Rancher: gerenciando múltiplos clusters K8s sem sofrer

# 1) cert-manager (Rancher usa pra emitir certificados internos)
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.15.3/cert-manager.crds.yaml

helm repo add jetstack https://charts.jetstack.io
helm upgrade --install cert-manager jetstack/cert-manager \
  --namespace cert-manager --create-namespace \
  --version v1.15.3

# 2) Rancher Manager (stable channel)
helm repo add rancher-stable https://releases.rancher.com/server-charts/stable

kubectl create namespace cattle-system

helm upgrade --install rancher rancher-stable/rancher \
  --namespace cattle-system \
  --set hostname=rancher.empresa.com \
  --set bootstrapPassword=ChangeMeOnFirstLogin \
  --set ingress.tls.source=letsEncrypt \
  --set letsEncrypt.email=ops@empresa.com \
  --set replicas=3

# 3) Verifica rollout
kubectl -n cattle-system rollout status deploy/rancher
kubectl -n cattle-system get ing

# No primeiro server node
curl -sfL https://get.rke2.io | sh -
systemctl enable --now rke2-server.service

# Pega kubeconfig
sudo cp /etc/rancher/rke2/rke2.yaml ~/.kube/config
sudo chown $USER ~/.kube/config

# Pega o token (pra adicionar novos nodes)
sudo cat /var/lib/rancher/rke2/server/node-token

# Em um segundo server node (HA control plane)
mkdir -p /etc/rancher/rke2
cat <<'EOF' | sudo tee /etc/rancher/rke2/config.yaml
server: https://10.0.0.10:9345
token: K10<TOKEN-DO-PRIMEIRO-NODE>
EOF
curl -sfL https://get.rke2.io | sh -
systemctl enable --now rke2-server.service

# Em um agent (worker)
cat <<'EOF' | sudo tee /etc/rancher/rke2/config.yaml
server: https://10.0.0.10:9345
token: K10<TOKEN>
EOF
curl -sfL https://get.rke2.io | INSTALL_RKE2_TYPE=agent sh -
systemctl enable --now rke2-agent.service

# Comando gerado pelo Rancher (colado em quem tem kubectl no EKS)
kubectl apply -f https://rancher.empresa.com/v3/import/abc123xyz_c-xxxxx.yaml

# Verifica
kubectl -n cattle-system get pods
# NAME                                    READY   STATUS
# cattle-cluster-agent-7d4c9b5b6c-xxxxx   1/1     Running

# fleet-gitrepo.yaml — apply no management cluster do Rancher
apiVersion: fleet.cattle.io/v1alpha1
kind: GitRepo
metadata:
  name: apps-prod
  namespace: fleet-default
spec:
  repo: https://github.com/empresa/k8s-gitops
  branch: main
  paths:
    - apps/payments
    - apps/orders
  targets:
    - name: prod-eu
      clusterSelector:
        matchLabels:
          env: prod
          region: eu-west
    - name: prod-us
      clusterSelector:
        matchLabels:
          env: prod
          region: us-east

# apps/payments/fleet.yaml — customizações por target
defaultNamespace: payments
helm:
  chart: ./chart
  values:
    replicas: 2

targetCustomizations:
  - name: prod-eu
    helm:
      values:
        replicas: 5
        region: eu-west-1
  - name: prod-us
    helm:
      values:
        replicas: 5
        region: us-east-1

# Exemplo: Project "payments" agrega 3 namespaces e aplica quota+rbac
apiVersion: management.cattle.io/v3
kind: Project
metadata:
  name: p-payments
  namespace: c-m-xxxxx        # id interno do cluster no Rancher
spec:
  displayName: payments
  description: "Time de pagamentos — payments-api, payments-worker, payments-db"
  resourceQuota:
    limit:
      limitsCpu: "20"
      limitsMemory: "40Gi"
      pods: "50"
  namespaceDefaultResourceQuota:
    limit:
      requestsCpu: "2"
      requestsMemory: "4Gi"

---
apiVersion: management.cattle.io/v3
kind: ProjectRoleTemplateBinding
metadata:
  name: prb-payments-lead
  namespace: c-m-xxxxx
projectName: c-m-xxxxx:p-payments
subjectKind: User
subjectName: alice@empresa.com
roleTemplateName: project-owner

# Install Rancher Monitoring (no cluster downstream)
helm repo add rancher-charts https://charts.rancher.io
kubectl create namespace cattle-monitoring-system

helm upgrade --install rancher-monitoring rancher-charts/rancher-monitoring \
  --namespace cattle-monitoring-system \
  --set prometheus.prometheusSpec.retention=15d \
  --set grafana.persistence.enabled=true

apiVersion: resources.cattle.io/v1
kind: Backup
metadata:
  name: rancher-nightly
spec:
  storageLocation:
    s3:
      bucketName: rancher-backups
      region: us-east-1
      credentialSecretName: s3-creds
      credentialSecretNamespace: cattle-resources-system
  schedule: "0 3 * * *"       # 03:00 UTC
  retentionCount: 14
  encryptionConfigSecretName: encryptionconfig