k8s 集羣中 rancher 部署

helm 安裝

• 安裝helm

#下載helm 並安裝
wget https://get.helm.sh/helm-v3.3.1-linux-amd64.tar.gz
tar -xf helm-v3.3.1-linux-amd64.tar.gz
mv ./linux-amd64/helm /usr/local/bin/helm && chmod +x /usr/local/bin/helm
helm version

• helm安裝rancher

#添加 rancher chart 倉庫地址
helm repo add rancher-stable https://releases.rancher.com/server-charts/stable
helm repo list

#下載指定rancher 版本包
cd /data/work/linux-amd64
helm fetch rancher-stable/rancher   --version=2.4.11

#創建 tls 證書
kubectl create secret tls  moviebook.cn  --cert=server.crt --key=server.key   -n  kube-system 

#渲染模板
helm template rancher ./rancher-2.4.11.tgz  --namespace kube-system --output-dir .  --set ingress.tls.source=moviebook   --set hostname=rancher-dev-yzk8s.xxmm.cn 

#查看模板文件
ls rancher/templates/
clusterRoleBinding.yaml  deployment.yaml  ingress.yaml  serviceAccount.yaml  service.yaml

#修改模板文件增加名稱空間
增加字段： namespace: kube-system

#創建模板文件
kubectl apply -f .

#設置寬泛的rbac 
kubectl create clusterrolebinding permissive-binding \
  --clusterrole=cluster-admin \
  --user=admin \
  --user=kubelet \
  --group=system:serviceaccounts


#使用nginx 反向代理rancher 
# cat rancher.conf 
server {
        listen 443 ssl;
        server_name rancher-dev-yzk8s.xx.cn;
        ssl_certificate      /etc/nginx/ssl/xx.cn/server.crt;
        ssl_certificate_key  /etc/nginx/ssl/xx.cn/server.key;

        location / {
            proxy_set_header Host $host;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Port $server_port;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_pass https://kubernetes_backend_ssl;
            proxy_http_version 1.1;
            proxy_set_header Upgrade "websocket";
            proxy_set_header Connection "upgrade";
            # 這裏將允許您在 Rancher UI 中打開命令行窗口時，窗口可以保留最多15分鐘。沒有這個參數時，默認值爲1分鐘，一分鐘後在Rancher中的shell會自動關閉。
            proxy_read_timeout 900s;
            proxy_buffering off;
        }
    }

server {
     listen 80;
     server_name rancher-dev-yzk8s.xx.cn;
     rewrite ^(.*)$ https://${server_name}$1 permanent;
}

#rancher 報錯
#rancher2.4.11 版本報錯Alert: Component controller-manager is unhealthy. 
#現象rancher2.4.11 版本報錯Alert: Component controller-manager is unhealthy.
kubectl get componentstatuses

controller-manager   Unhealthy   HTTP probe failed with statuscode: 400  

#處理方式，登錄三個master 節點，三個master 節點執行相同的操作
cd /etc/kubernetes
vim kube-controller-manager.conf
註釋以下兩個參數
#--port=0
#--secure-port=10252

#重啓kube-controller-manager、kubelet
systemctl restart  kube-controller-manager
systemctl restart kubelet

#再喫執行 kubectl get componentstatuses
controller-manager   Healthy   ok                  
scheduler            Healthy   ok                  
etcd-2               Healthy   {"health":"true"}   
etcd-1               Healthy   {"health":"true"}   
etcd-0               Healthy   {"health":"true"} 

#刷新rancher，問題解決