mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-05-05 12:43:16 +00:00
Add v2.14 preview docs (#2212)
This commit is contained in:
Lucas Saintarbor
GitHub
+13
@@ -0,0 +1,13 @@
|
||||
---
|
||||
title: About k3s-selinux
|
||||
---
|
||||
|
||||
<head>
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/reference-guides/rancher-security/selinux-rpm/about-k3s-selinux"/>
|
||||
</head>
|
||||
|
||||
`k3s-selinux` provides policies for K3s. It is installed automatically when the K3s installer script detects that it is running on an RPM-based distro.
|
||||
|
||||
The `k3s-selinux` GitHub repository is [here](https://github.com/rancher/k3s-selinux).
|
||||
|
||||
For more information about installing K3s on SELinux-enabled hosts, see the [K3s documentation](https://docs.k3s.io/advanced#selinux-support).
|
||||
+71
@@ -0,0 +1,71 @@
|
||||
---
|
||||
title: About rancher-selinux
|
||||
---
|
||||
|
||||
<head>
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux"/>
|
||||
</head>
|
||||
|
||||
To allow Rancher to work with SELinux, some functionality has to be manually enabled for the SELinux nodes. To help with that, Rancher provides an SELinux RPM.
|
||||
|
||||
The `rancher-selinux` RPM contains a set of SELinux policies designed to grant the necessary privileges to various Rancher components running on Linux systems with SELinux enabled.
|
||||
|
||||
The `rancher-selinux` GitHub repository is [here.](https://github.com/rancher/rancher-selinux)
|
||||
|
||||
## Installing the rancher-selinux RPM
|
||||
|
||||
:::note Requirement:
|
||||
|
||||
The `rancher-selinux` RPM was tested on openSUSE Tumbleweed and RHEL-based distributions including Centos/RockyLinux 8 and 9.
|
||||
|
||||
:::
|
||||
|
||||
### 1. Set up the yum repo
|
||||
|
||||
Set up the yum repo to install `rancher-selinux` directly on all hosts in the cluster.
|
||||
|
||||
In order to use the RPM repository, on a CentOS 8 or RHEL 8 system, run the following bash snippet:
|
||||
|
||||
```
|
||||
# cat << EOF > /etc/yum.repos.d/rancher.repo
|
||||
[rancher]
|
||||
name=Rancher
|
||||
baseurl=https://rpm.rancher.io/rancher/production/centos/8/noarch
|
||||
enabled=1
|
||||
gpgcheck=1
|
||||
gpgkey=https://rpm.rancher.io/public.key
|
||||
EOF
|
||||
```
|
||||
|
||||
In order to use the RPM repository, on a CentOS 9 or RHEL 9 system, run the following bash snippet:
|
||||
|
||||
```
|
||||
# cat << EOF > /etc/yum.repos.d/rancher.repo
|
||||
[rancher]
|
||||
name=Rancher
|
||||
baseurl=https://rpm.rancher.io/rancher/production/centos/9/noarch
|
||||
enabled=1
|
||||
gpgcheck=1
|
||||
gpgkey=https://rpm.rancher.io/public.key
|
||||
EOF
|
||||
```
|
||||
|
||||
### 2. Installing the RPM
|
||||
|
||||
Install the RPM:
|
||||
|
||||
```
|
||||
yum -y install rancher-selinux
|
||||
```
|
||||
|
||||
## Configuring the Logging and Monitoring Applications to Work with SELinux
|
||||
|
||||
:::note Requirement:
|
||||
|
||||
Logging v2 and Monitoring v2 were tested with SELinux on RHEL/CentOS 8, 9, and Tumbleweed.
|
||||
|
||||
:::
|
||||
|
||||
Applications do not automatically work once the `rancher-selinux` RPM is installed on the host. They need to be configured to run in an allowed SELinux container domain provided by the RPM.
|
||||
|
||||
To configure the `rancher-logging` or the `rancher-monitoring` chart to be SELinux aware, change `global.seLinux.enabled` to true in the `values.yaml` when installing the charts.
|
||||
+13
@@ -0,0 +1,13 @@
|
||||
---
|
||||
title: About rke2-selinux
|
||||
---
|
||||
|
||||
<head>
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/reference-guides/rancher-security/selinux-rpm/about-rke2-selinux"/>
|
||||
</head>
|
||||
|
||||
`rke2-selinux` provides policies for RKE2. It is installed automatically when the RKE2 installer script detects that it is running on an RPM-based distro.
|
||||
|
||||
The `rke2-selinux` GitHub repository is [here.](https://github.com/rancher/rke2-selinux)
|
||||
|
||||
For more information about installing RKE2 on SELinux-enabled hosts, see the [RKE2 documentation.](https://docs.rke2.io/install/methods#rpm)
|
||||
+23
@@ -0,0 +1,23 @@
|
||||
---
|
||||
title: SELinux RPM
|
||||
---
|
||||
|
||||
<head>
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/reference-guides/rancher-security/selinux-rpm"/>
|
||||
</head>
|
||||
|
||||
[Security-Enhanced Linux (SELinux)](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) is a security enhancement to Linux.
|
||||
|
||||
Developed by Red Hat, it is an implementation of mandatory access controls (MAC) on Linux. Mandatory access controls allow an administrator of a system to define how applications and users can access different resources such as files, devices, networks and inter-process communication. SELinux also enhances security by making an OS restrictive by default.
|
||||
|
||||
After being historically used by government agencies, SELinux is now an industry standard and enabled by default on SUSE distributions such as SUSE Linux Enterprise 16, openSUSE distributions such as openSUSE Tumbleweed, and RHEL-based OS such as Rocky Linux. To check whether SELinux is enabled and enforced on your system, use `getenforce`:
|
||||
|
||||
```
|
||||
# getenforce
|
||||
Enforcing
|
||||
```
|
||||
|
||||
We provide three RPMs (RPM Package Manager) that enable Rancher products to function properly on SELinux-enforcing hosts:
|
||||
- [`rancher-selinux`](about-rancher-selinux.md)
|
||||
- [`rke2-selinux`](about-rke2-selinux.md)
|
||||
- [`k3s-selinux`](about-k3s-selinux.md)
|
||||
Reference in New Issue
Block a user