Files
rancher-docs/zh/reference-guides/installation-references/helm-chart-options.html
T

17 lines
61 KiB
HTML
Raw Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
<!doctype html>
<html lang="zh" dir="ltr" class="docs-wrapper docs-doc-page docs-version-current plugin-docs plugin-id-default docs-doc-id-reference-guides/installation-references/helm-chart-options">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.21">
<link rel="search" type="application/opensearchdescription+xml" title="Rancher Manager" href="/zh/opensearch.xml"><title data-rh="true">Rancher Helm Chart 选项 | Rancher Manager</title><meta data-rh="true" name="twitter:card" content="summary_large_image"><meta data-rh="true" property="og:url" content="http://docs.ranchermanager.rancher.io//zh/reference-guides/installation-references/helm-chart-options"><meta data-rh="true" name="docusaurus_locale" content="zh"><meta data-rh="true" name="docsearch:language" content="zh"><meta data-rh="true" name="docusaurus_version" content="current"><meta data-rh="true" name="docusaurus_tag" content="docs-default-current"><meta data-rh="true" name="docsearch:version" content="current"><meta data-rh="true" name="docsearch:docusaurus_tag" content="docs-default-current"><meta data-rh="true" property="og:title" content="Rancher Helm Chart 选项 | Rancher Manager"><meta data-rh="true" name="description" content="本文提供了 Rancher Helm Chart 的配置参考。"><meta data-rh="true" property="og:description" content="本文提供了 Rancher Helm Chart 的配置参考。"><link data-rh="true" rel="icon" href="/zh/img/favicon.png"><link data-rh="true" rel="canonical" href="http://docs.ranchermanager.rancher.io//zh/reference-guides/installation-references/helm-chart-options"><link data-rh="true" rel="alternate" href="http://docs.ranchermanager.rancher.io//reference-guides/installation-references/helm-chart-options" hreflang="en"><link data-rh="true" rel="alternate" href="http://docs.ranchermanager.rancher.io//zh/reference-guides/installation-references/helm-chart-options" hreflang="zh"><link data-rh="true" rel="alternate" href="http://docs.ranchermanager.rancher.io//reference-guides/installation-references/helm-chart-options" hreflang="x-default"><link data-rh="true" rel="preconnect" href="https://30NEY6C9UY-dsn.algolia.net" crossorigin="anonymous"><link rel="stylesheet" href="/zh/assets/css/styles.27db6f3b.css">
<link rel="preload" href="/zh/assets/js/runtime~main.f10e0fa4.js" as="script">
<link rel="preload" href="/zh/assets/js/main.59e3f7b9.js" as="script">
</head>
<body class="navigation-with-keyboard">
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
<div role="region"><a href="#" class="skipToContent_fXgn">跳到主要内容</a></div><nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Navigation bar toggle" class="navbar__toggle clean-btn" type="button" tabindex="0"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/zh/"><div class="navbar__logo"><img src="/zh/img/rancher-logo-horiz-color.svg" alt="logo" class="themedImage_ToTc themedImage--light_HNdA"><img src="/zh/img/rancher-logo-horiz-color.svg" alt="logo" class="themedImage_ToTc themedImage--dark_i4oU"></div><b class="navbar__title text--truncate"></b></a><div class="navbar__item dropdown dropdown--hoverable"><a aria-current="page" class="navbar__link active" aria-haspopup="true" aria-expanded="false" role="button" href="/zh/">v2.6</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/zh/reference-guides/installation-references/helm-chart-options">v2.6</a></li><li><a class="dropdown__link" href="/zh/v2.5/reference-guides/installation-references/helm-chart-options">v2.5</a></li><li><a class="dropdown__link" href="/zh/v2.0-v2.4/reference-guides/installation-references/helm-chart-options">v2.0-v2.4</a></li><li><a class="dropdown__link" href="/zh/versions">All versions</a></li></ul></div></div><div class="navbar__items navbar__items--right"><a aria-current="page" class="navbar__item navbar__link navbar__docs navbar__link--active" href="/zh/">文档</a><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a href="#" aria-haspopup="true" aria-expanded="false" role="button" class="navbar__link"><svg viewBox="0 0 24 24" width="20" height="20" aria-hidden="true" class="iconLanguage_nlXk"><path fill="currentColor" d="M12.87 15.07l-2.54-2.51.03-.03c1.74-1.94 2.98-4.17 3.71-6.53H17V4h-7V2H8v2H1v1.99h11.17C11.5 7.92 10.44 9.75 9 11.35 8.07 10.32 7.3 9.19 6.69 8h-2c.73 1.63 1.73 3.17 2.98 4.56l-5.09 5.02L4 19l5-5 3.11 3.11.76-2.04zM18.5 10h-2L12 22h2l1.12-3h4.75L21 22h2l-4.5-12zm-2.62 7l1.62-4.33L19.12 17h-3.24z"></path></svg>简体中文</a><ul class="dropdown__menu"><li><a href="/reference-guides/installation-references/helm-chart-options" target="_self" rel="noopener noreferrer" class="dropdown__link">English</a></li><li><a href="/zh/reference-guides/installation-references/helm-chart-options" target="_self" rel="noopener noreferrer" class="dropdown__link dropdown__link--active">简体中文</a></li></ul></div><a href="https://github.com/rancher/rancher-docs" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link navbar__github">GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_lCJq"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a><div class="searchBox_ZlJk"><button type="button" class="DocSearch DocSearch-Button" aria-label="搜索"><span class="DocSearch-Button-Container"><svg width="20" height="20" class="DocSearch-Search-Icon" viewBox="0 0 20 20"><path d="M14.386 14.386l4.0877 4.0877-4.0877-4.0877c-2.9418 2.9419-7.7115 2.9419-10.6533 0-2.9419-2.9418-2.9419-7.7115 0-10.6533 2.9418-2.9419 7.7115-2.9419 10.6533 0 2.9419 2.9418 2.9419 7.7115 0 10.6533z" stroke="currentColor" fill="none" fill-rule="evenodd" stroke-linecap="round" stroke-linejoin="round"></path></svg><span class="DocSearch-Button-Placeholder">搜索</span></span><span class="DocSearch-Button-Keys"></span></button></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div class="main-wrapper docsWrapper_BCFX"><button aria-label="回到顶部" class="clean-btn theme-back-to-top-button backToTopButton_sjWU" type="button"></button><div class="docPage__5DB"><aside class="theme-doc-sidebar-container docSidebarContainer_b6E3"><div class="sidebar_njMd"><nav class="menu thin-scrollbar menu_SIkG"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/zh/">Rancher 2.6</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" href="/zh/getting-started">开始使用</a><button aria-label="打开/收起侧边栏菜单「开始使用」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" href="/zh/how-to-guides">操作指南</a><button aria-label="打开/收起侧边栏菜单「操作指南」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--active" aria-expanded="true" href="/zh/reference-guides">参考指南</a><button aria-label="打开/收起侧边栏菜单「参考指南」" type="button" class="clean-btn menu__caret"></button></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/best-practices">最佳实践</a><button aria-label="打开/收起侧边栏菜单「最佳实践」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/rancher-manager-architecture">Rancher Manager 架构</a><button aria-label="打开/收起侧边栏菜单「Rancher Manager 架构」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/cluster-configuration">集群配置</a><button aria-label="打开/收起侧边栏菜单「集群配置」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/single-node-rancher-in-docker">Docker 中的单节点 Rancher</a><button aria-label="打开/收起侧边栏菜单「Docker 中的单节点 Rancher」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--active" aria-expanded="true" tabindex="0" href="/zh/pages-for-subheaders/installation-references">安装参考</a><button aria-label="打开/收起侧边栏菜单「安装参考」" type="button" class="clean-btn menu__caret"></button></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" tabindex="0" href="/zh/reference-guides/installation-references/helm-chart-options">Rancher Helm Chart 选项</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/zh/reference-guides/installation-references/tls-settings">TLS 设置</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/zh/reference-guides/installation-references/feature-flags">功能开关</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/amazon-eks-permissions">Amazon EKS 权限</a><button aria-label="打开/收起侧边栏菜单「Amazon EKS 权限」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/backup-restore-configuration">Backup 和 Restore 配置</a><button aria-label="打开/收起侧边栏菜单「Backup 和 Restore 配置」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/configure-openldap">配置 OpenLDAP</a><button aria-label="打开/收起侧边栏菜单「配置 OpenLDAP」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/zh/reference-guides/kubernetes-concepts">Kubernetes 概念</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/monitoring-v2-configuration">Monitoring V2 配置</a><button aria-label="打开/收起侧边栏菜单「Monitoring V2 配置」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/prometheus-federator">Prometheus Federator</a><button aria-label="打开/收起侧边栏菜单「Prometheus Federator」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/user-settings">用户设置</a><button aria-label="打开/收起侧边栏菜单「用户设置」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/cli-with-rancher">Rancher CLI</a><button aria-label="打开/收起侧边栏菜单「Rancher CLI」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/about-the-api">关于 API</a><button aria-label="打开/收起侧边栏菜单「关于 API」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/zh/reference-guides/rancher-cluster-tools">集群工具:Logging,Monitoring 和可视化</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/zh/reference-guides/rancher-project-tools">项目工具:Logging,Monitoring 和可视化</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/zh/reference-guides/system-tools">系统工具</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/zh/reference-guides/rke1-template-example-yaml">RKE1 示例 YAML</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/pipelines">流水线</a><button aria-label="打开/收起侧边栏菜单「流水线」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/rancher-security">Rancher 安全</a><button aria-label="打开/收起侧边栏菜单「Rancher 安全」" type="button" class="clean-btn menu__caret"></button></div></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" href="/zh/explanations">说明</a><button aria-label="打开/收起侧边栏菜单「说明」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" href="/zh/faq">常见问题</a><button aria-label="打开/收起侧边栏菜单「常见问题」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" href="/zh/troubleshooting">故障排除</a><button aria-label="打开/收起侧边栏菜单「故障排除」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/zh/contribute-to-rancher">参与 Rancher 社区贡献</a></li></ul></nav></div></aside><main class="docMainContainer_gTbr"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_GujU"><div class="docItemContainer_Adtb"><article><nav class="theme-doc-breadcrumbs breadcrumbsContainer_Z_bl" aria-label="页面路径"><ul class="breadcrumbs" itemscope="" itemtype="https://schema.org/BreadcrumbList"><li class="breadcrumbs__item"><a aria-label="主页面" class="breadcrumbs__link" href="/zh/"><svg viewBox="0 0 24 24" class="breadcrumbHomeIcon_OVgt"><path d="M10 19v-5h4v5c0 .55.45 1 1 1h3c.55 0 1-.45 1-1v-7h1.7c.46 0 .68-.57.33-.87L12.67 3.6c-.38-.34-.96-.34-1.34 0l-8.36 7.53c-.34.3-.13.87.33.87H5v7c0 .55.45 1 1 1h3c.55 0 1-.45 1-1z" fill="currentColor"></path></svg></a></li><li itemscope="" itemprop="itemListElement" itemtype="https://schema.org/ListItem" class="breadcrumbs__item"><a class="breadcrumbs__link" itemprop="item" href="/zh/reference-guides"><span itemprop="name">参考指南</span></a><meta itemprop="position" content="1"></li><li itemscope="" itemprop="itemListElement" itemtype="https://schema.org/ListItem" class="breadcrumbs__item"><a class="breadcrumbs__link" itemprop="item" href="/zh/pages-for-subheaders/installation-references"><span itemprop="name">安装参考</span></a><meta itemprop="position" content="2"></li><li itemscope="" itemprop="itemListElement" itemtype="https://schema.org/ListItem" class="breadcrumbs__item breadcrumbs__item--active"><span class="breadcrumbs__link" itemprop="name">Rancher Helm Chart 选项</span><meta itemprop="position" content="3"></li></ul></nav><span class="theme-doc-version-badge badge badge--secondary">版本:v2.6</span><div class="tocCollapsible_ETCw theme-doc-toc-mobile tocMobile_aoJ5"><button type="button" class="clean-btn tocCollapsibleButton_TO0P">本页总览</button></div><div class="theme-doc-markdown markdown"><header><h1>Rancher Helm Chart 选项</h1></header><p>本文提供了 Rancher Helm Chart 的配置参考。</p><p>如需选择 Helm Chart 版本,请参见<a href="/zh/getting-started/installation-and-upgrade/resources/choose-a-rancher-version">本页</a>。</p><p>了解开启实验性功能的详情,请参见<a href="/zh/pages-for-subheaders/enable-experimental-features">本页</a>。</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="常用选项">常用选项<a class="hash-link" href="#常用选项" title="标题的直接链接">​</a></h2><table><thead><tr><th>选项</th><th>默认值</th><th>描述</th></tr></thead><tbody><tr><td><code>bootstrapPassword</code></td><td>&quot; &quot;</td><td><code>string</code> - 为第一个管理员用户设置<a href="#%E5%BC%95%E5%AF%BC%E5%AF%86%E7%A0%81">引导密码</a>。登录后,管理员需要重置密码。如不设置,会使用随机生成的引导密码。</td></tr><tr><td><code>hostname</code></td><td>&quot; &quot;</td><td><code>string</code> - 你的 Rancher Server 的完全限定的域名(FQDN)</td></tr><tr><td><code>ingress.tls.source</code></td><td>&quot;rancher&quot;</td><td><code>string</code> - 从哪里获取 Ingress 的证书- &quot;rancher, letsEncrypt, secret&quot;</td></tr><tr><td><code>letsEncrypt.email</code></td><td>&quot; &quot;</td><td><code>string</code> - 你的邮箱地址</td></tr><tr><td><code>letsEncrypt.environment</code></td><td>&quot;production&quot;</td><td><code>string</code> - 可选项:&quot;staging, production&quot;</td></tr><tr><td><code>privateCA</code></td><td>false</td><td><code>bool</code> - 如果你的证书是由私有 CA 签发的,把这个值设置为 true</td></tr></tbody></table><br><h2 class="anchor anchorWithStickyNavbar_LWe7" id="高级选项">高级选项<a class="hash-link" href="#高级选项" title="标题的直接链接">​</a></h2><table><thead><tr><th>选项</th><th>默认值</th><th>描述</th></tr></thead><tbody><tr><td><code>additionalTrustedCAs</code></td><td>false</td><td><code>bool</code> - 请参见<a href="#%E9%A2%9D%E5%A4%96%E7%9A%84%E6%8E%88%E4%BF%A1-ca">额外的授信 CA</a></td></tr><tr><td><code>addLocal</code></td><td>&quot;true&quot;</td><td><code>string</code> - 让 Rancher 检测并导入 “local” Rancher Server 集群。<em>注意:此选项在 2.5.0 中已不可用。你可考虑使用 <code>restrictedAdmin</code> 选项,来避免用户修改本地集群。</em></td></tr><tr><td><code>antiAffinity</code></td><td>&quot;preferred&quot;</td><td><code>string</code> - Rancher Pod 的反亲和性规则 - &quot;preferred, required&quot;</td></tr><tr><td><code>auditLog.destination</code></td><td>&quot;sidecar&quot;</td><td><code>string</code> - 发送审计日志到 Sidecar 容器的控制台或 hostPath 卷 - &quot;sidecar, hostPath&quot;</td></tr><tr><td><code>auditLog.hostPath</code></td><td>&quot;/var/log/rancher/audit&quot;</td><td><code>string</code> - 主机上的日志文件目标地址(仅当<code>auditLog.destination</code> 的值是 <code>hostPath</code> 时生效)</td></tr><tr><td><code>auditLog.level</code></td><td>0</td><td><code>int</code> - 设置 <a href="/zh/getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/enable-api-audit-log">API 审计日志</a>等级。0 代表关闭。<!-- -->[0-3]</td></tr><tr><td><code>auditLog.maxAge</code></td><td>1</td><td><code>int</code> - 旧审计日志文件最多可保留的天数(仅当<code>auditLog.destination</code> 的值是 <code>hostPath</code> 时生效)</td></tr><tr><td><code>auditLog.maxBackup</code></td><td>1</td><td><code>int</code> - 审计文件最大可保留的个数(仅当 <code>auditLog.destination</code> 的值是 <code>hostPath</code> 时生效)</td></tr><tr><td><code>auditLog.maxSize</code></td><td>100</td><td><code>int</code> - 在审计日志被轮换前的最大容量,单位是 MB(仅当 <code>auditLog.destination</code> 的值是 <code>hostPath</code> 时生效)</td></tr><tr><td><code>busyboxImage</code></td><td>&quot;busybox&quot;</td><td><code>string</code> - 用来收集审计日志的 busybox 镜像位置</td></tr><tr><td><code>certmanager.version</code></td><td>&quot;&quot;</td><td><code>string</code> - 设置 cert-manager compatibility</td></tr><tr><td><code>debug</code></td><td>false</td><td><code>bool</code> - 在 Rancher Server 设置 debug 参数</td></tr><tr><td><code>extraEnv</code></td><td>[]</td><td><code>list</code> - 为 Rancher 额外设置环境变量</td></tr><tr><td><code>imagePullSecrets</code></td><td>[]</td><td><code>list</code> - 私有镜像仓库凭证的密文名称列表</td></tr><tr><td><code>ingress.configurationSnippet</code></td><td>&quot;&quot;</td><td><code>string</code> - 添加额外的 Nginx 配置。可用于代理配置。</td></tr><tr><td><code>ingress.extraAnnotations</code></td><td>{}</td><td><code>map</code> - 用于自定义 Ingress 的额外注释</td></tr><tr><td><code>ingress.enabled</code></td><td>true</td><td>如果值为 false,Helm 不会安装 Rancher Ingress。你可把值设为 false 以部署你自己的 Ingress。</td></tr><tr><td><code>letsEncrypt.ingress.class</code></td><td>&quot;&quot;</td><td><code>string</code> - cert-manager acmesolver ingress 的可选 ingress 类,用于响应 Let&#x27;s Encrypt ACME 质询。选项:traefik,nginx。</td></tr><tr><td><code>noProxy</code></td><td>&quot;127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.cluster.local,cattle-system.svc&quot;</td><td><code>string</code> - 不使用代理的主机名或 IP 地址的逗号分隔列表</td></tr><tr><td><code>proxy</code></td><td>&quot;&quot;</td><td><code>string</code> - 给 Rancher 配置的 HTTP<!-- -->[S]<!-- --> 代理</td></tr><tr><td><code>rancherImage</code></td><td>&quot;rancher/rancher&quot;</td><td><code>string</code> - Rancher 镜像源</td></tr><tr><td><code>rancherImagePullPolicy</code></td><td>&quot;IfNotPresent&quot;</td><td><code>string</code> - 覆盖 Rancher Server 镜像的 imagePullPolicy - &quot;Always&quot;, &quot;Never&quot;, &quot;IfNotPresent&quot;</td></tr><tr><td><code>rancherImageTag</code></td><td>和 Chart 版本一致</td><td><code>string</code> - rancher/rancher 镜像标签</td></tr><tr><td><code>replicas</code></td><td>3</td><td><code>int</code> - Rancher Server 副本数。如果设为 -1,会根据集群中的可用节点数自动选择 1,2或3。</td></tr><tr><td><code>resources</code></td><td>{}</td><td><code>map</code> - Rancher Pod 资源请求和限制</td></tr><tr><td><code>restrictedAdmin</code></td><td><code>false</code></td><td><code>bool</code> - 如果值为 true,初始的 Rancher 用户访问本地 Kubernetes 集群会受到限制,以避免权限升级。详情请参见 <a href="/zh/how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions#%E5%8F%97%E9%99%90%E7%AE%A1%E7%90%86%E5%91%98">restricted-admin 角色</a>。</td></tr><tr><td><code>systemDefaultRegistry</code></td><td>&quot;&quot;</td><td><code>string</code> - 用于所有系统容器镜像的私有仓库,例如 <a href="http://registry.example.com/" target="_blank" rel="noopener noreferrer">http://registry.example.com/</a></td></tr><tr><td><code>tls</code></td><td>&quot;ingress&quot;</td><td><code>string</code> - 详情请参见<a href="#%E5%A4%96%E9%83%A8-tls-%E7%BB%88%E6%AD%A2">外部 TLS 终止</a>。- &quot;ingress, external&quot;</td></tr><tr><td><code>useBundledSystemChart</code></td><td><code>false</code></td><td><code>bool</code> - 选择 Rancher Server 打包的 system-charts。此参数用于离线环境安装。</td></tr></tbody></table><h3 class="anchor anchorWithStickyNavbar_LWe7" id="引导密码">引导密码<a class="hash-link" href="#引导密码" title="标题的直接链接">​</a></h3><p>Rancher 首次启动时,会为第一个管理员用户随机生成一个密码。当管理员首次登录 Rancher 时,用于获取引导密码(Bootstrap)的命令会在 UI 上显示。管理员需要运行命令并使用引导密码登录。然后 Rancher 会让管理员重置密码。</p><p>如果你想指定引导密码而不使用随机生成的密码,请参考以下命令设置密码。</p><div class="language-plain codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-plain codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">--set bootstrapPassword=&quot;rancher&quot;</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="复制代码到剪贴板" title="复制" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>无论你是使用提供的密码还是生成的密码,密码均存储在 Kubernetes 密文中。安装 Rancher 后,如何使用 kubectl 获取密码的说明将会在 UI 中显示:</p><div class="codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-text codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">kubectl get secret --namespace cattle-system bootstrap-secret -o go-template=&#x27;{{ .data.bootstrapPassword|base64decode}}{{ &quot;\n&quot; }}&#x27;</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="复制代码到剪贴板" title="复制" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><h3 class="anchor anchorWithStickyNavbar_LWe7" id="api-审计日志">API 审计日志<a class="hash-link" href="#api-审计日志" title="标题的直接链接">​</a></h3><p>启用 <a href="/zh/getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/enable-api-audit-log">API 审计日志</a></p><p>你可以像收集其他容器日志一样收集此日志。在 Rancher Server 集群上为 <code>System</code> 项目启用 <a href="/zh/pages-for-subheaders/logging">Logging</a>。</p><div class="language-plain codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-plain codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">--set auditLog.level=1</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="复制代码到剪贴板" title="复制" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>默认情况下,启用审计日志会在 Rancher pod 中创建一个 Sidecar 容器。这个容器(<code>rancher-audit-log</code>)会把日志流传输到 <code>stdout</code>。你可以像收集其他容器日志一样收集此日志。如果你使用 Sidecar 作为审计日志的目标时, <code>hostPath</code>,<code>maxAge</code>,<code>maxBackups</code> 和 <code>maxSize</code> 选项不会生效。建议使用你的操作系统或 Docker Daemon 的日志轮换功能来控制磁盘空间的使用。请为 Rancher Server 集群或 System 项目启用 <a href="/zh/pages-for-subheaders/logging">Logging</a>。</p><p>将 <code>auditLog.destination</code> 的值设为 <code>hostPath</code>,可以将日志转发到与主机系统共享的卷,而不是传输到 Sidecar 容器。如果目标设置为 <code>hostPath</code>,你可能需要调整其他 auditLog 参数以进行日志轮换。</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="额外设置环境变量">额外设置环境变量<a class="hash-link" href="#额外设置环境变量" title="标题的直接链接">​</a></h3><p>你可以使用 <code>extraEnv</code> 为 Rancher Server 额外设置环境变量。该列表使用与容器清单定义相同的 <code>name</code> 和 <code>value</code> 键。记住需要给值加上引号。</p><div class="language-plain codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-plain codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">--set &#x27;extraEnv[0].name=CATTLE_TLS_MIN_VERSION&#x27;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">--set &#x27;extraEnv[0].value=1.0&#x27;</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="复制代码到剪贴板" title="复制" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><h3 class="anchor anchorWithStickyNavbar_LWe7" id="tls-设置">TLS 设置<a class="hash-link" href="#tls-设置" title="标题的直接链接">​</a></h3><p>当你在 Kubernetes 集群内安装 Rancher 时,TLS 会在集群的 Ingress Controller 上卸载。支持的 TLS 设置取决于使用的 Ingress Controller。</p><p>参见 <a href="/zh/reference-guides/installation-references/tls-settings">TLS 设置</a>了解更多信息和选项。</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="导入-local-集群">导入 <code>local</code> 集群<a class="hash-link" href="#导入-local-集群" title="标题的直接链接">​</a></h3><p>默认情况下,Rancher Server 会检测并导入其所在的 <code>local</code> 集群。有权访问 <code>local</code> 集群的用户对 Rancher Server 管理的所有集群具有“root”访问权限。</p><div class="admonition admonition-caution alert alert--warning"><div class="admonition-heading"><h5><span class="admonition-icon"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 16 16"><path fill-rule="evenodd" d="M8.893 1.5c-.183-.31-.52-.5-.887-.5s-.703.19-.886.5L.138 13.499a.98.98 0 0 0 0 1.001c.193.31.53.501.886.501h13.964c.367 0 .704-.19.877-.5a1.03 1.03 0 0 0 .01-1.002L8.893 1.5zm.133 11.497H6.987v-2.003h2.039v2.003zm0-3.004H6.987V5.987h2.039v4.006z"></path></svg></span>caution</h5></div><div class="admonition-content"><p>如果你关闭 addLocal,大多数 Rancher 2.5 功能都不能使用,包括 EKS Provisioner。</p></div></div><p>如果这在你的环境中是一个问题,你可以在初始安装时将此选项设置为“false”。</p><p>此选项仅在首次安装 Rancher 时有效。详情请参见 <a href="https://github.com/rancher/rancher/issues/16522" target="_blank" rel="noopener noreferrer">Issue 16522</a>。</p><div class="language-plain codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-plain codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">--set addLocal=&quot;false&quot;</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="复制代码到剪贴板" title="复制" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><h3 class="anchor anchorWithStickyNavbar_LWe7" id="自定义-ingress">自定义 Ingress<a class="hash-link" href="#自定义-ingress" title="标题的直接链接">​</a></h3><p>要自定义或使用 Rancher Server 的其他 Ingress,你可以设置自己的 Ingress annotations。</p><p>设置自定义证书颁发者的示例:</p><div class="language-plain codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-plain codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">--set ingress.extraAnnotations.&#x27;cert-manager\.io/cluster-issuer&#x27;=issuer-name</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="复制代码到剪贴板" title="复制" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>以下是使用 <code>ingress.configurationSnippet</code>设置静态代理头的实例。该值像模板一样进行解析,因此可以使用变量。</p><div class="language-plain codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-plain codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">--set ingress.configurationSnippet=&#x27;more_set_input_headers X-Forwarded-Host {{ .Values.hostname }};&#x27;</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="复制代码到剪贴板" title="复制" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><h3 class="anchor anchorWithStickyNavbar_LWe7" id="http-代理">HTTP 代理<a class="hash-link" href="#http-代理" title="标题的直接链接">​</a></h3><p>Rancher 的一些功能(Helm Chart)需要使用互联网才能使用。使用 <code>proxy</code> 来设置你的代理服务器。</p><p>在 <code>noProxy</code> 列表中添加例外的 IP。确保你已添加了 Pod 集群 IP 范围(默认:<code>10.42.0.0/16</code>),服务集群 IP 范围(默认:<code>10.43.0.0/16</code>),内部集群域名(默认:<code>.svc,.cluster.local</code>)和所有 worker 集群 <code>controlplane</code> 节点。Rancher 支持在此列表中使用 CIDR 表示法范围。</p><div class="language-plain codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-plain codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">--set proxy=&quot;http://&lt;username&gt;:&lt;password&gt;@&lt;proxy_url&gt;:&lt;proxy_port&gt;/&quot;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">--set noProxy=&quot;127.0.0.0/8\,10.0.0.0/8\,172.16.0.0/12\,192.168.0.0/16\,.svc\,.cluster.local&quot;</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="复制代码到剪贴板" title="复制" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><h3 class="anchor anchorWithStickyNavbar_LWe7" id="额外的授信-ca">额外的授信 CA<a class="hash-link" href="#额外的授信-ca" title="标题的直接链接">​</a></h3><p>如果你有私有镜像仓库(registries)、应用商店(catalogs)或拦截证书的代理,则可能需要向 Rancher 添加额外的授信 CA。</p><div class="language-plain codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-plain codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">--set additionalTrustedCAs=true</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="复制代码到剪贴板" title="复制" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>创建完 Rancher deployment 后,将 pem 格式的 CA 证书复制到一个名为 <code>ca-additional.pem</code> 的文件中,并使用 <code>kubectl</code> 在 <code>cattle-system</code> 命名空间中创建 <code>tls-ca-additional</code> 密文。</p><div class="language-plain codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-plain codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">kubectl -n cattle-system create secret generic tls-ca-additional --from-file=ca-additional.pem=./ca-additional.pem</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="复制代码到剪贴板" title="复制" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><h3 class="anchor anchorWithStickyNavbar_LWe7" id="私有仓库和离线安装">私有仓库和离线安装<a class="hash-link" href="#私有仓库和离线安装" title="标题的直接链接">​</a></h3><p>有关使用私有仓库安装 Rancher 的详情,请参见<a href="/zh/pages-for-subheaders/air-gapped-helm-cli-install">离线安装</a>。</p><h1>外部 TLS 终止</h1><p>我们建议将负载均衡器配置为 4 层均衡,将普通 80/tcp 和 443/tcp 转发到 Rancher Management 集群节点。集群上的 Ingress Controller 会将端口 80 上的 HTTP 流量重定向到端口 443 上的 HTTPS。</p><p>你可以在 Rancher 集群(Ingress)外部的 L7 负载均衡器上终止 SSL/TLS。使用 <code>--set tls=external</code> 选项,将负载均衡器指向所有 Rancher 集群节点上的端口 HTTP 80。这将在 HTTP 端口 80 上暴露 Rancher 接口。请注意,允许直接连接到 Rancher 集群的客户端不会被加密。如果你选择这样做,我们建议你将网络级别的直接访问限制为仅你的负载均衡器。</p><div class="admonition admonition-note alert alert--secondary"><div class="admonition-heading"><h5><span class="admonition-icon"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="16" viewBox="0 0 14 16"><path fill-rule="evenodd" d="M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"></path></svg></span>note</h5></div><div class="admonition-content"><p>如果你使用的是私有 CA 签名的证书,请添加 <code>--set privateCA=true</code> 并参见<a href="/zh/getting-started/installation-and-upgrade/resources/add-tls-secrets">添加 TLS 密文 - 使用私有 CA 签名证书</a>,为 Rancher 添加 CA 证书。</p></div></div><p>你的负载均衡器必须支持长期存在的 Websocket 连接,并且需要插入代理头,以便 Rancher 可以正确传送链接。</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="使用-nginx-v025-为外部-tls-配置-ingress">使用 NGINX v0.25 为外部 TLS 配置 Ingress<a class="hash-link" href="#使用-nginx-v025-为外部-tls-配置-ingress" title="标题的直接链接">​</a></h3><p>在 NGINX 0.25 中,NGINX 关于转发头和外部 TLS 终止的行为<a href="https://github.com/kubernetes/ingress-nginx/blob/master/Changelog.md#0220" target="_blank" rel="noopener noreferrer">已更改</a>。因此,如果你同时使用 NGINX 0.25 和外部 TLS 终止配置,你必须编辑 <code>cluster.yml</code> 来为 Ingress 启用 <code>use-forwarded-headers</code> 选项。</p><div class="language-yaml codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-yaml codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token key atrule">ingress</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">provider</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> nginx</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">options</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">use-forwarded-headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">&#x27;true&#x27;</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="复制代码到剪贴板" title="复制" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><h3 class="anchor anchorWithStickyNavbar_LWe7" id="必须的-header">必须的 Header<a class="hash-link" href="#必须的-header" title="标题的直接链接">​</a></h3><ul><li><code>Host</code></li><li><code>X-Forwarded-Proto</code></li><li><code>X-Forwarded-Port</code></li><li><code>X-Forwarded-For</code></li></ul><h3 class="anchor anchorWithStickyNavbar_LWe7" id="建议的超时时间">建议的超时时间<a class="hash-link" href="#建议的超时时间" title="标题的直接链接">​</a></h3><ul><li>读超时:<code>1800 seconds</code></li><li>写超时:<code>1800 seconds</code></li><li>连接超时:<code>30 seconds</code></li></ul><h3 class="anchor anchorWithStickyNavbar_LWe7" id="健康检查">健康检查<a class="hash-link" href="#健康检查" title="标题的直接链接">​</a></h3><p>Rancher 将对 <code>/healthz</code> 端点的健康检查响应<code>200</code>。</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="示例-nginx-配置">示例 NGINX 配置<a class="hash-link" href="#示例-nginx-配置" title="标题的直接链接">​</a></h3><p>此 NGINX 配置已在 NGINX 1.14 上进行了测试。</p><div class="admonition admonition-caution alert alert--warning"><div class="admonition-heading"><h5><span class="admonition-icon"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 16 16"><path fill-rule="evenodd" d="M8.893 1.5c-.183-.31-.52-.5-.887-.5s-.703.19-.886.5L.138 13.499a.98.98 0 0 0 0 1.001c.193.31.53.501.886.501h13.964c.367 0 .704-.19.877-.5a1.03 1.03 0 0 0 .01-1.002L8.893 1.5zm.133 11.497H6.987v-2.003h2.039v2.003zm0-3.004H6.987V5.987h2.039v4.006z"></path></svg></span>caution</h5></div><div class="admonition-content"><p>此 NGINX 配置只是一个示例,可能不适合你的环境。如需查阅完整文档,请参见 <a href="https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/" target="_blank" rel="noopener noreferrer">NGINX 负载均衡 - HTTP 负载均衡</a>。</p></div></div><ul><li>将 <code>IP_NODE1</code>,<code>IP_NODE2</code> 和 <code>IP_NODE3</code> 替换为你集群中节点的 IP 地址。</li><li>将两处的 <code>FQDN</code> 均替换为 Rancher 的 DNS 名称。</li><li>把 <code>/certs/fullchain.pem</code> 和 <code>/certs/privkey.pem</code> 分别替换为服务器证书和服务器证书密钥的位置。</li></ul><div class="codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-text codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">worker_processes 4;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">worker_rlimit_nofile 40000;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">events {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> worker_connections 8192;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">}</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">http {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> upstream rancher {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> server IP_NODE_1:80;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> server IP_NODE_2:80;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> server IP_NODE_3:80;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> map $http_upgrade $connection_upgrade {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> default Upgrade;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> &#x27;&#x27; close;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> server {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> listen 443 ssl http2;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> server_name FQDN;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> ssl_certificate /certs/fullchain.pem;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> ssl_certificate_key /certs/privkey.pem;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> location / {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Host $host;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Forwarded-Proto $scheme;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Forwarded-Port $server_port;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass http://rancher;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_http_version 1.1;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Upgrade $http_upgrade;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Connection $connection_upgrade;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # 此项允许执行的 shell 窗口保持开启,最长可达15分钟。不使用此参数的话,默认1分钟后自动关闭。</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_read_timeout 900s;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_buffering off;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> server {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> listen 80;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> server_name FQDN;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> return 301 https://$server_name$request_uri;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">}</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="复制代码到剪贴板" title="复制" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/rancher/rancher-docs/edit/main/docs/reference-guides/installation-references/helm-chart-options.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_eYIM" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>编辑此页</a></div><div class="col lastUpdated_vbeJ"><span class="theme-last-updated">最后<!-- -->于 <b><time datetime="2022-09-23T17:11:24.000Z">2022/9/23</time></b> <!-- -->更新</span></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="文档分页导航"><a class="pagination-nav__link pagination-nav__link--prev" href="/zh/pages-for-subheaders/installation-references"><div class="pagination-nav__sublabel">上一页</div><div class="pagination-nav__label">安装参考</div></a><a class="pagination-nav__link pagination-nav__link--next" href="/zh/reference-guides/installation-references/tls-settings"><div class="pagination-nav__sublabel">下一页</div><div class="pagination-nav__label">TLS 设置</div></a></nav></div></div><div class="col col--3"><div class="tableOfContents_bqdL thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#常用选项" class="table-of-contents__link toc-highlight">常用选项</a></li><li><a href="#高级选项" class="table-of-contents__link toc-highlight">高级选项</a><ul><li><a href="#引导密码" class="table-of-contents__link toc-highlight">引导密码</a></li><li><a href="#api-审计日志" class="table-of-contents__link toc-highlight">API 审计日志</a></li><li><a href="#额外设置环境变量" class="table-of-contents__link toc-highlight">额外设置环境变量</a></li><li><a href="#tls-设置" class="table-of-contents__link toc-highlight">TLS 设置</a></li><li><a href="#导入-local-集群" class="table-of-contents__link toc-highlight">导入 <code>local</code> 集群</a></li><li><a href="#自定义-ingress" class="table-of-contents__link toc-highlight">自定义 Ingress</a></li><li><a href="#http-代理" class="table-of-contents__link toc-highlight">HTTP 代理</a></li><li><a href="#额外的授信-ca" class="table-of-contents__link toc-highlight">额外的授信 CA</a></li><li><a href="#私有仓库和离线安装" class="table-of-contents__link toc-highlight">私有仓库和离线安装</a></li><li><a href="#使用-nginx-v025-为外部-tls-配置-ingress" class="table-of-contents__link toc-highlight">使用 NGINX v0.25 为外部 TLS 配置 Ingress</a></li><li><a href="#必须的-header" class="table-of-contents__link toc-highlight">必须的 Header</a></li><li><a href="#建议的超时时间" class="table-of-contents__link toc-highlight">建议的超时时间</a></li><li><a href="#健康检查" class="table-of-contents__link toc-highlight">健康检查</a></li><li><a href="#示例-nginx-配置" class="table-of-contents__link toc-highlight">示例 NGINX 配置</a></li></ul></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 SUSE Rancher. All Rights Reserved.</div></div></div></footer></div>
<script src="/zh/assets/js/runtime~main.f10e0fa4.js"></script>
<script src="/zh/assets/js/main.59e3f7b9.js"></script>
</body>
</html>