mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-25 20:48:11 +00:00
* 593 Add password requirments * re-organize page to use tabs, remove redundant material * eng: Bootstrap password has no validation/length requirements, subsequent admin passwords must be 12 chars or longer * update quickstart guides with link to password requirments * link to content in setting up bootstrap password * Apply suggestions from code review Co-authored-by: Lucas Saintarbor <lucas.saintarbor@suse.com> * suggestions from code review * update password requirements * helm cli * fix link * another link * Apply suggestions from code review Co-authored-by: Billy Tat <btat@suse.com> * sync 2.8 * syncing 2.7 * adding in helm-cli sync for 2.7 & 2.8 --------- Co-authored-by: Lucas Saintarbor <lucas.saintarbor@suse.com> Co-authored-by: Billy Tat <btat@suse.com>
This commit is contained in:
Marty Hernandez Avedon
co-authored by
Lucas Saintarbor
Billy Tat
Lucas Saintarbor
Billy Tat
parent
957bd368a7
commit
489b54c333
+3
-13
@@ -17,7 +17,7 @@ For information on enabling experimental features, refer to [this page.](../../.
|
||||
|
||||
| Option | Default Value | Description |
|
||||
| ------------------------- | ------------- | ---------------------------------------------------------------------------------- |
|
||||
| `bootstrapPassword` | " " | `string` - Set the [bootstrap password](#bootstrap-password) for the first admin user. After logging in, the admin will need to reset their password. A randomly generated bootstrap password is used if this value is not set.
|
||||
| `bootstrapPassword` | " " | `string` - Set the [bootstrap password](#bootstrap-password) for the first admin user. After logging in, the admin should reset their password. A randomly generated bootstrap password is used if this value is not set.
|
||||
| `hostname` | " " | `string` - the Fully Qualified Domain Name for your Rancher Server |
|
||||
| `ingress.tls.source` | "rancher" | `string` - Where to get the cert for the ingress. - "rancher, letsEncrypt, secret" |
|
||||
| `letsEncrypt.email` | " " | `string` - Your email address |
|
||||
@@ -64,19 +64,9 @@ For information on enabling experimental features, refer to [this page.](../../.
|
||||
|
||||
### Bootstrap Password
|
||||
|
||||
When Rancher starts for the first time, a password is randomly generated for the first admin user. When the admin first logs in to Rancher, the UI shows commands that can be used to retrieve the bootstrap password. The admin needs to run those commands and log in with the bootstrap password. Then Rancher gives the admin an opportunity to reset the password.
|
||||
You can [set a specific bootstrap password](../resources/bootstrap-password.md) during Rancher installation. If you don't set a specific bootstrap password, Rancher randomly generates a password for the first admin account.
|
||||
|
||||
If you want to use a specific bootstrap password instead of a randomly generated one, provide the password.
|
||||
|
||||
```plain
|
||||
--set bootstrapPassword="rancher"
|
||||
```
|
||||
|
||||
The password, whether provided or generated, will be stored in a Kubernetes secret. After Rancher is installed, the UI will show instructions for how to retrieve the password using kubectl:
|
||||
|
||||
```
|
||||
kubectl get secret --namespace cattle-system bootstrap-secret -o go-template='{{ .data.bootstrapPassword|base64decode}}{{ "\n" }}'
|
||||
```
|
||||
When you log in for the first time, use the bootstrap password you set to log in. If you did not set a bootstrap password, the Rancher UI shows commands that can be used to [retrieve the bootstrap password](../resources/bootstrap-password.md#retrieving-the-bootstrap-password). Run those commands and log in to the account. After you log in for the first time, you are asked to reset the admin password.
|
||||
|
||||
### API Audit Log
|
||||
|
||||
|
||||
+49
-12
@@ -6,26 +6,63 @@ title: Setting up the Bootstrap Password
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/resources/bootstrap-password"/>
|
||||
</head>
|
||||
|
||||
When Rancher starts for the first time, a password is randomly generated for the first admin user. When the admin first logs in to Rancher, the UI shows commands that can be used to retrieve the bootstrap password. The admin needs to run those commands and log in with the bootstrap password. Then Rancher gives the admin an opportunity to reset the password.
|
||||
When you install Rancher, you can set a bootstrap password for the first admin account.
|
||||
|
||||
The bootstrap password is randomly generated if it is not set during installation with a variable. For details on how to set the bootstrap password using a variable, see below.
|
||||
If you choose not to set a bootstrap password, Rancher randomly generates a bootstrap password for the first admin account.
|
||||
|
||||
### Specifying the Bootstrap Password in Helm Installs
|
||||
For details on how to set the bootstrap password, see below.
|
||||
|
||||
For a Helm install, users can specify the bootstrap password variable by configuring it in the Helm chart values with `.Values.bootstrapPassword`.
|
||||
## Password Requirements
|
||||
|
||||
The password will be stored in a Kubernetes secret. After Rancher is installed, the UI will show instructions for how to retrieve the password using kubectl:
|
||||
The bootstrap password can be any length.
|
||||
|
||||
When you reset the first admin account's password after first login, the new password must be at least 12 characters long.
|
||||
|
||||
In Rancher v2.6.9 and later, you can [customize the minimum password length](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/manage-users-and-groups.md#minimum-password-length) for user accounts, within limitations.
|
||||
|
||||
Minimum password length can be any positive integer value between 2 and 256. Decimal values and leading zeroes are not allowed.
|
||||
|
||||
## Specifying the Bootstrap Password
|
||||
|
||||
<Tabs>
|
||||
<TabItem value="Helm">
|
||||
|
||||
During [Rancher installation](../install-upgrade-on-a-kubernetes-cluster/install-upgrade-on-a-kubernetes-cluster.md), set `bootstrapPassword` alongside any other flags for the Rancher Helm chart. For example:
|
||||
|
||||
```bash
|
||||
helm install rancher rancher-<chart-repo>/rancher \
|
||||
--set bootstrapPassword=<password>
|
||||
```
|
||||
|
||||
</TabItem>
|
||||
<TabItem value="Docker">
|
||||
|
||||
Pass the following value to the [Docker install command](../other-installation-methods/air-gapped-helm-cli-install/docker-install-commands.md):
|
||||
|
||||
```bash
|
||||
-e CATTLE_BOOTSTRAP_PASSWORD=<password>
|
||||
```
|
||||
|
||||
</TabItem>
|
||||
</Tabs>
|
||||
|
||||
## Retrieving the Bootstrap Password
|
||||
|
||||
The bootstrap password is stored in the Docker container logs. After Rancher is installed, the UI shows instructions for how to retrieve the password based on your installation method.
|
||||
|
||||
<Tabs>
|
||||
<TabItem value="Helm">
|
||||
|
||||
```bash
|
||||
kubectl get secret --namespace cattle-system bootstrap-secret -o go-template='{{ .data.bootstrapPassword|base64decode}}{{ "\n" }}'
|
||||
```
|
||||
|
||||
### Specifying the Bootstrap Password in Docker Installs
|
||||
|
||||
For a Docker install, you can specify the bootstrap password by passing `-e CATTLE_BOOTSTRAP_PASSWORD=password` to the Docker install command.
|
||||
|
||||
The password will be stored in the Docker container logs. After Rancher is installed, the UI will show instructions for how to retrieve the password using the Docker container ID:
|
||||
</TabItem>
|
||||
<TabItem value="Docker">
|
||||
|
||||
```bash
|
||||
docker logs container-id 2>&1 | grep "Bootstrap Password:"
|
||||
```
|
||||
docker logs container-id 2>&1 | grep "Bootstrap Password:"
|
||||
```
|
||||
|
||||
</TabItem>
|
||||
</Tabs>
|
||||
|
||||
+2
-2
@@ -57,8 +57,8 @@ The AWS module just creates an EC2 KeyPair, an EC2 SecurityGroup and an EC2 inst
|
||||
|
||||
- `aws_access_key` - Amazon AWS Access Key
|
||||
- `aws_secret_key` - Amazon AWS Secret Key
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server (minimum 12 characters)
|
||||
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirments.
|
||||
|
||||
5. **Optional:** Modify optional variables within `terraform.tfvars`. See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [AWS Quickstart Readme](https://github.com/rancher/quickstart/tree/master/rancher/aws) for more information.
|
||||
Suggestions include:
|
||||
|
||||
|
||||
+2
-2
@@ -43,8 +43,8 @@ Deploying to Microsoft Azure will incur charges.
|
||||
- `azure_client_id` - Microsoft Azure Client ID
|
||||
- `azure_client_secret` - Microsoft Azure Client Secret
|
||||
- `azure_tenant_id` - Microsoft Azure Tenant ID
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server (minimum 12 characters)
|
||||
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirments.
|
||||
|
||||
5. **Optional:** Modify optional variables within `terraform.tfvars`.
|
||||
See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [Azure Quickstart Readme](https://github.com/rancher/quickstart/tree/master/rancher/azure) for more information. Suggestions include:
|
||||
- `azure_location` - Microsoft Azure region, choose the closest instead of the default (`East US`)
|
||||
|
||||
+2
-2
@@ -38,8 +38,8 @@ Deploying to DigitalOcean will incur charges.
|
||||
|
||||
4. Edit `terraform.tfvars` and customize the following variables:
|
||||
- `do_token` - DigitalOcean access key
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server (minimum 12 characters)
|
||||
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirments.
|
||||
|
||||
5. **Optional:** Modify optional variables within `terraform.tfvars`.
|
||||
See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [DO Quickstart Readme](https://github.com/rancher/quickstart/tree/master/rancher/do) for more information. Suggestions include:
|
||||
- `do_region` - DigitalOcean region, choose the closest instead of the default (`nyc1`)
|
||||
|
||||
+2
-2
@@ -39,8 +39,8 @@ Deploying to Google GCP will incur charges.
|
||||
|
||||
4. Edit `terraform.tfvars` and customize the following variables:
|
||||
- `gcp_account_json` - GCP service account file path and file name
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server (minimum 12 characters)
|
||||
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirments.
|
||||
|
||||
5. **Optional:** Modify optional variables within `terraform.tfvars`.
|
||||
See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [GCP Quickstart Readme](https://github.com/rancher/quickstart/tree/master/rancher/gcp) for more information.
|
||||
Suggestions include:
|
||||
|
||||
+1
-1
@@ -129,7 +129,7 @@ The final command to install Rancher is below. The command requires a domain nam
|
||||
|
||||
To install a specific Rancher version, use the `--version` flag (e.g., `--version 2.6.6`). Otherwise, the latest Rancher is installed by default. Refer to [Choosing a Rancher Version](../../installation-and-upgrade/resources/choose-a-rancher-version.md).
|
||||
|
||||
Note the password requires a minimum of 12 characters.
|
||||
See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirments.
|
||||
|
||||
```
|
||||
helm install rancher rancher-latest/rancher \
|
||||
|
||||
+2
-2
@@ -38,8 +38,8 @@ Deploying to Hetzner Cloud will incur charges.
|
||||
|
||||
4. Edit `terraform.tfvars` and customize the following variables:
|
||||
- `hcloud_token` - Hetzner API access key
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server (minimum 12 characters)
|
||||
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirments.
|
||||
|
||||
5. **Optional:** Modify optional variables within `terraform.tfvars`.
|
||||
See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [Hetzner Quickstart Readme](https://github.com/rancher/quickstart/tree/master/rancher/hcloud) for more information.
|
||||
Suggestions include:
|
||||
|
||||
+2
-2
@@ -38,8 +38,8 @@ Deploying to Linode will incur charges.
|
||||
|
||||
4. Edit `terraform.tfvars` and customize the following variables:
|
||||
- `linode_token` - The Linode Personal Access Token mentioned above.
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server (minimum 12 characters).
|
||||
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirments.
|
||||
|
||||
5. **Optional:** Modify optional variables within `terraform.tfvars`.
|
||||
See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [Linode Quickstart Readme](https://github.com/rancher/quickstart/tree/master/rancher/linode) for more information. Suggestions include:
|
||||
- `linode_region` - The target Linode region to provision the server and cluster in.
|
||||
|
||||
+2
-2
@@ -39,8 +39,8 @@ Deploying to Outscale will incur charges.
|
||||
4. Edit `terraform.tfvars` and customize the following variables:
|
||||
- `access_key_id` - Outscale access key
|
||||
- `secret_key_id` - Outscale secret key
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server (minimum 12 characters)
|
||||
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirments.
|
||||
|
||||
5. **Optional:** Modify optional variables within `terraform.tfvars`.
|
||||
See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [Outscale Quickstart Readme](https://github.com/rancher/quickstart/tree/master/rancher/outscale) for more information.
|
||||
Suggestions include:
|
||||
|
||||
+3
-13
@@ -17,7 +17,7 @@ For information on enabling experimental features, refer to [this page.](../../.
|
||||
|
||||
| Option | Default Value | Description |
|
||||
| ------------------------- | ------------- | ---------------------------------------------------------------------------------- |
|
||||
| `bootstrapPassword` | " " | `string` - Set the [bootstrap password](#bootstrap-password) for the first admin user. After logging in, the admin will need to reset their password. A randomly generated bootstrap password is used if this value is not set.
|
||||
| `bootstrapPassword` | " " | `string` - Set the [bootstrap password](#bootstrap-password) for the first admin user. After logging in, the admin should reset their password. A randomly generated bootstrap password is used if this value is not set.
|
||||
| `hostname` | " " | `string` - the Fully Qualified Domain Name for your Rancher Server |
|
||||
| `ingress.tls.source` | "rancher" | `string` - Where to get the cert for the ingress. - "rancher, letsEncrypt, secret" |
|
||||
| `letsEncrypt.email` | " " | `string` - Your email address |
|
||||
@@ -67,19 +67,9 @@ For information on enabling experimental features, refer to [this page.](../../.
|
||||
|
||||
### Bootstrap Password
|
||||
|
||||
When Rancher starts for the first time, a password is randomly generated for the first admin user. When the admin first logs in to Rancher, the UI shows commands that can be used to retrieve the bootstrap password. The admin needs to run those commands and log in with the bootstrap password. Then Rancher gives the admin an opportunity to reset the password.
|
||||
You can [set a specific bootstrap password](../resources/bootstrap-password.md) during Rancher installation. If you don't set a specific bootstrap password, Rancher randomly generates a password for the first admin account.
|
||||
|
||||
If you want to use a specific bootstrap password instead of a randomly generated one, provide the password.
|
||||
|
||||
```plain
|
||||
--set bootstrapPassword="rancher"
|
||||
```
|
||||
|
||||
The password, whether provided or generated, will be stored in a Kubernetes secret. After Rancher is installed, the UI will show instructions for how to retrieve the password using kubectl:
|
||||
|
||||
```
|
||||
kubectl get secret --namespace cattle-system bootstrap-secret -o go-template='{{ .data.bootstrapPassword|base64decode}}{{ "\n" }}'
|
||||
```
|
||||
When you log in for the first time, use the bootstrap password you set to log in. If you did not set a bootstrap password, the Rancher UI shows commands that can be used to [retrieve the bootstrap password](../resources/bootstrap-password.md#retrieving-the-bootstrap-password). Run those commands and log in to the account. After you log in for the first time, you are asked to reset the admin password.
|
||||
|
||||
### API Audit Log
|
||||
|
||||
|
||||
+49
-12
@@ -6,26 +6,63 @@ title: Setting up the Bootstrap Password
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/resources/bootstrap-password"/>
|
||||
</head>
|
||||
|
||||
When Rancher starts for the first time, a password is randomly generated for the first admin user. When the admin first logs in to Rancher, the UI shows commands that can be used to retrieve the bootstrap password. The admin needs to run those commands and log in with the bootstrap password. Then Rancher gives the admin an opportunity to reset the password.
|
||||
When you install Rancher, you can set a bootstrap password for the first admin account.
|
||||
|
||||
The bootstrap password is randomly generated if it is not set during installation with a variable. For details on how to set the bootstrap password using a variable, see below.
|
||||
If you choose not to set a bootstrap password, Rancher randomly generates a bootstrap password for the first admin account.
|
||||
|
||||
### Specifying the Bootstrap Password in Helm Installs
|
||||
For details on how to set the bootstrap password, see below.
|
||||
|
||||
For a Helm install, users can specify the bootstrap password variable by configuring it in the Helm chart values with `.Values.bootstrapPassword`.
|
||||
## Password Requirements
|
||||
|
||||
The password will be stored in a Kubernetes secret. After Rancher is installed, the UI will show instructions for how to retrieve the password using kubectl:
|
||||
The bootstrap password can be any length.
|
||||
|
||||
When you reset the first admin account's password after first login, the new password must be at least 12 characters long.
|
||||
|
||||
You can [customize the minimum password length](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/manage-users-and-groups.md#minimum-password-length) for user accounts, within limitations.
|
||||
|
||||
Minimum password length can be any positive integer value between 2 and 256. Decimal values and leading zeroes are not allowed.
|
||||
|
||||
## Specifying the Bootstrap Password
|
||||
|
||||
<Tabs>
|
||||
<TabItem value="Helm">
|
||||
|
||||
During [Rancher installation](../install-upgrade-on-a-kubernetes-cluster/install-upgrade-on-a-kubernetes-cluster.md), set `bootstrapPassword` alongside any other flags for the Rancher Helm chart. For example:
|
||||
|
||||
```bash
|
||||
helm install rancher rancher-<chart-repo>/rancher \
|
||||
--set bootstrapPassword=<password>
|
||||
```
|
||||
|
||||
</TabItem>
|
||||
<TabItem value="Docker">
|
||||
|
||||
Pass the following value to the [Docker install command](../other-installation-methods/air-gapped-helm-cli-install/docker-install-commands.md):
|
||||
|
||||
```bash
|
||||
-e CATTLE_BOOTSTRAP_PASSWORD=<password>
|
||||
```
|
||||
|
||||
</TabItem>
|
||||
</Tabs>
|
||||
|
||||
## Retrieving the Bootstrap Password
|
||||
|
||||
The bootstrap password is stored in the Docker container logs. After Rancher is installed, the UI shows instructions for how to retrieve the password based on your installation method.
|
||||
|
||||
<Tabs>
|
||||
<TabItem value="Helm">
|
||||
|
||||
```bash
|
||||
kubectl get secret --namespace cattle-system bootstrap-secret -o go-template='{{ .data.bootstrapPassword|base64decode}}{{ "\n" }}'
|
||||
```
|
||||
|
||||
### Specifying the Bootstrap Password in Docker Installs
|
||||
|
||||
For a Docker install, you can specify the bootstrap password by passing `-e CATTLE_BOOTSTRAP_PASSWORD=password` to the Docker install command.
|
||||
|
||||
The password will be stored in the Docker container logs. After Rancher is installed, the UI will show instructions for how to retrieve the password using the Docker container ID:
|
||||
</TabItem>
|
||||
<TabItem value="Docker">
|
||||
|
||||
```bash
|
||||
docker logs container-id 2>&1 | grep "Bootstrap Password:"
|
||||
```
|
||||
docker logs container-id 2>&1 | grep "Bootstrap Password:"
|
||||
```
|
||||
|
||||
</TabItem>
|
||||
</Tabs>
|
||||
|
||||
+1
-1
@@ -57,7 +57,7 @@ The AWS module just creates an EC2 KeyPair, an EC2 SecurityGroup and an EC2 inst
|
||||
|
||||
- `aws_access_key` - Amazon AWS Access Key
|
||||
- `aws_secret_key` - Amazon AWS Secret Key
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server (minimum 12 characters)
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirments.
|
||||
|
||||
5. **Optional:** Modify optional variables within `terraform.tfvars`. See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [AWS Quickstart Readme](https://github.com/rancher/quickstart/tree/master/rancher/aws) for more information.
|
||||
Suggestions include:
|
||||
|
||||
+1
-2
@@ -43,8 +43,7 @@ Deploying to Microsoft Azure will incur charges.
|
||||
- `azure_client_id` - Microsoft Azure Client ID
|
||||
- `azure_client_secret` - Microsoft Azure Client Secret
|
||||
- `azure_tenant_id` - Microsoft Azure Tenant ID
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server (minimum 12 characters)
|
||||
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirments.
|
||||
5. **Optional:** Modify optional variables within `terraform.tfvars`.
|
||||
See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [Azure Quickstart Readme](https://github.com/rancher/quickstart/tree/master/rancher/azure) for more information. Suggestions include:
|
||||
- `azure_location` - Microsoft Azure region, choose the closest instead of the default (`East US`)
|
||||
|
||||
+1
-1
@@ -38,7 +38,7 @@ Deploying to DigitalOcean will incur charges.
|
||||
|
||||
4. Edit `terraform.tfvars` and customize the following variables:
|
||||
- `do_token` - DigitalOcean access key
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server (minimum 12 characters)
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirments.
|
||||
|
||||
5. **Optional:** Modify optional variables within `terraform.tfvars`.
|
||||
See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [DO Quickstart Readme](https://github.com/rancher/quickstart/tree/master/rancher/do) for more information. Suggestions include:
|
||||
|
||||
+1
-1
@@ -39,7 +39,7 @@ Deploying to Google GCP will incur charges.
|
||||
|
||||
4. Edit `terraform.tfvars` and customize the following variables:
|
||||
- `gcp_account_json` - GCP service account file path and file name
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server (minimum 12 characters)
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirments.
|
||||
|
||||
5. **Optional:** Modify optional variables within `terraform.tfvars`.
|
||||
See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [GCP Quickstart Readme](https://github.com/rancher/quickstart/tree/master/rancher/gcp) for more information.
|
||||
|
||||
+1
-1
@@ -130,7 +130,7 @@ To install a specific Rancher version, use the `--version` flag (e.g., `--versio
|
||||
|
||||
For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false` when using Rancher v2.7.2-v2.7.4. This is not necessary for Rancher v2.7.5 and above, but you can still manually set the option if you choose.
|
||||
|
||||
Note the password requires a minimum of 12 characters.
|
||||
See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirments.
|
||||
|
||||
```
|
||||
helm install rancher rancher-latest/rancher \
|
||||
|
||||
+1
-1
@@ -38,7 +38,7 @@ Deploying to Hetzner Cloud will incur charges.
|
||||
|
||||
4. Edit `terraform.tfvars` and customize the following variables:
|
||||
- `hcloud_token` - Hetzner API access key
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server (minimum 12 characters)
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirments.
|
||||
|
||||
5. **Optional:** Modify optional variables within `terraform.tfvars`.
|
||||
See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [Hetzner Quickstart Readme](https://github.com/rancher/quickstart/tree/master/rancher/hcloud) for more information.
|
||||
|
||||
+1
-1
@@ -38,7 +38,7 @@ Deploying to Linode will incur charges.
|
||||
|
||||
4. Edit `terraform.tfvars` and customize the following variables:
|
||||
- `linode_token` - The Linode Personal Access Token mentioned above.
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server (minimum 12 characters).
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirments.
|
||||
|
||||
5. **Optional:** Modify optional variables within `terraform.tfvars`.
|
||||
See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [Linode Quickstart Readme](https://github.com/rancher/quickstart/tree/master/rancher/linode) for more information. Suggestions include:
|
||||
|
||||
+1
-1
@@ -39,7 +39,7 @@ Deploying to Outscale will incur charges.
|
||||
4. Edit `terraform.tfvars` and customize the following variables:
|
||||
- `access_key_id` - Outscale access key
|
||||
- `secret_key_id` - Outscale secret key
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server (minimum 12 characters)
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirments.
|
||||
|
||||
5. **Optional:** Modify optional variables within `terraform.tfvars`.
|
||||
See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [Outscale Quickstart Readme](https://github.com/rancher/quickstart/tree/master/rancher/outscale) for more information.
|
||||
|
||||
+3
-13
@@ -17,7 +17,7 @@ For information on enabling experimental features, refer to [this page.](../../.
|
||||
|
||||
| Option | Default Value | Description |
|
||||
| ------------------------- | ------------- | ---------------------------------------------------------------------------------- |
|
||||
| `bootstrapPassword` | " " | `string` - Set the [bootstrap password](#bootstrap-password) for the first admin user. After logging in, the admin will need to reset their password. A randomly generated bootstrap password is used if this value is not set.
|
||||
| `bootstrapPassword` | " " | `string` - Set the [bootstrap password](#bootstrap-password) for the first admin user. After logging in, the admin should reset their password. A randomly generated bootstrap password is used if this value is not set.
|
||||
| `hostname` | " " | `string` - the Fully Qualified Domain Name for your Rancher Server |
|
||||
| `ingress.tls.source` | "rancher" | `string` - Where to get the cert for the ingress. - "rancher, letsEncrypt, secret" |
|
||||
| `letsEncrypt.email` | " " | `string` - Your email address |
|
||||
@@ -67,19 +67,9 @@ For information on enabling experimental features, refer to [this page.](../../.
|
||||
|
||||
### Bootstrap Password
|
||||
|
||||
When Rancher starts for the first time, a password is randomly generated for the first admin user. When the admin first logs in to Rancher, the UI shows commands that can be used to retrieve the bootstrap password. The admin needs to run those commands and log in with the bootstrap password. Then Rancher gives the admin an opportunity to reset the password.
|
||||
You can [set a specific bootstrap password](../resources/bootstrap-password.md) during Rancher installation. If you don't set a specific bootstrap password, Rancher randomly generates a password for the first admin account.
|
||||
|
||||
If you want to use a specific bootstrap password instead of a randomly generated one, provide the password.
|
||||
|
||||
```plain
|
||||
--set bootstrapPassword="rancher"
|
||||
```
|
||||
|
||||
The password, whether provided or generated, will be stored in a Kubernetes secret. After Rancher is installed, the UI will show instructions for how to retrieve the password using kubectl:
|
||||
|
||||
```
|
||||
kubectl get secret --namespace cattle-system bootstrap-secret -o go-template='{{ .data.bootstrapPassword|base64decode}}{{ "\n" }}'
|
||||
```
|
||||
When you log in for the first time, use the bootstrap password you set to log in. If you did not set a bootstrap password, the Rancher UI shows commands that can be used to [retrieve the bootstrap password](../resources/bootstrap-password.md#retrieving-the-bootstrap-password). Run those commands and log in to the account. After you log in for the first time, you are asked to reset the admin password.
|
||||
|
||||
### API Audit Log
|
||||
|
||||
|
||||
+49
-12
@@ -6,26 +6,63 @@ title: Setting up the Bootstrap Password
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/resources/bootstrap-password"/>
|
||||
</head>
|
||||
|
||||
When Rancher starts for the first time, a password is randomly generated for the first admin user. When the admin first logs in to Rancher, the UI shows commands that can be used to retrieve the bootstrap password. The admin needs to run those commands and log in with the bootstrap password. Then Rancher gives the admin an opportunity to reset the password.
|
||||
When you install Rancher, you can set a bootstrap password for the first admin account.
|
||||
|
||||
The bootstrap password is randomly generated if it is not set during installation with a variable. For details on how to set the bootstrap password using a variable, see below.
|
||||
If you choose not to set a bootstrap password, Rancher randomly generates a bootstrap password for the first admin account.
|
||||
|
||||
### Specifying the Bootstrap Password in Helm Installs
|
||||
For details on how to set the bootstrap password, see below.
|
||||
|
||||
For a Helm install, users can specify the bootstrap password variable by configuring it in the Helm chart values with `.Values.bootstrapPassword`.
|
||||
## Password Requirements
|
||||
|
||||
The password will be stored in a Kubernetes secret. After Rancher is installed, the UI will show instructions for how to retrieve the password using kubectl:
|
||||
The bootstrap password can be any length.
|
||||
|
||||
When you reset the first admin account's password after first login, the new password must be at least 12 characters long.
|
||||
|
||||
You can [customize the minimum password length](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/manage-users-and-groups.md#minimum-password-length) for user accounts, within limitations.
|
||||
|
||||
Minimum password length can be any positive integer value between 2 and 256. Decimal values and leading zeroes are not allowed.
|
||||
|
||||
## Specifying the Bootstrap Password
|
||||
|
||||
<Tabs>
|
||||
<TabItem value="Helm">
|
||||
|
||||
During [Rancher installation](../install-upgrade-on-a-kubernetes-cluster/install-upgrade-on-a-kubernetes-cluster.md), set `bootstrapPassword` alongside any other flags for the Rancher Helm chart. For example:
|
||||
|
||||
```bash
|
||||
helm install rancher rancher-<chart-repo>/rancher \
|
||||
--set bootstrapPassword=<password>
|
||||
```
|
||||
|
||||
</TabItem>
|
||||
<TabItem value="Docker">
|
||||
|
||||
Pass the following value to the [Docker install command](../other-installation-methods/air-gapped-helm-cli-install/docker-install-commands.md):
|
||||
|
||||
```bash
|
||||
-e CATTLE_BOOTSTRAP_PASSWORD=<password>
|
||||
```
|
||||
|
||||
</TabItem>
|
||||
</Tabs>
|
||||
|
||||
## Retrieving the Bootstrap Password
|
||||
|
||||
The bootstrap password is stored in the Docker container logs. After Rancher is installed, the UI shows instructions for how to retrieve the password based on your installation method.
|
||||
|
||||
<Tabs>
|
||||
<TabItem value="Helm">
|
||||
|
||||
```bash
|
||||
kubectl get secret --namespace cattle-system bootstrap-secret -o go-template='{{ .data.bootstrapPassword|base64decode}}{{ "\n" }}'
|
||||
```
|
||||
|
||||
### Specifying the Bootstrap Password in Docker Installs
|
||||
|
||||
For a Docker install, you can specify the bootstrap password by passing `-e CATTLE_BOOTSTRAP_PASSWORD=password` to the Docker install command.
|
||||
|
||||
The password will be stored in the Docker container logs. After Rancher is installed, the UI will show instructions for how to retrieve the password using the Docker container ID:
|
||||
</TabItem>
|
||||
<TabItem value="Docker">
|
||||
|
||||
```bash
|
||||
docker logs container-id 2>&1 | grep "Bootstrap Password:"
|
||||
```
|
||||
docker logs container-id 2>&1 | grep "Bootstrap Password:"
|
||||
```
|
||||
|
||||
</TabItem>
|
||||
</Tabs>
|
||||
+1
-1
@@ -43,7 +43,7 @@ Deploying to Microsoft Azure will incur charges.
|
||||
- `azure_client_id` - Microsoft Azure Client ID
|
||||
- `azure_client_secret` - Microsoft Azure Client Secret
|
||||
- `azure_tenant_id` - Microsoft Azure Tenant ID
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server (minimum 12 characters)
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirments.
|
||||
|
||||
5. **Optional:** Modify optional variables within `terraform.tfvars`.
|
||||
See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [Azure Quickstart Readme](https://github.com/rancher/quickstart/tree/master/rancher/azure) for more information. Suggestions include:
|
||||
|
||||
+2
-2
@@ -38,8 +38,8 @@ Deploying to DigitalOcean will incur charges.
|
||||
|
||||
4. Edit `terraform.tfvars` and customize the following variables:
|
||||
- `do_token` - DigitalOcean access key
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server (minimum 12 characters)
|
||||
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirments.
|
||||
|
||||
5. **Optional:** Modify optional variables within `terraform.tfvars`.
|
||||
See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [DO Quickstart Readme](https://github.com/rancher/quickstart/tree/master/rancher/do) for more information. Suggestions include:
|
||||
- `do_region` - DigitalOcean region, choose the closest instead of the default (`nyc1`)
|
||||
|
||||
+2
-1
@@ -39,7 +39,8 @@ Deploying to Google GCP will incur charges.
|
||||
|
||||
4. Edit `terraform.tfvars` and customize the following variables:
|
||||
- `gcp_account_json` - GCP service account file path and file name
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server (minimum 12 characters)
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirments.
|
||||
|
||||
|
||||
5. **Optional:** Modify optional variables within `terraform.tfvars`.
|
||||
See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [GCP Quickstart Readme](https://github.com/rancher/quickstart/tree/master/rancher/gcp) for more information.
|
||||
|
||||
+1
-1
@@ -130,7 +130,7 @@ To install a specific Rancher version, use the `--version` flag (e.g., `--versio
|
||||
|
||||
For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false` when using Rancher v2.7.2-v2.7.4. This is not necessary for Rancher v2.7.5 and above, but you can still manually set the option if you choose.
|
||||
|
||||
Note the password requires a minimum of 12 characters.
|
||||
See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirments.
|
||||
|
||||
```
|
||||
helm install rancher rancher-latest/rancher \
|
||||
|
||||
+2
-2
@@ -38,8 +38,8 @@ Deploying to Hetzner Cloud will incur charges.
|
||||
|
||||
4. Edit `terraform.tfvars` and customize the following variables:
|
||||
- `hcloud_token` - Hetzner API access key
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server (minimum 12 characters)
|
||||
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirments.
|
||||
|
||||
5. **Optional:** Modify optional variables within `terraform.tfvars`.
|
||||
See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [Hetzner Quickstart Readme](https://github.com/rancher/quickstart/tree/master/rancher/hcloud) for more information.
|
||||
Suggestions include:
|
||||
|
||||
+1
-1
@@ -38,7 +38,7 @@ Deploying to Linode will incur charges.
|
||||
|
||||
4. Edit `terraform.tfvars` and customize the following variables:
|
||||
- `linode_token` - The Linode Personal Access Token mentioned above.
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server (minimum 12 characters).
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirments.
|
||||
|
||||
5. **Optional:** Modify optional variables within `terraform.tfvars`.
|
||||
See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [Linode Quickstart Readme](https://github.com/rancher/quickstart/tree/master/rancher/linode) for more information. Suggestions include:
|
||||
|
||||
+1
-1
@@ -39,7 +39,7 @@ Deploying to Outscale will incur charges.
|
||||
4. Edit `terraform.tfvars` and customize the following variables:
|
||||
- `access_key_id` - Outscale access key
|
||||
- `secret_key_id` - Outscale secret key
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server (minimum 12 characters)
|
||||
- `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirments.
|
||||
|
||||
5. **Optional:** Modify optional variables within `terraform.tfvars`.
|
||||
See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [Outscale Quickstart Readme](https://github.com/rancher/quickstart/tree/master/rancher/outscale) for more information.
|
||||
|
||||
Reference in New Issue
Block a user