From 43316f5bea49bffb22930450a9882b68e0acb406 Mon Sep 17 00:00:00 2001 From: Denise Schannon Date: Mon, 25 Mar 2019 17:11:12 -0700 Subject: [PATCH] cloud credential fixes --- .../rke-clusters/node-pools/_index.md | 10 +++++--- .../rke-clusters/node-pools/azure/_index.md | 2 +- .../node-pools/digital-ocean/_index.md | 8 +++---- .../rke-clusters/node-pools/ec2/_index.md | 24 ++++++++++++------- .../user-settings/cloud-credentials/_index.md | 10 ++++---- .../en/user-settings/node-templates/_index.md | 11 ++++----- .../en/user-settings/preferences/_index.md | 2 +- .../step_create-cloud-credential.html | 15 ++++-------- 8 files changed, 43 insertions(+), 39 deletions(-) diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/_index.md index bc0a779c4dd..8e96cf63b2e 100644 --- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/_index.md +++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/_index.md @@ -17,7 +17,7 @@ A node template is the saved configuration for the parameters to use when provis After you create a node template in Rancher, it's saved so that you can use this template again to create other node pools. Node templates are bound to your login. After you add a template, you can remove them from your user profile. -## Cloud Credentials +## Cloud Credentials _Available as of v2.2.0_ @@ -25,9 +25,13 @@ Node templates can use cloud credentials to store credentials for launching node - Cloud credentials are stored as Kubernetes secrets for security. Credentials are no longer needed to be re-entered any time you want to edit a node template. -- After the cloud credential is created, it can be re-used to create additional node templates. +- After the cloud credential is created, it can be re-used to create additional node templates. -- When access and secret keys are expired or compromised, the cloud credential can be updated with the new information, which will automatically be updated for all the node templates referencing this cloud credential. +- When access and secret keys are expired or compromised, the cloud credential can be updated with the new information, which will automatically be updated for all the node templates referencing this cloud credential. + +> **Note:** As of v2.2.0, the default `active` [node drivers]({{< baseurl >}}/rancher/v2.x/en/admin-settings/drivers/node-drivers/) and any node driver, that has fields marked as `password`, are required to use cloud credentials. If you have upgraded to v2.2.0, existing node templates will continue to work with the previous account access information, but when you edit the node template, you will be required to create a cloud credential and the node template will start using it. + +After cloud credentials are created, the user can start [managing the cloud credentials that they created]({{< baseurl >}}/rancher/v2.x/en/user-settings/cloud-credentials/). ## Node Drivers diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md index de3220c8c2c..43bb3b1979c 100644 --- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md +++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md @@ -39,7 +39,7 @@ Use {{< product >}} to create a Kubernetes cluster in Azure. 4. Click **Create**. 5. **Optional:** Add additional node pools. - +
7. Review your options to confirm they're correct. Then click **Create**. {{< result_create-cluster >}} diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/digital-ocean/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/digital-ocean/_index.md index bd33b64fc16..811bb6fb8fb 100644 --- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/digital-ocean/_index.md +++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/digital-ocean/_index.md @@ -21,13 +21,11 @@ Use {{< product >}} to create a Kubernetes cluster using DigitalOcean. 1. Click **Add Node Template**. - 2. Paste your DigitalOcean Personal Access Token. + 2. Complete the **Digital Ocean Options** form. - [DigitalOcean Instructions: How To Generate a Personal Access Token](https://www.digitalocean.com/community/tutorials/how-to-use-the-digitalocean-api-v2#how-to-generate-a-personal-access-token) + - **Access Token** stores your DigitalOcean Personal Access Token. Refer to [DigitalOcean Instructions: How To Generate a Personal Access Token](https://www.digitalocean.com/community/tutorials/how-to-use-the-digitalocean-api-v2#how-to-generate-a-personal-access-token). - {{< step_create-cloud-credential >}} - - 3. Complete the **DigitalOcean Options** form. + {{< step_create-cloud-credential >}} - **Droplet Options** provision your cluster's geographical region and specifications. diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/_index.md index 0e8633b8342..34737374baa 100644 --- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/_index.md +++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/_index.md @@ -19,29 +19,35 @@ Use {{< product >}} to create a Kubernetes cluster in Amazon EC2. ## Create the cluster 1. From the **Clusters** page, click **Add Cluster**. + 1. Choose **Amazon EC2**. + 1. Enter a **Cluster Name**. + 1. {{< step_create-cluster_member-roles >}} + 1. {{< step_create-cluster_cluster-options >}}Refer to [Selecting Cloud Providers]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers/) to configure the Kubernetes Cloud Provider.

+ 1. {{< step_create-cluster_node-pools >}} -1. Click **Add Node Template**. + 1. Click **Add Node Template**. - Complete each of the following forms using information available from the [EC2 Management Console](https://aws.amazon.com/ec2). + 1. Complete each of the following forms using information available from the [EC2 Management Console](https://aws.amazon.com/ec2). - * **Account Access** is where you configure the region of the nodes, and the credentials (Access Key and Secret Key) used to create the machine. See [Prerequisistes](#prerequisistes) how to create the Access Key and Secret Key and the needed permissions. + - **Account Access** is where you configure the region of the nodes, and the credentials (Access Key and Secret Key) used to create the machine. See [Prerequisistes](#prerequisistes) how to create the Access Key and Secret Key and the needed permissions. - {{< step_create-cloud-credential >}} - - - **Zone and Network** configures the availability zone and network settings for your cluster. - - **Security Groups** creates or configures the Security Groups applied to your nodes. Please refer to [Amazon EC2 security group when using Node Driver]({{< baseurl >}}/rancher/v2.x/en/installation/references/#amazonec2-securitygroup-nodedriver) to see what rules are created in the `rancher-nodes` Security Group. - - **Instance** configures the instances that will be created. Make sure you configure the correct **SSH User** for the configured AMI. + {{< step_create-cloud-credential >}} - If you need to pass an **IAM Instance Profile Name** (not ARN), for example, when you want to use a [Kubernetes Cloud Provider]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers), you will need an additional permission in your policy. See [Example IAM policy with PassRole](#example-iam-policy-with-passrole) for an example policy. + - **Zone and Network** configures the availability zone and network settings for your cluster. + - **Security Groups** creates or configures the Security Groups applied to your nodes. Please refer to [Amazon EC2 security group when using Node Driver]({{< baseurl >}}/rancher/v2.x/en/installation/references/#amazonec2-securitygroup-nodedriver) to see what rules are created in the `rancher-nodes` Security Group. + - **Instance** configures the instances that will be created. Make sure you configure the correct **SSH User** for the configured AMI. +

+ If you need to pass an **IAM Instance Profile Name** (not ARN), for example, when you want to use a [Kubernetes Cloud Provider]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers), you will need an additional permission in your policy. See [Example IAM policy with PassRole](#example-iam-policy-with-passrole) for an example policy. 1. {{< step_rancher-template >}} 1. Click **Create**. 1. **Optional:** Add additional node pools. +
1. Review your cluster settings to confirm they are correct. Then click **Create**. {{< result_create-cluster >}} diff --git a/content/rancher/v2.x/en/user-settings/cloud-credentials/_index.md b/content/rancher/v2.x/en/user-settings/cloud-credentials/_index.md index 627c8098c1f..2e124536b8a 100644 --- a/content/rancher/v2.x/en/user-settings/cloud-credentials/_index.md +++ b/content/rancher/v2.x/en/user-settings/cloud-credentials/_index.md @@ -1,14 +1,15 @@ --- title: Managing Cloud Credentials -weight: 7010 +weight: 7011 --- _Available as of v2.2.0_ When you create a cluster [hosted by an infrastructure provider]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools), [node templates]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-templates) are used to provision the cluster nodes. These templates use Docker Machine configuration options to define an operating system image and settings/parameters for the node. -Node templates use cloud credentials to access the credential information required to provision nodes in the infrastructure providers. The same cloud credential can be used by multiple node templates. By using a cloud credential, you do not have to re-enter access keys for the same cloud provider. Cloud credentials are stored as Kubernetes secrets. +Node templates can use cloud credentials to access the credential information required to provision nodes in the infrastructure providers. The same cloud credential can be used by multiple node templates. By using a cloud credential, you do not have to re-enter access keys for the same cloud provider. Cloud credentials are stored as Kubernetes secrets. +Cloud credentials are only used by node templates if there are fields marked as `password`. The default `active` node drivers have their account access fields marked as `password`, but there may be some `inactive` node drivers, which are not using them yet. These node drivers will not use cloud credentials. You can create cloud credentials in two contexts: @@ -43,7 +44,8 @@ When access credentials are changed or compromised, updating a cloud credential In order to delete cloud credentials, there must not be any node template associated with it. If you are unable to delete the cloud credential, [delete any node templates]({{< baseurl >}}/rancher/v2.x/en/user-settings/node-templates/#deleting-a-node-template) that are still associated to that cloud credential. 1. From your user settings, select **User Avatar > Cloud Credentials**. -1. You can either individually delete a cloud credential or bulk delete. - - To individually delete one, choose the cloud credential you want to edit and click the **Vertical Ellipsis (...) > Delete**. +1. You can either individually delete a cloud credential or bulk delete. + + - To individually delete one, choose the cloud credential you want to edit and click the **Vertical Ellipsis (...) > Delete**. - To bulk delete cloud credentials, select one or more cloud credentials from the list. Click **Delete**. 1. Confirm that you want to delete these cloud credentials. diff --git a/content/rancher/v2.x/en/user-settings/node-templates/_index.md b/content/rancher/v2.x/en/user-settings/node-templates/_index.md index bc81cab4d0c..2ebd89b0bd7 100644 --- a/content/rancher/v2.x/en/user-settings/node-templates/_index.md +++ b/content/rancher/v2.x/en/user-settings/node-templates/_index.md @@ -21,14 +21,13 @@ When you create a node template, it is bound to your user profile. Node template ## Updating a Node Template 1. From your user settings, select **User Avatar > Node Templates**. -1. Choose the Node Template you want to edit and click the **Vertical Ellipsis (...) > Edit**. - - **Note:** - Starting 2.2, you'll have to enter Account Access Information and create a **cloud credential** before editing node template. This will save you the hassle of re-entering access information everytime you edit a node template. +1. Choose the node template that you want to edit and click the **Vertical Ellipsis (...) > Edit**. -1. Edit the required information and click **Save**. + > **Note:** As of v2.2.0, the default `active` [node drivers]({{< baseurl >}}/rancher/v2.x/en/admin-settings/drivers/node-drivers/) and any node driver, that has fields marked as `password`, are required to use [cloud credentials]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#cloud-credentials). If you have upgraded to v2.2.0, existing node templates will continue to work with the previous account access information, but when you edit the node template, you will be required to create a cloud credential and the node template will start using it. -**Result:** The node template is updated with new information. All node pools using this node template will automatically use the updated information when new nodes are added. +1. Edit the required information and click **Save**. + +**Result:** The node template is updated. All node pools using this node template will automatically use the updated information when new nodes are added. ## Cloning Node Templates diff --git a/content/rancher/v2.x/en/user-settings/preferences/_index.md b/content/rancher/v2.x/en/user-settings/preferences/_index.md index a3ae0523edd..fc2fe8c1f2b 100644 --- a/content/rancher/v2.x/en/user-settings/preferences/_index.md +++ b/content/rancher/v2.x/en/user-settings/preferences/_index.md @@ -1,6 +1,6 @@ --- title: User Preferences -weight: 7010 +weight: 7012 --- Each user can choose preferences to personalize their Rancher experience. To change preference settings, open the **User Settings** menu and then select **Preferences**. diff --git a/layouts/shortcodes/step_create-cloud-credential.html b/layouts/shortcodes/step_create-cloud-credential.html index 2bace0b576e..1cc2891c0b5 100644 --- a/layouts/shortcodes/step_create-cloud-credential.html +++ b/layouts/shortcodes/step_create-cloud-credential.html @@ -1,11 +1,6 @@ -
-

- Starting 2.2, account access information will be stored in Cloud Credentials.

Cloud Credentials are stored in Kubernetes secrets. Multiple node templates can use the same cloud credential. You can either use an existing cloud credential or create a new one on this page. -

+

+As of v2.2.0, account access information will be stored as a cloud credential. Cloud credentials are stored as Kubernetes secrets.
- -

-

-

+Since multiple node templates can use the same cloud credential. You can use an existing cloud credential or create a new one. To create a new cloud credential, enter Name and Account Access data, then click Create. +
+