集群安装
yum update -y
wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo && yum makecache
mkfs.ext4 /dev/sdb
mount /dev/sdb /mnt/
mount -t nfs -o vers=3,nolock 10.1.0.7:/ /app
curl https://releases.rancher.com/install-docker/19.03.sh | sh
docker ps
systemctl stop docker
mv /var/lib/docker /mnt/docker
ln -s /mnt/docker /var/lib/docker
systemctl start docker
docker ps
docker info
curl -L https://github.com/docker/compose/releases/download/1.21.0/docker-compose-$(uname -s)-$(uname -m) -o /usr/local/bin/docker-compose
chmod 755 docker-compose
wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo && yum makecache
yum -y install nfs-utils
yum update -y
curl https://releases.rancher.com/install-docker/19.03.sh | sh
systemctl stop docker
mv /var/lib/docker /mnt/docker
/dev/sdb 493G 3.4G 464G 1% /mnt
ln -s /mnt/docker /var/lib/docker
cat /etc/docker/daemon.json
{
"max-concurrent-downloads": 3,
"max-concurrent-uploads": 5,
"insecure-registries":["10.1.0.24:8888"],
"log-driver": "json-file",
"log-opts": {
"max-size": "100m",
"max-file": "3"
}
}
systemctl daemon-reload
systemctl restart docker
docker info
rancher
mkdir /mnt/rancher
docker run -d --restart=unless-stopped -p 80:80 -p 443:443 --privileged -v /mnt/rancher:/var/lib/rancher rancher/rancher:v2.5.9
#Kubernetes 版本 v1.20.11
[root@dev-rancher ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
rancher/rancher v2.5.9 d7329a56a8e4 17 months ago 1.06GB
master/etcd
sudo docker run -d --privileged --restart=unless-stopped --net=host -v /etc/kubernetes:/etc/kubernetes -v /var/run:/var/run rancher/rancher-agent:v2.5.9 --server https://10.1.0.31 --token tkvs7c5bztn6cqjb6mlnp6m4vl2qcffsvt7jb7h5skmbrq6llkmrz6 --ca-checksum 90e166c7a46d1c40470dee6143f850e875e457bece96a4768dc7c0fe75a1f854 --etcd --controlplane
[root@dev-master ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
rancher/hyperkube v1.20.11-rancher1 bf745e45cbc3 15 months ago 1.87GB
rancher/rke-tools v0.1.78 6eeaa0b8da2c 17 months ago 264MB
rancher/rancher-agent v2.5.9 ebd5d4b8d7aa 17 months ago 536MB
rancher/rke-tools v0.1.75 f27a7e64b68c 18 months ago 196MB
rancher/mirrored-coreos-etcd v3.4.15-rancher1 87c4f81d8822 22 months ago 83.8MB
rancher/mirrored-calico-node v3.17.2 5a3c598c81d5 22 months ago 165MB
rancher/mirrored-calico-pod2daemon-flexvol v3.17.2 e2608e41ac3d 22 months ago 21.7MB
rancher/mirrored-calico-cni v3.17.2 81860c306a8d 22 months ago 128MB
rancher/mirrored-calico-kube-controllers v3.17.2 59b927df412f 22 months ago 52.1MB
rancher/coreos-flannel v0.13.0-rancher1 0bfefe9f649b 2 years ago 57.5MB
rancher/kube-api-auth v0.1.4 96148b821282 2 years ago 37.3MB
rancher/mirrored-pause 3.2 80d28bedfe5d 2 years ago 683kB
node
sudo docker run -d --privileged --restart=unless-stopped --net=host -v /etc/kubernetes:/etc/kubernetes -v /var/run:/var/run rancher/rancher-agent:v2.5.9 --server https://10.1.0.31 --token tkvs7c5bztn6cqjb6mlnp6m4vl2qcffsvt7jb7h5skmbrq6llkmrz6 --ca-checksum 90e166c7a46d1c40470dee6143f850e875e457bece96a4768dc7c0fe75a1f854 --worker
[root@dev-node ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
nginx latest 605c77e624dd 11 months ago 141MB
rancher/hyperkube v1.20.11-rancher1 bf745e45cbc3 15 months ago 1.87GB
rancher/rke-tools v0.1.78 6eeaa0b8da2c 17 months ago 264MB
rancher/rancher-agent v2.5.9 ebd5d4b8d7aa 17 months ago 536MB
rancher/fleet-agent v0.3.5 2a0c55d5db35 19 months ago 163MB
rancher/nginx-ingress-controller nginx-0.43.0-rancher3 d62950c1bfa1 20 months ago 296MB
rancher/mirrored-calico-node v3.17.2 5a3c598c81d5 22 months ago 165MB
rancher/mirrored-calico-pod2daemon-flexvol v3.17.2 e2608e41ac3d 22 months ago 21.7MB
rancher/mirrored-calico-cni v3.17.2 81860c306a8d 22 months ago 128MB
rancher/mirrored-metrics-server v0.4.1 9759a41ccdf0 2 years ago 60.5MB
rancher/mirrored-coredns-coredns 1.8.0 296a6d5035e2 2 years ago 42.5MB
rancher/coreos-flannel v0.13.0-rancher1 0bfefe9f649b 2 years ago 57.5MB
rancher/mirrored-cluster-proportional-autoscaler 1.8.1 4f1064cf7caf 2 years ago 40.7MB
rancher/mirrored-pause 3.2 80d28bedfe5d 2 years ago 683kB
节点添加 集群仪表盘–kubeconfig旁点击,进入registation CMD,添加节点
独立容器 Rancher Server 证书更新
https://docs.rancher.cn/docs/rancher2/trending-topics/certificate-rotation/_index/
查看证书,浏览器里点证书 当前 11:06
1、exec 到 rancher server
kubectl --insecure-skip-tls-verify -n kube-system delete secrets k3s-serving
kubectl --insecure-skip-tls-verify delete secret serving-cert -n cattle-system
rm -f /var/lib/rancher/k3s/server/tls/dynamic-cert.json
2、重启 rancher-server
docker restart <rancher_server_id>
3、执行以下命令刷新参数
curl --insecure -sfL https://10.1.0.31/v3 # Rancher Server 的访问地址
docker restart <rancher_server_id>
浏览器查看证书,签发时间没有变,但是有效时间延长了
颁发日期 2022年12月21日星期三 11:06:38
截止日期 2023年12月21日星期四 13:43:57
颁发日期 2022年12月21日星期三 11:06:38
截止日期 2023年12月21日星期四 13:49:21
RKE 轮换证书
[root@dev-rancher ~]# docker exec -it e66494c60479 bash
root@e66494c60479:/var/lib/rancher# for i in ls /var/lib/rancher/k3s/server/tls/*.crt; do echo $i; openssl x509 -enddate -noout -in $i; done
ls
...
/var/lib/rancher/k3s/server/tls/client-admin.crt
notAfter=Dec 21 03:06:10 2023 GMT
/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt
notAfter=Dec 21 03:06:10 2023 GMT
/var/lib/rancher/k3s/server/tls/client-ca.crt
notAfter=Dec 18 03:06:10 2032 GMT
/var/lib/rancher/k3s/server/tls/client-cloud-controller.crt
notAfter=Dec 21 03:06:10 2023 GMT
/var/lib/rancher/k3s/server/tls/client-controller.crt
notAfter=Dec 21 03:06:10 2023 GMT
/var/lib/rancher/k3s/server/tls/client-k3s-controller.crt
notAfter=Dec 21 03:06:10 2023 GMT
/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt
notAfter=Dec 21 03:06:10 2023 GMT
/var/lib/rancher/k3s/server/tls/client-kube-proxy.crt
notAfter=Dec 21 03:06:10 2023 GMT
/var/lib/rancher/k3s/server/tls/client-scheduler.crt
notAfter=Dec 21 03:06:10 2023 GMT
/var/lib/rancher/k3s/server/tls/request-header-ca.crt
notAfter=Dec 18 03:06:10 2032 GMT
/var/lib/rancher/k3s/server/tls/server-ca.crt
notAfter=Dec 18 03:06:10 2032 GMT
/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt
notAfter=Dec 21 03:06:10 2023 GMT
`
openssl x509 -in /etc/kubernetes/ssl/kube-apiserver.pem -noout -dates
notBefore=Dec 21 03:26:12 2022 GMT
notAfter=Dec 18 06:07:55 2032 GMT
#默认证书有效期10年
修改本机的系统时间,提前触发集群证书过期时间
[root@dev-rancher ~]# timedatectl set-ntp false
[root@dev-rancher ~]# timedatectl set-time '2025-07-11 18:02:20'
[root@rancher01 ~]# kubectl get nodes
Unable to connect to the server: x509: certificate has expired or is not yet valid: current time 2022-07-20T13:57:29+08:00 is after 2022-07-12T16:33:11Z
rke cert rotate #批量更新所有服务证书(CA 证书不变)
rke cert rotate --service kubelet #更新某个指定服务(CA 证书不变)
rke cert rotate --rotate-ca #轮换 CA 和所有服务证书