jonas/tlu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

.

Browse Source
This commit is contained in:
jonas 2021-11-08 20:45:20 +01:00
parent 3ff432d92e
commit afe2541e29
5 changed files with 18 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
salt/pillars/rancher.sls
View File

@ -1,5 +1,5 @@
rancher: rancher:
ca_passphrase: rancher ca_passphrase: rancher
url: docker.io/rancher/rancher url: docker.io/rancher/rancher
tag: v2.6.1 tag: v2.6.2
bootstrapPassword: rancher bootstrapPassword: rancher

2
salt/states/rancher/certs.sls
View File

@ -58,7 +58,7 @@ Set permission on rancher-server singing request:
Create the rancher-server certificate: Create the rancher-server certificate:
cmd.run: cmd.run:
- name: openssl x509 -req -in rancher-server.csr -CA rancher-ca.crt -CAkey rancher-ca.key -CAcreateserial -out rancher-server.crt -days 3650 -sha256 -passin pass:{{ pillar['rancher']['ca_passphrase'] }} - name: openssl x509 -req -in rancher-server.csr -CA rancher-ca.crt -CAkey rancher-ca.key -CAcreateserial --extfile rancher-server.cnf -extensions v3_req -out rancher-server.crt -days 3650 -sha256 -passin pass:{{ pillar['rancher']['ca_passphrase'] }}
- cwd: /etc/rancher/ssl - cwd: /etc/rancher/ssl
- onchanges: - onchanges:
- cmd: Create the rancher-server signing request - cmd: Create the rancher-server signing request

17
salt/states/rancher/files/rancher-proxy.conf.jinja
View File

@ -1,16 +1,25 @@
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
server { server {
listen 443; listen 443;
server_name rancher.{{ pillar['network']['domain'] }}; server_name rancher.{{ pillar['network']['domain'] }};
ssl_certificate /etc/rancher/ssl/rancher-server.crt; ssl_certificate /etc/rancher/ssl/rancher-server.crt;
ssl_certificate_key /etc/rancher/ssl/rancher-server.key; ssl_certificate_key /etc/rancher/ssl/rancher-server.key;
location /{ location /{
proxy_pass https://localhost:6443; proxy_pass https://localhost:9443;
proxy_ssl_trusted_certificate /etc/rancher/ssl/rancher-server.crt; proxy_ssl_trusted_certificate /etc/rancher/ssl/rancher-server.crt;
proxy_ssl_verify off;
proxy_set_header Host $host:$server_port;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade; proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade"; proxy_set_header Connection $connection_upgrade;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Port $server_port;
} }
} }

4
salt/states/rancher/files/rancher-server.cnf.jinja
View File

@ -25,5 +25,5 @@ subjectAltName = @alt_names
CN = rancher.{{ pillar['network']['domain'] }} CN = rancher.{{ pillar['network']['domain'] }}
[alt_names] [alt_names]
DNS.0 = rancher.{{ pillar['network']['domain'] }} DNS.1 = rancher.{{ pillar['network']['domain'] }}
IP.0 = {{ pillar['network']['ip'] }} IP.1 = {{ pillar['network']['ip'] }}

2
salt/states/rancher/server.sls
View File

@ -40,7 +40,7 @@ Remove old rancher container:
Create rancher container: Create rancher container:
cmd.run: cmd.run:
- name: podman container create --name rancher --privileged --publish 6080:80 --publish 6443:443 --volume /etc/rancher/ssl/rancher-server.crt:/etc/rancher/ssl/cert.pem --volume /etc/rancher/ssl/rancher-server.key:/etc/rancher/ssl/key.pem --volume /etc/rancher/ssl/rancher-ca.crt:/etc/rancher/ssl/cacerts.pem --volume /srv/rancher-container:/var/lib/rancher --env CATTLE_BOOTSTRAP_PASSWORD={{ pillar['rancher']['bootstrapPassword'] }} {{ pillar['rancher']['url'] }}:{{ pillar['rancher']['tag'] }} - name: podman container create --name rancher --privileged --publish 9080:80 --publish 9443:443 --volume /etc/rancher/ssl/rancher-server.crt:/etc/rancher/ssl/cert.pem --volume /etc/rancher/ssl/rancher-server.key:/etc/rancher/ssl/key.pem --volume /etc/rancher/ssl/rancher-ca.crt:/etc/rancher/ssl/cacerts.pem --volume /srv/rancher-container:/var/lib/rancher --env CATTLE_BOOTSTRAP_PASSWORD={{ pillar['rancher']['bootstrapPassword'] }} {{ pillar['rancher']['url'] }}:{{ pillar['rancher']['tag'] }}
- unless: podman container exists rancher - unless: podman container exists rancher
Start the rancher container: Start the rancher container: