public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-26 13:08:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update the namespace exception list at multiple places (#926)

Browse Source
This commit is contained in:
Jiaqi Luo
2023-10-18 12:30:02 -07:00
committed by GitHub
parent 59ccda44d6
commit 0940a22d46
12 changed files with 102 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml
+3 -1
View File
@@ -17,6 +17,7 @@ plugins:
- cattle-system - cattle-system
- cattle-epinio-system - cattle-epinio-system
- cattle-fleet-system - cattle-fleet-system
- cattle-fleet-local-system
- longhorn-system - longhorn-system
- cattle-neuvector-system - cattle-neuvector-system
- cattle-monitoring-system - cattle-monitoring-system
@@ -32,6 +33,7 @@ plugins:
- cattle-sriov-system - cattle-sriov-system
- cattle-ui-plugin-system - cattle-ui-plugin-system
- tigera-operator - tigera-operator
- cattle-provisioning-capi-system
kind: PodSecurityConfiguration kind: PodSecurityConfiguration
name: PodSecurity name: PodSecurity
path: "" path: ""
docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md
+4 -1
View File
@@ -85,12 +85,13 @@ Any user that is bound to the above permission will be able to change the restri
## Exempting Required Rancher Namespaces ## Exempting Required Rancher Namespaces
When you run Rancher on a Kubernetes cluster that enforces a restrictive security policy by default, you'll need to [exempt the following namespaces](#exempting-namespaces), otherwise the policy might prevent Rancher system pods from running properly. When you run Rancher on a Kubernetes cluster that enforces a restrictive security policy by default, you'll need to [exempt the following namespaces](#exempting-namespaces), otherwise the policy might prevent Rancher system pods from running properly.
- `calico-apiserver` - `calico-apiserver`
- `calico-system` - `calico-system`
- `cattle-alerting` - `cattle-alerting`
- `cattle-csp-adapter-system` - `cattle-csp-adapter-system`
- `cattle-elemental-system`
- `cattle-epinio-system` - `cattle-epinio-system`
- `cattle-externalip-system` - `cattle-externalip-system`
- `cattle-fleet-local-system` - `cattle-fleet-local-system`
@@ -106,6 +107,8 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit
- `cattle-monitoring-system` - `cattle-monitoring-system`
- `cattle-neuvector-system` - `cattle-neuvector-system`
- `cattle-prometheus` - `cattle-prometheus`
- `cattle-provisioning-capi-system`
- `cattle-resources-system`
- `cattle-sriov-system` - `cattle-sriov-system`
- `cattle-system` - `cattle-system`
- `cattle-ui-plugin-system` - `cattle-ui-plugin-system`
docs/pages-for-subheaders/installation-requirements.md
+4
View File
@@ -23,6 +23,10 @@ See our page on [best practices](../reference-guides/best-practices/rancher-serv
Rancher needs to be installed on a supported Kubernetes version. Consult the [Rancher support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions) to ensure that your intended version of Kubernetes is supported. Rancher needs to be installed on a supported Kubernetes version. Consult the [Rancher support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions) to ensure that your intended version of Kubernetes is supported.
### Install Rancher on a Hardened Kubernetes cluster
If you install Rancher on a hardened Kubernetes cluster, check the [Exempting Required Rancher Namespaces](../../../docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md#exempting-required-rancher-namespaces) section for detailed requirements.
## Operating Systems and Container Runtime Requirements ## Operating Systems and Container Runtime Requirements
All supported operating systems are 64-bit x86. Rancher should work with any modern Linux distribution. All supported operating systems are 64-bit x86. Rancher should work with any modern Linux distribution.
docs/pages-for-subheaders/rke1-hardening-guide.md
+38 -35
View File
@@ -209,41 +209,44 @@ services:
exemptions: exemptions:
usernames: [] usernames: []
runtimeClasses: [] runtimeClasses: []
namespaces: [ calico-apiserver, namespaces: [calico-apiserver,
calico-system, calico-system,
cattle-alerting, cattle-alerting,
cattle-csp-adapter-system, cattle-csp-adapter-system,
cattle-epinio-system, cattle-elemental-system,
cattle-externalip-system, cattle-epinio-system,
cattle-fleet-local-system, cattle-externalip-system,
cattle-fleet-system, cattle-fleet-local-system,
cattle-gatekeeper-system, cattle-fleet-system,
cattle-global-data, cattle-gatekeeper-system,
cattle-global-nt, cattle-global-data,
cattle-impersonation-system, cattle-global-nt,
cattle-istio, cattle-impersonation-system,
cattle-istio-system, cattle-istio,
cattle-logging, cattle-istio-system,
cattle-logging-system, cattle-logging,
cattle-monitoring-system, cattle-logging-system,
cattle-neuvector-system, cattle-monitoring-system,
cattle-prometheus, cattle-neuvector-system,
cattle-sriov-system, cattle-prometheus,
cattle-system, cattle-provisioning-capi-system,
cattle-ui-plugin-system, cattle-resources-system,
cattle-windows-gmsa-system, cattle-sriov-system,
cert-manager, cattle-system,
cis-operator-system, cattle-ui-plugin-system,
fleet-default, cattle-windows-gmsa-system,
ingress-nginx, cert-manager,
istio-system, cis-operator-system,
kube-node-lease, fleet-default,
kube-public, ingress-nginx,
kube-system, istio-system,
longhorn-system, kube-node-lease,
rancher-alerting-drivers, kube-public,
security-scan, kube-system,
tigera-operator ] longhorn-system,
rancher-alerting-drivers,
security-scan,
tigera-operator]
kube-controller: kube-controller:
extra_args: extra_args:
feature-gates: RotateKubeletServerCertificate=true feature-gates: RotateKubeletServerCertificate=true
docs/reference-guides/rancher-security/psa-restricted-exemptions.md
+1
View File
@@ -46,6 +46,7 @@ plugins:
cattle-monitoring-system, cattle-monitoring-system,
cattle-neuvector-system, cattle-neuvector-system,
cattle-prometheus, cattle-prometheus,
cattle-provisioning-capi-system,
cattle-resources-system, cattle-resources-system,
cattle-sriov-system, cattle-sriov-system,
cattle-system, cattle-system,
sidebars.js
+1 -1
View File
@@ -57,7 +57,7 @@ const sidebars = {
"getting-started/quick-start-guides/deploy-rancher-manager/prime", "getting-started/quick-start-guides/deploy-rancher-manager/prime",
{ {
type: 'category', type: 'category',
label: 'Deploy Rancher Workloads', label: 'Deploy Workloads',
link: { link: {
type: 'doc', type: 'doc',
id: "pages-for-subheaders/deploy-rancher-workloads", id: "pages-for-subheaders/deploy-rancher-workloads",
versioned_docs/version-2.7/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml
+3 -1
View File
@@ -17,6 +17,7 @@ plugins:
- cattle-system - cattle-system
- cattle-epinio-system - cattle-epinio-system
- cattle-fleet-system - cattle-fleet-system
- cattle-fleet-local-system
- longhorn-system - longhorn-system
- cattle-neuvector-system - cattle-neuvector-system
- cattle-monitoring-system - cattle-monitoring-system
@@ -32,6 +33,7 @@ plugins:
- cattle-sriov-system - cattle-sriov-system
- cattle-ui-plugin-system - cattle-ui-plugin-system
- tigera-operator - tigera-operator
- cattle-provisioning-capi-system
kind: PodSecurityConfiguration kind: PodSecurityConfiguration
name: PodSecurity name: PodSecurity
path: "" path: ""
versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md
+4 -1
View File
@@ -85,12 +85,13 @@ Any user that is bound to the above permission will be able to change the restri
## Exempting Required Rancher Namespaces ## Exempting Required Rancher Namespaces
When you run Rancher on a Kubernetes cluster that enforces a restrictive security policy by default, you'll need to [exempt the following namespaces](#exempting-namespaces), otherwise the policy might prevent Rancher system pods from running properly. When you run Rancher on a Kubernetes cluster that enforces a restrictive security policy by default, you'll need to [exempt the following namespaces](#exempting-namespaces), otherwise the policy might prevent Rancher system pods from running properly.
- `calico-apiserver` - `calico-apiserver`
- `calico-system` - `calico-system`
- `cattle-alerting` - `cattle-alerting`
- `cattle-csp-adapter-system` - `cattle-csp-adapter-system`
- `cattle-elemental-system`
- `cattle-epinio-system` - `cattle-epinio-system`
- `cattle-externalip-system` - `cattle-externalip-system`
- `cattle-fleet-local-system` - `cattle-fleet-local-system`
@@ -106,6 +107,8 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit
- `cattle-monitoring-system` - `cattle-monitoring-system`
- `cattle-neuvector-system` - `cattle-neuvector-system`
- `cattle-prometheus` - `cattle-prometheus`
- `cattle-provisioning-capi-system`
- `cattle-resources-system`
- `cattle-sriov-system` - `cattle-sriov-system`
- `cattle-system` - `cattle-system`
- `cattle-ui-plugin-system` - `cattle-ui-plugin-system`
versioned_docs/version-2.7/pages-for-subheaders/installation-requirements.md
+4
View File
@@ -23,6 +23,10 @@ See our page on [best practices](../reference-guides/best-practices/rancher-serv
Rancher needs to be installed on a supported Kubernetes version. Consult the [Rancher support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions) to ensure that your intended version of Kubernetes is supported. Rancher needs to be installed on a supported Kubernetes version. Consult the [Rancher support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions) to ensure that your intended version of Kubernetes is supported.
### Install Rancher on a Hardened Kubernetes cluster
If you install Rancher on a hardened Kubernetes cluster, check the [Exempting Required Rancher Namespaces](../../../docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md#exempting-required-rancher-namespaces) section for detailed requirements.
## Operating Systems and Container Runtime Requirements ## Operating Systems and Container Runtime Requirements
All supported operating systems are 64-bit x86. Rancher should work with any modern Linux distribution. All supported operating systems are 64-bit x86. Rancher should work with any modern Linux distribution.
versioned_docs/version-2.7/pages-for-subheaders/rke1-hardening-guide.md
+38 -35
View File
@@ -209,41 +209,44 @@ services:
exemptions: exemptions:
usernames: [] usernames: []
runtimeClasses: [] runtimeClasses: []
namespaces: [ calico-apiserver, namespaces: [calico-apiserver,
calico-system, calico-system,
cattle-alerting, cattle-alerting,
cattle-csp-adapter-system, cattle-csp-adapter-system,
cattle-epinio-system, cattle-elemental-system,
cattle-externalip-system, cattle-epinio-system,
cattle-fleet-local-system, cattle-externalip-system,
cattle-fleet-system, cattle-fleet-local-system,
cattle-gatekeeper-system, cattle-fleet-system,
cattle-global-data, cattle-gatekeeper-system,
cattle-global-nt, cattle-global-data,
cattle-impersonation-system, cattle-global-nt,
cattle-istio, cattle-impersonation-system,
cattle-istio-system, cattle-istio,
cattle-logging, cattle-istio-system,
cattle-logging-system, cattle-logging,
cattle-monitoring-system, cattle-logging-system,
cattle-neuvector-system, cattle-monitoring-system,
cattle-prometheus, cattle-neuvector-system,
cattle-sriov-system, cattle-prometheus,
cattle-system, cattle-provisioning-capi-system,
cattle-ui-plugin-system, cattle-resources-system,
cattle-windows-gmsa-system, cattle-sriov-system,
cert-manager, cattle-system,
cis-operator-system, cattle-ui-plugin-system,
fleet-default, cattle-windows-gmsa-system,
ingress-nginx, cert-manager,
istio-system, cis-operator-system,
kube-node-lease, fleet-default,
kube-public, ingress-nginx,
kube-system, istio-system,
longhorn-system, kube-node-lease,
rancher-alerting-drivers, kube-public,
security-scan, kube-system,
tigera-operator ] longhorn-system,
rancher-alerting-drivers,
security-scan,
tigera-operator]
kube-controller: kube-controller:
extra_args: extra_args:
feature-gates: RotateKubeletServerCertificate=true feature-gates: RotateKubeletServerCertificate=true
versioned_docs/version-2.7/reference-guides/rancher-security/psa-restricted-exemptions.md
+1
View File
@@ -46,6 +46,7 @@ plugins:
cattle-monitoring-system, cattle-monitoring-system,
cattle-neuvector-system, cattle-neuvector-system,
cattle-prometheus, cattle-prometheus,
cattle-provisioning-capi-system,
cattle-resources-system, cattle-resources-system,
cattle-sriov-system, cattle-sriov-system,
cattle-system, cattle-system,
versioned_sidebars/version-2.7-sidebars.json
+1 -1
View File
@@ -37,7 +37,7 @@
"getting-started/quick-start-guides/deploy-rancher-manager/prime", "getting-started/quick-start-guides/deploy-rancher-manager/prime",
{ {
"type": "category", "type": "category",
"label": "Deploy Rancher Workloads", "label": "Deploy Workloads",
"link": { "link": {
"type": "doc", "type": "doc",
"id": "pages-for-subheaders/deploy-rancher-workloads" "id": "pages-for-subheaders/deploy-rancher-workloads"