diff --git a/content/rancher/v2.5/en/security/rancher-2.5/1.6-hardening-2.5/_index.md b/content/rancher/v2.5/en/security/rancher-2.5/1.6-hardening-2.5/_index.md index 3836853aa37..0b6497f2e1f 100644 --- a/content/rancher/v2.5/en/security/rancher-2.5/1.6-hardening-2.5/_index.md +++ b/content/rancher/v2.5/en/security/rancher-2.5/1.6-hardening-2.5/_index.md @@ -28,7 +28,7 @@ For more detail about evaluating a hardened cluster against the official CIS ben - Rancher **exec shell** and **view logs** for pods are **not** functional in a CIS 1.6 hardened setup when only public IP is provided when registering custom nodes. This functionality requires a private IP to be provided when registering the custom nodes. - When setting the `default_pod_security_policy_template_id:` to `restricted` Rancher creates **RoleBindings** and **ClusterRoleBindings** on the default service accounts. The CIS 1.6 5.1.5 check requires the default service accounts have no roles or cluster roles bound to it apart from the defaults. In addition the default service accounts should be configured such that it does not provide a service account token and does not have any explicit rights assignments. -Migration Rancher from 2.4 to 2.5. Addons were removed in HG 2.5, and therefore namespaces on migration may be not created on the downstream clusters. Pod may fail to run because of missing namesapce like ingress-nginx, cattlae-system. +Migration Rancher from 2.4 to 2.5. Addons were removed in HG 2.5, and therefore namespaces on migration may be not created on the downstream clusters. Pod may fail to run because of missing namesapce like ingress-nginx, cattle-system. ### Configure Kernel Runtime Parameters diff --git a/content/rancher/v2.6/en/admin-settings/drivers/_index.md b/content/rancher/v2.6/en/admin-settings/drivers/_index.md index 6cea6387a33..32d05779257 100644 --- a/content/rancher/v2.6/en/admin-settings/drivers/_index.md +++ b/content/rancher/v2.6/en/admin-settings/drivers/_index.md @@ -42,3 +42,7 @@ Rancher supports several major cloud providers, but by default, these node drive * [Azure]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/azure/) * [Digital Ocean]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/digital-ocean/) * [vSphere]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/vsphere/) + +There are several other node drivers that are disabled by default, but are packaged in Rancher: + +* [Harvester]({{}}/rancher/v2.6/en/virtualization-admin/#harvester-node-driver/), available in Rancher v2.6.1 diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/cloud-providers/azure/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/cloud-providers/azure/_index.md index fe893c7f701..3bd7d676fd8 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/cloud-providers/azure/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/cloud-providers/azure/_index.md @@ -16,7 +16,9 @@ The following account types are not supported for Azure Subscriptions: - Single tenant accounts (i.e. accounts with no subscriptions). - Multi-subscription accounts. -To set up the Azure cloud provider following credentials need to be configured: +# Prerequisites for RKE and RKE2 + +To set up the Azure cloud provider for both RKE and RKE2, the following credentials need to be configured: 1. [Set up the Azure Tenant ID](#1-set-up-the-azure-tenant-id) 2. [Set up the Azure Client ID and Azure Client Secret](#2-set-up-the-azure-client-id-and-azure-client-secret) @@ -67,4 +69,42 @@ If you provision hosts using Rancher Machine Azure driver, you will need to edit You should already assign custom hosts to this Network Security Group during provisioning. -Only hosts expected to be load balancer back ends need to be in this group. \ No newline at end of file +Only hosts expected to be load balancer back ends need to be in this group. + +# RKE2 Cluster Set-up in Rancher + +1. Choose "Azure" from the Cloud Provider drop-down in the Cluster Configuration section. + +1. * Supply the Cloud Provider Configuration. Note that Rancher will automatically create a new Network Security Group, Resource Group, Availability Set, Subnet, and Virtual Network. If you already have some or all of these created, you will need to specify them before creating the cluster. + * You can click on "Show Advanced" to see more of these automatically generated names and update them if + necessary. Your Cloud Provider Configuration **must** match the fields in the Machine Pools section. If you have multiple pools, they must all use the same Resource Group, Availability Set, Subnet, Virtual Network, and Network Security Group. + * An example is provided below. You will modify it as needed. + + {{% accordion id="v2.6.0-cloud-provider-config-file" label="Example Cloud Provider Config" %}} + +```yaml +{ + "cloud":"AzurePublicCloud", + "tenantId": "YOUR TENANTID HERE", + "aadClientId": "YOUR AADCLIENTID HERE", + "aadClientSecret": "YOUR AADCLIENTSECRET HERE", + "subscriptionId": "YOUR SUBSCRIPTIONID HERE", + "resourceGroup": "docker-machine", + "location": "westus", + "subnetName": "docker-machine", + "securityGroupName": "rancher-managed-KA4jV9V2", + "securityGroupResourceGroup": "docker-machine", + "vnetName": "docker-machine-vnet", + "vnetResourceGroup": "docker-machine", + "primaryAvailabilitySetName": "docker-machine", + "routeTableResourceGroup": "docker-machine", + "cloudProviderBackoff": false, + "useManagedIdentityExtension": false, + "useInstanceMetadata": true +} +``` + {{% /accordion %}} + +1. Under the **Cluster Configuration > Advanced** section, click **Add** under **Additional Controller Manager Args** and add this flag: `--configure-cloud-routes=false` + +1. Click the **Create** button to submit the form and create the cluster. diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/options/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/options/_index.md index f3f6d2f7b44..fa55f4c6be3 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/options/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/options/_index.md @@ -1,6 +1,6 @@ --- title: RKE Cluster Configuration -weight: 2250 +weight: 2300 --- This page has moved [here.]({{}}/rancher/v2.6/en/cluster-admin/editing-clusters/rke-config-reference) diff --git a/content/rancher/v2.6/en/installation/resources/feature-flags/_index.md b/content/rancher/v2.6/en/installation/resources/feature-flags/_index.md index 66ee3756515..a3fac147dad 100644 --- a/content/rancher/v2.6/en/installation/resources/feature-flags/_index.md +++ b/content/rancher/v2.6/en/installation/resources/feature-flags/_index.md @@ -25,6 +25,8 @@ For example, if you install Rancher, then set a feature flag to true with the Ra The following is a list of the feature flags available in Rancher: +- `harvester`: This feature flag is available starting in v2.6.1. It is used to manage access to the Virtualization Management page where users can navigate directly to Harvester clusters and access the Harvester UI. For more information, see [this page]({{}}/rancher/v2.6/en/virtualization-admin/#feature-flag/). +- `rke2`: We have introduced the ability to provision RKE2 clusters as tech preview. By default, this feature flag is enabled, which allows users to attempt to provision these type of clusters. - `fleet`: The previous `fleet` feature flag is now required to be enabled as the Fleet capabilities are leveraged within the new provisioning framework. If you had this feature flag disabled in earlier versions, upon upgrading to Rancher v2.6, the flag will automatically be enabled. See this [page]({{}}/rancher/v2.6/en/deploy-across-clusters/fleet) for more information. - `continuous-delivery`: In Rancher v2.5.x, Fleet came with a GitOps feature that could not be disabled separately from Fleet. In Rancher v2.6, the `continuous-delivery` feature flag was introduced to allow the GitOps feature of Fleet to be disabled. For more information, see [this page.](./continuous-delivery). - `legacy`: There are a set of features from previous versions that are slowly being phased out of Rancher for newer iterations of the feature. This is a mix of deprecated features as well as features that will eventually be moved to newer variations in Rancher. By default, this feature flag is disabled for new installations. If you are upgrading from a previous version, this feature flag would be enabled. @@ -46,6 +48,8 @@ The below table shows the availability and default value for feature flags in Ra | `token-hashing` | `false` for new installs, `true` for upgrades | GA* | v2.6.0 | | | `legacy` | `false` for new installs, `true` for upgrades | GA* | v2.6.0 | | | `multi-cluster-management` | `false` | GA* | v2.5.0 | | +| `harvester` | `true` | Experimental | v2.6.1 | | +| `rke2` | `true` | Experimental | v2.6.0 | | \* Generally Available. This feature is included in Rancher and it is not experimental. diff --git a/content/rancher/v2.6/en/security/rancher-2.5/1.6-hardening-2.5/_index.md b/content/rancher/v2.6/en/security/rancher-2.5/1.6-hardening-2.5/_index.md index 92567b208a8..78f2763e57c 100644 --- a/content/rancher/v2.6/en/security/rancher-2.5/1.6-hardening-2.5/_index.md +++ b/content/rancher/v2.6/en/security/rancher-2.5/1.6-hardening-2.5/_index.md @@ -26,7 +26,7 @@ For more detail about evaluating a hardened cluster against the official CIS ben - Rancher **exec shell** and **view logs** for pods are **not** functional in a CIS 1.6 hardened setup when only public IP is provided when registering custom nodes. This functionality requires a private IP to be provided when registering the custom nodes. - When setting the `default_pod_security_policy_template_id:` to `restricted` Rancher creates **RoleBindings** and **ClusterRoleBindings** on the default service accounts. The CIS 1.6 5.1.5 check requires the default service accounts have no roles or cluster roles bound to it apart from the defaults. In addition the default service accounts should be configured such that it does not provide a service account token and does not have any explicit rights assignments. -Migration Rancher from 2.4 to 2.5. Addons were removed in HG 2.5, and therefore namespaces on migration may be not created on the downstream clusters. Pod may fail to run because of missing namesapce like ingress-nginx, cattlae-system. +Migration Rancher from 2.4 to 2.5. Addons were removed in HG 2.5, and therefore namespaces on migration may be not created on the downstream clusters. Pod may fail to run because of missing namesapce like ingress-nginx, cattle-system. ### Configure Kernel Runtime Parameters diff --git a/content/rancher/v2.6/en/virtualization-admin/_index.md b/content/rancher/v2.6/en/virtualization-admin/_index.md new file mode 100644 index 00000000000..f37ffb8b951 --- /dev/null +++ b/content/rancher/v2.6/en/virtualization-admin/_index.md @@ -0,0 +1,33 @@ +--- +title: Harvester Integration +weight: 10 +--- + +##### _Tech Preview_ + +New in Rancher v2.6.1, [Harvester v0.3.0](https://docs.harvesterhci.io/v0.3/) is an open-source hyper-converged infrastructure (HCI) software built on Kubernetes. Harvester installs on bare metal server clusters and provides integrated virtualization and distributed storage capabilities. Although Harvester operates using Kubernetes, it does not require users to know Kubernetes concepts, making it a more user-friendly application. + +### Feature Flag + +The Harvester feature flag is used to manage access to the Virtualization Management (VM) page in Rancher where users can navigate directly to Harvester clusters and access the Harvester UI. The Harvester feature flag is enabled by default. Click [here]({{}}/rancher/v2.6/en/installation/resources/feature-flags/) for more information on feature flags in Rancher. + +To navigate to the Harvester cluster, click **☰ > Virtualization Management**. From Harvester Clusters page, click one of the clusters listed to go to the single Harvester cluster view. + +* If the Harvester feature flag is enabled, Harvester clusters will be filtered out from any pages or apps (such as Fleet and the multi-cluster app) that list Kubernetes clusters. + +* If the Harvester feature flag is disabled, and a Harvester cluster is imported, the Harvester cluster will be shown in the Rancher cluster list in the Cluster Management page. Harvester clusters will only be shown on the cluster list when the feature flag is off. + +* With the Harvester integration, Harvester clusters can now be imported into Rancher as a cluster type `Harvester`. + +* Users may import a Harvester cluster only on the Virtualization Management page. Importing a cluster on the Cluster Management page is not supported, and a warning will advise you to return to the VM page to do so. + +### Harvester Node Driver + +The [Harvester node driver](https://docs.harvesterhci.io/v0.3/rancher/node-driver/) is marked as `tech preview` on RKE and RKE2 options in Rancher. This will be the case both on the Create page and once the driver is already enabled. The node driver is available whether or not the Harvester feature flag is enabled. Note that the node driver is off by default. Users may create RKE or RKE2 clusters on Harvester only from the Cluster Management page. + +Click [here]({{}}/rancher/v2.6/en/admin-settings/drivers/#node-drivers) for more information on node drivers in Rancher. + +### Limitations + +* Harvester v0.3.0 doesn't support air gap environment installation. +* Harvester v0.3.0 doesn't support upgrade from v0.2.0 nor upgrade to future v1.0.0. \ No newline at end of file