diff --git a/config.toml b/config.toml index 6ea4f5e3a0b..35fdfda6e03 100644 --- a/config.toml +++ b/config.toml @@ -209,4 +209,4 @@ pre = "keyboard_arrow_down" [[menu.main]] name = "Partners" url = "https://rancher.com/partners/" - parent = "about" + parent = "about" \ No newline at end of file diff --git a/content/k3s/latest/en/advanced/_index.md b/content/k3s/latest/en/advanced/_index.md index b2da9136bbd..494650ebf82 100644 --- a/content/k3s/latest/en/advanced/_index.md +++ b/content/k3s/latest/en/advanced/_index.md @@ -24,6 +24,7 @@ This section contains advanced information describing the different ways you can - [SELinux Support](#selinux-support) - [Additional preparation for (Red Hat/CentOS) Enterprise Linux](#additional-preparation-for-red-hat-centos-enterprise-linux) - [Enabling Lazy Pulling of eStargz (Experimental)](#enabling-lazy-pulling-of-estargz-experimental) +- [Additional Logging Sources](#additional-logging-sources) # Certificate Rotation @@ -344,7 +345,7 @@ sudo reboot Standard Raspbian Buster installations do not start with `cgroups` enabled. **K3S** needs `cgroups` to start the systemd service. `cgroups`can be enabled by appending `cgroup_memory=1 cgroup_enable=memory` to `/boot/cmdline.txt`. -## example of /boot/cmdline.txt +### example of /boot/cmdline.txt ``` console=serial0,115200 console=tty1 root=PARTUUID=58b06195-02 rootfstype=ext4 elevator=deadline fsck.repair=yes rootwait cgroup_memory=1 cgroup_enable=memory ``` @@ -417,7 +418,7 @@ reboot # Enabling Lazy Pulling of eStargz (Experimental) -## What's lazy pulling and eStargz? +### What's lazy pulling and eStargz? Pulling images is known as one of the time-consuming steps in the container lifecycle. According to [Harter, et al.](https://www.usenix.org/conference/fast16/technical-sessions/presentation/harter), @@ -436,7 +437,7 @@ Because of the compatibility, eStargz can be pushed to standard container regist eStargz is developed based on the [stargz format proposed by Google CRFS project](https://github.com/google/crfs) but comes with practical features including content verification and performance optimization. For more details about lazy pulling and eStargz, please refer to [Stargz Snapshotter project repository](https://github.com/containerd/stargz-snapshotter). -## Configure k3s for lazy pulling of eStargz +### Configure k3s for lazy pulling of eStargz As shown in the following, `--snapshotter=stargz` option is needed for k3s server and agent. @@ -468,3 +469,14 @@ spec: ports: - containerPort: 80 ``` + +# Additional Logging Sources + +[Rancher logging]({{}}//rancher/v2.6/en/logging/helm-chart-options/) for K3s can be installed without using Rancher. The following instructions should be executed to do so: + +``` +helm repo add rancher-charts https://charts.rancher.io +helm repo update +helm install --create-namespace -n cattle-logging-system rancher-logging-crd rancher-charts/rancher-logging-crd +helm install --create-namespace -n cattle-logging-system rancher-logging --set additionalLoggingSources.k3s.enabled=true rancher-charts/rancher-logging +``` \ No newline at end of file diff --git a/content/k3s/latest/en/backup-restore/_index.md b/content/k3s/latest/en/backup-restore/_index.md index 21734573e14..447cabc14f2 100644 --- a/content/k3s/latest/en/backup-restore/_index.md +++ b/content/k3s/latest/en/backup-restore/_index.md @@ -26,6 +26,8 @@ _Available as of v1.19.1+k3s1_ In this section, you'll learn how to create backups of the K3s cluster data and to restore the cluster from backup. +>**Note on Single-Server with embedded SQLite:** Currently, backups of SQLite are not supported. Instead, make a copy of `/var/lib/rancher/k3s/server` and then delete K3s. + ### Creating Snapshots Snapshots are enabled by default. diff --git a/content/k3s/latest/en/helm/_index.md b/content/k3s/latest/en/helm/_index.md index 574c36d6c66..89d21d70ba5 100644 --- a/content/k3s/latest/en/helm/_index.md +++ b/content/k3s/latest/en/helm/_index.md @@ -66,6 +66,20 @@ spec: Content placed in `/var/lib/rancher/k3s/server/static/` can be accessed anonymously via the Kubernetes APIServer from within the cluster. This URL can be templated using the special variable `%{KUBERNETES_API}%` in the `spec.chart` field. For example, the packaged Traefik component loads its chart from `https://%{KUBERNETES_API}%/static/charts/traefik-1.81.0.tgz`. +**Note:** The `name` field should follow the Helm chart naming conventions. Refer [here](https://helm.sh/docs/chart_best_practices/conventions/#chart-names) to learn more. + +>**Notice on File Naming Requirements:** `HelmChart` and `HelmChartConfig` manifest filenames should adhere to Kubernetes object [naming restrictions](https://kubernetes.io/docs/concepts/overview/working-with-objects/names/). The Helm Controller uses filenames to create objects; therefore, the filename must also align with the restrictions. Any related errors can be observed in the rke2-server logs. The example below is an error generated from using underscores: +``` +level=error msg="Failed to process config: failed to process +/var/lib/rancher/rke2/server/manifests/rke2_ingress_daemonset.yaml: +Addon.k3s.cattle.io \"rke2_ingress_daemonset\" is invalid: metadata.name: +Invalid value: \"rke2_ingress_daemonset\": a lowercase RFC 1123 subdomain +must consist of lower case alphanumeric characters, '-' or '.', and must +start and end with an alphanumeric character (e.g. 'example.com', regex +used for validation is '[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9] +([-a-z0-9]*[a-z0-9])?)*')" +``` + ### Customizing Packaged Components with HelmChartConfig To allow overriding values for packaged components that are deployed as HelmCharts (such as Traefik), K3s versions starting with v1.19.0+k3s1 support customizing deployments via a HelmChartConfig resources. The HelmChartConfig resource must match the name and namespace of its corresponding HelmChart, and supports providing additional `valuesContent`, which is passed to the `helm` command as an additional value file. diff --git a/content/k3s/latest/en/installation/ha-embedded/_index.md b/content/k3s/latest/en/installation/ha-embedded/_index.md index 6b940fc02c9..f8fe7d2ebea 100644 --- a/content/k3s/latest/en/installation/ha-embedded/_index.md +++ b/content/k3s/latest/en/installation/ha-embedded/_index.md @@ -7,6 +7,9 @@ weight: 40 K3s has added full support for embedded etcd as of release v1.19.5+k3s1. Versions v1.19.1 thru v1.19.4 provide only experimental support for embedded etcd. Embedded etcd replaced experimental Dqlite in the K3s v1.19.1 release. This is a breaking change. Please note that upgrades from experimental Dqlite to embedded etcd are not supported. If you attempt an upgrade it will not succeed and data will be lost. +>**Warning:** +Embedded etcd (HA) may have performance issues on slower disks such as Raspberry Pis running with SD cards. + To run K3s in this mode, you must have an odd number of server nodes. We recommend starting with three nodes. To get started, first launch a server node with the `cluster-init` flag to enable clustering and a token that will be used as a shared secret to join additional servers to the cluster. diff --git a/content/k3s/latest/en/installation/network-options/_index.md b/content/k3s/latest/en/installation/network-options/_index.md index 97873e4151b..4b66327f51a 100644 --- a/content/k3s/latest/en/installation/network-options/_index.md +++ b/content/k3s/latest/en/installation/network-options/_index.md @@ -69,3 +69,18 @@ You should see that IP forwarding is set to true. {{% /tab %}} {{% /tabs %}} + +### Dual-stack installation + +To enable dual-stack in k3s, you must provide valid dual-stack `cluster-cidr` and `service-cidr`, and set `disable-network-policy` on all server nodes. Both servers and agents must provide valid dual-stack `node-ip` settings. Node address auto-detection and network policy enforcement are not supported on dual-stack clusters when using the default flannel CNI. Besides, only vxlan backend is supported at the moment. This is an example of a valid configuration: + +``` +node-ip: 10.0.10.7,2a05:d012:c6f:4611:5c2:5602:eed2:898c +cluster-cidr: 10.42.0.0/16,2001:cafe:42:0::/56 +service-cidr: 10.43.0.0/16,2001:cafe:42:1::/112 +disable-network-policy: true +``` + +Note that you can choose whatever `cluster-cidr` and `service-cidr` value, however the `node-ip` values must correspond to the ip addresses of your main interface. Remember to allow ipv6 traffic if you are deploying in a public cloud. + +If you are using a custom cni plugin, i.e. a cni plugin different from flannel, the previous configuration might not be enough to enable dual-stack in the cni plugin. Please check how to enable dual-stack in its documentation and verify if network policies can be enabled. diff --git a/content/os/v1.x/en/_index.md b/content/os/v1.x/en/_index.md index 37908051d30..fcd43aea12f 100644 --- a/content/os/v1.x/en/_index.md +++ b/content/os/v1.x/en/_index.md @@ -5,7 +5,7 @@ description: RancherOS is a simplified Linux distribution built from containers, weight: 1 --- -> RancherOS 1.x is currently in a maintain-only-as-essential mode. It is no longer being actively maintained at a code level other than addressing critical or security fixes. For more information about the support status of RancherOS, see [this page.](https://rancher.zendesk.com/hc/en-us/articles/360041771072-Could-you-help-us-understan[…]opment-and-support-status-of-RancherOS-for-2020-and-beyond-) +> RancherOS 1.x is currently in a maintain-only-as-essential mode. It is no longer being actively maintained at a code level other than addressing critical or security fixes. For more information about the support status of RancherOS, see [this page.](https://rancher.com/docs/os/v1.x/en/support/) RancherOS is the smallest, easiest way to run Docker in production. Every process in RancherOS is a container managed by Docker. This includes system services such as `udev` and `syslog`. Because it only includes the services necessary to run Docker, RancherOS is significantly smaller than most traditional operating systems. By removing unnecessary libraries and services, requirements for security patches and other maintenance are also reduced. This is possible because, with Docker, users typically package all necessary libraries into their containers. diff --git a/content/os/v1.x/en/support/_index.md b/content/os/v1.x/en/support/_index.md new file mode 100644 index 00000000000..26cccb68d28 --- /dev/null +++ b/content/os/v1.x/en/support/_index.md @@ -0,0 +1,15 @@ +--- +title: Support +weight: 170 +--- + +## Development and Maintenance Status + + +RancherOS 1.x is no longer being actively maintained. There are two significant reasons behind this product decision: + +**1. Docker:** The current industry requirements for a container runtime are very much evolving. Container runtimes like containerd and CRIO are now being actively considered as the default choices. RancherOS 1.x, which was specifically designed around using Docker engine only, unfortunately does not lend itself, in its current design, to this new evolving requirement. + +**2. ISV Support:** RancherOS was specifically designed as a minimalistic OS to support purpose-built containerized applications. It was not designed to be used as a general purpose OS (such as CentOS or Ubuntu). As such, most ISVs have not certified their software to run on RancherOS, nor does RancherOS even contain the necessary components for many of these applications to run. + +We're working on a replacement. Stay tuned! \ No newline at end of file diff --git a/content/rancher/v2.0-v2.4/en/cli/_index.md b/content/rancher/v2.0-v2.4/en/cli/_index.md index 2967263a91d..fe6e865db4e 100644 --- a/content/rancher/v2.0-v2.4/en/cli/_index.md +++ b/content/rancher/v2.0-v2.4/en/cli/_index.md @@ -63,13 +63,13 @@ The following commands are available for use in Rancher CLI. | `apps, [app]` | Performs operations on catalog applications (i.e. individual [Helm charts](https://docs.helm.sh/developing_charts/) or Rancher charts. | | `catalog` | Performs operations on [catalogs]({{}}/rancher/v2.0-v2.4/en/catalog/). | | `clusters, [cluster]` | Performs operations on your [clusters]({{}}/rancher/v2.0-v2.4/en/cluster-provisioning/). | -| `context` | Switches between Rancher [projects]({{}}/rancher/v2.0-v2.4/en/k8s-in-rancher/projects-and-namespaces/). For an example, see [Project Selection](#project-selection). | +| `context` | Switches between Rancher [projects]({{}}/rancher/v2.0-v2.4/en/cluster-admin/projects-and-namespaces/). For an example, see [Project Selection](#project-selection). | | `inspect [OPTIONS] [RESOURCEID RESOURCENAME]` | Displays details about [Kubernetes resources](https://kubernetes.io/docs/reference/kubectl/cheatsheet/#resource-types) or Rancher resources (i.e.: [projects]({{}}/rancher/v2.0-v2.4/en/k8s-in-rancher/projects-and-namespaces/) and [workloads]({{}}/rancher/v2.0-v2.4/en/k8s-in-rancher/workloads/)). Specify resources by name or ID. | | `kubectl` |Runs [kubectl commands](https://kubernetes.io/docs/reference/kubectl/overview/#operations). | | `login, [l]` | Logs into a Rancher Server. For an example, see [CLI Authentication](#cli-authentication). | | `namespaces, [namespace]` |Performs operations on namespaces. | | `nodes, [node]` |Performs operations on nodes. | -| `projects, [project]` | Performs operations on [projects]({{}}/rancher/v2.0-v2.4/en/k8s-in-rancher/projects-and-namespaces/). | +| `projects, [project]` | Performs operations on [projects]({{}}/rancher/v2.0-v2.4/en/cluster-admin/projects-and-namespaces/). | | `ps` | Displays [workloads]({{}}/rancher/v2.0-v2.4/en/k8s-in-rancher/workloads) in a project. | | `settings, [setting]` | Shows the current settings for your Rancher Server. | | `ssh` | Connects to one of your cluster nodes using the SSH protocol. | diff --git a/content/rancher/v2.0-v2.4/en/cluster-admin/tools/cluster-logging/splunk/_index.md b/content/rancher/v2.0-v2.4/en/cluster-admin/tools/cluster-logging/splunk/_index.md index 38fe73691b7..f5510ee8222 100644 --- a/content/rancher/v2.0-v2.4/en/cluster-admin/tools/cluster-logging/splunk/_index.md +++ b/content/rancher/v2.0-v2.4/en/cluster-admin/tools/cluster-logging/splunk/_index.md @@ -8,6 +8,7 @@ aliases: - /rancher/v2.0-v2.4/en/logging/legacy/cluster-logging/splunk - /rancher/v2.0-v2.4/en/logging/v2.0.x-v2.4.x/cluster-logging/splunk - /rancher/v2.x/en/logging/v2.0.x-v2.4.x/cluster-logging/splunk/ + - /rancher/v2.x/en/cluster-admin/tools/logging/splunk --- If your organization uses [Splunk](https://www.splunk.com/), you can configure Rancher to send it Kubernetes logs. Afterwards, you can log into your Splunk server to view logs. diff --git a/content/rancher/v2.0-v2.4/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md b/content/rancher/v2.0-v2.4/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md index b825babbfc0..263db5c0d39 100644 --- a/content/rancher/v2.0-v2.4/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md +++ b/content/rancher/v2.0-v2.4/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md @@ -12,6 +12,13 @@ First, you will set up your Azure cloud credentials in Rancher. Then you will us Then you will create an Azure cluster in Rancher, and when configuring the new cluster, you will define node pools for it. Each node pool will have a Kubernetes role of etcd, controlplane, or worker. Rancher will install Kubernetes on the new nodes, and it will set up each node with the Kubernetes role defined by the node pool. +>**Warning:** When the Rancher RKE cluster is running in Azure and has an Azure load balancer in front, the outbound flow will fail. The workaround for this problem is as follows: + +> - Terminate the SSL/TLS on the internal load balancer +> - Use the L7 load balancer + +> For more information, refer to the documentation on [Azure load balancer limitations](https://docs.microsoft.com/en-us/azure/load-balancer/components#limitations). + For more information on configuring the Kubernetes cluster that Rancher will install on the Azure nodes, refer to the [RKE cluster configuration reference.]({{}}/rancher/v2.0-v2.4/en/cluster-provisioning/rke-clusters/options) For more information on configuring Azure node templates, refer to the [Azure node template configuration reference.](./azure-node-template-config) diff --git a/content/rancher/v2.0-v2.4/en/installation/resources/k8s-tutorials/infrastructure-tutorials/infra-for-ha/_index.md b/content/rancher/v2.0-v2.4/en/installation/resources/k8s-tutorials/infrastructure-tutorials/infra-for-ha/_index.md index b9f4c847907..0ca01f9a5d8 100644 --- a/content/rancher/v2.0-v2.4/en/installation/resources/k8s-tutorials/infrastructure-tutorials/infra-for-ha/_index.md +++ b/content/rancher/v2.0-v2.4/en/installation/resources/k8s-tutorials/infrastructure-tutorials/infra-for-ha/_index.md @@ -9,7 +9,8 @@ This tutorial is intended to help you create a high-availability RKE cluster tha To install the Rancher management server on a high-availability RKE cluster, we recommend setting up the following infrastructure: -- **Three Linux nodes,** typically virtual machines, in an infrastructure provider such as Amazon's EC2, Google Compute Engine, or vSphere. +- **Three Linux nodes,** typically virtual machines, in an infrastructure provider such as Amazon's EC2, Google Compute Engine, Azure, or vSphere. + * **Note:** When installing Rancher with Helm in Azure, use the L7 load balancer to avoid networking issues. Please refer [here](https://docs.microsoft.com/en-us/azure/load-balancer/components#limitations) for more information on Azure load balancer limitations. - **A load balancer** to direct front-end traffic to the three nodes. - **A DNS record** to map a URL to the load balancer. This will become the Rancher server URL, and downstream Kubernetes clusters will need to reach it. diff --git a/content/rancher/v2.5/en/backups/configuration/backup-config/_index.md b/content/rancher/v2.5/en/backups/configuration/backup-config/_index.md index 5ec2433fc76..b162250b9eb 100644 --- a/content/rancher/v2.5/en/backups/configuration/backup-config/_index.md +++ b/content/rancher/v2.5/en/backups/configuration/backup-config/_index.md @@ -89,7 +89,7 @@ The S3 storage location contains the following configuration fields: 1. **Credential Secret** (optional): If you need to use the AWS Access keys Secret keys to access s3 bucket, create a secret with your credentials with keys and the directives `accessKey` and `secretKey`. It can be in any namespace. An example secret is [here.](#example-credentialsecret) This directive is unnecessary if the nodes running your operator are in EC2 and set up with IAM permissions that allow them to access S3, as described in [this section.](#iam-permissions-for-ec2-nodes-to-access-s3) The Credential Secret dropdown lists the secrets in all namespaces. 1. **Bucket Name**: The name of the S3 bucket where backup files will be stored. 1. **Region** (optional): The AWS [region](https://aws.amazon.com/about-aws/global-infrastructure/regions_az/) where the S3 bucket is located. This field isn't needed for configuring MinIO. -1. **Folder** (optional): The name of the folder in the S3 bucket where backup files will be stored. +1. **Folder** (optional): The name of the folder in the S3 bucket where backup files will be stored. Nested folders (e.g., `rancher/cluster1`) are not supported. 1. **Endpoint**: The [endpoint](https://docs.aws.amazon.com/general/latest/gr/s3.html) that is used to access S3 in the region of your bucket. 1. **Endpoint CA** (optional): This should be the Base64 encoded CA cert. For an example, refer to the [example S3 compatible configuration.](#example-s3-storage-configuration) 1. **Skip TLS Verifications** (optional): Set to true if you are not using TLS. @@ -100,7 +100,7 @@ The S3 storage location contains the following configuration fields: | `credentialSecretName` | If you need to use the AWS Access keys Secret keys to access s3 bucket, create a secret with your credentials with keys and the directives `accessKey` and `secretKey`. It can be in any namespace as long as you provide that namespace in `credentialSecretNamespace`. An example secret is [here.](#example-credentialsecret) This directive is unnecessary if the nodes running your operator are in EC2 and set up with IAM permissions that allow them to access S3, as described in [this section.](#iam-permissions-for-ec2-nodes-to-access-s3) | | | `credentialSecretNamespace` | The namespace of the secret containing the credentials to access S3. This directive is unnecessary if the nodes running your operator are in EC2 and set up with IAM permissions that allow them to access S3, as described in [this section.](#iam-permissions-for-ec2-nodes-to-access-s3) | | | `bucketName` | The name of the S3 bucket where backup files will be stored. | ✓ | -| `folder` | The name of the folder in the S3 bucket where backup files will be stored. | | +| `folder` | The name of the folder in the S3 bucket where backup files will be stored. Nested folders (e.g., `rancher/cluster1`) are not supported. | | | `region` | The AWS [region](https://aws.amazon.com/about-aws/global-infrastructure/regions_az/) where the S3 bucket is located. | ✓ | | `endpoint` | The [endpoint](https://docs.aws.amazon.com/general/latest/gr/s3.html) that is used to access S3 in the region of your bucket. | ✓ | | `endpointCA` | This should be the Base64 encoded CA cert. For an example, refer to the [example S3 compatible configuration.](#example-s3-storage-configuration) | | @@ -136,8 +136,8 @@ metadata: name: creds type: Opaque data: - accessKey: - secretKey: + accessKey: + secretKey: ``` ### IAM Permissions for EC2 Nodes to Access S3 @@ -183,4 +183,4 @@ After the role is created, and you have attached the corresponding instance prof # Examples -For example Backup custom resources, refer to [this page.](../../examples/#backup) \ No newline at end of file +For example Backup custom resources, refer to [this page.](../../examples/#backup) diff --git a/content/rancher/v2.5/en/backups/examples/_index.md b/content/rancher/v2.5/en/backups/examples/_index.md index 8b79893a849..83496c18f99 100644 --- a/content/rancher/v2.5/en/backups/examples/_index.md +++ b/content/rancher/v2.5/en/backups/examples/_index.md @@ -269,8 +269,8 @@ metadata: name: creds type: Opaque data: - accessKey: - secretKey: + accessKey: + secretKey: ``` # Example EncryptionConfiguration diff --git a/content/rancher/v2.5/en/backups/migrating-rancher/_index.md b/content/rancher/v2.5/en/backups/migrating-rancher/_index.md index 79a79dac064..1fc70aee590 100644 --- a/content/rancher/v2.5/en/backups/migrating-rancher/_index.md +++ b/content/rancher/v2.5/en/backups/migrating-rancher/_index.md @@ -21,11 +21,12 @@ Rancher can be installed on any Kubernetes cluster, including hosted Kubernetes - [K3s Kubernetes installation docs]({{}}/k3s/latest/en/installation/) ### 1. Install the rancher-backup Helm chart +Install version 1.x.x of the rancher-backup chart. ``` helm repo add rancher-charts https://charts.rancher.io helm repo update -helm install rancher-backup-crd rancher-charts/rancher-backup-crd -n cattle-resources-system --create-namespace -helm install rancher-backup rancher-charts/rancher-backup -n cattle-resources-system +helm install rancher-backup-crd rancher-charts/rancher-backup-crd -n cattle-resources-system --create-namespace --version $CHART_VERSION +helm install rancher-backup rancher-charts/rancher-backup -n cattle-resources-system --version $CHART_VERSION ``` ### 2. Restore from backup using a Restore custom resource @@ -39,8 +40,8 @@ metadata: name: s3-creds type: Opaque stringData: - accessKey: - secretKey: + accessKey: + secretKey: ``` This secret can be created in any namespace, with the above example it will get created in the default namespace diff --git a/content/rancher/v2.5/en/backups/restoring-rancher/_index.md b/content/rancher/v2.5/en/backups/restoring-rancher/_index.md index 2791485efed..d6ab3d801e1 100644 --- a/content/rancher/v2.5/en/backups/restoring-rancher/_index.md +++ b/content/rancher/v2.5/en/backups/restoring-rancher/_index.md @@ -56,8 +56,17 @@ To check how the restore is progressing, you can check the logs of the operator. ``` kubectl logs -n cattle-resources-system -l app.kubernetes.io/name=rancher-backup -f - +``` ### Cleanup -If you created the restore resource with kubectl, remove the resource to prevent a naming conflict with future restores. \ No newline at end of file +If you created the restore resource with kubectl, remove the resource to prevent a naming conflict with future restores. + +### Known Issues +In some cases, after restoring the backup, Rancher logs will show errors similar to the following: +``` +2021/10/05 21:30:45 [ERROR] error syncing 'c-89d82/m-4067aa68dd78': handler rke-worker-upgrader: clusters.management.cattle.io "c-89d82" not found, requeuing +``` +This happens because one of the resources that was just restored has finalizers but the related resources have been deleted so the handler cannot find it. + +To eliminate the errors, we need to find and delete the resource that causes the error. See more information [here](https://github.com/rancher/rancher/issues/35050#issuecomment-937968556) diff --git a/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md b/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md index 157b0ca2492..eab3d5a8d23 100644 --- a/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md +++ b/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md @@ -13,6 +13,13 @@ First, you will set up your Azure cloud credentials in Rancher. Then you will us Then you will create an Azure cluster in Rancher, and when configuring the new cluster, you will define node pools for it. Each node pool will have a Kubernetes role of etcd, controlplane, or worker. Rancher will install Kubernetes on the new nodes, and it will set up each node with the Kubernetes role defined by the node pool. +>**Warning:** When the Rancher RKE cluster is running in Azure and has an Azure load balancer in front, the outbound flow will fail. The workaround for this problem is as follows: + +> - Terminate the SSL/TLS on the internal load balancer +> - Use the L7 load balancer + +> For more information, refer to the documentation on [Azure load balancer limitations](https://docs.microsoft.com/en-us/azure/load-balancer/components#limitations). + For more information on configuring the Kubernetes cluster that Rancher will install on the Azure nodes, refer to the [RKE cluster configuration reference.]({{}}/rancher/v2.5/en/cluster-provisioning/rke-clusters/options) For more information on configuring Azure node templates, refer to the [Azure node template configuration reference.](./azure-node-template-config) diff --git a/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md b/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md index 24d1a59a0fb..abea9bad31e 100644 --- a/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md +++ b/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md @@ -15,6 +15,7 @@ Fleet is a separate project from Rancher, and can be installed on any Kubernetes - [Accessing Fleet in the Rancher UI](#accessing-fleet-in-the-rancher-ui) - [Windows Support](#windows-support) - [GitHub Repository](#github-repository) +- [Using Fleet Behind a Proxy](#using-fleet-behind-a-proxy) - [Documentation](#documentation) # Architecture @@ -46,8 +47,3 @@ For details on using Fleet behind a proxy, see [this page.](./proxy) # Documentation The Fleet documentation is at [https://fleet.rancher.io/.](https://fleet.rancher.io/) - - -### Using Fleet Behind a Proxy - -For details on using Fleet with a proxy, see [this page.](./proxy) \ No newline at end of file diff --git a/content/rancher/v2.5/en/installation/install-rancher-on-k8s/_index.md b/content/rancher/v2.5/en/installation/install-rancher-on-k8s/_index.md index 4c34d5acc48..01d5ee5f778 100644 --- a/content/rancher/v2.5/en/installation/install-rancher-on-k8s/_index.md +++ b/content/rancher/v2.5/en/installation/install-rancher-on-k8s/_index.md @@ -34,6 +34,7 @@ For help setting up a Kubernetes cluster, we provide these tutorials: - **K3s:** For the tutorial to install a K3s Kubernetes cluster, refer to [this page.]({{}}/rancher/v2.5/en/installation/resources/k8s-tutorials/ha-with-external-db) For help setting up the infrastructure for a high-availability K3s cluster, refer to [this page.]({{}}/rancher/v2.5/en/installation/resources/k8s-tutorials/infrastructure-tutorials/infra-for-ha-with-external-db) - **RKE2:** For the tutorial to install an RKE2 Kubernetes cluster, refer to [this page.]({{}}/rancher/v2.5/en/installation/resources/k8s-tutorials/ha-rke2) For help setting up the infrastructure for a high-availability RKE2 cluster, refer to [this page.]({{}}/rancher/v2.5/en/installation/resources/k8s-tutorials/infrastructure-tutorials/infra-for-rke2-ha) - **Amazon EKS:** For details on how to install Rancher on Amazon EKS, including how to install an ingress so that the Rancher server can be accessed, refer to [this page.]({{}}/rancher/v2.5/en/installation/install-rancher-on-k8s/amazon-eks) +- **AKS:** For details on how to install Rancher with Azure Kubernetes Service, including how to install an ingress so that the Rancher server can be accessed, refer to [this page.]({{}}/rancher/v2.5/en/installation/install-rancher-on-k8s/aks) - **GKE:** For details on how to install Rancher with Google Kubernetes Engine, including how to install an ingress so that the Rancher server can be accessed, refer to [this page.]({{}}/rancher/v2.5/en/installation/install-rancher-on-k8s/gke) ### CLI Tools diff --git a/content/rancher/v2.5/en/installation/install-rancher-on-k8s/aks/_index.md b/content/rancher/v2.5/en/installation/install-rancher-on-k8s/aks/_index.md index 08b873dd53b..eb273d4348f 100644 --- a/content/rancher/v2.5/en/installation/install-rancher-on-k8s/aks/_index.md +++ b/content/rancher/v2.5/en/installation/install-rancher-on-k8s/aks/_index.md @@ -4,7 +4,7 @@ shortTitle: AKS weight: 4 --- -This page covers how to install Rancher on Microsoft's Azure Kubernetes Servcice (AKS). +This page covers how to install Rancher on Microsoft's Azure Kubernetes Service (AKS). The guide uses command line tools to provision an AKS cluster with an ingress. If you prefer to provision your cluster using the Azure portal, refer to the [official documentation](https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough-portal). @@ -19,6 +19,7 @@ If you already have an AKS Kubernetes cluster, skip to the step about [installin - [Microsoft Azure Subscription](https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/create-subscription#create-a-subscription-in-the-azure-portal): Use this link to follow a tutorial to create a Microsoft Azure subscription if you don't have one yet. - [Micsoroft Azure Tenant](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-create-new-tenant): Use this link and follow instructions to create a Microsoft Azure tenant. - Your subscription has sufficient quota for at least 2 vCPUs. For details on Rancher server resource requirements, refer to [this section]({{}}/rancher/v2.5/en/installation/requirements/#rke-and-hosted-kubernetes) +- When installing Rancher with Helm in Azure, use the L7 load balancer to avoid networking issues. For more information, refer to the documentation on [Azure load balancer limitations](https://docs.microsoft.com/en-us/azure/load-balancer/components#limitations). # 1. Prepare your Workstation @@ -44,13 +45,13 @@ az group create --name rancher-rg --location eastus # 3. Create the AKS Cluster -To create an AKS cluster, run the following command. Use a VM size that applies to your use case. Refer to [this article](https://docs.microsoft.com/en-us/azure/virtual-machines/sizes) for available sizes and options. +To create an AKS cluster, run the following command. Use a VM size that applies to your use case. Refer to [this article](https://docs.microsoft.com/en-us/azure/virtual-machines/sizes) for available sizes and options. When choosing a Kubernetes version, be sure to first consult the [support matrix](https://rancher.com/support-matrix/) to find the highest version of Kubernetes that has been validated for your Rancher version. ``` az aks create \ - --resource-group rancher-rg + --resource-group rancher-rg \ --name rancher-server \ - --kubernetes-version 1.18.14 \ + --kubernetes-version 1.20.5 \ --node-count 3 \ --node-vm-size Standard_D2_v3 ``` diff --git a/content/rancher/v2.5/en/installation/install-rancher-on-k8s/amazon-eks/_index.md b/content/rancher/v2.5/en/installation/install-rancher-on-k8s/amazon-eks/_index.md index 0e9b59f7120..7bbcf58695c 100644 --- a/content/rancher/v2.5/en/installation/install-rancher-on-k8s/amazon-eks/_index.md +++ b/content/rancher/v2.5/en/installation/install-rancher-on-k8s/amazon-eks/_index.md @@ -81,12 +81,12 @@ Then enter the following values: ### 3. Create the EKS Cluster -To create an EKS cluster, run the following command. Use the AWS region that applies to your use case: +To create an EKS cluster, run the following command. Use the AWS region that applies to your use case. When choosing a Kubernetes version, be sure to first consult the [support matrix](https://rancher.com/support-matrix/) to find the highest version of Kubernetes that has been validated for your Rancher version. ``` eksctl create cluster \ --name rancher-server \ - --version 1.18 \ + --version 1.20 \ --region us-west-2 \ --nodegroup-name ranchernodes \ --nodes 3 \ @@ -163,4 +163,4 @@ There are many valid ways to set up the DNS. For help, refer to the AWS document Next, install the Rancher Helm chart by following the instructions on [this page.]({{}}/rancher/v2.5/en/installation/install-rancher-on-k8s/#install-the-rancher-helm-chart) The Helm instructions are the same for installing Rancher on any Kubernetes distribution. -Use that DNS name from the previous step as the Rancher server URL when you install Rancher. It can be passed in as a Helm option. For example, if the DNS name is `rancher.my.org`, you could run the Helm installation command with the option `--set hostname=rancher.my.org`. \ No newline at end of file +Use that DNS name from the previous step as the Rancher server URL when you install Rancher. It can be passed in as a Helm option. For example, if the DNS name is `rancher.my.org`, you could run the Helm installation command with the option `--set hostname=rancher.my.org`. diff --git a/content/rancher/v2.5/en/installation/install-rancher-on-k8s/chart-options/_index.md b/content/rancher/v2.5/en/installation/install-rancher-on-k8s/chart-options/_index.md index 52ec71d6256..5f922b37e88 100644 --- a/content/rancher/v2.5/en/installation/install-rancher-on-k8s/chart-options/_index.md +++ b/content/rancher/v2.5/en/installation/install-rancher-on-k8s/chart-options/_index.md @@ -99,14 +99,9 @@ You can set extra environment variables for Rancher server using `extraEnv`. Thi ### TLS Settings -To set a different TLS configuration, you can use the `CATTLE_TLS_MIN_VERSION` and `CATTLE_TLS_CIPHERS` environment variables. For example, to configure TLS 1.0 as minimum accepted TLS version: +When you install Rancher inside of a Kubernetes cluster, TLS is offloaded at the cluster's ingress controller. The possible TLS settings depend on the used ingress controller. -```plain ---set 'extraEnv[0].name=CATTLE_TLS_MIN_VERSION' ---set 'extraEnv[0].value=1.0' -``` - -See [TLS settings]({{}}/rancher/v2.5/en/admin-settings/tls-settings) for more information and options. +See [TLS settings]({{}}/rancher/v2.5/en/installation/resources/tls-settings) for more information and options. ### Import `local` Cluster diff --git a/content/rancher/v2.5/en/installation/install-rancher-on-k8s/gke/_index.md b/content/rancher/v2.5/en/installation/install-rancher-on-k8s/gke/_index.md index 492a2f60ccc..0bb0b01f39e 100644 --- a/content/rancher/v2.5/en/installation/install-rancher-on-k8s/gke/_index.md +++ b/content/rancher/v2.5/en/installation/install-rancher-on-k8s/gke/_index.md @@ -117,8 +117,10 @@ The following command creates a three-node cluster. Replace `cluster-name` with the name of your new cluster. +When choosing a Kubernetes version, be sure to first consult the [support matrix](https://rancher.com/support-matrix/) to find the highest version of Kubernetes that has been validated for your Rancher version. + ``` -gcloud container clusters create cluster-name --num-nodes=3 +gcloud container clusters create cluster-name --num-nodes=3 --cluster-version=1.20.10-gke.301 ``` # 6. Get Authentication Credentials @@ -177,4 +179,4 @@ There are many valid ways to set up the DNS. For help, refer to the Google Cloud Next, install the Rancher Helm chart by following the instructions on [this page.]({{}}/rancher/v2.5/en/installation/install-rancher-on-k8s/#install-the-rancher-helm-chart) The Helm instructions are the same for installing Rancher on any Kubernetes distribution. -Use the DNS name from the previous step as the Rancher server URL when you install Rancher. It can be passed in as a Helm option. For example, if the DNS name is `rancher.my.org`, you could run the Helm installation command with the option `--set hostname=rancher.my.org`. \ No newline at end of file +Use the DNS name from the previous step as the Rancher server URL when you install Rancher. It can be passed in as a Helm option. For example, if the DNS name is `rancher.my.org`, you could run the Helm installation command with the option `--set hostname=rancher.my.org`. diff --git a/content/rancher/v2.5/en/installation/resources/chart-options/_index.md b/content/rancher/v2.5/en/installation/resources/chart-options/_index.md deleted file mode 100644 index 600b285548b..00000000000 --- a/content/rancher/v2.5/en/installation/resources/chart-options/_index.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -title: Rancher Helm Chart Options -weight: 50 -aliases: - - /rancher/v2.x/en/installation/resources/chart-options/ ---- - -The Rancher Helm chart options reference moved to [this page.]({{}}/rancher/v2.5/en/installation/install-rancher-on-k8s/chart-options/) \ No newline at end of file diff --git a/content/rancher/v2.5/en/installation/resources/k8s-tutorials/ha-rke2/_index.md b/content/rancher/v2.5/en/installation/resources/k8s-tutorials/ha-rke2/_index.md index 390dfe259ee..64d7472dbdd 100644 --- a/content/rancher/v2.5/en/installation/resources/k8s-tutorials/ha-rke2/_index.md +++ b/content/rancher/v2.5/en/installation/resources/k8s-tutorials/ha-rke2/_index.md @@ -29,7 +29,13 @@ If you do not specify a pre-shared secret, RKE2 will generate one and place it a To avoid certificate errors with the fixed registration address, you should launch the server with the tls-san parameter set. This option adds an additional hostname or IP as a Subject Alternative Name in the server's TLS cert, and it can be specified as a list if you would like to access via both the IP and the hostname. -Here is an example of what the RKE2 config file (at /etc/rancher/rke2/config.yaml) would look like if you are following this guide: +First, you must create the directory where the RKE2 config file is going to be placed: + +``` +mkdir -p /etc/rancher/rke2/ +``` + +Next, create the RKE2 config file at `/etc/rancher/rke2/config.yaml` using the following example: ``` token: my-shared-secret @@ -37,7 +43,7 @@ tls-san: - my-kubernetes-domain.com - another-kubernetes-domain.com ``` -After that you need to run the install command and enable and start rke2: +After that, you need to run the install command and enable and start rke2: ``` curl -sfL https://get.rke2.io | INSTALL_RKE2_CHANNEL=v1.20 sh - @@ -51,7 +57,7 @@ systemctl start rke2-server.service tls-san: - my-kubernetes-domain.com - another-kubernetes-domain.com -After that you need to run the installer and enable then start rke2 +After that, you need to run the installer and enable, then start, rke2: curl -sfL https://get.rke2.io | sh - systemctl enable rke2-server.service diff --git a/content/rancher/v2.5/en/installation/resources/tls-settings/_index.md b/content/rancher/v2.5/en/installation/resources/tls-settings/_index.md index 3c97f7472ca..b691e069d55 100644 --- a/content/rancher/v2.5/en/installation/resources/tls-settings/_index.md +++ b/content/rancher/v2.5/en/installation/resources/tls-settings/_index.md @@ -8,30 +8,20 @@ aliases: - /rancher/v2.x/en/installation/resources/tls-settings/ --- -The default TLS configuration only accepts TLS 1.2 and secure TLS cipher suites. TLS 1.3 and TLS 1.3 exclusive cipher suites are not supported. +Changing the default TLS settings depends on the chosen installation method. -# Configuring TLS settings +# Running Rancher in a highly available Kubernetes cluster -The Audit Log is enabled and configured by passing environment variables to the Rancher server container. See the following to enable on your installation. +When you install Rancher inside of a Kubernetes cluster, TLS is offloaded at the cluster's ingress controller. The possible TLS settings depend on the used ingress controller: -- [TLS settings in Docker options]({{}}/rancher/v2.5/en/installation/other-installation-methods/single-node-docker/advanced/#tls-settings) +* nginx-ingress-controller (default for RKE1 and RKE2): [Default TLS Version and Ciphers](https://kubernetes.github.io/ingress-nginx/user-guide/tls/#default-tls-version-and-ciphers). +* traefik (default for K3s): [TLS Options](https://doc.traefik.io/traefik/https/tls/#tls-options). -- [TLS settings in Helm chart options]({{}}/rancher/v2.5/en/installation/install-rancher-on-k8s/chart-options/#tls-settings) +# Running Rancher in a single Docker container -# TLS Environment Variables +The default TLS configuration only accepts TLS 1.2 and secure TLS cipher suites. You can change this by setting the following environment variables: | Parameter | Description | Default | Available options | |-----|-----|-----|-----| -| `CATTLE_TLS_MIN_VERSION` | Minimum TLS version | `1.2` | `1.0`, `1.1`, `1.2` | -| `CATTLE_TLS_CIPHERS` | Allowed TLS cipher suites | `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,`
`TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,`
`TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,`
`TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,`
`TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,`
`TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305` | See [Golang tls constants](https://golang.org/pkg/crypto/tls/#pkg-constants) | - - -# Legacy configuration - -If you need to configure TLS the same way as it was before Rancher v2.1.7, please use the following settings: - - -| Parameter | Legacy value | -|-----|-----| -| `CATTLE_TLS_MIN_VERSION` | `1.0` | -| `CATTLE_TLS_CIPHERS` | `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,`
`TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,`
`TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,`
`TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,`
`TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,`
`TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,`
`TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,`
`TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,`
`TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,`
`TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,`
`TLS_RSA_WITH_AES_128_GCM_SHA256,`
`TLS_RSA_WITH_AES_256_GCM_SHA384,`
`TLS_RSA_WITH_AES_128_CBC_SHA,`
`TLS_RSA_WITH_AES_256_CBC_SHA,`
`TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,`
`TLS_RSA_WITH_3DES_EDE_CBC_SHA` +| `CATTLE_TLS_MIN_VERSION` | Minimum TLS version | `1.2` | `1.0`, `1.1`, `1.2`, `1.3` | +| `CATTLE_TLS_CIPHERS` | Allowed TLS cipher suites | `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`,
`TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384`,
`TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305`,
`TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`,
`TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`,
`TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305` | See [Golang tls constants](https://golang.org/pkg/crypto/tls/#pkg-constants) | diff --git a/content/rancher/v2.5/en/istio/resources/_index.md b/content/rancher/v2.5/en/istio/resources/_index.md index 6100804080c..b1b4c7bafe9 100644 --- a/content/rancher/v2.5/en/istio/resources/_index.md +++ b/content/rancher/v2.5/en/istio/resources/_index.md @@ -19,7 +19,7 @@ Before enabling Istio, we recommend that you confirm that your Rancher worker no The table below shows a summary of the minimum recommended resource requests and limits for the CPU and memory of each core Istio component. -In Kubernetes, the resource request indicates that the workload will not deployed on a node unless the node has at least the specified amount of memory and CPU available. If the workload surpasses the limit for CPU or memory, it can be terminated or evicted from the node. For more information on managing resource limits for containers, refer to the [Kubernetes documentation.](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/) +In Kubernetes, the resource request indicates that the workload will not be deployed on a node unless the node has at least the specified amount of memory and CPU available. If the workload surpasses the limit for CPU or memory, it can be terminated or evicted from the node. For more information on managing resource limits for containers, refer to the [Kubernetes documentation.](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/) {{% tabs %}} {{% tab "v2.5.6+" %}} diff --git a/content/rancher/v2.6/en/api/api-tokens/_index.md b/content/rancher/v2.6/en/api/api-tokens/_index.md index f4752f1a7ab..c682ae8460d 100644 --- a/content/rancher/v2.6/en/api/api-tokens/_index.md +++ b/content/rancher/v2.6/en/api/api-tokens/_index.md @@ -34,13 +34,14 @@ Here is the complete list of tokens that are generated with `ttl=0`: Admins can set a global TTL on Kubeconfig tokens. Once the token expires the kubectl command will require the user to authenticate to Rancher. -1. Disable the kubeconfig-generate-token setting in the Rancher API view at `https://}}/rancher/v2.6/en/cli) to retrieve a short lived token for the cluster. When you use this kubeconfig in a client, such as `kubectl`, the Rancher CLI needs to be installed as well. + +2. Set the `kubeconfig-token-ttl-minutes` setting to the desired duration in minutes. By default, `kubeconfig-token-ttl-minutes` is 960 (16 hours). -4. Edit the setting and set the value to desired duration in minutes. _**Note:**_ This value cannot exceed max-ttl of API tokens.(`https:// - secretKey: + accessKey: + secretKey: ``` ### IAM Permissions for EC2 Nodes to Access S3 @@ -173,4 +173,4 @@ After the role is created, and you have attached the corresponding instance prof # Examples -For example Backup custom resources, refer to [this page.](../../examples/#backup) \ No newline at end of file +For example Backup custom resources, refer to [this page.](../../examples/#backup) diff --git a/content/rancher/v2.6/en/backups/examples/_index.md b/content/rancher/v2.6/en/backups/examples/_index.md index b73e0405afd..87c607b7780 100644 --- a/content/rancher/v2.6/en/backups/examples/_index.md +++ b/content/rancher/v2.6/en/backups/examples/_index.md @@ -266,8 +266,8 @@ metadata: name: creds type: Opaque data: - accessKey: - secretKey: + accessKey: + secretKey: ``` # Example EncryptionConfiguration diff --git a/content/rancher/v2.6/en/backups/migrating-rancher/_index.md b/content/rancher/v2.6/en/backups/migrating-rancher/_index.md index 191eea93428..0154b6b1bd7 100644 --- a/content/rancher/v2.6/en/backups/migrating-rancher/_index.md +++ b/content/rancher/v2.6/en/backups/migrating-rancher/_index.md @@ -19,11 +19,12 @@ Rancher can be installed on any Kubernetes cluster, including hosted Kubernetes - [K3s Kubernetes installation docs]({{}}/k3s/latest/en/installation/) ### 1. Install the rancher-backup Helm chart +Install version 2.x.x of the rancher-backup chart. ``` helm repo add rancher-charts https://charts.rancher.io helm repo update -helm install rancher-backup-crd rancher-charts/rancher-backup-crd -n cattle-resources-system --create-namespace -helm install rancher-backup rancher-charts/rancher-backup -n cattle-resources-system +helm install rancher-backup-crd rancher-charts/rancher-backup-crd -n cattle-resources-system --create-namespace --version $CHART_VERSION +helm install rancher-backup rancher-charts/rancher-backup -n cattle-resources-system --version $CHART_VERSION ``` ### 2. Restore from backup using a Restore custom resource @@ -37,8 +38,8 @@ metadata: name: s3-creds type: Opaque stringData: - accessKey: - secretKey: + accessKey: + secretKey: ``` This secret can be created in any namespace, with the above example it will get created in the default namespace diff --git a/content/rancher/v2.6/en/backups/restoring-rancher/_index.md b/content/rancher/v2.6/en/backups/restoring-rancher/_index.md index f7ed081c124..0d9925329a1 100644 --- a/content/rancher/v2.6/en/backups/restoring-rancher/_index.md +++ b/content/rancher/v2.6/en/backups/restoring-rancher/_index.md @@ -57,4 +57,13 @@ kubectl logs -n cattle-resources-system -l app.kubernetes.io/name=rancher-backup ### Cleanup -If you created the restore resource with kubectl, remove the resource to prevent a naming conflict with future restores. \ No newline at end of file +If you created the restore resource with kubectl, remove the resource to prevent a naming conflict with future restores. + +### Known Issues +In some cases, after restoring the backup, Rancher logs will show errors similar to the following: +``` +2021/10/05 21:30:45 [ERROR] error syncing 'c-89d82/m-4067aa68dd78': handler rke-worker-upgrader: clusters.management.cattle.io "c-89d82" not found, requeuing +``` +This happens because one of the resources that was just restored has finalizers but the related resources have been deleted so the handler cannot find it. + +To eliminate the errors, we need to find and delete the resource that causes the error. See more information [here](https://github.com/rancher/rancher/issues/35050#issuecomment-937968556) diff --git a/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md b/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md index 30ed0bde851..38eb69b8cb1 100644 --- a/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md +++ b/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md @@ -16,3 +16,5 @@ Certificates can be rotated for the following services: - kube-scheduler - kube-controller-manager +> **Note:** For users who didn't rotate their webhook certificates, and they have expired after one year, please see this [page]({{}}/rancher/v2.6/en/troubleshooting/expired-webhook-certificates/) for help. + diff --git a/content/rancher/v2.6/en/cluster-admin/editing-clusters/aks-config-reference/_index.md b/content/rancher/v2.6/en/cluster-admin/editing-clusters/aks-config-reference/_index.md index 02b70c5ee55..1b522f15ad3 100644 --- a/content/rancher/v2.6/en/cluster-admin/editing-clusters/aks-config-reference/_index.md +++ b/content/rancher/v2.6/en/cluster-admin/editing-clusters/aks-config-reference/_index.md @@ -21,10 +21,6 @@ Rancher can configure member roles for AKS clusters in the same way as any other > The configuration information in this section assumes you have already set up a service principal for Rancher. For step-by-step instructions for how to set up the service principal, see [this section.]({{}}/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/aks/#prerequisites-in-microsoft-azure) -### Tenant ID - -To get the tenant ID, go to the Azure Portal, then click **Azure Active Directory**, then click **App registrations**, then click the name of the service principal. The tenant ID is listed on the app registration detail page as **Directory (tenant) ID**. - ### Subscription ID To get the subscription ID, click **All Services** in the left navigation bar. Then click **Subscriptions**. Go to the name of the subscription that you want to associate with your Kubernetes cluster and copy the **Subscription ID**. diff --git a/content/rancher/v2.6/en/cluster-provisioning/cluster-capabilities-table/index.md b/content/rancher/v2.6/en/cluster-provisioning/cluster-capabilities-table/index.md index b1701f346b3..2ea295d4617 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/cluster-capabilities-table/index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/cluster-capabilities-table/index.md @@ -12,11 +12,11 @@ headless: true | [Managing Persistent Volumes and Storage Classes]({{}}/rancher/v2.6/en/cluster-admin/volumes-and-storage/) | ✓ | ✓ | ✓ | ✓ | | [Managing Projects, Namespaces and Workloads]({{}}/rancher/v2.6/en/cluster-admin/projects-and-namespaces/) | ✓ | ✓ | ✓ | ✓ | | [Using App Catalogs]({{}}/rancher/v2.6/en/helm-charts/) | ✓ | ✓ | ✓ | ✓ | -| Configuring Tools (Alerts, Notifiers, Logging, Monitoring, Istio) | ✓ | ✓ | ✓ | ✓ | +| Configuring Tools ([Alerts, Notifiers, Monitoring]({{}}/rancher/v2.6/en/monitoring-alerting/), [Logging]({{}}/rancher/v2.6/en/logging/), [Istio]({{}}/rancher/v2.6/en/istio/)) | ✓ | ✓ | ✓ | ✓ | | [Running Security Scans]({{}}/rancher/v2.6/en/security/security-scan/) | ✓ | ✓ | ✓ | ✓ | | [Use existing configuration to create additional clusters]({{}}/rancher/v2.6/en/cluster-admin/cloning-clusters/)| ✓ | ✓ | ✓ | | | [Ability to rotate certificates]({{}}/rancher/v2.6/en/cluster-admin/certificate-rotation/) | ✓ | ✓ | | | -| [Ability to [backup]({{}}/rancher/v2.6/en/cluster-admin/backing-up-etcd/) and [restore]({{}}/rancher/v2.6/en/cluster-admin/restoring-etcd/) Rancher-launched clusters | ✓ | ✓ | | ✓4 | +| Ability to [backup]({{}}/rancher/v2.6/en/cluster-admin/backing-up-etcd/) and [restore]({{}}/rancher/v2.6/en/cluster-admin/restoring-etcd/) Rancher-launched clusters | ✓ | ✓ | | ✓4 | | [Cleaning Kubernetes components when clusters are no longer reachable from Rancher]({{}}/rancher/v2.6/en/cluster-admin/cleaning-cluster-nodes/) | ✓ | | | | | [Configuring Pod Security Policies]({{}}/rancher/v2.6/en/cluster-admin/pod-security-policy/) | ✓ | ✓ | || diff --git a/content/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/aks/_index.md b/content/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/aks/_index.md index 64157308900..e3aa18629c8 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/aks/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/aks/_index.md @@ -27,7 +27,6 @@ To interact with Azure APIs, an AKS cluster requires an Azure Active Directory ( Before creating the service principal, you need to obtain the following information from the [Microsoft Azure Portal](https://portal.azure.com): - Subscription ID -- Tenant ID - Client ID - Client secret @@ -84,7 +83,7 @@ You can also follow these instructions to set up a service principal and give it 1. Optional: Choose which accounts can use the service principal. 1. Click **Register**. 1. You should now see the name of your service principal under **Azure Active Directory > App registrations**. -1. Click the name of your service principal. Take note of the tenant ID and application ID (also called app ID or client ID) so that you can use it when provisioning your AKS cluster. Then click **Certificates & secrets**. +1. Click the name of your service principal. Take note of the application ID (also called app ID or client ID) so that you can use it when provisioning your AKS cluster. Then click **Certificates & secrets**. 1. Click **New client secret**. 1. Enter a short description, pick an expiration time, and click **Add**. Take note of the client secret so that you can use it when provisioning the AKS cluster. diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md index d771d0804e4..c918601b214 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md @@ -10,6 +10,13 @@ First, you will set up your Azure cloud credentials in Rancher. Then you will us Then you will create an Azure cluster in Rancher, and when configuring the new cluster, you will define node pools for it. Each node pool will have a Kubernetes role of etcd, controlplane, or worker. Rancher will install Kubernetes on the new nodes, and it will set up each node with the Kubernetes role defined by the node pool. +>**Warning:** When the Rancher RKE cluster is running in Azure and has an Azure load balancer in front, the outbound flow will fail. The workaround for this problem is as follows: + +> - Terminate the SSL/TLS on the internal load balancer +> - Use the L7 load balancer + +> For more information, refer to the documentation on [Azure load balancer limitations](https://docs.microsoft.com/en-us/azure/load-balancer/components#limitations). + For more information on configuring the Kubernetes cluster that Rancher will install on the Azure nodes, refer to the [RKE cluster configuration reference.]({{}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/options) For more information on configuring Azure node templates, refer to the [Azure node template configuration reference.](./azure-node-template-config) @@ -32,7 +39,7 @@ az ad sp create-for-rbac \ --scopes="/subscriptions/" ``` -The creation of this service principal returns three pieces of identification information, *The application ID, also called the client ID*, *The client secret*, and *The tenant ID*. This information will be used when you create a node template for Azure. +The creation of this service principal returns three pieces of identification information, *The application ID, also called the client ID*, and *The client secret*. This information will be used when you create a node template for Azure. # Creating an Azure Cluster @@ -91,4 +98,4 @@ You can access your cluster after its state is updated to **Active**. After creating your cluster, you can access it through the Rancher UI. As a best practice, we recommend setting up these alternate ways of accessing your cluster: - **Access your cluster with the kubectl CLI:** Follow [these steps]({{}}/rancher/v2.6/en/cluster-admin/cluster-access/kubectl/#accessing-clusters-with-kubectl-on-your-workstation) to access clusters with kubectl on your workstation. In this case, you will be authenticated through the Rancher server’s authentication proxy, then Rancher will connect you to the downstream cluster. This method lets you manage the cluster without the Rancher UI. -- **Access your cluster with the kubectl CLI, using the authorized cluster endpoint:** Follow [these steps]({{}}/rancher/v2.6/en/cluster-admin/cluster-access/kubectl/#authenticating-directly-with-a-downstream-cluster) to access your cluster with kubectl directly, without authenticating through Rancher. We recommend setting up this alternative method to access your cluster so that in case you can’t connect to Rancher, you can still access the cluster. \ No newline at end of file +- **Access your cluster with the kubectl CLI, using the authorized cluster endpoint:** Follow [these steps]({{}}/rancher/v2.6/en/cluster-admin/cluster-access/kubectl/#authenticating-directly-with-a-downstream-cluster) to access your cluster with kubectl directly, without authenticating through Rancher. We recommend setting up this alternative method to access your cluster so that in case you can’t connect to Rancher, you can still access the cluster. diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md index 8506ffee697..1d5b9d4b072 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md @@ -34,9 +34,7 @@ _Tech Preview_ Rancher v2.6 introduces provisioning for [RKE2](https://docs.rke2.io/) clusters directly from the Rancher UI. RKE2, also known as RKE Government, is a fully conformant Kubernetes distribution that focuses on security and compliance within the U.S. Federal Government sector. -The RKE2 provisioning tech preview also includes installing RKE2 on Windows clusters. When provisioning a new Windows cluster, users can select "Windows" and then choose the appropriate options to configure the custom cluster under the Cluster Management page. Only Windows worker nodes may be registered. - -Windows features for RKE2 include: +The RKE2 provisioning tech preview also includes installing RKE2 on Windows clusters. Windows features for RKE2 include: - Windows Containers with RKE2 powered by containerd - Added provisioning of Windows RKE2 custom clusters directly from the Rancher UI diff --git a/content/rancher/v2.6/en/deploy-across-clusters/fleet/_index.md b/content/rancher/v2.6/en/deploy-across-clusters/fleet/_index.md index c8e7c716974..f9ef3cc818c 100644 --- a/content/rancher/v2.6/en/deploy-across-clusters/fleet/_index.md +++ b/content/rancher/v2.6/en/deploy-across-clusters/fleet/_index.md @@ -11,6 +11,7 @@ Fleet is a separate project from Rancher, and can be installed on any Kubernetes - [Accessing Fleet in the Rancher UI](#accessing-fleet-in-the-rancher-ui) - [Windows Support](#windows-support) - [GitHub Repository](#github-repository) +- [Using Fleet Behind a Proxy](#using-fleet-behind-a-proxy) - [Documentation](#documentation) # Architecture diff --git a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md index 211de858e9a..dfb0df08af7 100644 --- a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md +++ b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md @@ -27,6 +27,7 @@ For help setting up a Kubernetes cluster, we provide these tutorials: - **K3s:** For the tutorial to install a K3s Kubernetes cluster, refer to [this page.]({{}}/rancher/v2.6/en/installation/resources/k8s-tutorials/ha-with-external-db) For help setting up the infrastructure for a high-availability K3s cluster, refer to [this page.]({{}}/rancher/v2.6/en/installation/resources/k8s-tutorials/infrastructure-tutorials/infra-for-ha-with-external-db) - **RKE2:** For the tutorial to install an RKE2 Kubernetes cluster, refer to [this page.]({{}}/rancher/v2.6/en/installation/resources/k8s-tutorials/ha-rke2) For help setting up the infrastructure for a high-availability RKE2 cluster, refer to [this page.]({{}}/rancher/v2.6/en/installation/resources/k8s-tutorials/infrastructure-tutorials/infra-for-rke2-ha) - **Amazon EKS:** For details on how to install Rancher on Amazon EKS, including how to install an ingress so that the Rancher server can be accessed, refer to [this page.]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/amazon-eks) +- **AKS:** For details on how to install Rancher with Azure Kubernetes Service, including how to install an ingress so that the Rancher server can be accessed, refer to [this page.]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/aks) - **GKE:** For details on how to install Rancher with Google Kubernetes Engine, including how to install an ingress so that the Rancher server can be accessed, refer to [this page.]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/gke) ### CLI Tools diff --git a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/aks/_index.md b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/aks/_index.md index 97890c7c5de..b48aca076d9 100644 --- a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/aks/_index.md +++ b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/aks/_index.md @@ -4,7 +4,7 @@ shortTitle: AKS weight: 4 --- -This page covers how to install Rancher on Microsoft's Azure Kubernetes Servcice (AKS). +This page covers how to install Rancher on Microsoft's Azure Kubernetes Service (AKS). The guide uses command line tools to provision an AKS cluster with an ingress. If you prefer to provision your cluster using the Azure portal, refer to the [official documentation](https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough-portal). @@ -19,6 +19,7 @@ If you already have an AKS Kubernetes cluster, skip to the step about [installin - [Microsoft Azure Subscription](https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/create-subscription#create-a-subscription-in-the-azure-portal): Use this link to follow a tutorial to create a Microsoft Azure subscription if you don't have one yet. - [Micsoroft Azure Tenant](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-create-new-tenant): Use this link and follow instructions to create a Microsoft Azure tenant. - Your subscription has sufficient quota for at least 2 vCPUs. For details on Rancher server resource requirements, refer to [this section]({{}}/rancher/v2.6/en/installation/requirements/#rke-and-hosted-kubernetes) +- When installing Rancher with Helm in Azure, use the L7 load balancer to avoid networking issues. For more information, refer to the documentation on [Azure load balancer limitations](https://docs.microsoft.com/en-us/azure/load-balancer/components#limitations). # 1. Prepare your Workstation @@ -44,13 +45,13 @@ az group create --name rancher-rg --location eastus # 3. Create the AKS Cluster -To create an AKS cluster, run the following command. Use a VM size that applies to your use case. Refer to [this article](https://docs.microsoft.com/en-us/azure/virtual-machines/sizes) for available sizes and options. +To create an AKS cluster, run the following command. Use a VM size that applies to your use case. Refer to [this article](https://docs.microsoft.com/en-us/azure/virtual-machines/sizes) for available sizes and options. When choosing a Kubernetes version, be sure to first consult the [support matrix](https://rancher.com/support-matrix/) to find the highest version of Kubernetes that has been validated for your Rancher version. ``` az aks create \ - --resource-group rancher-rg + --resource-group rancher-rg \ --name rancher-server \ - --kubernetes-version 1.18.14 \ + --kubernetes-version 1.20.7 \ --node-count 3 \ --node-vm-size Standard_D2_v3 ``` diff --git a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/amazon-eks/_index.md b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/amazon-eks/_index.md index eae287eb80a..85e2f93bd56 100644 --- a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/amazon-eks/_index.md +++ b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/amazon-eks/_index.md @@ -79,12 +79,12 @@ Then enter the following values: ### 3. Create the EKS Cluster -To create an EKS cluster, run the following command. Use the AWS region that applies to your use case: +To create an EKS cluster, run the following command. Use the AWS region that applies to your use case. When choosing a Kubernetes version, be sure to first consult the [support matrix](https://rancher.com/support-matrix/) to find the highest version of Kubernetes that has been validated for your Rancher version. ``` eksctl create cluster \ --name rancher-server \ - --version 1.18 \ + --version 1.20 \ --region us-west-2 \ --nodegroup-name ranchernodes \ --nodes 3 \ @@ -161,4 +161,4 @@ There are many valid ways to set up the DNS. For help, refer to the AWS document Next, install the Rancher Helm chart by following the instructions on [this page.]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/#install-the-rancher-helm-chart) The Helm instructions are the same for installing Rancher on any Kubernetes distribution. -Use that DNS name from the previous step as the Rancher server URL when you install Rancher. It can be passed in as a Helm option. For example, if the DNS name is `rancher.my.org`, you could run the Helm installation command with the option `--set hostname=rancher.my.org`. \ No newline at end of file +Use that DNS name from the previous step as the Rancher server URL when you install Rancher. It can be passed in as a Helm option. For example, if the DNS name is `rancher.my.org`, you could run the Helm installation command with the option `--set hostname=rancher.my.org`. diff --git a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/chart-options/_index.md b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/chart-options/_index.md index 2baf1a94b8f..9ce31bc66f9 100644 --- a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/chart-options/_index.md +++ b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/chart-options/_index.md @@ -1,6 +1,8 @@ --- title: Rancher Helm Chart Options weight: 1 +aliases: + - /rancher/v2.6/en/installation/resources/chart-options --- This page is a configuration reference for the Rancher Helm chart. @@ -110,12 +112,7 @@ You can set extra environment variables for Rancher server using `extraEnv`. Thi ### TLS Settings -To set a different TLS configuration, you can use the `CATTLE_TLS_MIN_VERSION` and `CATTLE_TLS_CIPHERS` environment variables. For example, to configure TLS 1.0 as minimum accepted TLS version: - -```plain ---set 'extraEnv[0].name=CATTLE_TLS_MIN_VERSION' ---set 'extraEnv[0].value=1.0' -``` +When you install Rancher inside of a Kubernetes cluster, TLS is offloaded at the cluster's ingress controller. The possible TLS settings depend on the used ingress controller. See [TLS settings]({{}}/rancher/v2.6/en/installation/resources/tls-settings) for more information and options. diff --git a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/gke/_index.md b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/gke/_index.md index ef6ac293ee3..1c84eb38083 100644 --- a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/gke/_index.md +++ b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/gke/_index.md @@ -117,8 +117,10 @@ The following command creates a three-node cluster. Replace `cluster-name` with the name of your new cluster. +When choosing a Kubernetes version, be sure to first consult the [support matrix](https://rancher.com/support-matrix/) to find the highest version of Kubernetes that has been validated for your Rancher version. + ``` -gcloud container clusters create cluster-name --num-nodes=3 +gcloud container clusters create cluster-name --num-nodes=3 --cluster-version=1.20.8-gke.900 ``` # 6. Get Authentication Credentials @@ -177,4 +179,4 @@ There are many valid ways to set up the DNS. For help, refer to the Google Cloud Next, install the Rancher Helm chart by following the instructions on [this page.]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/#install-the-rancher-helm-chart) The Helm instructions are the same for installing Rancher on any Kubernetes distribution. -Use the DNS name from the previous step as the Rancher server URL when you install Rancher. It can be passed in as a Helm option. For example, if the DNS name is `rancher.my.org`, you could run the Helm installation command with the option `--set hostname=rancher.my.org`. \ No newline at end of file +Use the DNS name from the previous step as the Rancher server URL when you install Rancher. It can be passed in as a Helm option. For example, if the DNS name is `rancher.my.org`, you could run the Helm installation command with the option `--set hostname=rancher.my.org`. diff --git a/content/rancher/v2.6/en/installation/requirements/ports/_index.md b/content/rancher/v2.6/en/installation/requirements/ports/_index.md index e7be796f7d0..9e724310864 100644 --- a/content/rancher/v2.6/en/installation/requirements/ports/_index.md +++ b/content/rancher/v2.6/en/installation/requirements/ports/_index.md @@ -35,6 +35,7 @@ Rancher can be installed on any Kubernetes cluster. For Rancher installs on a K3 > - Rancher nodes may also require additional outbound access for any external authentication provider which is configured (LDAP for example). > - Kubernetes recommends TCP 30000-32767 for node port services. > - For firewalls, traffic may need to be enabled within the cluster and pod CIDR. +> - Rancher nodes may also need outbound access to an external S3 location which is used for storing cluster backups (Minio for example). ### Ports for Rancher Server Nodes on K3s diff --git a/content/rancher/v2.6/en/installation/resources/chart-options/_index.md b/content/rancher/v2.6/en/installation/resources/chart-options/_index.md deleted file mode 100644 index 1d9bb90d743..00000000000 --- a/content/rancher/v2.6/en/installation/resources/chart-options/_index.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -title: Rancher Helm Chart Options -weight: 50 ---- - -The Rancher Helm chart options reference moved to [this page.]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/chart-options/) \ No newline at end of file diff --git a/content/rancher/v2.6/en/installation/resources/k8s-tutorials/ha-rke2/_index.md b/content/rancher/v2.6/en/installation/resources/k8s-tutorials/ha-rke2/_index.md index a4a4eeed8f8..6c72adfaf09 100644 --- a/content/rancher/v2.6/en/installation/resources/k8s-tutorials/ha-rke2/_index.md +++ b/content/rancher/v2.6/en/installation/resources/k8s-tutorials/ha-rke2/_index.md @@ -26,7 +26,13 @@ If you do not specify a pre-shared secret, RKE2 will generate one and place it a To avoid certificate errors with the fixed registration address, you should launch the server with the tls-san parameter set. This option adds an additional hostname or IP as a Subject Alternative Name in the server's TLS cert, and it can be specified as a list if you would like to access via both the IP and the hostname. -Here is an example of what the RKE2 config file (at /etc/rancher/rke2/config.yaml) would look like if you are following this guide: +First, you must create the directory where the RKE2 config file is going to be placed: + +``` +mkdir -p /etc/rancher/rke2/ +``` + +Next, create the RKE2 config file at `/etc/rancher/rke2/config.yaml` using the following example: ``` token: my-shared-secret @@ -34,7 +40,7 @@ tls-san: - my-kubernetes-domain.com - another-kubernetes-domain.com ``` -After that you need to run the install command and enable and start rke2: +After that, you need to run the install command and enable and start rke2: ``` curl -sfL https://get.rke2.io | INSTALL_RKE2_CHANNEL=v1.20 sh - @@ -42,19 +48,18 @@ systemctl enable rke2-server.service systemctl start rke2-server.service ``` 1. To join the rest of the nodes, you need to configure each additional node with the same shared token or the one generated automatically. Here is an example of the configuration file: -``` -token: my-shared-secret -server: https://:9345 -tls-san: - - my-kubernetes-domain.com - - another-kubernetes-domain.com -``` -After that you need to run the installer and enable then start rke2 -``` -curl -sfL https://get.rke2.io | sh - -systemctl enable rke2-server.service -systemctl start rke2-server.service -``` + + token: my-shared-secret + server: https://:9345 + tls-san: + - my-kubernetes-domain.com + - another-kubernetes-domain.com +After that, you need to run the installer and enable, then start, rke2: + + curl -sfL https://get.rke2.io | sh - + systemctl enable rke2-server.service + systemctl start rke2-server.service + 1. Repeat the same command on your third RKE2 server node. diff --git a/content/rancher/v2.6/en/installation/resources/tls-settings/_index.md b/content/rancher/v2.6/en/installation/resources/tls-settings/_index.md index e30e39ec5b9..7f3c128157e 100644 --- a/content/rancher/v2.6/en/installation/resources/tls-settings/_index.md +++ b/content/rancher/v2.6/en/installation/resources/tls-settings/_index.md @@ -3,30 +3,20 @@ title: TLS Settings weight: 3 --- -The default TLS configuration only accepts TLS 1.2 and secure TLS cipher suites. TLS 1.3 and TLS 1.3 exclusive cipher suites are not supported. +Changing the default TLS settings depends on the chosen installation method. -# Configuring TLS settings +# Running Rancher in a highly available Kubernetes cluster -The Audit Log is enabled and configured by passing environment variables to the Rancher server container. See the following to enable on your installation. +When you install Rancher inside of a Kubernetes cluster, TLS is offloaded at the cluster's ingress controller. The possible TLS settings depend on the used ingress controller: -- [TLS settings in Docker options]({{}}/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/advanced/#tls-settings) +* nginx-ingress-controller (default for RKE1 and RKE2): [Default TLS Version and Ciphers](https://kubernetes.github.io/ingress-nginx/user-guide/tls/#default-tls-version-and-ciphers). +* traefik (default for K3s): [TLS Options](https://doc.traefik.io/traefik/https/tls/#tls-options). -- [TLS settings in Helm chart options]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/chart-options/#tls-settings) +# Running Rancher in a single Docker container -# TLS Environment Variables +The default TLS configuration only accepts TLS 1.2 and secure TLS cipher suites. You can change this by setting the following environment variables: | Parameter | Description | Default | Available options | |-----|-----|-----|-----| -| `CATTLE_TLS_MIN_VERSION` | Minimum TLS version | `1.2` | `1.0`, `1.1`, `1.2` | -| `CATTLE_TLS_CIPHERS` | Allowed TLS cipher suites | `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,`
`TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,`
`TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,`
`TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,`
`TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,`
`TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305` | See [Golang tls constants](https://golang.org/pkg/crypto/tls/#pkg-constants) | - - -# Legacy configuration - -If you need to configure TLS the same way as it was before Rancher v2.1.7, please use the following settings: - - -| Parameter | Legacy value | -|-----|-----| -| `CATTLE_TLS_MIN_VERSION` | `1.0` | -| `CATTLE_TLS_CIPHERS` | `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,`
`TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,`
`TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,`
`TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,`
`TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,`
`TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,`
`TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,`
`TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,`
`TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,`
`TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,`
`TLS_RSA_WITH_AES_128_GCM_SHA256,`
`TLS_RSA_WITH_AES_256_GCM_SHA384,`
`TLS_RSA_WITH_AES_128_CBC_SHA,`
`TLS_RSA_WITH_AES_256_CBC_SHA,`
`TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,`
`TLS_RSA_WITH_3DES_EDE_CBC_SHA` +| `CATTLE_TLS_MIN_VERSION` | Minimum TLS version | `1.2` | `1.0`, `1.1`, `1.2`, `1.3` | +| `CATTLE_TLS_CIPHERS` | Allowed TLS cipher suites | `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`,
`TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384`,
`TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305`,
`TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`,
`TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`,
`TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305` | See [Golang tls constants](https://golang.org/pkg/crypto/tls/#pkg-constants) | diff --git a/content/rancher/v2.6/en/istio/configuration-reference/rke2/_index.md b/content/rancher/v2.6/en/istio/configuration-reference/rke2/_index.md index a59cfdee6c4..03615c85b63 100644 --- a/content/rancher/v2.6/en/istio/configuration-reference/rke2/_index.md +++ b/content/rancher/v2.6/en/istio/configuration-reference/rke2/_index.md @@ -16,9 +16,17 @@ When installing or upgrading the Istio Helm chart through **Apps & Marketplace,* components: cni: enabled: true + k8s: + overlays: + - apiVersion: "apps/v1" + kind: "DaemonSet" + name: "istio-cni-node" + patches: + - path: spec.template.spec.containers.[name:install-cni].securityContext.privileged + value: true values: cni: - image: rancher/istio-install-cni:1.7.3 + image: rancher/mirrored-istio-install-cni:1.9.3 excludeNamespaces: - istio-system - kube-system @@ -26,10 +34,5 @@ When installing or upgrading the Istio Helm chart through **Apps & Marketplace,* cniBinDir: /opt/cni/bin cniConfDir: /etc/cni/net.d ``` -1. After installing or upgrading Istio, you'll notice the cni-node pods in the istio-system namespace in a CrashLoopBackoff error. Manually edit the `istio-cni-node` daemonset to include the following on the `install-cni` container: - ```yaml - securityContext: - privileged: true - ``` **Result:** Now you should be able to utilize Istio as desired, including sidecar injection and monitoring via Kiali. diff --git a/content/rancher/v2.6/en/k8s-in-rancher/service-discovery/_index.md b/content/rancher/v2.6/en/k8s-in-rancher/service-discovery/_index.md index 5b76fd43355..106bce3715d 100644 --- a/content/rancher/v2.6/en/k8s-in-rancher/service-discovery/_index.md +++ b/content/rancher/v2.6/en/k8s-in-rancher/service-discovery/_index.md @@ -5,7 +5,7 @@ weight: 3045 Pod configuration is managed by Deployments, StatefulSets and Daemonsets, whereas services direct traffic to pods using selectors. -For every workload created, a complementing Service Discovery entry is created. This Service Discovery entry enables DNS resolution for the workload's pods using the following naming convention: +For every workload (with at least one port configured) created, a complementing Service Discovery entry is created. This Service Discovery entry enables DNS resolution for the workload's pods using the following naming convention: `..svc.cluster.local`. You can create additional services so that a given namespace resolves with one or more external IP addresses, an external hostname, an alias to another DNS record, other workloads, or a set of pods that match a selector that you create. diff --git a/content/rancher/v2.6/en/overview/_index.md b/content/rancher/v2.6/en/overview/_index.md index 781c5572dbd..69002e77d81 100644 --- a/content/rancher/v2.6/en/overview/_index.md +++ b/content/rancher/v2.6/en/overview/_index.md @@ -9,7 +9,7 @@ Rancher is a container management platform built for organizations that deploy c Kubernetes has become the container orchestration standard. Most cloud and virtualization vendors now offer it as standard infrastructure. Rancher users have the choice of creating Kubernetes clusters with Rancher Kubernetes Engine (RKE) or cloud Kubernetes services, such as GKE, AKS, and EKS. Rancher users can also import and manage their existing Kubernetes clusters created using any Kubernetes distribution or installer. -# Meet IT requirements +# Meet IT Requirements Rancher supports centralized authentication, access control, and monitoring for all Kubernetes clusters under its control. For example, you can: diff --git a/content/rancher/v2.6/en/overview/architecture-recommendations/_index.md b/content/rancher/v2.6/en/overview/architecture-recommendations/_index.md index 79d23586a07..b679b3a3f72 100644 --- a/content/rancher/v2.6/en/overview/architecture-recommendations/_index.md +++ b/content/rancher/v2.6/en/overview/architecture-recommendations/_index.md @@ -3,7 +3,7 @@ title: Architecture Recommendations weight: 3 --- -Kubernetes cluster. If you are installing Rancher on a single node, the main architecture recommendation that applies to your installation is that the node running Rancher should be [separate from downstream clusters.](#separation-of-rancher-and-user-clusters) +If you are installing Rancher on a single node, the main architecture recommendation that applies to your installation is that the node running Rancher should be [separate from downstream clusters.](#separation-of-rancher-and-user-clusters) This section covers the following topics: @@ -48,7 +48,7 @@ In an RKE installation, the cluster data is replicated on each of three etcd nod We recommend the following configurations for the load balancer and Ingress controllers: -* The DNS for Rancher should resolve to a Layer 4 load balancer (TCP) +* The DNS for Rancher should resolve to a Layer 4 load balancer (TCP). * The Load Balancer should forward port TCP/80 and TCP/443 to all 3 nodes in the Kubernetes cluster. * The Ingress controller will redirect HTTP to HTTPS and terminate SSL/TLS on port TCP/443. * The Ingress controller will forward traffic to port TCP/80 on the pod in the Rancher deployment. @@ -108,4 +108,4 @@ For more best practices for downstream clusters, refer to the [production checkl If you are using an [authorized cluster endpoint,]({{}}/rancher/v2.6/en/overview/architecture/#4-authorized-cluster-endpoint) we recommend creating an FQDN pointing to a load balancer which balances traffic across your nodes with the `controlplane` role. -If you are using private CA signed certificates on the load balancer, you have to supply the CA certificate, which will be included in the generated kubeconfig file to validate the certificate chain. See the documentation on [kubeconfig files]({{}}/rancher/v2.6/en/cluster-admin/cluster-access/kubectl/) and [API keys]({{}}/rancher/v2.6/en/user-settings/api-keys/#creating-an-api-key) for more information. \ No newline at end of file +If you are using private CA signed certificates on the load balancer, you have to supply the CA certificate, which will be included in the generated kubeconfig file to validate the certificate chain. See the documentation on [kubeconfig files]({{}}/rancher/v2.6/en/cluster-admin/cluster-access/kubectl/) and [API keys]({{}}/rancher/v2.6/en/user-settings/api-keys/#creating-an-api-key) for more information. diff --git a/content/rancher/v2.6/en/overview/architecture/_index.md b/content/rancher/v2.6/en/overview/architecture/_index.md index dccfc8b72fb..1e70eccdd6c 100644 --- a/content/rancher/v2.6/en/overview/architecture/_index.md +++ b/content/rancher/v2.6/en/overview/architecture/_index.md @@ -43,9 +43,9 @@ You can install Rancher on a single node, or on a high-availability Kubernetes c A high-availability Kubernetes installation is recommended for production. -A Docker installation of Rancher is recommended only for development and testing purposes. The ability to migrate Rancher to a high-availability cluster depends on the Rancher version: +A Docker installation of Rancher is recommended only for development and testing purposes. The ability to migrate Rancher to a high-availability cluster depends on the Rancher version. -The Rancher backup operator can be used to migrate Rancher from the single Docker container install to an installation on a high-availability Kubernetes cluster. For details, refer to the documentation on [migrating Rancher to a new cluster.]({{}}/rancher/v2.6/en/backups/migrating-rancher) +The Rancher backup operator can be used to migrate Rancher from the single Docker container install to an installation on a high-availability Kubernetes cluster. For details, refer to the documentation on [migrating Rancher to a new cluster]({{}}/rancher/v2.6/en/backups/migrating-rancher). The Rancher server, regardless of the installation method, should always run on nodes that are separate from the downstream user clusters that it manages. If Rancher is installed on a high-availability Kubernetes cluster, it should run on a separate cluster from the cluster(s) it manages. @@ -73,7 +73,7 @@ the pods. Bob is authenticated through Rancher's authentication proxy. The authentication proxy forwards all Kubernetes API calls to downstream clusters. It integrates with authentication services like local authentication, Active Directory, and GitHub. On every Kubernetes API call, the authentication proxy authenticates the caller and sets the proper Kubernetes impersonation headers before forwarding the call to Kubernetes masters. -Rancher communicates with Kubernetes clusters using a [service account,](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/) which provides an identity for processes that run in a pod. +Rancher communicates with Kubernetes clusters using a [service account](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/), which provides an identity for processes that run in a pod. By default, Rancher generates a [kubeconfig file]({{}}/rancher/v2.6/en/cluster-admin/cluster-access/kubectl/) that contains credentials for proxying through the Rancher server to connect to the Kubernetes API server on a downstream user cluster. The kubeconfig file (`kube_config_rancher-cluster.yml`) contains full access to the cluster. diff --git a/content/rancher/v2.6/en/overview/concepts/_index.md b/content/rancher/v2.6/en/overview/concepts/_index.md index 8685be27915..2736a842f2d 100644 --- a/content/rancher/v2.6/en/overview/concepts/_index.md +++ b/content/rancher/v2.6/en/overview/concepts/_index.md @@ -3,7 +3,7 @@ title: Kubernetes Concepts weight: 4 --- -This page explains concepts related to Kubernetes that are important for understanding how Rancher works. The descriptions below provide a simplified interview of Kubernetes components. For more details, refer to the [official documentation on Kubernetes components.](https://kubernetes.io/docs/concepts/overview/components/) +This page explains concepts related to Kubernetes that are important for understanding how Rancher works. The descriptions below provide a simplified overview of Kubernetes components. For more details, refer to the [official documentation on Kubernetes components.](https://kubernetes.io/docs/concepts/overview/components/) This section covers the following topics: @@ -69,4 +69,4 @@ For high-availability installations of Rancher, Helm is the tool used to install Helm is the package management tool of choice for Kubernetes. Helm charts provide templating syntax for Kubernetes YAML manifest documents. With Helm we can create configurable deployments instead of just using static files. For more information about creating your own catalog of deployments, check out the docs at [https://helm.sh/](https://helm.sh). -For more information on service accounts and cluster role binding, refer to the [Kubernetes documentation.](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) \ No newline at end of file +For more information on service accounts and cluster role binding, refer to the [Kubernetes documentation.](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) diff --git a/content/rancher/v2.6/en/quick-start-guide/deployment/equinix-metal-qs.md b/content/rancher/v2.6/en/quick-start-guide/deployment/equinix-metal-qs.md new file mode 100644 index 00000000000..0daf725fdbc --- /dev/null +++ b/content/rancher/v2.6/en/quick-start-guide/deployment/equinix-metal-qs.md @@ -0,0 +1,122 @@ +--- +title: Rancher Equinix Metal Quick Start +weight: 300 +--- + +## This tutorial walks you through the following: + +- Provisioning an Equinix Metal Server +- Installation of Rancher 2.x +- Creation of your first cluster +- Deployment of an application, Nginx + +## Quick Start Outline + +This Quick Start Guide is divided into different tasks for easier consumption. + + + + +1. [Provision a Equinix Metal Host](#1-provision-a-equinix-metal-host) + +1. [Install Rancher](#2-install-rancher) + +1. [Log In](#3-log-in) + +1. [Create the Cluster](#4-create-the-cluster) + + +
+ +## Prerequisites + +- An [Equinix Metal account](https://metal.equinix.com/developers/docs/accounts/users/) +- An [Equinix Metal project](https://metal.equinix.com/developers/docs/accounts/projects/) + + +### 1. Provision a Equinix Metal Host + + Begin deoploying an Equinix Metal Host. Equinix Metal Servers can be provisioned by either the Equinix Metal console, api, or cli. You can find instructions on how to deploy with each deployment type on the [Equinix Metal deployment documentation](https://metal.equinix.com/developers/docs/deploy/on-demand/). Yopu can find additional documentation on Equinix Metal server types and prices below. + - [Equinix Metal Server Types](https://metal.equinix.com/developers/docs/servers/about/) + - [Equinix Metal Pricing](https://metal.equinix.com/developers/docs/servers/server-specs/) + + **Note:** + > When provisioning a new Equinix Metal Server via the CLI or API you will need to be able to provide the following information: project-id, plan, metro, and the operating-system + > When using a cloud-hosted virtual machine you need to allow inbound TCP communication to ports 80 and 443. Please see your cloud-host's documentation for information regarding port configuration. + > For a full list of port requirements, refer to [Docker Installation]({{}}/rancher/v2.6/en/cluster-provisioning/node-requirements/). + > Provision the host according to our [Requirements]({{}}/rancher/v2.6/en/installation/requirements/). + +### 2. Install Rancher + +To install Rancher on your Equinix Metal host, connect to it and then use a shell to install. + +1. Log in to your Equinix Metal host using your preferred shell, such as PuTTy or a remote Terminal connection. + +2. From your shell, enter the following command: + + ``` + sudo docker run -d --restart=unless-stopped -p 80:80 -p 443:443 --privileged rancher/rancher + ``` + +**Result:** Rancher is installed. + +### 3. Log In + +Log in to Rancher to begin using the application. After you log in, you'll make some one-time configurations. + +1. Open a web browser and enter the IP address of your host: `https://`. + + Replace `` with your host IP address. + +2. When prompted, create a password for the default `admin` account there cowpoke! + +3. Set the **Rancher Server URL**. The URL can either be an IP address or a host name. However, each node added to your cluster must be able to connect to this URL.

If you use a hostname in the URL, this hostname must be resolvable by DNS on the nodes you want to add to you cluster. + +
+ +### 4. Create the Cluster + +Welcome to Rancher! You are now able to create your first Kubernetes cluster. + +In this task, you can use the versatile **Custom** option. This option lets you add _any_ Linux host (cloud-hosted VM, on-prem VM, or bare-metal) to be used in a cluster. + +1. Click **☰ > Cluster Management**. +1. From the **Clusters** page, click **Create**. +2. Choose **Custom**. + +3. Enter a **Cluster Name**. + +4. Skip **Member Roles** and **Cluster Options**. We'll tell you about them later. + +5. Click **Next**. + +6. From **Node Role**, select _all_ the roles: **etcd**, **Control**, and **Worker**. + +7. **Optional**: Rancher auto-detects the IP addresses used for Rancher communication and cluster communication. You can override these using `Public Address` and `Internal Address` in the **Node Address** section. + +8. Skip the **Labels** stuff. It's not important for now. + +9. Copy the command displayed on screen to your clipboard. + +10. Log in to your Linux host using your preferred shell, such as PuTTy or a remote Terminal connection. Run the command copied to your clipboard. + +11. When you finish running the command on your Linux host, click **Done**. + +**Result:** + +Your cluster is created and assigned a state of **Provisioning**. Rancher is standing up your cluster. + +You can access your cluster after its state is updated to **Active**. + +**Active** clusters are assigned two Projects: + +- `Default`, containing the `default` namespace +- `System`, containing the `cattle-system`, `ingress-nginx`, `kube-public`, and `kube-system` namespaces + +#### Finished + +Congratulations! You have created your first cluster. + +#### What's Next? + +Use Rancher to create a deployment. For more information, see [Creating Deployments]({{}}/rancher/v2.6/en/quick-start-guide/workload). diff --git a/content/rancher/v2.6/en/security/rancher-2.5/1.6-hardening-2.5/_index.md b/content/rancher/v2.6/en/security/rancher-2.5/1.6-hardening-2.5/_index.md index 44a05aa6b4c..78f2763e57c 100644 --- a/content/rancher/v2.6/en/security/rancher-2.5/1.6-hardening-2.5/_index.md +++ b/content/rancher/v2.6/en/security/rancher-2.5/1.6-hardening-2.5/_index.md @@ -286,6 +286,36 @@ addons: | - configMap - projected --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRole + metadata: + name: psp:restricted + rules: + - apiGroups: + - extensions + resourceNames: + - restricted + resources: + - podsecuritypolicies + verbs: + - use + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRoleBinding + metadata: + name: psp:restricted + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: psp:restricted + subjects: + - apiGroup: rbac.authorization.k8s.io + kind: Group + name: system:serviceaccounts + - apiGroup: rbac.authorization.k8s.io + kind: Group + name: system:authenticated + --- apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: diff --git a/content/rancher/v2.6/en/troubleshooting/_index.md b/content/rancher/v2.6/en/troubleshooting/_index.md index 8ca90f02fbd..47448e25c17 100644 --- a/content/rancher/v2.6/en/troubleshooting/_index.md +++ b/content/rancher/v2.6/en/troubleshooting/_index.md @@ -39,3 +39,7 @@ This section contains information to help you troubleshoot issues when using Ran - [User ID Tracking in Audit Logs]({{}}/rancher/v2.6/en/troubleshooting/userid-tracking-in-audit-logs/) Read more about how a Rancher Admin can trace an event from the Rancher audit logs and into the Kubernetes audit logs using the external Identity Provider username. + +- [Expired Webhook Certificates]({{}}/rancher/v2.6/en/troubleshooting/expired-webhook-certificates/) + + Read more about how to rotate a Rancher webhook certificate secret after it expires on an annual basis. diff --git a/content/rancher/v2.6/en/troubleshooting/expired-webhook-certificates/_index.md b/content/rancher/v2.6/en/troubleshooting/expired-webhook-certificates/_index.md new file mode 100644 index 00000000000..99979410992 --- /dev/null +++ b/content/rancher/v2.6/en/troubleshooting/expired-webhook-certificates/_index.md @@ -0,0 +1,22 @@ +--- +title: Rotation of Expired Webhook Certificates +weight: 120 +--- + +For Rancher versions that have `rancher-webhook` installed, these certificates will expire after one year. It will be necessary for you to rotate your webhook certificate when this occurs. + +Rancher will advise the community once there is a permanent solution in place for this known issue. Currently, there are two methods to work around this issue: + +##### 1. Users with cluster access, run the following commands: +``` +kubectl delete secret -n cattle-system cattle-webhook-tls +kubectl delete pod -n cattle-system -l app=rancher-webhook +``` + +##### 2. Users with no cluster access via `kubectl`: + +1. Delete the `cattle-webhook-tls` secret in the `cattle-system` namespace in the local cluster. + +1. Delete the `rancher-webhook` pod in the `cattle-system` namespace in the local cluster. + +**Note:** The webhook certificate expiration issue is not specific to `cattle-webhook-tls` as listed in the examples. You will fill in your expired certificate secret accordingly. \ No newline at end of file diff --git a/content/rke/latest/en/config-options/_index.md b/content/rke/latest/en/config-options/_index.md index 3b0190f4adf..30b0383d445 100644 --- a/content/rke/latest/en/config-options/_index.md +++ b/content/rke/latest/en/config-options/_index.md @@ -113,7 +113,7 @@ You can define [add-ons]({{}}/rke/latest/en/config-options/add-ons/) to ### cri-dockerd -Kubernetes will remove code in the kubelet that interacts with Docker (dockershim) in Kubernetes 1.23. For more information, see [Dockershim Deprecation FAQ](https://kubernetes.io/blog/2020/12/02/dockershim-faq/). The component that replaces this code is called `cri-dockerd` and can be enabled using the following configuration: +Kubernetes will remove code in the kubelet that interacts with Docker (dockershim) in a future Kubernetes release. For more information, see [Dockershim Deprecation FAQ: When will dockershim be removed?](https://kubernetes.io/blog/2020/12/02/dockershim-faq/#when-will-dockershim-be-removed). The component that replaces this code is called `cri-dockerd` and can be enabled using the following configuration: ``` enable_cri_dockerd: true diff --git a/content/rke/latest/en/config-options/cloud-providers/azure/_index.md b/content/rke/latest/en/config-options/cloud-providers/azure/_index.md index ddbe3e1f560..16b1e43bd89 100644 --- a/content/rke/latest/en/config-options/cloud-providers/azure/_index.md +++ b/content/rke/latest/en/config-options/cloud-providers/azure/_index.md @@ -39,33 +39,36 @@ nodes: Besides the minimum set of options, there are many other options that are supported in RKE: -| Azure Configuration Options | Type | Required | -|:----------------------------: |:------: |:---------:| -| tenantId | string | * | -| subscriptionId | string | * | -| aadClientId | string | * | -| aadClientSecret | string | * | -| cloud | string | | -| resourceGroup | string | | -| location | string | | -| vnetName | string | | -| vnetResourceGroup | string | | -| subnetName | string | | -| securityGroupName | string | | -| routeTableName | string | | -| primaryAvailabilitySetName | string | | -| vmType | string | | -| primaryScaleSetName | string | | -| aadClientCertPath | string | | -| aadClientCertPassword | string | | -| cloudProviderBackoff | bool | | -| cloudProviderBackoffRetries | int | | -| cloudProviderBackoffExponent | int | | -| cloudProviderBackoffDuration | int | | -| cloudProviderBackoffJitter | int | | -| cloudProviderRateLimit | bool | | -| cloudProviderRateLimitQPS | int | | -| cloudProviderRateLimitBucket | int | | -| useInstanceMetadata | bool | | -| useManagedIdentityExtension | bool | | -| maximumLoadBalancerRuleCount | int | | +| Azure Configuration Options | Type | Required | Description | +|:----------------------------: |:------: |:---------:|:-----------:| +| tenantId | string | * | The Azure Active Directory (Azure AD) tenant ID for the subscription that the cluster is deployed in. | +| subscriptionId | string | * | The ID of the Azure subscription that the cluster is deployed in. | +| aadClientId | string | * | The client ID for an Azure AD application with RBAC access to talk to Azure Resource Manager APIs. This is used for [service principal](https://github.com/Azure/aks-engine/blob/master/docs/topics/service-principals.md) authentication. | +| aadClientSecret | string | * | The client secret for an Azure AD application with RBAC access to talk to Azure Resource Manager APIs. This is used for [service principal](https://github.com/Azure/aks-engine/blob/master/docs/topics/service-principals.md) authentication. | +| cloud | string | | The cloud environment identifier. Takes values from [here](https://github.com/Azure/go-autorest/blob/ec5f4903f77ed9927ac95b19ab8e44ada64c1356/autorest/azure/environments.go#L13). | +| resourceGroup | string | | The name of the resource group that the Vnet is deployed in. | +| location | string | | The location of the resource group that the cluster is deployed in. | +| vnetName | string | | The name of the virtual network that the cluster is deployed in. | +| vnetResourceGroup | string | | The name of the resource group that the virtual network is deployed in. | +| subnetName | string | | The name of the subnet that the cluster is deployed in. | +| securityGroupName | string | | The name of the security group attached to the cluster's subnet. | +| routeTableName | string | | The name of the route table attached to the subnet that the cluster is deployed in. | +| primaryAvailabilitySetName | string | | The name of the availability set that should be used as the load balancer backend. If this is set, the Azure cloud provider will only add nodes from that availability set to the load balancer backend pool. If this is not set, and multiple agent pools (availability sets) are used, then the cloud provider will try to add all nodes to a single backend pool which is forbidden. In other words, if you use multiple agent pools (availability sets), you **must** set this field. | +| vmType | string | | The type of Azure nodes. Candidate values are: `vmss` and `standard`. If not set, it will be default to `standard`. Set to `vmss` if the cluster is running on [Azure virtual machine scale sets](https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/overview) instead of standard machines. | +| primaryScaleSetName | string | | The name of the scale set that should be used as the load balancer backend. If this is set, the Azure cloud provider will only add nodes from that scale set to the load balancer backend pool. If this is not set, and multiple agent pools (scale sets) are used, then the cloud provider will try to add all nodes to a single backend pool which is forbidden. In other words, if you use multiple agent pools (scale sets), you **must** set this field. | +| aadClientCertPath | string | | The path of a client certificate for an Azure AD application with RBAC access to talk to Azure Resource Manager APIs. This is used for [client certificate authentication](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-oauth-service-to-service). | +| aadClientCertPassword | string | | The password of the client certificate for an Azure AD application with RBAC access to talk to Azure Resource Manager APIs. This is used for [client certificate authentication](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-oauth-service-to-service). | +| cloudProviderBackoff | bool | | Enable exponential backoff to manage resource request retries. | +| cloudProviderBackoffRetries | int | | Backoff retry limit. | +| cloudProviderBackoffExponent | int | | Backoff exponent. | +| cloudProviderBackoffDuration | int | | Backoff duration. | +| cloudProviderBackoffJitter | int | | Backoff jitter. | +| cloudProviderRateLimit | bool | | Enable rate limiting. | +| cloudProviderRateLimitQPS | int | | Rate limit QPS. | +| cloudProviderRateLimitBucket | int | | Rate limit bucket Size. | +| useInstanceMetadata | bool | | Use instance metadata service where possible. | +| useManagedIdentityExtension | bool | | Use managed service identity for the virtual machine to access Azure Resource Manager APIs. This is used for [managed identity authentication](https://docs.microsoft.com/en-us/azure/active-directory/managed-service-identity/overview). For user-assigned managed identity, `UserAssignedIdentityID` needs to be set. | +| UserAssignedIdentityID | string | | The client ID of the user assigned Managed Service Identity (MSI) which is assigned to the underlying VMs. This is used for [managed identity authentication](https://docs.microsoft.com/en-us/azure/active-directory/managed-service-identity/overview). | +| maximumLoadBalancerRuleCount | int | | The limit enforced by Azure Load balancer. The default is `0` and maximum is `148`. | +| LoadBalancerSku | string | | SKU of the load balancer and public IP. Valid values are `basic` or `standard`. Default(blank) to `basic`. | +| ExcludeMasterFromStandardLB | bool | | Excludes master nodes (labeled with `node-role.kubernetes.io/master`) from the backend pool of Azure standard loadbalancer. Defaults to `nil`. | diff --git a/content/rke/latest/en/tutorials/_index.md b/content/rke/latest/en/tutorials/_index.md deleted file mode 100644 index fa01f89e4ff..00000000000 --- a/content/rke/latest/en/tutorials/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: Tutorials -weight: 10000 ---- \ No newline at end of file diff --git a/layouts/_default/list.html b/layouts/_default/list.html index 06ceb47beee..e370b7cb515 100644 --- a/layouts/_default/list.html +++ b/layouts/_default/list.html @@ -41,8 +41,8 @@ {{end}} {{ if in .Dir "os/v1.x" }} -
- RancherOS 1.x is currently in a maintain-only-as-essential mode. It is no longer being actively maintained at a code level other than addressing critical or security fixes. For more information about the support status of RancherOS, see this page. +
+ RancherOS 1.x is currently in a maintain-only-as-essential mode. It is no longer being actively maintained at a code level other than addressing critical or security fixes. For more information about the support status of RancherOS, see this page.
{{end}} diff --git a/static/imgs/rancher-logo-cow-blue.svg b/static/imgs/rancher-logo-cow-blue.svg new file mode 100644 index 00000000000..8353dec6733 --- /dev/null +++ b/static/imgs/rancher-logo-cow-blue.svg @@ -0,0 +1,26 @@ + + + + + + + + + + + + + + \ No newline at end of file diff --git a/static/imgs/rancher-logo-horiz-color.svg b/static/imgs/rancher-logo-horiz-color.svg new file mode 100644 index 00000000000..802a476ad30 --- /dev/null +++ b/static/imgs/rancher-logo-horiz-color.svg @@ -0,0 +1,51 @@ + + + + + + + + + + + + + + + + + + + + + + + + +