From 26cbe52761cff571eb00866a552b466f6993a9e1 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Fri, 18 Jul 2025 13:32:02 -0700 Subject: [PATCH] rm upgrade-a-hardened-cluster-to-k8s-v1-25 page for v2.9+ Rancher v2.8 is last version with v1.25 support --- ...upgrade-a-hardened-cluster-to-k8s-v1-25.md | 72 ------------------- ...upgrade-a-hardened-cluster-to-k8s-v1-25.md | 68 ------------------ ...upgrade-a-hardened-cluster-to-k8s-v1-25.md | 68 ------------------ ...upgrade-a-hardened-cluster-to-k8s-v1-25.md | 68 ------------------ ...upgrade-a-hardened-cluster-to-k8s-v1-25.md | 68 ------------------ ...upgrade-a-hardened-cluster-to-k8s-v1-25.md | 68 ------------------ sidebars.js | 1 - ...upgrade-a-hardened-cluster-to-k8s-v1-25.md | 72 ------------------- ...upgrade-a-hardened-cluster-to-k8s-v1-25.md | 72 ------------------- ...upgrade-a-hardened-cluster-to-k8s-v1-25.md | 72 ------------------- ...upgrade-a-hardened-cluster-to-k8s-v1-25.md | 72 ------------------- versioned_sidebars/version-2.10-sidebars.json | 1 - versioned_sidebars/version-2.11-sidebars.json | 1 - versioned_sidebars/version-2.12-sidebars.json | 1 - versioned_sidebars/version-2.9-sidebars.json | 1 - 15 files changed, 705 deletions(-) delete mode 100644 docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md delete mode 100644 i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md delete mode 100644 i18n/zh/docusaurus-plugin-content-docs/version-2.10/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md delete mode 100644 i18n/zh/docusaurus-plugin-content-docs/version-2.11/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md delete mode 100644 i18n/zh/docusaurus-plugin-content-docs/version-2.12/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md delete mode 100644 i18n/zh/docusaurus-plugin-content-docs/version-2.9/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md delete mode 100644 versioned_docs/version-2.10/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md delete mode 100644 versioned_docs/version-2.11/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md delete mode 100644 versioned_docs/version-2.12/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md delete mode 100644 versioned_docs/version-2.9/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md diff --git a/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md b/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md deleted file mode 100644 index 0f571b68353..00000000000 --- a/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: Upgrading a Hardened Custom/Imported Cluster to Kubernetes v1.25 ---- - - - - - -Kubernetes v1.25 changes how clusters describe and implement security policies. From this version forward, [Pod Security Policies (PSPs)](https://kubernetes.io/docs/concepts/security/pod-security-policy/) are no longer available. Kubernetes v1.25 replaces them with new security objects: [Pod Security Standards (PSS)](https://kubernetes.io/docs/concepts/security/pod-security-standards/), and [Pod Security Admissions (PSAs)](https://kubernetes.io/docs/concepts/security/pod-security-admission/). - -If you have custom or imported hardened clusters, you must take special preparations to ensure that the upgrade from an earlier version of Kubernetes to v1.25 or later goes smoothly. - -:::note - -After you upgrade to v1.25, add the necessary Rancher namespace exemptions. See [Pod Security Admission (PSA) Configuration Templates](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md#exempting-required-rancher-namespaces) for more details. - -::: - -## Upgrading Imported Hardened Clusters to Kubernetes v1.25 or Later - - - - -Perform the following on each node in the cluster: -1. Save [`rancher-psact.yaml`](./rancher-psact.yaml) in `/etc/rancher/rke2`. -1. Edit the RKE2 configuration file: - 1. Update the `profile` field to `cis-1.23`. - 1. Specify the path for the configuration file that you just added: `pod-security-admission-config-file: /etc/rancher/rke2/rancher-psact.yaml`. - - - - -Perform the following on each node in the cluster: - -Follow the official K3s instructions on [Upgrading Hardened Clusters from v1.24.x to v1.25.x](https://docs.k3s.io/known-issues#hardened-125), but use a [custom](./rancher-psact.yaml) Rancher PSA configuration template, instead of the configuration provided on the official K3s site. - - - -After you perform these steps, you can upgrade the cluster's Kubernetes version through the Rancher UI: - -1. In the upper left corner, click **☰ > Cluster Management**. -1. Find the cluster you want to update in the **Clusters** table, and click the **⋮**. -1. Select **Edit Config**. -1. In the **Kubernetes Version** dropdown menu, select the version that you would like to use. -1. Click **Save**. - -## Upgrading Custom Hardened Clusters to Kubernetes v1.25 or Later - - - - -1. In the upper left corner, click **☰ > Cluster Management**. -1. Find the cluster you want to update in the **Clusters** table, and click the **⋮**. -1. Select **Edit Config**. -1. Under **Basics > Security**, in the **CIS Profile** dropdown menu, select `cis-1.23`. -1. In the **Pod Security Admission Configuration Template** dropdown menu, select `rancher-restricted`. -1. In the **Kubernetes Version** dropdown menu, select the version that you would like to use. -1. Click **Save**. - - - - -1. In the upper left corner, click **☰ > Cluster Management**. -1. Find the cluster you want to update in the **Clusters** table, and click the **⋮**. -1. Select **Edit YAML**. -1. Delete `PodSecurityPolicy` from `kube-apiserver-arg.enable-admission-plugins` -1. Add this line to the `spec` field: `defaultPodSecurityAdmissionConfigurationTemplateName: rancher-restricted` -1. Update `kubernetesVersion` to your chosen version (v1.25 or later). -1. Click **Save**. - - - diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md b/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md deleted file mode 100644 index f55a95063b5..00000000000 --- a/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: 将加固的自定义/导入集群升级到 Kubernetes v1.25 ---- - -Kubernetes v1.25 改变了集群描述和执行安全策略的方式。从这个版本开始，[Pod 安全策略 (PSP)](https://kubernetes.io/docs/concepts/security/pod-security-policy/)不再可用。Kubernetes v1.25 将它们替换为新的安全对象：[Pod 安全标准 (PSS)](https://kubernetes.io/docs/concepts/security/pod-security-standards/) 和 [Pod 安全准入 (PSA)](https://kubernetes.io/docs/concepts/security/pod-security-admission/)。 - -如果你具有自定义或导入的加固集群，你需要做好准备，确保将旧版本的 Kubernetes 顺利升级到 v1.25 或更高版本。 - -:::note - -升级到 v1.25 后，添加必要的 Rancher 命名空间豁免。有关详细信息，请参阅 [Pod 安全准入 (PSA) 配置模板](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md#豁免必须的-rancher-命名空间)。 - -::: - -## 将导入的加固集群升级到 Kubernetes v1.25 或更高版本 - - - - -在集群中的每个节点上执行以下操作： -1. 将 [`rancher-psact.yaml`](./rancher-psact.yaml) 保存到 `/etc/rancher/rke2` 中。 -1. 编辑 RKE2 配置文件： - 1. 将 `profile` 字段更新为 `cis-1.23`。 - 1. 指定刚才添加的配置文件的路径：`pod-security-admission-config-file: /etc/rancher/rke2/rancher-psact.yaml`。 - - - - -在集群中的每个节点上执行以下操作： - -遵循 K3s [将加固集群从 v1.24.x 升级到 v1.25.x](https://docs.k3s.io/known-issues#hardened-125)的官方说明，但使用[自定义](./rancher-psact.yaml)Rancher PSA 配置模板，而不是 K3s 官方网站上提供的配置。 - - - -执行这些步骤后，你可以通过 Rancher UI 升级集群的 Kubernetes 版本： - -1. 在左上角，单击 **☰ > 集群管理**。 -1. 在**集群**表中找到要更新的集群，点击 **⋮**。 -1. 选择**编辑配置**。 -1. 在 **Kubernetes 版本**下拉菜单中，选择要使用的版本。 -1. 单击**保存**。 - -## 将自定义加固集群升级到 Kubernetes v1.25 或更高版本 - - - - -1. 在左上角，单击 **☰ > 集群管理**。 -1. 在**集群**表中找到要更新的集群，点击 **⋮**。 -1. 选择**编辑配置**。 -1. 在**基本信息 > 安全**下的 **CIS 配置文件**下拉菜单中，选择 `cis-1.23`。 -1. 在 **PSA 配置模板**下拉菜单中，选择 `rancher-restricted`。 -1. 在 **Kubernetes 版本**下拉菜单中，选择要使用的版本。 -1. 单击**保存**。 - - - - -1. 在左上角，单击 **☰ > 集群管理**。 -1. 在**集群**表中找到要更新的集群，点击 **⋮**。 -1. 选择**编辑 YAML**。 -1. 从 `kube-apiserver-arg.enable-admission-plugins` 中删除 `PodSecurityPolicy`。 -1. 在 `spec` 字段中，添加一行：`defaultPodSecurityAdmissionConfigurationTemplateName: rancher-restricted` -1. 将 `kubernetesVersion` 更新为你选择的版本（v1.25 或更高版本）。 -1. 单击**保存**。 - - - diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md deleted file mode 100644 index f55a95063b5..00000000000 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: 将加固的自定义/导入集群升级到 Kubernetes v1.25 ---- - -Kubernetes v1.25 改变了集群描述和执行安全策略的方式。从这个版本开始，[Pod 安全策略 (PSP)](https://kubernetes.io/docs/concepts/security/pod-security-policy/)不再可用。Kubernetes v1.25 将它们替换为新的安全对象：[Pod 安全标准 (PSS)](https://kubernetes.io/docs/concepts/security/pod-security-standards/) 和 [Pod 安全准入 (PSA)](https://kubernetes.io/docs/concepts/security/pod-security-admission/)。 - -如果你具有自定义或导入的加固集群，你需要做好准备，确保将旧版本的 Kubernetes 顺利升级到 v1.25 或更高版本。 - -:::note - -升级到 v1.25 后，添加必要的 Rancher 命名空间豁免。有关详细信息，请参阅 [Pod 安全准入 (PSA) 配置模板](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md#豁免必须的-rancher-命名空间)。 - -::: - -## 将导入的加固集群升级到 Kubernetes v1.25 或更高版本 - - - - -在集群中的每个节点上执行以下操作： -1. 将 [`rancher-psact.yaml`](./rancher-psact.yaml) 保存到 `/etc/rancher/rke2` 中。 -1. 编辑 RKE2 配置文件： - 1. 将 `profile` 字段更新为 `cis-1.23`。 - 1. 指定刚才添加的配置文件的路径：`pod-security-admission-config-file: /etc/rancher/rke2/rancher-psact.yaml`。 - - - - -在集群中的每个节点上执行以下操作： - -遵循 K3s [将加固集群从 v1.24.x 升级到 v1.25.x](https://docs.k3s.io/known-issues#hardened-125)的官方说明，但使用[自定义](./rancher-psact.yaml)Rancher PSA 配置模板，而不是 K3s 官方网站上提供的配置。 - - - -执行这些步骤后，你可以通过 Rancher UI 升级集群的 Kubernetes 版本： - -1. 在左上角，单击 **☰ > 集群管理**。 -1. 在**集群**表中找到要更新的集群，点击 **⋮**。 -1. 选择**编辑配置**。 -1. 在 **Kubernetes 版本**下拉菜单中，选择要使用的版本。 -1. 单击**保存**。 - -## 将自定义加固集群升级到 Kubernetes v1.25 或更高版本 - - - - -1. 在左上角，单击 **☰ > 集群管理**。 -1. 在**集群**表中找到要更新的集群，点击 **⋮**。 -1. 选择**编辑配置**。 -1. 在**基本信息 > 安全**下的 **CIS 配置文件**下拉菜单中，选择 `cis-1.23`。 -1. 在 **PSA 配置模板**下拉菜单中，选择 `rancher-restricted`。 -1. 在 **Kubernetes 版本**下拉菜单中，选择要使用的版本。 -1. 单击**保存**。 - - - - -1. 在左上角，单击 **☰ > 集群管理**。 -1. 在**集群**表中找到要更新的集群，点击 **⋮**。 -1. 选择**编辑 YAML**。 -1. 从 `kube-apiserver-arg.enable-admission-plugins` 中删除 `PodSecurityPolicy`。 -1. 在 `spec` 字段中，添加一行：`defaultPodSecurityAdmissionConfigurationTemplateName: rancher-restricted` -1. 将 `kubernetesVersion` 更新为你选择的版本（v1.25 或更高版本）。 -1. 单击**保存**。 - - - diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md deleted file mode 100644 index f55a95063b5..00000000000 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: 将加固的自定义/导入集群升级到 Kubernetes v1.25 ---- - -Kubernetes v1.25 改变了集群描述和执行安全策略的方式。从这个版本开始，[Pod 安全策略 (PSP)](https://kubernetes.io/docs/concepts/security/pod-security-policy/)不再可用。Kubernetes v1.25 将它们替换为新的安全对象：[Pod 安全标准 (PSS)](https://kubernetes.io/docs/concepts/security/pod-security-standards/) 和 [Pod 安全准入 (PSA)](https://kubernetes.io/docs/concepts/security/pod-security-admission/)。 - -如果你具有自定义或导入的加固集群，你需要做好准备，确保将旧版本的 Kubernetes 顺利升级到 v1.25 或更高版本。 - -:::note - -升级到 v1.25 后，添加必要的 Rancher 命名空间豁免。有关详细信息，请参阅 [Pod 安全准入 (PSA) 配置模板](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md#豁免必须的-rancher-命名空间)。 - -::: - -## 将导入的加固集群升级到 Kubernetes v1.25 或更高版本 - - - - -在集群中的每个节点上执行以下操作： -1. 将 [`rancher-psact.yaml`](./rancher-psact.yaml) 保存到 `/etc/rancher/rke2` 中。 -1. 编辑 RKE2 配置文件： - 1. 将 `profile` 字段更新为 `cis-1.23`。 - 1. 指定刚才添加的配置文件的路径：`pod-security-admission-config-file: /etc/rancher/rke2/rancher-psact.yaml`。 - - - - -在集群中的每个节点上执行以下操作： - -遵循 K3s [将加固集群从 v1.24.x 升级到 v1.25.x](https://docs.k3s.io/known-issues#hardened-125)的官方说明，但使用[自定义](./rancher-psact.yaml)Rancher PSA 配置模板，而不是 K3s 官方网站上提供的配置。 - - - -执行这些步骤后，你可以通过 Rancher UI 升级集群的 Kubernetes 版本： - -1. 在左上角，单击 **☰ > 集群管理**。 -1. 在**集群**表中找到要更新的集群，点击 **⋮**。 -1. 选择**编辑配置**。 -1. 在 **Kubernetes 版本**下拉菜单中，选择要使用的版本。 -1. 单击**保存**。 - -## 将自定义加固集群升级到 Kubernetes v1.25 或更高版本 - - - - -1. 在左上角，单击 **☰ > 集群管理**。 -1. 在**集群**表中找到要更新的集群，点击 **⋮**。 -1. 选择**编辑配置**。 -1. 在**基本信息 > 安全**下的 **CIS 配置文件**下拉菜单中，选择 `cis-1.23`。 -1. 在 **PSA 配置模板**下拉菜单中，选择 `rancher-restricted`。 -1. 在 **Kubernetes 版本**下拉菜单中，选择要使用的版本。 -1. 单击**保存**。 - - - - -1. 在左上角，单击 **☰ > 集群管理**。 -1. 在**集群**表中找到要更新的集群，点击 **⋮**。 -1. 选择**编辑 YAML**。 -1. 从 `kube-apiserver-arg.enable-admission-plugins` 中删除 `PodSecurityPolicy`。 -1. 在 `spec` 字段中，添加一行：`defaultPodSecurityAdmissionConfigurationTemplateName: rancher-restricted` -1. 将 `kubernetesVersion` 更新为你选择的版本（v1.25 或更高版本）。 -1. 单击**保存**。 - - - diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.12/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.12/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md deleted file mode 100644 index f55a95063b5..00000000000 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.12/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: 将加固的自定义/导入集群升级到 Kubernetes v1.25 ---- - -Kubernetes v1.25 改变了集群描述和执行安全策略的方式。从这个版本开始，[Pod 安全策略 (PSP)](https://kubernetes.io/docs/concepts/security/pod-security-policy/)不再可用。Kubernetes v1.25 将它们替换为新的安全对象：[Pod 安全标准 (PSS)](https://kubernetes.io/docs/concepts/security/pod-security-standards/) 和 [Pod 安全准入 (PSA)](https://kubernetes.io/docs/concepts/security/pod-security-admission/)。 - -如果你具有自定义或导入的加固集群，你需要做好准备，确保将旧版本的 Kubernetes 顺利升级到 v1.25 或更高版本。 - -:::note - -升级到 v1.25 后，添加必要的 Rancher 命名空间豁免。有关详细信息，请参阅 [Pod 安全准入 (PSA) 配置模板](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md#豁免必须的-rancher-命名空间)。 - -::: - -## 将导入的加固集群升级到 Kubernetes v1.25 或更高版本 - - - - -在集群中的每个节点上执行以下操作： -1. 将 [`rancher-psact.yaml`](./rancher-psact.yaml) 保存到 `/etc/rancher/rke2` 中。 -1. 编辑 RKE2 配置文件： - 1. 将 `profile` 字段更新为 `cis-1.23`。 - 1. 指定刚才添加的配置文件的路径：`pod-security-admission-config-file: /etc/rancher/rke2/rancher-psact.yaml`。 - - - - -在集群中的每个节点上执行以下操作： - -遵循 K3s [将加固集群从 v1.24.x 升级到 v1.25.x](https://docs.k3s.io/known-issues#hardened-125)的官方说明，但使用[自定义](./rancher-psact.yaml)Rancher PSA 配置模板，而不是 K3s 官方网站上提供的配置。 - - - -执行这些步骤后，你可以通过 Rancher UI 升级集群的 Kubernetes 版本： - -1. 在左上角，单击 **☰ > 集群管理**。 -1. 在**集群**表中找到要更新的集群，点击 **⋮**。 -1. 选择**编辑配置**。 -1. 在 **Kubernetes 版本**下拉菜单中，选择要使用的版本。 -1. 单击**保存**。 - -## 将自定义加固集群升级到 Kubernetes v1.25 或更高版本 - - - - -1. 在左上角，单击 **☰ > 集群管理**。 -1. 在**集群**表中找到要更新的集群，点击 **⋮**。 -1. 选择**编辑配置**。 -1. 在**基本信息 > 安全**下的 **CIS 配置文件**下拉菜单中，选择 `cis-1.23`。 -1. 在 **PSA 配置模板**下拉菜单中，选择 `rancher-restricted`。 -1. 在 **Kubernetes 版本**下拉菜单中，选择要使用的版本。 -1. 单击**保存**。 - - - - -1. 在左上角，单击 **☰ > 集群管理**。 -1. 在**集群**表中找到要更新的集群，点击 **⋮**。 -1. 选择**编辑 YAML**。 -1. 从 `kube-apiserver-arg.enable-admission-plugins` 中删除 `PodSecurityPolicy`。 -1. 在 `spec` 字段中，添加一行：`defaultPodSecurityAdmissionConfigurationTemplateName: rancher-restricted` -1. 将 `kubernetesVersion` 更新为你选择的版本（v1.25 或更高版本）。 -1. 单击**保存**。 - - - diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md deleted file mode 100644 index f55a95063b5..00000000000 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: 将加固的自定义/导入集群升级到 Kubernetes v1.25 ---- - -Kubernetes v1.25 改变了集群描述和执行安全策略的方式。从这个版本开始，[Pod 安全策略 (PSP)](https://kubernetes.io/docs/concepts/security/pod-security-policy/)不再可用。Kubernetes v1.25 将它们替换为新的安全对象：[Pod 安全标准 (PSS)](https://kubernetes.io/docs/concepts/security/pod-security-standards/) 和 [Pod 安全准入 (PSA)](https://kubernetes.io/docs/concepts/security/pod-security-admission/)。 - -如果你具有自定义或导入的加固集群，你需要做好准备，确保将旧版本的 Kubernetes 顺利升级到 v1.25 或更高版本。 - -:::note - -升级到 v1.25 后，添加必要的 Rancher 命名空间豁免。有关详细信息，请参阅 [Pod 安全准入 (PSA) 配置模板](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md#豁免必须的-rancher-命名空间)。 - -::: - -## 将导入的加固集群升级到 Kubernetes v1.25 或更高版本 - - - - -在集群中的每个节点上执行以下操作： -1. 将 [`rancher-psact.yaml`](./rancher-psact.yaml) 保存到 `/etc/rancher/rke2` 中。 -1. 编辑 RKE2 配置文件： - 1. 将 `profile` 字段更新为 `cis-1.23`。 - 1. 指定刚才添加的配置文件的路径：`pod-security-admission-config-file: /etc/rancher/rke2/rancher-psact.yaml`。 - - - - -在集群中的每个节点上执行以下操作： - -遵循 K3s [将加固集群从 v1.24.x 升级到 v1.25.x](https://docs.k3s.io/known-issues#hardened-125)的官方说明，但使用[自定义](./rancher-psact.yaml)Rancher PSA 配置模板，而不是 K3s 官方网站上提供的配置。 - - - -执行这些步骤后，你可以通过 Rancher UI 升级集群的 Kubernetes 版本： - -1. 在左上角，单击 **☰ > 集群管理**。 -1. 在**集群**表中找到要更新的集群，点击 **⋮**。 -1. 选择**编辑配置**。 -1. 在 **Kubernetes 版本**下拉菜单中，选择要使用的版本。 -1. 单击**保存**。 - -## 将自定义加固集群升级到 Kubernetes v1.25 或更高版本 - - - - -1. 在左上角，单击 **☰ > 集群管理**。 -1. 在**集群**表中找到要更新的集群，点击 **⋮**。 -1. 选择**编辑配置**。 -1. 在**基本信息 > 安全**下的 **CIS 配置文件**下拉菜单中，选择 `cis-1.23`。 -1. 在 **PSA 配置模板**下拉菜单中，选择 `rancher-restricted`。 -1. 在 **Kubernetes 版本**下拉菜单中，选择要使用的版本。 -1. 单击**保存**。 - - - - -1. 在左上角，单击 **☰ > 集群管理**。 -1. 在**集群**表中找到要更新的集群，点击 **⋮**。 -1. 选择**编辑 YAML**。 -1. 从 `kube-apiserver-arg.enable-admission-plugins` 中删除 `PodSecurityPolicy`。 -1. 在 `spec` 字段中，添加一行：`defaultPodSecurityAdmissionConfigurationTemplateName: rancher-restricted` -1. 将 `kubernetesVersion` 更新为你选择的版本（v1.25 或更高版本）。 -1. 单击**保存**。 - - - diff --git a/sidebars.js b/sidebars.js index 27803bd51df..5a0c2f80d89 100644 --- a/sidebars.js +++ b/sidebars.js @@ -118,7 +118,6 @@ const sidebars = { "getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks", "getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks", "getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke", - "getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25", "getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/troubleshooting", ] }, diff --git a/versioned_docs/version-2.10/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md b/versioned_docs/version-2.10/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md deleted file mode 100644 index 0f571b68353..00000000000 --- a/versioned_docs/version-2.10/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: Upgrading a Hardened Custom/Imported Cluster to Kubernetes v1.25 ---- - - - - - -Kubernetes v1.25 changes how clusters describe and implement security policies. From this version forward, [Pod Security Policies (PSPs)](https://kubernetes.io/docs/concepts/security/pod-security-policy/) are no longer available. Kubernetes v1.25 replaces them with new security objects: [Pod Security Standards (PSS)](https://kubernetes.io/docs/concepts/security/pod-security-standards/), and [Pod Security Admissions (PSAs)](https://kubernetes.io/docs/concepts/security/pod-security-admission/). - -If you have custom or imported hardened clusters, you must take special preparations to ensure that the upgrade from an earlier version of Kubernetes to v1.25 or later goes smoothly. - -:::note - -After you upgrade to v1.25, add the necessary Rancher namespace exemptions. See [Pod Security Admission (PSA) Configuration Templates](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md#exempting-required-rancher-namespaces) for more details. - -::: - -## Upgrading Imported Hardened Clusters to Kubernetes v1.25 or Later - - - - -Perform the following on each node in the cluster: -1. Save [`rancher-psact.yaml`](./rancher-psact.yaml) in `/etc/rancher/rke2`. -1. Edit the RKE2 configuration file: - 1. Update the `profile` field to `cis-1.23`. - 1. Specify the path for the configuration file that you just added: `pod-security-admission-config-file: /etc/rancher/rke2/rancher-psact.yaml`. - - - - -Perform the following on each node in the cluster: - -Follow the official K3s instructions on [Upgrading Hardened Clusters from v1.24.x to v1.25.x](https://docs.k3s.io/known-issues#hardened-125), but use a [custom](./rancher-psact.yaml) Rancher PSA configuration template, instead of the configuration provided on the official K3s site. - - - -After you perform these steps, you can upgrade the cluster's Kubernetes version through the Rancher UI: - -1. In the upper left corner, click **☰ > Cluster Management**. -1. Find the cluster you want to update in the **Clusters** table, and click the **⋮**. -1. Select **Edit Config**. -1. In the **Kubernetes Version** dropdown menu, select the version that you would like to use. -1. Click **Save**. - -## Upgrading Custom Hardened Clusters to Kubernetes v1.25 or Later - - - - -1. In the upper left corner, click **☰ > Cluster Management**. -1. Find the cluster you want to update in the **Clusters** table, and click the **⋮**. -1. Select **Edit Config**. -1. Under **Basics > Security**, in the **CIS Profile** dropdown menu, select `cis-1.23`. -1. In the **Pod Security Admission Configuration Template** dropdown menu, select `rancher-restricted`. -1. In the **Kubernetes Version** dropdown menu, select the version that you would like to use. -1. Click **Save**. - - - - -1. In the upper left corner, click **☰ > Cluster Management**. -1. Find the cluster you want to update in the **Clusters** table, and click the **⋮**. -1. Select **Edit YAML**. -1. Delete `PodSecurityPolicy` from `kube-apiserver-arg.enable-admission-plugins` -1. Add this line to the `spec` field: `defaultPodSecurityAdmissionConfigurationTemplateName: rancher-restricted` -1. Update `kubernetesVersion` to your chosen version (v1.25 or later). -1. Click **Save**. - - - diff --git a/versioned_docs/version-2.11/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md b/versioned_docs/version-2.11/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md deleted file mode 100644 index 0f571b68353..00000000000 --- a/versioned_docs/version-2.11/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: Upgrading a Hardened Custom/Imported Cluster to Kubernetes v1.25 ---- - - - - - -Kubernetes v1.25 changes how clusters describe and implement security policies. From this version forward, [Pod Security Policies (PSPs)](https://kubernetes.io/docs/concepts/security/pod-security-policy/) are no longer available. Kubernetes v1.25 replaces them with new security objects: [Pod Security Standards (PSS)](https://kubernetes.io/docs/concepts/security/pod-security-standards/), and [Pod Security Admissions (PSAs)](https://kubernetes.io/docs/concepts/security/pod-security-admission/). - -If you have custom or imported hardened clusters, you must take special preparations to ensure that the upgrade from an earlier version of Kubernetes to v1.25 or later goes smoothly. - -:::note - -After you upgrade to v1.25, add the necessary Rancher namespace exemptions. See [Pod Security Admission (PSA) Configuration Templates](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md#exempting-required-rancher-namespaces) for more details. - -::: - -## Upgrading Imported Hardened Clusters to Kubernetes v1.25 or Later - - - - -Perform the following on each node in the cluster: -1. Save [`rancher-psact.yaml`](./rancher-psact.yaml) in `/etc/rancher/rke2`. -1. Edit the RKE2 configuration file: - 1. Update the `profile` field to `cis-1.23`. - 1. Specify the path for the configuration file that you just added: `pod-security-admission-config-file: /etc/rancher/rke2/rancher-psact.yaml`. - - - - -Perform the following on each node in the cluster: - -Follow the official K3s instructions on [Upgrading Hardened Clusters from v1.24.x to v1.25.x](https://docs.k3s.io/known-issues#hardened-125), but use a [custom](./rancher-psact.yaml) Rancher PSA configuration template, instead of the configuration provided on the official K3s site. - - - -After you perform these steps, you can upgrade the cluster's Kubernetes version through the Rancher UI: - -1. In the upper left corner, click **☰ > Cluster Management**. -1. Find the cluster you want to update in the **Clusters** table, and click the **⋮**. -1. Select **Edit Config**. -1. In the **Kubernetes Version** dropdown menu, select the version that you would like to use. -1. Click **Save**. - -## Upgrading Custom Hardened Clusters to Kubernetes v1.25 or Later - - - - -1. In the upper left corner, click **☰ > Cluster Management**. -1. Find the cluster you want to update in the **Clusters** table, and click the **⋮**. -1. Select **Edit Config**. -1. Under **Basics > Security**, in the **CIS Profile** dropdown menu, select `cis-1.23`. -1. In the **Pod Security Admission Configuration Template** dropdown menu, select `rancher-restricted`. -1. In the **Kubernetes Version** dropdown menu, select the version that you would like to use. -1. Click **Save**. - - - - -1. In the upper left corner, click **☰ > Cluster Management**. -1. Find the cluster you want to update in the **Clusters** table, and click the **⋮**. -1. Select **Edit YAML**. -1. Delete `PodSecurityPolicy` from `kube-apiserver-arg.enable-admission-plugins` -1. Add this line to the `spec` field: `defaultPodSecurityAdmissionConfigurationTemplateName: rancher-restricted` -1. Update `kubernetesVersion` to your chosen version (v1.25 or later). -1. Click **Save**. - - - diff --git a/versioned_docs/version-2.12/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md b/versioned_docs/version-2.12/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md deleted file mode 100644 index 0f571b68353..00000000000 --- a/versioned_docs/version-2.12/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: Upgrading a Hardened Custom/Imported Cluster to Kubernetes v1.25 ---- - - - - - -Kubernetes v1.25 changes how clusters describe and implement security policies. From this version forward, [Pod Security Policies (PSPs)](https://kubernetes.io/docs/concepts/security/pod-security-policy/) are no longer available. Kubernetes v1.25 replaces them with new security objects: [Pod Security Standards (PSS)](https://kubernetes.io/docs/concepts/security/pod-security-standards/), and [Pod Security Admissions (PSAs)](https://kubernetes.io/docs/concepts/security/pod-security-admission/). - -If you have custom or imported hardened clusters, you must take special preparations to ensure that the upgrade from an earlier version of Kubernetes to v1.25 or later goes smoothly. - -:::note - -After you upgrade to v1.25, add the necessary Rancher namespace exemptions. See [Pod Security Admission (PSA) Configuration Templates](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md#exempting-required-rancher-namespaces) for more details. - -::: - -## Upgrading Imported Hardened Clusters to Kubernetes v1.25 or Later - - - - -Perform the following on each node in the cluster: -1. Save [`rancher-psact.yaml`](./rancher-psact.yaml) in `/etc/rancher/rke2`. -1. Edit the RKE2 configuration file: - 1. Update the `profile` field to `cis-1.23`. - 1. Specify the path for the configuration file that you just added: `pod-security-admission-config-file: /etc/rancher/rke2/rancher-psact.yaml`. - - - - -Perform the following on each node in the cluster: - -Follow the official K3s instructions on [Upgrading Hardened Clusters from v1.24.x to v1.25.x](https://docs.k3s.io/known-issues#hardened-125), but use a [custom](./rancher-psact.yaml) Rancher PSA configuration template, instead of the configuration provided on the official K3s site. - - - -After you perform these steps, you can upgrade the cluster's Kubernetes version through the Rancher UI: - -1. In the upper left corner, click **☰ > Cluster Management**. -1. Find the cluster you want to update in the **Clusters** table, and click the **⋮**. -1. Select **Edit Config**. -1. In the **Kubernetes Version** dropdown menu, select the version that you would like to use. -1. Click **Save**. - -## Upgrading Custom Hardened Clusters to Kubernetes v1.25 or Later - - - - -1. In the upper left corner, click **☰ > Cluster Management**. -1. Find the cluster you want to update in the **Clusters** table, and click the **⋮**. -1. Select **Edit Config**. -1. Under **Basics > Security**, in the **CIS Profile** dropdown menu, select `cis-1.23`. -1. In the **Pod Security Admission Configuration Template** dropdown menu, select `rancher-restricted`. -1. In the **Kubernetes Version** dropdown menu, select the version that you would like to use. -1. Click **Save**. - - - - -1. In the upper left corner, click **☰ > Cluster Management**. -1. Find the cluster you want to update in the **Clusters** table, and click the **⋮**. -1. Select **Edit YAML**. -1. Delete `PodSecurityPolicy` from `kube-apiserver-arg.enable-admission-plugins` -1. Add this line to the `spec` field: `defaultPodSecurityAdmissionConfigurationTemplateName: rancher-restricted` -1. Update `kubernetesVersion` to your chosen version (v1.25 or later). -1. Click **Save**. - - - diff --git a/versioned_docs/version-2.9/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md b/versioned_docs/version-2.9/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md deleted file mode 100644 index 0f571b68353..00000000000 --- a/versioned_docs/version-2.9/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: Upgrading a Hardened Custom/Imported Cluster to Kubernetes v1.25 ---- - - - - - -Kubernetes v1.25 changes how clusters describe and implement security policies. From this version forward, [Pod Security Policies (PSPs)](https://kubernetes.io/docs/concepts/security/pod-security-policy/) are no longer available. Kubernetes v1.25 replaces them with new security objects: [Pod Security Standards (PSS)](https://kubernetes.io/docs/concepts/security/pod-security-standards/), and [Pod Security Admissions (PSAs)](https://kubernetes.io/docs/concepts/security/pod-security-admission/). - -If you have custom or imported hardened clusters, you must take special preparations to ensure that the upgrade from an earlier version of Kubernetes to v1.25 or later goes smoothly. - -:::note - -After you upgrade to v1.25, add the necessary Rancher namespace exemptions. See [Pod Security Admission (PSA) Configuration Templates](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md#exempting-required-rancher-namespaces) for more details. - -::: - -## Upgrading Imported Hardened Clusters to Kubernetes v1.25 or Later - - - - -Perform the following on each node in the cluster: -1. Save [`rancher-psact.yaml`](./rancher-psact.yaml) in `/etc/rancher/rke2`. -1. Edit the RKE2 configuration file: - 1. Update the `profile` field to `cis-1.23`. - 1. Specify the path for the configuration file that you just added: `pod-security-admission-config-file: /etc/rancher/rke2/rancher-psact.yaml`. - - - - -Perform the following on each node in the cluster: - -Follow the official K3s instructions on [Upgrading Hardened Clusters from v1.24.x to v1.25.x](https://docs.k3s.io/known-issues#hardened-125), but use a [custom](./rancher-psact.yaml) Rancher PSA configuration template, instead of the configuration provided on the official K3s site. - - - -After you perform these steps, you can upgrade the cluster's Kubernetes version through the Rancher UI: - -1. In the upper left corner, click **☰ > Cluster Management**. -1. Find the cluster you want to update in the **Clusters** table, and click the **⋮**. -1. Select **Edit Config**. -1. In the **Kubernetes Version** dropdown menu, select the version that you would like to use. -1. Click **Save**. - -## Upgrading Custom Hardened Clusters to Kubernetes v1.25 or Later - - - - -1. In the upper left corner, click **☰ > Cluster Management**. -1. Find the cluster you want to update in the **Clusters** table, and click the **⋮**. -1. Select **Edit Config**. -1. Under **Basics > Security**, in the **CIS Profile** dropdown menu, select `cis-1.23`. -1. In the **Pod Security Admission Configuration Template** dropdown menu, select `rancher-restricted`. -1. In the **Kubernetes Version** dropdown menu, select the version that you would like to use. -1. Click **Save**. - - - - -1. In the upper left corner, click **☰ > Cluster Management**. -1. Find the cluster you want to update in the **Clusters** table, and click the **⋮**. -1. Select **Edit YAML**. -1. Delete `PodSecurityPolicy` from `kube-apiserver-arg.enable-admission-plugins` -1. Add this line to the `spec` field: `defaultPodSecurityAdmissionConfigurationTemplateName: rancher-restricted` -1. Update `kubernetesVersion` to your chosen version (v1.25 or later). -1. Click **Save**. - - - diff --git a/versioned_sidebars/version-2.10-sidebars.json b/versioned_sidebars/version-2.10-sidebars.json index ab30c016fa5..1e240ab02c3 100644 --- a/versioned_sidebars/version-2.10-sidebars.json +++ b/versioned_sidebars/version-2.10-sidebars.json @@ -98,7 +98,6 @@ "getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks", "getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks", "getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke", - "getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25", "getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/troubleshooting" ] }, diff --git a/versioned_sidebars/version-2.11-sidebars.json b/versioned_sidebars/version-2.11-sidebars.json index 75ddca79e5e..48195375a1f 100644 --- a/versioned_sidebars/version-2.11-sidebars.json +++ b/versioned_sidebars/version-2.11-sidebars.json @@ -98,7 +98,6 @@ "getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks", "getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks", "getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke", - "getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25", "getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/troubleshooting" ] }, diff --git a/versioned_sidebars/version-2.12-sidebars.json b/versioned_sidebars/version-2.12-sidebars.json index 75ddca79e5e..48195375a1f 100644 --- a/versioned_sidebars/version-2.12-sidebars.json +++ b/versioned_sidebars/version-2.12-sidebars.json @@ -98,7 +98,6 @@ "getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks", "getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks", "getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke", - "getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25", "getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/troubleshooting" ] }, diff --git a/versioned_sidebars/version-2.9-sidebars.json b/versioned_sidebars/version-2.9-sidebars.json index 6dd6ded6f64..dfb99d5cac2 100644 --- a/versioned_sidebars/version-2.9-sidebars.json +++ b/versioned_sidebars/version-2.9-sidebars.json @@ -98,7 +98,6 @@ "getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks", "getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks", "getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke", - "getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25", "getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/troubleshooting" ] },