05_安装Rancher（Rancher-高可用集群HA部署-离线安装）
安装Rancher
1、添加helm仓库
1.1、添加helm仓库
使用helm repo add来添加仓库，不同的地址适应不同的 Rancher 版本，请替换命令中的<CHART_REPO>，替换为latest，stable或alpha。
[rancher@rancher1 ~]$ helm repo add rancher-stable https://releases.rancher.com/server-charts/stable
"rancher-stable" has been added to your repositories1.2、获取最新的 Rancher Chart
获取最新的 Rancher Chart， tgz 文件会下载到本地。
[rancher@rancher1 ~]$ helm fetch rancher-stable/rancher 1.3、将tgz文件拷贝到rancher1中的rancher用户家目录下
将tgz文件(rancher-2.5.2.tgz)拷贝到内网rancher1中的rancher用户家目录下
[rancher@rancher1 ~]$ scp root@172.16.7.201:/home/rancher/rancher-2.5.2.tgz .2、 使用 Rancher 默认的自签名证书
使用 Rancher 默认的自签名证书在公网环境下获取最新的cert-manager Chart
2.1 添加 cert-manager 仓库
在可以连接互联网的系统中，添加 cert-manager 仓库。
helm repo add jetstack https://charts.jetstack.io
helm repo update2.2 获取最新的 cert-manager Chart
从 Helm Chart 仓库 中获取最新的 cert-manager Chart。
helm fetch jetstack/cert-manager --version v0.12.0将生成的cert-manager-v0.12.0.tgz文件拷贝到rancher1中
[rancher@rancher1 ~]$ scp root@172.16.7.200:/home/rancher/cert-manager-v0.12.0.tgz .2.3 渲染 chart 模板
使用您期望的参数渲染 chart 模板，切记设置image.repository以便从私有镜像仓库中拉取 Chart。这将生成一个包含相关 YAML 的名为cert-manager的文件夹。
helm template cert-manager ./cert-manager-v0.12.0.tgz --output-dir . \
--namespace cert-manager \
--set image.repository=172.16.7.199:80/quay.io/jetstack/cert-manager-controller \
--set webhook.image.repository=172.16.7.199:80/quay.io/jetstack/cert-manager-webhook \
--set cainjector.image.repository=172.16.7.199:80/quay.io/jetstack/cert-manager-cainjector输出内容如下：
WARNING: Kubernetes configuration file is group-readable. This is insecure. Location: /home/rancher/.kube/config
wrote ./cert-manager/templates/cainjector-serviceaccount.yaml
wrote ./cert-manager/templates/serviceaccount.yaml
wrote ./cert-manager/templates/webhook-serviceaccount.yaml
wrote ./cert-manager/templates/cainjector-rbac.yaml
wrote ./cert-manager/templates/rbac.yaml
wrote ./cert-manager/templates/rbac.yaml
wrote ./cert-manager/templates/rbac.yaml
wrote ./cert-manager/templates/rbac.yaml
wrote ./cert-manager/templates/rbac.yaml
wrote ./cert-manager/templates/rbac.yaml
wrote ./cert-manager/templates/rbac.yaml
wrote ./cert-manager/templates/rbac.yaml
wrote ./cert-manager/templates/webhook-rbac.yaml
wrote ./cert-manager/templates/cainjector-rbac.yaml
wrote ./cert-manager/templates/rbac.yaml
wrote ./cert-manager/templates/rbac.yaml
wrote ./cert-manager/templates/rbac.yaml
wrote ./cert-manager/templates/rbac.yaml
wrote ./cert-manager/templates/rbac.yaml
wrote ./cert-manager/templates/rbac.yaml
wrote ./cert-manager/templates/webhook-rbac.yaml
wrote ./cert-manager/templates/cainjector-rbac.yaml
wrote ./cert-manager/templates/rbac.yaml
wrote ./cert-manager/templates/cainjector-rbac.yaml
wrote ./cert-manager/templates/rbac.yaml
wrote ./cert-manager/templates/webhook-rbac.yaml
wrote ./cert-manager/templates/service.yaml
wrote ./cert-manager/templates/webhook-service.yaml
wrote ./cert-manager/templates/cainjector-deployment.yaml
wrote ./cert-manager/templates/deployment.yaml
wrote ./cert-manager/templates/webhook-deployment.yaml
wrote ./cert-manager/templates/webhook-rbac.yaml
wrote ./cert-manager/templates/webhook-mutating-webhook.yaml
wrote ./cert-manager/templates/webhook-validating-webhook.yaml执行完成会得到一个包含相关 YAML文件的cert-manager目录
[rancher@rancher1 ~]$ tree -L 3 cert-manager输出内容如下：
cert-manager
└── templates
├── cainjector-deployment.yaml
├── cainjector-rbac.yaml
├── cainjector-serviceaccount.yaml
├── deployment.yaml
├── rbac.yaml
├── serviceaccount.yaml
├── service.yaml
├── webhook-deployment.yaml
├── webhook-mutating-webhook.yaml
├── webhook-rbac.yaml
├── webhook-serviceaccount.yaml
├── webhook-service.yaml
└── webhook-validating-webhook.yaml2.4 下载 cert-manager 所需的 CRD 文件。
curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-0.12/deploy/manifests/00-crds.yaml说明：上面CRD文件需要梯子才能下载，梯子也要选哪条专线，不是每条都行。 内容如下：
见备份文件：cert-manager-crd.yaml2.5 渲染 Rancher 模板
渲染 Rancher 模板，声明您选择的选项。使用下面的参考表替换每个占位符。需要将 Rancher 配置为在由 Rancher 启动 Kubernetes 集群或 Rancher 工具时，使用私有镜像库。
helm template rancher ./rancher-2.5.2.tgz --output-dir . \
--namespace cattle-system \
--set hostname=rancher-slb.techzsun.com \
--set certmanager.version=v0.12.0 \
--set rancherImage=172.16.7.199:80/rancher/rancher \
--set systemDefaultRegistry=172.16.7.199:80 \
--set useBundledSystemChart=true输出内容如下：
WARNING: Kubernetes configuration file is group-readable. This is insecure. Location: /home/rancher/.kube/config
wrote ./rancher/templates/serviceAccount.yaml
wrote ./rancher/templates/clusterRoleBinding.yaml
wrote ./rancher/templates/service.yaml
wrote ./rancher/templates/deployment.yaml
wrote ./rancher/templates/ingress.yaml
wrote ./rancher/templates/issuer-rancher.yaml2.6 安装 Cert-manager
（仅限使用 Rancher 默认自签名证书）
2.6.1 为 cert-manager 创建 namespace
[rancher@rancher1 ~]$ kubectl create namespace cert-manager
namespace/cert-manager created2.6.2 创建 cert-manager CRD
kubectl apply -f cert-manager/cert-manager-crd.yaml输出内容如下：
Warning: apiextensions.k8s.io/v1beta1 CustomResourceDefinition is deprecated in v1.16+, unavailable in v1.22+; use apiextensions.k8s.io/v1 CustomResourceDefinition
customresourcedefinition.apiextensions.k8s.io/certificaterequests.cert-manager.io created
customresourcedefinition.apiextensions.k8s.io/certificates.cert-manager.io created
customresourcedefinition.apiextensions.k8s.io/challenges.acme.cert-manager.io created
customresourcedefinition.apiextensions.k8s.io/clusterissuers.cert-manager.io created
customresourcedefinition.apiextensions.k8s.io/issuers.cert-manager.io created
customresourcedefinition.apiextensions.k8s.io/orders.acme.cert-manager.io created2.6.3 启动 cert-manager
kubectl apply -R -f ./cert-manager输出内容如下：
Warning: apiextensions.k8s.io/v1beta1 CustomResourceDefinition is deprecated in v1.16+, unavailable in v1.22+; use apiextensions.k8s.io/v1 CustomResourceDefinition
customresourcedefinition.apiextensions.k8s.io/certificaterequests.cert-manager.io unchanged
customresourcedefinition.apiextensions.k8s.io/certificates.cert-manager.io unchanged
customresourcedefinition.apiextensions.k8s.io/challenges.acme.cert-manager.io unchanged
customresourcedefinition.apiextensions.k8s.io/clusterissuers.cert-manager.io unchanged
customresourcedefinition.apiextensions.k8s.io/issuers.cert-manager.io unchanged
customresourcedefinition.apiextensions.k8s.io/orders.acme.cert-manager.io unchanged
deployment.apps/cert-manager-cainjector created
Warning: rbac.authorization.k8s.io/v1beta1 ClusterRole is deprecated in v1.17+, unavailable in v1.22+; use rbac.authorization.k8s.io/v1 ClusterRole
clusterrole.rbac.authorization.k8s.io/cert-manager-cainjector created
Warning: rbac.authorization.k8s.io/v1beta1 ClusterRoleBinding is deprecated in v1.17+, unavailable in v1.22+; use rbac.authorization.k8s.io/v1 ClusterRoleBinding
clusterrolebinding.rbac.authorization.k8s.io/cert-manager-cainjector created
Warning: rbac.authorization.k8s.io/v1beta1 Role is deprecated in v1.17+, unavailable in v1.22+; use rbac.authorization.k8s.io/v1 Role
role.rbac.authorization.k8s.io/cert-manager-cainjector:leaderelection created
Warning: rbac.authorization.k8s.io/v1beta1 RoleBinding is deprecated in v1.17+, unavailable in v1.22+; use rbac.authorization.k8s.io/v1 RoleBinding
rolebinding.rbac.authorization.k8s.io/cert-manager-cainjector:leaderelection created
serviceaccount/cert-manager-cainjector created
deployment.apps/cert-manager created
clusterrole.rbac.authorization.k8s.io/cert-manager-controller-issuers created
clusterrole.rbac.authorization.k8s.io/cert-manager-controller-clusterissuers created
clusterrole.rbac.authorization.k8s.io/cert-manager-controller-certificates created
clusterrole.rbac.authorization.k8s.io/cert-manager-controller-orders created
clusterrole.rbac.authorization.k8s.io/cert-manager-controller-challenges created
clusterrole.rbac.authorization.k8s.io/cert-manager-controller-ingress-shim created
clusterrole.rbac.authorization.k8s.io/cert-manager-view created
clusterrole.rbac.authorization.k8s.io/cert-manager-edit created
clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-issuers created
clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-clusterissuers created
clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-certificates created
clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-orders created
clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-challenges created
clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-ingress-shim created
role.rbac.authorization.k8s.io/cert-manager:leaderelection created
rolebinding.rbac.authorization.k8s.io/cert-manager:leaderelection created
service/cert-manager created
serviceaccount/cert-manager created
deployment.apps/cert-manager-webhook created
Warning: admissionregistration.k8s.io/v1beta1 MutatingWebhookConfiguration is deprecated in v1.16+, unavailable in v1.22+; use admissionregistration.k8s.io/v1 MutatingWebhookConfiguration
mutatingwebhookconfiguration.admissionregistration.k8s.io/cert-manager-webhook created
clusterrole.rbac.authorization.k8s.io/cert-manager-webhook:webhook-requester created
clusterrolebinding.rbac.authorization.k8s.io/cert-manager-webhook:auth-delegator created
rolebinding.rbac.authorization.k8s.io/cert-manager-webhook:webhook-authentication-reader created
service/cert-manager-webhook created
serviceaccount/cert-manager-webhook created
Warning: admissionregistration.k8s.io/v1beta1 ValidatingWebhookConfiguration is deprecated in v1.16+, unavailable in v1.22+; use admissionregistration.k8s.io/v1 ValidatingWebhookConfiguration
validatingwebhookconfiguration.admissionregistration.k8s.io/cert-manager-webhook created2.6.7 安装Rancher
kubectl create namespace cattle-system
kubectl -n cattle-system apply -R -f ./rancher报错内容输出
clusterrolebinding.rbac.authorization.k8s.io/rancher created
deployment.apps/rancher created
Warning: extensions/v1beta1 Ingress is deprecated in v1.14+, unavailable in v1.22+; use networking.k8s.io/v1 Ingress
ingress.extensions/rancher created
service/rancher created
serviceaccount/rancher created
Error from server (InternalError): error when creating "rancher/templates/issuer-rancher.yaml": Internal error occurred: failed calling webhook "webhook.cert-manager.io": Post "https://cert-manager-webhook.cert-manager.svc:443/mutate?timeout=30s": dial tcp 10.43.17.204:443: connect: connection refused