Merge pull request #1008 from LucasSaintarbor/ls-rancher-payg

Rancher PAYG offerings for AWS and Azure
This commit is contained in:
Lucas Saintarbor
2024-01-18 12:47:31 -08:00
committed by GitHub
18 changed files with 1276 additions and 0 deletions
@@ -0,0 +1,9 @@
---
title: Common Issues for Rancher Prime PAYG on AWS
---
This page covers some common issues that might arise when setting up the Rancher Prime PAYG offering on Amazon's AWS Marketplace.
### Migrating Rancher to a different EKS Cluster
When you migrate Rancher to a different EKS cluster by following the steps in [Rancher Backups and Disaster Recovery](../../../pages-for-subheaders/backup-restore-and-disaster-recovery.md), you must reinstall Rancher Prime on the target EKS cluster after restoring from the backup. Furthermore, the restored Rancher version must not be newer than the version available in the AWS Marketplace.
@@ -0,0 +1,160 @@
---
title: Installing Rancher Prime PAYG on AWS
---
This page covers installing the Rancher Prime PAYG offering on Amazon's AWS Marketplace.
## Preparing your cluster
### OIDC provider
Your EKS cluster requires that you install an OIDC provider. To check that you've installed an OIDC provider, find the OIDC issuer with the following command. Substitute `<cluster-name>` with the name of your EKS cluster and `<region>` with the region where it is running:
```shell
aws eks describe-cluster --name <cluster-name> --region <region> --query cluster.identity.oidc.issuer --output text
```
This should return a URL, such as `https://oidc.eks.region.amazonaws.com/id/1234567890ABCDEF`. The part after `https://` (e.g. `oidc.eks.region.amazonaws.com/id/1234567890ABCDEF`) is the OIDC Provider Identity. The final section of the URL, `1234567890ABCDEF`, is the OIDC ID.
Use the OIDC ID to check if the EKS cluster has a provider:
```shell
aws iam list-open-id-connect-providers | grep <oidc-id>
```
If the last command produces no output, create an OIDC provider:
```shell
eksctl utils associate-iam-oidc-provider --cluster <cluster-name> --region <region> --approve
```
### IAM Role
You must create an IAM role and an attached policy to provide the necessary permissions. The role name is passed as an argument during the Helm deployment.
Create the role with a `<role-name>` of your choosing (for example, `rancher-csp-iam-role`) and attach the required policy:
```shell
eksctl create iamserviceaccount \
--name rancher-csp-billing-adapter \
--namespace cattle-csp-billing-adapter-system \
--cluster <cluster-name> \
--region <region> \
--role-name <role-name> --role-only \
--attach-policy-arn 'arn:aws:iam::aws:policy/AWSMarketplaceMeteringFullAccess' \
--approve
```
## Installing Rancher
1. Log Helm into the AWS Marketplace Elastic Container Registry (ECR) to fetch the application. The AWS Marketplace ECR is always in the `us-east-1` region:
```shell
export HELM_EXPERIMENTAL_OCI=1
aws --region us-east-1 ecr get-login-password \
| helm registry login --username AWS \
--password-stdin 709825985650.dkr.ecr.us-east-1.amazonaws.com
```
1. Install Rancher with Helm. Customize your Helm installation values if needed.
:::note
Rancher Prime uses cert-manager to issue and maintain its certificates. Rancher generates its own CA certificate and signs certificates with that CA.
:::
The Rancher hostname must be resolvable by a public DNS. For more details, see [Prerequisites](prerequisites.md). For example, if the DNS name is `rancher.my.org`, then replace `<host-name>` with `rancher.my.org` when running the `helm install` command.
```shell
helm install -n cattle-rancher-csp-deployer-system rancher-cloud --create-namespace \
oci://709825985650.dkr.ecr.us-east-1.amazonaws.com/suse/$REPOSITORY/rancher-cloud-helm/rancher-cloud \
--version <chart-version> \
--set rancherHostname=<host-name>\
--set rancherServerURL=https://<host-name>\
--set rancherReplicas=<replicas> \
--set rancherBootstrapPassword=<bootstrap-password>\
--set rancherIngressClassName=nginx \
--set global.aws.accountNumber=<aws-account-id>\
--set global.aws.roleName=<role-name>
```
:::note
Monitor the logs for the `rancher-cloud` pod since it is deleted one minute after a successful or failed installation.
```shell
kubectl logs -f rancher-cloud -n cattle-rancher-csp-deployer-system
```
:::
1. After a successful deployment, the following command should produce similar output:
```shell
kubectl get deployments --all-namespaces
```
**Response:**
```shell
NAMESPACE NAME READY UP-TO-DATE AVAILABLE AGE
cattle-csp-billing-adapter-system csp-rancher-usage-operator 1/1 1 1 30m
cattle-csp-billing-adapter-system rancher-csp-billing-adapter 1/1 1 1 30m
cattle-fleet-local-system fleet-agent 1/1 1 1 29m
cattle-fleet-system fleet-controller 1/1 1 1 29m
cattle-fleet-system gitjob 1/1 1 1 29m
cattle-provisioning-capi-system capi-controller-manager 1/1 1 1 28m
cattle-system rancher 1/1 1 1 32m
cattle-system rancher-webhook 1/1 1 1 29m
cert-manager cert-manager 1/1 1 1 32m
cert-manager cert-manager-cainjector 1/1 1 1 32m
cert-manager cert-manager-webhook 1/1 1 1 32m
ingress-nginx ingress-nginx-controller 1/1 1 1 33m
kube-system coredns 2/2 2 2 38m
```
### Check Helm Chart Installation
1. Check that the Helm chart installation completed:
```shell
helm ls -n cattle-rancher-csp-deployer-system
```
2. Verify the status of the installation:
```shell
helm status rancher-cloud -n cattle-rancher-csp-deployer-system
```
Refer to the [Troubleshooting](troubleshooting.md) section if installation fails.
When Helm chart installation successfully completes, Rancher Prime will be installed.
## Log into the Rancher Dashboard
You may now log in to the Rancher dashboard by pointing your browser to the Rancher server URL, `https://<host-name>`. The `<host-name>` is the hostname you entered when you [installed Rancher](#installing-rancher).
:::note
The Rancher hostname must be resolvable by public DNS. For more details, see [Prerequisites](prerequisites.md).
:::
## Uninstalling Rancher Prime PAYG Offering
Run the following command to uninstall Rancher Prime:
```shell
helm uninstall -n cattle-rancher-csp-deployer-system rancher-cloud
```
Uninstalling Rancher Prime may not remove all of the Kubernetes resources created by Rancher. Run the [Rancher resource cleanup script](https://github.com/rancher/rancher-cleanup) to perform a more comprehensive cleanup.
The best practice for uninstalling the Rancher Prime PAYG offering is to migrate any non-Rancher workloads to a different cluster and destroy the Rancher cluster.
:::warning
Ensure that you prepare and migrate any non-Rancher workloads off of the cluster before you destroy the cluster. These resources are nonrecoverable.
:::
@@ -0,0 +1,14 @@
---
title: Prerequisites
---
Before using Rancher Prime on AWS as a pay-as-you-go (PAYG) offering, you need the following resources, information, and tools:
- A Rancher-compatible EKS cluster. For more details, see the [Rancher support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/). Refer to [Creating an EKS cluster](../../../getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md) for bringing up an EKS cluster to [install Rancher Prime PAYG](installing-rancher-prime.md).
- An ingress on the EKS cluster, so that Rancher is accessible from outside the cluster. See the [Rancher documentation](../../../getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md#5-install-an-ingress) for instructions on deploying Ingress-NGINX on an EKS cluster.
- The Load Balancer IP address. See the [Rancher documentation](../../../getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md#6-get-load-balancer-ip) for how to find it, then save the `EXTERNAL-IP`.
- The Rancher hostname. The hostname must be a fully qualified domain name (FQDN), and its corresponding IP address must be resolvable from a public DNS. See the [Rancher documentation](../../../getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md#7-set-up-dns) for instructions on how to set up DNS. This DNS points to the `EXTERNAL-IP`.
- [`aws`](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html).
- [`curl`](https://curl.se/docs/install.html).
- [`eksctl`](https://eksctl.io/installation/).
- [`helm` (v3 or greater)](https://helm.sh/docs/intro/quickstart/#install-helm).
@@ -0,0 +1,59 @@
---
title: Troubleshooting Rancher Prime PAYG Cluster in AWS
---
This section contains information to help troubleshoot issues when installing the Rancher Prime PAYG offering.
## Jobs and Pods
Check the status of pods or jobs:
```shell
kubectl get pods --all-namespaces
```
If a pod is not in a `Running` state, you can attempt to find the root cause with the following commands:
- Describe pod: `kubectl describe pod <pod-name> -n <namespace>`
- Pod container logs: `kubectl logs <pod-name> -n <namespace>`
- Describe job: `kubectl describe job <job-name> -n <namespace>`
- Logs from the containers of pods of the job: `kubectl logs -l job-name=<job-name> -n <namespace>`
## Recovering from Failed Pods
1. If any of the pods aren't running, check the `rancher-cloud` pod:
```shell
kubectl get pods --all-namespaces | grep rancher-cloud
```
1. If the `rancher-cloud` pod is in an `Error` state, wait for the pod to be deleted. This should take about one minute.
1. Fix the problem and run:
```shell
helm upgrade -n cattle-rancher-csp-deployer-system rancher-cloud --create-namespace \
oci://709825985650.dkr.ecr.us-east-1.amazonaws.com/suse/<repository>/rancher-cloud-helm/rancher-cloud --install \
--version <chart-version> \
--set rancherHostname=<host-name> \
--set rancherServerURL=https://<host-name> \
--set rancherReplicas=<replicas> \
--set global.aws.accountNumber=<aws-account-id> \
--set global.aws.roleName=<role-name>
```
## Rancher Usage Record Not Found
When you attempt to retrieve a usage record, you might see the following message:
```shell
Error from server (NotFound): cspadapterusagerecords.susecloud.net "rancher-usage-record not found" Check Configuration, Retrieve generated configuration csp-config
```
To resolve the error, run:
```shell
kubectl get configmap -n cattle-csp-billing-adapter-system csp-config -o yaml
```
If a configuration is not listed, you can attempt to find the root cause by checking the pod status and log. See [Jobs and Pods](#jobs-and-pods) for more details.
@@ -0,0 +1,31 @@
---
title: Upgrading Rancher Prime PAYG Cluster in AWS
---
The AWS Marketplace PAYG offering is tied to a billing adapter and the Rancher Prime version. These are periodically updated as new versions of the billing adapter or Rancher Prime are released. When a new update is available, the Helm chart is updated with new tags and digests, and a new version of the Helm chart is uploaded.
To upgrade the deployed Helm chart to the latest version, run the following Helm command:
```shell
helm upgrade -n cattle-rancher-csp-deployer-system rancher-cloud --create-namespace \
oci://709825985650.dkr.ecr.us-east-1.amazonaws.com/suse/<respository>/rancher-cloud-helm/rancher-cloud \
--version <upgraded-chart-version> \
--set rancherHostname=<host-name> \
--set rancherServerURL=https://<host-name> \
--set rancherReplicas=<replicas> \
--set rancherIngressClassName=nginx \
--set global.aws.accountNumber=<aws-account-id> \
--set global.aws.roleName=<role-name>
```
To check if the upgraded Helm chart deployed successfully, run the following Helm command:
```shell
helm ls -n cattle-rancher-csp-deployer-system
```
:::warning
Rancher Prime PAYG customers have constraints on getting updates, based on the latest version SUSE has published to AWS. The latest available Rancher Prime version may trail slightly behind the latest Rancher release.
:::
@@ -0,0 +1,9 @@
---
title: Common Issues for Rancher Prime PAYG on Azure
---
This page covers some common issues that might arise when setting up the Rancher Prime PAYG offering on Microsoft's Azure Marketplace.
### Migrating Rancher to a Different AKS Cluster
When you migrate Rancher to a different AKS cluster by following the steps in [Rancher Backups and Disaster Recovery](../../../pages-for-subheaders/backup-restore-and-disaster-recovery.md), you must reinstall Rancher Prime on the target AKS cluster after restoring from the backup. Furthermore, the restored Rancher version must not be newer than the version available in the Azure Marketplace.
@@ -0,0 +1,104 @@
---
title: Installing Rancher Prime PAYG on Azure
---
This page covers installing the Rancher Prime PAYG offering on Microsoft's Azure Marketplace.
## How to Install Rancher Prime PAYG
The following steps describe how to create a new deployment of Rancher Prime from the Azure Marketplace page.
1. Select the **Rancher Prime with 24x7 Support** offer (either **EU and UK only** or **non-EU and non-UK only**) that corresponds to the location where your account is registered.
1. Choose a plan from the dropdown menu. View the **Plans + Pricing** tab for more details about the plan.
1. Select **Create**.
### Basics
On the **Basics** tab, specify the **Project details** and **Instance details**:
![Basics tab](/img/install-rancher-prime-basics.png)
1. Select an existing **Subscription** from the dropdown menu.
1. Select an existing **Resource group** from the dropdown menu.
:::note
The **Create new** resource group feature is not supported.
![Create new resource group not supported](/img/install-rancher-prime-basics-create-new.png)
:::
1. Select an existing **AKS Cluster Name** from the dropdown menu.
1. Choose an **Extension Resource name**. It can consist of alphanumeric characters and dots and must be between 2 and 253 characters long.
1. Select **Next**.
### Rancher Configuration
On the **Rancher Configuraion** tab, specify the following information:
![Rancher Configuration](/img/install-rancher-prime-bootstrap-password.png)
1. Enter the **Hostname** for Rancher. The Rancher hostname must be a fully qualified domain name (FQDN). The Rancher server URL will be created using this hostname.
:::note
The IP address of the Rancher hostname must be resolvable by a public DNS.
:::
1. Using the slider, select the number of **Replicas**.
1. Choose and confirm a **Bootstrap Password**. During the first login, you will use the bootstrap password to authenticate to the Rancher dashboard.
:::note
The current Rancher deployment exposes the bootstrap password in the Cluster configuration settings in the Azure Portal. Until this security issue is resolved, we suggest changing the Admin password after initial login, by editing your profile in the Rancher dashboard.
:::
1. Select **Next**.
### Review + create
1. On the **Review + create** tab, review the summary of the offer (Price, Basics, Rancher Configuration) and the link to **view automation template** (Azure Resource Manager Template).
1. Select **Create** to start the deployment.
### Deployment Complete
When the deployment successfully completes, Rancher Prime will be installed.
:::note
On the **Extensions + applications** page, the **Provisioning State** may show **Succeeded** even though the deployment may still be in progress. You can monitor the deployment progress by logging into the AKS cluster and looking at the **rancher-cloud** deployment.
:::
## Log into the Rancher Dashboard
You may now log in to the Rancher dashboard by pointing your browser to the Rancher server URL `https://<host-name>`. The `<host-name>` is the hostname you entered when you [installed Rancher](#installing-rancher).
:::note
The Rancher hostname must be resolvable by public DNS. See the [Prerequisites](prerequisites.md) for more details.
:::
## How to Use Rancher
After you login to Rancher Prime, you should notice the **Welcome to Rancher Prime** message at the top of the screen.
![Rancher Prime Home](/img/install-rancher-prime-home.png)
If your Rancher Prime PAYG deployment only has **Welcome to Rancher** at the top of the screen, make sure that you've updated to the latest version, and reset the branding to default (i.e., "suse") from **Global Settings**.
![Global Settings](/img/install-rancher-prime-global-settings.png)
## Rancher Prime PAYG Billing
View billing information in the Azure Portal by going to **Home** > **Cost Management (subscription) | Cost analysis**.
## Uninstalling Rancher Prime PAYG Offering
Uninstalling Rancher Prime may not remove all of the Kubernetes resources created by Rancher. Run the [Rancher resource cleanup script](https://github.com/rancher/rancher-cleanup) to perform a more comprehensive cleanup.
The best practice for uninstalling the Rancher Prime PAYG offering is to migrate any non-Rancher workloads to a different cluster and destroy the Rancher cluster.
:::warning
Ensure that you prepare and migrate any non-Rancher workloads off of the cluster before you destroy the cluster. These resources are nonrecoverable.
:::
@@ -0,0 +1,9 @@
---
title: Prerequisites
---
Before using Rancher Prime on Azure as a pay-as-you-go (PAYG) offering, you need the following resources, information, and tools:
- A Rancher-compatible AKS cluster. For more details, see the [Rancher support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/). You can only install the Rancher Prime PAYG offering onto clusters in regions where AKS and Azure Container Apps are available. See the [Azure documentation](https://azure.microsoft.com/en-us/explore/global-infrastructure/products-by-region/?products=container-apps,kubernetes-service&regions=all) for details. Refer to [Creating an AKS cluster](../../../getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks.md#3-create-the-aks-cluster) for bringing up an AKS cluster to [install Rancher Prime PAYG](installing-rancher-prime.md).
- An ingress installed on the AKS cluster, so that Rancher is accessible outside the cluster. See the [Rancher documentation](../../../getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks.md#5-install-an-ingress) for instructions on deploying Ingress-NGINX on an AKS cluster.
- The Rancher hostname. The hostname must be a fully qualified domain name (FQDN), and its corresponding IP address must be resolvable from a public DNS. See the [Rancher documentation](../../../getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks.md#7-set-up-dns) for instructions on how to set up DNS.
@@ -0,0 +1,88 @@
---
title: Troubleshooting Rancher Prime PAYG Cluster in Azure
---
This section contains information to help troubleshoot issues when installing the Rancher Prime PAYG offer and configuring the billing adapter.
## Deployment
After a successful deployment, check the status of the deployment. It should list similar pod and chart output as the example below.
```shell
kubectl get deployments --all-namespaces
```
**Response:**
```shell
NAMESPACE NAME READY UP-TO-DATE AVAILABLE AGE
cattle-csp-billing-adapter-system csp-rancher-usage-operator 1/1 1 1 8h
cattle-csp-billing-adapter-system rancher-csp-billing-adapter 1/1 1 1 8h
cattle-fleet-local-system fleet-agent 1/1 1 1 8h
cattle-fleet-system fleet-controller 1/1 1 1 8h
cattle-fleet-system gitjob 1/1 1 1 8h
cattle-provisioning-capi-system capi-controller-manager 1/1 1 1 8h
cattle-system rancher 3/3 3 3 8h
cattle-system rancher-webhook 1/1 1 1 8h
cert-manager cert-manager 1/1 1 1 8h
cert-manager cert-manager-cainjector 1/1 1 1 8h
cert-manager cert-manager-webhook 1/1 1 1 8h
ingress-nginx ingress-nginx-controller 1/1 1 1 9h
kube-system coredns 2/2 2 2 20h
kube-system coredns-autoscaler 1/1 1 1 20h
kube-system extension-agent 1/1 1 1 8h
kube-system extension-operator 1/1 1 1 8h
kube-system konnectivity-agent 2/2 2 2 20h
kube-system metrics-server 2/2 2 2 20h
```
## Jobs and Pods
Check the status of pods or jobs:
```shell
kubectl get pods --all-namespaces
```
If a pod is not in a `Running` state, you can attempt to find the root cause with the following commands:
- Describe pod: `kubectl describe pod <pod-name> -n <namespace>`
- Pod container logs: `kubectl logs <pod-name> -n <namespace>`
- Describe job: `kubectl describe job <job-name> -n <namespace`
- Logs from the containers of pods of the job: `kubectl logs -l job-name=<job-name> -n <namespace>`
## Rancher Usage Record Not Found
When you attempt to retrieve a usage record, you might see the following message:
```shell
Error from server (NotFound): cspadapterusagerecords.susecloud.net "rancher-usage-record not found" Check Configuration, Retrieve generated configuration csp-config
```
To resolve the error, run:
```shell
kubectl get configmap -n cattle-csp-billing-adapter-system csp-config -o yaml
```
If a configuration is not listed, you can attempt to find the root cause by checking the pod status and log. See [Jobs and Pods](#jobs-and-pods) for more details.
## Multiple Extensions of the Same Type
When you attempt to install an extension of the same type, you will see the following message:
```shell
Multiple extensions of same type is not allowed at this scope. (Code: ValidationFailed)"
```
The AKS cluster already has the extension with the same type. To resolve the error, uninstall the extension and re-deploy to the same cluster.
## Resource Already Existing in your Cluster
When you attempt to install a resource or extension that already exists, you will see the following message:
```shell
Helm installation failed : Resource already existing in your cluster : Recommendation Manually delete the resource(s) that currently exist in your cluster and try installation again. To delete these resources run the following commands: kubectl delete <resource type> -n <resource namespace> <resource name> : InnerError [rendered manifests contain a resource that already exists. Unable to continue with install: ServiceAccount "rancher" in namespace "cattle-system" exists and cannot be imported into the current release: invalid ownership metadata; annotation validation error: key "meta.helm.sh/release-name" must equal "test-nv2-reinstall": current value is "testnv2-plan"]
```
The AKS cluster already has the extension installed. To resolve the error, uninstall the extension as suggested in the error message, by deleting the resource via the kubectl command, or uninstall the extension in the Azure Console and re-deploy to the same cluster.
@@ -0,0 +1,17 @@
---
title: Upgrading Rancher Prime PAYG Cluster in Azure
---
The Azure Marketplace PAYG offering is periodically updated when a new version of Rancher Prime is released, and to optimize integration with Azure.
To update to the latest supported version of the Rancher Prime PAYG offering, run the following command in the cluster Cloud Shell:
```shell
az k8s-extension update --name $CLUSTER_EXTENSION_RESOURCE_NAME --cluster-name $CLUSTER_NAME --resource-group $RESOURCE_GROUP --cluster-type managedClusters --version $VERSION_TO_BE_UPGRADED
```
:::warning
Rancher Prime PAYG customers have constraints on getting updates, based on the latest version SUSE has published to Azure. The latest available Rancher Prime version may trail slightly behind the latest Rancher release.
:::