【工作相关】替换Rancher证书

• 登录到Rnacher Server 和Master Server 中，备份 SSL 

 

[~]$ ssh -p xx xx~$ sudo -s -H
~$ cp –r /etc/kubernetes/ssl  /home/ubuntu/ssl-prod-backup-mar-20
 
[~]$ ssh -p xx xxxxx:~$ sudo -s -H
xx:~$ cp –r /etc/kubernetes/ssl  /home/ubuntu/ssl-prod-backup-mar-20
 
[~]$ ssh -p xx xxxxx:~$ sudo -s -H
xx:~$ cp –r /etc/kubernetes/ssl  /home/ubuntu/ssl-prod-backup-mar-20
 
[~]$ ssh -p xx xxxxx:~$ sudo -s -H
xx:~$ cp –r /etc/kubernetes/ssl  /home/ubuntu/ssl-prod-backup-mar-20
 
[~]$ ssh -p xx xxxxx:~$ sudo -s -H
xx:~$ cp –r /etc/kubernetes/ssl  /home/ubuntu/ssl-prod-backup-mar-20
 
[~]$ ssh -p xx xxxxxx:~$ sudo -s -H
xx:~$ cp –r /etc/kubernetes/ssl  /home/ubuntu/ssl-prod-backup-mar-20

 

• 升级Rancher
  • 登录到Rancher Trigger Server，下载rke 1.0.9 版本

    [~]$ ssh -p xx xxxxx:~$ sudo -s -H
    :~$ wget https://github.com/rancher/rke/releases/download/v1.0.4/rke_linux-amd64
    :~$ chmod +x rke_linux-amd64
    :~$ mv rke_linux-amd64 rke_linux-amd64-1.0.4

  • Rotate the rancher server certificates

    @xx:~$ ./rke_linux-amd64-1.0.4 cert rotate --config rancher-cluster.yml

  • Once the rotation is successful check if the rancher certificates are updated using openssl command in one of the rancher server.

    @xx:~$ openssl x509 -text -n kube-apiserver-requestheader-ca.pem | grep -A 2 Validity
    @xx:~$ curl https://localhost:6443 -v -k 
     
    @xx:~$ openssl x509 -text -n kube-apiserver-requestheader-ca.pem | grep -A 2 Validity
    @xx:~$ curl https://localhost:6443 -v -k 
     
    @xx:~$ openssl x509 -text -n kube-apiserver-requestheader-ca.pem | grep -A 2 Validity
    @xx:~$ curl https://localhost:6443 -v -k 

  • Upgrade rancher to 2.2.8. using the below command

    xx:~$ helm upgrade rancher rancher-stable/rancher  --version 2.2.8 --namespace cattle-system --set hostname=rancher.xx.com

  • Go to rancher UI and check if the version is updated to 2.2.8 on the bottom of the UI as shown below. 
  • 

     

     

     

     Once the rotation is successful and the cluster turns active check all the servers and validate the applications.