SINFERE sinfere

Install Rancher 2.0 HA by using self signed certificates (+ intermediate) and Layer 4 Loadbalancer (TCP)

Warning: the RKE install method is only supported up to v2.0.8!

This gist describes how to setup Rancher 2 HA, by using self signed certificates (with intermediate) and a Layer 4 Loadbalancer (TCP)

Requirements

Linux OS
OS Binaries

Generate self signed certificates for Rancher 2.x

Generate certificates

docker run -v $PWD/certs:/certs \
  -e SSL_SUBJECT=test.example.com \
  -e SSL_DNS=test.example.com,test2.example.com \
  -e SSL_IP=10.0.0.1 \
 superseb/omgwtfssl

Generate CA, intermediate CA and server certificate with DNS alt names using Terraform in Docker and launch Rancher

Generate CA, intermediate CA and server certificate

docker run --rm -v $PWD/testcerts:/tmp/certs/files -e TF_VAR_ip_addresses='["127.0.0.1"]' -e TF_VAR_dns_names='["yolo.seb.local"]' superseb/intermediate

Run Rancher

Assigning Static IP Addresses in WSL2

WSL2 uses Hyper-V for networking. The WSL2 network settings are ephemeral and configured on demand when any WSL2 instance is first started in a Windows session. The configuration is reset on each Windows restart and the IP addresses change each time. The Windows host creates a hidden switch named "WSL" and a network adapter named "WSL" (appears as "vEthernet (WSL)" in the "Network Connections" panel). The Ubuntu instance creates a corresponding network interface named "eth0".

Assigning static IP addresses to the network interfaces on the Windows host or the WSL2 Ubuntu instance enables support for the following scenarios:

Docker Hub 镜像加速器

国内从 Docker Hub 拉取镜像有时会遇到困难，此时可以配置镜像加速器。Docker 官方和国内很多云服务商都提供了国内加速器服务。

Dockerized 实践 https://github.com/y0ngb1n/dockerized

配置加速地址

Ubuntu 16.04+、Debian 8+、CentOS 7+

	#!/bin/bash

	veth_in_use=()
	veth_unused=()
	veth_all=()

	function veth_interface_for_container() {
	local pid=$(docker inspect -f '{{.State.Pid}}' "${1}")
	mkdir -p /var/run/netns
	ln -sf /proc/$pid/ns/net "/var/run/netns/${1}"

	# This file contains only partial paths to match on
	# This file should reside in the same directory as the haproxy.cfg simply due to the way it is configured in the sample snippet-but they can go anywhere in the /etc/haproxy directory
	/my-partial- https://subdomain3.mydomain.com/my-new-full-path