mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-24 20:18:18 +00:00
Merge branch 'rancher:main' into main
This commit is contained in:
mschroeder-fzj
@@ -25,11 +25,15 @@ spec:
|
||||
EOF
|
||||
```
|
||||
|
||||
Use `metadata.generateName` to ensure a unique project ID, but note that `kubectl apply` does not work with `metadata.generateName`, so `kubectl create` must be used instead.
|
||||
When creating a new project, you have two primary options for setting the name:
|
||||
|
||||
- **Automatic Generation:** Use `metadata.generateName` to ensure a unique project ID. However, note that you must use `kubectl create` (instead of `kubectl apply`) with this option, as `kubectl apply` does not support it.
|
||||
- **Manual Naming:** You can explicitly set the project ID using `metadata.name`. If a project with that exact name already exists, the name request is denied.
|
||||
The display name seen in the UI is set by `spec.displayName`. If `spec.displayName` is not provided, the field `metadata.name` is used instead.
|
||||
|
||||
Set `metadata.namespace` and `spec.clusterName` to the ID for the cluster the project belongs to.
|
||||
|
||||
If you create a project through a cluster member account, you must include the annotation, `field.cattle.io/creatorId`, and set it to the cluster member account's user ID.
|
||||
If you create a project through a cluster member account and want that account to be able to access the project, you must include the annotation `field.cattle.io/creatorId`, and set it to the cluster member account's user ID.
|
||||
|
||||
```bash
|
||||
kubectl create -f - <<EOF
|
||||
@@ -46,7 +50,7 @@ spec:
|
||||
EOF
|
||||
```
|
||||
|
||||
Setting the `field.cattle.io/creatorId` field allows the cluster member account to see project resources with the `get` command and view the project in the Rancher UI. Cluster owner and admin accounts don't need to set this annotation to perform these tasks.
|
||||
Setting the `field.cattle.io/creatorId` field creates a `ProjectRoleTemplateBinding` that grants the specified user the ability to see project resources with the `get` command and view the project in the Rancher UI. Cluster owner and admin accounts don't need to set this annotation to perform these tasks.
|
||||
|
||||
Setting the `field.cattle.io/creator-principal-name` annotation to the user's principal preserves it in a projectroletemplatebinding automatically created for the project owner.
|
||||
|
||||
@@ -97,9 +101,13 @@ spec:
|
||||
EOF
|
||||
```
|
||||
|
||||
### Backing Namespace
|
||||
|
||||
After creating the project, the field `status.backingNamespace` gets populated. This represents the namespace in the management cluster that is created to manage project related resources. Examples of resources stored in the backing namespace are [project scoped secrets](../../how-to-guides/new-user-guides/kubernetes-resources-setup/secrets.md#creating-secrets-in-projects) and [project role template bindings](../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md#project-roles).
|
||||
|
||||
## Adding a Member to a Project
|
||||
|
||||
Look up the project ID to specify the `metadata.namespace` field and `projectName` field values.
|
||||
Look up the project's [backing namespace](#backing-namespace) to specify the `metadata.namespace` field value and look up the project's ID to specify the `projectName` field value.
|
||||
|
||||
```bash
|
||||
kubectl --namespace c-m-abcde get projects
|
||||
@@ -119,7 +127,7 @@ apiVersion: management.cattle.io/v3
|
||||
kind: ProjectRoleTemplateBinding
|
||||
metadata:
|
||||
generateName: prtb-
|
||||
namespace: p-vwxyz
|
||||
namespace: c-m-abcde-p-vwxyz
|
||||
projectName: c-m-abcde:p-vwxyz
|
||||
roleTemplateName: project-member
|
||||
userPrincipalName: keycloak_user://user
|
||||
@@ -145,16 +153,16 @@ Create a projectroletemplatebinding for each role you want to assign to the proj
|
||||
|
||||
## Listing Project Members
|
||||
|
||||
Look up the project ID:
|
||||
Look up the project backing namespace:
|
||||
|
||||
```bash
|
||||
kubectl --namespace c-m-abcde get projects
|
||||
```
|
||||
|
||||
to list projectroletemplatebindings in the project's namespace:
|
||||
To list projectroletemplatebindings in the project's backing namespace:
|
||||
|
||||
```bash
|
||||
kubectl --namespace p-vwxyz get projectroletemplatebindings
|
||||
kubectl --namespace c-m-abcde-p-vwxyz get projectroletemplatebindings
|
||||
```
|
||||
|
||||
## Deleting a Member From a Project
|
||||
@@ -164,14 +172,14 @@ Lookup the projectroletemplatebinding IDs containing the member in the project's
|
||||
Delete the projectroletemplatebinding from the project's namespace:
|
||||
|
||||
```bash
|
||||
kubectl --namespace p-vwxyz delete projectroletemplatebindings prtb-qx874 prtb-7zw7s
|
||||
kubectl --namespace c-m-abcde-p-vwxyz delete projectroletemplatebindings prtb-qx874 prtb-7zw7s
|
||||
```
|
||||
|
||||
## Creating a Namespace in a Project
|
||||
|
||||
The Project resource resides in the management cluster, even if the Project is for a managed cluster. The namespaces under the project reside in the managed cluster.
|
||||
|
||||
On the management cluster, look up the project ID for the cluster you are administrating since it generated using `metadata.generateName`:
|
||||
On the management cluster, look up the project ID for the cluster you are administrating if generated using `metadata.generateName`:
|
||||
|
||||
```bash
|
||||
kubectl --namespace c-m-abcde get projects
|
||||
@@ -207,3 +215,5 @@ kubectl --namespace c-m-abcde delete project p-vwxyz
|
||||
```
|
||||
|
||||
Note that this command doesn't delete the namespaces and resources that formerly belonged to the project.
|
||||
|
||||
It does delete all project role template bindings for the projects, so recreating the project will not restore members added to the project, and you have to add users as members again.
|
||||
|
||||
@@ -16,6 +16,7 @@ Rancher will publish deprecated features as part of the [release notes](https://
|
||||
|
||||
| Patch Version | Release Date |
|
||||
|---------------|---------------|
|
||||
| [2.13.1](https://github.com/rancher/rancher/releases/tag/v2.13.1) | December 18, 2025 |
|
||||
| [2.13.0](https://github.com/rancher/rancher/releases/tag/v2.13.0) | November 25, 2025 |
|
||||
|
||||
## What can I expect when a feature is marked for deprecation?
|
||||
|
||||
+32
@@ -50,6 +50,38 @@ The following CLI tools are required for setting up the Kubernetes cluster. Plea
|
||||
|
||||
## Install the Rancher Helm Chart
|
||||
|
||||
:::important
|
||||
|
||||
**Important:** In Rancher Community v2.13.1 if your registry configuration is one of the following you may see Rancher generate the `cattle-cluster-agent` image with an incorrect `docker.io` path segment:
|
||||
|
||||
- Environments where a **cluster-scoped container registry** is configured for system images.
|
||||
- Environments where a **global `system-default-registry`** is configured (e.g. airgap setups), even if no cluster-scoped registry is set.
|
||||
|
||||
**Workaround for Affected Setups:** As a workaround, override the `cattle-cluster-agent` image via the `CATTLE_AGENT_IMAGE` environment variable. This value must **not** contain any registry prefix (Rancher will handle that automatically). It should be set only to the repository and tag, for example:`rancher/rancher-agent:v2.13.1`
|
||||
|
||||
**Helm `install` example:**
|
||||
|
||||
```bash
|
||||
helm install rancher rancher-latest/rancher \
|
||||
...
|
||||
--set extraEnv[0].name=CATTLE_AGENT_IMAGE \
|
||||
--set extraEnv[0].value=rancher/rancher-agent:v2.13.1
|
||||
```
|
||||
|
||||
**Helm `upgrade` example:**
|
||||
|
||||
```bash
|
||||
helm upgrade rancher rancher-latest/rancher \
|
||||
...
|
||||
--set extraEnv[0].name=CATTLE_AGENT_IMAGE \
|
||||
--set extraEnv[0].value=rancher/rancher-agent:v2.13.1
|
||||
```
|
||||
|
||||
**Important Upgrade Note:**
|
||||
|
||||
The `CATTLE_AGENT_IMAGE` override is intended only as a temporary workaround for the affected configurations. Once a Rancher version is available that corrects this behavior, the `CATTLE_AGENT_IMAGE` override should be **removed** from Helm values, so that Rancher can resume managing the agent image normally and automatically track future image and tag changes. See [#53187](https://github.com/rancher/rancher/issues/53187#issuecomment-3676484603) for further information.
|
||||
:::
|
||||
|
||||
Rancher is installed using the [Helm](https://helm.sh/) package manager for Kubernetes. Helm charts provide templating syntax for Kubernetes YAML manifest documents. With Helm, we can create configurable deployments instead of just using static files.
|
||||
|
||||
For systems without direct internet access, see [Air Gap: Kubernetes install](../other-installation-methods/air-gapped-helm-cli-install/install-rancher-ha.md).
|
||||
|
||||
+32
@@ -28,6 +28,38 @@ Note that upgrades _to_ or _from_ any chart in the [rancher-alpha repository](..
|
||||
|
||||
### Helm Version
|
||||
|
||||
:::important
|
||||
|
||||
**Important:** In Rancher Community v2.13.1 if your registry configuration is one of the following you may see Rancher generate the `cattle-cluster-agent` image with an incorrect `docker.io` path segment:
|
||||
|
||||
- Environments where a **cluster-scoped container registry** is configured for system images.
|
||||
- Environments where a **global `system-default-registry`** is configured (e.g. airgap setups), even if no cluster-scoped registry is set.
|
||||
|
||||
**Workaround for Affected Setups:** As a workaround, override the `cattle-cluster-agent` image via the `CATTLE_AGENT_IMAGE` environment variable. This value must **not** contain any registry prefix (Rancher will handle that automatically). It should be set only to the repository and tag, for example:`rancher/rancher-agent:v2.13.1`
|
||||
|
||||
**Helm `install` example:**
|
||||
|
||||
```bash
|
||||
helm install rancher rancher-latest/rancher \
|
||||
...
|
||||
--set extraEnv[0].name=CATTLE_AGENT_IMAGE \
|
||||
--set extraEnv[0].value=rancher/rancher-agent:v2.13.1
|
||||
```
|
||||
|
||||
**Helm `upgrade` example:**
|
||||
|
||||
```bash
|
||||
helm upgrade rancher rancher-latest/rancher \
|
||||
...
|
||||
--set extraEnv[0].name=CATTLE_AGENT_IMAGE \
|
||||
--set extraEnv[0].value=rancher/rancher-agent:v2.13.1
|
||||
```
|
||||
|
||||
**Important Upgrade Note:**
|
||||
|
||||
The `CATTLE_AGENT_IMAGE` override is intended only as a temporary workaround for the affected configurations. Once a Rancher version is available that corrects this behavior, the `CATTLE_AGENT_IMAGE` override should be **removed** from Helm values, so that Rancher can resume managing the agent image normally and automatically track future image and tag changes. See [#53187](https://github.com/rancher/rancher/issues/53187#issuecomment-3676484603) for further information.
|
||||
:::
|
||||
|
||||
The upgrade instructions assume you are using Helm 3.
|
||||
|
||||
<DeprecationHelm2 />
|
||||
|
||||
@@ -15,10 +15,8 @@ The etcd data set is automatically cleaned up on a five-minute interval by Kuber
|
||||
```yaml
|
||||
# RKE2/K3s config.yaml
|
||||
---
|
||||
services:
|
||||
etcd:
|
||||
extra_args:
|
||||
quota-backend-bytes: 5368709120
|
||||
etcd-arg:
|
||||
- "quota-backend-bytes=5368709120"
|
||||
```
|
||||
|
||||
## Scaling etcd Disk Performance
|
||||
@@ -32,12 +30,7 @@ To implement this solution in an RKE2/K3s cluster, the `/var/lib/etcd/data` and
|
||||
```yaml
|
||||
# RKE2/K3s config.yaml
|
||||
---
|
||||
services:
|
||||
etcd:
|
||||
extra_args:
|
||||
data-dir: '/var/lib/rancher/etcd/data/'
|
||||
wal-dir: '/var/lib/rancher/etcd/wal/wal_dir'
|
||||
extra_binds:
|
||||
- '/var/lib/etcd/data:/var/lib/rancher/etcd/data'
|
||||
- '/var/lib/etcd/wal:/var/lib/rancher/etcd/wal'
|
||||
etcd-arg:
|
||||
- "data-dir=/var/lib/etcd/data"
|
||||
- "wal-dir=/var/lib/etcd/wal"
|
||||
```
|
||||
|
||||
@@ -13,7 +13,7 @@ A project is a group of namespaces, and it is a concept introduced by Rancher. P
|
||||
|
||||
:::note
|
||||
|
||||
Projects are de-emphasized on the UI because it is not required to create Kubernetes resources within a project scope. However, resources such as [Secrets](../../new-user-guides/kubernetes-resources-setup/secrets.md#creating-secrets-in-projects) can still be created in a project scope if the legacy feature flag is enabled.
|
||||
Projects are de-emphasized on the UI because it is not required to create Kubernetes resources within a project scope. However, resources such as [Secrets](../../new-user-guides/kubernetes-resources-setup/secrets.md#creating-secrets-in-projects) can still be created in a project scope.
|
||||
|
||||
:::
|
||||
|
||||
@@ -196,3 +196,7 @@ To add a resource quota,
|
||||
1. Select **Delete**.
|
||||
|
||||
When you delete a project, any namespaces that were formerly associated with the project will remain on the cluster. You can find these namespaces in the Rancher UI, in the **Not in a Project** tab of the **Projects/Namespaces** page. You can reassign these namespaces to a project by [moving](../manage-namespaces.md#moving-namespaces-to-another-project) them.
|
||||
|
||||
## Further Reading
|
||||
|
||||
You can create projects and project members more programmatically via the [Public API](../../../api/quickstart.md). See the [project workflow doc](../../../api/workflows/projects.md) for more information.
|
||||
|
||||
+1
@@ -19,6 +19,7 @@ In order to deploy and run the adapter successfully, you need to ensure its vers
|
||||
|
||||
| Rancher Version | Adapter Version |
|
||||
|-----------------|------------------|
|
||||
| v2.13.1 | 108.0.0+up8.0.0 |
|
||||
| v2.13.0 | 108.0.0+up8.0.0 |
|
||||
|
||||
### 1. Gain Access to the Local Cluster
|
||||
|
||||
@@ -20,6 +20,7 @@ Each Rancher version is designed to be compatible with a single version of the w
|
||||
|
||||
| Rancher Version | Webhook Version | Availability in Prime | Availability in Community |
|
||||
|-----------------|-----------------|-----------------------|---------------------------|
|
||||
| v2.13.1 | v0.9.1 | ✓ | ✓ |
|
||||
| v2.13.0 | v0.9.0 | ✗ | ✓ |
|
||||
|
||||
## Why Do We Need It?
|
||||
|
||||
+5
-12
@@ -11,10 +11,8 @@ Kubernetes 每隔五分钟会自动清理 etcd 数据集。在某些情况下（
|
||||
```yaml
|
||||
# RKE2/K3s config.yaml
|
||||
---
|
||||
services:
|
||||
etcd:
|
||||
extra_args:
|
||||
quota-backend-bytes: 5368709120
|
||||
etcd-arg:
|
||||
- "quota-backend-bytes=5368709120"
|
||||
```
|
||||
|
||||
## 扩展 etcd 磁盘性能
|
||||
@@ -28,12 +26,7 @@ services:
|
||||
```yaml
|
||||
# RKE2/K3s config.yaml
|
||||
---
|
||||
services:
|
||||
etcd:
|
||||
extra_args:
|
||||
data-dir: '/var/lib/rancher/etcd/data/'
|
||||
wal-dir: '/var/lib/rancher/etcd/wal/wal_dir'
|
||||
extra_binds:
|
||||
- '/var/lib/etcd/data:/var/lib/rancher/etcd/data'
|
||||
- '/var/lib/etcd/wal:/var/lib/rancher/etcd/wal'
|
||||
etcd-arg:
|
||||
- "data-dir=/var/lib/etcd/data"
|
||||
- "wal-dir=/var/lib/etcd/wal"
|
||||
```
|
||||
|
||||
@@ -16,6 +16,7 @@ Rancher 将在 GitHub 上发布的 Rancher 的[发版说明](https://github.com/
|
||||
|
||||
| Patch 版本 | 发布时间 |
|
||||
| --------------------------------------------------------------- | ------------------ |
|
||||
| [2.11.9](https://github.com/rancher/rancher/releases/tag/v2.11.9) | 2025 年 12 月 18 日 |
|
||||
| [2.11.8](https://github.com/rancher/rancher/releases/tag/v2.11.8) | 2025 年 11 月 24 日 |
|
||||
| [2.11.7](https://github.com/rancher/rancher/releases/tag/v2.11.7) | 2025 年 10 月 23 日 |
|
||||
| [2.11.6](https://github.com/rancher/rancher/releases/tag/v2.11.6) | 2025 年 9 月 25 日 |
|
||||
|
||||
+1
@@ -15,6 +15,7 @@ title: 安装 Adapter
|
||||
|
||||
| Rancher 版本 | Adapter 版本 |
|
||||
|-----------------|:----------------:|
|
||||
| v2.11.9 | v106.0.0+up6.0.0 |
|
||||
| v2.11.8 | v106.0.0+up6.0.0 |
|
||||
| v2.11.7 | v106.0.0+up6.0.0 |
|
||||
| v2.11.6 | v106.0.0+up6.0.0 |
|
||||
|
||||
+1
@@ -20,6 +20,7 @@ Rancher 将 Rancher-Webhook 作为单独的 deployment 和服务部署在 local
|
||||
|
||||
| Rancher Version | Webhook Version | Availability in Prime | Availability in Community |
|
||||
|-----------------|-----------------|-----------------------|---------------------------|
|
||||
| v2.11.9 | v0.7.8 | ✓ | ✗ |
|
||||
| v2.11.8 | v0.7.8 | ✓ | ✗ |
|
||||
| v2.11.7 | v0.7.7 | ✓ | ✗ |
|
||||
| v2.11.6 | v0.7.6 | ✓ | ✗ |
|
||||
|
||||
@@ -16,7 +16,8 @@ Rancher 将在 GitHub 上发布的 Rancher 的[发版说明](https://github.com/
|
||||
|
||||
| Patch 版本 | 发布时间 |
|
||||
| ----------------------------------------------------------------- | ------------------ |
|
||||
| [2.12.4](https://github.com/rancher/rancher/releases/tag/v2.12.3) | 2025 年 11 月 24 日 |
|
||||
| [2.12.5](https://github.com/rancher/rancher/releases/tag/v2.12.5) | 2025 年 12 月 18 日 |
|
||||
| [2.12.4](https://github.com/rancher/rancher/releases/tag/v2.12.4) | 2025 年 11 月 24 日 |
|
||||
| [2.12.3](https://github.com/rancher/rancher/releases/tag/v2.12.3) | 2025 年 10 月 23 日 |
|
||||
| [2.12.2](https://github.com/rancher/rancher/releases/tag/v2.12.2) | 2025 年 9 月 25 日 |
|
||||
| [2.12.1](https://github.com/rancher/rancher/releases/tag/v2.12.1) | 2025 年 8 月 28 日 |
|
||||
|
||||
+5
-12
@@ -11,10 +11,8 @@ Kubernetes 每隔五分钟会自动清理 etcd 数据集。在某些情况下（
|
||||
```yaml
|
||||
# RKE2/K3s config.yaml
|
||||
---
|
||||
services:
|
||||
etcd:
|
||||
extra_args:
|
||||
quota-backend-bytes: 5368709120
|
||||
etcd-arg:
|
||||
- "quota-backend-bytes=5368709120"
|
||||
```
|
||||
|
||||
## 扩展 etcd 磁盘性能
|
||||
@@ -28,12 +26,7 @@ services:
|
||||
```yaml
|
||||
# RKE2/K3s config.yaml
|
||||
---
|
||||
services:
|
||||
etcd:
|
||||
extra_args:
|
||||
data-dir: '/var/lib/rancher/etcd/data/'
|
||||
wal-dir: '/var/lib/rancher/etcd/wal/wal_dir'
|
||||
extra_binds:
|
||||
- '/var/lib/etcd/data:/var/lib/rancher/etcd/data'
|
||||
- '/var/lib/etcd/wal:/var/lib/rancher/etcd/wal'
|
||||
etcd-arg:
|
||||
- "data-dir=/var/lib/etcd/data"
|
||||
- "wal-dir=/var/lib/etcd/wal"
|
||||
```
|
||||
|
||||
+1
@@ -15,6 +15,7 @@ title: 安装 Adapter
|
||||
|
||||
| Rancher 版本 | Adapter 版本 |
|
||||
|-----------------|:----------------:|
|
||||
| v2.12.5 | 107.0.0+up7.0.0 |
|
||||
| v2.12.4 | 107.0.0+up7.0.0 |
|
||||
| v2.12.3 | 107.0.0+up7.0.0 |
|
||||
| v2.12.2 | 107.0.0+up7.0.0 |
|
||||
|
||||
+2
-1
@@ -20,7 +20,8 @@ Rancher 将 Rancher-Webhook 作为单独的 deployment 和服务部署在 local
|
||||
|
||||
| Rancher Version | Webhook Version | Availability in Prime | Availability in Community |
|
||||
|-----------------|-----------------|-----------------------|---------------------------|
|
||||
| v2.12.4 | v0.8.4 | ✓ | ✗ |
|
||||
| v2.12.5 | v0.8.4 | ✓ | ✗ |
|
||||
| v2.12.4 | v0.8.4 | ✓ | ✗ |
|
||||
| v2.12.3 | v0.8.3 | ✓ | ✓ |
|
||||
| v2.12.2 | v0.8.2 | ✓ | ✓ |
|
||||
| v2.12.1 | v0.8.1 | ✓ | ✓ |
|
||||
|
||||
@@ -16,7 +16,8 @@ Rancher 将在 GitHub 上发布的 Rancher 的[发版说明](https://github.com/
|
||||
|
||||
| Patch 版本 | 发布时间 |
|
||||
| ----------------------------------------------------------------- | ------------------ |
|
||||
| [2.13.0](https://github.com/rancher/rancher/releases/tag/v2.13.0) | 2025 年 11 月 25 日 |
|
||||
| [2.13.1](https://github.com/rancher/rancher/releases/tag/v2.13.1) | 2025 年 12 月 18 日 |
|
||||
| [2.13.0](https://github.com/rancher/rancher/releases/tag/v2.13.0) | 2025 年 11 月 25 日 |
|
||||
|
||||
## 当一个功能被标记为弃用我可以得到什么样的预期？
|
||||
|
||||
|
||||
+5
-12
@@ -11,10 +11,8 @@ Kubernetes 每隔五分钟会自动清理 etcd 数据集。在某些情况下（
|
||||
```yaml
|
||||
# RKE2/K3s config.yaml
|
||||
---
|
||||
services:
|
||||
etcd:
|
||||
extra_args:
|
||||
quota-backend-bytes: 5368709120
|
||||
etcd-arg:
|
||||
- "quota-backend-bytes=5368709120"
|
||||
```
|
||||
|
||||
## 扩展 etcd 磁盘性能
|
||||
@@ -28,12 +26,7 @@ services:
|
||||
```yaml
|
||||
# RKE2/K3s config.yaml
|
||||
---
|
||||
services:
|
||||
etcd:
|
||||
extra_args:
|
||||
data-dir: '/var/lib/rancher/etcd/data/'
|
||||
wal-dir: '/var/lib/rancher/etcd/wal/wal_dir'
|
||||
extra_binds:
|
||||
- '/var/lib/etcd/data:/var/lib/rancher/etcd/data'
|
||||
- '/var/lib/etcd/wal:/var/lib/rancher/etcd/wal'
|
||||
etcd-args:
|
||||
- "data-dir=/var/lib/etcd/data"
|
||||
- "wal-dir=/var/lib/etcd/wal"
|
||||
```
|
||||
|
||||
+1
@@ -15,6 +15,7 @@ title: 安装 Adapter
|
||||
|
||||
| Rancher 版本 | Adapter 版本 |
|
||||
|-----------------|------------------|
|
||||
| v2.13.1 | 108.0.0+up8.0.0 |
|
||||
| v2.13.0 | 108.0.0+up8.0.0 |
|
||||
|
||||
## 1. 获取对 Local 集群的访问权限
|
||||
|
||||
+1
@@ -20,6 +20,7 @@ Rancher 将 Rancher-Webhook 作为单独的 deployment 和服务部署在 local
|
||||
|
||||
| Rancher Version | Webhook Version | Availability in Prime | Availability in Community |
|
||||
|-----------------|-----------------|-----------------------|---------------------------|
|
||||
| v2.13.1 | v0.9.1 | ✓ | ✓ |
|
||||
| v2.13.0 | v0.9.0 | ✗ | ✓ |
|
||||
|
||||
## 为什么我们需要它？
|
||||
|
||||
@@ -1,10 +1,10 @@
|
||||
<!-- releaseTask -->
|
||||
The following table summarizes different GitHub metrics to give you an idea of each project's popularity and activity levels. This data was collected in September 2025.
|
||||
The following table summarizes different GitHub metrics to give you an idea of each project's popularity and activity levels. This data was collected in December 2025.
|
||||
|
||||
| Provider | Project | Stars | Forks | Contributors |
|
||||
| ---- | ---- | ---- | ---- | ---- |
|
||||
| Canal | https://github.com/projectcalico/canal | 721 | 98 | 20 |
|
||||
| Canal | https://github.com/projectcalico/canal | 721 | 97 | 18 |
|
||||
| Flannel | https://github.com/flannel-io/flannel | 9.3k | 2.9k | 244 |
|
||||
| Calico | https://github.com/projectcalico/calico | 6.9k | 1.5k | 392 |
|
||||
| Weave | https://github.com/weaveworks/weave | 6.6k | 680 | 84 |
|
||||
| Cilium | https://github.com/cilium/cilium | 22.9k | 3.4k | 1,012 |
|
||||
| Calico | https://github.com/projectcalico/calico | 6.9k | 1.5k | 396 |
|
||||
| Weave | https://github.com/weaveworks/weave | 6.6k | 680 | 83 |
|
||||
| Cilium | https://github.com/cilium/cilium | 23k | 3.5k | 1k |
|
||||
|
||||
+44
-7
@@ -17,12 +17,12 @@ Here you can find links to supporting documentation for the current released ver
|
||||
<th>Community</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>v2.13.0</b></td>
|
||||
<td><b>v2.13.1</b></td>
|
||||
<td><a href="https://ranchermanager.docs.rancher.com/v2.13">Documentation</a></td>
|
||||
<td><a href="https://github.com/rancher/rancher/releases/tag/v2.13.0">Release Notes</a></td>
|
||||
<td><center>N/A</center></td>
|
||||
<td><a href="https://github.com/rancher/rancher/releases/tag/v2.13.1">Release Notes</a></td>
|
||||
<td><center>N/A</center></td>
|
||||
<td><center>✓</center></td>
|
||||
<td><center>✓</center></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -38,9 +38,9 @@ Here you can find links to supporting documentation for the current released ver
|
||||
<th>Community</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>v2.12.4</b></td>
|
||||
<td><b>v2.12.5</b></td>
|
||||
<td><a href="https://ranchermanager.docs.rancher.com/v2.12">Documentation</a></td>
|
||||
<td><a href="https://github.com/rancher/rancher/releases/tag/v2.12.4">Release Notes</a></td>
|
||||
<td><a href="https://github.com/rancher/rancher/releases/tag/v2.12.5">Release Notes</a></td>
|
||||
<td><center>N/A</center></td>
|
||||
<td><center>✓</center></td>
|
||||
<td><center>N/A</center></td>
|
||||
@@ -59,9 +59,9 @@ Here you can find links to supporting documentation for the current released ver
|
||||
<th>Community</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>v2.11.8</b></td>
|
||||
<td><b>v2.11.9</b></td>
|
||||
<td><a href="https://ranchermanager.docs.rancher.com/v2.11">Documentation</a></td>
|
||||
<td><a href="https://github.com/rancher/rancher/releases/tag/v2.11.8">Release Notes</a></td>
|
||||
<td><a href="https://github.com/rancher/rancher/releases/tag/v2.11.9">Release Notes</a></td>
|
||||
<td><center>N/A</center></td>
|
||||
<td><center>✓</center></td>
|
||||
<td><center>NA</center></td>
|
||||
@@ -112,6 +112,27 @@ Here you can find links to supporting documentation for the current released ver
|
||||
|
||||
### Past Versions
|
||||
|
||||
Here you can find links to supporting documentation for previous versions of Rancher v2.13, and their availability for [Rancher Prime](/v2.13/getting-started/quick-start-guides/deploy-rancher-manager/prime) and the Community version of Rancher:
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<th>Version</th>
|
||||
<th>Documentation</th>
|
||||
<th>Release Notes</th>
|
||||
<th>Support Matrix</th>
|
||||
<th>Prime</th>
|
||||
<th>Community</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>v2.13.0</b></td>
|
||||
<td><a href="https://ranchermanager.docs.rancher.com/v2.13">Documentation</a></td>
|
||||
<td><a href="https://github.com/rancher/rancher/releases/tag/v2.13.0">Release Notes</a></td>
|
||||
<td><center>N/A</center></td>
|
||||
<td><center>N/A</center></td>
|
||||
<td><center>✓</center></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
Here you can find links to supporting documentation for previous versions of Rancher v2.12, and their availability for [Rancher Prime](/v2.12/getting-started/quick-start-guides/deploy-rancher-manager/prime) and the Community version of Rancher:
|
||||
|
||||
<table>
|
||||
@@ -123,6 +144,14 @@ Here you can find links to supporting documentation for previous versions of Ran
|
||||
<th>Prime</th>
|
||||
<th>Community</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>v2.12.4</b></td>
|
||||
<td><a href="https://ranchermanager.docs.rancher.com/v2.12">Documentation</a></td>
|
||||
<td><a href="https://github.com/rancher/rancher/releases/tag/v2.12.4">Release Notes</a></td>
|
||||
<td><center><a href="https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/rancher-v2-12-4/">Support Matrix</a></center></td>
|
||||
<td><center>✓</center></td>
|
||||
<td><center>N/A</center></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>v2.12.3</b></td>
|
||||
<td><a href="https://ranchermanager.docs.rancher.com/v2.12">Documentation</a></td>
|
||||
@@ -168,6 +197,14 @@ Here you can find links to supporting documentation for previous versions of Ran
|
||||
<th>Prime</th>
|
||||
<th>Community</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>v2.11.8</b></td>
|
||||
<td><a href="https://ranchermanager.docs.rancher.com/v2.11">Documentation</a></td>
|
||||
<td><a href="https://github.com/rancher/rancher/releases/tag/v2.11.8">Release Notes</a></td>
|
||||
<td><center><a href="https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/rancher-v2-11-8/">Support Matrix</a></center></td>
|
||||
<td><center>✓</center></td>
|
||||
<td><center>NA</center></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>v2.11.7</b></td>
|
||||
<td><a href="https://ranchermanager.docs.rancher.com/v2.11">Documentation</a></td>
|
||||
|
||||
@@ -25,11 +25,15 @@ spec:
|
||||
EOF
|
||||
```
|
||||
|
||||
Use `metadata.generateName` to ensure a unique project ID, but note that `kubectl apply` does not work with `metadata.generateName`, so `kubectl create` must be used instead.
|
||||
When creating a new project, you have two primary options for setting the name:
|
||||
|
||||
- **Automatic Generation:** Use `metadata.generateName` to ensure a unique project ID. However, note that you must use `kubectl create` (instead of `kubectl apply`) with this option, as `kubectl apply` does not support it.
|
||||
- **Manual Naming:** You can explicitly set the project ID using `metadata.name`. If a project with that exact name already exists, the name request is denied.
|
||||
The display name seen in the UI is set by `spec.displayName`. If `spec.displayName` is not provided, the field `metadata.name` is used instead.
|
||||
|
||||
Set `metadata.namespace` and `spec.clusterName` to the ID for the cluster the project belongs to.
|
||||
|
||||
If you create a project through a cluster member account, you must include the annotation, `field.cattle.io/creatorId`, and set it to the cluster member account's user ID.
|
||||
If you create a project through a cluster member account and want that account to be able to access the project, you must include the annotation `field.cattle.io/creatorId`, and set it to the cluster member account's user ID.
|
||||
|
||||
```bash
|
||||
kubectl create -f - <<EOF
|
||||
@@ -46,7 +50,7 @@ spec:
|
||||
EOF
|
||||
```
|
||||
|
||||
Setting the `field.cattle.io/creatorId` field allows the cluster member account to see project resources with the `get` command and view the project in the Rancher UI. Cluster owner and admin accounts don't need to set this annotation to perform these tasks.
|
||||
Setting the `field.cattle.io/creatorId` field creates a `ProjectRoleTemplateBinding` that grants the specified user the ability to see project resources with the `get` command and view the project in the Rancher UI. Cluster owner and admin accounts don't need to set this annotation to perform these tasks.
|
||||
|
||||
Setting the `field.cattle.io/creator-principal-name` annotation to the user's principal preserves it in a projectroletemplatebinding automatically created for the project owner.
|
||||
|
||||
@@ -97,9 +101,13 @@ spec:
|
||||
EOF
|
||||
```
|
||||
|
||||
### Backing Namespace
|
||||
|
||||
After creating the project, the field `status.backingNamespace` gets populated. This represents the namespace in the management cluster that is created to manage project related resources. Examples of resources stored in the backing namespace are [project scoped secrets](../../how-to-guides/new-user-guides/kubernetes-resources-setup/secrets.md#creating-secrets-in-projects) and [project role template bindings](../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md#project-roles).
|
||||
|
||||
## Adding a Member to a Project
|
||||
|
||||
Look up the project ID to specify the `metadata.namespace` field and `projectName` field values.
|
||||
Look up the project's [backing namespace](#backing-namespace) to specify the `metadata.namespace` field value and look up the project's ID to specify the `projectName` field value.
|
||||
|
||||
```bash
|
||||
kubectl --namespace c-m-abcde get projects
|
||||
@@ -119,7 +127,7 @@ apiVersion: management.cattle.io/v3
|
||||
kind: ProjectRoleTemplateBinding
|
||||
metadata:
|
||||
generateName: prtb-
|
||||
namespace: p-vwxyz
|
||||
namespace: c-m-abcde-p-vwxyz
|
||||
projectName: c-m-abcde:p-vwxyz
|
||||
roleTemplateName: project-member
|
||||
userPrincipalName: keycloak_user://user
|
||||
@@ -145,16 +153,16 @@ Create a projectroletemplatebinding for each role you want to assign to the proj
|
||||
|
||||
## Listing Project Members
|
||||
|
||||
Look up the project ID:
|
||||
Look up the project backing namespace:
|
||||
|
||||
```bash
|
||||
kubectl --namespace c-m-abcde get projects
|
||||
```
|
||||
|
||||
to list projectroletemplatebindings in the project's namespace:
|
||||
To list projectroletemplatebindings in the project's backing namespace:
|
||||
|
||||
```bash
|
||||
kubectl --namespace p-vwxyz get projectroletemplatebindings
|
||||
kubectl --namespace c-m-abcde-p-vwxyz get projectroletemplatebindings
|
||||
```
|
||||
|
||||
## Deleting a Member From a Project
|
||||
@@ -164,14 +172,14 @@ Lookup the projectroletemplatebinding IDs containing the member in the project's
|
||||
Delete the projectroletemplatebinding from the project's namespace:
|
||||
|
||||
```bash
|
||||
kubectl --namespace p-vwxyz delete projectroletemplatebindings prtb-qx874 prtb-7zw7s
|
||||
kubectl --namespace c-m-abcde-p-vwxyz delete projectroletemplatebindings prtb-qx874 prtb-7zw7s
|
||||
```
|
||||
|
||||
## Creating a Namespace in a Project
|
||||
|
||||
The Project resource resides in the management cluster, even if the Project is for a managed cluster. The namespaces under the project reside in the managed cluster.
|
||||
|
||||
On the management cluster, look up the project ID for the cluster you are administrating since it generated using `metadata.generateName`:
|
||||
On the management cluster, look up the project ID for the cluster you are administrating if generated using `metadata.generateName`:
|
||||
|
||||
```bash
|
||||
kubectl --namespace c-m-abcde get projects
|
||||
@@ -207,3 +215,5 @@ kubectl --namespace c-m-abcde delete project p-vwxyz
|
||||
```
|
||||
|
||||
Note that this command doesn't delete the namespaces and resources that formerly belonged to the project.
|
||||
|
||||
It does delete all project role template bindings for the projects, so recreating the project will not restore members added to the project, and you have to add users as members again.
|
||||
|
||||
+6
-2
@@ -13,7 +13,7 @@ A project is a group of namespaces, and it is a concept introduced by Rancher. P
|
||||
|
||||
:::note
|
||||
|
||||
Projects are de-emphasized on the UI because it is not required to create Kubernetes resources within a project scope. However, resources such as [Secrets](../../new-user-guides/kubernetes-resources-setup/secrets.md#creating-secrets-in-projects) can still be created in a project scope if the legacy feature flag is enabled.
|
||||
Projects are de-emphasized on the UI because it is not required to create Kubernetes resources within a project scope. However, resources such as [Secrets](../../new-user-guides/kubernetes-resources-setup/secrets.md#creating-secrets-in-projects) can still be created in a project scope.
|
||||
|
||||
:::
|
||||
|
||||
@@ -107,7 +107,7 @@ The `system` project:
|
||||
|
||||
:::note
|
||||
|
||||
In RKE clusters where the project network isolation option is enabled, the `system` project overrides the project network isolation option so that it can communicate with other projects, collect logs, and check health.
|
||||
In RKE2/K3s clusters where the project network isolation option is enabled, the `system` project overrides the project network isolation option so that it can communicate with other projects, collect logs, and check health.
|
||||
|
||||
:::
|
||||
|
||||
@@ -196,3 +196,7 @@ To add a resource quota,
|
||||
1. Select **Delete**.
|
||||
|
||||
When you delete a project, any namespaces that were formerly associated with the project will remain on the cluster. You can find these namespaces in the Rancher UI, in the **Not in a Project** tab of the **Projects/Namespaces** page. You can reassign these namespaces to a project by [moving](../manage-namespaces.md#moving-namespaces-to-another-project) them.
|
||||
|
||||
## Further Reading
|
||||
|
||||
You can create projects and project members more programmatically via the [Public API](../../../api/quickstart.md). See the [project workflow doc](../../../api/workflows/projects.md) for more information.
|
||||
|
||||
@@ -25,11 +25,15 @@ spec:
|
||||
EOF
|
||||
```
|
||||
|
||||
Use `metadata.generateName` to ensure a unique project ID, but note that `kubectl apply` does not work with `metadata.generateName`, so `kubectl create` must be used instead.
|
||||
When creating a new project, you have two primary options for setting the name:
|
||||
|
||||
- **Automatic Generation:** Use `metadata.generateName` to ensure a unique project ID. However, note that you must use `kubectl create` (instead of `kubectl apply`) with this option, as `kubectl apply` does not support it.
|
||||
- **Manual Naming:** You can explicitly set the project ID using `metadata.name`. If a project with that exact name already exists, the name request is denied.
|
||||
The display name seen in the UI is set by `spec.displayName`. If `spec.displayName` is not provided, the field `metadata.name` is used instead.
|
||||
|
||||
Set `metadata.namespace` and `spec.clusterName` to the ID for the cluster the project belongs to.
|
||||
|
||||
If you create a project through a cluster member account, you must include the annotation, `field.cattle.io/creatorId`, and set it to the cluster member account's user ID.
|
||||
If you create a project through a cluster member account and want that account to be able to access the project, you must include the annotation `field.cattle.io/creatorId`, and set it to the cluster member account's user ID.
|
||||
|
||||
```bash
|
||||
kubectl create -f - <<EOF
|
||||
@@ -46,7 +50,7 @@ spec:
|
||||
EOF
|
||||
```
|
||||
|
||||
Setting the `field.cattle.io/creatorId` field allows the cluster member account to see project resources with the `get` command and view the project in the Rancher UI. Cluster owner and admin accounts don't need to set this annotation to perform these tasks.
|
||||
Setting the `field.cattle.io/creatorId` field creates a `ProjectRoleTemplateBinding` that grants the specified user the ability to see project resources with the `get` command and view the project in the Rancher UI. Cluster owner and admin accounts don't need to set this annotation to perform these tasks.
|
||||
|
||||
Setting the `field.cattle.io/creator-principal-name` annotation to the user's principal preserves it in a projectroletemplatebinding automatically created for the project owner.
|
||||
|
||||
@@ -97,9 +101,13 @@ spec:
|
||||
EOF
|
||||
```
|
||||
|
||||
### Backing Namespace
|
||||
|
||||
After creating the project, the field `status.backingNamespace` gets populated. This represents the namespace in the management cluster that is created to manage project related resources. Examples of resources stored in the backing namespace are [project scoped secrets](../../how-to-guides/new-user-guides/kubernetes-resources-setup/secrets.md#creating-secrets-in-projects) and [project role template bindings](../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md#project-roles).
|
||||
|
||||
## Adding a Member to a Project
|
||||
|
||||
Look up the project ID to specify the `metadata.namespace` field and `projectName` field values.
|
||||
Look up the project's [backing namespace](#backing-namespace) to specify the `metadata.namespace` field value and look up the project's ID to specify the `projectName` field value.
|
||||
|
||||
```bash
|
||||
kubectl --namespace c-m-abcde get projects
|
||||
@@ -119,7 +127,7 @@ apiVersion: management.cattle.io/v3
|
||||
kind: ProjectRoleTemplateBinding
|
||||
metadata:
|
||||
generateName: prtb-
|
||||
namespace: p-vwxyz
|
||||
namespace: c-m-abcde-p-vwxyz
|
||||
projectName: c-m-abcde:p-vwxyz
|
||||
roleTemplateName: project-member
|
||||
userPrincipalName: keycloak_user://user
|
||||
@@ -145,16 +153,16 @@ Create a projectroletemplatebinding for each role you want to assign to the proj
|
||||
|
||||
## Listing Project Members
|
||||
|
||||
Look up the project ID:
|
||||
Look up the project backing namespace:
|
||||
|
||||
```bash
|
||||
kubectl --namespace c-m-abcde get projects
|
||||
```
|
||||
|
||||
to list projectroletemplatebindings in the project's namespace:
|
||||
To list projectroletemplatebindings in the project's backing namespace:
|
||||
|
||||
```bash
|
||||
kubectl --namespace p-vwxyz get projectroletemplatebindings
|
||||
kubectl --namespace c-m-abcde-p-vwxyz get projectroletemplatebindings
|
||||
```
|
||||
|
||||
## Deleting a Member From a Project
|
||||
@@ -164,14 +172,14 @@ Lookup the projectroletemplatebinding IDs containing the member in the project's
|
||||
Delete the projectroletemplatebinding from the project's namespace:
|
||||
|
||||
```bash
|
||||
kubectl --namespace p-vwxyz delete projectroletemplatebindings prtb-qx874 prtb-7zw7s
|
||||
kubectl --namespace c-m-abcde-p-vwxyz delete projectroletemplatebindings prtb-qx874 prtb-7zw7s
|
||||
```
|
||||
|
||||
## Creating a Namespace in a Project
|
||||
|
||||
The Project resource resides in the management cluster, even if the Project is for a managed cluster. The namespaces under the project reside in the managed cluster.
|
||||
|
||||
On the management cluster, look up the project ID for the cluster you are administrating since it generated using `metadata.generateName`:
|
||||
On the management cluster, look up the project ID for the cluster you are administrating if generated using `metadata.generateName`:
|
||||
|
||||
```bash
|
||||
kubectl --namespace c-m-abcde get projects
|
||||
@@ -207,3 +215,5 @@ kubectl --namespace c-m-abcde delete project p-vwxyz
|
||||
```
|
||||
|
||||
Note that this command doesn't delete the namespaces and resources that formerly belonged to the project.
|
||||
|
||||
It does delete all project role template bindings for the projects, so recreating the project will not restore members added to the project, and you have to add users as members again.
|
||||
|
||||
@@ -16,6 +16,7 @@ Rancher will publish deprecated features as part of the [release notes](https://
|
||||
|
||||
| Patch Version | Release Date |
|
||||
|---------------|---------------|
|
||||
| [2.11.9](https://github.com/rancher/rancher/releases/tag/v2.11.9) | December 18, 2025 |
|
||||
| [2.11.8](https://github.com/rancher/rancher/releases/tag/v2.11.8) | November 24, 2025 |
|
||||
| [2.11.7](https://github.com/rancher/rancher/releases/tag/v2.11.7) | October 23, 2025 |
|
||||
| [2.11.6](https://github.com/rancher/rancher/releases/tag/v2.11.6) | September 25, 2025 |
|
||||
|
||||
+6
-2
@@ -13,7 +13,7 @@ A project is a group of namespaces, and it is a concept introduced by Rancher. P
|
||||
|
||||
:::note
|
||||
|
||||
Projects are de-emphasized on the UI because it is not required to create Kubernetes resources within a project scope. However, resources such as [Secrets](../../new-user-guides/kubernetes-resources-setup/secrets.md#creating-secrets-in-projects) can still be created in a project scope if the legacy feature flag is enabled.
|
||||
Projects are de-emphasized on the UI because it is not required to create Kubernetes resources within a project scope. However, resources such as [Secrets](../../new-user-guides/kubernetes-resources-setup/secrets.md#creating-secrets-in-projects) can still be created in a project scope.
|
||||
|
||||
:::
|
||||
|
||||
@@ -107,7 +107,7 @@ The `system` project:
|
||||
|
||||
:::note
|
||||
|
||||
In RKE clusters where the project network isolation option is enabled, the `system` project overrides the project network isolation option so that it can communicate with other projects, collect logs, and check health.
|
||||
In RKE2/K3s clusters where the project network isolation option is enabled, the `system` project overrides the project network isolation option so that it can communicate with other projects, collect logs, and check health.
|
||||
|
||||
:::
|
||||
|
||||
@@ -196,3 +196,7 @@ To add a resource quota,
|
||||
1. Select **Delete**.
|
||||
|
||||
When you delete a project, any namespaces that were formerly associated with the project will remain on the cluster. You can find these namespaces in the Rancher UI, in the **Not in a Project** tab of the **Projects/Namespaces** page. You can reassign these namespaces to a project by [moving](../manage-namespaces.md#moving-namespaces-to-another-project) them.
|
||||
|
||||
## Further Reading
|
||||
|
||||
You can create projects and project members more programmatically via the [Public API](../../../api/quickstart.md). See the [project workflow doc](../../../api/workflows/projects.md) for more information.
|
||||
|
||||
+1
@@ -19,6 +19,7 @@ In order to deploy and run the adapter successfully, you need to ensure its vers
|
||||
|
||||
| Rancher Version | Adapter Version |
|
||||
|-----------------|------------------|
|
||||
| v2.11.9 | v106.0.0+up6.0.0 |
|
||||
| v2.11.8 | v106.0.0+up6.0.0 |
|
||||
| v2.11.7 | v106.0.0+up6.0.0 |
|
||||
| v2.11.6 | v106.0.0+up6.0.0 |
|
||||
|
||||
@@ -20,6 +20,7 @@ Each Rancher version is designed to be compatible with a single version of the w
|
||||
|
||||
| Rancher Version | Webhook Version | Availability in Prime | Availability in Community |
|
||||
|-----------------|-----------------|-----------------------|---------------------------|
|
||||
| v2.11.9 | v0.7.8 | ✓ | ✗ |
|
||||
| v2.11.8 | v0.7.8 | ✓ | ✗ |
|
||||
| v2.11.7 | v0.7.7 | ✓ | ✗ |
|
||||
| v2.11.6 | v0.7.6 | ✓ | ✗ |
|
||||
|
||||
@@ -25,11 +25,15 @@ spec:
|
||||
EOF
|
||||
```
|
||||
|
||||
Use `metadata.generateName` to ensure a unique project ID, but note that `kubectl apply` does not work with `metadata.generateName`, so `kubectl create` must be used instead.
|
||||
When creating a new project, you have two primary options for setting the name:
|
||||
|
||||
- **Automatic Generation:** Use `metadata.generateName` to ensure a unique project ID. However, note that you must use `kubectl create` (instead of `kubectl apply`) with this option, as `kubectl apply` does not support it.
|
||||
- **Manual Naming:** You can explicitly set the project ID using `metadata.name`. If a project with that exact name already exists, the name request is denied.
|
||||
The display name seen in the UI is set by `spec.displayName`. If `spec.displayName` is not provided, the field `metadata.name` is used instead.
|
||||
|
||||
Set `metadata.namespace` and `spec.clusterName` to the ID for the cluster the project belongs to.
|
||||
|
||||
If you create a project through a cluster member account, you must include the annotation, `field.cattle.io/creatorId`, and set it to the cluster member account's user ID.
|
||||
If you create a project through a cluster member account and want that account to be able to access the project, you must include the annotation `field.cattle.io/creatorId`, and set it to the cluster member account's user ID.
|
||||
|
||||
```bash
|
||||
kubectl create -f - <<EOF
|
||||
@@ -46,7 +50,7 @@ spec:
|
||||
EOF
|
||||
```
|
||||
|
||||
Setting the `field.cattle.io/creatorId` field allows the cluster member account to see project resources with the `get` command and view the project in the Rancher UI. Cluster owner and admin accounts don't need to set this annotation to perform these tasks.
|
||||
Setting the `field.cattle.io/creatorId` field creates a `ProjectRoleTemplateBinding` that grants the specified user the ability to see project resources with the `get` command and view the project in the Rancher UI. Cluster owner and admin accounts don't need to set this annotation to perform these tasks.
|
||||
|
||||
Setting the `field.cattle.io/creator-principal-name` annotation to the user's principal preserves it in a projectroletemplatebinding automatically created for the project owner.
|
||||
|
||||
@@ -97,9 +101,13 @@ spec:
|
||||
EOF
|
||||
```
|
||||
|
||||
### Backing Namespace
|
||||
|
||||
After creating the project, the field `status.backingNamespace` gets populated. This represents the namespace in the management cluster that is created to manage project related resources. Examples of resources stored in the backing namespace are [project scoped secrets](../../how-to-guides/new-user-guides/kubernetes-resources-setup/secrets.md#creating-secrets-in-projects) and [project role template bindings](../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md#project-roles).
|
||||
|
||||
## Adding a Member to a Project
|
||||
|
||||
Look up the project ID to specify the `metadata.namespace` field and `projectName` field values.
|
||||
Look up the project's [backing namespace](#backing-namespace) to specify the `metadata.namespace` field value and look up the project's ID to specify the `projectName` field value.
|
||||
|
||||
```bash
|
||||
kubectl --namespace c-m-abcde get projects
|
||||
@@ -119,7 +127,7 @@ apiVersion: management.cattle.io/v3
|
||||
kind: ProjectRoleTemplateBinding
|
||||
metadata:
|
||||
generateName: prtb-
|
||||
namespace: p-vwxyz
|
||||
namespace: c-m-abcde-p-vwxyz
|
||||
projectName: c-m-abcde:p-vwxyz
|
||||
roleTemplateName: project-member
|
||||
userPrincipalName: keycloak_user://user
|
||||
@@ -145,16 +153,16 @@ Create a projectroletemplatebinding for each role you want to assign to the proj
|
||||
|
||||
## Listing Project Members
|
||||
|
||||
Look up the project ID:
|
||||
Look up the project backing namespace:
|
||||
|
||||
```bash
|
||||
kubectl --namespace c-m-abcde get projects
|
||||
```
|
||||
|
||||
to list projectroletemplatebindings in the project's namespace:
|
||||
To list projectroletemplatebindings in the project's backing namespace:
|
||||
|
||||
```bash
|
||||
kubectl --namespace p-vwxyz get projectroletemplatebindings
|
||||
kubectl --namespace c-m-abcde-p-vwxyz get projectroletemplatebindings
|
||||
```
|
||||
|
||||
## Deleting a Member From a Project
|
||||
@@ -164,14 +172,14 @@ Lookup the projectroletemplatebinding IDs containing the member in the project's
|
||||
Delete the projectroletemplatebinding from the project's namespace:
|
||||
|
||||
```bash
|
||||
kubectl --namespace p-vwxyz delete projectroletemplatebindings prtb-qx874 prtb-7zw7s
|
||||
kubectl --namespace c-m-abcde-p-vwxyz delete projectroletemplatebindings prtb-qx874 prtb-7zw7s
|
||||
```
|
||||
|
||||
## Creating a Namespace in a Project
|
||||
|
||||
The Project resource resides in the management cluster, even if the Project is for a managed cluster. The namespaces under the project reside in the managed cluster.
|
||||
|
||||
On the management cluster, look up the project ID for the cluster you are administrating since it generated using `metadata.generateName`:
|
||||
On the management cluster, look up the project ID for the cluster you are administrating if generated using `metadata.generateName`:
|
||||
|
||||
```bash
|
||||
kubectl --namespace c-m-abcde get projects
|
||||
@@ -207,3 +215,5 @@ kubectl --namespace c-m-abcde delete project p-vwxyz
|
||||
```
|
||||
|
||||
Note that this command doesn't delete the namespaces and resources that formerly belonged to the project.
|
||||
|
||||
It does delete all project role template bindings for the projects, so recreating the project will not restore members added to the project, and you have to add users as members again.
|
||||
|
||||
@@ -16,6 +16,7 @@ Rancher will publish deprecated features as part of the [release notes](https://
|
||||
|
||||
| Patch Version | Release Date |
|
||||
|---------------|---------------|
|
||||
| [2.12.5](https://github.com/rancher/rancher/releases/tag/v2.12.5) | December 18, 2025 |
|
||||
| [2.12.4](https://github.com/rancher/rancher/releases/tag/v2.12.4) | November 24, 2025 |
|
||||
| [2.12.3](https://github.com/rancher/rancher/releases/tag/v2.12.3) | October 23, 2025 |
|
||||
| [2.12.2](https://github.com/rancher/rancher/releases/tag/v2.12.2) | September 25, 2025 |
|
||||
|
||||
+5
-12
@@ -15,10 +15,8 @@ The etcd data set is automatically cleaned up on a five-minute interval by Kuber
|
||||
```yaml
|
||||
# RKE2/K3s config.yaml
|
||||
---
|
||||
services:
|
||||
etcd:
|
||||
extra_args:
|
||||
quota-backend-bytes: 5368709120
|
||||
etcd-arg:
|
||||
- "quota-backend-bytes=5368709120"
|
||||
```
|
||||
|
||||
## Scaling etcd Disk Performance
|
||||
@@ -32,12 +30,7 @@ To implement this solution in an RKE2/K3s cluster, the `/var/lib/etcd/data` and
|
||||
```yaml
|
||||
# RKE2/K3s config.yaml
|
||||
---
|
||||
services:
|
||||
etcd:
|
||||
extra_args:
|
||||
data-dir: '/var/lib/rancher/etcd/data/'
|
||||
wal-dir: '/var/lib/rancher/etcd/wal/wal_dir'
|
||||
extra_binds:
|
||||
- '/var/lib/etcd/data:/var/lib/rancher/etcd/data'
|
||||
- '/var/lib/etcd/wal:/var/lib/rancher/etcd/wal'
|
||||
etcd-arg:
|
||||
- "data-dir=/var/lib/etcd/data"
|
||||
- "wal-dir=/var/lib/etcd/wal"
|
||||
```
|
||||
|
||||
+5
-1
@@ -13,7 +13,7 @@ A project is a group of namespaces, and it is a concept introduced by Rancher. P
|
||||
|
||||
:::note
|
||||
|
||||
Projects are de-emphasized on the UI because it is not required to create Kubernetes resources within a project scope. However, resources such as [Secrets](../../new-user-guides/kubernetes-resources-setup/secrets.md#creating-secrets-in-projects) can still be created in a project scope if the legacy feature flag is enabled.
|
||||
Projects are de-emphasized on the UI because it is not required to create Kubernetes resources within a project scope. However, resources such as [Secrets](../../new-user-guides/kubernetes-resources-setup/secrets.md#creating-secrets-in-projects) can still be created in a project scope.
|
||||
|
||||
:::
|
||||
|
||||
@@ -196,3 +196,7 @@ To add a resource quota,
|
||||
1. Select **Delete**.
|
||||
|
||||
When you delete a project, any namespaces that were formerly associated with the project will remain on the cluster. You can find these namespaces in the Rancher UI, in the **Not in a Project** tab of the **Projects/Namespaces** page. You can reassign these namespaces to a project by [moving](../manage-namespaces.md#moving-namespaces-to-another-project) them.
|
||||
|
||||
## Further Reading
|
||||
|
||||
You can create projects and project members more programmatically via the [Public API](../../../api/quickstart.md). See the [project workflow doc](../../../api/workflows/projects.md) for more information.
|
||||
|
||||
+1
@@ -19,6 +19,7 @@ In order to deploy and run the adapter successfully, you need to ensure its vers
|
||||
|
||||
| Rancher Version | Adapter Version |
|
||||
|-----------------|------------------|
|
||||
| v2.12.5 | 107.0.0+up7.0.0 |
|
||||
| v2.12.4 | 107.0.0+up7.0.0 |
|
||||
| v2.12.3 | 107.0.0+up7.0.0 |
|
||||
| v2.12.2 | 107.0.0+up7.0.0 |
|
||||
|
||||
@@ -20,7 +20,8 @@ Each Rancher version is designed to be compatible with a single version of the w
|
||||
|
||||
| Rancher Version | Webhook Version | Availability in Prime | Availability in Community |
|
||||
|-----------------|-----------------|-----------------------|---------------------------|
|
||||
| v2.12.4 | v0.8.4 | ✓ | ✗ |
|
||||
| v2.12.5 | v0.8.4 | ✓ | ✗ |
|
||||
| v2.12.4 | v0.8.4 | ✓ | ✗ |
|
||||
| v2.12.3 | v0.8.3 | ✓ | ✓ |
|
||||
| v2.12.2 | v0.8.2 | ✓ | ✓ |
|
||||
| v2.12.1 | v0.8.1 | ✓ | ✓ |
|
||||
|
||||
@@ -25,11 +25,15 @@ spec:
|
||||
EOF
|
||||
```
|
||||
|
||||
Use `metadata.generateName` to ensure a unique project ID, but note that `kubectl apply` does not work with `metadata.generateName`, so `kubectl create` must be used instead.
|
||||
When creating a new project, you have two primary options for setting the name:
|
||||
|
||||
- **Automatic Generation:** Use `metadata.generateName` to ensure a unique project ID. However, note that you must use `kubectl create` (instead of `kubectl apply`) with this option, as `kubectl apply` does not support it.
|
||||
- **Manual Naming:** You can explicitly set the project ID using `metadata.name`. If a project with that exact name already exists, the name request is denied.
|
||||
The display name seen in the UI is set by `spec.displayName`. If `spec.displayName` is not provided, the field `metadata.name` is used instead.
|
||||
|
||||
Set `metadata.namespace` and `spec.clusterName` to the ID for the cluster the project belongs to.
|
||||
|
||||
If you create a project through a cluster member account, you must include the annotation, `field.cattle.io/creatorId`, and set it to the cluster member account's user ID.
|
||||
If you create a project through a cluster member account and want that account to be able to access the project, you must include the annotation `field.cattle.io/creatorId`, and set it to the cluster member account's user ID.
|
||||
|
||||
```bash
|
||||
kubectl create -f - <<EOF
|
||||
@@ -46,7 +50,7 @@ spec:
|
||||
EOF
|
||||
```
|
||||
|
||||
Setting the `field.cattle.io/creatorId` field allows the cluster member account to see project resources with the `get` command and view the project in the Rancher UI. Cluster owner and admin accounts don't need to set this annotation to perform these tasks.
|
||||
Setting the `field.cattle.io/creatorId` field creates a `ProjectRoleTemplateBinding` that grants the specified user the ability to see project resources with the `get` command and view the project in the Rancher UI. Cluster owner and admin accounts don't need to set this annotation to perform these tasks.
|
||||
|
||||
Setting the `field.cattle.io/creator-principal-name` annotation to the user's principal preserves it in a projectroletemplatebinding automatically created for the project owner.
|
||||
|
||||
@@ -97,9 +101,13 @@ spec:
|
||||
EOF
|
||||
```
|
||||
|
||||
### Backing Namespace
|
||||
|
||||
After creating the project, the field `status.backingNamespace` gets populated. This represents the namespace in the management cluster that is created to manage project related resources. Examples of resources stored in the backing namespace are [project scoped secrets](../../how-to-guides/new-user-guides/kubernetes-resources-setup/secrets.md#creating-secrets-in-projects) and [project role template bindings](../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md#project-roles).
|
||||
|
||||
## Adding a Member to a Project
|
||||
|
||||
Look up the project ID to specify the `metadata.namespace` field and `projectName` field values.
|
||||
Look up the project's [backing namespace](#backing-namespace) to specify the `metadata.namespace` field value and look up the project's ID to specify the `projectName` field value.
|
||||
|
||||
```bash
|
||||
kubectl --namespace c-m-abcde get projects
|
||||
@@ -119,7 +127,7 @@ apiVersion: management.cattle.io/v3
|
||||
kind: ProjectRoleTemplateBinding
|
||||
metadata:
|
||||
generateName: prtb-
|
||||
namespace: p-vwxyz
|
||||
namespace: c-m-abcde-p-vwxyz
|
||||
projectName: c-m-abcde:p-vwxyz
|
||||
roleTemplateName: project-member
|
||||
userPrincipalName: keycloak_user://user
|
||||
@@ -145,16 +153,16 @@ Create a projectroletemplatebinding for each role you want to assign to the proj
|
||||
|
||||
## Listing Project Members
|
||||
|
||||
Look up the project ID:
|
||||
Look up the project backing namespace:
|
||||
|
||||
```bash
|
||||
kubectl --namespace c-m-abcde get projects
|
||||
```
|
||||
|
||||
to list projectroletemplatebindings in the project's namespace:
|
||||
To list projectroletemplatebindings in the project's backing namespace:
|
||||
|
||||
```bash
|
||||
kubectl --namespace p-vwxyz get projectroletemplatebindings
|
||||
kubectl --namespace c-m-abcde-p-vwxyz get projectroletemplatebindings
|
||||
```
|
||||
|
||||
## Deleting a Member From a Project
|
||||
@@ -164,14 +172,14 @@ Lookup the projectroletemplatebinding IDs containing the member in the project's
|
||||
Delete the projectroletemplatebinding from the project's namespace:
|
||||
|
||||
```bash
|
||||
kubectl --namespace p-vwxyz delete projectroletemplatebindings prtb-qx874 prtb-7zw7s
|
||||
kubectl --namespace c-m-abcde-p-vwxyz delete projectroletemplatebindings prtb-qx874 prtb-7zw7s
|
||||
```
|
||||
|
||||
## Creating a Namespace in a Project
|
||||
|
||||
The Project resource resides in the management cluster, even if the Project is for a managed cluster. The namespaces under the project reside in the managed cluster.
|
||||
|
||||
On the management cluster, look up the project ID for the cluster you are administrating since it generated using `metadata.generateName`:
|
||||
On the management cluster, look up the project ID for the cluster you are administrating if generated using `metadata.generateName`:
|
||||
|
||||
```bash
|
||||
kubectl --namespace c-m-abcde get projects
|
||||
@@ -207,3 +215,5 @@ kubectl --namespace c-m-abcde delete project p-vwxyz
|
||||
```
|
||||
|
||||
Note that this command doesn't delete the namespaces and resources that formerly belonged to the project.
|
||||
|
||||
It does delete all project role template bindings for the projects, so recreating the project will not restore members added to the project, and you have to add users as members again.
|
||||
|
||||
+32
@@ -50,6 +50,38 @@ The following CLI tools are required for setting up the Kubernetes cluster. Plea
|
||||
|
||||
## Install the Rancher Helm Chart
|
||||
|
||||
:::important
|
||||
|
||||
**Important:** In Rancher Community v2.13.1 if your registry configuration is one of the following you may see Rancher generate the `cattle-cluster-agent` image with an incorrect `docker.io` path segment:
|
||||
|
||||
- Environments where a **cluster-scoped container registry** is configured for system images.
|
||||
- Environments where a **global `system-default-registry`** is configured (e.g. airgap setups), even if no cluster-scoped registry is set.
|
||||
|
||||
**Workaround for Affected Setups:** As a workaround, override the `cattle-cluster-agent` image via the `CATTLE_AGENT_IMAGE` environment variable. This value must **not** contain any registry prefix (Rancher will handle that automatically). It should be set only to the repository and tag, for example:`rancher/rancher-agent:v2.13.1`
|
||||
|
||||
**Helm `install` example:**
|
||||
|
||||
```bash
|
||||
helm install rancher rancher-latest/rancher \
|
||||
...
|
||||
--set extraEnv[0].name=CATTLE_AGENT_IMAGE \
|
||||
--set extraEnv[0].value=rancher/rancher-agent:v2.13.1
|
||||
```
|
||||
|
||||
**Helm `upgrade` example:**
|
||||
|
||||
```bash
|
||||
helm upgrade rancher rancher-latest/rancher \
|
||||
...
|
||||
--set extraEnv[0].name=CATTLE_AGENT_IMAGE \
|
||||
--set extraEnv[0].value=rancher/rancher-agent:v2.13.1
|
||||
```
|
||||
|
||||
**Important Upgrade Note:**
|
||||
|
||||
The `CATTLE_AGENT_IMAGE` override is intended only as a temporary workaround for the affected configurations. Once a Rancher version is available that corrects this behavior, the `CATTLE_AGENT_IMAGE` override should be **removed** from Helm values, so that Rancher can resume managing the agent image normally and automatically track future image and tag changes. See [#53187](https://github.com/rancher/rancher/issues/53187#issuecomment-3676484603) for further information.
|
||||
:::
|
||||
|
||||
Rancher is installed using the [Helm](https://helm.sh/) package manager for Kubernetes. Helm charts provide templating syntax for Kubernetes YAML manifest documents. With Helm, we can create configurable deployments instead of just using static files.
|
||||
|
||||
For systems without direct internet access, see [Air Gap: Kubernetes install](../other-installation-methods/air-gapped-helm-cli-install/install-rancher-ha.md).
|
||||
|
||||
+32
@@ -28,6 +28,38 @@ Note that upgrades _to_ or _from_ any chart in the [rancher-alpha repository](..
|
||||
|
||||
### Helm Version
|
||||
|
||||
:::important
|
||||
|
||||
**Important:** In Rancher Community v2.13.1 if your registry configuration is one of the following you may see Rancher generate the `cattle-cluster-agent` image with an incorrect `docker.io` path segment:
|
||||
|
||||
- Environments where a **cluster-scoped container registry** is configured for system images.
|
||||
- Environments where a **global `system-default-registry`** is configured (e.g. airgap setups), even if no cluster-scoped registry is set.
|
||||
|
||||
**Workaround for Affected Setups:** As a workaround, override the `cattle-cluster-agent` image via the `CATTLE_AGENT_IMAGE` environment variable. This value must **not** contain any registry prefix (Rancher will handle that automatically). It should be set only to the repository and tag, for example:`rancher/rancher-agent:v2.13.1`
|
||||
|
||||
**Helm `install` example:**
|
||||
|
||||
```bash
|
||||
helm install rancher rancher-latest/rancher \
|
||||
...
|
||||
--set extraEnv[0].name=CATTLE_AGENT_IMAGE \
|
||||
--set extraEnv[0].value=rancher/rancher-agent:v2.13.1
|
||||
```
|
||||
|
||||
**Helm `upgrade` example:**
|
||||
|
||||
```bash
|
||||
helm upgrade rancher rancher-latest/rancher \
|
||||
...
|
||||
--set extraEnv[0].name=CATTLE_AGENT_IMAGE \
|
||||
--set extraEnv[0].value=rancher/rancher-agent:v2.13.1
|
||||
```
|
||||
|
||||
**Important Upgrade Note:**
|
||||
|
||||
The `CATTLE_AGENT_IMAGE` override is intended only as a temporary workaround for the affected configurations. Once a Rancher version is available that corrects this behavior, the `CATTLE_AGENT_IMAGE` override should be **removed** from Helm values, so that Rancher can resume managing the agent image normally and automatically track future image and tag changes. See [#53187](https://github.com/rancher/rancher/issues/53187#issuecomment-3676484603) for further information.
|
||||
:::
|
||||
|
||||
The upgrade instructions assume you are using Helm 3.
|
||||
|
||||
<DeprecationHelm2 />
|
||||
|
||||
+5
-12
@@ -15,10 +15,8 @@ The etcd data set is automatically cleaned up on a five-minute interval by Kuber
|
||||
```yaml
|
||||
# RKE2/K3s config.yaml
|
||||
---
|
||||
services:
|
||||
etcd:
|
||||
extra_args:
|
||||
quota-backend-bytes: 5368709120
|
||||
etcd-arg:
|
||||
- "quota-backend-bytes=5368709120"
|
||||
```
|
||||
|
||||
## Scaling etcd Disk Performance
|
||||
@@ -32,12 +30,7 @@ To implement this solution in an RKE2/K3s cluster, the `/var/lib/etcd/data` and
|
||||
```yaml
|
||||
# RKE2/K3s config.yaml
|
||||
---
|
||||
services:
|
||||
etcd:
|
||||
extra_args:
|
||||
data-dir: '/var/lib/rancher/etcd/data/'
|
||||
wal-dir: '/var/lib/rancher/etcd/wal/wal_dir'
|
||||
extra_binds:
|
||||
- '/var/lib/etcd/data:/var/lib/rancher/etcd/data'
|
||||
- '/var/lib/etcd/wal:/var/lib/rancher/etcd/wal'
|
||||
etcd-arg:
|
||||
- "data-dir=/var/lib/etcd/data"
|
||||
- "wal-dir=/var/lib/etcd/wal"
|
||||
```
|
||||
|
||||
+5
-1
@@ -13,7 +13,7 @@ A project is a group of namespaces, and it is a concept introduced by Rancher. P
|
||||
|
||||
:::note
|
||||
|
||||
Projects are de-emphasized on the UI because it is not required to create Kubernetes resources within a project scope. However, resources such as [Secrets](../../new-user-guides/kubernetes-resources-setup/secrets.md#creating-secrets-in-projects) can still be created in a project scope if the legacy feature flag is enabled.
|
||||
Projects are de-emphasized on the UI because it is not required to create Kubernetes resources within a project scope. However, resources such as [Secrets](../../new-user-guides/kubernetes-resources-setup/secrets.md#creating-secrets-in-projects) can still be created in a project scope.
|
||||
|
||||
:::
|
||||
|
||||
@@ -196,3 +196,7 @@ To add a resource quota,
|
||||
1. Select **Delete**.
|
||||
|
||||
When you delete a project, any namespaces that were formerly associated with the project will remain on the cluster. You can find these namespaces in the Rancher UI, in the **Not in a Project** tab of the **Projects/Namespaces** page. You can reassign these namespaces to a project by [moving](../manage-namespaces.md#moving-namespaces-to-another-project) them.
|
||||
|
||||
## Further Reading
|
||||
|
||||
You can create projects and project members more programmatically via the [Public API](../../../api/quickstart.md). See the [project workflow doc](../../../api/workflows/projects.md) for more information.
|
||||
|
||||
@@ -25,11 +25,15 @@ spec:
|
||||
EOF
|
||||
```
|
||||
|
||||
Use `metadata.generateName` to ensure a unique project ID, but note that `kubectl apply` does not work with `metadata.generateName`, so `kubectl create` must be used instead.
|
||||
When creating a new project, you have two primary options for setting the name:
|
||||
|
||||
- **Automatic Generation:** Use `metadata.generateName` to ensure a unique project ID. However, note that you must use `kubectl create` (instead of `kubectl apply`) with this option, as `kubectl apply` does not support it.
|
||||
- **Manual Naming:** You can explicitly set the project ID using `metadata.name`. If a project with that exact name already exists, the name request is denied.
|
||||
The display name seen in the UI is set by `spec.displayName`. If `spec.displayName` is not provided, the field `metadata.name` is used instead.
|
||||
|
||||
Set `metadata.namespace` and `spec.clusterName` to the ID for the cluster the project belongs to.
|
||||
|
||||
If you create a project through a cluster member account, you must include the annotation, `field.cattle.io/creatorId`, and set it to the cluster member account's user ID.
|
||||
If you create a project through a cluster member account and want that account to be able to access the project, you must include the annotation `field.cattle.io/creatorId`, and set it to the cluster member account's user ID.
|
||||
|
||||
```bash
|
||||
kubectl create -f - <<EOF
|
||||
@@ -46,7 +50,11 @@ spec:
|
||||
EOF
|
||||
```
|
||||
|
||||
Setting the `field.cattle.io/creatorId` field allows the cluster member account to see project resources with the `get` command and view the project in the Rancher UI. Cluster owner and admin accounts don't need to set this annotation to perform these tasks.
|
||||
Setting the `field.cattle.io/creatorId` field creates a `ProjectRoleTemplateBinding` that grants the specified user the ability to see project resources with the `get` command and view the project in the Rancher UI. Cluster owner and admin accounts don't need to set this annotation to perform these tasks.
|
||||
|
||||
Setting the `field.cattle.io/creator-principal-name` annotation to the user's principal preserves it in a projectroletemplatebinding automatically created for the project owner.
|
||||
|
||||
If you don't want the creator to be added as the owner member (e.g. if the creator is a cluster administrator) to the project you may set the `field.cattle.io/no-creator-rbac` annotation to `true`, which will prevent the corresponding projectroletemplatebinding from being created.
|
||||
|
||||
### Creating a Project With a Resource Quota
|
||||
|
||||
@@ -93,9 +101,13 @@ spec:
|
||||
EOF
|
||||
```
|
||||
|
||||
### Backing Namespace
|
||||
|
||||
After creating the project, the field `status.backingNamespace` gets populated. This represents the namespace in the management cluster that is created to manage project related resources. Examples of resources stored in the backing namespace are [project scoped secrets](../../how-to-guides/new-user-guides/kubernetes-resources-setup/secrets.md#creating-secrets-in-projects) and [project role template bindings](../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md#project-roles).
|
||||
|
||||
## Adding a Member to a Project
|
||||
|
||||
Look up the project ID to specify the `metadata.namespace` field and `projectName` field values.
|
||||
Look up the project's [backing namespace](#backing-namespace) to specify the `metadata.namespace` field value and look up the project's ID to specify the `projectName` field value.
|
||||
|
||||
```bash
|
||||
kubectl --namespace c-m-abcde get projects
|
||||
@@ -115,7 +127,7 @@ apiVersion: management.cattle.io/v3
|
||||
kind: ProjectRoleTemplateBinding
|
||||
metadata:
|
||||
generateName: prtb-
|
||||
namespace: p-vwxyz
|
||||
namespace: c-m-abcde-p-vwxyz
|
||||
projectName: c-m-abcde:p-vwxyz
|
||||
roleTemplateName: project-member
|
||||
userPrincipalName: keycloak_user://user
|
||||
@@ -141,16 +153,16 @@ Create a projectroletemplatebinding for each role you want to assign to the proj
|
||||
|
||||
## Listing Project Members
|
||||
|
||||
Look up the project ID:
|
||||
Look up the project backing namespace:
|
||||
|
||||
```bash
|
||||
kubectl --namespace c-m-abcde get projects
|
||||
```
|
||||
|
||||
to list projectroletemplatebindings in the project's namespace:
|
||||
To list projectroletemplatebindings in the project's backing namespace:
|
||||
|
||||
```bash
|
||||
kubectl --namespace p-vwxyz get projectroletemplatebindings
|
||||
kubectl --namespace c-m-abcde-p-vwxyz get projectroletemplatebindings
|
||||
```
|
||||
|
||||
## Deleting a Member From a Project
|
||||
@@ -160,14 +172,14 @@ Lookup the projectroletemplatebinding IDs containing the member in the project's
|
||||
Delete the projectroletemplatebinding from the project's namespace:
|
||||
|
||||
```bash
|
||||
kubectl --namespace p-vwxyz delete projectroletemplatebindings prtb-qx874 prtb-7zw7s
|
||||
kubectl --namespace c-m-abcde-p-vwxyz delete projectroletemplatebindings prtb-qx874 prtb-7zw7s
|
||||
```
|
||||
|
||||
## Creating a Namespace in a Project
|
||||
|
||||
The Project resource resides in the management cluster, even if the Project is for a managed cluster. The namespaces under the project reside in the managed cluster.
|
||||
|
||||
On the management cluster, look up the project ID for the cluster you are administrating since it generated using `metadata.generateName`:
|
||||
On the management cluster, look up the project ID for the cluster you are administrating if generated using `metadata.generateName`:
|
||||
|
||||
```bash
|
||||
kubectl --namespace c-m-abcde get projects
|
||||
@@ -203,3 +215,5 @@ kubectl --namespace c-m-abcde delete project p-vwxyz
|
||||
```
|
||||
|
||||
Note that this command doesn't delete the namespaces and resources that formerly belonged to the project.
|
||||
|
||||
It does delete all project role template bindings for the projects, so recreating the project will not restore members added to the project, and you have to add users as members again.
|
||||
|
||||
+6
-2
@@ -13,7 +13,7 @@ A project is a group of namespaces, and it is a concept introduced by Rancher. P
|
||||
|
||||
:::note
|
||||
|
||||
Projects are de-emphasized on the UI because it is not required to create Kubernetes resources within a project scope. However, resources such as [Secrets](../../new-user-guides/kubernetes-resources-setup/secrets.md#creating-secrets-in-projects) can still be created in a project scope if the legacy feature flag is enabled.
|
||||
Projects are de-emphasized on the UI because it is not required to create Kubernetes resources within a project scope. However, resources such as [Secrets](../../new-user-guides/kubernetes-resources-setup/secrets.md#creating-secrets-in-projects) can still be created in a project scope.
|
||||
|
||||
:::
|
||||
|
||||
@@ -107,7 +107,7 @@ The `system` project:
|
||||
|
||||
:::note
|
||||
|
||||
In RKE clusters where the project network isolation option is enabled, the `system` project overrides the project network isolation option so that it can communicate with other projects, collect logs, and check health.
|
||||
In RKE2/K3s clusters where the project network isolation option is enabled, the `system` project overrides the project network isolation option so that it can communicate with other projects, collect logs, and check health.
|
||||
|
||||
:::
|
||||
|
||||
@@ -196,3 +196,7 @@ To add a resource quota,
|
||||
1. Select **Delete**.
|
||||
|
||||
When you delete a project, any namespaces that were formerly associated with the project will remain on the cluster. You can find these namespaces in the Rancher UI, in the **Not in a Project** tab of the **Projects/Namespaces** page. You can reassign these namespaces to a project by [moving](../manage-namespaces.md#moving-namespaces-to-another-project) them.
|
||||
|
||||
## Further Reading
|
||||
|
||||
You can create projects and project members more programmatically via the [Public API](../../../api/quickstart.md). See the [project workflow doc](../../../api/workflows/projects.md) for more information.
|
||||
|
||||
Reference in New Issue
Block a user