diff --git a/content/rancher/v2.x/en/docs/_index.md b/content/rancher/v2.x/en/home/_index.md similarity index 98% rename from content/rancher/v2.x/en/docs/_index.md rename to content/rancher/v2.x/en/home/_index.md index 909a5267518..a18bc48bbdd 100644 --- a/content/rancher/v2.x/en/docs/_index.md +++ b/content/rancher/v2.x/en/home/_index.md @@ -1,5 +1,5 @@ --- -title: Docs +title: Home aliases: [/rancher/v2.x/en/] weight: 1 --- diff --git a/content/rancher/v2.x/en/docs/architecture/_index.md b/content/rancher/v2.x/en/home/architecture/_index.md similarity index 100% rename from content/rancher/v2.x/en/docs/architecture/_index.md rename to content/rancher/v2.x/en/home/architecture/_index.md diff --git a/content/rancher/v2.x/en/docs/overview/_index.md b/content/rancher/v2.x/en/home/overview/_index.md similarity index 100% rename from content/rancher/v2.x/en/docs/overview/_index.md rename to content/rancher/v2.x/en/home/overview/_index.md diff --git a/content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md b/content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md index a6f2dc81d7c..260ca64da5b 100644 --- a/content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md +++ b/content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md @@ -14,12 +14,23 @@ For development environments, we recommend installing Rancher by running a singl Installation of Rancher on a single node with an external load balancer involves multiple procedures. Review this overview to learn about each procedure you need to complete. 1. [Provision Linux Host](#part-1-provision-linux-host) + + Provision a single Linux host to launch your {{< product >}} Server. + 2. [Choose an SSL Option and Install Rancher](#part-2-choose-an-ssl-option-and-install-rancher) + + Choose an SSL option for Rancher communication encryption. After choosing an option, run the command that accompanies it to deploy Rancher. + 3. [Configure Load Balancer](#part-3-configure-load-balancer) + + Setup a load balancer to direct communications with Rancher and your Kubernetes cluster. + 4. **For those using a certificate signed by a recognized CA:** [Remove Default Certificates](#part-4-remove-default-certificates) + If you chose [Option B](#option-b-bring-your-own-certificate-signed-by-recognized-ca) as your SSL option, log into the Rancher UI and remove the certificates that Rancher automatically generates. + ## Part 1—Provision Linux Host @@ -49,18 +60,11 @@ You can choose from the following scenarios: If you elect to use a self-signed certificate to encrypt communication, you must install the certificate on your load balancer (which you'll do later) and your Rancher container. Run the docker command to deploy Rancher, pointing it toward your certificate. -**Before you Start:** - -Create a self-signed certificate. - -- The certificate files must be in [PEM format](#ssl-faq-troubleshooting). - -- The certificate files must be in base64. - -| Type | Location in container | -| ---------------------------- | ---------------------------: | -| CA certificates file | /etc/rancher/ssl/cacerts.pem | - +>**Prerequisites:** +>Create a self-signed certificate. +> +>- The certificate files must be in [PEM format](#ssl-faq-troubleshooting). +>- The certificate files must be in base64. **To Install Rancher Using a Self-Signed Cert:** @@ -76,13 +80,11 @@ docker run -d -p 80:80 -p 443:443 \ If your cluster is public facing, it's best to use a certificate signed by a recognized CA. -**Before you Start:** - -Obtain a certificate signed by a recognized CA, like GoDaddy or DigiCert. - -- The certificate files must be in [PEM format](#ssl-faq-troubleshooting). - -- The certificate files must be in base64. +>**Prerequisites:** +>Create a self-signed certificate. +> +>- The certificate files must be in [PEM format](#ssl-faq-troubleshooting). +>- The certificate files must be in base64. **To Install Rancher Using a Cert Signed by a Recognized CA:** diff --git a/content/rancher/v2.x/en/installation/single-node-install/_index.md b/content/rancher/v2.x/en/installation/single-node-install/_index.md index 2deb5c94a6f..e7c3d424df3 100644 --- a/content/rancher/v2.x/en/installation/single-node-install/_index.md +++ b/content/rancher/v2.x/en/installation/single-node-install/_index.md @@ -14,8 +14,13 @@ For development environments, we recommend installing Rancher by running a singl Installation of Rancher on a single node involves multiple procedures. Review this overview to learn about each procedure you need to complete. 1. [Provision Linux Host](#part-1-provision-linux-host) + + Provision a single Linux host to launch your {{< product >}} Server. + 2. [Choose an SSL Option and Install Rancher](#part-2-choose-an-ssl-option-and-install-rancher) + Choose an SSL option for Rancher communication encryption. After choosing an option, run the command that accompanies it to deploy Rancher. + ## Part 1—Provision Linux Host Provision a single Linux host to launch your {{< product >}} Server. @@ -57,22 +62,13 @@ If you install Rancher without specifying your own certificate, Rancher generate Your Rancher install can use a self-signed certificate that you provide to encrypt communications. -**Before You Start:** +>**Prerequisites:** +>Create a self-signed certificate. +> +>- The certificate files must be in [PEM format](#ssl-faq-troubleshooting). +>- The certificate files must be in base64. +>- Make sure that your certificate file includes all the intermediate certificates in the chain. The order of certificates in this case is your own certificate first, followed by the intermediates. For an example, refer to the [SSL FAQ / Troubleshooting](#ssl-faq-troubleshooting). -Create a self-signed Certificate. - -- The certificate files must be in [PEM format](#ssl-faq-troubleshooting). - -- The certificate files must be in base64. - -- Make sure that your certificate file includes all the intermediate certificates in the chain. The order of certificates in this case is your own certificate first, followed by the intermediates. For an example, refer to the [SSL FAQ / Troubleshooting](#ssl-faq-troubleshooting). - - | Type | Location in container | - | ---------------------------- | ---------------------------: | - | Certificate file | /etc/rancher/ssl/cert.pem | - | Certificate key file | /etc/rancher/ssl/key.pem | - | CA certificates file | /etc/rancher/ssl/cacerts.pem | -
**To Install Rancher Using a Self-Signed Cert:** @@ -94,21 +90,12 @@ If you're publishing your app publically, you should ideally be using a certific **Before You Start:** -Obtain a certificate signed by a recognized CA, like GoDaddy or DigiCert. - -- The certificate files must be in [PEM format](#ssl-faq-troubleshooting). - -- The certificate files must be in base64. - -- Make sure that the container includes your certificate file and the key file. - - In this case, mounting an additional CA certificate file is unnecessary because the cert is signed by a recognized CA. - - | Type | Location in container | - | ---------------------------- | ---------------------------: | - | Certificate file | /etc/rancher/ssl/cert.pem | - | Certificate key file | /etc/rancher/ssl/key.pem | - +>**Prerequisites:** +>Create a self-signed certificate. +> +>- The certificate files must be in [PEM format](#ssl-faq-troubleshooting). +>- The certificate files must be in base64. +>- Make sure that the container includes your certificate file and the key file. In this case, mounting an additional CA certificate file is unnecessary because the cert is signed by a recognized CA. **To Install Rancher Using a Certificate Signed by a Recognized CA:** @@ -123,12 +110,12 @@ After obtaining your certificate, run the Docker command to deploy Rancher, poin ### Option D—Let's Encrypt Certificate -Rancher supports Let's Encrypt certificates. Let's Encrypt uses an **http-01 challenge** to verify that you have control over your domain. You can confirm that you control the domain by pointing the hostname that you want to use for Rancher access (for example, `rancher.mydomain.com`) to the IP of the machine it is running on. You can bind the hostname to the IP address by creating an A record in DNS. +Rancher supports Let's Encrypt certificates. Let's Encrypt uses an http-01 challenge to verify that you have control over your domain. You can confirm that you control the domain by pointing the hostname that you want to use for Rancher access (for example, `rancher.mydomain.com`) to the IP of the machine it is running on. You can bind the hostname to the IP address by creating an A record in DNS. -**Before You Start:** - -- Create a record in your DNS that binds your Linux host IP address to the hostname that you want to use for Rancher access (`rancher.mydomain.com` for example). -- Open port `TCP/80` on your Linux host. The Let's Encrypt **http-01 challenge** can come from any source IP address, so port `TCP/80` needs to be open to all IP addresses. +>**Prerequisites:** +> +>- Create a record in your DNS that binds your Linux host IP address to the hostname that you want to use for Rancher access (`rancher.mydomain.com` for example). +>- Open port `TCP/80` on your Linux host. The Let's Encrypt http-01 challenge can come from any source IP address, so port `TCP/80` must be open to all IP addresses. **To Install Rancher Using a Let's Encrypt Certificate:** @@ -141,7 +128,7 @@ Run the following commands from your Linux host. docker run -d -p 80:80 -p 443:443 rancher/rancher --acme-domain rancher.mydomain.com ``` - >**Remember:** Let's Encrypt provides rate limits for requesting new certificates, so limit how often you create or destroy the container. For more information, see [Let's Encrypt documentation on rate limits](https://letsencrypt.org/docs/rate-limits/). + >**Remember:** Let's Encrypt provides rate limits for requesting new certificates. Therefore, limit how often you create or destroy the container. For more information, see [Let's Encrypt documentation on rate limits](https://letsencrypt.org/docs/rate-limits/). 2. Install Rancher diff --git a/layouts/shortcodes/note_server-tags.html b/layouts/shortcodes/note_server-tags.html index 1257e3325be..24d5b5aba51 100644 --- a/layouts/shortcodes/note_server-tags.html +++ b/layouts/shortcodes/note_server-tags.html @@ -1,7 +1,8 @@

Note:

- + +

The rancher/rancher container is hosted on DockerHub. If you don't have access to DockerHub, or you are installing Rancher without an Internet connection, refer to Air Gap Installation.

+

Note:

+

For a list of other Rancher Server tags available, refer to Rancher Server Tags.

+
diff --git a/layouts/shortcodes/ssl_faq.html b/layouts/shortcodes/ssl_faq.html index 2b482f9af9b..fdeae0f9faa 100644 --- a/layouts/shortcodes/ssl_faq.html +++ b/layouts/shortcodes/ssl_faq.html @@ -1,9 +1,13 @@

How do I know if my certificates are in PEM format?

-

You can recognize the PEM format by:

-

Starting with: -----BEGIN CERTIFICATE-----

-

Ending with: -----END CERTIFICATE-----

-

Example of a PEM certificate

+

You can recognize the PEM format by the following traits:

+ + +

PEM Certificate Example:

 ----BEGIN CERTIFICATE-----
@@ -13,22 +17,22 @@ VWQqljhfacYPgp8KJUJENQ9h5hZ2nSCrI+W00Jcw4QcEdCI8HL5wmg==
 -----END CERTIFICATE-----
-

What is the order of certificates in case I want to add my intermediate(s)?

+

What is the order of certificates if I want to add my intermediate(s)?

The order of adding certificates is as follows:

 -----BEGIN CERTIFICATE-----
-(Your certificate)
+%YOUR_CERTIFICATE%
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-(Your intermediate certificate)
+%YOUR_INTERMEDIATE_CERTIFICATE%
 -----END CERTIFICATE-----

How do I validate my certificate chain?

-

You can validate the certificate chain by using the openssl binary. If the output of the command (see the command example below) ends with Verify return code: 0 (ok), your certificate chain is valid. The ca.pem file should be the same as you supplied to the rancher/rancher container. When using a certificate signed by a well known Certificate Authority, you can omit the -CAfile parameter.

+

You can validate the certificate chain by using the openssl binary. If the output of the command (see the command example below) ends with Verify return code: 0 (ok), your certificate chain is valid. The ca.pem file must be the same as you added to the rancher/rancher container. When using a certificate signed by a recognized Certificate Authority, you can omit the -CAfile parameter.

Command