Setting up Rancher Server on a High Available RKE2 cluster.

Jeason Joseph

6 min read

·

Dec 31, 2024

--

Listen

Share

Press enter or click to view image in full size

This article is a guide for setting up Rancher Server on RKE2 with SLES/LEAP 15.6 OS in a lab environment.

We will be using an entire SUSE Stack which includes the following.

1. Operating System : We will be using the OpenSuse Leap 15.6 as the OS with iptables installed. For enterprise support explore SLES 15.6. Not covered in this article as it is simple and straight forward.
2. K8s distribution : We will install RKE2 (v1.31.4) for the Kubernetes cluster.
3. Rancher server : Deploy Rancher server (v2.10.1) using the helm chart.

Architecture

If you are installing Rancher on a single node, the main architecture recommendation that applies to your installation is that the node running Rancher should be separate from downstream clusters.

Press enter or click to view image in full size

• We have deployed 3 Virtual Machines(VM) for Running RKE2 in HA and 1 additional VM running the Nginx Load balancer

Press enter or click to view image in full size

• DNS : For the lab setup we have added the IP and hostname entry in the /etc/hosts file of each of the VMs. Recommended to setup DNS.
• Firewalld : This is a lab setup so it is disabled

Stage 1 : Pre-requisites

• RKE2 can be deployed on the major linux distros but for this setup we will uses OpenSuse Leap 15.6 built using the source from SUSE Linux Enterprise (SLE)
• Install the iptables package if not already present

zypper in iptables

• Install Nginx on the Load Balancer server.

zypper in nginx

• Will access the k8s cluster from the 1st node. Installing helm on rke2s1.

zypper in helm

Stage 2: RKE2 Setup

• The RKE2 server needs port 6443 and 9345 to be accessible by other nodes in the cluster. Requirements

Step 1: Load Balancer

1. Will use Nginx load balancer to provide fixed registration as per the RKE2 guidelines

2. Backup the default /etc/nginx/nginx.conf and modify as below

#Do Not copy paste, rather set appropriate value. This is just a sample.
#change rke2s1_ip,rke2s2_ip and rke2s3_ip with corresponding IP address.

load_module '/usr/lib64/nginx/modules/ngx_stream_module.so';

worker_processes 4;
worker_rlimit_nofile 40000;

events {
    worker_connections 8192;
}

stream {
    upstream supervisor_stream {
        server rke2s1_ip:9345 max_fails=3 fail_timeout=5s;
        server rke2s2_ip:9345 max_fails=3 fail_timeout=5s;
        server rke2s3_ip:9345 max_fails=3 fail_timeout=5s;
    }

    upstream k8s_api_stream {
        server rke2s1_ip:6443 max_fails=3 fail_timeout=5s;
        server rke2s2_ip:6443 max_fails=3 fail_timeout=5s;
        server rke2s3_ip:6443 max_fails=3 fail_timeout=5s;
    }

    server {
        listen 9345;
        proxy_pass supervisor_stream;
    }

    server {
        listen 6443;
        proxy_pass k8s_api_stream;
    }

#The Below settings are for Rancher server
    upstream rancher_servers_http {
        least_conn;
        server rke2s1_ip:80 max_fails=3 fail_timeout=5s;
        server rke2s1_ip:80 max_fails=3 fail_timeout=5s;
        server rke2s1_ip:80 max_fails=3 fail_timeout=5s;
    }

    server {
        listen 80;
        proxy_pass rancher_servers_http;
    }

    upstream rancher_servers_https {
        least_conn;
        server rke2s1_ip:443 max_fails=3 fail_timeout=5s;
        server rke2s2_ip:443 max_fails=3 fail_timeout=5s;
        server rke2s3_ip:443 max_fails=3 fail_timeout=5s;
    }

    server {
        listen 443;
        proxy_pass rancher_servers_https;
    }
}

Step 2 : 1st RKE2 server node

The below steps are run on 1st server rke2s1

1- Create the folder

mkdir /etc/rancher/rke2/

2- Create the config file at /etc/rancher/rke2/config.yaml

#Do Not copy paste, rather set appropriate value. This is just a sample.
tls-san:
  - rancher.dom.com
  - rke2s1.dom.com
  - rke2s2.dom.com
  - rke2s3.dom.com

3- Run the installer

curl -sfL https://get.rke2.io | sh -

4- Enable and start the service

systemctl enable --now rke2-server

5- Check the logs

journalctl -u rke2-server -f

6- Check the cluster status. You should see your server nodes in the Ready state.

/var/lib/rancher/rke2/bin/kubectl get nodes \
  --kubeconfig /etc/rancher/rke2/rke2.yaml 

7- Export the kubectl path and kubeconfig variables ( homework )

8- Get the token from the path /var/lib/rancher/rke2/server/node-token

Step 3: Setup additional RKE2 server nodes

The below steps are run on server rke2s2 and rke2s3

1- Create the folder

mkdir /etc/rancher/rke2/

2- Create the config file at /etc/rancher/rke2/config.yaml . Token is from step 2 and action number 8.

#Do Not copy paste, rather set appropriate value. This is just a sample.
server: https://rancher.dom.com:9345    
token: ohmygoodnessthisisaverylongtokengeneratedautomatically
tls-san:
  - rancher.dom.com
  - rke2s1.dom.com
  - rke2s2.dom.com
  - rke2s3.dom.com

3- Run the installer

curl -sfL https://get.rke2.io | sh -

4- Enable and start the service

systemctl enable --now rke2-server

5- Check the logs

journalctl -u rke2-server -f

6- Check the cluster status is functional. You should see your server nodes in the Ready state.

/var/lib/rancher/rke2/bin/kubectl get nodes \
  --kubeconfig /etc/rancher/rke2/rke2.yaml

Press enter or click to view image in full size

7- The same steps need to be repeated on additional server nodes.

Stage 2: Rancher deployment (Finally !)

The Nginx config is already configured as per the recommendation. Kindly use appropriate Load Balancer and config in Production Environment

1- Add the Helm Chart Repository. For the lab setup, alpha or latest helm chart repos can also be used. We will use the stable repo.

helm repo add rancher-stable https://releases.rancher.com/server-charts/stable

2- Create a Namespace for Rancher

kubectl create namespace cattle-system

3- Choose your SSL Configuration. We will proceed with Rancher-generated TLS certificate. For other options check here.

4- Install cert-manager. This is needed with Rancher-generated TLS certificate.

helm repo add jetstack https://charts.jetstack.io --force-update

helm install cert-manager jetstack/cert-manager --version v1.16.2 \
  --namespace cert-manager \
  --create-namespace \
  --set crds.enabled=true

Check the official documentation for the latest versions and steps.

Press enter or click to view image in full size

5- Install Rancher with Helm

#Change the hostname as needed.
helm install rancher rancher-latest/rancher \
  --namespace cattle-system \
  --set hostname=rancher.dom.com \
  --set bootstrapPassword=admin  

When the command finishes it will give a link to the url from which the password for the user can be set.

NAME: rancher
LAST DEPLOYED: Thu Jan  2 18:22:17 2025
NAMESPACE: cattle-system
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
Rancher Server has been installed.

NOTE: Rancher may take several minutes to fully initialize. Please standby while Certificates are being issued, Containers are started and the Ingress rule comes up.

Check out our docs at https://rancher.com/docs/

If you provided your own bootstrap password during installation, browse to https://rancher.dom.com to get started.

If this is the first time you installed Rancher, get started by running this command and clicking the URL it generates:

```
echo https://rancher.dom.com/dashboard/?setup=$(kubectl get secret --namespace cattle-system bootstrap-secret -o go-template='{{.data.bootstrapPassword|base64decode}}')
```

To get just the bootstrap password on its own, run:

```
kubectl get secret --namespace cattle-system bootstrap-secret -o go-template='{{.data.bootstrapPassword|base64decode}}{{ "\n" }}'

6- Verify that the Rancher Server is Successfully Deployed

kubectl -n cattle-system rollout status deploy/rancher

Waiting for deployment "rancher" rollout to finish: 0 of 3 updated replicas are available...
deployment "rancher" successfully rolled out

kubectl -n cattle-system get deploy rancher

NAME      DESIRED   CURRENT   UP-TO-DATE   AVAILABLE   AGE
rancher   3         3         3            3           3m

7- Access the Rancher URL

Press enter or click to view image in full size

Press enter or click to view image in full size

References