diff --git a/content/rancher/v2.x/en/faq/contributing/_index.md b/content/rancher/v2.x/en/faq/contributing/_index.md index 32dcec70bea..cec832053ca 100644 --- a/content/rancher/v2.x/en/faq/contributing/_index.md +++ b/content/rancher/v2.x/en/faq/contributing/_index.md @@ -16,9 +16,53 @@ All of repositories are located within our main GitHub organization. There are m - [Rancher CLI Repo](https://github.com/rancher/cli): This repository is the source code for the Rancher CLI used in Rancher 2.x. -### Bugs +### Bugs, Issues or Questions + +If you find any bugs or are having any trouble, please search the [reported issue](https://github.com/rancher/rancher/issues) as someone may have experienced the same issue or we are actively working on a solution. + +If you can't find anything related to your issue, contact us by [filing an issue](https://github.com/rancher/rancher/issues/new). Though we have many repositories related to Rancher, we want the bugs filed in the Rancher repository so we won't miss them! If you want to ask a question or ask fellow users about an use case, we suggest creating a post on the [Rancher Forums](https://forums.rancher.com). + +Please follow this checklist when filing an issue which will helps us investigate and fix the issue. More info means more data we can use to determine what is causing the issue or what might be related to the issue. + +>**Note:** For large amounts of data, please use [GitHub Gist](https://gist.github.com/) or similar and link the created resource in the issue. +>**Important:** Please remove any sensitive data as it will be publicly viewable. + +- Provide as much as detail as possible on the used resources. As the source of the issue can be many things, including as much of detail as possible helps to determine the root cause. See some examples below: + - Hosts (what cloud does it happen on, what Amazon Machine Image are you using, what DigitalOcean droplet are you using, what image are you provisioning that we can rebuild or use when we try to reproduce) + - Operating System (What operating system are you using. Providing specifics helps here like the output of `cat /etc/os-release` for exact OS release and `uname -r` for exact kernel used) + - Docker (What Docker version are you using, how did you install it? Most of the details of Docker can be found by supplying output of `docker version` and `docker info`) + - Environment (Are you in a proxy environment, are you using recognized CA/self signed certificates, are you using an external loadbalancer) + - Rancher (What version of Rancher are you using, this can be found on the bottom left of the UI or be retrieved from the image tag you are running on the host) + - Clusters (What kind of cluster did you create, how did you create it, what did you specify when you were creating it) +- Provide as much detail on how you got into the reported situation. This helps the person to reproduce the situation you are in. + - Provide manual steps or automation scripts used to get from a newly created setup to the situation you reported. +- Provide data/logs from the used resources. + - Rancher + - Single node + + ``` + docker logs \ + --tail=all \ + --timestamps \ + $(docker ps -q -f label=org.label-schema.vcs-url=https://github.com/rancher/rancher.git) + ``` + - High Availability + + ``` + kubectl --kubeconfig $KUBECONFIG logs \ + -n cattle-system \ + --timestamps=true \ + -f $(kubectl --kubeconfig $KUBECONFIG get pods -n cattle-system -o json | jq -r '.items[] | select(.spec.containers[].name="cattle-server") | .metadata.name') + ``` + - System logging (these might not all exist, depending on operating system) + - `/var/log/messages` + - `/var/log/syslog` + - `/var/log/kern.log` + - Docker daemon logging (these might not all exist, depending on operating system) + - `/var/log/docker.log` + +If you are experiencing performance issues, please provide as much of data (files or screenshots) of metrics which can help determing what is going on. If you have an issue related to a machine, it helps to supply output of `top`, `free -m`, `df` which shows processes/memory/disk usage. -If you find any bugs or are having any trouble, please contact us by filing an issue. Though we have many repositories related to Rancher, we want the bugs filed in the Rancher repo so we won’t miss them! ### Docs diff --git a/content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md index d33f854d83f..868ce25ae97 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md @@ -57,12 +57,6 @@ Installation of Rancher in a high-availability configuration involves multiple p During installation, RKE generates a config file that you'll use later for upgrades. Back it up to a safe location. -12. **For those using a certificate signed by a recognized CA:** - - [Remove Default Certificates](#12-remove-default-certificates) - - If you chose [Option B](#option-b-bring-your-own-certificate-signed-by-recognized-ca) as your SSL option, log into the Rancher UI and remove the certificates that Rancher automatically generates. -
## 1. Provision Linux Hosts @@ -111,7 +105,8 @@ Health checks can be executed on the `/healthz` endpoint of the node, this will We have example configurations for the following load balancers: -* [Amazon ALB]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install-external-lb/alb) +* [Amazon ALB configuration]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install-external-lb/alb) +* [NGINX configuration]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install-external-lb/nginx) ## 3. Configure DNS @@ -180,7 +175,7 @@ RKE uses a YAML config file to install and configure your Kubernetes cluster. Th 1. Download one of following templates, depending on the SSL certificate you're using. - [Template for self-signed certificate
`3-node-externalssl-certificate.yml`](https://raw.githubusercontent.com/rancher/rancher/58e695b51096b1f404188379cea6f6a35aea9e4c/rke-templates/3-node-externalssl-certificate.yml) - - [Template for certificate signed by recognized CA
`3-node-externalssl-recognizedca.yml`](https://raw.githubusercontent.com/rancher/rancher/58e695b51096b1f404188379cea6f6a35aea9e4c/rke-templates/3-node-externalssl-recognizedca.yml) + - [Template for certificate signed by recognized CA
`3-node-externalssl-recognizedca.yml`](https://raw.githubusercontent.com/rancher/rancher/7f60dc3afe1b45287ac36ba6bde6f7c6e35c11fe/rke-templates/3-node-externalssl-recognizedca.yml) 2. Rename the file to `rancher-cluster.yml`. @@ -328,22 +323,6 @@ With all configuration in place, use RKE to launch Rancher. You can complete thi During installation, RKE automatically generates a config file named `kube_config_rancher-cluster.yml` in the same directory as the `rancher-cluster.yml` file. Copy this file and back it up to a safe location. You'll use this file later when upgrading Rancher Server. -## 12. Remove Default Certificates - -**For those using a certificate signed by a recognized CA:** - ->**Note:** If you're using a self-signed certificate, you don't have to complete this procedure. Continue to [What's Next?](#what-s-next) - -By default, Rancher automatically generates self-signed certificates for itself after installation. However, since you've provided your own certificates, you must disable the certificates that Rancher generated for itself. - -**To Remove the Default Certificates:** - -1. Log into Rancher. - -2. Select **Settings** > **cacerts**. - -3. Choose `Edit` and remove the contents. Then click `Save`. - ## What's Next? You have a couple of options: diff --git a/content/rancher/v2.x/en/installation/ha-server-install-external-lb/nginx/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-external-lb/nginx/_index.md new file mode 100644 index 00000000000..20579aa96b8 --- /dev/null +++ b/content/rancher/v2.x/en/installation/ha-server-install-external-lb/nginx/_index.md @@ -0,0 +1,78 @@ +--- +title: NGINX configuration +weight: 277 +--- +## Install NGINX + +Start by installing NGINX on your load balancer host. NGINX has packages available for all known operating systems. + +For help installing NGINX, refer to their [install documentation](https://www.nginx.com/resources/wiki/start/topics/tutorials/install/). + +## Create NGINX Configuration + +After installing NGINX, you need to create the NGINX config file, `/etc/nginx/conf.d/rancher.conf`, with the IP addresses for your Linux nodes, chosen FQDN and location of the certificate file and certificate key file. + +1. Copy and paste the code sample below into your favorite text editor. Save it as `/etc/nginx/conf.d/rancher.conf`. + + **Example NGINX config:** + ``` + upstream rancher { + server IP_NODE_1:80; + server IP_NODE_2:80; + server IP_NODE_3:80; + } + + map $http_upgrade $connection_upgrade { + default Upgrade; + '' close; + } + + server { + listen 443 ssl http2; + server_name FQDN; + ssl_certificate /certs/fullchain.pem; + ssl_certificate_key /certs/privkey.pem; + + location / { + proxy_set_header Host $host; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Port $server_port; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_pass http://rancher; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + # This allows the ability for the execute shell window to remain open for up to 15 minutes. Without this parameter, the default is 1 minute and will automatically close. + proxy_read_timeout 900s; + } + } + + server { + listen 80; + server_name FQDN; + return 301 https://$server_name$request_uri; + } + ``` + +2. In `/etc/nginx/conf.d/rancher.conf`, replace `IP_NODE_1`, `IP_NODE_2`, and `IP_NODE_3` with the IPs of your Linux hosts. +3. In `/etc/nginx/conf.d/rancher.conf`, replace `FQDN` with the FQDN you chose for your Rancher installation. +4. In `/etc/nginx/conf.d/rancher.conf`, replace `/certs/fullchain.pem` with the path to your certificate. If there are intermediates required for you certificate, they should be included in this file. +5. In `/etc/nginx/conf.d/rancher.conf`, replace `/certs/privkey.pem` with the path to your certificate key. + +## Run NGINX + +* Reload or restart NGINX + + ```` + # Reload NGINX + nginx -s reload + + # Restart NGINX + # Depending on your Linux distribution + service nginx restart + systemctl restart nginx + ```` + +## Browse to Rancher UI + +You should now be to able to browse to `https://FQDN`. diff --git a/content/rancher/v2.x/en/installation/ha-server-install/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/_index.md index a0c82210974..efd0a46a5ec 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install/_index.md @@ -57,12 +57,6 @@ Installation of Rancher in a high-availability configuration involves multiple p During installation, RKE generates a config file that you'll use later for upgrades. Back it up to a safe location. -12. **For those using a certificate signed by a recognized CA:** - - [Remove Default Certificates](#12-remove-default-certificates) - - If you chose [Option B](#option-b-bring-your-own-certificate-signed-by-recognized-ca) as your SSL option, log into the Rancher UI and remove the certificates that Rancher automatically generates. -
## 1. Provision Linux Hosts @@ -230,7 +224,7 @@ RKE uses a `.yml` config file to install and configure your Kubernetes cluster. 1. Download one of following templates, depending on the SSL certificate you're using. - [Template for self-signed certificate
`3-node-certificate.yml`](https://raw.githubusercontent.com/rancher/rancher/e9d29b3f3b9673421961c68adf0516807d1317eb/rke-templates/3-node-certificate.yml) - - [Template for certificate signed by recognized CA
`3-node-certificate-recognizedca.yml`](https://raw.githubusercontent.com/rancher/rancher/e9d29b3f3b9673421961c68adf0516807d1317eb/rke-templates/3-node-certificate-recognizedca.yml) + - [Template for certificate signed by recognized CA
`3-node-certificate-recognizedca.yml`](https://raw.githubusercontent.com/rancher/rancher/d8ca0805a3958552e84fdf5d743859097ae81e0b/rke-templates/3-node-certificate-recognizedca.yml) 2. Rename the file to `rancher-cluster.yml`. @@ -427,22 +421,6 @@ INFO[0101] Finished building Kubernetes cluster successfully During installation, RKE automatically generates a config file named `kube_config_rancher-cluster.yml` in the same directory as the RKE binary. Copy this file and back it up to a safe location. You'll use this file later when upgrading Rancher Server. -## 12. Remove Default Certificates - -**For those using a certificate signed by a recognized CA:** - ->**Note:** If you're using a self-signed certificate, you don't have to complete this procedure. Continue to [What's Next?](#what-s-next) - -By default, Rancher automatically generates self-signed certificates for itself after installation. However, since you've provided your own certificates, you must disable the certificates that Rancher generated for itself. - -**To Remove the Default Certificates:** - -1. Log into Rancher. - -2. Select **Settings** > **cacerts**. - -3. Choose `Edit` and remove the contents. Then click `Save`. - ## What's Next? You have a couple of options: diff --git a/content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md b/content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md index 1c6deb2dde0..54eeed48a4f 100644 --- a/content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md +++ b/content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md @@ -26,12 +26,6 @@ Installation of Rancher on a single node with an external load balancer involves Setup a load balancer to direct communications with Rancher and your Kubernetes cluster. -4. **For those using a certificate signed by a recognized CA:** - - [Remove Default Certificates](#4-remove-default-certificates) - - If you chose [Option B](#option-b-bring-your-own-certificate-signed-by-recognized-ca) as your SSL option, log into the Rancher UI and remove the certificates that Rancher automatically generates. - ## 1. Provision Linux Host @@ -104,14 +98,14 @@ If your cluster is public facing, it's best to use a certificate signed by a rec **To Install Rancher Using a Cert Signed by a Recognized CA:** -If you use a certificate signed by a recognized CA, installing your certificate in the Rancher container isn't necessary. Just run the basic install command below. +If you use a certificate signed by a recognized CA, installing your certificate in the Rancher container isn't necessary. We do have to make sure there is no default CA certificate generated and stored, you can do this by passing the `--no-cacerts` parameter to the container. 1. Enter the following command. ``` docker run -d --restart=unless-stopped \ -p 80:80 -p 443:443 \ - rancher/rancher:latest + rancher/rancher:latest --no-cacerts ``` ## 3. Configure Load Balancer @@ -174,22 +168,6 @@ server { } ``` -## 4. Remove Default Certificates - -**For those using a certificate signed by a recognized CA:** - ->**Note:** If you're using a self-signed certificate, don't complete this procedure. Continue to [What's Next?](#what-s-next) - -By default, Rancher automatically generates self-signed certificates for itself after installation. However, since you've provided your own certificates, you must disable the certificates that Rancher generated for itself. - -**To Remove the Default Certificates:** - -1. Log into Rancher. - -2. Select **Settings** > **cacerts**. - -3. Choose `Edit` and remove the contents. Then click `Save`. -
## What's Next? diff --git a/content/rancher/v2.x/en/installation/troubleshooting-ha/job-complete-status/_index.md b/content/rancher/v2.x/en/installation/troubleshooting-ha/job-complete-status/_index.md index 8ea054a3bf6..375a6387346 100644 --- a/content/rancher/v2.x/en/installation/troubleshooting-ha/job-complete-status/_index.md +++ b/content/rancher/v2.x/en/installation/troubleshooting-ha/job-complete-status/_index.md @@ -24,6 +24,7 @@ The structure of the addons definition in `rancher-cluster.yml` is wrong. In the diff --git a/content/rancher/v2.x/en/tasks/projects/add-configmaps/_index.md b/content/rancher/v2.x/en/tasks/projects/add-configmaps/_index.md index c2c71a4fe63..75bb0a2b077 100644 --- a/content/rancher/v2.x/en/tasks/projects/add-configmaps/_index.md +++ b/content/rancher/v2.x/en/tasks/projects/add-configmaps/_index.md @@ -10,32 +10,31 @@ ConfigMaps store general configuration information for an application, such as c 1. From the **Global** view, select the project containing the namespace that you want to add a ConfigMap to. -1. From the main menu, select **Resources > Certificates**. Click **Add Certificate**. +1. From the main menu, select **Resources > Config Maps**. Click **Add Config Map**. -1. Enter a **Name** for the certificate. +1. Enter a **Name** for the Config Map. >**Note:** Kubernetes classifies ConfigMaps as [secrets](https://kubernetes.io/docs/concepts/configuration/secret/), and no two secrets in a project or namespace can have duplicate names. Therefore, to prevent conflicts, your ConfigMaps must have a unique name among the other certificates, ConfigMaps, registries, and secrets within your workspace. -1. Click on **Add Config Map** option and give it a name. - -1. Select the **Namespace** you want to add a ConfigMap to. You can also add a new namespace on the fly by clicking **Add to a new namespace**. +1. Select the **Namespace** you want to add Config Map to. You can also add a new namespace on the fly by clicking **Add to a new namespace**. 1. From **Config Map Values**, click **Add Config Map Value** to add a key value pair to your ConfigMap. Add as many values as you need. - - >**Note:** Don't use ConfigMaps to store sensitive data. +1. Click **Save**. + + >**Note:** Don't use ConfigMaps to store sensitive data [use a secret](../add-a-secret). > >**Tip:** You can add multiple key value pairs to the ConfigMap by copying and pasting. > > ![Bulk Key Value Pair Copy/Paste]({{< baseurl >}}/img/rancher/bulk-key-values.gif) -1. Click **Save**. - - **Result:** Your ConfigMap is added to the namespace. You can view it in the Rancher UI from the **Resources > Config Maps** view. ## What's Next? -Now that you have a ConfigMap added to a namespace, you can add it to a workload that you deploy from the namespace of origin. +Now that you have a ConfigMap added to a namespace, you can add it to a workload that you deploy from the namespace of origin. You can use the ConfigMap to specify information for you application to consume, such as: + +- Application environment variables. +- Specifying parameters for a Volume mounted to the workload. For more information on adding ConfigMaps to a workload, see [Deploying Workloads](../../workloads/deploy-workloads). \ No newline at end of file diff --git a/content/rancher/v2.x/en/tasks/projects/add-configuration-maps/_index.md b/content/rancher/v2.x/en/tasks/projects/add-configuration-maps/_index.md deleted file mode 100644 index 846fb199303..00000000000 --- a/content/rancher/v2.x/en/tasks/projects/add-configuration-maps/_index.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -title: Adding Configuration Maps -weight: -draft: true ---- -Coming Soon diff --git a/content/rancher/v2.x/en/tasks/workloads/deploy-workloads/_index.md b/content/rancher/v2.x/en/tasks/workloads/deploy-workloads/_index.md index a090f21e168..6a06772ae29 100644 --- a/content/rancher/v2.x/en/tasks/workloads/deploy-workloads/_index.md +++ b/content/rancher/v2.x/en/tasks/workloads/deploy-workloads/_index.md @@ -22,9 +22,15 @@ Deploy a workload to run an application in one or more containers. 1. Configure the remaining options: - **Environment Variables** + + Use this section to either specify environment variables for your workload to consume on the fly, or to pull them from another source, such as a secret or [ConfigMap](../../projects/add-configmaps). + - **Node Scheduling** - **Health Check** - - **Volumes** + - **Volumes** + + Use this section to add storage for your workload. You can manually specify the volume that you want to add, use a persistent volume claim to dynamically create a volume for the workload, or read data for a volume to use from a file such as a [ConfigMap](../../projects/add-configmaps). + - **Scaling/Upgrade Policy** 1. Click **Show Advanced Options** and configure: diff --git a/layouts/shortcodes/ssl_faq_single.html b/layouts/shortcodes/ssl_faq_single.html index aa3d2acefae..71f02c6b4d0 100644 --- a/layouts/shortcodes/ssl_faq_single.html +++ b/layouts/shortcodes/ssl_faq_single.html @@ -17,6 +17,42 @@ VWQqljhfacYPgp8KJUJENQ9h5hZ2nSCrI+W00Jcw4QcEdCI8HL5wmg== -----END CERTIFICATE----- +

PEM Certificate Key Example:

+ +
+-----BEGIN RSA PRIVATE KEY-----
+MIIGVDCCBDygAwIBAgIJAMiIrEm29kRLMA0GCSqGSIb3DQEBCwUAMHkxCzAJBgNV
+... more lines
+VWQqljhfacYPgp8KJUJENQ9h5hZ2nSCrI+W00Jcw4QcEdCI8HL5wmg==
+-----END RSA PRIVATE KEY-----
+
+ +

If your key looks like the example below, see How Can I Convert My Certificate Key From PKCS8 to PKCS1?

+ +

+-----BEGIN PRIVATE KEY-----
+MIIGVDCCBDygAwIBAgIJAMiIrEm29kRLMA0GCSqGSIb3DQEBCwUAMHkxCzAJBgNV
+... more lines
+VWQqljhfacYPgp8KJUJENQ9h5hZ2nSCrI+W00Jcw4QcEdCI8HL5wmg==
+-----END PRIVATE KEY-----
+
+ +

How Can I Convert My Certificate Key From PKCS8 to PKCS1?

+ +

If you are using a PKCS8 certificate key file, Rancher will log the following line:

+ +
+ListenConfigController cli-config [listener] failed with : failed to read private key: asn1: structure error: tags don't match (2 vs {class:0 tag:16 length:13 isCompound:true})
+
+ +

To make this work, you will need to convert the key from PKCS8 to PKCS1 using the command below:

+ +
+openssl rsa -in key.pem -out convertedkey.pem
+
+ +

You can now use convertedkey.pem as certificate key file for Rancher.

+

What is the Order of Certificates if I Want to Add My Intermediate(s)?

The order of adding certificates is as follows:

diff --git a/scripts/dev b/scripts/dev index 6b0dc7f2e20..211d5f7f671 100755 --- a/scripts/dev +++ b/scripts/dev @@ -5,7 +5,9 @@ PORT=9001 IMAGE=rancher/docs TAG=dev THEME= -BUILD= +BUILD_BUILD= +BUILD_DEV= +UPLOAD= # cd to app root CWD=$(dirname $0) @@ -20,11 +22,13 @@ print_help() cat 1>&2 <