From 88e911d05f5b470c52977521e926bc980fc0237e Mon Sep 17 00:00:00 2001 From: Daniel Noulet Date: Sun, 20 Sep 2026 15:18:00 +0200 Subject: [PATCH] fix: use local Rancher kubeconfig Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- Makefile | 19 +++++++++++-------- rancher-install.txt | 19 +++++++++++++++---- 2 files changed, 26 insertions(+), 12 deletions(-) diff --git a/Makefile b/Makefile index d904ae5..c763290 100644 --- a/Makefile +++ b/Makefile @@ -8,6 +8,7 @@ HELM ?= helm HELM_CHART := deploy/helm/go-guess HELM_RELEASE ?= go-guess HELM_NAMESPACE ?= go-guess +KUBECONFIG ?= $(HOME)/.config/kubectl/rancher.urpi.local.yaml .PHONY: help dev db-up db-down migrate migrate-down seed backend frontend frontend-install test test-backend test-frontend test-integration test-bdd test-bdd-down test-env test-env-down lint build helm-lint helm-deploy-development helm-deploy-production @@ -98,19 +99,21 @@ build: cd frontend && npm run build helm-lint: - $(HELM) lint $(HELM_CHART) -f $(HELM_CHART)/values-development.yaml - $(HELM) lint $(HELM_CHART) -f $(HELM_CHART)/values-production.yaml - $(HELM) template $(HELM_RELEASE) $(HELM_CHART) \ + KUBECONFIG="$(KUBECONFIG)" $(HELM) lint $(HELM_CHART) -f $(HELM_CHART)/values-development.yaml + KUBECONFIG="$(KUBECONFIG)" $(HELM) lint $(HELM_CHART) -f $(HELM_CHART)/values-production.yaml + KUBECONFIG="$(KUBECONFIG)" $(HELM) template $(HELM_RELEASE) $(HELM_CHART) \ -f $(HELM_CHART)/values-development.yaml >/dev/null - $(HELM) template $(HELM_RELEASE) $(HELM_CHART) \ + KUBECONFIG="$(KUBECONFIG)" $(HELM) template $(HELM_RELEASE) $(HELM_CHART) \ -f $(HELM_CHART)/values-production.yaml >/dev/null helm-deploy-development: - $(HELM) upgrade --install $(HELM_RELEASE) $(HELM_CHART) \ + KUBECONFIG="$(KUBECONFIG)" $(HELM) upgrade --install $(HELM_RELEASE) $(HELM_CHART) \ --namespace $(HELM_NAMESPACE)-development --create-namespace \ - -f $(HELM_CHART)/values-development.yaml + -f $(HELM_CHART)/values-development.yaml \ + --rollback-on-failure --wait --timeout 10m helm-deploy-production: - $(HELM) upgrade --install $(HELM_RELEASE) $(HELM_CHART) \ + KUBECONFIG="$(KUBECONFIG)" $(HELM) upgrade --install $(HELM_RELEASE) $(HELM_CHART) \ --namespace $(HELM_NAMESPACE)-production --create-namespace \ - -f $(HELM_CHART)/values-production.yaml + -f $(HELM_CHART)/values-production.yaml \ + --rollback-on-failure --wait --timeout 10m diff --git a/rancher-install.txt b/rancher-install.txt index cbdd214..2183c2a 100644 --- a/rancher-install.txt +++ b/rancher-install.txt @@ -18,6 +18,8 @@ Kubernetes cluster instead of copying this single-container topology. - Registry configuration: `~/.config/kubectl/registries.yaml` - Local HTTP: `http://127.0.0.1:8000` - Local HTTPS: `https://127.0.0.1:8443` +- Development application NodePort: `http://127.0.0.1:30080` +- Production application NodePort: `http://127.0.0.1:31374` Pinning the digest makes another installation reproducible. Review and update the Rancher version deliberately rather than running an unpinned `latest` image @@ -68,6 +70,8 @@ docker run -d \ --restart=unless-stopped \ -p 127.0.0.1:8000:80 \ -p 127.0.0.1:8443:443 \ + -p 127.0.0.1:30080:30080 \ + -p 127.0.0.1:31374:31374 \ -v /opt/rancher:/var/lib/rancher \ -v "$HOME/.config/kubectl/registries.yaml:/etc/rancher/k3s/registries.yaml:ro" \ --privileged \ @@ -75,9 +79,10 @@ docker run -d \ rancher/rancher@sha256:5f6c4dc52a05e0c400b53c08bf778ca55790f277e443b5881269158499b7ebe5 ``` -The explicit `127.0.0.1` bindings prevent ports `8000` and `8443` from being -published directly to the internet. Nginx on the same server can still reach -them. +The explicit `127.0.0.1` bindings prevent Rancher and application NodePorts +from being published directly to the internet. Nginx on the same server can +still reach them. Docker cannot add port mappings to an existing container, so +new NodePorts must be included when recreating the Rancher container. ## 4. Verify the installation @@ -95,10 +100,16 @@ docker exec rancher kubectl get nodes -o wide Expected results: - The container is running with restart policy `unless-stopped`. -- Only `127.0.0.1:8000` and `127.0.0.1:8443` are published. +- Only loopback ports `8000`, `8443`, `30080`, and `31374` are published. - `https://127.0.0.1:8443/ping` returns `pong`. - The embedded `local-node` reports `Ready`. +After deploying Go Guess, verify the application NodePort: + +```bash +curl --fail http://127.0.0.1:30080/api/health +``` + Retrieve the one-time bootstrap password locally, open `https://127.0.0.1:8443`, and immediately choose a permanent administrator password: