From 7ebcfc64adadfe861cbb07c36f1522757dbd791b Mon Sep 17 00:00:00 2001 From: David Noland Date: Mon, 4 Jan 2021 15:47:44 -0800 Subject: [PATCH 01/14] Improved command to get namespaces Previous command had flags like `-A` which make no sense when getting namespaces. Removed dependence on `jq` binary. --- .../v2.x/en/security/rancher-2.4/hardening-2.4/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/security/rancher-2.4/hardening-2.4/_index.md b/content/rancher/v2.x/en/security/rancher-2.4/hardening-2.4/_index.md index 583080c10af..e3636755203 100644 --- a/content/rancher/v2.x/en/security/rancher-2.4/hardening-2.4/_index.md +++ b/content/rancher/v2.x/en/security/rancher-2.4/hardening-2.4/_index.md @@ -89,7 +89,7 @@ Create a bash script file called `account_update.sh`. Be sure to `chmod +x accou ``` #!/bin/bash -e -for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do +for namespace in $(kubectl get namespaces -o custom-columns=NAME:.metadata.name --no-headers); do kubectl patch serviceaccount default -n ${namespace} -p "$(cat account_update.yaml)" done ``` From 0cac9bc3e8db872ef4642148d15dc334221911b7 Mon Sep 17 00:00:00 2001 From: Jonathan Philipos Date: Sat, 27 Feb 2021 23:47:21 +1100 Subject: [PATCH 02/14] Fix config.yaml tls-san reference --- .../v2.x/en/installation/install-rancher-on-linux/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-linux/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-linux/_index.md index c7c69757429..5ab98e108a0 100644 --- a/content/rancher/v2.x/en/installation/install-rancher-on-linux/_index.md +++ b/content/rancher/v2.x/en/installation/install-rancher-on-linux/_index.md @@ -87,7 +87,7 @@ Create the RancherD config file at `/etc/rancher/rke2/config.yaml`: ```yaml token: my-shared-secret tls-san: - - https://my-fixed-registration-address.com + - my-fixed-registration-address.com - another-kubernetes-domain.com ``` @@ -237,4 +237,4 @@ rancherd-uninstall.sh # RKE2 Documentation -For more information on RKE2, the Kubernetes distribution used to provision the underlying cluster, refer to the documentation [here.](https://docs.rke2.io/) \ No newline at end of file +For more information on RKE2, the Kubernetes distribution used to provision the underlying cluster, refer to the documentation [here.](https://docs.rke2.io/) From c6db407fce8c0eb9c657c11adcccae0a8ccb8664 Mon Sep 17 00:00:00 2001 From: Rich Paredes Date: Sun, 14 Mar 2021 00:34:31 -0500 Subject: [PATCH 03/14] Update _index.md There is no ssh_key_file_name variable so this should be an option. Additional information should be displayed so the user knows how to ssh to the Rancher server. --- .../quick-start-guide/deployment/microsoft-azure-qs/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/quick-start-guide/deployment/microsoft-azure-qs/_index.md b/content/rancher/v2.x/en/quick-start-guide/deployment/microsoft-azure-qs/_index.md index a895973568f..bc991140bfc 100644 --- a/content/rancher/v2.x/en/quick-start-guide/deployment/microsoft-azure-qs/_index.md +++ b/content/rancher/v2.x/en/quick-start-guide/deployment/microsoft-azure-qs/_index.md @@ -39,7 +39,6 @@ Suggestions include: - `azure_location` - Microsoft Azure region, choose the closest instead of the default - `prefix` - Prefix for all created resources - `instance_type` - Compute instance size used, minimum is `Standard_DS2_v2` but `Standard_DS2_v3` or `Standard_DS3_v2` could be used if within budget - - `ssh_key_file_name` - Use a specific SSH key instead of `~/.ssh/id_rsa` (public key is assumed to be `${ssh_key_file_name}.pub`) 1. Run `terraform init`. @@ -56,6 +55,7 @@ Suggestions include: ``` 1. Paste the `rancher_server_url` from the output above into the browser. Log in when prompted (default username is `admin`, use the password set in `rancher_server_admin_password`). +2. ssh to the Rancher Server using the `id_rsa` key generated in `quickstart/azure`. #### Result From ea51b8d7c5006f181edfd9e4fb1fa94cb27c034f Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Tue, 16 Mar 2021 15:17:51 -0700 Subject: [PATCH 04/14] Revert "Document installing Rancher on EKS" --- .../install-rancher-on-k8s/_index.md | 70 +++----- .../amazon-eks/_index.md | 164 ------------------ 2 files changed, 27 insertions(+), 207 deletions(-) delete mode 100644 content/rancher/v2.5/en/installation/install-rancher-on-k8s/amazon-eks/_index.md diff --git a/content/rancher/v2.5/en/installation/install-rancher-on-k8s/_index.md b/content/rancher/v2.5/en/installation/install-rancher-on-k8s/_index.md index c64606bf072..075b6a8c492 100644 --- a/content/rancher/v2.5/en/installation/install-rancher-on-k8s/_index.md +++ b/content/rancher/v2.5/en/installation/install-rancher-on-k8s/_index.md @@ -10,43 +10,19 @@ aliases: - /rancher/v2.5/en/installation/install-rancher-on-k8s/install --- -In this section, you'll learn how to deploy Rancher on a Kubernetes cluster using the Helm CLI. - -- [Prerequisites](#prerequisites) - - [A Kubernetes Cluster](#a-kubernetes-cluster) - - [Required CLI Tools](#required-cli-tools) - - [Ingress Controller (Only for Hosted Kubernetes)](ingress-controller-only-for-hosted-kubernetes) -- [Install the Rancher Helm Chart](#install-the-rancher-helm-chart) - -# Prerequisites - -### A Kubernetes Cluster +# Prerequisite Set up the Rancher server's local Kubernetes cluster. Rancher can be installed on any Kubernetes cluster. This cluster can use upstream Kubernetes, or it can use one of Rancher's Kubernetes distributions, or it can be a managed Kubernetes cluster from a provider such as Amazon EKS. -For help setting up a Kubernetes cluster, we provide these tutorials: +> **Note:** To deploy Rancher v2.5 on a hosted Kubernetes cluster such as EKS, GKE, or AKS, you should deploy a compatible Ingress controller first to configure [SSL termination on Rancher.]({{}}/rancher/v2.5/en/installation/install-rancher-on-k8s/#4-choose-your-ssl-configuration). -- **RKE:** For the tutorial to install an RKE Kubernetes cluster, refer to [this page.]({{}}/rancher/v2.5/en/installation/resources/k8s-tutorials/ha-rke/) For help setting up the infrastructure for a high-availability RKE cluster, refer to [this page.]({{}}/rancher/v2.5/en/installation/resources/k8s-tutorials/infrastructure-tutorials/infra-for-ha) -- **K3s:** For the tutorial to install a K3s Kubernetes cluster, refer to [this page.]({{}}/rancher/v2.5/en/installation/resources/k8s-tutorials/ha-with-external-db) For help setting up the infrastructure for a high-availability K3s cluster, refer to [this page.]({{}}/rancher/v2.5/en/installation/resources/k8s-tutorials/infrastructure-tutorials/infra-for-ha-with-external-db) -- **RKE2:** For the tutorial to install an RKE2 Kubernetes cluster, refer to [this page.]({{}}/rancher/v2.5/en/installation/resources/k8s-tutorials/ha-rke2) For help setting up the infrastructure for a high-availability RKE2 cluster, refer to [this page.]({{}}/rancher/v2.5/en/installation/resources/k8s-tutorials/infrastructure-tutorials/infra-for-rke2-ha) -- **Amazon EKS:** To install Rancher on Amazon EKS, including how to install an ingress so that the Rancher server can be accessed, refer to [this page.]({{}}/rancher/v2.5/en/installation/install-rancher-on-k8s/amazon-eks) +For the tutorial to install an RKE Kubernetes cluster, refer to [this page.]({{}}/rancher/v2.5/en/installation/resources/k8s-tutorials/ha-rke/) For help setting up the infrastructure for a high-availability RKE cluster, refer to [this page.]({{}}/rancher/v2.5/en/installation/resources/k8s-tutorials/infrastructure-tutorials/infra-for-ha) -### Required CLI Tools +For the tutorial to install a K3s Kubernetes cluster, refer to [this page.]({{}}/rancher/v2.5/en/installation/resources/k8s-tutorials/ha-with-external-db) For help setting up the infrastructure for a high-availability K3s cluster, refer to [this page.]({{}}/rancher/v2.5/en/installation/resources/k8s-tutorials/infrastructure-tutorials/infra-for-ha-with-external-db) -The following CLI tools are required for setting up the Kubernetes cluster. Please make sure these tools are installed and available in your `$PATH`. - -Refer to the [instructions provided by the Helm project](https://helm.sh/docs/intro/install/) for your specific platform. - -- [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl) - Kubernetes command-line tool. -- [helm](https://docs.helm.sh/using_helm/#installing-helm) - Package management for Kubernetes. Refer to the [Helm version requirements]({{}}/rancher/v2.5/en/installation/options/helm-version) to choose a version of Helm to install Rancher. - -### Ingress Controller (for Hosted Kubernetes) - -To deploy Rancher v2.5 on a hosted Kubernetes cluster such as EKS, GKE, or AKS, you should deploy a compatible Ingress controller first to configure [SSL termination on Rancher.]({{}}/rancher/v2.x/en/installation/install-rancher-on-k8s/#4-choose-your-ssl-configuration) - -For more information about deploying Rancher on EKS, refer to [this page.]({{}}/rancher/v2.5/en/installation/install-rancher-on-k8s/amazon-eks) +For the tutorial to install an RKE2 Kubernetes cluster, refer to [this page.]({{}}/rancher/v2.5/en/installation/resources/k8s-tutorials/ha-rke2) For help setting up the infrastructure for a high-availability RKE2 cluster, refer to [this page.]({{}}/rancher/v2.5/en/installation/resources/k8s-tutorials/infrastructure-tutorials/infra-for-rke2-ha) # Install the Rancher Helm Chart @@ -64,17 +40,25 @@ To choose a version of Helm to install Rancher with, refer to the [Helm version To set up Rancher, -1. [Add the Helm chart repository](#1-add-the-helm-chart-repository) -2. [Create a namespace for Rancher](#2-create-a-namespace-for-rancher) -3. [Choose your SSL configuration](#3-choose-your-ssl-configuration) -4. [Install cert-manager](#4-install-cert-manager) (unless you are bringing your own certificates, or TLS will be terminated on a load balancer) -5. [Install Rancher with Helm and your chosen certificate option](#5-install-rancher-with-helm-and-your-chosen-certificate-option) -6. [Verify that the Rancher server is successfully deployed](#6-verify-that-the-rancher-server-is-successfully-deployed) -7. [Save your options](#7-save-your-options) +1. [Install the required CLI tools](#1-install-the-required-cli-tools) +2. [Add the Helm chart repository](#2-add-the-helm-chart-repository) +3. [Create a namespace for Rancher](#3-create-a-namespace-for-rancher) +4. [Choose your SSL configuration](#4-choose-your-ssl-configuration) +5. [Install cert-manager](#5-install-cert-manager) (unless you are bringing your own certificates, or TLS will be terminated on a load balancer) +6. [Install Rancher with Helm and your chosen certificate option](#6-install-rancher-with-helm-and-your-chosen-certificate-option) +7. [Verify that the Rancher server is successfully deployed](#7-verify-that-the-rancher-server-is-successfully-deployed) +8. [Save your options](#8-save-your-options) +### 1. Install the Required CLI Tools +The following CLI tools are required for setting up the Kubernetes cluster. Please make sure these tools are installed and available in your `$PATH`. -### 1. Add the Helm Chart Repository +Refer to the [instructions provided by the Helm project](https://helm.sh/docs/intro/install/) for your specific platform. + +- [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl) - Kubernetes command-line tool. +- [helm](https://docs.helm.sh/using_helm/#installing-helm) - Package management for Kubernetes. Refer to the [Helm version requirements]({{}}/rancher/v2.5/en/installation/options/helm-version) to choose a version of Helm to install Rancher. + +### 2. Add the Helm Chart Repository Use `helm repo add` command to add the Helm chart repository that contains charts to install Rancher. For more information about the repository choices and which is best for your use case, see [Choosing a Version of Rancher]({{}}/rancher/v2.5/en/installation/install-rancher-on-k8s/chart-options/#helm-chart-repositories). @@ -84,7 +68,7 @@ Use `helm repo add` command to add the Helm chart repository that contains chart helm repo add rancher- https://releases.rancher.com/server-charts/ ``` -### 2. Create a Namespace for Rancher +### 3. Create a Namespace for Rancher We'll need to define a Kubernetes namespace where the resources created by the Chart should be installed. This should always be `cattle-system`: @@ -92,7 +76,7 @@ We'll need to define a Kubernetes namespace where the resources created by the C kubectl create namespace cattle-system ``` -### 3. Choose your SSL Configuration +### 4. Choose your SSL Configuration The Rancher management server is designed to be secure by default and requires SSL/TLS configuration. @@ -111,7 +95,7 @@ There are three recommended options for the source of the certificate used for T | Let’s Encrypt | `ingress.tls.source=letsEncrypt` | [yes](#5-install-cert-manager) | | Certificates from Files | `ingress.tls.source=secret` | no | -### 4. Install cert-manager +### 5. Install cert-manager > You should skip this step if you are bringing your own certificate files (option `ingress.tls.source=secret`), or if you use [TLS termination on an external load balancer]({{}}/rancher/v2.5/en/installation/install-rancher-on-k8s/chart-options/#external-tls-termination). @@ -166,7 +150,7 @@ cert-manager-webhook-787858fcdb-nlzsq 1/1 Running 0 2m {{% /accordion %}} -### 5. Install Rancher with Helm and Your Chosen Certificate Option +### 6. Install Rancher with Helm and Your Chosen Certificate Option The exact command to install Rancher differs depending on the certificate configuration. @@ -268,7 +252,7 @@ The Rancher chart configuration has many options for customizing the installatio See the [Chart Options]({{}}/rancher/v2.5/en/installation/resources/chart-options/) for the full list of options. -### 6. Verify that the Rancher Server is Successfully Deployed +### 7. Verify that the Rancher Server is Successfully Deployed After adding the secrets, check if Rancher was rolled out successfully: @@ -288,7 +272,7 @@ rancher 3 3 3 3 3m It should show the same count for `DESIRED` and `AVAILABLE`. -### 7. Save Your Options +### 8. Save Your Options Make sure you save the `--set` options you used. You will need to use the same options when you upgrade Rancher to new versions with Helm. diff --git a/content/rancher/v2.5/en/installation/install-rancher-on-k8s/amazon-eks/_index.md b/content/rancher/v2.5/en/installation/install-rancher-on-k8s/amazon-eks/_index.md deleted file mode 100644 index 40fbfdb88f9..00000000000 --- a/content/rancher/v2.5/en/installation/install-rancher-on-k8s/amazon-eks/_index.md +++ /dev/null @@ -1,164 +0,0 @@ ---- -title: Installing Rancher on Amazon EKS -shortTitle: Amazon EKS -weight: 4 ---- - -This page covers two ways to install Rancher on EKS. - -The first is a guide for deploying the Rancher server on an EKS cluster using CloudFormation. This guide was created in collaboration with Amazon Web Services to show how to deploy Rancher following best practices. - -The second is a guide for installing an EKS cluster with an ingress by using command line tools. This guide may be useful if you want to use fewer resources while trying out Rancher on EKS. - -If you already have an EKS Kubernetes cluster, skip to the step about [installing an ingress.](#5-install-an-ingress) Then install the Rancher Helm chart following the instructions on [this page.]({{}}/rancher/v2.5/en/installation/install-rancher-on-k8s/#install-the-rancher-helm-chart) - -- [Automated Quickstart using AWS Best Practices](#automated-quickstart-using-aws-best-practices) -- [Creating an EKS Cluster for the Rancher Server](#creating-an-eks-cluster-for-the-rancher-server) - -# Automated Quickstart using AWS Best Practices - -Rancher and Amazon Web Services collaborated on a quick start guide for deploying Rancher on an EKS cluster following AWS best practices. The deployment guide is [here.](https://aws-quickstart.github.io/quickstart-eks-rancher/) - -The quick start guide provides three options for deploying Rancher on EKS: - -- **Deploy Rancher into a new VPC and new Amazon EKS cluster.** This option builds a new AWS environment consisting of the VPC, subnets, NAT gateways, security groups, bastion hosts, Amazon EKS cluster, and other infrastructure components. It then deploys Rancher into this new EKS cluster. -- **Deploy Rancher into an existing VPC and a new Amazon EKS cluster.** This option provisions Rancher in your existing AWS infrastructure. -- **Deploy Rancher into an existing VPC and existing Amazon EKS cluster.** This option provisions Rancher in your existing AWS infrastructure. - -Deploying this Quick Start for a new virtual private cloud (VPC) and new Amazon EKS cluster using default parameters builds the following Rancher environment in the AWS Cloud: - -- A highly available architecture that spans three Availability Zones.* -- A VPC configured with public and private subnets, according to AWS best practices, to provide you with your own virtual network on AWS.* -- In the public subnets: - - Managed network address translation (NAT) gateways to allow outbound internet access for resources.* - - Linux bastion hosts in an Auto Scaling group to allow inbound Secure Shell (SSH) access to Amazon Elastic Compute Cloud (Amazon EC2) instances in public and private subnets.* -- In the private subnets: - - Kubernetes nodes in an Auto Scaling group.* - - A Network Load Balancer (not shown) for accessing the Rancher console. -- Rancher deployment using AWS Systems Manager automation. -- Amazon EKS service for the EKS cluster, which provides the Kubernetes control plane.* -- An Amazon Route 53 DNS record for accessing the Rancher deployment. - -\* The CloudFormation template that deploys the Quick Start into an existing Amazon EKS cluster skips the components marked by asterisks and prompts you for your existing VPC configuration. - -# Creating an EKS Cluster for the Rancher Server - -In this section, you'll install an EKS cluster with an ingress by using command line tools. This guide may be useful if you want to use fewer resources while trying out Rancher on EKS. - -> **Prerequisites:** -> -> - You should already have an AWS account. -> - Full administrative access is required to install the EKS cluster. The `AdministratorAccess` IAM policy can be used. -> - It is recommended to use an IAM user instead of the root AWS account. You will need the IAM user's access key and secret key to configure the AWS command line interface. - -### 1. Prepare your Workstation - -Install the following command line tools on your workstation: - -- **The AWS CLI v2:** For help, refer to these [installation steps.](https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html) -- **eksctl:** For help, refer to these [installation steps.](https://docs.aws.amazon.com/eks/latest/userguide/eksctl.html) -- **kubectl:** For help, refer to these [installation steps.](https://docs.aws.amazon.com/eks/latest/userguide/install-kubectl.html) -- **helm:** For help, refer to these [installation steps.](https://helm.sh/docs/intro/install/) - -### 2. Configure the AWS CLI - -To configure the AWS CLI, run the following command: - -``` -aws configure -``` - -Then enter the following values: - -| Value | Description | -|-------|-------------| -| AWS Access Key ID | The access key credential for the IAM user with EKS permissions. | -| AWS Secret Access Key | The secret key credential for the IAM user with EKS permissions. | -| Default region name | An [AWS region](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.RegionsAndAvailabilityZones.html#Concepts.RegionsAndAvailabilityZones.Regions) where the cluster nodes will be located. | -| Default output format | Enter `json`. | - -### 3. Create the EKS Cluster - -To create an EKS cluster, run the following command. Use the AWS region that applies to your use case: - -``` -eksctl create cluster \ - --name rancher-server \ - --version 1.18 \ - --region us-west-2 \ - --nodegroup-name ranchernodes \ - --node-type t2.medium \ - --nodes 3 \ - --nodes-min 1 \ - --nodes-max 4 \ - --managed -``` - -The cluster will take some time to be deployed with CloudFormation. - -### 4. Test the Cluster - -To test the cluster, run: - -``` -eksctl get cluster -``` - -The result should look like the following: - -``` -2021-03-14 21:23:30 [ℹ] eksctl version 0.40.0 -2021-03-14 21:23:30 [ℹ] using region us-west-2 -NAMEREGIONEKSCTL CREATED -rancher-server-clusterus-west-2True -``` - -### 5. Install an Ingress - -The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. - -The following command installs an `nginx-ingress-controller` with a LoadBalancer service. This will result in an ELB (Elastic Load Balancer) in front of NGINX: - -``` -helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx -helm repo update -helm upgrade --install \ - ingress-nginx ingress-nginx/ingress-nginx \ - --namespace ingress-nginx \ - --set controller.service.type=LoadBalancer \ - --version 3.12.0 \ - --create-namespace -``` - -### 6. Get Load Balancer IP - -To get the address of the load balancer, run: - -``` -kubectl get service ingress-nginx-controller --namespace=ingress-nginx -``` - -The result should look similar to the following: - -``` -NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) - AGE -ingress-nginx-controller LoadBalancer 10.100.90.18 a904a952c73bf4f668a17c46ac7c56ab-962521486.us-west-2.elb.amazonaws.com 80:31229/TCP,443:31050/TCP - 27m -``` - -Save the `EXTERNAL-IP`. - -### 7. Set up DNS - -External traffic to the Rancher server will need to be directed at the load balancer you created. - -Set up a DNS to point at the external IP that you saved. This DNS will be used as the Rancher server URL. - -There are many valid ways to set up the DNS. For help, refer to the AWS documentation on [routing traffic to an ELB load balancer.](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-elb-load-balancer.html) - -### 8. Install the Rancher Helm Chart - -Next, install the Rancher Helm chart by following the instructions on [this page.]({{}}/rancher/v2.5/en/installation/install-rancher-on-k8s/#install-the-rancher-helm-chart) The Helm instructions are the same for installing Rancher on any Kubernetes distribution. - -Use that DNS name from the previous step as the Rancher server URL when you install Rancher. It can be passed in as a Helm option. For example, if the DNS name is `rancher.my.org`, you could run the Helm installation command with the option `--set hostname=rancher.my.org`. \ No newline at end of file From 9c68de07694492d851d4922dd55cd64a6dd1633e Mon Sep 17 00:00:00 2001 From: Dawid Stankiewicz Date: Thu, 18 Mar 2021 13:07:34 +0100 Subject: [PATCH 05/14] Fix markdown URL --- .../rke-clusters/cloud-providers/amazon/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/amazon/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/amazon/_index.md index 16c53b10f8d..e855934b9a0 100644 --- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/amazon/_index.md +++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/amazon/_index.md @@ -22,7 +22,7 @@ All nodes added to the cluster must be able to interact with EC2 so that they ca * The first policy is for the nodes with the `controlplane` role. These nodes have to be able to create/remove EC2 resources. The following IAM policy is an example, please remove any unneeded permissions for your use case. * The second policy is for the nodes with the `etcd` or `worker` role. These nodes only have to be able to retrieve information from EC2. -While creating an Amazon EC2 cluster]({{}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/), you must fill in the **IAM Instance Profile Name** (not ARN) of the created IAM role when creating the **Node Template**. +While creating an [Amazon EC2 cluster]({{}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/), you must fill in the **IAM Instance Profile Name** (not ARN) of the created IAM role when creating the **Node Template**. While creating a [Custom cluster]({{}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes), you must manually attach the IAM role to the instance(s). From e0b86cb7b424e36fabfff8fc5f4e9e0646a3876c Mon Sep 17 00:00:00 2001 From: Rey Lejano Date: Thu, 18 Mar 2021 13:58:46 -0700 Subject: [PATCH 06/14] Fix link to setup infra for HA RKE2--extra open paren --- .../en/installation/resources/k8s-tutorials/ha-RKE2/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/installation/resources/k8s-tutorials/ha-RKE2/_index.md b/content/rancher/v2.x/en/installation/resources/k8s-tutorials/ha-RKE2/_index.md index b484b4ee007..3d208d1e19c 100644 --- a/content/rancher/v2.x/en/installation/resources/k8s-tutorials/ha-RKE2/_index.md +++ b/content/rancher/v2.x/en/installation/resources/k8s-tutorials/ha-RKE2/_index.md @@ -9,7 +9,7 @@ This section describes how to install a Kubernetes cluster according to the [bes # Prerequisites -These instructions assume you have set up three nodes, a load balancer, a DNS record, [this section.](({{}}/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/infra-for-rke2-ha) +These instructions assume you have set up three nodes, a load balancer, a DNS record, [this section.]({{}}/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/infra-for-rke2-ha) Note that in order for RKE2 to work correctly with the load balancer, you need to set up two listeners: one for the supervisor on port 9345, and one for the Kubernetes API on port 6443. From a008480ba864c52091ac991c68a2dcf812f04f8d Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Fri, 19 Mar 2021 09:58:54 -0700 Subject: [PATCH 07/14] Fix config.yaml tls-san reference #3072 --- .../v2.5/en/installation/install-rancher-on-linux/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.5/en/installation/install-rancher-on-linux/_index.md b/content/rancher/v2.5/en/installation/install-rancher-on-linux/_index.md index e9bc97a56a2..0ea25e9deb6 100644 --- a/content/rancher/v2.5/en/installation/install-rancher-on-linux/_index.md +++ b/content/rancher/v2.5/en/installation/install-rancher-on-linux/_index.md @@ -87,7 +87,7 @@ Create the RancherD config file at `/etc/rancher/rke2/config.yaml`: ```yaml token: my-shared-secret tls-san: - - https://my-fixed-registration-address.com + - my-fixed-registration-address.com - another-kubernetes-domain.com ``` From 4a21e8ee289fb9a0f69f34ce3a25cdad6c01fdbb Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Fri, 19 Mar 2021 10:24:32 -0700 Subject: [PATCH 08/14] Change the etcd directory for flatcar linux cluster when install V2 monitoring. #2977 --- content/rancher/v2.5/en/monitoring-alerting/_index.md | 1 + content/rancher/v2.x/en/monitoring-alerting/v2.5/_index.md | 1 + 2 files changed, 2 insertions(+) diff --git a/content/rancher/v2.5/en/monitoring-alerting/_index.md b/content/rancher/v2.5/en/monitoring-alerting/_index.md index 15e5f49d4f0..611c9242132 100644 --- a/content/rancher/v2.5/en/monitoring-alerting/_index.md +++ b/content/rancher/v2.5/en/monitoring-alerting/_index.md @@ -59,6 +59,7 @@ As an [administrator]({{}}/rancher/v2.5/en/admin-settings/rbac/global-p > > - Make sure that you are allowing traffic on port 9796 for each of your nodes because Prometheus will scrape metrics from here. > - Make sure your cluster fulfills the resource requirements. The cluster should have at least 1950Mi memory available, 2700m CPU, and 50Gi storage. A breakdown of the resource limits and requests is [here.](#setting-resource-limits-and-requests) +> - When installing monitoring on an RKE cluster using RancherOS or Flatcar Linux nodes, change the etcd node certificate directory to `/opt/rke/etc/kubernetes/ssl`. 1. In the Rancher UI, go to the cluster where you want to install monitoring and click **Cluster Explorer.** diff --git a/content/rancher/v2.x/en/monitoring-alerting/v2.5/_index.md b/content/rancher/v2.x/en/monitoring-alerting/v2.5/_index.md index 1249041c229..f6ff86eb195 100644 --- a/content/rancher/v2.x/en/monitoring-alerting/v2.5/_index.md +++ b/content/rancher/v2.x/en/monitoring-alerting/v2.5/_index.md @@ -54,6 +54,7 @@ As an [administrator]({{}}/rancher/v2.x/en/admin-settings/rbac/global-p > > - Make sure that you are allowing traffic on port 9796 for each of your nodes because Prometheus will scrape metrics from here. > - Make sure your cluster fulfills the resource requirements. The cluster should have at least 1950Mi memory available, 2700m CPU, and 50Gi storage. A breakdown of the resource limits and requests is [here.](#setting-resource-limits-and-requests) +> - When installing monitoring on an RKE cluster using RancherOS or Flatcar Linux nodes, change the etcd node certificate directory to `/opt/rke/etc/kubernetes/ssl`. 1. In the Rancher UI, go to the cluster where you want to install monitoring and click **Cluster Explorer.** From c5f6cc8e08329e85b409a45f01b229a831e9e362 Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Fri, 19 Mar 2021 10:36:41 -0700 Subject: [PATCH 09/14] Fix markdown URL #3121 --- .../rke-clusters/cloud-providers/amazon/_index.md | 2 +- .../rke-clusters/cloud-providers/amazon/_index.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.0-v2.4/en/cluster-provisioning/rke-clusters/cloud-providers/amazon/_index.md b/content/rancher/v2.0-v2.4/en/cluster-provisioning/rke-clusters/cloud-providers/amazon/_index.md index 84a00dd83e2..bd449cadc54 100644 --- a/content/rancher/v2.0-v2.4/en/cluster-provisioning/rke-clusters/cloud-providers/amazon/_index.md +++ b/content/rancher/v2.0-v2.4/en/cluster-provisioning/rke-clusters/cloud-providers/amazon/_index.md @@ -22,7 +22,7 @@ All nodes added to the cluster must be able to interact with EC2 so that they ca * The first policy is for the nodes with the `controlplane` role. These nodes have to be able to create/remove EC2 resources. The following IAM policy is an example, please remove any unneeded permissions for your use case. * The second policy is for the nodes with the `etcd` or `worker` role. These nodes only have to be able to retrieve information from EC2. -While creating an Amazon EC2 cluster]({{}}/rancher/v2.0-v2.4/en/cluster-provisioning/rke-clusters/node-pools/ec2/), you must fill in the **IAM Instance Profile Name** (not ARN) of the created IAM role when creating the **Node Template**. +While creating an [Amazon EC2 cluster]({{}}/rancher/v2.0-v2.4/en/cluster-provisioning/rke-clusters/node-pools/ec2/), you must fill in the **IAM Instance Profile Name** (not ARN) of the created IAM role when creating the **Node Template**. While creating a [Custom cluster]({{}}/rancher/v2.0-v2.4/en/cluster-provisioning/rke-clusters/custom-nodes), you must manually attach the IAM role to the instance(s). diff --git a/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/cloud-providers/amazon/_index.md b/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/cloud-providers/amazon/_index.md index 101110b7992..3549afe1d1b 100644 --- a/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/cloud-providers/amazon/_index.md +++ b/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/cloud-providers/amazon/_index.md @@ -22,7 +22,7 @@ All nodes added to the cluster must be able to interact with EC2 so that they ca * The first policy is for the nodes with the `controlplane` role. These nodes have to be able to create/remove EC2 resources. The following IAM policy is an example, please remove any unneeded permissions for your use case. * The second policy is for the nodes with the `etcd` or `worker` role. These nodes only have to be able to retrieve information from EC2. -While creating an Amazon EC2 cluster]({{}}/rancher/v2.5/en/cluster-provisioning/rke-clusters/node-pools/ec2/), you must fill in the **IAM Instance Profile Name** (not ARN) of the created IAM role when creating the **Node Template**. +While creating an [Amazon EC2 cluster]({{}}/rancher/v2.5/en/cluster-provisioning/rke-clusters/node-pools/ec2/), you must fill in the **IAM Instance Profile Name** (not ARN) of the created IAM role when creating the **Node Template**. While creating a [Custom cluster]({{}}/rancher/v2.5/en/cluster-provisioning/rke-clusters/custom-nodes), you must manually attach the IAM role to the instance(s). From ff8a2642eda55b61f1f735808be0e3bfc7a6466b Mon Sep 17 00:00:00 2001 From: Rey Lejano Date: Wed, 24 Mar 2021 08:09:09 -0700 Subject: [PATCH 10/14] update minimum eks permissions --- .../hosted-kubernetes-clusters/eks/_index.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/content/rancher/v2.5/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md b/content/rancher/v2.5/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md index 103337c9c6e..92fab1a1bce 100644 --- a/content/rancher/v2.5/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md +++ b/content/rancher/v2.5/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md @@ -517,6 +517,7 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b "Sid": "EC2Permisssions", "Effect": "Allow", "Action": [ + "ec2:RunInstances", "ec2:RevokeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:DescribeVpcs", @@ -524,6 +525,8 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeRouteTables", + "ec2:DescribeLaunchTemplateVersions", + "ec2:DescribeLaunchTemplates", "ec2:DescribeKeyPairs", "ec2:DescribeInternetGateways", "ec2:DescribeImages", @@ -534,6 +537,8 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b "ec2:DeleteKeyPair", "ec2:CreateTags", "ec2:CreateSecurityGroup", + "ec2:CreateLaunchTemplateVersion", + "ec2:CreateLaunchTemplate", "ec2:CreateKeyPair", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" From 6e92ccf42d0c7dfdf4db5fae9d9da1faca5e1a61 Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Fri, 19 Mar 2021 10:44:47 -0700 Subject: [PATCH 11/14] Edit SSH info in Azure quick start guide #3108 --- .../quick-start-guide/deployment/microsoft-azure-qs/_index.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/content/rancher/v2.5/en/quick-start-guide/deployment/microsoft-azure-qs/_index.md b/content/rancher/v2.5/en/quick-start-guide/deployment/microsoft-azure-qs/_index.md index e6ea9eaa8a4..29a316b16eb 100644 --- a/content/rancher/v2.5/en/quick-start-guide/deployment/microsoft-azure-qs/_index.md +++ b/content/rancher/v2.5/en/quick-start-guide/deployment/microsoft-azure-qs/_index.md @@ -39,7 +39,6 @@ Suggestions include: - `azure_location` - Microsoft Azure region, choose the closest instead of the default - `prefix` - Prefix for all created resources - `instance_type` - Compute instance size used, minimum is `Standard_DS2_v2` but `Standard_DS2_v3` or `Standard_DS3_v2` could be used if within budget - - `ssh_key_file_name` - Use a specific SSH key instead of `~/.ssh/id_rsa` (public key is assumed to be `${ssh_key_file_name}.pub`) 1. Run `terraform init`. @@ -56,7 +55,7 @@ Suggestions include: ``` 1. Paste the `rancher_server_url` from the output above into the browser. Log in when prompted (default username is `admin`, use the password set in `rancher_server_admin_password`). - +2. ssh to the Rancher Server using the `id_rsa` key generated in `quickstart/azure`. #### Result Two Kubernetes clusters are deployed into your Azure account, one running Rancher Server and the other ready for experimentation deployments. From be837e7f5ede4b21a911bbbef27e42f278164876 Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Thu, 25 Mar 2021 20:47:19 -0700 Subject: [PATCH 12/14] Modify EKS permissions #3127 --- .../hosted-kubernetes-clusters/eks/_index.md | 5 +++++ .../hosted-kubernetes-clusters/eks/_index.md | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/content/rancher/v2.0-v2.4/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md b/content/rancher/v2.0-v2.4/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md index 3d2bac5a6c4..4bbe6983d39 100644 --- a/content/rancher/v2.0-v2.4/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md +++ b/content/rancher/v2.0-v2.4/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md @@ -231,6 +231,7 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b "Sid": "EC2Permisssions", "Effect": "Allow", "Action": [ + "ec2:RunInstances", "ec2:RevokeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:DescribeVpcs", @@ -238,6 +239,8 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeRouteTables", + "ec2:DescribeLaunchTemplateVersions", + "ec2:DescribeLaunchTemplates", "ec2:DescribeKeyPairs", "ec2:DescribeInternetGateways", "ec2:DescribeImages", @@ -248,6 +251,8 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b "ec2:DeleteKeyPair", "ec2:CreateTags", "ec2:CreateSecurityGroup", + "ec2:CreateLaunchTemplateVersion", + "ec2:CreateLaunchTemplate", "ec2:CreateKeyPair", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" diff --git a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md index 1c793684ff9..96145e9268d 100644 --- a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md +++ b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md @@ -518,6 +518,7 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b "Sid": "EC2Permisssions", "Effect": "Allow", "Action": [ + "ec2:RunInstances", "ec2:RevokeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:DescribeVpcs", @@ -525,6 +526,8 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeRouteTables", + "ec2:DescribeLaunchTemplateVersions", + "ec2:DescribeLaunchTemplates", "ec2:DescribeKeyPairs", "ec2:DescribeInternetGateways", "ec2:DescribeImages", @@ -535,6 +538,8 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b "ec2:DeleteKeyPair", "ec2:CreateTags", "ec2:CreateSecurityGroup", + "ec2:CreateLaunchTemplateVersion", + "ec2:CreateLaunchTemplate", "ec2:CreateKeyPair", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" From 98f54cde2e433e89bb04485af022a272d004ccd9 Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Thu, 25 Mar 2021 20:56:12 -0700 Subject: [PATCH 13/14] Fix formatting --- .../rancher/v2.0-v2.4/en/helm-charts/catalog-config/_index.md | 3 +-- .../en/helm-charts/legacy-catalogs/catalog-config/_index.md | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/content/rancher/v2.0-v2.4/en/helm-charts/catalog-config/_index.md b/content/rancher/v2.0-v2.4/en/helm-charts/catalog-config/_index.md index 93a4eed48e4..d5f0a99a177 100644 --- a/content/rancher/v2.0-v2.4/en/helm-charts/catalog-config/_index.md +++ b/content/rancher/v2.0-v2.4/en/helm-charts/catalog-config/_index.md @@ -49,8 +49,7 @@ When [adding your catalog]({{}}/rancher/v2.0-v2.4/en/catalog/custom/add | Username (Optional) | Username or OAuth Token | | Password (Optional) | If you are authenticating using a username, enter the associated password. If you are using an OAuth token, use `x-oauth-basic`. | | Branch | For a Git repository, the branch name. Default: `master`. For a Helm Chart repository, this field is ignored. | -| Helm version | The Helm version that will be used to deploy all of the charts in the catalog. This field cannot be changed later. For more information, refer to the [section on Helm versions.]( -{{}}/rancher/v2.0-v2.4/en/helm-charts/legacy-catalogs/#catalog-helm-deployment-versions) | +| Helm version | The Helm version that will be used to deploy all of the charts in the catalog. This field cannot be changed later. For more information, refer to the [section on Helm versions.]({{}}/rancher/v2.0-v2.4/en/helm-charts/legacy-catalogs/#catalog-helm-deployment-versions) | # Private Repositories diff --git a/content/rancher/v2.x/en/helm-charts/legacy-catalogs/catalog-config/_index.md b/content/rancher/v2.x/en/helm-charts/legacy-catalogs/catalog-config/_index.md index 047a2d16122..37b66da90fe 100644 --- a/content/rancher/v2.x/en/helm-charts/legacy-catalogs/catalog-config/_index.md +++ b/content/rancher/v2.x/en/helm-charts/legacy-catalogs/catalog-config/_index.md @@ -48,8 +48,7 @@ When [adding your catalog]({{}}/rancher/v2.x/en/catalog/custom/adding/) | Username (Optional) | Username or OAuth Token | | Password (Optional) | If you are authenticating using a username, enter the associated password. If you are using an OAuth token, use `x-oauth-basic`. | | Branch | For a Git repository, the branch name. Default: `master`. For a Helm Chart repository, this field is ignored. | -| Helm version | The Helm version that will be used to deploy all of the charts in the catalog. This field cannot be changed later. For more information, refer to the [section on Helm versions.]( -{{}}/rancher/v2.x/en/helm-charts/legacy-catalogs/#catalog-helm-deployment-versions) | +| Helm version | The Helm version that will be used to deploy all of the charts in the catalog. This field cannot be changed later. For more information, refer to the [section on Helm versions.]({{}}/rancher/v2.x/en/helm-charts/legacy-catalogs/#catalog-helm-deployment-versions) | # Private Repositories From 336a098a7901b5abbfa9080400967b60ad655493 Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Fri, 26 Mar 2021 15:45:11 -0700 Subject: [PATCH 14/14] Remove misplaced files --- .../out-of-tree-vsphere/_index.md | 49 --------- .../vsphere-volume-migration/_index.md | 99 ------------------- 2 files changed, 148 deletions(-) delete mode 100644 content/rancher/v2.x/en/cluster-admin/volumes-and-storage/out-of-tree-vsphere/_index.md delete mode 100644 content/rancher/v2.x/en/cluster-admin/volumes-and-storage/vsphere-volume-migration/_index.md diff --git a/content/rancher/v2.x/en/cluster-admin/volumes-and-storage/out-of-tree-vsphere/_index.md b/content/rancher/v2.x/en/cluster-admin/volumes-and-storage/out-of-tree-vsphere/_index.md deleted file mode 100644 index c3f593e6549..00000000000 --- a/content/rancher/v2.x/en/cluster-admin/volumes-and-storage/out-of-tree-vsphere/_index.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: vSphere Out-of-tree Cloud Provider -weight: 10 ---- -_Available as of v2.5.6_ - -Kubernetes is moving away from maintaining cloud providers in-tree. vSphere has an out-of-tree cloud provider that can be used by installing the vSphere cloud provider and cloud storage plugins. - -This page covers how to install the CPI and CSI plugins after bringing up a cluster. - -# Prerequisites - -The vSphere version must be 6.7U3 or higher. - -# Installation - -The Cloud Provider Interface (CPI) should be installed first before installing the Cloud Storage Interface (CSI). - -### 1. Create a vSphere cluster - -1. On the Clusters page, click on **Add Cluster** and select the **vSphere** option. -1. Under **Cluster Options > In-Tree Cloud Provider** select **External**. -1. Click **Create**. - -### 2. Install the CPI plugin - - 1. From the **Cluster Explorer** view, go to the top left dropdown menu and click **Apps & Marketplace.** -1. Select the **vsphere-cpi** chart from the **helm3-library** catalog. Fill out the required vCenter details. -1. vSphere CPI initializes all nodes with ProviderID which is needed by the vSphere CSI driver. Check if all nodes are initialized with the ProviderID before installing CSI driver with the following command: - - ``` - kubectl describe nodes | grep "ProviderID" - ``` - -### 3. Installing the CSI plugin - - 1. From the **Cluster Explorer** view, go to the top left dropdown menu and click **Apps & Marketplace.** -1. Select the **vsphere-csi** chart from the **helm3-library** catalog. Fill out the required vCenter details. -2. Set **Enable CSI Migration** to **false**. -3. This chart creates a StorageClass with the `csi.vsphere.vmware.com` as the provisioner. Fill out the details for the StorageClass and launch the chart. - - -# Using the CSI driver for provisioning volumes - -The CSI chart by default creates a storageClass. - -If that option was not selected while launching the chart, create a storageClass with the `csi.vsphere.vmware.com` as the provisioner. - -All volumes provisioned using this StorageClass will get provisioned by the CSI driver. \ No newline at end of file diff --git a/content/rancher/v2.x/en/cluster-admin/volumes-and-storage/vsphere-volume-migration/_index.md b/content/rancher/v2.x/en/cluster-admin/volumes-and-storage/vsphere-volume-migration/_index.md deleted file mode 100644 index e024e44a252..00000000000 --- a/content/rancher/v2.x/en/cluster-admin/volumes-and-storage/vsphere-volume-migration/_index.md +++ /dev/null @@ -1,99 +0,0 @@ ---- -title: Migrating vSphere In-tree Volumes to CSI -weight: 5 ---- -_Available as of v2.5.6_ - -Kubernetes is moving away from maintaining cloud providers in-tree. vSphere has an out-of-tree cloud provider that can be used by installing the vSphere cloud provider and cloud storage plugins. - -This page covers how to migrate from the in-tree vSphere cloud provider to out-of-tree, and manage the existing VMs post migration. - -It follows the steps provided in the official [vSphere migration documentation](https://vsphere-csi-driver.sigs.k8s.io/features/vsphere_csi_migration.html) and provides the steps to be performed in Rancher. - -### Cloud-config Format Limitation - -Existing volumes that were provisioned using the following cloud-config format will NOT get migrated due to an existing bug in vsphere CSI. - -If the cloud-config has this format for datastore and resource pool path, vsphere CSI driver cannot recognize it: - -```yaml -default-datastore: /datastore/ -resourcepool-path: "/host//Resources/" -``` - -Volumes provisioned with the in-tree provider using the following format will get migrated correctly: - -```yaml -default-datastore: -resourcepool-path: "/Resources/" -``` - -Upstream bug: https://github.com/kubernetes-sigs/vsphere-csi-driver/issues/628 - -Rancher issue tracking this bug: https://github.com/rancher/rancher/issues/31105 - -# Prerequisites - -- vSphere CSI Migration requires vSphere 7.0u1. In order to be able to manage existing in-tree vSphere volumes, upgrade vSphere to 7.0u1. -- The Kubernetes version must be 1.19 or higher. - -# Migration - -### 1. Install the CPI plugin - -Before installing CPI, we need to taint all nodes with `node.cloudprovider.kubernetes.io/uninitialized=true:NoSchedule`. - -This can be done by running the following commands: - -``` -curl -O https://raw.githubusercontent.com/rancher/helm3-charts/56b622f519728378abeddfe95074f1b87ab73b1e/charts/vsphere-cpi/taints.sh -``` - -Or: - -``` -wget https://raw.githubusercontent.com/rancher/helm3-charts/56b622f519728378abeddfe95074f1b87ab73b1e/charts/vsphere-cpi/taints.sh -chmod +x taints.sh -./taints.sh -``` - -Once all nodes are tainted by the running the script, launch the Helm vSphere CPI chart. - -1. Within a project, select **Apps > Launch.** -2. Select the **vsphere-cpi** chart from the **helm3-library** catalog. -3. Fill out the required vCenter details and click **Launch**. - -vSphere CPI initializes all nodes with ProviderID, which is needed by the vSphere CSI driver. - -Check if all nodes are initialized with the ProviderID with the following command: - -``` -kubectl describe nodes | grep "ProviderID" -``` - -### 2. Install the CSI driver - -1. Within a project, select **Apps > Launch** and select the **vsphere-csi** chart from the **helm3-library** catalog. -1. Fill out the required vCenter details and click **Launch**. -1. Set **Enable CSI Migration** to **true**. -1. This chart creates a StorageClass with the `csi.vsphere.vmware.com` as the provisioner. You can provide the URL of the datastore to be used for CSI volume provisioning while creating this StorageClass. The datastore URL can be found in the vSphere client by selecting the datastore and going to the Summary tab. Fill out the details for the StorageClass and click **Launch**. - -### 3. Edit the cluster to enable CSI migration feature flags - -1. While editing the cluster, if the Kubernetes version is less than 1.19, select Kubernetes version 1.19 or higher from the **Kubernetes Version** dropdown. -2. For enabling feature flags, click on "Edit as YAML", and add the following under kube-controller and kubelet: - - ```yaml - extra_args: - feature-gates: "CSIMigration=true,CSIMigrationvSphere=true" - ``` - -### 4. Drain worker nodes - -Worker nodes must be drained during the upgrade before changing the kubelet and kube-controller-manager args. - -1. Click **Edit as Form** and then click on "Advanced Options." -1. Set the field **Maximum Worker Nodes Unavailable** to count of 1. -1. To drain the nodes during upgrade, select **Drain Nodes > Yes**. -1. Set **Force** and **Delete Local Data** to **true**. -1. Click **Save** to upgrade the cluster. \ No newline at end of file