Fix tables of contents, headers and formatting

2026-09-26 13:08:11 +00:00 · 2022-09-10 00:26:51 -07:00
parent 11ebb7d341
commit 5fdfa52386
336 changed files with 1249 additions and 3710 deletions
@@ -26,7 +26,7 @@ The core features of RKE templates allow DevOps and security teams to:
 - Control which users can create templates
 - Require users to create clusters from a template

-# Configurable Settings
+## Configurable Settings

 RKE templates can be created in the Rancher UI or defined in YAML format. They can define all the same parameters that can be specified when you use Rancher to provision custom nodes or nodes from an infrastructure provider:

@@ -42,7 +42,7 @@ RKE templates can be created in the Rancher UI or defined in YAML format. They c

 The [add-on section](#add-ons) of an RKE template is especially powerful because it allows a wide range of customization options.

-# Scope of RKE Templates
+## Scope of RKE Templates

 RKE templates are supported for Rancher-provisioned clusters. The templates can be used to provision custom clusters or clusters that are launched by an infrastructure provider.

@@ -53,7 +53,7 @@ RKE templates can be created from scratch to pre-define cluster configuration. T
 The settings of an existing cluster can be [saved as an RKE template.](../how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/apply-templates.md#converting-an-existing-cluster-to-use-an-rke-template) This creates a new template and binds the cluster settings to the template, so that the cluster can only be upgraded if the [template is updated](../how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md#updating-a-template), and the cluster is upgraded to [use a newer version of the template.](../how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md#upgrading-a-cluster-to-use-a-new-template-revision) The new template can also be used to create new clusters.


-# Example Scenarios
+## Example Scenarios
 When an organization has both basic and advanced Rancher users, administrators might want to give the advanced users more options for cluster creation, while restricting the options for basic users.

 These [example scenarios](../how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/example-use-cases.md) describe how an organization could use templates to standardize cluster creation.
@@ -65,7 +65,7 @@ Some of the example scenarios include the following:
 - **Updating template settings:** If an organization's security and DevOps teams decide to embed best practices into the required settings for new clusters, those best practices could change over time. If the best practices change, [a template can be updated to a new revision](../how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/example-use-cases.md#updating-templates-and-clusters-created-with-them) and clusters created from the template can [upgrade to the new version](../how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md#upgrading-a-cluster-to-use-a-new-template-revision) of the template.
 - **Sharing ownership of a template:** When a template owner no longer wants to maintain a template, or wants to share ownership of the template, this scenario describes how [template ownership can be shared.](../how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/example-use-cases.md#allowing-other-users-to-control-and-share-a-template)

-# Template Management
+## Template Management

 When you create an RKE template, it is available in the Rancher UI from the **Cluster Management** view under **RKE Templates**. When you create a template, you become the template owner, which gives you permission to revise and share the template. You can share the RKE templates with specific users or groups, and you can also make it public.

@@ -88,7 +88,7 @@ The documents in this section explain the details of RKE template management:

 An [example YAML configuration file for a template](../reference-guides/rke1-template-example-yaml.md) is provided for reference.

-# Applying Templates
+## Applying Templates

 You can [create a cluster from a template](../how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/apply-templates.md#creating-a-cluster-from-an-rke-template) that you created, or from a template that has been [shared with you.](../how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/access-or-share-templates.md)

@@ -98,13 +98,13 @@ RKE templates can be created from scratch to pre-define cluster configuration. T

 You can [save the configuration of an existing cluster as an RKE template.](../how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/apply-templates.md#converting-an-existing-cluster-to-use-an-rke-template) Then the cluster's settings can only be changed if the template is updated.

-# Standardizing Hardware
+## Standardizing Hardware

 RKE templates are designed to standardize Kubernetes and Rancher settings. If you want to standardize your infrastructure as well, one option is to use RKE templates [in conjunction with other tools](../how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/infrastructure.md).

 Another option is to use [cluster templates,](../how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/manage-cluster-templates.md) which include node pool configuration options, but don't provide configuration enforcement.

-# YAML Customization
+## YAML Customization

 If you define an RKE template as a YAML file, you can modify this [example RKE template YAML](../reference-guides/rke1-template-example-yaml.md). The YAML in the RKE template uses the same customization that Rancher uses when creating an RKE cluster, but since the YAML is located within the context of a Rancher provisioned cluster, you will need to nest the RKE template customization under the `rancher_kubernetes_engine_config` directive in the YAML.

@@ -5,20 +5,8 @@ weight: 2110
 ---
 Amazon EKS provides a managed control plane for your Kubernetes cluster. Amazon EKS runs the Kubernetes control plane instances across multiple Availability Zones to ensure high availability. Rancher provides an intuitive user interface for managing and deploying the Kubernetes clusters you run in Amazon EKS. With this guide, you will use Rancher to quickly and easily launch an Amazon EKS Kubernetes cluster in your AWS account. For more information on Amazon EKS, see this [documentation](https://docs.aws.amazon.com/eks/latest/userguide/what-is-eks.html).

- [Prerequisites in Amazon Web Services](#prerequisites-in-amazon-web-services)
-  - [Amazon VPC](#amazon-vpc)
-  - [IAM Policies](#iam-policies)
- [Create the EKS Cluster](#create-the-eks-cluster)
- [EKS Cluster Configuration Reference](#eks-cluster-configuration-reference)
- [Architecture](#architecture)
- [AWS Service Events](#aws-service-events)
- [Security and Compliance](#security-and-compliance)
- [Tutorial](#tutorial)
- [Minimum EKS Permissions](#minimum-eks-permissions)
- [Syncing](#syncing)
- [Troubleshooting](#troubleshooting)
- [Programmatically Creating EKS Clusters](#programmatically-creating-eks-clusters)
-# Prerequisites in Amazon Web Services
+
+## Prerequisites in Amazon Web Services

 :::caution

@@ -51,7 +39,7 @@ It's important to regularly rotate your access and secret keys. See this [docume
 For more detailed information on IAM policies for EKS, refer to the official [documentation on Amazon EKS IAM Policies, Roles, and Permissions](https://docs.aws.amazon.com/eks/latest/userguide/IAM_policies.html).


-# Create the EKS Cluster
+## Create the EKS Cluster

 Use Rancher to set up and configure your Kubernetes cluster.

@@ -74,11 +62,11 @@ You can access your cluster after its state is updated to **Active**.
 - `Default`, containing the `default` namespace
 - `System`, containing the `cattle-system`, `ingress-nginx`, `kube-public`, and `kube-system` namespaces

-# EKS Cluster Configuration Reference
+## EKS Cluster Configuration Reference

 For the full list of EKS cluster configuration options, see [this page.](../reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md)

-# Architecture
+## Architecture

 The figure below illustrates the high-level architecture of Rancher 2.x. The figure depicts a Rancher Server installation that manages two Kubernetes clusters: one created by RKE and another created by EKS.

@@ -86,31 +74,31 @@ The figure below illustrates the high-level architecture of Rancher 2.x. The fig

 ![Architecture](/img/rancher-architecture-rancher-api-server.svg)

-# AWS Service Events
+## AWS Service Events

 To find information on any AWS Service events, please see [this page](https://status.aws.amazon.com/).

-# Security and Compliance
+## Security and Compliance

 By default only the IAM user or role that created a cluster has access to it. Attempting to access the cluster with any other user or role without additional configuration will lead to an error. In Rancher, this means using a credential that maps to a user or role that was not used to create the cluster will cause an unauthorized error. For example, an EKSCtl cluster will not register in Rancher unless the credentials used to register the cluster match the role or user used by EKSCtl. Additional users and roles can be authorized to access a cluster by being added to the aws-auth configmap in the kube-system namespace. For a more in-depth explanation and detailed instructions, please see this [documentation](https://aws.amazon.com/premiumsupport/knowledge-center/amazon-eks-cluster-access/).

 For more information on security and compliance with your Amazon EKS Kubernetes cluster, please see this [documentation](https://docs.aws.amazon.com/eks/latest/userguide/shared-responsibilty.html).

-# Tutorial
+## Tutorial

 This [tutorial](https://aws.amazon.com/blogs/opensource/managing-eks-clusters-rancher/) on the AWS Open Source Blog will walk you through how to set up an EKS cluster with Rancher, deploy a publicly accessible app to test the cluster, and deploy a sample project to track real-time geospatial data using a combination of other open-source software such as Grafana and InfluxDB.

-# Minimum EKS Permissions
+## Minimum EKS Permissions

 See [this page](../reference-guides/amazon-eks-permissions/minimum-eks-permissions.md) for the minimum set of permissions necessary to use all functionality of the EKS driver in Rancher.

-# Syncing
+## Syncing

 The EKS provisioner can synchronize the state of an EKS cluster between Rancher and the provider. For an in-depth technical explanation of how this works, see [Syncing.](../reference-guides/cluster-configuration/rancher-server-configuration/sync-clusters.md)

 For information on configuring the refresh interval, refer to [this section.](../reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md#configuring-the-refresh-interval)

-# Troubleshooting
+## Troubleshooting

 If your changes were overwritten, it could be due to the way the cluster data is synced with EKS. Changes shouldn't be made to the cluster from another source, such as in the EKS console, and in Rancher within a five-minute span. For information on how this works and how to configure the refresh interval, refer to [Syncing.](#syncing)

@@ -118,6 +106,6 @@ If an unauthorized error is returned while attempting to modify or register the

 For any issues or troubleshooting details for your Amazon EKS Kubernetes cluster, please see this [documentation](https://docs.aws.amazon.com/eks/latest/userguide/troubleshooting.html).

-# Programmatically Creating EKS Clusters
+## Programmatically Creating EKS Clusters

 The most common way to programmatically deploy EKS clusters through Rancher is by using the Rancher2 Terraform provider. The documentation for creating clusters with Terraform is [here.](https://registry.terraform.io/providers/rancher/rancher2/latest/docs/resources/cluster)
@@ -9,22 +9,12 @@ The `rancher-backup` operator is used to backup and restore Rancher on any Kuber

 The backup-restore operator needs to be installed in the local cluster, and only backs up the Rancher app. The backup and restore operations are performed only in the local Kubernetes cluster.

- [Backup and Restore for Rancher installed with Docker](#backup-and-restore-for-rancher-installed-with-docker)
- [How Backups and Restores Work](#how-backups-and-restores-work)
- [Installing the rancher-backup Operator](#installing-the-rancher-backup-operator)
-  - [Installing rancher-backup with the Rancher UI](#installing-rancher-backup-with-the-rancher-ui)
-  - [RBAC](#rbac)
- [Backing up Rancher](#backing-up-rancher)
- [Restoring Rancher](#restoring-rancher)
- [Migrating Rancher to a New Cluster](#migrating-rancher-to-a-new-cluster)
- [Default Storage Location Configuration](#default-storage-location-configuration)
-  - [Example values.yaml for the rancher-backup Helm Chart](#example-values-yaml-for-the-rancher-backup-helm-chart)

-# Backup and Restore for Rancher installed with Docker
+## Backup and Restore for Rancher installed with Docker

 For Rancher installed with Docker, refer to [this page](../how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/back-up-docker-installed-rancher.md) to perform backups and [this page](../how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/restore-docker-installed-rancher.md) to perform restores.

-# How Backups and Restores Work
+## How Backups and Restores Work

 The `rancher-backup` operator introduces three custom resources: Backups, Restores, and ResourceSets. The following cluster-scoped custom resource definitions are added to the cluster:

@@ -48,7 +38,7 @@ Refer [here](../how-to-guides/new-user-guides/backup-restore-and-disaster-recove

 :::

-# Installing the rancher-backup Operator
+## Installing the rancher-backup Operator

 The `rancher-backup` operator can be installed from the Rancher UI, or with the Helm CLI. In both cases, the `rancher-backup` Helm chart is installed on the Kubernetes cluster running the Rancher server. It is a cluster-admin only feature and available only for the **local** cluster.  (*If you do not see `rancher-backup` in the Rancher UI, you may have selected the wrong cluster.*)

@@ -83,19 +73,19 @@ Only the rancher admins and the local cluster’s cluster-owner can:
 * Perform a backup or restore by creating a Backup CR and Restore CR respectively
 * List backups/restores performed so far

-# Backing up Rancher
+## Backing up Rancher

 A backup is performed by creating a Backup custom resource. For a tutorial, refer to [this page.](../how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/back-up-rancher.md)

-# Restoring Rancher
+## Restoring Rancher

 A restore is performed by creating a Restore custom resource. For a tutorial, refer to [this page.](../how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/restore-rancher.md)

-# Migrating Rancher to a New Cluster
+## Migrating Rancher to a New Cluster

 A migration is performed by following [these steps.](../how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/migrate-rancher-to-new-cluster.md)

-# Default Storage Location Configuration
+## Default Storage Location Configuration

 Configure a storage location where all backups are saved by default. You will have the option to override this with each backup, but will be limited to using an S3-compatible or Minio object store.

@@ -7,15 +7,8 @@ Rancher can run a security scan to check whether Kubernetes is deployed accordin

 The `rancher-cis-benchmark` app leverages <a href="https://github.com/aquasecurity/kube-bench" target="_blank">kube-bench,</a> an open-source tool from Aqua Security, to check clusters for CIS Kubernetes Benchmark compliance. Also, to generate a cluster-wide report, the application utilizes <a href="https://github.com/vmware-tanzu/sonobuoy" target="_blank">Sonobuoy</a> for report aggregation.

- [About the CIS Benchmark](#about-the-cis-benchmark)
- [About the Generated Report](#about-the-generated-report)
- [Test Profiles](#test-profiles)
- [About Skipped and Not Applicable Tests](#about-skipped-and-not-applicable-tests)
- [Roles-based Access Control](#roles-based-access-control)
- [Configuration](#configuration)
- [How-to Guides](#how-to-guides)

-# About the CIS Benchmark
+## About the CIS Benchmark

 The Center for Internet Security is a 501(c\)(3) non-profit organization, formed in October 2000, with a mission to "identify, develop, validate, promote, and sustain best practice solutions for cyber defense and build and lead communities to enable an environment of trust in cyberspace". The organization is headquartered in East Greenbush, New York, with members including large corporations, government agencies, and academic institutions.

@@ -24,7 +17,7 @@ CIS Benchmarks are best practices for the secure configuration of a target syste
 The official Benchmark documents are available through the CIS website. The sign-up form to access the documents is
 <a href="https://learn.cisecurity.org/benchmarks" target="_blank">here.</a>

-# About the Generated Report
+## About the Generated Report

 Each scan generates a report can be viewed in the Rancher UI and can be downloaded in CSV format.

@@ -55,7 +48,7 @@ The report contains the following information:

 Refer to [the table in the cluster hardening guide](./rancher-security.md) for information on which versions of Kubernetes, the Benchmark, Rancher, and our cluster hardening guide correspond to each other. Also refer to the hardening guide for configuration files of CIS-compliant clusters and information on remediating failed tests.

-# Test Profiles
+## Test Profiles

 The following profiles are available:

@@ -95,7 +88,7 @@ The `rancher-cis-benchmark` supports the CIS 1.6 Benchmark version.
 - For RKE2 Kubernetes clusters, the RKE2 Permissive 1.6 profile is the default.
 - For cluster types other than RKE, RKE2, EKS and GKE, the Generic CIS 1.5 profile will be used by default.

-# About Skipped and Not Applicable Tests
+## About Skipped and Not Applicable Tests

 For a list of skipped and not applicable tests, refer to [this page](../how-to-guides/advanced-user-guides/cis-scan-guides/skip-tests.md).

@@ -103,14 +96,14 @@ For now, only user-defined skipped tests are marked as skipped in the generated

 Any skipped tests that are defined as being skipped by one of the default profiles are marked as not applicable.

-# Roles-based Access Control
+## Roles-based Access Control

 For information about permissions, refer to [this page](../explanations/integrations-in-rancher/cis-scans/rbac-for-cis-scans.md)

-# Configuration
+## Configuration

 For more information about configuring the custom resources for the scans, profiles, and benchmark versions, refer to [this page](../explanations/integrations-in-rancher/cis-scans/configuration-reference.md)

-# How-to Guides
+## How-to Guides

 Please refer [here](../pages-for-subheaders/cis-scan-guides.md) for how-to guides on CIS scans.
@@ -3,14 +3,6 @@ title: Configuration Options
 weight: 3
 ---

- [Egress Support](#egress-support)
- [Enabling Automatic Sidecar Injection](#enabling-automatic-sidecar-injection)
- [Overlay File](#overlay-file)
- [Selectors and Scrape Configs](#selectors-and-scrape-configs)
- [Enable Istio with Pod Security Policies](#enable-istio-with-pod-security-policies)
- [Additional Steps for Installing Istio on an RKE2 Cluster](#additional-steps-for-installing-istio-on-an-rke2-cluster)
- [Additional Steps for Project Network Isolation](#additional-steps-for-project-network-isolation)
-
 ### Egress Support

 By default the Egress gateway is disabled, but can be enabled on install or upgrade through the values.yaml or via the [overlay file](#overlay-file).
@@ -11,16 +11,6 @@ If you also configure OpenLDAP as the back end to Shibboleth, it will return a S

 > The instructions in this section assume that you understand how Rancher, Shibboleth, and OpenLDAP work together. For a more detailed explanation of how it works, refer to [this page.](../how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-authentication/configure-shibboleth-saml/about-group-permissions.md)

-This section covers the following topics:
-
- [Setting up Shibboleth in Rancher](#setting-up-shibboleth-in-rancher)
-  - [Shibboleth Prerequisites](#shibboleth-prerequisites)
-  - [Configure Shibboleth in Rancher](#configure-shibboleth-in-rancher)
-  - [SAML Provider Caveats](#saml-provider-caveats)
- [Setting up OpenLDAP in Rancher](#setting-up-openldap-in-rancher)
-  - [OpenLDAP Prerequisites](#openldap-prerequisites)
-  - [Configure OpenLDAP in Rancher](#configure-openldap-in-rancher)
-  - [Troubleshooting](#troubleshooting)

 # Setting up Shibboleth in Rancher

@@ -6,20 +6,12 @@ Fleet is GitOps at scale. Fleet is designed to manage up to a million clusters.

 Fleet is a separate project from Rancher, and can be installed on any Kubernetes cluster with Helm.

- [Architecture](#architecture)
- [Accessing Fleet in the Rancher UI](#accessing-fleet-in-the-rancher-ui)
- [Windows Support](#windows-support)
- [GitHub Repository](#github-repository)
- [Use Fleet Behind a Proxy](#use-fleet-behind-a-proxy)
- [Helm Chart Dependencies](#helm-chart-dependencies)
- [Troubleshooting](#troubleshooting)
- [Documentation](#documentation)

-# Architecture
+## Architecture

 For information about how Fleet works, see [this page](../explanations/integrations-in-rancher/fleet-gitops-at-scale/architecture.md).

-# Accessing Fleet in the Rancher UI
+## Accessing Fleet in the Rancher UI

 Fleet comes preinstalled in Rancher and is managed by the **Continuous Delivery** option in the Rancher UI. For additional information on Continuous Delivery and other Fleet troubleshooting tips, refer [here](https://fleet.rancher.io/troubleshooting/).

@@ -43,30 +35,30 @@ Follow the steps below to access Continuous Delivery in the Rancher UI:

 1. Once the gitrepo is deployed, you can monitor the application through the Rancher UI.

-# Windows Support
+## Windows Support

 For details on support for clusters with Windows nodes, see [this page](../explanations/integrations-in-rancher/fleet-gitops-at-scale/windows-support.md).

-# GitHub Repository
+## GitHub Repository

 The Fleet Helm charts are available [here](https://github.com/rancher/fleet/releases/tag/v0.3.10).

-# Using Fleet Behind a Proxy
+## Using Fleet Behind a Proxy

 For details on using Fleet behind a proxy, see [this page](../explanations/integrations-in-rancher/fleet-gitops-at-scale/use-fleet-behind-a-proxy.md).

-# Helm Chart Dependencies
+## Helm Chart Dependencies

 In order for Helm charts with dependencies to deploy successfully, you must run a manual command (as listed below), as it is up to the user to fulfill the dependency list. If you do not do this and proceed to clone your repository and run `helm install`, your installation will fail because the dependencies will be missing.

 The Helm chart in the git repository must include its dependencies in the charts subdirectory. You must either manually run `helm dependencies update $chart` OR run `helm dependencies build $chart` locally, then commit the complete charts directory to your git repository. Note that you will update your commands with the applicable parameters

-# Troubleshooting
+## Troubleshooting

 - **Known Issue**: clientSecretName and helmSecretName secrets for Fleet gitrepos are not included in the backup nor restore created by the [backup-restore-operator](../how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/back-up-rancher#1-install-the-rancher-backup-operator). We will update the community once a permanent solution is in place.

 - **Temporary Workaround**: By default, user-defined secrets are not backed up in Fleet. It is necessary to recreate secrets if performing a disaster recovery restore or migration of Rancher into a fresh cluster. To modify resourceSet to include extra resources you want to backup, refer to docs [here](https://github.com/rancher/backup-restore-operator#user-flow).

-# Documentation
+## Documentation

 The Fleet documentation is at https://fleet.rancher.io/.
@@ -4,13 +4,13 @@ shortTitle: GKE Cluster Configuration
 weight: 3
 ---

-# Changes in Rancher v2.6
+## Changes in Rancher v2.6

 - Support for additional configuration options:
  - Project network isolation
  - Network tags

-# Cluster Location
+## Cluster Location

 | Value | Description |
 |--------|--------------|
@@ -19,7 +19,7 @@ weight: 3
 | Additional Zones | For zonal clusters, you can select additional zones to create a [multi-zone cluster.](https://cloud.google.com/kubernetes-engine/docs/concepts/types-of-clusters#multi-zonal_clusters) |
 | Region | For [regional clusters,](https://cloud.google.com/kubernetes-engine/docs/concepts/types-of-clusters#regional_clusters) you can select a region. For more information about available regions and zones, refer to [this section](https://cloud.google.com/compute/docs/regions-zones#available). The first part of each zone name is the name of the region. |

-# Cluster Options
+## Cluster Options

 ### Kubernetes Version

@@ -9,8 +9,6 @@ import TabItem from '@theme/TabItem';

 In this section, you'll learn how to deploy Rancher on a Kubernetes cluster using the Helm CLI.

- [Prerequisites](#prerequisites)
- [Install the Rancher Helm Chart](#install-the-rancher-helm-chart)

 # Prerequisites

@@ -18,7 +18,9 @@ The workloads and services that you want to be controlled by Istio must meet [Is

 # Install

-:::tip Quick Setup Tip: If you don't need external traffic to reach Istio, and you just want to set up Istio for monitoring and tracing traffic within the cluster, skip the steps for [setting up the Istio gateway](../how-to-guides/advanced-user-guides/istio-setup-guide/set-up-istio-gateway.md) and [setting up Istio's components for traffic management.](../how-to-guides/advanced-user-guides/istio-setup-guide/set-up-traffic-management.md)
+:::tip Quick Setup Tip:
+
+If you don't need external traffic to reach Istio, and you just want to set up Istio for monitoring and tracing traffic within the cluster, skip the steps for [setting up the Istio gateway](../how-to-guides/advanced-user-guides/istio-setup-guide/set-up-istio-gateway.md) and [setting up Istio's components for traffic management.](../how-to-guides/advanced-user-guides/istio-setup-guide/set-up-traffic-management.md)

 :::

@@ -19,17 +19,8 @@ After [setting up istio](istio-setup-guide.md) you can leverage Istio's control

 Istio needs to be set up by a `cluster-admin` before it can be used in a project.

- [What's New in Rancher v2.5](#what-s-new-in-rancher-v2-5)
- [Tools Bundled with Istio](#tools-bundled-with-istio)
- [Prerequisites](#prerequisites)
- [Setup Guide](#setup-guide)
- [Remove Istio](#remove-istio)
- [Migrate from Previous Istio Version](#migrate-from-previous-istio-version)
- [Accessing Visualizations](#accessing-visualizations)
- [Architecture](#architecture)
- [Additional steps for installing Istio on an RKE2 cluster](#additional-steps-for-installing-istio-on-an-rke2-cluster)

-# What's New in Rancher v2.5
+## What's New in Rancher v2.5

 The overall architecture of Istio has been simplified. A single component, Istiod, has been created by combining Pilot, Citadel, Galley and the sidecar injector. Node Agent functionality has also been merged into istio-agent.

@@ -41,7 +32,7 @@ Istio has migrated away from Helm as a way to install Istio and now provides ins

 This Helm chart will be available via the Apps and Marketplace in the UI. A user that has access to the Rancher Chart's catalog will need to set up Istio before it can be used in the project.

-# Tools Bundled with Istio
+## Tools Bundled with Istio

 Our [Istio](https://istio.io/) installer wraps the istioctl binary commands in a handy Helm chart, including an overlay file option to allow complex customization. 

@@ -59,7 +50,7 @@ Our Istio installer includes a quick-start, all-in-one installation of [Jaeger,]

 Note that this is not a production-qualified deployment of Jaeger. This deployment uses an in-memory storage component, while a persistent storage component is recommended for production. For more information on which deployment strategy you may need, refer to the [Jaeger documentation.](https://www.jaegertracing.io/docs/latest/operator/#production-strategy)

-# Prerequisites
+## Prerequisites

 Before enabling Istio, we recommend that you confirm that your Rancher worker nodes have enough [CPU and memory](../explanations/integrations-in-rancher/istio/cpu-and-memory-allocations.md) to run all of the components of Istio.

@@ -67,15 +58,15 @@ If you are installing Istio on RKE2 cluster, some additional steps are required.

 Note that Istio v2 (upstream Istio v1.7+) cannot be upgraded in an air gapped environment.

-# Setup Guide
+## Setup Guide

 Refer to the [setup guide](istio-setup-guide.md) for instructions on how to set up Istio and use it in a project.

-# Remove Istio
+## Remove Istio

 To remove Istio components from a cluster, namespace, or workload, refer to the section on [uninstalling Istio.](../explanations/integrations-in-rancher/istio/disable-istio.md)

-# Migrate From Previous Istio Version
+## Migrate From Previous Istio Version

 There is no upgrade path for Istio versions less than 1.7.x. To successfully install Istio through **Apps & Marketplace,** you will need to disable your existing Istio from the global view in the legacy Rancher UI.

@@ -83,7 +74,7 @@ If you have a significant amount of additional Istio CRDs you might consider man

 Another option is to manually uninstall istio resources one at a time, but leave the resources that are supported in both versions of Istio and that will not be installed by the newest version. This method is more likely to result in issues installing the new version, but could be a good option depending on your situation.

-# Accessing Visualizations
+## Accessing Visualizations

 > By default, only cluster-admins have access to Kiali. For instructions on how to allow admin, edit or views roles to access them, see [this section.](../explanations/integrations-in-rancher/istio/rbac-for-istio.md)

@@ -107,7 +98,7 @@ By default, all namespace will picked up by prometheus and make data available f

 Your access to the visualizations depend on your role. Grafana and Prometheus are only available for `cluster-admin` roles. The Kiali UI is available only to `cluster-admin` by default, but `cluster-admin` can allow other roles to access them by editing the Istio values.yaml.

-# Architecture
+## Architecture

 Istio installs a service mesh that uses [Envoy](https://www.envoyproxy.io/learn/service-mesh) sidecar proxies to intercept traffic to each workload. These sidecars intercept and manage service-to-service communication, allowing fine-grained observation and control over traffic within the cluster.

@@ -129,6 +120,6 @@ By default, each Rancher-provisioned cluster has one NGINX ingress controller al

 By default the Egress gateway is disabled, but can be enabled on install or upgrade through the values.yaml or via the [overlay file](configuration-options.md#overlay-file).

-# Additional Steps for Installing Istio on an RKE2 Cluster
+## Additional Steps for Installing Istio on an RKE2 Cluster

 To install Istio on an RKE2 cluster, follow the steps in [this section.](../explanations/integrations-in-rancher/istio/configuration-options/install-istio-on-rke2-cluster.md)
@@ -10,19 +10,7 @@ This section assumes a basic familiarity with Docker and Kubernetes. For a brief

 For a conceptual overview of how the Rancher server provisions clusters and what tools it uses to provision them, refer to the [architecture](rancher-manager-architecture.md) page.

-This section covers the following topics:

-<!-- TOC -->
-
- [Cluster Management Capabilities by Cluster Type](#cluster-management-capabilities-by-cluster-type)
- [Setting up clusters in a hosted Kubernetes provider](#setting-up-clusters-in-a-hosted-kubernetes-provider)
- [Launching Kubernetes with Rancher](#launching-kubernetes-with-rancher)
-  - [Launching Kubernetes and Provisioning Nodes in an Infrastructure Provider](#launching-kubernetes-and-provisioning-nodes-in-an-infrastructure-provider)
-  - [Launching Kubernetes on Existing Custom Nodes](#launching-kubernetes-on-existing-custom-nodes)
- [Registering Existing Clusters](#registering-existing-clusters)
- [Programmatically Creating Clusters](#programmatically-creating-clusters)
-
-<!-- /TOC -->

 ### Cluster Management Capabilities by Cluster Type

@@ -32,7 +20,7 @@ import ClusterCapabilitiesTable from '../shared-files/_cluster-capabilities-tabl

 <ClusterCapabilitiesTable />

-# Setting up Clusters in a Hosted Kubernetes Provider
+## Setting up Clusters in a Hosted Kubernetes Provider

 In this scenario, Rancher does not provision Kubernetes because it is installed by providers such as Google Kubernetes Engine (GKE), Amazon Elastic Container Service for Kubernetes, or Azure Kubernetes Service.

@@ -40,7 +28,7 @@ If you use a Kubernetes provider such as Google GKE, Rancher integrates with its

 For more information, refer to the section on [hosted Kubernetes clusters.](set-up-clusters-from-hosted-kubernetes-providers.md)

-# Launching Kubernetes with Rancher
+## Launching Kubernetes with Rancher

 Rancher uses the [Rancher Kubernetes Engine (RKE)](https://rancher.com/docs/rke/latest/en/) as a library when provisioning Kubernetes on your own nodes. RKE is Rancher’s own lightweight Kubernetes installer.

@@ -72,7 +60,7 @@ You can bring any nodes you want to Rancher and use them to create a cluster.

 These nodes include on-prem bare metal servers, cloud-hosted virtual machines, or on-prem virtual machines.

-# Registering Existing Clusters
+## Registering Existing Clusters

 The cluster registration feature replaces the feature to import clusters.

@@ -82,7 +70,7 @@ When you delete an EKS cluster that was created in Rancher, the cluster is destr

 For more information, see [this page.](../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/register-existing-clusters.md)

-# Programmatically Creating Clusters
+## Programmatically Creating Clusters

 The most common way to programmatically deploy Kubernetes clusters through Rancher is by using the Rancher2 Terraform provider. The documentation for creating clusters with Terraform is [here.](https://registry.terraform.io/providers/rancher/rancher2/latest/docs/resources/cluster)

@@ -27,10 +27,9 @@ Load Balancers have a couple of limitations you should be aware of:

 - If you want to use a load balancer with a Hosted Kubernetes cluster (i.e., clusters hosted in GKE, EKS, or AKS), the load balancer must be running within that cloud provider's infrastructure. Please review the compatibility tables regarding support for load balancers based on how you've provisioned your clusters:

+- [Support for Layer-4 Load Balancing](../how-to-guides/new-user-guides/kubernetes-resources-setup/load-balancer-and-ingress-controller/layer-4-and-layer-7-load-balancing.md#support-for-layer-4-load-balancing)

-    - [Support for Layer-4 Load Balancing](../how-to-guides/new-user-guides/kubernetes-resources-setup/load-balancer-and-ingress-controller/layer-4-and-layer-7-load-balancing.md#support-for-layer-4-load-balancing)
-
-    - [Support for Layer-7 Load Balancing](../how-to-guides/new-user-guides/kubernetes-resources-setup/load-balancer-and-ingress-controller/layer-4-and-layer-7-load-balancing.md#support-for-layer-7-load-balancing)
+- [Support for Layer-7 Load Balancing](../how-to-guides/new-user-guides/kubernetes-resources-setup/load-balancer-and-ingress-controller/layer-4-and-layer-7-load-balancing.md#support-for-layer-7-load-balancing)

 ## Ingress

@@ -10,22 +10,8 @@ The [Banzai Cloud Logging operator](https://banzaicloud.com/docs/one-eye/logging

 For an overview of the changes in v2.5, see [this section.](../explanations/integrations-in-rancher/logging/logging-architecture.md#changes-in-rancher-v2-5) For information about migrating from Logging V1, see [this page.](../explanations/integrations-in-rancher/logging/migrate-to-rancher-v2.5+-logging.md)

- [Enabling Logging](#enabling-logging)
- [Uninstall Logging](#uninstall-logging)
- [Architecture](#architecture)
- [Role-based Access Control](#role-based-access-control)
- [Configuring the Logging Custom Resources](#configuring-the-logging-custom-resources)
-  - [Flows and ClusterFlows](#flows-and-clusterflows)
-  - [Outputs and ClusterOutputs](#outputs-and-clusteroutputs)
- [Configuring the Logging Helm Chart](#configuring-the-logging-helm-chart)
-  - [Windows Support](#windows-support)
-  - [Working with a Custom Docker Root Directory](#working-with-a-custom-docker-root-directory)
-  - [Working with Taints and Tolerations](#working-with-taints-and-tolerations)
-  - [Logging V2 with SELinux](#logging-v2-with-selinux)
-  - [Additional Logging Sources](#additional-logging-sources)
- [Troubleshooting](#troubleshooting)

-# Enabling Logging
+## Enabling Logging

 You can enable the logging for a Rancher managed cluster by going to the Apps page and installing the logging app.

@@ -35,7 +21,7 @@ You can enable the logging for a Rancher managed cluster by going to the Apps pa

 **Result:** The logging app is deployed in the `cattle-logging-system` namespace.

-# Uninstall Logging
+## Uninstall Logging

 1. Go to the cluster where you want to install logging and click **Apps & Marketplace**.
 1. Click **Installed Apps**.
@@ -45,17 +31,17 @@ You can enable the logging for a Rancher managed cluster by going to the Apps pa

 **Result** `rancher-logging` is uninstalled.

-# Architecture
+## Architecture

 For more information about how the logging application works, see [this section.](../explanations/integrations-in-rancher/logging/logging-architecture.md)



-# Role-based Access Control
+## Role-based Access Control

 Rancher logging has two roles, `logging-admin` and `logging-view`. For more information on how and when to use these roles, see [this page.](../explanations/integrations-in-rancher/logging/rbac-for-logging.md)

-# Configuring Logging Custom Resources
+## Configuring Logging Custom Resources

 To manage `Flows,` `ClusterFlows`, `Outputs`, and `ClusterOutputs`,

@@ -71,7 +57,7 @@ For help with configuring `Flows` and `ClusterFlows`, see [this page.](../explan

 For help with configuring `Outputs` and `ClusterOutputs`, see [this page.](../explanations/integrations-in-rancher/logging/custom-resource-configuration/outputs-and-clusteroutputs.md)

-# Configuring the Logging Helm Chart
+## Configuring the Logging Helm Chart

 For a list of options that can be configured when the logging application is installed or upgraded, see [this page.](../explanations/integrations-in-rancher/logging/logging-helm-chart-options.md)

@@ -100,7 +86,7 @@ For information on enabling the logging application for SELinux-enabled nodes, s
 By default, Rancher collects logs for control plane components and node components for all cluster types. In some cases additional logs can be collected. For details, see [this section.](../explanations/integrations-in-rancher/logging/logging-helm-chart-options.md#additional-logging-sources)


-# Troubleshooting
+## Troubleshooting

 ### The `cattle-logging` Namespace Being Recreated

@@ -7,13 +7,6 @@ weight: 13

 Using the `rancher-monitoring` application, you can quickly deploy leading open-source monitoring and alerting solutions onto your cluster.

- [Features](#features)
- [How Monitoring Works](#how-monitoring-works)
- [Default Components and Deployments](#default-components-and-deployments)
- [Role-based Access Control](#role-based-access-control)
- [Guides](#guides)
- [Windows Cluster Support](#windows-cluster-support)
- [Known Issues](#known-issues)

 ### Features

@@ -34,25 +34,12 @@ Rancher's pipeline provides a simple CI/CD experience, but it does not offer the

 :::

-This section covers the following topics:

- [Concepts](#concepts)
- [How Pipelines Work](#how-pipelines-work)
-[Roles-based Access Control for Pipelines](#role-based-access-control-for-pipelines)
- [Setting up Pipelines](#setting-up-pipelines)
-  - [Configure version control providers](#1-configure-version-control-providers)
-  - [Configure repositories](#2-configure-repositories)
-  - [Configure the pipeline](#3-configure-the-pipeline)
- [Pipeline Configuration Reference](#pipeline-configuration-reference)
- [Running your Pipelines](#running-your-pipelines)
- [Triggering a Pipeline](#triggering-a-pipeline)
-  - [Modifying the Event Triggers for the Repository](#modifying-the-event-triggers-for-the-repository)
-
-# Concepts
+## Concepts

 For an explanation of concepts and terminology used in this section, refer to [this page.](../reference-guides/pipelines/concepts.md)

-# How Pipelines Work
+## How Pipelines Work

 After enabling the ability to use pipelines in a project, you can configure multiple pipelines in each project. Each pipeline is unique and can be configured independently.

@@ -86,7 +73,7 @@ When you configure a pipeline in one of your projects, a namespace specifically

  :::

-# Role-based Access Control for Pipelines
+## Role-based Access Control for Pipelines

 If you can access a project, you can enable repositories to start building pipelines.

@@ -94,7 +81,7 @@ Only [administrators](../how-to-guides/advanced-user-guides/authentication-permi

 Project members can only configure repositories and pipelines.

-# Setting up Pipelines
+## Setting up Pipelines

 ### Prerequisite

@@ -241,7 +228,7 @@ Now that repositories are added to your project, you can start configuring the p
 **Results:** Your pipeline is now configured and ready to be run.


-# Pipeline Configuration Reference
+## Pipeline Configuration Reference

 Refer to [this page](../reference-guides/pipelines/pipeline-configuration.md) for details on how to configure a pipeline to:

@@ -260,7 +247,7 @@ The configuration reference also covers how to configure:
 - Secrets


-# Running your Pipelines
+## Running your Pipelines

 Run your pipeline for the first time. Find your pipeline and select the vertical **⋮ > Run**.

@@ -272,7 +259,7 @@ During this initial run, your pipeline is tested, and the following pipeline com

 This process takes several minutes. When it completes, you can view each pipeline component from the project **Workloads** tab.

-# Triggering a Pipeline
+## Triggering a Pipeline

 When a repository is enabled, a webhook is automatically set in the version control provider. By default, the pipeline is triggered by a **push** event to a repository, but you can modify the event(s) that trigger running the pipeline.

@@ -57,7 +57,7 @@ If you are installing Rancher in a development or testing environment where iden

 Log into your host, and run the command below:

-```bash
+```
 docker run -d --restart=unless-stopped \
  -p 80:80 -p 443:443 \
  --privileged \
@@ -87,7 +87,7 @@ After creating your certificate, run the Docker command below to install Rancher

 Log into your host, and run the command below:

-```bash
+```
 docker run -d --restart=unless-stopped \
  -p 80:80 -p 443:443 \
  -v /<CERT_DIRECTORY>/<FULL_CHAIN.pem>:/etc/rancher/ssl/cert.pem \
@@ -123,7 +123,7 @@ After obtaining your certificate, run the Docker command below.

 Log into your host, and run the command below:

-```bash
+```
 docker run -d --restart=unless-stopped \
  -p 80:80 -p 443:443 \
  -v /<CERT_DIRECTORY>/<FULL_CHAIN.pem>:/etc/rancher/ssl/cert.pem \
@@ -177,7 +177,7 @@ If you are installing Rancher in a development or testing environment where you

 Log into your host, and run the command below:

-```bash
+```
 docker run -d --restart=unless-stopped \
  -p 80:80 -p 443:443 \
  --privileged \
@@ -24,17 +24,7 @@ aliases:

 Security is at the heart of all Rancher features. From integrating with all the popular authentication tools and services, to an enterprise grade [RBAC capability](manage-role-based-access-control-rbac.md), Rancher makes your Kubernetes clusters even more secure.

-On this page, we provide security related documentation along with resources to help you secure your Rancher installation and your downstream Kubernetes clusters:
-
- [NeuVector Integration with Rancher](#neuvector-integration-with-rancher)
- [Running a CIS security scan on a Kubernetes cluster](#running-a-cis-security-scan-on-a-kubernetes-cluster)
- [SELinux RPM](#selinux-rpm)
- [Guide to hardening Rancher installations](#rancher-hardening-guide)
- [The CIS Benchmark and self-assessment](#the-cis-benchmark-and-self-assessment)
- [Third-party penetration test reports](#third-party-penetration-test-reports)
- [Rancher Security Advisories and CVEs](#rancher-security-advisories-and-cves)
- [Kubernetes Security Best Practices](#kubernetes-security-best-practices)
-
+On this page, we provide security related documentation along with resources to help you secure your Rancher installation and your downstream Kubernetes clusters.
 ### NeuVector Integration with Rancher

 _New in v2.6.5_
@@ -12,14 +12,8 @@ aliases:

 Rancher provides specific security hardening guides for each supported Rancher's Kubernetes distributions.

- [Rancher Kubernetes Distributions](#rancher-kubernetes-distributions)
- [Hardening Guides and Benchmark Versions](#hardening-guides-and-benchmark-versions)
-  - [RKE Guides](#rke-guides)
-  - [RKE2 Guides](#rke2-guides)
-  - [K3s Guides](#k3s)
- [Rancher with SELinux](#rancher-with-selinux)

-# Rancher Kubernetes Distributions
+## Rancher Kubernetes Distributions

 Rancher uses the following Kubernetes distributions:

@@ -29,7 +23,7 @@ Rancher uses the following Kubernetes distributions:

 To harden a Kubernetes cluster outside of Rancher's distributions, refer to your Kubernetes provider docs.

-# Hardening Guides and Benchmark Versions
+## Hardening Guides and Benchmark Versions

 These guides have been tested along with the Rancher v2.6 release. Each self-assessment guide is accompanied with a hardening guide and tested on a specific Kubernetes version and CIS benchmark version. If a CIS benchmark has not been validated for your Kubernetes version, you can choose to use the existing guides until a newer version is added.

@@ -58,7 +52,7 @@ These guides have been tested along with the Rancher v2.6 release. Each self-ass
 | ------------------ | --------------------- | --------------------- | ---------------- |
 | Kubernetes v1.21 and v1.22 | CIS v1.6 | [Link](https://rancher.com/docs/k3s/latest/en/security/self_assessment/) | [Link](https://rancher.com/docs/k3s/latest/en/security/hardening_guide/) |

-# Rancher with SELinux
+## Rancher with SELinux

 [Security-Enhanced Linux (SELinux)](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) is a security enhancement to Linux. After being historically used by government agencies, SELinux is now industry standard and is enabled by default on RHEL and CentOS.

@@ -19,13 +19,6 @@ See [Configuring Custom Clusters for Windows](use-windows-clusters.md) before yo

 :::

-<!-- TOC -->
-
- [1. Provision a Linux Host](#1-provision-a-linux-host)
- [2. Create the Custom Cluster](#2-create-the-custom-cluster)
- [3. Amazon Only: Tag Resources](#3-amazon-only-tag-resources)
-
-<!-- /TOC -->

 ### 1. Provision a Linux Host

@@ -3,23 +3,6 @@ title: Launching Kubernetes on New Nodes in an Infrastructure Provider
 weight: 2205
 ---

-This section covers the following topics:
-
- [RKE Clusters](#rke-clusters)
-  - [Node templates](#node-templates)
-    - [Node labels](#node-labels)
-    - [Node taints](#node-taints)
-    - [Administrator control of node templates](#administrator-control-of-node-templates)
-  - [Node pools](#node-pools)
-    - [Node pool taints](#node-pool-taints)
-    - [About node auto-replace](#about-node-auto-replace)
-    - [Enabling node auto-replace](#enabling-node-auto-replace)
-    - [Disabling node auto-replace](#disabling-node-auto-replace)
-  - [Cloud credentials](#cloud-credentials)
-  - [Node drivers](#node-drivers)
- [RKE2 Clusters](#rke2-clusters)
-  - [Node roles in RKE2](#node-roles-in-rke2)
-
 When you create an RKE or RKE2 cluster using a node template in Rancher, each resulting node pool is shown in a new **Machine Pools** tab. You can see the machine pools by doing the following:

 1. Click  **☰ > Cluster Management**.
@@ -85,6 +68,7 @@ The recommended setup is to have:
 By default, Rancher tries to run the Docker Install script when provisioning RKE1 downstream cluster nodes, such as in vSphere. However, the Rancher Docker installation script would fail in air-gapped environments. To work around this issue, you may choose to skip installing Docker when creating a Node Template where Docker is pre-installed onto a VM image. You can accomplish this by selecting **None** in the dropdown list for `Docker Install URL` under **Engine Options** in the Rancher UI.

 <figcaption>**Engine Options Dropdown:**</figcaption>
+
 ![Engine Options Dropdown](/img/node-template-engine-options-rke1.png)

 #### Node Pool Taints
@@ -18,17 +18,8 @@ For the full list of requirements, see [this section.](#requirements-for-windows

 For a summary of Kubernetes features supported in Windows, see the Kubernetes documentation on [supported functionality and limitations for using Kubernetes with Windows](https://kubernetes.io/docs/setup/production-environment/windows/intro-windows-in-kubernetes/#supported-functionality-and-limitations) or the [guide for scheduling Windows containers in Kubernetes](https://kubernetes.io/docs/setup/production-environment/windows/user-guide-windows-containers/).

-This guide covers the following topics:

-<!-- TOC -->
-
- [Changes in Rancher v2.6](#changes-in-rancher-v2-6)
- [Requirements](#requirements-for-windows-clusters)
- [Tutorial: How to Create a Cluster with Windows Support](#tutorial-how-to-create-a-cluster-with-windows-support)
- [Configuration for Storage Classes in Azure](#configuration-for-storage-classes-in-azure)
-<!-- /TOC -->
-
-# Changes in Rancher v2.6
+## Changes in Rancher v2.6

 Rancher v2.6 introduces provisioning for [RKE2](https://docs.rke2.io/) clusters directly from the Rancher UI. RKE2, also known as RKE Government, is a fully conformant Kubernetes distribution that focuses on security and compliance within the U.S. Federal Government sector.

@@ -55,7 +46,7 @@ Rancher will allow Windows workload pods to deploy on both Windows and Linux wor

 - HostProcess containers in Windows RKE2 are supported in Kubernetes v1.24.1 and up. See [the upstream documentation](https://kubernetes.io/docs/tasks/configure-pod-container/create-hostprocess-pod/) for more information.

-# Requirements for Windows Clusters
+## Requirements for Windows Clusters

 The general node requirements for networking, operating systems, and Docker are the same as the node requirements for a [Rancher installation](installation-requirements.md).

@@ -156,7 +147,7 @@ If you are using the GCE (Google Compute Engine) cloud provider, you must do the
 - Enable the GCE cloud provider in the `cluster.yml` by following [these steps.](../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/launch-kubernetes-with-rancher/set-up-cloud-providers/other-cloud-providers/google-compute-engine.md)
 - When provisioning the cluster in Rancher, choose **Custom cloud provider** as the cloud provider in the Rancher UI.

-# Tutorial: How to Create a Cluster with Windows Support
+## Tutorial: How to Create a Cluster with Windows Support

 This tutorial describes how to create a Rancher-provisioned cluster with the three nodes in the [recommended architecture.](#guide-architecture)

@@ -164,15 +155,8 @@ When you provision a cluster with Rancher on existing nodes, you will add nodes

 To set up a cluster with support for Windows nodes and containers, you will need to complete the tasks below.

-<!-- TOC -->

-1. [Provision Hosts](#1-provision-hosts)
-1. [Create the Cluster on Existing Nodes](#2-create-the-cluster-on-existing-nodes)
-1. [Add Nodes to the Cluster](#3-add-nodes-to-the-cluster)
-1. [Optional: Configuration for Azure Files](#4-optional-configuration-for-azure-files)
-<!-- /TOC -->
-
-# 1. Provision Hosts
+### 1. Provision Hosts

 To begin provisioning a cluster on existing nodes with Windows support, prepare your hosts.

@@ -196,7 +180,7 @@ You will provision three nodes:

 If your nodes are hosted by a **Cloud Provider** and you want automation support such as loadbalancers or persistent storage devices, your nodes have additional configuration requirements. For details, see [Selecting Cloud Providers.](set-up-cloud-providers.md)

-# 2. Create the Cluster on Existing Nodes
+### 2. Create the Cluster on Existing Nodes

 The instructions for creating a Windows cluster on existing nodes are very similar to the general [instructions for creating a custom cluster](use-existing-nodes.md) with some Windows-specific requirements.

@@ -216,11 +200,11 @@ For <b>Host Gateway (L2bridge)</b> networking, it's best to use the same Layer 2

 :::

-# 3. Add Nodes to the Cluster
+### 3. Add Nodes to the Cluster

 This section describes how to register your Linux and Worker nodes to your cluster. You will run a command on each node, which will install the Rancher agent and allow Rancher to manage each node.

-### Add Linux Master Node
+#### Add Linux Master Node

 In this section, we fill out a form on the Rancher UI to get a custom command to install the Rancher agent on the Linux master node. Then we will copy the command and run it on our Linux master node to register the node in the cluster.

@@ -247,7 +231,7 @@ You can access your cluster after its state is updated to **Active**.

 It may take a few minutes for the node to be registered in your cluster.

-### Add Linux Worker Node
+#### Add Linux Worker Node

 In this section, we run a command to register the Linux worker node to the cluster.

@@ -275,7 +259,7 @@ For each Linux worker node added into the cluster, the following taints will be

 :::

-### Add a Windows Worker Node
+#### Add a Windows Worker Node

 In this section, we run a command to register the Windows worker node to the cluster.

@@ -298,6 +282,6 @@ After creating your cluster, you can access it through the Rancher UI. As a best
 - **Access your cluster with the kubectl CLI:** Follow [these steps](../how-to-guides/advanced-user-guides/manage-clusters/access-clusters/use-kubectl-and-kubeconfig.md#accessing-clusters-with-kubectl-on-your-workstation) to access clusters with kubectl on your workstation. In this case, you will be authenticated through the Rancher server’s authentication proxy, then Rancher will connect you to the downstream cluster. This method lets you manage the cluster without the Rancher UI.
 - **Access your cluster with the kubectl CLI, using the authorized cluster endpoint:** Follow [these steps](../how-to-guides/advanced-user-guides/manage-clusters/access-clusters/use-kubectl-and-kubeconfig.md#authenticating-directly-with-a-downstream-cluster) to access your cluster with kubectl directly, without authenticating through the Rancher server. We recommend setting up this alternative method to access your cluster so that in case you can’t connect to Rancher, you can still access the cluster.

-# Configuration for Storage Classes in Azure
+## Configuration for Storage Classes in Azure

 If you are using Azure VMs for your nodes, you can use [Azure files](https://docs.microsoft.com/en-us/azure/aks/azure-files-dynamic-pv) as a StorageClass for the cluster. For details, refer to [this section.](../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/launch-kubernetes-with-rancher/use-windows-clusters/azure-storageclass-configuration.md)
@@ -13,12 +13,7 @@ Rancher can provision nodes in vSphere and install Kubernetes on them. When crea

 A vSphere cluster may consist of multiple groups of VMs with distinct properties, such as the amount of memory or the number of vCPUs. This grouping allows for fine-grained control over the sizing of nodes for each Kubernetes role.

- [vSphere Enhancements in Rancher v2.3](#vsphere-enhancements-in-rancher-v2-3)
- [Creating a vSphere Cluster](#creating-a-vsphere-cluster)
- [Provisioning Storage](#provisioning-storage)
- [Enabling the vSphere Cloud Provider](#enabling-the-vsphere-cloud-provider)
-
-# vSphere Enhancements in Rancher v2.3
+## vSphere Enhancements in Rancher v2.3

 The vSphere node templates have been updated, allowing you to bring cloud operations on-premises with the following enhancements:

@@ -48,15 +43,15 @@ In this YouTube video, we demonstrate how to set up a node template with the new

 <YouTube id="dPIwg6x1AlU"/>

-# Creating a vSphere Cluster
+## Creating a vSphere Cluster

 In [this section,](../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/launch-kubernetes-with-rancher/use-new-nodes-in-an-infra-provider/vsphere/provision-kubernetes-clusters-in-vsphere.md) you'll learn how to use Rancher to install an [RKE](https://rancher.com/docs/rke/latest/en/) Kubernetes cluster in vSphere.

-# Provisioning Storage
+## Provisioning Storage

 For an example of how to provision storage in vSphere using Rancher, refer to [this section.](../how-to-guides/advanced-user-guides/manage-clusters/create-kubernetes-persistent-storage/provisioning-storage-examples/vsphere-storage.md) In order to dynamically provision storage in vSphere, the vSphere provider must be [enabled.](vsphere-cloud-provider.md)

-# Enabling the vSphere Cloud Provider
+## Enabling the vSphere Cloud Provider

 When a cloud provider is set up in Rancher, the Rancher server can automatically provision new infrastructure for the cluster, including new nodes or persistent storage devices.