在已有的k8s中部署rancher
k8s安装racher接上文安装ingress之后, 需要先安装ingress-nginx, 链接安装需要Helm, 请自行安装Helm.k8s的master节点是: 10.6.14.23第一步: 安装证书vim cert.sh#!/bin/bash -ehelp (){echo' ==========================================================
·
在k8s中rancher, 接上文安装ingress之后, 需要先安装ingress-nginx, 链接
安装需要Helm, 请自行安装Helm.
k8s的master节点是: 10.6.14.23
第一步: 安装证书
vim cert.sh
#!/bin/bash -e
help ()
{
echo ' ================================================================ '
echo ' --ssl-domain: 生成ssl证书需要的主域名，如不指定则默认为localhost，如果是ip访问服务，则可忽略；'
echo ' --ssl-trusted-ip: 一般ssl证书只信任域名的访问请求，有时候需要使用ip去访问server，那么需要给ssl证书添加扩展IP，多个IP用逗号隔开；'
echo ' --ssl-trusted-domain: 如果想多个域名访问，则添加扩展域名（SSL_TRUSTED_DOMAIN）,多个扩展域名用逗号隔开；'
echo ' --ssl-size: ssl加密位数，默认2048；'
echo ' --ssl-date: ssl有效期，默认10年；'
echo ' --ca-date: ca有效期，默认10年；'
echo ' --ssl-cn: 国家代码(2个字母的代号),默认CN;'
echo ' 使用示例:'
echo ' ./create_self-signed-cert.sh --ssl-domain=www.test.com --ssl-trusted-domain=www.test2.com \ '
echo ' --ssl-trusted-ip=1.1.1.1,2.2.2.2,3.3.3.3 --ssl-size=2048 --ssl-date=3650'
echo ' ================================================================'
}
case "$1" in
-h|--help) help; exit;;
esac
if [[ $1 == '' ]];then
help;
exit;
fi
CMDOPTS="$*"
for OPTS in $CMDOPTS;
do
key=$(echo ${OPTS} | awk -F"=" '{print $1}' )
value=$(echo ${OPTS} | awk -F"=" '{print $2}' )
case "$key" in
--ssl-domain) SSL_DOMAIN=$value ;;
--ssl-trusted-ip) SSL_TRUSTED_IP=$value ;;
--ssl-trusted-domain) SSL_TRUSTED_DOMAIN=$value ;;
--ssl-size) SSL_SIZE=$value ;;
--ssl-date) SSL_DATE=$value ;;
--ca-date) CA_DATE=$value ;;
--ssl-cn) CN=$value ;;
esac
done
#CA相关配置
CA_DATE=${CA_DATE:-3650}
CA_KEY=${CA_KEY:-cakey.pem}
CA_CERT=${CA_CERT:-cacerts.pem}
CA_DOMAIN=localhost
#ssl相关配置
SSL_CONFIG=${SSL_CONFIG:-$PWD/openssl.cnf}
SSL_DOMAIN=${SSL_DOMAIN:-localhost}
SSL_DATE=${SSL_DATE:-3650}
SSL_SIZE=${SSL_SIZE:-2048}
##国家代码(2个字母的代号),默认CN;
CN=${CN:-CN}
SSL_KEY=$SSL_DOMAIN.key
SSL_CSR=$SSL_DOMAIN.csr
SSL_CERT=$SSL_DOMAIN.crt
echo -e "\033[32m ---------------------------- \033[0m"
echo -e "\033[32m | 生成 SSL Cert | \033[0m"
echo -e "\033[32m ---------------------------- \033[0m"
if [[ -e ./${CA_KEY} ]]; then
echo -e "\033[32m ====> 1. 发现已存在CA私钥，备份"${CA_KEY}"为"${CA_KEY}"-bak，然后重新创建 \033[0m"
mv ${CA_KEY} "${CA_KEY}"-bak
openssl genrsa -out ${CA_KEY} ${SSL_SIZE}
else
echo -e "\033[32m ====> 1. 生成新的CA私钥 ${CA_KEY} \033[0m"
openssl genrsa -out ${CA_KEY} ${SSL_SIZE}
fi
if [[ -e ./${CA_CERT} ]]; then
echo -e "\033[32m ====> 2. 发现已存在CA证书，先备份"${CA_CERT}"为"${CA_CERT}"-bak，然后重新创建 \033[0m"
mv ${CA_CERT} "${CA_CERT}"-bak
openssl req -x509 -sha256 -new -nodes -key ${CA_KEY} -days ${CA_DATE} -out ${CA_CERT} -subj "/C=${CN}/CN=${CA_DOMAIN}"
else
echo -e "\033[32m ====> 2. 生成新的CA证书 ${CA_CERT} \033[0m"
openssl req -x509 -sha256 -new -nodes -key ${CA_KEY} -days ${CA_DATE} -out ${CA_CERT} -subj "/C=${CN}/CN=${CA_DOMAIN}"
fi
echo -e "\033[32m ====> 3. 生成Openssl配置文件 ${SSL_CONFIG} \033[0m"
cat > ${SSL_CONFIG} <<EOM
[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name
[req_distinguished_name]
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth, serverAuth
EOM
if [[ -n ${SSL_TRUSTED_IP} || -n ${SSL_TRUSTED_DOMAIN} ]]; then
cat >> ${SSL_CONFIG} <<EOM
subjectAltName = @alt_names
[alt_names]
EOM
IFS=","
dns=(${SSL_TRUSTED_DOMAIN})
dns+=(${SSL_DOMAIN})
for i in "${!dns[@]}"; do
echo DNS.$((i+1)) = ${dns[$i]} >> ${SSL_CONFIG}
done
if [[ -n ${SSL_TRUSTED_IP} ]]; then
ip=(${SSL_TRUSTED_IP})
for i in "${!ip[@]}"; do
echo IP.$((i+1)) = ${ip[$i]} >> ${SSL_CONFIG}
done
fi
fi
echo -e "\033[32m ====> 4. 生成服务SSL KEY ${SSL_KEY} \033[0m"
openssl genrsa -out ${SSL_KEY} ${SSL_SIZE}
echo -e "\033[32m ====> 5. 生成服务SSL CSR ${SSL_CSR} \033[0m"
openssl req -sha256 -new -key ${SSL_KEY} -out ${SSL_CSR} -subj "/C=${CN}/CN=${SSL_DOMAIN}" -config ${SSL_CONFIG}
echo -e "\033[32m ====> 6. 生成服务SSL CERT ${SSL_CERT} \033[0m"
openssl x509 -sha256 -req -in ${SSL_CSR} -CA ${CA_CERT} \
-CAkey ${CA_KEY} -CAcreateserial -out ${SSL_CERT} \
-days ${SSL_DATE} -extensions v3_req \
-extfile ${SSL_CONFIG}
echo -e "\033[32m ====> 7. 证书制作完成 \033[0m"
echo
echo -e "\033[32m ====> 8. 以YAML格式输出结果 \033[0m"
echo "----------------------------------------------------------"
echo "ca_key: |"
cat $CA_KEY | sed 's/^/ /'
echo
echo "ca_cert: |"
cat $CA_CERT | sed 's/^/ /'
echo
echo "ssl_key: |"
cat $SSL_KEY | sed 's/^/ /'
echo
echo "ssl_csr: |"
cat $SSL_CSR | sed 's/^/ /'
echo
echo "ssl_cert: |"
cat $SSL_CERT | sed 's/^/ /'
echo
echo -e "\033[32m ====> 9. 附加CA证书到Cert文件 \033[0m"
cat ${CA_CERT} >> ${SSL_CERT}
echo "ssl_cert: |"
cat $SSL_CERT | sed 's/^/ /'
echo
echo -e "\033[32m ====> 10. 重命名服务证书 \033[0m"
echo "cp ${SSL_DOMAIN}.key tls.key"
cp ${SSL_DOMAIN}.key tls.key
echo "cp ${SSL_DOMAIN}.crt tls.crt"
cp ${SSL_DOMAIN}.crt tls.crt
#生成证书
sudo chmod +x cert.sh
./cert.sh --ssl-domain=rancher.sigs.applysquare.net --ssl-size=2048 --ssl-date=3650
#创建namespace
kubectl create namespace cattle-system
#服务证书和私钥密文
kubectl -n cattle-system create \
secret tls tls-rancher-ingress \
--cert=./tls.crt \
--key=./tls.key
#ca证书密文
kubectl -n cattle-system create secret \
generic tls-ca \
--from-file=./cacerts.pem
第二步: Helm安装Rancher
#添加仓库
helm repo add rancher-stable https://releases.rancher.com/server-charts/stable
#安装rancher
helm install rancher rancher-stable/rancher \
--namespace cattle-system \
--set hostname=rancher.test.com \
--set ingress.tls.source=secret \
--set privateCA=false #为false不启用验证
第三步, 配置hosts
#节点的/etc/hosts 以及 本地访问的windows的hosts
10.6.14.23 rancher.test.com
这里需要使用到ingress-nginx配置的端口来访问.
https://rancher.test.com:32443 #其中32443端口来自上一篇文章安装ingress-nginx中
运行成功后pod和ingress如下:
第四步, 如果rancher安装失败,想要重新安装, 那么需要将rancher卸载干净, 那么需要执行脚本
vi delete-rancher.sh
sh delete-rancher.sh
#!/bin/bash
# k8s=1.18 rchaner=2.5.5
api_server="https://10.6.14.23:6443"
token=`cat .kube/admin-token`
echo "处理删除中断"
curl -k $api_server/api/v1/namespaces/local/finalize \
-H "Authorization: Bearer $token" \
-H "Content-Type: application/json" \
-XPUT \
-d '{"apiVersion":"v1","kind":"Namespace","metadata":{"name":"local"},"spec":{"finalizers":[]}}'
kubectl patch --type='json' -p='[{"op": "remove", "path": "/metadata/finalizers"}]' ns $(kubectl get ns |egrep 'cattle|fleet|rancher|local|^p-|^user-' |awk '{print $1}')
project_ns=`kubectl get ns |egrep '^p-|local' |awk '{print $1}'`
project_crd=(clusterroletemplatebindings.management.cattle.io clusteralertgroups.management.cattle.io projects.management.cattle.io projectalertgroups.management.cattle.io projectalertrules.management.cattle.io projectroletemplatebindings.management.cattle.io nodes.management.cattle.io)
for ns in ${project_ns[@]}
do
for crd in ${project_crd[@]}
do
kubectl patch --type='json' -p='[{"op": "remove", "path": "/metadata/finalizers"}]' $crd -n $ns $(kubectl get $crd -n $ns|grep -v NAME|awk '{print $1}')
done
done
crd_list=`kubectl get crd |grep cattle.io |awk '{print $1}'`
for crd in $crd_list
do
kubectl patch --type='json' -p='[{"op": "remove", "path": "/metadata/finalizers"}]' $crd $(kubectl get $crd |grep -v NAME|awk '{print $1}')
done
echo "使用rancher清理工具 https://docs.rancher.cn/docs/rancher2/system-tools/_index/"
./system-tools remove -c .kube/config
kubectl get crd
echo "理论上所有rancher的crd都会被删除，如果还有说明有异常，继续会强制删除"
echo "按任意键继续"
read anykey
echo "helm卸载"
helm uninstall rancher -n cattle-system
helm uninstall rancher-operator -n rancher-operator-system
helm uninstall rancher-operator-crd -n rancher-operator-system
helm uninstall fleet -n fleet-system
helm uninstall fleet-crd -n fleet-system
echo "清理剩余资源"
sleep 5
for ns in $(kubectl get ns |grep -v NAME|awk '{print $1}')
do
kubectl delete rolebinding $(kubectl get rolebinding -n $ns --selector='cattle.io/creator=norman' |grep -v NAME|awk '{print $1}') -n $ns
done
ns_list=`kubectl get ns |egrep 'cattle|fleet|rancher|local' |awk '{print $1}'`
kubectl delete ns $ns_list
kubectl patch --type='json' -p='[{"op": "remove", "path": "/metadata/finalizers"}]' crd $(kubectl get crd |grep 'cattle.io' |awk '{print $1}')
kubectl get crd |grep 'cattle.io' |awk '{print $1}' |xargs kubectl delete crd
kubectl get clusterrolebinding |egrep 'default-admin|fleet|pod-impersonation-helm-op|rancher' |awk '{print $1}' |xargs kubectl delete clusterrolebinding
kubectl get clusterrole |egrep 'fleet|pod-impersonation-helm-op' |awk '{print $1}' |xargs kubectl delete clusterrole
kubectl label ns $(kubectl get ns |egrep -v 'NAME' |awk '{print $1}') field.cattle.io/projectId-
参考文档:
https://blog.51cto.com/13760351/2494356?source=dra
https://www.cnblogs.com/37yan/p/14275214.html
K8S/Kubernetes社区为您提供最前沿的新闻资讯和知识内容
更多推荐
0
0- 0
已为社区贡献3条内容
所有评论(0)