Syncing with main

Signed-off-by: Sunil Singh <sunil.singh@suse.com>
2026-11-10 18:50:45 +00:00 · 2024-11-07 12:51:04 -08:00
1 parent 3b847a904f
commit 1584fa9cfc
@@ -188,7 +188,3 @@ openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout myservice.ke

 * 检查你的 Keycloak 日志。
 * 如果日志显示 `request validation failed: org.keycloak.common.VerificationException: SigAlg was null`，请在 Keycloak 客户端中将 `Client Signature Required` 设为 `OFF`。
-
-## Configuring SAML Single Logout (SLO)
-
-<ConfigureSLO />
@@ -105,7 +105,3 @@ OpenLDAP ServiceAccount 用于所有搜索。无论用户个人的 SAML 权限
 1. 在**用户和组搜索**下，选中**配置 OpenLDAP Server**。

 如果你在测试与 OpenLDAP Server 的连接时遇到问题，请确保你输入了ServiceAccount 的凭证并正确配置了搜索库。你可以检查 Rancher 日志来查明根本原因。调试日志可能包含有关错误的更详细信息。请参阅[如何启用调试日志](../../../../faq/technical-items.md#如何启用调试日志记录)了解更多信息。
-
-## Configuring SAML Single Logout (SLO)
-
-<ConfigureSLO />
@@ -60,7 +60,3 @@ title: 配置 PingIdentity (SAML)
 - 用户组下拉列表仅显示你所属的用户组。如果你不是某个组的成员，你将无法添加该组。

 :::
-
-## Configuring SAML Single Logout (SLO)
-
-<ConfigureSLO />
@@ -51,7 +51,3 @@ title: 2. 在 Rancher 中配置 Microsoft AD FS
 ```
 openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
 ```
-
-## Configuring SAML Single Logout (SLO)
-
-<ConfigureSLO />
@@ -76,10 +76,6 @@ SAML 协议不支持用户或用户组的搜索或查找。因此，如果你没

 要在 Rancher 中分配权限时启用搜索组，你需要为 SAML 身份认证服务配置支持组的后端（例如 OpenLDAP）。

-### Configuring SAML Single Logout (SLO)
-
-<ConfigureSLO />
-
 # 在 Rancher 中设置 OpenLDAP

 如果你将 OpenLDAP 配置为 Shibboleth 的后端，SAML 断言会返回到 Rancher，其中包括用于引用组的用户属性。然后，通过认证的用户将能够访问其所在的组有权访问的 Rancher 资源。
@@ -0,0 +1,19 @@
+---
+title: Best Practices for Disconnected Clusters
+---
+
+<head>
+  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/reference-guides/best-practices/disconnected-clusters"/>
+</head>
+
+Rancher supports managing clusters that may not always be online due to network disruptions, control plane availability, or because all cluster nodes are down. At the moment there are no known issues with disconnected clusters in the latest released Rancher version.
+
+While a managed cluster is disconnected from Rancher, management operations will be unavailable, and the Rancher UI will not allow navigation to the cluster. However, once the connection is reestablished, functionality is fully restored.
+
+### Best Practices for Managing Disconnected Clusters
+
+- **Cluster Availability During Rancher Upgrades**: It is recommended to have all, or at least most, managed clusters online during a Rancher upgrade. The reason is that upgrading Rancher automatically upgrades the Rancher agent software running on managed clusters. Keeping the agent and Rancher versions aligned ensures consistent functionality. Any clusters that are disconnected during the upgrade will have their agents updated as soon as they reconnect.
+
+- **Cleaning Up Disconnected Clusters**: Regularly remove clusters that will no longer reconnect to Rancher (e.g., clusters that have been decommissioned or destroyed). Keeping such clusters in the Rancher management system consumes unnecessary resources, which could impact Rancher's performance over time.
+
+- **Certificate Rotation Considerations**: When designing processes that involve regularly shutting down clusters, whether connected to Rancher or not, take into account certificate rotation policies. For example, RKE/RKE2/K3s clusters may rotate certificates on startup if they exceeded their lifetime.
@@ -14,6 +14,10 @@ title: Rancher 管理集群的最佳实践

 配置合理的监控和告警规则对于安全、可靠地运行生产环境中的工作负载至关重要。有关更多建议，请参阅[最佳实践](monitoring-best-practices.md)。

+### Disconnected clusters
+
+Rancher supports managing clusters that may not always be online due to network disruptions, control plane availability, or because all cluster nodes are down. Refer to this [guide](disconnected-clusters.md) for our recommendations.
+
 ## 设置容器的技巧

 配置良好的容器可以极大地提高环境的整体性能和安全性。有关容器设置的建议，请参见[设置容器的技巧](tips-to-set-up-containers.md)。