+
+1. Select **Enter data about the relying party manually** as the option for obtaining data about the relying party.
+
+ 
+
+1. Enter your desired **Display name** for your Relying Party Trust. For example, `Rancher`.
+
+ 
+
+1. Select **AD FS profile** as the configuration profile for your relying party trust.
+
+ 
+
+1. Leave the **optional token encryption certificate** empty, as Rancher AD FS will not be using one.
+
+ 
+
+1. Select **Enable support for the SAML 2.0 WebSSO protocol**
+ and enter `https://
+
+1. Add `https://
+
+1. This tutorial will not cover multi-factor authentication; please refer to the [Microsoft documentation](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs) if you would like to configure multi-factor authentication.
+
+ 
+
+1. From **Choose Issuance Authorization RUles**, you may select either of the options available according to use case. However, for the purposes of this guide, select **Permit all users to access this relying party**.
+
+ 
+
+1. After reviewing your settings, select **Next** to add the relying party trust.
+
+ 
+
+
+1. Select **Open the Edit Claim Rules...** and click **Close**.
+
+ 
+
+1. On the **Issuance Transform Rules** tab, click **Add Rule...**.
+
+ 
+
+1. Select **Send LDAP Attributes as Claims** as the **Claim rule template**.
+
+ 
+
+1. Set the **Claim rule name** to your desired name (for example, `Rancher Attributes`) and select **Active Directory** as the **Attribute store**. Create the following mapping to reflect the table below:
+
+ | LDAP Attribute | Outgoing Claim Type |
+ | -------------------------------------------- | ------------------- |
+ | Given-Name | Given Name |
+ | User-Principal-Name | UPN |
+ | Token-Groups - Qualified by Long Domain Name | Group |
+ | SAM-Account-Name | Name |
+ +
+
+1. Download the `federationmetadata.xml` from your AD server at:
+```
+https://Example: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname` | + | User Name Field | The AD attribute that contains the user name/given name.
Example: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name` | + | UID Field | An AD attribute that is unique to every user.
Example: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn` | + | Groups Field | Make entries for managing group memberships.
Example: `http://schemas.xmlsoap.org/claims/Group` | + | Rancher API Host | The URL for your Rancher Server. | + | Private Key / Certificate | This is a key-certificate pair to create a secure shell between Rancher and your AD FS. Ensure you set the Common Name (CN) to your Rancher Server URL.
[Certificate creation command](#cert-command) | + | Metadata XML | The `federationmetadata.xml` file exported from your AD FS server.
You can find this file at `https://
+ +You can obtain `
+ +You can obtain `
- -#### Nodes - -{{< requirements_hardware >}}
- -#### Software - -{{< requirements_software >}} - -{{< note_server-tags >}} - -#### Ports - -{{< requirements_ports_rancher_rke >}} - -
- -If you block ports internally on the nodes see the full [ports list]({{< baseurl >}}/rancher/v2.x/en/installation/references/) for all the communication details. +View the requirements for nodes hosting Rancher at [Requirements]({{< baseurl >}}/rancher/v2.x/en/installation/requirements). ### Load Balancer diff --git a/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md b/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md index 474722860dc..0e0c7cc90a6 100644 --- a/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md +++ b/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md @@ -13,6 +13,8 @@ Use `helm repo add` to add the Rancher chart repository. helm repo add rancher-stable https://releases.rancher.com/server-charts/stable ``` +For additional chart details, view the [source of these Rancher server charts](https://github.com/rancher/server-chart). + ### Install cert-manager > **Note:** cert-manager is only required for Rancher generated and LetsEncrypt issued certificates. You may skip this step if you are bringing your own certificates and using the `ingress.tls.source=secret` option. diff --git a/content/rancher/v2.x/en/installation/ha/kubernetes-rke/_index.md b/content/rancher/v2.x/en/installation/ha/kubernetes-rke/_index.md index 9df59191d0d..e04cf8d293b 100644 --- a/content/rancher/v2.x/en/installation/ha/kubernetes-rke/_index.md +++ b/content/rancher/v2.x/en/installation/ha/kubernetes-rke/_index.md @@ -9,15 +9,20 @@ Use RKE to install Kubernetes with a high-availability etcd configuration. Using the sample below create the `rancher-cluster.yml` file. Replace the IP Addresses in the `nodes` list with the IP address or DNS names of the 3 Nodes you created. +> **Note:** If your node has public and internal addresses, it is recommended to set the `internal_address:` so Kubernetes will use it for intra-cluster communication. Some services like AWS EC2 require setting the `internal_address:` if you want to use self-referencing security groups or firewalls. + ```yaml nodes: - address: 165.227.114.63 + internal_address: 172.16.22.12 user: ubuntu role: [controlplane,worker,etcd] - address: 165.227.116.167 + internal_address: 172.16.32.37 user: ubuntu role: [controlplane,worker,etcd] - address: 165.227.127.226 + internal_address: 172.16.42.73 user: ubuntu role: [controlplane,worker,etcd] ``` diff --git a/content/rancher/v2.x/en/installation/ha/rke-add-on/layer-4-lb/_index.md b/content/rancher/v2.x/en/installation/ha/rke-add-on/layer-4-lb/_index.md index 86685653fde..bb6f251614d 100644 --- a/content/rancher/v2.x/en/installation/ha/rke-add-on/layer-4-lb/_index.md +++ b/content/rancher/v2.x/en/installation/ha/rke-add-on/layer-4-lb/_index.md @@ -4,11 +4,14 @@ weight: 275 aliases: - /rancher/v2.x/en/installation/ha-server-install/ --- -This set of instructions creates a new Kubernetes cluster that's dedicated to running Rancher in a high-availability (HA) configuration. This procedure walks you through setting up a 3-node cluster using the Rancher Kubernetes Engine (RKE). The cluster's sole purpose is running pods for Rancher. The setup is based on: +This procedure walks you through setting up a 3-node cluster using the Rancher Kubernetes Engine (RKE). The cluster's sole purpose is running pods for Rancher. The setup is based on: - Layer 4 load balancer (TCP) - [NGINX ingress controller with SSL termination (HTTPS)](https://kubernetes.github.io/ingress-nginx/) + +In a HA setup that uses a layer 4 load balancer, the load balancer accepts Rancher client connections over the TCP/UDP protocols (i.e., the transport level). The load balancer then forwards these connections to individual cluster nodes without reading the request itself. Because the load balancer cannot read the packets it's forwarding, the routing decisions it can make are limited. +HA Rancher install with layer 4 load balancer, depicting SSL termination at ingress controllers  ## Installation Outline @@ -36,29 +39,7 @@ Installation of Rancher in a high-availability configuration involves multiple p ## 1. Provision Linux Hosts -Before you install Rancher, confirm you meet the host requirements. Provision 3 new Linux hosts using the requirements below. - -### Host Requirements - -#### Operating System - -{{< requirements_os >}} - -#### Hardware - -{{< requirements_hardware >}} - -#### Software - -{{< requirements_software >}} - -{{< note_server-tags >}} - -#### Ports - -The following diagram depicts the basic port requirements for Rancher. For a comprehensive list, see [Port Requirements]({{< baseurl >}}/rancher/v2.x/en/installation/references/). - - +Provision three Linux hosts according to our [Requirements]({{< baseurl >}}/rancher/v2.x/en/installation/requirements). ## 2. Configure Load Balancer @@ -200,12 +181,14 @@ RKE uses a `.yml` config file to install and configure your Kubernetes cluster. 1. Download one of following templates, depending on the SSL certificate you're using. - - [Template for self-signed certificate
`3-node-certificate.yml`](https://raw.githubusercontent.com/rancher/rancher/e9d29b3f3b9673421961c68adf0516807d1317eb/rke-templates/3-node-certificate.yml) - - [Template for certificate signed by recognized CA
`3-node-certificate-recognizedca.yml`](https://raw.githubusercontent.com/rancher/rancher/d8ca0805a3958552e84fdf5d743859097ae81e0b/rke-templates/3-node-certificate-recognizedca.yml) + - [Template for self-signed certificate
`3-node-certificate.yml`](https://raw.githubusercontent.com/rancher/rancher/master/rke-templates/3-node-certificate.yml) + - [Template for certificate signed by recognized CA
`3-node-certificate-recognizedca.yml`](https://raw.githubusercontent.com/rancher/rancher/master/rke-templates/3-node-certificate-recognizedca.yml) + + >**Advanced Config Options:** + > + >- Want records of all transactions with the Rancher API? Enable the [API Auditing]({{< baseurl >}}/rancher/v2.x/en/installation/api-auditing) feature by editing your RKE config file. For more information, see [RKE Documentation: API Auditing]({{< baseurl >}}/rke/v0.1.x/en/config-options/add-ons/api-auditing). + >- Want to know the other config options available for your RKE template? See the [RKE Documentation: Config Options]({{< baseurl >}}/rke/v0.1.x/en/config-options/). - >**Want records of all transactions with the Rancher API?** - > - >Enable the [API Auditing]({{< baseurl >}}/rancher/v2.x/en/installation/api-auditing/) feature by editing your RKE config file. For more information, see [RKE Documentation: API Auditing]({{< baseurl >}}/rke/v0.1.x/en/config-options/add-ons/api-auditing/). 2. Rename the file to `rancher-cluster.yml`. @@ -215,33 +198,37 @@ Once you have the `rancher-cluster.yml` config file template, edit the nodes sec 1. Open `rancher-cluster.yml` in your favorite text editor. -2. Update the `nodes` section with the information of your [Linux hosts](#1-provision-linux-hosts). +1. Update the `nodes` section with the information of your [Linux hosts](#1-provision-linux-hosts). For each node in your cluster, update the following placeholders: `IP_ADDRESS_X` and `USER`. The specified user should be able to access the Docket socket, you can test this by logging in with the specified user and run `docker ps`. >**Note:** - > When using RHEL/CentOS, the SSH user can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565. See [Operating System Requirements]({{< baseurl >}}/rke/v0.1.x/en/installation/os#redhat-enterprise-linux-rhel-centos) for RHEL/CentOS specific requirements. + > When using RHEL/CentOS, the SSH user can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565. See [Operating System Requirements]({{< baseurl >}}/rke/v0.1.x/en/installation/os#redhat-enterprise-linux-rhel-centos) >for RHEL/CentOS specific requirements. + nodes: + # The IP address or hostname of the node + - address: IP_ADDRESS_1 + # User that can login to the node and has access to the Docker socket (i.e. can execute `docker ps` on the node) + # When using RHEL/CentOS, this can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565 + user: USER + role: [controlplane,etcd,worker] + # Path the SSH key that can be used to access to node with the specified user + ssh_key_path: ~/.ssh/id_rsa + - address: IP_ADDRESS_2 + user: USER + role: [controlplane,etcd,worker] + ssh_key_path: ~/.ssh/id_rsa + - address: IP_ADDRESS_3 + user: USER + role: [controlplane,etcd,worker] + ssh_key_path: ~/.ssh/id_rsa + +1. **Optional:** By default, `rancher-cluster.yml` is configured to take backup snapshots of your data. To disable these snapshots, change the `backup` directive setting to `false`, as depicted below. + + services: + etcd: + backup: false -``` -nodes: - # The IP address or hostname of the node - - address: IP_ADDRESS_1 - # User that can login to the node and has access to the Docker socket (i.e. can execute `docker ps` on the node) - # When using RHEL/CentOS, this can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565 - user: USER - role: [controlplane,etcd,worker] - # Path the SSH key that can be used to access to node with the specified user - ssh_key_path: ~/.ssh/id_rsa - - address: IP_ADDRESS_2 - user: USER - role: [controlplane,etcd,worker] - ssh_key_path: ~/.ssh/id_rsa - - address: IP_ADDRESS_3 - user: USER - role: [controlplane,etcd,worker] - ssh_key_path: ~/.ssh/id_rsa -``` ## 7. Configure Certificates @@ -249,10 +236,7 @@ For security purposes, SSL (Secure Sockets Layer) is required when using Rancher Choose from the following options: -- [Option A—Bring Your Own Certificate: Self-Signed](#option-a-bring-your-own-certificate-self-signed) -- [Option B—Bring Your Own Certificate: Signed by Recognized CA](#option-b-bring-your-own-certificate-signed-by-recognized-ca) - -### Option A—Bring Your Own Certificate: Self-Signed +{{% accordion id="option-a" label="Option A—Bring Your Own Certificate: Self-Signed" %}} >**Prerequisites:** >Create a self-signed certificate. @@ -269,20 +253,20 @@ Choose from the following options: >**Note:** > The base64 encoded string should be on the same line as `tls.crt` or `tls.key`, without any newline at the beginning, in between or at the end. - **Result:** After replacing the values, the file should look like the example below (the base64 encoded strings should be different): + **Step Result:** After replacing the values, the file should look like the example below (the base64 encoded strings should be different): -```yaml ---- - apiVersion: v1 - kind: Secret - metadata: - name: cattle-keys-ingress - namespace: cattle-system - type: Opaque - data: - tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM1RENDQWN5Z0F3SUJBZ0lKQUlHc25NeG1LeGxLTUEwR0NTcUdTSWIzRFFFQkN3VUFNQkl4RURBT0JnTlYKQkFNTUIzUmxjM1F0WTJFd0hoY05NVGd3TlRBMk1qRXdOREE1V2hjTk1UZ3dOekExTWpFd05EQTVXakFXTVJRdwpFZ1lEVlFRRERBdG9ZUzV5Ym1Ob2NpNXViRENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DCmdnRUJBTFJlMXdzekZSb2Rib2pZV05DSHA3UkdJaUVIMENDZ1F2MmdMRXNkUUNKZlcrUFEvVjM0NnQ3bSs3TFEKZXJaV3ZZMWpuY2VuWU5JSGRBU0VnU0ducWExYnhUSU9FaE0zQXpib3B0WDhjSW1OSGZoQlZETGdiTEYzUk0xaQpPM1JLTGdIS2tYSTMxZndjbU9zWGUwaElYQnpUbmxnM20vUzlXL3NTc0l1dDVwNENDUWV3TWlpWFhuUElKb21lCmpkS3VjSHFnMTlzd0YvcGVUalZrcVpuMkJHazZRaWFpMU41bldRV0pjcThTenZxTTViZElDaWlwYU9hWWQ3RFEKYWRTejV5dlF0YkxQNW4wTXpnOU43S3pGcEpvUys5QWdkWDI5cmZqV2JSekp3RzM5R3dRemN6VWtLcnZEb05JaQo0UFJHc01yclFNVXFSYjRSajNQOEJodEMxWXNDQXdFQUFhTTVNRGN3Q1FZRFZSMFRCQUl3QURBTEJnTlZIUThFCkJBTUNCZUF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdJR0NDc0dBUVVGQndNQk1BMEdDU3FHU0liM0RRRUIKQ3dVQUE0SUJBUUNKZm5PWlFLWkowTFliOGNWUW5Vdi9NZkRZVEJIQ0pZcGM4MmgzUGlXWElMQk1jWDhQRC93MgpoOUExNkE4NGNxODJuQXEvaFZYYy9JNG9yaFY5WW9jSEg5UlcvbGthTUQ2VEJVR0Q1U1k4S292MHpHQ1ROaDZ6Ci9wZTNqTC9uU0pYSjRtQm51czJheHFtWnIvM3hhaWpYZG9kMmd3eGVhTklvRjNLbHB2aGU3ZjRBNmpsQTM0MmkKVVlCZ09iN1F5KytRZWd4U1diSmdoSzg1MmUvUUhnU2FVSkN6NW1sNGc1WndnNnBTUXhySUhCNkcvREc4dElSYwprZDMxSk1qY25Fb1Rhc1Jyc1NwVmNGdXZyQXlXN2liakZyYzhienBNcE1obDVwYUZRcEZzMnIwaXpZekhwakFsCk5ZR2I2OHJHcjBwQkp3YU5DS2ErbCtLRTk4M3A3NDYwCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K - tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBdEY3WEN6TVZHaDF1aU5oWTBJZW50RVlpSVFmUUlLQkMvYUFzU3gxQUlsOWI0OUQ5ClhmanEzdWI3c3RCNnRsYTlqV09keDZkZzBnZDBCSVNCSWFlcHJWdkZNZzRTRXpjRE51aW0xZnh3aVkwZCtFRlUKTXVCc3NYZEV6V0k3ZEVvdUFjcVJjamZWL0J5WTZ4ZDdTRWhjSE5PZVdEZWI5TDFiK3hLd2k2M21uZ0lKQjdBeQpLSmRlYzhnbWlaNk4wcTV3ZXFEWDJ6QVgrbDVPTldTcG1mWUVhVHBDSnFMVTNtZFpCWWx5cnhMTytvemx0MGdLCktLbG81cGgzc05CcDFMUG5LOUMxc3MvbWZRek9EMDNzck1Xa21oTDcwQ0IxZmIydCtOWnRITW5BYmYwYkJETnoKTlNRcXU4T2cwaUxnOUVhd3l1dEF4U3BGdmhHUGMvd0dHMExWaXdJREFRQUJBb0lCQUJKYUErOHp4MVhjNEw0egpwUFd5bDdHVDRTMFRLbTNuWUdtRnZudjJBZXg5WDFBU2wzVFVPckZyTnZpK2xYMnYzYUZoSFZDUEN4N1RlMDVxClhPa2JzZnZkZG5iZFQ2RjgyMnJleVByRXNINk9TUnBWSzBmeDVaMDQwVnRFUDJCWm04eTYyNG1QZk1vbDdya2MKcm9Kd09rOEVpUHZZekpsZUd0bTAwUm1sRysyL2c0aWJsOTVmQXpyc1MvcGUyS3ZoN2NBVEtIcVh6MjlpUmZpbApiTGhBamQwcEVSMjNYU0hHR1ZqRmF3amNJK1c2L2RtbDZURDhrSzFGaUtldmJKTlREeVNXQnpPbXRTYUp1K01JCm9iUnVWWG4yZVNoamVGM1BYcHZRMWRhNXdBa0dJQWxOWjRHTG5QU2ZwVmJyU0plU3RrTGNzdEJheVlJS3BWZVgKSVVTTHM0RUNnWUVBMmNnZUE2WHh0TXdFNU5QWlNWdGhzbXRiYi9YYmtsSTdrWHlsdk5zZjFPdXRYVzkybVJneQpHcEhUQ0VubDB0Z1p3T081T1FLNjdFT3JUdDBRWStxMDJzZndwcmgwNFZEVGZhcW5QNTBxa3BmZEJLQWpmanEyCjFoZDZMd2hLeDRxSm9aelp2VkowV0lvR1ZLcjhJSjJOWGRTUVlUanZUZHhGczRTamdqNFFiaEVDZ1lFQTFBWUUKSEo3eVlza2EvS2V2OVVYbmVrSTRvMm5aYjJ1UVZXazRXSHlaY2NRN3VMQVhGY3lJcW5SZnoxczVzN3RMTzJCagozTFZNUVBzazFNY25oTTl4WE4vQ3ZDTys5b2t0RnNaMGJqWFh6NEJ5V2lFNHJPS1lhVEFwcDVsWlpUT3ZVMWNyCm05R3NwMWJoVDVZb2RaZ3IwUHQyYzR4U2krUVlEWnNFb2lFdzNkc0NnWUVBcVJLYWNweWZKSXlMZEJjZ0JycGkKQTRFalVLMWZsSjR3enNjbGFKUDVoM1NjZUFCejQzRU1YT0kvSXAwMFJsY3N6em83N3cyMmpud09mOEJSM0RBMwp6ZTRSWDIydWw4b0hGdldvdUZOTTNOZjNaNExuYXpVc0F0UGhNS2hRWGMrcEFBWGthUDJkZzZ0TU5PazFxaUNHCndvU212a1BVVE84b1ViRTB1NFZ4ZmZFQ2dZQUpPdDNROVNadUlIMFpSSitIV095enlOQTRaUEkvUkhwN0RXS1QKajVFS2Y5VnR1OVMxY1RyOTJLVVhITXlOUTNrSjg2OUZPMnMvWk85OGg5THptQ2hDTjhkOWN6enI5SnJPNUFMTApqWEtBcVFIUlpLTFgrK0ZRcXZVVlE3cTlpaHQyMEZPb3E5OE5SZDMzSGYxUzZUWDNHZ3RWQ21YSml6dDAxQ3ZHCmR4VnVnd0tCZ0M2Mlp0b0RLb3JyT2hvdTBPelprK2YwQS9rNDJBOENiL29VMGpwSzZtdmxEWmNYdUF1QVZTVXIKNXJCZjRVYmdVYndqa1ZWSFR6LzdDb1BWSjUvVUxJWk1Db1RUNFprNTZXWDk4ZE93Q3VTVFpZYnlBbDZNS1BBZApTZEpuVVIraEpnSVFDVGJ4K1dzYnh2d0FkbWErWUhtaVlPRzZhSklXMXdSd1VGOURLUEhHCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== -``` + ```yaml + --- + apiVersion: v1 + kind: Secret + metadata: + name: cattle-keys-ingress + namespace: cattle-system + type: Opaque + data: + tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM1RENDQWN5Z0F3SUJBZ0lKQUlHc25NeG1LeGxLTUEwR0NTcUdTSWIzRFFFQkN3VUFNQkl4RURBT0JnTlYKQkFNTUIzUmxjM1F0WTJFd0hoY05NVGd3TlRBMk1qRXdOREE1V2hjTk1UZ3dOekExTWpFd05EQTVXakFXTVJRdwpFZ1lEVlFRRERBdG9ZUzV5Ym1Ob2NpNXViRENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DCmdnRUJBTFJlMXdzekZSb2Rib2pZV05DSHA3UkdJaUVIMENDZ1F2MmdMRXNkUUNKZlcrUFEvVjM0NnQ3bSs3TFEKZXJaV3ZZMWpuY2VuWU5JSGRBU0VnU0ducWExYnhUSU9FaE0zQXpib3B0WDhjSW1OSGZoQlZETGdiTEYzUk0xaQpPM1JLTGdIS2tYSTMxZndjbU9zWGUwaElYQnpUbmxnM20vUzlXL3NTc0l1dDVwNENDUWV3TWlpWFhuUElKb21lCmpkS3VjSHFnMTlzd0YvcGVUalZrcVpuMkJHazZRaWFpMU41bldRV0pjcThTenZxTTViZElDaWlwYU9hWWQ3RFEKYWRTejV5dlF0YkxQNW4wTXpnOU43S3pGcEpvUys5QWdkWDI5cmZqV2JSekp3RzM5R3dRemN6VWtLcnZEb05JaQo0UFJHc01yclFNVXFSYjRSajNQOEJodEMxWXNDQXdFQUFhTTVNRGN3Q1FZRFZSMFRCQUl3QURBTEJnTlZIUThFCkJBTUNCZUF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdJR0NDc0dBUVVGQndNQk1BMEdDU3FHU0liM0RRRUIKQ3dVQUE0SUJBUUNKZm5PWlFLWkowTFliOGNWUW5Vdi9NZkRZVEJIQ0pZcGM4MmgzUGlXWElMQk1jWDhQRC93MgpoOUExNkE4NGNxODJuQXEvaFZYYy9JNG9yaFY5WW9jSEg5UlcvbGthTUQ2VEJVR0Q1U1k4S292MHpHQ1ROaDZ6Ci9wZTNqTC9uU0pYSjRtQm51czJheHFtWnIvM3hhaWpYZG9kMmd3eGVhTklvRjNLbHB2aGU3ZjRBNmpsQTM0MmkKVVlCZ09iN1F5KytRZWd4U1diSmdoSzg1MmUvUUhnU2FVSkN6NW1sNGc1WndnNnBTUXhySUhCNkcvREc4dElSYwprZDMxSk1qY25Fb1Rhc1Jyc1NwVmNGdXZyQXlXN2liakZyYzhienBNcE1obDVwYUZRcEZzMnIwaXpZekhwakFsCk5ZR2I2OHJHcjBwQkp3YU5DS2ErbCtLRTk4M3A3NDYwCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBdEY3WEN6TVZHaDF1aU5oWTBJZW50RVlpSVFmUUlLQkMvYUFzU3gxQUlsOWI0OUQ5ClhmanEzdWI3c3RCNnRsYTlqV09keDZkZzBnZDBCSVNCSWFlcHJWdkZNZzRTRXpjRE51aW0xZnh3aVkwZCtFRlUKTXVCc3NYZEV6V0k3ZEVvdUFjcVJjamZWL0J5WTZ4ZDdTRWhjSE5PZVdEZWI5TDFiK3hLd2k2M21uZ0lKQjdBeQpLSmRlYzhnbWlaNk4wcTV3ZXFEWDJ6QVgrbDVPTldTcG1mWUVhVHBDSnFMVTNtZFpCWWx5cnhMTytvemx0MGdLCktLbG81cGgzc05CcDFMUG5LOUMxc3MvbWZRek9EMDNzck1Xa21oTDcwQ0IxZmIydCtOWnRITW5BYmYwYkJETnoKTlNRcXU4T2cwaUxnOUVhd3l1dEF4U3BGdmhHUGMvd0dHMExWaXdJREFRQUJBb0lCQUJKYUErOHp4MVhjNEw0egpwUFd5bDdHVDRTMFRLbTNuWUdtRnZudjJBZXg5WDFBU2wzVFVPckZyTnZpK2xYMnYzYUZoSFZDUEN4N1RlMDVxClhPa2JzZnZkZG5iZFQ2RjgyMnJleVByRXNINk9TUnBWSzBmeDVaMDQwVnRFUDJCWm04eTYyNG1QZk1vbDdya2MKcm9Kd09rOEVpUHZZekpsZUd0bTAwUm1sRysyL2c0aWJsOTVmQXpyc1MvcGUyS3ZoN2NBVEtIcVh6MjlpUmZpbApiTGhBamQwcEVSMjNYU0hHR1ZqRmF3amNJK1c2L2RtbDZURDhrSzFGaUtldmJKTlREeVNXQnpPbXRTYUp1K01JCm9iUnVWWG4yZVNoamVGM1BYcHZRMWRhNXdBa0dJQWxOWjRHTG5QU2ZwVmJyU0plU3RrTGNzdEJheVlJS3BWZVgKSVVTTHM0RUNnWUVBMmNnZUE2WHh0TXdFNU5QWlNWdGhzbXRiYi9YYmtsSTdrWHlsdk5zZjFPdXRYVzkybVJneQpHcEhUQ0VubDB0Z1p3T081T1FLNjdFT3JUdDBRWStxMDJzZndwcmgwNFZEVGZhcW5QNTBxa3BmZEJLQWpmanEyCjFoZDZMd2hLeDRxSm9aelp2VkowV0lvR1ZLcjhJSjJOWGRTUVlUanZUZHhGczRTamdqNFFiaEVDZ1lFQTFBWUUKSEo3eVlza2EvS2V2OVVYbmVrSTRvMm5aYjJ1UVZXazRXSHlaY2NRN3VMQVhGY3lJcW5SZnoxczVzN3RMTzJCagozTFZNUVBzazFNY25oTTl4WE4vQ3ZDTys5b2t0RnNaMGJqWFh6NEJ5V2lFNHJPS1lhVEFwcDVsWlpUT3ZVMWNyCm05R3NwMWJoVDVZb2RaZ3IwUHQyYzR4U2krUVlEWnNFb2lFdzNkc0NnWUVBcVJLYWNweWZKSXlMZEJjZ0JycGkKQTRFalVLMWZsSjR3enNjbGFKUDVoM1NjZUFCejQzRU1YT0kvSXAwMFJsY3N6em83N3cyMmpud09mOEJSM0RBMwp6ZTRSWDIydWw4b0hGdldvdUZOTTNOZjNaNExuYXpVc0F0UGhNS2hRWGMrcEFBWGthUDJkZzZ0TU5PazFxaUNHCndvU212a1BVVE84b1ViRTB1NFZ4ZmZFQ2dZQUpPdDNROVNadUlIMFpSSitIV095enlOQTRaUEkvUkhwN0RXS1QKajVFS2Y5VnR1OVMxY1RyOTJLVVhITXlOUTNrSjg2OUZPMnMvWk85OGg5THptQ2hDTjhkOWN6enI5SnJPNUFMTApqWEtBcVFIUlpLTFgrK0ZRcXZVVlE3cTlpaHQyMEZPb3E5OE5SZDMzSGYxUzZUWDNHZ3RWQ21YSml6dDAxQ3ZHCmR4VnVnd0tCZ0M2Mlp0b0RLb3JyT2hvdTBPelprK2YwQS9rNDJBOENiL29VMGpwSzZtdmxEWmNYdUF1QVZTVXIKNXJCZjRVYmdVYndqa1ZWSFR6LzdDb1BWSjUvVUxJWk1Db1RUNFprNTZXWDk4ZE93Q3VTVFpZYnlBbDZNS1BBZApTZEpuVVIraEpnSVFDVGJ4K1dzYnh2d0FkbWErWUhtaVlPRzZhSklXMXdSd1VGOURLUEhHCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== + ``` 2. In `kind: Secret` with `name: cattle-keys-server`, replace `
+ ## 1. Provision Linux Hosts -Before you install Rancher, confirm you meet the host requirements. Provision 3 new Linux hosts using the requirements below. - -### Requirements - -#### Operating System - -{{< requirements_os >}} - -#### Hardware - -{{< requirements_hardware >}} - -#### Software - -{{< requirements_software >}} - -{{< note_server-tags >}} - -#### Ports - -The following diagram depicts the basic port requirements for Rancher. For a comprehensive list, see [Port Requirements]({{< baseurl >}}/rancher/v2.x/en/installation/references/). - - +Provision three Linux hosts according to our [Requirements]({{< baseurl >}}/rancher/v2.x/en/installation/requirements). ## 2. Configure Load Balancer @@ -180,12 +129,13 @@ RKE uses a YAML config file to install and configure your Kubernetes cluster. Th 1. Download one of following templates, depending on the SSL certificate you're using. - - [Template for self-signed certificate
`3-node-externalssl-certificate.yml`](https://raw.githubusercontent.com/rancher/rancher/58e695b51096b1f404188379cea6f6a35aea9e4c/rke-templates/3-node-externalssl-certificate.yml) - - [Template for certificate signed by recognized CA
`3-node-externalssl-recognizedca.yml`](https://raw.githubusercontent.com/rancher/rancher/7f60dc3afe1b45287ac36ba6bde6f7c6e35c11fe/rke-templates/3-node-externalssl-recognizedca.yml) + - [Template for self-signed certificate
`3-node-externalssl-certificate.yml`](https://raw.githubusercontent.com/rancher/rancher/master/rke-templates/3-node-externalssl-certificate.yml) + - [Template for certificate signed by recognized CA
`3-node-externalssl-recognizedca.yml`](https://raw.githubusercontent.com/rancher/rancher/master/rke-templates/3-node-externalssl-recognizedca.yml) - >**Want records of all transactions with the Rancher API?** + >**Advanced Config Options:** > - >Enable the [API Auditing]({{< baseurl >}}/rancher/v2.x/en/installation/api-auditing) feature by editing your RKE config file. For more information, see [RKE Documentation: API Auditing]({{< baseurl >}}\rke\v0.1.x\en\config-options\add-ons\api-auditing). + >- Want records of all transactions with the Rancher API? Enable the [API Auditing]({{< baseurl >}}/rancher/v2.x/en/installation/api-auditing) feature by editing your RKE config file. For more information, see [RKE Documentation: API Auditing]({{< baseurl >}}/rke/v0.1.x/en/config-options/add-ons/api-auditing). + >- Want to know the other config options available for your RKE template? See the [RKE Documentation: Config Options]({{< baseurl >}}/rke/v0.1.x/en/config-options/). 2. Rename the file to `rancher-cluster.yml`. @@ -196,33 +146,37 @@ Once you have the `rancher-cluster.yml` config file template, edit the nodes sec 1. Open `rancher-cluster.yml` in your favorite text editor. -2. Update the `nodes` section with the information of your [Linux hosts](#1-provision-linux-hosts). +1. Update the `nodes` section with the information of your [Linux hosts](#1-provision-linux-hosts). For each node in your cluster, update the following placeholders: `IP_ADDRESS_X` and `USER`. The specified user should be able to access the Docket socket, you can test this by logging in with the specified user and run `docker ps`. >**Note:** - > When using RHEL/CentOS, the SSH user can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565. See [Operating System Requirements]({{< baseurl >}}/rke/v0.1.x/en/installation/os#redhat-enterprise-linux-rhel-centos) for RHEL/CentOS specific requirements. + > + >When using RHEL/CentOS, the SSH user can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565. See [Operating System Requirements]({{< baseurl >}}/rke/v0.1.x/en/installation/os#redhat-enterprise-linux-rhel-centos) for RHEL/CentOS specific requirements. + nodes: + # The IP address or hostname of the node + - address: IP_ADDRESS_1 + # User that can login to the node and has access to the Docker socket (i.e. can execute `docker ps` on the node) + # When using RHEL/CentOS, this can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565 + user: USER + role: [controlplane,etcd,worker] + # Path the SSH key that can be used to access to node with the specified user + ssh_key_path: ~/.ssh/id_rsa + - address: IP_ADDRESS_2 + user: USER + role: [controlplane,etcd,worker] + ssh_key_path: ~/.ssh/id_rsa + - address: IP_ADDRESS_3 + user: USER + role: [controlplane,etcd,worker] + ssh_key_path: ~/.ssh/id_rsa -``` -nodes: - # The IP address or hostname of the node - - address: IP_ADDRESS_1 - # User that can login to the node and has access to the Docker socket (i.e. can execute `docker ps` on the node) - # When using RHEL/CentOS, this can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565 - user: USER - role: [controlplane,etcd,worker] - # Path the SSH key that can be used to access to node with the specified user - ssh_key_path: ~/.ssh/id_rsa - - address: IP_ADDRESS_2 - user: USER - role: [controlplane,etcd,worker] - ssh_key_path: ~/.ssh/id_rsa - - address: IP_ADDRESS_3 - user: USER - role: [controlplane,etcd,worker] - ssh_key_path: ~/.ssh/id_rsa -``` +1. **Optional:** By default, `rancher-cluster.yml` is configured to take backup snapshots of your data. To disable these snapshots, change the `backup` directive setting to `false`, as depicted below. + + services: + etcd: + backup: false ## 7. Configure Certificates @@ -230,11 +184,7 @@ For security purposes, SSL (Secure Sockets Layer) is required when using Rancher Choose from the following options: -- [Option A—Bring Your Own Certificate: Self-Signed](#option-a-bring-your-own-certificate-self-signed) -- [Option B—Bring Your Own Certificate: Signed by Recognized CA](#option-b-bring-your-own-certificate-signed-by-recognized-ca) - -### Option A—Bring Your Own Certificate: Self-Signed - +{{% accordion id="option-a" label="Option A—Bring Your Own Certificate: Self-Signed" %}} >**Prerequisites:** >Create a self-signed certificate. > @@ -242,30 +192,26 @@ Choose from the following options: >- The certificate files must be encoded in [base64](#base64). >- In your certificate file, include all intermediate certificates in the chain. Order your certificates with your certificate first, followed by the intermediates. For an example, see [SSL FAQ / Troubleshooting](#cert-order). -1. In `kind: Secret` with `name: cattle-keys-ingress`: +In `kind: Secret` with `name: cattle-keys-ingress`, replace `
diff --git a/content/rancher/v2.x/en/installation/references/_index.md b/content/rancher/v2.x/en/installation/references/_index.md index 3f2e7facc22..d83a2fd7ba3 100644 --- a/content/rancher/v2.x/en/installation/references/_index.md +++ b/content/rancher/v2.x/en/installation/references/_index.md @@ -5,11 +5,12 @@ aliases: - /rancher/v2.x/en/hosts/amazon/#required-ports-for-rancher-to-work/ --- -To operate properly, Rancher requires the following ports to be open on your nodes. During creation of clusters using a cloud service (like Amazon EC2 or DigitalOcean), Rancher opens these ports for you. +To operate properly, Rancher requires certain ports to be open on your nodes. During creation of clusters using a cloud service (like Amazon EC2 or DigitalOcean), Rancher opens these ports for you. -The following diagram displays the basic port requirements for Rancher. If you need more detail, refer to the tables below. +The ports that Rancher opens change according to the type of machines hosting your cluster nodes. The following diagram depicts the ports that are opened for each [cluster type]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning). - +Cluster Type Port Requirements + {{< requirements_ports_rancher >}} {{< requirements_ports_rke >}} diff --git a/content/rancher/v2.x/en/installation/requirements/_index.md b/content/rancher/v2.x/en/installation/requirements/_index.md new file mode 100644 index 00000000000..b04d450859f --- /dev/null +++ b/content/rancher/v2.x/en/installation/requirements/_index.md @@ -0,0 +1,83 @@ +--- +title: Node Requirements +weight: 1 +aliases: +--- + +Whether you're configuring Rancher to run in a single-node or high-availability setup, each node running Rancher Server must meet the following requirements. + +{{% tabs %}} +{{% tab "Operating Systems" %}} +Rancher is supported on the following operating systems and their subsequent releases. + +* Ubuntu 16.04 (64-bit) +* Red Hat Enterprise Linux 7.5 (64-bit) +* RancherOS 1.4 (64-bit) + +If you are using RancherOS, make sure you switch the Docker engine to a supported version using:
+`sudo ros engine switch docker-17.03.2-ce` + +{{% /tab %}} +{{% tab "Hardware" %}} +Hardware requirements scale based on the size of your Rancher deployment. Provision each individual node according to the requirements. + +
| Deployment Size | +Clusters | +Nodes | +vCPUs | +RAM | +
|---|---|---|---|---|
| Small | +Up to 10 | +Up to 50 | +2 | +4GB | +
| Medium | +Up to 100 | +Up to 500 | +8 | +32GB | +
| Large | +Over 100 | +Over 500 | +Contact Rancher | +|
+ +{{% /tab %}} +{{% tab "Software" %}} +A supported version of [Docker](https://www.docker.com/) is required. + +Supported Versions: + +* `1.12.6` +* `1.13.1` +* `17.03.2` + +If you are using RancherOS, make sure you switch the Docker engine to a supported version using:
+`sudo ros engine switch docker-17.03.2-ce` + +[Docker Documentation: Installation Instructions](https://docs.docker.com/) + +{{% /tab %}} +{{% tab "Ports" %}} + +When deploying Rancher in an HA cluster, certain ports on your nodes must be open to allow communication with Rancher. The ports that must be open change according to the type of machines hosting your cluster nodes. For example, if your are deploying Rancher on nodes hosted by an IaaS, port `22` must be open for SSH. The following diagram depicts the ports that are opened for each [cluster type]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning). + +Cluster Type Port Requirements + + + +{{< requirements_ports_rancher >}} +{{< requirements_ports_rke >}} +{{< ports_aws_securitygroup_nodedriver >}} +{{% /tab %}} +{{% /tabs %}} diff --git a/content/rancher/v2.x/en/installation/single-node/_index.md b/content/rancher/v2.x/en/installation/single-node/_index.md index ad994a1e8e1..3aa2179099d 100644 --- a/content/rancher/v2.x/en/installation/single-node/_index.md +++ b/content/rancher/v2.x/en/installation/single-node/_index.md @@ -3,177 +3,90 @@ title: Single Node Install weight: 250 aliases: - /rancher/v2.x/en/installation/single-node-install/ - - /rancher/v2.x/en/installation/custom-ca-root-certificate/ --- -For development environments, we recommend installing Rancher by running a single Docker container. In this installation scenario, you'll install Docker on a single Linux host, and then install Rancher on your host using a single Docker container. +For development and testing environments, we recommend installing Rancher by running a single Docker container. In this installation scenario, you'll install Docker on a single Linux host, and then deploy Rancher on your host using a single Docker container. >**Want to use an external load balancer?** > See [Single Node Install with an External Load Balancer]({{< baseurl >}}/rancher/v2.x/en/installation/single-node/single-node-install-external-lb) instead. -## Installation Outline - -Installation of Rancher on a single node involves multiple procedures. Review this outline to learn about each procedure you need to complete. - -1. [Provision Linux Host](#1-provision-linux-host) - - Provision a single Linux host to launch your {{< product >}} Server. - -2. [Choose an SSL Option and Install Rancher](#2-choose-an-ssl-option-and-install-rancher) - - Choose an SSL option for Rancher communication encryption. After choosing an option, run the command that accompanies it to deploy Rancher. - ## 1. Provision Linux Host -Provision a single Linux host to launch your {{< product >}} Server. - -### Requirements - -#### Operating System - -{{< requirements_os >}} - -#### Hardware - -{{< requirements_hardware >}} - -#### Software - -{{< requirements_software >}} - -{{< note_server-tags >}} - -#### Ports - -The following diagram depicts the basic port requirements for Rancher. For a comprehensive list, see [Port Requirements]({{< baseurl >}}/rancher/v2.x/en/installation/references/). - - +Provision a single Linux host according to our [Requirements]({{< baseurl >}}/rancher/v2.x/en/installation/requirements) to launch your {{< product >}} Server. ## 2. Choose an SSL Option and Install Rancher For security purposes, SSL (Secure Sockets Layer) is required when using Rancher. SSL secures all Rancher network communication, like when you login or interact with a cluster. ->**Attention Air Gap Users:** -> If you are visiting this page to complete an [Air Gap Installation]({{< baseurl >}}/rancher/v2.x/en/installation/air-gap-installation/), you must pre-pend your private registry URL to the server tag when running the installation command in the option that you choose. Add `
@@ -211,11 +117,31 @@ You have a couple of options: {{< ssl_faq_single >}} -## Persistent Data +## Advanced Options + +### API Auditing + +If you want to record all transations with the Rancher API, enable the [API Auditing]({{< baseurl >}}/rancher/v2.x/en/installation/api-auditing) feature by adding the flags below into your install command. + + -e AUDIT_LEVEL=1 \ + -e AUDIT_LOG_PATH=/var/log/auditlog/rancher-api-audit.log \ + -e AUDIT_LOG_MAXAGE=20 \ + -e AUDIT_LOG_MAXBACKUP=20 \ + -e AUDIT_LOG_MAXSIZE=100 \ + +### Air Gap + +If you are visiting this page to complete an [Air Gap Installation]({{< baseurl >}}/rancher/v2.x/en/installation/air-gap-installation/), you must pre-pend your private registry URL to the server tag when running the installation command in the option that you choose. Add `
## What's Next? -You have a couple of options: -- Create a backup of your Rancher Server in case of a disaster scenario: [Single Node Backup and Restoration]({{< baseurl >}}/rancher/v2.x/en/installation/backups-and-restoration/single-node-backup-and-restoration/). +- **Recommended:** Review [Single Node Backup and Restoration]({{< baseurl >}}/rancher/v2.x/en/installation/backups-and-restoration/single-node-backup-and-restoration/). Although you don't have any data you need to back up right now, we recommend creating backups after regular Rancher use. - Create a Kubernetes cluster: [Provisioning Kubernetes Clusters]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/).
@@ -197,6 +150,26 @@ You have a couple of options: {{< ssl_faq_single >}} -## Persistent Data +## Advanced Options + +### API Auditing + +If you want to record all transations with the Rancher API, enable the [API Auditing]({{< baseurl >}}/rancher/v2.x/en/installation/api-auditing) feature by adding the flags below into your install command. + + -e AUDIT_LEVEL=1 \ + -e AUDIT_LOG_PATH=/var/log/auditlog/rancher-api-audit.log \ + -e AUDIT_LOG_MAXAGE=20 \ + -e AUDIT_LOG_MAXBACKUP=20 \ + -e AUDIT_LOG_MAXSIZE=100 \ + +### Air Gap + +If you are visiting this page to complete an [Air Gap Installation]({{< baseurl >}}/rancher/v2.x/en/installation/air-gap-installation/), you must pre-pend your private registry URL to the server tag when running the installation command in the option that you choose. Add `
**Note:** You can only choose this option while provisioning your cluster. It cannot be edited later. | + Network Provider | The [container networking interface]({{< baseurl >}}/rancher/v2.x/en/faq/networking/#cni-providers) that powers networking for your cluster.
**Note:** You can only choose this option while provisioning your cluster. It cannot be edited later. | Project Network Isolation | As of Rancher v2.0.7, if you're using the Canal network provider, you can choose whether to enable or disable inter-project communication. | Nginx Ingress | If you want to publish your applications in a high-availability configuration, and you're hosting your nodes with a cloud-provider that doesn't have a native load-balancing feature, enable this option to use Nginx ingress within the cluster. | Metrics Server Monitoring | Each cloud provider capable of launching a cluster using RKE can collect metrics and monitor for your cluster nodes. Enable this option to view your node metrics from your cloud provider's portal. | diff --git a/content/rancher/v2.x/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md b/content/rancher/v2.x/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md index d46f7938548..2d4a3a0b82a 100644 --- a/content/rancher/v2.x/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md +++ b/content/rancher/v2.x/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md @@ -38,29 +38,8 @@ This Quick Start Guide is divided into different tasks for easier consumption. > > For a full list of port requirements, refer to [Single Node Installation]({{< baseurl >}}/rancher/v2.x/en/installation/references). - Provision the host according to the requirements below. + Provision the host according to our [Requirements]({{< baseurl >}}/rancher/v2.x/en/installation/requirements/). -{{% accordion id="os" label="Operating System" %}} -{{< requirements_os >}} -{{% /accordion %}} -{{% accordion id="hardware" label="Hardware" %}} -Memory: 4GB -{{% /accordion %}} -{{% accordion id="software" label="Software" %}} -Docker - - **Supported Docker versions:** - - - `1.12.6` - - `1.13.1` - - `17.03.2` - - >**Notes:** - > - > - For Docker installation instructions, visit their [documentation](https://docs.docker.com/install/). - > - Docker requirements apply to both your Linux host and your cluster nodes. -{{% /accordion %}} -
### 2. Install Rancher To install Rancher on your host, connect to it and then use a shell to install. diff --git a/content/rancher/v2.x/en/upgrades/rollbacks/single-node-rollbacks/_index.md b/content/rancher/v2.x/en/upgrades/rollbacks/single-node-rollbacks/_index.md index 08bac2e9107..baee8b006ae 100644 --- a/content/rancher/v2.x/en/upgrades/rollbacks/single-node-rollbacks/_index.md +++ b/content/rancher/v2.x/en/upgrades/rollbacks/single-node-rollbacks/_index.md @@ -6,34 +6,78 @@ aliases: - /rancher/v2.x/en/upgrades/single-node-rollbacks --- -Rolling back an unsuccessful Rancher upgrade requires you to -restore the backup you created while completing [Single Node Upgrade]({{< baseurl >}}/rancher/v2.x/en/upgrades/upgrade-scenarios/single-node-upgrade/). +If a Rancher upgrade does not complete successfully, you'll have to roll back to your Rancher setup that you were using before [Single Node Upgrade]({{< baseurl >}}/rancher/v2.x/en/upgrades/upgrades/single-node-upgrade). Rolling back restores: + +- Your previous version of Rancher. +- Your data backup created before upgrade. + +## Before You Start + +During rollback to a prior version of Rancher, you'll enter a series of commands, filling placeholders with data from your environment. These placeholders are denoted with angled brackets and all capital letters (`
+ +You can obtain `
+ +You can obtain `
+More detailed information on Kubernetes concepts can be found in the +[Kubernetes Concepts Documentation](https://kubernetes.io/docs/concepts/). + + +## Migration Plan + + + +- [1. Get Started](#1-get-started) +- [2. Migrate Applications](#2-migrate-applications) +- [3. Expose Your Services](#3-expose-your-services) +- [4. Monitor Your Applications](#4-monitor-your-applications) +- [5. Schedule Deployments](#5-schedule-deployments) +- [6. Service Discovery](#6-service-discovery) + + + + + +## 1. Get Started + +As a Rancher 1.6 user who's interested in moving to 2.0, how should you get started with migration? The following blog provides a short checklist to help with this transition. + +Blog Post: [Migrating from Rancher 1.6 to Rancher 2.0—A Short Checklist](https://rancher.com/blog/2018/2018-08-09-migrate-1dot6-setup-to-2dot0/) + +## 2. Migrate Applications + +In Rancher 1.6, you launch applications as _services_ and organize them under _stacks_ in an _environment_, which represents a compute and administrative boundary. Rancher 1.6 supports the Docker compose standard and provides import/export for application configurations using the following files: `docker-compose.yml` and `rancher-compose.yml`. In 2.0 the environment concept doesn't exist. Instead it's replaced by: + +- **Cluster:** The compute boundary. +- **Project:** An administrative boundary. + +The following article explores how to map Cattle's stack and service design to Kubernetes. It also demonstrates how to migrate a simple application from Rancher 1.6 to 2.0 using either the Rancher UI or Docker Compose. + +Blog Post: [A Journey from Cattle to Kubernetes!](https://rancher.com/blog/2018/2018-08-02-journey-from-cattle-to-k8s/) + +## 3. Expose Your Services + +In Rancher 1.6, you could provide external access to your applications using port mapping. This article explores how to publicly expose your services in Rancher 2.0. It explores both UI and CLI methods to transition the port mapping functionality. + +Blog Post: [From Cattle to Kubernetes—How to Publicly Expose Your Services in Rancher 2.0](https://rancher.com/blog/2018/expose-and-monitor-workloads/) + +## 4. Monitor Your Applications + +Rancher 1.6 provided TCP and HTTP healthchecks using its own healthcheck microservice. Rancher 2.0 uses native Kubernetes healthcheck support instead. This article overviews how to configure it in Rancher 2.0. + +Blog Post: [From Cattle to Kubernetes—Application Healthchecks in Rancher 2.0](https://rancher.com/blog/2018/2018-08-22-k8s-monitoring-and-healthchecks/) + +## 5. Schedule Deployments + +Scheduling application containers on available resources is a key container orchestration technique. The following blog reviews how to schedule containers in Rancher 2.0 for those familiar with 1.6 scheduling labels (such as affinity and anti-affinity). It also explores how to launch a global service in 2.0. + +Blog Post: [From Cattle to Kubernetes—Scheduling Workloads in Rancher 2.0](https://rancher.com/blog/2018/2018-08-29-scheduling-options-in-2-dot-0/) + +## 6. Service Discovery + +Rancher 1.6 provides service discovery within and across stacks using its own internal DNS microservice. It also supports pointing to external services and creating aliases. Moving to Rancher 2.0, you can replicate this same service discovery behavior. The following blog reviews this topic and the solutions needed to achieve service discovery parity in Rancher 2.0. + +Blog Post: [From Cattle to Kubernetes—Service Discovery in Rancher 2.0](https://rancher.com/blog/2018/2018-09-04-service_discovery_2dot0/) + + + diff --git a/content/rke/v0.1.x/en/config-options/_index.md b/content/rke/v0.1.x/en/config-options/_index.md index 3d169c29e4d..2f24b34738b 100644 --- a/content/rke/v0.1.x/en/config-options/_index.md +++ b/content/rke/v0.1.x/en/config-options/_index.md @@ -54,13 +54,16 @@ ignore_docker_version: true ### Kubernetes Version -You can select which version of Kubernetes to install for your cluster. These options are the Kubernetes versions made available in Rancher v2.x. The current default Kubernetes version used by RKE is `v1.10.3-rancher2-1`. If a version is defined in `kubernetes_version` and is not found in this list, the default is used. +You can select which version of Kubernetes to install for your cluster. These options are the Kubernetes versions made available in Rancher v2.x. The current default Kubernetes version used by RKE is `v1.11.1-rancher1-1`. If a version is defined in `kubernetes_version` and is not found in this list, the default is used. Kubernetes version| -----------------| + v1.11.1-rancher1-1| + v1.10.5-rancher1-2| v1.10.3-rancher2-1| v1.10.1-rancher2-1| v1.10.0-rancher1-1| + v1.9.7-rancher2-2| v1.9.7-rancher2-1| v1.9.5-rancher1-1| v1.8.11-rancher2-1| @@ -74,7 +77,7 @@ There are two ways to select a Kubernetes version: - Using the configuration option `kubernetes_version` ```yaml -kubernetes_version: "v1.10.3-rancher2-1" +kubernetes_version: "v1.11.1-rancher1-1" ``` In case both are defined, the system images configuration will take precedence over `kubernetes_version`. diff --git a/content/rke/v0.1.x/en/config-options/add-ons/user-defined-add-ons/_index.md b/content/rke/v0.1.x/en/config-options/add-ons/user-defined-add-ons/_index.md index 7301025d39e..c748487eee5 100644 --- a/content/rke/v0.1.x/en/config-options/add-ons/user-defined-add-ons/_index.md +++ b/content/rke/v0.1.x/en/config-options/add-ons/user-defined-add-ons/_index.md @@ -3,11 +3,11 @@ title: User-Defined Add-Ons weight: 263 --- -Besides the [network plug-in]({{< baseurl >}}/rke/v0.1.x/en/config-options/network-plugins/) and [ingress controllers]({{< baseurl >}}/rke/v0.1.x/en/config-options/ingress-controllers/), you can define any add-on that you want deployed after the Kubernetes cluster is deployed. +Besides the [network plug-in]({{< baseurl >}}/rke/v0.1.x/en/config-options/add-ons/network-plugins) and [ingress controllers]({{< baseurl >}}/rke/v0.1.x/en/config-options/add-ons/ingress-controllers/), you can define any add-on that you want deployed after the Kubernetes cluster is deployed. There are two ways that you can specify an add-on. -- [In-line Add-ons](#inline-add-ons) +- [In-line Add-ons](#in-line-add-ons) - [Referencing YAML Files for Add-ons](#referencing-yaml-files-for-add-ons) > **Note:** When using user-defined add-ons, you *must* define a namespace for *all* your resources, otherwise they will end up in the `kube-system` namespace. @@ -20,7 +20,8 @@ As of v0.1.8, RKE will update an add-on if it is the same name. Prior to v0.1.8, update any add-ons by by using `kubectl edit`. -## In-line Addons +## In-line Add-ons + To define an add-on directly in the YAML file, make sure to use the YAML's block indicator `|-` as the `addons` directive is a multi-line string option. It's possible to specify multiple YAML resource definitions by separating them using the `---` directive. ```yaml diff --git a/content/rke/v0.1.x/en/config-options/cloud-providers/aws/_index.md b/content/rke/v0.1.x/en/config-options/cloud-providers/aws/_index.md index 639b77d85d1..278a54b1230 100644 --- a/content/rke/v0.1.x/en/config-options/cloud-providers/aws/_index.md +++ b/content/rke/v0.1.x/en/config-options/cloud-providers/aws/_index.md @@ -3,7 +3,7 @@ title: AWS Cloud Provider weight: 251 --- -To enable the AWS cloud provider, there are no configuration options. You only need to set the name as `aws`. In order to use the AWS cloud provider, all cluster nodes must have already been configured with an appropriate IAM role. +To enable the AWS cloud provider, there are no configuration options. You only need to set the name as `aws`. In order to use the AWS cloud provider, all cluster nodes must have already been configured with an [appropriate IAM role](#iam-requirements) and your AWS resources must be [tagged with a cluster ID](#tagging-amazon-resources). ```yaml cloud_provider: @@ -53,3 +53,31 @@ In order to use Elastic Load Balancers (ELBs) and EBS with Kubernetes, the node( ] } ``` + +## Tagging Amazon Resources + +Any resources used in a Kubernetes cluster with the Amazon cloud provider must be tagged with a cluster ID. + +[Amazon Documentation: Tagging Your Amazon EC2 Resources](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html) + +The following resources need to tagged with a `ClusterID`: + +- **Nodes**: All hosts added in Rancher. +- **Subnet**: The subnet used for your cluster +- **Security Group**: The security group used for your cluster. + + >**Note:** Do not tag multiple security groups. Tagging multiple groups generates an error when creating Elastic Load Balancer. + +The tag that should be used is: + +``` +Key=kubernetes.io/cluster/
-
{{ template "_internal/pagination.html" . }}
-
-
{{ end }}
{{.Title}}
+
+ 
+ {{ if .Params.Image }}
+
+ {{end}}
+
+
+ {{.Title}}
- {{ if .Params.Image }} -{{ .Summary | safeHTML }}
+ {{ if .Truncated }} +
+ Read More…
+
+ {{ end }}
+
+
+
+ {{ with .Params.Author }}
+
- person_outline By: {{ . }}
{{end}}
- {{ .Summary | safeHTML }}
- {{ if .Truncated }} -
- Read More…
-
- {{ end }}
-
-
+
-
- {{ with .Params.Author }}
-
person_outline By: {{ . }}
+ {{ if eq .Section "events" }}
+ {{ with .Params.EventDate }}
+ event {{ . }}
{{end}}
-
- {{ if eq .Section "events" }}
- {{ with .Params.EventDate }}
- event {{ . }}
- {{end}}
- {{ else }}
+ {{ else }}
- {{ with .Params.Date }}
- event {{ .Format "January 2, 2006" }}
- {{end}}
+ {{ with .Params.Date }}
+ event {{ .Format "January 2, 2006" }}
{{end}}
+ {{end}}
- {{ if eq .Section "blog" }}
- timer Read Time: {{.ReadingTime}} minutes
- {{end}}
+ {{ if eq .Section "blog" }}
+ timer Read Time: {{.ReadingTime}} minutes
+ {{end}}
- {{ with .Params.Location }}
- location_on {{ . }}
- {{end}}
+ {{ with .Params.Location }}
+ location_on {{ . }}
+ {{end}}
- {{ partial "page-edit.html" . }}
-
- -- -{{ end }} diff --git a/layouts/shortcodes/note_server-tags.html b/layouts/shortcodes/note_server-tags.html index 6a03c80a3ca..3911c33106a 100644 --- a/layouts/shortcodes/note_server-tags.html +++ b/layouts/shortcodes/note_server-tags.html @@ -1,8 +1,8 @@"{{.quote}}"-
------
- {{.source}},-
{{.position}}, {{.company}} -
-diff --git a/layouts/shortcodes/partners.html b/layouts/shortcodes/partners.html deleted file mode 100644 index c0d9933d93b..00000000000 --- a/layouts/shortcodes/partners.html +++ /dev/null @@ -1,14 +0,0 @@ -Note:
- -The
-rancher/ranchercontainer is hosted on DockerHub. If you don't have access to DockerHub, or you are installing Rancher without an Internet connection, refer to how to prepare for an Air Gap Installation.Note:
-For a list of other Rancher Server tags available, refer to Rancher Server Tags.
- +Notes:
++
- If you are using RancherOS, make sure you switch the Docker engine to a supported version using
+sudo ros engine switch docker-17.03.2-ce+- The
+rancher/ranchercontainer is hosted on DockerHub. If you don't have access to DockerHub, or you are installing Rancher without an Internet connection, refer to how to prepare for an Air Gap Installation.
- {{ range .Site.Data.partners.partner }}
-
diff --git a/layouts/shortcodes/requirements_hardware.html b/layouts/shortcodes/requirements_hardware.html
index 560d878625f..7c608e237e3 100644
--- a/layouts/shortcodes/requirements_hardware.html
+++ b/layouts/shortcodes/requirements_hardware.html
@@ -10,10 +10,10 @@
- 
-
- {{ end }}
-
- {{.name}}
-{{.description}}
- - {{ range .type }} - {{ . }} - {{ end }} - -
-
diff --git a/layouts/shortcodes/support.html b/layouts/shortcodes/support.html
deleted file mode 100644
index 3a3c342dab9..00000000000
--- a/layouts/shortcodes/support.html
+++ /dev/null
@@ -1,20 +0,0 @@
--
-
-
-
Docker
-Note:If you are using RancherOS, make sure you switch the Docker engine to a supported version using
-sudo ros engine switch docker-17.03.2-ceSupported Versions
+ +A supported version of Docker is required.
+Supported Versions:
1.12.61.13.1
@@ -11,6 +9,5 @@
-
-
| Rancher Version | -Release Date | -End full support | -Dend maintainance support | -
|---|---|---|---|
| {{.rancher}} | -{{.release}} | -{{.full}} | -{{.maintain}} | -
-
diff --git a/package.json b/package.json
index 7347d0ea7ed..371ccd08da0 100644
--- a/package.json
+++ b/package.json
@@ -6,8 +6,6 @@
"build": "gulp build",
"build:preview": "gulp build-preview",
"dev": "gulp dev",
- "server": "gulp server",
- "server:with-drafts": "gulp server:with-drafts",
"cms:delete": "gulp cms-delete",
"algolia": "node build-algolia.js"
},
diff --git a/scripts/dev b/scripts/dev
index 746a7bf9689..3ede772eac6 100755
--- a/scripts/dev
+++ b/scripts/dev
@@ -28,7 +28,7 @@ Usage:
-d - Build the dev image instead of pulling from the registry
-p PORT - Port to listen on
-t DIR - Use DIR to for the theme, to devlop the theme at the same time
--u - Upload tbe build image after building
+-u - Upload the build image after building
EOF
}
diff --git a/src/diagrams/cluster-ports.xml b/src/diagrams/cluster-ports.xml
new file mode 100644
index 00000000000..9d2555cbcb1
--- /dev/null
+++ b/src/diagrams/cluster-ports.xml
@@ -0,0 +1 @@
+
-
-
-
-
-
-
-
--
- {{ range .Site.Data.testimonials.testimonial }}
-
-
- {{.company}}---
{{.quote}}
- {{.source}}, {{.position}} -
- {{ end }}
-