc/nginx/conf.d/rancher.conf`, replace `FQDN` with the FQDN you chose for your Rancher installation. -4. In `/etc/nginx/conf.d/rancher.conf`, replace `/certs/fullchain.pem` with the path to your certificate. If there are intermediates required for you certificate, they should be included in this file. -5. In `/etc/nginx/conf.d/rancher.conf`, replace `/certs/privkey.pem` with the path to your certificate key. - -## Run NGINX - -* Reload or restart NGINX - - ```` - # Reload NGINX - nginx -s reload - - # Restart NGINX - # Depending on your Linux distribution - service nginx restart - systemctl restart nginx - ```` - -## Browse to Rancher UI - -You should now be to able to browse to `https://FQDN`. diff --git a/content/rancher/v2.x/en/installation/ha-server-install/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/_index.md index efd0a46a5ec..02eebf2a986 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install/_index.md @@ -1,435 +1,35 @@ --- -title: High Availability Installation with External Load Balancer (TCP/Layer 4) +title: High Availability Installation weight: 275 +draft: true --- -This set of instructions creates a new Kubernetes cluster that's dedicated to running Rancher in a high-availability (HA) configuration. This procedure walks you through setting up a 3-node cluster using the Rancher Kubernetes Engine (RKE). The cluster's sole purpose is running pods for Rancher. The setup is based on: -- Layer 4 load balancer (TCP) -- NGINX ingress controller with SSL termination (HTTPS) +When installed as a Deployment in a Kubernetes cluster, Rancher will take integrate with the cluster's etcd database and Kubernetes scheduling for High-Availability. + +This procedure walks you through setting up a 3-node cluster with RKE and installing the Rancher chart the Helm package manager. + +> NOTE: For the best performance, we recommend this Kubernetes cluster be dedicated only the Rancher workload. + +## Recommended Architecture + +* DNS for Rancher should resolve to a Layer 4 Load Balancer +* The Load Balancer should forward ports 80 and 443 TCP to all 3 nodes in the Kubernetes cluster. +* The ingress controller will redirect http port 80 to https and terminate SSL/TLS on port 443. +* The ingress controller will forward traffic to port 80 on the Pod in the Rancher Deployment. ![Rancher HA]({{< baseurl >}}/img/rancher/ha/rancher2ha.svg) +## Required Tools + +The following CLI tools are required for this install. Please make sure these tools installed and available in your `$PATH` + +* [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl) - Kubernetes command-line tool. +* [rke]({{< baseurl >}}/rke/v0.1.x/en/installation/) - Rancher Kubernetes Engine, cli for building Kubernetes clusters. +* [helm](https://docs.helm.sh/using_helm/#installing-helm) - Package management for Kubernetes. + ## Installation Outline -Installation of Rancher in a high-availability configuration involves multiple procedures. Review this outline to learn about each procedure you need to complete. - -1. [Provision Linux Hosts](#1-provision-linux-hosts) - - Provision three Linux hosts to serve as your Kubernetes cluster. - -2. [Configure Load Balancer](#2-configure-load-balancer) - - Configure your load balancer to have a highly available single point of entry to your Rancher cluster. - -3. [Configure DNS](#3-configure-dns) - - Make your setup accessible using a DNS name by configuring the DNS to point to your loadbalancer. - -4. [Download RKE](#4-download-rke) - - [RKE](https://github.com/rancher/rke/releases) is a fast, versatile Kubernetes installer that you can use to install Kubernetes on your Linux hosts. - -5. [Download RKE Config File Template](#5-download-config-file-template) - - RKE uses a YAML config file to install and configure your Kubernetes cluster. Download one of our RKE config file templates to get started. - -6. [Configure Nodes](#6-configure-nodes) - - Configure the **Nodes** section of the RKE config template. - -7. [Configure Certificates](#7-configure-certificates) - - Configure the **Certificates** part of the template too. - -8. [Configure FQDN](#8-configure-fqdn) - - And the **FQDN** part. - -9. [Back Up Your RKE Config File](#9-back-up-your-rke-config-file) - - After you've completed configuration of the RKE config file: 1. it's no longer a template since you'll be using it, and 2. you should back up the RKE config file to a safe place. You will reuse this file for upgrades later. - -10. [Run RKE](#10-run-rke) - - Run RKE to deploy Rancher to your cluster. - -11. [Back Up Auto-Generated Config File](#11-back-up-auto-generated-config-file) - - During installation, RKE generates a config file that you'll use later for upgrades. Back it up to a safe location. - -
- -## 1. Provision Linux Hosts - -Before you install Rancher, confirm you meet the host requirements. Provision 3 new Linux hosts using the requirements below. - -### Host Requirements - -#### Operating System - -{{< requirements_os >}} - -#### Hardware - -{{< requirements_hardware >}} - -#### Software - -{{< requirements_software >}} - -{{< note_server-tags >}} - -#### Ports - -The following diagram depicts the basic port requirements for Rancher. For a comprehensive list, see [Port Requirements]({{< baseurl >}}/rancher/v2.x/en/installation/references/). - -![Basic Port Requirements]({{< baseurl >}}/img/rancher/port-communications.png) - -## 2. Configure Load Balancer - -We will be using NGINX as our Layer 4 Load Balancer (TCP). NGINX will forward all connections to one of your Rancher nodes. If you want to use Amazon NLB, you can skip this step and use [Amazon NLB configuration]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install/nlb/) - ->**Note:** -> In this configuration, the load balancer is positioned in front of your Linux hosts. The load balancer can be any host that you have available that's capable of running NGINX. -> ->One caveat: do not use one of your Rancher nodes as the load balancer. - -### A. Install NGINX - -Start by installing NGINX on your load balancer host. NGINX has packages available for all known operating systems. - -For help installing NGINX, refer to their [install documentation](https://www.nginx.com/resources/wiki/start/topics/tutorials/install/). - -### B. Create NGINX Configuration - -After installing NGINX, you need to update the NGINX config file, `nginx.conf`, with the IP addresses for your nodes. - -1. Copy and paste the code sample below into your favorite text editor. Save it as `nginx.conf`. - -2. From `nginx.conf`, replace `IP_NODE_1`, `IP_NODE_2`, and `IP_NODE_3` with the IPs of your [Linux hosts](#1-provision-linux-hosts). - - **Example NGINX config:** - ``` - worker_processes 4; - worker_rlimit_nofile 40000; - - events { - worker_connections 8192; - } - - http { - server { - listen 80; - return 301 https://$host$request_uri; - } - } - - stream { - upstream rancher_servers { - least_conn; - server IP_NODE_1:443 max_fails=3 fail_timeout=5s; - server IP_NODE_2:443 max_fails=3 fail_timeout=5s; - server IP_NODE_3:443 max_fails=3 fail_timeout=5s; - } - server { - listen 443; - proxy_pass rancher_servers; - } - } - ``` - -3. Save `nginx.conf` to your load balancer at the following path: `/etc/nginx/nginx.conf`. - -4. Load the updates to your NGINX configuration by running the following command: - - ``` - # nginx -s reload - ``` - -### Option - Run NGINX as Docker container - -Instead of installing NGINX as a package on the operating system, you can rather run it as a Docker container. Save the edited **Example NGINX config** as `/etc/nginx.conf` and run the following command to launch the NGINX container: - -``` -docker run -d --restart=unless-stopped \ - -p 80:80 -p 443:443 \ - -v /etc/nginx.conf:/etc/nginx/nginx.conf \ - nginx:1.14 -``` - -## 3. Configure DNS - -Choose a fully qualified domain name (FQDN) that you want to use to access Rancher (e.g., `rancher.yourdomain.com`).

- -1. Log into your DNS server a create a `DNS A` record that points to the IP address of your [load balancer](#2-configure-load-balancer). - -2. Validate that the `DNS A` is working correctly. Run the following command from any terminal, replacing `HOSTNAME.DOMAIN.COM` with your chosen FQDN: - - `nslookup HOSTNAME.DOMAIN.COM` - - **Step Result:** Terminal displays output similar to the following: - - ``` - $ nslookup rancher.yourdomain.com - Server: YOUR_HOSTNAME_IP_ADDRESS - Address: YOUR_HOSTNAME_IP_ADDRESS#53 - - Non-authoritative answer: - Name: rancher.yourdomain.com - Address: HOSTNAME.DOMAIN.COM - ``` - -
- -## 4. Download RKE - -RKE is a fast, versatile Kubernetes installer that you can use to install Kubernetes on your Linux hosts. We will be using RKE to setup our cluster and run Rancher. - -1. From your workstation, open a web browser and navigate to our [RKE Releases](https://github.com/rancher/rke/releases/latest) page. Download the latest RKE installer applicable to your Operating System: - - - **MacOS**: `rke_darwin-amd64` - - **Linux**: `rke_linux-amd64` - - **Windows**: `rke_windows-amd64.exe` - -2. Make the RKE binary that you just downloaded executable. Open Terminal, change directory to the location of the RKE binary, and then run one of the commands below. - - >**Using Windows?** - >The file is already an executable. Skip to [Download Config File Template](#5-download-config-file-template). - - ``` - # MacOS - $ chmod +x rke_darwin-amd64 - # Linux - $ chmod +x rke_linux-amd64 - ``` - -3. Confirm that RKE is now executable by running the following command: - - ``` - # MacOS - $ ./rke_darwin-amd64 --version - # Linux - $ ./rke_linux-amd64 --version - ``` - - **Step Result:** You receive output similar to what follows: - ``` - rke version v - ``` - -## 5. Download RKE Config File Template - -RKE uses a `.yml` config file to install and configure your Kubernetes cluster. There are 2 templates to choose from, depending on the SSL certificate you want to use. - -1. Download one of following templates, depending on the SSL certificate you're using. - - - [Template for self-signed certificate
`3-node-certificate.yml`](https://raw.githubusercontent.com/rancher/rancher/e9d29b3f3b9673421961c68adf0516807d1317eb/rke-templates/3-node-certificate.yml) - - [Template for certificate signed by recognized CA
`3-node-certificate-recognizedca.yml`](https://raw.githubusercontent.com/rancher/rancher/d8ca0805a3958552e84fdf5d743859097ae81e0b/rke-templates/3-node-certificate-recognizedca.yml) - -2. Rename the file to `rancher-cluster.yml`. - -## 6. Configure Nodes - -Once you have the `rancher-cluster.yml` config file template, edit the nodes section to point toward your Linux hosts. - -1. Open `rancher-cluster.yml` in your favorite text editor. - -2. Update the `nodes` section with the information of your [Linux hosts](#provision-linux-hosts). - - For each node in your cluster, update the following placeholders: `IP_ADDRESS_X` and `USER`. - -``` -nodes: - - address: IP_ADDRESS_1 - # THE IP ADDRESS OR HOSTNAME OF THE NODE - user: USER - # USER WITH ADMIN ACCESS. USUALLY `root` - role: [controlplane,etcd,worker] - ssh_key_path: ~/.ssh/id_rsa - # PATH TO SSH KEY THAT AUTHENTICATES ON YOUR WORKSTATION - # USUALLY THE VALUE ABOVE - - address: IP_ADDRESS_2 - user: USER - role: [controlplane,etcd,worker] - ssh_key_path: ~/.ssh/id_rsa - - address: IP_ADDRESS_3 - user: USER - role: [controlplane,etcd,worker] - ssh_key_path: ~/.ssh/id_rsa -``` - -## 7. Configure Certificates - -For security purposes, SSL (Secure Sockets Layer) is required when using Rancher. SSL secures all Rancher network communication, like when you login or interact with a cluster. - -Choose from the following options: - -- [Option A—Bring Your Own Certificate: Self-Signed](#option-a-bring-your-own-certificate-self-signed) -- [Option B—Bring Your Own Certificate: Signed by Recognized CA](#option-b-bring-your-own-certificate-signed-by-recognized-ca) - -### Option A—Bring Your Own Certificate: Self-Signed - ->**Prerequisites:** ->Create a self-signed certificate. -> ->- The certificate files must be in [PEM format](#pem). ->- The certificate files must be encoded in [base64](#base64). ->- In your certificate file, include all intermediate certificates in the chain. Order your certificates with your certificate first, followed by the intermediates. For an example, see [Intermediate Certificates](#cert-order). - -1. In `kind: Secret` with `name: cattle-keys-ingress`: - - * Replace `` with the base64 encoded string of the Certificate file (usually called `cert.pem` or `domain.crt`) - * Replace `` with the base64 encoded string of the Certificate Key file (usually called `key.pem` or `domain.key`) - - >**Note:** - > The base64 encoded string should be on the same line as `tls.crt` or `tls.key`, without any newline at the beginning, in between or at the end. - - **Result:** After replacing the values, the file should look like the example below (the base64 encoded strings should be different): - -```yaml ---- - apiVersion: v1 - kind: Secret - metadata: - name: cattle-keys-ingress - namespace: cattle-system - type: Opaque - data: - tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM1RENDQWN5Z0F3SUJBZ0lKQUlHc25NeG1LeGxLTUEwR0NTcUdTSWIzRFFFQkN3VUFNQkl4RURBT0JnTlYKQkFNTUIzUmxjM1F0WTJFd0hoY05NVGd3TlRBMk1qRXdOREE1V2hjTk1UZ3dOekExTWpFd05EQTVXakFXTVJRdwpFZ1lEVlFRRERBdG9ZUzV5Ym1Ob2NpNXViRENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DCmdnRUJBTFJlMXdzekZSb2Rib2pZV05DSHA3UkdJaUVIMENDZ1F2MmdMRXNkUUNKZlcrUFEvVjM0NnQ3bSs3TFEKZXJaV3ZZMWpuY2VuWU5JSGRBU0VnU0ducWExYnhUSU9FaE0zQXpib3B0WDhjSW1OSGZoQlZETGdiTEYzUk0xaQpPM1JLTGdIS2tYSTMxZndjbU9zWGUwaElYQnpUbmxnM20vUzlXL3NTc0l1dDVwNENDUWV3TWlpWFhuUElKb21lCmpkS3VjSHFnMTlzd0YvcGVUalZrcVpuMkJHazZRaWFpMU41bldRV0pjcThTenZxTTViZElDaWlwYU9hWWQ3RFEKYWRTejV5dlF0YkxQNW4wTXpnOU43S3pGcEpvUys5QWdkWDI5cmZqV2JSekp3RzM5R3dRemN6VWtLcnZEb05JaQo0UFJHc01yclFNVXFSYjRSajNQOEJodEMxWXNDQXdFQUFhTTVNRGN3Q1FZRFZSMFRCQUl3QURBTEJnTlZIUThFCkJBTUNCZUF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdJR0NDc0dBUVVGQndNQk1BMEdDU3FHU0liM0RRRUIKQ3dVQUE0SUJBUUNKZm5PWlFLWkowTFliOGNWUW5Vdi9NZkRZVEJIQ0pZcGM4MmgzUGlXWElMQk1jWDhQRC93MgpoOUExNkE4NGNxODJuQXEvaFZYYy9JNG9yaFY5WW9jSEg5UlcvbGthTUQ2VEJVR0Q1U1k4S292MHpHQ1ROaDZ6Ci9wZTNqTC9uU0pYSjRtQm51czJheHFtWnIvM3hhaWpYZG9kMmd3eGVhTklvRjNLbHB2aGU3ZjRBNmpsQTM0MmkKVVlCZ09iN1F5KytRZWd4U1diSmdoSzg1MmUvUUhnU2FVSkN6NW1sNGc1WndnNnBTUXhySUhCNkcvREc4dElSYwprZDMxSk1qY25Fb1Rhc1Jyc1NwVmNGdXZyQXlXN2liakZyYzhienBNcE1obDVwYUZRcEZzMnIwaXpZekhwakFsCk5ZR2I2OHJHcjBwQkp3YU5DS2ErbCtLRTk4M3A3NDYwCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K - tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBdEY3WEN6TVZHaDF1aU5oWTBJZW50RVlpSVFmUUlLQkMvYUFzU3gxQUlsOWI0OUQ5ClhmanEzdWI3c3RCNnRsYTlqV09keDZkZzBnZDBCSVNCSWFlcHJWdkZNZzRTRXpjRE51aW0xZnh3aVkwZCtFRlUKTXVCc3NYZEV6V0k3ZEVvdUFjcVJjamZWL0J5WTZ4ZDdTRWhjSE5PZVdEZWI5TDFiK3hLd2k2M21uZ0lKQjdBeQpLSmRlYzhnbWlaNk4wcTV3ZXFEWDJ6QVgrbDVPTldTcG1mWUVhVHBDSnFMVTNtZFpCWWx5cnhMTytvemx0MGdLCktLbG81cGgzc05CcDFMUG5LOUMxc3MvbWZRek9EMDNzck1Xa21oTDcwQ0IxZmIydCtOWnRITW5BYmYwYkJETnoKTlNRcXU4T2cwaUxnOUVhd3l1dEF4U3BGdmhHUGMvd0dHMExWaXdJREFRQUJBb0lCQUJKYUErOHp4MVhjNEw0egpwUFd5bDdHVDRTMFRLbTNuWUdtRnZudjJBZXg5WDFBU2wzVFVPckZyTnZpK2xYMnYzYUZoSFZDUEN4N1RlMDVxClhPa2JzZnZkZG5iZFQ2RjgyMnJleVByRXNINk9TUnBWSzBmeDVaMDQwVnRFUDJCWm04eTYyNG1QZk1vbDdya2MKcm9Kd09rOEVpUHZZekpsZUd0bTAwUm1sRysyL2c0aWJsOTVmQXpyc1MvcGUyS3ZoN2NBVEtIcVh6MjlpUmZpbApiTGhBamQwcEVSMjNYU0hHR1ZqRmF3amNJK1c2L2RtbDZURDhrSzFGaUtldmJKTlREeVNXQnpPbXRTYUp1K01JCm9iUnVWWG4yZVNoamVGM1BYcHZRMWRhNXdBa0dJQWxOWjRHTG5QU2ZwVmJyU0plU3RrTGNzdEJheVlJS3BWZVgKSVVTTHM0RUNnWUVBMmNnZUE2WHh0TXdFNU5QWlNWdGhzbXRiYi9YYmtsSTdrWHlsdk5zZjFPdXRYVzkybVJneQpHcEhUQ0VubDB0Z1p3T081T1FLNjdFT3JUdDBRWStxMDJzZndwcmgwNFZEVGZhcW5QNTBxa3BmZEJLQWpmanEyCjFoZDZMd2hLeDRxSm9aelp2VkowV0lvR1ZLcjhJSjJOWGRTUVlUanZUZHhGczRTamdqNFFiaEVDZ1lFQTFBWUUKSEo3eVlza2EvS2V2OVVYbmVrSTRvMm5aYjJ1UVZXazRXSHlaY2NRN3VMQVhGY3lJcW5SZnoxczVzN3RMTzJCagozTFZNUVBzazFNY25oTTl4WE4vQ3ZDTys5b2t0RnNaMGJqWFh6NEJ5V2lFNHJPS1lhVEFwcDVsWlpUT3ZVMWNyCm05R3NwMWJoVDVZb2RaZ3IwUHQyYzR4U2krUVlEWnNFb2lFdzNkc0NnWUVBcVJLYWNweWZKSXlMZEJjZ0JycGkKQTRFalVLMWZsSjR3enNjbGFKUDVoM1NjZUFCejQzRU1YT0kvSXAwMFJsY3N6em83N3cyMmpud09mOEJSM0RBMwp6ZTRSWDIydWw4b0hGdldvdUZOTTNOZjNaNExuYXpVc0F0UGhNS2hRWGMrcEFBWGthUDJkZzZ0TU5PazFxaUNHCndvU212a1BVVE84b1ViRTB1NFZ4ZmZFQ2dZQUpPdDNROVNadUlIMFpSSitIV095enlOQTRaUEkvUkhwN0RXS1QKajVFS2Y5VnR1OVMxY1RyOTJLVVhITXlOUTNrSjg2OUZPMnMvWk85OGg5THptQ2hDTjhkOWN6enI5SnJPNUFMTApqWEtBcVFIUlpLTFgrK0ZRcXZVVlE3cTlpaHQyMEZPb3E5OE5SZDMzSGYxUzZUWDNHZ3RWQ21YSml6dDAxQ3ZHCmR4VnVnd0tCZ0M2Mlp0b0RLb3JyT2hvdTBPelprK2YwQS9rNDJBOENiL29VMGpwSzZtdmxEWmNYdUF1QVZTVXIKNXJCZjRVYmdVYndqa1ZWSFR6LzdDb1BWSjUvVUxJWk1Db1RUNFprNTZXWDk4ZE93Q3VTVFpZYnlBbDZNS1BBZApTZEpuVVIraEpnSVFDVGJ4K1dzYnh2d0FkbWErWUhtaVlPRzZhSklXMXdSd1VGOURLUEhHCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== -``` - -2. In `kind: Secret` with `name: cattle-keys-server`, replace `` with the base64 encoded string of the CA Certificate file (usually called `ca.pem` or `ca.crt`). - - >**Note:** - > The base64 encoded string should be on the same line as `cacerts.pem`, without any newline at the beginning, in between or at the end. - - - **Result:** The file should look like the example below (the base64 encoded string should be different): - ```yaml - --- - apiVersion: v1 - kind: Secret - metadata: - name: cattle-keys-server - namespace: cattle-system - type: Opaque - data: - cacerts.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNvRENDQVlnQ0NRRHVVWjZuMEZWeU16QU5CZ2txaGtpRzl3MEJBUXNGQURBU01SQXdEZ1lEVlFRRERBZDAKWlhOMExXTmhNQjRYRFRFNE1EVXdOakl4TURRd09Wb1hEVEU0TURjd05USXhNRFF3T1Zvd0VqRVFNQTRHQTFVRQpBd3dIZEdWemRDMWpZVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFNQmpBS3dQCndhRUhwQTdaRW1iWWczaTNYNlppVmtGZFJGckJlTmFYTHFPL2R0RUdmWktqYUF0Wm45R1VsckQxZUlUS3UzVHgKOWlGVlV4Mmo1Z0tyWmpwWitCUnFiZ1BNbk5hS1hocmRTdDRtUUN0VFFZdGRYMVFZS0pUbWF5NU45N3FoNTZtWQprMllKRkpOWVhHWlJabkdMUXJQNk04VHZramF0ZnZOdmJ0WmtkY2orYlY3aWhXanp2d2theHRUVjZlUGxuM2p5CnJUeXBBTDliYnlVcHlad3E2MWQvb0Q4VUtwZ2lZM1dOWmN1YnNvSjhxWlRsTnN6UjVadEFJV0tjSE5ZbE93d2oKaG41RE1tSFpwZ0ZGNW14TU52akxPRUc0S0ZRU3laYlV2QzlZRUhLZTUxbGVxa1lmQmtBZWpPY002TnlWQUh1dApuay9DMHpXcGdENkIwbkVDQXdFQUFUQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFHTCtaNkRzK2R4WTZsU2VBClZHSkMvdzE1bHJ2ZXdia1YxN3hvcmlyNEMxVURJSXB6YXdCdFJRSGdSWXVtblVqOGo4T0hFWUFDUEthR3BTVUsKRDVuVWdzV0pMUUV0TDA2eTh6M3A0MDBrSlZFZW9xZlVnYjQrK1JLRVJrWmowWXR3NEN0WHhwOVMzVkd4NmNOQQozZVlqRnRQd2hoYWVEQmdma1hXQWtISXFDcEsrN3RYem9pRGpXbi8walI2VDcrSGlaNEZjZ1AzYnd3K3NjUDIyCjlDQVZ1ZFg4TWpEQ1hTcll0Y0ZINllBanlCSTJjbDhoSkJqa2E3aERpVC9DaFlEZlFFVFZDM3crQjBDYjF1NWcKdE03Z2NGcUw4OVdhMnp5UzdNdXk5bEthUDBvTXl1Ty82Tm1wNjNsVnRHeEZKSFh4WTN6M0lycGxlbTNZQThpTwpmbmlYZXc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - ``` - -### Option B—Bring Your Own Certificate: Signed by Recognized CA - ->**Note:** -> If you are using Self Signed Certificate, [click here](#option-a-self-signed-certificate) to proceed. - -If you are using a Certificate Signed By A Recognized Certificate Authority, you will need to generate a base64 encoded string for the Certificate file and the Certificate Key file. Make sure that your certificate file includes all the [intermediate certificates](#ssl-faq-troubleshooting) in the chain, the order of certificates in this case is first your own certificate, followed by the intermediates. Please refer to the documentation of your CSP (Certificate Service Provider) to see what intermediate certificate(s) need to be included. - -In the `kind: Secret` with `name: cattle-keys-ingress`: - -* Replace `` with the base64 encoded string of the Certificate file (usually called `cert.pem` or `domain.crt`) -* Replace `` with the base64 encoded string of the Certificate Key file (usually called `key.pem` or `domain.key`) - -After replacing the values, the file should look like the example below (the base64 encoded strings should be different): - ->**Note:** -> The base64 encoded string should be on the same line as `tls.crt` or `tls.key`, without any newline at the beginning, in between or at the end. - -```yaml ---- -apiVersion: v1 -kind: Secret -metadata: - name: cattle-keys-ingress - namespace: cattle-system -type: Opaque -data: - tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM1RENDQWN5Z0F3SUJBZ0lKQUlHc25NeG1LeGxLTUEwR0NTcUdTSWIzRFFFQkN3VUFNQkl4RURBT0JnTlYKQkFNTUIzUmxjM1F0WTJFd0hoY05NVGd3TlRBMk1qRXdOREE1V2hjTk1UZ3dOekExTWpFd05EQTVXakFXTVJRdwpFZ1lEVlFRRERBdG9ZUzV5Ym1Ob2NpNXViRENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DCmdnRUJBTFJlMXdzekZSb2Rib2pZV05DSHA3UkdJaUVIMENDZ1F2MmdMRXNkUUNKZlcrUFEvVjM0NnQ3bSs3TFEKZXJaV3ZZMWpuY2VuWU5JSGRBU0VnU0ducWExYnhUSU9FaE0zQXpib3B0WDhjSW1OSGZoQlZETGdiTEYzUk0xaQpPM1JLTGdIS2tYSTMxZndjbU9zWGUwaElYQnpUbmxnM20vUzlXL3NTc0l1dDVwNENDUWV3TWlpWFhuUElKb21lCmpkS3VjSHFnMTlzd0YvcGVUalZrcVpuMkJHazZRaWFpMU41bldRV0pjcThTenZxTTViZElDaWlwYU9hWWQ3RFEKYWRTejV5dlF0YkxQNW4wTXpnOU43S3pGcEpvUys5QWdkWDI5cmZqV2JSekp3RzM5R3dRemN6VWtLcnZEb05JaQo0UFJHc01yclFNVXFSYjRSajNQOEJodEMxWXNDQXdFQUFhTTVNRGN3Q1FZRFZSMFRCQUl3QURBTEJnTlZIUThFCkJBTUNCZUF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdJR0NDc0dBUVVGQndNQk1BMEdDU3FHU0liM0RRRUIKQ3dVQUE0SUJBUUNKZm5PWlFLWkowTFliOGNWUW5Vdi9NZkRZVEJIQ0pZcGM4MmgzUGlXWElMQk1jWDhQRC93MgpoOUExNkE4NGNxODJuQXEvaFZYYy9JNG9yaFY5WW9jSEg5UlcvbGthTUQ2VEJVR0Q1U1k4S292MHpHQ1ROaDZ6Ci9wZTNqTC9uU0pYSjRtQm51czJheHFtWnIvM3hhaWpYZG9kMmd3eGVhTklvRjNLbHB2aGU3ZjRBNmpsQTM0MmkKVVlCZ09iN1F5KytRZWd4U1diSmdoSzg1MmUvUUhnU2FVSkN6NW1sNGc1WndnNnBTUXhySUhCNkcvREc4dElSYwprZDMxSk1qY25Fb1Rhc1Jyc1NwVmNGdXZyQXlXN2liakZyYzhienBNcE1obDVwYUZRcEZzMnIwaXpZekhwakFsCk5ZR2I2OHJHcjBwQkp3YU5DS2ErbCtLRTk4M3A3NDYwCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K - tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBdEY3WEN6TVZHaDF1aU5oWTBJZW50RVlpSVFmUUlLQkMvYUFzU3gxQUlsOWI0OUQ5ClhmanEzdWI3c3RCNnRsYTlqV09keDZkZzBnZDBCSVNCSWFlcHJWdkZNZzRTRXpjRE51aW0xZnh3aVkwZCtFRlUKTXVCc3NYZEV6V0k3ZEVvdUFjcVJjamZWL0J5WTZ4ZDdTRWhjSE5PZVdEZWI5TDFiK3hLd2k2M21uZ0lKQjdBeQpLSmRlYzhnbWlaNk4wcTV3ZXFEWDJ6QVgrbDVPTldTcG1mWUVhVHBDSnFMVTNtZFpCWWx5cnhMTytvemx0MGdLCktLbG81cGgzc05CcDFMUG5LOUMxc3MvbWZRek9EMDNzck1Xa21oTDcwQ0IxZmIydCtOWnRITW5BYmYwYkJETnoKTlNRcXU4T2cwaUxnOUVhd3l1dEF4U3BGdmhHUGMvd0dHMExWaXdJREFRQUJBb0lCQUJKYUErOHp4MVhjNEw0egpwUFd5bDdHVDRTMFRLbTNuWUdtRnZudjJBZXg5WDFBU2wzVFVPckZyTnZpK2xYMnYzYUZoSFZDUEN4N1RlMDVxClhPa2JzZnZkZG5iZFQ2RjgyMnJleVByRXNINk9TUnBWSzBmeDVaMDQwVnRFUDJCWm04eTYyNG1QZk1vbDdya2MKcm9Kd09rOEVpUHZZekpsZUd0bTAwUm1sRysyL2c0aWJsOTVmQXpyc1MvcGUyS3ZoN2NBVEtIcVh6MjlpUmZpbApiTGhBamQwcEVSMjNYU0hHR1ZqRmF3amNJK1c2L2RtbDZURDhrSzFGaUtldmJKTlREeVNXQnpPbXRTYUp1K01JCm9iUnVWWG4yZVNoamVGM1BYcHZRMWRhNXdBa0dJQWxOWjRHTG5QU2ZwVmJyU0plU3RrTGNzdEJheVlJS3BWZVgKSVVTTHM0RUNnWUVBMmNnZUE2WHh0TXdFNU5QWlNWdGhzbXRiYi9YYmtsSTdrWHlsdk5zZjFPdXRYVzkybVJneQpHcEhUQ0VubDB0Z1p3T081T1FLNjdFT3JUdDBRWStxMDJzZndwcmgwNFZEVGZhcW5QNTBxa3BmZEJLQWpmanEyCjFoZDZMd2hLeDRxSm9aelp2VkowV0lvR1ZLcjhJSjJOWGRTUVlUanZUZHhGczRTamdqNFFiaEVDZ1lFQTFBWUUKSEo3eVlza2EvS2V2OVVYbmVrSTRvMm5aYjJ1UVZXazRXSHlaY2NRN3VMQVhGY3lJcW5SZnoxczVzN3RMTzJCagozTFZNUVBzazFNY25oTTl4WE4vQ3ZDTys5b2t0RnNaMGJqWFh6NEJ5V2lFNHJPS1lhVEFwcDVsWlpUT3ZVMWNyCm05R3NwMWJoVDVZb2RaZ3IwUHQyYzR4U2krUVlEWnNFb2lFdzNkc0NnWUVBcVJLYWNweWZKSXlMZEJjZ0JycGkKQTRFalVLMWZsSjR3enNjbGFKUDVoM1NjZUFCejQzRU1YT0kvSXAwMFJsY3N6em83N3cyMmpud09mOEJSM0RBMwp6ZTRSWDIydWw4b0hGdldvdUZOTTNOZjNaNExuYXpVc0F0UGhNS2hRWGMrcEFBWGthUDJkZzZ0TU5PazFxaUNHCndvU212a1BVVE84b1ViRTB1NFZ4ZmZFQ2dZQUpPdDNROVNadUlIMFpSSitIV095enlOQTRaUEkvUkhwN0RXS1QKajVFS2Y5VnR1OVMxY1RyOTJLVVhITXlOUTNrSjg2OUZPMnMvWk85OGg5THptQ2hDTjhkOWN6enI5SnJPNUFMTApqWEtBcVFIUlpLTFgrK0ZRcXZVVlE3cTlpaHQyMEZPb3E5OE5SZDMzSGYxUzZUWDNHZ3RWQ21YSml6dDAxQ3ZHCmR4VnVnd0tCZ0M2Mlp0b0RLb3JyT2hvdTBPelprK2YwQS9rNDJBOENiL29VMGpwSzZtdmxEWmNYdUF1QVZTVXIKNXJCZjRVYmdVYndqa1ZWSFR6LzdDb1BWSjUvVUxJWk1Db1RUNFprNTZXWDk4ZE93Q3VTVFpZYnlBbDZNS1BBZApTZEpuVVIraEpnSVFDVGJ4K1dzYnh2d0FkbWErWUhtaVlPRzZhSklXMXdSd1VGOURLUEhHCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== -``` - -## 8. Configure FQDN - -There are two references to `` in the config file (one in this step and one in the next). Both need to be replaced with the FQDN chosen in [Configure DNS](#3-configure-dns). - -In the `kind: Ingress` with `name: cattle-ingress-http`: - -* Replace `` with the FQDN chosen in [Configure DNS](#3-configure-dns). - -After replacing `` with the FQDN chosen in [Configure DNS](#3-configure-dns), the file should look like the example below (`rancher.yourdomain.com` is the FQDN used in this example): - -```yaml - --- - apiVersion: extensions/v1beta1 - kind: Ingress - metadata: - namespace: cattle-system - name: cattle-ingress-http - annotations: - nginx.ingress.kubernetes.io/proxy-connect-timeout: "30" - nginx.ingress.kubernetes.io/proxy-read-timeout: "1800" # Max time in seconds for ws to remain shell window open - nginx.ingress.kubernetes.io/proxy-send-timeout: "1800" # Max time in seconds for ws to remain shell window open - spec: - rules: - - host: rancher.yourdomain.com - http: - paths: - - backend: - serviceName: cattle-service - servicePort: 80 - tls: - - secretName: cattle-keys-ingress - hosts: - - rancher.yourdomain.com -``` - -Save the `.yml` file and close it. - -## 9. Back Up Your RKE Config File - -After you close your `.yml` file, back it up to a secure location. You can use this file again when it's time to upgrade Rancher. - -## 10. Run RKE - -With all configuration in place, use RKE to launch Rancher. You can complete this action by running the `rke up` command and using the `--config` parameter to point toward your config file. - -1. From your workstation, make sure `rancher-cluster.yml` and the downloaded `rke` binary are in the same directory. - -2. Open a Terminal instance. Change to the directory that contains your config file and `rke`. - -3. Enter one of the `rke up` commands listen below. - -``` -# MacOS -./rke_darwin-amd64 up --config rancher-cluster.yml -# Linux -./rke_linux-amd64 up --config rancher-cluster.yml -``` - -**Step Result:** The output should be similar to the snippet below: - -``` -INFO[0000] Building Kubernetes cluster -INFO[0000] [dialer] Setup tunnel for host [1.1.1.1] -INFO[0000] [network] Deploying port listener containers -INFO[0000] [network] Pulling image [alpine:latest] on host [1.1.1.1] -... -INFO[0101] Finished building Kubernetes cluster successfully -``` - -## 11. Back Up Auto-Generated Config File - -During installation, RKE automatically generates a config file named `kube_config_rancher-cluster.yml` in the same directory as the RKE binary. Copy this file and back it up to a safe location. You'll use this file later when upgrading Rancher Server. - -## What's Next? - -You have a couple of options: - -- Create a backup of your Rancher Server in case of a disaster scenario: [High Availablility Back Up and Restoration]({{< baseurl >}}/rancher/v2.x/en/installation/backups-and-restoration/ha-backup-and-restoration). -- Create a Kubernetes cluster: [Creating a Cluster]({{ }}/rancher/v2.x/en/tasks/clusters/creating-a-cluster/). - -
- -## FAQ and Troubleshooting - -{{< ssl_faq_ha >}} +1. [Create Nodes and Load Balancer]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/create-nodes-and-load-balancer/) +1. [Install Kubernetes with RKE]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rke/) +1. [Initialize Helm (tiller)]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/helm/) +1. [Install Rancher]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rancher/) diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/create-nodes-and-load-balancer/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/create-nodes-and-load-balancer/_index.md similarity index 83% rename from content/rancher/v2.x/en/installation/ha-server-install2/create-nodes-and-load-balancer/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install/create-nodes-and-load-balancer/_index.md index 64ed0149c17..6a91f5e2546 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install2/create-nodes-and-load-balancer/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install/create-nodes-and-load-balancer/_index.md @@ -5,7 +5,9 @@ weight: 276 Use your provider of choice to provision 3 nodes and a Load Balancer endpoint for your RKE install. -You will need to provide SSH credentials and DNS/IP address for your nodes to RKE. +> Note: These nodes must be in the same region/datacenter. You may place these servers in separate availability zones. + +Collect the SSH credentials and DNS or IP addresses for your nodes to provide to RKE in the next step. ### Host Requirements @@ -58,8 +60,8 @@ Configure a load balancer as a basic Layer 4 tcp forwarder. The exact configurat #### Examples -* [Amazon NLB]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/create-nodes-and-load-balancer/nlb) +* [Amazon NLB](nlb/)
-### [Next: Install Kubernetes with RKE]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rke/) \ No newline at end of file +### [Next: Install Kubernetes with RKE](../rke/) \ No newline at end of file diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/create-nodes-and-load-balancer/nlb/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/create-nodes-and-load-balancer/nlb/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-server-install2/create-nodes-and-load-balancer/nlb/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install/create-nodes-and-load-balancer/nlb/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/helm/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/helm/_index.md similarity index 96% rename from content/rancher/v2.x/en/installation/ha-server-install2/helm/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install/helm/_index.md index 0454959b08e..73cd9a93660 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install2/helm/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install/helm/_index.md @@ -65,4 +65,4 @@ helm init --service-account tiller > NOTE: This `tiller` install has full cluster access, which should be acceptable if the cluster is dedicated to Rancher server. Check out the [helm docs](https://docs.helm.sh/using_helm/#role-based-access-control) for restricting `tiller` access to suit your security requirements. -### [Next: Install Rancher]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rancher/) \ No newline at end of file +### [Next: Install Rancher](../rancher/) \ No newline at end of file diff --git a/content/rancher/v2.x/en/installation/ha-server-install/nlb/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/nlb/_index.md deleted file mode 100644 index bbdb1813d81..00000000000 --- a/content/rancher/v2.x/en/installation/ha-server-install/nlb/_index.md +++ /dev/null @@ -1,172 +0,0 @@ ---- -title: Amazon NLB configuration -weight: 277 ---- -## Objectives - -Configuring an Amazon NLB is a multistage process. We've broken it down into multiple tasks so that it's easy to follow. - -1. [Create Target Groups](#create-target-groups) - - Begin by creating two target groups for the **TCP** protocol, one regarding TCP port 443 and one regarding TCP port 80 (providing redirect to TCP port 443). You'll add your Linux nodes to these groups. - -2. [Register Targets](#register-targets) - - Add your Linux nodes to the target groups. - -3. [Create Your NLB](#create-your-nlb) - - Use Amazon's Wizard to create an Network Load Balancer. As part of this process, you'll add the target groups you created in **1. Create Target Groups**. - - -## Create Target Groups - -Your first NLB configuration step is to create two target groups. Technically, only port 443 is needed to access Rancher, but its convenient to add a listener for port 80 which will be redirected to port 443 automatically. The NGINX controller on the nodes will make sure that port 80 gets redirected to port 443. - -Log into the [Amazon AWS Console](https://console.aws.amazon.com/ec2/) to get started, make sure to select the **Region** where your EC2 instances (Linux nodes) are created. - -The Target Groups configuration resides in the **Load Balancing** section of the **EC2** service. Select **Services** and choose **EC2**, find the section **Load Balancing** and open **Target Groups**. - -![EC2 Load Balancing section]({{< baseurl >}}/img/rancher/ha/nlb/ec2-loadbalancing.png) - -Click **Create target group** to create the first target group, regarding TCP port 443. - -### Target Group (TCP port 443) - -Configure the first target group according to the table below. Screenshots of the configuration are shown just below the table. - -Option | Setting ---------------------------------------|------------------------------------ -Target Group Name | `rancher-tcp-443` -Protocol | `TCP` -Port | `443` -Target type | `instance` -VPC | Choose your VPC -Protocol
(Health Check) | `HTTP` -Path
(Health Check) | `/healthz` -Port (Advanced health check) | `override`,`80` -Healthy threshold (Advanced health) | `3` -Unhealthy threshold (Advanced) | `3` -Timeout (Advanced) | `6 seconds` -Interval (Advanced) | `10 second` -Success codes | `200-399` - -
-**Screenshot Target group TCP port 443 settings**
-![Target group 443]({{< baseurl >}}/img/rancher/ha/nlb/create-targetgroup-443.png) - -
-**Screenshot Target group TCP port 443 Advanced settings**
-![Target group 443 Advanced]({{< baseurl >}}/img/rancher/ha/nlb/create-targetgroup-443-advanced.png) - -
- -Click **Create target group** to create the second target group, regarding TCP port 80. - -### Target Group (TCP port 80) - -Configure the second target group according to the table below. Screenshots of the configuration are shown just below the table. - -Option | Setting ---------------------------------------|------------------------------------ -Target Group Name | `rancher-tcp-80` -Protocol | `TCP` -Port | `80` -Target type | `instance` -VPC | Choose your VPC -Protocol
(Health Check) | `HTTP` -Path
(Health Check) | `/healthz` -Port (Advanced health check) | `traffic port` -Healthy threshold (Advanced health) | `3` -Unhealthy threshold (Advanced) | `3` -Timeout (Advanced) | `6 seconds` -Interval (Advanced) | `10 second` -Success codes | `200-399` - -
-**Screenshot Target group TCP port 80 settings**
-![Target group 80]({{< baseurl >}}/img/rancher/ha/nlb/create-targetgroup-80.png) - -
-**Screenshot Target group TCP port 80 Advanced settings**
-![Target group 80 Advanced]({{< baseurl >}}/img/rancher/ha/nlb/create-targetgroup-80-advanced.png) - -
- -## Register Targets - -Next, add your Linux nodes to both target groups. - -Select the target group named **rancher-tcp-443**, click the tab **Targets** and choose **Edit**. - -![Edit target group 443]({{< baseurl >}}/img/rancher/ha/nlb/edit-targetgroup-443.png) - -Select the instances (Linux nodes) you want to add, and click **Add to registered**. - -
-**Screenshot Add targets to target group TCP port 443**
- -![Add targets to target group 443]({{< baseurl >}}/img/rancher/ha/nlb/add-targets-targetgroup-443.png) - -
-**Screenshot Added targets to target group TCP port 443**
- -![Added targets to target group 443]({{< baseurl >}}/img/rancher/ha/nlb/added-targets-targetgroup-443.png) - -When the instances are added, click **Save** on the bottom right of the screen. - -Repeat those steps, replacing **rancher-tcp-443** with **rancher-tcp-80**. The same instances need to be added as targets to this target group. - -## Create Your NLB - -Use Amazon's Wizard to create an Network Load Balancer. As part of this process, you'll add the target groups you created in [Create Target Groups](#create-target-groups). - -1. From your web browser, navigate to the [Amazon EC2 Console](https://console.aws.amazon.com/ec2/). - -2. From the navigation pane, choose **LOAD BALANCING** > **Load Balancers**. - -3. Click **Create Load Balancer**. - -4. Choose **Network Load Balancer** and click **Create**. - -5. Complete the **Step 1: Configure Load Balancer** form. - - **Basic Configuration** - - - Name: `rancher` - - Scheme: `internet-facing` - - **Listeners** - - Add the **Load Balancer Protocols** and **Load Balancer Ports** below. - - `TCP`: `443` - - - **Availability Zones** - - - Select Your **VPC** and **Availability Zones**. - -6. Complete the **Step 2: Configure Routing** form. - - - From the **Target Group** drop-down, choose **Existing target group**. - - - From the **Name** drop-down, choose `rancher-tcp-443`. - - - Open **Advanced health check settings**, and configure **Interval** to `10 seconds`. - -7. Complete **Step 3: Register Targets**. Since you registered your targets earlier, all you have to do is click **Next: Review**. - -8. Complete **Step 4: Review**. Look over the load balancer details and click **Create** when you're satisfied. - -9. After AWS creates the NLB, click **Close**. - -## Add listener to NLB for TCP port 80 - -1. Select your newly created NLB and select the **Listeners** tab. - -2. Click **Add listener**. - -3. Use `TCP`:`80` as **Protocol** : **Port** - -4. Click **Add action** and choose **Forward to...** - -5. From the **Forward to** drop-down, choose `rancher-tcp-80`. - -6. Click **Save** in the top right of the screen. diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/rancher/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/rancher/_index.md similarity index 82% rename from content/rancher/v2.x/en/installation/ha-server-install2/rancher/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install/rancher/_index.md index eedbc5d9d18..779f7253ec0 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install2/rancher/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install/rancher/_index.md @@ -78,18 +78,18 @@ helm install rancher-stable/rancher --name rancher --namespace cattle-system \ --set ingress.tls.source=secret ``` -Now that Rancher is running, see [Adding TLS Secrets]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rancher/tls-secrets) to publish the certificate files so Rancher and the Ingress Controller can use them. +Now that Rancher is running, see [Adding TLS Secrets](tls-secrets/) to publish the certificate files so Rancher and the Ingress Controller can use them. ### Advanced Configurations The Rancher chart configuration has many options for customizing the install to suit your specific environment. Here are some common advanced scenarios. -* [Private Docker Image Registry/Air Gap Network]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rancher/chart-options/#Private-or-Air-Gap-Registry) +* [Private Docker Image Registry/Air Gap Network](chart-options/#private-or-air-gap-registry) -See the [Chart Options]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rancher/chart-options) for the full list of options. +See the [Chart Options](chart-options/) for the full list of options. ### Finishing Up That's it you should have a functional Rancher server. Point a browser at the hostname you picked and you should be greeted by the colorful login page. -Doesn't Work? Take a look at the [Troubleshooting]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rancher/troubleshooting) Page +Doesn't Work? Take a look at the [Troubleshooting](troubleshooting/) Page diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/rancher/chart-options/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/rancher/chart-options/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-server-install2/rancher/chart-options/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install/rancher/chart-options/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/rancher/tls-secrets/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/rancher/tls-secrets/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-server-install2/rancher/tls-secrets/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install/rancher/tls-secrets/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/rancher/troubleshooting/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/rancher/troubleshooting/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-server-install2/rancher/troubleshooting/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install/rancher/troubleshooting/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/rke/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/rke/_index.md similarity index 96% rename from content/rancher/v2.x/en/installation/ha-server-install2/rke/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install/rke/_index.md index 754fd20c72d..f0b529c112a 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install2/rke/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install/rke/_index.md @@ -73,4 +73,4 @@ NAME STATUS ROLES AGE VER 165.227.127.226 Ready controlplane,etcd,worker 11m v1.10.1 ``` -### [Next: Initialize Helm]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/helm/) \ No newline at end of file +### [Next: Initialize Helm](../helm/) \ No newline at end of file diff --git a/content/rancher/v2.x/en/installation/troubleshooting-ha/ssh-tunneling/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/rke/troubleshooting/_index.md similarity index 73% rename from content/rancher/v2.x/en/installation/troubleshooting-ha/ssh-tunneling/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install/rke/troubleshooting/_index.md index ee6573f52ed..3e354320768 100644 --- a/content/rancher/v2.x/en/installation/troubleshooting-ha/ssh-tunneling/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install/rke/troubleshooting/_index.md @@ -1,11 +1,11 @@ --- -title: Failed to set up SSH tunneling for host -weight: 10 +title: Troubleshooting +weight: 276 --- -### Failed to set up SSH tunneling for host [xxx.xxx.xxx.xxx]: Can't retrieve Docker Info +#### Failed to set up SSH tunneling for host [xxx.xxx.xxx.xxx]: Can't retrieve Docker Info -#### Failed to dial to /var/run/docker.sock: ssh: rejected: administratively prohibited (open failed) +##### Failed to dial to /var/run/docker.sock: ssh: rejected: administratively prohibited (open failed) * User specified to connect with does not have permission to access the Docker socket. This can be checked by logging into the host and running the command `docker ps`: @@ -25,18 +25,18 @@ $ nc xxx.xxx.xxx.xxx 22 SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.10 ``` -#### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: Error configuring SSH: ssh: no key found +##### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: Error configuring SSH: ssh: no key found * The key file specified as `ssh_key_path` cannot be accessed. Make sure that you specified the private key file (not the public key, `.pub`), and that the user that is running the `rke` command can access the private key file. -#### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain +##### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain * The key file specified as `ssh_key_path` is not correct for accesing the node. Double-check if you specified the correct `ssh_key_path` for the node and if you specified the correct user to connect with. -#### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: Error configuring SSH: ssh: cannot decode encrypted private keys +##### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: Error configuring SSH: ssh: cannot decode encrypted private keys * If you want to use encrypted private keys, you should use `ssh-agent` to load your keys with your passphrase. If the `SSH_AUTH_SOCK` environment variable is found in the environment where the `rke` command is run, it will be used automatically to connect to the node. -#### Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running? +##### Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running? * The node is not reachable on the configured `address` and `port`. diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/_index.md b/content/rancher/v2.x/en/installation/ha-server-install2/_index.md deleted file mode 100644 index 02eebf2a986..00000000000 --- a/content/rancher/v2.x/en/installation/ha-server-install2/_index.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -title: High Availability Installation -weight: 275 -draft: true ---- - -When installed as a Deployment in a Kubernetes cluster, Rancher will take integrate with the cluster's etcd database and Kubernetes scheduling for High-Availability. - -This procedure walks you through setting up a 3-node cluster with RKE and installing the Rancher chart the Helm package manager. - -> NOTE: For the best performance, we recommend this Kubernetes cluster be dedicated only the Rancher workload. - -## Recommended Architecture - -* DNS for Rancher should resolve to a Layer 4 Load Balancer -* The Load Balancer should forward ports 80 and 443 TCP to all 3 nodes in the Kubernetes cluster. -* The ingress controller will redirect http port 80 to https and terminate SSL/TLS on port 443. -* The ingress controller will forward traffic to port 80 on the Pod in the Rancher Deployment. - -![Rancher HA]({{< baseurl >}}/img/rancher/ha/rancher2ha.svg) - -## Required Tools - -The following CLI tools are required for this install. Please make sure these tools installed and available in your `$PATH` - -* [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl) - Kubernetes command-line tool. -* [rke]({{< baseurl >}}/rke/v0.1.x/en/installation/) - Rancher Kubernetes Engine, cli for building Kubernetes clusters. -* [helm](https://docs.helm.sh/using_helm/#installing-helm) - Package management for Kubernetes. - -## Installation Outline - -1. [Create Nodes and Load Balancer]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/create-nodes-and-load-balancer/) -1. [Install Kubernetes with RKE]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rke/) -1. [Initialize Helm (tiller)]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/helm/) -1. [Install Rancher]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rancher/) diff --git a/content/rancher/v2.x/en/installation/troubleshooting-ha/404-default-backend/_index.md b/content/rancher/v2.x/en/installation/troubleshooting-ha/404-default-backend/_index.md deleted file mode 100644 index 81140055fae..00000000000 --- a/content/rancher/v2.x/en/installation/troubleshooting-ha/404-default-backend/_index.md +++ /dev/null @@ -1,40 +0,0 @@ ---- -title: 404 - default backend -weight: 30 ---- - -To debug issues around this error, you will need to download the command-line tool `kubectl`. See [Install and Set Up kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) how to download `kubectl` for your platform. - -When you have made changes to `rancher-cluster.yml`, you will have to run `rke remove --config rancher-cluster.yml` to clean the nodes, so it cannot conflict with previous configuration errors. - -### Possible causes - -The nginx ingress controller is not able to serve the configured host in `rancher-cluster.yml`. This should be the FQDN you configured to access Rancher. You can check if it is properly configured by viewing the ingress that is created by running the following command: - -``` -kubectl --kubeconfig kube_config_rancher-cluster.yml get ingress -n cattle-system -o wide -``` - -Check if the `HOSTS` column is displaying the FQDN you configured in the template, and that the used nodes are listed in the `ADDRESS` column. If that is configured correctly, we can check the logging of the nginx ingress controller. - -The logging of the nginx ingress controller will show why it cannot serve the requested host. To view the logs, you can run the following command - -``` -kubectl --kubeconfig kube_config_rancher-cluster.yml logs -l app=ingress-nginx -n ingress-nginx -``` - -Errors - -* `x509: certificate is valid for fqdn, not your_configured_fqdn` - -The used certificates do not contain the correct hostname. Generate new certificates that contain the chosen FQDN to access Rancher and redeploy. - -* `Port 80 is already in use. Please check the flag --http-port` - -There is a process on the node occupying port 80, this port is needed for the nginx ingress controller to route requests to Rancher. You can find the process by running the command: `netstat -plant | grep \:80`. - -Stop/kill the process and redeploy. - -* `unexpected error creating pem file: no valid PEM formatted block found` - -The base64 encoded string configured in the template is not valid. Please check if you can decode the configured string using `base64 -D STRING`, this should return the same output as the content of the file you used to generate the string. If this is correct, please check if the base64 encoded string is placed directly after the key, without any newlines before, in between or after. (For example: `tls.crt: LS01..`) diff --git a/content/rancher/v2.x/en/installation/troubleshooting-ha/_index.md b/content/rancher/v2.x/en/installation/troubleshooting-ha/_index.md deleted file mode 100644 index 00ce37f6927..00000000000 --- a/content/rancher/v2.x/en/installation/troubleshooting-ha/_index.md +++ /dev/null @@ -1,24 +0,0 @@ ---- -title: Troubleshooting High Availability Installation -weight: 370 ---- -This section contains common errors seen when setting up a High Availability Installation. - -Choose from the following options: - -- [Generic troubleshooting]({{< baseurl >}}/rancher/v2.x/en/installation/troubleshooting-ha/generic-troubleshooting) - - In this section, you can find generic ways to debug your Kubernetes cluster. - -- [Failed to set up SSH tunneling for host]({{< baseurl >}}/rancher/v2.x/en/installation/troubleshooting-ha/ssh-tunneling) - - In this section, you can find errors related to SSH tunneling when you run the `rke` command to setup your nodes. - -- [Failed to get job complete status]({{< baseurl >}}/rancher/v2.x/en/installation/troubleshooting-ha/job-complete-status) - - In this section, you can find errors related to deploying addons. - -- [404 - default backend]({{< baseurl >}}/rancher/v2.x/en/installation/troubleshooting-ha/404-default-backend) - - In this section, you can find errors related to the `404 - default backend` page that is shown when trying to access Rancher. - diff --git a/content/rancher/v2.x/en/installation/troubleshooting-ha/generic-troubleshooting/_index.md b/content/rancher/v2.x/en/installation/troubleshooting-ha/generic-troubleshooting/_index.md deleted file mode 100644 index d1b696dfe42..00000000000 --- a/content/rancher/v2.x/en/installation/troubleshooting-ha/generic-troubleshooting/_index.md +++ /dev/null @@ -1,145 +0,0 @@ ---- -title: Generic troubleshooting -weight: 5 ---- - -Below are steps that you can follow to determine what is wrong in your cluster. - -* Double check if all the required ports are opened in your (host) firewall - -Double check if all the [required ports]({{< baseurl >}}/rancher/v2.x/en/installation/references/) are opened in your (host) firewall. - -* All nodes should be present and in **Ready** state - -To check, run the command: - -``` -kubectl --kubeconfig kube_config_rancher-cluster.yml get nodes -``` - -If a node is not shown in this output or a node is not in **Ready** state, you can check the logging of the `kubelet` container. Login to the node and run `docker logs kubelet`. - -* All pods/jobs should be in **Running**/**Completed** state - -To check, run the command: - -``` -kubectl --kubeconfig kube_config_rancher-cluster.yml get pods --all-namespaces -``` - -If a pod is not in **Running** state, you can dig into the root cause by running: - -

Describe pod

- -``` -kubectl --kubeconfig kube_config_rancher-cluster.yml describe pod POD_NAME -n NAMESPACE -``` - -

Pod container logs

- -``` -kubectl --kubeconfig kube_config_rancher-cluster.yml logs POD_NAME -n NAMESPACE -``` - -If a job is not in **Completed** state, you can dig into the root cause by running: - -

Describe job

- -``` -kubectl --kubeconfig kube_config_rancher-cluster.yml describe job JOB_NAME -n NAMESPACE -``` - -

Logs from the containers of pods of the job

- -``` -kubectl --kubeconfig kube_config_rancher-cluster.yml logs -l job-name=JOB_NAME -n NAMESPACE -``` - -* List all Kubernetes cluster events - -Kubernetes cluster events are stored, and can be retrieved by running: - -``` -kubectl --kubeconfig kube_config_rancher-cluster.yml get events --all-namespaces -``` - -* Check Rancher container logging - -``` -kubectl --kubeconfig kube_config_rancher-cluster.yml logs -l app=cattle -n cattle-system -``` - -* Check NGINX ingress controller logging - -``` -kubectl --kubeconfig kube_config_rancher-cluster.yml logs -l app=ingress-nginx -n ingress-nginx -``` - -* Check if overlay network is functioning correctly - -The pod can be scheduled to any of the hosts you used for your cluster, but that means that the NGINX ingress controller needs to be able to route the request from `NODE_1` to `NODE_2`. This happens over the overlay network. If the overlay network is not functioning, you will experience intermittent TCP/HTTP connection failures due to the NGINX ingress controller not being able to route to the pod. - -To test the overlay network, you can launch the following `DaemonSet` definition. This will run an `alpine` container on every host, which we will use to run a `ping` test between containers on all hosts. - -1. Save the following file as `ds-alpine.yml` - - ``` - apiVersion: apps/v1 - kind: DaemonSet - metadata: - name: alpine - spec: - selector: - matchLabels: - name: alpine - template: - metadata: - labels: - name: alpine - spec: - tolerations: - - effect: NoExecute - key: "node-role.kubernetes.io/etcd" - value: "true" - - effect: NoSchedule - key: "node-role.kubernetes.io/controlplane" - value: "true" - containers: - - image: alpine - imagePullPolicy: Always - name: alpine - command: ["sh", "-c", "tail -f /dev/null"] - terminationMessagePath: /dev/termination-log - ``` - -2. Launch it using `kubectl --kubeconfig kube_config_rancher-cluster.yml create -f ds-alpine.yml` -3. Wait until `kubectl --kubeconfig kube_config_rancher-cluster.yml rollout status ds/alpine -w` returns: `daemon set "alpine" successfully rolled out`. -4. Run the following command to let each container on every host ping each other (it's a single line command). - - ``` - echo "=> Start"; kubectl --kubeconfig kube_config_rancher-cluster.yml get pods -l name=alpine -o jsonpath='{range .items[*]}{@.metadata.name}{" "}{@.spec.nodeName}{"\n"}{end}' | while read spod shost; do kubectl --kubeconfig kube_config_rancher-cluster.yml get pods -l name=alpine -o jsonpath='{range .items[*]}{@.status.podIP}{" "}{@.spec.nodeName}{"\n"}{end}' | while read tip thost; do kubectl --kubeconfig kube_config_rancher-cluster.yml --request-timeout='10s' exec $spod -- /bin/sh -c "ping -c2 $tip > /dev/null 2>&1"; RC=$?; if [ $RC -ne 0 ]; then echo $shost cannot reach $thost; fi; done; done; echo "=> End" - ``` - -5. When this command has finished running, the output indicating everything is correct is: - - ``` - => Start - => End - ``` - -If you see error in the output, that means that the [required ports]({{< baseurl >}}/rancher/v2.x/en/installation/references/) for overlay networking are not opened between the hosts indicated. - -Example error output of a situation where NODE1 had the UDP ports blocked. - -``` -=> Start -command terminated with exit code 1 -NODE2 cannot reach NODE1 -command terminated with exit code 1 -NODE3 cannot reach NODE1 -command terminated with exit code 1 -NODE1 cannot reach NODE2 -command terminated with exit code 1 -NODE1 cannot reach NODE3 -=> End -``` diff --git a/content/rancher/v2.x/en/installation/troubleshooting-ha/job-complete-status/_index.md b/content/rancher/v2.x/en/installation/troubleshooting-ha/job-complete-status/_index.md deleted file mode 100644 index 375a6387346..00000000000 --- a/content/rancher/v2.x/en/installation/troubleshooting-ha/job-complete-status/_index.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Failed to get job complete status -weight: 20 ---- - -To debug issues around this error, you will need to download the command-line tool `kubectl`. See [Install and Set Up kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) how to download `kubectl` for your platform. - -When you have made changes to `rancher-cluster.yml`, you will have to run `rke remove --config rancher-cluster.yml` to clean the nodes, so it cannot conflict with previous configuration errors. - -### Failed to deploy addon execute job [rke-user-includes-addons]: Failed to get job complete status - -Something is wrong in the addons definitions, you can run the following command to get the root cause in the logging of the job: - -``` -kubectl --kubeconfig kube_config_rancher-cluster.yml logs -l job-name=rke-user-addon-deploy-job -n kube-system -``` - -#### error: error converting YAML to JSON: yaml: line 9: - -The structure of the addons definition in `rancher-cluster.yml` is wrong. In the different resources specified in the addons section, there is a error in the structure of the YAML. The pointer `yaml line 9` references to the line number of the addon that is causing issues. - -Things to check -
    -
      -
    • Is each of the base64 encoded certificate string placed directly after the key, for example: `tls.crt: LS01...`, there should be no newline/space before, in between or after.
      • -
    • Is the YAML properly formatted, each indentation should be 2 spaces as shown in the template files.
      • -
    • Verify the integrity of your certificate by running this command `cat MyCertificate | base64 -d` on Linux, `cat MyCertificate | base64 -D` on Mac OS . If any error exists, the command output will tell you. -
    -
- -#### Error from server (BadRequest): error when creating "/etc/config/rke-user-addon.yaml": Secret in version "v1" cannot be handled as a Secret - -The base64 string of one of the certificate strings is wrong. The log message will try to show you what part of the string is not recognized as valid base64. - -Things to check -
    -
      -
    • Check if the base64 string is valid by running one of the commands below:
      • - -``` -# MacOS -echo BASE64_CRT | base64 -D -# Linux -echo BASE64_CRT | base64 -d -# Windows -certutil -decode FILENAME.base64 FILENAME.verify -``` - -
    -
- -#### The Ingress "cattle-ingress-http" is invalid: spec.rules[0].host: Invalid value: "IP": must be a DNS name, not an IP address - -The host value can only contain a host name, as it is needed by the ingress controller to match the hostname and pass to the correct backend. From 0456a27c5afa24e0bbb7502fd1dfe607083df087 Mon Sep 17 00:00:00 2001 From: Jason Greathouse Date: Fri, 6 Jul 2018 11:20:59 -0500 Subject: [PATCH 07/18] add troubleshooting page link to rke --- .../v2.x/en/installation/ha-server-install/rke/_index.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rke/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/rke/_index.md index f0b529c112a..44685291108 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install/rke/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install/rke/_index.md @@ -73,4 +73,6 @@ NAME STATUS ROLES AGE VER 165.227.127.226 Ready controlplane,etcd,worker 11m v1.10.1 ``` +Issues or errors? See the [Troubleshooting](troubleshooting/) page. + ### [Next: Initialize Helm](../helm/) \ No newline at end of file From c3b59721ac948a9b800af0f9e75fe71e50e0b555 Mon Sep 17 00:00:00 2001 From: Jason Greathouse Date: Mon, 16 Jul 2018 10:03:03 +1000 Subject: [PATCH 08/18] add back in rke based install, align to outline. --- .../rancher/v2.x/en/installation/_index.md | 16 +- .../installation/ha-server-install/_index.md | 8 +- .../create-nodes-and-load-balancer/_index.md | 6 +- .../{helm => helm-install}/_index.md | 4 +- .../{rke => install-kubernetes-rke}/_index.md | 26 +- .../troubleshooting/_index.md | 0 .../_index.md | 56 +++ .../{rancher => rancher-install}/_index.md | 3 +- .../chart-options/_index.md | 24 +- .../tls-secrets/_index.md | 0 .../troubleshooting/_index.md | 0 .../rke-all-in-one-install/_index.md | 10 + .../ha-server-install-external-lb/_index.md | 337 ++++++++++++++ .../alb/_index.md | 94 ++++ .../nginx/_index.md | 78 ++++ .../ha-server-install/_index.md | 435 ++++++++++++++++++ .../ha-server-install/nlb/_index.md | 172 +++++++ .../404-default-backend/_index.md | 40 ++ .../troubleshooting-ha/_index.md | 24 + .../generic-troubleshooting/_index.md | 145 ++++++ .../job-complete-status/_index.md | 54 +++ .../ssh-tunneling/_index.md | 42 ++ .../advanced-install-options/_index.md | 4 + .../air-gap-installation/_index.md | 0 .../proxy-configuration/_index.md | 0 .../single-node-install-external-lb/_index.md | 0 26 files changed, 1542 insertions(+), 36 deletions(-) rename content/rancher/v2.x/en/installation/ha-server-install/{helm => helm-install}/_index.md (97%) rename content/rancher/v2.x/en/installation/ha-server-install/{rke => install-kubernetes-rke}/_index.md (68%) rename content/rancher/v2.x/en/installation/ha-server-install/{rke => install-kubernetes-rke}/troubleshooting/_index.md (100%) create mode 100644 content/rancher/v2.x/en/installation/ha-server-install/migrating-from-rke-all-in-one-install/_index.md rename content/rancher/v2.x/en/installation/ha-server-install/{rancher => rancher-install}/_index.md (99%) rename content/rancher/v2.x/en/installation/ha-server-install/{rancher => rancher-install}/chart-options/_index.md (60%) rename content/rancher/v2.x/en/installation/ha-server-install/{rancher => rancher-install}/tls-secrets/_index.md (100%) rename content/rancher/v2.x/en/installation/ha-server-install/{rancher => rancher-install}/troubleshooting/_index.md (100%) create mode 100644 content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/_index.md create mode 100644 content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install-external-lb/_index.md create mode 100644 content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install-external-lb/alb/_index.md create mode 100644 content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install-external-lb/nginx/_index.md create mode 100644 content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install/_index.md create mode 100644 content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install/nlb/_index.md create mode 100644 content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/404-default-backend/_index.md create mode 100644 content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/_index.md create mode 100644 content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/generic-troubleshooting/_index.md create mode 100644 content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/job-complete-status/_index.md create mode 100644 content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/ssh-tunneling/_index.md create mode 100644 content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/_index.md rename content/rancher/v2.x/en/installation/{ => single-node-install/advanced-install-options}/air-gap-installation/_index.md (100%) rename content/rancher/v2.x/en/installation/{ => single-node-install/advanced-install-options}/proxy-configuration/_index.md (100%) rename content/rancher/v2.x/en/installation/{ => single-node-install/advanced-install-options}/single-node-install-external-lb/_index.md (100%) diff --git a/content/rancher/v2.x/en/installation/_index.md b/content/rancher/v2.x/en/installation/_index.md index 9b1b0950d68..bcb93810982 100644 --- a/content/rancher/v2.x/en/installation/_index.md +++ b/content/rancher/v2.x/en/installation/_index.md @@ -10,28 +10,16 @@ This section contains instructions for installing Rancher in development and pro Install Rancher on a single Linux host. -- [Single Node Installation with External Load Balancer](single-node-install-external-lb/) - - In this scenario, you install Rancher on a single Linux host and access it using an external load balancer/proxy. - - [High Availability Installation](ha-server-install/) This install scenario creates a new Kubernetes cluster dedicated to running Rancher Server in a high-availability (HA) configuration. -### Advanced Install Scenarios +### Reference -- [Air Gap Installation](air-gap-installation/) +- [Images required for Air Gap Installation](air-gap-images/) Required images and configuration to install Rancher Server in an environment without direct Internet access. -- [Rancher HTTP Proxy Configuration](proxy-configuration/) - - Rancher configuration to run behind a proxy. - - -### Reference - - [Port Requirements](references/) List of required ports you must open to operate Rancher. - diff --git a/content/rancher/v2.x/en/installation/ha-server-install/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/_index.md index 02eebf2a986..84e8627571a 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install/_index.md @@ -29,7 +29,7 @@ The following CLI tools are required for this install. Please make sure these to ## Installation Outline -1. [Create Nodes and Load Balancer]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/create-nodes-and-load-balancer/) -1. [Install Kubernetes with RKE]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rke/) -1. [Initialize Helm (tiller)]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/helm/) -1. [Install Rancher]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install2/rancher/) +1. [Create Nodes and Load Balancer](create-nodes-and-load-balancer/) +1. [Install Kubernetes with RKE](install-kubernetese-rke/) +1. [Initialize Helm (tiller)](helm-install/) +1. [Install Rancher](rancher-install/) diff --git a/content/rancher/v2.x/en/installation/ha-server-install/create-nodes-and-load-balancer/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/create-nodes-and-load-balancer/_index.md index 6a91f5e2546..6e0d227543e 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install/create-nodes-and-load-balancer/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install/create-nodes-and-load-balancer/_index.md @@ -1,6 +1,6 @@ --- title: 1 - Create Nodes and Load Balancer -weight: 276 +weight: 185 --- Use your provider of choice to provision 3 nodes and a Load Balancer endpoint for your RKE install. @@ -54,7 +54,7 @@ In addition to the ports listed above these ports must be open between nodes. ### Load Balancer -RKE will configure an Ingress-Controller pod, on each of your nodes. The ingress controller pods are bound to ports 80 and 443 tcp on the host network and are the entry point for https traffic to the Rancher server. +RKE will configure an ingress-controller pod, on each of your nodes. The ingress-controller pods are bound to ports 80 and 443 tcp on the host network and are the entry point for https traffic to the Rancher server. Configure a load balancer as a basic Layer 4 tcp forwarder. The exact configuration will vary depending on your environment. @@ -64,4 +64,4 @@ Configure a load balancer as a basic Layer 4 tcp forwarder. The exact configurat
-### [Next: Install Kubernetes with RKE](../rke/) \ No newline at end of file +### [Next: Install Kubernetes with RKE](../install-kubernetes-rke/) \ No newline at end of file diff --git a/content/rancher/v2.x/en/installation/ha-server-install/helm/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/helm-install/_index.md similarity index 97% rename from content/rancher/v2.x/en/installation/ha-server-install/helm/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install/helm-install/_index.md index 73cd9a93660..d806c58e947 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install/helm/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install/helm-install/_index.md @@ -1,6 +1,6 @@ --- title: 3 - Initialize Helm (Install tiller) -weight: 276 +weight: 195 --- `helm` is the package management tool of choice for Kubernetes. `helm` `charts` provide templating syntax for Kubernetes YAML manifest documents. With `helm` we can create configurable deployments instead of just using static files. For more information about creating your own catalog of deployments, check out the docs at [https://helm.sh/](https://helm.sh/) @@ -65,4 +65,4 @@ helm init --service-account tiller > NOTE: This `tiller` install has full cluster access, which should be acceptable if the cluster is dedicated to Rancher server. Check out the [helm docs](https://docs.helm.sh/using_helm/#role-based-access-control) for restricting `tiller` access to suit your security requirements. -### [Next: Install Rancher](../rancher/) \ No newline at end of file +### [Next: Install Rancher](../rancher-install/) \ No newline at end of file diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rke/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/install-kubernetes-rke/_index.md similarity index 68% rename from content/rancher/v2.x/en/installation/ha-server-install/rke/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install/install-kubernetes-rke/_index.md index 44685291108..33c3583ca29 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install/rke/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install/install-kubernetes-rke/_index.md @@ -1,13 +1,13 @@ --- title: 2 - Install Kubernetes with RKE -weight: 276 +weight: 190 --- -Configure the RKE `cluster.yml` and run `rke` to install Kubernetes with a HA `etcd` install. +Configure the RKE `rancher-cluster.yml` and run `rke` to install Kubernetes with a HA `etcd` install. -### Create a `cluster.yml` File +### Create a `rancher-cluster.yml` File -Using the sample below create a `cluster.yml` file. Replace the IP Addresses in the `nodes` list with the IP address or DNS names of the 3 Nodes you created. +Using the sample below create a `rancher-cluster.yml` file. Replace the IP Addresses in the `nodes` list with the IP address or DNS names of the 3 Nodes you created. ```yaml nodes: @@ -49,17 +49,17 @@ Please see the [RKE Documentation]({{< baseurl >}}/rke/v0.1.x/en/) for the full ### Run RKE ``` -rke up --config ./cluster.yaml +rke up --config ./rancher-cluster.yaml ``` ### Testing your cluster -`rke` should have created a file `kube_config_cluster.yml`. This file has the credentials for `kubectl` and `helm`. +`rke` should have created a file `kube_config_rancher-cluster.yml`. This file has the credentials for `kubectl` and `helm`. -You can copy this file to `$HOME/.kube/config` or if you are working with multiple Kubernetes clusters, set`KUBECONFIG` environmental variable to the path of `kube_config_cluster.yml`. +You can copy this file to `$HOME/.kube/config` or if you are working with multiple Kubernetes clusters, set`KUBECONFIG` environmental variable to the path of `kube_config_rancher-cluster.yml`. ``` -export KUBECONFIG=$(pwd)/kube_config_cluster.yml +export KUBECONFIG=$(pwd)/kube_config_rancher-cluster.yml ``` Test you connectivity with `kubectl` and see if you can get the list of nodes back. @@ -73,6 +73,12 @@ NAME STATUS ROLES AGE VER 165.227.127.226 Ready controlplane,etcd,worker 11m v1.10.1 ``` -Issues or errors? See the [Troubleshooting](troubleshooting/) page. +### Save your files -### [Next: Initialize Helm](../helm/) \ No newline at end of file +You will need to save a copy of the `kube_config_rancher-cluster.yml` and `rancher-cluster.yml` files. You will need these files to maintain and upgrade your Rancher instance. + +### Issues or errors? + +See the [Troubleshooting](troubleshooting/) page. + +### [Next: Initialize Helm](../helm-install/) \ No newline at end of file diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rke/troubleshooting/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/install-kubernetes-rke/troubleshooting/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-server-install/rke/troubleshooting/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install/install-kubernetes-rke/troubleshooting/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install/migrating-from-rke-all-in-one-install/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/migrating-from-rke-all-in-one-install/_index.md new file mode 100644 index 00000000000..f64b13048e6 --- /dev/null +++ b/content/rancher/v2.x/en/installation/ha-server-install/migrating-from-rke-all-in-one-install/_index.md @@ -0,0 +1,56 @@ +--- +title: Migrating from RKE All-In-One Install +weight: 235 +--- + +The following instructions will help guide you through migrating from the RKE All-In-One install to managing Rancher with the Helm package manager. + +You will need the to have [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl) installed and `kube_config_rancher-cluster.yml` credentials file generated by RKE. + +> NOTE: This guide assumes a standard Rancher install. If you have modified any of the object names or namespaces, please adjust accordingly. + +### Point kubectl at your Rancher Cluster + +Make sure `kubectl` is using the correct cluster. Export the `KUBECONFIG` environmental variable pointing at the `kube_config_rancher-cluster.yml` + +``` +export KUBECONFIG=$(pwd)/kube_config_rancher-cluster.yml +``` + +### Save your certificates + +If you have terminated ssl on the Rancher cluster ingress, recover your certificate and key for use in the Helm install. + +Use `kubectl` to get the secret, decode the value and direct the output to a file. + +``` +kubectl -n cattle-system get secret cattle-keys-ingress -o jsonpath --template='{ .data.tls\.crt }' | base64 -d > tls.crt +kubectl -n cattle-system get secret cattle-keys-ingress -o jsonpath --template='{ .data.tls\.key }' | base64 -d > tls.key +``` + +If you specified a private CA root cert + +``` +kubectl -n cattle-system get secret cattle-keys-server -o jsonpath --template='{ .data.cacerts\.pem }' | base64 -d > tls.crt +``` + +### Remove previous Kubernetes objects + +Remove the kubernetes objects created by the RKE install. + +> NOTE: Removing these Kubernetes components will not affect the Rancher configuration or database, but with any maintenance it is a good idea to create a backup of the data before hand. See [Creating Backups-HA Install]({{< baseurl >}}/rancher/v2.x/en/backups/ha-backups) for details. + +``` +kubectl -n cattle-system delete ingress cattle-ingress-http +kubectl -n cattle-system delete service cattle-service +kubectl -n cattle-system delete deployment cattle +kubectl -n cattle-system delete clusterrolebinding cattle-crb +kubectl -n cattle-system delete serviceaccount cattle-admin +``` + +### Follow Helm and Rancher install steps + +From here follow the standard install steps. + +* [3 - Initialize Helm (Install tiller)](../3-helm-install/) +* [4 - Install Rancher](../4-rancher-install/) diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rancher/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/rancher-install/_index.md similarity index 99% rename from content/rancher/v2.x/en/installation/ha-server-install/rancher/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install/rancher-install/_index.md index 779f7253ec0..2fae0a6fae5 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install/rancher/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install/rancher-install/_index.md @@ -1,11 +1,10 @@ --- title: 4 - Install Rancher -weight: 276 +weight: 200 --- Rancher installation is now managed using the Helm package manager for Kubernetes. Use `helm` to install the prerequisite and Rancher charts. - ### Add the Chart Repo Use `helm repo add` to add the Rancher chart repository. diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rancher/chart-options/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/rancher-install/chart-options/_index.md similarity index 60% rename from content/rancher/v2.x/en/installation/ha-server-install/rancher/chart-options/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install/rancher-install/chart-options/_index.md index 2ba073e5b1e..9c7fb301654 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install/rancher/chart-options/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install/rancher-install/chart-options/_index.md @@ -24,6 +24,7 @@ weight: 276 | `resources` | {} | `map` - rancher pod resource requests & limits | | `rancherImage` | "rancher/rancher" | `string` - rancher image source | | `rancherImageTag` | same as chart version | `string` - rancher/rancher image tag | +| `tls` | "ingress" | `string` - Where to terminate SSL. - "ingress, external"
@@ -50,4 +51,25 @@ Add the `rancherImage` to point to your private registry image and `imagePullSec ``` --set rancherImage=reg.example.com:5000/rancher/rancher \ --set imagePullSecrets[0].name=regcred -``` \ No newline at end of file +``` + +### External TLS Termination + +If you wish to terminate the SSL/TLS on a load-balancer external to the Rancher cluster (ingress), use the `--tls=external` option and point your load balancer at port http 80. + +> NOTE: If you are using a Private CA signed cert, add `--set privateCA=true` and see [Adding TLS Secrets - Private CA Signed - Additional Steps](../tls-secrets/#private-ca-signed---additional-steps) to add the CA cert for Rancher. + +Your load balancer must support long lived websocket connections and will need to insert proxy headers so Rancher can route links correctly. + +> NOTE: The `tls=external` option will expose the Rancher interface on http port 80. Clients that are allowed to connect directly to the Rancher cluster will not be encrypted. We recommend that you restrict direct access at the network level to just your load balancer. + +#### Required headers + +* `Host` +* `X-Forwarded-Proto` +* `X-Forwarded-Port` +* `X-Forwarded-For` + +#### Health checks + +Rancher will respond `200` to health checks on the `/healthz` endpoint. diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rancher/tls-secrets/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/rancher-install/tls-secrets/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-server-install/rancher/tls-secrets/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install/rancher-install/tls-secrets/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rancher/troubleshooting/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/rancher-install/troubleshooting/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-server-install/rancher/troubleshooting/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install/rancher-install/troubleshooting/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/_index.md new file mode 100644 index 00000000000..66a23807b73 --- /dev/null +++ b/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/_index.md @@ -0,0 +1,10 @@ +--- +title: RKE All-In-One Install +weight: 276 +--- + +Rancher can be installed by providing the appropriate Kubernetes manifest configurations to RKE's `addons` feature. See the following instructions for examples appropriate to your environment. + +* [High Availability Installation with External Load Balancer (TCP/Layer 4)](./ha-server-install/) +* [High Availability Installation with External Load Balancer (HTTPS/Layer 7)](./ha-server-install-external-lb) +* [Troubleshooting RKE All-In-One Installs](./troubleshooting-ha) diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install-external-lb/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install-external-lb/_index.md new file mode 100644 index 00000000000..868ce25ae97 --- /dev/null +++ b/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install-external-lb/_index.md @@ -0,0 +1,337 @@ +--- +title: High Availability Installation with External Load Balancer (HTTPS/Layer 7) +weight: 276 +--- +This set of instructions creates a new Kubernetes cluster that's dedicated to running Rancher in a high-availability (HA) configuration. This procedure walks you through setting up a 3-node cluster using the Rancher Kubernetes Engine (RKE). The cluster's sole purpose is running pods for Rancher. The setup is based on: + +- Layer 7 Loadbalancer with SSL termination (HTTPS) +- NGINX Ingress controller (HTTP) + +![Rancher HA]({{< baseurl >}}/img/rancher/ha/rancher2ha-l7.svg) + +## Installation Outline + +Installation of Rancher in a high-availability configuration involves multiple procedures. Review this outline to learn about each procedure you need to complete. + +1. [Provision Linux Hosts](#1-provision-linux-hosts) + + Provision three Linux hosts to serve as your Kubernetes cluster. + +2. [Configure Load Balancer](#2-configure-load-balancer) + + Configure your load balancer to have a highly available single point of entry to your Rancher cluster. + +3. [Configure DNS](#3-configure-dns) + + Make your setup accessible using a DNS name by configuring the DNS to point to your loadbalancer. + +4. [Download RKE](#4-download-rke) + + [RKE](https://github.com/rancher/rke/releases) is a fast, versatile Kubernetes installer that you can use to install Kubernetes on your Linux hosts. + +5. [Download RKE Config File Template](#5-download-config-file-template) + + RKE uses a YAML config file to install and configure your Kubernetes cluster. Download one of our RKE config file templates to get started. + +6. [Configure Nodes](#6-configure-nodes) + + Configure the **Nodes** section of the RKE config template. + +7. [Configure Certificates](#7-configure-certificates) + + Configure the **Certificates** part of the template too. + +8. [Configure FQDN](#8-configure-fqdn) + + And the **FQDN** part. + +9. [Back Up Your RKE Config File](#9-back-up-your-rke-config-file) + + After you've completed configuration of the RKE config file: 1. it's no longer a template since you'll be using it, and 2. you should back up the RKE config file to a safe place. You will reuse this file for upgrades later. + +10. [Run RKE](#10-run-rke) + + Run RKE to deploy Rancher to your cluster. + +11. [Back Up Auto-Generated Config File](#11-back-up-auto-generated-config-file) + + During installation, RKE generates a config file that you'll use later for upgrades. Back it up to a safe location. + +
+## 1. Provision Linux Hosts + +Before you install Rancher, confirm you meet the host requirements. Provision 3 new Linux hosts using the requirements below. + +### Requirements + +#### Operating System + +{{< requirements_os >}} + +#### Hardware + +{{< requirements_hardware >}} + +#### Software + +{{< requirements_software >}} + +{{< note_server-tags >}} + +#### Ports + +The following diagram depicts the basic port requirements for Rancher. For a comprehensive list, see [Port Requirements]({{< baseurl >}}/rancher/v2.x/en/installation/references/). + +![Basic Port Requirements]({{< baseurl >}}/img/rancher/port-communications.png) + +## 2. Configure Load Balancer + +When using a load balancer in front of Rancher, there's no need for the container to redirect port communication from port 80 or port 443. By passing the header `X-Forwarded-Proto: https`, this redirect is disabled. This is the expected configuration when terminating SSL externally. + +The load balancer has to be configured to support the following: + +* **WebSocket** connections +* **SPDY** / **HTTP/2** protocols +* Passing / setting the following headers: + +| Header | Value | Description | +|---------------------|----------------------------------------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `Host` | FQDN used to reach Rancher. | To identify the server requested by the client. | +| `X-Forwarded-Proto` | `https` | To identify the protocol that a client used to connect to the load balancer.

**Note:** If this header is present, `rancher/rancher` does not redirect HTTP to HTTPS. | +| `X-Forwarded-Port` | Port used to reach Rancher. | To identify the protocol that client used to connect to the load balancer. | +| `X-Forwarded-For` | IP of the client connection. | To identify the originating IP address of a client. | + +Health checks can be executed on the `/healthz` endpoint of the node, this will return HTTP 200. + +We have example configurations for the following load balancers: + +* [Amazon ALB configuration]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install-external-lb/alb) +* [NGINX configuration]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install-external-lb/nginx) + +## 3. Configure DNS + +Choose a fully qualified domain name (FQDN) that you want to use to access Rancher (e.g., `rancher.yourdomain.com`).

+ +1. Log into your DNS server a create a `DNS A` record that points to the IP address of your [load balancer](#2-configure-load-balancer). + +2. Validate that the `DNS A` is working correctly. Run the following command from any terminal, replacing `HOSTNAME.DOMAIN.COM` with your chosen FQDN: + + `nslookup HOSTNAME.DOMAIN.COM` + + **Step Result:** Terminal displays output similar to the following: + + ``` + $ nslookup rancher.yourdomain.com + Server: YOUR_HOSTNAME_IP_ADDRESS + Address: YOUR_HOSTNAME_IP_ADDRESS#53 + + Non-authoritative answer: + Name: rancher.yourdomain.com + Address: HOSTNAME.DOMAIN.COM + ``` + +
+ +## 4. Download RKE + +RKE is a fast, versatile Kubernetes installer that you can use to install Kubernetes on your Linux hosts. We will be using RKE to setup our cluster and run Rancher. + +1. From your workstation, open a web browser and navigate to our [RKE Releases](https://github.com/rancher/rke/releases/latest) page. Download the latest RKE installer applicable to your Operating System: + + - **MacOS**: `rke_darwin-amd64` + - **Linux**: `rke_linux-amd64` + - **Windows**: `rke_windows-amd64.exe` + +2. Make the RKE binary that you just downloaded executable. Open Terminal, change directory to the location of the RKE binary, and then run one of the commands below. + + >**Using Windows?** + >The file is already an executable. Skip to [Download Config File Template](#5-download-config-file-template). + + ``` + # MacOS + $ chmod +x rke_darwin-amd64 + # Linux + $ chmod +x rke_linux-amd64 + ``` + +3. Confirm that RKE is now executable by running the following command: + + ``` + # MacOS + $ ./rke_darwin-amd64 --version + # Linux + $ ./rke_linux-amd64 --version + ``` + + **Step Result:** You receive output similar to what follows: + ``` + rke version v + ``` + +## 5. Download RKE Config File Template + +RKE uses a YAML config file to install and configure your Kubernetes cluster. There are 2 templates to choose from, depending on the SSL certificate you want to use. + +1. Download one of following templates, depending on the SSL certificate you're using. + + - [Template for self-signed certificate
`3-node-externalssl-certificate.yml`](https://raw.githubusercontent.com/rancher/rancher/58e695b51096b1f404188379cea6f6a35aea9e4c/rke-templates/3-node-externalssl-certificate.yml) + - [Template for certificate signed by recognized CA
`3-node-externalssl-recognizedca.yml`](https://raw.githubusercontent.com/rancher/rancher/7f60dc3afe1b45287ac36ba6bde6f7c6e35c11fe/rke-templates/3-node-externalssl-recognizedca.yml) + +2. Rename the file to `rancher-cluster.yml`. + +## 6. Configure Nodes + +Once you have the `rancher-cluster.yml` config file template, edit the nodes section to point toward your Linux hosts. + +1. Open `rancher-cluster.yml` in your favorite text editor. + +2. Update the `nodes` section with the information of your [Linux hosts](#provision-linux-hosts). + + For each node in your cluster, update the following placeholders: `IP_ADDRESS_X` and `USER`. + +``` +nodes: + - address: IP_ADDRESS_1 + # THE IP ADDRESS OR HOSTNAME OF THE NODE + user: USER + # USER WITH ADMIN ACCESS. USUALLY `root` + role: [controlplane,etcd,worker] + ssh_key_path: ~/.ssh/id_rsa + # PATH TO SSH KEY THAT AUTHENTICATES ON YOUR WORKSTATION + # USUALLY THE VALUE ABOVE + - address: IP_ADDRESS_2 + user: USER + role: [controlplane,etcd,worker] + ssh_key_path: ~/.ssh/id_rsa + - address: IP_ADDRESS_3 + user: USER + role: [controlplane,etcd,worker] + ssh_key_path: ~/.ssh/id_rsa +``` + +## 7. Configure Certificates + +For security purposes, SSL (Secure Sockets Layer) is required when using Rancher. SSL secures all Rancher network communication, like when you login or interact with a cluster. + +Choose from the following options: + +- [Option A—Bring Your Own Certificate: Self-Signed](#option-a-bring-your-own-certificate-self-signed) +- [Option B—Bring Your Own Certificate: Signed by Recognized CA](#option-b-bring-your-own-certificate-signed-by-recognized-ca) + +### Option A—Bring Your Own Certificate: Self-Signed + +>**Prerequisites:** +>Create a self-signed certificate. +> +>- The certificate files must be in [PEM format](#pem). +>- The certificate files must be encoded in [base64](#base64). +>- In your certificate file, include all intermediate certificates in the chain. Order your certificates with your certificate first, followed by the intermediates. For an example, see [SSL FAQ / Troubleshooting](#cert-order). + +1. In `kind: Secret` with `name: cattle-keys-ingress`: + + * Replace `` with the base64 encoded string of the CA Certificate file (usually called `ca.pem` or `ca.crt`) + + >**Note:** + > The base64 encoded string should be on the same line as `cacerts.pem`, without any newline at the beginning, in between or at the end. + + **Result:** After replacing the values, the file should look like the example below (the base64 encoded strings should be different): + + ``` + --- + apiVersion: v1 + kind: Secret + metadata: + name: cattle-keys-server + namespace: cattle-system + type: Opaque + data: + cacerts.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNvRENDQVlnQ0NRRHVVWjZuMEZWeU16QU5CZ2txaGtpRzl3MEJBUXNGQURBU01SQXdEZ1lEVlFRRERBZDAKWlhOMExXTmhNQjRYRFRFNE1EVXdOakl4TURRd09Wb1hEVEU0TURjd05USXhNRFF3T1Zvd0VqRVFNQTRHQTFVRQpBd3dIZEdWemRDMWpZVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFNQmpBS3dQCndhRUhwQTdaRW1iWWczaTNYNlppVmtGZFJGckJlTmFYTHFPL2R0RUdmWktqYUF0Wm45R1VsckQxZUlUS3UzVHgKOWlGVlV4Mmo1Z0tyWmpwWitCUnFiZ1BNbk5hS1hocmRTdDRtUUN0VFFZdGRYMVFZS0pUbWF5NU45N3FoNTZtWQprMllKRkpOWVhHWlJabkdMUXJQNk04VHZramF0ZnZOdmJ0WmtkY2orYlY3aWhXanp2d2theHRUVjZlUGxuM2p5CnJUeXBBTDliYnlVcHlad3E2MWQvb0Q4VUtwZ2lZM1dOWmN1YnNvSjhxWlRsTnN6UjVadEFJV0tjSE5ZbE93d2oKaG41RE1tSFpwZ0ZGNW14TU52akxPRUc0S0ZRU3laYlV2QzlZRUhLZTUxbGVxa1lmQmtBZWpPY002TnlWQUh1dApuay9DMHpXcGdENkIwbkVDQXdFQUFUQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFHTCtaNkRzK2R4WTZsU2VBClZHSkMvdzE1bHJ2ZXdia1YxN3hvcmlyNEMxVURJSXB6YXdCdFJRSGdSWXVtblVqOGo4T0hFWUFDUEthR3BTVUsKRDVuVWdzV0pMUUV0TDA2eTh6M3A0MDBrSlZFZW9xZlVnYjQrK1JLRVJrWmowWXR3NEN0WHhwOVMzVkd4NmNOQQozZVlqRnRQd2hoYWVEQmdma1hXQWtISXFDcEsrN3RYem9pRGpXbi8walI2VDcrSGlaNEZjZ1AzYnd3K3NjUDIyCjlDQVZ1ZFg4TWpEQ1hTcll0Y0ZINllBanlCSTJjbDhoSkJqa2E3aERpVC9DaFlEZlFFVFZDM3crQjBDYjF1NWcKdE03Z2NGcUw4OVdhMnp5UzdNdXk5bEthUDBvTXl1Ty82Tm1wNjNsVnRHeEZKSFh4WTN6M0lycGxlbTNZQThpTwpmbmlYZXc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + ``` + +### Option B—Bring Your Own Certificate: Signed by Recognized CA + +If you are using a Certificate Signed By A Recognized Certificate Authority, you don't need to perform any step in this part. + +## 8. Configure FQDN + +There is one reference to `` in the RKE config file. Replace this reference with the FQDN you chose in in [3. Configure DNS](#part-3-configure-dns). + +1. Open `rancher-cluster.yml`. + +2. In the `kind: Ingress` with `name: cattle-ingress-http:` + + Replace `` with the FQDN chosen in [3. Configure DNS](#3-configure-dns). + + **Step Result:** After replacing the values, the file should look like the example below (the base64 encoded strings should be different): + + ``` + apiVersion: extensions/v1beta1 + kind: Ingress + metadata: + namespace: cattle-system + name: cattle-ingress-http + annotations: + nginx.ingress.kubernetes.io/proxy-connect-timeout: "30" + nginx.ingress.kubernetes.io/proxy-read-timeout: "1800" # Max time in seconds for ws to remain shell window open + nginx.ingress.kubernetes.io/proxy-send-timeout: "1800" # Max time in seconds for ws to remain shell window open + spec: + rules: + - host: rancher.yourdomain.com + http: + paths: + - backend: + serviceName: cattle-service + servicePort: 80 + ``` + + +3. Save the file and close it. + +## 9. Back Up Your RKE Config File + +After you close your RKE config file, `rancher-cluster.yml`, back it up to a secure location. You can use this file again when it's time to upgrade Rancher. + +## 10. Run RKE + +With all configuration in place, use RKE to launch Rancher. You can complete this action by running the `rke up` command and using the `--config` parameter to point toward your config file. + +1. From your workstation, make sure `rancher-cluster.yml` and the downloaded `rke` binary are in the same directory. + +2. Open a Terminal instance. Change to the directory that contains your config file and `rke`. + +3. Enter one of the `rke up` commands listen below. + + ``` + # MacOS + ./rke_darwin-amd64 up --config rancher-cluster.yml + # Linux + ./rke_linux-amd64 up --config rancher-cluster.yml + ``` + + **Step Result:** The output should be similar to the snippet below: + + ``` + INFO[0000] Building Kubernetes cluster + INFO[0000] [dialer] Setup tunnel for host [1.1.1.1] + INFO[0000] [network] Deploying port listener containers + INFO[0000] [network] Pulling image [alpine:latest] on host [1.1.1.1] + ... + INFO[0101] Finished building Kubernetes cluster successfully + ``` + +## 11. Back Up Auto-Generated Config File + +During installation, RKE automatically generates a config file named `kube_config_rancher-cluster.yml` in the same directory as the `rancher-cluster.yml` file. Copy this file and back it up to a safe location. You'll use this file later when upgrading Rancher Server. + +## What's Next? + +You have a couple of options: + +- Create a backup of your Rancher Server in case of a disaster scenario: [High Availablility Back Up and Restoration]({{< baseurl >}}/rancher/v2.x/en/installation/backups-and-restoration/ha-backup-and-restoration). +- Create a Kubernetes cluster: [Creating a Cluster]({{< baseurl >}}/rancher/v2.x/en/tasks/clusters/creating-a-cluster/). + +
+ +## FAQ and Troubleshooting + +{{< ssl_faq_ha >}} diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install-external-lb/alb/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install-external-lb/alb/_index.md new file mode 100644 index 00000000000..424d35bdd3f --- /dev/null +++ b/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install-external-lb/alb/_index.md @@ -0,0 +1,94 @@ +--- +title: Amazon ALB configuration +weight: 277 +--- +## Objectives + +Configuring an Amazon ALB is a multistage process. We've broken it down into multiple tasks so that it's easy to follow. + +1. [Create Target Group](#create-target-group) + + Begin by creating one target group for the http protocol. You'll add your Linux nodes to this group. + +2. [Register Targets](#register-targets) + + Add your Linux nodes to the target group. + +3. [Create Your ALB](#create-your-alb) + + Use Amazon's Wizard to create an Application Load Balancer. As part of this process, you'll add the target groups you created in **1. Create Target Groups**. + + +## Create Target Group + +Your first ALB configuration step is to create one target group for HTTP. + +Log into the [Amazon AWS Console](https://console.aws.amazon.com/ec2/) to get started. + +The document below will guide you through this process. Use the data in the tables below to complete the procedure. + +[Amazon Documentation: Create a Target Group](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-target-group.html) + +### Target Group (HTTP) + +Option | Setting +----------------------------|------------------------------------ +Target Group Name | `rancher-http-80` +Protocol | `HTTP` +Port | `80` +Target type | `instance` +VPC | Choose your VPC +Protocol
(Health Check) | `HTTP` +Path
(Health Check) | `/healthz` + +## Register Targets + +Next, add your Linux nodes to your target group. + +[Amazon Documentation: Register Targets with Your Target Group](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/target-group-register-targets.html) + +### Create Your ALB + +Use Amazon's Wizard to create an Application Load Balancer. As part of this process, you'll add the target group you created in [Create Target Group](#create-target-group). + +1. From your web browser, navigate to the [Amazon EC2 Console](https://console.aws.amazon.com/ec2/). + +2. From the navigation pane, choose **LOAD BALANCING** > **Load Balancers**. + +3. Click **Create Load Balancer**. + +4. Choose **Application Load Balancer**. + +5. Complete the **Step 1: Configure Load Balancer** form. + - **Basic Configuration** + + - Name: `rancher-http` + - Scheme: `internet-facing` + - IP address type: `ipv4` + - **Listeners** + + Add the **Load Balancer Protocols** and **Load Balancer Ports** below. + - `HTTP`: `80` + - `HTTPS`: `443` + + - **Availability Zones** + + - Select Your **VPC** and **Availability Zones**. + +6. Complete the **Step 2: Configure Security Settings** form. + + Configure the certificate you want to use for SSL termination. + +7. Complete the **Step 3: Configure Security Groups** form. + +8. Complete the **Step 4: Configure Routing** form. + + - From the **Target Group** drop-down, choose **Existing target group**. + + - Add target group `rancher-http-80`. + +9. Complete **Step 5: Register Targets**. Since you registered your targets earlier, all you have to do it click **Next: Review**. + +10. Complete **Step 6: Review**. Look over the load balancer details and click **Create** when you're satisfied. + +11. After AWS creates the ALB, click **Close**. diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install-external-lb/nginx/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install-external-lb/nginx/_index.md new file mode 100644 index 00000000000..20579aa96b8 --- /dev/null +++ b/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install-external-lb/nginx/_index.md @@ -0,0 +1,78 @@ +--- +title: NGINX configuration +weight: 277 +--- +## Install NGINX + +Start by installing NGINX on your load balancer host. NGINX has packages available for all known operating systems. + +For help installing NGINX, refer to their [install documentation](https://www.nginx.com/resources/wiki/start/topics/tutorials/install/). + +## Create NGINX Configuration + +After installing NGINX, you need to create the NGINX config file, `/etc/nginx/conf.d/rancher.conf`, with the IP addresses for your Linux nodes, chosen FQDN and location of the certificate file and certificate key file. + +1. Copy and paste the code sample below into your favorite text editor. Save it as `/etc/nginx/conf.d/rancher.conf`. + + **Example NGINX config:** + ``` + upstream rancher { + server IP_NODE_1:80; + server IP_NODE_2:80; + server IP_NODE_3:80; + } + + map $http_upgrade $connection_upgrade { + default Upgrade; + '' close; + } + + server { + listen 443 ssl http2; + server_name FQDN; + ssl_certificate /certs/fullchain.pem; + ssl_certificate_key /certs/privkey.pem; + + location / { + proxy_set_header Host $host; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Port $server_port; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_pass http://rancher; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + # This allows the ability for the execute shell window to remain open for up to 15 minutes. Without this parameter, the default is 1 minute and will automatically close. + proxy_read_timeout 900s; + } + } + + server { + listen 80; + server_name FQDN; + return 301 https://$server_name$request_uri; + } + ``` + +2. In `/etc/nginx/conf.d/rancher.conf`, replace `IP_NODE_1`, `IP_NODE_2`, and `IP_NODE_3` with the IPs of your Linux hosts. +3. In `/etc/nginx/conf.d/rancher.conf`, replace `FQDN` with the FQDN you chose for your Rancher installation. +4. In `/etc/nginx/conf.d/rancher.conf`, replace `/certs/fullchain.pem` with the path to your certificate. If there are intermediates required for you certificate, they should be included in this file. +5. In `/etc/nginx/conf.d/rancher.conf`, replace `/certs/privkey.pem` with the path to your certificate key. + +## Run NGINX + +* Reload or restart NGINX + + ```` + # Reload NGINX + nginx -s reload + + # Restart NGINX + # Depending on your Linux distribution + service nginx restart + systemctl restart nginx + ```` + +## Browse to Rancher UI + +You should now be to able to browse to `https://FQDN`. diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install/_index.md new file mode 100644 index 00000000000..efd0a46a5ec --- /dev/null +++ b/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install/_index.md @@ -0,0 +1,435 @@ +--- +title: High Availability Installation with External Load Balancer (TCP/Layer 4) +weight: 275 +--- +This set of instructions creates a new Kubernetes cluster that's dedicated to running Rancher in a high-availability (HA) configuration. This procedure walks you through setting up a 3-node cluster using the Rancher Kubernetes Engine (RKE). The cluster's sole purpose is running pods for Rancher. The setup is based on: + +- Layer 4 load balancer (TCP) +- NGINX ingress controller with SSL termination (HTTPS) + +![Rancher HA]({{< baseurl >}}/img/rancher/ha/rancher2ha.svg) + +## Installation Outline + +Installation of Rancher in a high-availability configuration involves multiple procedures. Review this outline to learn about each procedure you need to complete. + +1. [Provision Linux Hosts](#1-provision-linux-hosts) + + Provision three Linux hosts to serve as your Kubernetes cluster. + +2. [Configure Load Balancer](#2-configure-load-balancer) + + Configure your load balancer to have a highly available single point of entry to your Rancher cluster. + +3. [Configure DNS](#3-configure-dns) + + Make your setup accessible using a DNS name by configuring the DNS to point to your loadbalancer. + +4. [Download RKE](#4-download-rke) + + [RKE](https://github.com/rancher/rke/releases) is a fast, versatile Kubernetes installer that you can use to install Kubernetes on your Linux hosts. + +5. [Download RKE Config File Template](#5-download-config-file-template) + + RKE uses a YAML config file to install and configure your Kubernetes cluster. Download one of our RKE config file templates to get started. + +6. [Configure Nodes](#6-configure-nodes) + + Configure the **Nodes** section of the RKE config template. + +7. [Configure Certificates](#7-configure-certificates) + + Configure the **Certificates** part of the template too. + +8. [Configure FQDN](#8-configure-fqdn) + + And the **FQDN** part. + +9. [Back Up Your RKE Config File](#9-back-up-your-rke-config-file) + + After you've completed configuration of the RKE config file: 1. it's no longer a template since you'll be using it, and 2. you should back up the RKE config file to a safe place. You will reuse this file for upgrades later. + +10. [Run RKE](#10-run-rke) + + Run RKE to deploy Rancher to your cluster. + +11. [Back Up Auto-Generated Config File](#11-back-up-auto-generated-config-file) + + During installation, RKE generates a config file that you'll use later for upgrades. Back it up to a safe location. + +
+ +## 1. Provision Linux Hosts + +Before you install Rancher, confirm you meet the host requirements. Provision 3 new Linux hosts using the requirements below. + +### Host Requirements + +#### Operating System + +{{< requirements_os >}} + +#### Hardware + +{{< requirements_hardware >}} + +#### Software + +{{< requirements_software >}} + +{{< note_server-tags >}} + +#### Ports + +The following diagram depicts the basic port requirements for Rancher. For a comprehensive list, see [Port Requirements]({{< baseurl >}}/rancher/v2.x/en/installation/references/). + +![Basic Port Requirements]({{< baseurl >}}/img/rancher/port-communications.png) + +## 2. Configure Load Balancer + +We will be using NGINX as our Layer 4 Load Balancer (TCP). NGINX will forward all connections to one of your Rancher nodes. If you want to use Amazon NLB, you can skip this step and use [Amazon NLB configuration]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install/nlb/) + +>**Note:** +> In this configuration, the load balancer is positioned in front of your Linux hosts. The load balancer can be any host that you have available that's capable of running NGINX. +> +>One caveat: do not use one of your Rancher nodes as the load balancer. + +### A. Install NGINX + +Start by installing NGINX on your load balancer host. NGINX has packages available for all known operating systems. + +For help installing NGINX, refer to their [install documentation](https://www.nginx.com/resources/wiki/start/topics/tutorials/install/). + +### B. Create NGINX Configuration + +After installing NGINX, you need to update the NGINX config file, `nginx.conf`, with the IP addresses for your nodes. + +1. Copy and paste the code sample below into your favorite text editor. Save it as `nginx.conf`. + +2. From `nginx.conf`, replace `IP_NODE_1`, `IP_NODE_2`, and `IP_NODE_3` with the IPs of your [Linux hosts](#1-provision-linux-hosts). + + **Example NGINX config:** + ``` + worker_processes 4; + worker_rlimit_nofile 40000; + + events { + worker_connections 8192; + } + + http { + server { + listen 80; + return 301 https://$host$request_uri; + } + } + + stream { + upstream rancher_servers { + least_conn; + server IP_NODE_1:443 max_fails=3 fail_timeout=5s; + server IP_NODE_2:443 max_fails=3 fail_timeout=5s; + server IP_NODE_3:443 max_fails=3 fail_timeout=5s; + } + server { + listen 443; + proxy_pass rancher_servers; + } + } + ``` + +3. Save `nginx.conf` to your load balancer at the following path: `/etc/nginx/nginx.conf`. + +4. Load the updates to your NGINX configuration by running the following command: + + ``` + # nginx -s reload + ``` + +### Option - Run NGINX as Docker container + +Instead of installing NGINX as a package on the operating system, you can rather run it as a Docker container. Save the edited **Example NGINX config** as `/etc/nginx.conf` and run the following command to launch the NGINX container: + +``` +docker run -d --restart=unless-stopped \ + -p 80:80 -p 443:443 \ + -v /etc/nginx.conf:/etc/nginx/nginx.conf \ + nginx:1.14 +``` + +## 3. Configure DNS + +Choose a fully qualified domain name (FQDN) that you want to use to access Rancher (e.g., `rancher.yourdomain.com`).

+ +1. Log into your DNS server a create a `DNS A` record that points to the IP address of your [load balancer](#2-configure-load-balancer). + +2. Validate that the `DNS A` is working correctly. Run the following command from any terminal, replacing `HOSTNAME.DOMAIN.COM` with your chosen FQDN: + + `nslookup HOSTNAME.DOMAIN.COM` + + **Step Result:** Terminal displays output similar to the following: + + ``` + $ nslookup rancher.yourdomain.com + Server: YOUR_HOSTNAME_IP_ADDRESS + Address: YOUR_HOSTNAME_IP_ADDRESS#53 + + Non-authoritative answer: + Name: rancher.yourdomain.com + Address: HOSTNAME.DOMAIN.COM + ``` + +
+ +## 4. Download RKE + +RKE is a fast, versatile Kubernetes installer that you can use to install Kubernetes on your Linux hosts. We will be using RKE to setup our cluster and run Rancher. + +1. From your workstation, open a web browser and navigate to our [RKE Releases](https://github.com/rancher/rke/releases/latest) page. Download the latest RKE installer applicable to your Operating System: + + - **MacOS**: `rke_darwin-amd64` + - **Linux**: `rke_linux-amd64` + - **Windows**: `rke_windows-amd64.exe` + +2. Make the RKE binary that you just downloaded executable. Open Terminal, change directory to the location of the RKE binary, and then run one of the commands below. + + >**Using Windows?** + >The file is already an executable. Skip to [Download Config File Template](#5-download-config-file-template). + + ``` + # MacOS + $ chmod +x rke_darwin-amd64 + # Linux + $ chmod +x rke_linux-amd64 + ``` + +3. Confirm that RKE is now executable by running the following command: + + ``` + # MacOS + $ ./rke_darwin-amd64 --version + # Linux + $ ./rke_linux-amd64 --version + ``` + + **Step Result:** You receive output similar to what follows: + ``` + rke version v + ``` + +## 5. Download RKE Config File Template + +RKE uses a `.yml` config file to install and configure your Kubernetes cluster. There are 2 templates to choose from, depending on the SSL certificate you want to use. + +1. Download one of following templates, depending on the SSL certificate you're using. + + - [Template for self-signed certificate
`3-node-certificate.yml`](https://raw.githubusercontent.com/rancher/rancher/e9d29b3f3b9673421961c68adf0516807d1317eb/rke-templates/3-node-certificate.yml) + - [Template for certificate signed by recognized CA
`3-node-certificate-recognizedca.yml`](https://raw.githubusercontent.com/rancher/rancher/d8ca0805a3958552e84fdf5d743859097ae81e0b/rke-templates/3-node-certificate-recognizedca.yml) + +2. Rename the file to `rancher-cluster.yml`. + +## 6. Configure Nodes + +Once you have the `rancher-cluster.yml` config file template, edit the nodes section to point toward your Linux hosts. + +1. Open `rancher-cluster.yml` in your favorite text editor. + +2. Update the `nodes` section with the information of your [Linux hosts](#provision-linux-hosts). + + For each node in your cluster, update the following placeholders: `IP_ADDRESS_X` and `USER`. + +``` +nodes: + - address: IP_ADDRESS_1 + # THE IP ADDRESS OR HOSTNAME OF THE NODE + user: USER + # USER WITH ADMIN ACCESS. USUALLY `root` + role: [controlplane,etcd,worker] + ssh_key_path: ~/.ssh/id_rsa + # PATH TO SSH KEY THAT AUTHENTICATES ON YOUR WORKSTATION + # USUALLY THE VALUE ABOVE + - address: IP_ADDRESS_2 + user: USER + role: [controlplane,etcd,worker] + ssh_key_path: ~/.ssh/id_rsa + - address: IP_ADDRESS_3 + user: USER + role: [controlplane,etcd,worker] + ssh_key_path: ~/.ssh/id_rsa +``` + +## 7. Configure Certificates + +For security purposes, SSL (Secure Sockets Layer) is required when using Rancher. SSL secures all Rancher network communication, like when you login or interact with a cluster. + +Choose from the following options: + +- [Option A—Bring Your Own Certificate: Self-Signed](#option-a-bring-your-own-certificate-self-signed) +- [Option B—Bring Your Own Certificate: Signed by Recognized CA](#option-b-bring-your-own-certificate-signed-by-recognized-ca) + +### Option A—Bring Your Own Certificate: Self-Signed + +>**Prerequisites:** +>Create a self-signed certificate. +> +>- The certificate files must be in [PEM format](#pem). +>- The certificate files must be encoded in [base64](#base64). +>- In your certificate file, include all intermediate certificates in the chain. Order your certificates with your certificate first, followed by the intermediates. For an example, see [Intermediate Certificates](#cert-order). + +1. In `kind: Secret` with `name: cattle-keys-ingress`: + + * Replace `` with the base64 encoded string of the Certificate file (usually called `cert.pem` or `domain.crt`) + * Replace `` with the base64 encoded string of the Certificate Key file (usually called `key.pem` or `domain.key`) + + >**Note:** + > The base64 encoded string should be on the same line as `tls.crt` or `tls.key`, without any newline at the beginning, in between or at the end. + + **Result:** After replacing the values, the file should look like the example below (the base64 encoded strings should be different): + +```yaml +--- + apiVersion: v1 + kind: Secret + metadata: + name: cattle-keys-ingress + namespace: cattle-system + type: Opaque + data: + tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM1RENDQWN5Z0F3SUJBZ0lKQUlHc25NeG1LeGxLTUEwR0NTcUdTSWIzRFFFQkN3VUFNQkl4RURBT0JnTlYKQkFNTUIzUmxjM1F0WTJFd0hoY05NVGd3TlRBMk1qRXdOREE1V2hjTk1UZ3dOekExTWpFd05EQTVXakFXTVJRdwpFZ1lEVlFRRERBdG9ZUzV5Ym1Ob2NpNXViRENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DCmdnRUJBTFJlMXdzekZSb2Rib2pZV05DSHA3UkdJaUVIMENDZ1F2MmdMRXNkUUNKZlcrUFEvVjM0NnQ3bSs3TFEKZXJaV3ZZMWpuY2VuWU5JSGRBU0VnU0ducWExYnhUSU9FaE0zQXpib3B0WDhjSW1OSGZoQlZETGdiTEYzUk0xaQpPM1JLTGdIS2tYSTMxZndjbU9zWGUwaElYQnpUbmxnM20vUzlXL3NTc0l1dDVwNENDUWV3TWlpWFhuUElKb21lCmpkS3VjSHFnMTlzd0YvcGVUalZrcVpuMkJHazZRaWFpMU41bldRV0pjcThTenZxTTViZElDaWlwYU9hWWQ3RFEKYWRTejV5dlF0YkxQNW4wTXpnOU43S3pGcEpvUys5QWdkWDI5cmZqV2JSekp3RzM5R3dRemN6VWtLcnZEb05JaQo0UFJHc01yclFNVXFSYjRSajNQOEJodEMxWXNDQXdFQUFhTTVNRGN3Q1FZRFZSMFRCQUl3QURBTEJnTlZIUThFCkJBTUNCZUF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdJR0NDc0dBUVVGQndNQk1BMEdDU3FHU0liM0RRRUIKQ3dVQUE0SUJBUUNKZm5PWlFLWkowTFliOGNWUW5Vdi9NZkRZVEJIQ0pZcGM4MmgzUGlXWElMQk1jWDhQRC93MgpoOUExNkE4NGNxODJuQXEvaFZYYy9JNG9yaFY5WW9jSEg5UlcvbGthTUQ2VEJVR0Q1U1k4S292MHpHQ1ROaDZ6Ci9wZTNqTC9uU0pYSjRtQm51czJheHFtWnIvM3hhaWpYZG9kMmd3eGVhTklvRjNLbHB2aGU3ZjRBNmpsQTM0MmkKVVlCZ09iN1F5KytRZWd4U1diSmdoSzg1MmUvUUhnU2FVSkN6NW1sNGc1WndnNnBTUXhySUhCNkcvREc4dElSYwprZDMxSk1qY25Fb1Rhc1Jyc1NwVmNGdXZyQXlXN2liakZyYzhienBNcE1obDVwYUZRcEZzMnIwaXpZekhwakFsCk5ZR2I2OHJHcjBwQkp3YU5DS2ErbCtLRTk4M3A3NDYwCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBdEY3WEN6TVZHaDF1aU5oWTBJZW50RVlpSVFmUUlLQkMvYUFzU3gxQUlsOWI0OUQ5ClhmanEzdWI3c3RCNnRsYTlqV09keDZkZzBnZDBCSVNCSWFlcHJWdkZNZzRTRXpjRE51aW0xZnh3aVkwZCtFRlUKTXVCc3NYZEV6V0k3ZEVvdUFjcVJjamZWL0J5WTZ4ZDdTRWhjSE5PZVdEZWI5TDFiK3hLd2k2M21uZ0lKQjdBeQpLSmRlYzhnbWlaNk4wcTV3ZXFEWDJ6QVgrbDVPTldTcG1mWUVhVHBDSnFMVTNtZFpCWWx5cnhMTytvemx0MGdLCktLbG81cGgzc05CcDFMUG5LOUMxc3MvbWZRek9EMDNzck1Xa21oTDcwQ0IxZmIydCtOWnRITW5BYmYwYkJETnoKTlNRcXU4T2cwaUxnOUVhd3l1dEF4U3BGdmhHUGMvd0dHMExWaXdJREFRQUJBb0lCQUJKYUErOHp4MVhjNEw0egpwUFd5bDdHVDRTMFRLbTNuWUdtRnZudjJBZXg5WDFBU2wzVFVPckZyTnZpK2xYMnYzYUZoSFZDUEN4N1RlMDVxClhPa2JzZnZkZG5iZFQ2RjgyMnJleVByRXNINk9TUnBWSzBmeDVaMDQwVnRFUDJCWm04eTYyNG1QZk1vbDdya2MKcm9Kd09rOEVpUHZZekpsZUd0bTAwUm1sRysyL2c0aWJsOTVmQXpyc1MvcGUyS3ZoN2NBVEtIcVh6MjlpUmZpbApiTGhBamQwcEVSMjNYU0hHR1ZqRmF3amNJK1c2L2RtbDZURDhrSzFGaUtldmJKTlREeVNXQnpPbXRTYUp1K01JCm9iUnVWWG4yZVNoamVGM1BYcHZRMWRhNXdBa0dJQWxOWjRHTG5QU2ZwVmJyU0plU3RrTGNzdEJheVlJS3BWZVgKSVVTTHM0RUNnWUVBMmNnZUE2WHh0TXdFNU5QWlNWdGhzbXRiYi9YYmtsSTdrWHlsdk5zZjFPdXRYVzkybVJneQpHcEhUQ0VubDB0Z1p3T081T1FLNjdFT3JUdDBRWStxMDJzZndwcmgwNFZEVGZhcW5QNTBxa3BmZEJLQWpmanEyCjFoZDZMd2hLeDRxSm9aelp2VkowV0lvR1ZLcjhJSjJOWGRTUVlUanZUZHhGczRTamdqNFFiaEVDZ1lFQTFBWUUKSEo3eVlza2EvS2V2OVVYbmVrSTRvMm5aYjJ1UVZXazRXSHlaY2NRN3VMQVhGY3lJcW5SZnoxczVzN3RMTzJCagozTFZNUVBzazFNY25oTTl4WE4vQ3ZDTys5b2t0RnNaMGJqWFh6NEJ5V2lFNHJPS1lhVEFwcDVsWlpUT3ZVMWNyCm05R3NwMWJoVDVZb2RaZ3IwUHQyYzR4U2krUVlEWnNFb2lFdzNkc0NnWUVBcVJLYWNweWZKSXlMZEJjZ0JycGkKQTRFalVLMWZsSjR3enNjbGFKUDVoM1NjZUFCejQzRU1YT0kvSXAwMFJsY3N6em83N3cyMmpud09mOEJSM0RBMwp6ZTRSWDIydWw4b0hGdldvdUZOTTNOZjNaNExuYXpVc0F0UGhNS2hRWGMrcEFBWGthUDJkZzZ0TU5PazFxaUNHCndvU212a1BVVE84b1ViRTB1NFZ4ZmZFQ2dZQUpPdDNROVNadUlIMFpSSitIV095enlOQTRaUEkvUkhwN0RXS1QKajVFS2Y5VnR1OVMxY1RyOTJLVVhITXlOUTNrSjg2OUZPMnMvWk85OGg5THptQ2hDTjhkOWN6enI5SnJPNUFMTApqWEtBcVFIUlpLTFgrK0ZRcXZVVlE3cTlpaHQyMEZPb3E5OE5SZDMzSGYxUzZUWDNHZ3RWQ21YSml6dDAxQ3ZHCmR4VnVnd0tCZ0M2Mlp0b0RLb3JyT2hvdTBPelprK2YwQS9rNDJBOENiL29VMGpwSzZtdmxEWmNYdUF1QVZTVXIKNXJCZjRVYmdVYndqa1ZWSFR6LzdDb1BWSjUvVUxJWk1Db1RUNFprNTZXWDk4ZE93Q3VTVFpZYnlBbDZNS1BBZApTZEpuVVIraEpnSVFDVGJ4K1dzYnh2d0FkbWErWUhtaVlPRzZhSklXMXdSd1VGOURLUEhHCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== +``` + +2. In `kind: Secret` with `name: cattle-keys-server`, replace `` with the base64 encoded string of the CA Certificate file (usually called `ca.pem` or `ca.crt`). + + >**Note:** + > The base64 encoded string should be on the same line as `cacerts.pem`, without any newline at the beginning, in between or at the end. + + + **Result:** The file should look like the example below (the base64 encoded string should be different): + ```yaml + --- + apiVersion: v1 + kind: Secret + metadata: + name: cattle-keys-server + namespace: cattle-system + type: Opaque + data: + cacerts.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNvRENDQVlnQ0NRRHVVWjZuMEZWeU16QU5CZ2txaGtpRzl3MEJBUXNGQURBU01SQXdEZ1lEVlFRRERBZDAKWlhOMExXTmhNQjRYRFRFNE1EVXdOakl4TURRd09Wb1hEVEU0TURjd05USXhNRFF3T1Zvd0VqRVFNQTRHQTFVRQpBd3dIZEdWemRDMWpZVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFNQmpBS3dQCndhRUhwQTdaRW1iWWczaTNYNlppVmtGZFJGckJlTmFYTHFPL2R0RUdmWktqYUF0Wm45R1VsckQxZUlUS3UzVHgKOWlGVlV4Mmo1Z0tyWmpwWitCUnFiZ1BNbk5hS1hocmRTdDRtUUN0VFFZdGRYMVFZS0pUbWF5NU45N3FoNTZtWQprMllKRkpOWVhHWlJabkdMUXJQNk04VHZramF0ZnZOdmJ0WmtkY2orYlY3aWhXanp2d2theHRUVjZlUGxuM2p5CnJUeXBBTDliYnlVcHlad3E2MWQvb0Q4VUtwZ2lZM1dOWmN1YnNvSjhxWlRsTnN6UjVadEFJV0tjSE5ZbE93d2oKaG41RE1tSFpwZ0ZGNW14TU52akxPRUc0S0ZRU3laYlV2QzlZRUhLZTUxbGVxa1lmQmtBZWpPY002TnlWQUh1dApuay9DMHpXcGdENkIwbkVDQXdFQUFUQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFHTCtaNkRzK2R4WTZsU2VBClZHSkMvdzE1bHJ2ZXdia1YxN3hvcmlyNEMxVURJSXB6YXdCdFJRSGdSWXVtblVqOGo4T0hFWUFDUEthR3BTVUsKRDVuVWdzV0pMUUV0TDA2eTh6M3A0MDBrSlZFZW9xZlVnYjQrK1JLRVJrWmowWXR3NEN0WHhwOVMzVkd4NmNOQQozZVlqRnRQd2hoYWVEQmdma1hXQWtISXFDcEsrN3RYem9pRGpXbi8walI2VDcrSGlaNEZjZ1AzYnd3K3NjUDIyCjlDQVZ1ZFg4TWpEQ1hTcll0Y0ZINllBanlCSTJjbDhoSkJqa2E3aERpVC9DaFlEZlFFVFZDM3crQjBDYjF1NWcKdE03Z2NGcUw4OVdhMnp5UzdNdXk5bEthUDBvTXl1Ty82Tm1wNjNsVnRHeEZKSFh4WTN6M0lycGxlbTNZQThpTwpmbmlYZXc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + ``` + +### Option B—Bring Your Own Certificate: Signed by Recognized CA + +>**Note:** +> If you are using Self Signed Certificate, [click here](#option-a-self-signed-certificate) to proceed. + +If you are using a Certificate Signed By A Recognized Certificate Authority, you will need to generate a base64 encoded string for the Certificate file and the Certificate Key file. Make sure that your certificate file includes all the [intermediate certificates](#ssl-faq-troubleshooting) in the chain, the order of certificates in this case is first your own certificate, followed by the intermediates. Please refer to the documentation of your CSP (Certificate Service Provider) to see what intermediate certificate(s) need to be included. + +In the `kind: Secret` with `name: cattle-keys-ingress`: + +* Replace `` with the base64 encoded string of the Certificate file (usually called `cert.pem` or `domain.crt`) +* Replace `` with the base64 encoded string of the Certificate Key file (usually called `key.pem` or `domain.key`) + +After replacing the values, the file should look like the example below (the base64 encoded strings should be different): + +>**Note:** +> The base64 encoded string should be on the same line as `tls.crt` or `tls.key`, without any newline at the beginning, in between or at the end. + +```yaml +--- +apiVersion: v1 +kind: Secret +metadata: + name: cattle-keys-ingress + namespace: cattle-system +type: Opaque +data: + tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM1RENDQWN5Z0F3SUJBZ0lKQUlHc25NeG1LeGxLTUEwR0NTcUdTSWIzRFFFQkN3VUFNQkl4RURBT0JnTlYKQkFNTUIzUmxjM1F0WTJFd0hoY05NVGd3TlRBMk1qRXdOREE1V2hjTk1UZ3dOekExTWpFd05EQTVXakFXTVJRdwpFZ1lEVlFRRERBdG9ZUzV5Ym1Ob2NpNXViRENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DCmdnRUJBTFJlMXdzekZSb2Rib2pZV05DSHA3UkdJaUVIMENDZ1F2MmdMRXNkUUNKZlcrUFEvVjM0NnQ3bSs3TFEKZXJaV3ZZMWpuY2VuWU5JSGRBU0VnU0ducWExYnhUSU9FaE0zQXpib3B0WDhjSW1OSGZoQlZETGdiTEYzUk0xaQpPM1JLTGdIS2tYSTMxZndjbU9zWGUwaElYQnpUbmxnM20vUzlXL3NTc0l1dDVwNENDUWV3TWlpWFhuUElKb21lCmpkS3VjSHFnMTlzd0YvcGVUalZrcVpuMkJHazZRaWFpMU41bldRV0pjcThTenZxTTViZElDaWlwYU9hWWQ3RFEKYWRTejV5dlF0YkxQNW4wTXpnOU43S3pGcEpvUys5QWdkWDI5cmZqV2JSekp3RzM5R3dRemN6VWtLcnZEb05JaQo0UFJHc01yclFNVXFSYjRSajNQOEJodEMxWXNDQXdFQUFhTTVNRGN3Q1FZRFZSMFRCQUl3QURBTEJnTlZIUThFCkJBTUNCZUF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdJR0NDc0dBUVVGQndNQk1BMEdDU3FHU0liM0RRRUIKQ3dVQUE0SUJBUUNKZm5PWlFLWkowTFliOGNWUW5Vdi9NZkRZVEJIQ0pZcGM4MmgzUGlXWElMQk1jWDhQRC93MgpoOUExNkE4NGNxODJuQXEvaFZYYy9JNG9yaFY5WW9jSEg5UlcvbGthTUQ2VEJVR0Q1U1k4S292MHpHQ1ROaDZ6Ci9wZTNqTC9uU0pYSjRtQm51czJheHFtWnIvM3hhaWpYZG9kMmd3eGVhTklvRjNLbHB2aGU3ZjRBNmpsQTM0MmkKVVlCZ09iN1F5KytRZWd4U1diSmdoSzg1MmUvUUhnU2FVSkN6NW1sNGc1WndnNnBTUXhySUhCNkcvREc4dElSYwprZDMxSk1qY25Fb1Rhc1Jyc1NwVmNGdXZyQXlXN2liakZyYzhienBNcE1obDVwYUZRcEZzMnIwaXpZekhwakFsCk5ZR2I2OHJHcjBwQkp3YU5DS2ErbCtLRTk4M3A3NDYwCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBdEY3WEN6TVZHaDF1aU5oWTBJZW50RVlpSVFmUUlLQkMvYUFzU3gxQUlsOWI0OUQ5ClhmanEzdWI3c3RCNnRsYTlqV09keDZkZzBnZDBCSVNCSWFlcHJWdkZNZzRTRXpjRE51aW0xZnh3aVkwZCtFRlUKTXVCc3NYZEV6V0k3ZEVvdUFjcVJjamZWL0J5WTZ4ZDdTRWhjSE5PZVdEZWI5TDFiK3hLd2k2M21uZ0lKQjdBeQpLSmRlYzhnbWlaNk4wcTV3ZXFEWDJ6QVgrbDVPTldTcG1mWUVhVHBDSnFMVTNtZFpCWWx5cnhMTytvemx0MGdLCktLbG81cGgzc05CcDFMUG5LOUMxc3MvbWZRek9EMDNzck1Xa21oTDcwQ0IxZmIydCtOWnRITW5BYmYwYkJETnoKTlNRcXU4T2cwaUxnOUVhd3l1dEF4U3BGdmhHUGMvd0dHMExWaXdJREFRQUJBb0lCQUJKYUErOHp4MVhjNEw0egpwUFd5bDdHVDRTMFRLbTNuWUdtRnZudjJBZXg5WDFBU2wzVFVPckZyTnZpK2xYMnYzYUZoSFZDUEN4N1RlMDVxClhPa2JzZnZkZG5iZFQ2RjgyMnJleVByRXNINk9TUnBWSzBmeDVaMDQwVnRFUDJCWm04eTYyNG1QZk1vbDdya2MKcm9Kd09rOEVpUHZZekpsZUd0bTAwUm1sRysyL2c0aWJsOTVmQXpyc1MvcGUyS3ZoN2NBVEtIcVh6MjlpUmZpbApiTGhBamQwcEVSMjNYU0hHR1ZqRmF3amNJK1c2L2RtbDZURDhrSzFGaUtldmJKTlREeVNXQnpPbXRTYUp1K01JCm9iUnVWWG4yZVNoamVGM1BYcHZRMWRhNXdBa0dJQWxOWjRHTG5QU2ZwVmJyU0plU3RrTGNzdEJheVlJS3BWZVgKSVVTTHM0RUNnWUVBMmNnZUE2WHh0TXdFNU5QWlNWdGhzbXRiYi9YYmtsSTdrWHlsdk5zZjFPdXRYVzkybVJneQpHcEhUQ0VubDB0Z1p3T081T1FLNjdFT3JUdDBRWStxMDJzZndwcmgwNFZEVGZhcW5QNTBxa3BmZEJLQWpmanEyCjFoZDZMd2hLeDRxSm9aelp2VkowV0lvR1ZLcjhJSjJOWGRTUVlUanZUZHhGczRTamdqNFFiaEVDZ1lFQTFBWUUKSEo3eVlza2EvS2V2OVVYbmVrSTRvMm5aYjJ1UVZXazRXSHlaY2NRN3VMQVhGY3lJcW5SZnoxczVzN3RMTzJCagozTFZNUVBzazFNY25oTTl4WE4vQ3ZDTys5b2t0RnNaMGJqWFh6NEJ5V2lFNHJPS1lhVEFwcDVsWlpUT3ZVMWNyCm05R3NwMWJoVDVZb2RaZ3IwUHQyYzR4U2krUVlEWnNFb2lFdzNkc0NnWUVBcVJLYWNweWZKSXlMZEJjZ0JycGkKQTRFalVLMWZsSjR3enNjbGFKUDVoM1NjZUFCejQzRU1YT0kvSXAwMFJsY3N6em83N3cyMmpud09mOEJSM0RBMwp6ZTRSWDIydWw4b0hGdldvdUZOTTNOZjNaNExuYXpVc0F0UGhNS2hRWGMrcEFBWGthUDJkZzZ0TU5PazFxaUNHCndvU212a1BVVE84b1ViRTB1NFZ4ZmZFQ2dZQUpPdDNROVNadUlIMFpSSitIV095enlOQTRaUEkvUkhwN0RXS1QKajVFS2Y5VnR1OVMxY1RyOTJLVVhITXlOUTNrSjg2OUZPMnMvWk85OGg5THptQ2hDTjhkOWN6enI5SnJPNUFMTApqWEtBcVFIUlpLTFgrK0ZRcXZVVlE3cTlpaHQyMEZPb3E5OE5SZDMzSGYxUzZUWDNHZ3RWQ21YSml6dDAxQ3ZHCmR4VnVnd0tCZ0M2Mlp0b0RLb3JyT2hvdTBPelprK2YwQS9rNDJBOENiL29VMGpwSzZtdmxEWmNYdUF1QVZTVXIKNXJCZjRVYmdVYndqa1ZWSFR6LzdDb1BWSjUvVUxJWk1Db1RUNFprNTZXWDk4ZE93Q3VTVFpZYnlBbDZNS1BBZApTZEpuVVIraEpnSVFDVGJ4K1dzYnh2d0FkbWErWUhtaVlPRzZhSklXMXdSd1VGOURLUEhHCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== +``` + +## 8. Configure FQDN + +There are two references to `` in the config file (one in this step and one in the next). Both need to be replaced with the FQDN chosen in [Configure DNS](#3-configure-dns). + +In the `kind: Ingress` with `name: cattle-ingress-http`: + +* Replace `` with the FQDN chosen in [Configure DNS](#3-configure-dns). + +After replacing `` with the FQDN chosen in [Configure DNS](#3-configure-dns), the file should look like the example below (`rancher.yourdomain.com` is the FQDN used in this example): + +```yaml + --- + apiVersion: extensions/v1beta1 + kind: Ingress + metadata: + namespace: cattle-system + name: cattle-ingress-http + annotations: + nginx.ingress.kubernetes.io/proxy-connect-timeout: "30" + nginx.ingress.kubernetes.io/proxy-read-timeout: "1800" # Max time in seconds for ws to remain shell window open + nginx.ingress.kubernetes.io/proxy-send-timeout: "1800" # Max time in seconds for ws to remain shell window open + spec: + rules: + - host: rancher.yourdomain.com + http: + paths: + - backend: + serviceName: cattle-service + servicePort: 80 + tls: + - secretName: cattle-keys-ingress + hosts: + - rancher.yourdomain.com +``` + +Save the `.yml` file and close it. + +## 9. Back Up Your RKE Config File + +After you close your `.yml` file, back it up to a secure location. You can use this file again when it's time to upgrade Rancher. + +## 10. Run RKE + +With all configuration in place, use RKE to launch Rancher. You can complete this action by running the `rke up` command and using the `--config` parameter to point toward your config file. + +1. From your workstation, make sure `rancher-cluster.yml` and the downloaded `rke` binary are in the same directory. + +2. Open a Terminal instance. Change to the directory that contains your config file and `rke`. + +3. Enter one of the `rke up` commands listen below. + +``` +# MacOS +./rke_darwin-amd64 up --config rancher-cluster.yml +# Linux +./rke_linux-amd64 up --config rancher-cluster.yml +``` + +**Step Result:** The output should be similar to the snippet below: + +``` +INFO[0000] Building Kubernetes cluster +INFO[0000] [dialer] Setup tunnel for host [1.1.1.1] +INFO[0000] [network] Deploying port listener containers +INFO[0000] [network] Pulling image [alpine:latest] on host [1.1.1.1] +... +INFO[0101] Finished building Kubernetes cluster successfully +``` + +## 11. Back Up Auto-Generated Config File + +During installation, RKE automatically generates a config file named `kube_config_rancher-cluster.yml` in the same directory as the RKE binary. Copy this file and back it up to a safe location. You'll use this file later when upgrading Rancher Server. + +## What's Next? + +You have a couple of options: + +- Create a backup of your Rancher Server in case of a disaster scenario: [High Availablility Back Up and Restoration]({{< baseurl >}}/rancher/v2.x/en/installation/backups-and-restoration/ha-backup-and-restoration). +- Create a Kubernetes cluster: [Creating a Cluster]({{ }}/rancher/v2.x/en/tasks/clusters/creating-a-cluster/). + +
+ +## FAQ and Troubleshooting + +{{< ssl_faq_ha >}} diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install/nlb/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install/nlb/_index.md new file mode 100644 index 00000000000..bbdb1813d81 --- /dev/null +++ b/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install/nlb/_index.md @@ -0,0 +1,172 @@ +--- +title: Amazon NLB configuration +weight: 277 +--- +## Objectives + +Configuring an Amazon NLB is a multistage process. We've broken it down into multiple tasks so that it's easy to follow. + +1. [Create Target Groups](#create-target-groups) + + Begin by creating two target groups for the **TCP** protocol, one regarding TCP port 443 and one regarding TCP port 80 (providing redirect to TCP port 443). You'll add your Linux nodes to these groups. + +2. [Register Targets](#register-targets) + + Add your Linux nodes to the target groups. + +3. [Create Your NLB](#create-your-nlb) + + Use Amazon's Wizard to create an Network Load Balancer. As part of this process, you'll add the target groups you created in **1. Create Target Groups**. + + +## Create Target Groups + +Your first NLB configuration step is to create two target groups. Technically, only port 443 is needed to access Rancher, but its convenient to add a listener for port 80 which will be redirected to port 443 automatically. The NGINX controller on the nodes will make sure that port 80 gets redirected to port 443. + +Log into the [Amazon AWS Console](https://console.aws.amazon.com/ec2/) to get started, make sure to select the **Region** where your EC2 instances (Linux nodes) are created. + +The Target Groups configuration resides in the **Load Balancing** section of the **EC2** service. Select **Services** and choose **EC2**, find the section **Load Balancing** and open **Target Groups**. + +![EC2 Load Balancing section]({{< baseurl >}}/img/rancher/ha/nlb/ec2-loadbalancing.png) + +Click **Create target group** to create the first target group, regarding TCP port 443. + +### Target Group (TCP port 443) + +Configure the first target group according to the table below. Screenshots of the configuration are shown just below the table. + +Option | Setting +--------------------------------------|------------------------------------ +Target Group Name | `rancher-tcp-443` +Protocol | `TCP` +Port | `443` +Target type | `instance` +VPC | Choose your VPC +Protocol
(Health Check) | `HTTP` +Path
(Health Check) | `/healthz` +Port (Advanced health check) | `override`,`80` +Healthy threshold (Advanced health) | `3` +Unhealthy threshold (Advanced) | `3` +Timeout (Advanced) | `6 seconds` +Interval (Advanced) | `10 second` +Success codes | `200-399` + +
+**Screenshot Target group TCP port 443 settings**
+![Target group 443]({{< baseurl >}}/img/rancher/ha/nlb/create-targetgroup-443.png) + +
+**Screenshot Target group TCP port 443 Advanced settings**
+![Target group 443 Advanced]({{< baseurl >}}/img/rancher/ha/nlb/create-targetgroup-443-advanced.png) + +
+ +Click **Create target group** to create the second target group, regarding TCP port 80. + +### Target Group (TCP port 80) + +Configure the second target group according to the table below. Screenshots of the configuration are shown just below the table. + +Option | Setting +--------------------------------------|------------------------------------ +Target Group Name | `rancher-tcp-80` +Protocol | `TCP` +Port | `80` +Target type | `instance` +VPC | Choose your VPC +Protocol
(Health Check) | `HTTP` +Path
(Health Check) | `/healthz` +Port (Advanced health check) | `traffic port` +Healthy threshold (Advanced health) | `3` +Unhealthy threshold (Advanced) | `3` +Timeout (Advanced) | `6 seconds` +Interval (Advanced) | `10 second` +Success codes | `200-399` + +
+**Screenshot Target group TCP port 80 settings**
+![Target group 80]({{< baseurl >}}/img/rancher/ha/nlb/create-targetgroup-80.png) + +
+**Screenshot Target group TCP port 80 Advanced settings**
+![Target group 80 Advanced]({{< baseurl >}}/img/rancher/ha/nlb/create-targetgroup-80-advanced.png) + +
+ +## Register Targets + +Next, add your Linux nodes to both target groups. + +Select the target group named **rancher-tcp-443**, click the tab **Targets** and choose **Edit**. + +![Edit target group 443]({{< baseurl >}}/img/rancher/ha/nlb/edit-targetgroup-443.png) + +Select the instances (Linux nodes) you want to add, and click **Add to registered**. + +
+**Screenshot Add targets to target group TCP port 443**
+ +![Add targets to target group 443]({{< baseurl >}}/img/rancher/ha/nlb/add-targets-targetgroup-443.png) + +
+**Screenshot Added targets to target group TCP port 443**
+ +![Added targets to target group 443]({{< baseurl >}}/img/rancher/ha/nlb/added-targets-targetgroup-443.png) + +When the instances are added, click **Save** on the bottom right of the screen. + +Repeat those steps, replacing **rancher-tcp-443** with **rancher-tcp-80**. The same instances need to be added as targets to this target group. + +## Create Your NLB + +Use Amazon's Wizard to create an Network Load Balancer. As part of this process, you'll add the target groups you created in [Create Target Groups](#create-target-groups). + +1. From your web browser, navigate to the [Amazon EC2 Console](https://console.aws.amazon.com/ec2/). + +2. From the navigation pane, choose **LOAD BALANCING** > **Load Balancers**. + +3. Click **Create Load Balancer**. + +4. Choose **Network Load Balancer** and click **Create**. + +5. Complete the **Step 1: Configure Load Balancer** form. + - **Basic Configuration** + + - Name: `rancher` + - Scheme: `internet-facing` + - **Listeners** + + Add the **Load Balancer Protocols** and **Load Balancer Ports** below. + - `TCP`: `443` + + - **Availability Zones** + + - Select Your **VPC** and **Availability Zones**. + +6. Complete the **Step 2: Configure Routing** form. + + - From the **Target Group** drop-down, choose **Existing target group**. + + - From the **Name** drop-down, choose `rancher-tcp-443`. + + - Open **Advanced health check settings**, and configure **Interval** to `10 seconds`. + +7. Complete **Step 3: Register Targets**. Since you registered your targets earlier, all you have to do is click **Next: Review**. + +8. Complete **Step 4: Review**. Look over the load balancer details and click **Create** when you're satisfied. + +9. After AWS creates the NLB, click **Close**. + +## Add listener to NLB for TCP port 80 + +1. Select your newly created NLB and select the **Listeners** tab. + +2. Click **Add listener**. + +3. Use `TCP`:`80` as **Protocol** : **Port** + +4. Click **Add action** and choose **Forward to...** + +5. From the **Forward to** drop-down, choose `rancher-tcp-80`. + +6. Click **Save** in the top right of the screen. diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/404-default-backend/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/404-default-backend/_index.md new file mode 100644 index 00000000000..81140055fae --- /dev/null +++ b/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/404-default-backend/_index.md @@ -0,0 +1,40 @@ +--- +title: 404 - default backend +weight: 30 +--- + +To debug issues around this error, you will need to download the command-line tool `kubectl`. See [Install and Set Up kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) how to download `kubectl` for your platform. + +When you have made changes to `rancher-cluster.yml`, you will have to run `rke remove --config rancher-cluster.yml` to clean the nodes, so it cannot conflict with previous configuration errors. + +### Possible causes + +The nginx ingress controller is not able to serve the configured host in `rancher-cluster.yml`. This should be the FQDN you configured to access Rancher. You can check if it is properly configured by viewing the ingress that is created by running the following command: + +``` +kubectl --kubeconfig kube_config_rancher-cluster.yml get ingress -n cattle-system -o wide +``` + +Check if the `HOSTS` column is displaying the FQDN you configured in the template, and that the used nodes are listed in the `ADDRESS` column. If that is configured correctly, we can check the logging of the nginx ingress controller. + +The logging of the nginx ingress controller will show why it cannot serve the requested host. To view the logs, you can run the following command + +``` +kubectl --kubeconfig kube_config_rancher-cluster.yml logs -l app=ingress-nginx -n ingress-nginx +``` + +Errors + +* `x509: certificate is valid for fqdn, not your_configured_fqdn` + +The used certificates do not contain the correct hostname. Generate new certificates that contain the chosen FQDN to access Rancher and redeploy. + +* `Port 80 is already in use. Please check the flag --http-port` + +There is a process on the node occupying port 80, this port is needed for the nginx ingress controller to route requests to Rancher. You can find the process by running the command: `netstat -plant | grep \:80`. + +Stop/kill the process and redeploy. + +* `unexpected error creating pem file: no valid PEM formatted block found` + +The base64 encoded string configured in the template is not valid. Please check if you can decode the configured string using `base64 -D STRING`, this should return the same output as the content of the file you used to generate the string. If this is correct, please check if the base64 encoded string is placed directly after the key, without any newlines before, in between or after. (For example: `tls.crt: LS01..`) diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/_index.md new file mode 100644 index 00000000000..00ce37f6927 --- /dev/null +++ b/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/_index.md @@ -0,0 +1,24 @@ +--- +title: Troubleshooting High Availability Installation +weight: 370 +--- +This section contains common errors seen when setting up a High Availability Installation. + +Choose from the following options: + +- [Generic troubleshooting]({{< baseurl >}}/rancher/v2.x/en/installation/troubleshooting-ha/generic-troubleshooting) + + In this section, you can find generic ways to debug your Kubernetes cluster. + +- [Failed to set up SSH tunneling for host]({{< baseurl >}}/rancher/v2.x/en/installation/troubleshooting-ha/ssh-tunneling) + + In this section, you can find errors related to SSH tunneling when you run the `rke` command to setup your nodes. + +- [Failed to get job complete status]({{< baseurl >}}/rancher/v2.x/en/installation/troubleshooting-ha/job-complete-status) + + In this section, you can find errors related to deploying addons. + +- [404 - default backend]({{< baseurl >}}/rancher/v2.x/en/installation/troubleshooting-ha/404-default-backend) + + In this section, you can find errors related to the `404 - default backend` page that is shown when trying to access Rancher. + diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/generic-troubleshooting/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/generic-troubleshooting/_index.md new file mode 100644 index 00000000000..d1b696dfe42 --- /dev/null +++ b/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/generic-troubleshooting/_index.md @@ -0,0 +1,145 @@ +--- +title: Generic troubleshooting +weight: 5 +--- + +Below are steps that you can follow to determine what is wrong in your cluster. + +* Double check if all the required ports are opened in your (host) firewall + +Double check if all the [required ports]({{< baseurl >}}/rancher/v2.x/en/installation/references/) are opened in your (host) firewall. + +* All nodes should be present and in **Ready** state + +To check, run the command: + +``` +kubectl --kubeconfig kube_config_rancher-cluster.yml get nodes +``` + +If a node is not shown in this output or a node is not in **Ready** state, you can check the logging of the `kubelet` container. Login to the node and run `docker logs kubelet`. + +* All pods/jobs should be in **Running**/**Completed** state + +To check, run the command: + +``` +kubectl --kubeconfig kube_config_rancher-cluster.yml get pods --all-namespaces +``` + +If a pod is not in **Running** state, you can dig into the root cause by running: + +

Describe pod

+ +``` +kubectl --kubeconfig kube_config_rancher-cluster.yml describe pod POD_NAME -n NAMESPACE +``` + +

Pod container logs

+ +``` +kubectl --kubeconfig kube_config_rancher-cluster.yml logs POD_NAME -n NAMESPACE +``` + +If a job is not in **Completed** state, you can dig into the root cause by running: + +

Describe job

+ +``` +kubectl --kubeconfig kube_config_rancher-cluster.yml describe job JOB_NAME -n NAMESPACE +``` + +

Logs from the containers of pods of the job

+ +``` +kubectl --kubeconfig kube_config_rancher-cluster.yml logs -l job-name=JOB_NAME -n NAMESPACE +``` + +* List all Kubernetes cluster events + +Kubernetes cluster events are stored, and can be retrieved by running: + +``` +kubectl --kubeconfig kube_config_rancher-cluster.yml get events --all-namespaces +``` + +* Check Rancher container logging + +``` +kubectl --kubeconfig kube_config_rancher-cluster.yml logs -l app=cattle -n cattle-system +``` + +* Check NGINX ingress controller logging + +``` +kubectl --kubeconfig kube_config_rancher-cluster.yml logs -l app=ingress-nginx -n ingress-nginx +``` + +* Check if overlay network is functioning correctly + +The pod can be scheduled to any of the hosts you used for your cluster, but that means that the NGINX ingress controller needs to be able to route the request from `NODE_1` to `NODE_2`. This happens over the overlay network. If the overlay network is not functioning, you will experience intermittent TCP/HTTP connection failures due to the NGINX ingress controller not being able to route to the pod. + +To test the overlay network, you can launch the following `DaemonSet` definition. This will run an `alpine` container on every host, which we will use to run a `ping` test between containers on all hosts. + +1. Save the following file as `ds-alpine.yml` + + ``` + apiVersion: apps/v1 + kind: DaemonSet + metadata: + name: alpine + spec: + selector: + matchLabels: + name: alpine + template: + metadata: + labels: + name: alpine + spec: + tolerations: + - effect: NoExecute + key: "node-role.kubernetes.io/etcd" + value: "true" + - effect: NoSchedule + key: "node-role.kubernetes.io/controlplane" + value: "true" + containers: + - image: alpine + imagePullPolicy: Always + name: alpine + command: ["sh", "-c", "tail -f /dev/null"] + terminationMessagePath: /dev/termination-log + ``` + +2. Launch it using `kubectl --kubeconfig kube_config_rancher-cluster.yml create -f ds-alpine.yml` +3. Wait until `kubectl --kubeconfig kube_config_rancher-cluster.yml rollout status ds/alpine -w` returns: `daemon set "alpine" successfully rolled out`. +4. Run the following command to let each container on every host ping each other (it's a single line command). + + ``` + echo "=> Start"; kubectl --kubeconfig kube_config_rancher-cluster.yml get pods -l name=alpine -o jsonpath='{range .items[*]}{@.metadata.name}{" "}{@.spec.nodeName}{"\n"}{end}' | while read spod shost; do kubectl --kubeconfig kube_config_rancher-cluster.yml get pods -l name=alpine -o jsonpath='{range .items[*]}{@.status.podIP}{" "}{@.spec.nodeName}{"\n"}{end}' | while read tip thost; do kubectl --kubeconfig kube_config_rancher-cluster.yml --request-timeout='10s' exec $spod -- /bin/sh -c "ping -c2 $tip > /dev/null 2>&1"; RC=$?; if [ $RC -ne 0 ]; then echo $shost cannot reach $thost; fi; done; done; echo "=> End" + ``` + +5. When this command has finished running, the output indicating everything is correct is: + + ``` + => Start + => End + ``` + +If you see error in the output, that means that the [required ports]({{< baseurl >}}/rancher/v2.x/en/installation/references/) for overlay networking are not opened between the hosts indicated. + +Example error output of a situation where NODE1 had the UDP ports blocked. + +``` +=> Start +command terminated with exit code 1 +NODE2 cannot reach NODE1 +command terminated with exit code 1 +NODE3 cannot reach NODE1 +command terminated with exit code 1 +NODE1 cannot reach NODE2 +command terminated with exit code 1 +NODE1 cannot reach NODE3 +=> End +``` diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/job-complete-status/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/job-complete-status/_index.md new file mode 100644 index 00000000000..375a6387346 --- /dev/null +++ b/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/job-complete-status/_index.md @@ -0,0 +1,54 @@ +--- +title: Failed to get job complete status +weight: 20 +--- + +To debug issues around this error, you will need to download the command-line tool `kubectl`. See [Install and Set Up kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) how to download `kubectl` for your platform. + +When you have made changes to `rancher-cluster.yml`, you will have to run `rke remove --config rancher-cluster.yml` to clean the nodes, so it cannot conflict with previous configuration errors. + +### Failed to deploy addon execute job [rke-user-includes-addons]: Failed to get job complete status + +Something is wrong in the addons definitions, you can run the following command to get the root cause in the logging of the job: + +``` +kubectl --kubeconfig kube_config_rancher-cluster.yml logs -l job-name=rke-user-addon-deploy-job -n kube-system +``` + +#### error: error converting YAML to JSON: yaml: line 9: + +The structure of the addons definition in `rancher-cluster.yml` is wrong. In the different resources specified in the addons section, there is a error in the structure of the YAML. The pointer `yaml line 9` references to the line number of the addon that is causing issues. + +Things to check +
    +
      +
    • Is each of the base64 encoded certificate string placed directly after the key, for example: `tls.crt: LS01...`, there should be no newline/space before, in between or after.
      • +
    • Is the YAML properly formatted, each indentation should be 2 spaces as shown in the template files.
      • +
    • Verify the integrity of your certificate by running this command `cat MyCertificate | base64 -d` on Linux, `cat MyCertificate | base64 -D` on Mac OS . If any error exists, the command output will tell you. +
    +
+ +#### Error from server (BadRequest): error when creating "/etc/config/rke-user-addon.yaml": Secret in version "v1" cannot be handled as a Secret + +The base64 string of one of the certificate strings is wrong. The log message will try to show you what part of the string is not recognized as valid base64. + +Things to check +
    +
      +
    • Check if the base64 string is valid by running one of the commands below:
      • + +``` +# MacOS +echo BASE64_CRT | base64 -D +# Linux +echo BASE64_CRT | base64 -d +# Windows +certutil -decode FILENAME.base64 FILENAME.verify +``` + +
    +
+ +#### The Ingress "cattle-ingress-http" is invalid: spec.rules[0].host: Invalid value: "IP": must be a DNS name, not an IP address + +The host value can only contain a host name, as it is needed by the ingress controller to match the hostname and pass to the correct backend. diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/ssh-tunneling/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/ssh-tunneling/_index.md new file mode 100644 index 00000000000..ee6573f52ed --- /dev/null +++ b/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/ssh-tunneling/_index.md @@ -0,0 +1,42 @@ +--- +title: Failed to set up SSH tunneling for host +weight: 10 +--- + +### Failed to set up SSH tunneling for host [xxx.xxx.xxx.xxx]: Can't retrieve Docker Info + +#### Failed to dial to /var/run/docker.sock: ssh: rejected: administratively prohibited (open failed) + +* User specified to connect with does not have permission to access the Docker socket. This can be checked by logging into the host and running the command `docker ps`: + +``` +$ ssh user@server +user@server$ docker ps +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +``` + +See [Manage Docker as a non-root user](https://docs.docker.com/install/linux/linux-postinstall/#manage-docker-as-a-non-root-user) how to set this up properly. + +* When using RedHat/CentOS as operating system, you cannot use the user `root` to connect to the nodes because of [Bugzilla #1527565](https://bugzilla.redhat.com/show_bug.cgi?id=1527565). You will need to add a separate user and configure it to access the Docker socket. See [Manage Docker as a non-root user](https://docs.docker.com/install/linux/linux-postinstall/#manage-docker-as-a-non-root-user) how to set this up properly. + +* SSH server version is not version 6.7 or higher. This is needed for socket forwarding to work, which is used to connect to the Docker socket over SSH. This can be checked using `sshd -V` on the host you are connecting to, or using netcat: +``` +$ nc xxx.xxx.xxx.xxx 22 +SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.10 +``` + +#### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: Error configuring SSH: ssh: no key found + +* The key file specified as `ssh_key_path` cannot be accessed. Make sure that you specified the private key file (not the public key, `.pub`), and that the user that is running the `rke` command can access the private key file. + +#### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain + +* The key file specified as `ssh_key_path` is not correct for accesing the node. Double-check if you specified the correct `ssh_key_path` for the node and if you specified the correct user to connect with. + +#### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: Error configuring SSH: ssh: cannot decode encrypted private keys + +* If you want to use encrypted private keys, you should use `ssh-agent` to load your keys with your passphrase. If the `SSH_AUTH_SOCK` environment variable is found in the environment where the `rke` command is run, it will be used automatically to connect to the node. + +#### Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running? + +* The node is not reachable on the configured `address` and `port`. diff --git a/content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/_index.md b/content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/_index.md new file mode 100644 index 00000000000..c221c221a90 --- /dev/null +++ b/content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/_index.md @@ -0,0 +1,4 @@ +--- +title: Advanced Install Options +weight: 250 +--- \ No newline at end of file diff --git a/content/rancher/v2.x/en/installation/air-gap-installation/_index.md b/content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/air-gap-installation/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/air-gap-installation/_index.md rename to content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/air-gap-installation/_index.md diff --git a/content/rancher/v2.x/en/installation/proxy-configuration/_index.md b/content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/proxy-configuration/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/proxy-configuration/_index.md rename to content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/proxy-configuration/_index.md diff --git a/content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md b/content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/single-node-install-external-lb/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md rename to content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/single-node-install-external-lb/_index.md From e9363c7a65904eba129dc45cea0c60f6362bc8cb Mon Sep 17 00:00:00 2001 From: Jason Greathouse Date: Tue, 17 Jul 2018 09:38:21 +1000 Subject: [PATCH 09/18] add aliases and check links --- content/rancher/v2.x/en/installation/_index.md | 2 +- .../_index.md | 2 +- .../create-nodes-and-load-balancer/_index.md | 0 .../create-nodes-and-load-balancer/nlb/_index.md | 0 .../helm-install/_index.md | 2 +- .../install-kubernetes-rke/_index.md | 0 .../troubleshooting/_index.md | 0 .../_index.md | 4 ++-- .../rancher-install/_index.md | 1 + .../rancher-install/chart-options/_index.md | 0 .../rancher-install/tls-secrets/_index.md | 0 .../rancher-install/troubleshooting/_index.md | 0 .../rke-all-in-one-install/_index.md | 0 .../ha-server-install-external-lb/_index.md | 8 +++++--- .../ha-server-install-external-lb/alb/_index.md | 2 ++ .../nginx/_index.md | 2 ++ .../ha-server-install/_index.md | 4 +++- .../ha-server-install/nlb/_index.md | 2 ++ .../404-default-backend/_index.md | 2 ++ .../troubleshooting-ha/_index.md | 11 ++++++----- .../generic-troubleshooting/_index.md | 4 +++- .../job-complete-status/_index.md | 2 ++ .../troubleshooting-ha/ssh-tunneling/_index.md | 2 ++ .../installation/single-node-install/_index.md | 16 ++++------------ .../advanced-install-options/_index.md | 6 +++++- .../air-gap-installation/_index.md | 2 ++ .../proxy-configuration/_index.md | 2 ++ .../single-node-install-external-lb/_index.md | 6 ++++-- 28 files changed, 52 insertions(+), 30 deletions(-) rename content/rancher/v2.x/en/installation/{ha-server-install => ha-server-install-helm}/_index.md (96%) rename content/rancher/v2.x/en/installation/{ha-server-install => ha-server-install-helm}/create-nodes-and-load-balancer/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-server-install => ha-server-install-helm}/create-nodes-and-load-balancer/nlb/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-server-install => ha-server-install-helm}/helm-install/_index.md (96%) rename content/rancher/v2.x/en/installation/{ha-server-install => ha-server-install-helm}/install-kubernetes-rke/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-server-install => ha-server-install-helm}/install-kubernetes-rke/troubleshooting/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-server-install => ha-server-install-helm}/migrating-from-rke-all-in-one-install/_index.md (95%) rename content/rancher/v2.x/en/installation/{ha-server-install => ha-server-install-helm}/rancher-install/_index.md (97%) rename content/rancher/v2.x/en/installation/{ha-server-install => ha-server-install-helm}/rancher-install/chart-options/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-server-install => ha-server-install-helm}/rancher-install/tls-secrets/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-server-install => ha-server-install-helm}/rancher-install/troubleshooting/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-server-install => ha-server-install-helm}/rke-all-in-one-install/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-server-install => ha-server-install-helm}/rke-all-in-one-install/ha-server-install-external-lb/_index.md (98%) rename content/rancher/v2.x/en/installation/{ha-server-install => ha-server-install-helm}/rke-all-in-one-install/ha-server-install-external-lb/alb/_index.md (97%) rename content/rancher/v2.x/en/installation/{ha-server-install => ha-server-install-helm}/rke-all-in-one-install/ha-server-install-external-lb/nginx/_index.md (97%) rename content/rancher/v2.x/en/installation/{ha-server-install => ha-server-install-helm}/rke-all-in-one-install/ha-server-install/_index.md (99%) rename content/rancher/v2.x/en/installation/{ha-server-install => ha-server-install-helm}/rke-all-in-one-install/ha-server-install/nlb/_index.md (99%) rename content/rancher/v2.x/en/installation/{ha-server-install => ha-server-install-helm}/rke-all-in-one-install/troubleshooting-ha/404-default-backend/_index.md (96%) rename content/rancher/v2.x/en/installation/{ha-server-install => ha-server-install-helm}/rke-all-in-one-install/troubleshooting-ha/_index.md (55%) rename content/rancher/v2.x/en/installation/{ha-server-install => ha-server-install-helm}/rke-all-in-one-install/troubleshooting-ha/generic-troubleshooting/_index.md (98%) rename content/rancher/v2.x/en/installation/{ha-server-install => ha-server-install-helm}/rke-all-in-one-install/troubleshooting-ha/job-complete-status/_index.md (96%) rename content/rancher/v2.x/en/installation/{ha-server-install => ha-server-install-helm}/rke-all-in-one-install/troubleshooting-ha/ssh-tunneling/_index.md (97%) diff --git a/content/rancher/v2.x/en/installation/_index.md b/content/rancher/v2.x/en/installation/_index.md index bcb93810982..1c6f3ecf56f 100644 --- a/content/rancher/v2.x/en/installation/_index.md +++ b/content/rancher/v2.x/en/installation/_index.md @@ -10,7 +10,7 @@ This section contains instructions for installing Rancher in development and pro Install Rancher on a single Linux host. -- [High Availability Installation](ha-server-install/) +- [High Availability Installation](ha-server-install-helm/) This install scenario creates a new Kubernetes cluster dedicated to running Rancher Server in a high-availability (HA) configuration. diff --git a/content/rancher/v2.x/en/installation/ha-server-install/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-helm/_index.md similarity index 96% rename from content/rancher/v2.x/en/installation/ha-server-install/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install-helm/_index.md index 84e8627571a..b61fc421174 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install-helm/_index.md @@ -30,6 +30,6 @@ The following CLI tools are required for this install. Please make sure these to ## Installation Outline 1. [Create Nodes and Load Balancer](create-nodes-and-load-balancer/) -1. [Install Kubernetes with RKE](install-kubernetese-rke/) +1. [Install Kubernetes with RKE](install-kubernetes-rke/) 1. [Initialize Helm (tiller)](helm-install/) 1. [Install Rancher](rancher-install/) diff --git a/content/rancher/v2.x/en/installation/ha-server-install/create-nodes-and-load-balancer/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-helm/create-nodes-and-load-balancer/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-server-install/create-nodes-and-load-balancer/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install-helm/create-nodes-and-load-balancer/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install/create-nodes-and-load-balancer/nlb/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-helm/create-nodes-and-load-balancer/nlb/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-server-install/create-nodes-and-load-balancer/nlb/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install-helm/create-nodes-and-load-balancer/nlb/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install/helm-install/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-helm/helm-install/_index.md similarity index 96% rename from content/rancher/v2.x/en/installation/ha-server-install/helm-install/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install-helm/helm-install/_index.md index d806c58e947..5b5192d6675 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install/helm-install/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install-helm/helm-install/_index.md @@ -21,7 +21,7 @@ kubectl create clusterrolebinding tiller --clusterrole cluster-admin --serviceac
Additional steps for Air Gap/Private Registry

-If you have an Air Gapped network extra configuration will be required. +If you have an Air Gapped network you will need the tiller image available in your private registry. ##### Create registry secret diff --git a/content/rancher/v2.x/en/installation/ha-server-install/install-kubernetes-rke/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-helm/install-kubernetes-rke/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-server-install/install-kubernetes-rke/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install-helm/install-kubernetes-rke/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install/install-kubernetes-rke/troubleshooting/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-helm/install-kubernetes-rke/troubleshooting/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-server-install/install-kubernetes-rke/troubleshooting/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install-helm/install-kubernetes-rke/troubleshooting/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install/migrating-from-rke-all-in-one-install/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-helm/migrating-from-rke-all-in-one-install/_index.md similarity index 95% rename from content/rancher/v2.x/en/installation/ha-server-install/migrating-from-rke-all-in-one-install/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install-helm/migrating-from-rke-all-in-one-install/_index.md index f64b13048e6..b79def6577d 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install/migrating-from-rke-all-in-one-install/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install-helm/migrating-from-rke-all-in-one-install/_index.md @@ -31,14 +31,14 @@ kubectl -n cattle-system get secret cattle-keys-ingress -o jsonpath --template=' If you specified a private CA root cert ``` -kubectl -n cattle-system get secret cattle-keys-server -o jsonpath --template='{ .data.cacerts\.pem }' | base64 -d > tls.crt +kubectl -n cattle-system get secret cattle-keys-server -o jsonpath --template='{ .data.cacerts\.pem }' | base64 -d > cacerts.pem ``` ### Remove previous Kubernetes objects Remove the kubernetes objects created by the RKE install. -> NOTE: Removing these Kubernetes components will not affect the Rancher configuration or database, but with any maintenance it is a good idea to create a backup of the data before hand. See [Creating Backups-HA Install]({{< baseurl >}}/rancher/v2.x/en/backups/ha-backups) for details. +> NOTE: Removing these Kubernetes components will not affect the Rancher configuration or database, but with any maintenance it is a good idea to create a backup of the data before hand. See [Creating Backups-HA Install]({{< baseurl >}}/rancher/v2.x/en/backups/backups/ha-backups) for details. ``` kubectl -n cattle-system delete ingress cattle-ingress-http diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rancher-install/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-helm/rancher-install/_index.md similarity index 97% rename from content/rancher/v2.x/en/installation/ha-server-install/rancher-install/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install-helm/rancher-install/_index.md index 2fae0a6fae5..44589fdf7d7 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install/rancher-install/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install-helm/rancher-install/_index.md @@ -84,6 +84,7 @@ Now that Rancher is running, see [Adding TLS Secrets](tls-secrets/) to publish t The Rancher chart configuration has many options for customizing the install to suit your specific environment. Here are some common advanced scenarios. * [Private Docker Image Registry/Air Gap Network](chart-options/#private-or-air-gap-registry) +* [TLS Termination on an External Load Balancer](chart-options/#external-tls-termination) See the [Chart Options](chart-options/) for the full list of options. diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rancher-install/chart-options/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-helm/rancher-install/chart-options/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-server-install/rancher-install/chart-options/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install-helm/rancher-install/chart-options/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rancher-install/tls-secrets/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-helm/rancher-install/tls-secrets/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-server-install/rancher-install/tls-secrets/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install-helm/rancher-install/tls-secrets/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rancher-install/troubleshooting/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-helm/rancher-install/troubleshooting/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-server-install/rancher-install/troubleshooting/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install-helm/rancher-install/troubleshooting/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install-external-lb/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/ha-server-install-external-lb/_index.md similarity index 98% rename from content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install-external-lb/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/ha-server-install-external-lb/_index.md index 868ce25ae97..b48e1dca8ee 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install-external-lb/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/ha-server-install-external-lb/_index.md @@ -1,6 +1,8 @@ --- title: High Availability Installation with External Load Balancer (HTTPS/Layer 7) weight: 276 +aliases: +- /rancher/v2.x/en/installation/ha-server-install-external-lb/ --- This set of instructions creates a new Kubernetes cluster that's dedicated to running Rancher in a high-availability (HA) configuration. This procedure walks you through setting up a 3-node cluster using the Rancher Kubernetes Engine (RKE). The cluster's sole purpose is running pods for Rancher. The setup is based on: @@ -105,8 +107,8 @@ Health checks can be executed on the `/healthz` endpoint of the node, this will We have example configurations for the following load balancers: -* [Amazon ALB configuration]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install-external-lb/alb) -* [NGINX configuration]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install-external-lb/nginx) +* [Amazon ALB configuration](alb/) +* [NGINX configuration](nginx/) ## 3. Configure DNS @@ -327,7 +329,7 @@ During installation, RKE automatically generates a config file named `kube_confi You have a couple of options: -- Create a backup of your Rancher Server in case of a disaster scenario: [High Availablility Back Up and Restoration]({{< baseurl >}}/rancher/v2.x/en/installation/backups-and-restoration/ha-backup-and-restoration). +- Create a backup of your Rancher Server in case of a disaster scenario: [High Availablility Back Up and Restoration]({{< baseurl >}}/rancher/v2.x/en/backups/ha-backups/). - Create a Kubernetes cluster: [Creating a Cluster]({{< baseurl >}}/rancher/v2.x/en/tasks/clusters/creating-a-cluster/).
diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install-external-lb/alb/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/ha-server-install-external-lb/alb/_index.md similarity index 97% rename from content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install-external-lb/alb/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/ha-server-install-external-lb/alb/_index.md index 424d35bdd3f..bc96496e99e 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install-external-lb/alb/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/ha-server-install-external-lb/alb/_index.md @@ -1,6 +1,8 @@ --- title: Amazon ALB configuration weight: 277 +aliases: +- /rancher/v2.x/en/installation/ha-server-install-external-lb/alb/ --- ## Objectives diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install-external-lb/nginx/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/ha-server-install-external-lb/nginx/_index.md similarity index 97% rename from content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install-external-lb/nginx/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/ha-server-install-external-lb/nginx/_index.md index 20579aa96b8..02e01d3960c 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install-external-lb/nginx/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/ha-server-install-external-lb/nginx/_index.md @@ -1,6 +1,8 @@ --- title: NGINX configuration weight: 277 +aliases: +- /rancher/v2.x/en/installation/ha-server-install-external-lb/nginx/ --- ## Install NGINX diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/ha-server-install/_index.md similarity index 99% rename from content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/ha-server-install/_index.md index efd0a46a5ec..188cfc6f909 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/ha-server-install/_index.md @@ -1,6 +1,8 @@ --- title: High Availability Installation with External Load Balancer (TCP/Layer 4) weight: 275 +aliases: +- /rancher/v2.x/en/installation/ha-server-install/ --- This set of instructions creates a new Kubernetes cluster that's dedicated to running Rancher in a high-availability (HA) configuration. This procedure walks you through setting up a 3-node cluster using the Rancher Kubernetes Engine (RKE). The cluster's sole purpose is running pods for Rancher. The setup is based on: @@ -425,7 +427,7 @@ During installation, RKE automatically generates a config file named `kube_confi You have a couple of options: -- Create a backup of your Rancher Server in case of a disaster scenario: [High Availablility Back Up and Restoration]({{< baseurl >}}/rancher/v2.x/en/installation/backups-and-restoration/ha-backup-and-restoration). +- Create a backup of your Rancher Server in case of a disaster scenario: [High Availablility Back Up and Restoration]({{< baseurl >}}/rancher/v2.x/en/installation/backups/restorations/ha-restoration). - Create a Kubernetes cluster: [Creating a Cluster]({{ }}/rancher/v2.x/en/tasks/clusters/creating-a-cluster/).
diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install/nlb/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/ha-server-install/nlb/_index.md similarity index 99% rename from content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install/nlb/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/ha-server-install/nlb/_index.md index bbdb1813d81..f2eebef4170 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/ha-server-install/nlb/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/ha-server-install/nlb/_index.md @@ -1,6 +1,8 @@ --- title: Amazon NLB configuration weight: 277 +aliases: +- /rancher/v2.x/en/installation/ha-server-install/nlb/ --- ## Objectives diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/404-default-backend/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/troubleshooting-ha/404-default-backend/_index.md similarity index 96% rename from content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/404-default-backend/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/troubleshooting-ha/404-default-backend/_index.md index 81140055fae..78bbfc446b6 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/404-default-backend/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/troubleshooting-ha/404-default-backend/_index.md @@ -1,6 +1,8 @@ --- title: 404 - default backend weight: 30 +aliases: +- /rancher/v2.x/en/installation/troubleshooting-ha/404-default-backend/ --- To debug issues around this error, you will need to download the command-line tool `kubectl`. See [Install and Set Up kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) how to download `kubectl` for your platform. diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/troubleshooting-ha/_index.md similarity index 55% rename from content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/troubleshooting-ha/_index.md index 00ce37f6927..7023eb3dfbe 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/troubleshooting-ha/_index.md @@ -1,24 +1,25 @@ --- title: Troubleshooting High Availability Installation weight: 370 +aliases: +- /rancher/v2.x/en/installation/troubleshooting-ha/ --- This section contains common errors seen when setting up a High Availability Installation. Choose from the following options: -- [Generic troubleshooting]({{< baseurl >}}/rancher/v2.x/en/installation/troubleshooting-ha/generic-troubleshooting) +- [Generic troubleshooting](generic-troubleshooting/) In this section, you can find generic ways to debug your Kubernetes cluster. -- [Failed to set up SSH tunneling for host]({{< baseurl >}}/rancher/v2.x/en/installation/troubleshooting-ha/ssh-tunneling) +- [Failed to set up SSH tunneling for host](ssh-tunneling/) In this section, you can find errors related to SSH tunneling when you run the `rke` command to setup your nodes. -- [Failed to get job complete status]({{< baseurl >}}/rancher/v2.x/en/installation/troubleshooting-ha/job-complete-status) +- [Failed to get job complete status](job-complete-status/) In this section, you can find errors related to deploying addons. -- [404 - default backend]({{< baseurl >}}/rancher/v2.x/en/installation/troubleshooting-ha/404-default-backend) +- [404 - default backend](404-default-backend/) In this section, you can find errors related to the `404 - default backend` page that is shown when trying to access Rancher. - diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/generic-troubleshooting/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/troubleshooting-ha/generic-troubleshooting/_index.md similarity index 98% rename from content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/generic-troubleshooting/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/troubleshooting-ha/generic-troubleshooting/_index.md index d1b696dfe42..5790d6a0c23 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/generic-troubleshooting/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/troubleshooting-ha/generic-troubleshooting/_index.md @@ -1,6 +1,8 @@ --- title: Generic troubleshooting -weight: 5 +weight: 5 +aliases: +- /rancher/v2.x/en/installation/troubleshooting-ha/generic-troubleshooting/ --- Below are steps that you can follow to determine what is wrong in your cluster. diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/job-complete-status/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/troubleshooting-ha/job-complete-status/_index.md similarity index 96% rename from content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/job-complete-status/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/troubleshooting-ha/job-complete-status/_index.md index 375a6387346..eaec014af2d 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/job-complete-status/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/troubleshooting-ha/job-complete-status/_index.md @@ -1,6 +1,8 @@ --- title: Failed to get job complete status weight: 20 +aliases: +- /rancher/v2.x/en/installation/troubleshooting-ha/job-complete-status/ --- To debug issues around this error, you will need to download the command-line tool `kubectl`. See [Install and Set Up kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) how to download `kubectl` for your platform. diff --git a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/ssh-tunneling/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/troubleshooting-ha/ssh-tunneling/_index.md similarity index 97% rename from content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/ssh-tunneling/_index.md rename to content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/troubleshooting-ha/ssh-tunneling/_index.md index ee6573f52ed..d9e2d477628 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install/rke-all-in-one-install/troubleshooting-ha/ssh-tunneling/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/troubleshooting-ha/ssh-tunneling/_index.md @@ -1,6 +1,8 @@ --- title: Failed to set up SSH tunneling for host weight: 10 +aliases: +- /rancher/v2.x/en/installation/troubleshooting-ha/ssh-tunneling/ --- ### Failed to set up SSH tunneling for host [xxx.xxx.xxx.xxx]: Can't retrieve Docker Info diff --git a/content/rancher/v2.x/en/installation/single-node-install/_index.md b/content/rancher/v2.x/en/installation/single-node-install/_index.md index eb24c5085a3..feefc33e4b8 100644 --- a/content/rancher/v2.x/en/installation/single-node-install/_index.md +++ b/content/rancher/v2.x/en/installation/single-node-install/_index.md @@ -4,11 +4,8 @@ weight: 250 --- For development environments, we recommend installing Rancher by running a single Docker container. In this installation scenario, you'll install Docker on a single Linux host, and then install Rancher on your host using a single Docker container. - >**Want to use an external load balancer?** -> See [Single Node Installation with an External Load Balancer]({{< baseurl >}}/rancher/v2.x/en/installation/single-node-install-external-lb) instead. - - +> See [Single Node Installation with an External Load Balancer](advanced-install-options/single-node-install-external-lb) instead. ## Installation Outline @@ -28,15 +25,15 @@ Provision a single Linux host to launch your {{< product >}} Server. ### Requirements -#### Operating System +#### Operating System {{< requirements_os >}} -#### Hardware +#### Hardware {{< requirements_hardware >}} -#### Software +#### Software {{< requirements_software >}} @@ -81,8 +78,6 @@ If you install Rancher without using your own certificate, Rancher generates a s rancher/rancher:latest ``` - - ### Option B—Bring Your Own Certificate: Self-Signed Your Rancher install can use a self-signed certificate that you provide to encrypt communications. @@ -93,7 +88,6 @@ Your Rancher install can use a self-signed certificate that you provide to encry >- The certificate files must be in [PEM format](#pem). >- In your certificate file, include all intermediate certificates in the chain. Order your certificates with your certificate first, followed by the intermediates. For an example, see [SSL FAQ / Troubleshooting](#cert-order). - **To Install Rancher Using a Self-Signed Cert:** Your Rancher install can use a self-signed certificate that you provide to encrypt communications. @@ -163,7 +157,6 @@ Run the following commands from your Linux host. --acme-domain rancher.mydomain.com ``` - > >**Remember:** Let's Encrypt provides rate limits for requesting new certificates. Therefore, limit how often you create or destroy the container. For more information, see [Let's Encrypt documentation on rate limits](https://letsencrypt.org/docs/rate-limits/). @@ -199,4 +192,3 @@ docker run -d --restart=unless-stopped \ -p 8080:80 -p 8443:443 \ rancher/rancher:latest ``` - diff --git a/content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/_index.md b/content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/_index.md index c221c221a90..a2e251d49c4 100644 --- a/content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/_index.md +++ b/content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/_index.md @@ -1,4 +1,8 @@ --- title: Advanced Install Options weight: 250 ---- \ No newline at end of file +--- + +* [Air Gap Installation](air-gap-installation) +* [HTTP/S Proxy Configuration](proxy-configuration) +* [Using an External Load Balancer](single-node-install-external-lb) \ No newline at end of file diff --git a/content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/air-gap-installation/_index.md b/content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/air-gap-installation/_index.md index a65c2d4614e..df38b9ca48a 100644 --- a/content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/air-gap-installation/_index.md +++ b/content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/air-gap-installation/_index.md @@ -1,6 +1,8 @@ --- title: Air Gap Installation weight: 345 +aliases: +- /rancher/v2.x/en/installation/air-gap-installation/ --- Rancher supports installing from a private registry. In every [release](https://github.com/rancher/rancher/releases), we provide you with the needed Docker images and scripts to mirror those images to your own registry. The Docker images are used when nodes are added to a cluster, or when you enable features like pipelines or logging. diff --git a/content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/proxy-configuration/_index.md b/content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/proxy-configuration/_index.md index 4656ad38022..79572a0274d 100644 --- a/content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/proxy-configuration/_index.md +++ b/content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/proxy-configuration/_index.md @@ -1,6 +1,8 @@ --- title: Rancher HTTP Proxy Configuration weight: 360 +aliases: +- /rancher/v2.x/en/installation/proxy-configuration/ --- If you operate Rancher behind a proxy and you need to reach the Internet to perform tasks (such as using Helm catalogs), you must provide Rancher information about your proxy. diff --git a/content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/single-node-install-external-lb/_index.md b/content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/single-node-install-external-lb/_index.md index 54eeed48a4f..cdd34be43a5 100644 --- a/content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/single-node-install-external-lb/_index.md +++ b/content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/single-node-install-external-lb/_index.md @@ -1,6 +1,8 @@ --- title: Single Node Installation with External Load Balancer weight: 260 +aliases: +- /rancher/v2.x/en/installation/single-node-install-external-lb/ --- For development environments, we recommend installing Rancher by running a single Docker container. In this installation scenario, you'll deploy Rancher to a Linux host using a single Docker container. Then you will configure an external load balancer to work with Rancher. @@ -58,7 +60,7 @@ The following diagram depicts the basic port requirements for Rancher. For a com For security purposes, SSL (Secure Sockets Layer) is required when using Rancher. SSL secures all Rancher network communication, like when you login or interact with a cluster. >**Attention Air Gap Users:** -> If you are visiting this page to complete [Air Gap Installation]({{< baseurl >}}/rancher/v2.x/en/installation/air-gap-installation/), you must prepend your private registry URL to the server tag when running the installation command in the option that you choose. Replace `` with your private registry URL. +> If you are visiting this page to complete [Air Gap Installation](../air-gap-installation/), you must prepend your private registry URL to the server tag when running the installation command in the option that you choose. Replace `` with your private registry URL. > > Example: ``` @@ -173,7 +175,7 @@ server { ## What's Next? You have a couple of options: -- Create a backup of your Rancher Server in case of a disaster scenario: [Single Node Backup and Restoration]({{< baseurl >}}/rancher/v2.x/en/installation/backups-and-restoration/single-node-backup-and-restoration/). +- Create a backup of your Rancher Server in case of a disaster scenario: [Single Node Backup and Restoration]({{< baseurl >}}/rancher/v2.x/en/installation/backups/single-node-backups/). - Create a Kubernetes cluster: [Creating a Cluster]({{< baseurl >}}/rancher/v2.x/en/tasks/clusters/creating-a-cluster/).
From dda6aa514588a6f7f4b9deb758765cf74c3af75a Mon Sep 17 00:00:00 2001 From: Jason Greathouse Date: Wed, 18 Jul 2018 11:23:39 +1000 Subject: [PATCH 10/18] clean up dir names, add ports shortcode, typos and fixes --- .../_index.md | 19 ++++--- .../create-nodes-lb}/_index.md | 23 +------- .../create-nodes-lb}/nlb/_index.md | 0 .../helm-init}/_index.md | 2 +- .../helm-rancher-install}/_index.md | 0 .../chart-options/_index.md | 2 + .../tls-secrets/_index.md | 0 .../troubleshooting/_index.md | 0 .../install-kubernetes-rke/_index.md | 2 +- .../troubleshooting/_index.md | 0 .../migrating-from-rke-all-in-one}/_index.md | 4 +- .../rke-all-in-one}/_index.md | 6 +- .../install-layer-4-lb}/_index.md | 0 .../install-layer-4-lb}/nlb/_index.md | 0 .../install-layer-7-lb}/_index.md | 0 .../install-layer-7-lb}/alb/_index.md | 0 .../install-layer-7-lb}/nginx/_index.md | 0 .../404-default-backend/_index.md | 0 .../rke-all-in-one/troubleshooting}/_index.md | 0 .../generic-troubleshooting/_index.md | 0 .../job-complete-status/_index.md | 0 .../troubleshooting}/ssh-tunneling/_index.md | 0 .../requirements_ports_rancher_rke.html | 57 +++++++++++++++++++ 23 files changed, 80 insertions(+), 35 deletions(-) rename content/rancher/v2.x/en/installation/{ha-server-install-helm => ha-install}/_index.md (69%) rename content/rancher/v2.x/en/installation/{ha-server-install-helm/create-nodes-and-load-balancer => ha-install/create-nodes-lb}/_index.md (58%) rename content/rancher/v2.x/en/installation/{ha-server-install-helm/create-nodes-and-load-balancer => ha-install/create-nodes-lb}/nlb/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-server-install-helm/helm-install => ha-install/helm-init}/_index.md (97%) rename content/rancher/v2.x/en/installation/{ha-server-install-helm/rancher-install => ha-install/helm-rancher-install}/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-server-install-helm/rancher-install => ha-install/helm-rancher-install}/chart-options/_index.md (93%) rename content/rancher/v2.x/en/installation/{ha-server-install-helm/rancher-install => ha-install/helm-rancher-install}/tls-secrets/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-server-install-helm/rancher-install => ha-install/helm-rancher-install}/troubleshooting/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-server-install-helm => ha-install}/install-kubernetes-rke/_index.md (98%) rename content/rancher/v2.x/en/installation/{ha-server-install-helm => ha-install}/install-kubernetes-rke/troubleshooting/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-server-install-helm/migrating-from-rke-all-in-one-install => ha-install/migrating-from-rke-all-in-one}/_index.md (95%) rename content/rancher/v2.x/en/installation/{ha-server-install-helm/rke-all-in-one-install => ha-install/rke-all-in-one}/_index.md (71%) rename content/rancher/v2.x/en/installation/{ha-server-install-helm/rke-all-in-one-install/ha-server-install => ha-install/rke-all-in-one/install-layer-4-lb}/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-server-install-helm/rke-all-in-one-install/ha-server-install => ha-install/rke-all-in-one/install-layer-4-lb}/nlb/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-server-install-helm/rke-all-in-one-install/ha-server-install-external-lb => ha-install/rke-all-in-one/install-layer-7-lb}/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-server-install-helm/rke-all-in-one-install/ha-server-install-external-lb => ha-install/rke-all-in-one/install-layer-7-lb}/alb/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-server-install-helm/rke-all-in-one-install/ha-server-install-external-lb => ha-install/rke-all-in-one/install-layer-7-lb}/nginx/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-server-install-helm/rke-all-in-one-install/troubleshooting-ha => ha-install/rke-all-in-one/troubleshooting}/404-default-backend/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-server-install-helm/rke-all-in-one-install/troubleshooting-ha => ha-install/rke-all-in-one/troubleshooting}/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-server-install-helm/rke-all-in-one-install/troubleshooting-ha => ha-install/rke-all-in-one/troubleshooting}/generic-troubleshooting/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-server-install-helm/rke-all-in-one-install/troubleshooting-ha => ha-install/rke-all-in-one/troubleshooting}/job-complete-status/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-server-install-helm/rke-all-in-one-install/troubleshooting-ha => ha-install/rke-all-in-one/troubleshooting}/ssh-tunneling/_index.md (100%) create mode 100644 layouts/shortcodes/requirements_ports_rancher_rke.html diff --git a/content/rancher/v2.x/en/installation/ha-server-install-helm/_index.md b/content/rancher/v2.x/en/installation/ha-install/_index.md similarity index 69% rename from content/rancher/v2.x/en/installation/ha-server-install-helm/_index.md rename to content/rancher/v2.x/en/installation/ha-install/_index.md index b61fc421174..a638152eecf 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install-helm/_index.md +++ b/content/rancher/v2.x/en/installation/ha-install/_index.md @@ -6,16 +6,16 @@ draft: true When installed as a Deployment in a Kubernetes cluster, Rancher will take integrate with the cluster's etcd database and Kubernetes scheduling for High-Availability. -This procedure walks you through setting up a 3-node cluster with RKE and installing the Rancher chart the Helm package manager. +This procedure walks you through setting up a 3-node cluster with RKE and installing the Rancher chart with the Helm package manager. -> NOTE: For the best performance, we recommend this Kubernetes cluster be dedicated only the Rancher workload. +> NOTE: For the best performance, we recommend this Kubernetes cluster is dedicated to only the Rancher workload. ## Recommended Architecture * DNS for Rancher should resolve to a Layer 4 Load Balancer * The Load Balancer should forward ports 80 and 443 TCP to all 3 nodes in the Kubernetes cluster. -* The ingress controller will redirect http port 80 to https and terminate SSL/TLS on port 443. -* The ingress controller will forward traffic to port 80 on the Pod in the Rancher Deployment. +* The Ingress controller will redirect http port 80 to https and terminate SSL/TLS on port 443. +* The Ingress controller will forward traffic to port 80 on the Pod in the Rancher Deployment. ![Rancher HA]({{< baseurl >}}/img/rancher/ha/rancher2ha.svg) @@ -29,7 +29,12 @@ The following CLI tools are required for this install. Please make sure these to ## Installation Outline -1. [Create Nodes and Load Balancer](create-nodes-and-load-balancer/) +1. [Create Nodes and Load Balancer](create-nodes-lb/) 1. [Install Kubernetes with RKE](install-kubernetes-rke/) -1. [Initialize Helm (tiller)](helm-install/) -1. [Install Rancher](rancher-install/) +1. [Initialize Helm (tiller)](helm-init/) +1. [Install Rancher](helm-rancher-install/) + +## Additional Install Options + +* [Migrating from RKE all-in-one install](migrating-from-rke-all-in-one/) +* [RKE all-in-one install](rke-all-in-one/) \ No newline at end of file diff --git a/content/rancher/v2.x/en/installation/ha-server-install-helm/create-nodes-and-load-balancer/_index.md b/content/rancher/v2.x/en/installation/ha-install/create-nodes-lb/_index.md similarity index 58% rename from content/rancher/v2.x/en/installation/ha-server-install-helm/create-nodes-and-load-balancer/_index.md rename to content/rancher/v2.x/en/installation/ha-install/create-nodes-lb/_index.md index 6e0d227543e..a9f46cdf326 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install-helm/create-nodes-and-load-balancer/_index.md +++ b/content/rancher/v2.x/en/installation/ha-install/create-nodes-lb/_index.md @@ -27,30 +27,11 @@ Collect the SSH credentials and DNS or IP addresses for your nodes to provide to #### Ports -##### Cluster External Ports - -These are ports that should be open between nodes and the external network for communication and management of Rancher. - -| Protocol | Ports | Description | -| --- | --- | --- | -| tcp | 22 | SSH for RKE install | -| tcp | 80 | ingress controller - redirect to https | -| tcp | 443 | ingress controller - https traffic to Rancher | -| tcp | 6443 | https to kube-api, used by kubectl and helm | -| tcp | 30000 - 32767 | Kubernetes NodePorts for k8s workloads | +{{< requirements_ports_rancher_rke >}}
-##### Additional Ports Required Between Rancher Cluster Nodes - -In addition to the ports listed above these ports must be open between nodes. - -| Protocol | Ports | Description | -| --- | --- | --- | -| tcp | 2379-2380 | etcd | -| udp | 8472 | overlay networking | -| tcp | 10250 | kubelet | -
+If you block ports internally on the nodes see the full [ports list]({{< baseurl >}}/rancher/v2.x/en/installation/references/) for all the communication details. ### Load Balancer diff --git a/content/rancher/v2.x/en/installation/ha-server-install-helm/create-nodes-and-load-balancer/nlb/_index.md b/content/rancher/v2.x/en/installation/ha-install/create-nodes-lb/nlb/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-server-install-helm/create-nodes-and-load-balancer/nlb/_index.md rename to content/rancher/v2.x/en/installation/ha-install/create-nodes-lb/nlb/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install-helm/helm-install/_index.md b/content/rancher/v2.x/en/installation/ha-install/helm-init/_index.md similarity index 97% rename from content/rancher/v2.x/en/installation/ha-server-install-helm/helm-install/_index.md rename to content/rancher/v2.x/en/installation/ha-install/helm-init/_index.md index 5b5192d6675..6370143a30a 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install-helm/helm-install/_index.md +++ b/content/rancher/v2.x/en/installation/ha-install/helm-init/_index.md @@ -65,4 +65,4 @@ helm init --service-account tiller > NOTE: This `tiller` install has full cluster access, which should be acceptable if the cluster is dedicated to Rancher server. Check out the [helm docs](https://docs.helm.sh/using_helm/#role-based-access-control) for restricting `tiller` access to suit your security requirements. -### [Next: Install Rancher](../rancher-install/) \ No newline at end of file +### [Next: Install Rancher](../helm-rancher-install/) \ No newline at end of file diff --git a/content/rancher/v2.x/en/installation/ha-server-install-helm/rancher-install/_index.md b/content/rancher/v2.x/en/installation/ha-install/helm-rancher-install/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-server-install-helm/rancher-install/_index.md rename to content/rancher/v2.x/en/installation/ha-install/helm-rancher-install/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install-helm/rancher-install/chart-options/_index.md b/content/rancher/v2.x/en/installation/ha-install/helm-rancher-install/chart-options/_index.md similarity index 93% rename from content/rancher/v2.x/en/installation/ha-server-install-helm/rancher-install/chart-options/_index.md rename to content/rancher/v2.x/en/installation/ha-install/helm-rancher-install/chart-options/_index.md index 9c7fb301654..6243357518f 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install-helm/rancher-install/chart-options/_index.md +++ b/content/rancher/v2.x/en/installation/ha-install/helm-rancher-install/chart-options/_index.md @@ -21,6 +21,8 @@ weight: 276 | --- | --- | --- | | `debug` | false | `bool` - set debug flag on rancher server | | `imagePullSecrets` | [] | `list` - list of names of Secret resource containing private registry credentials | +| `proxy` | "" | `string` - string - HTTP[S] proxy server for Rancher | +| `noProxy` | "localhost,127.0.0.1" | `string` - comma seperated list of hostnames or ip address not to use the proxy | | `resources` | {} | `map` - rancher pod resource requests & limits | | `rancherImage` | "rancher/rancher" | `string` - rancher image source | | `rancherImageTag` | same as chart version | `string` - rancher/rancher image tag | diff --git a/content/rancher/v2.x/en/installation/ha-server-install-helm/rancher-install/tls-secrets/_index.md b/content/rancher/v2.x/en/installation/ha-install/helm-rancher-install/tls-secrets/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-server-install-helm/rancher-install/tls-secrets/_index.md rename to content/rancher/v2.x/en/installation/ha-install/helm-rancher-install/tls-secrets/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install-helm/rancher-install/troubleshooting/_index.md b/content/rancher/v2.x/en/installation/ha-install/helm-rancher-install/troubleshooting/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-server-install-helm/rancher-install/troubleshooting/_index.md rename to content/rancher/v2.x/en/installation/ha-install/helm-rancher-install/troubleshooting/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install-helm/install-kubernetes-rke/_index.md b/content/rancher/v2.x/en/installation/ha-install/install-kubernetes-rke/_index.md similarity index 98% rename from content/rancher/v2.x/en/installation/ha-server-install-helm/install-kubernetes-rke/_index.md rename to content/rancher/v2.x/en/installation/ha-install/install-kubernetes-rke/_index.md index 33c3583ca29..61c1f212969 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install-helm/install-kubernetes-rke/_index.md +++ b/content/rancher/v2.x/en/installation/ha-install/install-kubernetes-rke/_index.md @@ -81,4 +81,4 @@ You will need to save a copy of the `kube_config_rancher-cluster.yml` and `ranch See the [Troubleshooting](troubleshooting/) page. -### [Next: Initialize Helm](../helm-install/) \ No newline at end of file +### [Next: Initialize Helm](../helm-init/) \ No newline at end of file diff --git a/content/rancher/v2.x/en/installation/ha-server-install-helm/install-kubernetes-rke/troubleshooting/_index.md b/content/rancher/v2.x/en/installation/ha-install/install-kubernetes-rke/troubleshooting/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-server-install-helm/install-kubernetes-rke/troubleshooting/_index.md rename to content/rancher/v2.x/en/installation/ha-install/install-kubernetes-rke/troubleshooting/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install-helm/migrating-from-rke-all-in-one-install/_index.md b/content/rancher/v2.x/en/installation/ha-install/migrating-from-rke-all-in-one/_index.md similarity index 95% rename from content/rancher/v2.x/en/installation/ha-server-install-helm/migrating-from-rke-all-in-one-install/_index.md rename to content/rancher/v2.x/en/installation/ha-install/migrating-from-rke-all-in-one/_index.md index b79def6577d..5f7ab068ab6 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install-helm/migrating-from-rke-all-in-one-install/_index.md +++ b/content/rancher/v2.x/en/installation/ha-install/migrating-from-rke-all-in-one/_index.md @@ -52,5 +52,5 @@ kubectl -n cattle-system delete serviceaccount cattle-admin From here follow the standard install steps. -* [3 - Initialize Helm (Install tiller)](../3-helm-install/) -* [4 - Install Rancher](../4-rancher-install/) +* [3 - Initialize Helm (Install tiller)](../helm-init/) +* [4 - Install Rancher](../helm-rancher-install/) diff --git a/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/_index.md b/content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/_index.md similarity index 71% rename from content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/_index.md rename to content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/_index.md index 66a23807b73..25e835effd2 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/_index.md +++ b/content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/_index.md @@ -5,6 +5,6 @@ weight: 276 Rancher can be installed by providing the appropriate Kubernetes manifest configurations to RKE's `addons` feature. See the following instructions for examples appropriate to your environment. -* [High Availability Installation with External Load Balancer (TCP/Layer 4)](./ha-server-install/) -* [High Availability Installation with External Load Balancer (HTTPS/Layer 7)](./ha-server-install-external-lb) -* [Troubleshooting RKE All-In-One Installs](./troubleshooting-ha) +* [High Availability Installation with External Load Balancer (TCP/Layer 4)](install-layer-4-lb/) +* [High Availability Installation with External Load Balancer (HTTPS/Layer 7)](install-layer-7-lb/) +* [Troubleshooting RKE All-In-One Installs](troubleshooting/) diff --git a/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/ha-server-install/_index.md b/content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/install-layer-4-lb/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/ha-server-install/_index.md rename to content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/install-layer-4-lb/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/ha-server-install/nlb/_index.md b/content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/install-layer-4-lb/nlb/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/ha-server-install/nlb/_index.md rename to content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/install-layer-4-lb/nlb/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/ha-server-install-external-lb/_index.md b/content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/install-layer-7-lb/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/ha-server-install-external-lb/_index.md rename to content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/install-layer-7-lb/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/ha-server-install-external-lb/alb/_index.md b/content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/install-layer-7-lb/alb/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/ha-server-install-external-lb/alb/_index.md rename to content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/install-layer-7-lb/alb/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/ha-server-install-external-lb/nginx/_index.md b/content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/install-layer-7-lb/nginx/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/ha-server-install-external-lb/nginx/_index.md rename to content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/install-layer-7-lb/nginx/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/troubleshooting-ha/404-default-backend/_index.md b/content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/troubleshooting/404-default-backend/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/troubleshooting-ha/404-default-backend/_index.md rename to content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/troubleshooting/404-default-backend/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/troubleshooting-ha/_index.md b/content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/troubleshooting/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/troubleshooting-ha/_index.md rename to content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/troubleshooting/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/troubleshooting-ha/generic-troubleshooting/_index.md b/content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/troubleshooting/generic-troubleshooting/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/troubleshooting-ha/generic-troubleshooting/_index.md rename to content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/troubleshooting/generic-troubleshooting/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/troubleshooting-ha/job-complete-status/_index.md b/content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/troubleshooting/job-complete-status/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/troubleshooting-ha/job-complete-status/_index.md rename to content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/troubleshooting/job-complete-status/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/troubleshooting-ha/ssh-tunneling/_index.md b/content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/troubleshooting/ssh-tunneling/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-server-install-helm/rke-all-in-one-install/troubleshooting-ha/ssh-tunneling/_index.md rename to content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/troubleshooting/ssh-tunneling/_index.md diff --git a/layouts/shortcodes/requirements_ports_rancher_rke.html b/layouts/shortcodes/requirements_ports_rancher_rke.html new file mode 100644 index 00000000000..41401055ff8 --- /dev/null +++ b/layouts/shortcodes/requirements_ports_rancher_rke.html @@ -0,0 +1,57 @@ +

+
Cluster External Ports
+

These ports should be open between nodes and the external network for communication and management of Rancher.

+ + + + + + + + + + + + + + + + + + + + + + + + + + + +
ProtocolPortDescription
TCP22SSH for RKE
TCP80Ingress controller - redirect to HTTPS
TCP443Ingress controller - HTTPS traffic to Rancher
TCP6443HTTPS to kube-api, used by kubectl and helm
+

+
Additional Ports Required Between Rancher Cluster Nodes
+

In addition to the ports listed above these ports must be open between nodes.

+ + + + + + + + + + + + + + + + + + + + + +
ProtocolPortDescription
TCP2379-2380etcd
udp8472Overlay networking
TCP10250kubelet
+
From b58515c38479b0cdc5ed28e289d40ef5903f3c11 Mon Sep 17 00:00:00 2001 From: Jason Greathouse Date: Wed, 18 Jul 2018 14:14:09 +1000 Subject: [PATCH 11/18] renames suggested by ahmad --- content/rancher/v2.x/en/installation/_index.md | 8 ++------ .../v2.x/en/installation/{ha-install => ha}/_index.md | 4 ++-- .../{ha-install => ha}/create-nodes-lb/_index.md | 2 +- .../{ha-install => ha}/create-nodes-lb/nlb/_index.md | 0 .../installation/{ha-install => ha}/helm-init/_index.md | 2 +- .../helm-rancher-install => ha/helm-rancher}/_index.md | 0 .../helm-rancher}/chart-options/_index.md | 0 .../helm-rancher}/tls-secrets/_index.md | 0 .../helm-rancher}/troubleshooting/_index.md | 0 .../kubernetes-rke}/_index.md | 0 .../kubernetes-rke}/troubleshooting/_index.md | 0 .../migrating-from-rke-all-in-one/_index.md | 2 +- .../{ha-install => ha}/rke-all-in-one/_index.md | 4 ++-- .../rke-all-in-one/layer-4-lb}/_index.md | 0 .../rke-all-in-one/layer-4-lb}/nlb/_index.md | 0 .../rke-all-in-one/layer-7-lb}/_index.md | 0 .../rke-all-in-one/layer-7-lb}/alb/_index.md | 0 .../rke-all-in-one/layer-7-lb}/nginx/_index.md | 0 .../troubleshooting/404-default-backend/_index.md | 0 .../rke-all-in-one/troubleshooting/_index.md | 0 .../troubleshooting/generic-troubleshooting/_index.md | 0 .../troubleshooting/job-complete-status/_index.md | 0 .../troubleshooting/ssh-tunneling/_index.md | 0 .../{single-node-install => single-node}/_index.md | 2 +- .../advanced-options}/_index.md | 0 .../advanced-options}/air-gap-installation/_index.md | 0 .../advanced-options}/proxy-configuration/_index.md | 0 .../single-node-install-external-lb/_index.md | 0 28 files changed, 10 insertions(+), 14 deletions(-) rename content/rancher/v2.x/en/installation/{ha-install => ha}/_index.md (94%) rename content/rancher/v2.x/en/installation/{ha-install => ha}/create-nodes-lb/_index.md (94%) rename content/rancher/v2.x/en/installation/{ha-install => ha}/create-nodes-lb/nlb/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-install => ha}/helm-init/_index.md (97%) rename content/rancher/v2.x/en/installation/{ha-install/helm-rancher-install => ha/helm-rancher}/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-install/helm-rancher-install => ha/helm-rancher}/chart-options/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-install/helm-rancher-install => ha/helm-rancher}/tls-secrets/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-install/helm-rancher-install => ha/helm-rancher}/troubleshooting/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-install/install-kubernetes-rke => ha/kubernetes-rke}/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-install/install-kubernetes-rke => ha/kubernetes-rke}/troubleshooting/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-install => ha}/migrating-from-rke-all-in-one/_index.md (97%) rename content/rancher/v2.x/en/installation/{ha-install => ha}/rke-all-in-one/_index.md (86%) rename content/rancher/v2.x/en/installation/{ha-install/rke-all-in-one/install-layer-4-lb => ha/rke-all-in-one/layer-4-lb}/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-install/rke-all-in-one/install-layer-4-lb => ha/rke-all-in-one/layer-4-lb}/nlb/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-install/rke-all-in-one/install-layer-7-lb => ha/rke-all-in-one/layer-7-lb}/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-install/rke-all-in-one/install-layer-7-lb => ha/rke-all-in-one/layer-7-lb}/alb/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-install/rke-all-in-one/install-layer-7-lb => ha/rke-all-in-one/layer-7-lb}/nginx/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-install => ha}/rke-all-in-one/troubleshooting/404-default-backend/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-install => ha}/rke-all-in-one/troubleshooting/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-install => ha}/rke-all-in-one/troubleshooting/generic-troubleshooting/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-install => ha}/rke-all-in-one/troubleshooting/job-complete-status/_index.md (100%) rename content/rancher/v2.x/en/installation/{ha-install => ha}/rke-all-in-one/troubleshooting/ssh-tunneling/_index.md (100%) rename content/rancher/v2.x/en/installation/{single-node-install => single-node}/_index.md (99%) rename content/rancher/v2.x/en/installation/{single-node-install/advanced-install-options => single-node/advanced-options}/_index.md (100%) rename content/rancher/v2.x/en/installation/{single-node-install/advanced-install-options => single-node/advanced-options}/air-gap-installation/_index.md (100%) rename content/rancher/v2.x/en/installation/{single-node-install/advanced-install-options => single-node/advanced-options}/proxy-configuration/_index.md (100%) rename content/rancher/v2.x/en/installation/{single-node-install/advanced-install-options => single-node/advanced-options}/single-node-install-external-lb/_index.md (100%) diff --git a/content/rancher/v2.x/en/installation/_index.md b/content/rancher/v2.x/en/installation/_index.md index 1c6f3ecf56f..62fdbccf749 100644 --- a/content/rancher/v2.x/en/installation/_index.md +++ b/content/rancher/v2.x/en/installation/_index.md @@ -6,20 +6,16 @@ This section contains instructions for installing Rancher in development and pro ### Installation Options -- [Single Node Installation](single-node-install/) +- [Single Node Installation](single-node/) Install Rancher on a single Linux host. -- [High Availability Installation](ha-server-install-helm/) +- [High Availability Installation](ha/) This install scenario creates a new Kubernetes cluster dedicated to running Rancher Server in a high-availability (HA) configuration. ### Reference -- [Images required for Air Gap Installation](air-gap-images/) - - Required images and configuration to install Rancher Server in an environment without direct Internet access. - - [Port Requirements](references/) List of required ports you must open to operate Rancher. diff --git a/content/rancher/v2.x/en/installation/ha-install/_index.md b/content/rancher/v2.x/en/installation/ha/_index.md similarity index 94% rename from content/rancher/v2.x/en/installation/ha-install/_index.md rename to content/rancher/v2.x/en/installation/ha/_index.md index a638152eecf..0f6ab3746fc 100644 --- a/content/rancher/v2.x/en/installation/ha-install/_index.md +++ b/content/rancher/v2.x/en/installation/ha/_index.md @@ -30,9 +30,9 @@ The following CLI tools are required for this install. Please make sure these to ## Installation Outline 1. [Create Nodes and Load Balancer](create-nodes-lb/) -1. [Install Kubernetes with RKE](install-kubernetes-rke/) +1. [Install Kubernetes with RKE](kubernetes-rke/) 1. [Initialize Helm (tiller)](helm-init/) -1. [Install Rancher](helm-rancher-install/) +1. [Install Rancher](helm-rancher/) ## Additional Install Options diff --git a/content/rancher/v2.x/en/installation/ha-install/create-nodes-lb/_index.md b/content/rancher/v2.x/en/installation/ha/create-nodes-lb/_index.md similarity index 94% rename from content/rancher/v2.x/en/installation/ha-install/create-nodes-lb/_index.md rename to content/rancher/v2.x/en/installation/ha/create-nodes-lb/_index.md index a9f46cdf326..60f1135c858 100644 --- a/content/rancher/v2.x/en/installation/ha-install/create-nodes-lb/_index.md +++ b/content/rancher/v2.x/en/installation/ha/create-nodes-lb/_index.md @@ -45,4 +45,4 @@ Configure a load balancer as a basic Layer 4 tcp forwarder. The exact configurat
-### [Next: Install Kubernetes with RKE](../install-kubernetes-rke/) \ No newline at end of file +### [Next: Install Kubernetes with RKE](../kubernetes-rke/) \ No newline at end of file diff --git a/content/rancher/v2.x/en/installation/ha-install/create-nodes-lb/nlb/_index.md b/content/rancher/v2.x/en/installation/ha/create-nodes-lb/nlb/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-install/create-nodes-lb/nlb/_index.md rename to content/rancher/v2.x/en/installation/ha/create-nodes-lb/nlb/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-install/helm-init/_index.md b/content/rancher/v2.x/en/installation/ha/helm-init/_index.md similarity index 97% rename from content/rancher/v2.x/en/installation/ha-install/helm-init/_index.md rename to content/rancher/v2.x/en/installation/ha/helm-init/_index.md index 6370143a30a..c28458fa89c 100644 --- a/content/rancher/v2.x/en/installation/ha-install/helm-init/_index.md +++ b/content/rancher/v2.x/en/installation/ha/helm-init/_index.md @@ -65,4 +65,4 @@ helm init --service-account tiller > NOTE: This `tiller` install has full cluster access, which should be acceptable if the cluster is dedicated to Rancher server. Check out the [helm docs](https://docs.helm.sh/using_helm/#role-based-access-control) for restricting `tiller` access to suit your security requirements. -### [Next: Install Rancher](../helm-rancher-install/) \ No newline at end of file +### [Next: Install Rancher](../helm-rancher/) \ No newline at end of file diff --git a/content/rancher/v2.x/en/installation/ha-install/helm-rancher-install/_index.md b/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-install/helm-rancher-install/_index.md rename to content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-install/helm-rancher-install/chart-options/_index.md b/content/rancher/v2.x/en/installation/ha/helm-rancher/chart-options/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-install/helm-rancher-install/chart-options/_index.md rename to content/rancher/v2.x/en/installation/ha/helm-rancher/chart-options/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-install/helm-rancher-install/tls-secrets/_index.md b/content/rancher/v2.x/en/installation/ha/helm-rancher/tls-secrets/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-install/helm-rancher-install/tls-secrets/_index.md rename to content/rancher/v2.x/en/installation/ha/helm-rancher/tls-secrets/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-install/helm-rancher-install/troubleshooting/_index.md b/content/rancher/v2.x/en/installation/ha/helm-rancher/troubleshooting/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-install/helm-rancher-install/troubleshooting/_index.md rename to content/rancher/v2.x/en/installation/ha/helm-rancher/troubleshooting/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-install/install-kubernetes-rke/_index.md b/content/rancher/v2.x/en/installation/ha/kubernetes-rke/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-install/install-kubernetes-rke/_index.md rename to content/rancher/v2.x/en/installation/ha/kubernetes-rke/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-install/install-kubernetes-rke/troubleshooting/_index.md b/content/rancher/v2.x/en/installation/ha/kubernetes-rke/troubleshooting/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-install/install-kubernetes-rke/troubleshooting/_index.md rename to content/rancher/v2.x/en/installation/ha/kubernetes-rke/troubleshooting/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-install/migrating-from-rke-all-in-one/_index.md b/content/rancher/v2.x/en/installation/ha/migrating-from-rke-all-in-one/_index.md similarity index 97% rename from content/rancher/v2.x/en/installation/ha-install/migrating-from-rke-all-in-one/_index.md rename to content/rancher/v2.x/en/installation/ha/migrating-from-rke-all-in-one/_index.md index 5f7ab068ab6..b6b750a1dbb 100644 --- a/content/rancher/v2.x/en/installation/ha-install/migrating-from-rke-all-in-one/_index.md +++ b/content/rancher/v2.x/en/installation/ha/migrating-from-rke-all-in-one/_index.md @@ -53,4 +53,4 @@ kubectl -n cattle-system delete serviceaccount cattle-admin From here follow the standard install steps. * [3 - Initialize Helm (Install tiller)](../helm-init/) -* [4 - Install Rancher](../helm-rancher-install/) +* [4 - Install Rancher](../helm-rancher/) diff --git a/content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/_index.md b/content/rancher/v2.x/en/installation/ha/rke-all-in-one/_index.md similarity index 86% rename from content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/_index.md rename to content/rancher/v2.x/en/installation/ha/rke-all-in-one/_index.md index 25e835effd2..fda319a3c4e 100644 --- a/content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/_index.md +++ b/content/rancher/v2.x/en/installation/ha/rke-all-in-one/_index.md @@ -5,6 +5,6 @@ weight: 276 Rancher can be installed by providing the appropriate Kubernetes manifest configurations to RKE's `addons` feature. See the following instructions for examples appropriate to your environment. -* [High Availability Installation with External Load Balancer (TCP/Layer 4)](install-layer-4-lb/) -* [High Availability Installation with External Load Balancer (HTTPS/Layer 7)](install-layer-7-lb/) +* [High Availability Installation with External Load Balancer (TCP/Layer 4)](layer-4-lb/) +* [High Availability Installation with External Load Balancer (HTTPS/Layer 7)](layer-7-lb/) * [Troubleshooting RKE All-In-One Installs](troubleshooting/) diff --git a/content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/install-layer-4-lb/_index.md b/content/rancher/v2.x/en/installation/ha/rke-all-in-one/layer-4-lb/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/install-layer-4-lb/_index.md rename to content/rancher/v2.x/en/installation/ha/rke-all-in-one/layer-4-lb/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/install-layer-4-lb/nlb/_index.md b/content/rancher/v2.x/en/installation/ha/rke-all-in-one/layer-4-lb/nlb/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/install-layer-4-lb/nlb/_index.md rename to content/rancher/v2.x/en/installation/ha/rke-all-in-one/layer-4-lb/nlb/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/install-layer-7-lb/_index.md b/content/rancher/v2.x/en/installation/ha/rke-all-in-one/layer-7-lb/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/install-layer-7-lb/_index.md rename to content/rancher/v2.x/en/installation/ha/rke-all-in-one/layer-7-lb/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/install-layer-7-lb/alb/_index.md b/content/rancher/v2.x/en/installation/ha/rke-all-in-one/layer-7-lb/alb/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/install-layer-7-lb/alb/_index.md rename to content/rancher/v2.x/en/installation/ha/rke-all-in-one/layer-7-lb/alb/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/install-layer-7-lb/nginx/_index.md b/content/rancher/v2.x/en/installation/ha/rke-all-in-one/layer-7-lb/nginx/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/install-layer-7-lb/nginx/_index.md rename to content/rancher/v2.x/en/installation/ha/rke-all-in-one/layer-7-lb/nginx/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/troubleshooting/404-default-backend/_index.md b/content/rancher/v2.x/en/installation/ha/rke-all-in-one/troubleshooting/404-default-backend/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/troubleshooting/404-default-backend/_index.md rename to content/rancher/v2.x/en/installation/ha/rke-all-in-one/troubleshooting/404-default-backend/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/troubleshooting/_index.md b/content/rancher/v2.x/en/installation/ha/rke-all-in-one/troubleshooting/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/troubleshooting/_index.md rename to content/rancher/v2.x/en/installation/ha/rke-all-in-one/troubleshooting/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/troubleshooting/generic-troubleshooting/_index.md b/content/rancher/v2.x/en/installation/ha/rke-all-in-one/troubleshooting/generic-troubleshooting/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/troubleshooting/generic-troubleshooting/_index.md rename to content/rancher/v2.x/en/installation/ha/rke-all-in-one/troubleshooting/generic-troubleshooting/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/troubleshooting/job-complete-status/_index.md b/content/rancher/v2.x/en/installation/ha/rke-all-in-one/troubleshooting/job-complete-status/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/troubleshooting/job-complete-status/_index.md rename to content/rancher/v2.x/en/installation/ha/rke-all-in-one/troubleshooting/job-complete-status/_index.md diff --git a/content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/troubleshooting/ssh-tunneling/_index.md b/content/rancher/v2.x/en/installation/ha/rke-all-in-one/troubleshooting/ssh-tunneling/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/ha-install/rke-all-in-one/troubleshooting/ssh-tunneling/_index.md rename to content/rancher/v2.x/en/installation/ha/rke-all-in-one/troubleshooting/ssh-tunneling/_index.md diff --git a/content/rancher/v2.x/en/installation/single-node-install/_index.md b/content/rancher/v2.x/en/installation/single-node/_index.md similarity index 99% rename from content/rancher/v2.x/en/installation/single-node-install/_index.md rename to content/rancher/v2.x/en/installation/single-node/_index.md index 0afffbf944c..b895c5aa800 100644 --- a/content/rancher/v2.x/en/installation/single-node-install/_index.md +++ b/content/rancher/v2.x/en/installation/single-node/_index.md @@ -5,7 +5,7 @@ weight: 250 For development environments, we recommend installing Rancher by running a single Docker container. In this installation scenario, you'll install Docker on a single Linux host, and then install Rancher on your host using a single Docker container. >**Want to use an external load balancer?** -> See [Single Node Installation with an External Load Balancer](advanced-install-options/single-node-install-external-lb) instead. +> See [Single Node Installation with an External Load Balancer](advanced-options/single-node-install-external-lb) instead. ## Installation Outline diff --git a/content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/_index.md b/content/rancher/v2.x/en/installation/single-node/advanced-options/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/_index.md rename to content/rancher/v2.x/en/installation/single-node/advanced-options/_index.md diff --git a/content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/air-gap-installation/_index.md b/content/rancher/v2.x/en/installation/single-node/advanced-options/air-gap-installation/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/air-gap-installation/_index.md rename to content/rancher/v2.x/en/installation/single-node/advanced-options/air-gap-installation/_index.md diff --git a/content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/proxy-configuration/_index.md b/content/rancher/v2.x/en/installation/single-node/advanced-options/proxy-configuration/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/proxy-configuration/_index.md rename to content/rancher/v2.x/en/installation/single-node/advanced-options/proxy-configuration/_index.md diff --git a/content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/single-node-install-external-lb/_index.md b/content/rancher/v2.x/en/installation/single-node/advanced-options/single-node-install-external-lb/_index.md similarity index 100% rename from content/rancher/v2.x/en/installation/single-node-install/advanced-install-options/single-node-install-external-lb/_index.md rename to content/rancher/v2.x/en/installation/single-node/advanced-options/single-node-install-external-lb/_index.md From d835b16913aca0aa58d4a7e8bcac4f40ed5f9eb7 Mon Sep 17 00:00:00 2001 From: Jason Greathouse Date: Wed, 18 Jul 2018 17:05:35 +1000 Subject: [PATCH 12/18] add http proxy examples --- .../v2.x/en/installation/ha/helm-rancher/_index.md | 1 + .../installation/ha/helm-rancher/chart-options/_index.md | 9 +++++++++ 2 files changed, 10 insertions(+) diff --git a/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md b/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md index 44589fdf7d7..0428fc02681 100644 --- a/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md +++ b/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md @@ -83,6 +83,7 @@ Now that Rancher is running, see [Adding TLS Secrets](tls-secrets/) to publish t The Rancher chart configuration has many options for customizing the install to suit your specific environment. Here are some common advanced scenarios. +* [HTTP Proxy](chart-options/#http-proxy) * [Private Docker Image Registry/Air Gap Network](chart-options/#private-or-air-gap-registry) * [TLS Termination on an External Load Balancer](chart-options/#external-tls-termination) diff --git a/content/rancher/v2.x/en/installation/ha/helm-rancher/chart-options/_index.md b/content/rancher/v2.x/en/installation/ha/helm-rancher/chart-options/_index.md index 6243357518f..aaaac97b40c 100644 --- a/content/rancher/v2.x/en/installation/ha/helm-rancher/chart-options/_index.md +++ b/content/rancher/v2.x/en/installation/ha/helm-rancher/chart-options/_index.md @@ -30,6 +30,15 @@ weight: 276
+### HTTP Proxy + +Rancher requires internet access for some functionality (helm charts). Set proxy to your proxy server. Add your domain name or ip exceptions to the noProxy list. Make sure any worker cluster `controlplane` nodes are included in this list. + +``` +--set proxy="http://:@:/" +--set noProxy="127.0.0.1,localhost,myinternaldomain.example.com" +``` + ### Private or Air Gap Registry You can point to a private registry for an "Air Gap" install. From 5b50855870a37f00dd8113aa8a496247bb979c3f Mon Sep 17 00:00:00 2001 From: Jason Greathouse Date: Wed, 18 Jul 2018 17:12:04 +1000 Subject: [PATCH 13/18] add http proxy examples --- .../en/installation/ha/helm-rancher/chart-options/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/installation/ha/helm-rancher/chart-options/_index.md b/content/rancher/v2.x/en/installation/ha/helm-rancher/chart-options/_index.md index aaaac97b40c..5fdb8813b04 100644 --- a/content/rancher/v2.x/en/installation/ha/helm-rancher/chart-options/_index.md +++ b/content/rancher/v2.x/en/installation/ha/helm-rancher/chart-options/_index.md @@ -32,7 +32,7 @@ weight: 276 ### HTTP Proxy -Rancher requires internet access for some functionality (helm charts). Set proxy to your proxy server. Add your domain name or ip exceptions to the noProxy list. Make sure any worker cluster `controlplane` nodes are included in this list. +Rancher requires internet access for some functionality (helm charts). Set proxy to your proxy server. Add your domain name or ip exceptions to the noProxy list. Make sure your worker cluster `controlplane` nodes are included in this list. ``` --set proxy="http://:@:/" From e6b46ab0db17d7400eee53250dff2d81a4804051 Mon Sep 17 00:00:00 2001 From: Jason Greathouse Date: Fri, 20 Jul 2018 13:02:22 +1000 Subject: [PATCH 14/18] cleanup for style and some phrasing --- .../rancher/v2.x/en/installation/ha/_index.md | 6 +++--- .../installation/ha/create-nodes-lb/_index.md | 8 ++++---- .../en/installation/ha/helm-init/_index.md | 8 ++++---- .../en/installation/ha/helm-rancher/_index.md | 8 +++++++- .../ha/helm-rancher/chart-options/_index.md | 14 +++++++++++--- .../ha/helm-rancher/tls-secrets/_index.md | 2 +- .../ha/helm-rancher/troubleshooting/_index.md | 2 +- .../installation/ha/kubernetes-rke/_index.md | 19 ++++++++----------- .../migrating-from-rke-all-in-one/_index.md | 4 ++-- 9 files changed, 41 insertions(+), 30 deletions(-) diff --git a/content/rancher/v2.x/en/installation/ha/_index.md b/content/rancher/v2.x/en/installation/ha/_index.md index 0f6ab3746fc..ea8072ec8b3 100644 --- a/content/rancher/v2.x/en/installation/ha/_index.md +++ b/content/rancher/v2.x/en/installation/ha/_index.md @@ -4,11 +4,11 @@ weight: 275 draft: true --- -When installed as a Deployment in a Kubernetes cluster, Rancher will take integrate with the cluster's etcd database and Kubernetes scheduling for High-Availability. +When installed in a Kubernetes cluster, Rancher will integrate with the cluster's etcd database and take advantage of Kubernetes scheduling for High-Availability. This procedure walks you through setting up a 3-node cluster with RKE and installing the Rancher chart with the Helm package manager. -> NOTE: For the best performance, we recommend this Kubernetes cluster is dedicated to only the Rancher workload. +> **Note:** For the best performance, we recommend this Kubernetes cluster be dedicated only to the Rancher workload. ## Recommended Architecture @@ -21,7 +21,7 @@ This procedure walks you through setting up a 3-node cluster with RKE and instal ## Required Tools -The following CLI tools are required for this install. Please make sure these tools installed and available in your `$PATH` +The following CLI tools are required for this install. Please make sure these tools are installed and available in your `$PATH` * [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl) - Kubernetes command-line tool. * [rke]({{< baseurl >}}/rke/v0.1.x/en/installation/) - Rancher Kubernetes Engine, cli for building Kubernetes clusters. diff --git a/content/rancher/v2.x/en/installation/ha/create-nodes-lb/_index.md b/content/rancher/v2.x/en/installation/ha/create-nodes-lb/_index.md index 60f1135c858..69d37b8220b 100644 --- a/content/rancher/v2.x/en/installation/ha/create-nodes-lb/_index.md +++ b/content/rancher/v2.x/en/installation/ha/create-nodes-lb/_index.md @@ -5,9 +5,9 @@ weight: 185 Use your provider of choice to provision 3 nodes and a Load Balancer endpoint for your RKE install. -> Note: These nodes must be in the same region/datacenter. You may place these servers in separate availability zones. +> **Note:** These nodes must be in the same region/datacenter. You may place these servers in separate availability zones. -Collect the SSH credentials and DNS or IP addresses for your nodes to provide to RKE in the next step. +**Don't forget to collect the SSH credentials and DNS or IP addresses of your nodes to provide to RKE in the next step.** ### Host Requirements @@ -35,9 +35,9 @@ If you block ports internally on the nodes see the full [ports list]({{< baseurl ### Load Balancer -RKE will configure an ingress-controller pod, on each of your nodes. The ingress-controller pods are bound to ports 80 and 443 tcp on the host network and are the entry point for https traffic to the Rancher server. +RKE will configure an ingress-controller pod, on each of your nodes. The ingress-controller pods are bound to ports 80 and 443 TCP on the host network and are the entry point for HTTPS traffic to the Rancher server. -Configure a load balancer as a basic Layer 4 tcp forwarder. The exact configuration will vary depending on your environment. +Configure a load balancer as a basic Layer 4 TCP forwarder. The exact configuration will vary depending on your environment. #### Examples diff --git a/content/rancher/v2.x/en/installation/ha/helm-init/_index.md b/content/rancher/v2.x/en/installation/ha/helm-init/_index.md index c28458fa89c..8bf567a9d86 100644 --- a/content/rancher/v2.x/en/installation/ha/helm-init/_index.md +++ b/content/rancher/v2.x/en/installation/ha/helm-init/_index.md @@ -3,11 +3,11 @@ title: 3 - Initialize Helm (Install tiller) weight: 195 --- -`helm` is the package management tool of choice for Kubernetes. `helm` `charts` provide templating syntax for Kubernetes YAML manifest documents. With `helm` we can create configurable deployments instead of just using static files. For more information about creating your own catalog of deployments, check out the docs at [https://helm.sh/](https://helm.sh/) +Helm is the package management tool of choice for Kubernetes. Helm "charts" provide templating syntax for Kubernetes YAML manifest documents. With Helm we can create configurable deployments instead of just using static files. For more information about creating your own catalog of deployments, check out the docs at [https://helm.sh/](https://helm.sh/). -### Initialize Helm on your Cluster +### Initialize Helm on the cluster -`helm` installs the `tiller` service on your cluster to manage `chart` deployments. Since `rke` has RBAC enabled by default we will need to use `kubectl` to create a `serviceaccount` and `clusterrolebinding` so `tiller` can deploy to our cluster for us. +Helm installs the `tiller` service on your cluster to manage charts. Since RKE enables RBAC by default we will need to use `kubectl` to create a `serviceaccount` and `clusterrolebinding` so `tiller` has permission to deploy to the cluster. * Create the `ServiceAccount` in the `kube-system` namespace. * Create the `ClusterRoleBinding` to give the `tiller` account access to the cluster. @@ -21,7 +21,7 @@ kubectl create clusterrolebinding tiller --clusterrole cluster-admin --serviceac
Additional steps for Air Gap/Private Registry

-If you have an Air Gapped network you will need the tiller image available in your private registry. +If you have an Air Gapped network you will need the `tiller` image available in your private registry. ##### Create registry secret diff --git a/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md b/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md index 0428fc02681..4070ead937c 100644 --- a/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md +++ b/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md @@ -15,6 +15,8 @@ helm repo add rancher-stable https://releases.rancher.com/server-charts/stable ### Install cert-manager +> **Note:** cert-manager is only required for Rancher generated and LetsEncrypt issued certificates. You may skip this step if you are bringing your own certificates and using the `ingress.tls.source=secret` option. + Rancher relies on [cert-manager](https://github.com/kubernetes/charts/tree/master/stable/cert-manager) from the Kubernetes Helm "stable" catalog to issue self-signed or LetsEncrypt certificates. Install `cert-manager` from the Helm stable catalog. @@ -37,7 +39,7 @@ There are three options for the source of the certificate. #### (Default) Rancher Generated Certificates -The default is to use the Rancher to generate a CA and use the `cert-manager` to issue the certificate for access to the Rancher server interface. +The default is for Rancher to generate a CA and use the `cert-manager` to issue the certificate for access to the Rancher server interface. The only requirement is to set the `hostname` to the DNS name you pointed at your Load Balancer. @@ -89,6 +91,10 @@ The Rancher chart configuration has many options for customizing the install to See the [Chart Options](chart-options/) for the full list of options. +### Save your options + +Make sure you save the `--set` options you used. You will need to use the same options when you upgrade Rancher to new versions with Helm. + ### Finishing Up That's it you should have a functional Rancher server. Point a browser at the hostname you picked and you should be greeted by the colorful login page. diff --git a/content/rancher/v2.x/en/installation/ha/helm-rancher/chart-options/_index.md b/content/rancher/v2.x/en/installation/ha/helm-rancher/chart-options/_index.md index 5fdb8813b04..0cc9df9bee8 100644 --- a/content/rancher/v2.x/en/installation/ha/helm-rancher/chart-options/_index.md +++ b/content/rancher/v2.x/en/installation/ha/helm-rancher/chart-options/_index.md @@ -32,17 +32,25 @@ weight: 276 ### HTTP Proxy -Rancher requires internet access for some functionality (helm charts). Set proxy to your proxy server. Add your domain name or ip exceptions to the noProxy list. Make sure your worker cluster `controlplane` nodes are included in this list. +Rancher requires internet access for some functionality (helm charts). Use `proxy` to set your proxy server. + +Add your IP exceptions to the `noProxy` list. Make sure you add the Service cluster IP range (default: 10.43.0.1/16) and any worker cluster `controlplane` nodes. Rancher supports CIDR notation ranges in this list. ``` --set proxy="http://:@:/" ---set noProxy="127.0.0.1,localhost,myinternaldomain.example.com" +--set noProxy="127.0.0.1,localhost,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16" ``` ### Private or Air Gap Registry You can point to a private registry for an "Air Gap" install. +#### Images + +Populate your private registry with Rancher images. + +You can get the list of images required for rancher and worker cluster installs from the [Releases](https://github.com/rancher/rancher/releases/latest) page. + #### Create Registry Secret Use `kubectl` to create a docker-registry secret in the `cattle-system` namespace. @@ -66,7 +74,7 @@ Add the `rancherImage` to point to your private registry image and `imagePullSec ### External TLS Termination -If you wish to terminate the SSL/TLS on a load-balancer external to the Rancher cluster (ingress), use the `--tls=external` option and point your load balancer at port http 80. +If you wish to terminate the SSL/TLS on a load-balancer external to the Rancher cluster (ingress), use the `--tls=external` option and point your load balancer at port http 80 on all of the rancher cluster nodes. > NOTE: If you are using a Private CA signed cert, add `--set privateCA=true` and see [Adding TLS Secrets - Private CA Signed - Additional Steps](../tls-secrets/#private-ca-signed---additional-steps) to add the CA cert for Rancher. diff --git a/content/rancher/v2.x/en/installation/ha/helm-rancher/tls-secrets/_index.md b/content/rancher/v2.x/en/installation/ha/helm-rancher/tls-secrets/_index.md index 50f2a4dff57..b77e4e1e9ba 100644 --- a/content/rancher/v2.x/en/installation/ha/helm-rancher/tls-secrets/_index.md +++ b/content/rancher/v2.x/en/installation/ha/helm-rancher/tls-secrets/_index.md @@ -7,7 +7,7 @@ Kubernetes will create all the objects and services for Rancher, but it will not Combine the server certificate followed by the intermediate cert chain your CA provided into a file named `tls.crt`. Copy your key into a file name `tls.key`. -Use `kubectl` with the `tls` type to create the secrets. +Use `kubectl` with the `tls` secret type to create the secrets. ``` kubectl -n cattle-system create secret tls tls-rancher-ingress \ diff --git a/content/rancher/v2.x/en/installation/ha/helm-rancher/troubleshooting/_index.md b/content/rancher/v2.x/en/installation/ha/helm-rancher/troubleshooting/_index.md index 2fce8e8d444..fd12a12e04f 100644 --- a/content/rancher/v2.x/en/installation/ha/helm-rancher/troubleshooting/_index.md +++ b/content/rancher/v2.x/en/installation/ha/helm-rancher/troubleshooting/_index.md @@ -5,7 +5,7 @@ weight: 276 ### Where is everything -Most of the troubleshooting will be done on Objects in these 3 namespaces. +Most of the troubleshooting will be done on objects in these 3 namespaces. * `cattle-system` - `rancher` deployment and pods. * `ingress-nginx` - Ingress controller pods and services. diff --git a/content/rancher/v2.x/en/installation/ha/kubernetes-rke/_index.md b/content/rancher/v2.x/en/installation/ha/kubernetes-rke/_index.md index 61c1f212969..fffac4ad1ba 100644 --- a/content/rancher/v2.x/en/installation/ha/kubernetes-rke/_index.md +++ b/content/rancher/v2.x/en/installation/ha/kubernetes-rke/_index.md @@ -3,11 +3,11 @@ title: 2 - Install Kubernetes with RKE weight: 190 --- -Configure the RKE `rancher-cluster.yml` and run `rke` to install Kubernetes with a HA `etcd` install. +Use RKE to install Kubernetes with a high-availability etcd configuration. -### Create a `rancher-cluster.yml` File +### Create the rancher-cluster.yml file -Using the sample below create a `rancher-cluster.yml` file. Replace the IP Addresses in the `nodes` list with the IP address or DNS names of the 3 Nodes you created. +Using the sample below create the `rancher-cluster.yml` file. Replace the IP Addresses in the `nodes` list with the IP address or DNS names of the 3 Nodes you created. ```yaml nodes: @@ -20,11 +20,9 @@ nodes: - address: 165.227.127.226 user: ubuntu role: [controlplane,worker,etcd] - # internal_address: 10.10.0.1 - # ssh_key_path: /home/user/.ssh/id_rsa ``` -#### Common RKE Options +#### Common RKE nodes: options | Option | Description | | --- | --- | @@ -36,11 +34,10 @@ nodes:
-#### Advanced Configurations +#### Advanced configurations RKE has many configuration options for customizing the install to suit your specific environment. Here are some common advanced scenarios. -* [SSH Bastion/Jump Server]({{< baseurl >}}/rke/v0.1.x/en/config-options/bastion-host/) * [System Images for Air Gap Network]({{< baseurl >}}/rke/v0.1.x/en/config-options/system-images/) * [Private Docker Image Registry]({{< baseurl >}}/rke/v0.1.x/en/config-options/private-registries/) @@ -54,9 +51,9 @@ rke up --config ./rancher-cluster.yaml ### Testing your cluster -`rke` should have created a file `kube_config_rancher-cluster.yml`. This file has the credentials for `kubectl` and `helm`. +RKE should have created a file `kube_config_rancher-cluster.yml`. This file has the credentials for `kubectl` and `helm`. -You can copy this file to `$HOME/.kube/config` or if you are working with multiple Kubernetes clusters, set`KUBECONFIG` environmental variable to the path of `kube_config_rancher-cluster.yml`. +You can copy this file to `$HOME/.kube/config` or if you are working with multiple Kubernetes clusters, set the `KUBECONFIG` environmental variable to the path of `kube_config_rancher-cluster.yml`. ``` export KUBECONFIG=$(pwd)/kube_config_rancher-cluster.yml @@ -75,7 +72,7 @@ NAME STATUS ROLES AGE VER ### Save your files -You will need to save a copy of the `kube_config_rancher-cluster.yml` and `rancher-cluster.yml` files. You will need these files to maintain and upgrade your Rancher instance. +Save a copy of the `kube_config_rancher-cluster.yml` and `rancher-cluster.yml` files. You will need these files to maintain and upgrade your Rancher instance. ### Issues or errors? diff --git a/content/rancher/v2.x/en/installation/ha/migrating-from-rke-all-in-one/_index.md b/content/rancher/v2.x/en/installation/ha/migrating-from-rke-all-in-one/_index.md index b6b750a1dbb..ec8d135ccbf 100644 --- a/content/rancher/v2.x/en/installation/ha/migrating-from-rke-all-in-one/_index.md +++ b/content/rancher/v2.x/en/installation/ha/migrating-from-rke-all-in-one/_index.md @@ -7,7 +7,7 @@ The following instructions will help guide you through migrating from the RKE Al You will need the to have [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl) installed and `kube_config_rancher-cluster.yml` credentials file generated by RKE. -> NOTE: This guide assumes a standard Rancher install. If you have modified any of the object names or namespaces, please adjust accordingly. +> **Note:** This guide assumes a standard Rancher install. If you have modified any of the object names or namespaces, please adjust accordingly. ### Point kubectl at your Rancher Cluster @@ -38,7 +38,7 @@ kubectl -n cattle-system get secret cattle-keys-server -o jsonpath --template='{ Remove the kubernetes objects created by the RKE install. -> NOTE: Removing these Kubernetes components will not affect the Rancher configuration or database, but with any maintenance it is a good idea to create a backup of the data before hand. See [Creating Backups-HA Install]({{< baseurl >}}/rancher/v2.x/en/backups/backups/ha-backups) for details. +> **Note:** Removing these Kubernetes components will not affect the Rancher configuration or database, but with any maintenance it is a good idea to create a backup of the data before hand. See [Creating Backups-HA Install]({{< baseurl >}}/rancher/v2.x/en/backups/backups/ha-backups) for details. ``` kubectl -n cattle-system delete ingress cattle-ingress-http From 1d27cdd4bddcb9d378cd1ae3270cdb797465eb77 Mon Sep 17 00:00:00 2001 From: Jason Greathouse Date: Mon, 13 Aug 2018 13:31:09 -0500 Subject: [PATCH 15/18] move private-ca to single-node, move cleaning-cluster-nodes to faq --- .../cleaning-cluster-nodes/_index.md | 2 +- .../v2.x/en/installation/removing-rancher/_index.md | 12 ------------ .../single-node/advanced-options/_index.md | 3 ++- .../private-ca-root-certificate}/_index.md | 2 +- 4 files changed, 4 insertions(+), 15 deletions(-) rename content/rancher/v2.x/en/{installation/removing-rancher => faq}/cleaning-cluster-nodes/_index.md (99%) delete mode 100644 content/rancher/v2.x/en/installation/removing-rancher/_index.md rename content/rancher/v2.x/en/installation/{custom-ca-root-certificate => single-node/advanced-options/private-ca-root-certificate}/_index.md (97%) diff --git a/content/rancher/v2.x/en/installation/removing-rancher/cleaning-cluster-nodes/_index.md b/content/rancher/v2.x/en/faq/cleaning-cluster-nodes/_index.md similarity index 99% rename from content/rancher/v2.x/en/installation/removing-rancher/cleaning-cluster-nodes/_index.md rename to content/rancher/v2.x/en/faq/cleaning-cluster-nodes/_index.md index 29fda3d5053..a582dfe6a2e 100644 --- a/content/rancher/v2.x/en/installation/removing-rancher/cleaning-cluster-nodes/_index.md +++ b/content/rancher/v2.x/en/faq/cleaning-cluster-nodes/_index.md @@ -183,4 +183,4 @@ Chains | iptables -L -t nat iptables -L -t mangle iptables -L -``` +``` \ No newline at end of file diff --git a/content/rancher/v2.x/en/installation/removing-rancher/_index.md b/content/rancher/v2.x/en/installation/removing-rancher/_index.md deleted file mode 100644 index 3a9f7d56271..00000000000 --- a/content/rancher/v2.x/en/installation/removing-rancher/_index.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -title: Removing Rancher -weight: 375 ---- - -This section contains instructions on how to remove Rancher or nodes added to clusters. - -Choose from the following options: - -- [Cleaning cluster nodes]({{< baseurl >}}/rancher/v2.x/en/installation/removing-rancher/cleaning-cluster-nodes) - - In this section, you can find steps to clean nodes that have been added to clusters created in Rancher. diff --git a/content/rancher/v2.x/en/installation/single-node/advanced-options/_index.md b/content/rancher/v2.x/en/installation/single-node/advanced-options/_index.md index a2e251d49c4..7764115530c 100644 --- a/content/rancher/v2.x/en/installation/single-node/advanced-options/_index.md +++ b/content/rancher/v2.x/en/installation/single-node/advanced-options/_index.md @@ -5,4 +5,5 @@ weight: 250 * [Air Gap Installation](air-gap-installation) * [HTTP/S Proxy Configuration](proxy-configuration) -* [Using an External Load Balancer](single-node-install-external-lb) \ No newline at end of file +* [Using an External Load Balancer](single-node-install-external-lb) +* [Using a Private CA Root Certificate](private-ca-root-certificate) \ No newline at end of file diff --git a/content/rancher/v2.x/en/installation/custom-ca-root-certificate/_index.md b/content/rancher/v2.x/en/installation/single-node/advanced-options/private-ca-root-certificate/_index.md similarity index 97% rename from content/rancher/v2.x/en/installation/custom-ca-root-certificate/_index.md rename to content/rancher/v2.x/en/installation/single-node/advanced-options/private-ca-root-certificate/_index.md index 423c087784d..275fc2408a8 100644 --- a/content/rancher/v2.x/en/installation/custom-ca-root-certificate/_index.md +++ b/content/rancher/v2.x/en/installation/single-node/advanced-options/private-ca-root-certificate/_index.md @@ -1,5 +1,5 @@ --- -title: Adding custom CA root certificates +title: Using a Private CA Root Certificate weight: 365 --- Services that Rancher needs to access are sometimes configured with a certificate from an custom/internal Certificate Authority (CA) root, also known as self signed certificate. If the presented certificate from the service cannot be validated by Rancher, the following error will appear: `x509: certificate signed by unknown authority`. From 1ed4b9076236bdc522ec4e92d0323996d9f0fd56 Mon Sep 17 00:00:00 2001 From: Jason Greathouse Date: Mon, 13 Aug 2018 13:37:21 -0500 Subject: [PATCH 16/18] push server-tags down the list --- content/rancher/v2.x/en/installation/server-tags/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/installation/server-tags/_index.md b/content/rancher/v2.x/en/installation/server-tags/_index.md index 2eae26dfe6d..c3f3130667f 100644 --- a/content/rancher/v2.x/en/installation/server-tags/_index.md +++ b/content/rancher/v2.x/en/installation/server-tags/_index.md @@ -1,6 +1,6 @@ --- title: Server Tags -weight: 200 +weight: 2000 --- {{< product >}} Server is distributed as a Docker image, which have _tags_ attached to them. Tags are used to identify what version is included in the image. Rancher includes additional tags that point to a specific version. Remember that if you use the additional tags, you must explicitly pull a new version of that image tag. Otherwise it will use the cached image on the host. From e2ce8ac9ef773bbda1e6f9b2cb51c5ee4467192c Mon Sep 17 00:00:00 2001 From: Jason Greathouse Date: Tue, 14 Aug 2018 14:32:15 -0500 Subject: [PATCH 17/18] make extention consistent --- .../rancher/v2.x/en/installation/ha/kubernetes-rke/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/installation/ha/kubernetes-rke/_index.md b/content/rancher/v2.x/en/installation/ha/kubernetes-rke/_index.md index fffac4ad1ba..a27e908462b 100644 --- a/content/rancher/v2.x/en/installation/ha/kubernetes-rke/_index.md +++ b/content/rancher/v2.x/en/installation/ha/kubernetes-rke/_index.md @@ -46,7 +46,7 @@ Please see the [RKE Documentation]({{< baseurl >}}/rke/v0.1.x/en/) for the full ### Run RKE ``` -rke up --config ./rancher-cluster.yaml +rke up --config ./rancher-cluster.yml ``` ### Testing your cluster From ab118d891d4cbee8130babc033fb450c62a7e71d Mon Sep 17 00:00:00 2001 From: Jason Greathouse Date: Tue, 14 Aug 2018 17:09:39 -0500 Subject: [PATCH 18/18] refactor links to long format --- content/rancher/v2.x/en/installation/_index.md | 6 +++--- content/rancher/v2.x/en/installation/ha/_index.md | 12 ++++++------ .../en/installation/ha/create-nodes-lb/_index.md | 4 ++-- .../v2.x/en/installation/ha/helm-init/_index.md | 2 +- .../v2.x/en/installation/ha/helm-rancher/_index.md | 12 ++++++------ .../ha/helm-rancher/chart-options/_index.md | 2 +- .../v2.x/en/installation/ha/kubernetes-rke/_index.md | 4 ++-- .../ha/kubernetes-rke/troubleshooting/_index.md | 2 +- .../ha/migrating-from-rke-all-in-one/_index.md | 4 ++-- .../v2.x/en/installation/ha/rke-all-in-one/_index.md | 6 +++--- .../v2.x/en/installation/single-node/_index.md | 2 +- .../single-node/advanced-options/_index.md | 8 ++++---- .../single-node-install-external-lb/_index.md | 2 +- 13 files changed, 33 insertions(+), 33 deletions(-) diff --git a/content/rancher/v2.x/en/installation/_index.md b/content/rancher/v2.x/en/installation/_index.md index 62fdbccf749..6493b977fb9 100644 --- a/content/rancher/v2.x/en/installation/_index.md +++ b/content/rancher/v2.x/en/installation/_index.md @@ -6,16 +6,16 @@ This section contains instructions for installing Rancher in development and pro ### Installation Options -- [Single Node Installation](single-node/) +- [Single Node Installation]({{< baseurl >}}/rancher/v2.x/en/installation/single-node/) Install Rancher on a single Linux host. -- [High Availability Installation](ha/) +- [High Availability Installation]({{< baseurl >}}/rancher/v2.x/en/installation/single-node/ha/) This install scenario creates a new Kubernetes cluster dedicated to running Rancher Server in a high-availability (HA) configuration. ### Reference -- [Port Requirements](references/) +- [Port Requirements]({{< baseurl >}}/rancher/v2.x/en/installation/single-node/references/) List of required ports you must open to operate Rancher. diff --git a/content/rancher/v2.x/en/installation/ha/_index.md b/content/rancher/v2.x/en/installation/ha/_index.md index ea8072ec8b3..ba365960641 100644 --- a/content/rancher/v2.x/en/installation/ha/_index.md +++ b/content/rancher/v2.x/en/installation/ha/_index.md @@ -29,12 +29,12 @@ The following CLI tools are required for this install. Please make sure these to ## Installation Outline -1. [Create Nodes and Load Balancer](create-nodes-lb/) -1. [Install Kubernetes with RKE](kubernetes-rke/) -1. [Initialize Helm (tiller)](helm-init/) -1. [Install Rancher](helm-rancher/) +1. [Create Nodes and Load Balancer]({{< baseurl >}}/rancher/v2.x/en/installation/ha/create-nodes-lb/) +1. [Install Kubernetes with RKE]({{< baseurl >}}/rancher/v2.x/en/installation/ha/kubernetes-rke/) +1. [Initialize Helm (tiller)]({{< baseurl >}}/rancher/v2.x/en/installation/ha/helm-init/) +1. [Install Rancher]({{< baseurl >}}/rancher/v2.x/en/installation/ha/helm-rancher/) ## Additional Install Options -* [Migrating from RKE all-in-one install](migrating-from-rke-all-in-one/) -* [RKE all-in-one install](rke-all-in-one/) \ No newline at end of file +* [Migrating from RKE all-in-one install]({{< baseurl >}}/rancher/v2.x/en/installation/ha/migrating-from-rke-all-in-one/) +* [RKE all-in-one install]({{< baseurl >}}/rancher/v2.x/en/installation/ha/rke-all-in-one/) \ No newline at end of file diff --git a/content/rancher/v2.x/en/installation/ha/create-nodes-lb/_index.md b/content/rancher/v2.x/en/installation/ha/create-nodes-lb/_index.md index 69d37b8220b..1a00ac78b24 100644 --- a/content/rancher/v2.x/en/installation/ha/create-nodes-lb/_index.md +++ b/content/rancher/v2.x/en/installation/ha/create-nodes-lb/_index.md @@ -41,8 +41,8 @@ Configure a load balancer as a basic Layer 4 TCP forwarder. The exact configurat #### Examples -* [Amazon NLB](nlb/) +* [Amazon NLB]({{< baseurl >}}/rancher/v2.x/en/installation/ha/create-nodes-lb/nlb/)
-### [Next: Install Kubernetes with RKE](../kubernetes-rke/) \ No newline at end of file +### [Next: Install Kubernetes with RKE]({{< baseurl >}}/rancher/v2.x/en/installation/ha/kubernetes-rke/) \ No newline at end of file diff --git a/content/rancher/v2.x/en/installation/ha/helm-init/_index.md b/content/rancher/v2.x/en/installation/ha/helm-init/_index.md index 8bf567a9d86..4ce856866ef 100644 --- a/content/rancher/v2.x/en/installation/ha/helm-init/_index.md +++ b/content/rancher/v2.x/en/installation/ha/helm-init/_index.md @@ -65,4 +65,4 @@ helm init --service-account tiller > NOTE: This `tiller` install has full cluster access, which should be acceptable if the cluster is dedicated to Rancher server. Check out the [helm docs](https://docs.helm.sh/using_helm/#role-based-access-control) for restricting `tiller` access to suit your security requirements. -### [Next: Install Rancher](../helm-rancher/) \ No newline at end of file +### [Next: Install Rancher]({{< baseurl >}}/rancher/v2.x/en/installation/ha//helm-rancher/) \ No newline at end of file diff --git a/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md b/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md index 4070ead937c..8542eb3dd05 100644 --- a/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md +++ b/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md @@ -79,17 +79,17 @@ helm install rancher-stable/rancher --name rancher --namespace cattle-system \ --set ingress.tls.source=secret ``` -Now that Rancher is running, see [Adding TLS Secrets](tls-secrets/) to publish the certificate files so Rancher and the Ingress Controller can use them. +Now that Rancher is running, see [Adding TLS Secrets]({{< baseurl >}}/rancher/v2.x/en/installation/ha/helm-rancher/tls-secrets/) to publish the certificate files so Rancher and the Ingress Controller can use them. ### Advanced Configurations The Rancher chart configuration has many options for customizing the install to suit your specific environment. Here are some common advanced scenarios. -* [HTTP Proxy](chart-options/#http-proxy) -* [Private Docker Image Registry/Air Gap Network](chart-options/#private-or-air-gap-registry) -* [TLS Termination on an External Load Balancer](chart-options/#external-tls-termination) +* [HTTP Proxy]({{< baseurl >}}/rancher/v2.x/en/installation/ha/helm-rancher/chart-options/#http-proxy) +* [Private Docker Image Registry/Air Gap Network]({{< baseurl >}}/rancher/v2.x/en/installation/ha/helm-rancher/chart-options/#private-or-air-gap-registry) +* [TLS Termination on an External Load Balancer]({{< baseurl >}}/rancher/v2.x/en/installation/ha/helm-rancher/chart-options/#external-tls-termination) -See the [Chart Options](chart-options/) for the full list of options. +See the [Chart Options]({{< baseurl >}}/rancher/v2.x/en/installation/ha/helm-rancher/chart-options/) for the full list of options. ### Save your options @@ -99,4 +99,4 @@ Make sure you save the `--set` options you used. You will need to use the same o That's it you should have a functional Rancher server. Point a browser at the hostname you picked and you should be greeted by the colorful login page. -Doesn't Work? Take a look at the [Troubleshooting](troubleshooting/) Page +Doesn't Work? Take a look at the [Troubleshooting]({{< baseurl >}}/rancher/v2.x/en/installation/ha/helm-rancher/troubleshooting/) Page diff --git a/content/rancher/v2.x/en/installation/ha/helm-rancher/chart-options/_index.md b/content/rancher/v2.x/en/installation/ha/helm-rancher/chart-options/_index.md index 0cc9df9bee8..2b60ca99456 100644 --- a/content/rancher/v2.x/en/installation/ha/helm-rancher/chart-options/_index.md +++ b/content/rancher/v2.x/en/installation/ha/helm-rancher/chart-options/_index.md @@ -76,7 +76,7 @@ Add the `rancherImage` to point to your private registry image and `imagePullSec If you wish to terminate the SSL/TLS on a load-balancer external to the Rancher cluster (ingress), use the `--tls=external` option and point your load balancer at port http 80 on all of the rancher cluster nodes. -> NOTE: If you are using a Private CA signed cert, add `--set privateCA=true` and see [Adding TLS Secrets - Private CA Signed - Additional Steps](../tls-secrets/#private-ca-signed---additional-steps) to add the CA cert for Rancher. +> NOTE: If you are using a Private CA signed cert, add `--set privateCA=true` and see [Adding TLS Secrets - Private CA Signed - Additional Steps]({{< baseurl >}}/rancher/v2.x/en/installation/ha/helm-rancher/tls-secrets/#private-ca-signed---additional-steps) to add the CA cert for Rancher. Your load balancer must support long lived websocket connections and will need to insert proxy headers so Rancher can route links correctly. diff --git a/content/rancher/v2.x/en/installation/ha/kubernetes-rke/_index.md b/content/rancher/v2.x/en/installation/ha/kubernetes-rke/_index.md index a27e908462b..556760f3000 100644 --- a/content/rancher/v2.x/en/installation/ha/kubernetes-rke/_index.md +++ b/content/rancher/v2.x/en/installation/ha/kubernetes-rke/_index.md @@ -76,6 +76,6 @@ Save a copy of the `kube_config_rancher-cluster.yml` and `rancher-cluster.yml` f ### Issues or errors? -See the [Troubleshooting](troubleshooting/) page. +See the [Troubleshooting]({{< baseurl >}}/rancher/v2.x/en/installation/ha/kubernetes-rke/troubleshooting/) page. -### [Next: Initialize Helm](../helm-init/) \ No newline at end of file +### [Next: Initialize Helm]({{< baseurl >}}/rancher/v2.x/en/installation/ha/helm-init/) \ No newline at end of file diff --git a/content/rancher/v2.x/en/installation/ha/kubernetes-rke/troubleshooting/_index.md b/content/rancher/v2.x/en/installation/ha/kubernetes-rke/troubleshooting/_index.md index 3e354320768..6e677bc0f18 100644 --- a/content/rancher/v2.x/en/installation/ha/kubernetes-rke/troubleshooting/_index.md +++ b/content/rancher/v2.x/en/installation/ha/kubernetes-rke/troubleshooting/_index.md @@ -31,7 +31,7 @@ SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.10 ##### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain -* The key file specified as `ssh_key_path` is not correct for accesing the node. Double-check if you specified the correct `ssh_key_path` for the node and if you specified the correct user to connect with. +* The key file specified as `ssh_key_path` is not correct for accessing the node. Double-check if you specified the correct `ssh_key_path` for the node and if you specified the correct user to connect with. ##### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: Error configuring SSH: ssh: cannot decode encrypted private keys diff --git a/content/rancher/v2.x/en/installation/ha/migrating-from-rke-all-in-one/_index.md b/content/rancher/v2.x/en/installation/ha/migrating-from-rke-all-in-one/_index.md index ec8d135ccbf..a90aabe6a3b 100644 --- a/content/rancher/v2.x/en/installation/ha/migrating-from-rke-all-in-one/_index.md +++ b/content/rancher/v2.x/en/installation/ha/migrating-from-rke-all-in-one/_index.md @@ -52,5 +52,5 @@ kubectl -n cattle-system delete serviceaccount cattle-admin From here follow the standard install steps. -* [3 - Initialize Helm (Install tiller)](../helm-init/) -* [4 - Install Rancher](../helm-rancher/) +* [3 - Initialize Helm (Install tiller)]({{< baseurl >}}/rancher/v2.x/en/installation/ha/helm-init/) +* [4 - Install Rancher]({{< baseurl >}}/rancher/v2.x/en/installation/ha/helm-rancher/) diff --git a/content/rancher/v2.x/en/installation/ha/rke-all-in-one/_index.md b/content/rancher/v2.x/en/installation/ha/rke-all-in-one/_index.md index fda319a3c4e..4b3cb65c1f0 100644 --- a/content/rancher/v2.x/en/installation/ha/rke-all-in-one/_index.md +++ b/content/rancher/v2.x/en/installation/ha/rke-all-in-one/_index.md @@ -5,6 +5,6 @@ weight: 276 Rancher can be installed by providing the appropriate Kubernetes manifest configurations to RKE's `addons` feature. See the following instructions for examples appropriate to your environment. -* [High Availability Installation with External Load Balancer (TCP/Layer 4)](layer-4-lb/) -* [High Availability Installation with External Load Balancer (HTTPS/Layer 7)](layer-7-lb/) -* [Troubleshooting RKE All-In-One Installs](troubleshooting/) +* [High Availability Installation with External Load Balancer (TCP/Layer 4)]({{< baseurl >}}/rancher/v2.x/installation/ha/rke-all-in-one/layer-4-lb/) +* [High Availability Installation with External Load Balancer (HTTPS/Layer 7)]({{< baseurl >}}/rancher/v2.x/installation/ha/rke-all-in-one/layer-7-lb/) +* [Troubleshooting RKE All-In-One Installs]({{< baseurl >}}/rancher/v2.x/installation/ha/rke-all-in-one/troubleshooting/) diff --git a/content/rancher/v2.x/en/installation/single-node/_index.md b/content/rancher/v2.x/en/installation/single-node/_index.md index 0f9458f1a35..8c4df50be0c 100644 --- a/content/rancher/v2.x/en/installation/single-node/_index.md +++ b/content/rancher/v2.x/en/installation/single-node/_index.md @@ -5,7 +5,7 @@ weight: 250 For development environments, we recommend installing Rancher by running a single Docker container. In this installation scenario, you'll install Docker on a single Linux host, and then install Rancher on your host using a single Docker container. >**Want to use an external load balancer?** -> See [Single Node Installation with an External Load Balancer](advanced-options/single-node-install-external-lb) instead. +> See [Single Node Installation with an External Load Balancer]({{< baseurl >}}/rancher/v2.x/en/installation/single-node/advanced-options/single-node-install-external-lb) instead. ## Installation Outline diff --git a/content/rancher/v2.x/en/installation/single-node/advanced-options/_index.md b/content/rancher/v2.x/en/installation/single-node/advanced-options/_index.md index 7764115530c..64d66862152 100644 --- a/content/rancher/v2.x/en/installation/single-node/advanced-options/_index.md +++ b/content/rancher/v2.x/en/installation/single-node/advanced-options/_index.md @@ -3,7 +3,7 @@ title: Advanced Install Options weight: 250 --- -* [Air Gap Installation](air-gap-installation) -* [HTTP/S Proxy Configuration](proxy-configuration) -* [Using an External Load Balancer](single-node-install-external-lb) -* [Using a Private CA Root Certificate](private-ca-root-certificate) \ No newline at end of file +* [Air Gap Installation]({{< baseurl >}}/rancher/v2.x/en/installation/single-node/advanced-options/air-gap-installation) +* [HTTP/S Proxy Configuration]({{< baseurl >}}/rancher/v2.x/en/installation/single-node/advanced-options/proxy-configuration) +* [Using an External Load Balancer]({{< baseurl >}}/rancher/v2.x/en/installation/single-node/advanced-options/single-node-install-external-lb) +* [Using a Private CA Root Certificate]({{< baseurl >}}/rancher/v2.x/en/installation/single-node/advanced-options/private-ca-root-certificate) \ No newline at end of file diff --git a/content/rancher/v2.x/en/installation/single-node/advanced-options/single-node-install-external-lb/_index.md b/content/rancher/v2.x/en/installation/single-node/advanced-options/single-node-install-external-lb/_index.md index ffb4f677db1..b85ee0326a5 100644 --- a/content/rancher/v2.x/en/installation/single-node/advanced-options/single-node-install-external-lb/_index.md +++ b/content/rancher/v2.x/en/installation/single-node/advanced-options/single-node-install-external-lb/_index.md @@ -8,7 +8,7 @@ For development environments, we recommend installing Rancher by running a singl >**Want to skip the external load balancer?** -> See [Single Node Installation]({{< baseurl >}}/rancher/v2.x/en/installation/single-node-install) instead. +> See [Single Node Installation]({{< baseurl >}}/rancher/v2.x/en/installation/single-node) instead.