关于容器:Rancher的安装和几个坑

装置Rancher

1、装置docker-ce

略…

2、装置rancher

PS：因为端口2380抵触，注册核心（sericecomb）与rancher集群需部署在不同服务器，或批改端口

• 容器形式启动

  docker run -d --restart=unless-stopped -p 80:80 -p 443:443 -v /data1/srv/rancher:/var/lib/rancher/ rancher/rancher:stable
  or
  docker run -d --restart=unless-stopped -p 8080:8080 rancher/server
  

  运行rancher/rancher:stable无奈启动，始终重启中的状态，查看日志：

  [root@Bluse]# docker logs 81616bc88b42
  ERROR: Rancher must be ran with the --privileged flag when running outside of Kubernetes
  ERROR: Rancher must be ran with the --privileged flag when running outside of Kubernetes
  ERROR: Rancher must be ran with the --privileged flag when running outside of Kubernetes

  应用docker run命令装置 Rancher 2.5.x 时，须要增加--privileged标记变量，启用特权模式装置 Rancher

• 关上UI批改明码

3、增加集群

• 增加集群及master节点

  全局界面点击“增加集群”–“自定义”–编辑相干参数配置–“下一步”–复制增加主机节点命令到指标机器执行–“实现”

  docker run -d --privileged --restart=unless-stopped --net=host -v /etc/kubernetes:/etc/kubernetes -v /var/run:/var/run rancher/rancher-agent:v2.4.5 --server https://192.168.1.243 --token vgp67fl97cgj6zf6wdhd7zf25pm7988nbs6fbdd56tnsb7wkwjg76z --ca-checksum 140bc2675dceaaa34447b1cf2b710eb6738a46656bc794eed56095aea1672ed9 --node-name master01 --etcd --controlplane

• 增加node节点

  docker run -d --privileged --restart=unless-stopped --net=host -v /etc/kubernetes:/etc/kubernetes -v /var/run:/var/run rancher/rancher-agent:v2.4.5 --server https://192.168.1.243 --token vgp67fl97cgj6zf6wdhd7zf25pm7988nbs6fbdd56tnsb7wkwjg76z --ca-checksum 140bc2675dceaaa34447b1cf2b710eb6738a46656bc794eed56095aea1672ed9 --node-name node01 --worker

• 增加镜像库凭据

  抉择集群–“资源”下拉菜单中抉择“密文”–抉择“镜像库凭证列表”页–点击“增加凭证”，输出harbor地址及认证信息

附：清理脚本

docker stop $(docker ps -aq)
docker system prune -f
docker volume rm $(docker volume ls -q)
docker image rm $(docker image ls -q)
rm -rf /etc/ceph 
       /etc/cni 
       /etc/kubernetes 
       /opt/cni 
       /opt/rke 
       /run/secrets/kubernetes.io 
       /run/calico 
       /run/flannel 
       /var/lib/calico 
       /var/lib/etcd 
       /var/lib/cni 
       /var/lib/kubelet 
       /var/lib/rancher/rke/log 
       /var/log/containers 
       /var/log/pods 
       /var/run/calico

rancher最大的一个坑就是证书的有效期只有一年，运行一年后会呈现上面的日志

[info] Waiting on etcd startup: Get [https://localhost:2379/health](https://localhost:2379/health): x509: certificate has expired or is not yet valid的谬误

而后ui无奈登录，重启后整个rancher就挂了，翻了翻官网材料，各种降级更新感觉很繁琐，远不如从新再装一个来的不便，起初通过测试，间接把/var/lib/rancher/k3s/server/tls/下已过期的证书（.crt和.key）删掉，大略有14个，也能够生成新的证书，解决过期问题

​