Rancher Server 设置
- Rancher 版本：v2.5.14
- 安装选项 (Docker install/Helm Chart): Helm Chart
- 如果是 Helm Chart 安装，需要提供 Local 集群的类型（RKE1, RKE2, k3s, EKS, 等）和版本：k3s
- 在线或离线部署：离线
下游集群信息
- Kubernetes 版本: 1.20
- Cluster Type (Local/Downstream): Downstream
- 如果 Downstream，是什么类型的集群?(自定义/导入或为托管 等): 自定义
用户信息
- 登录用户的角色是什么？ （管理员/集群所有者/集群成员/项目所有者/项目成员/自定义）：
- 如果自定义，自定义权限集：
主机操作系统： CentOS 7
问题描述： 按照官网基于 k3s 离线安装 Rancher Server，使用一键自签名脚本生成 tls.crt 和 tls.key 并导入 k3s 集群中，安装成功。
然后添加自定义集群，在下游集群节点上执行命令，rancher-agent 报错，无法添加集群。
难道是生成自签名脚本时，需要把下游集群节点 ip 也配进去吗？
重现步骤：
-
主机分配：172.33.149.32/33 为 k3s 节点；172.33.149.34/35 为下游集群节点。
-
一键生成自签名脚本得到 tls.crt 和 tls.key
./create_self-signed-cert.sh \
--ssl-domain=xxyf.rancher.com \
--ssl-trusted-ip=172.33.149.32,172.33.149.33 \
--ssl-trusted-domain=xxyf.rancher.com \
--ssl-size=2048 \
--ssl-date=3650
- 导入 k3s 集群
kubectl create namespace cattle-system
kubectl -n cattle-system create secret tls tls-rancher-ingress --cert=/root/tls/tls.crt --key=/root/tls/tls.key
-
按照文档步骤安装 Rancher Server，一切正常。
-
添加自定义集群，选择全部角色，复制命令，在 172.33.149.34 节点上执行命令。
结果：
报错 x509: certificate signed by unknown authority，详见日志。
预期结果：
正确添加自定义集群节点。
截图：
其他上下文信息：
日志
INFO: Arguments: --server https://xxyf.rancher.com --token REDACTED --etcd --controlplane --worker
INFO: Environment: CATTLE_ADDRESS=172.33.149.34 CATTLE_INTERNAL_ADDRESS= CATTLE_NODE_NAME=server149034 CATTLE_ROLE=,etcd,worker,controlplane CATTLE_SERVER=https://xxyf.rancher.com CATTLE_TOKEN=REDACTED
INFO: Using resolv.conf: nameserver 114.114.114.114
INFO: https://xxyf.rancher.com/ping is accessible
INFO: xxyf.rancher.com resolves to 172.33.149.32
time="2022-07-27T23:34:26Z" level=info msg="Listening on /tmp/log.sock"
time="2022-07-27T23:34:26Z" level=info msg="Rancher agent version 52a8de7b6-dirty is starting"
time="2022-07-27T23:34:26Z" level=info msg="Option requestedHostname=server149034"
time="2022-07-27T23:34:26Z" level=info msg="Option customConfig=map[address:172.33.149.34 internalAddress: label:map[] roles:[etcd worker controlplane] taints:[]]"
time="2022-07-27T23:34:26Z" level=info msg="Option etcd=true"
time="2022-07-27T23:34:26Z" level=info msg="Option controlPlane=true"
time="2022-07-27T23:34:26Z" level=info msg="Option worker=true"
time="2022-07-27T23:34:26Z" level=info msg="Certificate details from https://xxyf.rancher.com"
time="2022-07-27T23:34:26Z" level=info msg="Certificate #0 (https://xxyf.rancher.com)"
time="2022-07-27T23:34:26Z" level=info msg="Subject: CN=xxyf.rancher.com,C=CN"
time="2022-07-27T23:34:26Z" level=info msg="Issuer: CN=cattle-ca,C=CN"
time="2022-07-27T23:34:26Z" level=info msg="IsCA: false"
time="2022-07-27T23:34:26Z" level=info msg="DNS Names: [xxyf.rancher.com xxyf.rancher.com]"
time="2022-07-27T23:34:26Z" level=info msg="IPAddresses: [172.33.149.32 172.33.149.33]"
time="2022-07-27T23:34:26Z" level=info msg="NotBefore: 2022-07-26 04:52:29 +0000 UTC"
time="2022-07-27T23:34:26Z" level=info msg="NotAfter: 2032-07-23 04:52:29 +0000 UTC"
time="2022-07-27T23:34:26Z" level=info msg="SignatureAlgorithm: SHA256-RSA"
time="2022-07-27T23:34:26Z" level=info msg="PublicKeyAlgorithm: RSA"
time="2022-07-27T23:34:26Z" level=info msg="Certificate #1 (https://xxyf.rancher.com)"
time="2022-07-27T23:34:26Z" level=info msg="Subject: CN=cattle-ca,C=CN"
time="2022-07-27T23:34:26Z" level=info msg="Issuer: CN=cattle-ca,C=CN"
time="2022-07-27T23:34:26Z" level=info msg="IsCA: true"
time="2022-07-27T23:34:26Z" level=info msg="DNS Names: <none>"
time="2022-07-27T23:34:26Z" level=info msg="IPAddresses: <none>"
time="2022-07-27T23:34:26Z" level=info msg="NotBefore: 2022-07-26 04:52:29 +0000 UTC"
time="2022-07-27T23:34:26Z" level=info msg="NotAfter: 2032-07-23 04:52:29 +0000 UTC"
time="2022-07-27T23:34:26Z" level=info msg="SignatureAlgorithm: SHA256-RSA"
time="2022-07-27T23:34:26Z" level=info msg="PublicKeyAlgorithm: RSA"
time="2022-07-27T23:34:26Z" level=fatal msg="Certificate chain is not complete,
please check if all needed intermediate certificates are included in the server certificate (in the correct order)
and if the cacerts setting in Rancher either contains the correct CA certificate (in the case of using self signed certificates)
or is empty (in the case of using a certificate signed by a recognized CA). Certificate information is displayed above.
error: Get \"https://xxyf.rancher.com\": x509: certificate signed by unknown authority"
