飞天使-k8s知识点31-rancher的正确打开方式

飞天使star

已于 2024-05-20 15:58:53 修改

阅读量783

点赞数 13

CC 4.0 BY-SA版权

文章标签： kubernetes rancher 容器

于 2024-05-09 17:05:36 首次发布

本文链接：https://blog.csdn.net/startfefesfe/article/details/138621392

文章目录

安装之前优化一下内核参数以及系统内核版本

内核版本 4.17+ 
cat > /etc/modules-load.d/iptables.conf <<EOF
ip_tables
iptable_filter
EOF
然后重启服务器
mkdir -p /data/rancher_data

rancher安装主要是使用以下命令

docker run -d \
--name rancher-2.7.5 \
--restart=always \
--privileged \
-p 8081:80 \
-p 8082:443 \
-v /data/rancher_data:/var/lib/rancher \
-v /data/rancher_data/kubelet:/var/lib/kubelet \
rancher/rancher:v2.7.5

nginx的配置为

upstream rancher-rancher {
  #server 127.0.0.1:8081;
  server 127.0.0.1:8082;
}
server {
    listen       80;
    server_name  rancher.abc.com;

    rewrite ^/(.*)$ https://$host/$1;
}


server {
    listen       443 ssl;
    server_name  rancher.abc.com;
  ssl_certificate  /server//abc.crt;
  ssl_certificate_key /server/abc.com.key;
    ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    location / {
        proxy_pass   https://rancher-rancher;
        proxy_set_header Host $host;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        add_header 'Access-Control-Allow-Origin' '*';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, PUT, DELETE';
        add_header 'Access-Control-Allow-Credentials' 'true';
        if ( $request_method = 'OPTIONS' ) {
            return 200;
        }
    }
}

会有报错

E0509 08:52:25.505821      33 upgradeaware.go:365] Proxy upgrade error: invalid upgrade response: status code 201
2024/05/09 08:52:31 [ERROR] Error during subscribe websocket: close sent
E0509 08:53:25.616709      33 upgradeaware.go:365] Proxy upgrade error: invalid upgrade response: status code 201
E0509 08:53:47.300960      33 upgradeaware.go:365] Proxy upgrade error: invalid upgrade response: status code 200
E0509 08:54:05.214105      33 upgradeaware.go:365] Proxy upgrade error: invalid upgrade response: status code 200
E0509 08:54:13.474111      33 upgradeaware.go:365] Proxy upgrade error: invalid upgrade response: status code 200
E0509 08:54:25.689266      33 upgradeaware.go:365] Proxy upgrade error: invalid upgrade response: status code 201
E0509 08:55:25.764830      33 upgradeaware.go:365] Proxy upgrade error: invalid upgrade response: status code 201

解决办法

upstream rancher-rancher-http {
  server 127.0.0.1:8081;
}
upstream rancher-rancher-https {
  server 127.0.0.1:8082;
}

map $http_upgrade $connection_upgrade {
    default Upgrade;
    ''      close;
}

server {
    listen       80;
    server_name  rancher.test.com;
   rewrite ^/(.*)$ https://$host/$1;
}


server {
    listen       443 ssl;
    server_name  rancher.test.com;
  ssl_certificate  /server/key/test.com/test.com.crt;
  ssl_certificate_key /server/key/test.com/test.com.key;
    ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    location / {
        proxy_pass   https://rancher-rancher-https;
        if ( $request_method = 'OPTIONS' ) {
            return 200;
        }
       proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        # This allows the ability for the execute shell window to remain open for up to 15 minutes. Without this parameter, the default is 1 minute and will automatically close.
        proxy_read_timeout 900s;
    }
}

参考资料：https://stackoverflow.com/questions/66375380/kubectl-proxy-behind-nginx-invalid-upgrade-response
在这里插入图片描述