# rancher安装手册

#### rancher与K8S的对应关系

rancher与k8s之间有版本匹配关系，对于v1.20.15版本以下的k8s，可以支持的rancher版本为v2.5.17,对于更新版本的k8s支持版本为v2.7.9，请及时根据自己的K8S版本，升级到最稳定版本。

rancher与k8s的版本对应：<https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/rancher-v2-10-10/>


rancher发布页：<https://github.com/rancher/rancher/releases>

rancher官方帮助：<https://ranchermanager.docs.rancher.com/zh/>

**2024年11月21日：当前最新文档版本，v2.8.5**

#### docker-copose.yaml

```yaml
version: "3"
services:
  rancher-2.0:
    image: rancher/rancher:v2.8.5
    container_name: rancher-rancher
    restart: always
    privileged: true
#    ports:
#      - 8000:443
    volumes:
      - ./data:/var/lib/rancher/
#      - ./registries.yaml:/etc/rancher/k3s/registries.yaml
      - ./auditlog:/var/log/auditlog
    environment:
      - AUDIT_LEVEL=1
      - CATTLE_SYSTEM_DEFAULT_REGISTRY=harbor.iovhm.com/hub
      - CATTLE_AGENT_IMAGE=harbor.iovhm.com/hub/rancher/rancher-agent:v2.8.5
#      - HTTP_PROXY=socks5://192.168.0.10:1080
#      - HTTPS_PROXY=socks5://192.168.0.10:1080
#      - NO_PROXY=localhost,127.0.0.1,0.0.0.0,10.0.0.0/8,cattle-system.svc,.svc,.cluster.local,10.101.25.0/24,.cn


  rancher-nginx:
    image: harbor.iovhm.com/hub/nginx:latest
    restart: always  # 自动重启
    privileged: true
    ports:
      - 8000:443
    volumes:
      - ./nginx/default.conf:/etc/nginx/conf.d/default.conf
      - ./nginx/ssl:/home/ssl/
    environment:
      - TZ=Asia/Shanghai
    depends_on:
      - rancher-2.0  

```
- nginx.conf
```

server {
    listen 8000 ssl;
    server_name localhost;

    ssl_certificate /home/ssl/server.crt;
    ssl_certificate_key /home/ssl/server.key;

    client_max_body_size 0;

    location / {
        proxy_pass https://192.168.102.29:8000;
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-Proto https;
        proxy_ssl_verify off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }
}

server {
    listen 443 ssl default_server;
    server_name _;  # 代表无效域名，专门用来兜底

    # 随便给个假证书，防止报错
    ssl_certificate     /home/ssl/server.crt; 
    ssl_certificate_key /home/ssl/server.key;

    # 直接返回 403 禁止访问（或者用 return 444; 直接断开连接）
    return 403; 
}


```

#### 使用https证书

参考网址 <https://ranchermanager.docs.rancher.com/zh/getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker>

```
# 准备证书文件

# ./ssl/cacerts.pem
# ./ssl/cert.pem
# ./ssl/key.pem

# 挂载

    volumes:
      - ./ssl:/etc/rancher/ssl



```