4层代理中主要是TCP协议代理，TCP代理主要基于IP+端口来通信。
7层代理中主要是http协议, http协议主要基于URL来通信。
1.安装Docker-CE: https://abc.htmltoo.com/thread-45069.htm
安装rancher2
2.Nginx配置
vi /etc/nginx/conf.d/rancher.conf
upstream rancher {
server IP_NODE_1:80;
server IP_NODE_2:80;
server IP_NODE_3:80;
}
map $http_upgrade $connection_upgrade {
default Upgrade;
'' close;
}
server {
listen 443 ssl http2;
server_name FQDN;
ssl_certificate /certs/fullchain.pem;
ssl_certificate_key /certs/privkey.pem;
location / {
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://rancher;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
# This allows the ability for the execute shell window to remain open for up to 15 minutes. Without this parameter, the default is 1 minute and will automatically close.
proxy_read_timeout 900s;
}
}
server {
listen 80;
server_name FQDN;
return 301 https://$server_name$request_uri;
}在/etc/nginx/conf.d/rancher.conf中, 替换 IP_NODE_1, IP_NODE_2, IP_NODE_3 为需添加到集群的Linux主机的IP；
在/etc/nginx/conf.d/rancher.conf中, 替换FQDN为你设置用来登录rancher的域名；
在/etc/nginx/conf.d/rancher.conf中, 替换/certs/fullchain.pem为证书的路径；
在/etc/nginx/conf.d/rancher.conf中, 替换/certs/privkey.pem为证书密钥的路径；
-----
cat >> /etc/nginx.conf << EOF
worker_processes 4;
worker_rlimit_nofile 40000;
events {
worker_connections 8192;
}
stream {
upstream rancher_servers_http {
least_conn;
server 172.18.1.4:80 max_fails=3 fail_timeout=5s;
server 172.18.1.5:80 max_fails=3 fail_timeout=5s;
server 172.18.1.9:80 max_fails=3 fail_timeout=5s;
}
server {
listen 80;
proxy_pass rancher_servers_http;
}
upstream rancher_servers_https {
least_conn;
server 172.18.1.4:443 max_fails=3 fail_timeout=5s;
server 172.18.1.5:443 max_fails=3 fail_timeout=5s;
server 172.18.1.9:443 max_fails=3 fail_timeout=5s;
}
server {
listen 443;
proxy_pass rancher_servers_https;
}
}
EOFdocker run -d --restart=unless-stopped -p 80:80 -p 443:443 -v /etc/nginx.conf:/etc/nginx/nginx.conf nginx:latest
-----
# 重新加载或者重启NGINX
# Reload NGINX
nginx -s reload
# Restart NGINX
# Depending on your Linux distribution
service nginx restart
systemctl restart nginx
# 访问Rancher: 安装成功后，通过https://FQDN 来访问RANCHER UI
3.配置DNS
选择一个用于访问Rancher的域名(FQDN)(例如，demo.rancher.com).
方案1- 有DNS服务器
1、登录DNS服务，创建一条 A 记录指向负载均衡主机IP；
2、在终端中执行一下命令来验证运行解析是否生效:
nslookup HOSTNAME.DOMAIN.COM
如果解析生效 nslookup demo.rancher.com DNS Server: YOUR_HOSTNAME_IP_ADDRESS DNS Address: YOUR_HOSTNAME_IP_ADDRESS#53 Non-authoritative answer: Name: demo.rancher.com Address: <负载均衡IP地址>
如果解析不生效 nslookup demo.rancher.com DNS Server: YOUR_HOSTNAME_IP_ADDRESS DNS Address: YOUR_HOSTNAME_IP_ADDRESS#5 ** server can't find demo.rancher.com: NXDOMAIN
方案2 - 无DNS服务
如果环境为内部网络且无DNS服务器，可以通过修改客户端的/etc/hosts文件，添加相应的条目。
vi /etc/hosts
4.下载 RKE
RKE是一种快速，通用的Kubernetes安装程序，可用于在Linux主机上安装Kubernetes。我们将使用RKE来配置Kubernetes集群并运行Rancher。
a.打开浏览器访问下载文件页面，根据你操作系统类型下载最新版本的RKE:
MacOS: rke_darwin-amd64
Linux: rke_linux-amd64
Windows: rke_windows-amd64.exe
b.通过chmod +x命令给刚下载的RKE二进制文件添加可执行权限。
如果是Windows系统，则跳过这一步.
# MacOS $ chmod +x rke_darwin-amd64 # Linux $ chmod +x rke_linux-amd64
c.确认RKE是否是最新版本:
# MacOS ./rke_darwin-amd64 --version # Linux ./rke_linux-amd64 --version 步骤结果: 你将看到以下内容: rke version v<N.N.N>
5.下载RKE配置模板
RKE通过 .yml 配置文件来安装和配置Kubernetes集群，有2个模板可供选择，具体取决于使用的SSL证书类型。
a.根据你使用的SSL证书类型，选择模板下载:
Template for self-signed certificate
vi 3-node-externalssl-certificate.yml
nodes: - address: <IP> # hostname or IP to access nodes user: <USER> # root user (usually 'root') role: [controlplane,etcd,worker] # K8s roles for node ssh_key_path: <PEM_FILE> # path to PEM file - address: <IP> user: <USER> role: [controlplane,etcd,worker] ssh_key_path: <PEM_FILE> - address: <IP> user: <USER> role: [controlplane,etcd,worker] ssh_key_path: <PEM_FILE> addons: |- --- kind: Namespace apiVersion: v1 metadata: name: cattle-system --- kind: ServiceAccount apiVersion: v1 metadata: name: cattle-admin namespace: cattle-system --- kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: cattle-crb namespace: cattle-system subjects: - kind: ServiceAccount name: cattle-admin namespace: cattle-system roleRef: kind: ClusterRole name: cluster-admin apiGroup: rbac.authorization.k8s.io --- apiVersion: v1 kind: Secret metadata: name: cattle-keys-server namespace: cattle-system type: Opaque data: cacerts.pem: <BASE64_CA> # CA cert used to sign cattle server cert and key --- apiVersion: v1 kind: Service metadata: namespace: cattle-system name: cattle-service labels: app: cattle spec: ports: - port: 80 targetPort: 80 protocol: TCP name: http selector: app: cattle --- apiVersion: extensions/v1beta1 kind: Ingress metadata: namespace: cattle-system name: cattle-ingress-http annotations: nginx.ingress.kubernetes.io/proxy-connect-timeout: "30" nginx.ingress.kubernetes.io/proxy-read-timeout: "1800" # Max time in seconds for ws to remain shell window open nginx.ingress.kubernetes.io/proxy-send-timeout: "1800" # Max time in seconds for ws to remain shell window open nginx.ingress.kubernetes.io/ssl-redirect: "false" # Disable redirect to ssl spec: rules: - host: <FQDN> http: paths: - backend: serviceName: cattle-service servicePort: 80 --- kind: Deployment apiVersion: extensions/v1beta1 metadata: namespace: cattle-system name: cattle spec: replicas: 1 template: metadata: labels: app: cattle spec: serviceAccountName: cattle-admin containers: - image: rancher/rancher:latest imagePullPolicy: Always name: cattle-server ports: - containerPort: 80 protocol: TCP volumeMounts: - mountPath: /etc/rancher/ssl name: cattle-keys-volume readOnly: true volumes: - name: cattle-keys-volume secret: defaultMode: 420 secretName: cattle-keys-server
Template for certificate signed by recognized CA
vi 3-node-externalssl-recognizedca.yml
nodes: - address: <IP> # hostname or IP to access nodes user: <USER> # root user (usually 'root') role: [controlplane,etcd,worker] # K8s roles for node ssh_key_path: <PEM_FILE> # path to PEM file - address: <IP> user: <USER> role: [controlplane,etcd,worker] ssh_key_path: <PEM_FILE> - address: <IP> user: <USER> role: [controlplane,etcd,worker] ssh_key_path: <PEM_FILE> addons: |- --- kind: Namespace apiVersion: v1 metadata: name: cattle-system --- kind: ServiceAccount apiVersion: v1 metadata: name: cattle-admin namespace: cattle-system --- kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: cattle-crb namespace: cattle-system subjects: - kind: ServiceAccount name: cattle-admin namespace: cattle-system roleRef: kind: ClusterRole name: cluster-admin apiGroup: rbac.authorization.k8s.io --- apiVersion: v1 kind: Service metadata: namespace: cattle-system name: cattle-service labels: app: cattle spec: ports: - port: 80 targetPort: 80 protocol: TCP name: http selector: app: cattle --- apiVersion: extensions/v1beta1 kind: Ingress metadata: namespace: cattle-system name: cattle-ingress-http annotations: nginx.ingress.kubernetes.io/proxy-connect-timeout: "30" nginx.ingress.kubernetes.io/proxy-read-timeout: "1800" # Max time in seconds for ws to remain shell window open nginx.ingress.kubernetes.io/proxy-send-timeout: "1800" # Max time in seconds for ws to remain shell window open nginx.ingress.kubernetes.io/ssl-redirect: "false" # Disable redirect to ssl spec: rules: - host: <FQDN> http: paths: - backend: serviceName: cattle-service servicePort: 80 --- kind: Deployment apiVersion: extensions/v1beta1 metadata: namespace: cattle-system name: cattle spec: replicas: 1 template: metadata: labels: app: cattle spec: serviceAccountName: cattle-admin containers: - image: rancher/rancher:latest imagePullPolicy: Always name: cattle-server ports: - containerPort: 80 protocol: TCP
b.重命名模板文件为 rancher-cluster.yml
6.节点配置
获得rancher-cluster.yml配置文件模板后，编辑节点部分以指向Linux主机。
a.节点免密登录
第一步:在任意一台Linux主机使用ssh-keygen命令产生公钥私钥对
ssh-keygen
第二步:通过ssh-copy-id命令将公钥复制到远程机器中
ssh-copy-id -i .ssh/id_rsa.pub $user@192.168.x.xxx
b.编辑rancher-cluster.yml配置文件
编辑器打开 rancher-cluster.yml 文件,在nodes配置版块中，修改 IP_ADDRESS_X and USER为你真实的Linux主机IP和用户名,ssh_key_path为第一步生成的私钥文件，如果是在RKE所在主机上生成的公钥私钥对，此配置可保持默认:
nodes: - address: IP_ADDRESS_1 # THE IP ADDRESS OR HOSTNAME OF THE NODE user: USER # USER WITH ADMIN ACCESS. USUALLY `root` role: [controlplane,etcd,worker] ssh_key_path: ~/.ssh/id_rsa # PATH TO SSH KEY THAT AUTHENTICATES ON YOUR WORKSTATION # USUALLY THE VALUE ABOVE - address: IP_ADDRESS_2 user: USER role: [controlplane,etcd,worker] ssh_key_path: ~/.ssh/id_rsa - address: IP_ADDRESS_3 user: USER role: [controlplane,etcd,worker] ssh_key_path: ~/.ssh/id_rsa
使用RHEL/CentOS系统时，因为系统安全限制，ssh不能使用root账户。
7.证书配置
出于安全考虑，使用Rancher需要SSL加密。 SSL可以保护所有Rancher网络通信，例如登录或与集群交互时。
a.方案A — 使用自签名证书
先决条件:
i.证书必须是PEM格式,PEM只是一种证书类型，并不是说文件必须是PEM为后缀，具体可以查看证书类型；
ii.证书必须通过base64加密；
iii.在你的证书文件中，包含链中的所有中间证书；
在kind: Secret和name: cattle-keys-ingress中:
替换为CA证书文件的base64编码字符串(通常称为ca.pem或ca.crt)
注意:
base64编码的字符串应该与cacerts.pem在同一行，冒号后有一个空格，在开头，中间或结尾没有任何换行符。
结果:替换值后，文件应如下所示(base64编码的字符串应该不同):
--- apiVersion: v1 kind: Secret metadata: name: cattle-keys-server namespace: cattle-system type: Opaque data: cacerts.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNvRENDQVlnQ0NRRHVVWjZuMEZWeU16QU5CZ2txaGtpRzl3MEJBUXNGQURBU01SQXdEZ1lEVlFRRERBZDAKWlhOMExXTmhNQjRYRFRFNE1EVXdOakl4TURRd09Wb1hEVEU0TURjd05USXhNRFF3T1Zvd0VqRVFNQTRHQTFVRQpBd3dIZEdWemRDMWpZVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFNQmpBS3dQCndhRUhwQTdaRW1iWWczaTNYNlppVmtGZFJGckJlTmFYTHFPL2R0RUdmWktqYUF0Wm45R1VsckQxZUlUS3UzVHgKOWlGVlV4Mmo1Z0tyWmpwWitCUnFiZ1BNbk5hS1hocmRTdDRtUUN0VFFZdGRYMVFZS0pUbWF5NU45N3FoNTZtWQprMllKRkpOWVhHWlJabkdMUXJQNk04VHZramF0ZnZOdmJ0WmtkY2orYlY3aWhXanp2d2theHRUVjZlUGxuM2p5CnJUeXBBTDliYnlVcHlad3E2MWQvb0Q4VUtwZ2lZM1dOWmN1YnNvSjhxWlRsTnN6UjVadEFJV0tjSE5ZbE93d2oKaG41RE1tSFpwZ0ZGNW14TU52akxPRUc0S0ZRU3laYlV2QzlZRUhLZTUxbGVxa1lmQmtBZWpPY002TnlWQUh1dApuay9DMHpXcGdENkIwbkVDQXdFQUFUQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFHTCtaNkRzK2R4WTZsU2VBClZHSkMvdzE1bHJ2ZXdia1YxN3hvcmlyNEMxVURJSXB6YXdCdFJRSGdSWXVtblVqOGo4T0hFWUFDUEthR3BTVUsKRDVuVWdzV0pMUUV0TDA2eTh6M3A0MDBrSlZFZW9xZlVnYjQrK1JLRVJrWmowWXR3NEN0WHhwOVMzVkd4NmNOQQozZVlqRnRQd2hoYWVEQmdma1hXQWtISXFDcEsrN3RYem9pRGpXbi8walI2VDcrSGlaNEZjZ1AzYnd3K3NjUDIyCjlDQVZ1ZFg4TWpEQ1hTcll0Y0ZINllBanlCSTJjbDhoSkJqa2E3aERpVC9DaFlEZlFFVFZDM3crQjBDYjF1NWcKdE03Z2NGcUw4OVdhMnp5UzdNdXk5bEthUDBvTXl1Ty82Tm1wNjNsVnRHeEZKSFh4WTN6M0lycGxlbTNZQThpTwpmbmlYZXc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
b.方案B—使用权威CA机构颁发的证书
8.域名配置
RKE配置文件中有一个<FQDN>引用,编辑配置文件替换<FQDN>:
结果: 替换值后，文件应如下所示(base64编码的字符串应该不同):
apiVersion: extensions/v1beta1 kind: Ingress metadata: namespace: cattle-system name: cattle-ingress-http annotations: nginx.ingress.kubernetes.io/proxy-connect-timeout: "30" nginx.ingress.kubernetes.io/proxy-read-timeout: "1800" # Max time in seconds for ws toremain shell window open nginx.ingress.kubernetes.io/proxy-send-timeout: "1800" # Max time in seconds for ws toremain shell window open spec: rules: - host: demo.rancher.com http: paths: - backend: serviceName: cattle-service servicePort: 80
9.备份配置文件
保存关闭.yml文件后，将其备份到安全位置。升级Rancher时，你需要再次使用此文件。
10.运行RKE
完成所有配置后，你可以通过运行rke up命令并使用–config参数指定配置文件来完成Rancher 集群的安装。
i.下载RKE二进制文档到你的主机，确保 rancher-cluster.yml与下载的rke 在同一目录下；
ii.打开shell 终端，切换路径到RKE所在的目录；
iii.根据操作系统类型，选择以下命令并执行:
# MacOS ./rke_darwin-amd64 up --config rancher-cluster.yml # Linux ./rke_linux-amd64 up --config rancher-cluster.yml
结果: 应该会有以下日志输出:
INFO[0000] Building Kubernetes cluster INFO[0000] [dialer] Setup tunnel for host [1.1.1.1] INFO[0000] [network] Deploying port listener containers INFO[0000] [network] Pulling image [alpine:latest] on host [1.1.1.1] ... INFO[0101] Finished building Kubernetes cluster successfully
11.备份自动生成的kubectl配置文件
在安装过程中，RKE会自动生成一个kube_config_rancher-cluster.yml与RKE二进制文件位于同一目录中的配置文件。此文件很重要，它可以在Rancher server故障时，利用kubectl通过此配置文件管理Kubernetes集群。复制此文件将其备份到安全位置。
12.要更改主机端口映射，替换-p 80:80 -p 443:443为-p 8080:80 -p 8443:443:
docker run -d --restart=unless-stopped -p 8080:80 -p 8443:443 rancher/rancher:latest
参考网址: