rancher添加外部k8s集群

自签证书

(umask 077;openssl genrsa -out rancher.wuxingge.com.key 2048)
openssl req -new -key rancher.wuxingge.com.key -out rancher.wuxingge.com.csr -subj "/CN=10.10.111.201"
echo subjectAltName = IP:10.10.111.201 > extfile.cnf
openssl x509 -req -in rancher.wuxingge.com.csr -CA ca.crt -CAkey ca.key -CAcreateserial -extfile extfile.cnf -out rancher.wuxingge.com.crt -days 36500

部署rancher（自签证书、数据持久化）

docker run -d --privileged --restart=unless-stopped --name rancher \
    -p 80:80 -p 443:443 \
	-v /opt/rancher:/var/lib/rancher \
    -v /opt/ssl/rancher.wuxingge.com.crt:/etc/rancher/ssl/cert.pem \
    -v /opt/ssl/rancher.wuxingge.com.key:/etc/rancher/ssl/key.pem \
    -v /opt/ssl/ca.crt:/etc/rancher/ssl/cacerts.pem \
    registry.cn-hangzhou.aliyuncs.com/wuxingge/rancher:2.5.9

docker-compose部署rancher
vim docker-compose.yaml

version: '3.8'
services:
  rancher:
    container_name: rancher
    image: registry.cn-hangzhou.aliyuncs.com/wuxingge123/rancher:v2.9.3
    restart: unless-stopped
    volumes:
      - /opt/rancher:/var/lib/rancher
      - /opt/ssl/rancher.cs.crtccs.crt:/etc/rancher/ssl/cert.pem
      - /opt/ssl/rancher.cs.crtccs.key:/etc/rancher/ssl/key.pem
      - /opt/ssl/ca.crt:/etc/rancher/ssl/cacerts.pem
    ports:
      - "80:80"
      - "443:443"
    privileged: true

http访问rancher，设置admin用户密码

rancher添加外部kubernetes集群
根据提示执行以下命令

kubectl create clusterrolebinding cluster-admin-binding --clusterrole cluster-admin --user kubernetes-admin


curl --insecure -sfL https://10.10.111.201/v3/import/txdnrbk2lkj2cpvjws2dt2vccflhftwb8lpvhmp5cq62t4fzmfnxgw_c-dvqdd.yaml | kubectl apply -f -