Docker 安装 rancher 2.11.0 的CA问题

[Sam]

安装方式：docker run -d -p 8055:80 -p 8443:443 --restart=unless-stopped -v /data/rancher:/var/lib/rancher -v /data/rancher/auditlog:/var/log/auditlog --name rancher --privileged=true registry.cn-hangzhou.aliyuncs.com/rancher/rancher:v2.11.0

导入方式：

k8s 为华为云CCE集群

agent报错：INFO: Value from https://rancher.xxx.work/v3/settings/cacerts is an x509 certificate
time=“2025-04-22T06:43:33Z” level=info msg=“Listening on /tmp/log.sock”
time=“2025-04-22T06:43:33Z” level=info msg=“Rancher agent version v2.11.0 is starting”
time=“2025-04-22T06:43:33Z” level=info msg=“Testing connection to https://rancher.xxx.work using trusted certificate authorities within: /etc/kubernetes/ssl/certs/serverca”
time=“2025-04-22T06:43:33Z” level=error msg=“Could not securely connect to https://rancher.xxx.work: Get "https://rancher.xxx.work": tls: failed to verify certificate: x509: certificate signed by unknown authority”

我的证书是正常的证书，阿里采购的通配符证书

[ksd]

你 docker run 启动的 rancher 也没挂载证书啊

[Sam]

这个是挂载ssl的证书还是k8s 的tls证书

[ksd]

参考官网文档：https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker

[Sam]

我的docker 命令不对吗

[ksd]

都报错了，那肯定就是不对呗…… 一点上下文都没有……

[Sam]

我只是在启动docker您需要什么上下文，这就是我的第一步

[Sam]

–volumes-from rancher-data 这个参数不加的话还是报CA的错误，加上就报这个错误了

[Sam]

我用的这个是对的吗

[ksd]

我给你发的链接里，有 –volumes-from rancher-data 这个参数？？？

[ksd]

对

[Sam]

是没有的，我用您哪个链接的命令启动后agent还是报 CA的问题：time=“2025-04-22T09:18:40Z” level=info msg=“Rancher agent version v2.11.0 is starting”
time=“2025-04-22T09:18:40Z” level=info msg=“Listening on /tmp/log.sock”
time=“2025-04-22T09:18:40Z” level=error msg=“unable to read CA file from /etc/kubernetes/ssl/certs/serverca: open /etc/kubernetes/ssl/certs/serverca: no such file or directory”
time=“2025-04-22T09:18:40Z” level=error msg=“Strict CA verification is enabled but encountered error finding root CA”

[Sam]

所以我找了下中文文档，那里面提示有这个，我试了下

[ksd]

你把你的详细的操作步骤列一下，我看看能不能重现

[Sam]

1，启动docker
docker run -d -p 8056:80 -p 9443:443 --volumes-from rancher-data --restart=unless-stopped -v /data/rancher1:/var/lib/rancher -v /data/rancher1/auditlog:/var/log/auditlog -v /data/ssl/cf_work.pem:/etc/rancher/ssl/cert.pem -v /data/ssl/cf_work_key.pem:/etc/rancher/ssl/key.pem --name rancher1 --privileged=true registry.cn-hangzhou.aliyuncs.com/rancher/rancher:v2.11.0 --no-cacerts

2，改密码并导入k8s 集群

3，查看agent状态出现异常

agent报错：time=“2025-04-23T02:07:42Z” level=info msg=“Listening on /tmp/log.sock”
time=“2025-04-23T02:07:42Z” level=info msg=“Rancher agent version v2.11.0 is starting”
time=“2025-04-23T02:07:42Z” level=error msg=“unable to read CA file from /etc/kubernetes/ssl/certs/serverca: open /etc/kubernetes/ssl/certs/serverca: no such file or directory”
time=“2025-04-23T02:07:42Z” level=error msg=“Strict CA verification is enabled but encountered error finding root CA”

4，集群状态

[ksd]

然撤按照这样设置，然后重新导入试一下

[Sam]

可以了，这个模式有啥区别吗

[ksd]

参考：TLS Settings | Rancher

[Sam]

好的，感谢