Merge remote-tracking branch 'upstream/main' into main-to-release/v2.7.2

2026-09-28 05:59:03 +00:00 · 2023-03-08 10:44:35 -08:00
parent cf9222b1ad 3c50c59e49
commit 17a240fb7b
164 changed files with 2708 additions and 1604 deletions
@@ -165,11 +165,23 @@ You'll also need to manually enter the Graph, Token, and Auth Endpoints.
 To complete configuration, enter information about your AD instance in the Rancher UI.

 1. Log into Rancher.
-1. In the upper left corner of the toolbar, click **☰ > Users & Authentication**.
-1. In the nav menu, click **Auth Provider**.
+
+1. In the top left corner, click **☰ > Users & Authentication**.
+
+1. In the left navigation menu, click **Auth Provider**.
+
 1. Click **AzureAD**.
+
 1. Complete the **Configure Azure AD Account** form using the information you copied while completing [Copy Azure Application Data](#4-copy-azure-application-data).

+    :::caution
+
+    The Azure AD account will be granted administrator privileges, since its details will be mapped to the Rancher local principal account. Make sure that this level of privilege is appropriate before you continue.
+
+    :::
+
+    **For Standard or China Endpoints:**
+
    The following table maps the values you copied in the Azure portal to the fields in Rancher:

    | Rancher Field      | Azure Value                           |
@@ -179,20 +191,19 @@ To complete configuration, enter information about your AD instance in the Ranch
    | Application Secret | Key Value                             |
    | Endpoint           | https://login.microsoftonline.com/    |

+    **For Custom Endpoints:**

-**For Custom Endpoints:**
+    The following table maps your custom config values to Rancher fields:

-The following table maps the custom config values you copied in the Azure portal to the fields in Rancher:
+    | Rancher Field      | Azure Value                           |
+    | ------------------ | ------------------------------------- |
+    | Graph Endpoint     | Microsoft Graph API Endpoint          |
+    | Token Endpoint     | OAuth 2.0 Token Endpoint              |
+    | Auth Endpoint      | OAuth 2.0 Authorization Endpoint      |

-| Rancher Field      | Azure Value                           |
-| ------------------ | ------------------------------------- |
-| Graph Endpoint     | Microsoft Graph API Endpoint          |
-| Token Endpoint     | OAuth 2.0 Token Endpoint              |
-| Auth Endpoint      | OAuth 2.0 Authorization Endpoint      |
+    **Important:** When entering the Graph Endpoint in a custom config, remove the tenant ID from the URL:

-**Important:** When entering the Graph Endpoint in a custom config, remove the tenant ID from the URL, like below:
-
-<code>http<span>s://g</span>raph.microsoft.com<del>/abb5adde-bee8-4821-8b03-e63efdc7701c</del></code>
+    <code>http<span>s://g</span>raph.microsoft.com<del>/abb5adde-bee8-4821-8b03-e63efdc7701c</del></code>

 1. Click **Enable**.

@@ -201,8 +212,8 @@ The following table maps the custom config values you copied in the Azure portal

 ### Migrating from Azure AD Graph API to Microsoft Graph API

-Since the [Azure AD Graph API](https://docs.microsoft.com/en-us/graph/migrate-azure-ad-graph-overview) is deprecated and slated to retire in June 2023, admins should update their Azure AD App to use the [Microsoft Graph API](https://docs.microsoft.com/en-us/graph/use-the-api) in Rancher. 
-This needs to be done well in advance of the endpoint being retired. 
+Since the [Azure AD Graph API](https://docs.microsoft.com/en-us/graph/migrate-azure-ad-graph-overview) is deprecated and slated to retire in June 2023, admins should update their Azure AD App to use the [Microsoft Graph API](https://docs.microsoft.com/en-us/graph/use-the-api) in Rancher.
+This needs to be done well in advance of the endpoint being retired.
 If Rancher is still configured to use the Azure AD Graph API when it is retired, users may not be able to log into Rancher using Azure AD.

 #### Updating Endpoints in the Rancher UI
@@ -9,7 +9,7 @@ For Kubernetes v1.21 and up, the NGINX Ingress controller no longer runs in host

 Because of this change to the controller, the default behavior no longer sets `hostNetwork` to `true`. However, you must set `hostNetwork` to `true` for TCP- and UDP-based Services to work.

-:::note
+:::

 ## Specify a hostname to use

@@ -63,6 +63,8 @@ Before v2.6, secrets were required to be in a project scope. Projects are no lon

 **Result:** Your secret is added to the individual project you chose. You can view the secret in the Rancher UI by clicking either **Storage > Secrets** or **More Resources > Core > Secrets**.

+Since project-scoped secrets are set at the project level, any changes made at the namespace level will be overwritten.
+
 :::note

 Project-scoped secrets on the local cluster are only visible when a single project is selected.
@@ -8,6 +8,7 @@ The following table lists the permissions required for the vSphere user account:

 | Privilege Group       | Operations  |
 |:----------------------|:-----------------------------------------------------------------------|
+| Cns Privileges        | Searchable |
 | Datastore             | AllocateSpace <br/> Browse <br/> FileManagement (Low level file operations) <br/> UpdateVirtualMachineFiles <br/> UpdateVirtualMachineMetadata |
 | Global                | Set custom attribute |
 | Network               | Assign |
@@ -20,8 +20,8 @@ The following steps can also be performed using the `kubectl` command line tool.
 :::

 1. Click **☰ > Cluster Management**.
-1. Go to the cluster where you want to provide vSphere storage.
-1. In the left navigation bar, click **Storage > StorageClasses**.
+1. Choose the cluster you want to provide vSphere storage to and click **Exlpore**. 
+1. In the left navigation bar, select **Storage > StorageClasses**.
 1. Click **Create**.
 3. Enter a **Name** for the StorageClass.
 4. Under **Provisioner**, select **VMWare vSphere Volume**.