rancher 非docker离线安装

Last updated on September 5, 2026 pm

🧙 Questions

使用非docker的方式离线安装rancher
centos7.9

☄️ Ideas

配置免密登录

ssh-copy-id root@120.55.168.57

上传rke2安装包

https://github.com/rancher/rke2/releases/tag/v1.28.3%2Brke2r1

scp rancher.zip root@120.55.168.57:/data/downloads

cd /data/downloads
yum install unzip -y
unzip rancher.zip

创建rke2目录

mkdir -p /data/rancher
ln -s /data/rancher /var/lib/rancher

mkdir -p /data/containers
ln -s /data/containers /var/lib/containers

安装rke2

必须要使用root用户执行

mkdir -p /data/rke2-artifacts
cd /data/downloads/rancher
cp rke2-images.linux-amd64.tar.zst /data/rke2-artifacts/
cp rke2.linux-amd64.tar.gz /data/rke2-artifacts/
cp sha256sum-amd64.txt /data/rke2-artifacts/

cd /data/downloads/rancher
INSTALL_RKE2_ARTIFACT_PATH=/data/rke2-artifacts sh install.sh

启动rke2

journalctl -u rke2-server -f 看日志

systemctl enable rke2-server.service
systemctl start rke2-server.service
systemctl status rke2-server.service

检查rke2服务

此时k8s已经安装好了

tee -a /etc/profile <<-'EOF'
export KUBECONFIG=/etc/rancher/rke2/rke2.yaml 
export PATH=$PATH:/var/lib/rancher/rke2/bin
EOF
source /etc/profile
kubectl get nodes
kubectl get pods -n kube-system

离线安装helm

cd /data/downloads/rancher/
tar -zxvf helm-v3.15.3-linux-amd64.tar.gz
mv linux-amd64/helm /usr/bin/helm
helm version

离线安装nerdctl

cd /data/downloads/rancher
tar -vzxf nerdctl-2.2.0-linux-amd64.tar.gz
mv nerdctl /usr/bin/nerdctl
mv containerd-rootless-setuptool.sh /usr/bin/containerd-rootless-setuptool.sh
mv containerd-rootless.sh /usr/bin/containerd-rootless.sh

https://github.com/containerd/nerdctl/blob/main/docs/config.md

mkdir -p /etc/nerdctl
vim /etc/nerdctl/nerdctl.toml

debug          = false
debug_full     = false
address        = "unix:///run/k3s/containerd/containerd.sock"
namespace      = "k8s.io"
snapshotter    = "stargz"
cgroup_manager = "cgroupfs"
hosts_dir      = ["/etc/containerd/certs.d", "/etc/docker/certs.d"]
experimental   = true
userns_remap   = ""
dns            = ["8.8.8.8", "1.1.1.1"]
dns_opts       = ["ndots:1", "timeout:2"]
dns_search     = ["example.com", "example.org"]
insecure_registry = true

whereis nerdctl
which nerdctl
nerdctl version

下载harbor安装包

cd /data/downloads/rancher
nerdctl load -i local-path-provisioner-v0.0.32-amd64.tar.gz
nerdctl load -i busybox-latest.tar.gz

打包helm chart

cd /data/downloads/rancher
tar -xzf harbor-offline-installer-v2.14.1.tgz
cd /data/downloads/rancher/harbor 
nerdctl load -i harbor.v2.14.1.tar.gz

修改版本，将2.14.0改成v2.14.1

cd /data/downloads/rancher
tar -vzxf harbor-helm-1.18.0.tar.gz
cd /data/downloads/rancher/harbor-helm-1.18.0

sed -i 's/v2\.14\.0/v2.14.1/g' values.yaml
helm package .

配置crictl，用于检查镜像是否安装成功
检查是否导入

cat <<EOF | sudo tee /etc/crictl.yaml
runtime-endpoint: unix:///run/k3s/containerd/containerd.sock
image-endpoint: unix:///run/k3s/containerd/containerd.sock
timeout: 10
debug: false
EOF

crictl images

安装rancher的local-path-provisioner，挂载本地磁盘

cd /data/downloads/rancher
vim local-path-provisioner-v0.0.32.yaml

# DEFAULT_PATH_FOR_NON_LISTED_NODES
# 将/opt/local-path-provisioner 改成 /data/local-path-provisioner (自己的磁盘)
kubectl apply -f local-path-provisioner-v0.0.32.yaml
kubectl get pods -n local-path-storage
kubectl get storageclass

创建tls证书

注意IP.1的外网ip，一定要改，不然页面无法访问
IP.1=172.16.56.45
或者使用域名
nerdctl login 会通过wget请求https，添加centos认证

mkdir -p /data/harbor/ssl/ && cd /data/harbor/ssl/
openssl genrsa -out ca.key 4096
openssl req -x509 -new -nodes -sha512 -days 3650 \
 -subj "/C=CN/ST=Shanghai/L=Shanghai/O=isxcode/OU=Personal/CN=isxcode-data-center" \
 -key ca.key \
 -out ca.crt

openssl genrsa -out harbor.key 4096
openssl req -sha512 -new \
    -subj "/C=CN/ST=Shanghai/L=Shanghai/O=isxcode/OU=Personal/CN=isxcode-data-center" \
    -key harbor.key \
    -out harbor.csr

touch v3.ext
cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1=isxcode-data-center
EOF

openssl x509 -req -sha512 -days 3650 \
    -extfile v3.ext \
    -CA ca.crt -CAkey ca.key -CAcreateserial \
    -in harbor.csr \
    -out harbor.crt

openssl x509 -inform PEM -in harbor.crt -out harbor.cert

cp /data/harbor/ssl/* /etc/pki/ca-trust/source/anchors/
update-ca-trust

拷贝到其他子节点上，每个节点都要做【多节点】

scp root@dehoop-test-1:/data/harbor/ssl/* /etc/pki/ca-trust/source/anchors/
update-ca-trust

创建 secret
kubectl delete secret harbor-tls -n harbor

kubectl create namespace harbor
kubectl create secret tls harbor-tls \
    --cert=/data/harbor/ssl/harbor.cert  \
    --key=/data/harbor/ssl/harbor.key \
    -n harbor

kubectl get secret -n harbor -o wide

安装harbor

卸载重装
helm uninstall harbor -n harbor

helm upgrade --install harbor /data/downloads/rancher/harbor-helm-1.18.0/harbor-1.18.0.tgz \
  --namespace harbor --create-namespace \
  --set expose.type=nodePort \
  --set expose.tls.enabled=true \
  --set expose.tls.certSource=secret \
  --set expose.tls.auto.commonName=isxcode-data-center \
  --set expose.tls.secret.secretName=harbor-tls \
  --set persistence.persistentVolumeClaim.registry.storageClass=local-path \
  --set persistence.persistentVolumeClaim.registry.size=20Gi \
  --set persistence.persistentVolumeClaim.redis.storageClass=local-path \
  --set persistence.persistentVolumeClaim.redis.size=5Gi \
  --set persistence.persistentVolumeClaim.database.storageClass=local-path \
  --set persistence.persistentVolumeClaim.database.size=10Gi \
  --set persistence.persistentVolumeClaim.jobservice.jobLog.storageClass=local-path \
  --set persistence.persistentVolumeClaim.jobservice.jobLog.size=1Gi \
  --set persistence.persistentVolumeClaim.trivy.storageClass=local-path \
  --set persistence.persistentVolumeClaim.trivy.size=5Gi \
  --set externalURL=https://isxcode-data-center:30003 \
  --set expose.nodePort.ports.https.port=30003 \
  --set proxy.httpsPort=30003 \
  --set harborAdminPassword=MySecurePass123! \
  --set imagePullPolicy=Never \
  --wait --timeout=20m

# 需要等待久一点
kubectl -n harbor get pods

域名无法外网访问的，只能在内网

nerdctl login https://isxcode-data-center:30003
Enter Username: admin
Enter Password: MySecurePass123!

修改本地镜像到harbor

nerdctl tag busybox:latest isxcode-data-center:30003/library/busybox:latest
nerdctl push isxcode-data-center:30003/library/busybox:latest

nerdctl tag rancher/local-path-provisioner:v0.0.32 isxcode-data-center:30003/library/local-path-provisioner:v0.0.32
nerdctl push isxcode-data-center:30003/library/local-path-provisioner:v0.0.32

修改local-path-storage的镜像仓库地址

kubectl -n local-path-storage set image deployment/local-path-provisioner \
  local-path-provisioner=isxcode-data-center:30003/library/local-path-provisioner:v0.0.32

kubectl -n local-path-storage get deployment local-path-provisioner -o jsonpath='{.spec.template.spec.containers[0].image}'

修改local-path-storage的configMap

kubectl edit configmap -n local-path-storage local-path-config

# 搜索 busybox 编辑修改
containers:
  - name: helper-pod
    image: isxcode-data-center:30003/library/busybox:latest

重启local-path-storage

kubectl -n local-path-storage rollout restart deployment local-path-provisioner
kubectl -n local-path-storage rollout status deployment local-path-provisioner

导入rancher的离线镜像 v2.8.5

cd /data/downloads/rancher
chmod +x rancher-load-images.sh
./rancher-load-images.sh --image-list ./rancher-images.txt --registry isxcode-data-center:30003/library

k8s安装自签证书

cd /data/downloads/rancher
kubectl create namespace cert-manager
kubectl apply -f ./cert-manager-crd.yaml
helm install cert-manager /data/downloads/rancher/cert-manager-v1.15.1.tgz \
    --namespace cert-manager \
    --set image.repository=isxcode-data-center:30003/library/quay.io/jetstack/cert-manager-controller \
    --set webhook.image.repository=isxcode-data-center:30003/library/quay.io/jetstack/cert-manager-webhook \
    --set cainjector.image.repository=isxcode-data-center:30003/library/quay.io/jetstack/cert-manager-cainjector \
    --set startupapicheck.image.repository=isxcode-data-center:30003/library/quay.io/jetstack/cert-manager-startupapicheck \
    --debug
helm list -A
kubectl -n cert-manager get pods

k8s安装rancher

卸载：helm uninstall rancher -n cattle-system

cd /data/downloads/rancher
kubectl create namespace cattle-system
helm install rancher /data/downloads/rancher/rancher-2.8.5.tgz \
  --namespace cattle-system \
  --set hostname=dehoop-01 \
  --set certmanager.version=1.15.1 \
  --set rancherImage=isxcode-data-center:30003/library/rancher/rancher \
  --set useBundledSystemChart=true \
  --set systemDefaultRegistry=isxcode-data-center:30003/library \
  --set rancherImageTag=v2.8.5 \
  --set service.type=NodePort

kubectl -n cattle-system get deploy rancher
kubectl -n cattle-system get pods

修改端口号

kubectl edit svc rancher -n cattle-system

修改nodePort

 ports:
- name: http
  nodePort: 30123
  port: 80
  protocol: TCP
  targetPort: 80
- name: https-internal
  nodePort: 30119   # 修改这个
  port: 443
  protocol: TCP
  targetPort: 444

kubectl get svc -n cattle-system
# NAME              TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)                      AGE
# rancher           NodePort    10.43.178.130   <none>        80:30119/TCP,443:31257/TCP   6m54s
# rancher-webhook   ClusterIP   10.43.207.252   <none>        443/TCP                      32s

获取密码

kubectl get secret --namespace cattle-system bootstrap-secret -o go-template='{{.data.bootstrapPassword|base64decode}}{{ "\n" }}'

访问地址: https://isxcode-data-center:30119
初始密码: tqc54jl25l657mdwmhw25xfxtmjpg2srw6vchdjqf5j8m8zwkfkwsr
自动获取密码：LMcSvbiN8CW7Uncl

🔗 Links

rancher docs

rancher

rancher 非docker离线安装

https://ispong.isxcode.com/kubernetes/rancher/rancher 非docker离线安装/

Author

ispong

Posted on

November 24, 2025

Licensed under

mac 挂载目录 Previous

docker 安装数据源 Next