# RKE2 Cluster offline installation with rhel9.2 and SELinux ## 1. Firewall list disable firewalld first. REF: https://docs.rke2.io/install/requirements ## .設定固定IP ```shell! 1. 確認可用網路介面：nmcli connection 2. 透過nmcli設定網卡：nmcli connection modify ens33 ipv4.addresses 192.168.1.210/24 ipv4.gateway 192.168.1.254 ipv4.dns 192.168.1.X ipv4.method manual 3. 確認映像檔倉庫可以可偵測到（e.g. harbor）：ping harbor.example.com ``` ## 安裝RKE2 :::info 1. 從harbor copy rke2資料夾全部檔案至相關節點。 2. 不要先安裝selinux相關套件，請按照文件順序進行安裝。 ::: 複製相關檔案 ```shell! [suse@localhost ~]$ scp root@192.168.1.101:/root/work/rke2/* . The authenticity of host '192.168.1.101 (192.168.1.101)' can't be established. ED25519 key fingerprint is SHA256:N2ypmxaouqdjtc51LqpYR1YSOHnDm1mmIwAzT/7ej3Q. This key is not known by any other names Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.1.101' (ED25519) to the list of known hosts. (root@192.168.1.101) Password: config.yaml 100% 70 88.2KB/s 00:00 install.sh 100% 24KB 13.2MB/s 00:00 registries.yaml 100% 208 201.8KB/s 00:00 rke2-images.linux-amd64.tar.zst 100% 812MB 341.5MB/s 00:02 rke2.linux-amd64.tar.gz 100% 33MB 417.0MB/s 00:00 rke2selinux.tar.gz 100% 177MB 380.0MB/s 00:00 sha256sum-amd64.txt 100% 4252 3.7MB/s 00:00 ``` 建立RKE2離線安裝所需目錄與複製相關套件。 ```shell! [suse@localhost ~]$ pwd /home/suse [suse@localhost ~]$ sudo mkdir /root/rke2-artifacts && sudo mv * /root/rke2-artifacts/ [suse@localhost ~]$ sudo su - root [root@localhost ~]# cd /root/rke2-artifacts/ [root@localhost rke2-artifacts]# ls -alh total 1023M drwxr-xr-x. 3 root root 4.0K Nov 26 11:50 . dr-xr-x---. 4 root root 185 Nov 26 11:50 .. -rw-r--r--. 1 suse suse 70 Nov 26 11:44 config.yaml -rwxr-xr-x. 1 suse suse 25K Nov 26 11:44 install.sh -rw-r--r--. 1 suse suse 208 Nov 26 11:44 registries.yaml -rw-r--r--. 1 suse suse 813M Nov 26 11:44 rke2-images.linux-amd64.tar.zst -rw-r--r--. 1 suse suse 34M Nov 26 11:44 rke2.linux-amd64.tar.gz drwxr-xr-x. 4 suse suse 109 Nov 26 09:30 rke2selinux -rw-r--r--. 1 suse suse 178M Nov 26 11:44 rke2selinux.tar.gz -rw-r--r--. 1 suse suse 4.2K Nov 26 11:44 sha256sum-amd64.txt [root@localhost rke2-artifacts]# INSTALL_RKE2_ARTIFACT_PATH=/root/rke2-artifacts sh install.sh [WARN] /usr/local is read-only or a mount point; installing to /opt/rke2 [INFO] staging local checksums from /root/rke2-artifacts/sha256sum-amd64.txt [INFO] staging zst airgap image tarball from /root/rke2-artifacts/rke2-images.linux-amd64.tar.zst [INFO] staging tarball from /root/rke2-artifacts/rke2.linux-amd64.tar.gz [INFO] verifying airgap tarball grep: /tmp/rke2-install.VlfWezVfj7/rke2-images.checksums: No such file or directory [INFO] installing airgap tarball to /var/lib/rancher/rke2/agent/images [INFO] verifying tarball [INFO] unpacking tarball file to /opt/rke2 [INFO] updating tarball contents to reflect install path [INFO] moving systemd units to /etc/systemd/system [INFO] install complete; you may want to run: export PATH=$PATH:/opt/rke2/bin [root@localhost rke2-artifacts]# export PATH=$PATH:/opt/rke2/bin ``` RKE2 config - 注意第一台與二、三台的組態在config.yaml中的不同。 第一台組態，這裡的node name要與hostname一致，不一致會以這邊為主強制更新。 ```shell! node-name: - 'r1' token: my-shared-secret selinux: true ``` 第二與第三，注意server的IP位置。 ```shell! server: https://192.168.1.203:9345 node-name: - 'r2' token: my-shared-secret selinux: true ``` 映像檔組態(all) - registries.yaml ```shell! mirrors: docker.io: endpoint: - "https://harbor.example.com" configs: "harbor.example.com": auth: username: admin password: Harbor12345 tls: insecure_skip_verify: true ``` 安裝selinux與rke2 server相關套件 ```shell! # tar -zxvf rke2selinux.tar.gz rke2selinux/ rke2selinux/rancher-rke2-1-30-latest/ rke2selinux/rancher-rke2-1-30-latest/rke2-agent-1.30.0~rke2r1-0.el9.x86_64.rpm rke2selinux/rancher-rke2-1-30-latest/rke2-agent-1.30.1~rke2r1-0.el9.x86_64.rpm rke2selinux/rancher-rke2-1-30-latest/rke2-agent-1.30.2~rke2r1-0.el9.x86_64.rpm rke2selinux/rancher-rke2-1-30-latest/rke2-agent-1.30.3~rke2r1-0.el9.x86_64.rpm rke2selinux/rancher-rke2-1-30-latest/rke2-agent-1.30.4~rke2r1-0.el9.x86_64.rpm rke2selinux/rancher-rke2-1-30-latest/rke2-agent-1.30.5~rke2r1-0.el9.x86_64.rpm rke2selinux/rancher-rke2-1-30-latest/rke2-agent-1.30.6~rke2r1-0.el9.x86_64.rpm rke2selinux/rancher-rke2-1-30-latest/rke2-common-1.30.0~rke2r1-0.el9.x86_64.rpm rke2selinux/rancher-rke2-1-30-latest/rke2-common-1.30.1~rke2r1-0.el9.x86_64.rpm rke2selinux/rancher-rke2-1-30-latest/rke2-common-1.30.2~rke2r1-0.el9.x86_64.rpm rke2selinux/rancher-rke2-1-30-latest/rke2-common-1.30.3~rke2r1-0.el9.x86_64.rpm rke2selinux/rancher-rke2-1-30-latest/rke2-common-1.30.4~rke2r1-0.el9.x86_64.rpm rke2selinux/rancher-rke2-1-30-latest/rke2-common-1.30.5~rke2r1-0.el9.x86_64.rpm rke2selinux/rancher-rke2-1-30-latest/rke2-common-1.30.6~rke2r1-0.el9.x86_64.rpm rke2selinux/rancher-rke2-1-30-latest/rke2-server-1.30.0~rke2r1-0.el9.x86_64.rpm rke2selinux/rancher-rke2-1-30-latest/rke2-server-1.30.1~rke2r1-0.el9.x86_64.rpm rke2selinux/rancher-rke2-1-30-latest/rke2-server-1.30.2~rke2r1-0.el9.x86_64.rpm rke2selinux/rancher-rke2-1-30-latest/rke2-server-1.30.3~rke2r1-0.el9.x86_64.rpm rke2selinux/rancher-rke2-1-30-latest/rke2-server-1.30.4~rke2r1-0.el9.x86_64.rpm rke2selinux/rancher-rke2-1-30-latest/rke2-server-1.30.5~rke2r1-0.el9.x86_64.rpm rke2selinux/rancher-rke2-1-30-latest/rke2-server-1.30.6~rke2r1-0.el9.x86_64.rpm rke2selinux/rancher-rke2-common-latest/ rke2selinux/rancher-rke2-common-latest/rke2-selinux-0.12-1.el9.noarch.rpm rke2selinux/rancher-rke2-common-latest/rke2-selinux-0.13-1.el9.noarch.rpm rke2selinux/rancher-rke2-common-latest/rke2-selinux-0.14-1.el9.noarch.rpm rke2selinux/rancher-rke2-common-latest/rke2-selinux-0.15-1.el9.noarch.rpm rke2selinux/rancher-rke2-common-latest/rke2-selinux-0.16-1.el9.noarch.rpm rke2selinux/rancher-rke2-common-latest/rke2-selinux-0.17-1.el9.noarch.rpm rke2selinux/rancher-rke2-common-latest/rke2-selinux-0.18-1.el9.noarch.rpm rke2selinux/rancher-rke2-1-30-latest.repo # cd rke2selinux/ [suse@localhost rke2selinux]# ls rancher-rke2-1-30-latest rancher-rke2-1-30-latest.repo rancher-rke2-common-latest [suse@localhost rke2selinux]# cd rancher-rke2-common-latest/ [suse@localhost rancher-rke2-common-latest]# ls rke2-selinux-0.12-1.el9.noarch.rpm rke2-selinux-0.15-1.el9.noarch.rpm rke2-selinux-0.18-1.el9.noarch.rpm rke2-selinux-0.13-1.el9.noarch.rpm rke2-selinux-0.16-1.el9.noarch.rpm rke2-selinux-0.14-1.el9.noarch.rpm rke2-selinux-0.17-1.el9.noarch.rpm [suse@localhost rancher-rke2-common-latest]# sudo rpm -ivh rke2-selinux-0.18-1.el9.noarch.rpm [sudo] password for suse: warning: rke2-selinux-0.18-1.el9.noarch.rpm: Header V3 RSA/SHA256 Signature, key ID e257814a: NOKEY Verifying... ################################# [100%] Preparing... ################################# [100%] Updating / installing... 1:rke2-selinux-0.18-1.el9 ################################# [100%] [suse@localhost rancher-rke2-1-30-latest]# sudo rpm -ivh rke2-common-1.30.6~rke2r1-0.el9.x86_64.rpm warning: rke2-common-1.30.6~rke2r1-0.el9.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID e257814a: NOKEY Verifying... ################################# [100%] Preparing... ################################# [100%] Updating / installing... 1:rke2-common-1.30.6~rke2r1-0.el9 ################################# [100%] ``` 啟用叢集 ```shell! systemctl enable --now rke2-server.service ``` 測試 pull image 正常. ```shell! kubectl create deploy myweb --image=rancher/mirrored-library-nginx:1.24.0-alpine --port=80 ``` :::info export service, if unable access service/pod IP, it's must be firewall issue. ::: ## REF 1. [firewall list](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/installation-requirements/port-requirements) 2. [SELinux RPM](https://docs.rke2.io/install/methods#rpm)