Merge branch 'main' into imperative-api-required

2026-09-25 12:38:05 +00:00 · 2025-07-31 19:30:20 +02:00
parent 80dc50b560 8268557cfb
commit 30a5a05733
288 changed files with 16815 additions and 33505 deletions
@@ -25,7 +25,7 @@ jobs:
        run: yarn install --frozen-lockfile
      - name: Build website
        env:
-          NODE_OPTIONS: "--max_old_space_size=7168"
+          NODE_OPTIONS: "--max_old_space_size=8192"
        run: yarn build --no-minify

      - name: Upload Build Artifact
@@ -15,7 +15,7 @@ To get started, [fork](https://github.com/rancher/rancher-docs/fork) and clone t

 Our repository doesn't allow you to make changes directly to the `main` branch. Create a working branch and make pull requests from your fork to [rancher/rancher-docs](https://github.com/rancher/rancher-docs).

-For most updates, you'll need to edit a file in the `/docs` directory, which represents the ["Latest"](https://ranchermanager.docs.rancher.com/) version of our published documentation. The "Latest" version is a mirror of the most recently released version of Rancher. As of August 2024, the most recently released version of Rancher is 2.9.
+For most updates, you'll need to edit a file in the `/docs` directory, which represents the ["Latest"](https://ranchermanager.docs.rancher.com/) version of our published documentation. The "Latest" version is a mirror of the most recently released version of Rancher. As of July 2025, the most recently released version of Rancher is 2.12.

 Whenever an update is made to `/docs`, you should apply the same change to the corresponding file in `/versioned_docs/version-2.9`. If a change only affects older versions, you don't need to mirror it to the `/docs` directory.

@@ -15,4 +15,4 @@ At this time, not all Rancher resources are available through the Rancher Kubern

 import ApiDocMdx from '@theme/ApiDocMdx';

-<ApiDocMdx id="rancher-api-v2-11" />
+<ApiDocMdx id="rancher-api-v2-12" />
@@ -16,4 +16,4 @@ All versions of Kubernetes supported by Rancher with the feature will have the a

 :::note
 If the underlying Kubernetes distribution does not support the aggregation layer, you must migrate to a Kubernetes distribution that does before upgrading.
-:::
+:::
@@ -72,7 +72,7 @@ API responses are paginated with a limit of 100 resources per page by default. T

 ## Capturing v3 API Calls

-You can use browser developer tools to capture how the v3 API is called. For example, you could follow these steps to use the Chrome developer tools to get the API call for provisioning an RKE cluster:
+You can use browser developer tools to capture how the v3 API is called. For example, you could follow these steps to use the Chrome developer tools to get the API call for provisioning a Rancher Kubernetes distribution cluster:

 1. In the Rancher UI, go to **Cluster Management** and click **Create.**
 1. Click one of the cluster types. This example uses Digital Ocean.
@@ -0,0 +1,205 @@
+---
+title: Kubeconfigs
+---
+
+<head>
+    <link rel="canonical" href="https://ranchermanager.docs.rancher.com/api/workflows/kubeconfigs"/>
+</head>
+
+## Kubeconfig Resource
+
+Kubeconfig is a Rancher resource `kubeconfigs.ext.cattle.io` that allows generating `v1.Config` kubeconfig files for interacting with Rancher and clusters managed by Rancher.
+
+```sh
+kubectl api-resources --api-group=ext.cattle.io
+```
+
+To get a description of the fields and structure of the Kubeconfig resource, run:
+
+```sh
+kubectl explain kubeconfigs.ext.cattle.io
+```
+
+## Feature Flag
+
+The Kubeconfigs Public API is available since Rancher v2.12.0 and is enabled by default. It can be disabled by setting the `ext-kubeconfigs` feature flag to `false`.
+
+```sh
+kubectl patch feature ext-kubeconfigs -p '{"spec":{"value":false}}'
+```
+
+## Creating a Kubeconfig
+
+Only a **valid and active** Rancher user can create a Kubeconfig. For example, trying to create a Kubeconfig using a `system:admin` service account will lead to an error:
+
+```bash
+kubectl create -o jsonpath='{.status.value}' -f -<<EOF
+apiVersion: ext.cattle.io/v1
+kind: Kubeconfig
+EOF
+Error from server (Forbidden): error when creating "STDIN": kubeconfigs.ext.cattle.io is forbidden: user system:admin is not a Rancher user
+```
+
+:::warning Important
+
+The kubeconfig content is generated and returned in the `.status.value` field **only once** when the Kubeconfig is successfully created because it contains secret values for created tokens. Therefore it has to be captured by using an appropriate output option, such as `-o jsonpath='{.status.value}'`, or `-o yaml`.
+
+:::
+
+A kubeconfig can be created for more than one cluster at a time by specifying a list of cluster names in the `spec.clusters` field. You can look up cluster names by listing `clusters.management.cattle.io` resources.
+
+```sh
+kubectl get clusters.management.cattle.io -o=jsonpath="{.items[*]['metadata.name', 'spec.displayName']}{'\n'}"
+local local
+c-m-p66cdvlj downstream1
+```
+
+The `metadata.name` and `metadata.generateName` fields are ignored, and the name of the new Kubeconfig is automatically generated using the prefix `kubeconfig-`.
+
+You can use the `spec.currentContext` field to set the cluster name, and it is used to set the current context in the kubeconfig. If you do not set the `spec.currentContext` field, then the first cluster in the `spec.clusters` list will be used as the current context. For ACE-enabled clusters that don't have an FQDN set, the first control plane node will be used as the current context.
+
+For ACE-enabled clusters, if the FQDN is set, then that will be used as a cluster entry in the kubeconfig; otherwise, entries for all control plane nodes will be created.
+
+```bash
+kubectl create -o jsonpath='{.status.value}' -f -<<EOF
+apiVersion: ext.cattle.io/v1
+kind: Kubeconfig
+spec:
+  clusters: [c-m-p66cdvlj, c-m-fcd3g5h]
+  description: My Kubeconfig
+  currentContext: c-m-p66cdvlj
+EOF
+```
+
+If `"*"` is specified as the first item in the `spec.clusters` field, the kubeconfig will be created for all clusters that the user has access to, if any.
+
+```bash
+kubectl create -o jsonpath='{.status.value}' -f -<<EOF
+apiVersion: ext.cattle.io/v1
+kind: Kubeconfig
+spec:
+  clusters: ["*"]
+  description: My Kubeconfig
+EOF
+```
+
+If `spec.ttl` is not specified, the Kubeconfig's tokens will be created with the expiration time defined in the `kubeconfig-default-token-ttl-minutes` setting, which is 30 days by default. If `spec.ttl` is specified, it should be greater than 0 and less than or equal to the value of the `kubeconfig-default-token-ttl-minutes` setting expressed in seconds.
+
+```bash
+kubectl create -o jsonpath='{.status.value}' -f -<<EOF
+apiVersion: ext.cattle.io/v1
+kind: Kubeconfig
+spec:
+  clusters: [c-m-p66cdvlj] # Downstream cluster
+  ttl: 7200 # 2 hours
+EOF
+```
+
+## Listing Kubeconfigs
+
+Listing previously generated Kubeconfigs can be useful for cleaning up backing tokens if the Kubeconfig is no longer needed (e.g., it was issued temporarily). Admins can list all Kubeconfigs, while regular users can only view their own.
+
+```sh
+kubectl get kubeconfig
+NAME               TTL   TOKENS   STATUS     AGE
+kubeconfig-zp786   30d   2/2      Complete   18d
+kubeconfig-7zvzp   30d   1/1      Complete   12d
+kubeconfig-jznml   30d   1/1      Complete   12d
+```
+Use `-o wide` to get more details:
+
+```sh
+kubectl get kubeconfig -o wide
+NAME               TTL   TOKENS   STATUS     AGE     USER         CLUSTERS       DESCRIPTION
+kubeconfig-zp786   30d   2/2      Complete   18d     user-w5gcf   *              all clusters
+kubeconfig-7zvzp   30d   1/1      Complete   12d     u-w7drc      *
+kubeconfig-jznml   30d   1/1      Complete   12d     u-w7drc      *
+```
+
+## Viewing a Kubeconfig
+
+Admins can get any Kubeconfig, while regular users can only get their own.
+
+```sh
+kubectl get kubeconfig kubeconfig-zp786
+NAME               TTL   TOKENS   STATUS     AGE
+kubeconfig-zp786   30d   2/2      Complete   18d
+```
+
+Use `-o wide` to get more details:
+
+```sh
+kubectl get kubeconfig kubeconfig-zp786 -o wide
+NAME               TTL   TOKENS   STATUS     AGE     USER         CLUSTERS       DESCRIPTION
+kubeconfig-zp786   30d   2/2      Complete   18d     user-w5gcf   *              all clusters
+```
+
+## Deleting a Kubeconfig
+
+Admins can delete any Kubeconfig, while regular users can only delete their own. When a Kubeconfig is deleted, the kubeconfig tokens are also deleted.
+
+```sh
+kubectl delete kubeconfig kubeconfig-zp786
+kubeconfig.ext.cattle.io "kubeconfig-zp786" deleted
+```
+
+To delete a Kubeconfig using preconditions:
+
+```sh
+cat <<EOF | k delete --raw /apis/ext.cattle.io/v1/kubeconfigs/kubeconfig-zp786 -f -
+{
+  "apiVersion": "v1",
+  "kind": "DeleteOptions",
+  "preconditions": {
+    "uid": "52183e05-d382-47d2-b4b9-d0735823ce90",
+    "resourceVersion": "31331505"
+  }
+}
+EOF
+```
+
+## Deleting a Collection of Kubeconfigs
+
+Admins can delete any Kubeconfig, while regular users can only delete their own.
+
+To delete all Kubeconfigs:
+
+```sh
+kubectl delete --raw /apis/ext.cattle.io/v1/kubeconfigs
+```
+
+To delete a collection of Kubeconfigs by label:
+
+```sh
+kubectl delete --raw /apis/ext.cattle.io/v1/kubeconfigs?labelSelector=foo%3Dbar
+```
+
+## Updating a Kubeconfig
+
+Only the `metadata`, e.g. adding a label or an annotation, and the `spec.description` field can be updated. All other `spec` fields are immutable.
+
+To edit a Kubeconfig:
+
+```sh
+kubectl edit kubeconfig kubeconfig-zp786
+```
+
+To patch a Kubeconfig and update its description:
+
+```sh
+kubectl patch kubeconfig kubeconfig-zp786 -type merge -p '{"spec":{"description":"Updated description"}}'
+kubeconfig.ext.cattle.io/kubeconfig-zp786 patched
+
+kubectl get kubeconfig kubeconfig-fdcpl -o jsonpath='{.spec.description}'
+Updated description
+```
+
+To patch a Kubeconfig and add a label:
+
+```sh
+kubectl patch kubeconfig kubeconfig-zp786 -type merge -p '{"metadata":{"labels":{"foo":"bar"}}}'
+kubeconfig.ext.cattle.io/kubeconfig-zp786 patched
+
+kubectl get kubeconfig kubeconfig-zp786 -o jsonpath='{.metadata.labels.foo}'
+bar
+```
@@ -0,0 +1,132 @@
+---
+title: Tokens
+---
+
+<head>
+    <link rel="canonical" href="https://ranchermanager.docs.rancher.com/api/workflows/tokens"/>
+</head>
+
+## Token Resource
+
+Rancher has an imperative API resource `tokens.ext.cattle.io` that allows you to generate tokens for authenticating with Rancher.
+
+```sh
+kubectl api-resources --api-group=ext.cattle.io
+```
+
+To get a description of the fields and structure of the Token resource, run:
+
+```sh
+kubectl explain tokens.ext.cattle.io
+```
+
+## Feature Flag
+
+The Tokens Public API is available for Rancher v2.12.0 and later, and is enabled by default. You can disable the Tokens Public API by setting the `ext-tokens` feature flag to `false` as shown in the example `kubectl` command below:
+
+```sh
+kubectl patch feature ext-tokens -p '{"spec":{"value":false}}'
+```
+
+## Creating a Token
+
+:::caution
+The Token value is only returned once in the `status.value` field.
+:::
+
+Only a **valid and active** Rancher user can create a Token. Otherwise, you will get an error displayed (`Error from server (Forbidden)...`) when attempting to create a Token.
+
+```bash
+kubectl create -o jsonpath='{.status.value}' -f -<<EOF
+apiVersion: ext.cattle.io/v1
+kind: Token
+EOF
+Error from server (Forbidden): error when creating "STDIN": tokens.ext.cattle.io is forbidden: user system:admin is not a Rancher user
+```
+
+A Token is always created for the user making the request. Attempting to create a Token for a different user, by specifying a different `spec.userID`, is forbidden and will fail.
+
+- The `spec.description` field can be set to an arbitrary human-readable description of the Token's purpose. The default value is empty.
+
+- The `spec.kind` field can be set to the kind of Token. The value `session` indicates a login Token. All other values, including the default empty string, indicate a kind of derived Token.
+
+- The `metadata.name` and `metadata.generateName` fields are ignored, and the name of the new Token is automatically generated using the prefix `token-`.
+
+	```bash
+	kubectl create -o jsonpath='{.status.value}' -f -<<EOF
+	apiVersion: ext.cattle.io/v1
+	kind: Token
+	spec:
+	  description: My Token
+	EOF
+	```
+
+- If the `spec.ttl` is not specified, the Token is created with the expiration time defined in the `auth-token-max-ttl-minutes` setting. The default expiration time is 90 days. If `spec.ttl` is specified, it should be greater than 0 and less than or equal to the value of the `auth-token-max-ttl-minutes` setting expressed in milliseconds.
+
+	```bash
+	kubectl create -o jsonpath='{.status.value}' -f -<<EOF
+	apiVersion: ext.cattle.io/v1
+	kind: Token
+	spec:
+	  ttl: 7200000 # 2 hours
+	EOF
+	```
+
+## Listing Tokens
+
+Listing previously generated Tokens can help clean up tokens that are no longer needed (e.g., they were issued temporarily). Admins can list all Tokens, while regular users can only see their own.
+
+```sh
+kubectl get tokens.ext.cattle.io
+NAME          KIND   TTL   AGE
+token-chjc9          90d   18s
+token-6fzgj          90d   16s
+token-8nbrm          90d   14s
+```
+
+Use `-o wide` to get more details:
+
+```sh
+kubectl get tokens.ext.cattle.io -o wide
+NAME          USER         KIND   TTL   AGE   DESCRIPTION
+token-chjc9   user-jtghh          90d   24s   example
+token-6fzgj   user-jtghh          90d   22s   box
+token-8nbrm   user-jtghh          90d   20s   jinx
+```
+
+## Viewing a Token
+
+Admins can get any Token, while regular users can only get their own.
+
+```sh
+kubectl get tokens.ext.cattle.io token-chjc9
+NAME          KIND   TTL   AGE
+token-chjc9          90d   18s
+```
+
+Use `-o wide` to get more details:
+
+```sh
+kubectl get tokens.ext.cattle.io token-chjc9 -o wide
+NAME          USER         KIND   TTL   AGE   DESCRIPTION
+token-chjc9   user-jtghh          90d   24s   example
+```
+
+## Deleting a Token
+
+Admins can delete any Token, while regular users can only delete their own.  
+
+```sh
+kubectl delete tokens.ext.cattle.io token-chjc9
+token.ext.cattle.io "token-chjc9" deleted
+```
+
+## Updating a Token
+
+Only the metadata fields `spec.description`, `spec.ttl`, and `spec.enabled` can be updated. All other `spec` fields are immutable. Admins can extend the `spec.ttl` field, while regular users can only reduce the value.
+
+An example `kubectl` command to edit a Token:
+
+```sh
+kubectl edit tokens.ext.cattle.io token-zp786
+```
@@ -39,7 +39,6 @@ User Interface | https://github.com/rancher/dashboard/ | This repository is the
 (Rancher) Docker Machine | https://github.com/rancher/machine | This repository is the source of the Docker Machine binary used when using Node Drivers. This is a fork of the `docker/machine` repository.
 machine-package | https://github.com/rancher/machine-package | This repository is used to build the Rancher Docker Machine binary.
 kontainer-engine | https://github.com/rancher/kontainer-engine | This repository is the source of kontainer-engine, the tool to provision hosted Kubernetes clusters.
-RKE repository | https://github.com/rancher/rke | This repository is the source of Rancher Kubernetes Engine, the tool to provision Kubernetes clusters on any machine.
 CLI | https://github.com/rancher/cli | This repository is the source code for the Rancher CLI used in Rancher 2.x.
 (Rancher) Helm repository | https://github.com/rancher/helm | This repository is the source of the packaged Helm binary. This is a fork of the `helm/helm` repository.
 loglevel repository | https://github.com/rancher/loglevel | This repository is the source of the loglevel binary, used to dynamically change log levels.
@@ -109,27 +108,6 @@ Please remove any sensitive data as it will be publicly viewable.
        -l app=rancher \
        --timestamps=true
        ```
-        - Docker install using `docker` on each of the nodes in the RKE cluster
-
-        ```
-        docker logs \
-        --timestamps \
-        $(docker ps | grep -E "rancher/rancher@|rancher_rancher" | awk '{ print $1 }')
-        ```
-        - Kubernetes Install with RKE Add-On
-
-        :::note
-
-        Make sure you configured the correct kubeconfig (for example, `export KUBECONFIG=$PWD/kube_config_cluster.yml` if the Rancher server is installed on a Kubernetes cluster) or are using the embedded kubectl via the UI.
-
-        :::
-
-        ```
-        kubectl -n cattle-system \
-        logs \
-        --timestamps=true \
-        -f $(kubectl --kubeconfig $KUBECONFIG get pods -n cattle-system -o json | jq -r '.items[] | select(.spec.containers[].name="cattle-server") | .metadata.name')
-        ```
    - System logging (these might not all exist, depending on operating system)
        - `/var/log/messages`
        - `/var/log/syslog`
@@ -47,60 +47,9 @@ CNI network providers using this network model include Calico and Cilium. Cilium

 ## What CNI Providers are Provided by Rancher?

-### RKE Kubernetes clusters
-
-Out-of-the-box, Rancher provides the following CNI network providers for RKE Kubernetes clusters: Canal, Flannel, Calico, and Weave.
-
-You can choose your CNI network provider when you create new Kubernetes clusters from Rancher.
-
-#### Canal
-
-![Canal Logo](/img/canal-logo.png)
-
-Canal is a CNI network provider that gives you the best of Flannel and Calico. It allows users to easily deploy Calico and Flannel networking together as a unified networking solution, combining Calico’s network policy enforcement with the rich superset of Calico (unencapsulated) and/or Flannel (encapsulated) network connectivity options.
-
-In Rancher, Canal is the default CNI network provider combined with Flannel and VXLAN encapsulation.
-
-Kubernetes workers should open UDP port `8472` (VXLAN) and TCP port `9099` (health checks). If using Wireguard, you should open UDP ports `51820` and `51821`. For more details, refer to [the port requirements for user clusters](../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/node-requirements-for-rancher-managed-clusters.md).
-
-![](/img/canal-diagram.png)
-
-For more information, see the [Canal GitHub Page.](https://github.com/projectcalico/canal)
-
-#### Flannel
-
-![Flannel Logo](/img/flannel-logo.png)
-
-Flannel is a simple and easy way to configure L3 network fabric designed for Kubernetes. Flannel runs a single binary agent named flanneld on each host, which is responsible for allocating a subnet lease to each host out of a larger, preconfigured address space. Flannel uses either the Kubernetes API or etcd directly to store the network configuration, the allocated subnets, and any auxiliary data (such as the host's public IP). Packets are forwarded using one of several backend mechanisms, with the default encapsulation being [VXLAN](https://github.com/flannel-io/flannel/blob/master/Documentation/backends.md#vxlan).
-
-Encapsulated traffic is unencrypted by default. Flannel provides two solutions for encryption:
-
-* [IPSec](https://github.com/flannel-io/flannel/blob/master/Documentation/backends.md#ipsec), which makes use of [strongSwan](https://www.strongswan.org/) to establish encrypted IPSec tunnels between Kubernetes workers. It is an experimental backend for encryption.
-* [WireGuard](https://github.com/flannel-io/flannel/blob/master/Documentation/backends.md#wireguard), which is a more faster-performing alternative to strongSwan.
-
-Kubernetes workers should open UDP port `8472` (VXLAN). See [the port requirements for user clusters](../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/node-requirements-for-rancher-managed-clusters.md#networking-requirements) for more details.
-
-![Flannel Diagram](/img/flannel-diagram.png)
-
-For more information, see the [Flannel GitHub Page](https://github.com/flannel-io/flannel).
-
-#### Weave
-
-<DeprecationWeave />
-
-![Weave Logo](/img/weave-logo.png)
-
-Weave enables networking and network policy in Kubernetes clusters across the cloud. Additionally, it support encrypting traffic between the peers.
-
-Kubernetes workers should open TCP port `6783` (control port), UDP port `6783` and UDP port `6784` (data ports). See the [port requirements for user clusters](../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/node-requirements-for-rancher-managed-clusters.md#networking-requirements) for more details.
-
-For more information, see the following pages:
-
- [Weave Net Official Site](https://github.com/weaveworks/weave/blob/master/site/overview.md)
-
 ### RKE2 Kubernetes clusters

-Out-of-the-box, Rancher provides the following CNI network providers for RKE2 Kubernetes clusters: [Canal](#canal) (see above section), Calico, and Cilium.
+Out-of-the-box, Rancher provides the following CNI network providers for RKE2 Kubernetes clusters: Calico, Canal, Cilium, and Flannel.

 You can choose your CNI network provider when you create new Kubernetes clusters from Rancher.

@@ -131,6 +80,20 @@ For more information, see the following pages:
 - [Project Calico Official Site](https://www.projectcalico.org/)
 - [Project Calico GitHub Page](https://github.com/projectcalico/calico)

+#### Canal
+
+![Canal Logo](/img/canal-logo.png)
+
+Canal is a CNI network provider that gives you the best of Flannel and Calico. It allows users to easily deploy Calico and Flannel networking together as a unified networking solution, combining Calico’s network policy enforcement with the rich superset of Calico (unencapsulated) and/or Flannel (encapsulated) network connectivity options.
+
+In Rancher, Canal is the default CNI network provider combined with Flannel and VXLAN encapsulation.
+
+Kubernetes workers should open UDP port `8472` (VXLAN) and TCP port `9099` (health checks). If using Wireguard, you should open UDP ports `51820` and `51821`. For more details, refer to [the port requirements for user clusters](../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/node-requirements-for-rancher-managed-clusters.md).
+
+![](/img/canal-diagram.png)
+
+For more information, see the [Canal GitHub Page.](https://github.com/projectcalico/canal)
+
 #### Cilium

 ![Cilium Logo](/img/cilium-logo.png)
@@ -158,6 +121,23 @@ spec:
      - remote-node
 ```

+#### Flannel
+
+![Flannel Logo](/img/flannel-logo.png)
+
+Flannel is a simple and easy way to configure L3 network fabric designed for Kubernetes. Flannel runs a single binary agent named flanneld on each host, which is responsible for allocating a subnet lease to each host out of a larger, preconfigured address space. Flannel uses either the Kubernetes API or etcd directly to store the network configuration, the allocated subnets, and any auxiliary data (such as the host's public IP). Packets are forwarded using one of several backend mechanisms, with the default encapsulation being [VXLAN](https://github.com/flannel-io/flannel/blob/master/Documentation/backends.md#vxlan).
+
+Encapsulated traffic is unencrypted by default. Flannel provides two solutions for encryption:
+
+* [IPSec](https://github.com/flannel-io/flannel/blob/master/Documentation/backends.md#ipsec), which makes use of [strongSwan](https://www.strongswan.org/) to establish encrypted IPSec tunnels between Kubernetes workers. It is an experimental backend for encryption.
+* [WireGuard](https://github.com/flannel-io/flannel/blob/master/Documentation/backends.md#wireguard), which is a more faster-performing alternative to strongSwan.
+
+Kubernetes workers should open UDP port `8472` (VXLAN). See [the port requirements for user clusters](../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/node-requirements-for-rancher-managed-clusters.md#networking-requirements) for more details.
+
+![Flannel Diagram](/img/flannel-diagram.png)
+
+For more information, see the [Flannel GitHub Page](https://github.com/flannel-io/flannel).
+
 ## CNI Features by Provider

 The following table summarizes the different features available for each CNI network provider provided by Rancher.
@@ -196,4 +176,4 @@ Canal is the default CNI network provider. We recommend it for most use cases. I

 ## How can I configure a CNI network provider?

-Please see [Cluster Options](../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md) on how to configure a network provider for your cluster. For more advanced configuration options, please see how to configure your cluster using a [Config File](../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md#rke-cluster-config-file-reference) and the options for [Network Plug-ins](https://rancher.com/docs/rke/latest/en/config-options/add-ons/network-plugins/).
+Please see [Cluster Options](../reference-guides/cluster-configuration/rancher-server-configuration/rke2-cluster-configuration.md) on how to configure a network provider for your cluster. For more advanced configuration options, please see how to configure your cluster using a [Config File](../reference-guides/cluster-configuration/rancher-server-configuration/rke2-cluster-configuration.md#cluster-config-file-reference).
@@ -16,10 +16,7 @@ Rancher will publish deprecated features as part of the [release notes](https://

 | Patch Version |  Release Date |
 |---------------|---------------|
-| [2.11.3](https://github.com/rancher/rancher/releases/tag/v2.11.3) | June 25, 2025 |
-| [2.11.2](https://github.com/rancher/rancher/releases/tag/v2.11.2) | May 22, 2025 |
-| [2.11.1](https://github.com/rancher/rancher/releases/tag/v2.11.1) | Apr 24, 2025 |
-| [2.11.0](https://github.com/rancher/rancher/releases/tag/v2.11.0) | Mar 31, 2025 |
+| [2.12.0](https://github.com/rancher/rancher/releases/tag/v2.12.0) | July 30, 2025 |

 ## What can I expect when a feature is marked for deprecation?

@@ -1,49 +0,0 @@
---
-title: Dockershim FAQ
---
-
-<head>
-  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/faq/dockershim"/>
-</head>
-
-The Dockershim is the CRI compliant layer between the Kubelet and the Docker daemon. As part of the Kubernetes 1.20 release, the [deprecation of the in-tree Dockershim was announced](https://kubernetes.io/blog/2020/12/02/dont-panic-kubernetes-and-docker/). Removal is currently scheduled for Kubernetes 1.24. For more information on the deprecation and its timelines, see the [Kubernetes Dockershim Deprecation FAQ](https://kubernetes.io/blog/2020/12/02/dockershim-faq/#when-will-dockershim-be-removed).
-
-RKE clusters, starting with Kubernetes 1.21, now support the external Dockershim to continue leveraging Docker as the CRI runtime. We now implement the upstream open source community Dockershim announced by [Mirantis and Docker](https://www.mirantis.com/blog/mirantis-to-take-over-support-of-kubernetes-dockershim-2/) to ensure RKE clusters can continue to leverage Docker.
-
-To enable the external Dockershim, configure the following option.
-
-```
-enable_cri_dockerd: true
-```
-
-For users looking to use another container runtime, Rancher has the edge-focused K3s and datacenter-focused RKE2 Kubernetes distributions that use containerd as the default runtime. Imported RKE2 and K3s Kubernetes clusters can then be upgraded and managed through Rancher even after the removal of in-tree Dockershim in Kubernetes 1.24.
-
-## FAQ
-
-<br/>
-
-Q: Do I have to upgrade Rancher to get Rancher’s support of the upstream Dockershim?
-
-The upstream support of Dockershim begins for RKE in Kubernetes 1.21. You will need to be on Rancher 2.6 or above to have support for RKE with Kubernetes 1.21. See our [support matrix](https://rancher.com/support-maintenance-terms/all-supported-versions/rancher-v2.6.0/) for details.
-
-<br/>
-
-Q: I am currently on RKE with Kubernetes 1.20. Do I need to upgrade to RKE with Kubernetes 1.21 sooner to avoid being out of support for Dockershim?
-
-A: The version of Dockershim in RKE with Kubernetes 1.20 will continue to work and is not scheduled for removal upstream until Kubernetes 1.24. It will only emit a warning of its future deprecation, which Rancher has mitigated in RKE with Kubernetes 1.21. You can plan your upgrade to Kubernetes 1.21 as you would normally, but should consider enabling the external Dockershim by Kubernetes 1.22. The external Dockershim will need to be enabled before upgrading to Kubernetes 1.24, at which point the existing implementation will be removed.
-
-For more information on the deprecation and its timeline, see the [Kubernetes Dockershim Deprecation FAQ](https://kubernetes.io/blog/2020/12/02/dockershim-faq/#when-will-dockershim-be-removed).
-
-<br/>
-
-Q: What are my other options if I don’t want to depend on the Dockershim?
-
-A: You can use a runtime like containerd with Kubernetes that does not require Dockershim support. RKE2 or K3s are two options for doing this.
-
-<br/>
-
-Q: If I am already using RKE1 and want to switch to RKE2, what are my migration options?
-
-A: Rancher is exploring the possibility of an in-place upgrade path. Alternatively you can always migrate workloads from one cluster to another using kubectl.
-
-<br/>
@@ -14,17 +14,11 @@ See [kubectl Installation](https://kubernetes.io/docs/tasks/tools/install-kubect

 ## Configuration

-When you create a Kubernetes cluster with RKE, RKE creates a `kube_config_cluster.yml` in the local directory that contains credentials to connect to your new cluster with tools like `kubectl` or `helm`.
-
-You can copy this file as `$HOME/.kube/config` or if you are working with multiple Kubernetes clusters, set the `KUBECONFIG` environmental variable to the path of `kube_config_cluster.yml`.
-
-```
-export KUBECONFIG=$(pwd)/kube_config_cluster.yml
-```
+When you create a Kubernetes cluster with RKE2/K3s, the Kubeconfig file is stored at `/etc/rancher/rke2/rke2.yaml` or `/etc/rancher/k3s/k3s.yaml` depending on your chosen distribution. These files are used to configure access to the Kubernetes cluster.

 Test your connectivity with `kubectl` and see if you can get the list of nodes back.

-```
+```shell
 kubectl get nodes
 NAME                          STATUS    ROLES                      AGE       VERSION
 165.227.114.63                Ready     controlplane,etcd,worker   11m       v1.10.1
@@ -17,9 +17,9 @@ If Rancher is ever deleted or unrecoverable, all workloads in the downstream Kub

 The capability to access a downstream cluster without Rancher depends on the type of cluster and the way that the cluster was created. To summarize:

- **Registered clusters:** The cluster will be unaffected and you can access the cluster using the same methods that you did before the cluster was registered into Rancher.
+- **Registered/Imported clusters:** The cluster will be unaffected and you can access the cluster using the same methods that you did before the cluster was registered into Rancher.
 - **Hosted Kubernetes clusters:** If you created the cluster in a cloud-hosted Kubernetes provider such as EKS, GKE, or AKS, you can continue to manage the cluster using your provider's cloud credentials.
- **RKE clusters:** To access an [RKE cluster,](../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) the cluster must have the [authorized cluster endpoint](../reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md#4-authorized-cluster-endpoint) enabled, and you must have already downloaded the cluster's kubeconfig file from the Rancher UI. (The authorized cluster endpoint is enabled by default for RKE clusters.) With this endpoint, you can access your cluster with kubectl directly instead of communicating through the Rancher server's [authentication proxy.](../reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md#1-the-authentication-proxy) For instructions on how to configure kubectl to use the authorized cluster endpoint, refer to the section about directly accessing clusters with [kubectl and the kubeconfig file.](../how-to-guides/new-user-guides/manage-clusters/access-clusters/use-kubectl-and-kubeconfig.md#authenticating-directly-with-a-downstream-cluster) These clusters will use a snapshot of the authentication as it was configured when Rancher was removed.
+- **Rancher provisioned clusters:** To access an [RKE2/K3s cluster](../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) the cluster must have the [authorized cluster endpoint](../reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md#4-authorized-cluster-endpoint) enabled, and you must have already downloaded the cluster's kubeconfig file from the Rancher UI. With this endpoint, you can access your cluster with kubectl directly instead of communicating through the Rancher server's [authentication proxy.](../reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md#1-the-authentication-proxy) For instructions on how to configure kubectl to use the authorized cluster endpoint, refer to the section about directly accessing clusters with [kubectl and the kubeconfig file.](../how-to-guides/new-user-guides/manage-clusters/access-clusters/use-kubectl-and-kubeconfig.md#authenticating-directly-with-a-downstream-cluster) These clusters will use a snapshot of the authentication as it was configured when Rancher was removed.

 ## What if I don't want Rancher anymore?

@@ -56,10 +56,10 @@ To detach the cluster,

 **Result:** The registered cluster is detached from Rancher and functions normally outside of Rancher.

-## What if I don't want my RKE cluster or hosted Kubernetes cluster managed by Rancher?
+## What if I don't want my hosted Kubernetes cluster managed by Rancher?

 At this time, there is no functionality to detach these clusters from Rancher. In this context, "detach" is defined as the ability to remove Rancher components from the cluster and manage access to the cluster independently of Rancher.

 The capability to manage these clusters without Rancher is being tracked in this [issue.](https://github.com/rancher/rancher/issues/25234)

-For information about how to access clusters if the Rancher server is deleted, refer to [this section.](#if-the-rancher-server-is-deleted-how-do-i-access-my-downstream-clusters)
+For information about how to access clusters if the Rancher server is deleted, refer to [this section.](#if-the-rancher-server-is-deleted-how-do-i-access-my-downstream-clusters)
@@ -64,7 +64,7 @@ The Layer-4 Load Balancer is created as `type: LoadBalancer`. In Kubernetes, thi
 ## Where is the state of Rancher stored?

 - Docker Install: in the embedded etcd of the `rancher/rancher` container, located at `/var/lib/rancher`.
- Kubernetes install: in the etcd of the RKE cluster created to run Rancher.
+- Kubernetes install: default location is in the `/var/lib/rancher/rke2` or `/var/lib/rancher/k3s` directories of the respective RKE2/K3s cluster created to run Rancher.

 ## How are the supported Docker versions determined?

@@ -99,7 +99,7 @@ When the node is removed from the cluster, and the node is cleaned, you can add

 ## How can I add more arguments/binds/environment variables to Kubernetes components in a Rancher Launched Kubernetes cluster?

-You can add more arguments/binds/environment variables via the [Config File](../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md#rke-cluster-config-file-reference) option in Cluster Options. For more information, see the [Extra Args, Extra Binds, and Extra Environment Variables](https://rancher.com/docs/rke/latest/en/config-options/services/services-extras/) in the RKE documentation or browse the [Example Cluster.ymls](https://rancher.com/docs/rke/latest/en/example-yamls/).
+You can add more arguments/binds/environment variables via the respective [RKE2 Config File](../reference-guides/cluster-configuration/rancher-server-configuration/rke2-cluster-configuration.md#cluster-configuration) or [K3s Config File](../reference-guides/cluster-configuration/rancher-server-configuration/k3s-cluster-configuration.md#cluster-configuration).

 ## How do I check if my certificate chain is valid?

@@ -26,32 +26,54 @@ The following is a list of feature flags available in Rancher. If you've upgrade
 - `imperative-api-extension`: Enables Rancher's [extension API server](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation/) to register new APIs to Kubernetes. This flag is enabled by default. See the [Extension API Server](../../../api/extension-apiserver.md) page for more information.
 - `istio-virtual-service-ui`: Enables a [visual interface](../../../how-to-guides/advanced-user-guides/enable-experimental-features/istio-traffic-management-features.md) to create, read, update, and delete Istio virtual services and destination rules, which are Istio traffic management features.
 - `legacy`: Enables a set of features from 2.5.x and earlier, that are slowly being phased out in favor of newer implementations. These are a mix of deprecated features as well as features that will eventually be available to newer versions. This flag is disabled by default on new Rancher installations. If you're upgrading from a previous version of Rancher, this flag is enabled.
- `managed-system-upgrade-controller`: Enables the installation of the system-upgrade-controller app in downstream RKE2/K3s clusters, currently limited to imported clusters and the local cluster, with plans to expand support to node-driver clusters.
+- `managed-system-upgrade-controller`: Enables the installation of the system-upgrade-controller app in downstream imported RKE2/K3s clusters, as well as in the local cluster if it is an RKE2/K3s cluster.
+
+:::note Important:
+
+This `managed-system-upgrade-controller` flag is intended for **internal use only** and does not have an associated Feature CR. Use with caution.
+
+To control whether Rancher should manage the Kubernetes version of imported RKE2/K3s clusters, it is recommended to use the [imported-cluster-version-management](../../../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/register-existing-clusters.md#configuring-version-management-for-rke2-and-k3s-clusters) feature that is available in Rancher v2.11.0 or newer.
+
+:::
+
+:::danger
+
+If the `managed-system-upgrade-controller` flag was **disabled** in Rancher v2.10.x, and any imported RKE2/K3s clusters were upgraded **outside of Rancher**, follow the steps below to prevent the unexpected installation of the system-upgrade-controller app and to ensure the [imported-cluster-version-management](../../../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/register-existing-clusters.md#configuring-version-management-for-rke2-and-k3s-clusters) feature works correctly:
+
+1. Upgrade Rancher to v2.11.0 or newer, making sure to **retain** the `managed-system-upgrade-controller=false` feature flag in Helm values if it was set during the v2.10.x installation.
+1. After Rancher is fully up and running, disable the `imported-cluster-version-management` setting. You can do this either through the Rancher UI by clicking **☰ > Global Settings > Settings > imported-cluster-version-management**, or by editing the corresponding `Setting.management.cattle.io/v3` custom resource via kubectl.
+1. Perform a second Helm upgrade, this time omitting the `managed-system-upgrade-controller=false` feature flag.
+
+Now, the imported cluster version management is disabled by default, and Rancher no longer installs the system-upgrade-controller app on imported clusters automatically.
+
+You can enable this feature on a per-cluster basis. For more information, please refer to the [documentation](../../../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/register-existing-clusters.md#configuring-version-management-for-rke2-and-k3s-clusters).
+
+:::
+
 - `multi-cluster-management`: Allows multi-cluster provisioning and management of Kubernetes clusters. This flag can only be set at install time. It can't be enabled or disabled later.
 - `rke1-custom-node-cleanup`: Enables cleanup of deleted RKE1 custom nodes. We recommend that you keep this flag enabled, to prevent removed nodes from attempting to rejoin the cluster.
 - `rke2`: Enables provisioning RKE2 clusters. This flag is enabled by default.
 - `token-hashing`: Enables token hashing. Once enabled, existing tokens will be hashed and all new tokens will be hashed automatically with the SHA256 algorithm. Once a token is hashed it can't be undone. This flag can't be disabled after its enabled. See [API Tokens](../../../api/api-tokens.md#token-hashing) for more information.
- `uiextension`: Enables UI extensions. This flag is enabled by default. Enabling or disabling the flag forces the Rancher pod to restart. The first time this flag is set to `true`, it creates a CRD and enables the controllers and endpoints necessary for the feature to work. If set to `false`, it disables the previously mentioned controllers and endpoints. Setting `uiextension` to `false` has no effect on the CRD -- it does not create a CRD if it does not yet exist, nor does it delete the CRD if it already exists. 
+- `uiextension`: Enables UI extensions. This flag is enabled by default. Enabling or disabling the flag forces the Rancher pod to restart. The first time this flag is set to `Active`, it creates a CRD and enables the controllers and endpoints necessary for the feature to work. If set to `Disabled`, it disables the previously mentioned controllers and endpoints. Setting `uiextension` to `Disabled` has no effect on the CRD -- it does not create a CRD if it does not yet exist, nor does it delete the CRD if it already exists. 
 - `unsupported-storage-drivers`: Enables types for storage providers and provisioners that aren't enabled by default. See [Allow Unsupported Storage Drivers](../../../how-to-guides/advanced-user-guides/enable-experimental-features/unsupported-storage-drivers.md) for more information.
- `ui-sql-cache`: Enables a SQLite-based cache for UI tables. See [UI Server-Side Pagination](../../../how-to-guides/advanced-user-guides/enable-experimental-features/ui-server-side-pagination.md) for more information.
-
+- `ui-sql-cache`: Enables an SQLite-based cache for UI tables and Server-Side Pagination. See [UI Server-Side Pagination](../../../how-to-guides/advanced-user-guides/ui-server-side-pagination.md) for more information.

 The following table shows the availability and default values for some feature flags in Rancher. Features marked "GA" are generally available:

 | Feature Flag Name             | Default Value | Status       | Available As Of | Additional Information |
 | ----------------------------- | ------------- | ------------ | --------------- | ---------------------- |
-| `aggregated-roletemplates` | `false` | Highly experimentatl | v2.11.0 | This flag value is locked on install and can't be changed. |
-| `clean-stale-secrets` | `true` | GA | v2.10.2 | |
-| `continuous-delivery` | `true` | GA | v2.6.0 | |
-| `external-rules` | v2.7.14: `false`, v2.8.5: `true` | Removed | v2.7.14, v2.8.5 | This flag affected [external `RoleTemplate` behavior](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md#external-roletemplate-behavior). It is removed in Rancher v2.9.0 and later as the behavior is enabled by default. |
-| `fleet`  | `true` | Can no longer be disabled | v2.6.0 | |
-| `fleet`  | `true` | GA | v2.5.0 | |
-| `harvester` | `true` | Experimental | v2.6.1 | |
-| `imperative-api-extension` | `true` | GA | v2.11.0 | |
-| `legacy` | `false` for new installs, `true` for upgrades | GA | v2.6.0 | |
-| `managed-system-upgrade-controller` | `true` | GA | v2.10.0 | |
+| `aggregated-roletemplates` | `Disabled` | Highly experimental | v2.11.0 | This flag value is locked on install and can't be changed. |
+| `clean-stale-secrets` | `Active` | GA | v2.10.2 | |
+| `continuous-delivery` | `Active` | GA | v2.6.0 | |
+| `external-rules` | v2.7.14: `Disabled`, v2.8.5: `Active` | Removed | v2.7.14, v2.8.5 | This flag affected [external `RoleTemplate` behavior](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md#external-roletemplate-behavior). It is removed in Rancher v2.9.0 and later as the behavior is enabled by default. |
+| `fleet`  | `Active` | Can no longer be disabled | v2.6.0 | |
+| `fleet`  | `Active` | GA | v2.5.0 | |
+| `harvester` | `Active` | Experimental | v2.6.1 | |
+| `imperative-api-extension` | `Active` | GA | v2.11.0 | |
+| `legacy` | `Disabled` for new installs, `Active` for upgrades | GA | v2.6.0 | |
+| `managed-system-upgrade-controller` | `Active` | GA | v2.10.0 | |
 | `rke1-custom-node-cleanup`| `true` | GA | v2.6.0 | |
 | `rke2` | `true` | Experimental | v2.6.0 | |
-| `token-hashing` | `false` for new installs, `true` for upgrades | GA | v2.6.0 | |
-| `uiextension` | `true` | GA | v2.9.0 | |
-| `ui-sql-cache` | `false` | Highly experimental | v2.9.0 | |
+| `token-hashing` | `Disabled` for new installs, `Active` for upgrades | GA | v2.6.0 | |
+| `uiextension` | `Active` | GA | v2.9.0 | |
+| `ui-sql-cache` | `Active` | GA | v2.9.0 | |
@@ -36,7 +36,8 @@ For information on enabling experimental features, refer to [this page.](../../.
 | `antiAffinity`                 | "preferred"                                           | `string` - AntiAffinity rule for Rancher pods - "preferred, required"                                                                             |
 | `auditLog.destination`         | "sidecar"                                             | `string` - Stream to sidecar container console or hostPath volume - "sidecar, hostPath"                                                           |
 | `auditLog.hostPath`            | "/var/log/rancher/audit"                              | `string` - log file destination on host (only applies when `auditLog.destination` is set to `hostPath`)                                           |
-| `auditLog.level`               | 0                                                     | `int` - set the [API Audit Log](../../../how-to-guides/advanced-user-guides/enable-api-audit-log.md) level. 0 is off. [0-3]                                   |
+| `auditLog.enabled`            |  false                            | `bool` - Enables / disables audit logging.                                           |
+| `auditLog.level`               | 0                                                     | `int` - Sets the [API Audit Log](../../../how-to-guides/advanced-user-guides/enable-api-audit-log.md) level [0-3].                                  |
 | `auditLog.maxAge`              | 1                                                     | `int` - maximum number of days to retain old audit log files (only applies when `auditLog.destination` is set to `hostPath`)                      |
 | `auditLog.maxBackup`           | 1                                                     | `int` - maximum number of audit log files to retain (only applies when `auditLog.destination` is set to `hostPath`)                               |
 | `auditLog.maxSize`             | 100                                                   | `int` - maximum size in megabytes of the audit log file before it gets rotated (only applies when `auditLog.destination` is set to `hostPath`)    |
@@ -63,6 +64,10 @@ For information on enabling experimental features, refer to [this page.](../../.
 | `tls`                          | "ingress"                                             | `string` - See [External TLS Termination](#external-tls-termination) for details. - "ingress, external"                                           |
 | `useBundledSystemChart`        | `false`                                               | `bool` - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations.  |

+
+When using Rancher v2.12.0 and above, Rancher will use an audit logging controller that watches `AuditPolicy` CRs for configuring additional redactions, for more info see [API Audit Log](../../../how-to-guides/advanced-user-guides/enable-api-audit-log.md).
+
+
 ### Bootstrap Password

 You can [set a specific bootstrap password](../resources/bootstrap-password.md) during Rancher installation. If you don't set a specific bootstrap password, Rancher randomly generates a password for the first admin account.
@@ -53,6 +53,10 @@ You can obtain `<RANCHER_CONTAINER_TAG>` and `<RANCHER_CONTAINER_NAME>` by loggi

 ## Upgrade

+:::danger 
+Rancher upgrades to version 2.12.0 and later will be blocked if any RKE1-related resources are detected, as the Rancher Kubernetes Engine (RKE/RKE1) is end of life as of **July 31, 2025**. For detailed cleanup and recovery steps, refer to the [RKE1 Resource Validation and Upgrade Requirements in Rancher v2.12](#rke1-resource-validation-and-upgrade-requirements-in-rancher-v212).
+:::
+
 During upgrade, you create a copy of the data from your current Rancher container and a backup in case something goes wrong. Then you deploy the new version of Rancher in a new container using your existing data.
 ### 1. Create a copy of the data from your Rancher server container

@@ -388,6 +392,45 @@ See [Restoring Cluster Networking](https://github.com/rancher/rancher-docs/tree/

 Remove the previous Rancher server container. If you only stop the previous Rancher server container (and don't remove it), the container may restart after the next server reboot.

+## RKE1 Resource Validation and Upgrade Requirements in Rancher v2.12
+
+Rancher v2.12.0 and later has removed support for the Rancher Kubernetes Engine (RKE/RKE1). During upgrade, Rancher validates the cluster resources and blocks the upgrade if any RKE1-related resources are detected.
+
+This validation affects the following resource types:
+
+- Clusters with `rkeConfig` (`clusters.management.cattle.io`)
+- NodeTemplates (`nodetemplates.management.cattle.io`)
+- ClusterTemplates (`clustertemplates.management.cattle.io`)
+
+This is particularly relevant for single-node Docker installations, where Rancher is not running during the upgrade. In such cases, controllers are not available to automatically clean up deprecated resources, and the upgrade process will fail early with an error listing the blocking resources.
+
+### 1. Pre-Upgrade (Recommended)
+
+Before upgrading, while Rancher is still running:
+
+- Run the `pre-upgrade-hook` cleanup script to delete all RKE1 clusters and templates. You can find the script in the Rancher GitHub repository: [pre-upgrade-hook.sh](https://github.com/rancher/rancher/blob/v2.12.0/chart/scripts/pre-upgrade-hook.sh).
+- This allows Rancher to clean up associated resources and finalizers.
+
+### 2. Post-Upgrade Failure Due to Residual RKE1 Resources
+
+If the upgrade to Rancher v2.12.0 or later is attempted without prior cleanup of RKE1 resources:
+
+- The upgrade will fail and display an error listing the resource names that are preventing the upgrade.
+- This occurs because Rancher includes validation to detect and block upgrades when unsupported RKE1 resources are still present.
+- To proceed, [rollback](#rolling-back) to the previous Rancher version, delete the identified resources, and then retry after [manual cleanup](#manual-cleanup-after-rollback).
+
+:::note Helm-based Rancher
+Helm-based Rancher installations are not affected by this issue, as Rancher remains available during the upgrade and can perform resource cleanup as needed.
+:::
+
+### Manual Cleanup After Rollback
+
+Users should perform the following steps after rolling back to a previous Rancher version:
+
+- **Manually delete** the resources listed in the upgrade error message (e.g., RKE1 clusters, NodeTemplates, ClusterTemplates).
+- If deletion is blocked due to **finalizers**, edit the resources and remove the `metadata.finalizers` field.
+- If a **validating webhook** prevents deletion (e.g., for the `system-project`), please refer to the [Bypassing the Webhook](../../../../reference-guides/rancher-webhook.md#bypassing-the-webhook) documentation.
+
 ## Rolling Back

 If your upgrade does not complete successfully, you can roll back Rancher server and its data back to its last healthy state. For more information, see [Docker Rollback](roll-back-docker-installed-rancher.md).
@@ -1,17 +0,0 @@
---
-title: CIS Scan Guides
---
-
-<head>
-  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/cis-scan-guides"/>
-</head>
-
- [Install rancher-cis-benchmark](install-rancher-cis-benchmark.md)
- [Uninstall rancher-cis-benchmark](uninstall-rancher-cis-benchmark.md)
- [Run a Scan](run-a-scan.md)
- [Run a Scan Periodically on a Schedule](run-a-scan-periodically-on-a-schedule.md)
- [Skip Tests](skip-tests.md)
- [View Reports](view-reports.md)
- [Enable Alerting for rancher-cis-benchmark](enable-alerting-for-rancher-cis-benchmark.md)
- [Configure Alerts for Periodic Scan on a Schedule](configure-alerts-for-periodic-scan-on-a-schedule.md)
- [Create a Custom Benchmark Version to Run](create-a-custom-benchmark-version-to-run.md)
@@ -1,13 +0,0 @@
---
-title: Create a Custom Benchmark Version for Running a Cluster Scan
---
-
-<head>
-  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/cis-scan-guides/create-a-custom-benchmark-version-to-run"/>
-</head>
-
-There could be some Kubernetes cluster setups that require custom configurations of the Benchmark tests. For example, the path to the Kubernetes config files or certs might be different than the standard location where the upstream CIS Benchmarks look for them.
-
-It is now possible to create a custom Benchmark Version for running a cluster scan using the `rancher-cis-benchmark` application.
-
-For details, see [this page.](../../../integrations-in-rancher/cis-scans/custom-benchmark.md)
@@ -1,24 +0,0 @@
---
-title: Enable Alerting for Rancher CIS Benchmark
---
-
-<head>
-  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/cis-scan-guides/enable-alerting-for-rancher-cis-benchmark"/>
-</head>
-
-Alerts can be configured to be sent out for a scan that runs on a schedule.
-
-:::note Prerequisite:
-
-Before enabling alerts for `rancher-cis-benchmark`, make sure to install the `rancher-monitoring` application and configure the Receivers and Routes. For more information, see [this section.](../../../reference-guides/monitoring-v2-configuration/receivers.md)
-
-While configuring the routes for `rancher-cis-benchmark` alerts, you can specify the matching using the key-value pair `job: rancher-cis-scan`. An example route configuration is [here.](../../../reference-guides/monitoring-v2-configuration/receivers.md#example-route-config-for-cis-scan-alerts)
-
-:::
-
-While installing or upgrading the `rancher-cis-benchmark` Helm chart, set the following flag to `true` in the `values.yaml`:
-
-```yaml
-alerts:
-  enabled: true
-```
@@ -1,26 +0,0 @@
---
-title: Run a Scan
---
-
-<head>
-  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/cis-scan-guides/run-a-scan"/>
-</head>
-
-When a ClusterScan custom resource is created, it launches a new CIS scan on the cluster for the chosen ClusterScanProfile.
-
-:::note
-
-There is currently a limitation of running only one CIS scan at a time for a cluster. If you create multiple ClusterScan custom resources, they will be run one after the other by the operator, and until one scan finishes, the rest of the ClusterScan custom resources will be in the "Pending" state.
-
-:::
-
-To run a scan,
-
-1. In the upper left corner, click **☰ > Cluster Management**.
-1. On the **Clusters** page, go to the cluster where you want to run a CIS scan and click **Explore**.
-1. Click **CIS Benchmark > Scan**.
-1. Click **Create**.
-1. Choose a cluster scan profile. The profile determines which CIS Benchmark version will be used and which tests will be performed. If you choose the Default profile, then the CIS Operator will choose a profile applicable to the type of Kubernetes cluster it is installed on.
-1. Click **Create**.
-
-**Result:** A report is generated with the scan results. To see the results, click the name of the scan that appears.
@@ -1,38 +0,0 @@
---
-title: Skip Tests
---
-
-<head>
-  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/cis-scan-guides/skip-tests"/>
-</head>
-
-CIS scans can be run using test profiles with user-defined skips.
-
-To skip tests, you will create a custom CIS scan profile. A profile contains the configuration for the CIS scan, which includes the benchmark versions to use and any specific tests to skip in that benchmark.
-
-1. In the upper left corner, click **☰ > Cluster Management**.
-1. On the **Clusters** page, go to the cluster where you want to run a CIS scan and click **Explore**.
-1. Click **CIS Benchmark > Profile**.
-1. From here, you can create a profile in multiple ways. To make a new profile, click **Create** and fill out the form in the UI. To make a new profile based on an existing profile, go to the existing profile and click **⋮ Clone**.  If you are filling out the form, add the tests to skip using the test IDs, using the relevant CIS Benchmark as a reference. If you are creating the new test profile as YAML, you will add the IDs of the tests to skip in the `skipTests` directive. You will also give the profile a name:
-
-    ```yaml
-    apiVersion: cis.cattle.io/v1
-    kind: ClusterScanProfile
-    metadata:
-      annotations:
-        meta.helm.sh/release-name: clusterscan-operator
-        meta.helm.sh/release-namespace: cis-operator-system
-      labels:
-        app.kubernetes.io/managed-by: Helm
-      name: "<example-profile>"
-    spec:
-      benchmarkVersion: cis-1.5
-      skipTests:
-        - "1.1.20"
-        - "1.1.21"
-    ```
-1. Click **Create**.
-
-**Result:** A new CIS scan profile is created.
-
-When you [run a scan](./run-a-scan.md) that uses this profile, the defined tests will be skipped during the scan. The skipped tests will be marked in the generated report as `Skip`.
@@ -1,13 +0,0 @@
---
-title: Uninstall Rancher CIS Benchmark
---
-
-<head>
-  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/cis-scan-guides/uninstall-rancher-cis-benchmark"/>
-</head>
-
-1. From the **Cluster Dashboard,** go to the left navigation bar and click **Apps > Installed Apps**.
-1. Go to the `cis-operator-system` namespace and check the boxes next to `rancher-cis-benchmark-crd` and `rancher-cis-benchmark`.
-1. Click **Delete** and confirm **Delete**.
-
-**Result:** The `rancher-cis-benchmark` application is uninstalled.
@@ -1,23 +0,0 @@
---
-title: View Reports
---
-
-<head>
-  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/cis-scan-guides/view-reports"/>
-</head>
-
-To view the generated CIS scan reports,
-
-1. In the upper left corner, click **☰ > Cluster Management**.
-1. On the **Clusters** page, go to the cluster where you want to run a CIS scan and click **Explore**.
-1. Click **CIS Benchmark > Scan**.
-1. The **Scans** page will show the generated reports. To see a detailed report, go to a scan report and click the name.
-
-One can download the report from the Scans list or from the scan detail page.
-
-To get the verbose version of the CIS scan results, run the following command on the cluster that was scanned. Note that the scan must be completed before this can be done.
-
-```console
-export REPORT="scan-report-name"
-kubectl get clusterscanreport $REPORT -o json |jq ".spec.reportJSON | fromjson" | jq -r ".actual_value_map_data" | base64 -d | gunzip | jq .
-```
@@ -0,0 +1,16 @@
+---
+title: Compliance Scan Guides
+---
+
+<head>
+  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/compliance-scan-guides"/>
+</head>
+
+- [Install rancher-compliance](install-rancher-compliance.md)
+- [Uninstall rancher-compliance](uninstall-rancher-compliance.md)
+- [Run a Scan](run-a-scan.md)
+- [Run a Scan Periodically on a Schedule](run-a-scan-periodically-on-a-schedule.md)
+- [View Reports](view-reports.md)
+- [Enable Alerting for rancher-compliance](enable-alerting-for-rancher-compliance.md)
+- [Configure Alerts for Periodic Scan on a Schedule](configure-alerts-for-periodic-scan-on-a-schedule.md)
+- [Create a Custom Benchmark Version to Run](create-a-custom-compliance-version-to-run.md)
@@ -3,7 +3,7 @@ title: Configure Alerts for Periodic Scan on a Schedule
 ---

 <head>
-  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/cis-scan-guides/configure-alerts-for-periodic-scan-on-a-schedule"/>
+  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/compliance-scan-guides/configure-alerts-for-periodic-scan-on-a-schedule"/>
 </head>

 It is possible to run a ClusterScan on a schedule.
@@ -12,27 +12,27 @@ A scheduled scan can also specify if you should receive alerts when the scan com

 Alerts are supported only for a scan that runs on a schedule.

-The CIS Benchmark application supports two types of alerts:
+The compliance application supports two types of alerts:

 - Alert on scan completion: This alert is sent out when the scan run finishes. The alert includes details including the ClusterScan's name and the ClusterScanProfile name.
 - Alert on scan failure: This alert is sent out if there are some test failures in the scan run or if the scan is in a `Fail` state.

 :::note Prerequisite

-Before enabling alerts for `rancher-cis-benchmark`, make sure to install the `rancher-monitoring` application and configure the Receivers and Routes. For more information, see [this section.](../../../reference-guides/monitoring-v2-configuration/receivers.md)
+Before enabling alerts for `rancher-compliance`, make sure to install the `rancher-monitoring` application and configure the Receivers and Routes. For more information, see [this section.](../../../reference-guides/monitoring-v2-configuration/receivers.md)

-While configuring the routes for `rancher-cis-benchmark` alerts, you can specify the matching using the key-value pair `job: rancher-cis-scan`. An example route configuration is [here.](../../../reference-guides/monitoring-v2-configuration/receivers.md#example-route-config-for-cis-scan-alerts)
+While configuring the routes for `rancher-compliance` alerts, you can specify the matching using the key-value pair `job: rancher-compliance-scan`. An example route configuration is [here.](../../../reference-guides/monitoring-v2-configuration/receivers.md#example-route-config-for-compliance-scan-alerts)

 :::

 To configure alerts for a scan that runs on a schedule,

-1. Please enable alerts on the `rancher-cis-benchmark` application. For more information, see [this page](../../../how-to-guides/advanced-user-guides/cis-scan-guides/enable-alerting-for-rancher-cis-benchmark.md).
+1. Please enable alerts on the `rancher-compliance` application. For more information, see [this page](../../../how-to-guides/advanced-user-guides/compliance-scan-guides/enable-alerting-for-rancher-compliance.md).
 1. In the upper left corner, click **☰ > Cluster Management**.
-1. On the **Clusters** page, go to the cluster where you want to run a CIS scan and click **Explore**.
-1. Click **CIS Benchmark > Scan**.
+1. On the **Clusters** page, go to the cluster where you want to run a Compliance scan and click **Explore**.
+1. Click **compliance > Scan**.
 1. Click **Create**.
-1. Choose a cluster scan profile. The profile determines which CIS Benchmark version will be used and which tests will be performed. If you choose the Default profile, then the CIS Operator will choose a profile applicable to the type of Kubernetes cluster it is installed on.
+1. Choose a cluster scan profile. The profile determines which CIS Benchmark version will be used and which tests will be performed. If you choose the Default profile, then the Compliance Operator will choose a profile applicable to the type of Kubernetes cluster it is installed on.
 1. Choose the option **Run scan on a schedule**.
 1. Enter a valid [cron schedule expression](https://en.wikipedia.org/wiki/Cron#CRON_expression) in the field **Schedule**.
 1. Check the boxes next to the Alert types under **Alerting**.
@@ -41,4 +41,4 @@ To configure alerts for a scan that runs on a schedule,

 **Result:** The scan runs and reschedules to run according to the cron schedule provided. Alerts are sent out when the scan finishes if routes and receiver are configured under `rancher-monitoring` application.

-A report is generated with the scan results every time the scan runs. To see the latest results, click the name of the scan that appears.
+A report is generated with the scan results every time the scan runs. To see the latest results, click the name of the scan that appears.
@@ -0,0 +1,13 @@
+---
+title: Create a Custom Compliance Version for Running a Cluster Scan
+---
+
+<head>
+  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/compliance-scan-guides/create-a-custom-compliance-version-to-run"/>
+</head>
+
+There could be some Kubernetes cluster setups that require custom configurations of the Compliance tests. For example, the path to the Kubernetes config files or certs might be different than the standard location where the upstream Compliance look for them.
+
+It is now possible to create a custom compliance version for running a cluster scan using the `rancher-compliance` application.
+
+For details, see [this page.](../../../integrations-in-rancher/compliance-scans/custom-benchmark.md)
@@ -0,0 +1,24 @@
+---
+title: Enable Alerting for Rancher Compliance
+---
+
+<head>
+  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/compliance-scan-guides/enable-alerting-for-rancher-compliance"/>
+</head>
+
+Alerts can be configured to be sent out for a scan that runs on a schedule.
+
+:::note Prerequisite:
+
+Before enabling alerts for `rancher-compliance`, make sure to install the `rancher-monitoring` application and configure the Receivers and Routes. For more information, see [this section.](../../../reference-guides/monitoring-v2-configuration/receivers.md)
+
+While configuring the routes for `rancher-compliance` alerts, you can specify the matching using the key-value pair `job: rancher-compliance-scan`. An example route configuration is [here.](../../../reference-guides/monitoring-v2-configuration/receivers.md#example-route-config-for-compliance-scan-alerts)
+
+:::
+
+While installing or upgrading the `rancher-compliance` Helm chart, set the following flag to `true` in the `values.yaml`:
+
+```yaml
+alerts:
+  enabled: true
+```
@@ -1,15 +1,15 @@
 ---
-title: Install Rancher CIS Benchmark
+title: Install Rancher Compliance
 ---

 <head>
-  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/cis-scan-guides/install-rancher-cis-benchmark"/>
+  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/compliance-scan-guides/install-rancher-compliance"/>
 </head>

 1. In the upper left corner, click **☰ > Cluster Management**.
-1. On the **Clusters** page, go to the cluster where you want to install CIS Benchmark and click **Explore**.
+1. On the **Clusters** page, go to the cluster where you want to install Compliance and click **Explore**.
 1. In the left navigation bar, click **Apps > Charts**.
-1. Click **CIS Benchmark**
+1. Click **Compliance**
 1. Click **Install**.

-**Result:** The CIS scan application is deployed on the Kubernetes cluster.
+**Result:** The compliance scan application is deployed on the Kubernetes cluster.
@@ -3,15 +3,15 @@ title: Run a Scan Periodically on a Schedule
 ---

 <head>
-  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/cis-scan-guides/run-a-scan-periodically-on-a-schedule"/>
+  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/compliance-scan-guides/run-a-scan-periodically-on-a-schedule"/>
 </head>

 To run a ClusterScan on a schedule,

 1. In the upper left corner, click **☰ > Cluster Management**.
-1. On the **Clusters** page, go to the cluster where you want to run a CIS scan and click **Explore**.
-1. Click **CIS Benchmark > Scan**.
-1. Choose a cluster scan profile. The profile determines which CIS Benchmark version will be used and which tests will be performed. If you choose the Default profile, then the CIS Operator will choose a profile applicable to the type of Kubernetes cluster it is installed on.
+1. On the **Clusters** page, go to the cluster where you want to run a Compliance scan and click **Explore**.
+1. Click **Compliance > Scan**.
+1. Choose a cluster scan profile. The profile determines which CIS Benchmark version will be used and which tests will be performed. If you choose the Default profile, then the Compliance Operator will choose a profile applicable to the type of Kubernetes cluster it is installed on.
 1. Choose the option **Run scan on a schedule**.
 1. Enter a valid <a href="https://en.wikipedia.org/wiki/Cron#CRON_expression" target="_blank">cron schedule expression</a> in the field **Schedule**.
 1. Choose a **Retention** count, which indicates the number of reports maintained for this recurring scan. By default this count is 3. When this retention limit is reached, older reports will get purged.
@@ -21,4 +21,4 @@ To run a ClusterScan on a schedule,

 A report is generated with the scan results every time the scan runs. To see the latest results, click the name of the scan that appears.

-You can also see the previous reports by choosing the report from the **Reports** dropdown on the scan detail page.
+You can also see the previous reports by choosing the report from the **Reports** dropdown on the scan detail page.
@@ -0,0 +1,26 @@
+---
+title: Run a Scan
+---
+
+<head>
+  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/compliance-scan-guides/run-a-scan"/>
+</head>
+
+When a ClusterScan custom resource is created, it launches a new compliance scan on the cluster for the chosen ClusterScanProfile.
+
+:::note
+
+There is currently a limitation of running only one compliance scan at a time for a cluster. If you create multiple ClusterScan custom resources, they will be run one after the other by the operator, and until one scan finishes, the rest of the ClusterScan custom resources will be in the "Pending" state.
+
+:::
+
+To run a scan,
+
+1. In the upper left corner, click **☰ > Cluster Management**.
+1. On the **Clusters** page, go to the cluster where you want to run a compliance scan and click **Explore**.
+1. Click **Compliance > Scan**.
+1. Click **Create**.
+1. Choose a cluster scan profile. The profile determines which CIS Benchmark version will be used and which tests will be performed. If you choose the Default profile, then the Compliance Operator will choose a profile applicable to the type of Kubernetes cluster it is installed on.
+1. Click **Create**.
+
+**Result:** A report is generated with the scan results. To see the results, click the name of the scan that appears.
@@ -0,0 +1,13 @@
+---
+title: Uninstall Rancher Compliance
+---
+
+<head>
+  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/compliance-scan-guides/uninstall-rancher-compliance"/>
+</head>
+
+1. From the **Cluster Dashboard,** go to the left navigation bar and click **Apps > Installed Apps**.
+1. Go to the `compliance-operator-system` namespace and check the boxes next to `rancher-compliance-crd` and `rancher-compliance`.
+1. Click **Delete** and confirm **Delete**.
+
+**Result:** The `rancher-compliance` application is uninstalled.
@@ -0,0 +1,23 @@
+---
+title: View Reports
+---
+
+<head>
+  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/compliance-scan-guides/view-reports"/>
+</head>
+
+To view the generated Compliance scan reports,
+
+1. In the upper left corner, click **☰ > Cluster Management**.
+1. On the **Clusters** page, go to the cluster where you want to run a Compliance scan and click **Explore**.
+1. Click **Compliance > Scan**.
+1. The **Scans** page will show the generated reports. To see a detailed report, go to a scan report and click the name.
+
+One can download the report from the Scans list or from the scan detail page.
+
+To get the verbose version of the compliance scan results, run the following command on the cluster that was scanned. Note that the scan must be completed before this can be done.
+
+```console
+export REPORT="scan-report-name"
+kubectl get clusterscanreports.compliance.cattle.io $REPORT -o json |jq ".spec.reportJSON | fromjson" | jq -r ".actual_value_map_data" | base64 -d | gunzip | jq .
+```
@@ -185,6 +185,7 @@ For help troubleshooting certificates, see [this section.](../../getting-started
 If you want to record all transactions with the Rancher API, enable the [API Auditing](enable-api-audit-log.md) feature by adding the flags below into your install command.

    -e AUDIT_LEVEL=1 \
+    -e AUDIT_LOG_ENABLED=true \
    -e AUDIT_LOG_PATH=/var/log/auditlog/rancher-api-audit.log \
    -e AUDIT_LOG_MAXAGE=20 \
    -e AUDIT_LOG_MAXBACKUP=20 \
@@ -0,0 +1,138 @@
+---
+title: Configure Rancher as an OIDC provider
+---
+
+<head>
+  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/configure-oidc-provider"/>
+</head>
+
+Rancher can function as a standard OpenID Connect (OIDC) provider, allowing external applications to use Rancher for authentication.
+This can be used for enabling single sign-on (SSO) across Rancher Prime components. For example, see the [documentation](https://documentation.suse.com/cloudnative/suse-observability/next/en/setup/security/authentication/oidc.html) for configuring the OIDC provider for SUSE Observability.
+
+The OIDC provider can be enabled with the `oidc-provider` feature flag. When this flag is on the following endpoints are available:
+
+- `https://{rancher-url}/oidc/authorize`: This endpoint initiates the authentication flow. If a user is already logged into Rancher, it returns an authorization code. Otherwise, it redirects the user to the Rancher login page. Authorization codes and related request information are securely stored in session secrets. Codes are single-use and expire after 10 minutes.
+
+- `https://{rancher-url}/oidc/token`: This endpoint exchanges an authorization code for an `id_token`, `access_token`, and `refresh_token`.
+
+- `https://{rancher-url}/oidc/.well-known/openid-configuration`: This endpoint returns a JSON document containing the OIDC provider's configuration, including endpoint URLs, supported scopes, claims, and other relevant details.
+
+- `https://{rancher-url}/oidc/userinfo`: This endpoint provides information about the authenticated user.
+
+The OIDC provider supports the OIDC Authentication Code Flow with PKCE.
+
+## Configure OIDCClient
+
+An `OIDCClient` represents an external application that will be authenticating against Rancher.
+
+### Programmatically
+
+Create an `OIDCClient`:
+
+```yaml
+apiVersion: management.cattle.io/v3
+kind: OIDCClient
+metadata:
+  name: oidc-client-test
+spec:
+  tokenExpirationSeconds: 600 # expiration of the id_token and access_token
+  refreshTokenExpirationSeconds: 3600 # expiration of the refresh_token
+  redirectURIs:
+    - "https://myredirecturl.com" # replace with your redirect url
+```
+Rancher automatically generates a client ID and client secret for each `OIDCClient`.
+Once the resource is created, Rancher populates the status field with the client id:
+
+```yaml
+apiVersion: management.cattle.io/v3
+kind: OIDCClient
+metadata:
+  name: oidc-client-test
+spec:
+  tokenExpirationSeconds: 600 # expiration of the id_token and access_token
+  refreshTokenExpirationSeconds: 3600 # expiration of the refresh_token
+  redirectURIs:
+    - "https://myredirecturl.com" # replace with your redirect url
+status:
+  clientID: client-xxx
+  clientSecrets:
+    client-secret-1:
+      createdAt: "xxx"
+      lastFiveCharacters: xxx
+```
+
+Rancher automatically generates a Kubernetes `Secret` in the `cattle-oidc-client-secrets` namespace for each `OIDCClient` resource. The Secret's name matches the `OIDCClient` client ID.
+Initially, the `Secret` contains a single client secret.
+
+To retrieve the client secret:
+
+```
+kubectl get secret client-xxx -n cattle-oidc-client-secrets -o jsonpath="{.data.client-secret-1}" | base64 -d
+```
+
+Output:
+
+```
+secret-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+```
+
+You can now use this client ID and client secret in your OIDC client application.
+
+#### Managing Client Secrets
+
+You can manage multiple client secrets per `OIDCClient`. Use annotations on the `OIDCClient` resource to perform secret operations:
+
+- Creation: Adding the `cattle.io/oidc-client-secret-create: true` annotation triggers the creation of a new client secret.
+- Removal: Adding the `cattle.io/oidc-client-secret-remove:client-secret-1` annotation removes the specified client secrets.
+- Regeneration: Adding the `cattle.io/oidc-client-secret-regenerate:client-secret-1` annotation regenerates the specified client secrets.
+
+### Rancher UI
+
+Create an OIDCClient:
+
+1. In the top left corner, click **☰ > Users & Authentication**.
+1. In the left navigation menu, click **OIDC Apps**.
+1. Click **Add Application**. Fill out the **Create OIDC App** form.
+1. Click **Add Application**.
+
+#### Managing Client Secrets
+
+In the OIDC App page:
+
+- Creation: Click **Add new secret**.
+- Removal: Click **⋮ > Delete**
+- Regeneration: Click **⋮ > Regenerate**
+
+## Signing key
+
+A default key pair for signing the `id_token`, `access_token`, and `refresh_token` tokens is created by Rancher in a `Secret` called `oidc-signing-key` in the `cattle-system` namespace. Only one key will be used for signing, but multiple public keys can be returned in the jwks endpoint in order to avoid disruption when doing a key rotation. 
+
+### Rotation without disruption
+
+In order to create a new key pair for signing you need to manually create a new keypair and add it to the `oidc-signing-key` `Secret`
+
+Example:
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+ name: oidc-signing-key
+type: Opaque
+data:
+ key2.pem: <base64-encoded-new-private-key>
+ key1.pub: <base64-encoded-old-public-key>
+ key2.pub: <base64-encoded-new-public-key>
+```
+
+Rancher will sign tokens using `key2.pem`, while the JWKS endpoint will serve both `key1.pub` and `key2.pub`. This ensures a smooth 
+key rotation from `key1` to `key2` without disrupting existing token verification. Note that only one private key (.pem) can be stored in the 
+secret at a time, and each key pair must share the same base name, differing only by their suffix: .pem for the private key and .pub for the public key.
+
+### Rotation with disruption
+
+Removing the `oidc-signing-key` `Secret` will cause Rancher to regenerate the signing key on the next restart.
+
+:::warning
+This will invalidate all previously issued `id_token`, `access_token`, and `refresh_token` tokens making them unusable.
+:::
@@ -1,41 +0,0 @@
---
-title: UI Server-Side Pagination
---
-
-<head>
-  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-experimental-features/ui-server-side-pagination"/>
-</head>
-
-:::caution
-UI server-side pagination is not intended for use in production at this time. This feature is considered highly experimental. SUSE customers should consult SUSE Support before activating this feature.
-:::
-
-
-UI server-side pagination caching provides an optional SQLite-backed cache of Kubernetes objects to improve performance. This unlocks sorting, filtering and pagination features used by the UI to restrict the amount of resources it fetches and stores in browser memory. These features are primarily used to improve list performance for resources with high counts.
-
-This feature creates file system based caches in the `rancher` pods of the upstream cluster, and in the `cattle-cluster-agent` pods of the downstream clusters. In most environments, disk usage and I/O should not be significant. However, you should monitor activity after you enable caching.
-
-SQLite-backed caching persists copies of any cached Kubernetes objects to disk. See [Encrypting SQLite-backed Caching](#encrypting-sqlite-backed-caches) if this is a security concern.
-
-## Enabling UI Server-Side Pagination
-
-1. In the upper left corner, click **☰ > Global Settings > Feature Flags**.
-1. Find **`ui-sql-cache`** and select **⋮ > Activate > Activate**.
-1. Wait for Rancher to restart. This also restarts agents on all downstream clusters.
-1. In the upper left corner, click **☰ > Global Settings > Performance**.
-1. Go to **Server-side Pagination** and check the **Enable Server-side Pagination** option.
-1. Click **Apply**.
-1. Reload the page with the browser button (or the equivalent keyboard combination, typically `CTRL + R` on Windows and Linux, and `⌘ + R` on macOS).
-
-
-## Encrypting SQLite-backed Caches
-
-UI server-side pagination persists copies of any cached Kubernetes objects to disk. If you're concerned about the safety of this data, you can encrypt all objects before they are persisted to disk, by setting the environment variable `CATTLE_ENCRYPT_CACHE_ALL` to `true` in `rancher` pods in the upstream cluster and `cattle-cluster-agent` pods in the downstream clusters.
-
-Secrets and security Tokens are always encrypted regardless of the above setting.
-
-## Known Limitations of UI Server-Side Pagination
-
-This initial release improves the performance of Pods, Secrets, Nodes and ConfigMaps in the Cluster Explorer pages, and most resources in the Explorer's **More Resources** section.
-
-Pages can't be automatically refreshed. You can manually refresh table contents by clicking the **Refresh** button.
@@ -0,0 +1,80 @@
+---
+title: UI Server-Side Pagination
+---
+
+<head>
+  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/ui-server-side-pagination"/>
+</head>
+
+Server-Side Pagination (SSP) is a Rancher feature to provide significant performance improvements across the UI for resources with high counts, restricting the amount of resources browser fetches and stores in memory.
+
+Note that SSP is optional, **enabled by default**, and it can be disabled via the feature flag `ui-sql-cache`.
+
+## Disk Space
+
+:::important
+It is crucial that you review the available disk space on your nodes and plan accordingly before upgrading to Rancher v2.12.0 and later to avoid potential disk pressure and pod eviction issues.
+:::
+
+The SSP relies on a caching mechanism that introduces a new requirement for ephemeral disk space on your cluster nodes. This cache, an internal SQLite database, is stored within the container's file system. This affects the nodes running the **Rancher server pods** (`rancher` in the `cattle-system` namespace on the local cluster) and the nodes running the **Rancher agent pods** (`cattle-cluster-agent` in the `cattle-system` namespace on all downstream clusters).
+
+The amount of disk space required is dynamic and depends on the quantity and size of Kubernetes resources visualized in the UI. As a guideline, the cache may consume approximately **twice the size of the raw Kubernetes objects** it stores.
+
+For example, internal tests showed that caching 5000 ConfigMaps, totaling 50 MB, consumed 81 MB of disk space. For a conservative, high-level estimate, you can plan for the available disk space on each relevant node to be at least **twice the size of your etcd snapshot**. For most production environments, ensuring a few extra gigabytes of storage are available on the relevant nodes is a safe starting point.
+
+Please note this space counts against [ephemeral storage](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#setting-requests-and-limits-for-local-ephemeral-storage) requests and limits you might have set for your Rancher container via the `resource` value in the Helm chart. Make sure those settings provide for abundant available space.
+
+If you see the error `database or disk is full (13)` in the pod logs, this is a symptom that more space needs to be allocated.
+
+SQLite-backed caching persists copies of any cached Kubernetes objects to disk. See [Encrypting SQLite-backed Caching](#encrypting-sqlite-backed-caches) if this is a security concern.
+
+## Enabling Server-Side Pagination
+
+1. In the upper left corner, click **☰ > Global Settings > Feature Flags**.
+1. Find **`ui-sql-cache`** and select **⋮ > Activate > Activate**.
+1. Wait for Rancher to restart. This also restarts agents on all downstream clusters.
+1. Reload the page with the browser button (or the equivalent keyboard combination, typically `CTRL + R` on Windows and Linux, and `⌘ + R` on macOS).
+
+## Disabling Server-Side Pagination
+
+1. In the upper left corner, click **☰ > Global Settings > Feature Flags**.
+1. Find **`ui-sql-cache`** and select **⋮ > Deactivate > Deactivate**.
+1. Wait for Rancher to restart. This also restarts agents on all downstream clusters.
+1. Reload the page with the browser button (or the equivalent keyboard combination, typically `CTRL + R` on Windows and Linux, and `⌘ + R` on macOS).
+
+## Encrypting SQLite-backed Caches
+
+UI server-side pagination persists copies of any cached Kubernetes objects to disk. If you're concerned about the safety of this data, you can encrypt all objects before they are persisted to disk, by setting the environment variable `CATTLE_ENCRYPT_CACHE_ALL` to `true` in `rancher` pods in the upstream cluster and `cattle-cluster-agent` pods in the downstream clusters.
+
+Secrets and security Tokens are always encrypted regardless of the above setting.
+
+## Known Limitations of UI Server-Side Pagination
+
+This release improves the performance of most pages used to view, create or edit resources within the `local` or downstream clusters i.e. the Cluster Explorer view. However, RBAC related resources and areas outside the Cluster Explorer are not yet covered by this feature.
+
+Additionally, the following limitations are present when the feature is enabled. These mainly revolve around different sort or filter behaviors in affected lists:
+
+- Resources in lists are automatically updated, however, not instantaneously.
+- All lists that utilize Server-Side Pagination:
+  - `State` column sort and filter features work on the resources `metadata.state.name` field instead of one deduced locally by the UI.
+  - Updates are shown every 5 seconds, rather than instantly.
+- Cluster Explorer:
+  - `Cluster` group --> `Nodes` page
+    - The following columns are not sortable or filterable: `Roles`, `External/Internal IP`, `CPU`, `RAM` (logic to determine their value is calculated in the browser)
+  - `Workloads` list:
+    - The `Workloads` list, which showed multiple different resource types has been removed.
+      - Server-Side Pagination of multiple resources is not currently possible.
+  - `Workloads` group --> All lists
+    - `Pod Restarts` and `Workload Health` columns have been removed.
+      - [Re-enable Pod Restart Count and Pod Health columns for Workload lists #14211](https://github.com/rancher/dashboard/issues/14211)
+  - `Workloads` group / `Job` List
+    - `Duration` is not sortable (sorting on a duration).
+      - [Implement more complex server-side pagination sorting #12815](https://github.com/rancher/dashboard/issues/12815)
+  - `Workloads` group / `Pod` List
+    - `Images` is not sortable (sorting on an array).
+  - `Service Discovery` group / `Ingresses`
+    - `Default` is not sortable/filterable (logic to determine their value is calculated in the browser).
+  - `Storage` group / `ConfigMaps`
+    - `Data` is not sortable/filterable (logic to determine their value is calculated in the browser).
+  - `Storage` group / `Secrets`
+    - `Data` is not sortable/filterable (logic to determine their value is calculated in the browser).
@@ -49,3 +49,4 @@ Rancher supports several major cloud providers, but by default, these node drive
 There are several other node drivers that are disabled by default, but are packaged in Rancher:

 *   [Harvester](../../../../integrations-in-rancher/harvester/overview.md#harvester-node-driver/), available as of Rancher v2.6.1
+*   [Google GCE](../../launch-kubernetes-with-rancher/use-new-nodes-in-an-infra-provider/create-a-google-compute-engine-cluster.md), available as of Rancher v2.12.0
@@ -0,0 +1,60 @@
+---
+title: Configure Amazon Cognito
+description: Create an Amazon Cognito user pool and configure Rancher to work with Amazon Cognito. Your users can then sign into Rancher using their login from Amazon Cognito.
+---
+
+<head> 
+  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-amazon-cognito"/>
+</head>
+
+If your organization uses Amazon Cognito for user authentication, you can configure Rancher to allow login using Amazon Cognito credentials. The following instructions describe how to configure Rancher to work with Amazon Cognito:
+
+## Prerequisites
+
+- In Rancher:
+  - Amazon Cognito is disabled.
+
+:::note
+Consult the Amazon Cognito [documentation](https://aws.amazon.com/cognito/getting-started/) to configure the user pool.
+:::
+
+- In Amazon Cognito:
+  - Create a new user pool or use an existing one. 
+  - In the `App client` settings, set the redirect URL to `https://yourRancherHostURL/verify-auth`. Replace `yourRancherHostURL` with the actual hostname of your Rancher instance (e.g., https://rancher.example.com/verify-auth).
+
+## Configuring Amazon Cognito in Rancher
+
+1. In the upper left corner of the Rancher UI, click **☰ > Users & Authentication**.
+1. In the left navigation bar, click **Auth Provider**.
+1. Select **Amazon Cognito**.
+1. Complete the **Configure an Amazon Cognito account** form. For help with filling the form, see the [configuration reference](#configuration-reference).
+1. Click **Enable**.
+
+   Rancher will redirect you to the Amazon Cognito login page. Enter your Amazon Cognito credentials to validate your Rancher configuration.
+
+   :::note
+
+   You may need to disable your popup blocker to see the Amazon Cognito login page.
+
+   :::
+
+**Result:** Rancher is configured to work with your Amazon Cognito using the OIDC protocol. Your users can now sign into Rancher using their Amazon Cognito logins.
+
+:::note
+User and group search is not supported for Amazon Cognito. When assigning permissions to a Project or Cluster, you must manually enter the UserID generated by Cognito 
+if the user has not yet logged in to Rancher. However, if the user has previously logged in, you can assign permissions using their username or email address.
+:::
+
+## Configuration Reference
+
+| Field                     | Description                                                                                                                                                                                                                                         |
+| ------------------------- |-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| Client ID                 | The Client ID of your Amazon Cognito App Client.                                                                                                                                                                                                    |
+| Client Secret             | The generated Secret of your Amazon Cognito App Client.                                                                                                                                                                                             |
+| Issuer                    | The Issuer URL of your Amazon Cognito App Client. It follows the format `https://cognito-idp.{region}.amazonaws.com/{userPoolId}`, and can be found in the App Client settings page. Rancher uses the Issuer URL to fetch all of the required URLs. |
+
+## Troubleshooting
+
+### You are not redirected to your authentication provider
+
+If you fill out the **Configure an Amazon Cognito account** form and click on **Enable**, and you are not redirected to Amazon Cognito, verify your Amazon Cognito configuration.
@@ -196,6 +196,34 @@ As previously mentioned, custom roles can be defined for use at the cluster or p

 When defining a custom role, you can grant access to specific resources or specify roles from which the custom role should inherit. A custom role can be made up of a combination of specific grants and inherited roles. All grants are additive. This means that defining a narrower grant for a specific resource **will not** override a broader grant defined in a role that the custom role is inheriting from.

+#### UpdatePSA For Project Level
+
+About defining custom roles, you can grant permission to a user to create or update *PSA* policies when defining namespaces within projects.
+
+To do so, you can use the following `RoleTemplate` to be applied on the cluster:
+
+```yaml
+apiVersion: management.cattle.io/v3
+builtin: false
+context: project
+description: ''
+displayName: Manage PSA Labels
+external: false
+hidden: false
+kind: RoleTemplate
+metadata:
+  name: namespaces-psa
+rules:
+  - apiGroups:
+      - management.cattle.io
+    resources:
+      - projects
+    verbs:
+      - updatepsa
+```
+
+When creating a new project (from the **Members** tab), click **Add** to add the user and select **Custom** > **Create Namespaces** (to allow the user to create namespaces). Then click **Add** again and select `UpdatePSA` project role template from the list of **Project Permissions**.
+
 ### Default Cluster and Project Roles

 By default, when a standard user creates a new cluster or project, they are automatically assigned an ownership role: either [cluster owner](#cluster-roles) or [project owner](#project-roles). However, in some organizations, these roles may overextend administrative access. In this use case, you can change the default role to something more restrictive, such as a set of individual roles or a custom role.
@@ -0,0 +1,23 @@
+---
+title: Notification Center
+---
+
+<head>
+  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/notification-center"/>
+</head>
+
+## What is the Notification Center?
+
+The Notification Center, located in the upper-right corner of your Rancher dashboard and marked by a bell icon, is your central hub for staying informed about various events within Rancher.
+
+Notifications are categorized by severity and type:
+
+* **Error** indicates a high-severity issue.
+* **Warning** indicates a medium-severity concern.
+* **Information** provides general updates of lower severity.
+* **Task** shows that a process or action is currently in progress.
+* **Success** confirms that a process or action has completed successfully.
+
+For example, you might receive a notification when a new version of Rancher is available, or a direct link to the Rancher Release Notes.
+
+You can easily browse through your notifications using the up and down arrow keys. Certain notifications may also include an associated action, allowing you to respond immediately.
@@ -38,9 +38,6 @@ You can assign a PSA template at the same time that you create a downstream clus
 1. In the **Pod Security Admission Configuration Template** dropdown menu, select the template you want to assign.
 1. Click **Save**.

-### Hardening the Cluster
-
-If you select the **rancher-restricted** template but don't select a **CIS Profile**, you won't meet required CIS benchmarks. See the [RKE2 hardening guide](../../../reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-hardening-guide.md) for more details.

 </TabItem>
 <TabItem value="RKE1">
@@ -70,7 +70,7 @@ To perform a backup, a custom resource of type Backup must be created.
          folder: rancher
          region: us-west-2
          endpoint: s3.us-west-2.amazonaws.com
-      resourceSetName: rancher-resource-set
+      resourceSetName: rancher-resource-set-full
      encryptionConfigSecretName: encryptionconfig
      schedule: "@every 1h"
      retentionCount: 10
@@ -78,7 +78,7 @@ To perform a backup, a custom resource of type Backup must be created.

    :::note

-    When creating the Backup resource using YAML editor, the `resourceSetName` must be set to `rancher-resource-set`
+    When creating the Backup resource using YAML editor, the `resourceSetName` must be set to `rancher-resource-set-full` or `rancher-resource-set-basic`.

    :::

@@ -28,7 +28,7 @@ The `rancher-backup` operator introduces three custom resources: Backups, Restor

 The ResourceSet defines which Kubernetes resources need to be backed up. The ResourceSet is not available to be configured in the Rancher UI because the values required to back up Rancher are predefined. This ResourceSet should not be modified.

-When a Backup custom resource is created, the `rancher-backup` operator calls the `kube-apiserver` to get the resources in the ResourceSet (specifically, the predefined `rancher-resource-set`) that the Backup custom resource refers to.
+When a Backup custom resource is created, the `rancher-backup` operator calls the `kube-apiserver` to get the resources in the ResourceSet that the Backup custom resource refers to.

 The operator then creates the backup file in the .tar.gz format and stores it in the location configured in the Backup resource.

@@ -170,6 +170,13 @@ You can define the default behavior for newly created clusters or existing ones

 Changes to the global **imported-cluster-version-management** setting take effect during the cluster’s next reconciliation cycle.

+:::note
+
+If version management is enabled for a cluster, Rancher will deploy the system-upgrade-controller app, along with the associated Plans and other required Kubernetes resources, to the cluster. 
+If version management is disabled, Rancher will remove these components from the cluster.
+
+:::
+
 ## Configuring RKE2 and K3s Cluster Upgrades

 :::tip
@@ -14,15 +14,16 @@ This page is about secrets in general. For details on setting up a private regis

 :::

-When configuring a workload, you'll be able to choose which secrets to include. Like config maps, secrets can be referenced by workloads as either an environment variable or a volume mount.
+When configuring a workload, you are able to choose which secrets to include. Like config maps, secrets can be referenced by workloads as either an environment variable or a volume mount.

-Mounted secrets will be updated automatically unless they are mounted as subpath volumes. For details on how updated secrets are propagated, refer to the [Kubernetes documentation.](https://kubernetes.io/docs/concepts/configuration/secret/#mounted-secrets-are-updated-automatically)
+Mounted secrets are updated automatically unless they are mounted as subpath volumes. For details on how updated secrets are propagated, refer to the [Kubernetes documentation.](https://kubernetes.io/docs/concepts/configuration/secret/#mounted-secrets-are-updated-automatically)

 ## Creating Secrets in Namespaces

 1. In the upper left corner, click **☰ > Cluster Management**.
 1. Go to the cluster where you want to add a secret and click **Explore**.
 1. To navigate to secrets, you may click either **Storage > Secrets** or **More Resources > Core > Secrets**.
+1. Select the **Namespaced** tab.
 1. Click **Create**.
 1. Select the type of secret you want to create.
 1. Select a **Namespace** for the secret.
@@ -48,32 +49,66 @@ Mounted secrets will be updated automatically unless they are mounted as subpath

 **Result:** Your secret is added to the namespace you chose. You can view the secret in the Rancher UI by clicking either **Storage > Secrets** or **More Resources > Core > Secrets**.

-Mounted secrets will be updated automatically unless they are mounted as subpath volumes. For details on how updated secrets are propagated, refer to the [Kubernetes documentation.](https://kubernetes.io/docs/concepts/configuration/secret/#mounted-secrets-are-updated-automatically)
+Mounted secrets are updated automatically unless they are mounted as subpath volumes. For details on how updated secrets are propagated, refer to the [Kubernetes documentation.](https://kubernetes.io/docs/concepts/configuration/secret/#mounted-secrets-are-updated-automatically)


 ## Creating Secrets in Projects

-Before v2.6, secrets were required to be in a project scope. Projects are no longer required, and you may use the namespace scope instead. As a result, the Rancher UI was updated to reflect this new functionality. However, you may still create project-scoped secrets if desired. Note that you have to first enable the `legacy` feature flag and look at a single project to do so. Use the following steps to set up your project-level secret:
+When creating a secret in a project scope, the secret is copied into all namespaces within the project.

-1. In the upper left corner, click **☰ > Global Settings** in the dropdown.
-1. Click **Feature Flags**.
-1. Go to the `legacy` feature flag and click **Activate**.
-1. In the upper left corner, click **☰ > Cluster Management** in the dropdown.
-1. Go to the cluster that you created and click **Explore.**
-1. Click **Legacy > Projects**.
-1. In the top navigation bar, filter to see only one project.
-1. In the left navigation bar, click **Secrets**.
-1. Click **Add Secret**.
+### Creating a Project Scoped Secret in the UI

-**Result:** Your secret is added to the individual project you chose. You can view the secret in the Rancher UI by clicking either **Storage > Secrets** or **More Resources > Core > Secrets**.
+1. In the upper left corner, click **☰ > Cluster Management**.
+1. Go to the cluster where you want to add a secret and click **Explore**.
+1. To navigate to secrets, you may click either **Storage > Secrets** or **More Resources > Core > Secrets**.
+1. Select the **Project Scoped** tab.
+1. Click **Create Project Scoped Secret**.
+1. Select the type of secret you want to create.
+1. Select a **Project** for the secret.
+1. Enter a **Name** for the secret.

-Since project-scoped secrets are set at the project level, any changes made at the namespace level will be overwritten.
+    :::note

-:::note
+    Kubernetes classifies secrets, certificates, and registries all as [secrets](https://kubernetes.io/docs/concepts/configuration/secret/), and no two secrets in a namespace can have duplicate names. If you create a project scoped secret that has the same name as an existing secret in one of the project namespaces, the existing secret is overwritten.

-Project-scoped secrets on the local cluster are only visible when a single project is selected.
+    :::

-:::
+1. From **Data**, click **Add** to add a key-value pair. Add as many values as you need.
+
+    :::tip
+
+    You can add multiple key-value pairs to the secret by copying and pasting.
+
+    :::
+
+    ![](/img/bulk-key-values.gif)
+
+1. Click **Save**.
+
+**Result:** Your secret is added to each namespace within the project. You can view the secret in the Rancher UI by clicking either **Storage > Secrets** or **More Resources > Core > Secrets**.
+
+### Creating a Project Scoped Secret with kubectl
+
+Project scoped secrets work by creating the original secret on the management cluster in what's known as the "Project Backing Namespace". Rancher stores important project related information in this namespace. You can find it in the `status.backingNamespace` field in the project CRD, or by doing `kubectl get projects -A` in the management cluster.
+
+In order for the secret to be acknowledged by Rancher as a project scoped secret, it also needs the label `management.cattle.io/project-scoped-secret: <projectID>`.
+
+Example yaml:
+
+```
+apiVersion: v1
+data:
+  key: ZG9n
+kind: Secret
+metadata:
+  labels:
+    management.cattle.io/project-scoped-secret: p-vwxyz
+  name: test-secret
+  namespace: c-abc123-p-vwxyz
+type: Opaque
+```
+
+In the above YAML, the namespace is the backing namespace of project `p-vwxyz` and the project scoped secret label references the projectID. When applied to the management cluster, all namespaces within the project `p-vwxyz` contain a copy of `test-secret`.

 ## What's Next?

@@ -54,12 +54,18 @@ If you use RKE2 to set up a cluster, your nodes must meet the [requirements](htt

 ### Launching Kubernetes on New Nodes in an Infrastructure Provider

-RKE2 provisioning is built on top of a new provisioning framework that leverages the upstream [Cluster API](https://github.com/kubernetes-sigs/cluster-api) project. With this new provisioning framework, you can:
+RKE2 provisioning is built on top of a new provisioning framework that leverages the upstream [Cluster API (CAPI)](https://github.com/kubernetes-sigs/cluster-api) project. With this new provisioning framework, you can:

 - Provision RKE2 clusters onto any provider for which Rancher has a node driver
 - Fully configure RKE2 clusters within Rancher
 - Choose CNI options Calico, Cilium, and Multus in addition to Canal

+When you make changes to your cluster configuration in RKE2, this may result in nodes reprovisioning. This is controlled by CAPI controllers and not by Rancher itself. Note that for etcd nodes, the same behavior does not apply.
+
+The following are some specific example configuration changes that may cause the described behavior:
+
+- When editing the cluster and enabling drain before delete, the existing control plane nodes and worker are deleted and new nodes are created.
+
 RKE2 provisioning also includes installing RKE2 on clusters with Windows nodes.

 Windows features for RKE2 include:
@@ -1,37 +0,0 @@
---
-title: Behavior Differences Between RKE1 and RKE2
---
-
-<head>
-  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences"/>
-</head>
-
-<EOLRKE1Warning />
-
-RKE2, also known as RKE Government, is a Kubernetes distribution that focuses on security and compliance for U.S. Federal Government entities. It is considered the next iteration of the Rancher Kubernetes Engine, now known as RKE1.
-
-RKE1 and RKE2 have several slight behavioral differences to note, and this page will highlight some of these at a high level.
-
-### Control Plane Components
-
-RKE1 uses Docker for deploying and managing control plane components, and it also uses Docker as the container runtime for Kubernetes. By contrast, RKE2 launches control plane components as static pods that are managed by the kubelet. RKE2's container runtime is containerd, which allows things such as mirroring a container image registry. RKE1 with Docker does not allow mirroring.
-
-### Cluster API
-
-RKE2/K3s provisioning is built on top of the Cluster API (CAPI) upstream framework which often makes RKE2-provisioned clusters behave differently than RKE1-provisioned clusters.
-
-When you make changes to your cluster configuration in RKE2, this **may** result in nodes reprovisioning. This is controlled by CAPI controllers and not by Rancher itself. Note that for etcd nodes, the same behavior does not apply.
-
-The following are some specific example configuration changes that may cause the described behavior:
-
- When editing the cluster and enabling `drain before delete`, the existing control plane nodes and worker are deleted and new nodes are created.
-
-Users who are used to RKE1 provisioning should take note of this new RKE2 behavior which may be unexpected.
-
-### Terminology
-
-You will notice that some terms have changed or gone away going from RKE1 to RKE2. For example, in RKE1 provisioning, you use **node templates**; in RKE2 provisioning, you can configure your cluster node pools when creating or editing the cluster. Another example is that the term **node pool** in RKE1 is now known as **machine pool** in RKE2.
-
-
-
-
@@ -6,53 +6,11 @@ title: Creating a DigitalOcean Cluster
  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/use-new-nodes-in-an-infra-provider/create-a-digitalocean-cluster"/>
 </head>

-In this section, you'll learn how to use Rancher to install an [RKE](https://rancher.com/docs/rke/latest/en/) Kubernetes cluster in DigitalOcean.
+In this section, you'll learn how to deploy an [RKE2](https://docs.rke2.io/)/[K3s](https://docs.k3s.io/) Kubernetes cluster in DigitalOcean.

-First, you will set up your DigitalOcean cloud credentials in Rancher. Then you will use your cloud credentials to create a node template, which Rancher will use to provision new nodes in DigitalOcean.
+First, you will set up your DigitalOcean cloud credentials in Rancher.

-Then you will create a DigitalOcean cluster in Rancher, and when configuring the new cluster, you will define node pools for it. Each node pool will have a Kubernetes role of etcd, controlplane, or worker. Rancher will install RKE Kubernetes on the new nodes, and it will set up each node with the Kubernetes role defined by the node pool.
-
-<Tabs>
-<TabItem value="RKE">
-
-1. [Create your cloud credentials](#1-create-your-cloud-credentials)
-2. [Create a node template with your cloud credentials](#2-create-a-node-template-with-your-cloud-credentials)
-3. [Create a cluster with node pools using the node template](#3-create-a-cluster-with-node-pools-using-the-node-template)
-
-### 1. Create your cloud credentials
-
-1. Click **☰ > Cluster Management**.
-1. Click **Cloud Credentials**.
-1. Click **Create**.
-1. Click **DigitalOcean**.
-1. Enter your Digital Ocean credentials.
-1. Click **Create**.
-
-**Result:** You have created the cloud credentials that will be used to provision nodes in your cluster. You can reuse these credentials for other node templates, or in other clusters.
-
-### 2. Create a node template with your cloud credentials
-
-Creating a [node template](use-new-nodes-in-an-infra-provider.md#node-templates) for DigitalOcean will allow Rancher to provision new nodes in DigitalOcean. Node templates can be reused for other clusters.
-
-1. Click **☰ > Cluster Management**.
-1. Click **RKE1 Configuration > Node Templates**.
-1. Click **Add Template**.
-1. Click **DigitalOcean**.
-1. Fill out a node template for DigitalOcean. For help filling out the form, refer to [DigitalOcean Node Template Configuration.](../../../../reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/digitalocean.md)
-
-### 3. Create a cluster with node pools using the node template
-
-1. Click **☰ > Cluster Management**.
-1. On the **Clusters** page, click **Create**.
-1. Click **DigitalOcean**.
-1. Enter a **Cluster Name**.
-1. Add one or more node pools to your cluster. Add one or more node pools to your cluster. Each node pool uses a node template to provision new nodes. For more information about node pools, including best practices for assigning Kubernetes roles to them, see [this section.](use-new-nodes-in-an-infra-provider.md)
-1. **In the Cluster Configuration** section, choose the version of Kubernetes that will be installed, what network provider will be used and if you want to enable project network isolation. To see more cluster options, click on **Show advanced options**. For help configuring the cluster, refer to the [RKE cluster configuration reference.](../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md)
-1. Use **Member Roles** to configure user authorization for the cluster. Click **Add Member** to add users that can access the cluster. Use the **Role** drop-down to set permissions for each user.
-1. Click **Create**.
-
-</TabItem>
-<TabItem value="RKE2">
+Then you will create a DigitalOcean cluster in Rancher, and when configuring the new cluster, you will define machine pools for it. Each machine pool will have a Kubernetes role of etcd, controlplane, or worker. Rancher will install Kubernetes on the new nodes, and it will set up each node with the Kubernetes role defined by the machine pool.

 ### 1. Create your cloud credentials

@@ -77,13 +35,10 @@ Use Rancher to create a Kubernetes cluster in DigitalOcean.
 1. Enter a **Cluster Name**.
 1. Create a machine pool for each Kubernetes role. Refer to the [best practices](use-new-nodes-in-an-infra-provider.md#node-roles) for recommendations on role assignments and counts.
    1. For each machine pool, define the machine configuration. Refer to the [DigitalOcean machine configuration reference](../../../../reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/digitalocean.md) for information on configuration options.
-1. Use the **Cluster Configuration** to choose the version of Kubernetes that will be installed, what network provider will be used and if you want to enable project network isolation. For help configuring the cluster, refer to the [RKE2 cluster configuration reference.](../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke2-cluster-configuration.md)
+1. Use the **Cluster Configuration** to choose the version of Kubernetes that will be installed, what network provider will be used and if you want to enable project network isolation. For help configuring the cluster, refer to the [RKE2](../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke2-cluster-configuration.md) and [K3s](../../../../reference-guides/cluster-configuration/rancher-server-configuration/k3s-cluster-configuration.md) cluster configuration reference.
 1. Use **Member Roles** to configure user authorization for the cluster. Click **Add Member** to add users that can access the cluster. Use the **Role** drop-down to set permissions for each user.
 1. Click **Create**.

-</TabItem>
-</Tabs>
-
 **Result:**

 Your cluster is created and assigned a state of **Provisioning**. Rancher is standing up your cluster.
@@ -0,0 +1,107 @@
+---
+title: Creating a Google Compute Engine cluster
+---
+
+<head>
+  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/use-new-nodes-in-an-infra-provider/create-a-google-gce-cluster"/>
+</head>
+
+
+In this section, you'll learn how to use Rancher to provision an [RKE2](https://docs.rke2.io/)/[K3s](https://docs.k3s.io/) Kubernetes cluster on the Google Cloud Platform (GCP) using Google Compute Engine (GCE) through Rancher.
+
+
+First, you will enable the GCE node driver in the Rancher UI. Then, you follow the steps to create a GCP service account with the necessary permissions, and generate a JSON key file. This key file will be used to create a cloud credential in Rancher. 
+
+
+Then, you will create a GCE cluster in Rancher, and when configuring the cluster, you will define machine pools for it. Each machine pool will have a Kubernetes role of etcd, controlplane, or worker. Rancher will install RKE2 onto the new nodes, and it will set up each node with the Kubernetes role defined by the machine pool.
+
+
+1. [Enable the GCE node driver](#1-enable-the-gce-node-driver)
+1. [Create your cloud credential](#2-create-a-cloud-credential)
+1. [Create a GCE cluster with your cloud credential](#3-create-a-cluster-using-the-cloud-credential)
+1. [GCE Best Practices](#gce-best-practices)
+
+### Prerequisites
+
+1.   A valid Google Cloud Platform account and project.
+1.   A GCP Service Account JSON key file. The service account associated with this key must have the following IAM roles:
+      1. **Compute Admin**
+      1. **Service Account User**
+      1. **Viewer**
+1. A VPC Network to provision VMs within. 
+
+Refer to the [GCP documentation](https://cloud.google.com/iam/docs/service-account-overview) on creating and managing service account keys for more details.
+
+
+### 1. Enable the GCE node driver
+
+The GCE node driver is not enabled by default in Rancher. You must enable it before you can provision GCE clusters, or work with GCE specific CRDs.
+
+1.  Click **☰ > Cluster Management**.
+1.  On the left hand side, click **Drivers**.
+1.  Open the **Node Drivers** tab.
+1.  Find the **Google GCE** driver and select **⋮ > Activate**.
+
+
+### 2. Create a cloud credential
+
+1. Click **☰ > Cluster Management**.
+1. Click **Cloud Credentials**.
+1. Click **Create**.
+1. Click **Google**.
+1. Enter your GCP Service Account JSON key file.
+1. Click **Create**.
+
+**Result:** You have created the cloud credentials that will be used to provision nodes in your cluster. You can reuse these credentials in other clusters. Depending on the permissions granted to the service account, this credential may also be used for GKE clusters.
+
+
+### 3. Create a cluster using the cloud credential
+
+1. Click **☰ > Cluster Management**.
+1. On the **Clusters** page, click **Create**.
+1. Click **Google GCE**.
+1. Select a **Cloud Credential** and provide the GCP project to create the VM in.
+1. Enter a **Cluster Name**.
+1. Create a machine pool for each Kubernetes role. Refer to the [best practices](use-new-nodes-in-an-infra-provider.md#node-roles) for recommendations on role assignments and counts.
+  1. For each machine pool, define the machine configuration. Refer to the [Google GCE machine configuration reference](../../../../reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/google-gce.md) for information on configuration options.
+1. Use the **Cluster Configuration** to choose the version of Kubernetes that will be installed, what network provider will be used and if you want to enable project network isolation. For help configuring the cluster, refer to the [RKE2](../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke2-cluster-configuration.md) and [K3s](../../../../reference-guides/cluster-configuration/rancher-server-configuration/k3s-cluster-configuration.md) cluster configuration reference.
+1. Use **Member Roles** to configure user authorization for the cluster. Click **Add Member** to add users that can access the cluster. Use the **Role** drop-down to set permissions for each user.
+1. Click **Create**.
+
+
+**Result:**
+
+Your cluster is created and assigned a state of **Provisioning**. Rancher is standing up your cluster.
+
+You can access your cluster after its state is updated to **Active**.
+
+**Active** clusters are assigned two Projects:
+
+- `Default`, containing the `default` namespace
+- `System`, containing the `cattle-system`, `ingress-nginx`, `kube-public`, and `kube-system` namespaces
+
+### GCE Best Practices
+
+#### External Firewall Rules, Open Ports, and ACE
+
+If the cluster being provisioned will utilize the [Authorized Cluster Endpoint (ACE) feature](../../../new-user-guides/manage-clusters/access-clusters/use-kubectl-and-kubeconfig.md#authenticating-directly-with-a-downstream-cluster), controlplane nodes must expose port `6443`. This port is not exposed in the default machine pool configuration to prevent it from being exposed across all cluster nodes, and to reduce the number of firewall rules created by Rancher. 
+
+In order for ACE to work as expected, you must specify this port in the Rancher UI when configuring the controlplane machine pool by enabling the `Expose external ports` checkbox, under the `Show Advanced` section of the machine pool configuration UI. Alternatively, you may manually create a custom firewall rule in GCP and provide the related network tag in the controlplane machine-pool configuration.
+
+#### Internal Firewall Rules
+
+Rancher will automatically create a firewall rule and network tag to facilitate communication between cluster nodes internally within the specified VPC network. This rule will contain the minimum number of ports required to create an RKE2/K3s cluster. 
+
+If you need to extend the number of ports exposed internally between cluster nodes, a new firewall rule should be manually created, and the associated network tag assigned to the relevant machine pools. If desired, the automatic creation of the internal firewall rule can be disabled for each given machine pool when creating or updating the cluster. 
+
+#### Cross Network Deployments
+
+While it is possible to deploy different machine pools into different VPC networks, the internal firewall rule created by Rancher does not support this configuration by default. To create machine pools in different networks, additional firewall rules to facilitate communication between nodes in different networks must be manually created.
+
+
+## Optional Next Steps
+
+After creating your cluster, you can access it through the Rancher UI. As a best practice, we recommend setting up these alternate ways of accessing your cluster:
+
+- **Access your cluster with the kubectl CLI:** Follow [these steps](../../../new-user-guides/manage-clusters/access-clusters/use-kubectl-and-kubeconfig.md#accessing-clusters-with-kubectl-from-your-workstation) to access clusters with kubectl on your workstation. In this case, you will be authenticated through the Rancher server’s authentication proxy, then Rancher will connect you to the downstream cluster. This method lets you manage the cluster without the Rancher UI.
+- **Access your cluster with the kubectl CLI, using the authorized cluster endpoint:** Follow [these steps](../../../new-user-guides/manage-clusters/access-clusters/use-kubectl-and-kubeconfig.md#authenticating-directly-with-a-downstream-cluster) to access your cluster with kubectl directly, without authenticating through Rancher. We recommend setting up this alternative method to access your cluster so that in case you can’t connect to Rancher, you can still access the cluster.
@@ -7,11 +7,11 @@ description: Learn the prerequisites and steps required in order for you to crea
  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/use-new-nodes-in-an-infra-provider/create-an-amazon-ec2-cluster"/>
 </head>

-In this section, you'll learn how to use Rancher to install an [RKE](https://rancher.com/docs/rke/latest/en/) Kubernetes cluster in Amazon EC2.
+In this section, you'll learn how to deploy an [RKE2](https://docs.rke2.io/)/[K3s](https://docs.k3s.io/) Kubernetes cluster in Amazon EC2.

-First, you will set up your EC2 cloud credentials in Rancher. Then you will use your cloud credentials to create a node template, which Rancher will use to provision new nodes in EC2.
+First, you will set up your EC2 cloud credentials in Rancher.

-Then you will create an EC2 cluster in Rancher, and when configuring the new cluster, you will define node pools for it. Each node pool will have a Kubernetes role of etcd, controlplane, or worker. Rancher will install RKE Kubernetes on the new nodes, and it will set up each node with the Kubernetes role defined by the node pool.
+Then you will create an EC2 cluster in Rancher, and when configuring the new cluster, you will define machine pools for it. Each machine pool will have a Kubernetes role of etcd, controlplane, or worker. Rancher will install Kubernetes on the new nodes, and it will set up each node with the Kubernetes role defined by the machine pool.

 ### Prerequisites

@@ -26,64 +26,6 @@ Then you will create an EC2 cluster in Rancher, and when configuring the new clu

 The steps to create a cluster differ based on your Rancher version.

-<Tabs>
-<TabItem value="RKE">
-
-1. [Create your cloud credentials](#1-create-your-cloud-credentials)
-2. [Create a node template with your cloud credentials and information from EC2](#2-create-a-node-template-with-your-cloud-credentials-and-information-from-ec2)
-3. [Create a cluster with node pools using the node template](#3-create-a-cluster-with-node-pools-using-the-node-template)
-
-### 1. Create your cloud credentials
-
-1. Click **☰ > Cluster Management**.
-1. Click **Cloud Credentials**.
-1. Click **Create**.
-1. Click **Amazon**.
-1. Enter a name for the cloud credential.
-1. In the **Default Region** field, select the AWS region where your cluster nodes will be located.
-1. Enter your AWS EC2 **Access Key** and **Secret Key**.
-1. Click **Create**.
-
-**Result:** You have created the cloud credentials that will be used to provision nodes in your cluster. You can reuse these credentials for other node templates, or in other clusters.
-
-### 2. Create a node template with your cloud credentials and information from EC2
-
-Creating a [node template](use-new-nodes-in-an-infra-provider.md#node-templates) for EC2 will allow Rancher to provision new nodes in EC2. Node templates can be reused for other clusters.
-
-1. Click **☰ > Cluster Management**.
-1. Click **RKE1 Configuration > Node Templates**
-1. Click **Add Template**.
-1. Fill out a node template for EC2. For help filling out the form, refer to [EC2 Node Template Configuration.](../../../../reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/amazon-ec2.md)
-1. Click **Create**.
-
-    :::note
-
-    If you want to use the [dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/) feature, there are additional [requirements](https://rancher.com/docs/rke//latest/en/config-options/dual-stack#requirements) that must be taken into consideration.
-
-    :::
-
-### 3. Create a cluster with node pools using the node template
-
-Add one or more node pools to your cluster. For more information about node pools, see [this section.](use-new-nodes-in-an-infra-provider.md)
-
-1. Click **☰ > Cluster Management**.
-1. On the **Clusters** page, click **Create**.
-1. Click **Amazon EC2**.
-1. Create a node pool for each Kubernetes role. For each node pool, choose a node template that you created. For more information about node pools, including best practices for assigning Kubernetes roles to them, see [this section.](use-new-nodes-in-an-infra-provider.md)
-1. Click **Add Member** to add users that can access the cluster. Use the **Role** drop-down to set permissions for each user.
-1. Use **Cluster Options** to choose the version of Kubernetes that will be installed, what network provider will be used and if you want to enable project network isolation. Refer to [Selecting Cloud Providers](../../kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/set-up-cloud-providers.md) to configure the Kubernetes Cloud Provider. For help configuring the cluster, refer to the [RKE cluster configuration reference.](../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md)
-
-    :::note
-
-    If you want to use the [dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/) feature, there are additional [requirements](https://rancher.com/docs/rke//latest/en/config-options/dual-stack#requirements) that must be taken into consideration.
-
-    :::
-
-1. Click **Create**.
-
-</TabItem>
-<TabItem value="RKE2">
-
 ### 1. Create your cloud credentials

 If you already have a set of cloud credentials to use, skip this section.
@@ -97,7 +39,7 @@ If you already have a set of cloud credentials to use, skip this section.
 1. Enter your AWS EC2 **Access Key** and **Secret Key**.
 1. Click **Create**.

-**Result:** You have created the cloud credentials that will be used to provision nodes in your cluster. You can reuse these credentials for other node templates, or in other clusters.
+**Result:** You have created the cloud credentials that will be used to provision nodes in your cluster.

 ### 2. Create your cluster

@@ -109,13 +51,10 @@ If you already have a set of cloud credentials to use, skip this section.
 1. Enter a **Cluster Name**.
 1. Create a machine pool for each Kubernetes role. Refer to the [best practices](use-new-nodes-in-an-infra-provider.md#node-roles) for recommendations on role assignments and counts.
    1. For each machine pool, define the machine configuration. Refer to [the EC2 machine configuration reference](../../../../reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/amazon-ec2.md) for information on configuration options.
-1. Use the **Cluster Configuration** to choose the version of Kubernetes that will be installed, what network provider will be used and if you want to enable project network isolation. For help configuring the cluster, refer to the [RKE2 cluster configuration reference.](../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke2-cluster-configuration.md)
+1. Use the **Cluster Configuration** to choose the version of Kubernetes that will be installed, what network provider will be used and if you want to enable project network isolation. For help configuring the cluster, refer to the [RKE2](../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke2-cluster-configuration.md) and [K3s](../../../../reference-guides/cluster-configuration/rancher-server-configuration/k3s-cluster-configuration.md) cluster configuration reference.
 1. Use **Member Roles** to configure user authorization for the cluster. Click **Add Member** to add users that can access the cluster. Use the **Role** drop-down to set permissions for each user.
 1. Click **Create**.

-</TabItem>
-</Tabs>
-
 **Result:**

 Your cluster is created and assigned a state of **Provisioning**. Rancher is standing up your cluster.
@@ -6,15 +6,15 @@ title: Creating an Azure Cluster
  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/use-new-nodes-in-an-infra-provider/create-an-azure-cluster"/>
 </head>

-In this section, you'll learn how to install an [RKE](https://rancher.com/docs/rke/latest/en/) Kubernetes cluster in Azure through Rancher.
+In this section, you'll learn how to deploy an [RKE2](https://docs.rke2.io/)/[K3s](https://docs.k3s.io/) Kubernetes cluster in Azure through Rancher.

-First, you will set up your Azure cloud credentials in Rancher. Then you will use your cloud credentials to create a node template, which Rancher will use to provision new nodes in Azure.
+First, you will set up your Azure cloud credentials in Rancher.

-Then you will create an Azure cluster in Rancher, and when configuring the new cluster, you will define node pools for it. Each node pool will have a Kubernetes role of etcd, controlplane, or worker. Rancher will install Kubernetes on the new nodes, and it will set up each node with the Kubernetes role defined by the node pool.
+Then you will create an Azure cluster in Rancher, and when configuring the new cluster, you will define machine pools for it. Each machine pool will have a Kubernetes role of etcd, controlplane, or worker. Rancher will install Kubernetes on the new nodes, and it will set up each node with the Kubernetes role defined by the machine pool.

 :::caution

-When the Rancher RKE cluster is running in Azure and has an Azure load balancer in front, the outbound flow will fail. The workaround for this problem is as follows:
+When the Rancher RKE2/K3s cluster is running in Azure and has an Azure load balancer in front, the outbound flow will fail. The workaround for this problem is as follows:

 - Terminate the SSL/TLS on the internal load balancer
 - Use the L7 load balancer
@@ -23,16 +23,16 @@ For more information, refer to the documentation on [Azure load balancer limitat

 :::

-For more information on configuring the Kubernetes cluster that Rancher will install on the Azure nodes, refer to the [RKE cluster configuration reference.](../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md)
+For more information on configuring the Kubernetes cluster that Rancher will install on the Azure nodes, refer to the [RKE2](../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke2-cluster-configuration.md) and [K3s](../../../../reference-guides/cluster-configuration/rancher-server-configuration/k3s-cluster-configuration.md) cluster configuration references.

-For more information on configuring Azure node templates, refer to the [Azure node template configuration reference.](../../../../reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/azure.md)
+For more information on configuring Azure machines, refer to the [Azure machine configuration reference](../../../../reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/azure.md).

 - [Preparation in Azure](#preparation-in-azure)
 - [Creating an Azure Cluster](#creating-an-azure-cluster)

 ## Preparation in Azure

-Before creating a node template in Rancher using a cloud infrastructure such as Azure, we must configure Rancher to allow the manipulation of resources in an Azure subscription.
+Before a cluster can be deployed, we must configure our Azure subscription to allow the manipulation of its resources by a third party, such as Rancher.

 To do this, we will first create a new Azure **service principal (SP)** in Azure **Active Directory (AD)**, which, in Azure, is an application user who has permission to manage Azure resources.

@@ -45,54 +45,10 @@ az ad sp create-for-rbac \
  --scopes="/subscriptions/<subscription Id>"
 ```

-The creation of this service principal returns three pieces of identification information, *The application ID, also called the client ID*, and *The client secret*. This information will be used when you create a node template for Azure.
+The creation of this service principal returns the **application ID**, also called the **client ID**, and the **client secret**. This information is used when you create your cloud credentials.

 ## Creating an Azure Cluster

-<Tabs>
-<TabItem value="RKE">
-
-1. [Create your cloud credentials](#1-create-your-cloud-credentials)
-2. [Create a node template with your cloud credentials](#2-create-a-node-template-with-your-cloud-credentials)
-3. [Create a cluster with node pools using the node template](#3-create-a-cluster-with-node-pools-using-the-node-template)
-
-### 1. Create your cloud credentials
-
-1. Click **☰ > Cluster Management**.
-1. Click **Cloud Credentials**.
-1. Click **Create**.
-1. Click **Azure**.
-1. Enter your Azure credentials.
-1. Click **Create**.
-
-**Result:** You have created the cloud credentials that will be used to provision nodes in your cluster. You can reuse these credentials for other node templates, or in other clusters.
-
-### 2. Create a node template with your cloud credentials
-
-Creating a [node template](use-new-nodes-in-an-infra-provider.md#node-templates) for Azure will allow Rancher to provision new nodes in Azure. Node templates can be reused for other clusters.
-
-1. Click **☰ > Cluster Management**.
-1. Click **RKE1 Configuration > Node Templates**.
-1. Click **Add Template**.
-1. Click **Azure**.
-1. Fill out a node template for Azure. For help filling out the form, refer to [Azure Node Template Configuration.](../../../../reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/azure.md)
-
-### 3. Create a cluster with node pools using the node template
-
-Use Rancher to create a Kubernetes cluster in Azure.
-
-1. Click **☰ > Cluster Management**.
-1. On the **Clusters** page, click **Create**.
-1. Click **Azure**.
-1. Enter a **Cluster Name**.
-1. Add one or more node pools to your cluster. Each node pool uses a node template to provision new nodes. For more information about node pools, including best practices, see [this section.](use-new-nodes-in-an-infra-provider.md)
-1. In the **Cluster Configuration** to choose the version of Kubernetes that will be installed, what network provider will be used and if you want to enable project network isolation. To see more cluster options, click on **Show advanced options**. For help configuring the cluster, refer to the [RKE cluster configuration reference.](../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md)
-1. Use **Member Roles** to configure user authorization for the cluster. Click **Add Member** to add users that can access the cluster. Use the **Role** drop-down to set permissions for each user.
-1. Click **Create**.
-
-</TabItem>
-<TabItem value="RKE2">
-
 ### 1. Create your cloud credentials

 If you already have a set of cloud credentials to use, skip this section.
@@ -104,7 +60,7 @@ If you already have a set of cloud credentials to use, skip this section.
 1. Enter your Azure credentials.
 1. Click **Create**.

-**Result:** You have created the cloud credentials that will be used to provision nodes in your cluster. You can reuse these credentials for other node templates, or in other clusters.
+**Result:** You have created the cloud credentials that will be used to provision nodes in your cluster.

 ### 2. Create your cluster

@@ -118,13 +74,10 @@ Use Rancher to create a Kubernetes cluster in Azure.
 1. Enter a **Cluster Name**.
 1. Create a machine pool for each Kubernetes role. Refer to the [best practices](use-new-nodes-in-an-infra-provider.md#node-roles) for recommendations on role assignments and counts.
    1. For each machine pool, define the machine configuration. Refer to the [Azure machine configuration reference](../../../../reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/azure.md) for information on configuration options.
-1. Use the **Cluster Configuration** to choose the version of Kubernetes that will be installed, what network provider will be used and if you want to enable project network isolation.  For help configuring the cluster, refer to the [RKE2 cluster configuration reference.](../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke2-cluster-configuration.md)
+1. Use the **Cluster Configuration** to choose the version of Kubernetes that will be installed, what network provider will be used and if you want to enable project network isolation.  For help configuring the cluster, refer to the [RKE2](../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke2-cluster-configuration.md) and [K3s](../../../../reference-guides/cluster-configuration/rancher-server-configuration/k3s-cluster-configuration.md) cluster configuration reference.
 1. Use **Member Roles** to configure user authorization for the cluster. Click **Add Member** to add users that can access the cluster. Use the **Role** drop-down to set permissions for each user.
 1. Click **Create**.

-</TabItem>
-</Tabs>
-
 **Result:**

 Your cluster is created and assigned a state of **Provisioning**. Rancher is standing up your cluster.
@@ -18,4 +18,4 @@ A Nutanix cluster may consist of multiple groups of VMs with distinct properties

 ## Creating a Nutanix Cluster

-In [this section,](provision-kubernetes-clusters-in-aos.md) you'll learn how to use Rancher to install an [RKE](https://rancher.com/docs/rke/latest/en/) Kubernetes cluster in Nutanix AOS.
+In [this section,](provision-kubernetes-clusters-in-aos.md) you'll learn how to use Rancher to install an [RKE2](https://docs.rke2.io/)/[K3s](https://docs.k3s.io/) Kubernetes cluster in Nutanix AOS.
@@ -6,9 +6,9 @@ title: Creating a VMware vSphere Virtual Machine Template
  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/use-new-nodes-in-an-infra-provider/vsphere/create-a-vm-template"/>
 </head>

-Creating virtual machines in a repeatable and reliable fashion can often be difficult. VMware vSphere offers the ability to build one VM that can then be converted to a template. The template can then be used to create identically configured VMs. Rancher leverages this capability within node pools to create identical RKE1 and RKE2 nodes.
+Creating virtual machines in a repeatable and reliable fashion can often be difficult. VMware vSphere offers the ability to build one VM that can then be converted to a template. The template can then be used to create identically configured VMs. Rancher leverages this capability to create identical RKE/K3s nodes.

-In order to leverage the template to create new VMs, Rancher has some [specific requirements](#requirements) that the VM must have pre-installed. After you configure the VM with these requirements, you will next need to [prepare the VM](#preparing-your-vm) before [creating the template](#creating-a-template). Finally, once preparation is complete, the VM can be [converted to a template](#converting-to-a-template) and [moved into a content library](#moving-to-a-content-library), ready for Rancher node pool usage.
+In order to leverage the template to create new VMs, Rancher has some [specific requirements](#requirements) that the VM must have pre-installed. After you configure the VM with these requirements, you will next need to [prepare the VM](#preparing-your-vm) before [creating the template](#creating-a-template). Finally, once preparation is complete, the VM can be [converted to a template](#converting-to-a-template) and [moved into a content library](#moving-to-a-content-library).


 ## Requirements
@@ -47,14 +47,6 @@ The list of packages that need to be installed on the template is as follows:

 * Windows Container Feature
 * [cloudbase-init](https://cloudbase.it/cloudbase-init/#download)
-* [Docker EE](https://docs.microsoft.com/en-us/virtualization/windowscontainers/quick-start/set-up-environment?tabs=Windows-Server#install-docker) - RKE1 Only
-
-:::note About the configuration for Windows templates varies between RKE1 and RKE2:
-
- RKE1 leverages Docker, so any RKE1 templates need to have Docker EE pre-installed as well
- RKE2 does not require Docker EE, and thus it does not need to be installed
-
-:::

 ## Creating a Template

@@ -34,7 +34,7 @@ The following steps create a role with the required privileges and then assign i

 4. Go to the **Users and Groups** tab.

-5. Create a new user. Fill out the form and then click **OK**. Make sure to note the username and password, because you will need it when configuring node templates in Rancher.
+5. Create a new user. Fill out the form and then click **OK**. Make sure to note the username and password, because you will need it when creating cloud credentials in Rancher.

    ![](/img/rancheruser.png)

@@ -6,16 +6,11 @@ title: Provisioning Kubernetes Clusters in VMware vSphere
  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/use-new-nodes-in-an-infra-provider/vsphere/provision-kubernetes-clusters-in-vsphere"/>
 </head>

-In this section, you'll learn how to use Rancher to install an [RKE](https://rancher.com/docs/rke/latest/en/)  Kubernetes cluster in VMware vSphere.
+In this section, you'll learn how to deploy an [RKE2](https://docs.rke2.io/)/[K3s](https://docs.k3s.io/) Kubernetes cluster in VMware vSphere.

-First, you will set up your vSphere cloud credentials in Rancher. Then you will use your cloud credentials to create a node template, which Rancher will use to provision nodes in vSphere.
-
-Then you will create a vSphere cluster in Rancher, and when configuring the new cluster, you will define node pools for it. Each node pool will have a Kubernetes role of etcd, controlplane, or worker. Rancher will install RKE Kubernetes on the new nodes, and it will set up each node with the Kubernetes role defined by the node pool.
-
-For details on configuring the vSphere node template, refer to the [vSphere node template configuration reference.](../../../../../reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/vsphere.md)
-
-For details on configuring RKE Kubernetes clusters in Rancher, refer to the [cluster configuration reference.](../../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md#rke-cluster-config-file-reference)
+First, you will set up your vSphere cloud credentials in Rancher.

+Then you will create a vSphere cluster in Rancher, and when configuring the new cluster, you will define machine pools for it. Each machine pool will have a Kubernetes role of etcd, controlplane, or worker. Rancher will install Kubernetes on the new nodes, and it will set up each node with the Kubernetes role defined by the machine pool.

 - [Preparation in vSphere](#preparation-in-vmware-vsphere)
 - [Creating a vSphere Cluster](#creating-a-vmware-vsphere-cluster)
@@ -24,11 +19,9 @@ For details on configuring RKE Kubernetes clusters in Rancher, refer to the [clu

 This section describes the requirements for setting up vSphere so that Rancher can provision VMs and clusters.

-The node templates are documented and tested with the vSphere Web Services API version 6.5.
-
 ### Create Credentials in VMware vSphere

-Before proceeding to create a cluster, you must ensure that you have a vSphere user with sufficient permissions. When you set up a node template, the template will need to use these vSphere credentials.
+Before proceeding to create a cluster, you must ensure that you have a vSphere user with sufficient permissions.

 Refer to this [how-to guide](create-credentials.md) for instructions on how to create a user in vSphere with the required permissions. These steps result in a username and password that you will need to provide to Rancher, which allows Rancher to provision resources in vSphere.

@@ -58,10 +51,6 @@ User-data.iso files may have become orphaned upon node deletion due to a vSphere

 :::

-1. [Create your cloud credentials](#1-create-your-cloud-credentials)
-2. [Create a node template with your cloud credentials](#2-create-a-node-template-with-your-cloud-credentials)
-3. [Create a cluster with node pools using the node template](#3-create-a-cluster-with-node-pools-using-the-node-template)
-
 ### 1. Create your cloud credentials

 1. Click **☰ > Cluster Management**.
@@ -71,32 +60,21 @@ User-data.iso files may have become orphaned upon node deletion due to a vSphere
 1. Enter your vSphere credentials. For help, refer to **Account Access** in the [node template configuration reference.](../../../../../reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/vsphere.md)
 1. Click **Create**.

-**Result:** You have created the cloud credentials that will be used to provision nodes in your cluster. You can reuse these credentials for other node templates, or in other clusters.
+**Result:** You have created the cloud credentials that will be used to provision nodes in your cluster.

-### 2. Create a node template with your cloud credentials
-
-Creating a [node template](../use-new-nodes-in-an-infra-provider.md#node-templates) for vSphere will allow Rancher to provision new nodes in vSphere. Node templates can be reused for other clusters.
-
-1. Click **☰ > Cluster Management**.
-1. Click **RKE1 Configuration > Node Templates**.
-1. Click **Create**.
-1. Click **Add Template**.
-1. Click **vSphere**.
-1. Fill out a node template for vSphere. For help filling out the form, refer to the vSphere node template [configuration reference.](../../../../../reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/vsphere.md).
-1. Click **Create**.
-
-### 3. Create a cluster with node pools using the node template
+### 2. Create your cluster

 Use Rancher to create a Kubernetes cluster in vSphere.

 1. In the upper left corner, click **☰ > Cluster Management**.
 1. On the **Clusters** page, click **Create**.
 1. Click **VMware vSphere**.
-1. Enter a **Cluster Name** and use your vSphere cloud credentials. Click **Continue**.
+1. Enter a **Cluster Name** and use your vSphere cloud credentials.
+1. Create a machine pool for each Kubernetes role. Refer to the [best practices](../use-new-nodes-in-an-infra-provider.md#node-roles) for recommendations on role assignments and counts.
+    1. For each machine pool, define the machine configuration.
+1. Use **Cluster Configuration** to choose the version of Kubernetes that will be installed, what network provider will be used and if you want to enable project network isolation. For help configuring the cluster, refer to the [RKE2](../../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke2-cluster-configuration.md) and [K3s](../../../../../reference-guides/cluster-configuration/rancher-server-configuration/k3s-cluster-configuration.md) cluster configuration reference.
 1. Use **Member Roles** to configure user authorization for the cluster. Click **Add Member** to add users that can access the cluster. Use the **Role** drop-down to set permissions for each user.
-1. Use **Cluster Options** to choose the version of Kubernetes that will be installed, what network provider will be used and if you want to enable project network isolation. To see more cluster options, click on **Show advanced options**. For help configuring the cluster, refer to the [RKE cluster configuration reference.](../../../../../reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md)
 1. If you want to dynamically provision persistent storage or other infrastructure later, you will need to enable the vSphere cloud provider by modifying the cluster YAML file. For details, refer to [in-tree vSphere cloud provider docs](../../../../../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/configure-in-tree-vsphere.md) and [out-of-tree vSphere cloud provider docs](../../../../../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/configure-out-of-tree-vsphere.md).
-1. Add one or more node pools to your cluster. Each node pool uses a node template to provision new nodes. For more information about node pools, including best practices for assigning Kubernetes roles to the nodes, see [this section.](../use-new-nodes-in-an-infra-provider.md#node-pools)
 1. Review your options to confirm they're correct. Then click **Create**.

 **Result:**
@@ -10,8 +10,6 @@ In Rancher v2.8.3 and later, you can configure the graceful shutdown of virtual

 In RKE2/K3s, you can set up graceful shutdown when you create the cluster, or edit the cluster configuration to add it afterward. 

-In RKE, you can edit node templates to similar results.
-
 :::note 

 Since Rancher can't detect the platform of an imported cluster, you cannot enable graceful shutdown on VMware vSphere clusters you have imported.
@@ -20,30 +18,12 @@ Since Rancher can't detect the platform of an imported cluster, you cannot enabl

 ## Enable Graceful Shutdown During VMware vSphere Cluster Creation 

-<Tabs>
-<TabItem value="RKE2/K3s">
-
 In RKE2/K3s, you can configure new VMware vSphere clusters with graceful shutdown for VMs:

 1. Click **☰ > Cluster Management**.
 1. Click **Create** and select **VMware vSphere** to provision a new cluster.
 1. Under **Machine Pools > Scheduling**, in the **Graceful Shutdown Timeout** field, enter an integer value greater than 0. The value you enter is the amount of time in seconds Rancher waits before deleting VMs on the cluster. If the value is set to `0`, graceful shutdown is disabled.

-</TabItem>
-<TabItem value="RKE">
-
-In RKE, you can't directly configure a new cluster with graceful shutdown. However, you can configure node templates which automatically create node pools with graceful shutdown enabled. The node template can then be used to provision new VMware vSphere clusters that have a graceful shutdown delay. 
-
-1. Click **☰ > Cluster Management**.
-1. From the left navigation, select **RKE1 Configuration > Node Templates**.
-1. Click **Add Template** and select **vSphere** to create a node template.
-1. Under **2. Scheduling**, in the **Graceful Shutdown Timeout** field, enter an integer value greater than 0. The value you enter is the amount of time in seconds Rancher waits before deleting VMs on the cluster. If the value is set to `0`, graceful shutdown is disabled.
-
-When you [use the newly-created node template to create node pools](../use-new-nodes-in-an-infra-provider.md), the nodes will gracefully shutdown of VMs according to the **Graceful Shutdown Timeout** value you have set.
-
-</TabItem>
-</Tabs>
-
 ## Enable Graceful Shutdown in Existing RKE2/K3s Clusters

 In RKE2/K3s, you can edit the configuration of an existing VMware vSphere cluster to enable graceful shutdown, which adds a delay before deleting VMs.
@@ -52,14 +32,3 @@ In RKE2/K3s, you can edit the configuration of an existing VMware vSphere cluste
 1. On the **Clusters** page, find the VMware vSphere hosted cluster you want to edit. Click **⋮** at the end of the row associated with the cluster. Select **Edit Config**.
 1. Under **Machine Pools > Scheduling**, in the **Graceful Shutdown Timeout** field, enter an integer value greater than 0. The value you enter is the amount of time in seconds Rancher waits before deleting VMs on the cluster. If the value is set to `0`, graceful shutdown is disabled.

-## Enable Graceful Shutdown in Existing RKE Clusters
-
-In RKE, you can't directly edit an existing cluster's configuration to add graceful shutdown to existing VMware vSphere clusters. However, you can edit the configuration of existing node templates. As noted in [Updating a Node Template](../../../../../reference-guides/user-settings/manage-node-templates.md#updating-a-node-template), all node pools using the node template automatically use the updated information when new nodes are added to the cluster.
-
-To edit an existing node template to enable graceful shutdown:
-
-1. Click **☰ > Cluster Management**.
-1. From the left navigation, select **RKE1 Configuration > Node Templates**.
-1. Find the VMware vSphere node template you want to edit. Click **⋮** at the end of the row associated with the template. Select **Edit**.
-1. Under **2. Scheduling**, in the **Graceful Shutdown Timeout** field, enter an integer value greater than 0. The value you enter is the amount of time in seconds Rancher waits before deleting VMs on the cluster. If the value is set to `0`, graceful shutdown is disabled.
-1. Click **Save**.
@@ -15,33 +15,9 @@ Rancher can provision nodes in vSphere and install Kubernetes on them. When crea

 A vSphere cluster may consist of multiple groups of VMs with distinct properties, such as the amount of memory or the number of vCPUs. This grouping allows for fine-grained control over the sizing of nodes for each Kubernetes role.

-## VMware vSphere Enhancements
-
-The vSphere node templates allow you to bring cloud operations on-premises with the following enhancements:
-
-### Self-healing Node Pools
-
-One of the biggest advantages of provisioning vSphere nodes with Rancher is that it allows you to take advantage of Rancher's self-healing node pools, also called the [node auto-replace feature,](../use-new-nodes-in-an-infra-provider.md#about-node-auto-replace) in your on-premises clusters. Self-healing node pools are designed to help you replace worker nodes for stateless applications. When Rancher provisions nodes from a node template, Rancher can automatically replace unreachable nodes.
-
-:::caution
-
-It is not recommended to enable node auto-replace on a node pool of master nodes or nodes with persistent volumes attached, because VMs are treated ephemerally. When a node in a node pool loses connectivity with the cluster, its persistent volumes are destroyed, resulting in data loss for stateful applications.
-
-:::
-
-### Dynamically Populated Options for Instances and Scheduling
-
-Node templates for vSphere have been updated so that when you create a node template with your vSphere credentials, the template is automatically populated with the same options for provisioning VMs that you have access to in the vSphere console.
-
-For the fields to be populated, your setup needs to fulfill the [prerequisites.](provision-kubernetes-clusters-in-vsphere.md#preparation-in-vmware-vsphere)
-
-### More Supported Operating Systems
-
-You can provision VMs with any operating system that supports `cloud-init`. Only YAML format is supported for the [cloud config.](https://cloudinit.readthedocs.io/en/latest/topics/examples.html)
-
 ## Creating a VMware vSphere Cluster

-In [this section,](provision-kubernetes-clusters-in-vsphere.md) you'll learn how to use Rancher to install an [RKE](https://rancher.com/docs/rke/latest/en/) Kubernetes cluster in vSphere.
+In [this section,](provision-kubernetes-clusters-in-vsphere.md) you'll learn how to use Rancher to install an [RKE2](https://docs.rke2.io/)/[K3s](https://docs.k3s.io/) Kubernetes cluster in vSphere.

 ## Provisioning Storage

@@ -48,14 +48,13 @@ Rancher will discover and show resources created by `kubectl`. However, these re

 ## Authenticating Directly with a Downstream Cluster

-This section intended to help you set up an alternative method to access an [RKE cluster.](../../launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md)
+This section intended to help you set up an alternative method to access a [Rancher-launched cluster.](../../launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md)

-This method is only available for RKE, RKE2, and K3s clusters that have the [authorized cluster endpoint](../../../../reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md#4-authorized-cluster-endpoint) enabled. When Rancher creates the cluster, it generates a kubeconfig file that includes additional kubectl context(s) for accessing your cluster. This additional context allows you to use kubectl to authenticate with the downstream cluster without authenticating through Rancher. For a longer explanation of how the authorized cluster endpoint works, refer to [this page](authorized-cluster-endpoint.md).
+This method is only available RKE2 and K3s clusters that have the [authorized cluster endpoint](../../../../reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md#4-authorized-cluster-endpoint) enabled. When Rancher creates the cluster, it generates a kubeconfig file that includes additional kubectl context(s) for accessing your cluster. This additional context allows you to use kubectl to authenticate with the downstream cluster without authenticating through Rancher. For a longer explanation of how the authorized cluster endpoint works, refer to [this page](authorized-cluster-endpoint.md).

 On RKE2 and K3s clusters, you need to [manually enable](../../kubernetes-clusters-in-rancher-setup/register-existing-clusters.md#authorized-cluster-endpoint-support-for-rke2-and-k3s-clusters) authorized cluster endpoints.

-We recommend that as a best practice, you should set up this method to access your RKE, RKE2, and K3s clusters, so that just in case you can’t connect to Rancher, you can still access the cluster.
-
+We recommend that as a best practice, you should set up this method to access your RKE2 and K3s clusters, so that just in case you can’t connect to Rancher, you can still access the cluster.

 :::note Prerequisites:

@@ -74,7 +73,7 @@ CURRENT   NAME                        CLUSTER                     AUTHINFO     N

 In this example, when you use `kubectl` with the first context, `my-cluster`, you will be authenticated through the Rancher server.

-With the second context, `my-cluster-controlplane-1`, you would authenticate with the authorized cluster endpoint, communicating with an downstream RKE cluster directly.
+With the second context, `my-cluster-controlplane-1`, you would authenticate with the authorized cluster endpoint, communicating with an downstream RKE/K3s cluster directly.

 We recommend using a load balancer with the authorized cluster endpoint. For details, refer to the [recommended architecture section.](../../../../reference-guides/rancher-manager-architecture/architecture-recommendations.md#architecture-for-an-authorized-cluster-endpoint-ace)

@@ -123,65 +123,6 @@ Install [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/).
 ## Cleaning up Nodes

 <Tabs groupId="k8s-distro" queryString>
-<TabItem value="RKE1">
-
-Before you run the following commands, first remove the node through the Rancher UI.
-
-To remove a node:
-
-1. Click **☰** and select **Cluster Management**.
-1. In the table of clusters, click the name of the cluster the node belongs to.
-1. In the first tab, click the checkbox next to the node's state.
-1. Click **Delete**.
-
-If you remove the entire cluster instead of an individual node, or skip rermoving the node through the Rancher UI, follow these steps:
-
-1. [Remove](#docker-containers-images-and-volumes) the Docker containers from the node and [unmount](#mounts) any volumes.
-1. Reboot the node.
-1. [Remove](#directories-and-files) any remaining files.
-1. Confirm that network interfaces and IP tables were properly cleaned after the reboot. If not, reboot one more time.
-
-### Windows Nodes
-
-To clean up a Windows node, run the script in `c:\etc\rancher`. This script deletes Kubernetes-generated resources and the execution binary. It also drops the firewall rules and network settings:
-
-```
-pushd c:\etc\rancher
-.\cleanup.ps1
-popd
-```
-
-After you run this script, the node is reset and can be re-added to a Kubernetes cluster.
-
-### Docker Containers, Images, and Volumes
-
-:::caution
-
-Be careful when cleaning up Docker containers. The following command will remove *all* Docker containers, images, and volumes on the node, including non-Rancher related containers:
-
-:::
-
-```
-docker rm -f $(docker ps -qa)
-docker rmi -f $(docker images -q)
-docker volume rm $(docker volume ls -q)
-```
-
-### Mounts
-
-Kubernetes components and secrets leave behind the following mounts:
-
-* `/var/lib/kubelet`
-* `/var/lib/rancher`
-* Miscellaneous mounts in `/var/lib/kubelet/pods/`
-
-To unmount all mounts, run: 
-
-```
-for mount in $(mount | grep tmpfs | grep '/var/lib/kubelet' | awk '{ print $3 }') /var/lib/kubelet /var/lib/rancher; do umount $mount; done
-```
-
-</TabItem>
 <TabItem value="RKE2">

 :::note
@@ -248,54 +189,7 @@ Depending on the role you assigned to the node, certain directories may or may n

 :::

-<Tabs>
-<TabItem value="RKE1">
-
-| Directories                  |
-|------------------------------|
-| `/etc/ceph`                  |
-| `/etc/cni`                   |
-| `/etc/kubernetes`            |
-| `/opt/cni`                   |
-| `/opt/rke`                   |
-| `/run/calico`                |
-| `/run/flannel`               |
-| `/run/secrets/kubernetes.io` |
-| `/var/lib/calico`            |
-| `/var/lib/cni`               |
-| `/var/lib/etcd`              |
-| `/var/lib/kubelet`           |
-| `/var/lib/rancher/rke`       |
-| `/var/lib/weave`             |
-| `/var/log/containers`        |
-| `/var/log/kube-audit`        |
-| `/var/log/pods`              |
-| `/var/run/calico`            |
-
-**To clean the directories:**
-
-```shell
-rm -rf /etc/ceph \
-       /etc/cni \
-       /etc/kubernetes \
-       /opt/cni \
-       /opt/rke \
-       /run/calico \
-       /run/flannel \
-       /run/secrets/kubernetes.io \
-       /var/lib/calico \
-       /var/lib/cni \
-       /var/lib/etcd \
-       /var/lib/kubelet \
-       /var/lib/rancher/rke \
-       /var/lib/weave \
-       /var/log/containers \
-       /var/log/kube-audit \
-       /var/log/pods \
-       /var/run/calico
-```
-
-</TabItem>
+<Tabs groupId="k8s-distro" queryString>
 <TabItem value="RKE2">

 | Directories                  |
@@ -16,20 +16,6 @@ By default, Kubernetes clusters require certificates and Rancher launched Kubern

 Certificates can be rotated for the following services:

-<Tabs>
-<TabItem value="RKE">
-
- etcd
- kubelet (node certificate)
- kubelet (serving certificate, if [enabled](https://rancher.com/docs/rke/latest/en/config-options/services/#kubelet-options))
- kube-apiserver
- kube-proxy
- kube-scheduler
- kube-controller-manager
-
-</TabItem>
-<TabItem value="RKE2">
-
 - admin
 - api-server
 - controller-manager
@@ -42,9 +28,6 @@ Certificates can be rotated for the following services:
 - kubelet
 - kube-proxy

-</TabItem>
-</Tabs>
-
 :::note

 For users who didn't rotate their webhook certificates, and they have expired after one year, please see this [page](../../../troubleshooting/other-troubleshooting-tips/expired-webhook-certificate-rotation.md) for help.
@@ -68,15 +51,4 @@ Rancher launched Kubernetes clusters have the ability to rotate the auto-generat

 ### Additional Notes

-<Tabs>
-<TabItem value="RKE">
-
-Even though the RKE CLI can use custom certificates for the Kubernetes cluster components, Rancher currently doesn't allow the ability to upload these in Rancher launched Kubernetes clusters.
-
-</TabItem>
-<TabItem value="RKE2">
-
-In RKE2, both etcd and control plane nodes are treated as the same `server` concept. As such, when rotating certificates of services specific to either of these components will result in certificates being rotated on both. The certificates will only change for the specified service, but you will see nodes for both components go into an updating state. You may also see worker only nodes go into an updating state. This is to restart the workers after a certificate change to ensure they get the latest client certs.
-
-</TabItem>
-</Tabs>
+In RKE2/K3s, both etcd and control plane nodes are treated as the same `server` concept. As such, when rotating certificates of services specific to either of these components will result in certificates being rotated on both. The certificates will only change for the specified service, but you will see nodes for both components go into an updating state. You may also see worker only nodes go into an updating state. This is to restart the workers after a certificate change to ensure they get the latest client certs.
@@ -6,39 +6,11 @@ title: Encryption Key Rotation
  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/manage-clusters/rotate-encryption-key"/>
 </head>

-### RKE1 Encryption Key Rotation
+:::note Important

-1. Enable encryption key rotation with either of the following two options:
+Encryption key rotation is enabled by default and cannot be disabled.

-    - Select the `Enabled` radio button in the Rancher UI under **Cluster Options > Advanced Options > Secrets Encryption**:
-
-    ![Enable Encryption Key Rotation](/img/rke1-enable-secrets-encryption.png)
-
-    - OR, apply the following YAML:
-
-    ```yaml
-    rancher_kubernetes_engine_config:
-      services:
-        kube_api:
-          secrets_encryption_config:
-            enabled: true
-    ```
-
-2. Rotate keys in the Rancher UI:
-
-    2.1. Click **☰ > Cluster Management**.
-
-    2.2. Select **⋮ > Rotate Encryption Keys** on the far right of the screen next to your chosen cluster:
-
-    ![Encryption Key Rotation](/img/rke1-encryption-key.png)
-
-
-
-### RKE2 Encryption Key Rotation
-
-_**New in v2.6.7**_
-
->**Important:** Encryption key rotation is enabled by default and cannot be disabled.
+:::

 To rotate keys in the Rancher UI:

@@ -48,5 +20,4 @@ To rotate keys in the Rancher UI:

    ![Encryption Key Rotation](/img/rke2-encryption-key.png)

-
->**Note:** For more information on RKE2 secrets encryption config, please see the [RKE2 docs](https://docs.rke2.io/security/secrets_encryption).
+>**Note:** For more information on RKE2 secrets encryption config, please see the [RKE2 docs](https://docs.rke2.io/security/secrets_encryption).
@@ -1,52 +0,0 @@
---
-title: Roles-based Access Control
---
-
-<head>
-  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/integrations-in-rancher/cis-scans/rbac-for-cis-scans"/>
-</head>
-
-This section describes the permissions required to use the rancher-cis-benchmark App.
-
-The rancher-cis-benchmark is a cluster-admin only feature by default.
-
-However, the `rancher-cis-benchmark` chart installs these two default `ClusterRoles`:
-
- cis-admin
- cis-view
-
-In Rancher, only cluster owners and global administrators have `cis-admin` access by default.
-
-Note: If you were using the `cis-edit` role added in Rancher v2.5 setup, it has now been removed since
-Rancher v2.5.2 because it essentially is same as `cis-admin`. If you happen to create any clusterrolebindings
-for `cis-edit`, please update them to use `cis-admin` ClusterRole instead.
-
-## Cluster-Admin Access
-
-Rancher CIS Scans is a cluster-admin only feature by default.
-This means only the Rancher global admins, and the cluster’s cluster-owner can:
-
- Install/Uninstall the rancher-cis-benchmark App
- See the navigation links for CIS Benchmark CRDs - ClusterScanBenchmarks, ClusterScanProfiles, ClusterScans
- List the default ClusterScanBenchmarks and ClusterScanProfiles
- Create/Edit/Delete new ClusterScanProfiles
- Create/Edit/Delete a new ClusterScan to run the CIS scan on the cluster
- View and Download the ClusterScanReport created after the ClusterScan is complete
-
-
-## Summary of Default Permissions for Kubernetes Default Roles
-
-The rancher-cis-benchmark creates three `ClusterRoles` and adds the CIS Benchmark CRD access to the following default K8s `ClusterRoles`:
-
-| ClusterRole created by chart | Default K8s ClusterRole  | Permissions given with Role
-| ------------------------------| ---------------------------| ---------------------------|
-| `cis-admin` | `admin`| Ability to CRUD clusterscanbenchmarks, clusterscanprofiles, clusterscans, clusterscanreports CR
-| `cis-view` | `view `| Ability to List(R) clusterscanbenchmarks, clusterscanprofiles, clusterscans, clusterscanreports CR
-
-
-By default only cluster-owner role will have ability to manage and use `rancher-cis-benchmark` feature.
-
-The other Rancher roles (cluster-member, project-owner, project-member) do not have any default permissions to manage and use rancher-cis-benchmark resources.
-
-But if a cluster-owner wants to delegate access to other users, they can do so by creating ClusterRoleBindings between these users and the above CIS ClusterRoles manually.
-There is no automatic role aggregation supported for the `rancher-cis-benchmark` ClusterRoles.
@@ -1,57 +0,0 @@
---
-title: Skipped and Not Applicable Tests
---
-
-<head>
-  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/integrations-in-rancher/cis-scans/skipped-and-not-applicable-tests"/>
-</head>
-
-This section lists the tests that are skipped in the permissive test profile for RKE.
-
-> All the tests that are skipped and not applicable on this page will be counted as Not Applicable in the v2.5 generated report. The skipped test count will only mention the user-defined skipped tests. This allows user-skipped tests to be distinguished from the tests that are skipped by default in the RKE permissive test profile.
-
-## CIS Benchmark v1.5
-
-### CIS Benchmark v1.5 Skipped Tests
-
-| Number | Description | Reason for Skipping |
-| ---------- | ------------- | --------- |
-| 1.1.12 |  Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) |  A system service account is required for etcd data directory ownership. Refer to Rancher's hardening guide for more details on how to configure this ownership.     |
-| 1.2.6 | Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)  |  When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers.  |
-| 1.2.16 | Ensure that the admission control plugin PodSecurityPolicy is set (Automated) |  Enabling Pod Security Policy can cause applications to unexpectedly fail.     |
-| 1.2.33 | Ensure that the --encryption-provider-config argument is set as appropriate (Manual)  |  Enabling encryption changes how data can be recovered as data is encrypted.     |
-| 1.2.34 | Ensure that encryption providers are appropriately configured (Manual) |  Enabling encryption changes how data can be recovered as data is encrypted.     |
-| 4.2.6 | Ensure that the --protect-kernel-defaults argument is set to true (Automated) |  System level configurations are required before provisioning the cluster in order for this argument to be set to true.     |
-| 4.2.10 |  Ensure that the--tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) |  When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers.     |
-| 5.1.5 |  Ensure that default service accounts are not actively used. (Automated)  |  Kubernetes provides default service accounts to be used.     |
-| 5.2.2 | Minimize the admission of containers wishing to share the host process ID namespace (Automated) |  Enabling Pod Security Policy can cause applications to unexpectedly fail.     |
-| 5.2.3 |  Minimize the admission of containers wishing to share the host IPC namespace (Automated) |  Enabling Pod Security Policy can cause applications to unexpectedly fail.     |
-| 5.2.4 |  Minimize the admission of containers wishing to share the host network namespace (Automated) |  Enabling Pod Security Policy can cause applications to unexpectedly fail.     |
-| 5.2.5 |   Minimize the admission of containers with allowPrivilegeEscalation (Automated)  |  Enabling Pod Security Policy can cause applications to unexpectedly fail.     |
-| 5.3.2 | Ensure that all Namespaces have Network Policies defined (Automated) |  Enabling Network Policies can prevent certain applications from communicating with each other.     |
-| 5.6.4 | The default namespace should not be used (Automated)  |  Kubernetes provides a default namespace.     |
-
-### CIS Benchmark v1.5 Not Applicable Tests
-
-| Number | Description | Reason for being not applicable |
-| ---------- | ------------- | --------- |
-| 1.1.1 | Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated)  |  Clusters provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. All configuration is passed in as arguments at container run time.     |
-| 1.1.2 |  Ensure that the API server pod specification file ownership is set to root:root (Automated) |  Clusters provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. All configuration is passed in as arguments at container run time.     |
-| 1.1.3 |  Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Automated) |  Clusters provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time.     |
-| 1.1.4 |  Ensure that the controller manager pod specification file ownership is set to root:root (Automated) |  Clusters provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time.     |
-| 1.1.5 |  Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Automated) |  Clusters provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time.     |
-| 1.1.6 |  Ensure that the scheduler pod specification file ownership is set to root:root (Automated) |  Clusters provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time.     |
-| 1.1.7 |  Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated)  |  Clusters provisioned by RKE doesn't require or maintain a configuration file for etcd. All configuration is passed in as arguments at container run time.     |
-| 1.1.8 |  Ensure that the etcd pod specification file ownership is set to root:root (Automated)  |  Clusters provisioned by RKE doesn't require or maintain a configuration file for etcd. All configuration is passed in as arguments at container run time.     |
-| 1.1.13 |  Ensure that the admin.conf file permissions are set to 644 or more restrictive (Automated) |  Clusters provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes.     |
-| 1.1.14 | Ensure that the admin.conf file ownership is set to root:root (Automated)  |  Clusters provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes.     |
-| 1.1.15 | Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Automated)  |  Clusters provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time.  |
-| 1.1.16 |  Ensure that the scheduler.conf file ownership is set to root:root (Automated) |  Clusters provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time.     |
-| 1.1.17 | Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Automated) |  Clusters provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time.     |
-| 1.1.18 | Ensure that the controller-manager.conf file ownership is set to root:root (Automated) |  Clusters provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time.     |
-| 1.3.6 | Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)  |  Clusters provisioned by RKE handles certificate rotation directly through RKE.     |
-| 4.1.1 |  Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated) |  Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time.     |
-| 4.1.2 | Ensure that the kubelet service file ownership is set to root:root (Automated) |  Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time.     |
-| 4.1.9 | Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Automated) |  Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. All configuration is passed in as arguments at container run time.     |
-| 4.1.10 |  Ensure that the kubelet configuration file ownership is set to root:root (Automated) |  Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. All configuration is passed in as arguments at container run time.     |
-| 4.2.12 |  Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) |  Clusters provisioned by RKE handles certificate rotation directly through RKE.     |
@@ -19,10 +19,7 @@ In order to deploy and run the adapter successfully, you need to ensure its vers

 | Rancher Version | Adapter Version  |
 |-----------------|------------------|
-| v2.11.3         | v106.0.0+up6.0.0 |
-| v2.11.2         | v106.0.0+up6.0.0 |
-| v2.11.1         | v106.0.0+up6.0.0 |
-| v2.11.0         | v106.0.0+up6.0.0 |
+| v2.12.0         |  107.0.0+up7.0.0 |

 ### 1. Gain Access to the Local Cluster

@@ -1,14 +1,14 @@
 ---
-title: CIS Scans
+title: Compliance Scans
 ---

 <head>
-  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/integrations-in-rancher/cis-scans"/>
+  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/integrations-in-rancher/compliance-scans"/>
 </head>

-Rancher can run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark. The CIS scans can run on any Kubernetes cluster, including hosted Kubernetes providers such as EKS, AKS, and GKE.
+Rancher can run a security scan to check whether a cluster is deployed according to security best practices as defined in Kubernetes security benchmarks, such as the ones provided by STIG, BSI or CIS. The Compliance scans can run on any Kubernetes cluster, including hosted Kubernetes providers such as EKS, AKS, and GKE.

-The `rancher-cis-benchmark` app leverages <a href="https://github.com/aquasecurity/kube-bench" target="_blank">kube-bench,</a> an open-source tool from Aqua Security, to check clusters for CIS Kubernetes Benchmark compliance. Also, to generate a cluster-wide report, the application utilizes <a href="https://github.com/vmware-tanzu/sonobuoy" target="_blank">Sonobuoy</a> for report aggregation.
+The `rancher-compliance` app leverages <a href="https://github.com/aquasecurity/kube-bench" target="_blank">kube-bench,</a> an open-source tool from Aqua Security, to check the compliance of clusters against Kubernetes Benchmarks. Also, to generate a cluster-wide report, the application utilizes <a href="https://github.com/vmware-tanzu/sonobuoy" target="_blank">Sonobuoy</a> for report aggregation.


 ## About the CIS Benchmark
@@ -94,24 +94,22 @@ In order to pass the "Hardened" profile, you will need to follow the steps on th

 The default profile and the supported CIS benchmark version depends on the type of cluster that will be scanned:

-The `rancher-cis-benchmark` supports the CIS 1.6 Benchmark version.
+The `rancher-compliance` supports the CIS 1.9 Benchmark version.

- For RKE Kubernetes clusters, the RKE Permissive 1.6 profile is the default.
+- For RKE Kubernetes clusters, the RKE Permissive 1.9 profile is the default.
 - EKS and GKE have their own CIS Benchmarks published by `kube-bench`. The corresponding test profiles are used by default for those clusters.
- For RKE2 Kubernetes clusters, the RKE2 Permissive 1.6 profile is the default.
+- For RKE2 Kubernetes clusters, the RKE2 Permissive 1.9 profile is the default.
 - For cluster types other than RKE, RKE2, EKS and GKE, the Generic CIS 1.5 profile will be used by default.

 ## About Skipped and Not Applicable Tests

-For a list of skipped and not applicable tests, refer to [this page](../../how-to-guides/advanced-user-guides/cis-scan-guides/skip-tests.md).
-
 For now, only user-defined skipped tests are marked as skipped in the generated report.

 Any skipped tests that are defined as being skipped by one of the default profiles are marked as not applicable.

 ## Roles-based Access Control

-For information about permissions, refer to [this page](rbac-for-cis-scans.md)
+For information about permissions, refer to [this page](rbac-for-compliance-scans.md)

 ## Configuration

@@ -119,4 +117,4 @@ For more information about configuring the custom resources for the scans, profi

 ## How-to Guides

-Please refer to the [CIS Scan Guides](../../how-to-guides/advanced-user-guides/cis-scan-guides/cis-scan-guides.md) to learn how to run CIS scans.
+Please refer to the [Compliance Scan Guides](../../how-to-guides/advanced-user-guides/compliance-scan-guides/compliance-scan-guides.md) to learn how to run Compliance scans.
@@ -3,27 +3,27 @@ title: Configuration
 ---

 <head>
-  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/integrations-in-rancher/cis-scans/configuration-reference"/>
+  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/integrations-in-rancher/compliance-scans/configuration-reference"/>
 </head>

-This configuration reference is intended to help you manage the custom resources created by the `rancher-cis-benchmark` application. These resources are used for performing CIS scans on a cluster, skipping tests, setting the test profile that will be used during a scan, and other customization.
+This configuration reference is intended to help you manage the custom resources created by the `rancher-compliance` application. These resources are used for performing compliance scans on a cluster, skipping tests, setting the test profile that will be used during a scan, and other customization.

-To configure the custom resources, go to the **Cluster Dashboard** To configure the CIS scans,
+To configure the custom resources, go to the **Cluster Dashboard** To configure the compliance scans,

 1. In the upper left corner, click **☰ > Cluster Management**.
-1. On the **Clusters** page, go to the cluster where you want to configure CIS scans and click **Explore**.
-1. In the left navigation bar, click **CIS Benchmark**.
+1. On the **Clusters** page, go to the cluster where you want to configure compliance scans and click **Explore**.
+1. In the left navigation bar, click **Compliance**.

 ## Scans

-A scan is created to trigger a CIS scan on the cluster based on the defined profile. A report is created after the scan is completed.
+A scan is created to trigger a compliance scan on the cluster based on the defined profile. A report is created after the scan is completed.

 When configuring a scan, you need to define the name of the scan profile that will be used with the `scanProfileName` directive.

 An example ClusterScan custom resource is below:

 ```yaml
-apiVersion: cis.cattle.io/v1
+apiVersion: compliance.cattle.io/v1
 kind: ClusterScan
 metadata:
  name: rke-cis
@@ -33,11 +33,11 @@ spec:

 ## Profiles

-A profile contains the configuration for the CIS scan, which includes the benchmark version to use and any specific tests to skip in that benchmark.
+A profile contains the configuration for the compliance scan, which includes the benchmark version to use and any specific tests to skip in that benchmark.

 :::caution

-By default, a few ClusterScanProfiles are installed as part of the `rancher-cis-benchmark` chart. If a user edits these default benchmarks or profiles, the next chart update will reset them back. So it is advisable for users to not edit the default  ClusterScanProfiles.
+By default, a few ClusterScanProfiles are installed as part of the `rancher-compliance` chart. If a user edits these default benchmarks or profiles, the next chart update will reset them back. So it is advisable for users to not edit the default  ClusterScanProfiles.

 :::

@@ -50,12 +50,12 @@ When you create a new profile, you will also need to give it a name.
 An example `ClusterScanProfile` is below:

 ```yaml
-apiVersion: cis.cattle.io/v1
+apiVersion: compliance.cattle.io/v1
 kind: ClusterScanProfile
 metadata:
  annotations:
    meta.helm.sh/release-name: clusterscan-operator
-    meta.helm.sh/release-namespace: cis-operator-system
+    meta.helm.sh/release-namespace: compliance-operator-system
  labels:
    app.kubernetes.io/managed-by: Helm
  name: "<example-profile>"
@@ -70,9 +70,9 @@ spec:

 A benchmark version is the name of benchmark to run using `kube-bench`, as well as the valid configuration parameters for that benchmark.

-A `ClusterScanBenchmark` defines the CIS `BenchmarkVersion` name and test configurations. The `BenchmarkVersion` name is a parameter provided to the `kube-bench` tool.
+A `ClusterScanBenchmark` defines the Compliance `BenchmarkVersion` name and test configurations. The `BenchmarkVersion` name is a parameter provided to the `kube-bench` tool.

-By default, a few `BenchmarkVersion` names and test configurations are packaged as part of the CIS scan application. When this feature is enabled, these default BenchmarkVersions will be automatically installed and available for users to create a ClusterScanProfile.
+By default, a few `BenchmarkVersion` names and test configurations are packaged as part of the Compliance scan application. When this feature is enabled, these default BenchmarkVersions will be automatically installed and available for users to create a ClusterScanProfile.

 :::caution

@@ -89,12 +89,12 @@ A ClusterScanBenchmark consists of the fields:
 An example `ClusterScanBenchmark` is below:

 ```yaml
-apiVersion: cis.cattle.io/v1
+apiVersion: compliance.cattle.io/v1
 kind: ClusterScanBenchmark
 metadata:
  annotations:
    meta.helm.sh/release-name: clusterscan-operator
-    meta.helm.sh/release-namespace: cis-operator-system
+    meta.helm.sh/release-namespace: compliance-operator-system
  creationTimestamp: "2020-08-28T18:18:07Z"
  generation: 1
  labels:
@@ -106,4 +106,4 @@ metadata:
 spec:
  clusterProvider: ""
  minKubernetesVersion: 1.15.0
-```
+```
@@ -3,19 +3,20 @@ title: Creating a Custom Benchmark Version for Running a Cluster Scan
 ---

 <head>
-  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/integrations-in-rancher/cis-scans/custom-benchmark"/>
+  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/integrations-in-rancher/compliance-scans/custom-benchmark"/>
 </head>

-Each Benchmark Version defines a set of test configuration files that define the CIS tests to be run by the <a href="https://github.com/aquasecurity/kube-bench" target="_blank">kube-bench</a> tool.
-The `rancher-cis-benchmark` application installs a few default Benchmark Versions which are listed under CIS Benchmark application menu.
+Each Benchmark Version defines a set of test configuration files that define the Compliance tests to be run by the <a href="https://github.com/aquasecurity/kube-bench" target="_blank">kube-bench</a> tool.
+The `rancher-compliance` application installs a few default Benchmark Versions which are listed under Compliance application menu.

-But there could be some Kubernetes cluster setups that require custom configurations of the Benchmark tests. For example, the path to the Kubernetes config files or certs might be different than the standard location where the upstream CIS Benchmarks look for them.

-It is now possible to create a custom Benchmark Version for running a cluster scan using the `rancher-cis-benchmark` application.
+But in the following cases, a custom configuration or remediation may be required:

-When a cluster scan is run, you need to select a Profile which points to a specific Benchmark Version.
+- Non-standard file locations: When Kubernetes binaries, configuration or certificate paths deviate from upstream benchmark defaults.
+Example: Unlike traditional Kubernetes, K3s bundles control plane components into a single binary. Therefore,` --anonymous-auth` flag presence and configuration should be verified in K3s' logs (`journalctl`), not via `kube-apiserver` process checks (`ps`).

-Follow all the steps below to add a custom Benchmark Version and run a scan using it.
+- Alternative risk mitigations: If a setup doesn't meet a check but has an equally effective compensating control with justification. Or simply is not concerned by the check requirement because of its design.
+Example: By default, K3s embeds the api server within the k3s process. There is no API server pod specification file, so verifying the latter's file permissions is not required.

 ## 1. Prepare the Custom Benchmark Version ConfigMap

@@ -46,7 +47,7 @@ To prepare a custom benchmark version ConfigMap, suppose we want to add a custom

 1. In the upper left corner, click **☰ > Cluster Management**.
 1. On the **Clusters** page, go to the cluster where you want to add a custom benchmark and click **Explore**.
-1. In the left navigation bar, click **CIS Benchmark > Benchmark Version**.
+1. In the left navigation bar, click **Compliance > Benchmark Version**.
 1. Click **Create**.
 1. Enter the **Name** and a description for your custom benchmark version.
 1. Choose the cluster provider that your benchmark version applies to.
@@ -60,7 +61,7 @@ To run a scan using your custom benchmark version, you need to add a new Profile

 1. In the upper left corner, click **☰ > Cluster Management**.
 1. On the **Clusters** page, go to the cluster where you want to add a custom benchmark and click **Explore**.
-1. In the left navigation bar, click **CIS Benchmark > Profile**.
+1. In the left navigation bar, click **Compliance > Profile**.
 1. Click **Create**.
 1. Provide a **Name** and description. In this example, we name it `foo-profile`.
 1. Choose the Benchmark Version from the dropdown.
@@ -74,7 +75,7 @@ To run a scan,

 1. In the upper left corner, click **☰ > Cluster Management**.
 1. On the **Clusters** page, go to the cluster where you want to add a custom benchmark and click **Explore**.
-1. In the left navigation bar, click **CIS Benchmark > Scan**.
+1. In the left navigation bar, click **Compliance > Scan**.
 1. Click **Create**.
 1. Choose the new cluster scan profile.
 1. Click **Create**.
@@ -0,0 +1,48 @@
+---
+title: Roles-based Access Control
+---
+
+<head>
+  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/integrations-in-rancher/compliance-scans/rbac-for-compliance-scans"/>
+</head>
+
+This section describes the permissions required to use the rancher-compliance App.
+
+The rancher-compliance is a cluster-admin only feature by default.
+
+However, the `rancher-compliance` chart installs these two default `ClusterRoles`:
+
+- compliance-admin
+- compliance-view
+
+In Rancher, only cluster owners and global administrators have `compliance-admin` access by default.
+
+## Cluster-Admin Access
+
+Rancher Compliance Scans is a cluster-admin only feature by default.
+This means only the Rancher global admins, and the cluster’s cluster-owner can:
+
+- Install/Uninstall the rancher-compliance App
+- See the navigation links for Compliance CRDs - ClusterScanBenchmarks, ClusterScanProfiles, ClusterScans
+- List the default ClusterScanBenchmarks and ClusterScanProfiles
+- Create/Edit/Delete new ClusterScanProfiles
+- Create/Edit/Delete a new ClusterScan to run the Compliance scan on the cluster
+- View and Download the ClusterScanReport created after the ClusterScan is complete
+
+
+## Summary of Default Permissions for Kubernetes Default Roles
+
+The rancher-compliance creates three `ClusterRoles` and adds the Compliance CRD access to the following default K8s `ClusterRoles`:
+
+| ClusterRole created by chart | Default K8s ClusterRole  | Permissions given with Role
+| ------------------------------| ---------------------------| ---------------------------|
+| `compliance-admin` | `admin`| Ability to CRUD clusterscanbenchmarks, clusterscanprofiles, clusterscans, clusterscanreports CR
+| `compliance-view` | `view `| Ability to List(R) clusterscanbenchmarks, clusterscanprofiles, clusterscans, clusterscanreports CR
+
+
+By default only cluster-owner role will have ability to manage and use `rancher-compliance` feature.
+
+The other Rancher roles (cluster-member, project-owner, project-member) do not have any default permissions to manage and use rancher-compliance resources.
+
+But if a cluster-owner wants to delegate access to other users, they can do so by creating ClusterRoleBindings between these users and the above Compliance ClusterRoles manually.
+There is no automatic role aggregation supported for the `rancher-compliance` ClusterRoles.
@@ -24,7 +24,7 @@ To navigate to the Harvester cluster, click **☰ > Virtualization Management**.

 ## Harvester Node Driver

-The [Harvester node driver](https://docs.harvesterhci.io/v1.1/rancher/node/node-driver/) is generally available for RKE and RKE2 options in Rancher. The node driver is available whether or not the Harvester feature flag is enabled. Note that the node driver is off by default. Users may create RKE or RKE2 clusters on Harvester only from the Cluster Management page.
+The [Harvester node driver](https://docs.harvesterhci.io/v1.5/rancher/node/node-driver/) is generally available for K3s and RKE2 options in Rancher. The node driver is available whether or not the Harvester feature flag is enabled. Note that the node driver is off by default. Users may create K3s or RKE2 clusters on Harvester only from the Cluster Management page.

 Harvester allows `.ISO` images to be uploaded and displayed through the Harvester UI, but this is not supported in the Rancher UI. This is because `.ISO` images usually require additional setup that interferes with a clean deployment (without requiring user intervention), and they are not typically used in cloud environments.

@@ -32,11 +32,11 @@ See [Provisioning Drivers](../../how-to-guides/new-user-guides/authentication-pe

 ## Port Requirements

-The port requirements for the Harvester cluster can be found [here](https://docs.harvesterhci.io/v1.1/install/requirements#networking).
+The port requirements for the Harvester cluster can be found [here](https://docs.harvesterhci.io/v1.5/install/requirements#networking).

 In addition, other networking considerations are as follows:

 - Be sure to enable VLAN trunk ports of the physical switch for VM VLAN networks.
- Follow the networking setup guidance [here](https://docs.harvesterhci.io/v1.1/networking/index).
+- Follow the networking setup guidance [here](https://docs.harvesterhci.io/v1.5/networking/index).

-For other port requirements for other guest clusters, such as K3s and RKE1, please see [these docs](https://docs.harvesterhci.io/v1.1/install/requirements/#guest-clusters).
+For other port requirements for other guest clusters, such as K3s and RKE2, please see [these docs](https://docs.harvesterhci.io/v1.5/install/requirements/#guest-clusters).
@@ -33,12 +33,6 @@ While you can create your own ResourceSets to back up custom applications, two R

 `rancher-resource-set-full` includes all essential secrets in the backup files to ensure Rancher continues running smoothly after a restore or migration. To avoid storing sensitive information in plain text, we strongly advise you to enable encryption with a strong key.

-:::note Important:
-
-`rancher-resource-set` is also included by default with the `rancher-backup` operator. However, this ResourceSet is deprecated and is only being kept for backwards compatibility reasons. `rancher-resource-set` will be removed in Rancher v2.12. Please update your Backup custom resources to use either `rancher-resource-set-full` or `rancher-resource-set-basic`.
-
-:::
-
 | YAML Directive Name | Description |
 | ---------------- | ---------------- |
 | `resourceSetName` |  Provide the name of the ResourceSet to define which resources will be included in this backup. |
@@ -16,4 +16,4 @@ While a managed cluster is disconnected from Rancher, management operations will

 - **Cleaning Up Disconnected Clusters**: Regularly remove clusters that will no longer reconnect to Rancher (e.g., clusters that have been decommissioned or destroyed). Keeping such clusters in the Rancher management system consumes unnecessary resources, which could impact Rancher's performance over time.

- **Certificate Rotation Considerations**: When designing processes that involve regularly shutting down clusters, whether connected to Rancher or not, take into account certificate rotation policies. For example, RKE/RKE2/K3s clusters may rotate certificates on startup if they exceeded their lifetime.
+- **Certificate Rotation Considerations**: When designing processes that involve regularly shutting down clusters, whether connected to Rancher or not, take into account certificate rotation policies. For example, RKE2/K3s clusters may rotate certificates on startup if they exceeded their lifetime.
@@ -30,9 +30,7 @@ Once you have created these _ClusterOutput_ objects, create a _ClusterFlow_ to c

 ### Kubernetes Components

-_ClusterFlows_ have the ability to collect logs from all containers on all hosts in the Kubernetes cluster. This works well in cases where those containers are part of a Kubernetes pod; however, RKE containers exist outside of the scope of Kubernetes.
-
-Currently the logs from RKE containers are collected, but are not able to easily be filtered. This is because those logs do not contain information as to the source container (e.g. `etcd` or `kube-apiserver`).
+_ClusterFlows_ have the ability to collect logs from all containers on all hosts in the Kubernetes cluster. This works well in cases where those containers are part of a Kubernetes pod.

 A future release of Rancher will include the source container name which will enable filtering of these component logs. Once that change is made, you will be able to customize a _ClusterFlow_ to retrieve **only** the Kubernetes component logs, and direct them to an appropriate output.

@@ -98,7 +98,7 @@ Monitoring the availability and performance of all your internal workloads is vi

 ## Security Monitoring

-In addition to monitoring workloads to detect performance, availability or scalability problems, the cluster and the workloads running into it should also be monitored for potential security problems. A good starting point is to frequently run and alert on [CIS Scans](../../../how-to-guides/advanced-user-guides/cis-scan-guides/cis-scan-guides.md) which check if the cluster is configured according to security best practices.
+In addition to monitoring workloads to detect performance, availability or scalability problems, the cluster and the workloads running into it should also be monitored for potential security problems. A good starting point is to frequently run and alert on [Compliance Scans](../../../how-to-guides/advanced-user-guides/compliance-scan-guides/compliance-scan-guides.md) which check if the cluster is configured according to security best practices.

 For the workloads, you can have a look at Kubernetes and Container security solutions like [NeuVector](https://www.suse.com/products/neuvector/), [Falco](https://falco.org/), [Aqua Kubernetes Security](https://www.aquasec.com/solutions/kubernetes-container-security/), [SysDig](https://sysdig.com/).

@@ -54,9 +54,6 @@ Consider the following recommendations based on your needs:
 ### Make sure nodes are configured correctly for Kubernetes
 It's important to follow K8s and etcd best practices when deploying your nodes, including disabling swap, double checking you have full network connectivity between all machines in the cluster, using unique hostnames, MAC addresses, and product_uuids for every node, checking that all correct ports are opened, and deploying with ssd backed etcd. More details can be found in the [kubernetes docs](https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#before-you-begin) and [etcd's performance op guide](https://etcd.io/docs/v3.5/op-guide/performance/).

-### When using RKE: Back up the Statefile
-RKE keeps record of the cluster state in a file called `cluster.rkestate`. This file is important for the recovery of a cluster and/or the continued maintenance of the cluster through RKE. Because this file contains certificate material, we strongly recommend encrypting this file before backing up. After each run of `rke up` you should backup the state file.
-
 ### Run All Nodes in the Cluster in the Same Datacenter
 For best performance, run all three of your nodes in the same geographic datacenter. If you are running nodes in the cloud, such as AWS, run each node in a separate Availability Zone. For example, launch node 1 in us-west-2a, node 2 in us-west-2b, and node 3 in us-west-2c.

@@ -66,7 +66,7 @@ You should remove any remaining legacy apps that appear in the Cluster Manager U

 ### Using the Authorized Cluster Endpoint (ACE)

-An [Authorized Cluster Endpoint](../../../reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md#4-authorized-cluster-endpoint) (ACE) provides access to the Kubernetes API of Rancher-provisioned RKE, RKE2, and K3s clusters. When enabled, the ACE adds a context to kubeconfig files generated for the cluster. The context uses a direct endpoint to the cluster, thereby bypassing Rancher. This reduces load on Rancher for cases where unmediated API access is acceptable or preferable. See [Authorized Cluster Endpoint](../../../reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md#4-authorized-cluster-endpoint) for more information and configuration instructions.
+An [Authorized Cluster Endpoint](../../../reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md#4-authorized-cluster-endpoint) (ACE) provides access to the Kubernetes API of Rancher-provisioned RKE2 and K3s clusters. When enabled, the ACE adds a context to kubeconfig files generated for the cluster. The context uses a direct endpoint to the cluster, thereby bypassing Rancher. This reduces load on Rancher for cases where unmediated API access is acceptable or preferable. See [Authorized Cluster Endpoint](../../../reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md#4-authorized-cluster-endpoint) for more information and configuration instructions.

 ### Reducing Event Handler Executions

@@ -14,7 +14,6 @@ For information on editing cluster membership, go to [this page.](../../how-to-g

 The cluster configuration options depend on the type of Kubernetes cluster:

- [RKE Cluster Configuration](rancher-server-configuration/rke1-cluster-configuration.md)
 - [RKE2 Cluster Configuration](rancher-server-configuration/rke2-cluster-configuration.md)
 - [K3s Cluster Configuration](rancher-server-configuration/k3s-cluster-configuration.md)
 - [EKS Cluster Configuration](rancher-server-configuration/eks-cluster-configuration.md)
@@ -6,4 +6,4 @@ title: Downstream Cluster Configuration
  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/reference-guides/cluster-configuration/downstream-cluster-configuration"/>
 </head>

-The following docs will discuss [node template configuration](node-template-configuration/node-template-configuration.md) and [machine configuration](machine-configuration/machine-configuration.md).
+The following docs will discuss [machine configuration](machine-configuration/machine-configuration.md).
@@ -0,0 +1,87 @@
+---
+title: GCE Machine Configuration
+---
+
+<head>
+  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/google-gce"/>
+</head>
+
+
+For more information about Google Cloud Platform (GCP) and the Google Compute Engine (GCE), refer to the official [GCP documentation](https://cloud.google.com/docs).
+
+### Zone
+
+The GCP Region and Zone that the VM will be deployed to. For example, `us-east1-b`.
+
+### Machine Image Project
+
+The image project that the desired image families belong to.
+
+### Machine Image Family
+
+The image family that the desired machine operating system belongs to.
+
+### Machine Image
+
+The operating system that will be installed onto the VM.
+
+### Disk Type
+
+The type of the disk attached to the VM. The available types may differ between regions.
+
+### Disk Size
+
+The size of the disk attached to the VM, in Gigabytes.
+
+### Machine Type
+
+The type of VM that will be deployed. Machine types determine the number of resources (vCPU, RAM, etc.) allocated for each node.
+
+### Network
+
+The VPC network that the VM will be created in. This value cannot be changed once the machine pool has been provisioned.
+
+### Subnet
+
+The VPC subnetwork tha the VM will be created in. This value cannot be changed once the machine pool has been provisioned.
+
+### Username
+
+A custom username set as the default user of the GCE VM. 
+
+### External Address
+
+The desired external IP address for the GCE VM.
+
+### Scopes
+
+A list of OAuth2 scopes which allow the VM to access other GCP APIs.
+
+### Allow Internal Communication
+
+By default, a VPC firewall rule is automatically created to expose a fixed set of ports within the VPC to facilitate communication between cluster nodes. This behavior can be disabled on a per machine pool basis, when clicking the `Show Advanced` option and disabling the `Allow Internal Communication` checkbox. 
+
+### Expose External ports
+
+A list of ports to be opened _externally_ to the wider internet. Open ports are defined at the machine pool level. Enabling this option will result in the automatic creation of a VPC firewall rule. This rule will be automatically deleted when the cluster or machine pool is deleted.
+
+### Network Tags
+
+Tags is a list of _network tags_, which can be used to associate preexisting Firewall Rules with all VMs within a machine pool.
+
+### Labels
+
+A comma seperated list of custom labels to be attached to all VMs within a given machine pool. Unlike Tags, Labels do not influence networking behavior and only serve to organize cloud resources.
+
+## Advanced Options
+
+When creating clusters via the Rancher UI some options are automatically configured for you. However, when creating machine config objects manually, you must ensure you properly configure the below fields.
+
+### external-firewall-rule-prefix
+
+A prefix that will be used when creating the firewall rule to expose ports publicly. Ideally, this should be a concatenation the machine pool name and the cluster name. This field must be set if the machine pool is configured to expose ports publicly, otherwise it can be omitted.
+
+### internal-firewall-rule-prefix
+
+A prefix that will be used when creating the internal firewall rule which allows for communication between nodes within the cluster. If this field is omitted, no internal firewall rule will be created.
+
@@ -6,7 +6,6 @@ title: Rancher Server Configuration
  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/reference-guides/cluster-configuration/rancher-server-configuration"/>
 </head>

- [RKE1 Cluster Configuration](rke1-cluster-configuration.md)
 - [RKE2 Cluster Configuration](rke2-cluster-configuration.md)
 - [K3s Cluster Configuration](k3s-cluster-configuration.md)
 - [EKS Cluster Configuration](eks-cluster-configuration.md)
@@ -133,9 +133,9 @@ If the cloud provider you want to use is not listed as an option, you will need

 The default [pod security admission configuration template](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md) for the cluster.

-##### Worker CIS Profile
+##### Worker Compliance Profile

-Select a [CIS benchmark](../../../how-to-guides/advanced-user-guides/cis-scan-guides/cis-scan-guides.md) to validate the system configuration against.
+Select a [compliance benchmark](../../../how-to-guides/advanced-user-guides/compliance-scan-guides/compliance-scan-guides.md) to validate the system configuration against.

 ##### Project Network Isolation

@@ -10,13 +10,7 @@ This page explains concepts related to Kubernetes that are important for underst

 ## About Docker

-Docker is the container packaging and runtime standard. Developers build container images from Dockerfiles and distribute container images from Docker registries. [Docker Hub](https://hub.docker.com) is the most popular public registry. Many organizations also set up private Docker registries. Docker is primarily used to manage containers on individual nodes.
-
-:::note
-
-Although Rancher 1.6 supported Docker Swarm clustering technology, it is no longer supported in Rancher 2.x due to the success of Kubernetes.
-
-:::
+Docker is a container packaging and runtime standard. Developers can build container images from Dockerfiles and distribute container images from Docker registries. [Docker Hub](https://hub.docker.com) is a popular public registry. Many organizations also set up private Docker registries. Docker is primarily used to manage containers on individual nodes.

 ## About Kubernetes

@@ -26,7 +20,7 @@ Kubernetes is the container cluster management standard. YAML files specify cont

 A cluster is a group of computers that work together as a single system.

-A _Kubernetes Cluster_ is a cluster that uses the [Kubernetes container-orchestration system](https://kubernetes.io/) to deploy, maintain, and scale Docker containers, allowing your organization to automate application operations.
+A _Kubernetes Cluster_ is a cluster that uses the [Kubernetes container-orchestration system](https://kubernetes.io/) to deploy, maintain, and scale containers, allowing your organization to automate application operations.

 ## Roles for Nodes in Kubernetes Clusters

@@ -351,29 +351,29 @@ receivers:
  - service_key: 'database-integration-key'
 ```

-## Example Route Config for CIS Scan Alerts
+## Example Route Config for Compliance Scan Alerts

-While configuring the routes for `rancher-cis-benchmark` alerts, you can specify the matching using the key-value pair `job: rancher-cis-scan`.
+While configuring the routes for `rancher-compliance` alerts, you can specify the matching using the key-value pair `job: rancher-compliance-scan`.

-For example, the following example route configuration could be used with a Slack receiver named `test-cis`:
+For example, the following example route configuration could be used with a Slack receiver named `test-compliance`:

 ```yaml
 spec:
-  receiver: test-cis
+  receiver: test-compliance
  group_by:
 #    - string
  group_wait: 30s
  group_interval: 30s
  repeat_interval: 30s
  match:
-    job: rancher-cis-scan
+    job: rancher-compliance-scan
 #    key: string
  match_re:
    {}
 #    key: string
 ```

-For more information on enabling alerting for `rancher-cis-benchmark`, see [this section.](../../how-to-guides/advanced-user-guides/cis-scan-guides/enable-alerting-for-rancher-cis-benchmark.md)
+For more information on enabling alerting for `rancher-compliance-benchmark`, see [this section.](../../how-to-guides/advanced-user-guides/compliance-scan-guides/enable-alerting-for-rancher-compliance.md)

 ## Trusted CA for Notifiers

@@ -42,8 +42,8 @@ Rancher's integration with Istio was improved in Rancher v2.5.

 For more information, refer to the Istio documentation [here.](../integrations-in-rancher/istio/istio.md)

-## CIS Scans
+## Compliance Scans

-Rancher can run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark.
+Rancher can run a security scan to check whether Kubernetes is deployed according to security best practices as defined in most recognized Kubernetes Security Benchmarks, such as STIG.

-For more information, refer to the CIS scan documentation [here.](../how-to-guides/advanced-user-guides/cis-scan-guides/cis-scan-guides.md)
+For more information, refer to the Compliance scan documentation [here.](../how-to-guides/advanced-user-guides/compliance-scan-guides/compliance-scan-guides.md)
@@ -32,14 +32,6 @@ One option for the underlying Kubernetes cluster is to use K3s Kubernetes. K3s i

 ![Architecture of a K3s Kubernetes Cluster Running the Rancher Management Server](/img/k3s-server-storage.svg)

-### RKE Kubernetes Cluster Installations
-
-In an RKE installation, the cluster data is replicated on each of three etcd nodes in the cluster, providing redundancy and data duplication in case one of the nodes fails.
-
-<figcaption>Architecture of an RKE Kubernetes Cluster Running the Rancher Management Server</figcaption>
-
-![Architecture of an RKE Kubernetes cluster running the Rancher management server](/img/rke-server-storage.svg)
-
 ## Recommended Load Balancer Configuration for Kubernetes Installations

 We recommend the following configurations for the load balancer and Ingress controllers:
@@ -61,7 +53,7 @@ For the best performance and greater security, we recommend a dedicated Kubernet

 ## Recommended Node Roles for Kubernetes Installations

-The below recommendations apply when Rancher is installed on a K3s Kubernetes cluster or an RKE Kubernetes cluster.
+The below recommendations apply when Rancher is installed on a K3s Kubernetes cluster.

 ### K3s Cluster Roles

@@ -69,38 +61,6 @@ In K3s clusters, there are two types of nodes: server nodes and agent nodes. Bot

 For the cluster running the Rancher management server, we recommend using two server nodes. Agent nodes are not required.

-### RKE Cluster Roles
-
-If Rancher is installed on an RKE Kubernetes cluster, the cluster should have three nodes, and each node should have all three Kubernetes roles: etcd, controlplane, and worker.
-
-### Contrasting RKE Cluster Architecture for Rancher Server and for Downstream Kubernetes Clusters
-
-Our recommendation for RKE node roles on the Rancher server cluster contrasts with our recommendations for the downstream user clusters that run your apps and services.
-
-Rancher uses RKE as a library when provisioning downstream Kubernetes clusters. Note: The capability to provision downstream K3s clusters will be added in a future version of Rancher.
-
-For downstream Kubernetes clusters, we recommend that each node in a user cluster should have a single role for stability and scalability.
-
-![Kubernetes Roles for Nodes in Rancher Server Cluster vs. User Clusters](/img/rancher-architecture-node-roles.svg)
-
-RKE only requires at least one node with each role and does not require nodes to be restricted to one role. However, for the clusters that run your apps, we recommend separate roles for each node so that workloads on worker nodes don't interfere with the Kubernetes master or cluster data as your services scale.
-
-We recommend that downstream user clusters should have at least:
-
- **Three nodes with only the etcd role** to maintain a quorum if one node is lost, making the state of your cluster highly available
- **Two nodes with only the controlplane role** to make the master component highly available
- **One or more nodes with only the worker role** to run the Kubernetes node components, as well as the workloads for your apps and services
-
-With that said, it is safe to use all three roles on three nodes when setting up the Rancher server because:
-
-* It allows one `etcd` node failure.
-* It maintains multiple instances of the master components by having multiple `controlplane` nodes.
-* No other workloads than Rancher itself should be created on this cluster.
-
-Because no additional workloads will be deployed on the Rancher server cluster, in most cases it is not necessary to use the same architecture that we recommend for the scalability and reliability of downstream clusters.
-
-For more best practices for downstream clusters, refer to the [production checklist](../../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/checklist-for-production-ready-clusters/checklist-for-production-ready-clusters.md) or our [best practices guide.](../best-practices/best-practices.md)
-
 ## Architecture for an Authorized Cluster Endpoint (ACE)

 If you are using an [authorized cluster endpoint (ACE),](../../reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md#4-authorized-cluster-endpoint) we recommend creating an FQDN pointing to a load balancer which balances traffic across your nodes with the `controlplane` role.
@@ -41,7 +41,7 @@ There is one cluster controller and one cluster agent for each downstream cluste
 - Watches for resource changes in the downstream cluster
 - Brings the current state of the downstream cluster to the desired state
 -  Configures access control policies to clusters and projects
-  Provisions clusters by calling the required Docker machine drivers and Kubernetes engines, such as RKE and GKE
+-  Provisions clusters by calling the required Docker machine drivers and Kubernetes engines, such as GKE

 By default, to enable Rancher to communicate with a downstream cluster, the cluster controller connects to the cluster agent. If the cluster agent is not available, the cluster controller can connect to a [node agent](#3-node-agents) instead.

@@ -62,7 +62,7 @@ The `cattle-node-agent` is deployed using a [DaemonSet](https://kubernetes.io/do

 An authorized cluster endpoint (ACE) allows users to connect to the Kubernetes API server of a downstream cluster without having to route their requests through the Rancher authentication proxy.

-> ACE is available on RKE, RKE2, and K3s clusters that are provisioned or registered with Rancher. It's not available on  clusters in a hosted Kubernetes provider, such as Amazon's EKS.
+> ACE is available on RKE2 and K3s clusters that are provisioned or registered with Rancher. It's not available on  clusters in a hosted Kubernetes provider, such as Amazon's EKS.

 There are two main reasons why a user might need the authorized cluster endpoint:

@@ -178,11 +178,8 @@ If you see an error related to "impersonation" in the UI, pay close attention to

 The files mentioned below are needed to maintain, troubleshoot and upgrade your cluster:

- `rancher-cluster.yml`: The RKE cluster configuration file.
- `kube_config_rancher-cluster.yml`: The Kubeconfig file for the cluster, this file contains credentials for full access to the cluster. You can use this file to authenticate with a Rancher-launched Kubernetes cluster if Rancher goes down.
- `rancher-cluster.rkestate`: The Kubernetes cluster state file. This file contains credentials for full access to the cluster. Note: This state file is only created when using RKE v0.2.0 or higher.
-
-> **Note:** The "rancher-cluster" parts of the two latter file names are dependent on how you name the RKE cluster configuration file.
+- `config.yaml`: The RKE2 and K3s cluster configuration file.
+- `rke2.yaml` or `k3s.yaml`: The Kubeconfig file for your RKE2 or K3s cluster. This file contains credentials for full access to the cluster. You can use this file to authenticate with a Rancher-launched Kubernetes cluster if Rancher goes down.

 For more information on connecting to a cluster without the Rancher authentication proxy and other configuration options, refer to the [kubeconfig file](../../how-to-guides/new-user-guides/manage-clusters/access-clusters/use-kubectl-and-kubeconfig.md) documentation.

@@ -194,13 +191,7 @@ The tools that Rancher uses to provision downstream user clusters depends on the

 Rancher can dynamically provision nodes in a provider such as Amazon EC2, DigitalOcean, Azure, or vSphere, then install Kubernetes on them.

-Rancher provisions this type of cluster using [RKE](https://github.com/rancher/rke) and [docker-machine.](https://github.com/rancher/machine)
-
-### Rancher Launched Kubernetes for Custom Nodes
-
-When setting up this type of cluster, Rancher installs Kubernetes on existing nodes, which creates a custom cluster.
-
-Rancher provisions this type of cluster using [RKE.](https://github.com/rancher/rke)
+Rancher provisions this type of cluster using [docker-machine.](https://github.com/rancher/machine)

 ### Hosted Kubernetes Providers

@@ -1,50 +0,0 @@
---
-title: Self-Assessment and Hardening Guides for Rancher
---
-
-<head>
-  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/reference-guides/rancher-security/hardening-guides"/>
-</head>
-
-Rancher provides specific security hardening guides for each supported Rancher version's Kubernetes distributions.
-
-## Rancher Kubernetes Distributions
-
-Rancher uses the following Kubernetes distributions:
-
- [**RKE**](https://rancher.com/docs/rke/latest/en/), Rancher Kubernetes Engine, is a CNCF-certified Kubernetes distribution that runs entirely within Docker containers.
- [**RKE2**](https://docs.rke2.io/) is a fully conformant Kubernetes distribution that focuses on security and compliance within the U.S. Federal Government sector.
- [**K3s**](https://docs.k3s.io/) is a fully conformant, lightweight Kubernetes distribution. It is easy to install, with half the memory requirement of upstream Kubernetes, all in a binary of less than 100 MB.
-
-To harden a Kubernetes cluster that's running a distribution other than those listed, refer to your Kubernetes provider docs.
-
-## Hardening Guides and Benchmark Versions
-
-Each self-assessment guide is accompanied by a hardening guide. These guides were tested alongside the listed Rancher releases. Each self-assessment guides was tested on a specific Kubernetes version and CIS benchmark version. If a CIS benchmark has not been validated for your Kubernetes version, you can use the existing guides until a guide for your version is added.
-
-### RKE Guides
-
-| Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guides |
-|--------------------|-----------------------|-----------------------|------------------|
-| Kubernetes v1.25/v1.26/v1.27 | CIS v1.7 | [Link](rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md) | [Link](rke1-hardening-guide/rke1-hardening-guide.md) |
-
-### RKE2 Guides
-
-| Type | Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guides |
-|------|--------------------|-----------------------|-----------------------|------------------|
-| Rancher provisioned RKE2 | Kubernetes v1.25/v1.26/v1.27 | CIS v1.7 | [Link](rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md) | [Link](rke2-hardening-guide/rke2-hardening-guide.md) |
-| Standalone RKE2 | Kubernetes v1.27-v1.32 | CIS v1.9 | [Link](https://docs.rke2.io/security/cis_self_assessment19) | [Link](https://docs.rke2.io/security/hardening_guide) |
-
-### K3s Guides
-
-| Type | Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guides |
-|------|--------------------|-----------------------|-----------------------|------------------|
-| Rancher provisioned K3s cluster | Kubernetes v1.25/v1.26/v1.27 | CIS v1.7 | [Link](k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md) | [Link](k3s-hardening-guide/k3s-hardening-guide.md) |
-| Standalone K3s | Kubernetes v1.22 up to v1.24 | CIS v1.23 | [Link](https://docs.k3s.io/security/self-assessment-1.8) | [Link](https://docs.k3s.io/security/hardening-guide) |
-
-## Rancher with SELinux
-
-[Security-Enhanced Linux (SELinux)](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) is a kernel module that adds extra access controls and security tools to Linux. Historically used by government agencies, SELinux is now industry-standard. SELinux is enabled by default on RHEL and CentOS.
-
-To use Rancher with SELinux, we recommend [installing](../selinux-rpm/about-rancher-selinux.md) the `rancher-selinux` RPM.
-
@@ -1,744 +0,0 @@
---
-title: K3s Hardening Guides
---
-
-<head>
-  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide"/>
-</head>
-
-This document provides prescriptive guidance for how to harden a K3s cluster intended for production, before provisioning it with Rancher. It outlines the configurations and controls required for Center for Information Security (CIS) Kubernetes benchmark controls.
-
-:::note
-This hardening guide describes how to secure the nodes in your cluster. We recommended that you follow this guide before you install Kubernetes.
-:::
-
-This hardening guide is intended to be used for K3s clusters and is associated with the following versions of the CIS Kubernetes Benchmark, Kubernetes, and Rancher:
-
-| Rancher Version | CIS Benchmark Version | Kubernetes Version           |
-|-----------------|-----------------------|------------------------------|
-| Rancher v2.7    | Benchmark v1.23       | Kubernetes v1.23             |
-| Rancher v2.7    | Benchmark v1.24       | Kubernetes v1.24             |
-| Rancher v2.7    | Benchmark v1.7        | Kubernetes v1.25 up to v1.26 |
-
-:::note
-In Benchmark v1.7, the `--protect-kernel-defaults` (4.2.6) parameter isn't required anymore, and was removed by CIS.
-:::
-
-For more details on how to evaluate a hardened K3s cluster against the official CIS benchmark, refer to the K3s self-assessment guides for specific Kubernetes and CIS benchmark versions.
-
-K3s passes a number of the Kubernetes CIS controls without modification, as it applies several security mitigations by default. There are some notable exceptions to this that require manual intervention to fully comply with the CIS Benchmark:
-
-1. K3s does not modify the host operating system. Any host-level modifications need to be done manually.
-2. Certain CIS policy controls for `NetworkPolicies` and `PodSecurityStandards` (`PodSecurityPolicies` on v1.24 and older) restrict cluster functionality.
-   You must opt into having K3s configure these policies. Add the appropriate options to your command-line flags or configuration file (enable admission plugins), and manually apply the appropriate policies.
-   See further for more details.
-
-The first section (1.1) of the CIS Benchmark primarily focuses on  pod manifest permissions and ownership. Since everything in the distribution is packaged in a single binary, this section does not apply to the core components of K3s.
-
-## Host-level Requirements
-
-### Ensure `protect-kernel-defaults` is set
-
-<Tabs groupId="k3s-version">
-<TabItem value="v1.25 and Newer" default>
-
-The `protect-kernel-defaults` is no longer required since CIS benchmark 1.7.
-
-</TabItem>
-<TabItem value="v1.24 and Older">
-
-This is a kubelet flag that will cause the kubelet to exit if the required kernel parameters are unset or are set to values that are different from the kubelet's defaults.
-
-The `protect-kernel-defaults` flag can be set in the cluster configuration in Rancher.
-
-```yaml
-spec:
-  rkeConfig:
-    machineSelectorConfig:
-      - config:
-          protect-kernel-defaults: true
-```
-
-</TabItem>
-</Tabs>
-
-### Set kernel parameters
-
-The following `sysctl` configuration is recommended for all nodes type in the cluster. Set the following parameters in `/etc/sysctl.d/90-kubelet.conf`:
-
-```ini
-vm.panic_on_oom=0
-vm.overcommit_memory=1
-kernel.panic=10
-kernel.panic_on_oops=1
-```
-
-Run `sudo sysctl -p /etc/sysctl.d/90-kubelet.conf` to enable the settings.
-
-This configuration needs to be done before setting the kubelet flag, otherwise K3s will fail to start.
-
-## Kubernetes Runtime Requirements
-
-The CIS Benchmark runtime requirements center around pod security (via PSA), network policies and API Server auditing logs.
-
-By default, K3s does not include any pod security or network policies. However, K3s ships with a controller that enforces any network policies you create. By default, K3s enables both the `PodSecurity` and `NodeRestriction` admission controllers, among others.
-
-### Pod Security
-
-<Tabs groupId="k3s-version">
-<TabItem value="v1.25 and Newer" default>
-
-K3s v1.25 and newer support [Pod Security admission (PSA)](https://kubernetes.io/docs/concepts/security/pod-security-admission/) for controlling pod security.
-
-You can specify the PSA configuration by setting the `defaultPodSecurityAdmissionConfigurationTemplateName` field in the cluster configuration in Rancher:
-
-```yaml
-spec:
-  defaultPodSecurityAdmissionConfigurationTemplateName: rancher-restricted
-```
-
-The `rancher-restricted` template is provided by Rancher to enforce the highly-restrictive Kubernetes upstream [`Restricted`](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted) profile with best practices for pod hardening.
-
-</TabItem>
-<TabItem value="v1.24 and Older">
-
-K3s v1.24 and older support [Pod Security Policy (PSP)](https://github.com/kubernetes/website/blob/release-1.24/content/en/docs/concepts/security/pod-security-policy.md) for controlling pod security.
-
-You can enable PSPs by passing the following flags in the cluster configuration in Rancher:
-
-```yaml
-spec:
-  rkeConfig:
-    machineGlobalConfig:
-      kube-apiserver-arg:
-        - enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount
-```
-
-This maintains the `NodeRestriction` plugin and enables the `PodSecurityPolicy`.
-
-Once you enable PSPs, you can apply a policy to satisfy the necessary controls described in section 5.2 of the CIS Benchmark.
-
-:::note
-These are manual checks in the CIS Benchmark. The CIS scan flags the results as `warning`, because manual inspection is necessary by the cluster operator.
-:::
-
-Here is an example of a compliant PSP:
-
-```yaml
---
-apiVersion: policy/v1beta1
-kind: PodSecurityPolicy
-metadata:
-  name: restricted-psp
-spec:
-  privileged: false                # CIS - 5.2.1
-  allowPrivilegeEscalation: false  # CIS - 5.2.5
-  requiredDropCapabilities:        # CIS - 5.2.7/8/9
-    - ALL
-  volumes:
-    - 'configMap'
-    - 'emptyDir'
-    - 'projected'
-    - 'secret'
-    - 'downwardAPI'
-    - 'csi'
-    - 'persistentVolumeClaim'
-    - 'ephemeral'
-  hostNetwork: false               # CIS - 5.2.4
-  hostIPC: false                   # CIS - 5.2.3
-  hostPID: false                   # CIS - 5.2.2
-  runAsUser:
-    rule: 'MustRunAsNonRoot'       # CIS - 5.2.6
-  seLinux:
-    rule: 'RunAsAny'
-  supplementalGroups:
-    rule: 'MustRunAs'
-    ranges:
-      - min: 1
-        max: 65535
-  fsGroup:
-    rule: 'MustRunAs'
-    ranges:
-      - min: 1
-        max: 65535
-  readOnlyRootFilesystem: false
-```
-
-For the example PSP to be effective, we need to create a `ClusterRole` and a `ClusterRoleBinding`. We also need to include a "system unrestricted policy" for system-level pods that require additional privileges, and an additional policy that allows the necessary sysctls for full functionality of ServiceLB.
-
-```yaml
---
-apiVersion: policy/v1beta1
-kind: PodSecurityPolicy
-metadata:
-  name: restricted-psp
-spec:
-  privileged: false
-  allowPrivilegeEscalation: false
-  requiredDropCapabilities:
-    - ALL
-  volumes:
-    - 'configMap'
-    - 'emptyDir'
-    - 'projected'
-    - 'secret'
-    - 'downwardAPI'
-    - 'csi'
-    - 'persistentVolumeClaim'
-    - 'ephemeral'
-  hostNetwork: false
-  hostIPC: false
-  hostPID: false
-  runAsUser:
-    rule: 'MustRunAsNonRoot'
-  seLinux:
-    rule: 'RunAsAny'
-  supplementalGroups:
-    rule: 'MustRunAs'
-    ranges:
-      - min: 1
-        max: 65535
-  fsGroup:
-    rule: 'MustRunAs'
-    ranges:
-      - min: 1
-        max: 65535
-  readOnlyRootFilesystem: false
---
-apiVersion: policy/v1beta1
-kind: PodSecurityPolicy
-metadata:
-  name: system-unrestricted-psp
-  annotations:
-    seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
-spec:
-  allowPrivilegeEscalation: true
-  allowedCapabilities:
-  - '*'
-  fsGroup:
-    rule: RunAsAny
-  hostIPC: true
-  hostNetwork: true
-  hostPID: true
-  hostPorts:
-  - max: 65535
-    min: 0
-  privileged: true
-  runAsUser:
-    rule: RunAsAny
-  seLinux:
-    rule: RunAsAny
-  supplementalGroups:
-    rule: RunAsAny
-  volumes:
-  - '*'
---
-apiVersion: policy/v1beta1
-kind: PodSecurityPolicy
-metadata:
-  name: svclb-psp
-  annotations:
-    seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
-spec:
-  allowPrivilegeEscalation: false
-  allowedCapabilities:
-  - NET_ADMIN
-  allowedUnsafeSysctls:
-  - net.ipv4.ip_forward
-  - net.ipv6.conf.all.forwarding
-  fsGroup:
-    rule: RunAsAny
-  hostPorts:
-  - max: 65535
-    min: 0
-  runAsUser:
-    rule: RunAsAny
-  seLinux:
-    rule: RunAsAny
-  supplementalGroups:
-    rule: RunAsAny
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: psp:restricted-psp
-rules:
- apiGroups:
-  - policy
-  resources:
-  - podsecuritypolicies
-  verbs:
-  - use
-  resourceNames:
-  - restricted-psp
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: psp:system-unrestricted-psp
-rules:
- apiGroups:
-  - policy
-  resources:
-  - podsecuritypolicies
-  resourceNames:
-  - system-unrestricted-psp
-  verbs:
-  - use
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: psp:svclb-psp
-rules:
- apiGroups:
-  - policy
-  resources:
-  - podsecuritypolicies
-  resourceNames:
-  - svclb-psp
-  verbs:
-  - use
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: psp:svc-local-path-provisioner-psp
-rules:
- apiGroups:
-  - policy
-  resources:
-  - podsecuritypolicies
-  resourceNames:
-  - system-unrestricted-psp
-  verbs:
-  - use
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: psp:svc-coredns-psp
-rules:
- apiGroups:
-  - policy
-  resources:
-  - podsecuritypolicies
-  resourceNames:
-  - system-unrestricted-psp
-  verbs:
-  - use
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: psp:svc-cis-operator-psp
-rules:
- apiGroups:
-  - policy
-  resources:
-  - podsecuritypolicies
-  resourceNames:
-  - system-unrestricted-psp
-  verbs:
-  - use
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: default:restricted-psp
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: psp:restricted-psp
-subjects:
- kind: Group
-  name: system:authenticated
-  apiGroup: rbac.authorization.k8s.io
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: system-unrestricted-node-psp-rolebinding
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: psp:system-unrestricted-psp
-subjects:
- apiGroup: rbac.authorization.k8s.io
-  kind: Group
-  name: system:nodes
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: system-unrestricted-svc-acct-psp-rolebinding
-  namespace: kube-system
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: psp:system-unrestricted-psp
-subjects:
- apiGroup: rbac.authorization.k8s.io
-  kind: Group
-  name: system:serviceaccounts
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: svclb-psp-rolebinding
-  namespace: kube-system
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: psp:svclb-psp
-subjects:
- kind: ServiceAccount
-  name: svclb
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: svc-local-path-provisioner-psp-rolebinding
-  namespace: kube-system
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: psp:svc-local-path-provisioner-psp
-subjects:
- kind: ServiceAccount
-  name: local-path-provisioner-service-account
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: svc-coredns-psp-rolebinding
-  namespace: kube-system
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: psp:svc-coredns-psp
-subjects:
- kind: ServiceAccount
-  name: coredns
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: svc-cis-operator-psp-rolebinding
-  namespace: cis-operator-system
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: psp:svc-cis-operator-psp
-subjects:
- kind: ServiceAccount
-  name: cis-operator-serviceaccount
-```
-
-The policies presented above can be placed in a file named `policy.yaml` in the `/var/lib/rancher/k3s/server/manifests` directory. Both the policy file and the its directory hierarchy must be created before starting K3s. A restrictive access permission is recommended to avoid leaking potential sensitive information.
-
-```shell
-sudo mkdir -p -m 700 /var/lib/rancher/k3s/server/manifests
-```
-
-:::note
-The critical Kubernetes additions such as CNI, DNS, and Ingress are run as pods in the `kube-system` namespace. Therefore, this namespace has a less restrictive policy, so that these components can run properly.
-:::
-
-</TabItem>
-</Tabs>
-
-### Network Policies
-
-CIS requires that all namespaces apply a network policy that reasonably limits traffic into namespaces and pods.
-
-:::note
-This is a manual check in the CIS Benchmark. The CIS scan flags the result as a `warning`, because manual inspection is necessary by the cluster operator.
-:::
-
-The network policies can be placed in the `policy.yaml` file in `/var/lib/rancher/k3s/server/manifests` directory. If the directory was not created as part of the PSP (as described above), it must be created first.
-
-```shell
-sudo mkdir -p -m 700 /var/lib/rancher/k3s/server/manifests
-```
-
-Here is an example of a compliant network policy:
-
-```yaml
---
-kind: NetworkPolicy
-apiVersion: networking.k8s.io/v1
-metadata:
-  name: intra-namespace
-  namespace: kube-system
-spec:
-  podSelector: {}
-  ingress:
-    - from:
-      - namespaceSelector:
-          matchLabels:
-            name: kube-system
---
-kind: NetworkPolicy
-apiVersion: networking.k8s.io/v1
-metadata:
-  name: intra-namespace
-  namespace: default
-spec:
-  podSelector: {}
-  ingress:
-    - from:
-      - namespaceSelector:
-          matchLabels:
-            name: default
---
-kind: NetworkPolicy
-apiVersion: networking.k8s.io/v1
-metadata:
-  name: intra-namespace
-  namespace: kube-public
-spec:
-  podSelector: {}
-  ingress:
-    - from:
-      - namespaceSelector:
-          matchLabels:
-            name: kube-public
-```
-
-The active restrictions block DNS unless purposely allowed. Below is a network policy that allows DNS-related traffic:
-
-```yaml
---
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: default-network-dns-policy
-  namespace: <NAMESPACE>
-spec:
-  ingress:
-  - ports:
-    - port: 53
-      protocol: TCP
-    - port: 53
-      protocol: UDP
-  podSelector:
-    matchLabels:
-      k8s-app: kube-dns
-  policyTypes:
-  - Ingress
-```
-
-The metrics-server and Traefik ingress controller are blocked by default if network policies are not created to allow access.
-
-```yaml
---
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: allow-all-metrics-server
-  namespace: kube-system
-spec:
-  podSelector:
-    matchLabels:
-      k8s-app: metrics-server
-  ingress:
-  - {}
-  policyTypes:
-  - Ingress
---
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: allow-all-svclbtraefik-ingress
-  namespace: kube-system
-spec:
-  podSelector:
-    matchLabels:
-      svccontroller.k3s.cattle.io/svcname: traefik
-  ingress:
-  - {}
-  policyTypes:
-  - Ingress
---
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: allow-all-traefik-v121-ingress
-  namespace: kube-system
-spec:
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: traefik
-  ingress:
-  - {}
-  policyTypes:
-  - Ingress
-```
-
-:::note
-You must manage network policies as normal for any additional namespaces you create.
-:::
-
-### API Server audit configuration
-
-CIS requirements 1.2.22 to 1.2.25 are related to configuring audit logs for the API Server. K3s does not create by default the log directory and audit policy, as auditing requirements are specific to each user's policies and environment.
-
-If you need a log directory, it must be created before you start K3s. We recommend a restrictive access permission to avoid leaking sensitive information.
-
-```bash
-sudo mkdir -p -m 700 /var/lib/rancher/k3s/server/logs
-```
-
-The following is a starter audit policy to log request metadata. This policy should be written to a file named `audit.yaml` in the `/var/lib/rancher/k3s/server` directory. Detailed information about policy configuration for the API server can be found in the [official Kubernetes documentation](https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/).
-
-```yaml
---
-apiVersion: audit.k8s.io/v1
-kind: Policy
-rules:
- level: Metadata
-```
-
-Further configurations are also needed to pass CIS checks. These are not configured by default in K3s, because they vary based on your environment and needs:
-
- Ensure that the `--audit-log-path` argument is set.
- Ensure that the `--audit-log-maxage` argument is set to 30 or as appropriate.
- Ensure that the `--audit-log-maxbackup` argument is set to 10 or as appropriate.
- Ensure that the `--audit-log-maxsize` argument is set to 100 or as appropriate.
-
-Combined, to enable and configure audit logs, add the following lines to the K3s cluster configuration file in Rancher:
-
-```yaml
-spec:
-  rkeConfig:
-    machineGlobalConfig:
-      kube-apiserver-arg:
-        - audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml    # CIS 3.2.1
-        - audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log   # CIS 1.2.18
-        - audit-log-maxage=30                                         # CIS 1.2.19
-        - audit-log-maxbackup=10                                      # CIS 1.2.20
-        - audit-log-maxsize=100                                       # CIS 1.2.21
-```
-
-### Controller Manager Requirements
-
-CIS requirement 1.3.1 checks for garbage collection settings in the Controller Manager. Garbage collection is important to ensure sufficient resource availability and avoid degraded performance and availability. Based on your system resources and tests, choose an appropriate threshold value to activate garbage collection.
-
-This can be remediated by setting the following configuration in the K3s cluster file in Rancher. The value below is only an example. The appropriate threshold value is specific to each user's environment.
-
-```yaml
-spec:
-  rkeConfig:
-    machineGlobalConfig:
-      kube-controller-manager-arg:
-        - terminated-pod-gc-threshold=10                              # CIS 1.3.1
-```
-
-### Configure `default` Service Account
-
-Kubernetes provides a `default` service account which is used by cluster workloads where no specific service account is assigned to the pod. Where access to the Kubernetes API from a pod is required, a specific service account should be created for that pod, and rights granted to that service account.
-
-For CIS requirement 5.1.5 the `default` service account should be configured such that it does not provide a service account token and does not have any explicit rights assignments.
-
-This can be remediated by updating the `automountServiceAccountToken` field to `false` for the `default` service account in each namespace.
-
-For `default` service accounts in the built-in namespaces (`kube-system`, `kube-public`, `kube-node-lease`, and `default)`, K3s does not automatically do this.
-
-Save the following configuration to a file called `account_update.yaml`.
-
-```yaml
---
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: default
-automountServiceAccountToken: false
-```
-
-Create a bash script file called `account_update.sh`. Be sure to `chmod +x account_update.sh` so the script has execute permissions.
-
-```shell
-#!/bin/bash -e
-
-for namespace in $(kubectl get namespaces -A -o=jsonpath="{.items[*]['metadata.name']}"); do
-  kubectl patch serviceaccount default -n ${namespace} -p "$(cat account_update.yaml)"
-done
-```
-
-Run the script every time a new service account is added to your cluster.
-
-## Reference Hardened K3s Template Configuration
-
-The following reference template configuration is used in Rancher to create a hardened K3s custom cluster based on each CIS control in this guide. This reference does not include other required **cluster configuration** directives, which vary based on your environment.
-
-<Tabs groupId="k3s-version">
-<TabItem value="v1.25 and Newer" default>
-
-```yaml
-apiVersion: provisioning.cattle.io/v1
-kind: Cluster
-metadata:
-  name: # Define cluster name
-spec:
-  defaultPodSecurityAdmissionConfigurationTemplateName: rancher-restricted
-  enableNetworkPolicy: true
-  kubernetesVersion: # Define K3s version
-  rkeConfig:
-    machineGlobalConfig:
-      kube-apiserver-arg:
-        - enable-admission-plugins=NodeRestriction,ServiceAccount     # CIS 1.2.15, 1.2.13
-        - audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml    # CIS 3.2.1
-        - audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log   # CIS 1.2.18
-        - audit-log-maxage=30                                         # CIS 1.2.19
-        - audit-log-maxbackup=10                                      # CIS 1.2.20
-        - audit-log-maxsize=100                                       # CIS 1.2.21
-        - request-timeout=300s                                        # CIS 1.2.22
-        - service-account-lookup=true                                 # CIS 1.2.24
-      kube-controller-manager-arg:
-        - terminated-pod-gc-threshold=10                              # CIS 1.3.1
-      secrets-encryption: true
-    machineSelectorConfig:
-      - config:
-          kubelet-arg:
-            - make-iptables-util-chains=true                          # CIS 4.2.7
-```
-
-</TabItem>
-<TabItem value="v1.24 and Older">
-
-```yaml
-apiVersion: provisioning.cattle.io/v1
-kind: Cluster
-metadata:
-  name: # Define cluster name
-spec:
-  enableNetworkPolicy: true
-  kubernetesVersion: # Define K3s version
-  rkeConfig:
-    machineGlobalConfig:
-      kube-apiserver-arg:
-        - enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount    # CIS 1.2.15, 5.2, 1.2.13
-        - audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml    # CIS 3.2.1
-        - audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log   # CIS 1.2.18
-        - audit-log-maxage=30                                         # CIS 1.2.19
-        - audit-log-maxbackup=10                                      # CIS 1.2.20
-        - audit-log-maxsize=100                                       # CIS 1.2.21
-        - request-timeout=300s                                        # CIS 1.2.22
-        - service-account-lookup=true                                 # CIS 1.2.24
-      kube-controller-manager-arg:
-        - terminated-pod-gc-threshold=10                              # CIS 1.3.1
-      secrets-encryption: true
-    machineSelectorConfig:
-      - config:
-          kubelet-arg:
-            - make-iptables-util-chains=true                          # CIS 4.2.7
-          protect-kernel-defaults: true                               # CIS 4.2.6
-```
-
-</TabItem>
-</Tabs>
-
-## Conclusion
-
-If you have followed this guide, your K3s custom cluster provisioned by Rancher will be configured to pass the CIS Kubernetes Benchmark. You can review our K3s self-assessment guides to understand how we verified each of the benchmarks and how you can do the same on your cluster.
@@ -1,513 +0,0 @@
---
-title: RKE Hardening Guides
---
-
-<EOLRKE1Warning />
-
-<head>
-  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide"/>
-</head>
-
-This document provides prescriptive guidance for how to harden an RKE cluster intended for production, before provisioning it with Rancher. It outlines the configurations and controls required for Center for Information Security (CIS) Kubernetes benchmark controls.
-
-:::note
-This hardening guide describes how to secure the nodes in your cluster. We recommended that you follow this guide before you install Kubernetes.
-:::
-
-This hardening guide is intended to be used for RKE clusters and is associated with the following versions of the CIS Kubernetes Benchmark, Kubernetes, and Rancher:
-
-| Rancher Version | CIS Benchmark Version | Kubernetes Version           |
-|-----------------|-----------------------|------------------------------|
-| Rancher v2.7    | Benchmark v1.23       | Kubernetes v1.23             |
-| Rancher v2.7    | Benchmark v1.24       | Kubernetes v1.24             |
-| Rancher v2.7    | Benchmark v1.7        | Kubernetes v1.25 up to v1.26 |
-
-:::note
- In Benchmark v1.24 and later, check id `4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Automated)` might fail, as `/etc/kubernetes/ssl/kube-ca.pem` is set to 644 by default.
- In Benchmark v1.7, the `--protect-kernel-defaults` (`4.2.6`) parameter isn't required anymore, and was removed by CIS.
-:::
-
-For more details on how to evaluate a hardened RKE cluster against the official CIS benchmark, refer to the RKE self-assessment guides for specific Kubernetes and CIS benchmark versions.
-
-## Host-level requirements
-
-### Configure Kernel Runtime Parameters
-
-The following `sysctl` configuration is recommended for all nodes types in the cluster. Set the following parameters in `/etc/sysctl.d/90-kubelet.conf`:
-
-```ini
-vm.overcommit_memory=1
-vm.panic_on_oom=0
-kernel.panic=10
-kernel.panic_on_oops=1
-```
-
-Run `sysctl -p /etc/sysctl.d/90-kubelet.conf` to enable the settings.
-
-### Configure `etcd` user and group
-
-A user account and group for the **etcd** service is required to be set up before installing RKE.
-
-#### Create `etcd` user and group
-
-To create the **etcd** user and group run the following console commands.
-The commands below use `52034` for **uid** and **gid** for example purposes.
-Any valid unused **uid** or **gid** could also be used in lieu of `52034`.
-
-```bash
-groupadd --gid 52034 etcd
-useradd --comment "etcd service account" --uid 52034 --gid 52034 etcd --shell /usr/sbin/nologin
-```
-
-When deploying RKE through its cluster configuration `config.yml` file, update the `uid` and `gid` of the `etcd` user:
-
-```yaml
-services:
-  etcd:
-    gid: 52034
-    uid: 52034
-```
-
-## Kubernetes runtime requirements
-
-### Configure `default` Service Account
-
-#### Set `automountServiceAccountToken` to `false` for `default` service accounts
-
-Kubernetes provides a default service account which is used by cluster workloads where no specific service account is assigned to the pod.
-Where access to the Kubernetes API from a pod is required, a specific service account should be created for that pod, and rights granted to that service account.
-The default service account should be configured such that it does not provide a service account token and does not have any explicit rights assignments.
-
-For each namespace including `default` and `kube-system` on a standard RKE install, the `default` service account must include this value:
-
-```yaml
-automountServiceAccountToken: false
-```
-
-Save the following configuration to a file called `account_update.yaml`.
-
-```yaml
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: default
-automountServiceAccountToken: false
-```
-
-Create a bash script file called `account_update.sh`.
-Be sure to `chmod +x account_update.sh` so the script has execute permissions.
-
-```bash
-#!/bin/bash -e
-
-for namespace in $(kubectl get namespaces -A -o=jsonpath="{.items[*]['metadata.name']}"); do
-  kubectl patch serviceaccount default -n ${namespace} -p "$(cat account_update.yaml)"
-done
-```
-
-Execute this script to apply the `account_update.yaml` configuration to `default` service account in all namespaces.
-
-### Configure Network Policy
-
-#### Ensure that all Namespaces have Network Policies defined
-
-Running different applications on the same Kubernetes cluster creates a risk of one compromised application attacking a neighboring application. Network segmentation is important to ensure that containers can communicate only with those they are supposed to. A network policy is a specification of how selections of pods are allowed to communicate with each other and other network endpoints.
-
-Network Policies are namespace scoped. When a network policy is introduced to a given namespace, all traffic not allowed by the policy is denied. However, if there are no network policies in a namespace all traffic will be allowed into and out of the pods in that namespace. To enforce network policies, a container network interface (CNI) plugin must be enabled. This guide uses [Canal](https://github.com/projectcalico/canal) to provide the policy enforcement. Additional information about CNI providers can be found [here](https://www.suse.com/c/rancher_blog/comparing-kubernetes-cni-providers-flannel-calico-canal-and-weave/).
-
-Once a CNI provider is enabled on a cluster a default network policy can be applied. For reference purposes a **permissive** example is provided below. If you want to allow all traffic to all pods in a namespace (even if policies are added that cause some pods to be treated as “isolated”), you can create a policy that explicitly allows all traffic in that namespace. Save the following configuration as `default-allow-all.yaml`. Additional [documentation](https://kubernetes.io/docs/concepts/services-networking/network-policies/) about network policies can be found on the Kubernetes site.
-
-:::caution
-This network policy is just an example and is not recommended for production use.
-:::
-
-```yaml
---
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: default-allow-all
-spec:
-  podSelector: {}
-  ingress:
-  - {}
-  egress:
-  - {}
-  policyTypes:
-  - Ingress
-  - Egress
-```
-
-Create a bash script file called `apply_networkPolicy_to_all_ns.sh`. Be sure to `chmod +x apply_networkPolicy_to_all_ns.sh` so the script has execute permissions.
-
-```bash
-#!/bin/bash -e
-
-for namespace in $(kubectl get namespaces -A -o=jsonpath="{.items[*]['metadata.name']}"); do
-  kubectl apply -f default-allow-all.yaml -n ${namespace}
-done
-```
-
-Execute this script to apply the `default-allow-all.yaml` configuration with the **permissive** `NetworkPolicy` to all namespaces.
-
-## Known Limitations
-
- Rancher **exec shell** and **view logs** for pods are **not** functional in a hardened setup when only a public IP is provided when registering custom nodes. This functionality requires a private IP to be provided when registering the custom nodes.
-
-## Reference Hardened RKE `cluster.yml` Configuration
-
-The reference `cluster.yml` is used by the RKE CLI that provides the configuration needed to achieve a hardened installation of RKE. RKE [documentation](https://rancher.com/docs/rke/latest/en/installation/) provides additional details about the configuration items. This reference `cluster.yml` does not include the required `nodes` directive which will vary depending on your environment. Documentation for node configuration in RKE can be found [here](https://rancher.com/docs/rke/latest/en/config-options/nodes/).
-
-The example `cluster.yml` configuration file contains an Admission Configuration policy in the `services.kube-api.admission_configuration` field. This [sample](../../psa-restricted-exemptions.md) policy contains the namespace exemptions necessary for an imported RKE cluster to run properly in Rancher, similar to Rancher's pre-defined [`rancher-restricted`](../../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md) policy.
-
-If you prefer to use RKE's default `restricted` policy, then leave the `services.kube-api.admission_configuration` field empty and set `services.pod_security_configuration` to `restricted`. See [the RKE docs](https://rke.docs.rancher.com/config-options/services/pod-security-admission) for more information.
-
-<Tabs groupId="rke1-version">
-<TabItem value="v1.25 and Newer" default>
-
-:::note
-If you intend to import an RKE cluster into Rancher, please consult the [documentation](../../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md) for how to configure the PSA to exempt Rancher system namespaces.
-:::
-
-```yaml
-# If you intend to deploy Kubernetes in an air-gapped environment,
-# please consult the documentation on how to configure custom RKE images.
-nodes: []
-kubernetes_version: # Define RKE version
-services:
-  etcd:
-    uid: 52034
-    gid: 52034
-  kube-api:
-    secrets_encryption_config:
-      enabled: true
-    audit_log:
-      enabled: true
-    event_rate_limit:
-      enabled: true
-    # Leave `pod_security_configuration` out if you are setting a
-    # custom policy in `admission_configuration`. Otherwise set
-    # it to `restricted` to use RKE's pre-defined restricted policy,
-    # and remove everything inside `admission_configuration` field.
-    #
-    # pod_security_configuration: restricted
-    #
-    admission_configuration:
-      apiVersion: apiserver.config.k8s.io/v1
-      kind: AdmissionConfiguration
-      plugins:
-        - name: PodSecurity
-          configuration:
-            apiVersion: pod-security.admission.config.k8s.io/v1
-            kind: PodSecurityConfiguration
-            defaults:
-              enforce: "restricted"
-              enforce-version: "latest"
-              audit: "restricted"
-              audit-version: "latest"
-              warn: "restricted"
-              warn-version: "latest"
-            exemptions:
-              usernames: []
-              runtimeClasses: []
-              namespaces: [calico-apiserver,
-                           calico-system,
-                           cattle-alerting,
-                           cattle-csp-adapter-system,
-                           cattle-elemental-system,
-                           cattle-epinio-system,
-                           cattle-externalip-system,
-                           cattle-fleet-local-system,
-                           cattle-fleet-system,
-                           cattle-gatekeeper-system,
-                           cattle-global-data,
-                           cattle-global-nt,
-                           cattle-impersonation-system,
-                           cattle-istio,
-                           cattle-istio-system,
-                           cattle-logging,
-                           cattle-logging-system,
-                           cattle-monitoring-system,
-                           cattle-neuvector-system,
-                           cattle-prometheus,
-                           cattle-provisioning-capi-system,
-                           cattle-resources-system,
-                           cattle-sriov-system,
-                           cattle-system,
-                           cattle-ui-plugin-system,
-                           cattle-windows-gmsa-system,
-                           cert-manager,
-                           cis-operator-system,
-                           fleet-default,
-                           ingress-nginx,
-                           istio-system,
-                           kube-node-lease,
-                           kube-public,
-                           kube-system,
-                           longhorn-system,
-                           rancher-alerting-drivers,
-                           security-scan,
-                           tigera-operator]
-  kube-controller:
-    extra_args:
-      feature-gates: RotateKubeletServerCertificate=true
-  kubelet:
-    extra_args:
-      feature-gates: RotateKubeletServerCertificate=true
-    generate_serving_certificate: true
-addons: |
-  apiVersion: networking.k8s.io/v1
-  kind: NetworkPolicy
-  metadata:
-    name: default-allow-all
-  spec:
-    podSelector: {}
-    ingress:
-    - {}
-    egress:
-    - {}
-    policyTypes:
-    - Ingress
-    - Egress
-  ---
-  apiVersion: v1
-  kind: ServiceAccount
-  metadata:
-    name: default
-  automountServiceAccountToken: false
-```
-
-</TabItem>
-<TabItem value="v1.24 and Older">
-
-```yaml
-# If you intend to deploy Kubernetes in an air-gapped environment,
-# please consult the documentation on how to configure custom RKE images.
-nodes: []
-kubernetes_version: # Define RKE version
-services:
-  etcd:
-    uid: 52034
-    gid: 52034
-  kube-api:
-    secrets_encryption_config:
-      enabled: true
-    audit_log:
-      enabled: true
-    event_rate_limit:
-      enabled: true
-    pod_security_policy: true
-  kube-controller:
-    extra_args:
-      feature-gates: RotateKubeletServerCertificate=true
-  kubelet:
-    extra_args:
-      feature-gates: RotateKubeletServerCertificate=true
-      protect-kernel-defaults: true
-    generate_serving_certificate: true
-addons: |
-  # Upstream Kubernetes restricted PSP policy
-  # https://github.com/kubernetes/website/blob/564baf15c102412522e9c8fc6ef2b5ff5b6e766c/content/en/examples/policy/restricted-psp.yaml
-  apiVersion: policy/v1beta1
-  kind: PodSecurityPolicy
-  metadata:
-    name: restricted-noroot
-  spec:
-    privileged: false
-    # Required to prevent escalations to root.
-    allowPrivilegeEscalation: false
-    requiredDropCapabilities:
-      - ALL
-    # Allow core volume types.
-    volumes:
-      - 'configMap'
-      - 'emptyDir'
-      - 'projected'
-      - 'secret'
-      - 'downwardAPI'
-      # Assume that ephemeral CSI drivers & persistentVolumes set up by the cluster admin are safe to use.
-      - 'csi'
-      - 'persistentVolumeClaim'
-      - 'ephemeral'
-    hostNetwork: false
-    hostIPC: false
-    hostPID: false
-    runAsUser:
-      # Require the container to run without root privileges.
-      rule: 'MustRunAsNonRoot'
-    seLinux:
-      # This policy assumes the nodes are using AppArmor rather than SELinux.
-      rule: 'RunAsAny'
-    supplementalGroups:
-      rule: 'MustRunAs'
-      ranges:
-        # Forbid adding the root group.
-        - min: 1
-          max: 65535
-    fsGroup:
-      rule: 'MustRunAs'
-      ranges:
-        # Forbid adding the root group.
-        - min: 1
-          max: 65535
-    readOnlyRootFilesystem: false
-  ---
-  apiVersion: rbac.authorization.k8s.io/v1
-  kind: ClusterRole
-  metadata:
-    name: psp:restricted-noroot
-  rules:
-  - apiGroups:
-    - extensions
-    resourceNames:
-    - restricted-noroot
-    resources:
-    - podsecuritypolicies
-    verbs:
-    - use
-  ---
-  apiVersion: rbac.authorization.k8s.io/v1
-  kind: ClusterRoleBinding
-  metadata:
-    name: psp:restricted-noroot
-  roleRef:
-    apiGroup: rbac.authorization.k8s.io
-    kind: ClusterRole
-    name: psp:restricted-noroot
-  subjects:
-  - apiGroup: rbac.authorization.k8s.io
-    kind: Group
-    name: system:serviceaccounts
-  - apiGroup: rbac.authorization.k8s.io
-    kind: Group
-    name: system:authenticated
-  ---
-  apiVersion: networking.k8s.io/v1
-  kind: NetworkPolicy
-  metadata:
-    name: default-allow-all
-  spec:
-    podSelector: {}
-    ingress:
-    - {}
-    egress:
-    - {}
-    policyTypes:
-    - Ingress
-    - Egress
-  ---
-  apiVersion: v1
-  kind: ServiceAccount
-  metadata:
-    name: default
-  automountServiceAccountToken: false
-```
-
-</TabItem>
-</Tabs>
-
-## Reference Hardened RKE Cluster Template Configuration
-
-The reference RKE cluster template provides the minimum required configuration to achieve a hardened installation of Kubernetes. RKE templates are used to provision Kubernetes and define Rancher settings. Follow the Rancher [documentation](../../../../getting-started/installation-and-upgrade/installation-and-upgrade.md) for additional information about installing RKE and its template details.
-
-<Tabs groupId="rke1-version">
-<TabItem value="v1.25 and Newer" default>
-
-```yaml
-#
-# Cluster Config
-#
-default_pod_security_admission_configuration_template_name: rancher-restricted
-enable_network_policy: true
-local_cluster_auth_endpoint:
-  enabled: true
-name: # Define cluster name
-
-#
-# Rancher Config
-#
-rancher_kubernetes_engine_config:
-  addon_job_timeout: 45
-  authentication:
-    strategy: x509|webhook
-  kubernetes_version: # Define RKE version
-  services:
-    etcd:
-      uid: 52034
-      gid: 52034
-    kube-api:
-      audit_log:
-        enabled: true
-      event_rate_limit:
-        enabled: true
-      pod_security_policy: false
-      secrets_encryption_config:
-        enabled: true
-    kube-controller:
-      extra_args:
-        feature-gates: RotateKubeletServerCertificate=true
-        tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-    kubelet:
-      extra_args:
-        feature-gates: RotateKubeletServerCertificate=true
-        tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-      generate_serving_certificate: true
-    scheduler:
-      extra_args:
-        tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-```
-
-</TabItem>
-<TabItem value="v1.24 and Older">
-
-```yaml
-#
-# Cluster Config
-#
-default_pod_security_policy_template_id: restricted-noroot
-enable_network_policy: true
-local_cluster_auth_endpoint:
-  enabled: true
-name: # Define cluster name
-
-#
-# Rancher Config
-#
-rancher_kubernetes_engine_config:
-  addon_job_timeout: 45
-  authentication:
-    strategy: x509|webhook
-  kubernetes_version: # Define RKE version
-  services:
-    etcd:
-      uid: 52034
-      gid: 52034
-    kube-api:
-      audit_log:
-        enabled: true
-      event_rate_limit:
-        enabled: true
-      pod_security_policy: true
-      secrets_encryption_config:
-        enabled: true
-    kube-controller:
-      extra_args:
-        feature-gates: RotateKubeletServerCertificate=true
-        tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-    kubelet:
-      extra_args:
-        feature-gates: RotateKubeletServerCertificate=true
-        protect-kernel-defaults: true
-        tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-      generate_serving_certificate: true
-    scheduler:
-      extra_args:
-        tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-```
-
-</TabItem>
-</Tabs>
-
-## Conclusion
-
-If you have followed this guide, your RKE custom cluster provisioned by Rancher will be configured to pass the CIS Kubernetes Benchmark. You can review our RKE self-assessment guides to understand how we verified each of the benchmarks and how you can do the same on your cluster.
@@ -1,274 +0,0 @@
---
-title: RKE2 Hardening Guides
---
-
-<head>
-  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide"/>
-</head>
-
-This document provides prescriptive guidance for how to harden an RKE2 cluster intended for production, before provisioning it with Rancher. It outlines the configurations and controls required for Center for Information Security (CIS) Kubernetes benchmark controls.
-
-:::note
-This hardening guide describes how to secure the nodes in your cluster. We recommended that you follow this guide before you install Kubernetes.
-:::
-
-This hardening guide is intended to be used for RKE2 clusters and is associated with the following versions of the CIS Kubernetes Benchmark, Kubernetes, and Rancher:
-
-| Rancher Version | CIS Benchmark Version | Kubernetes Version           |
-|-----------------|-----------------------|------------------------------|
-| Rancher v2.7    | Benchmark v1.23       | Kubernetes v1.23             |
-| Rancher v2.7    | Benchmark v1.24       | Kubernetes v1.24             |
-| Rancher v2.7    | Benchmark v1.7        | Kubernetes v1.25 up to v1.26 |
-
-:::note
- In Benchmark v1.24 and later, some check ids might fail due to new file permission requirements (600 instead of 644). Impacted check ids: `1.1.1`, `1.1.3`, `1.1.5`, `1.1.7`, `1.1.13`, `1.1.15`, `1.1.17`, `4.1.3`, `4.1.5` and `4.1.9`. 
- - In Benchmark v1.7, the `--protect-kernel-defaults` (4.2.6) parameter is not required anymore, and was removed by CIS.
-:::
-
-For more details on how to evaluate a hardened RKE2 cluster against the official CIS benchmark, refer to the RKE2 self-assessment guides for specific Kubernetes and CIS benchmark versions.
-
-RKE2 passes a number of the Kubernetes CIS controls without modification, as it applies several security mitigations by default. There are some notable exceptions to this that require manual intervention to fully comply with the CIS Benchmark:
-
-1. RKE2 will not modify the host operating system. Therefore, you, the operator, must make a few host-level modifications.
-2. Certain CIS controls for Network Policies and Pod Security Standards (or Pod Security Policies (PSP) on RKE2 versions prior to v1.25) will restrict the functionality of the cluster. You must opt into having RKE2 configure these for you. To help ensure these requirements are met, RKE2 can be started with the profile flag set to `cis-1.23` for v1.25 and newer or `cis-1.6` for v1.24 and older.
-
-## Host-level requirements
-
-There are two areas of host-level requirements: kernel parameters and etcd process/directory configuration. These are outlined in this section.
-
-### Ensure `protect-kernel-defaults` is set
-
-<Tabs groupId="k3s-version">
-<TabItem value="v1.25 and Newer" default>
-
-The `protect-kernel-defaults` is no longer required since CIS benchmark 1.7.
-
-</TabItem>
-<TabItem value="v1.24 and Older">
-
-This is a kubelet flag that will cause the kubelet to exit if the required kernel parameters are unset or are set to values that are different from the kubelet's defaults.
-
-The `protect-kernel-defaults` flag can be set in the cluster configuration in Rancher.
-
-```yaml
-spec:
-  rkeConfig:
-    machineSelectorConfig:
-      - config:
-          protect-kernel-defaults: true
-```
-
-</TabItem>
-</Tabs>
-
-### Set kernel parameters
-
-The following `sysctl` configuration is recommended for all nodes type in the cluster. Set the following parameters in `/etc/sysctl.d/90-kubelet.conf`:
-
-```ini
-vm.panic_on_oom=0
-vm.overcommit_memory=1
-kernel.panic=10
-kernel.panic_on_oops=1
-```
-
-Run `sudo sysctl -p /etc/sysctl.d/90-kubelet.conf` to enable the settings.
-
-### Ensure etcd is configured properly
-
-The CIS Benchmark requires that the etcd data directory be owned by the `etcd` user and group. This implicitly requires the etcd process run as the host-level `etcd` user. To achieve this, RKE2 takes several steps when started with a valid `cis-1.xx` profile:
-
-1. Check that the `etcd` user and group exists on the host. If they don't, exit with an error.
-2. Create etcd's data directory with `etcd` as the user and group owner.
-3. Ensure the etcd process is ran as the `etcd` user and group by setting the etcd static pod's `SecurityContext` appropriately.
-
-To meet the above requirements, you must:
-
-#### Create the etcd user
-
-On some Linux distributions, the `useradd` command will not create a group. The `-U` flag is included below to account for that. This flag tells `useradd` to create a group with the same name as the user.
-
-```bash
-sudo useradd -r -c "etcd user" -s /sbin/nologin -M etcd -U
-```
-
-## Kubernetes runtime requirements
-
-The runtime requirements to pass the CIS Benchmark are centered around pod security, network policies and kernel parameters. Most of this is automatically handled by RKE2 when using a valid `cis-1.xx` profile, but some additional operator intervention is required. These are outlined in this section.
-
-### PodSecurity
-
-RKE2 always runs with some amount of pod security.
-
-<Tabs groupId="rke2-version">
-<TabItem value="v1.25 and Newer" default>
-
-On v1.25 and newer, [Pod Security Admissions (PSAs)](https://kubernetes.io/docs/concepts/security/pod-security-admission/) are used for pod security.
-
-Below is the minimum necessary configuration needed for hardening RKE2 to pass CIS v1.23 hardened profile `rke2-cis-1.7-hardened` available in Rancher.
-
-```yaml
-spec:
-  defaultPodSecurityAdmissionConfigurationTemplateName: rancher-restricted
-  rkeConfig:
-    machineSelectorConfig:
-      - config:
-          profile: cis-1.23
-```
-
-When both the `defaultPodSecurityAdmissionConfigurationTemplateName` and `profile` flags are set, Rancher and RKE2 does the following:
-
-1. Checks that host-level requirements have been met. If they haven't, RKE2 will exit with a fatal error describing the unmet requirements.
-2. Applies network policies that allow the cluster to pass associated controls.
-3. Configures the Pod Security Admission Controller with the PSA configuration template `rancher-restricted`, to enforce restricted mode in all namespaces, except the ones in the template's exemption list.
-   These namespaces are exempted to allow system pods to run without restrictions, which is required for proper operation of the cluster.
-
-:::note
-If you intend to import an RKE cluster into Rancher, please consult the [documentation](../../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md) for how to configure the PSA to exempt Rancher system namespaces.
-:::
-
-</TabItem>
-
-<TabItem value="v1.24 and Older">
-
-On Kubernetes v1.24 and older, the `PodSecurityPolicy` admission controller is always enabled.
-
-Below is the minimum necessary configuration needed for hardening RKE2 to pass CIS v1.23 hardened profile `rke2-cis-1.23-hardened` available in Rancher.
-
-:::note
-In the following example the profile is set to `cis-1.6` which is the value defined in the upstream RKE2, but the cluster is actually configured to pass the CIS v1.23 hardened profile
-:::
-
-```yaml
-spec:
-  defaultPodSecurityPolicyTemplateName: restricted-noroot
-  rkeConfig:
-    machineSelectorConfig:
-      - config:
-          profile: cis-1.6
-```
-
-
-When both the `defaultPodSecurityPolicyTemplateName` and `profile` flags are set, Rancher and RKE2 does the following:
-
-1. Checks that host-level requirements have been met. If they haven't, RKE2 will exit with a fatal error describing the unmet requirements.
-2. Applies network policies that allow the cluster to pass associated controls.
-3. Configures runtime pod security policies that allow the cluster to pass associated controls.
-
-</TabItem>
-</Tabs>
-
-:::note
-The Kubernetes control plane components and critical additions such as CNI, DNS, and Ingress are ran as pods in the `kube-system` namespace. Therefore, this namespace will have a policy that is less restrictive so that these components can run properly.
-:::
-
-### NetworkPolicies
-
-When ran with a valid `cis-1.xx` profile, RKE2 will put `NetworkPolicies` in place that passes the CIS Benchmark for Kubernetes' built-in namespaces. These namespaces are: `kube-system`, `kube-public`, `kube-node-lease`, and `default`.
-
-The `NetworkPolicy` used will only allow pods within the same namespace to talk to each other. The notable exception to this is that it allows DNS requests to be resolved.
-
-:::note
-Operators must manage network policies as normal for additional namespaces that are created.
-:::
-
-### Configure `default` service account
-
-**Set `automountServiceAccountToken` to `false` for `default` service accounts**
-
-Kubernetes provides a `default` service account which is used by cluster workloads where no specific service account is assigned to the pod. Where access to the Kubernetes API from a pod is required, a specific service account should be created for that pod, and rights granted to that service account. The `default` service account should be configured such that it does not provide a service account token and does not have any explicit rights assignments.
-
-For each namespace including `default` and `kube-system` on a standard RKE2 install, the `default` service account must include this value:
-
-```yaml
-automountServiceAccountToken: false
-```
-
-For namespaces created by the cluster operator, the following script and configuration file can be used to configure the `default` service account.
-
-The configuration bellow must be saved to a file called `account_update.yaml`.
-
-```yaml
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: default
-automountServiceAccountToken: false
-```
-
-Create a bash script file called `account_update.sh`. Be sure to `sudo chmod +x account_update.sh` so the script has execute permissions.
-
-```bash
-#!/bin/bash -e
-
-for namespace in $(kubectl get namespaces -A -o=jsonpath="{.items[*]['metadata.name']}"); do
-  echo -n "Patching namespace $namespace - "
-  kubectl patch serviceaccount default -n ${namespace} -p "$(cat account_update.yaml)"
-done
-```
-
-Execute this script to apply the `account_update.yaml` configuration to `default` service account in all namespaces.
-
-### API Server audit configuration
-
-CIS requirements 1.2.19 to 1.2.22 are related to configuring audit logs for the API Server. When RKE2 is started with the `profile` flag set, it will automatically configure hardened `--audit-log-` parameters in the API Server to pass those CIS checks.
-
-RKE2's default audit policy is configured to not log requests in the API Server. This is done to allow cluster operators flexibility to customize an audit policy that suits their auditing requirements and needs, as these are specific to each users' environment and policies.
-
-A default audit policy is created by RKE2 when started with the `profile` flag set. The policy is defined in `/etc/rancher/rke2/audit-policy.yaml`.
-
-```yaml
-apiVersion: audit.k8s.io/v1
-kind: Policy
-metadata:
-  creationTimestamp: null
-rules:
- level: None
-```
-
-## Reference Hardened RKE2 Template Configuration
-
-The reference template configuration is used in Rancher to create a hardened RKE2 custom cluster. This reference does not include other required **cluster configuration** directives which will vary depending on your environment.
-
-
-<Tabs groupId="rke2-version">
-<TabItem value="v1.25 and Newer" default>
-
-```yaml
-apiVersion: provisioning.cattle.io/v1
-kind: Cluster
-metadata:
-  name: # Define cluster name
-spec:
-  defaultPodSecurityAdmissionConfigurationTemplateName: rancher-restricted
-  kubernetesVersion: # Define RKE2 version
-  rkeConfig:
-    machineSelectorConfig:
-      - config:
-          profile: cis-1.23
-```
-</TabItem>
-
-<TabItem value="v1.24 and Older">
-
-```yaml
-apiVersion: provisioning.cattle.io/v1
-kind: Cluster
-metadata:
-  name: # Define cluster name
-spec:
-  defaultPodSecurityPolicyTemplateName: restricted-noroot
-  kubernetesVersion: # Define RKE2 version
-  rkeConfig:
-    machineSelectorConfig:
-      - config:
-          profile: cis-1.6
-          protect-kernel-defaults: true
-```
-
-</TabItem>
-</Tabs>
-
-## Conclusion
-
-If you have followed this guide, your RKE2 custom cluster provisioned by Rancher will be configured to pass the CIS Kubernetes Benchmark. You can review our RKE2 self-assessment guides to understand how we verified each of the benchmarks and how you can do the same on your cluster.
@@ -25,6 +25,6 @@ If you require such features, combine Layer 7 firewalls with [external authentic
 You should protect the following ports behind an [external load balancer](../../how-to-guides/new-user-guides/kubernetes-resources-setup/load-balancer-and-ingress-controller/layer-4-and-layer-7-load-balancing.md#layer-4-load-balancer) that has SSL offload enabled:

 - **K3s:** Port 6443, used by the Kubernetes API.
- **RKE and RKE2:** Port 6443, used by the Kubernetes API, and port 9345, used for node registration. 
+- **RKE2:** Port 6443, used by the Kubernetes API, and port 9345, used for node registration. 

 These ports have TLS SAN certificates which list nodes' public IP addresses. An attacker could use that information to gain unauthorized access or monitor activity on the cluster. Protecting these ports helps mitigate against nodes' public IP addresses being disclosed to potential attackers.
@@ -31,22 +31,14 @@ On this page, we provide security related documentation along with resources to

 NeuVector is an open-source, container-focused security application that is now integrated into Rancher. NeuVector provides production security, DevOps vulnerability protection, and a container firewall, et al. Please see the [Rancher docs](../../integrations-in-rancher/neuvector/neuvector.md) and the [NeuVector docs](https://open-docs.neuvector.com/) for more information.

-## Running a CIS Security Scan on a Kubernetes Cluster
+## Running a Compliance Security Scan on a Kubernetes Cluster

-Rancher leverages [kube-bench](https://github.com/aquasecurity/kube-bench) to run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the [CIS](https://www.cisecurity.org/cis-benchmarks/) (Center for Internet Security) Kubernetes Benchmark.
+Rancher leverages [kube-bench](https://github.com/aquasecurity/kube-bench) to run a security scan to check whether Kubernetes is deployed according to security best practices.

-The CIS Kubernetes Benchmark is a reference document that can be used to establish a secure configuration baseline for Kubernetes.
-
-The Center for Internet Security (CIS) is a 501(c\)(3) non-profit organization, formed in October 2000, with a mission to "identify, develop, validate, promote, and sustain best practice solutions for cyber defense and build and lead communities to enable an environment of trust in cyberspace".
-
-CIS Benchmarks are best practices for the secure configuration of a target system. CIS Benchmarks are developed through the generous volunteer efforts of subject matter experts, technology vendors, public and private community members, and the CIS Benchmark Development team.
-
-The Benchmark provides recommendations of two types: Automated and Manual. We run tests related to only Automated recommendations.
-
-When Rancher runs a CIS security scan on a cluster, it generates a report showing the results of each test, including a summary with the number of passed, skipped and failed tests. The report also includes remediation steps for any failed tests.
-
-For details, refer to the section on [security scans](../../how-to-guides/advanced-user-guides/cis-scan-guides/cis-scan-guides.md).
+When Rancher runs a Compliance scan on a cluster, it generates a report showing the results of each test, including a summary with the number of passed, skipped and failed tests. The report also includes remediation steps for any failed tests.

+For details, refer to the section on [security scans](../../how-to-guides/advanced-user-guides/compliance-scan-guides/compliance-scan-guides.md).
+`
 ## SELinux RPM

 [Security-Enhanced Linux (SELinux)](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) is a security enhancement to Linux. After being historically used by government agencies, SELinux is now industry standard and is enabled by default on CentOS 7 and 8.
@@ -67,7 +59,7 @@ Each version of the hardening guide is intended to be used with specific version

 The benchmark self-assessment is a companion to the Rancher security hardening guide. While the hardening guide shows you how to harden the cluster, the benchmark guide is meant to help you evaluate the level of security of the hardened cluster.

-Because Rancher and RKE install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark don't apply. This guide will walk through the various controls and provide updated example commands to audit compliance in Rancher created clusters. The original benchmark documents can be downloaded from the [CIS website](https://www.cisecurity.org/benchmark/kubernetes/).
+This guide walks through the various controls and provide updated example commands to audit compliance in Rancher created clusters. The original benchmark documents can be downloaded from the [CIS website](https://www.cisecurity.org/benchmark/kubernetes/).

 Each version of Rancher's self-assessment guide corresponds to specific versions of the hardening guide, Rancher, Kubernetes, and the CIS Benchmark.

@@ -44,7 +44,7 @@ Rancher is committed to informing the community of security issues in our produc
 | [CVE-2022-31247](https://github.com/rancher/rancher/security/advisories/GHSA-6x34-89p7-95wg) | An issue was discovered in Rancher versions up to and including 2.5.15 and 2.6.6 where a flaw with authorization logic allows privilege escalation in downstream clusters through cluster role template binding (CRTB) and project role template binding (PRTB). The vulnerability can be exploited by any user who has permissions to create/edit CRTB or PRTB (such as `cluster-owner`, `manage cluster members`, `project-owner`, and `manage project members`) to gain owner permission in another project in the same cluster or in another project on a different downstream cluster. | 18 August 2022 | [Rancher v2.6.7](https://github.com/rancher/rancher/releases/tag/v2.6.7) and [Rancher v2.5.16](https://github.com/rancher/rancher/releases/tag/v2.5.16) |
 | [CVE-2021-36783](https://github.com/rancher/rancher/security/advisories/GHSA-8w87-58w6-hfv8) | It was discovered that in Rancher versions up to and including 2.5.12 and 2.6.3, there is a failure to properly sanitize credentials in cluster template answers. This failure can lead to plaintext storage and exposure of credentials, passwords, and API tokens. The exposed credentials are visible in Rancher to authenticated `Cluster Owners`, `Cluster Members`, `Project Owners`, and `Project Members` on the endpoints `/v1/management.cattle.io.clusters`, `/v3/clusters`, and `/k8s/clusters/local/apis/management.cattle.io/v3/clusters`. | 18 August 2022 | [Rancher v2.6.7](https://github.com/rancher/rancher/releases/tag/v2.6.7) and [Rancher v2.5.16](https://github.com/rancher/rancher/releases/tag/v2.5.16) |
 | [CVE-2021-36782](https://github.com/rancher/rancher/security/advisories/GHSA-g7j7-h4q8-8w2f) | An issue was discovered in Rancher versions up to and including 2.5.15 and 2.6.6 where sensitive fields like passwords, API keys, and Rancher's service account token (used to provision clusters) were stored in plaintext directly on Kubernetes objects like `Clusters` (e.g., `cluster.management.cattle.io`). Anyone with read access to those objects in the Kubernetes API could retrieve the plaintext version of those sensitive data. The issue was partially found and reported by Florian Struck (from [Continum AG](https://www.continum.net/)) and [Marco Stuurman](https://github.com/fe-ax) (from [Shock Media B.V.](https://www.shockmedia.nl/)). | 18 August 2022 | [Rancher v2.6.7](https://github.com/rancher/rancher/releases/tag/v2.6.7) and [Rancher v2.5.16](https://github.com/rancher/rancher/releases/tag/v2.5.16) |
-| [CVE-2022-21951](https://github.com/rancher/rancher/security/advisories/GHSA-vrph-m5jj-c46c) | This vulnerability only affects customers using [Weave](../../faq/container-network-interface-providers.md#weave) Container Network Interface (CNI) when configured through [RKE templates](../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md). A vulnerability was discovered in Rancher versions 2.5.0 up to and including 2.5.13, and 2.6.0 up to and including 2.6.4, where a user interface (UI) issue with RKE templates does not include a value for the Weave password when Weave is chosen as the CNI. If a cluster is created based on the mentioned template, and Weave is configured as the CNI, no password will be created for [network encryption](https://github.com/weaveworks/weave/blob/master/site/tasks/manage/security-untrusted-networks.md) in Weave; therefore, network traffic in the cluster will be sent unencrypted. | 24 May 2022 | [Rancher v2.6.5](https://github.com/rancher/rancher/releases/tag/v2.6.5) and [Rancher v2.5.14](https://github.com/rancher/rancher/releases/tag/v2.5.14) |
+| [CVE-2022-21951](https://github.com/rancher/rancher/security/advisories/GHSA-vrph-m5jj-c46c) | This vulnerability only affects customers using Weave Container Network Interface (CNI) when configured through [RKE templates](../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md). A vulnerability was discovered in Rancher versions 2.5.0 up to and including 2.5.13, and 2.6.0 up to and including 2.6.4, where a user interface (UI) issue with RKE templates does not include a value for the Weave password when Weave is chosen as the CNI. If a cluster is created based on the mentioned template, and Weave is configured as the CNI, no password will be created for [network encryption](https://github.com/weaveworks/weave/blob/master/site/tasks/manage/security-untrusted-networks.md) in Weave; therefore, network traffic in the cluster will be sent unencrypted. | 24 May 2022 | [Rancher v2.6.5](https://github.com/rancher/rancher/releases/tag/v2.6.5) and [Rancher v2.5.14](https://github.com/rancher/rancher/releases/tag/v2.5.14) |
 | [CVE-2021-36784](https://github.com/rancher/rancher/security/advisories/GHSA-jwvr-vv7p-gpwq) | A vulnerability was discovered in Rancher versions from 2.5.0 up to and including 2.5.12 and from 2.6.0 up to and including 2.6.3 which allows users who have create or update permissions on [Global Roles](../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/manage-role-based-access-control-rbac.md) to escalate their permissions, or those of another user, to admin-level permissions. Global Roles grant users Rancher-wide permissions, such as the ability to create clusters. In the identified versions of Rancher, when users are given permission to edit or create Global Roles, they are not restricted to only granting permissions which they already posses. This vulnerability affects customers who utilize non-admin users that are able to create or edit Global Roles. The most common use case for this scenario is the `restricted-admin` role. | 14 Apr 2022 | [Rancher v2.6.4](https://github.com/rancher/rancher/releases/tag/v2.6.4) and [Rancher v2.5.13](https://github.com/rancher/rancher/releases/tag/v2.5.13) |
 | [CVE-2021-4200](https://github.com/rancher/rancher/security/advisories/GHSA-hx8w-ghh8-r4xf) | This vulnerability only affects customers using the `restricted-admin` role in Rancher. A vulnerability was discovered in Rancher versions from 2.5.0 up to and including 2.5.12 and from 2.6.0 up to and including 2.6.3 where the `global-data` role in `cattle-global-data` namespace grants write access to the Catalogs. Since each user with any level of catalog access was bound to the `global-data` role, this grants write access to templates (`CatalogTemplates`) and template versions (`CatalogTemplateVersions`) for any user with any level of catalog access. New users created in Rancher are by default assigned to the `user` role (standard user), which is not designed to grant write catalog access. This vulnerability effectively elevates the privilege of any user to write access for the catalog template and catalog template version resources. | 14 Apr 2022 | [Rancher v2.6.4](https://github.com/rancher/rancher/releases/tag/v2.6.4) and [Rancher v2.5.13](https://github.com/rancher/rancher/releases/tag/v2.5.13) |
 | [GHSA-wm2r-rp98-8pmh](https://github.com/rancher/rancher/security/advisories/GHSA-wm2r-rp98-8pmh) | This vulnerability only affects customers using [Continuous Delivery with Fleet](../../integrations-in-rancher/fleet/fleet.md) for continuous delivery with authenticated Git and/or Helm repositories. An issue was discovered in `go-getter` library in versions prior to [`v1.5.11`](https://github.com/hashicorp/go-getter/releases/tag/v1.5.11) that exposes SSH private keys in base64 format due to a failure in redacting such information from error messages. The vulnerable version of this library is used in Rancher through Fleet in versions of Fleet prior to [`v0.3.9`](https://github.com/rancher/fleet/releases/tag/v0.3.9). This issue affects Rancher versions 2.5.0 up to and including 2.5.12 and from 2.6.0 up to and including 2.6.3. The issue was found and reported by Dagan Henderson from Raft Engineering. | 14 Apr 2022 | [Rancher v2.6.4](https://github.com/rancher/rancher/releases/tag/v2.6.4) and [Rancher v2.5.13](https://github.com/rancher/rancher/releases/tag/v2.5.13) |
@@ -20,10 +20,7 @@ Each Rancher version is designed to be compatible with a single version of the w

 | Rancher Version | Webhook Version | Availability in Prime | Availability in Community |
 |-----------------|-----------------|-----------------------|---------------------------|
-| v2.11.3         |     v0.7.3      | &check;               | &check;                   |
-| v2.11.2         |     v0.7.2      | &check;               | &check;                   |
-| v2.11.1         |     v0.7.1      | &check;               | &check;                   |
-| v2.11.0         |     v0.7.0      | &cross;               | &check;                   |
+| v2.12.0         |     v0.8.0      | &cross;               | &check;                   |

 ## Why Do We Need It?

@@ -44,6 +44,7 @@ Privileged access is [required.](../../getting-started/installation-and-upgrade/
 docker run -d --restart=unless-stopped \
  -p 80:80 -p 443:443 \
  -v /var/log/rancher/auditlog:/var/log/auditlog \
+  -e AUDIT_LOG_ENABLED=true \
  -e AUDIT_LEVEL=1 \
  --privileged \
  rancher/rancher:latest
@@ -8,7 +8,7 @@
 | [Managing Projects, Namespaces and Workloads](../how-to-guides/new-user-guides/manage-clusters/projects-and-namespaces.md) | ✓ | ✓ | ✓ | ✓ |
 | [Using App Catalogs](../how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md) | ✓ | ✓ | ✓ | ✓ |
 | Configuring Tools ([Alerts, Notifiers, Monitoring](../integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md), [Logging](../integrations-in-rancher/logging/logging.md), [Istio](../integrations-in-rancher/istio/istio.md)) | ✓ | ✓ | ✓ | ✓ |
-| [Running Security Scans](../how-to-guides/advanced-user-guides/cis-scan-guides/cis-scan-guides.md) | ✓ | ✓ | ✓ | ✓ |
+| [Running Security Scans](../how-to-guides/advanced-user-guides/compliance-scan-guides/compliance-scan-guides.md) | ✓ | ✓ | ✓ | ✓ |
 | [Ability to rotate certificates](../how-to-guides/new-user-guides/manage-clusters/rotate-certificates.md) | ✓ | ✓  |  | |
 | Ability to [backup](../how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/back-up-rancher-launched-kubernetes-clusters.md) and [restore](../how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/restore-rancher-launched-kubernetes-clusters-from-backup.md) Rancher-launched clusters | ✓ | ✓ |  | ✓<sup>4</sup> |
 | [Cleaning Kubernetes components when clusters are no longer reachable from Rancher](../how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md) | ✓ | | | |
--- a/Show More
+++ b/Show More