mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-10-14 05:36:13 +00:00
17 lines
61 KiB
HTML
17 lines
61 KiB
HTML
<!doctype html>
|
||
<html lang="zh" dir="ltr" class="docs-wrapper docs-doc-page docs-version-current plugin-docs plugin-id-default docs-doc-id-reference-guides/installation-references/helm-chart-options">
|
||
<head>
|
||
<meta charset="UTF-8">
|
||
<meta name="viewport" content="width=device-width,initial-scale=1">
|
||
<meta name="generator" content="Docusaurus v2.0.0-beta.21">
|
||
<link rel="search" type="application/opensearchdescription+xml" title="Rancher Manager" href="/zh/opensearch.xml"><title data-rh="true">Rancher Helm Chart 选项 | Rancher Manager</title><meta data-rh="true" name="twitter:card" content="summary_large_image"><meta data-rh="true" property="og:url" content="http://docs.ranchermanager.rancher.io//zh/reference-guides/installation-references/helm-chart-options"><meta data-rh="true" name="docusaurus_locale" content="zh"><meta data-rh="true" name="docsearch:language" content="zh"><meta data-rh="true" name="docusaurus_version" content="current"><meta data-rh="true" name="docusaurus_tag" content="docs-default-current"><meta data-rh="true" name="docsearch:version" content="current"><meta data-rh="true" name="docsearch:docusaurus_tag" content="docs-default-current"><meta data-rh="true" property="og:title" content="Rancher Helm Chart 选项 | Rancher Manager"><meta data-rh="true" name="description" content="本文提供了 Rancher Helm Chart 的配置参考。"><meta data-rh="true" property="og:description" content="本文提供了 Rancher Helm Chart 的配置参考。"><link data-rh="true" rel="icon" href="/zh/img/favicon.png"><link data-rh="true" rel="canonical" href="http://docs.ranchermanager.rancher.io//zh/reference-guides/installation-references/helm-chart-options"><link data-rh="true" rel="alternate" href="http://docs.ranchermanager.rancher.io//reference-guides/installation-references/helm-chart-options" hreflang="en"><link data-rh="true" rel="alternate" href="http://docs.ranchermanager.rancher.io//zh/reference-guides/installation-references/helm-chart-options" hreflang="zh"><link data-rh="true" rel="alternate" href="http://docs.ranchermanager.rancher.io//reference-guides/installation-references/helm-chart-options" hreflang="x-default"><link data-rh="true" rel="preconnect" href="https://30NEY6C9UY-dsn.algolia.net" crossorigin="anonymous"><link rel="stylesheet" href="/zh/assets/css/styles.27db6f3b.css">
|
||
<link rel="preload" href="/zh/assets/js/runtime~main.f10e0fa4.js" as="script">
|
||
<link rel="preload" href="/zh/assets/js/main.59e3f7b9.js" as="script">
|
||
</head>
|
||
<body class="navigation-with-keyboard">
|
||
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
|
||
<div role="region"><a href="#" class="skipToContent_fXgn">跳到主要内容</a></div><nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Navigation bar toggle" class="navbar__toggle clean-btn" type="button" tabindex="0"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/zh/"><div class="navbar__logo"><img src="/zh/img/rancher-logo-horiz-color.svg" alt="logo" class="themedImage_ToTc themedImage--light_HNdA"><img src="/zh/img/rancher-logo-horiz-color.svg" alt="logo" class="themedImage_ToTc themedImage--dark_i4oU"></div><b class="navbar__title text--truncate"></b></a><div class="navbar__item dropdown dropdown--hoverable"><a aria-current="page" class="navbar__link active" aria-haspopup="true" aria-expanded="false" role="button" href="/zh/">v2.6</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/zh/reference-guides/installation-references/helm-chart-options">v2.6</a></li><li><a class="dropdown__link" href="/zh/v2.5/reference-guides/installation-references/helm-chart-options">v2.5</a></li><li><a class="dropdown__link" href="/zh/v2.0-v2.4/reference-guides/installation-references/helm-chart-options">v2.0-v2.4</a></li><li><a class="dropdown__link" href="/zh/versions">All versions</a></li></ul></div></div><div class="navbar__items navbar__items--right"><a aria-current="page" class="navbar__item navbar__link navbar__docs navbar__link--active" href="/zh/">文档</a><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a href="#" aria-haspopup="true" aria-expanded="false" role="button" class="navbar__link"><svg viewBox="0 0 24 24" width="20" height="20" aria-hidden="true" class="iconLanguage_nlXk"><path fill="currentColor" d="M12.87 15.07l-2.54-2.51.03-.03c1.74-1.94 2.98-4.17 3.71-6.53H17V4h-7V2H8v2H1v1.99h11.17C11.5 7.92 10.44 9.75 9 11.35 8.07 10.32 7.3 9.19 6.69 8h-2c.73 1.63 1.73 3.17 2.98 4.56l-5.09 5.02L4 19l5-5 3.11 3.11.76-2.04zM18.5 10h-2L12 22h2l1.12-3h4.75L21 22h2l-4.5-12zm-2.62 7l1.62-4.33L19.12 17h-3.24z"></path></svg>简体中文</a><ul class="dropdown__menu"><li><a href="/reference-guides/installation-references/helm-chart-options" target="_self" rel="noopener noreferrer" class="dropdown__link">English</a></li><li><a href="/zh/reference-guides/installation-references/helm-chart-options" target="_self" rel="noopener noreferrer" class="dropdown__link dropdown__link--active">简体中文</a></li></ul></div><a href="https://github.com/rancher/rancher-docs" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link navbar__github">GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_lCJq"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a><div class="searchBox_ZlJk"><button type="button" class="DocSearch DocSearch-Button" aria-label="搜索"><span class="DocSearch-Button-Container"><svg width="20" height="20" class="DocSearch-Search-Icon" viewBox="0 0 20 20"><path d="M14.386 14.386l4.0877 4.0877-4.0877-4.0877c-2.9418 2.9419-7.7115 2.9419-10.6533 0-2.9419-2.9418-2.9419-7.7115 0-10.6533 2.9418-2.9419 7.7115-2.9419 10.6533 0 2.9419 2.9418 2.9419 7.7115 0 10.6533z" stroke="currentColor" fill="none" fill-rule="evenodd" stroke-linecap="round" stroke-linejoin="round"></path></svg><span class="DocSearch-Button-Placeholder">搜索</span></span><span class="DocSearch-Button-Keys"></span></button></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div class="main-wrapper docsWrapper_BCFX"><button aria-label="回到顶部" class="clean-btn theme-back-to-top-button backToTopButton_sjWU" type="button"></button><div class="docPage__5DB"><aside class="theme-doc-sidebar-container docSidebarContainer_b6E3"><div class="sidebar_njMd"><nav class="menu thin-scrollbar menu_SIkG"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/zh/">Rancher 2.6</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" href="/zh/getting-started">开始使用</a><button aria-label="打开/收起侧边栏菜单「开始使用」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" href="/zh/how-to-guides">操作指南</a><button aria-label="打开/收起侧边栏菜单「操作指南」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--active" aria-expanded="true" href="/zh/reference-guides">参考指南</a><button aria-label="打开/收起侧边栏菜单「参考指南」" type="button" class="clean-btn menu__caret"></button></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/best-practices">最佳实践</a><button aria-label="打开/收起侧边栏菜单「最佳实践」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/rancher-manager-architecture">Rancher Manager 架构</a><button aria-label="打开/收起侧边栏菜单「Rancher Manager 架构」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/cluster-configuration">集群配置</a><button aria-label="打开/收起侧边栏菜单「集群配置」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/single-node-rancher-in-docker">Docker 中的单节点 Rancher</a><button aria-label="打开/收起侧边栏菜单「Docker 中的单节点 Rancher」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--active" aria-expanded="true" tabindex="0" href="/zh/pages-for-subheaders/installation-references">安装参考</a><button aria-label="打开/收起侧边栏菜单「安装参考」" type="button" class="clean-btn menu__caret"></button></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" tabindex="0" href="/zh/reference-guides/installation-references/helm-chart-options">Rancher Helm Chart 选项</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/zh/reference-guides/installation-references/tls-settings">TLS 设置</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/zh/reference-guides/installation-references/feature-flags">功能开关</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/amazon-eks-permissions">Amazon EKS 权限</a><button aria-label="打开/收起侧边栏菜单「Amazon EKS 权限」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/backup-restore-configuration">Backup 和 Restore 配置</a><button aria-label="打开/收起侧边栏菜单「Backup 和 Restore 配置」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/configure-openldap">配置 OpenLDAP</a><button aria-label="打开/收起侧边栏菜单「配置 OpenLDAP」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/zh/reference-guides/kubernetes-concepts">Kubernetes 概念</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/monitoring-v2-configuration">Monitoring V2 配置</a><button aria-label="打开/收起侧边栏菜单「Monitoring V2 配置」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/prometheus-federator">Prometheus Federator</a><button aria-label="打开/收起侧边栏菜单「Prometheus Federator」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/user-settings">用户设置</a><button aria-label="打开/收起侧边栏菜单「用户设置」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/cli-with-rancher">Rancher CLI</a><button aria-label="打开/收起侧边栏菜单「Rancher CLI」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/about-the-api">关于 API</a><button aria-label="打开/收起侧边栏菜单「关于 API」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/zh/reference-guides/rancher-cluster-tools">集群工具:Logging,Monitoring 和可视化</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/zh/reference-guides/rancher-project-tools">项目工具:Logging,Monitoring 和可视化</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/zh/reference-guides/system-tools">系统工具</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/zh/reference-guides/rke1-template-example-yaml">RKE1 示例 YAML</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/pipelines">流水线</a><button aria-label="打开/收起侧边栏菜单「流水线」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/rancher-security">Rancher 安全</a><button aria-label="打开/收起侧边栏菜单「Rancher 安全」" type="button" class="clean-btn menu__caret"></button></div></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" href="/zh/explanations">说明</a><button aria-label="打开/收起侧边栏菜单「说明」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" href="/zh/faq">常见问题</a><button aria-label="打开/收起侧边栏菜单「常见问题」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" href="/zh/troubleshooting">故障排除</a><button aria-label="打开/收起侧边栏菜单「故障排除」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/zh/contribute-to-rancher">参与 Rancher 社区贡献</a></li></ul></nav></div></aside><main class="docMainContainer_gTbr"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_GujU"><div class="docItemContainer_Adtb"><article><nav class="theme-doc-breadcrumbs breadcrumbsContainer_Z_bl" aria-label="页面路径"><ul class="breadcrumbs" itemscope="" itemtype="https://schema.org/BreadcrumbList"><li class="breadcrumbs__item"><a aria-label="主页面" class="breadcrumbs__link" href="/zh/"><svg viewBox="0 0 24 24" class="breadcrumbHomeIcon_OVgt"><path d="M10 19v-5h4v5c0 .55.45 1 1 1h3c.55 0 1-.45 1-1v-7h1.7c.46 0 .68-.57.33-.87L12.67 3.6c-.38-.34-.96-.34-1.34 0l-8.36 7.53c-.34.3-.13.87.33.87H5v7c0 .55.45 1 1 1h3c.55 0 1-.45 1-1z" fill="currentColor"></path></svg></a></li><li itemscope="" itemprop="itemListElement" itemtype="https://schema.org/ListItem" class="breadcrumbs__item"><a class="breadcrumbs__link" itemprop="item" href="/zh/reference-guides"><span itemprop="name">参考指南</span></a><meta itemprop="position" content="1"></li><li itemscope="" itemprop="itemListElement" itemtype="https://schema.org/ListItem" class="breadcrumbs__item"><a class="breadcrumbs__link" itemprop="item" href="/zh/pages-for-subheaders/installation-references"><span itemprop="name">安装参考</span></a><meta itemprop="position" content="2"></li><li itemscope="" itemprop="itemListElement" itemtype="https://schema.org/ListItem" class="breadcrumbs__item breadcrumbs__item--active"><span class="breadcrumbs__link" itemprop="name">Rancher Helm Chart 选项</span><meta itemprop="position" content="3"></li></ul></nav><span class="theme-doc-version-badge badge badge--secondary">版本:v2.6</span><div class="tocCollapsible_ETCw theme-doc-toc-mobile tocMobile_aoJ5"><button type="button" class="clean-btn tocCollapsibleButton_TO0P">本页总览</button></div><div class="theme-doc-markdown markdown"><header><h1>Rancher Helm Chart 选项</h1></header><p>本文提供了 Rancher Helm Chart 的配置参考。</p><p>如需选择 Helm Chart 版本,请参见<a href="/zh/getting-started/installation-and-upgrade/resources/choose-a-rancher-version">本页</a>。</p><p>了解开启实验性功能的详情,请参见<a href="/zh/pages-for-subheaders/enable-experimental-features">本页</a>。</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="常用选项">常用选项<a class="hash-link" href="#常用选项" title="标题的直接链接"></a></h2><table><thead><tr><th>选项</th><th>默认值</th><th>描述</th></tr></thead><tbody><tr><td><code>bootstrapPassword</code></td><td>" "</td><td><code>string</code> - 为第一个管理员用户设置<a href="#%E5%BC%95%E5%AF%BC%E5%AF%86%E7%A0%81">引导密码</a>。登录后,管理员需要重置密码。如不设置,会使用随机生成的引导密码。</td></tr><tr><td><code>hostname</code></td><td>" "</td><td><code>string</code> - 你的 Rancher Server 的完全限定的域名(FQDN)</td></tr><tr><td><code>ingress.tls.source</code></td><td>"rancher"</td><td><code>string</code> - 从哪里获取 Ingress 的证书- "rancher, letsEncrypt, secret"</td></tr><tr><td><code>letsEncrypt.email</code></td><td>" "</td><td><code>string</code> - 你的邮箱地址</td></tr><tr><td><code>letsEncrypt.environment</code></td><td>"production"</td><td><code>string</code> - 可选项:"staging, production"</td></tr><tr><td><code>privateCA</code></td><td>false</td><td><code>bool</code> - 如果你的证书是由私有 CA 签发的,把这个值设置为 true</td></tr></tbody></table><br><h2 class="anchor anchorWithStickyNavbar_LWe7" id="高级选项">高级选项<a class="hash-link" href="#高级选项" title="标题的直接链接"></a></h2><table><thead><tr><th>选项</th><th>默认值</th><th>描述</th></tr></thead><tbody><tr><td><code>additionalTrustedCAs</code></td><td>false</td><td><code>bool</code> - 请参见<a href="#%E9%A2%9D%E5%A4%96%E7%9A%84%E6%8E%88%E4%BF%A1-ca">额外的授信 CA</a></td></tr><tr><td><code>addLocal</code></td><td>"true"</td><td><code>string</code> - 让 Rancher 检测并导入 “local” Rancher Server 集群。<em>注意:此选项在 2.5.0 中已不可用。你可考虑使用 <code>restrictedAdmin</code> 选项,来避免用户修改本地集群。</em></td></tr><tr><td><code>antiAffinity</code></td><td>"preferred"</td><td><code>string</code> - Rancher Pod 的反亲和性规则 - "preferred, required"</td></tr><tr><td><code>auditLog.destination</code></td><td>"sidecar"</td><td><code>string</code> - 发送审计日志到 Sidecar 容器的控制台或 hostPath 卷 - "sidecar, hostPath"</td></tr><tr><td><code>auditLog.hostPath</code></td><td>"/var/log/rancher/audit"</td><td><code>string</code> - 主机上的日志文件目标地址(仅当<code>auditLog.destination</code> 的值是 <code>hostPath</code> 时生效)</td></tr><tr><td><code>auditLog.level</code></td><td>0</td><td><code>int</code> - 设置 <a href="/zh/getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/enable-api-audit-log">API 审计日志</a>等级。0 代表关闭。<!-- -->[0-3]</td></tr><tr><td><code>auditLog.maxAge</code></td><td>1</td><td><code>int</code> - 旧审计日志文件最多可保留的天数(仅当<code>auditLog.destination</code> 的值是 <code>hostPath</code> 时生效)</td></tr><tr><td><code>auditLog.maxBackup</code></td><td>1</td><td><code>int</code> - 审计文件最大可保留的个数(仅当 <code>auditLog.destination</code> 的值是 <code>hostPath</code> 时生效)</td></tr><tr><td><code>auditLog.maxSize</code></td><td>100</td><td><code>int</code> - 在审计日志被轮换前的最大容量,单位是 MB(仅当 <code>auditLog.destination</code> 的值是 <code>hostPath</code> 时生效)</td></tr><tr><td><code>busyboxImage</code></td><td>"busybox"</td><td><code>string</code> - 用来收集审计日志的 busybox 镜像位置</td></tr><tr><td><code>certmanager.version</code></td><td>""</td><td><code>string</code> - 设置 cert-manager compatibility</td></tr><tr><td><code>debug</code></td><td>false</td><td><code>bool</code> - 在 Rancher Server 设置 debug 参数</td></tr><tr><td><code>extraEnv</code></td><td>[]</td><td><code>list</code> - 为 Rancher 额外设置环境变量</td></tr><tr><td><code>imagePullSecrets</code></td><td>[]</td><td><code>list</code> - 私有镜像仓库凭证的密文名称列表</td></tr><tr><td><code>ingress.configurationSnippet</code></td><td>""</td><td><code>string</code> - 添加额外的 Nginx 配置。可用于代理配置。</td></tr><tr><td><code>ingress.extraAnnotations</code></td><td>{}</td><td><code>map</code> - 用于自定义 Ingress 的额外注释</td></tr><tr><td><code>ingress.enabled</code></td><td>true</td><td>如果值为 false,Helm 不会安装 Rancher Ingress。你可把值设为 false 以部署你自己的 Ingress。</td></tr><tr><td><code>letsEncrypt.ingress.class</code></td><td>""</td><td><code>string</code> - cert-manager acmesolver ingress 的可选 ingress 类,用于响应 Let's Encrypt ACME 质询。选项:traefik,nginx。</td></tr><tr><td><code>noProxy</code></td><td>"127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.cluster.local,cattle-system.svc"</td><td><code>string</code> - 不使用代理的主机名或 IP 地址的逗号分隔列表</td></tr><tr><td><code>proxy</code></td><td>""</td><td><code>string</code> - 给 Rancher 配置的 HTTP<!-- -->[S]<!-- --> 代理</td></tr><tr><td><code>rancherImage</code></td><td>"rancher/rancher"</td><td><code>string</code> - Rancher 镜像源</td></tr><tr><td><code>rancherImagePullPolicy</code></td><td>"IfNotPresent"</td><td><code>string</code> - 覆盖 Rancher Server 镜像的 imagePullPolicy - "Always", "Never", "IfNotPresent"</td></tr><tr><td><code>rancherImageTag</code></td><td>和 Chart 版本一致</td><td><code>string</code> - rancher/rancher 镜像标签</td></tr><tr><td><code>replicas</code></td><td>3</td><td><code>int</code> - Rancher Server 副本数。如果设为 -1,会根据集群中的可用节点数自动选择 1,2或3。</td></tr><tr><td><code>resources</code></td><td>{}</td><td><code>map</code> - Rancher Pod 资源请求和限制</td></tr><tr><td><code>restrictedAdmin</code></td><td><code>false</code></td><td><code>bool</code> - 如果值为 true,初始的 Rancher 用户访问本地 Kubernetes 集群会受到限制,以避免权限升级。详情请参见 <a href="/zh/how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions#%E5%8F%97%E9%99%90%E7%AE%A1%E7%90%86%E5%91%98">restricted-admin 角色</a>。</td></tr><tr><td><code>systemDefaultRegistry</code></td><td>""</td><td><code>string</code> - 用于所有系统容器镜像的私有仓库,例如 <a href="http://registry.example.com/" target="_blank" rel="noopener noreferrer">http://registry.example.com/</a></td></tr><tr><td><code>tls</code></td><td>"ingress"</td><td><code>string</code> - 详情请参见<a href="#%E5%A4%96%E9%83%A8-tls-%E7%BB%88%E6%AD%A2">外部 TLS 终止</a>。- "ingress, external"</td></tr><tr><td><code>useBundledSystemChart</code></td><td><code>false</code></td><td><code>bool</code> - 选择 Rancher Server 打包的 system-charts。此参数用于离线环境安装。</td></tr></tbody></table><h3 class="anchor anchorWithStickyNavbar_LWe7" id="引导密码">引导密码<a class="hash-link" href="#引导密码" title="标题的直接链接"></a></h3><p>Rancher 首次启动时,会为第一个管理员用户随机生成一个密码。当管理员首次登录 Rancher 时,用于获取引导密码(Bootstrap)的命令会在 UI 上显示。管理员需要运行命令并使用引导密码登录。然后 Rancher 会让管理员重置密码。</p><p>如果你想指定引导密码而不使用随机生成的密码,请参考以下命令设置密码。</p><div class="language-plain codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-plain codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">--set bootstrapPassword="rancher"</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="复制代码到剪贴板" title="复制" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>无论你是使用提供的密码还是生成的密码,密码均存储在 Kubernetes 密文中。安装 Rancher 后,如何使用 kubectl 获取密码的说明将会在 UI 中显示:</p><div class="codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-text codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">kubectl get secret --namespace cattle-system bootstrap-secret -o go-template='{{ .data.bootstrapPassword|base64decode}}{{ "\n" }}'</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="复制代码到剪贴板" title="复制" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><h3 class="anchor anchorWithStickyNavbar_LWe7" id="api-审计日志">API 审计日志<a class="hash-link" href="#api-审计日志" title="标题的直接链接"></a></h3><p>启用 <a href="/zh/getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/enable-api-audit-log">API 审计日志</a></p><p>你可以像收集其他容器日志一样收集此日志。在 Rancher Server 集群上为 <code>System</code> 项目启用 <a href="/zh/pages-for-subheaders/logging">Logging</a>。</p><div class="language-plain codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-plain codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">--set auditLog.level=1</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="复制代码到剪贴板" title="复制" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>默认情况下,启用审计日志会在 Rancher pod 中创建一个 Sidecar 容器。这个容器(<code>rancher-audit-log</code>)会把日志流传输到 <code>stdout</code>。你可以像收集其他容器日志一样收集此日志。如果你使用 Sidecar 作为审计日志的目标时, <code>hostPath</code>,<code>maxAge</code>,<code>maxBackups</code> 和 <code>maxSize</code> 选项不会生效。建议使用你的操作系统或 Docker Daemon 的日志轮换功能来控制磁盘空间的使用。请为 Rancher Server 集群或 System 项目启用 <a href="/zh/pages-for-subheaders/logging">Logging</a>。</p><p>将 <code>auditLog.destination</code> 的值设为 <code>hostPath</code>,可以将日志转发到与主机系统共享的卷,而不是传输到 Sidecar 容器。如果目标设置为 <code>hostPath</code>,你可能需要调整其他 auditLog 参数以进行日志轮换。</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="额外设置环境变量">额外设置环境变量<a class="hash-link" href="#额外设置环境变量" title="标题的直接链接"></a></h3><p>你可以使用 <code>extraEnv</code> 为 Rancher Server 额外设置环境变量。该列表使用与容器清单定义相同的 <code>name</code> 和 <code>value</code> 键。记住需要给值加上引号。</p><div class="language-plain codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-plain codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">--set 'extraEnv[0].name=CATTLE_TLS_MIN_VERSION'</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">--set 'extraEnv[0].value=1.0'</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="复制代码到剪贴板" title="复制" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><h3 class="anchor anchorWithStickyNavbar_LWe7" id="tls-设置">TLS 设置<a class="hash-link" href="#tls-设置" title="标题的直接链接"></a></h3><p>当你在 Kubernetes 集群内安装 Rancher 时,TLS 会在集群的 Ingress Controller 上卸载。支持的 TLS 设置取决于使用的 Ingress Controller。</p><p>参见 <a href="/zh/reference-guides/installation-references/tls-settings">TLS 设置</a>了解更多信息和选项。</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="导入-local-集群">导入 <code>local</code> 集群<a class="hash-link" href="#导入-local-集群" title="标题的直接链接"></a></h3><p>默认情况下,Rancher Server 会检测并导入其所在的 <code>local</code> 集群。有权访问 <code>local</code> 集群的用户对 Rancher Server 管理的所有集群具有“root”访问权限。</p><div class="admonition admonition-caution alert alert--warning"><div class="admonition-heading"><h5><span class="admonition-icon"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 16 16"><path fill-rule="evenodd" d="M8.893 1.5c-.183-.31-.52-.5-.887-.5s-.703.19-.886.5L.138 13.499a.98.98 0 0 0 0 1.001c.193.31.53.501.886.501h13.964c.367 0 .704-.19.877-.5a1.03 1.03 0 0 0 .01-1.002L8.893 1.5zm.133 11.497H6.987v-2.003h2.039v2.003zm0-3.004H6.987V5.987h2.039v4.006z"></path></svg></span>caution</h5></div><div class="admonition-content"><p>如果你关闭 addLocal,大多数 Rancher 2.5 功能都不能使用,包括 EKS Provisioner。</p></div></div><p>如果这在你的环境中是一个问题,你可以在初始安装时将此选项设置为“false”。</p><p>此选项仅在首次安装 Rancher 时有效。详情请参见 <a href="https://github.com/rancher/rancher/issues/16522" target="_blank" rel="noopener noreferrer">Issue 16522</a>。</p><div class="language-plain codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-plain codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">--set addLocal="false"</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="复制代码到剪贴板" title="复制" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><h3 class="anchor anchorWithStickyNavbar_LWe7" id="自定义-ingress">自定义 Ingress<a class="hash-link" href="#自定义-ingress" title="标题的直接链接"></a></h3><p>要自定义或使用 Rancher Server 的其他 Ingress,你可以设置自己的 Ingress annotations。</p><p>设置自定义证书颁发者的示例:</p><div class="language-plain codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-plain codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">--set ingress.extraAnnotations.'cert-manager\.io/cluster-issuer'=issuer-name</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="复制代码到剪贴板" title="复制" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>以下是使用 <code>ingress.configurationSnippet</code>设置静态代理头的实例。该值像模板一样进行解析,因此可以使用变量。</p><div class="language-plain codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-plain codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">--set ingress.configurationSnippet='more_set_input_headers X-Forwarded-Host {{ .Values.hostname }};'</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="复制代码到剪贴板" title="复制" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><h3 class="anchor anchorWithStickyNavbar_LWe7" id="http-代理">HTTP 代理<a class="hash-link" href="#http-代理" title="标题的直接链接"></a></h3><p>Rancher 的一些功能(Helm Chart)需要使用互联网才能使用。使用 <code>proxy</code> 来设置你的代理服务器。</p><p>在 <code>noProxy</code> 列表中添加例外的 IP。确保你已添加了 Pod 集群 IP 范围(默认:<code>10.42.0.0/16</code>),服务集群 IP 范围(默认:<code>10.43.0.0/16</code>),内部集群域名(默认:<code>.svc,.cluster.local</code>)和所有 worker 集群 <code>controlplane</code> 节点。Rancher 支持在此列表中使用 CIDR 表示法范围。</p><div class="language-plain codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-plain codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">--set proxy="http://<username>:<password>@<proxy_url>:<proxy_port>/"</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">--set noProxy="127.0.0.0/8\,10.0.0.0/8\,172.16.0.0/12\,192.168.0.0/16\,.svc\,.cluster.local"</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="复制代码到剪贴板" title="复制" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><h3 class="anchor anchorWithStickyNavbar_LWe7" id="额外的授信-ca">额外的授信 CA<a class="hash-link" href="#额外的授信-ca" title="标题的直接链接"></a></h3><p>如果你有私有镜像仓库(registries)、应用商店(catalogs)或拦截证书的代理,则可能需要向 Rancher 添加额外的授信 CA。</p><div class="language-plain codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-plain codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">--set additionalTrustedCAs=true</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="复制代码到剪贴板" title="复制" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>创建完 Rancher deployment 后,将 pem 格式的 CA 证书复制到一个名为 <code>ca-additional.pem</code> 的文件中,并使用 <code>kubectl</code> 在 <code>cattle-system</code> 命名空间中创建 <code>tls-ca-additional</code> 密文。</p><div class="language-plain codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-plain codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">kubectl -n cattle-system create secret generic tls-ca-additional --from-file=ca-additional.pem=./ca-additional.pem</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="复制代码到剪贴板" title="复制" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><h3 class="anchor anchorWithStickyNavbar_LWe7" id="私有仓库和离线安装">私有仓库和离线安装<a class="hash-link" href="#私有仓库和离线安装" title="标题的直接链接"></a></h3><p>有关使用私有仓库安装 Rancher 的详情,请参见<a href="/zh/pages-for-subheaders/air-gapped-helm-cli-install">离线安装</a>。</p><h1>外部 TLS 终止</h1><p>我们建议将负载均衡器配置为 4 层均衡,将普通 80/tcp 和 443/tcp 转发到 Rancher Management 集群节点。集群上的 Ingress Controller 会将端口 80 上的 HTTP 流量重定向到端口 443 上的 HTTPS。</p><p>你可以在 Rancher 集群(Ingress)外部的 L7 负载均衡器上终止 SSL/TLS。使用 <code>--set tls=external</code> 选项,将负载均衡器指向所有 Rancher 集群节点上的端口 HTTP 80。这将在 HTTP 端口 80 上暴露 Rancher 接口。请注意,允许直接连接到 Rancher 集群的客户端不会被加密。如果你选择这样做,我们建议你将网络级别的直接访问限制为仅你的负载均衡器。</p><div class="admonition admonition-note alert alert--secondary"><div class="admonition-heading"><h5><span class="admonition-icon"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="16" viewBox="0 0 14 16"><path fill-rule="evenodd" d="M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"></path></svg></span>note</h5></div><div class="admonition-content"><p>如果你使用的是私有 CA 签名的证书,请添加 <code>--set privateCA=true</code> 并参见<a href="/zh/getting-started/installation-and-upgrade/resources/add-tls-secrets">添加 TLS 密文 - 使用私有 CA 签名证书</a>,为 Rancher 添加 CA 证书。</p></div></div><p>你的负载均衡器必须支持长期存在的 Websocket 连接,并且需要插入代理头,以便 Rancher 可以正确传送链接。</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="使用-nginx-v025-为外部-tls-配置-ingress">使用 NGINX v0.25 为外部 TLS 配置 Ingress<a class="hash-link" href="#使用-nginx-v025-为外部-tls-配置-ingress" title="标题的直接链接"></a></h3><p>在 NGINX 0.25 中,NGINX 关于转发头和外部 TLS 终止的行为<a href="https://github.com/kubernetes/ingress-nginx/blob/master/Changelog.md#0220" target="_blank" rel="noopener noreferrer">已更改</a>。因此,如果你同时使用 NGINX 0.25 和外部 TLS 终止配置,你必须编辑 <code>cluster.yml</code> 来为 Ingress 启用 <code>use-forwarded-headers</code> 选项。</p><div class="language-yaml codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-yaml codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token key atrule">ingress</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">provider</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> nginx</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">options</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">use-forwarded-headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">'true'</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="复制代码到剪贴板" title="复制" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><h3 class="anchor anchorWithStickyNavbar_LWe7" id="必须的-header">必须的 Header<a class="hash-link" href="#必须的-header" title="标题的直接链接"></a></h3><ul><li><code>Host</code></li><li><code>X-Forwarded-Proto</code></li><li><code>X-Forwarded-Port</code></li><li><code>X-Forwarded-For</code></li></ul><h3 class="anchor anchorWithStickyNavbar_LWe7" id="建议的超时时间">建议的超时时间<a class="hash-link" href="#建议的超时时间" title="标题的直接链接"></a></h3><ul><li>读超时:<code>1800 seconds</code></li><li>写超时:<code>1800 seconds</code></li><li>连接超时:<code>30 seconds</code></li></ul><h3 class="anchor anchorWithStickyNavbar_LWe7" id="健康检查">健康检查<a class="hash-link" href="#健康检查" title="标题的直接链接"></a></h3><p>Rancher 将对 <code>/healthz</code> 端点的健康检查响应<code>200</code>。</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="示例-nginx-配置">示例 NGINX 配置<a class="hash-link" href="#示例-nginx-配置" title="标题的直接链接"></a></h3><p>此 NGINX 配置已在 NGINX 1.14 上进行了测试。</p><div class="admonition admonition-caution alert alert--warning"><div class="admonition-heading"><h5><span class="admonition-icon"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 16 16"><path fill-rule="evenodd" d="M8.893 1.5c-.183-.31-.52-.5-.887-.5s-.703.19-.886.5L.138 13.499a.98.98 0 0 0 0 1.001c.193.31.53.501.886.501h13.964c.367 0 .704-.19.877-.5a1.03 1.03 0 0 0 .01-1.002L8.893 1.5zm.133 11.497H6.987v-2.003h2.039v2.003zm0-3.004H6.987V5.987h2.039v4.006z"></path></svg></span>caution</h5></div><div class="admonition-content"><p>此 NGINX 配置只是一个示例,可能不适合你的环境。如需查阅完整文档,请参见 <a href="https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/" target="_blank" rel="noopener noreferrer">NGINX 负载均衡 - HTTP 负载均衡</a>。</p></div></div><ul><li>将 <code>IP_NODE1</code>,<code>IP_NODE2</code> 和 <code>IP_NODE3</code> 替换为你集群中节点的 IP 地址。</li><li>将两处的 <code>FQDN</code> 均替换为 Rancher 的 DNS 名称。</li><li>把 <code>/certs/fullchain.pem</code> 和 <code>/certs/privkey.pem</code> 分别替换为服务器证书和服务器证书密钥的位置。</li></ul><div class="codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-text codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">worker_processes 4;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">worker_rlimit_nofile 40000;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">events {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> worker_connections 8192;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">}</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">http {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> upstream rancher {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> server IP_NODE_1:80;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> server IP_NODE_2:80;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> server IP_NODE_3:80;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> map $http_upgrade $connection_upgrade {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> default Upgrade;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> '' close;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> server {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> listen 443 ssl http2;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> server_name FQDN;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> ssl_certificate /certs/fullchain.pem;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> ssl_certificate_key /certs/privkey.pem;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> location / {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Host $host;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Forwarded-Proto $scheme;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Forwarded-Port $server_port;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass http://rancher;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_http_version 1.1;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Upgrade $http_upgrade;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Connection $connection_upgrade;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # 此项允许执行的 shell 窗口保持开启,最长可达15分钟。不使用此参数的话,默认1分钟后自动关闭。</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_read_timeout 900s;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_buffering off;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> server {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> listen 80;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> server_name FQDN;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> return 301 https://$server_name$request_uri;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">}</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="复制代码到剪贴板" title="复制" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/rancher/rancher-docs/edit/main/docs/reference-guides/installation-references/helm-chart-options.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_eYIM" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>编辑此页</a></div><div class="col lastUpdated_vbeJ"><span class="theme-last-updated">最后<!-- -->于 <b><time datetime="2022-09-23T17:11:24.000Z">2022/9/23</time></b> <!-- -->更新</span></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="文档分页导航"><a class="pagination-nav__link pagination-nav__link--prev" href="/zh/pages-for-subheaders/installation-references"><div class="pagination-nav__sublabel">上一页</div><div class="pagination-nav__label">安装参考</div></a><a class="pagination-nav__link pagination-nav__link--next" href="/zh/reference-guides/installation-references/tls-settings"><div class="pagination-nav__sublabel">下一页</div><div class="pagination-nav__label">TLS 设置</div></a></nav></div></div><div class="col col--3"><div class="tableOfContents_bqdL thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#常用选项" class="table-of-contents__link toc-highlight">常用选项</a></li><li><a href="#高级选项" class="table-of-contents__link toc-highlight">高级选项</a><ul><li><a href="#引导密码" class="table-of-contents__link toc-highlight">引导密码</a></li><li><a href="#api-审计日志" class="table-of-contents__link toc-highlight">API 审计日志</a></li><li><a href="#额外设置环境变量" class="table-of-contents__link toc-highlight">额外设置环境变量</a></li><li><a href="#tls-设置" class="table-of-contents__link toc-highlight">TLS 设置</a></li><li><a href="#导入-local-集群" class="table-of-contents__link toc-highlight">导入 <code>local</code> 集群</a></li><li><a href="#自定义-ingress" class="table-of-contents__link toc-highlight">自定义 Ingress</a></li><li><a href="#http-代理" class="table-of-contents__link toc-highlight">HTTP 代理</a></li><li><a href="#额外的授信-ca" class="table-of-contents__link toc-highlight">额外的授信 CA</a></li><li><a href="#私有仓库和离线安装" class="table-of-contents__link toc-highlight">私有仓库和离线安装</a></li><li><a href="#使用-nginx-v025-为外部-tls-配置-ingress" class="table-of-contents__link toc-highlight">使用 NGINX v0.25 为外部 TLS 配置 Ingress</a></li><li><a href="#必须的-header" class="table-of-contents__link toc-highlight">必须的 Header</a></li><li><a href="#建议的超时时间" class="table-of-contents__link toc-highlight">建议的超时时间</a></li><li><a href="#健康检查" class="table-of-contents__link toc-highlight">健康检查</a></li><li><a href="#示例-nginx-配置" class="table-of-contents__link toc-highlight">示例 NGINX 配置</a></li></ul></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 SUSE Rancher. All Rights Reserved.</div></div></div></footer></div>
|
||
<script src="/zh/assets/js/runtime~main.f10e0fa4.js"></script>
|
||
<script src="/zh/assets/js/main.59e3f7b9.js"></script>
|
||
</body>
|
||
</html> |