From a159812432cb1ba3f5c806969de6c33ca4572aa3 Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Thu, 17 Oct 2019 17:00:34 -0700 Subject: [PATCH 1/5] Say to check ingress-nginx upgrade policy --- .../rancher/v2.x/en/cluster-admin/editing-clusters/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md b/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md index 4eb7e29a741..cbc805c76ea 100644 --- a/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md +++ b/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md @@ -79,7 +79,7 @@ As of Rancher v2.3.0, the Kubernetes metadata feature was added, which allows Ra **Result:** Kubernetes begins upgrading for the cluster. During the upgrade, your cluster is unavailable. -> **Note:** The `ingress-nginx` pods are set to only upgrade on delete. After upgrading your cluster, you need to delete these pods to get the correct version for your deployment. +> **Note:** Check the upgrade policy of the `ingress-nginx` pods. If the upgrade policy is set to **onDelete,** you will need to delete these pods to get the correct version for your deployment. ### Adding a Pod Security Policy From 3d58fdeb080d5b8eba5da5a00b3f9b8a058d2430 Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Fri, 18 Oct 2019 16:24:00 -0700 Subject: [PATCH 2/5] Explain ingress-nginx update strategy --- .../v2.x/en/cluster-admin/cloning-clusters/_index.md | 2 ++ .../v2.x/en/cluster-admin/editing-clusters/_index.md | 6 +++++- .../hosted-kubernetes-clusters/cce/_index.md | 2 +- .../hosted-kubernetes-clusters/tke/_index.md | 2 +- content/rancher/v2.x/en/security/hardening-2.3/_index.md | 2 ++ 5 files changed, 11 insertions(+), 3 deletions(-) diff --git a/content/rancher/v2.x/en/cluster-admin/cloning-clusters/_index.md b/content/rancher/v2.x/en/cluster-admin/cloning-clusters/_index.md index b097e8b7b12..150503020a0 100644 --- a/content/rancher/v2.x/en/cluster-admin/cloning-clusters/_index.md +++ b/content/rancher/v2.x/en/cluster-admin/cloning-clusters/_index.md @@ -51,6 +51,8 @@ Begin by using Rancher CLI to export the configuration for the cluster that you ## 2. Modify Cluster Config +> As of Rancher v2.3.0, cluster configuration directives must be nested under the `rancher_kubernetes_engine_config` directive in `cluster.yml`. For more information, refer to the section on [the config file structure in Rancher v2.3.0+.]({{}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#config-file-structure-in-rancher-v2-3-0) + Use your favorite text editor to modify the cluster configuration in `cluster-template.yml` for your cloned cluster. > **Note:** As of Rancher v2.3.0, cluster configuration directives must be nested under the `rancher_kubernetes_engine_config` directive in `cluster.yml`. For more information, refer to the section on [the config file structure in Rancher v2.3.0+.]({{}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#config-file-structure-in-rancher-v2-3-0) diff --git a/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md b/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md index cbc805c76ea..633ce78db15 100644 --- a/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md +++ b/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md @@ -79,7 +79,11 @@ As of Rancher v2.3.0, the Kubernetes metadata feature was added, which allows Ra **Result:** Kubernetes begins upgrading for the cluster. During the upgrade, your cluster is unavailable. -> **Note:** Check the upgrade policy of the `ingress-nginx` pods. If the upgrade policy is set to **onDelete,** you will need to delete these pods to get the correct version for your deployment. +### Upgrading ingress-nginx + +For RKE v0.1.8+, the `ingress-nginx` YAML does not contain an upgrade policy, which makes the update strategy `RollingUpdate` by default. This policy allows the daemonset to restart the pods. + +For RKE prior to v0.1.8, the `updateStrategy` directive in the `ingress-nginx` YAML is set to `OnDelete.` In that case, you will need to delete these pods to get the correct version for your deployment. ### Adding a Pod Security Policy diff --git a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/cce/_index.md b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/cce/_index.md index 45c2dfa3e48..39bb5c1c44b 100644 --- a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/cce/_index.md +++ b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/cce/_index.md @@ -50,7 +50,7 @@ Huawei CCE service doesn't support the ability to create clusters with public ac | Cluster Label | The labels for the cluster. | | Highway Subnet | This option is only supported in `BareMetal` type. It requires you to select a VPC with high network speed for the bare metal machines. | -> **Note:** If you are editing the cluster in the `cluster.yml` instead of the Rancher UI, note that as of Rancher v2.3.0, cluster configuration directives must be nested under the `rancher_kubernetes_engine_config` directive in `cluster.yml`. For more information, refer to the section on [the config file structure in Rancher v2.3.0+.]({{}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#config-file-structure-in-rancher-v2-3-0) + **Note:** If you are editing the cluster in the `cluster.yml` instead of the Rancher UI, note that as of Rancher v2.3.0, cluster configuration directives must be nested under the `rancher_kubernetes_engine_config` directive in `cluster.yml`. For more information, refer to the section on [the config file structure in Rancher v2.3.0+.]({{}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#config-file-structure-in-rancher-v2-3-0) 7. Fill the following node configuration of the cluster: diff --git a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/tke/_index.md b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/tke/_index.md index 9899c63be38..c3f8087e741 100644 --- a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/tke/_index.md +++ b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/tke/_index.md @@ -48,7 +48,7 @@ You can use Rancher to create a cluster hosted in Tencent Kubernetes Engine (TKE | VPC | Select the VPC name that you have created in the Tencent Cloud Console. | | Container Network CIDR | Enter the CIDR range of your Kubernetes cluster, you may check the available range of the CIDR in the VPC service of the Tencent Cloud Console. Default to 172.16.0.0/16. | -> Note: If you are editing the cluster in the `cluster.yml` instead of the Rancher UI, note that as of Rancher v2.3.0, cluster configuration directives must be nested under the `rancher_kubernetes_engine_config` directive in `cluster.yml`. For more information, refer to the section on [the config file structure in Rancher v2.3.0+.]({{}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#config-file-structure-in-rancher-v2-3-0) + **Note:** If you are editing the cluster in the `cluster.yml` instead of the Rancher UI, note that as of Rancher v2.3.0, cluster configuration directives must be nested under the `rancher_kubernetes_engine_config` directive in `cluster.yml`. For more information, refer to the section on [the config file structure in Rancher v2.3.0+.]({{}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#config-file-structure-in-rancher-v2-3-0) 7. Click `Next: Select Instance Type` to choose the instance type that will use for your TKE cluster. diff --git a/content/rancher/v2.x/en/security/hardening-2.3/_index.md b/content/rancher/v2.x/en/security/hardening-2.3/_index.md index ab0ebdf9feb..20ed39326b0 100644 --- a/content/rancher/v2.x/en/security/hardening-2.3/_index.md +++ b/content/rancher/v2.x/en/security/hardening-2.3/_index.md @@ -1124,6 +1124,8 @@ If a disallowed node driver is active, visit the _Node Drivers_ page under _Glob ## Appendix A - Complete RKE `cluster.yml` Example +> **Note:** As of Rancher v2.3.0, cluster configuration directives must be nested under the `rancher_kubernetes_engine_config` directive in `cluster.yml`. For more information, refer to the section on [the config file structure in Rancher v2.3.0+.]({{}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#config-file-structure-in-rancher-v2-3-0) + ``` yaml nodes: - address: 18.191.190.205 From 756b31312e81bfd30e8b57c149d5d164df0296b8 Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Fri, 18 Oct 2019 16:33:54 -0700 Subject: [PATCH 3/5] Remove changes from other commit --- .../rancher/v2.x/en/cluster-admin/cloning-clusters/_index.md | 2 -- content/rancher/v2.x/en/security/hardening-2.3/_index.md | 2 -- 2 files changed, 4 deletions(-) diff --git a/content/rancher/v2.x/en/cluster-admin/cloning-clusters/_index.md b/content/rancher/v2.x/en/cluster-admin/cloning-clusters/_index.md index 150503020a0..b097e8b7b12 100644 --- a/content/rancher/v2.x/en/cluster-admin/cloning-clusters/_index.md +++ b/content/rancher/v2.x/en/cluster-admin/cloning-clusters/_index.md @@ -51,8 +51,6 @@ Begin by using Rancher CLI to export the configuration for the cluster that you ## 2. Modify Cluster Config -> As of Rancher v2.3.0, cluster configuration directives must be nested under the `rancher_kubernetes_engine_config` directive in `cluster.yml`. For more information, refer to the section on [the config file structure in Rancher v2.3.0+.]({{}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#config-file-structure-in-rancher-v2-3-0) - Use your favorite text editor to modify the cluster configuration in `cluster-template.yml` for your cloned cluster. > **Note:** As of Rancher v2.3.0, cluster configuration directives must be nested under the `rancher_kubernetes_engine_config` directive in `cluster.yml`. For more information, refer to the section on [the config file structure in Rancher v2.3.0+.]({{}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#config-file-structure-in-rancher-v2-3-0) diff --git a/content/rancher/v2.x/en/security/hardening-2.3/_index.md b/content/rancher/v2.x/en/security/hardening-2.3/_index.md index 20ed39326b0..ab0ebdf9feb 100644 --- a/content/rancher/v2.x/en/security/hardening-2.3/_index.md +++ b/content/rancher/v2.x/en/security/hardening-2.3/_index.md @@ -1124,8 +1124,6 @@ If a disallowed node driver is active, visit the _Node Drivers_ page under _Glob ## Appendix A - Complete RKE `cluster.yml` Example -> **Note:** As of Rancher v2.3.0, cluster configuration directives must be nested under the `rancher_kubernetes_engine_config` directive in `cluster.yml`. For more information, refer to the section on [the config file structure in Rancher v2.3.0+.]({{}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#config-file-structure-in-rancher-v2-3-0) - ``` yaml nodes: - address: 18.191.190.205 From d5f5f3a9f93444fed42597b459e6c272c63ae195 Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Mon, 2 Dec 2019 15:52:44 -0700 Subject: [PATCH 4/5] Add ingress config to cluster.yml example, add note to upgrade section --- .../v2.x/en/cluster-admin/editing-clusters/_index.md | 2 +- .../v2.x/en/installation/ha/kubernetes-rke/_index.md | 7 +++++++ content/rancher/v2.x/en/upgrades/upgrades/ha/_index.md | 5 ++++- 3 files changed, 12 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md b/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md index 633ce78db15..92ccfc2b965 100644 --- a/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md +++ b/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md @@ -83,7 +83,7 @@ As of Rancher v2.3.0, the Kubernetes metadata feature was added, which allows Ra For RKE v0.1.8+, the `ingress-nginx` YAML does not contain an upgrade policy, which makes the update strategy `RollingUpdate` by default. This policy allows the daemonset to restart the pods. -For RKE prior to v0.1.8, the `updateStrategy` directive in the `ingress-nginx` YAML is set to `OnDelete.` In that case, you will need to delete these pods to get the correct version for your deployment. +For RKE prior to v0.1.8, the `updateStrategy` directive in the `ingress-nginx` YAML was set to `OnDelete` because RKE did not yet support updating ingress and addons. In that case, you will need to delete these pods to get the correct version for your deployment. ### Adding a Pod Security Policy diff --git a/content/rancher/v2.x/en/installation/ha/kubernetes-rke/_index.md b/content/rancher/v2.x/en/installation/ha/kubernetes-rke/_index.md index e785a901ac9..9b5eb8a8ebb 100644 --- a/content/rancher/v2.x/en/installation/ha/kubernetes-rke/_index.md +++ b/content/rancher/v2.x/en/installation/ha/kubernetes-rke/_index.md @@ -33,6 +33,13 @@ services: snapshot: true creation: 6h retention: 24h + +# Required for external TLS termination with +# ingress-nginx v0.22+ +ingress: + provider: nginx + options: + use-forwarded-headers: "true" ``` #### Common RKE Nodes Options diff --git a/content/rancher/v2.x/en/upgrades/upgrades/ha/_index.md b/content/rancher/v2.x/en/upgrades/upgrades/ha/_index.md index 864a5b88eb7..b3e15eefaad 100644 --- a/content/rancher/v2.x/en/upgrades/upgrades/ha/_index.md +++ b/content/rancher/v2.x/en/upgrades/upgrades/ha/_index.md @@ -13,7 +13,10 @@ To upgrade the components in your Kubernetes cluster, or the definition of the [ If you installed Rancher using the RKE Add-on yaml, follow the directions to [migrate or upgrade]({{}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on). ->**Note:** [Let's Encrypt will be blocking cert-manager instances older than 0.8.0 starting November 1st 2019.](https://community.letsencrypt.org/t/blocking-old-cert-manager-versions/98753) Upgrade cert-manager to the latest version by following [these instructions.]({{}}/rancher/v2.x/en/installation/options/upgrading-cert-manager) +>**Notes:** +> +> - [Let's Encrypt will be blocking cert-manager instances older than 0.8.0 starting November 1st 2019.](https://community.letsencrypt.org/t/blocking-old-cert-manager-versions/98753) Upgrade cert-manager to the latest version by following [these instructions.]({{}}/rancher/v2.x/en/installation/options/upgrading-cert-manager) +> - If you are upgrading Rancher from v2.x to v2.3+, and you are using external TLS termination, you will need to edit the cluster.yml to [enable using forwarded host headers.]({{}}/rancher/v2.x/en/installation/ha/helm-rancher/chart-options/#configuring-ingress-for-external-tls-when-using-nginx-v0-25) # Prerequisites From 30ee7c983dd642398c6c138702bf21b3c4ade685 Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Mon, 30 Dec 2019 13:36:45 -0700 Subject: [PATCH 5/5] Say that nginx-ingress updateStrategy depends on Kubernetes version --- .../rancher/v2.x/en/cluster-admin/editing-clusters/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md b/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md index 92ccfc2b965..9f194c51414 100644 --- a/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md +++ b/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md @@ -81,7 +81,7 @@ As of Rancher v2.3.0, the Kubernetes metadata feature was added, which allows Ra ### Upgrading ingress-nginx -For RKE v0.1.8+, the `ingress-nginx` YAML does not contain an upgrade policy, which makes the update strategy `RollingUpdate` by default. This policy allows the daemonset to restart the pods. +For RKE v0.1.8+, the `ingress-nginx` YAML does not contain an `updateStrategy`. Therefore, the `updateStrategy` is the default value that is set by the Kubernetes API version. For example, the default `updateStrategy` for Kubernetes v1.13 was `onDelete`. When RKE v0.3.2 began supporting Kubernetes v1.16, the `updateStrategy` for `ingress-nginx` became `RollingUpdate` by default for RKE clusters with Kubernetes 1.16. This policy allows the daemonset to restart the pods. For RKE prior to v0.1.8, the `updateStrategy` directive in the `ingress-nginx` YAML was set to `OnDelete` because RKE did not yet support updating ingress and addons. In that case, you will need to delete these pods to get the correct version for your deployment.