mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-27 13:38:07 +00:00
Remove unneeded intermediate folders
This commit is contained in:
Billy Tat
@@ -0,0 +1,44 @@
|
||||
---
|
||||
title: Dockershim
|
||||
weight: 300
|
||||
---
|
||||
|
||||
The Dockershim is the CRI compliant layer between the Kubelet and the Docker daemon. As part of the Kubernetes 1.20 release, the [deprecation of the in-tree Dockershim was announced](https://kubernetes.io/blog/2020/12/02/dont-panic-kubernetes-and-docker/). For more information on the deprecation and its timelines, see the [Kubernetes Dockershim Deprecation FAQ](https://kubernetes.io/blog/2020/12/02/dockershim-faq/#when-will-dockershim-be-removed).
|
||||
|
||||
RKE clusters now support the external Dockershim to continue leveraging Docker as the CRI runtime. We now implement the upstream open source community external Dockershim announced by [Mirantis and Docker](https://www.mirantis.com/blog/mirantis-to-take-over-support-of-kubernetes-dockershim-2/) to ensure RKE clusters can continue to leverage Docker.
|
||||
|
||||
To enable the external Dockershim, configure the following option.
|
||||
|
||||
```
|
||||
enable_cri_dockerd: true
|
||||
```
|
||||
|
||||
For users looking to use another container runtime, Rancher has the edge-focused K3s and datacenter-focused RKE2 Kubernetes distributions that use containerd as the default runtime. Imported RKE2 and K3s Kubernetes clusters can then be upgraded and managed through Rancher going forward.
|
||||
|
||||
### FAQ
|
||||
|
||||
<br/>
|
||||
|
||||
Q. Do I have to upgrade Rancher to get Rancher’s support of the upstream Dockershim?
|
||||
|
||||
A The upstream support of Dockershim begins for RKE in Kubernetes 1.21. You will need to be on a version of Rancher that supports RKE 1.21. See our support matrix for details.
|
||||
|
||||
<br/>
|
||||
|
||||
Q. I am currently on RKE with Kubernetes 1.20. Do I need to upgrade to RKE with Kubernetes 1.21 sooner to avoid being out of support for Dockershim?
|
||||
|
||||
A. The version of Dockershim in RKE with Kubernetes 1.20 will continue to work and it is not deprecated until a later release. For information on the timeline, see the [Kubernetes Dockershim Deprecation FAQ](https://kubernetes.io/blog/2020/12/02/dockershim-faq/#when-will-dockershim-be-removed). It will only emit a warning of its future deprecation, which Rancher has mitigated in RKE with Kubernetes 1.21. You can plan your upgrade to 1.21 as you would normally.
|
||||
|
||||
<br/>
|
||||
|
||||
Q: What are my other options if I don’t want to depend on the Dockershim?
|
||||
|
||||
A: You can use a runtime like containerd with Kubernetes that does not require Dockershim support. RKE2 or K3s are two options for doing this.
|
||||
|
||||
<br/>
|
||||
|
||||
Q: If I am already using RKE1 and want to switch to RKE2, what are my migration options?
|
||||
|
||||
A: Today, you can stand up a new cluster and migrate workloads to a new RKE2 cluster that uses containerd. Rancher is exploring the possibility of an in-place upgrade path.
|
||||
|
||||
<br/>
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
---
|
||||
title: Installing Docker
|
||||
weight: 1
|
||||
---
|
||||
|
||||
Docker is required to be installed on nodes where the Rancher server will be installed with Helm or Docker.
|
||||
|
||||
There are a couple of options for installing Docker. One option is to refer to the [official Docker documentation](https://docs.docker.com/install/) about how to install Docker on Linux. The steps will vary based on the Linux distribution.
|
||||
|
||||
Another option is to use one of Rancher's Docker installation scripts, which are available for most recent versions of Docker.
|
||||
|
||||
For example, this command could be used to install Docker 20.10 on Ubuntu:
|
||||
|
||||
```
|
||||
curl https://releases.rancher.com/install-docker/20.10.sh | sh
|
||||
```
|
||||
|
||||
Rancher has installation scripts for every version of upstream Docker that Kubernetes supports. To find out whether a script is available for installing a certain Docker version, refer to this [GitHub repository,](https://github.com/rancher/install-docker) which contains all of Rancher's Docker installation scripts.
|
||||
+22
@@ -0,0 +1,22 @@
|
||||
---
|
||||
headless: true
|
||||
---
|
||||
| Protocol | Port | Description |
|
||||
|:--------: |:----------------: |---------------------------------------------------------------------------------- |
|
||||
| TCP | 22 | Node driver SSH provisioning |
|
||||
| TCP | 179 | Calico BGP Port |
|
||||
| TCP | 2376 | Node driver Docker daemon TLS port |
|
||||
| TCP | 2379 | etcd client requests |
|
||||
| TCP | 2380 | etcd peer communication |
|
||||
| UDP | 8472 | Canal/Flannel VXLAN overlay networking |
|
||||
| UDP | 4789 | Flannel VXLAN overlay networking on Windows cluster |
|
||||
| TCP | 8443 | Rancher webhook |
|
||||
| TCP | 9099 | Canal/Flannel livenessProbe/readinessProbe |
|
||||
| TCP | 9100 | Default port required by Monitoring to scrape metrics from Linux node-exporters |
|
||||
| TCP | 9443 | Rancher webhook |
|
||||
| TCP | 9796 | Default port required by Monitoring to scrape metrics from Windows node-exporters |
|
||||
| TCP | 6783 | Weave Port |
|
||||
| UDP | 6783-6784 | Weave UDP Ports |
|
||||
| TCP | 10250 | Metrics server communication with all nodes API |
|
||||
| TCP | 10254 | Ingress controller livenessProbe/readinessProbe |
|
||||
| TCP/UDP | 30000-32767 | NodePort port range |
|
||||
@@ -0,0 +1,333 @@
|
||||
---
|
||||
title: Port Requirements
|
||||
description: Read about port requirements needed in order for Rancher to operate properly, both for Rancher nodes and downstream Kubernetes cluster nodes
|
||||
weight: 300
|
||||
---
|
||||
|
||||
import Tabs from '@theme/Tabs';
|
||||
import TabItem from '@theme/TabItem';
|
||||
|
||||
To operate properly, Rancher requires a number of ports to be open on Rancher nodes and on downstream Kubernetes cluster nodes.
|
||||
|
||||
- [Rancher Nodes](#rancher-nodes)
|
||||
- [Ports for Rancher Server Nodes on K3s](#ports-for-rancher-server-nodes-on-k3s)
|
||||
- [Ports for Rancher Server Nodes on RKE](#ports-for-rancher-server-nodes-on-rke)
|
||||
- [Ports for Rancher Server Nodes on RKE2](#ports-for-rancher-server-nodes-on-rke2)
|
||||
- [Ports for Rancher Server in Docker](#ports-for-rancher-server-in-docker)
|
||||
- [Downstream Kubernetes Cluster Nodes](#downstream-kubernetes-cluster-nodes)
|
||||
- [Ports for Rancher Launched Kubernetes Clusters using Node Pools](#ports-for-rancher-launched-kubernetes-clusters-using-node-pools)
|
||||
- [Ports for Rancher Launched Kubernetes Clusters using Custom Nodes](#ports-for-rancher-launched-kubernetes-clusters-using-custom-nodes)
|
||||
- [Ports for Hosted Kubernetes Clusters](#ports-for-hosted-kubernetes-clusters)
|
||||
- [Ports for Registered Clusters](#ports-for-registered-clusters)
|
||||
- [Other Port Considerations](#other-port-considerations)
|
||||
- [Commonly Used Ports](#commonly-used-ports)
|
||||
- [Local Node Traffic](#local-node-traffic)
|
||||
- [Rancher AWS EC2 Security Group](#rancher-aws-ec2-security-group)
|
||||
- [Opening SUSE Linux Ports](#opening-suse-linux-ports)
|
||||
|
||||
# Rancher Nodes
|
||||
|
||||
The following table lists the ports that need to be open to and from nodes that are running the Rancher server.
|
||||
|
||||
The port requirements differ based on the Rancher server architecture.
|
||||
|
||||
Rancher can be installed on any Kubernetes cluster. For Rancher installs on a K3s, RKE, or RKE2 Kubernetes cluster, refer to the tabs below. For other Kubernetes distributions, refer to the distribution's documentation for the port requirements for cluster nodes.
|
||||
|
||||
> **Notes:**
|
||||
>
|
||||
> - Rancher nodes may also require additional outbound access for any external authentication provider which is configured (LDAP for example).
|
||||
> - Kubernetes recommends TCP 30000-32767 for node port services.
|
||||
> - For firewalls, traffic may need to be enabled within the cluster and pod CIDR.
|
||||
> - Rancher nodes may also need outbound access to an external S3 location which is used for storing cluster backups (Minio for example).
|
||||
|
||||
### Ports for Rancher Server Nodes on K3s
|
||||
|
||||
<details>
|
||||
<summary>Click to expand</summary>
|
||||
|
||||
The K3s server needs port 6443 to be accessible by the nodes.
|
||||
|
||||
The nodes need to be able to reach other nodes over UDP port 8472 when Flannel VXLAN is used. The node should not listen on any other port. K3s uses reverse tunneling such that the nodes make outbound connections to the server and all kubelet traffic runs through that tunnel. However, if you do not use Flannel and provide your own custom CNI, then port 8472 is not needed by K3s.
|
||||
|
||||
If you wish to utilize the metrics server, you will need to open port 10250 on each node.
|
||||
|
||||
> **Important:** The VXLAN port on nodes should not be exposed to the world as it opens up your cluster network to be accessed by anyone. Run your nodes behind a firewall/security group that disables access to port 8472.
|
||||
|
||||
The following tables break down the port requirements for inbound and outbound traffic:
|
||||
|
||||
<figcaption>Inbound Rules for Rancher Server Nodes</figcaption>
|
||||
|
||||
| Protocol | Port | Source | Description
|
||||
|-----|-----|----------------|---|
|
||||
| TCP | 80 | Load balancer/proxy that does external SSL termination | Rancher UI/API when external SSL termination is used |
|
||||
| TCP | 443 | <ul><li>server nodes</li><li>agent nodes</li><li>hosted/registered Kubernetes</li><li>any source that needs to be able to use the Rancher UI or API</li></ul> | Rancher agent, Rancher UI/API, kubectl |
|
||||
| TCP | 6443 | K3s server nodes | Kubernetes API
|
||||
| UDP | 8472 | K3s server and agent nodes | Required only for Flannel VXLAN.
|
||||
| TCP | 10250 | K3s server and agent nodes | kubelet
|
||||
|
||||
<figcaption>Outbound Rules for Rancher Nodes</figcaption>
|
||||
|
||||
| Protocol | Port | Destination | Description |
|
||||
| -------- | ---- | -------------------------------------------------------- | --------------------------------------------- |
|
||||
| TCP | 22 | Any node IP from a node created using Node Driver | SSH provisioning of nodes using Node Driver |
|
||||
| TCP | 443 | git.rancher.io | Rancher catalog |
|
||||
| TCP | 2376 | Any node IP from a node created using Node driver | Docker daemon TLS port used by Docker Machine |
|
||||
| TCP | 6443 | Hosted/Imported Kubernetes API | Kubernetes API server |
|
||||
|
||||
</details>
|
||||
|
||||
### Ports for Rancher Server Nodes on RKE
|
||||
|
||||
<details>
|
||||
<summary>Click to expand</summary>
|
||||
|
||||
Typically Rancher is installed on three RKE nodes that all have the etcd, control plane and worker roles.
|
||||
|
||||
The following tables break down the port requirements for traffic between the Rancher nodes:
|
||||
|
||||
<figcaption>Rules for traffic between Rancher nodes</figcaption>
|
||||
|
||||
| Protocol | Port | Description |
|
||||
|-----|-----|----------------|
|
||||
| TCP | 443 | Rancher agents |
|
||||
| TCP | 2379 | etcd client requests |
|
||||
| TCP | 2380 | etcd peer communication |
|
||||
| TCP | 6443 | Kubernetes apiserver |
|
||||
| TCP | 8443 | Nginx Ingress's Validating Webhook |
|
||||
| UDP | 8472 | Canal/Flannel VXLAN overlay networking |
|
||||
| TCP | 9099 | Canal/Flannel livenessProbe/readinessProbe |
|
||||
| TCP | 10250 | Metrics server communication with all nodes |
|
||||
| TCP | 10254 | Ingress controller livenessProbe/readinessProbe |
|
||||
|
||||
The following tables break down the port requirements for inbound and outbound traffic:
|
||||
|
||||
<figcaption>Inbound Rules for Rancher Nodes</figcaption>
|
||||
|
||||
| Protocol | Port | Source | Description |
|
||||
|-----|-----|----------------|---|
|
||||
| TCP | 22 | RKE CLI | SSH provisioning of node by RKE |
|
||||
| TCP | 80 | Load Balancer/Reverse Proxy | HTTP traffic to Rancher UI/API |
|
||||
| TCP | 443 | <ul><li>Load Balancer/Reverse Proxy</li><li>IPs of all cluster nodes and other API/UI clients</li></ul> | HTTPS traffic to Rancher UI/API |
|
||||
| TCP | 6443 | Kubernetes API clients | HTTPS traffic to Kubernetes API |
|
||||
|
||||
<figcaption>Outbound Rules for Rancher Nodes</figcaption>
|
||||
|
||||
| Protocol | Port | Destination | Description |
|
||||
|-----|-----|----------------|---|
|
||||
| TCP | 443 | `35.160.43.145`,`35.167.242.46`,`52.33.59.17` | Rancher catalog (git.rancher.io) |
|
||||
| TCP | 22 | Any node created using a node driver | SSH provisioning of node by node driver |
|
||||
| TCP | 2376 | Any node created using a node driver | Docker daemon TLS port used by node driver |
|
||||
| TCP | 6443 | Hosted/Imported Kubernetes API | Kubernetes API server |
|
||||
| TCP | Provider dependent | Port of the Kubernetes API endpoint in hosted cluster | Kubernetes API |
|
||||
|
||||
</details>
|
||||
|
||||
### Ports for Rancher Server Nodes on RKE2
|
||||
|
||||
<details>
|
||||
<summary>Click to expand</summary>
|
||||
|
||||
The RKE2 server needs port 6443 and 9345 to be accessible by other nodes in the cluster.
|
||||
|
||||
All nodes need to be able to reach other nodes over UDP port 8472 when Flannel VXLAN is used.
|
||||
|
||||
If you wish to utilize the metrics server, you will need to open port 10250 on each node.
|
||||
|
||||
**Important:** The VXLAN port on nodes should not be exposed to the world as it opens up your cluster network to be accessed by anyone. Run your nodes behind a firewall/security group that disables access to port 8472.
|
||||
|
||||
<figcaption>Inbound Rules for RKE2 Server Nodes</figcaption>
|
||||
|
||||
| Protocol | Port | Source | Description
|
||||
|-----|-----|----------------|---|
|
||||
| TCP | 9345 | RKE2 agent nodes | Kubernetes API
|
||||
| TCP | 6443 | RKE2 agent nodes | Kubernetes API
|
||||
| UDP | 8472 | RKE2 server and agent nodes | Required only for Flannel VXLAN
|
||||
| TCP | 10250 | RKE2 server and agent nodes | kubelet
|
||||
| TCP | 2379 | RKE2 server nodes | etcd client port
|
||||
| TCP | 2380 | RKE2 server nodes | etcd peer port
|
||||
| TCP | 30000-32767 | RKE2 server and agent nodes | NodePort port range
|
||||
| TCP | 5473 | Calico-node pod connecting to typha pod | Required when deploying with Calico
|
||||
| HTTP | 8080 | Load balancer/proxy that does external SSL termination | Rancher UI/API when external SSL termination is used |
|
||||
| HTTPS | 8443 | <ul><li>hosted/registered Kubernetes</li><li>any source that needs to be able to use the Rancher UI or API</li></ul> | Rancher agent, Rancher UI/API, kubectl. Not needed if you have LB doing TLS termination. |
|
||||
|
||||
Typically all outbound traffic is allowed.
|
||||
|
||||
</details>
|
||||
|
||||
### Ports for Rancher Server in Docker
|
||||
|
||||
<details>
|
||||
<summary>Click to expand</summary>
|
||||
|
||||
The following tables break down the port requirements for Rancher nodes, for inbound and outbound traffic:
|
||||
|
||||
<figcaption>Inbound Rules for Rancher Node</figcaption>
|
||||
|
||||
| Protocol | Port | Source | Description
|
||||
|-----|-----|----------------|---|
|
||||
| TCP | 80 | Load balancer/proxy that does external SSL termination | Rancher UI/API when external SSL termination is used
|
||||
| TCP | 443 | <ul><li>hosted/registered Kubernetes</li><li>any source that needs to be able to use the Rancher UI or API</li></ul> | Rancher agent, Rancher UI/API, kubectl
|
||||
|
||||
<figcaption>Outbound Rules for Rancher Node</figcaption>
|
||||
|
||||
| Protocol | Port | Source | Description |
|
||||
|-----|-----|----------------|---|
|
||||
| TCP | 22 | Any node IP from a node created using Node Driver | SSH provisioning of nodes using Node Driver |
|
||||
| TCP | 443 | git.rancher.io | Rancher catalog |
|
||||
| TCP | 2376 | Any node IP from a node created using a node driver | Docker daemon TLS port used by Docker Machine |
|
||||
| TCP | 6443 | Hosted/Imported Kubernetes API | Kubernetes API server |
|
||||
|
||||
</details>
|
||||
|
||||
# Downstream Kubernetes Cluster Nodes
|
||||
|
||||
Downstream Kubernetes clusters run your apps and services. This section describes what ports need to be opened on the nodes in downstream clusters so that Rancher can communicate with them.
|
||||
|
||||
The port requirements differ depending on how the downstream cluster was launched. Each of the tabs below list the ports that need to be opened for different [cluster types]({{<baseurl>}}/rancher/v2.6/en/cluster-provisioning/).
|
||||
|
||||
The following diagram depicts the ports that are opened for each [cluster type]({{<baseurl>}}/rancher/v2.6/en/cluster-provisioning).
|
||||
|
||||
<figcaption>Port Requirements for the Rancher Management Plane</figcaption>
|
||||
|
||||
|
||||
|
||||
>**Tip:**
|
||||
>
|
||||
>If security isn't a large concern and you're okay with opening a few additional ports, you can use the table in [Commonly Used Ports](#commonly-used-ports) as your port reference instead of the comprehensive tables below.
|
||||
|
||||
### Ports for Rancher Launched Kubernetes Clusters using Node Pools
|
||||
|
||||
<details>
|
||||
<summary>Click to expand</summary>
|
||||
|
||||
The following table depicts the port requirements for [Rancher Launched Kubernetes]({{<baseurl>}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/) with nodes created in an [Infrastructure Provider]({{<baseurl>}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/).
|
||||
|
||||
>**Note:**
|
||||
>The required ports are automatically opened by Rancher during creation of clusters in cloud providers like Amazon EC2 or DigitalOcean.
|
||||
|
||||
{{< ports-iaas-nodes >}}
|
||||
|
||||
</details>
|
||||
|
||||
### Ports for Rancher Launched Kubernetes Clusters using Custom Nodes
|
||||
|
||||
<details>
|
||||
<summary>Click to expand</summary>
|
||||
|
||||
The following table depicts the port requirements for [Rancher Launched Kubernetes]({{<baseurl>}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/) with [Custom Nodes]({{<baseurl>}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/custom-nodes/).
|
||||
|
||||
{{< ports-custom-nodes >}}
|
||||
|
||||
</details>
|
||||
|
||||
### Ports for Hosted Kubernetes Clusters
|
||||
|
||||
<details>
|
||||
<summary>Click to expand</summary>
|
||||
|
||||
The following table depicts the port requirements for [hosted clusters]({{<baseurl>}}/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters).
|
||||
|
||||
{{< ports-imported-hosted >}}
|
||||
|
||||
</details>
|
||||
|
||||
### Ports for Registered Clusters
|
||||
|
||||
Note: Registered clusters were called imported clusters before Rancher v2.5.
|
||||
|
||||
<details>
|
||||
<summary>Click to expand</summary>
|
||||
|
||||
The following table depicts the port requirements for [registered clusters]({{<baseurl>}}/rancher/v2.6/en/cluster-provisioning/registered-clusters/).
|
||||
|
||||
{{< ports-imported-hosted >}}
|
||||
|
||||
</details>
|
||||
|
||||
|
||||
# Other Port Considerations
|
||||
|
||||
### Commonly Used Ports
|
||||
|
||||
These ports are typically opened on your Kubernetes nodes, regardless of what type of cluster it is.
|
||||
|
||||
{{% include file="/rancher/v2.6/en/installation/requirements/ports/common-ports-table</summary>
|
||||
|
||||
----
|
||||
|
||||
### Local Node Traffic
|
||||
|
||||
Ports marked as `local traffic` (i.e., `9099 TCP`) in the above requirements are used for Kubernetes healthchecks (`livenessProbe` and`readinessProbe`).
|
||||
These healthchecks are executed on the node itself. In most cloud environments, this local traffic is allowed by default.
|
||||
|
||||
However, this traffic may be blocked when:
|
||||
|
||||
- You have applied strict host firewall policies on the node.
|
||||
- You are using nodes that have multiple interfaces (multihomed).
|
||||
|
||||
In these cases, you have to explicitly allow this traffic in your host firewall, or in case of public/private cloud hosted machines (i.e. AWS or OpenStack), in your security group configuration. Keep in mind that when using a security group as source or destination in your security group, explicitly opening ports only applies to the private interface of the nodes / instances.
|
||||
|
||||
### Rancher AWS EC2 Security Group
|
||||
|
||||
When using the [AWS EC2 node driver]({{<baseurl>}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/ec2/) to provision cluster nodes in Rancher, you can choose to let Rancher create a security group called `rancher-nodes`. The following rules are automatically added to this security group.
|
||||
|
||||
| Type | Protocol | Port Range | Source/Destination | Rule Type |
|
||||
|-----------------|:--------:|:-----------:|------------------------|:---------:|
|
||||
| SSH | TCP | 22 | 0.0.0.0/0 | Inbound |
|
||||
| HTTP | TCP | 80 | 0.0.0.0/0 | Inbound |
|
||||
| Custom TCP Rule | TCP | 443 | 0.0.0.0/0 | Inbound |
|
||||
| Custom TCP Rule | TCP | 2376 | 0.0.0.0/0 | Inbound |
|
||||
| Custom TCP Rule | TCP | 2379-2380 | sg-xxx (rancher-nodes) | Inbound |
|
||||
| Custom UDP Rule | UDP | 4789 | sg-xxx (rancher-nodes) | Inbound |
|
||||
| Custom TCP Rule | TCP | 6443 | 0.0.0.0/0 | Inbound |
|
||||
| Custom UDP Rule | UDP | 8472 | sg-xxx (rancher-nodes) | Inbound |
|
||||
| Custom TCP Rule | TCP | 10250-10252 | sg-xxx (rancher-nodes) | Inbound |
|
||||
| Custom TCP Rule | TCP | 10256 | sg-xxx (rancher-nodes) | Inbound |
|
||||
| Custom TCP Rule | TCP | 30000-32767 | 0.0.0.0/0 | Inbound |
|
||||
| Custom UDP Rule | UDP | 30000-32767 | 0.0.0.0/0 | Inbound |
|
||||
| All traffic | All | All | 0.0.0.0/0 | Outbound |
|
||||
|
||||
### Opening SUSE Linux Ports
|
||||
|
||||
SUSE Linux may have a firewall that blocks all ports by default. To open the ports needed for adding the host to a custom cluster,
|
||||
|
||||
<Tabs>
|
||||
<TabItem value="SLES 15 / openSUSE Leap 15">
|
||||
|
||||
1. SSH into the instance.
|
||||
1. Start YaST in text mode:
|
||||
```
|
||||
sudo yast2
|
||||
```
|
||||
|
||||
1. Navigate to **Security and Users** > **Firewall** > **Zones:public** > **Ports**. To navigate within the interface, follow the instructions [here](https://doc.opensuse.org/documentation/leap/reference/html/book.opensuse.reference/cha-yast-text.html#sec-yast-cli-navigate).
|
||||
1. To open the required ports, enter them into the **TCP Ports** and **UDP Ports** fields. In this example, ports 9796 and 10250 are also opened for monitoring. The resulting fields should look similar to the following:
|
||||
```yaml
|
||||
TCP Ports
|
||||
22, 80, 443, 2376, 2379, 2380, 6443, 9099, 9796, 10250, 10254, 30000-32767
|
||||
UDP Ports
|
||||
8472, 30000-32767
|
||||
```
|
||||
|
||||
1. When all required ports are enter, select **Accept**.
|
||||
|
||||
|
||||
</TabItem>
|
||||
<TabItem value="SLES 12 / openSUSE Leap 42">
|
||||
|
||||
1. SSH into the instance.
|
||||
1. Edit /`etc/sysconfig/SuSEfirewall2` and open the required ports. In this example, ports 9796 and 10250 are also opened for monitoring:
|
||||
```
|
||||
FW_SERVICES_EXT_TCP="22 80 443 2376 2379 2380 6443 9099 9796 10250 10254 30000:32767"
|
||||
FW_SERVICES_EXT_UDP="8472 30000:32767"
|
||||
FW_ROUTE=yes
|
||||
```
|
||||
1. Restart the firewall with the new ports:
|
||||
```
|
||||
SuSEfirewall2
|
||||
```
|
||||
|
||||
</TabItem>
|
||||
</Tabs>
|
||||
|
||||
**Result:** The node has the open ports required to be added to a custom cluster.
|
||||
@@ -0,0 +1,179 @@
|
||||
---
|
||||
title: Installation Requirements
|
||||
description: Learn the node requirements for each node running Rancher server when you’re configuring Rancher to run either in a Docker or Kubernetes setup
|
||||
weight: 1
|
||||
---
|
||||
|
||||
This page describes the software, hardware, and networking requirements for the nodes where the Rancher server will be installed. The Rancher server can be installed on a single node or a high-availability Kubernetes cluster.
|
||||
|
||||
> It is important to note that if you install Rancher on a Kubernetes cluster, requirements are different from the [node requirements for downstream user clusters,]({{<baseurl>}}/rancher/v2.6/en/cluster-provisioning/node-requirements/) which will run your apps and services.
|
||||
|
||||
Make sure the node(s) for the Rancher server fulfill the following requirements:
|
||||
|
||||
- [Operating Systems and Container Runtime Requirements](#operating-systems-and-container-runtime-requirements)
|
||||
- [RKE Specific Requirements](#rke-specific-requirements)
|
||||
- [K3s Specific Requirements](#k3s-specific-requirements)
|
||||
- [RKE2 Specific Requirements](#rke2-specific-requirements)
|
||||
- [Installing Docker](#installing-docker)
|
||||
- [Hardware Requirements](#hardware-requirements)
|
||||
- [CPU and Memory](#cpu-and-memory)
|
||||
- [RKE and Hosted Kubernetes](#rke-and-hosted-kubernetes)
|
||||
- [K3s Kubernetes](#k3s-kubernetes)
|
||||
- [RKE2 Kubernetes](#rke2-kubernetes)
|
||||
- [Docker](#docker)
|
||||
- [Ingress](#ingress)
|
||||
- [Ingress for RKE2](#ingress-for-rke2)
|
||||
- [Ingress for EKS](#ingress-for-eks)
|
||||
- [Disks](#disks)
|
||||
- [Networking Requirements](#networking-requirements)
|
||||
- [Node IP Addresses](#node-ip-addresses)
|
||||
- [Port Requirements](#port-requirements)
|
||||
- [Dockershim Support](#dockershim-support)
|
||||
|
||||
For a list of best practices that we recommend for running the Rancher server in production, refer to the [best practices section.]({{<baseurl>}}/rancher/v2.6/en/best-practices/rancher-server/deployment-types/)
|
||||
|
||||
The Rancher UI works best in Firefox or Chrome.
|
||||
|
||||
# Operating Systems and Container Runtime Requirements
|
||||
|
||||
Rancher should work with any modern Linux distribution.
|
||||
|
||||
Docker is required for nodes that will run RKE Kubernetes clusters. It is not required for Kubernetes installs.
|
||||
|
||||
Rancher needs to be installed on a supported Kubernetes version. To find out which versions of Kubernetes are supported for your Rancher version, refer to the [support maintenance terms.](https://rancher.com/support-maintenance-terms/)
|
||||
|
||||
For details on which OS and Docker versions were tested with each Rancher version, refer to the [support maintenance terms.](https://rancher.com/support-maintenance-terms/)
|
||||
|
||||
All supported operating systems are 64-bit x86.
|
||||
|
||||
The `ntp` (Network Time Protocol) package should be installed. This prevents errors with certificate validation that can occur when the time is not synchronized between the client and server.
|
||||
|
||||
Some distributions of Linux may have default firewall rules that block communication with Helm. We recommend disabling firewalld. For Kubernetes v1.19, v1.20 and v1.21, firewalld must be turned off.
|
||||
|
||||
If you don't feel comfortable doing so you might check suggestions in the [respective issue](https://github.com/rancher/rancher/issues/28840). Some users were successful [creating a separate firewalld zone with a policy of ACCEPT for the Pod CIDR](https://github.com/rancher/rancher/issues/28840#issuecomment-787404822).
|
||||
|
||||
If you plan to run Rancher on ARM64, see [Running on ARM64 (Experimental).]({{<baseurl>}}/rancher/v2.6/en/installation/resources/advanced/arm64-platform/)
|
||||
|
||||
### RKE Specific Requirements
|
||||
|
||||
For the container runtime, RKE should work with any modern Docker version.
|
||||
|
||||
Note that the following sysctl setting must be applied:
|
||||
|
||||
```
|
||||
net.bridge.bridge-nf-call-iptables=1
|
||||
```
|
||||
|
||||
### K3s Specific Requirements
|
||||
|
||||
For the container runtime, K3s should work with any modern version of Docker or containerd.
|
||||
|
||||
Rancher needs to be installed on a supported Kubernetes version. To find out which versions of Kubernetes are supported for your Rancher version, refer to the [support maintenance terms.](https://rancher.com/support-maintenance-terms/) To specify the K3s version, use the INSTALL_K3S_VERSION environment variable when running the K3s installation script.
|
||||
|
||||
If you are installing Rancher on a K3s cluster with **Raspbian Buster**, follow [these steps]({{<baseurl>}}/k3s/latest/en/advanced/#enabling-legacy-iptables-on-raspbian-buster) to switch to legacy iptables.
|
||||
|
||||
If you are installing Rancher on a K3s cluster with Alpine Linux, follow [these steps]({{<baseurl>}}/k3s/latest/en/advanced/#additional-preparation-for-alpine-linux-setup) for additional setup.
|
||||
|
||||
|
||||
|
||||
### RKE2 Specific Requirements
|
||||
|
||||
For details on which OS versions were tested with RKE2, refer to the [support maintenance terms.](https://rancher.com/support-maintenance-terms/)
|
||||
|
||||
Docker is not required for RKE2 installs.
|
||||
|
||||
### Installing Docker
|
||||
|
||||
Docker is required for Helm chart installs, and it can be installed by following the steps in the official [Docker documentation.](https://docs.docker.com/) Rancher also provides [scripts]({{<baseurl>}}/rancher/v2.6/en/installation/requirements/installing-docker) to install Docker with one command.
|
||||
|
||||
# Hardware Requirements
|
||||
|
||||
The following sections describe the CPU, memory, and disk requirements for the nodes where the Rancher server is installed.
|
||||
|
||||
# CPU and Memory
|
||||
|
||||
Hardware requirements scale based on the size of your Rancher deployment. Provision each individual node according to the requirements. The requirements are different depending on if you are installing Rancher in a single container with Docker, or if you are installing Rancher on a Kubernetes cluster.
|
||||
|
||||
### RKE and Hosted Kubernetes
|
||||
|
||||
These CPU and memory requirements apply to each host in the Kubernetes cluster where the Rancher server is installed.
|
||||
|
||||
These requirements apply to RKE Kubernetes clusters, as well as to hosted Kubernetes clusters such as EKS.
|
||||
|
||||
| Deployment Size | Clusters | Nodes | vCPUs | RAM |
|
||||
| --------------- | ---------- | ------------ | -------| ------- |
|
||||
| Small | Up to 150 | Up to 1500 | 2 | 8 GB |
|
||||
| Medium | Up to 300 | Up to 3000 | 4 | 16 GB |
|
||||
| Large | Up to 500 | Up to 5000 | 8 | 32 GB |
|
||||
| X-Large | Up to 1000 | Up to 10,000 | 16 | 64 GB |
|
||||
| XX-Large | Up to 2000 | Up to 20,000 | 32 | 128 GB |
|
||||
|
||||
Every use case and environment is different. Please [contact Rancher](https://rancher.com/contact/) to review yours.
|
||||
|
||||
### K3s Kubernetes
|
||||
|
||||
These CPU and memory requirements apply to each host in a [K3s Kubernetes cluster where the Rancher server is installed.]({{<baseurl>}}/rancher/v2.6/en/installation/install-rancher-on-k8s/)
|
||||
|
||||
| Deployment Size | Clusters | Nodes | vCPUs | RAM | Database Size |
|
||||
| --------------- | ---------- | ------------ | -------| ---------| ------------------------- |
|
||||
| Small | Up to 150 | Up to 1500 | 2 | 8 GB | 2 cores, 4 GB + 1000 IOPS |
|
||||
| Medium | Up to 300 | Up to 3000 | 4 | 16 GB | 2 cores, 4 GB + 1000 IOPS |
|
||||
| Large | Up to 500 | Up to 5000 | 8 | 32 GB | 2 cores, 4 GB + 1000 IOPS |
|
||||
| X-Large | Up to 1000 | Up to 10,000 | 16 | 64 GB | 2 cores, 4 GB + 1000 IOPS |
|
||||
| XX-Large | Up to 2000 | Up to 20,000 | 32 | 128 GB | 2 cores, 4 GB + 1000 IOPS |
|
||||
|
||||
Every use case and environment is different. Please [contact Rancher](https://rancher.com/contact/) to review yours.
|
||||
|
||||
|
||||
### RKE2 Kubernetes
|
||||
|
||||
These CPU and memory requirements apply to each instance with RKE2 installed. Minimum recommendations are outlined here.
|
||||
|
||||
| Deployment Size | Clusters | Nodes | vCPUs | RAM |
|
||||
| --------------- | -------- | --------- | ----- | ---- |
|
||||
| Small | Up to 5 | Up to 50 | 2 | 5 GB |
|
||||
| Medium | Up to 15 | Up to 200 | 3 | 9 GB |
|
||||
|
||||
### Docker
|
||||
|
||||
These CPU and memory requirements apply to a host with a [single-node]({{<baseurl>}}/rancher/v2.6/en/installation/other-installation-methods/single-node-docker) installation of Rancher.
|
||||
|
||||
| Deployment Size | Clusters | Nodes | vCPUs | RAM |
|
||||
| --------------- | -------- | --------- | ----- | ---- |
|
||||
| Small | Up to 5 | Up to 50 | 1 | 4 GB |
|
||||
| Medium | Up to 15 | Up to 200 | 2 | 8 GB |
|
||||
|
||||
# Ingress
|
||||
|
||||
Each node in the Kubernetes cluster that Rancher is installed on should run an Ingress.
|
||||
|
||||
The Ingress should be deployed as DaemonSet to ensure your load balancer can successfully route traffic to all nodes.
|
||||
|
||||
For RKE and K3s installations, you don't have to install the Ingress manually because it is installed by default.
|
||||
|
||||
For hosted Kubernetes clusters (EKS, GKE, AKS) and RKE2 Kubernetes installations, you will need to set up the ingress.
|
||||
|
||||
### Ingress for EKS
|
||||
For an example of how to deploy an nginx-ingress-controller with a LoadBalancer service, refer to [this section.]({{<baseurl>}}/rancher/v2.6/en/installation/install-rancher-on-k8s/amazon-eks/#5-install-an-ingress)
|
||||
|
||||
# Disks
|
||||
|
||||
Rancher performance depends on etcd in the cluster performance. To ensure optimal speed, we recommend always using SSD disks to back your Rancher management Kubernetes cluster. On cloud providers, you will also want to use the minimum size that allows the maximum IOPS. In larger clusters, consider using dedicated storage devices for etcd data and wal directories.
|
||||
|
||||
# Networking Requirements
|
||||
|
||||
This section describes the networking requirements for the node(s) where the Rancher server is installed.
|
||||
|
||||
> If a server containing Rancher has the `X-Frame-Options=DENY` header, some pages in the new Rancher UI will not be able to render after upgrading from the legacy UI. This is because some legacy pages are embedded as iFrames in the new UI.
|
||||
|
||||
### Node IP Addresses
|
||||
|
||||
Each node used should have a static IP configured, regardless of whether you are installing Rancher on a single node or on an HA cluster. In case of DHCP, each node should have a DHCP reservation to make sure the node gets the same IP allocated.
|
||||
|
||||
### Port Requirements
|
||||
|
||||
To operate properly, Rancher requires a number of ports to be open on Rancher nodes and on downstream Kubernetes cluster nodes. [Port Requirements]({{<baseurl>}}/rancher/v2.6/en/installation/requirements/ports) lists all the necessary ports for Rancher and Downstream Clusters for the different cluster types.
|
||||
|
||||
# Dockershim Support
|
||||
|
||||
For more information on Dockershim support, refer to [this page]({{<baseurl>}}/rancher/v2.6/en/installation/requirements/dockershim/).
|
||||
Reference in New Issue
Block a user