151. 如何在 RKE2 集群中编辑启用的 TLS 协议或 ingress-nginx ciphers

IT干货

363人浏览 · 2026-05-07 18:03:16

IT干货 · 2026-05-07 18:03:16 发布

Environment 环境

A Rancher-provisioned or standalone RKE2 cluster with the ingress-nginx ingress controller
一个由 Rancher 配置的或独立 RKE2 集群，带有 ingress-nginx 入口控制器

Situation 地理位置

You may wish to customise the TLS protocols or ciphers enabled by the built-in ingress-nginx ingress controller (via the ssl-protocols or ssl-ciphers configuration), in an RKE2 cluster.
你可能希望在 RKE2 集群中自定义内置的 ingress-nginx 入口控制器（通过 SSL 协议或 SSL 密码配置）启用的 TLS 协议或密码。

For example, in ingress-nginx v1.12.4, the version packaged with RKE2 v1.33+rke2r1, the default ssl-protocol is TLS v1.2. You may wish to enable the deprecated TLS v1.0 and TLS v1.1 protocols, or enable the newer TLS v1.3 protocol. This article details how to achieve this in both Rancher-provisioned and standalone RKE2 clusters.
例如，在 ingress-nginx v1.12.4 中，RKE2 v1.33+rke2r1 的版本，默认的 SSL 协议是 TLS v1.2。您可以启用已弃用的 TLS v1.0 和 TLS v1.1 协议，或者启用更新的 TLS v1.3 协议。本文详细介绍了如何在 Rancher 配置和独立 RKE2 集群中实现这一目标。

NOTE: Changing the default ssl protocols and ciphers has security implications, in particular the use of less secure deprecated protocols or ciphers. You should proceed with caution.
注意：更改默认 SSL 协议和密码存在安全隐患，特别是使用安全性较低的废弃协议或密码。你应该谨慎行事。

Resolution 结局

Configuration for Rancher-provisioned RKE2 clusters
Rancher 配置的 RKE2 集群配置

Login to the Rancher UI
登录牧场主界面
Navigate to Cluster Management
导航至集群管理
Click Edit Config for the relevant Rancher-provisioned RKE2 cluster
点击编辑配置以查看相关的 Rancher 配置 RKE2 集群
Click Additional Manifest and provide the a HelmChartConfig, with the desired ssl-protocol and ssl-cipher, for the rke2-ingress-nginx chart. In this example, the deprecated TLS versions v1.0 and v1.1 are added to the ssl-protocols, as well as the newer TLS v1.3.
点击 “附加清单 ”，为 rke2-ingress-nginx 图表提供包含所需 ssl 协议和 ssl 密码的 a HelmChartConfig。在此示例中，已弃用的 TLS v1.0 和 v1.1 版本被添加到 SSL 协议中，以及更新的 TLS v1.3。
```
<code>apiVersion: <a data-cke-saved-href="http://helm.cattle.io/v1" href="http://helm.cattle.io/v1">helm.cattle.io/v1</a>
kind: HelmChartConfig
metadata:
 name: rke2-ingress-nginx
 namespace: kube-system
spec:
 valuesContent: |-
 controller:
 config:
 ssl-protocols: "TLSv1 TLSv1.1 TLSv1.2 TLSv1.3"</code>
```
Click Save at the bottom of the page
点击页面底部的保存
Wait for cluster to finish updating
等待集群更新完成
Explore the cluster and launch a kubectl shell.
探索集群并发射库贝克特尔炮弹。

The ssl protocols and ciphers configuration in the running ingress-nginx Pods can be confirmed by running the below command against the cluster:
运行中的 ingress-nginx Pods 中的 SSL 协议和密码配置可以通过对集群运行以下命令来确认：

<span style="color:#000000"><span style="background-color:#ffffff"><span style="background-color:#efefef"><code>for pod in $(kubectl get pods -l <a data-cke-saved-href="http://app.kubernetes.io/instance=rke2-ingress-nginx" href="http://app.kubernetes.io/instance=rke2-ingress-nginx">app.kubernetes.io/instance=rke2-ingress-nginx</a> -n kube-system --no-headers -o name | awk -F '/' '{print $2}'); do echo -n "Checking $pod .... "; kubectl -n kube-system exec "$pod" -- /dbg conf | grep ssl_protocols; done</code></span></span></span>

Configuration for standalone RKE2 clusters
独立 RKE2 集群配置

On server nodes in the cluster, create a HelmChartConfig manifest, with the desired ssl-protocol and ssl-cipher, for the rke2-ingress-nginx chart, within the directory /var/lib/rancher/rke2/server/manifests/ (e.g. /var/lib/rancher/rke2/server/manifests/rke2-ingress-nginx-config.yaml). In this example, the deprecated TLS versions v1.0 and v1.1 are added to the ssl-protocols, as well as the newer TLS v1.3.
在集群中的服务器节点上，创建一个 HelmChartConfig 清单，包含所需的 ssl 协议和 ssl 密码，用于 rke2-ingress-nginx 图表，目录为/var/lib/rancher/rke2/server/manifests/（例如/var/lib/rancher/rke2/server/manifests/rke2-ingress-nginx-config.yaml）。在此示例中，已弃用的 TLS v1.0 和 v1.1 版本被添加到 SSL 协议中，以及更新的 TLS v1.3。
```
<code>apiVersion: <a data-cke-saved-href="http://helm.cattle.io/v1" href="http://helm.cattle.io/v1">helm.cattle.io/v1</a>
kind: HelmChartConfig
metadata:
 name: rke2-ingress-nginx
 namespace: kube-system
spec:
 valuesContent: |-
 controller:
 config:
 ssl-protocols: "TLSv1 TLSv1.1 TLSv1.2 TLSv1.3"</code>
```
Wait for the rke2-ingress-nginx helm chart to finish upgrading
等 rke2-ingress-nginx 的舵轮表升级完成

<span style="color:#000000"><span style="background-color:#ffffff"><span style="background-color:#efefef"><code>for pod in $(kubectl get pods -l <a data-cke-saved-href="http://app.kubernetes.io/instance=rke2-ingress-nginx" href="http://app.kubernetes.io/instance=rke2-ingress-nginx">app.kubernetes.io/instance=rke2-ingress-nginx</a> -n kube-system --no-headers -o name | awk -F '/' '{print $2}'); do echo -n "Checking $pod .... "; kubectl -n kube-system exec "$pod" -- /dbg conf | grep ssl_protocols; done</code></span></span></span>

Cause 病因

Additional Information 附加信息