How to upgrade Rancher agents to use SSL?

nico · June 28, 2018, 7:15am

I have same issue, and lots of people have issues when running rancher behind https :

Add Host With letsencrypt SSL Fail!

opened 07:02AM - 05 Jan 17 UTC

closed 08:38PM - 17 May 17 UTC

*Describe your issue here* My Rancher Server running at port 51263, then use ng…inx agent to port 443 (proxy_pass), http2 enabled, chrome can browse it, no problem . Then I copy letsencrypt cert1.pem to /var/lib/rancher/etc/ssl/ca.crt, and run rancher/agent, it showed: INFO: Running Agent Registration Process, CATTLE_URL=https://xxx.com/v1 INFO: Attempting to connect to: https://xxx.com/v1 INFO: https://xxx.com/v1 is accessible Traceback (most recent call last): File "./resolve_url.py", line 9, in <module> r = requests.get(url) File "/usr/local/lib/python2.7/dist-packages/requests/api.py", line 70, in get return request('get', url, params=params, **kwargs) File "/usr/local/lib/python2.7/dist-packages/requests/api.py", line 56, in request return session.request(method=method, url=url, **kwargs) File "/usr/local/lib/python2.7/dist-packages/requests/sessions.py", line 488, in request resp = self.send(prep, **send_kwargs) File "/usr/local/lib/python2.7/dist-packages/requests/sessions.py", line 609, in send r = adapter.send(request, **kwargs) File "/usr/local/lib/python2.7/dist-packages/requests/adapters.py", line 497, in send raise SSLError(e, request=request) requests.exceptions.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590) curl: no URL specified! curl: try 'curl --help' or 'curl --manual' for more information ERROR: returned ERROR: --- START --- ERROR: --- END --- ERROR: Failed to load registration env from CATTLE_URL=https://xxx.com/v1 ENV_URL= ERROR: Please ensure the proper value for the Host Registration URL is set I don't konw what's wrong? --- | Useful | Info | | :-- | :-- | |Versions|Rancher `v1.2.2` Cattle: `v0.174.13` UI: `v1.2.40` | |Access|`localauth` `admin`| |Orchestration|`Cattle`| |Route|`hosts.index`|

github.com/rancher/rancher

Agent blows up if the SSL CA is unknown

opened 01:20AM - 16 Mar 16 UTC

closed 05:57AM - 20 Mar 16 UTC

brentkearney

kind/bug

Rancher Version: v0.63.1 Docker Version: 1.10.3 OS: Ubuntu 14.04 Steps to Re…produce: Setup nginx proxy for SSL as per Rancher documentation. Use COMODO signed wildcard certificate. Results: Agent fails to connect. If CA bundle path is passed into the container with -e CURL_CA_BUNDLE="/etc/ssl/mycert.ca-bundle", then it connects, but resolve_url.py blows up. `docker run -d -e CURL_CA_BUNDLE="/etc/ssl/myserver.ca-bundle" -v /etc/ssl:/etc/ssl:ro`... rancher/agent:v0.10.0` ``` INFO: Running Agent Registration Process, CATTLE_URL=https://myserver.ca/v1 INFO: Checking for Docker version >= 1.6.0 INFO: Found Server version: 1.10.3 INFO: docker version: Client version: 1.6.0 INFO: docker version: Client API version: 1.18 INFO: docker version: Go version (client): go1.4.2 INFO: docker version: Git commit (client): 4749651 INFO: docker version: OS/Arch (client): linux/amd64 INFO: docker version: Server version: 1.10.3 INFO: docker version: Server API version: 1.22 INFO: docker version: Go version (server): go1.5.3 INFO: docker version: Git commit (server): 20f81dd INFO: docker version: OS/Arch (server): linux/amd64 INFO: docker info: Containers: 1 INFO: docker info: Images: 1 INFO: docker info: Storage Driver: aufs INFO: docker info: Root Dir: /data/docker/aufs INFO: docker info: Backing Filesystem: extfs INFO: docker info: Dirs: 15 INFO: docker info: Dirperm1 Supported: true INFO: docker info: Execution Driver: native-0.2 INFO: docker info: Kernel Version: 3.19.0-56-generic INFO: docker info: Operating System: Ubuntu 14.04.4 LTS INFO: docker info: CPUs: 8 INFO: docker info: Total Memory: 11.73 GiB INFO: docker info: Name: nigel INFO: docker info: ID: B7MO:TEDR:B5V3:BHWQ:MO4X:TONG:ER7G:WA3R:NV5Q:EXLY:4PEC:UOBI INFO: docker info: Http Proxy: INFO: docker info: Https Proxy: INFO: docker info: No Proxy: WARNING: No swap limit support INFO: Attempting to connect to: https://myserver.ca/v1 INFO: https://myserver.ca/v1 is accessible Traceback (most recent call last): File "./resolve_url.py", line 9, in <module> r = requests.get(url) File "/usr/local/lib/python2.7/dist-packages/requests/api.py", line 67, in get return request('get', url, params=params, **kwargs) File "/usr/local/lib/python2.7/dist-packages/requests/api.py", line 53, in request return session.request(method=method, url=url, **kwargs) File "/usr/local/lib/python2.7/dist-packages/requests/sessions.py", line 468, in request resp = self.send(prep, **send_kwargs) File "/usr/local/lib/python2.7/dist-packages/requests/sessions.py", line 576, in send r = adapter.send(request, **kwargs) File "/usr/local/lib/python2.7/dist-packages/requests/adapters.py", line 447, in send raise SSLError(e, request=request) requests.exceptions.SSLError: bad handshake: Error([('SSL routines', 'SSL3_GET_SERVER_CERTIFICATE', 'certificate verify failed')],) curl: no URL specified! curl: try 'curl --help' or 'curl --manual' for more information ERROR: returned ERROR: --- START --- ERROR: --- END --- ERROR: Failed to load registration env from CATTLE_URL=https://myserver.ca/v1 ENV_URL= ERROR: Please ensure the proper value for the Host Registration URL is set ``` Perhaps a way to fix this would be to have resolve_url.py look for the same environment variable that the command line curl client does, CURL_CA_BUNDLE. Then use it to specify the optional "verify" argument in the `requests.get` call in resolve_url.py. i.e. ``` ca_path = os.environ['CURL_CA_BUNDLE'] r = requests.get(url, verify=ca_path) ``` Expected: Successful SSL connection to the Rancher server.

Lots of potential solutions, I did not have enough time to try them all, I am still blocked.

Topic		Replies	Views
Re-registering rancher-agent with HTTPS? Rancher 1.x	4	2192	July 13, 2017
Add host - https - cert issue Rancher 1.x	1	1243	August 8, 2018
Rancher agent cannot connect with self-signed server cert Rancher 1.x	1	1337	March 3, 2017
Enabling https on Rancher Rancher 1.x	8	3094	April 11, 2017
Self-signed root certificate (ca.crt) for rancher-agent and server? Rancher 1.x	12	8369	November 3, 2015

How to upgrade Rancher agents to use SSL?

Related topics