public/rancher-docs
1
0 Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-11-09 10:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
3ea1b85e613f07be5d2d1e015f7397ff48d5dfd8
rancher-docs/assets/js/0e43428f.d46c2e43.js
T

1 line
9.5 KiB
JavaScript
Raw Blame History

"use strict";(self.webpackChunkrancher_docs=self.webpackChunkrancher_docs||[]).push([[65608],{3905:(e,t,n)=>{n.d(t,{Zo:()=>d,kt:()=>m});var a=n(67294);function r(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function s(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);t&&(a=a.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,a)}return n}function o(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?s(Object(n),!0).forEach((function(t){r(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):s(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function i(e,t){if(null==e)return{};var n,a,r=function(e,t){if(null==e)return{};var n,a,r={},s=Object.keys(e);for(a=0;a<s.length;a++)n=s[a],t.indexOf(n)>=0||(r[n]=e[n]);return r}(e,t);if(Object.getOwnPropertySymbols){var s=Object.getOwnPropertySymbols(e);for(a=0;a<s.length;a++)n=s[a],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(r[n]=e[n])}return r}var l=a.createContext({}),c=function(e){var t=a.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):o(o({},t),e)),n},d=function(e){var t=c(e.components);return a.createElement(l.Provider,{value:t},e.children)},p={inlineCode:"code",wrapper:function(e){var t=e.children;return a.createElement(a.Fragment,{},t)}},u=a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,s=e.originalType,l=e.parentName,d=i(e,["components","mdxType","originalType","parentName"]),u=c(n),m=r,y=u["".concat(l,".").concat(m)]||u[m]||p[m]||s;return n?a.createElement(y,o(o({ref:t},d),{},{components:n})):a.createElement(y,o({ref:t},d))}));function m(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var s=n.length,o=new Array(s);o[0]=u;var i={};for(var l in t)hasOwnProperty.call(t,l)&&(i[l]=t[l]);i.originalType=e,i.mdxType="string"==typeof e?e:r,o[1]=i;for(var c=2;c<s;c++)o[c]=n[c];return a.createElement.apply(null,o)}return a.createElement.apply(null,n)}u.displayName="MDXCreateElement"},41241:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>l,contentTitle:()=>o,default:()=>p,frontMatter:()=>s,metadata:()=>i,toc:()=>c});var a=n(87462),r=(n(67294),n(3905));const s={title:"Template for an RKE Cluster with a Self-signed Certificate and Layer 4 Load Balancer"},o=void 0,i={unversionedId:"getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/cluster-yml-templates/node-certificate",id:"version-2.0-2.4/getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/cluster-yml-templates/node-certificate",title:"Template for an RKE Cluster with a Self-signed Certificate and Layer 4 Load Balancer",description:"RKE uses a cluster.yml file to install and configure your Kubernetes cluster.",source:"@site/versioned_docs/version-2.0-2.4/getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/cluster-yml-templates/node-certificate.md",sourceDirName:"getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/cluster-yml-templates",slug:"/getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/cluster-yml-templates/node-certificate",permalink:"/v2.0-v2.4/getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/cluster-yml-templates/node-certificate",draft:!1,editUrl:"https://github.com/rancher/rancher-docs/edit/main/versioned_docs/version-2.0-2.4/getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/cluster-yml-templates/node-certificate.md",tags:[],version:"2.0-2.4",lastUpdatedAt:1663953084,formattedLastUpdatedAt:"Sep 23, 2022",frontMatter:{title:"Template for an RKE Cluster with a Self-signed Certificate and Layer 4 Load Balancer"},sidebar:"tutorialSidebar",previous:{title:"cluster.yml Templates for RKE add-on installs",permalink:"/v2.0-v2.4/pages-for-subheaders/cluster-yml"},next:{title:"Template for an RKE Cluster with a Certificate Signed by Recognized CA and a Layer 4 Load Balancer",permalink:"/v2.0-v2.4/getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/cluster-yml-templates/node-certificate-recognizedca"}},l={},c=[],d={toc:c};function p(e){let{components:t,...n}=e;return(0,r.kt)("wrapper",(0,a.Z)({},d,n,{components:t,mdxType:"MDXLayout"}),(0,r.kt)("p",null,"RKE uses a cluster.yml file to install and configure your Kubernetes cluster."),(0,r.kt)("p",null,"This template is intended to be used for RKE add-on installs, which are only supported up to Rancher v2.0.8. Please use the Rancher Helm chart if you are installing a newer Rancher version."),(0,r.kt)("p",null,"The following template can be used for the cluster.yml if you have a setup with:"),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Self-signed SSL"),(0,r.kt)("li",{parentName:"ul"},"Layer 4 load balancer"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"https://kubernetes.github.io/ingress-nginx/"},"NGINX Ingress controller"))),(0,r.kt)("blockquote",null,(0,r.kt)("p",{parentName:"blockquote"},"For more options, refer to ",(0,r.kt)("a",{parentName:"p",href:"https://rancher.com/docs/rke/latest/en/config-options/"},"RKE Documentation: Config Options"),".")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre",className:"language-yaml"},'nodes:\n - address: <IP> # hostname or IP to access nodes\n user: <USER> # root user (usually \'root\')\n role: [controlplane,etcd,worker] # K8s roles for node\n ssh_key_path: <PEM_FILE> # path to PEM file\n - address: <IP>\n user: <USER>\n role: [controlplane,etcd,worker]\n ssh_key_path: <PEM_FILE>\n - address: <IP>\n user: <USER>\n role: [controlplane,etcd,worker]\n ssh_key_path: <PEM_FILE>\n\nservices:\n etcd:\n snapshot: true\n creation: 6h\n retention: 24h\n\naddons: |-\n ---\n kind: Namespace\n apiVersion: v1\n metadata:\n name: cattle-system\n ---\n kind: ServiceAccount\n apiVersion: v1\n metadata:\n name: cattle-admin\n namespace: cattle-system\n ---\n kind: ClusterRoleBinding\n apiVersion: rbac.authorization.k8s.io/v1\n metadata:\n name: cattle-crb\n namespace: cattle-system\n subjects:\n - kind: ServiceAccount\n name: cattle-admin\n namespace: cattle-system\n roleRef:\n kind: ClusterRole\n name: cluster-admin\n apiGroup: rbac.authorization.k8s.io\n ---\n apiVersion: v1\n kind: Secret\n metadata:\n name: cattle-keys-ingress\n namespace: cattle-system\n type: Opaque\n data:\n tls.crt: <BASE64_CRT> # ssl cert for ingress. If selfsigned, must be signed by same CA as cattle server\n tls.key: <BASE64_KEY> # ssl key for ingress. If selfsigned, must be signed by same CA as cattle server\n ---\n apiVersion: v1\n kind: Secret\n metadata:\n name: cattle-keys-server\n namespace: cattle-system\n type: Opaque\n data:\n cacerts.pem: <BASE64_CA> # CA cert used to sign cattle server cert and key\n ---\n apiVersion: v1\n kind: Service\n metadata:\n namespace: cattle-system\n name: cattle-service\n labels:\n app: cattle\n spec:\n ports:\n - port: 80\n targetPort: 80\n protocol: TCP\n name: http\n - port: 443\n targetPort: 443\n protocol: TCP\n name: https\n selector:\n app: cattle\n ---\n apiVersion: extensions/v1beta1\n kind: Ingress\n metadata:\n namespace: cattle-system\n name: cattle-ingress-http\n annotations:\n nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"\n nginx.ingress.kubernetes.io/proxy-read-timeout: "1800" # Max time in seconds for ws to remain shell window open\n nginx.ingress.kubernetes.io/proxy-send-timeout: "1800" # Max time in seconds for ws to remain shell window open\n spec:\n rules:\n - host: <FQDN> # FQDN to access cattle server\n http:\n paths:\n - backend:\n serviceName: cattle-service\n servicePort: 80\n tls:\n - secretName: cattle-keys-ingress\n hosts:\n - <FQDN> # FQDN to access cattle server\n ---\n kind: Deployment\n apiVersion: extensions/v1beta1\n metadata:\n namespace: cattle-system\n name: cattle\n spec:\n replicas: 1\n template:\n metadata:\n labels:\n app: cattle\n spec:\n serviceAccountName: cattle-admin\n containers:\n # Rancher install via RKE addons is only supported up to v2.0.8\n - image: rancher/rancher:v2.0.8\n imagePullPolicy: Always\n name: cattle-server\n # env:\n # - name: HTTP_PROXY\n # value: "http://your_proxy_address:port"\n # - name: HTTPS_PROXY\n # value: "http://your_proxy_address:port"\n # - name: NO_PROXY\n # value: "localhost,127.0.0.1,0.0.0.0,10.43.0.0/16,your_network_ranges_that_dont_need_proxy_to_access"\n livenessProbe:\n httpGet:\n path: /ping\n port: 80\n initialDelaySeconds: 60\n periodSeconds: 60\n readinessProbe:\n httpGet:\n path: /ping\n port: 80\n initialDelaySeconds: 20\n periodSeconds: 10\n ports:\n - containerPort: 80\n protocol: TCP\n - containerPort: 443\n protocol: TCP\n volumeMounts:\n - mountPath: /etc/rancher/ssl\n name: cattle-keys-volume\n readOnly: true\n volumes:\n - name: cattle-keys-volume\n secret:\n defaultMode: 420\n secretName: cattle-keys-server\n')))}p.isMDXComponent=!0}}]);
Reference in new issue View Git Blame Copy Permalink