Rancher Manager and RKE2 Test Flight

Provisioning

• The Rancher Cluster Manager provisioner provides all dependencies for you to run a highly available implementation of Rancher on your AWS infrastructure, including:
  • VPC
  • Public Subnets
  • Private Subnets
  • Cluster ElasticLoadBalancers
  • SecurityGroups (limiting traffic to only essential ports)
  • LaunchTemplates
  • AutoscalingGroups
• After configuring and deploying your CloudFormation stack, it can take up to 10 minutes for your Rancher cluster manager to be fully available.
• Your RKE2 Kubernetes Controlplane and Agent NodePools are managed by AWS AutoScalingGroups, and are served by AWS Classic LoadBalancers. To see the currently state of RKE2 and Rancher in terms of AWS resources:
  • Navigate to the EC2 page.
  • Under Load Balancing, select Load Balancers.
  • Find the 2 load balancers for your cluster (controlplane and rancher). Ensure they have healthy nodes attached to the load balancers.
  • If your stack has been up for 10 minutes and no instances are registered to the LoadBalancers, you'll need to delete and recreate your Cloudformation stack.
  • If the issue persists, you will need to create a publicly accessible bastion in VPC created by Cloudformation, and use that as a jumpbox to access your Controlplane EC2s. Once in your Controlplane EC2s, check on '/var/log/cloud-init-output.log', 'systemctl status rke2-server', and 'journalctl -u rke2-server' for errors.

Accessing Rancher

• If you're utilizing the Route 53 RecordSet capability of the CloudFormation template, make sure your Route 53 DNS server is routable from your local machine and navigate to the rancher hostname in a browser (ie. https://rancher.example.com )
• If not utilizing Route 53, you will need to create a CNAME DNS Record in whichever DNS provider you are utilizing to point the hostname you specified at provisioning time to the generated Rancher Loadbalancer. To get this information, please navigated to the Outputs of your Cloudformation stack.

Other Notes

• One IAM Role is required by the controlplane nodes to orchestrate provisioning order. This role, attached to every controlplane node, only has the ability to describe Autoscaling Groups and Autoscaling Instances.
• Each node's underlying EBS volume is encrypted by default.
• It is critical for you to store and protect your ClusterJoinToken parameter. This is vital for restoring cluster state and adding new nodes in the future.