飞天使-k8s知识点31-rancher的正确打开方式

安装之前优化一下内核参数以及系统内核版本

内核版本 4.17+ 
cat > /etc/modules-load.d/iptables.conf <<EOF
ip_tables
iptable_filter
EOF
然后重启服务器
mkdir -p /data/rancher_data
1
2
3
4
5
6
7

rancher安装主要是使用以下命令

docker run -d \
--name rancher-2.7.5 \
--restart=always \
--privileged \
-p 8081:80 \
-p 8082:443 \
-v /data/rancher_data:/var/lib/rancher \
-v /data/rancher_data/kubelet:/var/lib/kubelet \
rancher/rancher:v2.7.5
1
2
3
4
5
6
7
8
9

nginx的配置为

upstream rancher-rancher {
  #server 127.0.0.1:8081;
  server 127.0.0.1:8082;
}
server {
    listen       80;
    server_name  rancher.abc.com;

    rewrite ^/(.*)$ https://$host/$1;
}


server {
    listen       443 ssl;
    server_name  rancher.abc.com;
  ssl_certificate  /server//abc.crt;
  ssl_certificate_key /server/abc.com.key;
    ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    location / {
        proxy_pass   https://rancher-rancher;
        proxy_set_header Host $host;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        add_header 'Access-Control-Allow-Origin' '*';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, PUT, DELETE';
        add_header 'Access-Control-Allow-Credentials' 'true';
        if ( $request_method = 'OPTIONS' ) {
            return 200;
        }
    }
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

会有报错

E0509 08:52:25.505821      33 upgradeaware.go:365] Proxy upgrade error: invalid upgrade response: status code 201
2024/05/09 08:52:31 [ERROR] Error during subscribe websocket: close sent
E0509 08:53:25.616709      33 upgradeaware.go:365] Proxy upgrade error: invalid upgrade response: status code 201
E0509 08:53:47.300960      33 upgradeaware.go:365] Proxy upgrade error: invalid upgrade response: status code 200
E0509 08:54:05.214105      33 upgradeaware.go:365] Proxy upgrade error: invalid upgrade response: status code 200
E0509 08:54:13.474111      33 upgradeaware.go:365] Proxy upgrade error: invalid upgrade response: status code 200
E0509 08:54:25.689266      33 upgradeaware.go:365] Proxy upgrade error: invalid upgrade response: status code 201
E0509 08:55:25.764830      33 upgradeaware.go:365] Proxy upgrade error: invalid upgrade response: status code 201
1
2
3
4
5
6
7
8

解决办法

upstream rancher-rancher {
  #server 127.0.0.1:8081;
  server 127.0.0.1:8082;
}
server {
    listen       80;
    server_name  rancher.abc.com;

    rewrite ^/(.*)$ https://$host/$1;
}


server {
    listen       443 ssl;
    server_name  rancher.abc.com;
  ssl_certificate  /server/abc.com.crt;
  ssl_certificate_key /server/abc.com.key;
    ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    location / {
        proxy_pass   https://rancher-rancher;
        proxy_set_header Host $host;
        if ( $request_method = 'OPTIONS' ) {
            return 200;
        }
    }
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

参考资料：https://stackoverflow.com/questions/66375380/kubectl-proxy-behind-nginx-invalid-upgrade-response