diff --git a/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml b/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml
index ae248cc9b7c..361adde18a6 100644
--- a/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml
+++ b/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml
@@ -17,6 +17,7 @@ plugins:
- cattle-system
- cattle-epinio-system
- cattle-fleet-system
+ - cattle-fleet-local-system
- longhorn-system
- cattle-neuvector-system
- cattle-monitoring-system
@@ -32,6 +33,7 @@ plugins:
- cattle-sriov-system
- cattle-ui-plugin-system
- tigera-operator
+ - cattle-provisioning-capi-system
kind: PodSecurityConfiguration
name: PodSecurity
- path: ""
\ No newline at end of file
+ path: ""
diff --git a/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rollbacks.md b/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rollbacks.md
index bb7fed4fe0a..7f3290938b4 100644
--- a/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rollbacks.md
+++ b/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rollbacks.md
@@ -6,29 +6,54 @@ title: Rollbacks
-## Additional Steps for Rollbacks with Rancher v2.6.4+
+This page outlines how to rollback Rancher to a previous version after an upgrade.
-Rancher v2.6.4 upgrades the cluster-api module from v0.4.4 to v1.0.2. Version v1.0.2 of the cluster-api, in turn, upgrades the Cluster API's Custom Resource Definitions (CRDs) from `cluster.x-k8s.io/v1alpha4` to `cluster.x-k8s.io/v1beta1`. The CRDs upgrade to v1beta1 causes rollbacks to fail when you attempt to move from Rancher v2.6.4 to any previous version of Rancher v2.6.x. This is because CRDs that use the older apiVersion (v1alpha4) are incompatible with v1beta1.
+Follow the instructions from this page when:
+- The running Rancher instance has been upgraded to a newer version after the backup was made.
+- The upstream (local) cluster is the same as where the backup was made.
-To avoid rollback failure, the following Rancher scripts should be run **before** you attempt a restore operation or rollback:
+:::tip
-* `verify.sh`: Checks for any Rancher-related resources in the cluster.
-* `cleanup.sh`: Cleans up the cluster.
-
-See the [rancher/rancher-cleanup repo](https://github.com/rancher/rancher-cleanup) for more details and source code.
-
-:::caution
-
- There will be downtime while `cleanup.sh` runs, since the script deletes resources created by Rancher.
+* Follow these steps to [migrate Rancher](../../../how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/migrate-rancher-to-new-cluster.md).
+* If you need to restore Rancher to its previous state at the same Rancher version, see the [restore documentation]( ../../../how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/restore-rancher.md).
:::
-### Rolling back from v2.6.4+ to lower versions of v2.6.x
+## Alternative Steps for Special Scenarios
-1. Follow these [instructions](https://github.com/rancher/rancher-cleanup/blob/main/README.md) to run the scripts.
-1. Follow these [instructions](../../../how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/migrate-rancher-to-new-cluster.md) to install the rancher-backup Helm chart on the existing cluster and restore the previous state.
- 1. Omit Step 3.
- 1. When you reach Step 4, install the Rancher v2.6.x version on the local cluster you intend to roll back to.
+Alternative steps need to be performed for rollbacks in the following scenarios:
+- Rolling back from v2.6.4 and later to an earlier version of v2.6.x.
+- Rolling back from v2.7.7 and later to an earlier version of v2.7.x.
+
+In Rancher v2.6.4, the cluster-api module is upgraded from v0.4.4 to v1.0.2. The cluster-api v1.0.2, in turn, upgrades the apiVersions of its Custom Resource Definitions (CRDs) from `cluster.x-k8s.io/v1alpha4` to `cluster.x-k8s.io/v1beta1`. Custom Resources (CRs) that use the older apiVersion (v1alpha4) are incompatible with v1beta1, which causes rollbacks to fail when you attempt to move from Rancher v2.6.4 to any previous version of Rancher v2.6.x.
+
+In Rancher v2.7.7, the app `rancher-provisioning-capi` is installed on the upstream (local) cluster automatically as a replacement for the embedded cluster-api controllers. Conflicts and unexpected errors will occur if the upstream cluster contains both the app, and Rancher v2.7.6 and earlier. Therefore, alternative steps are needed if you attempt to move from Rancher v2.7.7 to any previous version of Rancher v2.7.x.
+
+### Step 1: Clean Up the Upstream (Local) Cluster
+
+To avoid rollback failure, follow these [instructions](https://github.com/rancher/rancher-cleanup/blob/main/README.md) to run the scripts **before** you attempt a restore operation or rollback:
+
+* `cleanup.sh`: Cleans up the cluster.
+* `verify.sh`: Checks for any Rancher-related resources in the cluster.
+
+:::caution
+
+There will be downtime while `cleanup.sh` runs, since the script deletes resources created by Rancher.
+
+:::
+
+**Result:** all Rancher-related resources should be cleaned up on the upstream (local) cluster.
+
+See the [rancher/rancher-cleanup repo](https://github.com/rancher/rancher-cleanup) for more details and source code.
+
+### Step 2: Restore the Backup and Bring Up Rancher
+
+At this point, there should be no Rancher-related resources on the upstream cluster. Therefore, the next step will be the same as if you were migrating Rancher to a new cluster that contains no Rancher resources.
+
+Follow these [instructions](./migrate-rancher-to-new-cluster.md) to install the Rancher-Backup Helm chart and restore Rancher to its previous state.
+Please keep in mind that:
+1. Step 3 can be skipped, because the Cert-Manager app should still exist on the upstream (local) cluster if it was installed before.
+2. At Step 4, install the Rancher version you intend to roll back to.
## Rolling Back to Rancher v2.5.0+
@@ -46,7 +71,7 @@ A restore is performed by creating a Restore custom resource.
:::
-### Create the Restore Custom Resource
+### Step 1: Create the Restore Custom Resource
1. Click **☰ > Cluster Management**.
1. Go to the local cluster and click **Explore**.
@@ -95,7 +120,7 @@ kubectl get pods -n cattle-resources-system
kubectl logs -n cattle-resources-system -f
```
-### Roll back to a previous Rancher version
+### Step 2: Roll Back to a Previous Rancher Version
Rancher can be rolled back using the Helm CLI. To roll back to the previous version:
diff --git a/docs/getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/publish-images.md b/docs/getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/publish-images.md
index bf242ada285..1bd1d3314f0 100644
--- a/docs/getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/publish-images.md
+++ b/docs/getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/publish-images.md
@@ -71,7 +71,7 @@ In a Kubernetes Install, if you elect to use the Rancher default self-signed TLS
```plain
helm repo add jetstack https://charts.jetstack.io
helm repo update
- helm fetch jetstack/cert-manager --version v1.11.0
+ helm fetch jetstack/cert-manager
helm template ./cert-manager-.tgz | awk '$1 ~ /image:/ {print $2}' | sed s/\"//g >> ./rancher-images.txt
```
@@ -250,7 +250,7 @@ The workstation must have Docker 18.02+ in order to support manifests, which are
```plain
helm repo add jetstack https://charts.jetstack.io
helm repo update
- helm fetch jetstack/cert-manager --version v1.11.0
+ helm fetch jetstack/cert-manager
helm template ./cert-manager-.tgz | awk '$1 ~ /image:/ {print $2}' | sed s/\"//g >> ./rancher-images.txt
```
diff --git a/docs/getting-started/installation-and-upgrade/other-installation-methods/rancher-behind-an-http-proxy/install-rancher.md b/docs/getting-started/installation-and-upgrade/other-installation-methods/rancher-behind-an-http-proxy/install-rancher.md
index 0267e72d0be..122b0686a87 100644
--- a/docs/getting-started/installation-and-upgrade/other-installation-methods/rancher-behind-an-http-proxy/install-rancher.md
+++ b/docs/getting-started/installation-and-upgrade/other-installation-methods/rancher-behind-an-http-proxy/install-rancher.md
@@ -35,7 +35,7 @@ kubectl create namespace cert-manager
Install the CustomResourceDefinitions of cert-manager:
```
-kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.crds.yaml
+kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download//cert-manager.crds.yaml
```
And install it with Helm. Note that cert-manager also needs your proxy configured in case it needs to communicate with Let's Encrypt or other external certificate issuers:
@@ -48,7 +48,7 @@ To see options on how to customize the cert-manager install (including for cases
```
helm upgrade --install cert-manager jetstack/cert-manager \
- --namespace cert-manager --version v1.11.0 \
+ --namespace cert-manager \
--set http_proxy=http://${proxy_host} \
--set https_proxy=http://${proxy_host} \
--set no_proxy=127.0.0.0/8\\,10.0.0.0/8\\,cattle-system.svc\\,172.16.0.0/12\\,192.168.0.0/16\\,.svc\\,.cluster.local
diff --git a/docs/getting-started/installation-and-upgrade/resources/upgrade-cert-manager.md b/docs/getting-started/installation-and-upgrade/resources/upgrade-cert-manager.md
index 9a9ec2b8f83..c92e2d89ade 100644
--- a/docs/getting-started/installation-and-upgrade/resources/upgrade-cert-manager.md
+++ b/docs/getting-started/installation-and-upgrade/resources/upgrade-cert-manager.md
@@ -6,6 +6,8 @@ title: Upgrading Cert-Manager
+Rancher is compatible with the API version cert-manager.io/v1 and was last tested with cert-manager version v1.13.1.
+
Rancher uses cert-manager to automatically generate and renew TLS certificates for HA deployments of Rancher. As of Fall 2019, three important changes to cert-manager are set to occur that you need to take action on if you have an HA deployment of Rancher:
1. [Let's Encrypt will be blocking cert-manager instances older than 0.8.0 starting November 1st 2019.](https://community.letsencrypt.org/t/blocking-old-cert-manager-versions/98753)
@@ -96,8 +98,7 @@ In order to upgrade cert-manager, follow these instructions:
```plain
helm install \
cert-manager jetstack/cert-manager \
- --namespace cert-manager \
- --version v1.11.0
+ --namespace cert-manager
```
1. [Restore back up resources](https://cert-manager.io/docs/tutorials/backup/#restoring-resources)
@@ -129,7 +130,7 @@ Before you can perform the upgrade, you must prepare your air gapped environment
1. Fetch the latest cert-manager chart available from the [Helm chart repository](https://artifacthub.io/packages/helm/cert-manager/cert-manager).
```plain
- helm fetch jetstack/cert-manager --version v1.11.0
+ helm fetch jetstack/cert-manager
```
1. Render the cert manager template with the options you would like to use to install the chart. Remember to set the `image.repository` option to pull the image from your private registry. This will create a `cert-manager` directory with the Kubernetes manifest files.
diff --git a/docs/getting-started/quick-start-guides/deploy-rancher-manager/helm-cli.md b/docs/getting-started/quick-start-guides/deploy-rancher-manager/helm-cli.md
index b6489884a74..d262b7e2fff 100644
--- a/docs/getting-started/quick-start-guides/deploy-rancher-manager/helm-cli.md
+++ b/docs/getting-started/quick-start-guides/deploy-rancher-manager/helm-cli.md
@@ -108,7 +108,7 @@ helm repo add rancher-latest https://releases.rancher.com/server-charts/latest
kubectl create namespace cattle-system
-kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.crds.yaml
+kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download//cert-manager.crds.yaml
helm repo add jetstack https://charts.jetstack.io
@@ -116,14 +116,12 @@ helm repo update
helm install cert-manager jetstack/cert-manager \
--namespace cert-manager \
- --create-namespace \
- --version v1.11.0
+ --create-namespace
# Windows Powershell
helm install cert-manager jetstack/cert-manager `
--namespace cert-manager `
- --create-namespace `
- --version v1.11.0
+ --create-namespace
```
The final command to install Rancher is below. The command requires a domain name that forwards traffic to the Linux machine. For the sake of simplicity in this tutorial, you can use a fake domain name to create your proof-of-concept. An example of a fake domain name would be `.sslip.io`.
diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md
index dac4d66ee52..b85fd487935 100644
--- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md
+++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md
@@ -85,12 +85,13 @@ Any user that is bound to the above permission will be able to change the restri
## Exempting Required Rancher Namespaces
-When you run Rancher on a Kubernetes cluster that enforces a restrictive security policy by default, you'll need to [exempt the following namespaces](#exempting-namespaces), otherwise the policy might prevent Rancher system pods from running properly.
+When you run Rancher on a Kubernetes cluster that enforces a restrictive security policy by default, you'll need to [exempt the following namespaces](#exempting-namespaces), otherwise the policy might prevent Rancher system pods from running properly.
- `calico-apiserver`
- `calico-system`
- `cattle-alerting`
- `cattle-csp-adapter-system`
+- `cattle-elemental-system`
- `cattle-epinio-system`
- `cattle-externalip-system`
- `cattle-fleet-local-system`
@@ -106,6 +107,8 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit
- `cattle-monitoring-system`
- `cattle-neuvector-system`
- `cattle-prometheus`
+- `cattle-provisioning-capi-system`
+- `cattle-resources-system`
- `cattle-sriov-system`
- `cattle-system`
- `cattle-ui-plugin-system`
diff --git a/docs/how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/restore-rancher.md b/docs/how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/restore-rancher.md
index d78bde42e1b..f8a9ac718b8 100644
--- a/docs/how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/restore-rancher.md
+++ b/docs/how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/restore-rancher.md
@@ -8,39 +8,24 @@ title: Restoring Rancher
This page outlines how to perform a restore with Rancher.
-:::note Important:
+Follow the instructions from this page when:
+- The running Rancher instance is at the same version as when the backup was made.
+- The upstream (local) cluster is the same as where the backup was made.
-* Follow the instructions from this page for restoring rancher on the same cluster where it was backed up from. In order to migrate rancher to a new cluster, follow the steps to [migrate rancher.](migrate-rancher-to-new-cluster.md)
-* While restoring rancher on the same setup, the operator will scale down the rancher deployment when restore starts, and it will scale back up the deployment once restore completes. So Rancher will be unavailable during the restore.
-* If you need to restore Rancher to a previous version after an upgrade, see the [rollback documentation.](../../../getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rollbacks.md)
+:::note Important
+
+While restoring Rancher on the same setup, the operator will scale down the Rancher deployment when restore starts, and it will scale back up the deployment once restore completes. Rancher will be unavailable during the restore.
:::
-## Additional Steps for Rollbacks with Rancher v2.6.4+
+:::tip
-Rancher v2.6.4 upgrades the cluster-api module from v0.4.4 to v1.0.2. Version v1.0.2 of the cluster-api, in turn, upgrades the Cluster API's Custom Resource Definitions (CRDs) from `cluster.x-k8s.io/v1alpha4` to `cluster.x-k8s.io/v1beta1`. The CRDs upgrade to v1beta1 causes rollbacks to fail when you attempt to move from Rancher v2.6.4 to any previous version of Rancher v2.6.x. This is because CRDs that use the older apiVersion (v1alpha4) are incompatible with v1beta1.
-
-To avoid rollback failure, the following Rancher scripts should be run **before** you attempt a restore operation or rollback:
-
-* `verify.sh`: Checks for any Rancher-related resources in the cluster.
-* `cleanup.sh`: Cleans up the cluster.
-
-See the [rancher/rancher-cleanup repo](https://github.com/rancher/rancher-cleanup) for more details and source code.
-
-:::caution
-
- There will be downtime while `cleanup.sh` runs, since the script deletes resources created by Rancher.
+* Follow those steps to [migrate Rancher](migrate-rancher-to-new-cluster.md).
+* If you need to restore Rancher to a previous version after an upgrade, see the [rollback documentation](../../../getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rollbacks.md).
:::
-### Rolling back from v2.6.4+ to lower versions of v2.6.x
-
-1. Follow these [instructions](https://github.com/rancher/rancher-cleanup/blob/main/README.md) to run the scripts.
-1. Follow these [instructions](./migrate-rancher-to-new-cluster.md) to install the rancher-backup Helm chart on the existing cluster and restore the previous state.
- 1. Omit Step 3.
- 1. When you reach Step 4, install the Rancher v2.6.x version on the local cluster you intend to roll back to.
-
-### Create the Restore Custom Resource
+## Create the Restore Custom Resource
A restore is performed by creating a Restore custom resource.
@@ -79,7 +64,7 @@ A restore is performed by creating a Restore custom resource.
2. Cluster-scoped resources
3. Namespaced resources
-### Logs
+## Logs
To check how the restore is progressing, you can check the logs of the operator. Run this command to follow the logs:
@@ -87,11 +72,11 @@ To check how the restore is progressing, you can check the logs of the operator.
kubectl logs -n cattle-resources-system -l app.kubernetes.io/name=rancher-backup -f
```
-### Cleanup
+## Cleanup
If you created the restore resource with kubectl, remove the resource to prevent a naming conflict with future restores.
-### Known Issues
+## Known Issues
In some cases, after restoring the backup, Rancher logs will show errors similar to the following:
```
2021/10/05 21:30:45 [ERROR] error syncing 'c-89d82/m-4067aa68dd78': handler rke-worker-upgrader: clusters.management.cattle.io "c-89d82" not found, requeuing
diff --git a/docs/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md b/docs/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md
index 4eda613d25f..cc8c3754f48 100644
--- a/docs/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md
+++ b/docs/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md
@@ -149,7 +149,7 @@ To see options on how to customize the cert-manager install (including for cases
```
# If you have installed the CRDs manually instead of with the `--set installCRDs=true` option added to your Helm install command, you should upgrade your CRD resources before upgrading the Helm chart:
-kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.crds.yaml
+kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download//cert-manager.crds.yaml
# Add the Jetstack Helm repository
helm repo add jetstack https://charts.jetstack.io
@@ -160,8 +160,7 @@ helm repo update
# Install the cert-manager Helm chart
helm install cert-manager jetstack/cert-manager \
--namespace cert-manager \
- --create-namespace \
- --version v1.11.0
+ --create-namespace
```
Once you’ve installed cert-manager, you can verify it is deployed correctly by checking the cert-manager namespace for running pods:
diff --git a/docs/pages-for-subheaders/installation-requirements.md b/docs/pages-for-subheaders/installation-requirements.md
index e90c3bbd087..758b6fea806 100644
--- a/docs/pages-for-subheaders/installation-requirements.md
+++ b/docs/pages-for-subheaders/installation-requirements.md
@@ -23,6 +23,10 @@ See our page on [best practices](../reference-guides/best-practices/rancher-serv
Rancher needs to be installed on a supported Kubernetes version. Consult the [Rancher support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions) to ensure that your intended version of Kubernetes is supported.
+### Install Rancher on a Hardened Kubernetes cluster
+
+If you install Rancher on a hardened Kubernetes cluster, check the [Exempting Required Rancher Namespaces](../../../docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md#exempting-required-rancher-namespaces) section for detailed requirements.
+
## Operating Systems and Container Runtime Requirements
All supported operating systems are 64-bit x86. Rancher should work with any modern Linux distribution.
diff --git a/docs/pages-for-subheaders/rancher-security.md b/docs/pages-for-subheaders/rancher-security.md
index 8207aac036f..5a30b09c77b 100644
--- a/docs/pages-for-subheaders/rancher-security.md
+++ b/docs/pages-for-subheaders/rancher-security.md
@@ -87,7 +87,3 @@ Rancher is committed to informing the community of security issues in our produc
### Kubernetes Security Best Practices
For recommendations on securing your Kubernetes cluster, refer to the [Kubernetes Security Best Practices](../reference-guides/rancher-security/kubernetes-security-best-practices.md) guide.
-
-### Rancher Webhook Hardening
-
-The Rancher webhook deploys on both the upstream Rancher cluster and all provisioned clusters. For recommendations on hardening the Rancher webhook, see the [Hardening the Rancher Webhook](../reference-guides/rancher-security/rancher-webhook-hardening.md) guide.
diff --git a/docs/pages-for-subheaders/rke1-hardening-guide.md b/docs/pages-for-subheaders/rke1-hardening-guide.md
index 4d6f97e18c7..effc11a78bf 100644
--- a/docs/pages-for-subheaders/rke1-hardening-guide.md
+++ b/docs/pages-for-subheaders/rke1-hardening-guide.md
@@ -209,41 +209,44 @@ services:
exemptions:
usernames: []
runtimeClasses: []
- namespaces: [ calico-apiserver,
- calico-system,
- cattle-alerting,
- cattle-csp-adapter-system,
- cattle-epinio-system,
- cattle-externalip-system,
- cattle-fleet-local-system,
- cattle-fleet-system,
- cattle-gatekeeper-system,
- cattle-global-data,
- cattle-global-nt,
- cattle-impersonation-system,
- cattle-istio,
- cattle-istio-system,
- cattle-logging,
- cattle-logging-system,
- cattle-monitoring-system,
- cattle-neuvector-system,
- cattle-prometheus,
- cattle-sriov-system,
- cattle-system,
- cattle-ui-plugin-system,
- cattle-windows-gmsa-system,
- cert-manager,
- cis-operator-system,
- fleet-default,
- ingress-nginx,
- istio-system,
- kube-node-lease,
- kube-public,
- kube-system,
- longhorn-system,
- rancher-alerting-drivers,
- security-scan,
- tigera-operator ]
+ namespaces: [calico-apiserver,
+ calico-system,
+ cattle-alerting,
+ cattle-csp-adapter-system,
+ cattle-elemental-system,
+ cattle-epinio-system,
+ cattle-externalip-system,
+ cattle-fleet-local-system,
+ cattle-fleet-system,
+ cattle-gatekeeper-system,
+ cattle-global-data,
+ cattle-global-nt,
+ cattle-impersonation-system,
+ cattle-istio,
+ cattle-istio-system,
+ cattle-logging,
+ cattle-logging-system,
+ cattle-monitoring-system,
+ cattle-neuvector-system,
+ cattle-prometheus,
+ cattle-provisioning-capi-system,
+ cattle-resources-system,
+ cattle-sriov-system,
+ cattle-system,
+ cattle-ui-plugin-system,
+ cattle-windows-gmsa-system,
+ cert-manager,
+ cis-operator-system,
+ fleet-default,
+ ingress-nginx,
+ istio-system,
+ kube-node-lease,
+ kube-public,
+ kube-system,
+ longhorn-system,
+ rancher-alerting-drivers,
+ security-scan,
+ tigera-operator]
kube-controller:
extra_args:
feature-gates: RotateKubeletServerCertificate=true
diff --git a/docs/reference-guides/rancher-security/psa-restricted-exemptions.md b/docs/reference-guides/rancher-security/psa-restricted-exemptions.md
index 0f35551cf31..f9e68addefb 100644
--- a/docs/reference-guides/rancher-security/psa-restricted-exemptions.md
+++ b/docs/reference-guides/rancher-security/psa-restricted-exemptions.md
@@ -46,6 +46,7 @@ plugins:
cattle-monitoring-system,
cattle-neuvector-system,
cattle-prometheus,
+ cattle-provisioning-capi-system,
cattle-resources-system,
cattle-sriov-system,
cattle-system,
diff --git a/docusaurus.config.js b/docusaurus.config.js
index 44160c32272..a8176995835 100644
--- a/docusaurus.config.js
+++ b/docusaurus.config.js
@@ -1,5 +1,7 @@
/** @type {import('@docusaurus/types').DocusaurusConfig} */
+const tailwindPlugin = require('./plugins/tailwind-plugin.cjs');
+
module.exports = {
title: 'Rancher',
tagline: '',
@@ -184,6 +186,7 @@ module.exports = {
],
],
plugins: [
+ tailwindPlugin,
[
'@docusaurus/plugin-client-redirects',
{
diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/install-rancher-ha.md b/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/install-rancher-ha.md
index 0aa220051f7..d28b59ed745 100644
--- a/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/install-rancher-ha.md
+++ b/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/install-rancher-ha.md
@@ -102,14 +102,14 @@ helm repo update
从 [Helm Chart 仓库](https://artifacthub.io/packages/helm/cert-manager/cert-manager)中获取最新可用的 cert-manager Chart:
```plain
-helm fetch jetstack/cert-manager --version v1.11.0
+helm fetch jetstack/cert-manager
```
##### 3. 检索 Cert-Manager CRD
为 cert-manager 下载所需的 CRD 文件:
```plain
-curl -L -o cert-manager-crd.yaml https://github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.crds.yaml
+curl -L -o cert-manager-crd.yaml https://github.com/cert-manager/cert-manager/releases/download//cert-manager.crds.yaml
```
### 4. 安装 Rancher
@@ -146,7 +146,7 @@ curl -L -o cert-manager-crd.yaml https://github.com/cert-manager/cert-manager/re
3. 安装 cert-manager。
```plain
- helm install cert-manager ./cert-manager-v1.11.0.tgz \
+ helm install cert-manager ./cert-manager-.tgz \
--namespace cert-manager \
--set image.repository=/quay.io/jetstack/cert-manager-controller \
--set webhook.image.repository=/quay.io/jetstack/cert-manager-webhook \
diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/publish-images.md b/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/publish-images.md
index c64f7132d1d..e3240faf9c4 100644
--- a/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/publish-images.md
+++ b/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/publish-images.md
@@ -67,7 +67,7 @@ title: '2. 收集镜像并发布到私有仓库'
```plain
helm repo add jetstack https://charts.jetstack.io
helm repo update
- helm fetch jetstack/cert-manager --version v1.11.0
+ helm fetch jetstack/cert-manager
helm template ./cert-manager-.tgz | awk '$1 ~ /image:/ {print $2}' | sed s/\"//g >> ./rancher-images.txt
```
@@ -246,7 +246,7 @@ Linux 镜像需要在 Linux 主机上收集和推送,但是你必须先将 Win
```plain
helm repo add jetstack https://charts.jetstack.io
helm repo update
- helm fetch jetstack/cert-manager --version v1.11.0
+ helm fetch jetstack/cert-manager
helm template ./cert-manager-.tgz | awk '$1 ~ /image:/ {print $2}' | sed s/\"//g >> ./rancher-images.txt
```
diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/other-installation-methods/rancher-behind-an-http-proxy/install-rancher.md b/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/other-installation-methods/rancher-behind-an-http-proxy/install-rancher.md
index da7bd9fb728..63da5f840ae 100644
--- a/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/other-installation-methods/rancher-behind-an-http-proxy/install-rancher.md
+++ b/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/other-installation-methods/rancher-behind-an-http-proxy/install-rancher.md
@@ -31,7 +31,7 @@ kubectl create namespace cert-manager
安装 cert-manager 的 CustomResourceDefinitions:
```
-kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.crds.yaml
+kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download//cert-manager.crds.yaml
```
使用 Helm 安装 cert-manager。请注意,cert-manager 还需要你配置代理,以防它需要与 Let's Encrypt 或其他外部证书颁发商进行通信:
@@ -44,7 +44,7 @@ kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/
```
helm upgrade --install cert-manager jetstack/cert-manager \
- --namespace cert-manager --version v1.11.0 \
+ --namespace cert-manager \
--set http_proxy=http://${proxy_host} \
--set https_proxy=http://${proxy_host} \
--set no_proxy=127.0.0.0/8\\,10.0.0.0/8\\,cattle-system.svc\\,172.16.0.0/12\\,192.168.0.0/16\\,.svc\\,.cluster.local
diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/resources/upgrade-cert-manager.md b/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/resources/upgrade-cert-manager.md
index 40267b47065..2d9fc0d656f 100644
--- a/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/resources/upgrade-cert-manager.md
+++ b/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/resources/upgrade-cert-manager.md
@@ -92,8 +92,7 @@ Rancher 使用 cert-manager 为 Rancher 高可用部署自动生成和续期 TLS
```plain
helm install \
cert-manager jetstack/cert-manager \
- --namespace cert-manager \
- --version v1.11.0
+ --namespace cert-manager
```
1. [恢复备份资源](https://cert-manager.io/docs/tutorials/backup/#restoring-resources):
@@ -125,7 +124,7 @@ Rancher 使用 cert-manager 为 Rancher 高可用部署自动生成和续期 TLS
1. 从 [Helm Chart 仓库](https://artifacthub.io/packages/helm/cert-manager/cert-manager)中获取最新可用的 cert-manager Chart:
```plain
- helm fetch jetstack/cert-manager --version v1.11.0
+ helm fetch jetstack/cert-manager
```
1. 使用安装 Chart 的选项来渲染 cert-manager 模板。记住要设置 `image.repository` 选项,以从你的私有镜像仓库拉取镜像。此操作会创建一个包含 Kubernetes manifest 文件的 `cert-manager` 目录。
diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/quick-start-guides/deploy-rancher-manager/helm-cli.md b/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/quick-start-guides/deploy-rancher-manager/helm-cli.md
index b3acb4f9ecc..f3ecac4d210 100644
--- a/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/quick-start-guides/deploy-rancher-manager/helm-cli.md
+++ b/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/quick-start-guides/deploy-rancher-manager/helm-cli.md
@@ -104,7 +104,7 @@ helm repo add rancher-latest https://releases.rancher.com/server-charts/latest
kubectl create namespace cattle-system
-kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.crds.yaml
+kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download//cert-manager.crds.yaml
helm repo add jetstack https://charts.jetstack.io
@@ -112,14 +112,12 @@ helm repo update
helm install cert-manager jetstack/cert-manager \
--namespace cert-manager \
- --create-namespace \
- --version v1.11.0
+ --create-namespace
# Windows Powershell
helm install cert-manager jetstack/cert-manager `
--namespace cert-manager `
- --create-namespace `
- --version v1.11.0
+ --create-namespace
```
安装 Rancher 的最终命令如下。该命令需要一个将流量转发到 Linux 主机的域名。为了简化本教程,你可以使用假域名。`.sslip.io` 是一个假域名的例子。
diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md b/i18n/zh/docusaurus-plugin-content-docs/current/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md
index b189e6d7a35..fa70d2f8e45 100644
--- a/i18n/zh/docusaurus-plugin-content-docs/current/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md
+++ b/i18n/zh/docusaurus-plugin-content-docs/current/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md
@@ -145,7 +145,7 @@ Rancher Management Server 默认需要 SSL/TLS 配置来保证访问的安全性
```
# 如果你手动安装了CRD,而不是在 Helm 安装命令中添加了 `--set installCRDs=true` 选项,你应该在升级 Helm Chart 之前升级 CRD 资源。
-kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.crds.yaml
+kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download//cert-manager.crds.yaml
# 添加 Jetstack Helm 仓库
helm repo add jetstack https://charts.jetstack.io
@@ -156,8 +156,7 @@ helm repo update
# 安装 cert-manager Helm Chart
helm install cert-manager jetstack/cert-manager \
--namespace cert-manager \
- --create-namespace \
- --version v1.11.0
+ --create-namespace
```
安装完 cert-manager 后,你可以通过检查 cert-manager 命名空间中正在运行的 Pod 来验证它是否已正确部署:
diff --git a/package.json b/package.json
index b859b45d035..4645b3daadf 100644
--- a/package.json
+++ b/package.json
@@ -17,17 +17,23 @@
"@docusaurus/core": "^2.3.1",
"@docusaurus/plugin-client-redirects": "^2.3.1",
"@docusaurus/preset-classic": "^2.3.1",
+ "@fluentui/react-icons": "^2.0.204",
"@mdx-js/react": "^1.6.22",
"@swc/core": "^1.3.62",
- "clsx": "^1.1.1",
+ "autoprefixer": "^10.4.15",
+ "clsx": "^1.2.1",
+ "postcss": "^8.4.28",
+ "param-case": "^3.0.4",
"prism-react-renderer": "^1.3.3",
"react": "^17.0.2",
"react-dom": "^17.0.2",
+ "react-icons": "^4.10.1",
"redocusaurus": "^1.6.3",
"remark-cli": "^11.0.0",
"remark-lint-no-dead-urls": "^1.1.0",
"remark-validate-links": "^12.1.0",
- "swc-loader": "^0.2.3"
+ "swc-loader": "^0.2.3",
+ "tailwindcss": "^3.3.3"
},
"devDependencies": {
"@docusaurus/module-type-aliases": "^2.3.1"
diff --git a/plugins/tailwind-plugin.cjs b/plugins/tailwind-plugin.cjs
new file mode 100644
index 00000000000..1e6a04c2067
--- /dev/null
+++ b/plugins/tailwind-plugin.cjs
@@ -0,0 +1,15 @@
+function tailwindPlugin(context, options) {
+ return {
+ name: 'tailwind-plugin',
+ configurePostCss(postcssOptions) {
+ postcssOptions.plugins = [
+ require('postcss-import'),
+ require('tailwindcss'),
+ require('autoprefixer'),
+ ];
+ return postcssOptions;
+ },
+ };
+}
+
+module.exports = tailwindPlugin;
diff --git a/sidebars.js b/sidebars.js
index 71e5f0a46d6..2e8491500b0 100644
--- a/sidebars.js
+++ b/sidebars.js
@@ -57,7 +57,7 @@ const sidebars = {
"getting-started/quick-start-guides/deploy-rancher-manager/prime",
{
type: 'category',
- label: 'Deploy Rancher Workloads',
+ label: 'Deploy Workloads',
link: {
type: 'doc',
id: "pages-for-subheaders/deploy-rancher-workloads",
diff --git a/src/components/CardComponents.tsx b/src/components/CardComponents.tsx
new file mode 100644
index 00000000000..636cbf9b547
--- /dev/null
+++ b/src/components/CardComponents.tsx
@@ -0,0 +1,64 @@
+import React, { ReactNode } from 'react';
+import { paramCase } from 'param-case';
+import Link from '@docusaurus/Link';
+import clsx from 'clsx';
+
+export function CardSection({
+ id,
+ title,
+ icon,
+ children,
+ description,
+ className,
+ hasSubSections = false,
+ HeadingTag = 'h1',
+}: {
+ id?: string;
+ title?: string;
+ icon?: JSX.Element;
+ children: ReactNode;
+ description?: ReactNode;
+ hasSubSections?: boolean;
+ HeadingTag?: any;
+ className?: string;
+}) {
+ return (
+