diff --git a/docs/en/cluster-admin/cluster-autoscaler/amazon/amazon.md b/docs/en/cluster-admin/cluster-autoscaler/amazon/amazon.md index 00ad33025f5..db9e80fd102 100644 --- a/docs/en/cluster-admin/cluster-autoscaler/amazon/amazon.md +++ b/docs/en/cluster-admin/cluster-autoscaler/amazon/amazon.md @@ -5,7 +5,7 @@ weight: 1 This guide will show you how to install and use [Kubernetes cluster-autoscaler](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/) on Rancher custom clusters using AWS EC2 Auto Scaling Groups. -We are going to install a Rancher RKE custom cluster with a fixed number of nodes with the etcd and controlplane roles, and a variable nodes with the worker role, managed by `cluster-autoscaler`. +We are going to install a Rancher RKE custom cluster with a fixed number of nodes with the etcd and controlplane roles, and a variable nodes with the worker role, managed by `cluster-autoscaler`. - [Prerequisites](#prerequisites) - [1. Create a Custom Cluster](#1-create-a-custom-cluster) @@ -68,7 +68,7 @@ On AWS EC2, we should create a few objects to configure our system. We've define } ``` -2. Master group: Nodes that will be part of the Kubernetes etcd and/or control planes. This will be out of the ASG. +2. Master group: Nodes that will be part of the Kubernetes etcd and/or control planes. This will be out of the ASG. * IAM profile: Required by the Kubernetes cloud_provider integration. Optionally, `AWS_ACCESS_KEY` and `AWS_SECRET_KEY` can be used instead [using-aws-credentials.](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#using-aws-credentials) This profile is called `K8sMasterProfile`. ```json @@ -211,7 +211,7 @@ On AWS EC2, we should create a few objects to configure our system. We've define * `kubernetes.io/cluster/: owned` * `k8s.io/cluster-autoscaler/: true` * `k8s.io/cluster-autoscaler/enabled: true` - * User data: `K8sWorkerUserData` Ubuntu 18.04(ami-0e11cbb34015ff725), installs docker and add worker node to the k8s cluster + * User data: `K8sWorkerUserData` Ubuntu 18.04(ami-0e11cbb34015ff725), installs docker and add worker node to the k8s cluster ```sh #!/bin/bash -x @@ -246,7 +246,7 @@ Once we've configured AWS, let's create VMs to bootstrap our cluster: * master (etcd+controlplane): Depending your needs, deploy three master instances with proper size. More info is at [the recommendations for production-ready clusters.]({{}}/rancher/v2.6/en/cluster-provisioning/production/) * IAM role: `K8sMasterRole` * Security group: `K8sMasterSg` - * Tags: + * Tags: * `kubernetes.io/cluster/: owned` * User data: `K8sMasterUserData` @@ -254,7 +254,7 @@ Once we've configured AWS, let's create VMs to bootstrap our cluster: * Name: `K8sWorkerAsg` * IAM role: `K8sWorkerRole` * Security group: `K8sWorkerSg` - * Tags: + * Tags: * `kubernetes.io/cluster/: owned` * `k8s.io/cluster-autoscaler/: true` * `k8s.io/cluster-autoscaler/enabled: true` @@ -268,7 +268,7 @@ Once the VMs are deployed, you should have a Rancher custom cluster up and runni ### 4. Install Cluster-autoscaler -At this point, we should have rancher cluster up and running. We are going to install cluster-autoscaler on master nodes and `kube-system` namespace, following cluster-autoscaler recommendation. +At this point, we should have rancher cluster up and running. We are going to install cluster-autoscaler on master nodes and `kube-system` namespace, following cluster-autoscaler recommendation. #### Parameters @@ -296,9 +296,9 @@ This table shows cluster-autoscaler parameters for fine tuning: |node-deletion-delay-timeout|"2m"|Maximum time CA waits for removing delay-deletion.cluster-autoscaler.kubernetes.io/ annotations before deleting the node| |scan-interval|"10s"|How often cluster is reevaluated for scale up or down| |max-nodes-total|0|Maximum number of nodes in all node groups. Cluster autoscaler will not grow the cluster beyond this number| -|cores-total|"0:320000"|Minimum and maximum number of cores in cluster, in the format :. Cluster autoscaler will not scale the cluster beyond these numbers| -|memory-total|"0:6400000"|Minimum and maximum number of gigabytes of memory in cluster, in the format :. Cluster autoscaler will not scale the cluster beyond these numbers| -cloud-provider|-|Cloud provider type| +|cores-total|"0:320000"|Minimum and maximum number of cores in cluster, in the format `:.` Cluster autoscaler will not scale the cluster beyond these numbers| +|memory-total|"0:6400000"|Minimum and maximum number of gigabytes of memory in cluster, in the format `:.` Cluster autoscaler will not scale the cluster beyond these numbers| +cloud-provider|-|Cloud provider type| |max-bulk-soft-taint-count|10|Maximum number of nodes that can be tainted/untainted PreferNoSchedule at the same time. Set to 0 to turn off such tainting| |max-bulk-soft-taint-time|"3s"|Maximum duration of tainting/untainting nodes as PreferNoSchedule at the same time| |max-empty-bulk-delete|10|Maximum number of empty nodes that can be deleted at the same time| @@ -307,7 +307,7 @@ cloud-provider|-|Cloud provider type| |ok-total-unready-count|3|Number of allowed unready nodes, irrespective of max-total-unready-percentage| |scale-up-from-zero|true|Should CA scale up when there 0 ready nodes| |max-node-provision-time|"15m"|Maximum time CA waits for node to be provisioned| -|nodes|-|sets min,max size and other configuration data for a node group in a format accepted by cloud provider. Can be used multiple times. Format: ::| +|nodes|-|sets min,max size and other configuration data for a node group in a format accepted by cloud provider. Can be used multiple times. Format: `::`| |node-group-auto-discovery|-|One or more definition(s) of node group auto-discovery. A definition is expressed `:[[=]]`| |estimator|-|"binpacking"|Type of resource estimator to be used in scale up. Available values: ["binpacking"]| |expander|"random"|Type of node group expander to be used in scale up. Available values: `["random","most-pods","least-waste","price","priority"]`| @@ -524,7 +524,7 @@ Cluster-autoscaler deployment can also be set up using [manual configuration](ht # Testing -At this point, we should have a cluster-scaler up and running in our Rancher custom cluster. Cluster-scale should manage `K8sWorkerAsg` ASG to scale up and down between 2 and 10 nodes, when one of the following conditions is true: +At this point, we should have a cluster-scaler up and running in our Rancher custom cluster. Cluster-scale should manage `K8sWorkerAsg` ASG to scale up and down between 2 and 10 nodes, when one of the following conditions is true: * There are pods that failed to run in the cluster due to insufficient resources. In this case, the cluster is scaled up. * There are nodes in the cluster that have been underutilized for an extended period of time and their pods can be placed on other existing nodes. In this case, the cluster is scaled down. diff --git a/docs/en/security/hardening-guides/rke-1.6-benchmark-2.6/rke-1.6-benchmark-2.6.md b/docs/en/security/hardening-guides/rke-1.6-benchmark-2.6/rke-1.6-benchmark-2.6.md index f6bd2a79028..8a979e1b2eb 100644 --- a/docs/en/security/hardening-guides/rke-1.6-benchmark-2.6/rke-1.6-benchmark-2.6.md +++ b/docs/en/security/hardening-guides/rke-1.6-benchmark-2.6/rke-1.6-benchmark-2.6.md @@ -562,7 +562,7 @@ root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --e **Remediation:** Follow the documentation and configure alternate mechanisms for authentication. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and remove the --basic-auth-file= parameter. +on the master node and remove the `--basic-auth-file=` parameter. **Audit:** @@ -590,7 +590,7 @@ root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --e **Remediation:** Follow the documentation and configure alternate mechanisms for authentication. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and remove the --token-auth-file= parameter. +on the master node and remove the `--token-auth-file=` parameter. **Audit:** @@ -2177,7 +2177,7 @@ if test -e $CAFILE; then stat -c permissions=%a $CAFILE; fi **Remediation:** Run the following command to modify the ownership of the --client-ca-file. -chown root:root +`chown root:root ` **Audit Script:** `check_cafile_ownership.sh` diff --git a/docs/en/security/hardening-guides/rke2-1.6-benchmark-2.6/rke2-1.6-benchmark-2.6.md b/docs/en/security/hardening-guides/rke2-1.6-benchmark-2.6/rke2-1.6-benchmark-2.6.md index f97cec92319..1353fd50b30 100644 --- a/docs/en/security/hardening-guides/rke2-1.6-benchmark-2.6/rke2-1.6-benchmark-2.6.md +++ b/docs/en/security/hardening-guides/rke2-1.6-benchmark-2.6/rke2-1.6-benchmark-2.6.md @@ -754,7 +754,7 @@ on the master node and set the below parameter. **Remediation:** Follow the documentation and configure alternate mechanisms for authentication. Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the master node and remove the --basic-auth-file= parameter. +on the master node and remove the `--basic-auth-file=` parameter. **Audit:** @@ -782,7 +782,7 @@ root 5275 5222 15 14:58 ? 00:01:26 kube-apiserver --audit-policy-file=/etc/ranch **Remediation:** Follow the documentation and configure alternate mechanisms for authentication. Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the master node and remove the --token-auth-file= parameter. +on the master node and remove the `--token-auth-file=` parameter. **Audit:** @@ -2273,7 +2273,7 @@ stat -c %a /var/lib/rancher/rke2/server/tls/server-ca.crt **Remediation:** Run the following command to modify the ownership of the --client-ca-file. -chown root:roset: trueot +`chown root:roset: trueot ` **Audit:** diff --git a/versioned_docs/version-2.0-2.4/v2.0-v2.4/en/cluster-admin/cluster-autoscaler/amazon/amazon.md b/versioned_docs/version-2.0-2.4/v2.0-v2.4/en/cluster-admin/cluster-autoscaler/amazon/amazon.md index bd8dfee2fde..cd6961ac739 100644 --- a/versioned_docs/version-2.0-2.4/v2.0-v2.4/en/cluster-admin/cluster-autoscaler/amazon/amazon.md +++ b/versioned_docs/version-2.0-2.4/v2.0-v2.4/en/cluster-admin/cluster-autoscaler/amazon/amazon.md @@ -5,7 +5,7 @@ weight: 1 This guide will show you how to install and use [Kubernetes cluster-autoscaler](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/) on Rancher custom clusters using AWS EC2 Auto Scaling Groups. -We are going to install a Rancher RKE custom cluster with a fixed number of nodes with the etcd and controlplane roles, and a variable nodes with the worker role, managed by `cluster-autoscaler`. +We are going to install a Rancher RKE custom cluster with a fixed number of nodes with the etcd and controlplane roles, and a variable nodes with the worker role, managed by `cluster-autoscaler`. - [Prerequisites](#prerequisites) - [1. Create a Custom Cluster](#1-create-a-custom-cluster) @@ -68,7 +68,7 @@ On AWS EC2, we should create a few objects to configure our system. We've define } ``` -2. Master group: Nodes that will be part of the Kubernetes etcd and/or control planes. This will be out of the ASG. +2. Master group: Nodes that will be part of the Kubernetes etcd and/or control planes. This will be out of the ASG. * IAM profile: Required by the Kubernetes cloud_provider integration. Optionally, `AWS_ACCESS_KEY` and `AWS_SECRET_KEY` can be used instead [using-aws-credentials.](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#using-aws-credentials) This profile is called `K8sMasterProfile`. ```json @@ -211,7 +211,7 @@ On AWS EC2, we should create a few objects to configure our system. We've define * `kubernetes.io/cluster/: owned` * `k8s.io/cluster-autoscaler/: true` * `k8s.io/cluster-autoscaler/enabled: true` - * User data: `K8sWorkerUserData` Ubuntu 18.04(ami-0e11cbb34015ff725), installs docker and add worker node to the k8s cluster + * User data: `K8sWorkerUserData` Ubuntu 18.04(ami-0e11cbb34015ff725), installs docker and add worker node to the k8s cluster ```sh #!/bin/bash -x @@ -246,7 +246,7 @@ Once we've configured AWS, let's create VMs to bootstrap our cluster: * master (etcd+controlplane): Depending your needs, deploy three master instances with proper size. More info is at [the recommendations for production-ready clusters.]({{}}/rancher/v2.0-v2.4/en/cluster-provisioning/production/) * IAM role: `K8sMasterRole` * Security group: `K8sMasterSg` - * Tags: + * Tags: * `kubernetes.io/cluster/: owned` * User data: `K8sMasterUserData` @@ -254,7 +254,7 @@ Once we've configured AWS, let's create VMs to bootstrap our cluster: * Name: `K8sWorkerAsg` * IAM role: `K8sWorkerRole` * Security group: `K8sWorkerSg` - * Tags: + * Tags: * `kubernetes.io/cluster/: owned` * `k8s.io/cluster-autoscaler/: true` * `k8s.io/cluster-autoscaler/enabled: true` @@ -268,7 +268,7 @@ Once the VMs are deployed, you should have a Rancher custom cluster up and runni ### 4. Install Cluster-autoscaler -At this point, we should have rancher cluster up and running. We are going to install cluster-autoscaler on master nodes and `kube-system` namespace, following cluster-autoscaler recommendation. +At this point, we should have rancher cluster up and running. We are going to install cluster-autoscaler on master nodes and `kube-system` namespace, following cluster-autoscaler recommendation. #### Parameters @@ -296,9 +296,9 @@ This table shows cluster-autoscaler parameters for fine tuning: |node-deletion-delay-timeout|"2m"|Maximum time CA waits for removing delay-deletion.cluster-autoscaler.kubernetes.io/ annotations before deleting the node| |scan-interval|"10s"|How often cluster is reevaluated for scale up or down| |max-nodes-total|0|Maximum number of nodes in all node groups. Cluster autoscaler will not grow the cluster beyond this number| -|cores-total|"0:320000"|Minimum and maximum number of cores in cluster, in the format :. Cluster autoscaler will not scale the cluster beyond these numbers| -|memory-total|"0:6400000"|Minimum and maximum number of gigabytes of memory in cluster, in the format :. Cluster autoscaler will not scale the cluster beyond these numbers| -cloud-provider|-|Cloud provider type| +|cores-total|"0:320000"|Minimum and maximum number of cores in cluster, in the format `:.` Cluster autoscaler will not scale the cluster beyond these numbers| +|memory-total|"0:6400000"|Minimum and maximum number of gigabytes of memory in cluster, in the format `:.` Cluster autoscaler will not scale the cluster beyond these numbers| +cloud-provider|-|Cloud provider type| |max-bulk-soft-taint-count|10|Maximum number of nodes that can be tainted/untainted PreferNoSchedule at the same time. Set to 0 to turn off such tainting| |max-bulk-soft-taint-time|"3s"|Maximum duration of tainting/untainting nodes as PreferNoSchedule at the same time| |max-empty-bulk-delete|10|Maximum number of empty nodes that can be deleted at the same time| @@ -307,7 +307,7 @@ cloud-provider|-|Cloud provider type| |ok-total-unready-count|3|Number of allowed unready nodes, irrespective of max-total-unready-percentage| |scale-up-from-zero|true|Should CA scale up when there 0 ready nodes| |max-node-provision-time|"15m"|Maximum time CA waits for node to be provisioned| -|nodes|-|sets min,max size and other configuration data for a node group in a format accepted by cloud provider. Can be used multiple times. Format: ::| +|nodes|-|sets min,max size and other configuration data for a node group in a format accepted by cloud provider. Can be used multiple times. Format: `::`| |node-group-auto-discovery|-|One or more definition(s) of node group auto-discovery. A definition is expressed `:[[=]]`| |estimator|-|"binpacking"|Type of resource estimator to be used in scale up. Available values: ["binpacking"]| |expander|"random"|Type of node group expander to be used in scale up. Available values: `["random","most-pods","least-waste","price","priority"]`| @@ -520,7 +520,7 @@ kubectl -n kube-system apply -f cluster-autoscaler-deployment.yaml # Testing -At this point, we should have a cluster-scaler up and running in our Rancher custom cluster. Cluster-scale should manage `K8sWorkerAsg` ASG to scale up and down between 2 and 10 nodes, when one of the following conditions is true: +At this point, we should have a cluster-scaler up and running in our Rancher custom cluster. Cluster-scale should manage `K8sWorkerAsg` ASG to scale up and down between 2 and 10 nodes, when one of the following conditions is true: * There are pods that failed to run in the cluster due to insufficient resources. In this case, the cluster is scaled up. * There are nodes in the cluster that have been underutilized for an extended period of time and their pods can be placed on other existing nodes. In this case, the cluster is scaled down. diff --git a/versioned_docs/version-2.5/v2.5/en/cluster-admin/cluster-autoscaler/amazon/amazon.md b/versioned_docs/version-2.5/v2.5/en/cluster-admin/cluster-autoscaler/amazon/amazon.md index 940ea548823..9d0fd642f18 100644 --- a/versioned_docs/version-2.5/v2.5/en/cluster-admin/cluster-autoscaler/amazon/amazon.md +++ b/versioned_docs/version-2.5/v2.5/en/cluster-admin/cluster-autoscaler/amazon/amazon.md @@ -7,7 +7,7 @@ aliases: This guide will show you how to install and use [Kubernetes cluster-autoscaler](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/) on Rancher custom clusters using AWS EC2 Auto Scaling Groups. -We are going to install a Rancher RKE custom cluster with a fixed number of nodes with the etcd and controlplane roles, and a variable nodes with the worker role, managed by `cluster-autoscaler`. +We are going to install a Rancher RKE custom cluster with a fixed number of nodes with the etcd and controlplane roles, and a variable nodes with the worker role, managed by `cluster-autoscaler`. - [Prerequisites](#prerequisites) - [1. Create a Custom Cluster](#1-create-a-custom-cluster) @@ -70,7 +70,7 @@ On AWS EC2, we should create a few objects to configure our system. We've define } ``` -2. Master group: Nodes that will be part of the Kubernetes etcd and/or control planes. This will be out of the ASG. +2. Master group: Nodes that will be part of the Kubernetes etcd and/or control planes. This will be out of the ASG. * IAM profile: Required by the Kubernetes cloud_provider integration. Optionally, `AWS_ACCESS_KEY` and `AWS_SECRET_KEY` can be used instead [using-aws-credentials.](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#using-aws-credentials) This profile is called `K8sMasterProfile`. ```json @@ -213,7 +213,7 @@ On AWS EC2, we should create a few objects to configure our system. We've define * `kubernetes.io/cluster/: owned` * `k8s.io/cluster-autoscaler/: true` * `k8s.io/cluster-autoscaler/enabled: true` - * User data: `K8sWorkerUserData` Ubuntu 18.04(ami-0e11cbb34015ff725), installs docker and add worker node to the k8s cluster + * User data: `K8sWorkerUserData` Ubuntu 18.04(ami-0e11cbb34015ff725), installs docker and add worker node to the k8s cluster ```sh #!/bin/bash -x @@ -248,7 +248,7 @@ Once we've configured AWS, let's create VMs to bootstrap our cluster: * master (etcd+controlplane): Depending your needs, deploy three master instances with proper size. More info is at [the recommendations for production-ready clusters.]({{}}/rancher/v2.5/en/cluster-provisioning/production/) * IAM role: `K8sMasterRole` * Security group: `K8sMasterSg` - * Tags: + * Tags: * `kubernetes.io/cluster/: owned` * User data: `K8sMasterUserData` @@ -256,7 +256,7 @@ Once we've configured AWS, let's create VMs to bootstrap our cluster: * Name: `K8sWorkerAsg` * IAM role: `K8sWorkerRole` * Security group: `K8sWorkerSg` - * Tags: + * Tags: * `kubernetes.io/cluster/: owned` * `k8s.io/cluster-autoscaler/: true` * `k8s.io/cluster-autoscaler/enabled: true` @@ -270,7 +270,7 @@ Once the VMs are deployed, you should have a Rancher custom cluster up and runni ### 4. Install Cluster-autoscaler -At this point, we should have rancher cluster up and running. We are going to install cluster-autoscaler on master nodes and `kube-system` namespace, following cluster-autoscaler recommendation. +At this point, we should have rancher cluster up and running. We are going to install cluster-autoscaler on master nodes and `kube-system` namespace, following cluster-autoscaler recommendation. #### Parameters @@ -298,9 +298,9 @@ This table shows cluster-autoscaler parameters for fine tuning: |node-deletion-delay-timeout|"2m"|Maximum time CA waits for removing delay-deletion.cluster-autoscaler.kubernetes.io/ annotations before deleting the node| |scan-interval|"10s"|How often cluster is reevaluated for scale up or down| |max-nodes-total|0|Maximum number of nodes in all node groups. Cluster autoscaler will not grow the cluster beyond this number| -|cores-total|"0:320000"|Minimum and maximum number of cores in cluster, in the format :. Cluster autoscaler will not scale the cluster beyond these numbers| -|memory-total|"0:6400000"|Minimum and maximum number of gigabytes of memory in cluster, in the format :. Cluster autoscaler will not scale the cluster beyond these numbers| -cloud-provider|-|Cloud provider type| +|cores-total|"0:320000"|Minimum and maximum number of cores in cluster, in the format `:.` Cluster autoscaler will not scale the cluster beyond these numbers| +|memory-total|"0:6400000"|Minimum and maximum number of gigabytes of memory in cluster, in the format `:.` Cluster autoscaler will not scale the cluster beyond these numbers| +cloud-provider|-|Cloud provider type| |max-bulk-soft-taint-count|10|Maximum number of nodes that can be tainted/untainted PreferNoSchedule at the same time. Set to 0 to turn off such tainting| |max-bulk-soft-taint-time|"3s"|Maximum duration of tainting/untainting nodes as PreferNoSchedule at the same time| |max-empty-bulk-delete|10|Maximum number of empty nodes that can be deleted at the same time| @@ -309,7 +309,7 @@ cloud-provider|-|Cloud provider type| |ok-total-unready-count|3|Number of allowed unready nodes, irrespective of max-total-unready-percentage| |scale-up-from-zero|true|Should CA scale up when there 0 ready nodes| |max-node-provision-time|"15m"|Maximum time CA waits for node to be provisioned| -|nodes|-|sets min,max size and other configuration data for a node group in a format accepted by cloud provider. Can be used multiple times. Format: ::| +|nodes|-|sets min,max size and other configuration data for a node group in a format accepted by cloud provider. Can be used multiple times. Format: `::`| |node-group-auto-discovery|-|One or more definition(s) of node group auto-discovery. A definition is expressed `:[[=]]`| |estimator|-|"binpacking"|Type of resource estimator to be used in scale up. Available values: ["binpacking"]| |expander|"random"|Type of node group expander to be used in scale up. Available values: `["random","most-pods","least-waste","price","priority"]`| @@ -522,7 +522,7 @@ kubectl -n kube-system apply -f cluster-autoscaler-deployment.yaml # Testing -At this point, we should have a cluster-scaler up and running in our Rancher custom cluster. Cluster-scale should manage `K8sWorkerAsg` ASG to scale up and down between 2 and 10 nodes, when one of the following conditions is true: +At this point, we should have a cluster-scaler up and running in our Rancher custom cluster. Cluster-scale should manage `K8sWorkerAsg` ASG to scale up and down between 2 and 10 nodes, when one of the following conditions is true: * There are pods that failed to run in the cluster due to insufficient resources. In this case, the cluster is scaled up. * There are nodes in the cluster that have been underutilized for an extended period of time and their pods can be placed on other existing nodes. In this case, the cluster is scaled down. diff --git a/versioned_docs/version-2.5/v2.5/en/security/rancher-2.5/1.6-benchmark-2.5/1.6-benchmark-2.5.md b/versioned_docs/version-2.5/v2.5/en/security/rancher-2.5/1.6-benchmark-2.5/1.6-benchmark-2.5.md index f435c8471fa..f34e1ba7984 100644 --- a/versioned_docs/version-2.5/v2.5/en/security/rancher-2.5/1.6-benchmark-2.5/1.6-benchmark-2.5.md +++ b/versioned_docs/version-2.5/v2.5/en/security/rancher-2.5/1.6-benchmark-2.5/1.6-benchmark-2.5.md @@ -651,7 +651,7 @@ root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfil **Remediation:** Follow the documentation and configure alternate mechanisms for authentication. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and remove the --basic-auth-file= parameter. +on the master node and remove the `--basic-auth-file=` parameter. **Audit:** @@ -679,7 +679,7 @@ root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfil **Remediation:** Follow the documentation and configure alternate mechanisms for authentication. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and remove the --token-auth-file= parameter. +on the master node and remove the `--token-auth-file=` parameter. **Audit:** @@ -2322,7 +2322,7 @@ if test -e $CAFILE; then stat -c permissions=%a $CAFILE; fi **Remediation:** Run the following command to modify the ownership of the --client-ca-file. -chown root:root +`chown root:root ` **Audit:** diff --git a/versioned_docs/version-2.6/v2.6/en/cluster-admin/cluster-autoscaler/amazon/amazon.md b/versioned_docs/version-2.6/v2.6/en/cluster-admin/cluster-autoscaler/amazon/amazon.md index ffa5b83b76b..717abd28a43 100644 --- a/versioned_docs/version-2.6/v2.6/en/cluster-admin/cluster-autoscaler/amazon/amazon.md +++ b/versioned_docs/version-2.6/v2.6/en/cluster-admin/cluster-autoscaler/amazon/amazon.md @@ -5,7 +5,7 @@ weight: 1 This guide will show you how to install and use [Kubernetes cluster-autoscaler](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/) on Rancher custom clusters using AWS EC2 Auto Scaling Groups. -We are going to install a Rancher RKE custom cluster with a fixed number of nodes with the etcd and controlplane roles, and a variable nodes with the worker role, managed by `cluster-autoscaler`. +We are going to install a Rancher RKE custom cluster with a fixed number of nodes with the etcd and controlplane roles, and a variable nodes with the worker role, managed by `cluster-autoscaler`. - [Prerequisites](#prerequisites) - [1. Create a Custom Cluster](#1-create-a-custom-cluster) @@ -68,7 +68,7 @@ On AWS EC2, we should create a few objects to configure our system. We've define } ``` -2. Master group: Nodes that will be part of the Kubernetes etcd and/or control planes. This will be out of the ASG. +2. Master group: Nodes that will be part of the Kubernetes etcd and/or control planes. This will be out of the ASG. * IAM profile: Required by the Kubernetes cloud_provider integration. Optionally, `AWS_ACCESS_KEY` and `AWS_SECRET_KEY` can be used instead [using-aws-credentials.](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#using-aws-credentials) This profile is called `K8sMasterProfile`. ```json @@ -211,7 +211,7 @@ On AWS EC2, we should create a few objects to configure our system. We've define * `kubernetes.io/cluster/: owned` * `k8s.io/cluster-autoscaler/: true` * `k8s.io/cluster-autoscaler/enabled: true` - * User data: `K8sWorkerUserData` Ubuntu 18.04(ami-0e11cbb34015ff725), installs docker and add worker node to the k8s cluster + * User data: `K8sWorkerUserData` Ubuntu 18.04(ami-0e11cbb34015ff725), installs docker and add worker node to the k8s cluster ```sh #!/bin/bash -x @@ -246,7 +246,7 @@ Once we've configured AWS, let's create VMs to bootstrap our cluster: * master (etcd+controlplane): Depending your needs, deploy three master instances with proper size. More info is at [the recommendations for production-ready clusters.]({{}}/rancher/v2.6/en/cluster-provisioning/production/) * IAM role: `K8sMasterRole` * Security group: `K8sMasterSg` - * Tags: + * Tags: * `kubernetes.io/cluster/: owned` * User data: `K8sMasterUserData` @@ -254,7 +254,7 @@ Once we've configured AWS, let's create VMs to bootstrap our cluster: * Name: `K8sWorkerAsg` * IAM role: `K8sWorkerRole` * Security group: `K8sWorkerSg` - * Tags: + * Tags: * `kubernetes.io/cluster/: owned` * `k8s.io/cluster-autoscaler/: true` * `k8s.io/cluster-autoscaler/enabled: true` @@ -268,7 +268,7 @@ Once the VMs are deployed, you should have a Rancher custom cluster up and runni ### 4. Install Cluster-autoscaler -At this point, we should have rancher cluster up and running. We are going to install cluster-autoscaler on master nodes and `kube-system` namespace, following cluster-autoscaler recommendation. +At this point, we should have rancher cluster up and running. We are going to install cluster-autoscaler on master nodes and `kube-system` namespace, following cluster-autoscaler recommendation. #### Parameters @@ -296,9 +296,9 @@ This table shows cluster-autoscaler parameters for fine tuning: |node-deletion-delay-timeout|"2m"|Maximum time CA waits for removing delay-deletion.cluster-autoscaler.kubernetes.io/ annotations before deleting the node| |scan-interval|"10s"|How often cluster is reevaluated for scale up or down| |max-nodes-total|0|Maximum number of nodes in all node groups. Cluster autoscaler will not grow the cluster beyond this number| -|cores-total|"0:320000"|Minimum and maximum number of cores in cluster, in the format :. Cluster autoscaler will not scale the cluster beyond these numbers| -|memory-total|"0:6400000"|Minimum and maximum number of gigabytes of memory in cluster, in the format :. Cluster autoscaler will not scale the cluster beyond these numbers| -cloud-provider|-|Cloud provider type| +|cores-total|"0:320000"|Minimum and maximum number of cores in cluster, in the format `:.` Cluster autoscaler will not scale the cluster beyond these numbers| +|memory-total|"0:6400000"|Minimum and maximum number of gigabytes of memory in cluster, in the format `:.` Cluster autoscaler will not scale the cluster beyond these numbers| +cloud-provider|-|Cloud provider type| |max-bulk-soft-taint-count|10|Maximum number of nodes that can be tainted/untainted PreferNoSchedule at the same time. Set to 0 to turn off such tainting| |max-bulk-soft-taint-time|"3s"|Maximum duration of tainting/untainting nodes as PreferNoSchedule at the same time| |max-empty-bulk-delete|10|Maximum number of empty nodes that can be deleted at the same time| @@ -307,7 +307,7 @@ cloud-provider|-|Cloud provider type| |ok-total-unready-count|3|Number of allowed unready nodes, irrespective of max-total-unready-percentage| |scale-up-from-zero|true|Should CA scale up when there 0 ready nodes| |max-node-provision-time|"15m"|Maximum time CA waits for node to be provisioned| -|nodes|-|sets min,max size and other configuration data for a node group in a format accepted by cloud provider. Can be used multiple times. Format: ::| +|nodes|-|sets min,max size and other configuration data for a node group in a format accepted by cloud provider. Can be used multiple times. Format: `::`| |node-group-auto-discovery|-|One or more definition(s) of node group auto-discovery. A definition is expressed `:[[=]]`| |estimator|-|"binpacking"|Type of resource estimator to be used in scale up. Available values: ["binpacking"]| |expander|"random"|Type of node group expander to be used in scale up. Available values: `["random","most-pods","least-waste","price","priority"]`| @@ -520,7 +520,7 @@ kubectl -n kube-system apply -f cluster-autoscaler-deployment.yaml # Testing -At this point, we should have a cluster-scaler up and running in our Rancher custom cluster. Cluster-scale should manage `K8sWorkerAsg` ASG to scale up and down between 2 and 10 nodes, when one of the following conditions is true: +At this point, we should have a cluster-scaler up and running in our Rancher custom cluster. Cluster-scale should manage `K8sWorkerAsg` ASG to scale up and down between 2 and 10 nodes, when one of the following conditions is true: * There are pods that failed to run in the cluster due to insufficient resources. In this case, the cluster is scaled up. * There are nodes in the cluster that have been underutilized for an extended period of time and their pods can be placed on other existing nodes. In this case, the cluster is scaled down. diff --git a/versioned_docs/version-2.6/v2.6/en/security/hardening-guides/rke-1.6-benchmark-2.6/rke-1.6-benchmark-2.6.md b/versioned_docs/version-2.6/v2.6/en/security/hardening-guides/rke-1.6-benchmark-2.6/rke-1.6-benchmark-2.6.md index 6dc2904182f..3f561e5ff67 100644 --- a/versioned_docs/version-2.6/v2.6/en/security/hardening-guides/rke-1.6-benchmark-2.6/rke-1.6-benchmark-2.6.md +++ b/versioned_docs/version-2.6/v2.6/en/security/hardening-guides/rke-1.6-benchmark-2.6/rke-1.6-benchmark-2.6.md @@ -558,7 +558,7 @@ root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --e **Remediation:** Follow the documentation and configure alternate mechanisms for authentication. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and remove the --basic-auth-file= parameter. +on the master node and remove the `--basic-auth-file=` parameter. **Audit:** @@ -586,7 +586,7 @@ root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --e **Remediation:** Follow the documentation and configure alternate mechanisms for authentication. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the master node and remove the --token-auth-file= parameter. +on the master node and remove the `--token-auth-file=` parameter. **Audit:** @@ -2173,7 +2173,7 @@ if test -e $CAFILE; then stat -c permissions=%a $CAFILE; fi **Remediation:** Run the following command to modify the ownership of the --client-ca-file. -chown root:root +`chown root:root ` **Audit Script:** `check_cafile_ownership.sh` diff --git a/versioned_docs/version-2.6/v2.6/en/security/hardening-guides/rke2-1.6-benchmark-2.6/rke2-1.6-benchmark-2.6.md b/versioned_docs/version-2.6/v2.6/en/security/hardening-guides/rke2-1.6-benchmark-2.6/rke2-1.6-benchmark-2.6.md index 8e4fc25bbfd..f50043d7cbc 100644 --- a/versioned_docs/version-2.6/v2.6/en/security/hardening-guides/rke2-1.6-benchmark-2.6/rke2-1.6-benchmark-2.6.md +++ b/versioned_docs/version-2.6/v2.6/en/security/hardening-guides/rke2-1.6-benchmark-2.6/rke2-1.6-benchmark-2.6.md @@ -750,7 +750,7 @@ on the master node and set the below parameter. **Remediation:** Follow the documentation and configure alternate mechanisms for authentication. Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the master node and remove the --basic-auth-file= parameter. +on the master node and remove the `--basic-auth-file=` parameter. **Audit:** @@ -778,7 +778,7 @@ root 5275 5222 15 14:58 ? 00:01:26 kube-apiserver --audit-policy-file=/etc/ranch **Remediation:** Follow the documentation and configure alternate mechanisms for authentication. Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the master node and remove the --token-auth-file= parameter. +on the master node and remove the `--token-auth-file=` parameter. **Audit:** @@ -2269,7 +2269,7 @@ stat -c %a /var/lib/rancher/rke2/server/tls/server-ca.crt **Remediation:** Run the following command to modify the ownership of the --client-ca-file. -chown root:roset: trueot +`chown root:roset: trueot ` **Audit:**