From 4d915c71c719719c84522144c5cc35cafaa1308f Mon Sep 17 00:00:00 2001 From: LucasSaintarbor Date: Fri, 6 Mar 2026 12:04:46 -0800 Subject: [PATCH 01/12] Increase max-old-space-size to 8192 bytes --- .github/workflows/test-deploy.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test-deploy.yml b/.github/workflows/test-deploy.yml index f02e5094430..40f3850b660 100644 --- a/.github/workflows/test-deploy.yml +++ b/.github/workflows/test-deploy.yml @@ -27,5 +27,5 @@ jobs: run: yarn run remark --quiet --use remark-lint-no-dead-urls ./docs - name: Test build website env: - NODE_OPTIONS: "--max_old_space_size=7168" + NODE_OPTIONS: "--max_old_space_size=8192" run: yarn build --no-minify \ No newline at end of file From ad82b388e94a23d3b25a53b497999f4490ec4897 Mon Sep 17 00:00:00 2001 From: LucasSaintarbor Date: Fri, 6 Mar 2026 12:40:53 -0800 Subject: [PATCH 02/12] Increase max-old-space-size to 9216 bytes --- .github/workflows/test-deploy.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test-deploy.yml b/.github/workflows/test-deploy.yml index 40f3850b660..b36c779cbca 100644 --- a/.github/workflows/test-deploy.yml +++ b/.github/workflows/test-deploy.yml @@ -27,5 +27,5 @@ jobs: run: yarn run remark --quiet --use remark-lint-no-dead-urls ./docs - name: Test build website env: - NODE_OPTIONS: "--max_old_space_size=8192" + NODE_OPTIONS: "--max_old_space_size=9216" run: yarn build --no-minify \ No newline at end of file From 860d55373c7bfa36f792ea4d740253e695658d5b Mon Sep 17 00:00:00 2001 From: LucasSaintarbor Date: Fri, 6 Mar 2026 13:32:27 -0800 Subject: [PATCH 03/12] Increase max-old-space-size to 10240 bytes --- .github/workflows/deploy.yml | 2 +- .github/workflows/test-deploy.yml | 2 +- package.json | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index b80ff521263..ae36a4b1aa7 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -25,7 +25,7 @@ jobs: run: yarn install --frozen-lockfile - name: Build website env: - NODE_OPTIONS: "--max_old_space_size=8192" + NODE_OPTIONS: "--max_old_space_size=10240" run: yarn build --no-minify - name: Upload Build Artifact diff --git a/.github/workflows/test-deploy.yml b/.github/workflows/test-deploy.yml index b36c779cbca..da5d7b379cf 100644 --- a/.github/workflows/test-deploy.yml +++ b/.github/workflows/test-deploy.yml @@ -27,5 +27,5 @@ jobs: run: yarn run remark --quiet --use remark-lint-no-dead-urls ./docs - name: Test build website env: - NODE_OPTIONS: "--max_old_space_size=9216" + NODE_OPTIONS: "--max_old_space_size=10240" run: yarn build --no-minify \ No newline at end of file diff --git a/package.json b/package.json index 7084bbcce4c..5fb7a445f4c 100644 --- a/package.json +++ b/package.json @@ -4,8 +4,8 @@ "private": true, "scripts": { "docusaurus": "docusaurus", - "start": "NODE_OPTIONS='--max-old-space-size=7168' docusaurus start", - "build": "NODE_OPTIONS='--max-old-space-size=7168' docusaurus build", + "start": "NODE_OPTIONS='--max-old-space-size=10240' docusaurus start", + "build": "NODE_OPTIONS='--max-old-space-size=10240' docusaurus build", "swizzle": "docusaurus swizzle", "deploy": "docusaurus deploy", "clear": "docusaurus clear", From b531d548721687921ee9235e40a03f5310cfe5b1 Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Fri, 6 Mar 2026 14:21:52 -0800 Subject: [PATCH 04/12] Updating ns exemption list in sample configurations. Signed-off-by: Sunil Singh --- .../rancher-psact.yaml | 54 ++++++++--- .../psa-config-templates.md | 4 + .../psa-restricted-exemptions.md | 97 ++++++++++--------- .../rancher-psact.yaml | 50 +++++++--- .../psa-config-templates.md | 8 ++ .../psa-restricted-exemptions.md | 94 +++++++++--------- .../rancher-psact.yaml | 50 +++++++--- .../psa-config-templates.md | 8 ++ .../psa-restricted-exemptions.md | 94 +++++++++--------- .../rancher-psact.yaml | 50 +++++++--- .../psa-config-templates.md | 8 ++ .../psa-restricted-exemptions.md | 94 +++++++++--------- .../rancher-psact.yaml | 54 ++++++++--- .../psa-config-templates.md | 4 + .../psa-restricted-exemptions.md | 97 ++++++++++--------- .../rancher-psact.yaml | 54 ++++++++--- .../psa-config-templates.md | 4 + .../psa-restricted-exemptions.md | 97 ++++++++++--------- 18 files changed, 555 insertions(+), 366 deletions(-) diff --git a/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml b/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml index 361adde18a6..b79ecda66e8 100644 --- a/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml +++ b/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml @@ -12,28 +12,50 @@ plugins: warn-version: latest exemptions: namespaces: - - ingress-nginx - - kube-system - - cattle-system - - cattle-epinio-system - - cattle-fleet-system - - cattle-fleet-local-system - - longhorn-system - - cattle-neuvector-system - - cattle-monitoring-system - - rancher-alerting-drivers - - cis-operator-system + - calico-apiserver + - calico-system + - cattle-alerting + - cattle-capi-system - cattle-csp-adapter-system + - cattle-elemental-system + - cattle-epinio-system - cattle-externalip-system + - cattle-fleet-local-system + - cattle-fleet-system - cattle-gatekeeper-system - - istio-system + - cattle-global-data + - cattle-global-nt + - cattle-impersonation-system + - cattle-istio - cattle-istio-system + - cattle-logging - cattle-logging-system - - cattle-windows-gmsa-system - - cattle-sriov-system - - cattle-ui-plugin-system - - tigera-operator + - cattle-monitoring-system + - cattle-neuvector-system + - cattle-prometheus - cattle-provisioning-capi-system + - cattle-resources-system + - cattle-sriov-system + - cattle-system + - cattle-turtles-system + - cattle-ui-plugin-system + - cattle-windows-gmsa-system + - cert-manager + - cis-operator-system + - compliance-operator-system + - fleet-default + - fleet-local + - ingress-nginx + - istio-system + - kube-node-lease + - kube-public + - kube-system + - longhorn-system + - rancher-alerting-drivers + - rancher-compliance-system + - security-scan + - sr-operator-system + - tigera-operator kind: PodSecurityConfiguration name: PodSecurity path: "" diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md index e924a4cfffa..113bedf35c1 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md @@ -91,6 +91,7 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit - `calico-apiserver` - `calico-system` - `cattle-alerting` +- `cattle-capi-system` - `cattle-csp-adapter-system` - `cattle-elemental-system` - `cattle-epinio-system` @@ -112,10 +113,12 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit - `cattle-resources-system` - `cattle-sriov-system` - `cattle-system` +- `cattle-turtles-system` - `cattle-ui-plugin-system` - `cattle-windows-gmsa-system` - `cert-manager` - `cis-operator-system` +- `compliance-operator-system` - `fleet-default` - `fleet-local` - `ingress-nginx` @@ -125,6 +128,7 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit - `kube-system` - `longhorn-system` - `rancher-alerting-drivers` +- `rancher-compliance-system` - `security-scan` - `sr-operator-system` - `tigera-operator` diff --git a/docs/reference-guides/rancher-security/psa-restricted-exemptions.md b/docs/reference-guides/rancher-security/psa-restricted-exemptions.md index 09afca597e0..973a0c878bb 100644 --- a/docs/reference-guides/rancher-security/psa-restricted-exemptions.md +++ b/docs/reference-guides/rancher-security/psa-restricted-exemptions.md @@ -14,56 +14,57 @@ kind: AdmissionConfiguration plugins: - name: PodSecurity configuration: - apiVersion: pod-security.admission.config.k8s.io/v1 + apiVersion: pod-security.admission.config.k8s.io/v1beta1 kind: PodSecurityConfiguration defaults: - enforce: "restricted" - enforce-version: "latest" - audit: "restricted" - audit-version: "latest" - warn: "restricted" - warn-version: "latest" + enforce: restricted + enforce-version: latest exemptions: - usernames: [] + namespaces: + - calico-apiserver + - calico-system + - cattle-alerting + - cattle-capi-system + - cattle-csp-adapter-system + - cattle-elemental-system + - cattle-epinio-system + - cattle-externalip-system + - cattle-fleet-local-system + - cattle-fleet-system + - cattle-gatekeeper-system + - cattle-global-data + - cattle-global-nt + - cattle-impersonation-system + - cattle-istio + - cattle-istio-system + - cattle-logging + - cattle-logging-system + - cattle-monitoring-system + - cattle-neuvector-system + - cattle-prometheus + - cattle-provisioning-capi-system + - cattle-resources-system + - cattle-sriov-system + - cattle-system + - cattle-turtles-system + - cattle-ui-plugin-system + - cattle-windows-gmsa-system + - cert-manager + - cis-operator-system + - compliance-operator-system + - fleet-default + - fleet-local + - ingress-nginx + - istio-system + - kube-node-lease + - kube-public + - kube-system + - longhorn-system + - rancher-alerting-drivers + - rancher-compliance-system + - security-scan + - sr-operator-system + - tigera-operator runtimeClasses: [] - namespaces: [calico-apiserver, - calico-system, - cattle-alerting, - cattle-csp-adapter-system, - cattle-elemental-system, - cattle-epinio-system, - cattle-externalip-system, - cattle-fleet-local-system, - cattle-fleet-system, - cattle-gatekeeper-system, - cattle-global-data, - cattle-global-nt, - cattle-impersonation-system, - cattle-istio, - cattle-istio-system, - cattle-logging, - cattle-logging-system, - cattle-monitoring-system, - cattle-neuvector-system, - cattle-prometheus, - cattle-provisioning-capi-system, - cattle-resources-system, - cattle-sriov-system, - cattle-system, - cattle-ui-plugin-system, - cattle-windows-gmsa-system, - cert-manager, - cis-operator-system, - fleet-default, - fleet-local, - ingress-nginx, - istio-system, - kube-node-lease, - kube-public, - kube-system, - longhorn-system, - rancher-alerting-drivers, - security-scan, - sr-operator-system, - tigera-operator] + usernames: [] ``` diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml b/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml index ae248cc9b7c..b79ecda66e8 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml +++ b/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml @@ -12,26 +12,50 @@ plugins: warn-version: latest exemptions: namespaces: - - ingress-nginx - - kube-system - - cattle-system - - cattle-epinio-system - - cattle-fleet-system - - longhorn-system - - cattle-neuvector-system - - cattle-monitoring-system - - rancher-alerting-drivers - - cis-operator-system + - calico-apiserver + - calico-system + - cattle-alerting + - cattle-capi-system - cattle-csp-adapter-system + - cattle-elemental-system + - cattle-epinio-system - cattle-externalip-system + - cattle-fleet-local-system + - cattle-fleet-system - cattle-gatekeeper-system - - istio-system + - cattle-global-data + - cattle-global-nt + - cattle-impersonation-system + - cattle-istio - cattle-istio-system + - cattle-logging - cattle-logging-system - - cattle-windows-gmsa-system + - cattle-monitoring-system + - cattle-neuvector-system + - cattle-prometheus + - cattle-provisioning-capi-system + - cattle-resources-system - cattle-sriov-system + - cattle-system + - cattle-turtles-system - cattle-ui-plugin-system + - cattle-windows-gmsa-system + - cert-manager + - cis-operator-system + - compliance-operator-system + - fleet-default + - fleet-local + - ingress-nginx + - istio-system + - kube-node-lease + - kube-public + - kube-system + - longhorn-system + - rancher-alerting-drivers + - rancher-compliance-system + - security-scan + - sr-operator-system - tigera-operator kind: PodSecurityConfiguration name: PodSecurity - path: "" \ No newline at end of file + path: "" diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md b/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md index 22d7033980d..8434d685d9b 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md +++ b/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md @@ -90,7 +90,9 @@ The policies shipped by default in Rancher aim to provide a trade-off between se - `calico-apiserver` - `calico-system` - `cattle-alerting` +- `cattle-capi-system` - `cattle-csp-adapter-system` +- `cattle-elemental-system` - `cattle-epinio-system` - `cattle-externalip-system` - `cattle-fleet-local-system` @@ -106,12 +108,16 @@ The policies shipped by default in Rancher aim to provide a trade-off between se - `cattle-monitoring-system` - `cattle-neuvector-system` - `cattle-prometheus` +- `cattle-provisioning-capi-system` +- `cattle-resources-system` - `cattle-sriov-system` - `cattle-system` +- `cattle-turtles-system` - `cattle-ui-plugin-system` - `cattle-windows-gmsa-system` - `cert-manager` - `cis-operator-system` +- `compliance-operator-system` - `fleet-default` - `fleet-local` - `ingress-nginx` @@ -121,7 +127,9 @@ The policies shipped by default in Rancher aim to provide a trade-off between se - `kube-system` - `longhorn-system` - `rancher-alerting-drivers` +- `rancher-compliance-system` - `security-scan` +- `sr-operator-system` - `tigera-operator` Rancher、Rancher 拥有的一些 Chart 以及 RKE2 和 K3s 发行版都使用这些命名空间。列出的命名空间的一个子集已经在内置的 Rancher `rancher-restricted` 策略中被豁免，用于下游集群。有关运行 Rancher 所需的所有豁免的完整模板，请参阅此[准入配置示例](../../../reference-guides/rancher-security/psa-restricted-exemptions.md)。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rancher-security/psa-restricted-exemptions.md b/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rancher-security/psa-restricted-exemptions.md index d623ef71dfb..76a3032af36 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rancher-security/psa-restricted-exemptions.md +++ b/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rancher-security/psa-restricted-exemptions.md @@ -10,53 +10,57 @@ kind: AdmissionConfiguration plugins: - name: PodSecurity configuration: - apiVersion: pod-security.admission.config.k8s.io/v1 + apiVersion: pod-security.admission.config.k8s.io/v1beta1 kind: PodSecurityConfiguration defaults: - enforce: "restricted" - enforce-version: "latest" - audit: "restricted" - audit-version: "latest" - warn: "restricted" - warn-version: "latest" + enforce: restricted + enforce-version: latest exemptions: - usernames: [] + namespaces: + - calico-apiserver + - calico-system + - cattle-alerting + - cattle-capi-system + - cattle-csp-adapter-system + - cattle-elemental-system + - cattle-epinio-system + - cattle-externalip-system + - cattle-fleet-local-system + - cattle-fleet-system + - cattle-gatekeeper-system + - cattle-global-data + - cattle-global-nt + - cattle-impersonation-system + - cattle-istio + - cattle-istio-system + - cattle-logging + - cattle-logging-system + - cattle-monitoring-system + - cattle-neuvector-system + - cattle-prometheus + - cattle-provisioning-capi-system + - cattle-resources-system + - cattle-sriov-system + - cattle-system + - cattle-turtles-system + - cattle-ui-plugin-system + - cattle-windows-gmsa-system + - cert-manager + - cis-operator-system + - compliance-operator-system + - fleet-default + - fleet-local + - ingress-nginx + - istio-system + - kube-node-lease + - kube-public + - kube-system + - longhorn-system + - rancher-alerting-drivers + - rancher-compliance-system + - security-scan + - sr-operator-system + - tigera-operator runtimeClasses: [] - namespaces: [calico-apiserver, - calico-system, - cattle-alerting, - cattle-csp-adapter-system, - cattle-elemental-system, - cattle-epinio-system, - cattle-externalip-system, - cattle-fleet-local-system, - cattle-fleet-system, - cattle-gatekeeper-system, - cattle-global-data, - cattle-global-nt, - cattle-impersonation-system, - cattle-istio, - cattle-istio-system, - cattle-logging, - cattle-logging-system, - cattle-monitoring-system, - cattle-neuvector-system, - cattle-prometheus, - cattle-resources-system, - cattle-sriov-system, - cattle-system, - cattle-ui-plugin-system, - cattle-windows-gmsa-system, - cert-manager, - cis-operator-system, - fleet-default, - ingress-nginx, - istio-system, - kube-node-lease, - kube-public, - kube-system, - longhorn-system, - rancher-alerting-drivers, - security-scan, - tigera-operator] + usernames: [] ``` diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml b/i18n/zh/docusaurus-plugin-content-docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml index ae248cc9b7c..b79ecda66e8 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml @@ -12,26 +12,50 @@ plugins: warn-version: latest exemptions: namespaces: - - ingress-nginx - - kube-system - - cattle-system - - cattle-epinio-system - - cattle-fleet-system - - longhorn-system - - cattle-neuvector-system - - cattle-monitoring-system - - rancher-alerting-drivers - - cis-operator-system + - calico-apiserver + - calico-system + - cattle-alerting + - cattle-capi-system - cattle-csp-adapter-system + - cattle-elemental-system + - cattle-epinio-system - cattle-externalip-system + - cattle-fleet-local-system + - cattle-fleet-system - cattle-gatekeeper-system - - istio-system + - cattle-global-data + - cattle-global-nt + - cattle-impersonation-system + - cattle-istio - cattle-istio-system + - cattle-logging - cattle-logging-system - - cattle-windows-gmsa-system + - cattle-monitoring-system + - cattle-neuvector-system + - cattle-prometheus + - cattle-provisioning-capi-system + - cattle-resources-system - cattle-sriov-system + - cattle-system + - cattle-turtles-system - cattle-ui-plugin-system + - cattle-windows-gmsa-system + - cert-manager + - cis-operator-system + - compliance-operator-system + - fleet-default + - fleet-local + - ingress-nginx + - istio-system + - kube-node-lease + - kube-public + - kube-system + - longhorn-system + - rancher-alerting-drivers + - rancher-compliance-system + - security-scan + - sr-operator-system - tigera-operator kind: PodSecurityConfiguration name: PodSecurity - path: "" \ No newline at end of file + path: "" diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md index 22d7033980d..8434d685d9b 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md @@ -90,7 +90,9 @@ The policies shipped by default in Rancher aim to provide a trade-off between se - `calico-apiserver` - `calico-system` - `cattle-alerting` +- `cattle-capi-system` - `cattle-csp-adapter-system` +- `cattle-elemental-system` - `cattle-epinio-system` - `cattle-externalip-system` - `cattle-fleet-local-system` @@ -106,12 +108,16 @@ The policies shipped by default in Rancher aim to provide a trade-off between se - `cattle-monitoring-system` - `cattle-neuvector-system` - `cattle-prometheus` +- `cattle-provisioning-capi-system` +- `cattle-resources-system` - `cattle-sriov-system` - `cattle-system` +- `cattle-turtles-system` - `cattle-ui-plugin-system` - `cattle-windows-gmsa-system` - `cert-manager` - `cis-operator-system` +- `compliance-operator-system` - `fleet-default` - `fleet-local` - `ingress-nginx` @@ -121,7 +127,9 @@ The policies shipped by default in Rancher aim to provide a trade-off between se - `kube-system` - `longhorn-system` - `rancher-alerting-drivers` +- `rancher-compliance-system` - `security-scan` +- `sr-operator-system` - `tigera-operator` Rancher、Rancher 拥有的一些 Chart 以及 RKE2 和 K3s 发行版都使用这些命名空间。列出的命名空间的一个子集已经在内置的 Rancher `rancher-restricted` 策略中被豁免，用于下游集群。有关运行 Rancher 所需的所有豁免的完整模板，请参阅此[准入配置示例](../../../reference-guides/rancher-security/psa-restricted-exemptions.md)。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.13/reference-guides/rancher-security/psa-restricted-exemptions.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.13/reference-guides/rancher-security/psa-restricted-exemptions.md index d623ef71dfb..76a3032af36 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.13/reference-guides/rancher-security/psa-restricted-exemptions.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.13/reference-guides/rancher-security/psa-restricted-exemptions.md @@ -10,53 +10,57 @@ kind: AdmissionConfiguration plugins: - name: PodSecurity configuration: - apiVersion: pod-security.admission.config.k8s.io/v1 + apiVersion: pod-security.admission.config.k8s.io/v1beta1 kind: PodSecurityConfiguration defaults: - enforce: "restricted" - enforce-version: "latest" - audit: "restricted" - audit-version: "latest" - warn: "restricted" - warn-version: "latest" + enforce: restricted + enforce-version: latest exemptions: - usernames: [] + namespaces: + - calico-apiserver + - calico-system + - cattle-alerting + - cattle-capi-system + - cattle-csp-adapter-system + - cattle-elemental-system + - cattle-epinio-system + - cattle-externalip-system + - cattle-fleet-local-system + - cattle-fleet-system + - cattle-gatekeeper-system + - cattle-global-data + - cattle-global-nt + - cattle-impersonation-system + - cattle-istio + - cattle-istio-system + - cattle-logging + - cattle-logging-system + - cattle-monitoring-system + - cattle-neuvector-system + - cattle-prometheus + - cattle-provisioning-capi-system + - cattle-resources-system + - cattle-sriov-system + - cattle-system + - cattle-turtles-system + - cattle-ui-plugin-system + - cattle-windows-gmsa-system + - cert-manager + - cis-operator-system + - compliance-operator-system + - fleet-default + - fleet-local + - ingress-nginx + - istio-system + - kube-node-lease + - kube-public + - kube-system + - longhorn-system + - rancher-alerting-drivers + - rancher-compliance-system + - security-scan + - sr-operator-system + - tigera-operator runtimeClasses: [] - namespaces: [calico-apiserver, - calico-system, - cattle-alerting, - cattle-csp-adapter-system, - cattle-elemental-system, - cattle-epinio-system, - cattle-externalip-system, - cattle-fleet-local-system, - cattle-fleet-system, - cattle-gatekeeper-system, - cattle-global-data, - cattle-global-nt, - cattle-impersonation-system, - cattle-istio, - cattle-istio-system, - cattle-logging, - cattle-logging-system, - cattle-monitoring-system, - cattle-neuvector-system, - cattle-prometheus, - cattle-resources-system, - cattle-sriov-system, - cattle-system, - cattle-ui-plugin-system, - cattle-windows-gmsa-system, - cert-manager, - cis-operator-system, - fleet-default, - ingress-nginx, - istio-system, - kube-node-lease, - kube-public, - kube-system, - longhorn-system, - rancher-alerting-drivers, - security-scan, - tigera-operator] + usernames: [] ``` diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml b/i18n/zh/docusaurus-plugin-content-docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml index ae248cc9b7c..b79ecda66e8 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml @@ -12,26 +12,50 @@ plugins: warn-version: latest exemptions: namespaces: - - ingress-nginx - - kube-system - - cattle-system - - cattle-epinio-system - - cattle-fleet-system - - longhorn-system - - cattle-neuvector-system - - cattle-monitoring-system - - rancher-alerting-drivers - - cis-operator-system + - calico-apiserver + - calico-system + - cattle-alerting + - cattle-capi-system - cattle-csp-adapter-system + - cattle-elemental-system + - cattle-epinio-system - cattle-externalip-system + - cattle-fleet-local-system + - cattle-fleet-system - cattle-gatekeeper-system - - istio-system + - cattle-global-data + - cattle-global-nt + - cattle-impersonation-system + - cattle-istio - cattle-istio-system + - cattle-logging - cattle-logging-system - - cattle-windows-gmsa-system + - cattle-monitoring-system + - cattle-neuvector-system + - cattle-prometheus + - cattle-provisioning-capi-system + - cattle-resources-system - cattle-sriov-system + - cattle-system + - cattle-turtles-system - cattle-ui-plugin-system + - cattle-windows-gmsa-system + - cert-manager + - cis-operator-system + - compliance-operator-system + - fleet-default + - fleet-local + - ingress-nginx + - istio-system + - kube-node-lease + - kube-public + - kube-system + - longhorn-system + - rancher-alerting-drivers + - rancher-compliance-system + - security-scan + - sr-operator-system - tigera-operator kind: PodSecurityConfiguration name: PodSecurity - path: "" \ No newline at end of file + path: "" diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md index 22d7033980d..8434d685d9b 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md @@ -90,7 +90,9 @@ The policies shipped by default in Rancher aim to provide a trade-off between se - `calico-apiserver` - `calico-system` - `cattle-alerting` +- `cattle-capi-system` - `cattle-csp-adapter-system` +- `cattle-elemental-system` - `cattle-epinio-system` - `cattle-externalip-system` - `cattle-fleet-local-system` @@ -106,12 +108,16 @@ The policies shipped by default in Rancher aim to provide a trade-off between se - `cattle-monitoring-system` - `cattle-neuvector-system` - `cattle-prometheus` +- `cattle-provisioning-capi-system` +- `cattle-resources-system` - `cattle-sriov-system` - `cattle-system` +- `cattle-turtles-system` - `cattle-ui-plugin-system` - `cattle-windows-gmsa-system` - `cert-manager` - `cis-operator-system` +- `compliance-operator-system` - `fleet-default` - `fleet-local` - `ingress-nginx` @@ -121,7 +127,9 @@ The policies shipped by default in Rancher aim to provide a trade-off between se - `kube-system` - `longhorn-system` - `rancher-alerting-drivers` +- `rancher-compliance-system` - `security-scan` +- `sr-operator-system` - `tigera-operator` Rancher、Rancher 拥有的一些 Chart 以及 RKE2 和 K3s 发行版都使用这些命名空间。列出的命名空间的一个子集已经在内置的 Rancher `rancher-restricted` 策略中被豁免，用于下游集群。有关运行 Rancher 所需的所有豁免的完整模板，请参阅此[准入配置示例](../../../reference-guides/rancher-security/psa-restricted-exemptions.md)。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.14/reference-guides/rancher-security/psa-restricted-exemptions.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.14/reference-guides/rancher-security/psa-restricted-exemptions.md index d623ef71dfb..76a3032af36 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.14/reference-guides/rancher-security/psa-restricted-exemptions.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.14/reference-guides/rancher-security/psa-restricted-exemptions.md @@ -10,53 +10,57 @@ kind: AdmissionConfiguration plugins: - name: PodSecurity configuration: - apiVersion: pod-security.admission.config.k8s.io/v1 + apiVersion: pod-security.admission.config.k8s.io/v1beta1 kind: PodSecurityConfiguration defaults: - enforce: "restricted" - enforce-version: "latest" - audit: "restricted" - audit-version: "latest" - warn: "restricted" - warn-version: "latest" + enforce: restricted + enforce-version: latest exemptions: - usernames: [] + namespaces: + - calico-apiserver + - calico-system + - cattle-alerting + - cattle-capi-system + - cattle-csp-adapter-system + - cattle-elemental-system + - cattle-epinio-system + - cattle-externalip-system + - cattle-fleet-local-system + - cattle-fleet-system + - cattle-gatekeeper-system + - cattle-global-data + - cattle-global-nt + - cattle-impersonation-system + - cattle-istio + - cattle-istio-system + - cattle-logging + - cattle-logging-system + - cattle-monitoring-system + - cattle-neuvector-system + - cattle-prometheus + - cattle-provisioning-capi-system + - cattle-resources-system + - cattle-sriov-system + - cattle-system + - cattle-turtles-system + - cattle-ui-plugin-system + - cattle-windows-gmsa-system + - cert-manager + - cis-operator-system + - compliance-operator-system + - fleet-default + - fleet-local + - ingress-nginx + - istio-system + - kube-node-lease + - kube-public + - kube-system + - longhorn-system + - rancher-alerting-drivers + - rancher-compliance-system + - security-scan + - sr-operator-system + - tigera-operator runtimeClasses: [] - namespaces: [calico-apiserver, - calico-system, - cattle-alerting, - cattle-csp-adapter-system, - cattle-elemental-system, - cattle-epinio-system, - cattle-externalip-system, - cattle-fleet-local-system, - cattle-fleet-system, - cattle-gatekeeper-system, - cattle-global-data, - cattle-global-nt, - cattle-impersonation-system, - cattle-istio, - cattle-istio-system, - cattle-logging, - cattle-logging-system, - cattle-monitoring-system, - cattle-neuvector-system, - cattle-prometheus, - cattle-resources-system, - cattle-sriov-system, - cattle-system, - cattle-ui-plugin-system, - cattle-windows-gmsa-system, - cert-manager, - cis-operator-system, - fleet-default, - ingress-nginx, - istio-system, - kube-node-lease, - kube-public, - kube-system, - longhorn-system, - rancher-alerting-drivers, - security-scan, - tigera-operator] + usernames: [] ``` diff --git a/versioned_docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml b/versioned_docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml index 361adde18a6..b79ecda66e8 100644 --- a/versioned_docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml +++ b/versioned_docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml @@ -12,28 +12,50 @@ plugins: warn-version: latest exemptions: namespaces: - - ingress-nginx - - kube-system - - cattle-system - - cattle-epinio-system - - cattle-fleet-system - - cattle-fleet-local-system - - longhorn-system - - cattle-neuvector-system - - cattle-monitoring-system - - rancher-alerting-drivers - - cis-operator-system + - calico-apiserver + - calico-system + - cattle-alerting + - cattle-capi-system - cattle-csp-adapter-system + - cattle-elemental-system + - cattle-epinio-system - cattle-externalip-system + - cattle-fleet-local-system + - cattle-fleet-system - cattle-gatekeeper-system - - istio-system + - cattle-global-data + - cattle-global-nt + - cattle-impersonation-system + - cattle-istio - cattle-istio-system + - cattle-logging - cattle-logging-system - - cattle-windows-gmsa-system - - cattle-sriov-system - - cattle-ui-plugin-system - - tigera-operator + - cattle-monitoring-system + - cattle-neuvector-system + - cattle-prometheus - cattle-provisioning-capi-system + - cattle-resources-system + - cattle-sriov-system + - cattle-system + - cattle-turtles-system + - cattle-ui-plugin-system + - cattle-windows-gmsa-system + - cert-manager + - cis-operator-system + - compliance-operator-system + - fleet-default + - fleet-local + - ingress-nginx + - istio-system + - kube-node-lease + - kube-public + - kube-system + - longhorn-system + - rancher-alerting-drivers + - rancher-compliance-system + - security-scan + - sr-operator-system + - tigera-operator kind: PodSecurityConfiguration name: PodSecurity path: "" diff --git a/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md b/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md index e924a4cfffa..113bedf35c1 100644 --- a/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md +++ b/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md @@ -91,6 +91,7 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit - `calico-apiserver` - `calico-system` - `cattle-alerting` +- `cattle-capi-system` - `cattle-csp-adapter-system` - `cattle-elemental-system` - `cattle-epinio-system` @@ -112,10 +113,12 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit - `cattle-resources-system` - `cattle-sriov-system` - `cattle-system` +- `cattle-turtles-system` - `cattle-ui-plugin-system` - `cattle-windows-gmsa-system` - `cert-manager` - `cis-operator-system` +- `compliance-operator-system` - `fleet-default` - `fleet-local` - `ingress-nginx` @@ -125,6 +128,7 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit - `kube-system` - `longhorn-system` - `rancher-alerting-drivers` +- `rancher-compliance-system` - `security-scan` - `sr-operator-system` - `tigera-operator` diff --git a/versioned_docs/version-2.13/reference-guides/rancher-security/psa-restricted-exemptions.md b/versioned_docs/version-2.13/reference-guides/rancher-security/psa-restricted-exemptions.md index 09afca597e0..973a0c878bb 100644 --- a/versioned_docs/version-2.13/reference-guides/rancher-security/psa-restricted-exemptions.md +++ b/versioned_docs/version-2.13/reference-guides/rancher-security/psa-restricted-exemptions.md @@ -14,56 +14,57 @@ kind: AdmissionConfiguration plugins: - name: PodSecurity configuration: - apiVersion: pod-security.admission.config.k8s.io/v1 + apiVersion: pod-security.admission.config.k8s.io/v1beta1 kind: PodSecurityConfiguration defaults: - enforce: "restricted" - enforce-version: "latest" - audit: "restricted" - audit-version: "latest" - warn: "restricted" - warn-version: "latest" + enforce: restricted + enforce-version: latest exemptions: - usernames: [] + namespaces: + - calico-apiserver + - calico-system + - cattle-alerting + - cattle-capi-system + - cattle-csp-adapter-system + - cattle-elemental-system + - cattle-epinio-system + - cattle-externalip-system + - cattle-fleet-local-system + - cattle-fleet-system + - cattle-gatekeeper-system + - cattle-global-data + - cattle-global-nt + - cattle-impersonation-system + - cattle-istio + - cattle-istio-system + - cattle-logging + - cattle-logging-system + - cattle-monitoring-system + - cattle-neuvector-system + - cattle-prometheus + - cattle-provisioning-capi-system + - cattle-resources-system + - cattle-sriov-system + - cattle-system + - cattle-turtles-system + - cattle-ui-plugin-system + - cattle-windows-gmsa-system + - cert-manager + - cis-operator-system + - compliance-operator-system + - fleet-default + - fleet-local + - ingress-nginx + - istio-system + - kube-node-lease + - kube-public + - kube-system + - longhorn-system + - rancher-alerting-drivers + - rancher-compliance-system + - security-scan + - sr-operator-system + - tigera-operator runtimeClasses: [] - namespaces: [calico-apiserver, - calico-system, - cattle-alerting, - cattle-csp-adapter-system, - cattle-elemental-system, - cattle-epinio-system, - cattle-externalip-system, - cattle-fleet-local-system, - cattle-fleet-system, - cattle-gatekeeper-system, - cattle-global-data, - cattle-global-nt, - cattle-impersonation-system, - cattle-istio, - cattle-istio-system, - cattle-logging, - cattle-logging-system, - cattle-monitoring-system, - cattle-neuvector-system, - cattle-prometheus, - cattle-provisioning-capi-system, - cattle-resources-system, - cattle-sriov-system, - cattle-system, - cattle-ui-plugin-system, - cattle-windows-gmsa-system, - cert-manager, - cis-operator-system, - fleet-default, - fleet-local, - ingress-nginx, - istio-system, - kube-node-lease, - kube-public, - kube-system, - longhorn-system, - rancher-alerting-drivers, - security-scan, - sr-operator-system, - tigera-operator] + usernames: [] ``` diff --git a/versioned_docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml b/versioned_docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml index 361adde18a6..b79ecda66e8 100644 --- a/versioned_docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml +++ b/versioned_docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml @@ -12,28 +12,50 @@ plugins: warn-version: latest exemptions: namespaces: - - ingress-nginx - - kube-system - - cattle-system - - cattle-epinio-system - - cattle-fleet-system - - cattle-fleet-local-system - - longhorn-system - - cattle-neuvector-system - - cattle-monitoring-system - - rancher-alerting-drivers - - cis-operator-system + - calico-apiserver + - calico-system + - cattle-alerting + - cattle-capi-system - cattle-csp-adapter-system + - cattle-elemental-system + - cattle-epinio-system - cattle-externalip-system + - cattle-fleet-local-system + - cattle-fleet-system - cattle-gatekeeper-system - - istio-system + - cattle-global-data + - cattle-global-nt + - cattle-impersonation-system + - cattle-istio - cattle-istio-system + - cattle-logging - cattle-logging-system - - cattle-windows-gmsa-system - - cattle-sriov-system - - cattle-ui-plugin-system - - tigera-operator + - cattle-monitoring-system + - cattle-neuvector-system + - cattle-prometheus - cattle-provisioning-capi-system + - cattle-resources-system + - cattle-sriov-system + - cattle-system + - cattle-turtles-system + - cattle-ui-plugin-system + - cattle-windows-gmsa-system + - cert-manager + - cis-operator-system + - compliance-operator-system + - fleet-default + - fleet-local + - ingress-nginx + - istio-system + - kube-node-lease + - kube-public + - kube-system + - longhorn-system + - rancher-alerting-drivers + - rancher-compliance-system + - security-scan + - sr-operator-system + - tigera-operator kind: PodSecurityConfiguration name: PodSecurity path: "" diff --git a/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md b/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md index e924a4cfffa..113bedf35c1 100644 --- a/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md +++ b/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md @@ -91,6 +91,7 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit - `calico-apiserver` - `calico-system` - `cattle-alerting` +- `cattle-capi-system` - `cattle-csp-adapter-system` - `cattle-elemental-system` - `cattle-epinio-system` @@ -112,10 +113,12 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit - `cattle-resources-system` - `cattle-sriov-system` - `cattle-system` +- `cattle-turtles-system` - `cattle-ui-plugin-system` - `cattle-windows-gmsa-system` - `cert-manager` - `cis-operator-system` +- `compliance-operator-system` - `fleet-default` - `fleet-local` - `ingress-nginx` @@ -125,6 +128,7 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit - `kube-system` - `longhorn-system` - `rancher-alerting-drivers` +- `rancher-compliance-system` - `security-scan` - `sr-operator-system` - `tigera-operator` diff --git a/versioned_docs/version-2.14/reference-guides/rancher-security/psa-restricted-exemptions.md b/versioned_docs/version-2.14/reference-guides/rancher-security/psa-restricted-exemptions.md index 09afca597e0..973a0c878bb 100644 --- a/versioned_docs/version-2.14/reference-guides/rancher-security/psa-restricted-exemptions.md +++ b/versioned_docs/version-2.14/reference-guides/rancher-security/psa-restricted-exemptions.md @@ -14,56 +14,57 @@ kind: AdmissionConfiguration plugins: - name: PodSecurity configuration: - apiVersion: pod-security.admission.config.k8s.io/v1 + apiVersion: pod-security.admission.config.k8s.io/v1beta1 kind: PodSecurityConfiguration defaults: - enforce: "restricted" - enforce-version: "latest" - audit: "restricted" - audit-version: "latest" - warn: "restricted" - warn-version: "latest" + enforce: restricted + enforce-version: latest exemptions: - usernames: [] + namespaces: + - calico-apiserver + - calico-system + - cattle-alerting + - cattle-capi-system + - cattle-csp-adapter-system + - cattle-elemental-system + - cattle-epinio-system + - cattle-externalip-system + - cattle-fleet-local-system + - cattle-fleet-system + - cattle-gatekeeper-system + - cattle-global-data + - cattle-global-nt + - cattle-impersonation-system + - cattle-istio + - cattle-istio-system + - cattle-logging + - cattle-logging-system + - cattle-monitoring-system + - cattle-neuvector-system + - cattle-prometheus + - cattle-provisioning-capi-system + - cattle-resources-system + - cattle-sriov-system + - cattle-system + - cattle-turtles-system + - cattle-ui-plugin-system + - cattle-windows-gmsa-system + - cert-manager + - cis-operator-system + - compliance-operator-system + - fleet-default + - fleet-local + - ingress-nginx + - istio-system + - kube-node-lease + - kube-public + - kube-system + - longhorn-system + - rancher-alerting-drivers + - rancher-compliance-system + - security-scan + - sr-operator-system + - tigera-operator runtimeClasses: [] - namespaces: [calico-apiserver, - calico-system, - cattle-alerting, - cattle-csp-adapter-system, - cattle-elemental-system, - cattle-epinio-system, - cattle-externalip-system, - cattle-fleet-local-system, - cattle-fleet-system, - cattle-gatekeeper-system, - cattle-global-data, - cattle-global-nt, - cattle-impersonation-system, - cattle-istio, - cattle-istio-system, - cattle-logging, - cattle-logging-system, - cattle-monitoring-system, - cattle-neuvector-system, - cattle-prometheus, - cattle-provisioning-capi-system, - cattle-resources-system, - cattle-sriov-system, - cattle-system, - cattle-ui-plugin-system, - cattle-windows-gmsa-system, - cert-manager, - cis-operator-system, - fleet-default, - fleet-local, - ingress-nginx, - istio-system, - kube-node-lease, - kube-public, - kube-system, - longhorn-system, - rancher-alerting-drivers, - security-scan, - sr-operator-system, - tigera-operator] + usernames: [] ``` From 473eea4b4141fb889464db4cdf7ee5071d09bcca Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Mon, 9 Mar 2026 14:16:40 -0700 Subject: [PATCH 05/12] Update code block after review Signed-off-by: Sunil Singh --- .../rancher-security/psa-restricted-exemptions.md | 10 +++++++--- .../rancher-security/psa-restricted-exemptions.md | 10 +++++++--- .../rancher-security/psa-restricted-exemptions.md | 10 +++++++--- .../rancher-security/psa-restricted-exemptions.md | 10 +++++++--- .../rancher-security/psa-restricted-exemptions.md | 10 +++++++--- .../rancher-security/psa-restricted-exemptions.md | 10 +++++++--- 6 files changed, 42 insertions(+), 18 deletions(-) diff --git a/docs/reference-guides/rancher-security/psa-restricted-exemptions.md b/docs/reference-guides/rancher-security/psa-restricted-exemptions.md index 973a0c878bb..d54afa9b708 100644 --- a/docs/reference-guides/rancher-security/psa-restricted-exemptions.md +++ b/docs/reference-guides/rancher-security/psa-restricted-exemptions.md @@ -14,11 +14,15 @@ kind: AdmissionConfiguration plugins: - name: PodSecurity configuration: - apiVersion: pod-security.admission.config.k8s.io/v1beta1 + apiVersion: pod-security.admission.config.k8s.io/v1 kind: PodSecurityConfiguration defaults: - enforce: restricted - enforce-version: latest + enforce: "restricted" + enforce-version: "latest" + audit: "restricted" + audit-version: "latest" + warn: "restricted" + warn-version: "latest" exemptions: namespaces: - calico-apiserver diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rancher-security/psa-restricted-exemptions.md b/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rancher-security/psa-restricted-exemptions.md index 76a3032af36..5618bc10850 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rancher-security/psa-restricted-exemptions.md +++ b/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rancher-security/psa-restricted-exemptions.md @@ -10,11 +10,15 @@ kind: AdmissionConfiguration plugins: - name: PodSecurity configuration: - apiVersion: pod-security.admission.config.k8s.io/v1beta1 + apiVersion: pod-security.admission.config.k8s.io/v1 kind: PodSecurityConfiguration defaults: - enforce: restricted - enforce-version: latest + enforce: "restricted" + enforce-version: "latest" + audit: "restricted" + audit-version: "latest" + warn: "restricted" + warn-version: "latest" exemptions: namespaces: - calico-apiserver diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.13/reference-guides/rancher-security/psa-restricted-exemptions.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.13/reference-guides/rancher-security/psa-restricted-exemptions.md index 76a3032af36..5618bc10850 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.13/reference-guides/rancher-security/psa-restricted-exemptions.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.13/reference-guides/rancher-security/psa-restricted-exemptions.md @@ -10,11 +10,15 @@ kind: AdmissionConfiguration plugins: - name: PodSecurity configuration: - apiVersion: pod-security.admission.config.k8s.io/v1beta1 + apiVersion: pod-security.admission.config.k8s.io/v1 kind: PodSecurityConfiguration defaults: - enforce: restricted - enforce-version: latest + enforce: "restricted" + enforce-version: "latest" + audit: "restricted" + audit-version: "latest" + warn: "restricted" + warn-version: "latest" exemptions: namespaces: - calico-apiserver diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.14/reference-guides/rancher-security/psa-restricted-exemptions.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.14/reference-guides/rancher-security/psa-restricted-exemptions.md index 76a3032af36..5618bc10850 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.14/reference-guides/rancher-security/psa-restricted-exemptions.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.14/reference-guides/rancher-security/psa-restricted-exemptions.md @@ -10,11 +10,15 @@ kind: AdmissionConfiguration plugins: - name: PodSecurity configuration: - apiVersion: pod-security.admission.config.k8s.io/v1beta1 + apiVersion: pod-security.admission.config.k8s.io/v1 kind: PodSecurityConfiguration defaults: - enforce: restricted - enforce-version: latest + enforce: "restricted" + enforce-version: "latest" + audit: "restricted" + audit-version: "latest" + warn: "restricted" + warn-version: "latest" exemptions: namespaces: - calico-apiserver diff --git a/versioned_docs/version-2.13/reference-guides/rancher-security/psa-restricted-exemptions.md b/versioned_docs/version-2.13/reference-guides/rancher-security/psa-restricted-exemptions.md index 973a0c878bb..d54afa9b708 100644 --- a/versioned_docs/version-2.13/reference-guides/rancher-security/psa-restricted-exemptions.md +++ b/versioned_docs/version-2.13/reference-guides/rancher-security/psa-restricted-exemptions.md @@ -14,11 +14,15 @@ kind: AdmissionConfiguration plugins: - name: PodSecurity configuration: - apiVersion: pod-security.admission.config.k8s.io/v1beta1 + apiVersion: pod-security.admission.config.k8s.io/v1 kind: PodSecurityConfiguration defaults: - enforce: restricted - enforce-version: latest + enforce: "restricted" + enforce-version: "latest" + audit: "restricted" + audit-version: "latest" + warn: "restricted" + warn-version: "latest" exemptions: namespaces: - calico-apiserver diff --git a/versioned_docs/version-2.14/reference-guides/rancher-security/psa-restricted-exemptions.md b/versioned_docs/version-2.14/reference-guides/rancher-security/psa-restricted-exemptions.md index 973a0c878bb..d54afa9b708 100644 --- a/versioned_docs/version-2.14/reference-guides/rancher-security/psa-restricted-exemptions.md +++ b/versioned_docs/version-2.14/reference-guides/rancher-security/psa-restricted-exemptions.md @@ -14,11 +14,15 @@ kind: AdmissionConfiguration plugins: - name: PodSecurity configuration: - apiVersion: pod-security.admission.config.k8s.io/v1beta1 + apiVersion: pod-security.admission.config.k8s.io/v1 kind: PodSecurityConfiguration defaults: - enforce: restricted - enforce-version: latest + enforce: "restricted" + enforce-version: "latest" + audit: "restricted" + audit-version: "latest" + warn: "restricted" + warn-version: "latest" exemptions: namespaces: - calico-apiserver From cc2e26e03ed4d18f333240e2c99777df5ba5e3c7 Mon Sep 17 00:00:00 2001 From: Siva Kanakala Date: Tue, 10 Mar 2026 21:02:39 +0530 Subject: [PATCH 06/12] upgrade-feature-charts --- .../upgrades.md | 17 +++++++++++++++-- .../upgrades.md | 17 +++++++++++++++-- .../upgrades.md | 17 +++++++++++++++-- .../upgrades.md | 17 +++++++++++++++-- .../upgrades.md | 17 +++++++++++++++-- .../upgrades.md | 17 +++++++++++++++-- 6 files changed, 90 insertions(+), 12 deletions(-) diff --git a/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md b/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md index d4b8be7d061..f204f68f467 100644 --- a/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md +++ b/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md @@ -136,8 +136,21 @@ You'll use the backup as a restore point if something goes wrong during upgrade. ```plain helm fetch rancher-/rancher --version=2.6.8 ``` +### 3. Review Rancher Feature Chart Versions Before Upgrade -### 3. Upgrade Rancher +Rancher feature charts follow specific release lines that align with Rancher versions. Major versions of feature charts correspond to Rancher minor versions and follow a defined versioning scheme. + +Before upgrading Rancher, review any installed Rancher feature charts and upgrade them to the latest available version within their current chart release line. This helps ensure compatibility and avoids potential issues during or after the Rancher upgrade. + +To review installed feature charts: + +1. In the Rancher UI, go to **Apps & Marketplace**. +2. Select **Installed Apps**. +3. Review the chart versions and upgrade to the latest patch release within the same chart major version if needed. + +For more information, see the [Helm Charts in Rancher – Versioning Scheme](../../../how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md#versioning-scheme). + +### 4. Upgrade Rancher This section describes how to upgrade normal (Internet-connected) or air-gapped installations of Rancher with Helm. @@ -222,7 +235,7 @@ Alternatively, it's possible to export the current values to a file and referenc --version=2.6.8 ``` -### 4. Verify the Upgrade +### 5. Verify the Upgrade Log into Rancher to confirm that the upgrade succeeded. diff --git a/versioned_docs/version-2.10/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md b/versioned_docs/version-2.10/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md index f6c7154d3a0..1c16b57b96c 100644 --- a/versioned_docs/version-2.10/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md +++ b/versioned_docs/version-2.10/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md @@ -107,8 +107,21 @@ You'll use the backup as a restore point if something goes wrong during upgrade. ```plain helm fetch rancher-/rancher --version=2.6.8 ``` +### 3. Review Rancher Feature Chart Versions Before Upgrade -### 3. Upgrade Rancher +Rancher feature charts follow specific release lines that align with Rancher versions. Major versions of feature charts correspond to Rancher minor versions and follow a defined versioning scheme. + +Before upgrading Rancher, review any installed Rancher feature charts and upgrade them to the latest available version within their current chart release line. This helps ensure compatibility and avoids potential issues during or after the Rancher upgrade. + +To review installed feature charts: + +1. In the Rancher UI, go to **Apps & Marketplace**. +2. Select **Installed Apps**. +3. Review the chart versions and upgrade to the latest patch release within the same chart major version if needed. + +For more information, see the [Helm Charts in Rancher – Versioning Scheme](../../../how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md#versioning-scheme). + +### 4. Upgrade Rancher This section describes how to upgrade normal (Internet-connected) or air-gapped installations of Rancher with Helm. @@ -193,7 +206,7 @@ Alternatively, it's possible to export the current values to a file and referenc --version=2.6.8 ``` -### 4. Verify the Upgrade +### 5. Verify the Upgrade Log into Rancher to confirm that the upgrade succeeded. diff --git a/versioned_docs/version-2.11/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md b/versioned_docs/version-2.11/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md index f6c7154d3a0..1c16b57b96c 100644 --- a/versioned_docs/version-2.11/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md +++ b/versioned_docs/version-2.11/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md @@ -107,8 +107,21 @@ You'll use the backup as a restore point if something goes wrong during upgrade. ```plain helm fetch rancher-/rancher --version=2.6.8 ``` +### 3. Review Rancher Feature Chart Versions Before Upgrade -### 3. Upgrade Rancher +Rancher feature charts follow specific release lines that align with Rancher versions. Major versions of feature charts correspond to Rancher minor versions and follow a defined versioning scheme. + +Before upgrading Rancher, review any installed Rancher feature charts and upgrade them to the latest available version within their current chart release line. This helps ensure compatibility and avoids potential issues during or after the Rancher upgrade. + +To review installed feature charts: + +1. In the Rancher UI, go to **Apps & Marketplace**. +2. Select **Installed Apps**. +3. Review the chart versions and upgrade to the latest patch release within the same chart major version if needed. + +For more information, see the [Helm Charts in Rancher – Versioning Scheme](../../../how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md#versioning-scheme). + +### 4. Upgrade Rancher This section describes how to upgrade normal (Internet-connected) or air-gapped installations of Rancher with Helm. @@ -193,7 +206,7 @@ Alternatively, it's possible to export the current values to a file and referenc --version=2.6.8 ``` -### 4. Verify the Upgrade +### 5. Verify the Upgrade Log into Rancher to confirm that the upgrade succeeded. diff --git a/versioned_docs/version-2.12/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md b/versioned_docs/version-2.12/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md index 1c2ce244893..59dd423de46 100644 --- a/versioned_docs/version-2.12/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md +++ b/versioned_docs/version-2.12/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md @@ -104,8 +104,21 @@ You'll use the backup as a restore point if something goes wrong during upgrade. ```plain helm fetch rancher-/rancher --version=2.6.8 ``` +### 3. Review Rancher Feature Chart Versions Before Upgrade -### 3. Upgrade Rancher +Rancher feature charts follow specific release lines that align with Rancher versions. Major versions of feature charts correspond to Rancher minor versions and follow a defined versioning scheme. + +Before upgrading Rancher, review any installed Rancher feature charts and upgrade them to the latest available version within their current chart release line. This helps ensure compatibility and avoids potential issues during or after the Rancher upgrade. + +To review installed feature charts: + +1. In the Rancher UI, go to **Apps & Marketplace**. +2. Select **Installed Apps**. +3. Review the chart versions and upgrade to the latest patch release within the same chart major version if needed. + +For more information, see the [Helm Charts in Rancher – Versioning Scheme](../../../how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md#versioning-scheme). + +### 4. Upgrade Rancher This section describes how to upgrade normal (Internet-connected) or air-gapped installations of Rancher with Helm. @@ -190,7 +203,7 @@ Alternatively, it's possible to export the current values to a file and referenc --version=2.6.8 ``` -### 4. Verify the Upgrade +### 5. Verify the Upgrade Log into Rancher to confirm that the upgrade succeeded. diff --git a/versioned_docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md b/versioned_docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md index d4b8be7d061..f204f68f467 100644 --- a/versioned_docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md +++ b/versioned_docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md @@ -136,8 +136,21 @@ You'll use the backup as a restore point if something goes wrong during upgrade. ```plain helm fetch rancher-/rancher --version=2.6.8 ``` +### 3. Review Rancher Feature Chart Versions Before Upgrade -### 3. Upgrade Rancher +Rancher feature charts follow specific release lines that align with Rancher versions. Major versions of feature charts correspond to Rancher minor versions and follow a defined versioning scheme. + +Before upgrading Rancher, review any installed Rancher feature charts and upgrade them to the latest available version within their current chart release line. This helps ensure compatibility and avoids potential issues during or after the Rancher upgrade. + +To review installed feature charts: + +1. In the Rancher UI, go to **Apps & Marketplace**. +2. Select **Installed Apps**. +3. Review the chart versions and upgrade to the latest patch release within the same chart major version if needed. + +For more information, see the [Helm Charts in Rancher – Versioning Scheme](../../../how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md#versioning-scheme). + +### 4. Upgrade Rancher This section describes how to upgrade normal (Internet-connected) or air-gapped installations of Rancher with Helm. @@ -222,7 +235,7 @@ Alternatively, it's possible to export the current values to a file and referenc --version=2.6.8 ``` -### 4. Verify the Upgrade +### 5. Verify the Upgrade Log into Rancher to confirm that the upgrade succeeded. diff --git a/versioned_docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md b/versioned_docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md index d4b8be7d061..f204f68f467 100644 --- a/versioned_docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md +++ b/versioned_docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md @@ -136,8 +136,21 @@ You'll use the backup as a restore point if something goes wrong during upgrade. ```plain helm fetch rancher-/rancher --version=2.6.8 ``` +### 3. Review Rancher Feature Chart Versions Before Upgrade -### 3. Upgrade Rancher +Rancher feature charts follow specific release lines that align with Rancher versions. Major versions of feature charts correspond to Rancher minor versions and follow a defined versioning scheme. + +Before upgrading Rancher, review any installed Rancher feature charts and upgrade them to the latest available version within their current chart release line. This helps ensure compatibility and avoids potential issues during or after the Rancher upgrade. + +To review installed feature charts: + +1. In the Rancher UI, go to **Apps & Marketplace**. +2. Select **Installed Apps**. +3. Review the chart versions and upgrade to the latest patch release within the same chart major version if needed. + +For more information, see the [Helm Charts in Rancher – Versioning Scheme](../../../how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md#versioning-scheme). + +### 4. Upgrade Rancher This section describes how to upgrade normal (Internet-connected) or air-gapped installations of Rancher with Helm. @@ -222,7 +235,7 @@ Alternatively, it's possible to export the current values to a file and referenc --version=2.6.8 ``` -### 4. Verify the Upgrade +### 5. Verify the Upgrade Log into Rancher to confirm that the upgrade succeeded. From b336f5f47c7bcb24a69fe5723219f31c53977878 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Wed, 11 Mar 2026 15:56:19 -0700 Subject: [PATCH 07/12] Update banners to reflect current version status v2.10 will be EOL 2026-06 v2.11 EOM 2025-10 and will be EOL 2026-10 v2.12 EOM 2026-02 --- docusaurus.config.js | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/docusaurus.config.js b/docusaurus.config.js index e97de849ff2..7961bf04e81 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -197,17 +197,15 @@ module.exports = { "2.12": { label: "v2.12", path: "v2.12", - banner: "none" }, 2.11: { label: "v2.11", - path: "v2.11", - banner: "none", + path: "v2.11" }, "2.10": { label: "v2.10", path: "v2.10", - banner: "none", + className: 'toArchive' }, 2.9: { label: "v2.9 (Archived)", From 50736e012a292f9c2eb0e2cce53689270c6ad675 Mon Sep 17 00:00:00 2001 From: Lucas Saintarbor Date: Thu, 12 Mar 2026 08:46:15 -0700 Subject: [PATCH 08/12] Explain SAML and OpenLDAP Group Permissions (#2225) * Add SamlOpenLDAPGroupPermissions shared file * Add SamlOpenLDAPGroupPermissions shared file to Configure Keycloak (SAML) page * Add SamlOpenLDAPGroupPermissions shared file to Configure Okta (SAML) page * Add SamlOpenLDAPGroupPermissions shared file to Configure PingIdentity (SAML) page * Add SamlOpenLDAPGroupPermissions shared file to Configuring Rancher for Microsoft AD FS page * Add SamlOpenLDAPGroupPermissions shared file to Group Permissions with Shibboleth and OpenLDAP page * Add SamlOpenLDAPGroupPermissions shared file to other versions of Configure Keycloak (SAML) page * Add SamlOpenLDAPGroupPermissions shared file to other versions of Configure Okta (SAML) page * Add SamlOpenLDAPGroupPermissions shared file to other versions Configure PingIdentity (SAML) page * Add SamlOpenLDAPGroupPermissions shared file to other versions of Configuring Rancher for Microsoft AD FS page * Add SamlOpenLDAPGroupPermissions shared file to other versions of Group Permissions with Shibboleth and OpenLDAP page --- .../authentication-config/configure-keycloak-saml.md | 4 ++++ .../authentication-config/configure-okta-saml.md | 4 ++++ .../authentication-config/configure-pingidentity.md | 4 ++++ .../configure-rancher-for-ms-adfs.md | 4 ++++ .../about-group-permissions.md | 8 ++++++-- .../authentication-config/configure-keycloak-saml.md | 4 ++++ .../authentication-config/configure-okta-saml.md | 4 ++++ .../authentication-config/configure-pingidentity.md | 4 ++++ .../configure-rancher-for-ms-adfs.md | 4 ++++ .../about-group-permissions.md | 4 ++++ .../authentication-config/configure-keycloak-saml.md | 4 ++++ .../authentication-config/configure-okta-saml.md | 4 ++++ .../authentication-config/configure-pingidentity.md | 4 ++++ .../configure-rancher-for-ms-adfs.md | 4 ++++ .../about-group-permissions.md | 4 ++++ .../authentication-config/configure-keycloak-saml.md | 4 ++++ .../authentication-config/configure-okta-saml.md | 4 ++++ .../authentication-config/configure-pingidentity.md | 4 ++++ .../configure-rancher-for-ms-adfs.md | 4 ++++ .../about-group-permissions.md | 4 ++++ .../authentication-config/configure-keycloak-saml.md | 4 ++++ .../authentication-config/configure-okta-saml.md | 4 ++++ .../authentication-config/configure-pingidentity.md | 4 ++++ .../configure-rancher-for-ms-adfs.md | 4 ++++ .../about-group-permissions.md | 4 ++++ .../authentication-config/configure-keycloak-saml.md | 4 ++++ .../authentication-config/configure-okta-saml.md | 4 ++++ .../authentication-config/configure-pingidentity.md | 4 ++++ .../configure-rancher-for-ms-adfs.md | 4 ++++ .../about-group-permissions.md | 4 ++++ .../authentication-config/configure-keycloak-saml.md | 4 ++++ .../authentication-config/configure-okta-saml.md | 4 ++++ .../authentication-config/configure-pingidentity.md | 4 ++++ .../configure-rancher-for-ms-adfs.md | 4 ++++ .../about-group-permissions.md | 4 ++++ shared-files/_saml-openldap-group-permissions.md | 11 +++++++++++ src/theme/MDXComponents.js | 2 ++ .../authentication-config/configure-keycloak-saml.md | 4 ++++ .../authentication-config/configure-okta-saml.md | 4 ++++ .../authentication-config/configure-pingidentity.md | 4 ++++ .../configure-rancher-for-ms-adfs.md | 4 ++++ .../about-group-permissions.md | 8 ++++++-- .../authentication-config/configure-keycloak-saml.md | 4 ++++ .../authentication-config/configure-okta-saml.md | 4 ++++ .../authentication-config/configure-pingidentity.md | 4 ++++ .../configure-rancher-for-ms-adfs.md | 4 ++++ .../about-group-permissions.md | 8 ++++++-- .../authentication-config/configure-keycloak-saml.md | 4 ++++ .../authentication-config/configure-okta-saml.md | 4 ++++ .../authentication-config/configure-pingidentity.md | 4 ++++ .../configure-rancher-for-ms-adfs.md | 4 ++++ .../about-group-permissions.md | 8 ++++++-- .../authentication-config/configure-keycloak-saml.md | 4 ++++ .../authentication-config/configure-okta-saml.md | 4 ++++ .../authentication-config/configure-pingidentity.md | 4 ++++ .../configure-rancher-for-ms-adfs.md | 4 ++++ .../about-group-permissions.md | 8 ++++++-- .../authentication-config/configure-keycloak-saml.md | 4 ++++ .../authentication-config/configure-okta-saml.md | 4 ++++ .../authentication-config/configure-pingidentity.md | 4 ++++ .../configure-rancher-for-ms-adfs.md | 4 ++++ .../about-group-permissions.md | 8 ++++++-- 62 files changed, 265 insertions(+), 12 deletions(-) create mode 100644 shared-files/_saml-openldap-group-permissions.md diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md index 8eaf0a28eb1..90a32299dce 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md @@ -196,3 +196,7 @@ Try configuring and saving keycloak as your SAML provider and then accessing the ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md index b16d92780dc..7ae94eab8b7 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md @@ -112,3 +112,7 @@ If you experience issues when you test the connection to the OpenLDAP server, en ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + \ No newline at end of file diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md index fb778648405..b5919069938 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md @@ -68,3 +68,7 @@ Note that these URLs will not return valid data until the authentication configu ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md index b2785bd83f0..0d2108c319f 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md @@ -55,3 +55,7 @@ openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -da ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + \ No newline at end of file diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md index a51b1328cd0..d476a771b9c 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md @@ -10,14 +10,14 @@ Because Shibboleth is a SAML provider, it doesn't support searching for groups. One solution to this problem is to configure an OpenLDAP identity provider. With an OpenLDAP back end for Shibboleth, you will be able to search for groups in Rancher and assign them to resources such as clusters, projects, or namespaces from the Rancher UI. -### Terminology +## Terminology - **Shibboleth** is a single sign-on log-in system for computer networks and the Internet. It allows people to sign in using just one identity to various systems. It validates user credentials, but does not, on its own, handle group memberships. - **SAML:** Security Assertion Markup Language, an open standard for exchanging authentication and authorization data between an identity provider and a service provider. - **OpenLDAP:** a free, open-source implementation of the Lightweight Directory Access Protocol (LDAP). It is used to manage an organization’s computers and users. OpenLDAP is useful for Rancher users because it supports groups. In Rancher, it is possible to assign permissions to groups so that they can access resources such as clusters, projects, or namespaces, as long as the groups already exist in the identity provider. - **IdP or IDP:** An identity provider. OpenLDAP is an example of an identity provider. -### Adding OpenLDAP Group Permissions to Rancher Resources +## Adding OpenLDAP Group Permissions to Rancher Resources The diagram below illustrates how members of an OpenLDAP group can access resources in Rancher that the group has permissions for. @@ -30,3 +30,7 @@ When a member of the OpenLDAP group logs in to Rancher, she is redirected to Shi Shibboleth validates her credentials, and retrieves user attributes from OpenLDAP, including groups. Then Shibboleth sends a SAML assertion to Rancher including the user attributes. Rancher uses the group data so that she can access all of the resources and permissions that her groups have permissions for. ![Adding OpenLDAP Group Permissions to Rancher Resources](/img/shibboleth-with-openldap-groups.svg) + +## SAML and OpenLDAP Group Permissions + + diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md b/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md index 9fbe04001f1..60ddb129b0e 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md +++ b/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md @@ -192,3 +192,7 @@ openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout myservice.ke ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md b/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md index 7e0ff7decb6..8e2422dc163 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md +++ b/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md @@ -109,3 +109,7 @@ OpenLDAP ServiceAccount 用于所有搜索。无论用户个人的 SAML 权限 ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md b/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md index a37eb4015e3..c40b63dcab9 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md +++ b/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md @@ -64,3 +64,7 @@ title: 配置 PingIdentity (SAML) ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md b/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md index b29f42313d8..27f04ea6ea9 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md +++ b/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md @@ -55,3 +55,7 @@ openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -da ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md b/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md index ab226898b81..dd18c89969f 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md +++ b/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md @@ -30,3 +30,7 @@ title: Shibboleth 和 OpenLDAP 的组权限 Shibboleth 会验证用户的凭证，并从 OpenLDAP 检索用户属性，其中包括用户所在的组信息。然后 Shibboleth 将向 Rancher 发送一个包含用户属性的 SAML 断言。Rancher 会使用组数据，以便用户可以访问他所在的组有权访问的所有资源。 ![Adding OpenLDAP Group Permissions to Rancher Resources](/img/shibboleth-with-openldap-groups.svg) + +## SAML and OpenLDAP Group Permissions + + diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md index 9fbe04001f1..60ddb129b0e 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md @@ -192,3 +192,7 @@ openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout myservice.ke ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md index 7e0ff7decb6..8e2422dc163 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md @@ -109,3 +109,7 @@ OpenLDAP ServiceAccount 用于所有搜索。无论用户个人的 SAML 权限 ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md index a37eb4015e3..c40b63dcab9 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md @@ -64,3 +64,7 @@ title: 配置 PingIdentity (SAML) ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md index b29f42313d8..27f04ea6ea9 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md @@ -55,3 +55,7 @@ openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -da ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md index ab226898b81..dd18c89969f 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md @@ -30,3 +30,7 @@ title: Shibboleth 和 OpenLDAP 的组权限 Shibboleth 会验证用户的凭证，并从 OpenLDAP 检索用户属性，其中包括用户所在的组信息。然后 Shibboleth 将向 Rancher 发送一个包含用户属性的 SAML 断言。Rancher 会使用组数据，以便用户可以访问他所在的组有权访问的所有资源。 ![Adding OpenLDAP Group Permissions to Rancher Resources](/img/shibboleth-with-openldap-groups.svg) + +## SAML and OpenLDAP Group Permissions + + diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md index 9fbe04001f1..60ddb129b0e 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md @@ -192,3 +192,7 @@ openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout myservice.ke ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md index 7e0ff7decb6..8e2422dc163 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md @@ -109,3 +109,7 @@ OpenLDAP ServiceAccount 用于所有搜索。无论用户个人的 SAML 权限 ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md index a37eb4015e3..c40b63dcab9 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md @@ -64,3 +64,7 @@ title: 配置 PingIdentity (SAML) ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md index b29f42313d8..27f04ea6ea9 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md @@ -55,3 +55,7 @@ openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -da ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md index ab226898b81..dd18c89969f 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md @@ -30,3 +30,7 @@ title: Shibboleth 和 OpenLDAP 的组权限 Shibboleth 会验证用户的凭证，并从 OpenLDAP 检索用户属性，其中包括用户所在的组信息。然后 Shibboleth 将向 Rancher 发送一个包含用户属性的 SAML 断言。Rancher 会使用组数据，以便用户可以访问他所在的组有权访问的所有资源。 ![Adding OpenLDAP Group Permissions to Rancher Resources](/img/shibboleth-with-openldap-groups.svg) + +## SAML and OpenLDAP Group Permissions + + diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md index 9fbe04001f1..60ddb129b0e 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md @@ -192,3 +192,7 @@ openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout myservice.ke ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md index 7e0ff7decb6..8e2422dc163 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md @@ -109,3 +109,7 @@ OpenLDAP ServiceAccount 用于所有搜索。无论用户个人的 SAML 权限 ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md index a37eb4015e3..c40b63dcab9 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md @@ -64,3 +64,7 @@ title: 配置 PingIdentity (SAML) ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md index b29f42313d8..27f04ea6ea9 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md @@ -55,3 +55,7 @@ openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -da ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md index ab226898b81..dd18c89969f 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md @@ -30,3 +30,7 @@ title: Shibboleth 和 OpenLDAP 的组权限 Shibboleth 会验证用户的凭证，并从 OpenLDAP 检索用户属性，其中包括用户所在的组信息。然后 Shibboleth 将向 Rancher 发送一个包含用户属性的 SAML 断言。Rancher 会使用组数据，以便用户可以访问他所在的组有权访问的所有资源。 ![Adding OpenLDAP Group Permissions to Rancher Resources](/img/shibboleth-with-openldap-groups.svg) + +## SAML and OpenLDAP Group Permissions + + diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md index 9fbe04001f1..60ddb129b0e 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md @@ -192,3 +192,7 @@ openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout myservice.ke ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md index 7e0ff7decb6..8e2422dc163 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md @@ -109,3 +109,7 @@ OpenLDAP ServiceAccount 用于所有搜索。无论用户个人的 SAML 权限 ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md index a37eb4015e3..c40b63dcab9 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md @@ -64,3 +64,7 @@ title: 配置 PingIdentity (SAML) ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md index b29f42313d8..27f04ea6ea9 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md @@ -55,3 +55,7 @@ openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -da ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md index ab226898b81..dd18c89969f 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md @@ -30,3 +30,7 @@ title: Shibboleth 和 OpenLDAP 的组权限 Shibboleth 会验证用户的凭证，并从 OpenLDAP 检索用户属性，其中包括用户所在的组信息。然后 Shibboleth 将向 Rancher 发送一个包含用户属性的 SAML 断言。Rancher 会使用组数据，以便用户可以访问他所在的组有权访问的所有资源。 ![Adding OpenLDAP Group Permissions to Rancher Resources](/img/shibboleth-with-openldap-groups.svg) + +## SAML and OpenLDAP Group Permissions + + diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md index 9fbe04001f1..60ddb129b0e 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md @@ -192,3 +192,7 @@ openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout myservice.ke ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md index 7e0ff7decb6..8e2422dc163 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md @@ -109,3 +109,7 @@ OpenLDAP ServiceAccount 用于所有搜索。无论用户个人的 SAML 权限 ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md index a37eb4015e3..c40b63dcab9 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md @@ -64,3 +64,7 @@ title: 配置 PingIdentity (SAML) ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md index b29f42313d8..27f04ea6ea9 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md @@ -55,3 +55,7 @@ openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -da ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md index ab226898b81..dd18c89969f 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md @@ -30,3 +30,7 @@ title: Shibboleth 和 OpenLDAP 的组权限 Shibboleth 会验证用户的凭证，并从 OpenLDAP 检索用户属性，其中包括用户所在的组信息。然后 Shibboleth 将向 Rancher 发送一个包含用户属性的 SAML 断言。Rancher 会使用组数据，以便用户可以访问他所在的组有权访问的所有资源。 ![Adding OpenLDAP Group Permissions to Rancher Resources](/img/shibboleth-with-openldap-groups.svg) + +## SAML and OpenLDAP Group Permissions + + diff --git a/shared-files/_saml-openldap-group-permissions.md b/shared-files/_saml-openldap-group-permissions.md new file mode 100644 index 00000000000..28ee56cb5dd --- /dev/null +++ b/shared-files/_saml-openldap-group-permissions.md @@ -0,0 +1,11 @@ +When you configure a SAML authentication provider backed by OpenLDAP, the SAML response might return only a subset of the groups that a user belongs to. The exact groups returned depend on the configuration of your external authentication provider. + +Rancher assigns user permissions based strictly on the groups provided in the SAML response. + +:::note + +Even if you can search for and view specific OpenLDAP groups in the Rancher UI, you cannot use them to assign permissions if they are missing from the SAML response. + +To assign permissions successfully, verify that your SAML authentication provider is configured to return all necessary OpenLDAP groups. + +::: diff --git a/src/theme/MDXComponents.js b/src/theme/MDXComponents.js index fc29fa7edc6..871d566aa20 100644 --- a/src/theme/MDXComponents.js +++ b/src/theme/MDXComponents.js @@ -15,6 +15,7 @@ import ConfigureSLO from '/shared-files/_configure-slo.md'; import ConfigureSLOOidc from '/shared-files/_configure-slo-oidc.md'; import EOLRKE1Warning from '/shared-files/_eol-rke1-warning.md'; import PermissionsWarning from '/shared-files/_permissions-warning.md'; +import SamlOpenLDAPGroupPermissions from '/shared-files/_saml-openldap-group-permissions.md'; export default { // Re-use the default mapping @@ -35,4 +36,5 @@ export default { DockerSupportWarning, EOLRKE1Warning, PermissionsWarning, + SamlOpenLDAPGroupPermissions, }; diff --git a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md index 8eaf0a28eb1..90a32299dce 100644 --- a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md +++ b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md @@ -196,3 +196,7 @@ Try configuring and saving keycloak as your SAML provider and then accessing the ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md index b16d92780dc..c1c48e0438c 100644 --- a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md +++ b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md @@ -112,3 +112,7 @@ If you experience issues when you test the connection to the OpenLDAP server, en ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md index fb778648405..b5919069938 100644 --- a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md +++ b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md @@ -68,3 +68,7 @@ Note that these URLs will not return valid data until the authentication configu ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md index b2785bd83f0..c8f83bdcf57 100644 --- a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md +++ b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md @@ -55,3 +55,7 @@ openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -da ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md index a51b1328cd0..d476a771b9c 100644 --- a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md +++ b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md @@ -10,14 +10,14 @@ Because Shibboleth is a SAML provider, it doesn't support searching for groups. One solution to this problem is to configure an OpenLDAP identity provider. With an OpenLDAP back end for Shibboleth, you will be able to search for groups in Rancher and assign them to resources such as clusters, projects, or namespaces from the Rancher UI. -### Terminology +## Terminology - **Shibboleth** is a single sign-on log-in system for computer networks and the Internet. It allows people to sign in using just one identity to various systems. It validates user credentials, but does not, on its own, handle group memberships. - **SAML:** Security Assertion Markup Language, an open standard for exchanging authentication and authorization data between an identity provider and a service provider. - **OpenLDAP:** a free, open-source implementation of the Lightweight Directory Access Protocol (LDAP). It is used to manage an organization’s computers and users. OpenLDAP is useful for Rancher users because it supports groups. In Rancher, it is possible to assign permissions to groups so that they can access resources such as clusters, projects, or namespaces, as long as the groups already exist in the identity provider. - **IdP or IDP:** An identity provider. OpenLDAP is an example of an identity provider. -### Adding OpenLDAP Group Permissions to Rancher Resources +## Adding OpenLDAP Group Permissions to Rancher Resources The diagram below illustrates how members of an OpenLDAP group can access resources in Rancher that the group has permissions for. @@ -30,3 +30,7 @@ When a member of the OpenLDAP group logs in to Rancher, she is redirected to Shi Shibboleth validates her credentials, and retrieves user attributes from OpenLDAP, including groups. Then Shibboleth sends a SAML assertion to Rancher including the user attributes. Rancher uses the group data so that she can access all of the resources and permissions that her groups have permissions for. ![Adding OpenLDAP Group Permissions to Rancher Resources](/img/shibboleth-with-openldap-groups.svg) + +## SAML and OpenLDAP Group Permissions + + diff --git a/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md b/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md index 8eaf0a28eb1..90a32299dce 100644 --- a/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md +++ b/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md @@ -196,3 +196,7 @@ Try configuring and saving keycloak as your SAML provider and then accessing the ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md b/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md index b16d92780dc..c1c48e0438c 100644 --- a/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md +++ b/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md @@ -112,3 +112,7 @@ If you experience issues when you test the connection to the OpenLDAP server, en ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md b/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md index fb778648405..b5919069938 100644 --- a/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md +++ b/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md @@ -68,3 +68,7 @@ Note that these URLs will not return valid data until the authentication configu ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md b/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md index b2785bd83f0..c8f83bdcf57 100644 --- a/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md +++ b/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md @@ -55,3 +55,7 @@ openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -da ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md b/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md index a51b1328cd0..d476a771b9c 100644 --- a/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md +++ b/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md @@ -10,14 +10,14 @@ Because Shibboleth is a SAML provider, it doesn't support searching for groups. One solution to this problem is to configure an OpenLDAP identity provider. With an OpenLDAP back end for Shibboleth, you will be able to search for groups in Rancher and assign them to resources such as clusters, projects, or namespaces from the Rancher UI. -### Terminology +## Terminology - **Shibboleth** is a single sign-on log-in system for computer networks and the Internet. It allows people to sign in using just one identity to various systems. It validates user credentials, but does not, on its own, handle group memberships. - **SAML:** Security Assertion Markup Language, an open standard for exchanging authentication and authorization data between an identity provider and a service provider. - **OpenLDAP:** a free, open-source implementation of the Lightweight Directory Access Protocol (LDAP). It is used to manage an organization’s computers and users. OpenLDAP is useful for Rancher users because it supports groups. In Rancher, it is possible to assign permissions to groups so that they can access resources such as clusters, projects, or namespaces, as long as the groups already exist in the identity provider. - **IdP or IDP:** An identity provider. OpenLDAP is an example of an identity provider. -### Adding OpenLDAP Group Permissions to Rancher Resources +## Adding OpenLDAP Group Permissions to Rancher Resources The diagram below illustrates how members of an OpenLDAP group can access resources in Rancher that the group has permissions for. @@ -30,3 +30,7 @@ When a member of the OpenLDAP group logs in to Rancher, she is redirected to Shi Shibboleth validates her credentials, and retrieves user attributes from OpenLDAP, including groups. Then Shibboleth sends a SAML assertion to Rancher including the user attributes. Rancher uses the group data so that she can access all of the resources and permissions that her groups have permissions for. ![Adding OpenLDAP Group Permissions to Rancher Resources](/img/shibboleth-with-openldap-groups.svg) + +## SAML and OpenLDAP Group Permissions + + diff --git a/versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md b/versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md index 8eaf0a28eb1..90a32299dce 100644 --- a/versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md +++ b/versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md @@ -196,3 +196,7 @@ Try configuring and saving keycloak as your SAML provider and then accessing the ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md b/versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md index b16d92780dc..c1c48e0438c 100644 --- a/versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md +++ b/versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md @@ -112,3 +112,7 @@ If you experience issues when you test the connection to the OpenLDAP server, en ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md b/versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md index fb778648405..b5919069938 100644 --- a/versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md +++ b/versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md @@ -68,3 +68,7 @@ Note that these URLs will not return valid data until the authentication configu ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md b/versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md index b2785bd83f0..c8f83bdcf57 100644 --- a/versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md +++ b/versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md @@ -55,3 +55,7 @@ openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -da ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md b/versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md index a51b1328cd0..d476a771b9c 100644 --- a/versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md +++ b/versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md @@ -10,14 +10,14 @@ Because Shibboleth is a SAML provider, it doesn't support searching for groups. One solution to this problem is to configure an OpenLDAP identity provider. With an OpenLDAP back end for Shibboleth, you will be able to search for groups in Rancher and assign them to resources such as clusters, projects, or namespaces from the Rancher UI. -### Terminology +## Terminology - **Shibboleth** is a single sign-on log-in system for computer networks and the Internet. It allows people to sign in using just one identity to various systems. It validates user credentials, but does not, on its own, handle group memberships. - **SAML:** Security Assertion Markup Language, an open standard for exchanging authentication and authorization data between an identity provider and a service provider. - **OpenLDAP:** a free, open-source implementation of the Lightweight Directory Access Protocol (LDAP). It is used to manage an organization’s computers and users. OpenLDAP is useful for Rancher users because it supports groups. In Rancher, it is possible to assign permissions to groups so that they can access resources such as clusters, projects, or namespaces, as long as the groups already exist in the identity provider. - **IdP or IDP:** An identity provider. OpenLDAP is an example of an identity provider. -### Adding OpenLDAP Group Permissions to Rancher Resources +## Adding OpenLDAP Group Permissions to Rancher Resources The diagram below illustrates how members of an OpenLDAP group can access resources in Rancher that the group has permissions for. @@ -30,3 +30,7 @@ When a member of the OpenLDAP group logs in to Rancher, she is redirected to Shi Shibboleth validates her credentials, and retrieves user attributes from OpenLDAP, including groups. Then Shibboleth sends a SAML assertion to Rancher including the user attributes. Rancher uses the group data so that she can access all of the resources and permissions that her groups have permissions for. ![Adding OpenLDAP Group Permissions to Rancher Resources](/img/shibboleth-with-openldap-groups.svg) + +## SAML and OpenLDAP Group Permissions + + diff --git a/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md b/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md index 8eaf0a28eb1..90a32299dce 100644 --- a/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md +++ b/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md @@ -196,3 +196,7 @@ Try configuring and saving keycloak as your SAML provider and then accessing the ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md b/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md index b16d92780dc..c1c48e0438c 100644 --- a/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md +++ b/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md @@ -112,3 +112,7 @@ If you experience issues when you test the connection to the OpenLDAP server, en ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md b/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md index fb778648405..b5919069938 100644 --- a/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md +++ b/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md @@ -68,3 +68,7 @@ Note that these URLs will not return valid data until the authentication configu ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md b/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md index b2785bd83f0..c8f83bdcf57 100644 --- a/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md +++ b/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md @@ -55,3 +55,7 @@ openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -da ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md b/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md index a51b1328cd0..d476a771b9c 100644 --- a/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md +++ b/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md @@ -10,14 +10,14 @@ Because Shibboleth is a SAML provider, it doesn't support searching for groups. One solution to this problem is to configure an OpenLDAP identity provider. With an OpenLDAP back end for Shibboleth, you will be able to search for groups in Rancher and assign them to resources such as clusters, projects, or namespaces from the Rancher UI. -### Terminology +## Terminology - **Shibboleth** is a single sign-on log-in system for computer networks and the Internet. It allows people to sign in using just one identity to various systems. It validates user credentials, but does not, on its own, handle group memberships. - **SAML:** Security Assertion Markup Language, an open standard for exchanging authentication and authorization data between an identity provider and a service provider. - **OpenLDAP:** a free, open-source implementation of the Lightweight Directory Access Protocol (LDAP). It is used to manage an organization’s computers and users. OpenLDAP is useful for Rancher users because it supports groups. In Rancher, it is possible to assign permissions to groups so that they can access resources such as clusters, projects, or namespaces, as long as the groups already exist in the identity provider. - **IdP or IDP:** An identity provider. OpenLDAP is an example of an identity provider. -### Adding OpenLDAP Group Permissions to Rancher Resources +## Adding OpenLDAP Group Permissions to Rancher Resources The diagram below illustrates how members of an OpenLDAP group can access resources in Rancher that the group has permissions for. @@ -30,3 +30,7 @@ When a member of the OpenLDAP group logs in to Rancher, she is redirected to Shi Shibboleth validates her credentials, and retrieves user attributes from OpenLDAP, including groups. Then Shibboleth sends a SAML assertion to Rancher including the user attributes. Rancher uses the group data so that she can access all of the resources and permissions that her groups have permissions for. ![Adding OpenLDAP Group Permissions to Rancher Resources](/img/shibboleth-with-openldap-groups.svg) + +## SAML and OpenLDAP Group Permissions + + diff --git a/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md b/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md index 8eaf0a28eb1..90a32299dce 100644 --- a/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md +++ b/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-saml.md @@ -196,3 +196,7 @@ Try configuring and saving keycloak as your SAML provider and then accessing the ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md b/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md index b16d92780dc..7ae94eab8b7 100644 --- a/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md +++ b/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-okta-saml.md @@ -112,3 +112,7 @@ If you experience issues when you test the connection to the OpenLDAP server, en ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + \ No newline at end of file diff --git a/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md b/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md index fb778648405..e7be4b39c56 100644 --- a/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md +++ b/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-pingidentity.md @@ -68,3 +68,7 @@ Note that these URLs will not return valid data until the authentication configu ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + \ No newline at end of file diff --git a/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md b/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md index b2785bd83f0..c8f83bdcf57 100644 --- a/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md +++ b/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-microsoft-ad-federation-service-saml/configure-rancher-for-ms-adfs.md @@ -55,3 +55,7 @@ openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -da ## Configuring SAML Single Logout (SLO) + +## SAML and OpenLDAP Group Permissions + + diff --git a/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md b/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md index a51b1328cd0..442d2c5e00c 100644 --- a/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md +++ b/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/configure-shibboleth-saml/about-group-permissions.md @@ -10,14 +10,14 @@ Because Shibboleth is a SAML provider, it doesn't support searching for groups. One solution to this problem is to configure an OpenLDAP identity provider. With an OpenLDAP back end for Shibboleth, you will be able to search for groups in Rancher and assign them to resources such as clusters, projects, or namespaces from the Rancher UI. -### Terminology +## Terminology - **Shibboleth** is a single sign-on log-in system for computer networks and the Internet. It allows people to sign in using just one identity to various systems. It validates user credentials, but does not, on its own, handle group memberships. - **SAML:** Security Assertion Markup Language, an open standard for exchanging authentication and authorization data between an identity provider and a service provider. - **OpenLDAP:** a free, open-source implementation of the Lightweight Directory Access Protocol (LDAP). It is used to manage an organization’s computers and users. OpenLDAP is useful for Rancher users because it supports groups. In Rancher, it is possible to assign permissions to groups so that they can access resources such as clusters, projects, or namespaces, as long as the groups already exist in the identity provider. - **IdP or IDP:** An identity provider. OpenLDAP is an example of an identity provider. -### Adding OpenLDAP Group Permissions to Rancher Resources +## Adding OpenLDAP Group Permissions to Rancher Resources The diagram below illustrates how members of an OpenLDAP group can access resources in Rancher that the group has permissions for. @@ -30,3 +30,7 @@ When a member of the OpenLDAP group logs in to Rancher, she is redirected to Shi Shibboleth validates her credentials, and retrieves user attributes from OpenLDAP, including groups. Then Shibboleth sends a SAML assertion to Rancher including the user attributes. Rancher uses the group data so that she can access all of the resources and permissions that her groups have permissions for. ![Adding OpenLDAP Group Permissions to Rancher Resources](/img/shibboleth-with-openldap-groups.svg) + +## SAML and OpenLDAP Group Permissions + + \ No newline at end of file From e88572c810cd6b1304835931ac0ed5aa90d74806 Mon Sep 17 00:00:00 2001 From: Manuel Buil Date: Thu, 12 Mar 2026 17:11:56 +0100 Subject: [PATCH 09/12] Add Traefik migration to docs and backports (#2184) Signed-off-by: Manuel Buil Co-authored-by: Petr Kovar --- .../rancher-on-aks.md | 56 ++++++++----------- .../rancher-on-amazon-eks.md | 54 +++++++++--------- .../rancher-on-gke.md | 41 +++++++++----- .../rancher-on-aks.md | 56 ++++++++----------- .../rancher-on-amazon-eks.md | 54 +++++++++--------- .../rancher-on-gke.md | 41 +++++++++----- .../rancher-on-aks.md | 56 ++++++++----------- .../rancher-on-amazon-eks.md | 54 +++++++++--------- .../rancher-on-gke.md | 41 +++++++++----- .../rancher-on-aks.md | 56 ++++++++----------- .../rancher-on-amazon-eks.md | 54 +++++++++--------- .../rancher-on-gke.md | 41 +++++++++----- .../rancher-on-aks.md | 56 ++++++++----------- .../rancher-on-amazon-eks.md | 54 +++++++++--------- .../rancher-on-gke.md | 41 +++++++++----- .../rancher-on-aks.md | 56 ++++++++----------- .../rancher-on-amazon-eks.md | 54 +++++++++--------- .../rancher-on-gke.md | 41 +++++++++----- 18 files changed, 462 insertions(+), 444 deletions(-) diff --git a/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks.md b/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks.md index 6aa9bfda5ac..0d299ca6317 100644 --- a/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks.md +++ b/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks.md @@ -52,12 +52,6 @@ az group create --name rancher-rg --location eastus To create an AKS cluster, run the following command. Use a VM size that applies to your use case. Refer to [this article](https://docs.microsoft.com/en-us/azure/virtual-machines/sizes) for available sizes and options. When choosing a Kubernetes version, be sure to first consult the [support matrix](https://rancher.com/support-matrix/) to find the highest version of Kubernetes that has been validated for your Rancher version. -:::note - -If you're updating from an older version of Kubernetes, to Kubernetes v1.22 or above, you also need to [update](https://kubernetes.github.io/ingress-nginx/user-guide/k8s-122-migration/) ingress-nginx. - -::: - ``` az aks create \ --resource-group rancher-rg \ @@ -81,48 +75,46 @@ This command merges your cluster's credentials into the existing kubeconfig and ## 5. Install an Ingress -The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. Installing an Ingress requires allocating a public IP address. Ensure you have sufficient quota, otherwise it will fail to assign the IP address. Limits for public IP addresses are applicable at a regional level per subscription. +The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. Installing an Ingress requires allocating a public IP address. Ensure you have sufficient quota, otherwise it will fail to assign the IP address. Limits for public IP addresses are applicable at a regional level per subscription. You can use a managed ingress controller provided by Azure or a third-party ingress controller like Traefik. -To make sure that you choose the correct Ingress-NGINX Helm chart, first find an `Ingress-NGINX version` that's compatible with your Kubernetes version in the [Kubernetes/ingress-nginx support table](https://github.com/kubernetes/ingress-nginx#supported-versions-table). +:::warning +It is not recommended to install a third-party ingress controller, like Traefik, if a managed ingress controller is already being used. +::: -Then, list the Helm charts available to you by running the following command: +:::warning +**Ingress-NGINX EOL:** The community `ingress-nginx` controller reaches End-of-Life (EOL) in March 2026. This page uses Traefik, which is the recommended migration path for Rancher environments. +::: -``` -helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx +Traefik includes a native Ingress NGINX provider. This allows you to migrate from NGINX without rewriting your existing Ingress objects, as Traefik will automatically interpret `nginx.ingress.kubernetes.io` annotations. If you are upgrading a cluster that is already using `ingress-nginx`, follow this [guide](https://doc.traefik.io/traefik/migrate/nginx-to-traefik/) for more information. + +To install Traefik (chart version 39.0.0) on a fresh cluster, run the following `helm` commands: +```bash +helm repo add traefik https://traefik.github.io/charts helm repo update -helm search repo ingress-nginx -l -``` - -The `helm search` command's output contains an `APP VERSION` column. The versions under this column are equivalent to the `Ingress-NGINX version` you chose earlier. Using the app version, select a chart version that bundles an app compatible with your Kubernetes install. For example, if you have Kubernetes v1.24, you can select the v4.6.0 Helm chart, since Ingress-NGINX v1.7.0 comes bundled with that chart, and v1.7.0 is compatible with Kubernetes v1.24. When in doubt, select the most recent compatible version. - -Now that you know which Helm chart `version` you need, run the following command. It installs an `nginx-ingress-controller` with a Kubernetes load balancer service: - -``` -helm search repo ingress-nginx -l helm upgrade --install \ - ingress-nginx ingress-nginx/ingress-nginx \ - --namespace ingress-nginx \ - --set controller.service.type=LoadBalancer \ - --set controller.service.annotations."service\.beta\.kubernetes\.io/azure-load-balancer-health-probe-request-path"=/healthz \ - --set controller.service.externalTrafficPolicy=Local \ - --version 4.6.0 \ - --create-namespace + traefik traefik/traefik \ + --namespace traefik \ + --version 39.0.0 \ + --create-namespace \ + --set service.type=LoadBalancer \ + --set ping.enabled=true \ + --set service.annotations."service\.beta\.kubernetes\.io/azure-load-balancer-health-probe-request-path"=/ping ``` ## 6. Get Load Balancer IP To get the address of the load balancer, run: -``` -kubectl get service ingress-nginx-controller --namespace=ingress-nginx +```bash +kubectl get service traefik --namespace=traefik ``` The result should look similar to the following: -``` +```bash NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE -ingress-nginx-controller LoadBalancer 10.0.116.18 40.31.180.83 80:31229/TCP,443:31050/TCP +traefik LoadBalancer 10.0.116.18 40.31.180.83 80:31229/TCP,443:31050/TCP 67s ``` @@ -145,7 +137,7 @@ Use that DNS name from the previous step as the Rancher server URL when you inst When installing Rancher on top of this setup, you will also need to pass the value below into the Rancher Helm install command in order to set the name of the ingress controller to be used with Rancher's ingress resource: ``` ---set ingress.ingressClassName=nginx +--set ingress.ingressClassName=traefik ``` Refer [here for the Helm install command](install-upgrade-on-a-kubernetes-cluster.md#5-install-rancher-with-helm-and-your-chosen-certificate-option) for your chosen certificate option. diff --git a/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md b/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md index 85c83a2d503..6b9c38b344e 100644 --- a/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md +++ b/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md @@ -52,8 +52,6 @@ Then enter the following values: To create an EKS cluster, run the following command. Use the AWS region that applies to your use case. When choosing a Kubernetes version, be sure to first consult the [support matrix](https://rancher.com/support-matrix/) to find the highest version of Kubernetes that has been validated for your Rancher version. -**Note:** If you're updating from an older version of Kubernetes, to Kubernetes v1.22 or above, you also need to [update](https://kubernetes.github.io/ingress-nginx/user-guide/k8s-122-migration/) ingress-nginx. - ``` eksctl create cluster \ --name rancher-server \ @@ -88,46 +86,48 @@ rancher-server-cluster us-west-2 True ### 5. Install an Ingress -The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. +The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. Installing an Ingress requires allocating a public IP address. Ensure you have sufficient quota, otherwise it will fail to assign the IP address. Limits for public IP addresses are applicable at a regional level per subscription. You can use a managed ingress controller provided by AWS (ALB) or a third-party ingress controller like Traefik. -To make sure that you choose the correct Ingress-NGINX Helm chart, first find an `Ingress-NGINX version` that's compatible with your Kubernetes version in the [Kubernetes/ingress-nginx support table](https://github.com/kubernetes/ingress-nginx#supported-versions-table). +:::warning +It is not recommended to install a third-party ingress controller, like Traefik, if a managed ingress controller (ALB) is already being used. +::: -Then, list the Helm charts available to you by running the following command: -``` -helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx +:::warning +**Ingress-NGINX EOL:** The community `ingress-nginx` controller reaches End-of-Life (EOL) in March 2026. This page uses Traefik, which is the recommended migration path for Rancher environments. +::: + +Traefik includes a native Ingress NGINX provider. This allows you to migrate from NGINX without rewriting your existing Ingress objects, as Traefik will automatically interpret `nginx.ingress.kubernetes.io` annotations. If you are upgrading a cluster that is already using `ingress-nginx`, follow this [guide](https://doc.traefik.io/traefik/migrate/nginx-to-traefik/) for more information. + +To install Traefik (chart version 39.0.0) on a fresh cluster, run the following `helm` commands: +```bash +helm repo add traefik https://traefik.github.io/charts helm repo update -helm search repo ingress-nginx -l -``` - -The `helm search` command's output contains an `APP VERSION` column. The versions under this column are equivalent to the `Ingress-NGINX version` you chose earlier. Using the app version, select a chart version that bundles an app compatible with your Kubernetes install. For example, if you have Kubernetes v1.23, you can select the v4.6.0 Helm chart, since Ingress-NGINX v1.7.0 comes bundled with that chart, and v1.7.0 is compatible with Kubernetes v1.23. When in doubt, select the most recent compatible version. - -Now that you know which Helm chart `version` you need, run the following command. It installs an `nginx-ingress-controller` with a Kubernetes load balancer service: - -``` helm upgrade --install \ - ingress-nginx ingress-nginx/ingress-nginx \ - --namespace ingress-nginx \ - --set controller.service.type=LoadBalancer \ - --version 4.6.0 \ - --create-namespace + traefik traefik/traefik \ + --namespace traefik \ + --version 39.0.0 \ + --create-namespace \ + --set service.type=LoadBalancer \ + --set ping.enabled=true \ ``` + ### 6. Get Load Balancer IP To get the address of the load balancer, run: -``` -kubectl get service ingress-nginx-controller --namespace=ingress-nginx +```bash +kubectl get service traefik --namespace=traefik ``` The result should look similar to the following: -``` -NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) +```bash +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE -ingress-nginx-controller LoadBalancer 10.100.90.18 a904a952c73bf4f668a17c46ac7c56ab-962521486.us-west-2.elb.amazonaws.com 80:31229/TCP,443:31050/TCP - 27m +traefik LoadBalancer 10.100.90.18 a904a952c73bf4f668a17c46ac7c56ab-962521486.us-west-2.elb.amazonaws.com 80:31229/TCP,443:31050/TCP + 67s ``` Save the `EXTERNAL-IP`. @@ -149,7 +149,7 @@ Use that DNS name from the previous step as the Rancher server URL when you inst When installing Rancher on top of this setup, you will also need to pass the value below into the Rancher Helm install command in order to set the name of the ingress controller to be used with Rancher's ingress resource: ``` ---set ingress.ingressClassName=nginx +--set ingress.ingressClassName=traefik ``` Refer [here for the Helm install command](install-upgrade-on-a-kubernetes-cluster.md#5-install-rancher-with-helm-and-your-chosen-certificate-option) for your chosen certificate option. diff --git a/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke.md b/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke.md index a3c3518e4c0..093c5fb589e 100644 --- a/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke.md +++ b/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke.md @@ -124,7 +124,6 @@ When choosing a Kubernetes version, be sure to first consult the [support matrix To successfully create a GKE cluster with Rancher, your GKE must be in Standard mode. GKE has two modes of operation when creating a Kubernetes cluster, Autopilot and Standard mode. The cluster configuration for Autopilot mode has restrictions on editing the kube-system namespace. However, Rancher needs to create resources in the kube-system namespace during installation. As a result, you will not be able to install Rancher on a GKE cluster created in Autopilot mode. For more information about the difference between GKE Autopilot mode and Standard mode, visit [Compare GKE Autopilot and Standard.](https://cloud.google.com/kubernetes-engine/docs/resources/autopilot-standard-feature-comparison) -**Note:** If you're updating from an older version of Kubernetes, to Kubernetes v1.22 or above, you also need to [update](https://kubernetes.github.io/ingress-nginx/user-guide/k8s-122-migration/) ingress-nginx. ``` gcloud container clusters create cluster-name --num-nodes=3 --cluster-version= @@ -140,36 +139,48 @@ gcloud container clusters get-credentials cluster-name This command configures `kubectl` to use the cluster you created. + ## 7. Install an Ingress -The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. +The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. Installing an Ingress requires allocating a public IP address. Ensure you have sufficient quota, otherwise it will fail to assign the IP address. Limits for public IP addresses are applicable at a regional level per subscription. You can use a managed ingress controller provided by GCP or a third-party ingress controller like Traefik. -The following command installs an `nginx-ingress-controller` with a LoadBalancer service: +:::warning +It is not recommended to install a third-party ingress controller, like Traefik, if a managed ingress controller is already being used. +::: -``` -helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx +:::warning +**Ingress-NGINX EOL:** The community `ingress-nginx` controller reaches End-of-Life (EOL) in March 2026. This page uses Traefik, which is the recommended migration path for Rancher environments. +::: + +Traefik includes a native Ingress NGINX provider. This allows you to migrate from NGINX without rewriting your existing Ingress objects, as Traefik will automatically interpret `nginx.ingress.kubernetes.io` annotations. If you are upgrading a cluster that is already using `ingress-nginx`, follow this [guide](https://doc.traefik.io/traefik/migrate/nginx-to-traefik/) for more information. + +To install Traefik (chart version 39.0.0) on a fresh cluster, run the following `helm` commands: +```bash +helm repo add traefik https://traefik.github.io/charts helm repo update helm upgrade --install \ - ingress-nginx ingress-nginx/ingress-nginx \ - --namespace ingress-nginx \ - --set controller.service.type=LoadBalancer \ - --version 4.0.18 \ - --create-namespace + traefik traefik/traefik \ + --namespace traefik \ + --version 39.0.0 \ + --create-namespace \ + --set service.type=LoadBalancer \ + --set ping.enabled=true \ ``` -## 8. Get the Load Balancer IP + +## 8. Get Load Balancer IP To get the address of the load balancer, run: -``` -kubectl get service ingress-nginx-controller --namespace=ingress-nginx +```bash +kubectl get service traefik --namespace=traefik ``` The result should look similar to the following: ``` NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE -ingress-nginx-controller LoadBalancer 10.3.244.156 35.233.206.34 80:31876/TCP,443:32497/TCP 81s +traefik LoadBalancer 10.3.244.156 35.233.206.34 80:31876/TCP,443:32497/TCP 81s ``` Save the `EXTERNAL-IP`. @@ -191,7 +202,7 @@ Use the DNS name from the previous step as the Rancher server URL when you insta When installing Rancher on top of this setup, you will also need to set the name of the ingress controller to be used with Rancher's ingress resource: ``` ---set ingress.ingressClassName=nginx +--set ingress.ingressClassName=traefik ``` Refer [here for the Helm install command](install-upgrade-on-a-kubernetes-cluster.md#5-install-rancher-with-helm-and-your-chosen-certificate-option) for your chosen certificate option. diff --git a/versioned_docs/version-2.10/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks.md b/versioned_docs/version-2.10/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks.md index 6aa9bfda5ac..0d299ca6317 100644 --- a/versioned_docs/version-2.10/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks.md +++ b/versioned_docs/version-2.10/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks.md @@ -52,12 +52,6 @@ az group create --name rancher-rg --location eastus To create an AKS cluster, run the following command. Use a VM size that applies to your use case. Refer to [this article](https://docs.microsoft.com/en-us/azure/virtual-machines/sizes) for available sizes and options. When choosing a Kubernetes version, be sure to first consult the [support matrix](https://rancher.com/support-matrix/) to find the highest version of Kubernetes that has been validated for your Rancher version. -:::note - -If you're updating from an older version of Kubernetes, to Kubernetes v1.22 or above, you also need to [update](https://kubernetes.github.io/ingress-nginx/user-guide/k8s-122-migration/) ingress-nginx. - -::: - ``` az aks create \ --resource-group rancher-rg \ @@ -81,48 +75,46 @@ This command merges your cluster's credentials into the existing kubeconfig and ## 5. Install an Ingress -The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. Installing an Ingress requires allocating a public IP address. Ensure you have sufficient quota, otherwise it will fail to assign the IP address. Limits for public IP addresses are applicable at a regional level per subscription. +The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. Installing an Ingress requires allocating a public IP address. Ensure you have sufficient quota, otherwise it will fail to assign the IP address. Limits for public IP addresses are applicable at a regional level per subscription. You can use a managed ingress controller provided by Azure or a third-party ingress controller like Traefik. -To make sure that you choose the correct Ingress-NGINX Helm chart, first find an `Ingress-NGINX version` that's compatible with your Kubernetes version in the [Kubernetes/ingress-nginx support table](https://github.com/kubernetes/ingress-nginx#supported-versions-table). +:::warning +It is not recommended to install a third-party ingress controller, like Traefik, if a managed ingress controller is already being used. +::: -Then, list the Helm charts available to you by running the following command: +:::warning +**Ingress-NGINX EOL:** The community `ingress-nginx` controller reaches End-of-Life (EOL) in March 2026. This page uses Traefik, which is the recommended migration path for Rancher environments. +::: -``` -helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx +Traefik includes a native Ingress NGINX provider. This allows you to migrate from NGINX without rewriting your existing Ingress objects, as Traefik will automatically interpret `nginx.ingress.kubernetes.io` annotations. If you are upgrading a cluster that is already using `ingress-nginx`, follow this [guide](https://doc.traefik.io/traefik/migrate/nginx-to-traefik/) for more information. + +To install Traefik (chart version 39.0.0) on a fresh cluster, run the following `helm` commands: +```bash +helm repo add traefik https://traefik.github.io/charts helm repo update -helm search repo ingress-nginx -l -``` - -The `helm search` command's output contains an `APP VERSION` column. The versions under this column are equivalent to the `Ingress-NGINX version` you chose earlier. Using the app version, select a chart version that bundles an app compatible with your Kubernetes install. For example, if you have Kubernetes v1.24, you can select the v4.6.0 Helm chart, since Ingress-NGINX v1.7.0 comes bundled with that chart, and v1.7.0 is compatible with Kubernetes v1.24. When in doubt, select the most recent compatible version. - -Now that you know which Helm chart `version` you need, run the following command. It installs an `nginx-ingress-controller` with a Kubernetes load balancer service: - -``` -helm search repo ingress-nginx -l helm upgrade --install \ - ingress-nginx ingress-nginx/ingress-nginx \ - --namespace ingress-nginx \ - --set controller.service.type=LoadBalancer \ - --set controller.service.annotations."service\.beta\.kubernetes\.io/azure-load-balancer-health-probe-request-path"=/healthz \ - --set controller.service.externalTrafficPolicy=Local \ - --version 4.6.0 \ - --create-namespace + traefik traefik/traefik \ + --namespace traefik \ + --version 39.0.0 \ + --create-namespace \ + --set service.type=LoadBalancer \ + --set ping.enabled=true \ + --set service.annotations."service\.beta\.kubernetes\.io/azure-load-balancer-health-probe-request-path"=/ping ``` ## 6. Get Load Balancer IP To get the address of the load balancer, run: -``` -kubectl get service ingress-nginx-controller --namespace=ingress-nginx +```bash +kubectl get service traefik --namespace=traefik ``` The result should look similar to the following: -``` +```bash NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE -ingress-nginx-controller LoadBalancer 10.0.116.18 40.31.180.83 80:31229/TCP,443:31050/TCP +traefik LoadBalancer 10.0.116.18 40.31.180.83 80:31229/TCP,443:31050/TCP 67s ``` @@ -145,7 +137,7 @@ Use that DNS name from the previous step as the Rancher server URL when you inst When installing Rancher on top of this setup, you will also need to pass the value below into the Rancher Helm install command in order to set the name of the ingress controller to be used with Rancher's ingress resource: ``` ---set ingress.ingressClassName=nginx +--set ingress.ingressClassName=traefik ``` Refer [here for the Helm install command](install-upgrade-on-a-kubernetes-cluster.md#5-install-rancher-with-helm-and-your-chosen-certificate-option) for your chosen certificate option. diff --git a/versioned_docs/version-2.10/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md b/versioned_docs/version-2.10/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md index 85c83a2d503..6b9c38b344e 100644 --- a/versioned_docs/version-2.10/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md +++ b/versioned_docs/version-2.10/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md @@ -52,8 +52,6 @@ Then enter the following values: To create an EKS cluster, run the following command. Use the AWS region that applies to your use case. When choosing a Kubernetes version, be sure to first consult the [support matrix](https://rancher.com/support-matrix/) to find the highest version of Kubernetes that has been validated for your Rancher version. -**Note:** If you're updating from an older version of Kubernetes, to Kubernetes v1.22 or above, you also need to [update](https://kubernetes.github.io/ingress-nginx/user-guide/k8s-122-migration/) ingress-nginx. - ``` eksctl create cluster \ --name rancher-server \ @@ -88,46 +86,48 @@ rancher-server-cluster us-west-2 True ### 5. Install an Ingress -The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. +The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. Installing an Ingress requires allocating a public IP address. Ensure you have sufficient quota, otherwise it will fail to assign the IP address. Limits for public IP addresses are applicable at a regional level per subscription. You can use a managed ingress controller provided by AWS (ALB) or a third-party ingress controller like Traefik. -To make sure that you choose the correct Ingress-NGINX Helm chart, first find an `Ingress-NGINX version` that's compatible with your Kubernetes version in the [Kubernetes/ingress-nginx support table](https://github.com/kubernetes/ingress-nginx#supported-versions-table). +:::warning +It is not recommended to install a third-party ingress controller, like Traefik, if a managed ingress controller (ALB) is already being used. +::: -Then, list the Helm charts available to you by running the following command: -``` -helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx +:::warning +**Ingress-NGINX EOL:** The community `ingress-nginx` controller reaches End-of-Life (EOL) in March 2026. This page uses Traefik, which is the recommended migration path for Rancher environments. +::: + +Traefik includes a native Ingress NGINX provider. This allows you to migrate from NGINX without rewriting your existing Ingress objects, as Traefik will automatically interpret `nginx.ingress.kubernetes.io` annotations. If you are upgrading a cluster that is already using `ingress-nginx`, follow this [guide](https://doc.traefik.io/traefik/migrate/nginx-to-traefik/) for more information. + +To install Traefik (chart version 39.0.0) on a fresh cluster, run the following `helm` commands: +```bash +helm repo add traefik https://traefik.github.io/charts helm repo update -helm search repo ingress-nginx -l -``` - -The `helm search` command's output contains an `APP VERSION` column. The versions under this column are equivalent to the `Ingress-NGINX version` you chose earlier. Using the app version, select a chart version that bundles an app compatible with your Kubernetes install. For example, if you have Kubernetes v1.23, you can select the v4.6.0 Helm chart, since Ingress-NGINX v1.7.0 comes bundled with that chart, and v1.7.0 is compatible with Kubernetes v1.23. When in doubt, select the most recent compatible version. - -Now that you know which Helm chart `version` you need, run the following command. It installs an `nginx-ingress-controller` with a Kubernetes load balancer service: - -``` helm upgrade --install \ - ingress-nginx ingress-nginx/ingress-nginx \ - --namespace ingress-nginx \ - --set controller.service.type=LoadBalancer \ - --version 4.6.0 \ - --create-namespace + traefik traefik/traefik \ + --namespace traefik \ + --version 39.0.0 \ + --create-namespace \ + --set service.type=LoadBalancer \ + --set ping.enabled=true \ ``` + ### 6. Get Load Balancer IP To get the address of the load balancer, run: -``` -kubectl get service ingress-nginx-controller --namespace=ingress-nginx +```bash +kubectl get service traefik --namespace=traefik ``` The result should look similar to the following: -``` -NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) +```bash +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE -ingress-nginx-controller LoadBalancer 10.100.90.18 a904a952c73bf4f668a17c46ac7c56ab-962521486.us-west-2.elb.amazonaws.com 80:31229/TCP,443:31050/TCP - 27m +traefik LoadBalancer 10.100.90.18 a904a952c73bf4f668a17c46ac7c56ab-962521486.us-west-2.elb.amazonaws.com 80:31229/TCP,443:31050/TCP + 67s ``` Save the `EXTERNAL-IP`. @@ -149,7 +149,7 @@ Use that DNS name from the previous step as the Rancher server URL when you inst When installing Rancher on top of this setup, you will also need to pass the value below into the Rancher Helm install command in order to set the name of the ingress controller to be used with Rancher's ingress resource: ``` ---set ingress.ingressClassName=nginx +--set ingress.ingressClassName=traefik ``` Refer [here for the Helm install command](install-upgrade-on-a-kubernetes-cluster.md#5-install-rancher-with-helm-and-your-chosen-certificate-option) for your chosen certificate option. diff --git a/versioned_docs/version-2.10/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke.md b/versioned_docs/version-2.10/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke.md index a3c3518e4c0..093c5fb589e 100644 --- a/versioned_docs/version-2.10/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke.md +++ b/versioned_docs/version-2.10/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke.md @@ -124,7 +124,6 @@ When choosing a Kubernetes version, be sure to first consult the [support matrix To successfully create a GKE cluster with Rancher, your GKE must be in Standard mode. GKE has two modes of operation when creating a Kubernetes cluster, Autopilot and Standard mode. The cluster configuration for Autopilot mode has restrictions on editing the kube-system namespace. However, Rancher needs to create resources in the kube-system namespace during installation. As a result, you will not be able to install Rancher on a GKE cluster created in Autopilot mode. For more information about the difference between GKE Autopilot mode and Standard mode, visit [Compare GKE Autopilot and Standard.](https://cloud.google.com/kubernetes-engine/docs/resources/autopilot-standard-feature-comparison) -**Note:** If you're updating from an older version of Kubernetes, to Kubernetes v1.22 or above, you also need to [update](https://kubernetes.github.io/ingress-nginx/user-guide/k8s-122-migration/) ingress-nginx. ``` gcloud container clusters create cluster-name --num-nodes=3 --cluster-version= @@ -140,36 +139,48 @@ gcloud container clusters get-credentials cluster-name This command configures `kubectl` to use the cluster you created. + ## 7. Install an Ingress -The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. +The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. Installing an Ingress requires allocating a public IP address. Ensure you have sufficient quota, otherwise it will fail to assign the IP address. Limits for public IP addresses are applicable at a regional level per subscription. You can use a managed ingress controller provided by GCP or a third-party ingress controller like Traefik. -The following command installs an `nginx-ingress-controller` with a LoadBalancer service: +:::warning +It is not recommended to install a third-party ingress controller, like Traefik, if a managed ingress controller is already being used. +::: -``` -helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx +:::warning +**Ingress-NGINX EOL:** The community `ingress-nginx` controller reaches End-of-Life (EOL) in March 2026. This page uses Traefik, which is the recommended migration path for Rancher environments. +::: + +Traefik includes a native Ingress NGINX provider. This allows you to migrate from NGINX without rewriting your existing Ingress objects, as Traefik will automatically interpret `nginx.ingress.kubernetes.io` annotations. If you are upgrading a cluster that is already using `ingress-nginx`, follow this [guide](https://doc.traefik.io/traefik/migrate/nginx-to-traefik/) for more information. + +To install Traefik (chart version 39.0.0) on a fresh cluster, run the following `helm` commands: +```bash +helm repo add traefik https://traefik.github.io/charts helm repo update helm upgrade --install \ - ingress-nginx ingress-nginx/ingress-nginx \ - --namespace ingress-nginx \ - --set controller.service.type=LoadBalancer \ - --version 4.0.18 \ - --create-namespace + traefik traefik/traefik \ + --namespace traefik \ + --version 39.0.0 \ + --create-namespace \ + --set service.type=LoadBalancer \ + --set ping.enabled=true \ ``` -## 8. Get the Load Balancer IP + +## 8. Get Load Balancer IP To get the address of the load balancer, run: -``` -kubectl get service ingress-nginx-controller --namespace=ingress-nginx +```bash +kubectl get service traefik --namespace=traefik ``` The result should look similar to the following: ``` NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE -ingress-nginx-controller LoadBalancer 10.3.244.156 35.233.206.34 80:31876/TCP,443:32497/TCP 81s +traefik LoadBalancer 10.3.244.156 35.233.206.34 80:31876/TCP,443:32497/TCP 81s ``` Save the `EXTERNAL-IP`. @@ -191,7 +202,7 @@ Use the DNS name from the previous step as the Rancher server URL when you insta When installing Rancher on top of this setup, you will also need to set the name of the ingress controller to be used with Rancher's ingress resource: ``` ---set ingress.ingressClassName=nginx +--set ingress.ingressClassName=traefik ``` Refer [here for the Helm install command](install-upgrade-on-a-kubernetes-cluster.md#5-install-rancher-with-helm-and-your-chosen-certificate-option) for your chosen certificate option. diff --git a/versioned_docs/version-2.11/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks.md b/versioned_docs/version-2.11/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks.md index 6aa9bfda5ac..0d299ca6317 100644 --- a/versioned_docs/version-2.11/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks.md +++ b/versioned_docs/version-2.11/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks.md @@ -52,12 +52,6 @@ az group create --name rancher-rg --location eastus To create an AKS cluster, run the following command. Use a VM size that applies to your use case. Refer to [this article](https://docs.microsoft.com/en-us/azure/virtual-machines/sizes) for available sizes and options. When choosing a Kubernetes version, be sure to first consult the [support matrix](https://rancher.com/support-matrix/) to find the highest version of Kubernetes that has been validated for your Rancher version. -:::note - -If you're updating from an older version of Kubernetes, to Kubernetes v1.22 or above, you also need to [update](https://kubernetes.github.io/ingress-nginx/user-guide/k8s-122-migration/) ingress-nginx. - -::: - ``` az aks create \ --resource-group rancher-rg \ @@ -81,48 +75,46 @@ This command merges your cluster's credentials into the existing kubeconfig and ## 5. Install an Ingress -The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. Installing an Ingress requires allocating a public IP address. Ensure you have sufficient quota, otherwise it will fail to assign the IP address. Limits for public IP addresses are applicable at a regional level per subscription. +The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. Installing an Ingress requires allocating a public IP address. Ensure you have sufficient quota, otherwise it will fail to assign the IP address. Limits for public IP addresses are applicable at a regional level per subscription. You can use a managed ingress controller provided by Azure or a third-party ingress controller like Traefik. -To make sure that you choose the correct Ingress-NGINX Helm chart, first find an `Ingress-NGINX version` that's compatible with your Kubernetes version in the [Kubernetes/ingress-nginx support table](https://github.com/kubernetes/ingress-nginx#supported-versions-table). +:::warning +It is not recommended to install a third-party ingress controller, like Traefik, if a managed ingress controller is already being used. +::: -Then, list the Helm charts available to you by running the following command: +:::warning +**Ingress-NGINX EOL:** The community `ingress-nginx` controller reaches End-of-Life (EOL) in March 2026. This page uses Traefik, which is the recommended migration path for Rancher environments. +::: -``` -helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx +Traefik includes a native Ingress NGINX provider. This allows you to migrate from NGINX without rewriting your existing Ingress objects, as Traefik will automatically interpret `nginx.ingress.kubernetes.io` annotations. If you are upgrading a cluster that is already using `ingress-nginx`, follow this [guide](https://doc.traefik.io/traefik/migrate/nginx-to-traefik/) for more information. + +To install Traefik (chart version 39.0.0) on a fresh cluster, run the following `helm` commands: +```bash +helm repo add traefik https://traefik.github.io/charts helm repo update -helm search repo ingress-nginx -l -``` - -The `helm search` command's output contains an `APP VERSION` column. The versions under this column are equivalent to the `Ingress-NGINX version` you chose earlier. Using the app version, select a chart version that bundles an app compatible with your Kubernetes install. For example, if you have Kubernetes v1.24, you can select the v4.6.0 Helm chart, since Ingress-NGINX v1.7.0 comes bundled with that chart, and v1.7.0 is compatible with Kubernetes v1.24. When in doubt, select the most recent compatible version. - -Now that you know which Helm chart `version` you need, run the following command. It installs an `nginx-ingress-controller` with a Kubernetes load balancer service: - -``` -helm search repo ingress-nginx -l helm upgrade --install \ - ingress-nginx ingress-nginx/ingress-nginx \ - --namespace ingress-nginx \ - --set controller.service.type=LoadBalancer \ - --set controller.service.annotations."service\.beta\.kubernetes\.io/azure-load-balancer-health-probe-request-path"=/healthz \ - --set controller.service.externalTrafficPolicy=Local \ - --version 4.6.0 \ - --create-namespace + traefik traefik/traefik \ + --namespace traefik \ + --version 39.0.0 \ + --create-namespace \ + --set service.type=LoadBalancer \ + --set ping.enabled=true \ + --set service.annotations."service\.beta\.kubernetes\.io/azure-load-balancer-health-probe-request-path"=/ping ``` ## 6. Get Load Balancer IP To get the address of the load balancer, run: -``` -kubectl get service ingress-nginx-controller --namespace=ingress-nginx +```bash +kubectl get service traefik --namespace=traefik ``` The result should look similar to the following: -``` +```bash NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE -ingress-nginx-controller LoadBalancer 10.0.116.18 40.31.180.83 80:31229/TCP,443:31050/TCP +traefik LoadBalancer 10.0.116.18 40.31.180.83 80:31229/TCP,443:31050/TCP 67s ``` @@ -145,7 +137,7 @@ Use that DNS name from the previous step as the Rancher server URL when you inst When installing Rancher on top of this setup, you will also need to pass the value below into the Rancher Helm install command in order to set the name of the ingress controller to be used with Rancher's ingress resource: ``` ---set ingress.ingressClassName=nginx +--set ingress.ingressClassName=traefik ``` Refer [here for the Helm install command](install-upgrade-on-a-kubernetes-cluster.md#5-install-rancher-with-helm-and-your-chosen-certificate-option) for your chosen certificate option. diff --git a/versioned_docs/version-2.11/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md b/versioned_docs/version-2.11/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md index 85c83a2d503..6b9c38b344e 100644 --- a/versioned_docs/version-2.11/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md +++ b/versioned_docs/version-2.11/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md @@ -52,8 +52,6 @@ Then enter the following values: To create an EKS cluster, run the following command. Use the AWS region that applies to your use case. When choosing a Kubernetes version, be sure to first consult the [support matrix](https://rancher.com/support-matrix/) to find the highest version of Kubernetes that has been validated for your Rancher version. -**Note:** If you're updating from an older version of Kubernetes, to Kubernetes v1.22 or above, you also need to [update](https://kubernetes.github.io/ingress-nginx/user-guide/k8s-122-migration/) ingress-nginx. - ``` eksctl create cluster \ --name rancher-server \ @@ -88,46 +86,48 @@ rancher-server-cluster us-west-2 True ### 5. Install an Ingress -The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. +The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. Installing an Ingress requires allocating a public IP address. Ensure you have sufficient quota, otherwise it will fail to assign the IP address. Limits for public IP addresses are applicable at a regional level per subscription. You can use a managed ingress controller provided by AWS (ALB) or a third-party ingress controller like Traefik. -To make sure that you choose the correct Ingress-NGINX Helm chart, first find an `Ingress-NGINX version` that's compatible with your Kubernetes version in the [Kubernetes/ingress-nginx support table](https://github.com/kubernetes/ingress-nginx#supported-versions-table). +:::warning +It is not recommended to install a third-party ingress controller, like Traefik, if a managed ingress controller (ALB) is already being used. +::: -Then, list the Helm charts available to you by running the following command: -``` -helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx +:::warning +**Ingress-NGINX EOL:** The community `ingress-nginx` controller reaches End-of-Life (EOL) in March 2026. This page uses Traefik, which is the recommended migration path for Rancher environments. +::: + +Traefik includes a native Ingress NGINX provider. This allows you to migrate from NGINX without rewriting your existing Ingress objects, as Traefik will automatically interpret `nginx.ingress.kubernetes.io` annotations. If you are upgrading a cluster that is already using `ingress-nginx`, follow this [guide](https://doc.traefik.io/traefik/migrate/nginx-to-traefik/) for more information. + +To install Traefik (chart version 39.0.0) on a fresh cluster, run the following `helm` commands: +```bash +helm repo add traefik https://traefik.github.io/charts helm repo update -helm search repo ingress-nginx -l -``` - -The `helm search` command's output contains an `APP VERSION` column. The versions under this column are equivalent to the `Ingress-NGINX version` you chose earlier. Using the app version, select a chart version that bundles an app compatible with your Kubernetes install. For example, if you have Kubernetes v1.23, you can select the v4.6.0 Helm chart, since Ingress-NGINX v1.7.0 comes bundled with that chart, and v1.7.0 is compatible with Kubernetes v1.23. When in doubt, select the most recent compatible version. - -Now that you know which Helm chart `version` you need, run the following command. It installs an `nginx-ingress-controller` with a Kubernetes load balancer service: - -``` helm upgrade --install \ - ingress-nginx ingress-nginx/ingress-nginx \ - --namespace ingress-nginx \ - --set controller.service.type=LoadBalancer \ - --version 4.6.0 \ - --create-namespace + traefik traefik/traefik \ + --namespace traefik \ + --version 39.0.0 \ + --create-namespace \ + --set service.type=LoadBalancer \ + --set ping.enabled=true \ ``` + ### 6. Get Load Balancer IP To get the address of the load balancer, run: -``` -kubectl get service ingress-nginx-controller --namespace=ingress-nginx +```bash +kubectl get service traefik --namespace=traefik ``` The result should look similar to the following: -``` -NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) +```bash +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE -ingress-nginx-controller LoadBalancer 10.100.90.18 a904a952c73bf4f668a17c46ac7c56ab-962521486.us-west-2.elb.amazonaws.com 80:31229/TCP,443:31050/TCP - 27m +traefik LoadBalancer 10.100.90.18 a904a952c73bf4f668a17c46ac7c56ab-962521486.us-west-2.elb.amazonaws.com 80:31229/TCP,443:31050/TCP + 67s ``` Save the `EXTERNAL-IP`. @@ -149,7 +149,7 @@ Use that DNS name from the previous step as the Rancher server URL when you inst When installing Rancher on top of this setup, you will also need to pass the value below into the Rancher Helm install command in order to set the name of the ingress controller to be used with Rancher's ingress resource: ``` ---set ingress.ingressClassName=nginx +--set ingress.ingressClassName=traefik ``` Refer [here for the Helm install command](install-upgrade-on-a-kubernetes-cluster.md#5-install-rancher-with-helm-and-your-chosen-certificate-option) for your chosen certificate option. diff --git a/versioned_docs/version-2.11/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke.md b/versioned_docs/version-2.11/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke.md index a3c3518e4c0..093c5fb589e 100644 --- a/versioned_docs/version-2.11/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke.md +++ b/versioned_docs/version-2.11/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke.md @@ -124,7 +124,6 @@ When choosing a Kubernetes version, be sure to first consult the [support matrix To successfully create a GKE cluster with Rancher, your GKE must be in Standard mode. GKE has two modes of operation when creating a Kubernetes cluster, Autopilot and Standard mode. The cluster configuration for Autopilot mode has restrictions on editing the kube-system namespace. However, Rancher needs to create resources in the kube-system namespace during installation. As a result, you will not be able to install Rancher on a GKE cluster created in Autopilot mode. For more information about the difference between GKE Autopilot mode and Standard mode, visit [Compare GKE Autopilot and Standard.](https://cloud.google.com/kubernetes-engine/docs/resources/autopilot-standard-feature-comparison) -**Note:** If you're updating from an older version of Kubernetes, to Kubernetes v1.22 or above, you also need to [update](https://kubernetes.github.io/ingress-nginx/user-guide/k8s-122-migration/) ingress-nginx. ``` gcloud container clusters create cluster-name --num-nodes=3 --cluster-version= @@ -140,36 +139,48 @@ gcloud container clusters get-credentials cluster-name This command configures `kubectl` to use the cluster you created. + ## 7. Install an Ingress -The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. +The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. Installing an Ingress requires allocating a public IP address. Ensure you have sufficient quota, otherwise it will fail to assign the IP address. Limits for public IP addresses are applicable at a regional level per subscription. You can use a managed ingress controller provided by GCP or a third-party ingress controller like Traefik. -The following command installs an `nginx-ingress-controller` with a LoadBalancer service: +:::warning +It is not recommended to install a third-party ingress controller, like Traefik, if a managed ingress controller is already being used. +::: -``` -helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx +:::warning +**Ingress-NGINX EOL:** The community `ingress-nginx` controller reaches End-of-Life (EOL) in March 2026. This page uses Traefik, which is the recommended migration path for Rancher environments. +::: + +Traefik includes a native Ingress NGINX provider. This allows you to migrate from NGINX without rewriting your existing Ingress objects, as Traefik will automatically interpret `nginx.ingress.kubernetes.io` annotations. If you are upgrading a cluster that is already using `ingress-nginx`, follow this [guide](https://doc.traefik.io/traefik/migrate/nginx-to-traefik/) for more information. + +To install Traefik (chart version 39.0.0) on a fresh cluster, run the following `helm` commands: +```bash +helm repo add traefik https://traefik.github.io/charts helm repo update helm upgrade --install \ - ingress-nginx ingress-nginx/ingress-nginx \ - --namespace ingress-nginx \ - --set controller.service.type=LoadBalancer \ - --version 4.0.18 \ - --create-namespace + traefik traefik/traefik \ + --namespace traefik \ + --version 39.0.0 \ + --create-namespace \ + --set service.type=LoadBalancer \ + --set ping.enabled=true \ ``` -## 8. Get the Load Balancer IP + +## 8. Get Load Balancer IP To get the address of the load balancer, run: -``` -kubectl get service ingress-nginx-controller --namespace=ingress-nginx +```bash +kubectl get service traefik --namespace=traefik ``` The result should look similar to the following: ``` NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE -ingress-nginx-controller LoadBalancer 10.3.244.156 35.233.206.34 80:31876/TCP,443:32497/TCP 81s +traefik LoadBalancer 10.3.244.156 35.233.206.34 80:31876/TCP,443:32497/TCP 81s ``` Save the `EXTERNAL-IP`. @@ -191,7 +202,7 @@ Use the DNS name from the previous step as the Rancher server URL when you insta When installing Rancher on top of this setup, you will also need to set the name of the ingress controller to be used with Rancher's ingress resource: ``` ---set ingress.ingressClassName=nginx +--set ingress.ingressClassName=traefik ``` Refer [here for the Helm install command](install-upgrade-on-a-kubernetes-cluster.md#5-install-rancher-with-helm-and-your-chosen-certificate-option) for your chosen certificate option. diff --git a/versioned_docs/version-2.12/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks.md b/versioned_docs/version-2.12/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks.md index 6aa9bfda5ac..0d299ca6317 100644 --- a/versioned_docs/version-2.12/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks.md +++ b/versioned_docs/version-2.12/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks.md @@ -52,12 +52,6 @@ az group create --name rancher-rg --location eastus To create an AKS cluster, run the following command. Use a VM size that applies to your use case. Refer to [this article](https://docs.microsoft.com/en-us/azure/virtual-machines/sizes) for available sizes and options. When choosing a Kubernetes version, be sure to first consult the [support matrix](https://rancher.com/support-matrix/) to find the highest version of Kubernetes that has been validated for your Rancher version. -:::note - -If you're updating from an older version of Kubernetes, to Kubernetes v1.22 or above, you also need to [update](https://kubernetes.github.io/ingress-nginx/user-guide/k8s-122-migration/) ingress-nginx. - -::: - ``` az aks create \ --resource-group rancher-rg \ @@ -81,48 +75,46 @@ This command merges your cluster's credentials into the existing kubeconfig and ## 5. Install an Ingress -The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. Installing an Ingress requires allocating a public IP address. Ensure you have sufficient quota, otherwise it will fail to assign the IP address. Limits for public IP addresses are applicable at a regional level per subscription. +The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. Installing an Ingress requires allocating a public IP address. Ensure you have sufficient quota, otherwise it will fail to assign the IP address. Limits for public IP addresses are applicable at a regional level per subscription. You can use a managed ingress controller provided by Azure or a third-party ingress controller like Traefik. -To make sure that you choose the correct Ingress-NGINX Helm chart, first find an `Ingress-NGINX version` that's compatible with your Kubernetes version in the [Kubernetes/ingress-nginx support table](https://github.com/kubernetes/ingress-nginx#supported-versions-table). +:::warning +It is not recommended to install a third-party ingress controller, like Traefik, if a managed ingress controller is already being used. +::: -Then, list the Helm charts available to you by running the following command: +:::warning +**Ingress-NGINX EOL:** The community `ingress-nginx` controller reaches End-of-Life (EOL) in March 2026. This page uses Traefik, which is the recommended migration path for Rancher environments. +::: -``` -helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx +Traefik includes a native Ingress NGINX provider. This allows you to migrate from NGINX without rewriting your existing Ingress objects, as Traefik will automatically interpret `nginx.ingress.kubernetes.io` annotations. If you are upgrading a cluster that is already using `ingress-nginx`, follow this [guide](https://doc.traefik.io/traefik/migrate/nginx-to-traefik/) for more information. + +To install Traefik (chart version 39.0.0) on a fresh cluster, run the following `helm` commands: +```bash +helm repo add traefik https://traefik.github.io/charts helm repo update -helm search repo ingress-nginx -l -``` - -The `helm search` command's output contains an `APP VERSION` column. The versions under this column are equivalent to the `Ingress-NGINX version` you chose earlier. Using the app version, select a chart version that bundles an app compatible with your Kubernetes install. For example, if you have Kubernetes v1.24, you can select the v4.6.0 Helm chart, since Ingress-NGINX v1.7.0 comes bundled with that chart, and v1.7.0 is compatible with Kubernetes v1.24. When in doubt, select the most recent compatible version. - -Now that you know which Helm chart `version` you need, run the following command. It installs an `nginx-ingress-controller` with a Kubernetes load balancer service: - -``` -helm search repo ingress-nginx -l helm upgrade --install \ - ingress-nginx ingress-nginx/ingress-nginx \ - --namespace ingress-nginx \ - --set controller.service.type=LoadBalancer \ - --set controller.service.annotations."service\.beta\.kubernetes\.io/azure-load-balancer-health-probe-request-path"=/healthz \ - --set controller.service.externalTrafficPolicy=Local \ - --version 4.6.0 \ - --create-namespace + traefik traefik/traefik \ + --namespace traefik \ + --version 39.0.0 \ + --create-namespace \ + --set service.type=LoadBalancer \ + --set ping.enabled=true \ + --set service.annotations."service\.beta\.kubernetes\.io/azure-load-balancer-health-probe-request-path"=/ping ``` ## 6. Get Load Balancer IP To get the address of the load balancer, run: -``` -kubectl get service ingress-nginx-controller --namespace=ingress-nginx +```bash +kubectl get service traefik --namespace=traefik ``` The result should look similar to the following: -``` +```bash NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE -ingress-nginx-controller LoadBalancer 10.0.116.18 40.31.180.83 80:31229/TCP,443:31050/TCP +traefik LoadBalancer 10.0.116.18 40.31.180.83 80:31229/TCP,443:31050/TCP 67s ``` @@ -145,7 +137,7 @@ Use that DNS name from the previous step as the Rancher server URL when you inst When installing Rancher on top of this setup, you will also need to pass the value below into the Rancher Helm install command in order to set the name of the ingress controller to be used with Rancher's ingress resource: ``` ---set ingress.ingressClassName=nginx +--set ingress.ingressClassName=traefik ``` Refer [here for the Helm install command](install-upgrade-on-a-kubernetes-cluster.md#5-install-rancher-with-helm-and-your-chosen-certificate-option) for your chosen certificate option. diff --git a/versioned_docs/version-2.12/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md b/versioned_docs/version-2.12/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md index 85c83a2d503..6b9c38b344e 100644 --- a/versioned_docs/version-2.12/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md +++ b/versioned_docs/version-2.12/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md @@ -52,8 +52,6 @@ Then enter the following values: To create an EKS cluster, run the following command. Use the AWS region that applies to your use case. When choosing a Kubernetes version, be sure to first consult the [support matrix](https://rancher.com/support-matrix/) to find the highest version of Kubernetes that has been validated for your Rancher version. -**Note:** If you're updating from an older version of Kubernetes, to Kubernetes v1.22 or above, you also need to [update](https://kubernetes.github.io/ingress-nginx/user-guide/k8s-122-migration/) ingress-nginx. - ``` eksctl create cluster \ --name rancher-server \ @@ -88,46 +86,48 @@ rancher-server-cluster us-west-2 True ### 5. Install an Ingress -The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. +The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. Installing an Ingress requires allocating a public IP address. Ensure you have sufficient quota, otherwise it will fail to assign the IP address. Limits for public IP addresses are applicable at a regional level per subscription. You can use a managed ingress controller provided by AWS (ALB) or a third-party ingress controller like Traefik. -To make sure that you choose the correct Ingress-NGINX Helm chart, first find an `Ingress-NGINX version` that's compatible with your Kubernetes version in the [Kubernetes/ingress-nginx support table](https://github.com/kubernetes/ingress-nginx#supported-versions-table). +:::warning +It is not recommended to install a third-party ingress controller, like Traefik, if a managed ingress controller (ALB) is already being used. +::: -Then, list the Helm charts available to you by running the following command: -``` -helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx +:::warning +**Ingress-NGINX EOL:** The community `ingress-nginx` controller reaches End-of-Life (EOL) in March 2026. This page uses Traefik, which is the recommended migration path for Rancher environments. +::: + +Traefik includes a native Ingress NGINX provider. This allows you to migrate from NGINX without rewriting your existing Ingress objects, as Traefik will automatically interpret `nginx.ingress.kubernetes.io` annotations. If you are upgrading a cluster that is already using `ingress-nginx`, follow this [guide](https://doc.traefik.io/traefik/migrate/nginx-to-traefik/) for more information. + +To install Traefik (chart version 39.0.0) on a fresh cluster, run the following `helm` commands: +```bash +helm repo add traefik https://traefik.github.io/charts helm repo update -helm search repo ingress-nginx -l -``` - -The `helm search` command's output contains an `APP VERSION` column. The versions under this column are equivalent to the `Ingress-NGINX version` you chose earlier. Using the app version, select a chart version that bundles an app compatible with your Kubernetes install. For example, if you have Kubernetes v1.23, you can select the v4.6.0 Helm chart, since Ingress-NGINX v1.7.0 comes bundled with that chart, and v1.7.0 is compatible with Kubernetes v1.23. When in doubt, select the most recent compatible version. - -Now that you know which Helm chart `version` you need, run the following command. It installs an `nginx-ingress-controller` with a Kubernetes load balancer service: - -``` helm upgrade --install \ - ingress-nginx ingress-nginx/ingress-nginx \ - --namespace ingress-nginx \ - --set controller.service.type=LoadBalancer \ - --version 4.6.0 \ - --create-namespace + traefik traefik/traefik \ + --namespace traefik \ + --version 39.0.0 \ + --create-namespace \ + --set service.type=LoadBalancer \ + --set ping.enabled=true \ ``` + ### 6. Get Load Balancer IP To get the address of the load balancer, run: -``` -kubectl get service ingress-nginx-controller --namespace=ingress-nginx +```bash +kubectl get service traefik --namespace=traefik ``` The result should look similar to the following: -``` -NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) +```bash +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE -ingress-nginx-controller LoadBalancer 10.100.90.18 a904a952c73bf4f668a17c46ac7c56ab-962521486.us-west-2.elb.amazonaws.com 80:31229/TCP,443:31050/TCP - 27m +traefik LoadBalancer 10.100.90.18 a904a952c73bf4f668a17c46ac7c56ab-962521486.us-west-2.elb.amazonaws.com 80:31229/TCP,443:31050/TCP + 67s ``` Save the `EXTERNAL-IP`. @@ -149,7 +149,7 @@ Use that DNS name from the previous step as the Rancher server URL when you inst When installing Rancher on top of this setup, you will also need to pass the value below into the Rancher Helm install command in order to set the name of the ingress controller to be used with Rancher's ingress resource: ``` ---set ingress.ingressClassName=nginx +--set ingress.ingressClassName=traefik ``` Refer [here for the Helm install command](install-upgrade-on-a-kubernetes-cluster.md#5-install-rancher-with-helm-and-your-chosen-certificate-option) for your chosen certificate option. diff --git a/versioned_docs/version-2.12/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke.md b/versioned_docs/version-2.12/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke.md index a3c3518e4c0..093c5fb589e 100644 --- a/versioned_docs/version-2.12/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke.md +++ b/versioned_docs/version-2.12/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke.md @@ -124,7 +124,6 @@ When choosing a Kubernetes version, be sure to first consult the [support matrix To successfully create a GKE cluster with Rancher, your GKE must be in Standard mode. GKE has two modes of operation when creating a Kubernetes cluster, Autopilot and Standard mode. The cluster configuration for Autopilot mode has restrictions on editing the kube-system namespace. However, Rancher needs to create resources in the kube-system namespace during installation. As a result, you will not be able to install Rancher on a GKE cluster created in Autopilot mode. For more information about the difference between GKE Autopilot mode and Standard mode, visit [Compare GKE Autopilot and Standard.](https://cloud.google.com/kubernetes-engine/docs/resources/autopilot-standard-feature-comparison) -**Note:** If you're updating from an older version of Kubernetes, to Kubernetes v1.22 or above, you also need to [update](https://kubernetes.github.io/ingress-nginx/user-guide/k8s-122-migration/) ingress-nginx. ``` gcloud container clusters create cluster-name --num-nodes=3 --cluster-version= @@ -140,36 +139,48 @@ gcloud container clusters get-credentials cluster-name This command configures `kubectl` to use the cluster you created. + ## 7. Install an Ingress -The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. +The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. Installing an Ingress requires allocating a public IP address. Ensure you have sufficient quota, otherwise it will fail to assign the IP address. Limits for public IP addresses are applicable at a regional level per subscription. You can use a managed ingress controller provided by GCP or a third-party ingress controller like Traefik. -The following command installs an `nginx-ingress-controller` with a LoadBalancer service: +:::warning +It is not recommended to install a third-party ingress controller, like Traefik, if a managed ingress controller is already being used. +::: -``` -helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx +:::warning +**Ingress-NGINX EOL:** The community `ingress-nginx` controller reaches End-of-Life (EOL) in March 2026. This page uses Traefik, which is the recommended migration path for Rancher environments. +::: + +Traefik includes a native Ingress NGINX provider. This allows you to migrate from NGINX without rewriting your existing Ingress objects, as Traefik will automatically interpret `nginx.ingress.kubernetes.io` annotations. If you are upgrading a cluster that is already using `ingress-nginx`, follow this [guide](https://doc.traefik.io/traefik/migrate/nginx-to-traefik/) for more information. + +To install Traefik (chart version 39.0.0) on a fresh cluster, run the following `helm` commands: +```bash +helm repo add traefik https://traefik.github.io/charts helm repo update helm upgrade --install \ - ingress-nginx ingress-nginx/ingress-nginx \ - --namespace ingress-nginx \ - --set controller.service.type=LoadBalancer \ - --version 4.0.18 \ - --create-namespace + traefik traefik/traefik \ + --namespace traefik \ + --version 39.0.0 \ + --create-namespace \ + --set service.type=LoadBalancer \ + --set ping.enabled=true \ ``` -## 8. Get the Load Balancer IP + +## 8. Get Load Balancer IP To get the address of the load balancer, run: -``` -kubectl get service ingress-nginx-controller --namespace=ingress-nginx +```bash +kubectl get service traefik --namespace=traefik ``` The result should look similar to the following: ``` NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE -ingress-nginx-controller LoadBalancer 10.3.244.156 35.233.206.34 80:31876/TCP,443:32497/TCP 81s +traefik LoadBalancer 10.3.244.156 35.233.206.34 80:31876/TCP,443:32497/TCP 81s ``` Save the `EXTERNAL-IP`. @@ -191,7 +202,7 @@ Use the DNS name from the previous step as the Rancher server URL when you insta When installing Rancher on top of this setup, you will also need to set the name of the ingress controller to be used with Rancher's ingress resource: ``` ---set ingress.ingressClassName=nginx +--set ingress.ingressClassName=traefik ``` Refer [here for the Helm install command](install-upgrade-on-a-kubernetes-cluster.md#5-install-rancher-with-helm-and-your-chosen-certificate-option) for your chosen certificate option. diff --git a/versioned_docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks.md b/versioned_docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks.md index 6aa9bfda5ac..0d299ca6317 100644 --- a/versioned_docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks.md +++ b/versioned_docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks.md @@ -52,12 +52,6 @@ az group create --name rancher-rg --location eastus To create an AKS cluster, run the following command. Use a VM size that applies to your use case. Refer to [this article](https://docs.microsoft.com/en-us/azure/virtual-machines/sizes) for available sizes and options. When choosing a Kubernetes version, be sure to first consult the [support matrix](https://rancher.com/support-matrix/) to find the highest version of Kubernetes that has been validated for your Rancher version. -:::note - -If you're updating from an older version of Kubernetes, to Kubernetes v1.22 or above, you also need to [update](https://kubernetes.github.io/ingress-nginx/user-guide/k8s-122-migration/) ingress-nginx. - -::: - ``` az aks create \ --resource-group rancher-rg \ @@ -81,48 +75,46 @@ This command merges your cluster's credentials into the existing kubeconfig and ## 5. Install an Ingress -The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. Installing an Ingress requires allocating a public IP address. Ensure you have sufficient quota, otherwise it will fail to assign the IP address. Limits for public IP addresses are applicable at a regional level per subscription. +The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. Installing an Ingress requires allocating a public IP address. Ensure you have sufficient quota, otherwise it will fail to assign the IP address. Limits for public IP addresses are applicable at a regional level per subscription. You can use a managed ingress controller provided by Azure or a third-party ingress controller like Traefik. -To make sure that you choose the correct Ingress-NGINX Helm chart, first find an `Ingress-NGINX version` that's compatible with your Kubernetes version in the [Kubernetes/ingress-nginx support table](https://github.com/kubernetes/ingress-nginx#supported-versions-table). +:::warning +It is not recommended to install a third-party ingress controller, like Traefik, if a managed ingress controller is already being used. +::: -Then, list the Helm charts available to you by running the following command: +:::warning +**Ingress-NGINX EOL:** The community `ingress-nginx` controller reaches End-of-Life (EOL) in March 2026. This page uses Traefik, which is the recommended migration path for Rancher environments. +::: -``` -helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx +Traefik includes a native Ingress NGINX provider. This allows you to migrate from NGINX without rewriting your existing Ingress objects, as Traefik will automatically interpret `nginx.ingress.kubernetes.io` annotations. If you are upgrading a cluster that is already using `ingress-nginx`, follow this [guide](https://doc.traefik.io/traefik/migrate/nginx-to-traefik/) for more information. + +To install Traefik (chart version 39.0.0) on a fresh cluster, run the following `helm` commands: +```bash +helm repo add traefik https://traefik.github.io/charts helm repo update -helm search repo ingress-nginx -l -``` - -The `helm search` command's output contains an `APP VERSION` column. The versions under this column are equivalent to the `Ingress-NGINX version` you chose earlier. Using the app version, select a chart version that bundles an app compatible with your Kubernetes install. For example, if you have Kubernetes v1.24, you can select the v4.6.0 Helm chart, since Ingress-NGINX v1.7.0 comes bundled with that chart, and v1.7.0 is compatible with Kubernetes v1.24. When in doubt, select the most recent compatible version. - -Now that you know which Helm chart `version` you need, run the following command. It installs an `nginx-ingress-controller` with a Kubernetes load balancer service: - -``` -helm search repo ingress-nginx -l helm upgrade --install \ - ingress-nginx ingress-nginx/ingress-nginx \ - --namespace ingress-nginx \ - --set controller.service.type=LoadBalancer \ - --set controller.service.annotations."service\.beta\.kubernetes\.io/azure-load-balancer-health-probe-request-path"=/healthz \ - --set controller.service.externalTrafficPolicy=Local \ - --version 4.6.0 \ - --create-namespace + traefik traefik/traefik \ + --namespace traefik \ + --version 39.0.0 \ + --create-namespace \ + --set service.type=LoadBalancer \ + --set ping.enabled=true \ + --set service.annotations."service\.beta\.kubernetes\.io/azure-load-balancer-health-probe-request-path"=/ping ``` ## 6. Get Load Balancer IP To get the address of the load balancer, run: -``` -kubectl get service ingress-nginx-controller --namespace=ingress-nginx +```bash +kubectl get service traefik --namespace=traefik ``` The result should look similar to the following: -``` +```bash NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE -ingress-nginx-controller LoadBalancer 10.0.116.18 40.31.180.83 80:31229/TCP,443:31050/TCP +traefik LoadBalancer 10.0.116.18 40.31.180.83 80:31229/TCP,443:31050/TCP 67s ``` @@ -145,7 +137,7 @@ Use that DNS name from the previous step as the Rancher server URL when you inst When installing Rancher on top of this setup, you will also need to pass the value below into the Rancher Helm install command in order to set the name of the ingress controller to be used with Rancher's ingress resource: ``` ---set ingress.ingressClassName=nginx +--set ingress.ingressClassName=traefik ``` Refer [here for the Helm install command](install-upgrade-on-a-kubernetes-cluster.md#5-install-rancher-with-helm-and-your-chosen-certificate-option) for your chosen certificate option. diff --git a/versioned_docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md b/versioned_docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md index 85c83a2d503..6b9c38b344e 100644 --- a/versioned_docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md +++ b/versioned_docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md @@ -52,8 +52,6 @@ Then enter the following values: To create an EKS cluster, run the following command. Use the AWS region that applies to your use case. When choosing a Kubernetes version, be sure to first consult the [support matrix](https://rancher.com/support-matrix/) to find the highest version of Kubernetes that has been validated for your Rancher version. -**Note:** If you're updating from an older version of Kubernetes, to Kubernetes v1.22 or above, you also need to [update](https://kubernetes.github.io/ingress-nginx/user-guide/k8s-122-migration/) ingress-nginx. - ``` eksctl create cluster \ --name rancher-server \ @@ -88,46 +86,48 @@ rancher-server-cluster us-west-2 True ### 5. Install an Ingress -The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. +The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. Installing an Ingress requires allocating a public IP address. Ensure you have sufficient quota, otherwise it will fail to assign the IP address. Limits for public IP addresses are applicable at a regional level per subscription. You can use a managed ingress controller provided by AWS (ALB) or a third-party ingress controller like Traefik. -To make sure that you choose the correct Ingress-NGINX Helm chart, first find an `Ingress-NGINX version` that's compatible with your Kubernetes version in the [Kubernetes/ingress-nginx support table](https://github.com/kubernetes/ingress-nginx#supported-versions-table). +:::warning +It is not recommended to install a third-party ingress controller, like Traefik, if a managed ingress controller (ALB) is already being used. +::: -Then, list the Helm charts available to you by running the following command: -``` -helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx +:::warning +**Ingress-NGINX EOL:** The community `ingress-nginx` controller reaches End-of-Life (EOL) in March 2026. This page uses Traefik, which is the recommended migration path for Rancher environments. +::: + +Traefik includes a native Ingress NGINX provider. This allows you to migrate from NGINX without rewriting your existing Ingress objects, as Traefik will automatically interpret `nginx.ingress.kubernetes.io` annotations. If you are upgrading a cluster that is already using `ingress-nginx`, follow this [guide](https://doc.traefik.io/traefik/migrate/nginx-to-traefik/) for more information. + +To install Traefik (chart version 39.0.0) on a fresh cluster, run the following `helm` commands: +```bash +helm repo add traefik https://traefik.github.io/charts helm repo update -helm search repo ingress-nginx -l -``` - -The `helm search` command's output contains an `APP VERSION` column. The versions under this column are equivalent to the `Ingress-NGINX version` you chose earlier. Using the app version, select a chart version that bundles an app compatible with your Kubernetes install. For example, if you have Kubernetes v1.23, you can select the v4.6.0 Helm chart, since Ingress-NGINX v1.7.0 comes bundled with that chart, and v1.7.0 is compatible with Kubernetes v1.23. When in doubt, select the most recent compatible version. - -Now that you know which Helm chart `version` you need, run the following command. It installs an `nginx-ingress-controller` with a Kubernetes load balancer service: - -``` helm upgrade --install \ - ingress-nginx ingress-nginx/ingress-nginx \ - --namespace ingress-nginx \ - --set controller.service.type=LoadBalancer \ - --version 4.6.0 \ - --create-namespace + traefik traefik/traefik \ + --namespace traefik \ + --version 39.0.0 \ + --create-namespace \ + --set service.type=LoadBalancer \ + --set ping.enabled=true \ ``` + ### 6. Get Load Balancer IP To get the address of the load balancer, run: -``` -kubectl get service ingress-nginx-controller --namespace=ingress-nginx +```bash +kubectl get service traefik --namespace=traefik ``` The result should look similar to the following: -``` -NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) +```bash +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE -ingress-nginx-controller LoadBalancer 10.100.90.18 a904a952c73bf4f668a17c46ac7c56ab-962521486.us-west-2.elb.amazonaws.com 80:31229/TCP,443:31050/TCP - 27m +traefik LoadBalancer 10.100.90.18 a904a952c73bf4f668a17c46ac7c56ab-962521486.us-west-2.elb.amazonaws.com 80:31229/TCP,443:31050/TCP + 67s ``` Save the `EXTERNAL-IP`. @@ -149,7 +149,7 @@ Use that DNS name from the previous step as the Rancher server URL when you inst When installing Rancher on top of this setup, you will also need to pass the value below into the Rancher Helm install command in order to set the name of the ingress controller to be used with Rancher's ingress resource: ``` ---set ingress.ingressClassName=nginx +--set ingress.ingressClassName=traefik ``` Refer [here for the Helm install command](install-upgrade-on-a-kubernetes-cluster.md#5-install-rancher-with-helm-and-your-chosen-certificate-option) for your chosen certificate option. diff --git a/versioned_docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke.md b/versioned_docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke.md index a3c3518e4c0..093c5fb589e 100644 --- a/versioned_docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke.md +++ b/versioned_docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke.md @@ -124,7 +124,6 @@ When choosing a Kubernetes version, be sure to first consult the [support matrix To successfully create a GKE cluster with Rancher, your GKE must be in Standard mode. GKE has two modes of operation when creating a Kubernetes cluster, Autopilot and Standard mode. The cluster configuration for Autopilot mode has restrictions on editing the kube-system namespace. However, Rancher needs to create resources in the kube-system namespace during installation. As a result, you will not be able to install Rancher on a GKE cluster created in Autopilot mode. For more information about the difference between GKE Autopilot mode and Standard mode, visit [Compare GKE Autopilot and Standard.](https://cloud.google.com/kubernetes-engine/docs/resources/autopilot-standard-feature-comparison) -**Note:** If you're updating from an older version of Kubernetes, to Kubernetes v1.22 or above, you also need to [update](https://kubernetes.github.io/ingress-nginx/user-guide/k8s-122-migration/) ingress-nginx. ``` gcloud container clusters create cluster-name --num-nodes=3 --cluster-version= @@ -140,36 +139,48 @@ gcloud container clusters get-credentials cluster-name This command configures `kubectl` to use the cluster you created. + ## 7. Install an Ingress -The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. +The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. Installing an Ingress requires allocating a public IP address. Ensure you have sufficient quota, otherwise it will fail to assign the IP address. Limits for public IP addresses are applicable at a regional level per subscription. You can use a managed ingress controller provided by GCP or a third-party ingress controller like Traefik. -The following command installs an `nginx-ingress-controller` with a LoadBalancer service: +:::warning +It is not recommended to install a third-party ingress controller, like Traefik, if a managed ingress controller is already being used. +::: -``` -helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx +:::warning +**Ingress-NGINX EOL:** The community `ingress-nginx` controller reaches End-of-Life (EOL) in March 2026. This page uses Traefik, which is the recommended migration path for Rancher environments. +::: + +Traefik includes a native Ingress NGINX provider. This allows you to migrate from NGINX without rewriting your existing Ingress objects, as Traefik will automatically interpret `nginx.ingress.kubernetes.io` annotations. If you are upgrading a cluster that is already using `ingress-nginx`, follow this [guide](https://doc.traefik.io/traefik/migrate/nginx-to-traefik/) for more information. + +To install Traefik (chart version 39.0.0) on a fresh cluster, run the following `helm` commands: +```bash +helm repo add traefik https://traefik.github.io/charts helm repo update helm upgrade --install \ - ingress-nginx ingress-nginx/ingress-nginx \ - --namespace ingress-nginx \ - --set controller.service.type=LoadBalancer \ - --version 4.0.18 \ - --create-namespace + traefik traefik/traefik \ + --namespace traefik \ + --version 39.0.0 \ + --create-namespace \ + --set service.type=LoadBalancer \ + --set ping.enabled=true \ ``` -## 8. Get the Load Balancer IP + +## 8. Get Load Balancer IP To get the address of the load balancer, run: -``` -kubectl get service ingress-nginx-controller --namespace=ingress-nginx +```bash +kubectl get service traefik --namespace=traefik ``` The result should look similar to the following: ``` NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE -ingress-nginx-controller LoadBalancer 10.3.244.156 35.233.206.34 80:31876/TCP,443:32497/TCP 81s +traefik LoadBalancer 10.3.244.156 35.233.206.34 80:31876/TCP,443:32497/TCP 81s ``` Save the `EXTERNAL-IP`. @@ -191,7 +202,7 @@ Use the DNS name from the previous step as the Rancher server URL when you insta When installing Rancher on top of this setup, you will also need to set the name of the ingress controller to be used with Rancher's ingress resource: ``` ---set ingress.ingressClassName=nginx +--set ingress.ingressClassName=traefik ``` Refer [here for the Helm install command](install-upgrade-on-a-kubernetes-cluster.md#5-install-rancher-with-helm-and-your-chosen-certificate-option) for your chosen certificate option. diff --git a/versioned_docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks.md b/versioned_docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks.md index 6aa9bfda5ac..0d299ca6317 100644 --- a/versioned_docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks.md +++ b/versioned_docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks.md @@ -52,12 +52,6 @@ az group create --name rancher-rg --location eastus To create an AKS cluster, run the following command. Use a VM size that applies to your use case. Refer to [this article](https://docs.microsoft.com/en-us/azure/virtual-machines/sizes) for available sizes and options. When choosing a Kubernetes version, be sure to first consult the [support matrix](https://rancher.com/support-matrix/) to find the highest version of Kubernetes that has been validated for your Rancher version. -:::note - -If you're updating from an older version of Kubernetes, to Kubernetes v1.22 or above, you also need to [update](https://kubernetes.github.io/ingress-nginx/user-guide/k8s-122-migration/) ingress-nginx. - -::: - ``` az aks create \ --resource-group rancher-rg \ @@ -81,48 +75,46 @@ This command merges your cluster's credentials into the existing kubeconfig and ## 5. Install an Ingress -The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. Installing an Ingress requires allocating a public IP address. Ensure you have sufficient quota, otherwise it will fail to assign the IP address. Limits for public IP addresses are applicable at a regional level per subscription. +The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. Installing an Ingress requires allocating a public IP address. Ensure you have sufficient quota, otherwise it will fail to assign the IP address. Limits for public IP addresses are applicable at a regional level per subscription. You can use a managed ingress controller provided by Azure or a third-party ingress controller like Traefik. -To make sure that you choose the correct Ingress-NGINX Helm chart, first find an `Ingress-NGINX version` that's compatible with your Kubernetes version in the [Kubernetes/ingress-nginx support table](https://github.com/kubernetes/ingress-nginx#supported-versions-table). +:::warning +It is not recommended to install a third-party ingress controller, like Traefik, if a managed ingress controller is already being used. +::: -Then, list the Helm charts available to you by running the following command: +:::warning +**Ingress-NGINX EOL:** The community `ingress-nginx` controller reaches End-of-Life (EOL) in March 2026. This page uses Traefik, which is the recommended migration path for Rancher environments. +::: -``` -helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx +Traefik includes a native Ingress NGINX provider. This allows you to migrate from NGINX without rewriting your existing Ingress objects, as Traefik will automatically interpret `nginx.ingress.kubernetes.io` annotations. If you are upgrading a cluster that is already using `ingress-nginx`, follow this [guide](https://doc.traefik.io/traefik/migrate/nginx-to-traefik/) for more information. + +To install Traefik (chart version 39.0.0) on a fresh cluster, run the following `helm` commands: +```bash +helm repo add traefik https://traefik.github.io/charts helm repo update -helm search repo ingress-nginx -l -``` - -The `helm search` command's output contains an `APP VERSION` column. The versions under this column are equivalent to the `Ingress-NGINX version` you chose earlier. Using the app version, select a chart version that bundles an app compatible with your Kubernetes install. For example, if you have Kubernetes v1.24, you can select the v4.6.0 Helm chart, since Ingress-NGINX v1.7.0 comes bundled with that chart, and v1.7.0 is compatible with Kubernetes v1.24. When in doubt, select the most recent compatible version. - -Now that you know which Helm chart `version` you need, run the following command. It installs an `nginx-ingress-controller` with a Kubernetes load balancer service: - -``` -helm search repo ingress-nginx -l helm upgrade --install \ - ingress-nginx ingress-nginx/ingress-nginx \ - --namespace ingress-nginx \ - --set controller.service.type=LoadBalancer \ - --set controller.service.annotations."service\.beta\.kubernetes\.io/azure-load-balancer-health-probe-request-path"=/healthz \ - --set controller.service.externalTrafficPolicy=Local \ - --version 4.6.0 \ - --create-namespace + traefik traefik/traefik \ + --namespace traefik \ + --version 39.0.0 \ + --create-namespace \ + --set service.type=LoadBalancer \ + --set ping.enabled=true \ + --set service.annotations."service\.beta\.kubernetes\.io/azure-load-balancer-health-probe-request-path"=/ping ``` ## 6. Get Load Balancer IP To get the address of the load balancer, run: -``` -kubectl get service ingress-nginx-controller --namespace=ingress-nginx +```bash +kubectl get service traefik --namespace=traefik ``` The result should look similar to the following: -``` +```bash NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE -ingress-nginx-controller LoadBalancer 10.0.116.18 40.31.180.83 80:31229/TCP,443:31050/TCP +traefik LoadBalancer 10.0.116.18 40.31.180.83 80:31229/TCP,443:31050/TCP 67s ``` @@ -145,7 +137,7 @@ Use that DNS name from the previous step as the Rancher server URL when you inst When installing Rancher on top of this setup, you will also need to pass the value below into the Rancher Helm install command in order to set the name of the ingress controller to be used with Rancher's ingress resource: ``` ---set ingress.ingressClassName=nginx +--set ingress.ingressClassName=traefik ``` Refer [here for the Helm install command](install-upgrade-on-a-kubernetes-cluster.md#5-install-rancher-with-helm-and-your-chosen-certificate-option) for your chosen certificate option. diff --git a/versioned_docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md b/versioned_docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md index 85c83a2d503..6b9c38b344e 100644 --- a/versioned_docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md +++ b/versioned_docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md @@ -52,8 +52,6 @@ Then enter the following values: To create an EKS cluster, run the following command. Use the AWS region that applies to your use case. When choosing a Kubernetes version, be sure to first consult the [support matrix](https://rancher.com/support-matrix/) to find the highest version of Kubernetes that has been validated for your Rancher version. -**Note:** If you're updating from an older version of Kubernetes, to Kubernetes v1.22 or above, you also need to [update](https://kubernetes.github.io/ingress-nginx/user-guide/k8s-122-migration/) ingress-nginx. - ``` eksctl create cluster \ --name rancher-server \ @@ -88,46 +86,48 @@ rancher-server-cluster us-west-2 True ### 5. Install an Ingress -The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. +The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. Installing an Ingress requires allocating a public IP address. Ensure you have sufficient quota, otherwise it will fail to assign the IP address. Limits for public IP addresses are applicable at a regional level per subscription. You can use a managed ingress controller provided by AWS (ALB) or a third-party ingress controller like Traefik. -To make sure that you choose the correct Ingress-NGINX Helm chart, first find an `Ingress-NGINX version` that's compatible with your Kubernetes version in the [Kubernetes/ingress-nginx support table](https://github.com/kubernetes/ingress-nginx#supported-versions-table). +:::warning +It is not recommended to install a third-party ingress controller, like Traefik, if a managed ingress controller (ALB) is already being used. +::: -Then, list the Helm charts available to you by running the following command: -``` -helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx +:::warning +**Ingress-NGINX EOL:** The community `ingress-nginx` controller reaches End-of-Life (EOL) in March 2026. This page uses Traefik, which is the recommended migration path for Rancher environments. +::: + +Traefik includes a native Ingress NGINX provider. This allows you to migrate from NGINX without rewriting your existing Ingress objects, as Traefik will automatically interpret `nginx.ingress.kubernetes.io` annotations. If you are upgrading a cluster that is already using `ingress-nginx`, follow this [guide](https://doc.traefik.io/traefik/migrate/nginx-to-traefik/) for more information. + +To install Traefik (chart version 39.0.0) on a fresh cluster, run the following `helm` commands: +```bash +helm repo add traefik https://traefik.github.io/charts helm repo update -helm search repo ingress-nginx -l -``` - -The `helm search` command's output contains an `APP VERSION` column. The versions under this column are equivalent to the `Ingress-NGINX version` you chose earlier. Using the app version, select a chart version that bundles an app compatible with your Kubernetes install. For example, if you have Kubernetes v1.23, you can select the v4.6.0 Helm chart, since Ingress-NGINX v1.7.0 comes bundled with that chart, and v1.7.0 is compatible with Kubernetes v1.23. When in doubt, select the most recent compatible version. - -Now that you know which Helm chart `version` you need, run the following command. It installs an `nginx-ingress-controller` with a Kubernetes load balancer service: - -``` helm upgrade --install \ - ingress-nginx ingress-nginx/ingress-nginx \ - --namespace ingress-nginx \ - --set controller.service.type=LoadBalancer \ - --version 4.6.0 \ - --create-namespace + traefik traefik/traefik \ + --namespace traefik \ + --version 39.0.0 \ + --create-namespace \ + --set service.type=LoadBalancer \ + --set ping.enabled=true \ ``` + ### 6. Get Load Balancer IP To get the address of the load balancer, run: -``` -kubectl get service ingress-nginx-controller --namespace=ingress-nginx +```bash +kubectl get service traefik --namespace=traefik ``` The result should look similar to the following: -``` -NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) +```bash +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE -ingress-nginx-controller LoadBalancer 10.100.90.18 a904a952c73bf4f668a17c46ac7c56ab-962521486.us-west-2.elb.amazonaws.com 80:31229/TCP,443:31050/TCP - 27m +traefik LoadBalancer 10.100.90.18 a904a952c73bf4f668a17c46ac7c56ab-962521486.us-west-2.elb.amazonaws.com 80:31229/TCP,443:31050/TCP + 67s ``` Save the `EXTERNAL-IP`. @@ -149,7 +149,7 @@ Use that DNS name from the previous step as the Rancher server URL when you inst When installing Rancher on top of this setup, you will also need to pass the value below into the Rancher Helm install command in order to set the name of the ingress controller to be used with Rancher's ingress resource: ``` ---set ingress.ingressClassName=nginx +--set ingress.ingressClassName=traefik ``` Refer [here for the Helm install command](install-upgrade-on-a-kubernetes-cluster.md#5-install-rancher-with-helm-and-your-chosen-certificate-option) for your chosen certificate option. diff --git a/versioned_docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke.md b/versioned_docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke.md index a3c3518e4c0..093c5fb589e 100644 --- a/versioned_docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke.md +++ b/versioned_docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke.md @@ -124,7 +124,6 @@ When choosing a Kubernetes version, be sure to first consult the [support matrix To successfully create a GKE cluster with Rancher, your GKE must be in Standard mode. GKE has two modes of operation when creating a Kubernetes cluster, Autopilot and Standard mode. The cluster configuration for Autopilot mode has restrictions on editing the kube-system namespace. However, Rancher needs to create resources in the kube-system namespace during installation. As a result, you will not be able to install Rancher on a GKE cluster created in Autopilot mode. For more information about the difference between GKE Autopilot mode and Standard mode, visit [Compare GKE Autopilot and Standard.](https://cloud.google.com/kubernetes-engine/docs/resources/autopilot-standard-feature-comparison) -**Note:** If you're updating from an older version of Kubernetes, to Kubernetes v1.22 or above, you also need to [update](https://kubernetes.github.io/ingress-nginx/user-guide/k8s-122-migration/) ingress-nginx. ``` gcloud container clusters create cluster-name --num-nodes=3 --cluster-version= @@ -140,36 +139,48 @@ gcloud container clusters get-credentials cluster-name This command configures `kubectl` to use the cluster you created. + ## 7. Install an Ingress -The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. +The cluster needs an Ingress so that Rancher can be accessed from outside the cluster. Installing an Ingress requires allocating a public IP address. Ensure you have sufficient quota, otherwise it will fail to assign the IP address. Limits for public IP addresses are applicable at a regional level per subscription. You can use a managed ingress controller provided by GCP or a third-party ingress controller like Traefik. -The following command installs an `nginx-ingress-controller` with a LoadBalancer service: +:::warning +It is not recommended to install a third-party ingress controller, like Traefik, if a managed ingress controller is already being used. +::: -``` -helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx +:::warning +**Ingress-NGINX EOL:** The community `ingress-nginx` controller reaches End-of-Life (EOL) in March 2026. This page uses Traefik, which is the recommended migration path for Rancher environments. +::: + +Traefik includes a native Ingress NGINX provider. This allows you to migrate from NGINX without rewriting your existing Ingress objects, as Traefik will automatically interpret `nginx.ingress.kubernetes.io` annotations. If you are upgrading a cluster that is already using `ingress-nginx`, follow this [guide](https://doc.traefik.io/traefik/migrate/nginx-to-traefik/) for more information. + +To install Traefik (chart version 39.0.0) on a fresh cluster, run the following `helm` commands: +```bash +helm repo add traefik https://traefik.github.io/charts helm repo update helm upgrade --install \ - ingress-nginx ingress-nginx/ingress-nginx \ - --namespace ingress-nginx \ - --set controller.service.type=LoadBalancer \ - --version 4.0.18 \ - --create-namespace + traefik traefik/traefik \ + --namespace traefik \ + --version 39.0.0 \ + --create-namespace \ + --set service.type=LoadBalancer \ + --set ping.enabled=true \ ``` -## 8. Get the Load Balancer IP + +## 8. Get Load Balancer IP To get the address of the load balancer, run: -``` -kubectl get service ingress-nginx-controller --namespace=ingress-nginx +```bash +kubectl get service traefik --namespace=traefik ``` The result should look similar to the following: ``` NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE -ingress-nginx-controller LoadBalancer 10.3.244.156 35.233.206.34 80:31876/TCP,443:32497/TCP 81s +traefik LoadBalancer 10.3.244.156 35.233.206.34 80:31876/TCP,443:32497/TCP 81s ``` Save the `EXTERNAL-IP`. @@ -191,7 +202,7 @@ Use the DNS name from the previous step as the Rancher server URL when you insta When installing Rancher on top of this setup, you will also need to set the name of the ingress controller to be used with Rancher's ingress resource: ``` ---set ingress.ingressClassName=nginx +--set ingress.ingressClassName=traefik ``` Refer [here for the Helm install command](install-upgrade-on-a-kubernetes-cluster.md#5-install-rancher-with-helm-and-your-chosen-certificate-option) for your chosen certificate option. From fc747f457a92aac1584054b0f0fbb340716a1d24 Mon Sep 17 00:00:00 2001 From: Meza Date: Thu, 12 Mar 2026 13:21:03 -0400 Subject: [PATCH 10/12] [main] Replace references to deprecated Helm chart values (#2221) * [main] Replace references to deprecated Helm chart values Signed-off-by: Meza --------- Signed-off-by: Meza Co-authored-by: Lucas Saintarbor --- .../air-gapped-upgrades.md | 8 ++--- .../helm-chart-options.md | 31 +++++++++-------- .../install-rancher-ha.md | 8 ++--- .../enable-experimental-features.md | 2 +- .../air-gapped-upgrades.md | 8 ++--- .../helm-chart-options.md | 34 +++++++++++-------- .../install-rancher-ha.md | 8 ++--- .../enable-experimental-features.md | 2 +- .../air-gapped-upgrades.md | 8 ++--- .../helm-chart-options.md | 31 +++++++++-------- .../install-rancher-ha.md | 8 ++--- .../enable-experimental-features.md | 2 +- .../air-gapped-upgrades.md | 8 ++--- .../helm-chart-options.md | 31 +++++++++-------- .../install-rancher-ha.md | 8 ++--- .../enable-experimental-features.md | 2 +- 16 files changed, 103 insertions(+), 96 deletions(-) diff --git a/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/air-gapped-upgrades.md b/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/air-gapped-upgrades.md index e7ded014194..e71802845f6 100644 --- a/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/air-gapped-upgrades.md +++ b/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/air-gapped-upgrades.md @@ -33,7 +33,7 @@ helm upgrade rancher ./rancher-.tgz \ --namespace cattle-system \ --set hostname= \ --set certmanager.version= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher --set useBundledSystemChart=true # Use the packaged Rancher system charts ``` @@ -48,7 +48,7 @@ helm template rancher ./rancher-.tgz --output-dir . \ --namespace cattle-system \ --set hostname= \ --set certmanager.version= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher --set useBundledSystemChart=true # Use the packaged Rancher system charts ``` @@ -65,7 +65,7 @@ kubectl -n cattle-system apply -R -f ./rancher helm upgrade rancher ./rancher-.tgz \ --namespace cattle-system \ --set hostname= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set ingress.tls.source=secret \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher --set useBundledSystemChart=true # Use the packaged Rancher system charts @@ -77,7 +77,7 @@ If you are using a Private CA signed cert, add `--set privateCA=true` following helm upgrade rancher ./rancher-.tgz \ --namespace cattle-system \ --set hostname= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set ingress.tls.source=secret \ --set privateCA=true \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher diff --git a/docs/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md b/docs/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md index 3ee46920bbd..873e125ced0 100644 --- a/docs/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md +++ b/docs/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md @@ -32,37 +32,38 @@ For information on enabling experimental features, refer to [this page.](../../. | ------------------------------ | ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | | `additionalTrustedCAs` | false | `bool` - See [Additional Trusted CAs](#additional-trusted-cas) | | `addLocal` | "true" | `string` - Have Rancher detect and import the "local" (upstream) Rancher server cluster. _Note: This option is no longer available in v2.5.0. Consider using the `restrictedAdmin` option to prevent users from modifying the local cluster._ | -| `agentTLSMode` | "" | `string` - either `system-store` or `strict`. See [Agent TLS Enforcement](./tls-settings.md#agent-tls-enforcement) | +| `agentTLSMode` | "" | `string` - either `system-store` or `strict`. See [Agent TLS Enforcement](./tls-settings.md#agent-tls-enforcement) | | `antiAffinity` | "preferred" | `string` - AntiAffinity rule for Rancher pods - "preferred, required" | | `auditLog.destination` | "sidecar" | `string` - Stream to sidecar container console or hostPath volume - "sidecar, hostPath" | | `auditLog.hostPath` | "/var/log/rancher/audit" | `string` - log file destination on host (only applies when `auditLog.destination` is set to `hostPath`) | -| `auditLog.enabled` | false | `bool` - Enables / disables audit logging. | -| `auditLog.level` | 0 | `int` - Sets the [API Audit Log](../../../how-to-guides/advanced-user-guides/enable-api-audit-log.md) level [0-3]. | +| `auditLog.enabled` | false | `bool` - Enables / disables audit logging. | +| `auditLog.level` | 0 | `int` - Sets the [API Audit Log](../../../how-to-guides/advanced-user-guides/enable-api-audit-log.md) level [0-3]. | | `auditLog.maxAge` | 1 | `int` - maximum number of days to retain old audit log files (only applies when `auditLog.destination` is set to `hostPath`) | | `auditLog.maxBackup` | 1 | `int` - maximum number of audit log files to retain (only applies when `auditLog.destination` is set to `hostPath`) | | `auditLog.maxSize` | 100 | `int` - maximum size in megabytes of the audit log file before it gets rotated (only applies when `auditLog.destination` is set to `hostPath`) | | `auditLog.image.repository` | "registry.suse.com/bci/bci-micro" | `string` - Location for the image used to collect audit logs. | | `auditLog.image.tag` | "15.4.14.3" | `string` - Tag for the image used to collect audit logs. | -| `auditLog.image.pullPolicy` | "IfNotPresent" | `string` - Override imagePullPolicy for auditLog images - "Always", "Never", "IfNotPresent". | -| `busyboxImage` | "" | `string` - Image location for busybox image used to collect audit logs. _Note: This option is deprecated use `auditLog.image.repository` to control auditing sidecar image._ | +| `auditLog.image.pullPolicy` | "IfNotPresent" | `string` - Override imagePullPolicy for auditLog images - "Always", "Never", "IfNotPresent". | +| `busyboxImage` | "" | `string` - Image location for busybox image used to collect audit logs. _Note: This option is deprecated use `auditLog.image.repository` to control auditing sidecar image._ | | `certmanager.version` | "" | `string` - set cert-manager compatibility | | `debug` | false | `bool` - set debug flag on rancher server | -| `extraEnv` | [] | `list` - set additional environment variables for Rancher | +| `extraEnv` | [] | `list` - set additional environment variables for Rancher | | `imagePullSecrets` | [] | `list` - list of names of Secret resource containing private registry credentials | -| `ingress.configurationSnippet` | "" | `string` - additional Nginx configuration. Can be used for proxy configuration. | +| `ingress.configurationSnippet` | "" | `string` - additional Nginx configuration. Can be used for proxy configuration. | | `ingress.extraAnnotations` | {} | `map` - additional annotations to customize the ingress | -| `ingress.enabled` | true | When set to false, Helm will not install a Rancher ingress. Set the option to false to deploy your own ingress. | +| `ingress.enabled` | true | `string` - When set to false, Helm will not install a Rancher ingress. Set the option to false to deploy your own ingress. | | `letsEncrypt.ingress.class` | "" | `string` - optional ingress class for the cert-manager acmesolver ingress that responds to the Let's Encrypt ACME challenges. Options: traefik, nginx. | | -| `noProxy` | "127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.cluster.local,cattle-system.svc" | `string` - comma separated list of hostnames or ip address not to use the proxy | | +| `noProxy` | "127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.cluster.local,cattle-system.svc" | `string` - comma separated list of hostnames or ip address not to use the proxy | | | `proxy` | "" | `string` - HTTP[S] proxy server for Rancher | -| `rancherImage` | "rancher/rancher" | `string` - rancher image source | -| `rancherImagePullPolicy` | "IfNotPresent" | `string` - Override imagePullPolicy for rancher server images - "Always", "Never", "IfNotPresent" | -| `rancherImageTag` | same as chart version | `string` - rancher/rancher image tag | -| `replicas` | 3 | `int` - Number of Rancher server replicas. Setting to -1 will dynamically choose 1, 2, or 3 based on the number of available nodes in the cluster. | +| `image.registry` | "" | `string` - Override rancher image-specific registry, e.g, http://registry.example.com/ | +| `image.repository` | "rancher/rancher" | `string` - Rancher image source | +| `image.pullPolicy` | "IfNotPresent" | `string` - Override imagePullPolicy for rancher server images - "Always", "Never", "IfNotPresent" | +| `image.tag` | "" | `string` - Defaults to .Chart.appVersion for rancher/rancher image tag | +| `replicas` | 3 | `int` - Number of Rancher server replicas. Setting to -1 will dynamically choose 1, 2, or 3 based on the number of available nodes in the cluster.| | `resources` | {} | `map` - rancher pod resource requests & limits | -| `systemDefaultRegistry` | "" | `string` - private registry to be used for all system container images, e.g., http://registry.example.com/ | +| `systemDefaultRegistry` | "" | `string` - private registry to be used for all system container images, e.g., http://registry.example.com/ | | `tls` | "ingress" | `string` - See [External TLS Termination](#external-tls-termination) for details. - "ingress, external" | -| `useBundledSystemChart` | `false` | `bool` - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations. | +| `useBundledSystemChart` | `false` | `bool` - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations. | When using Rancher v2.12.0 and above, Rancher will use an audit logging controller that watches `AuditPolicy` CRs for configuring additional redactions, for more info see [API Audit Log](../../../how-to-guides/advanced-user-guides/enable-api-audit-log.md). diff --git a/docs/getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/install-rancher-ha.md b/docs/getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/install-rancher-ha.md index dd4ca193bce..6a4eb8bcd5d 100644 --- a/docs/getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/install-rancher-ha.md +++ b/docs/getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/install-rancher-ha.md @@ -185,12 +185,12 @@ Placeholder | Description --namespace cattle-system \ --set hostname= \ --set certmanager.version= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher --set useBundledSystemChart=true # Use the packaged Rancher system charts ``` -**Optional**: To install a specific Rancher version, set the `rancherImageTag` value, example: `--set rancherImageTag=v2.5.8` +**Optional**: To install a specific Rancher version, set the `image.tag` value, example: `--set image.tag=v2.10.3` #### Option B: Certificates From Files Using Kubernetes Secrets @@ -213,7 +213,7 @@ Install Rancher, declaring your chosen options. Use the reference table below to helm install rancher ./rancher-.tgz \ --namespace cattle-system \ --set hostname= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set ingress.tls.source=secret \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher --set useBundledSystemChart=true # Use the packaged Rancher system charts @@ -225,7 +225,7 @@ If you are using a Private CA signed cert, add `--set privateCA=true` following helm install rancher ./rancher-.tgz \ --namespace cattle-system \ --set hostname= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set ingress.tls.source=secret \ --set privateCA=true \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher diff --git a/docs/how-to-guides/advanced-user-guides/enable-experimental-features/enable-experimental-features.md b/docs/how-to-guides/advanced-user-guides/enable-experimental-features/enable-experimental-features.md index 5aafc84e1e7..b6bc8208574 100644 --- a/docs/how-to-guides/advanced-user-guides/enable-experimental-features/enable-experimental-features.md +++ b/docs/how-to-guides/advanced-user-guides/enable-experimental-features/enable-experimental-features.md @@ -64,7 +64,7 @@ When you install the Helm chart, you should pass in feature flag names in a comm helm install rancher ./rancher-.tgz \ --namespace cattle-system \ --set hostname= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set ingress.tls.source=secret \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher --set useBundledSystemChart=true # Use the packaged Rancher system charts diff --git a/versioned_docs/version-2.12/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/air-gapped-upgrades.md b/versioned_docs/version-2.12/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/air-gapped-upgrades.md index e7ded014194..e71802845f6 100644 --- a/versioned_docs/version-2.12/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/air-gapped-upgrades.md +++ b/versioned_docs/version-2.12/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/air-gapped-upgrades.md @@ -33,7 +33,7 @@ helm upgrade rancher ./rancher-.tgz \ --namespace cattle-system \ --set hostname= \ --set certmanager.version= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher --set useBundledSystemChart=true # Use the packaged Rancher system charts ``` @@ -48,7 +48,7 @@ helm template rancher ./rancher-.tgz --output-dir . \ --namespace cattle-system \ --set hostname= \ --set certmanager.version= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher --set useBundledSystemChart=true # Use the packaged Rancher system charts ``` @@ -65,7 +65,7 @@ kubectl -n cattle-system apply -R -f ./rancher helm upgrade rancher ./rancher-.tgz \ --namespace cattle-system \ --set hostname= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set ingress.tls.source=secret \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher --set useBundledSystemChart=true # Use the packaged Rancher system charts @@ -77,7 +77,7 @@ If you are using a Private CA signed cert, add `--set privateCA=true` following helm upgrade rancher ./rancher-.tgz \ --namespace cattle-system \ --set hostname= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set ingress.tls.source=secret \ --set privateCA=true \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher diff --git a/versioned_docs/version-2.12/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md b/versioned_docs/version-2.12/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md index 3ee46920bbd..2a70338a693 100644 --- a/versioned_docs/version-2.12/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md +++ b/versioned_docs/version-2.12/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md @@ -32,37 +32,41 @@ For information on enabling experimental features, refer to [this page.](../../. | ------------------------------ | ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | | `additionalTrustedCAs` | false | `bool` - See [Additional Trusted CAs](#additional-trusted-cas) | | `addLocal` | "true" | `string` - Have Rancher detect and import the "local" (upstream) Rancher server cluster. _Note: This option is no longer available in v2.5.0. Consider using the `restrictedAdmin` option to prevent users from modifying the local cluster._ | -| `agentTLSMode` | "" | `string` - either `system-store` or `strict`. See [Agent TLS Enforcement](./tls-settings.md#agent-tls-enforcement) | +| `agentTLSMode` | "" | `string` - either `system-store` or `strict`. See [Agent TLS Enforcement](./tls-settings.md#agent-tls-enforcement) | | `antiAffinity` | "preferred" | `string` - AntiAffinity rule for Rancher pods - "preferred, required" | | `auditLog.destination` | "sidecar" | `string` - Stream to sidecar container console or hostPath volume - "sidecar, hostPath" | | `auditLog.hostPath` | "/var/log/rancher/audit" | `string` - log file destination on host (only applies when `auditLog.destination` is set to `hostPath`) | -| `auditLog.enabled` | false | `bool` - Enables / disables audit logging. | -| `auditLog.level` | 0 | `int` - Sets the [API Audit Log](../../../how-to-guides/advanced-user-guides/enable-api-audit-log.md) level [0-3]. | +| `auditLog.enabled` | false | `bool` - Enables / disables audit logging. | +| `auditLog.level` | 0 | `int` - Sets the [API Audit Log](../../../how-to-guides/advanced-user-guides/enable-api-audit-log.md) level [0-3]. | | `auditLog.maxAge` | 1 | `int` - maximum number of days to retain old audit log files (only applies when `auditLog.destination` is set to `hostPath`) | | `auditLog.maxBackup` | 1 | `int` - maximum number of audit log files to retain (only applies when `auditLog.destination` is set to `hostPath`) | | `auditLog.maxSize` | 100 | `int` - maximum size in megabytes of the audit log file before it gets rotated (only applies when `auditLog.destination` is set to `hostPath`) | | `auditLog.image.repository` | "registry.suse.com/bci/bci-micro" | `string` - Location for the image used to collect audit logs. | | `auditLog.image.tag` | "15.4.14.3" | `string` - Tag for the image used to collect audit logs. | -| `auditLog.image.pullPolicy` | "IfNotPresent" | `string` - Override imagePullPolicy for auditLog images - "Always", "Never", "IfNotPresent". | -| `busyboxImage` | "" | `string` - Image location for busybox image used to collect audit logs. _Note: This option is deprecated use `auditLog.image.repository` to control auditing sidecar image._ | +| `auditLog.image.pullPolicy` | "IfNotPresent" | `string` - Override imagePullPolicy for auditLog images - "Always", "Never", "IfNotPresent". | +| `busyboxImage` | "" | `string` - Image location for busybox image used to collect audit logs. _Note: This option is deprecated use `auditLog.image.repository` to control auditing sidecar image._ | | `certmanager.version` | "" | `string` - set cert-manager compatibility | | `debug` | false | `bool` - set debug flag on rancher server | -| `extraEnv` | [] | `list` - set additional environment variables for Rancher | +| `extraEnv` | [] | `list` - set additional environment variables for Rancher | | `imagePullSecrets` | [] | `list` - list of names of Secret resource containing private registry credentials | -| `ingress.configurationSnippet` | "" | `string` - additional Nginx configuration. Can be used for proxy configuration. | +| `ingress.configurationSnippet` | "" | `string` - additional Nginx configuration. Can be used for proxy configuration. | | `ingress.extraAnnotations` | {} | `map` - additional annotations to customize the ingress | -| `ingress.enabled` | true | When set to false, Helm will not install a Rancher ingress. Set the option to false to deploy your own ingress. | +| `ingress.enabled` | true | `string` - When set to false, Helm will not install a Rancher ingress. Set the option to false to deploy your own ingress. | | `letsEncrypt.ingress.class` | "" | `string` - optional ingress class for the cert-manager acmesolver ingress that responds to the Let's Encrypt ACME challenges. Options: traefik, nginx. | | -| `noProxy` | "127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.cluster.local,cattle-system.svc" | `string` - comma separated list of hostnames or ip address not to use the proxy | | +| `noProxy` | "127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.cluster.local,cattle-system.svc" | `string` - comma separated list of hostnames or ip address not to use the proxy | | | `proxy` | "" | `string` - HTTP[S] proxy server for Rancher | -| `rancherImage` | "rancher/rancher" | `string` - rancher image source | -| `rancherImagePullPolicy` | "IfNotPresent" | `string` - Override imagePullPolicy for rancher server images - "Always", "Never", "IfNotPresent" | -| `rancherImageTag` | same as chart version | `string` - rancher/rancher image tag | -| `replicas` | 3 | `int` - Number of Rancher server replicas. Setting to -1 will dynamically choose 1, 2, or 3 based on the number of available nodes in the cluster. | +| `rancherImage` | "rancher/rancher" | `string` - rancher image source _Note: This option is deprecated in v2.12.0. Use `image.repository` instead._ | +| `rancherImagePullPolicy` | "IfNotPresent" | `string` - Override imagePullPolicy for rancher server images - "Always", "Never", "IfNotPresent" _Note: This option is deprecated as of v2.12.0. Use `image.pullPolicy` instead._ | +| `rancherImageTag` | same as chart version | `string` - rancher/rancher image tag _Note: This option is deprecated in v2.12.0. Use `image.tag` instead._ | +| `image.registry` | "" | `string` - Override rancher image-specific registry, e.g, http://registry.example.com/ | +| `image.repository` | "rancher/rancher" | `string` - Rancher image source | +| `image.pullPolicy` | "IfNotPresent" | `string` - Override imagePullPolicy for rancher server images - "Always", "Never", "IfNotPresent" | +| `image.tag` | "" | `string` - Defaults to .Chart.appVersion for rancher/rancher image tag | +| `replicas` | 3 | `int` - Number of Rancher server replicas. Setting to -1 will dynamically choose 1, 2, or 3 based on the number of available nodes in the cluster.| | `resources` | {} | `map` - rancher pod resource requests & limits | -| `systemDefaultRegistry` | "" | `string` - private registry to be used for all system container images, e.g., http://registry.example.com/ | +| `systemDefaultRegistry` | "" | `string` - private registry to be used for all system container images, e.g., http://registry.example.com/ | | `tls` | "ingress" | `string` - See [External TLS Termination](#external-tls-termination) for details. - "ingress, external" | -| `useBundledSystemChart` | `false` | `bool` - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations. | +| `useBundledSystemChart` | `false` | `bool` - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations. | When using Rancher v2.12.0 and above, Rancher will use an audit logging controller that watches `AuditPolicy` CRs for configuring additional redactions, for more info see [API Audit Log](../../../how-to-guides/advanced-user-guides/enable-api-audit-log.md). diff --git a/versioned_docs/version-2.12/getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/install-rancher-ha.md b/versioned_docs/version-2.12/getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/install-rancher-ha.md index dd4ca193bce..6a4eb8bcd5d 100644 --- a/versioned_docs/version-2.12/getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/install-rancher-ha.md +++ b/versioned_docs/version-2.12/getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/install-rancher-ha.md @@ -185,12 +185,12 @@ Placeholder | Description --namespace cattle-system \ --set hostname= \ --set certmanager.version= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher --set useBundledSystemChart=true # Use the packaged Rancher system charts ``` -**Optional**: To install a specific Rancher version, set the `rancherImageTag` value, example: `--set rancherImageTag=v2.5.8` +**Optional**: To install a specific Rancher version, set the `image.tag` value, example: `--set image.tag=v2.10.3` #### Option B: Certificates From Files Using Kubernetes Secrets @@ -213,7 +213,7 @@ Install Rancher, declaring your chosen options. Use the reference table below to helm install rancher ./rancher-.tgz \ --namespace cattle-system \ --set hostname= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set ingress.tls.source=secret \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher --set useBundledSystemChart=true # Use the packaged Rancher system charts @@ -225,7 +225,7 @@ If you are using a Private CA signed cert, add `--set privateCA=true` following helm install rancher ./rancher-.tgz \ --namespace cattle-system \ --set hostname= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set ingress.tls.source=secret \ --set privateCA=true \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher diff --git a/versioned_docs/version-2.12/how-to-guides/advanced-user-guides/enable-experimental-features/enable-experimental-features.md b/versioned_docs/version-2.12/how-to-guides/advanced-user-guides/enable-experimental-features/enable-experimental-features.md index 5aafc84e1e7..b6bc8208574 100644 --- a/versioned_docs/version-2.12/how-to-guides/advanced-user-guides/enable-experimental-features/enable-experimental-features.md +++ b/versioned_docs/version-2.12/how-to-guides/advanced-user-guides/enable-experimental-features/enable-experimental-features.md @@ -64,7 +64,7 @@ When you install the Helm chart, you should pass in feature flag names in a comm helm install rancher ./rancher-.tgz \ --namespace cattle-system \ --set hostname= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set ingress.tls.source=secret \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher --set useBundledSystemChart=true # Use the packaged Rancher system charts diff --git a/versioned_docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/air-gapped-upgrades.md b/versioned_docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/air-gapped-upgrades.md index e7ded014194..e71802845f6 100644 --- a/versioned_docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/air-gapped-upgrades.md +++ b/versioned_docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/air-gapped-upgrades.md @@ -33,7 +33,7 @@ helm upgrade rancher ./rancher-.tgz \ --namespace cattle-system \ --set hostname= \ --set certmanager.version= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher --set useBundledSystemChart=true # Use the packaged Rancher system charts ``` @@ -48,7 +48,7 @@ helm template rancher ./rancher-.tgz --output-dir . \ --namespace cattle-system \ --set hostname= \ --set certmanager.version= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher --set useBundledSystemChart=true # Use the packaged Rancher system charts ``` @@ -65,7 +65,7 @@ kubectl -n cattle-system apply -R -f ./rancher helm upgrade rancher ./rancher-.tgz \ --namespace cattle-system \ --set hostname= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set ingress.tls.source=secret \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher --set useBundledSystemChart=true # Use the packaged Rancher system charts @@ -77,7 +77,7 @@ If you are using a Private CA signed cert, add `--set privateCA=true` following helm upgrade rancher ./rancher-.tgz \ --namespace cattle-system \ --set hostname= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set ingress.tls.source=secret \ --set privateCA=true \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher diff --git a/versioned_docs/version-2.13/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md b/versioned_docs/version-2.13/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md index 3ee46920bbd..873e125ced0 100644 --- a/versioned_docs/version-2.13/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md +++ b/versioned_docs/version-2.13/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md @@ -32,37 +32,38 @@ For information on enabling experimental features, refer to [this page.](../../. | ------------------------------ | ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | | `additionalTrustedCAs` | false | `bool` - See [Additional Trusted CAs](#additional-trusted-cas) | | `addLocal` | "true" | `string` - Have Rancher detect and import the "local" (upstream) Rancher server cluster. _Note: This option is no longer available in v2.5.0. Consider using the `restrictedAdmin` option to prevent users from modifying the local cluster._ | -| `agentTLSMode` | "" | `string` - either `system-store` or `strict`. See [Agent TLS Enforcement](./tls-settings.md#agent-tls-enforcement) | +| `agentTLSMode` | "" | `string` - either `system-store` or `strict`. See [Agent TLS Enforcement](./tls-settings.md#agent-tls-enforcement) | | `antiAffinity` | "preferred" | `string` - AntiAffinity rule for Rancher pods - "preferred, required" | | `auditLog.destination` | "sidecar" | `string` - Stream to sidecar container console or hostPath volume - "sidecar, hostPath" | | `auditLog.hostPath` | "/var/log/rancher/audit" | `string` - log file destination on host (only applies when `auditLog.destination` is set to `hostPath`) | -| `auditLog.enabled` | false | `bool` - Enables / disables audit logging. | -| `auditLog.level` | 0 | `int` - Sets the [API Audit Log](../../../how-to-guides/advanced-user-guides/enable-api-audit-log.md) level [0-3]. | +| `auditLog.enabled` | false | `bool` - Enables / disables audit logging. | +| `auditLog.level` | 0 | `int` - Sets the [API Audit Log](../../../how-to-guides/advanced-user-guides/enable-api-audit-log.md) level [0-3]. | | `auditLog.maxAge` | 1 | `int` - maximum number of days to retain old audit log files (only applies when `auditLog.destination` is set to `hostPath`) | | `auditLog.maxBackup` | 1 | `int` - maximum number of audit log files to retain (only applies when `auditLog.destination` is set to `hostPath`) | | `auditLog.maxSize` | 100 | `int` - maximum size in megabytes of the audit log file before it gets rotated (only applies when `auditLog.destination` is set to `hostPath`) | | `auditLog.image.repository` | "registry.suse.com/bci/bci-micro" | `string` - Location for the image used to collect audit logs. | | `auditLog.image.tag` | "15.4.14.3" | `string` - Tag for the image used to collect audit logs. | -| `auditLog.image.pullPolicy` | "IfNotPresent" | `string` - Override imagePullPolicy for auditLog images - "Always", "Never", "IfNotPresent". | -| `busyboxImage` | "" | `string` - Image location for busybox image used to collect audit logs. _Note: This option is deprecated use `auditLog.image.repository` to control auditing sidecar image._ | +| `auditLog.image.pullPolicy` | "IfNotPresent" | `string` - Override imagePullPolicy for auditLog images - "Always", "Never", "IfNotPresent". | +| `busyboxImage` | "" | `string` - Image location for busybox image used to collect audit logs. _Note: This option is deprecated use `auditLog.image.repository` to control auditing sidecar image._ | | `certmanager.version` | "" | `string` - set cert-manager compatibility | | `debug` | false | `bool` - set debug flag on rancher server | -| `extraEnv` | [] | `list` - set additional environment variables for Rancher | +| `extraEnv` | [] | `list` - set additional environment variables for Rancher | | `imagePullSecrets` | [] | `list` - list of names of Secret resource containing private registry credentials | -| `ingress.configurationSnippet` | "" | `string` - additional Nginx configuration. Can be used for proxy configuration. | +| `ingress.configurationSnippet` | "" | `string` - additional Nginx configuration. Can be used for proxy configuration. | | `ingress.extraAnnotations` | {} | `map` - additional annotations to customize the ingress | -| `ingress.enabled` | true | When set to false, Helm will not install a Rancher ingress. Set the option to false to deploy your own ingress. | +| `ingress.enabled` | true | `string` - When set to false, Helm will not install a Rancher ingress. Set the option to false to deploy your own ingress. | | `letsEncrypt.ingress.class` | "" | `string` - optional ingress class for the cert-manager acmesolver ingress that responds to the Let's Encrypt ACME challenges. Options: traefik, nginx. | | -| `noProxy` | "127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.cluster.local,cattle-system.svc" | `string` - comma separated list of hostnames or ip address not to use the proxy | | +| `noProxy` | "127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.cluster.local,cattle-system.svc" | `string` - comma separated list of hostnames or ip address not to use the proxy | | | `proxy` | "" | `string` - HTTP[S] proxy server for Rancher | -| `rancherImage` | "rancher/rancher" | `string` - rancher image source | -| `rancherImagePullPolicy` | "IfNotPresent" | `string` - Override imagePullPolicy for rancher server images - "Always", "Never", "IfNotPresent" | -| `rancherImageTag` | same as chart version | `string` - rancher/rancher image tag | -| `replicas` | 3 | `int` - Number of Rancher server replicas. Setting to -1 will dynamically choose 1, 2, or 3 based on the number of available nodes in the cluster. | +| `image.registry` | "" | `string` - Override rancher image-specific registry, e.g, http://registry.example.com/ | +| `image.repository` | "rancher/rancher" | `string` - Rancher image source | +| `image.pullPolicy` | "IfNotPresent" | `string` - Override imagePullPolicy for rancher server images - "Always", "Never", "IfNotPresent" | +| `image.tag` | "" | `string` - Defaults to .Chart.appVersion for rancher/rancher image tag | +| `replicas` | 3 | `int` - Number of Rancher server replicas. Setting to -1 will dynamically choose 1, 2, or 3 based on the number of available nodes in the cluster.| | `resources` | {} | `map` - rancher pod resource requests & limits | -| `systemDefaultRegistry` | "" | `string` - private registry to be used for all system container images, e.g., http://registry.example.com/ | +| `systemDefaultRegistry` | "" | `string` - private registry to be used for all system container images, e.g., http://registry.example.com/ | | `tls` | "ingress" | `string` - See [External TLS Termination](#external-tls-termination) for details. - "ingress, external" | -| `useBundledSystemChart` | `false` | `bool` - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations. | +| `useBundledSystemChart` | `false` | `bool` - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations. | When using Rancher v2.12.0 and above, Rancher will use an audit logging controller that watches `AuditPolicy` CRs for configuring additional redactions, for more info see [API Audit Log](../../../how-to-guides/advanced-user-guides/enable-api-audit-log.md). diff --git a/versioned_docs/version-2.13/getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/install-rancher-ha.md b/versioned_docs/version-2.13/getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/install-rancher-ha.md index dd4ca193bce..6a4eb8bcd5d 100644 --- a/versioned_docs/version-2.13/getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/install-rancher-ha.md +++ b/versioned_docs/version-2.13/getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/install-rancher-ha.md @@ -185,12 +185,12 @@ Placeholder | Description --namespace cattle-system \ --set hostname= \ --set certmanager.version= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher --set useBundledSystemChart=true # Use the packaged Rancher system charts ``` -**Optional**: To install a specific Rancher version, set the `rancherImageTag` value, example: `--set rancherImageTag=v2.5.8` +**Optional**: To install a specific Rancher version, set the `image.tag` value, example: `--set image.tag=v2.10.3` #### Option B: Certificates From Files Using Kubernetes Secrets @@ -213,7 +213,7 @@ Install Rancher, declaring your chosen options. Use the reference table below to helm install rancher ./rancher-.tgz \ --namespace cattle-system \ --set hostname= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set ingress.tls.source=secret \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher --set useBundledSystemChart=true # Use the packaged Rancher system charts @@ -225,7 +225,7 @@ If you are using a Private CA signed cert, add `--set privateCA=true` following helm install rancher ./rancher-.tgz \ --namespace cattle-system \ --set hostname= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set ingress.tls.source=secret \ --set privateCA=true \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher diff --git a/versioned_docs/version-2.13/how-to-guides/advanced-user-guides/enable-experimental-features/enable-experimental-features.md b/versioned_docs/version-2.13/how-to-guides/advanced-user-guides/enable-experimental-features/enable-experimental-features.md index 5aafc84e1e7..b6bc8208574 100644 --- a/versioned_docs/version-2.13/how-to-guides/advanced-user-guides/enable-experimental-features/enable-experimental-features.md +++ b/versioned_docs/version-2.13/how-to-guides/advanced-user-guides/enable-experimental-features/enable-experimental-features.md @@ -64,7 +64,7 @@ When you install the Helm chart, you should pass in feature flag names in a comm helm install rancher ./rancher-.tgz \ --namespace cattle-system \ --set hostname= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set ingress.tls.source=secret \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher --set useBundledSystemChart=true # Use the packaged Rancher system charts diff --git a/versioned_docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/air-gapped-upgrades.md b/versioned_docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/air-gapped-upgrades.md index e7ded014194..e71802845f6 100644 --- a/versioned_docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/air-gapped-upgrades.md +++ b/versioned_docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/air-gapped-upgrades.md @@ -33,7 +33,7 @@ helm upgrade rancher ./rancher-.tgz \ --namespace cattle-system \ --set hostname= \ --set certmanager.version= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher --set useBundledSystemChart=true # Use the packaged Rancher system charts ``` @@ -48,7 +48,7 @@ helm template rancher ./rancher-.tgz --output-dir . \ --namespace cattle-system \ --set hostname= \ --set certmanager.version= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher --set useBundledSystemChart=true # Use the packaged Rancher system charts ``` @@ -65,7 +65,7 @@ kubectl -n cattle-system apply -R -f ./rancher helm upgrade rancher ./rancher-.tgz \ --namespace cattle-system \ --set hostname= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set ingress.tls.source=secret \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher --set useBundledSystemChart=true # Use the packaged Rancher system charts @@ -77,7 +77,7 @@ If you are using a Private CA signed cert, add `--set privateCA=true` following helm upgrade rancher ./rancher-.tgz \ --namespace cattle-system \ --set hostname= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set ingress.tls.source=secret \ --set privateCA=true \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher diff --git a/versioned_docs/version-2.14/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md b/versioned_docs/version-2.14/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md index 3ee46920bbd..873e125ced0 100644 --- a/versioned_docs/version-2.14/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md +++ b/versioned_docs/version-2.14/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md @@ -32,37 +32,38 @@ For information on enabling experimental features, refer to [this page.](../../. | ------------------------------ | ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | | `additionalTrustedCAs` | false | `bool` - See [Additional Trusted CAs](#additional-trusted-cas) | | `addLocal` | "true" | `string` - Have Rancher detect and import the "local" (upstream) Rancher server cluster. _Note: This option is no longer available in v2.5.0. Consider using the `restrictedAdmin` option to prevent users from modifying the local cluster._ | -| `agentTLSMode` | "" | `string` - either `system-store` or `strict`. See [Agent TLS Enforcement](./tls-settings.md#agent-tls-enforcement) | +| `agentTLSMode` | "" | `string` - either `system-store` or `strict`. See [Agent TLS Enforcement](./tls-settings.md#agent-tls-enforcement) | | `antiAffinity` | "preferred" | `string` - AntiAffinity rule for Rancher pods - "preferred, required" | | `auditLog.destination` | "sidecar" | `string` - Stream to sidecar container console or hostPath volume - "sidecar, hostPath" | | `auditLog.hostPath` | "/var/log/rancher/audit" | `string` - log file destination on host (only applies when `auditLog.destination` is set to `hostPath`) | -| `auditLog.enabled` | false | `bool` - Enables / disables audit logging. | -| `auditLog.level` | 0 | `int` - Sets the [API Audit Log](../../../how-to-guides/advanced-user-guides/enable-api-audit-log.md) level [0-3]. | +| `auditLog.enabled` | false | `bool` - Enables / disables audit logging. | +| `auditLog.level` | 0 | `int` - Sets the [API Audit Log](../../../how-to-guides/advanced-user-guides/enable-api-audit-log.md) level [0-3]. | | `auditLog.maxAge` | 1 | `int` - maximum number of days to retain old audit log files (only applies when `auditLog.destination` is set to `hostPath`) | | `auditLog.maxBackup` | 1 | `int` - maximum number of audit log files to retain (only applies when `auditLog.destination` is set to `hostPath`) | | `auditLog.maxSize` | 100 | `int` - maximum size in megabytes of the audit log file before it gets rotated (only applies when `auditLog.destination` is set to `hostPath`) | | `auditLog.image.repository` | "registry.suse.com/bci/bci-micro" | `string` - Location for the image used to collect audit logs. | | `auditLog.image.tag` | "15.4.14.3" | `string` - Tag for the image used to collect audit logs. | -| `auditLog.image.pullPolicy` | "IfNotPresent" | `string` - Override imagePullPolicy for auditLog images - "Always", "Never", "IfNotPresent". | -| `busyboxImage` | "" | `string` - Image location for busybox image used to collect audit logs. _Note: This option is deprecated use `auditLog.image.repository` to control auditing sidecar image._ | +| `auditLog.image.pullPolicy` | "IfNotPresent" | `string` - Override imagePullPolicy for auditLog images - "Always", "Never", "IfNotPresent". | +| `busyboxImage` | "" | `string` - Image location for busybox image used to collect audit logs. _Note: This option is deprecated use `auditLog.image.repository` to control auditing sidecar image._ | | `certmanager.version` | "" | `string` - set cert-manager compatibility | | `debug` | false | `bool` - set debug flag on rancher server | -| `extraEnv` | [] | `list` - set additional environment variables for Rancher | +| `extraEnv` | [] | `list` - set additional environment variables for Rancher | | `imagePullSecrets` | [] | `list` - list of names of Secret resource containing private registry credentials | -| `ingress.configurationSnippet` | "" | `string` - additional Nginx configuration. Can be used for proxy configuration. | +| `ingress.configurationSnippet` | "" | `string` - additional Nginx configuration. Can be used for proxy configuration. | | `ingress.extraAnnotations` | {} | `map` - additional annotations to customize the ingress | -| `ingress.enabled` | true | When set to false, Helm will not install a Rancher ingress. Set the option to false to deploy your own ingress. | +| `ingress.enabled` | true | `string` - When set to false, Helm will not install a Rancher ingress. Set the option to false to deploy your own ingress. | | `letsEncrypt.ingress.class` | "" | `string` - optional ingress class for the cert-manager acmesolver ingress that responds to the Let's Encrypt ACME challenges. Options: traefik, nginx. | | -| `noProxy` | "127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.cluster.local,cattle-system.svc" | `string` - comma separated list of hostnames or ip address not to use the proxy | | +| `noProxy` | "127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.cluster.local,cattle-system.svc" | `string` - comma separated list of hostnames or ip address not to use the proxy | | | `proxy` | "" | `string` - HTTP[S] proxy server for Rancher | -| `rancherImage` | "rancher/rancher" | `string` - rancher image source | -| `rancherImagePullPolicy` | "IfNotPresent" | `string` - Override imagePullPolicy for rancher server images - "Always", "Never", "IfNotPresent" | -| `rancherImageTag` | same as chart version | `string` - rancher/rancher image tag | -| `replicas` | 3 | `int` - Number of Rancher server replicas. Setting to -1 will dynamically choose 1, 2, or 3 based on the number of available nodes in the cluster. | +| `image.registry` | "" | `string` - Override rancher image-specific registry, e.g, http://registry.example.com/ | +| `image.repository` | "rancher/rancher" | `string` - Rancher image source | +| `image.pullPolicy` | "IfNotPresent" | `string` - Override imagePullPolicy for rancher server images - "Always", "Never", "IfNotPresent" | +| `image.tag` | "" | `string` - Defaults to .Chart.appVersion for rancher/rancher image tag | +| `replicas` | 3 | `int` - Number of Rancher server replicas. Setting to -1 will dynamically choose 1, 2, or 3 based on the number of available nodes in the cluster.| | `resources` | {} | `map` - rancher pod resource requests & limits | -| `systemDefaultRegistry` | "" | `string` - private registry to be used for all system container images, e.g., http://registry.example.com/ | +| `systemDefaultRegistry` | "" | `string` - private registry to be used for all system container images, e.g., http://registry.example.com/ | | `tls` | "ingress" | `string` - See [External TLS Termination](#external-tls-termination) for details. - "ingress, external" | -| `useBundledSystemChart` | `false` | `bool` - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations. | +| `useBundledSystemChart` | `false` | `bool` - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations. | When using Rancher v2.12.0 and above, Rancher will use an audit logging controller that watches `AuditPolicy` CRs for configuring additional redactions, for more info see [API Audit Log](../../../how-to-guides/advanced-user-guides/enable-api-audit-log.md). diff --git a/versioned_docs/version-2.14/getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/install-rancher-ha.md b/versioned_docs/version-2.14/getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/install-rancher-ha.md index dd4ca193bce..6a4eb8bcd5d 100644 --- a/versioned_docs/version-2.14/getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/install-rancher-ha.md +++ b/versioned_docs/version-2.14/getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/install-rancher-ha.md @@ -185,12 +185,12 @@ Placeholder | Description --namespace cattle-system \ --set hostname= \ --set certmanager.version= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher --set useBundledSystemChart=true # Use the packaged Rancher system charts ``` -**Optional**: To install a specific Rancher version, set the `rancherImageTag` value, example: `--set rancherImageTag=v2.5.8` +**Optional**: To install a specific Rancher version, set the `image.tag` value, example: `--set image.tag=v2.10.3` #### Option B: Certificates From Files Using Kubernetes Secrets @@ -213,7 +213,7 @@ Install Rancher, declaring your chosen options. Use the reference table below to helm install rancher ./rancher-.tgz \ --namespace cattle-system \ --set hostname= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set ingress.tls.source=secret \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher --set useBundledSystemChart=true # Use the packaged Rancher system charts @@ -225,7 +225,7 @@ If you are using a Private CA signed cert, add `--set privateCA=true` following helm install rancher ./rancher-.tgz \ --namespace cattle-system \ --set hostname= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set ingress.tls.source=secret \ --set privateCA=true \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher diff --git a/versioned_docs/version-2.14/how-to-guides/advanced-user-guides/enable-experimental-features/enable-experimental-features.md b/versioned_docs/version-2.14/how-to-guides/advanced-user-guides/enable-experimental-features/enable-experimental-features.md index 5aafc84e1e7..b6bc8208574 100644 --- a/versioned_docs/version-2.14/how-to-guides/advanced-user-guides/enable-experimental-features/enable-experimental-features.md +++ b/versioned_docs/version-2.14/how-to-guides/advanced-user-guides/enable-experimental-features/enable-experimental-features.md @@ -64,7 +64,7 @@ When you install the Helm chart, you should pass in feature flag names in a comm helm install rancher ./rancher-.tgz \ --namespace cattle-system \ --set hostname= \ - --set rancherImage=/rancher/rancher \ + --set image.registry= \ --set ingress.tls.source=secret \ --set systemDefaultRegistry= \ # Set a default private registry to be used in Rancher --set useBundledSystemChart=true # Use the packaged Rancher system charts From dd90555a6479a0fc500d68e51327fdfa356f633f Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Thu, 12 Mar 2026 11:12:28 -0700 Subject: [PATCH 11/12] Removing ingress-nginx due to deprecation and replacing with traefik. Signed-off-by: Sunil Singh --- .../install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml | 2 +- .../psa-config-templates.md | 2 +- .../rancher-security/psa-restricted-exemptions.md | 2 +- .../install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml | 2 +- .../psa-config-templates.md | 2 +- .../rancher-security/psa-restricted-exemptions.md | 2 +- .../install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml | 2 +- .../psa-config-templates.md | 2 +- .../rancher-security/psa-restricted-exemptions.md | 2 +- .../install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml | 2 +- .../psa-config-templates.md | 2 +- .../rancher-security/psa-restricted-exemptions.md | 2 +- .../install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml | 2 +- .../psa-config-templates.md | 2 +- .../rancher-security/psa-restricted-exemptions.md | 2 +- .../install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml | 2 +- .../psa-config-templates.md | 2 +- .../rancher-security/psa-restricted-exemptions.md | 2 +- 18 files changed, 18 insertions(+), 18 deletions(-) diff --git a/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml b/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml index b79ecda66e8..0b0fb33c74d 100644 --- a/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml +++ b/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml @@ -45,7 +45,6 @@ plugins: - compliance-operator-system - fleet-default - fleet-local - - ingress-nginx - istio-system - kube-node-lease - kube-public @@ -56,6 +55,7 @@ plugins: - security-scan - sr-operator-system - tigera-operator + - traefik kind: PodSecurityConfiguration name: PodSecurity path: "" diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md index 113bedf35c1..d4a4ed070bd 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md @@ -121,7 +121,6 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit - `compliance-operator-system` - `fleet-default` - `fleet-local` -- `ingress-nginx` - `istio-system` - `kube-node-lease` - `kube-public` @@ -132,6 +131,7 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit - `security-scan` - `sr-operator-system` - `tigera-operator` +- `traefik` Rancher, some Rancher owned charts, and RKE2 and K3s distributions all use these namespaces. A subset of the listed namespaces are already exempt in the built-in Rancher `rancher-restricted` policy, for use in downstream clusters. For a complete template which has all the exemptions you need to run Rancher, please refer to this [sample Admission Configuration](../../../reference-guides/rancher-security/psa-restricted-exemptions.md). diff --git a/docs/reference-guides/rancher-security/psa-restricted-exemptions.md b/docs/reference-guides/rancher-security/psa-restricted-exemptions.md index d54afa9b708..c404dc04bc2 100644 --- a/docs/reference-guides/rancher-security/psa-restricted-exemptions.md +++ b/docs/reference-guides/rancher-security/psa-restricted-exemptions.md @@ -58,7 +58,6 @@ plugins: - compliance-operator-system - fleet-default - fleet-local - - ingress-nginx - istio-system - kube-node-lease - kube-public @@ -69,6 +68,7 @@ plugins: - security-scan - sr-operator-system - tigera-operator + - traefik runtimeClasses: [] usernames: [] ``` diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml b/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml index b79ecda66e8..0b0fb33c74d 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml +++ b/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml @@ -45,7 +45,6 @@ plugins: - compliance-operator-system - fleet-default - fleet-local - - ingress-nginx - istio-system - kube-node-lease - kube-public @@ -56,6 +55,7 @@ plugins: - security-scan - sr-operator-system - tigera-operator + - traefik kind: PodSecurityConfiguration name: PodSecurity path: "" diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md b/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md index 8434d685d9b..8f3969f36ad 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md +++ b/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md @@ -120,7 +120,6 @@ The policies shipped by default in Rancher aim to provide a trade-off between se - `compliance-operator-system` - `fleet-default` - `fleet-local` -- `ingress-nginx` - `istio-system` - `kube-node-lease` - `kube-public` @@ -131,6 +130,7 @@ The policies shipped by default in Rancher aim to provide a trade-off between se - `security-scan` - `sr-operator-system` - `tigera-operator` +- `traefik` Rancher、Rancher 拥有的一些 Chart 以及 RKE2 和 K3s 发行版都使用这些命名空间。列出的命名空间的一个子集已经在内置的 Rancher `rancher-restricted` 策略中被豁免，用于下游集群。有关运行 Rancher 所需的所有豁免的完整模板，请参阅此[准入配置示例](../../../reference-guides/rancher-security/psa-restricted-exemptions.md)。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rancher-security/psa-restricted-exemptions.md b/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rancher-security/psa-restricted-exemptions.md index 5618bc10850..05462e2c546 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rancher-security/psa-restricted-exemptions.md +++ b/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rancher-security/psa-restricted-exemptions.md @@ -54,7 +54,6 @@ plugins: - compliance-operator-system - fleet-default - fleet-local - - ingress-nginx - istio-system - kube-node-lease - kube-public @@ -65,6 +64,7 @@ plugins: - security-scan - sr-operator-system - tigera-operator + - traefik runtimeClasses: [] usernames: [] ``` diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml b/i18n/zh/docusaurus-plugin-content-docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml index b79ecda66e8..0b0fb33c74d 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml @@ -45,7 +45,6 @@ plugins: - compliance-operator-system - fleet-default - fleet-local - - ingress-nginx - istio-system - kube-node-lease - kube-public @@ -56,6 +55,7 @@ plugins: - security-scan - sr-operator-system - tigera-operator + - traefik kind: PodSecurityConfiguration name: PodSecurity path: "" diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md index 8434d685d9b..8f3969f36ad 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md @@ -120,7 +120,6 @@ The policies shipped by default in Rancher aim to provide a trade-off between se - `compliance-operator-system` - `fleet-default` - `fleet-local` -- `ingress-nginx` - `istio-system` - `kube-node-lease` - `kube-public` @@ -131,6 +130,7 @@ The policies shipped by default in Rancher aim to provide a trade-off between se - `security-scan` - `sr-operator-system` - `tigera-operator` +- `traefik` Rancher、Rancher 拥有的一些 Chart 以及 RKE2 和 K3s 发行版都使用这些命名空间。列出的命名空间的一个子集已经在内置的 Rancher `rancher-restricted` 策略中被豁免，用于下游集群。有关运行 Rancher 所需的所有豁免的完整模板，请参阅此[准入配置示例](../../../reference-guides/rancher-security/psa-restricted-exemptions.md)。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.13/reference-guides/rancher-security/psa-restricted-exemptions.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.13/reference-guides/rancher-security/psa-restricted-exemptions.md index 5618bc10850..05462e2c546 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.13/reference-guides/rancher-security/psa-restricted-exemptions.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.13/reference-guides/rancher-security/psa-restricted-exemptions.md @@ -54,7 +54,6 @@ plugins: - compliance-operator-system - fleet-default - fleet-local - - ingress-nginx - istio-system - kube-node-lease - kube-public @@ -65,6 +64,7 @@ plugins: - security-scan - sr-operator-system - tigera-operator + - traefik runtimeClasses: [] usernames: [] ``` diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml b/i18n/zh/docusaurus-plugin-content-docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml index b79ecda66e8..0b0fb33c74d 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml @@ -45,7 +45,6 @@ plugins: - compliance-operator-system - fleet-default - fleet-local - - ingress-nginx - istio-system - kube-node-lease - kube-public @@ -56,6 +55,7 @@ plugins: - security-scan - sr-operator-system - tigera-operator + - traefik kind: PodSecurityConfiguration name: PodSecurity path: "" diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md index 8434d685d9b..8f3969f36ad 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md @@ -120,7 +120,6 @@ The policies shipped by default in Rancher aim to provide a trade-off between se - `compliance-operator-system` - `fleet-default` - `fleet-local` -- `ingress-nginx` - `istio-system` - `kube-node-lease` - `kube-public` @@ -131,6 +130,7 @@ The policies shipped by default in Rancher aim to provide a trade-off between se - `security-scan` - `sr-operator-system` - `tigera-operator` +- `traefik` Rancher、Rancher 拥有的一些 Chart 以及 RKE2 和 K3s 发行版都使用这些命名空间。列出的命名空间的一个子集已经在内置的 Rancher `rancher-restricted` 策略中被豁免，用于下游集群。有关运行 Rancher 所需的所有豁免的完整模板，请参阅此[准入配置示例](../../../reference-guides/rancher-security/psa-restricted-exemptions.md)。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.14/reference-guides/rancher-security/psa-restricted-exemptions.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.14/reference-guides/rancher-security/psa-restricted-exemptions.md index 5618bc10850..05462e2c546 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.14/reference-guides/rancher-security/psa-restricted-exemptions.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.14/reference-guides/rancher-security/psa-restricted-exemptions.md @@ -54,7 +54,6 @@ plugins: - compliance-operator-system - fleet-default - fleet-local - - ingress-nginx - istio-system - kube-node-lease - kube-public @@ -65,6 +64,7 @@ plugins: - security-scan - sr-operator-system - tigera-operator + - traefik runtimeClasses: [] usernames: [] ``` diff --git a/versioned_docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml b/versioned_docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml index b79ecda66e8..0b0fb33c74d 100644 --- a/versioned_docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml +++ b/versioned_docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml @@ -45,7 +45,6 @@ plugins: - compliance-operator-system - fleet-default - fleet-local - - ingress-nginx - istio-system - kube-node-lease - kube-public @@ -56,6 +55,7 @@ plugins: - security-scan - sr-operator-system - tigera-operator + - traefik kind: PodSecurityConfiguration name: PodSecurity path: "" diff --git a/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md b/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md index 113bedf35c1..d4a4ed070bd 100644 --- a/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md +++ b/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md @@ -121,7 +121,6 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit - `compliance-operator-system` - `fleet-default` - `fleet-local` -- `ingress-nginx` - `istio-system` - `kube-node-lease` - `kube-public` @@ -132,6 +131,7 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit - `security-scan` - `sr-operator-system` - `tigera-operator` +- `traefik` Rancher, some Rancher owned charts, and RKE2 and K3s distributions all use these namespaces. A subset of the listed namespaces are already exempt in the built-in Rancher `rancher-restricted` policy, for use in downstream clusters. For a complete template which has all the exemptions you need to run Rancher, please refer to this [sample Admission Configuration](../../../reference-guides/rancher-security/psa-restricted-exemptions.md). diff --git a/versioned_docs/version-2.13/reference-guides/rancher-security/psa-restricted-exemptions.md b/versioned_docs/version-2.13/reference-guides/rancher-security/psa-restricted-exemptions.md index d54afa9b708..c404dc04bc2 100644 --- a/versioned_docs/version-2.13/reference-guides/rancher-security/psa-restricted-exemptions.md +++ b/versioned_docs/version-2.13/reference-guides/rancher-security/psa-restricted-exemptions.md @@ -58,7 +58,6 @@ plugins: - compliance-operator-system - fleet-default - fleet-local - - ingress-nginx - istio-system - kube-node-lease - kube-public @@ -69,6 +68,7 @@ plugins: - security-scan - sr-operator-system - tigera-operator + - traefik runtimeClasses: [] usernames: [] ``` diff --git a/versioned_docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml b/versioned_docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml index b79ecda66e8..0b0fb33c74d 100644 --- a/versioned_docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml +++ b/versioned_docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml @@ -45,7 +45,6 @@ plugins: - compliance-operator-system - fleet-default - fleet-local - - ingress-nginx - istio-system - kube-node-lease - kube-public @@ -56,6 +55,7 @@ plugins: - security-scan - sr-operator-system - tigera-operator + - traefik kind: PodSecurityConfiguration name: PodSecurity path: "" diff --git a/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md b/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md index 113bedf35c1..d4a4ed070bd 100644 --- a/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md +++ b/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md @@ -121,7 +121,6 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit - `compliance-operator-system` - `fleet-default` - `fleet-local` -- `ingress-nginx` - `istio-system` - `kube-node-lease` - `kube-public` @@ -132,6 +131,7 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit - `security-scan` - `sr-operator-system` - `tigera-operator` +- `traefik` Rancher, some Rancher owned charts, and RKE2 and K3s distributions all use these namespaces. A subset of the listed namespaces are already exempt in the built-in Rancher `rancher-restricted` policy, for use in downstream clusters. For a complete template which has all the exemptions you need to run Rancher, please refer to this [sample Admission Configuration](../../../reference-guides/rancher-security/psa-restricted-exemptions.md). diff --git a/versioned_docs/version-2.14/reference-guides/rancher-security/psa-restricted-exemptions.md b/versioned_docs/version-2.14/reference-guides/rancher-security/psa-restricted-exemptions.md index d54afa9b708..c404dc04bc2 100644 --- a/versioned_docs/version-2.14/reference-guides/rancher-security/psa-restricted-exemptions.md +++ b/versioned_docs/version-2.14/reference-guides/rancher-security/psa-restricted-exemptions.md @@ -58,7 +58,6 @@ plugins: - compliance-operator-system - fleet-default - fleet-local - - ingress-nginx - istio-system - kube-node-lease - kube-public @@ -69,6 +68,7 @@ plugins: - security-scan - sr-operator-system - tigera-operator + - traefik runtimeClasses: [] usernames: [] ``` From 2386faad52d197e0a55c7fb0a6017ccd2198a380 Mon Sep 17 00:00:00 2001 From: Lucas Saintarbor Date: Mon, 16 Mar 2026 11:37:28 -0700 Subject: [PATCH 12/12] Move Configuring OIDC Single Logout (SLO) section on relevant pages (#2233) --- .../authentication-config/configure-amazon-cognito.md | 8 ++++---- .../authentication-config/configure-generic-oidc.md | 8 ++++---- .../authentication-config/configure-keycloak-oidc.md | 8 ++++---- .../authentication-config/configure-amazon-cognito.md | 8 ++++---- .../authentication-config/configure-generic-oidc.md | 8 ++++---- .../authentication-config/configure-keycloak-oidc.md | 8 ++++---- .../authentication-config/configure-amazon-cognito.md | 8 ++++---- .../authentication-config/configure-generic-oidc.md | 8 ++++---- .../authentication-config/configure-keycloak-oidc.md | 8 ++++---- 9 files changed, 36 insertions(+), 36 deletions(-) diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-amazon-cognito.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-amazon-cognito.md index 91ac8b6b51c..cf4937b0037 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-amazon-cognito.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-amazon-cognito.md @@ -53,12 +53,12 @@ if the user has not yet logged in to Rancher. However, if the user has previousl | Client Secret | The generated Secret of your Amazon Cognito App Client. | | Issuer | The Issuer URL of your Amazon Cognito App Client. It follows the format `https://cognito-idp.{region}.amazonaws.com/{userPoolId}`, and can be found in the App Client settings page. Rancher uses the Issuer URL to fetch all of the required URLs. | +## Configuring OIDC Single Logout (SLO) + + + ## Troubleshooting ### You are not redirected to your authentication provider If you fill out the **Configure an Amazon Cognito account** form and click on **Enable**, and you are not redirected to Amazon Cognito, verify your Amazon Cognito configuration. - -## Configuring OIDC Single Logout (SLO) - - \ No newline at end of file diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md index 4b9685729d0..8ec61010eda 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md @@ -139,6 +139,10 @@ For example, if your IdP sends `groups` in a claim called `custom_roles`, enter | Custom Email Claim | `email` | The name of the claim in the OIDC token that contains the user's email address. | | Custom Groups Claim | `groups` | The name of the claim in the OIDC token that contains the user's group memberships (used for RBAC). | +## Configuring OIDC Single Logout (SLO) + + + ## Troubleshooting If you are experiencing issues while testing the connection to the OIDC server, first double-check the configuration options of your OIDC client. You can also inspect the Rancher logs to help pinpoint what's causing issues. Debug logs may contain more detailed information about the error. Please refer to [How can I enable debug logging](../../../../faq/technical-items.md#how-can-i-enable-debug-logging) in this documentation. @@ -156,7 +160,3 @@ If the `Issuer` and `Auth Endpoint` are generated incorrectly, open the **Config ### Error: "Invalid grant_type" In some cases, the "Invalid grant_type" error message may be misleading and is actually caused by setting the `Valid Redirect URI` incorrectly. - -## Configuring OIDC Single Logout (SLO) - - diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-oidc.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-oidc.md index 646bf3ee8b6..0d406be4273 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-oidc.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-oidc.md @@ -168,6 +168,10 @@ After configuration is completed, Rancher user permissions need to be reapplied ::: +## Configuring OIDC Single Logout (SLO) + + + ## Annex: Troubleshooting If you are experiencing issues while testing the connection to the Keycloak server, first double-check the configuration options of your OIDC client. You may also inspect the Rancher logs to help pinpoint what's causing issues. Debug logs may contain more detailed information about the error. Please refer to [How can I enable debug logging](../../../../faq/technical-items.md#how-can-i-enable-debug-logging) in this documentation. @@ -203,7 +207,3 @@ To resolve this, you can either: 3. Save your changes. 2. Reconfigure your Keycloak OIDC setup using a user that is assigned to at least one group in Keycloak. - -## Configuring OIDC Single Logout (SLO) - - \ No newline at end of file diff --git a/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-amazon-cognito.md b/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-amazon-cognito.md index 91ac8b6b51c..cf4937b0037 100644 --- a/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-amazon-cognito.md +++ b/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-amazon-cognito.md @@ -53,12 +53,12 @@ if the user has not yet logged in to Rancher. However, if the user has previousl | Client Secret | The generated Secret of your Amazon Cognito App Client. | | Issuer | The Issuer URL of your Amazon Cognito App Client. It follows the format `https://cognito-idp.{region}.amazonaws.com/{userPoolId}`, and can be found in the App Client settings page. Rancher uses the Issuer URL to fetch all of the required URLs. | +## Configuring OIDC Single Logout (SLO) + + + ## Troubleshooting ### You are not redirected to your authentication provider If you fill out the **Configure an Amazon Cognito account** form and click on **Enable**, and you are not redirected to Amazon Cognito, verify your Amazon Cognito configuration. - -## Configuring OIDC Single Logout (SLO) - - \ No newline at end of file diff --git a/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md b/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md index 4b9685729d0..8ec61010eda 100644 --- a/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md +++ b/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md @@ -139,6 +139,10 @@ For example, if your IdP sends `groups` in a claim called `custom_roles`, enter | Custom Email Claim | `email` | The name of the claim in the OIDC token that contains the user's email address. | | Custom Groups Claim | `groups` | The name of the claim in the OIDC token that contains the user's group memberships (used for RBAC). | +## Configuring OIDC Single Logout (SLO) + + + ## Troubleshooting If you are experiencing issues while testing the connection to the OIDC server, first double-check the configuration options of your OIDC client. You can also inspect the Rancher logs to help pinpoint what's causing issues. Debug logs may contain more detailed information about the error. Please refer to [How can I enable debug logging](../../../../faq/technical-items.md#how-can-i-enable-debug-logging) in this documentation. @@ -156,7 +160,3 @@ If the `Issuer` and `Auth Endpoint` are generated incorrectly, open the **Config ### Error: "Invalid grant_type" In some cases, the "Invalid grant_type" error message may be misleading and is actually caused by setting the `Valid Redirect URI` incorrectly. - -## Configuring OIDC Single Logout (SLO) - - diff --git a/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-oidc.md b/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-oidc.md index 646bf3ee8b6..0d406be4273 100644 --- a/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-oidc.md +++ b/versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-oidc.md @@ -168,6 +168,10 @@ After configuration is completed, Rancher user permissions need to be reapplied ::: +## Configuring OIDC Single Logout (SLO) + + + ## Annex: Troubleshooting If you are experiencing issues while testing the connection to the Keycloak server, first double-check the configuration options of your OIDC client. You may also inspect the Rancher logs to help pinpoint what's causing issues. Debug logs may contain more detailed information about the error. Please refer to [How can I enable debug logging](../../../../faq/technical-items.md#how-can-i-enable-debug-logging) in this documentation. @@ -203,7 +207,3 @@ To resolve this, you can either: 3. Save your changes. 2. Reconfigure your Keycloak OIDC setup using a user that is assigned to at least one group in Keycloak. - -## Configuring OIDC Single Logout (SLO) - - \ No newline at end of file diff --git a/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-amazon-cognito.md b/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-amazon-cognito.md index 91ac8b6b51c..cf4937b0037 100644 --- a/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-amazon-cognito.md +++ b/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-amazon-cognito.md @@ -53,12 +53,12 @@ if the user has not yet logged in to Rancher. However, if the user has previousl | Client Secret | The generated Secret of your Amazon Cognito App Client. | | Issuer | The Issuer URL of your Amazon Cognito App Client. It follows the format `https://cognito-idp.{region}.amazonaws.com/{userPoolId}`, and can be found in the App Client settings page. Rancher uses the Issuer URL to fetch all of the required URLs. | +## Configuring OIDC Single Logout (SLO) + + + ## Troubleshooting ### You are not redirected to your authentication provider If you fill out the **Configure an Amazon Cognito account** form and click on **Enable**, and you are not redirected to Amazon Cognito, verify your Amazon Cognito configuration. - -## Configuring OIDC Single Logout (SLO) - - \ No newline at end of file diff --git a/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md b/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md index 4b9685729d0..8ec61010eda 100644 --- a/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md +++ b/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md @@ -139,6 +139,10 @@ For example, if your IdP sends `groups` in a claim called `custom_roles`, enter | Custom Email Claim | `email` | The name of the claim in the OIDC token that contains the user's email address. | | Custom Groups Claim | `groups` | The name of the claim in the OIDC token that contains the user's group memberships (used for RBAC). | +## Configuring OIDC Single Logout (SLO) + + + ## Troubleshooting If you are experiencing issues while testing the connection to the OIDC server, first double-check the configuration options of your OIDC client. You can also inspect the Rancher logs to help pinpoint what's causing issues. Debug logs may contain more detailed information about the error. Please refer to [How can I enable debug logging](../../../../faq/technical-items.md#how-can-i-enable-debug-logging) in this documentation. @@ -156,7 +160,3 @@ If the `Issuer` and `Auth Endpoint` are generated incorrectly, open the **Config ### Error: "Invalid grant_type" In some cases, the "Invalid grant_type" error message may be misleading and is actually caused by setting the `Valid Redirect URI` incorrectly. - -## Configuring OIDC Single Logout (SLO) - - diff --git a/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-oidc.md b/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-oidc.md index 646bf3ee8b6..0d406be4273 100644 --- a/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-oidc.md +++ b/versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-keycloak-oidc.md @@ -168,6 +168,10 @@ After configuration is completed, Rancher user permissions need to be reapplied ::: +## Configuring OIDC Single Logout (SLO) + + + ## Annex: Troubleshooting If you are experiencing issues while testing the connection to the Keycloak server, first double-check the configuration options of your OIDC client. You may also inspect the Rancher logs to help pinpoint what's causing issues. Debug logs may contain more detailed information about the error. Please refer to [How can I enable debug logging](../../../../faq/technical-items.md#how-can-i-enable-debug-logging) in this documentation. @@ -203,7 +207,3 @@ To resolve this, you can either: 3. Save your changes. 2. Reconfigure your Keycloak OIDC setup using a user that is assigned to at least one group in Keycloak. - -## Configuring OIDC Single Logout (SLO) - - \ No newline at end of file