mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-25 12:38:05 +00:00
deploy: a7b41dd423
This commit is contained in:
github-actions[bot]
@@ -12,7 +12,7 @@
|
||||
|
||||
<script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" charset="UTF-8" data-domain-script="0f98beb0-fc4c-417d-a42e-564e2cae42d2" async></script>
|
||||
<script src="/scripts/optanonwrapper.js" async></script><link rel="stylesheet" href="/assets/css/styles.efd70281.css">
|
||||
<link rel="preload" href="/assets/js/runtime~main.34041f6f.js" as="script">
|
||||
<link rel="preload" href="/assets/js/runtime~main.c4ddb06c.js" as="script">
|
||||
<link rel="preload" href="/assets/js/main.dc85dcc0.js" as="script">
|
||||
</head>
|
||||
<body class="navigation-with-keyboard">
|
||||
@@ -20,7 +20,7 @@
|
||||
|
||||
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
|
||||
<div role="region" aria-label="Skip to main content"><a class="skipToContent_fXgn" href="#docusaurus_skipToContent_fallback">Skip to main content</a></div><nav aria-label="Main" class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Toggle navigation bar" aria-expanded="false" class="navbar__toggle clean-btn" type="button"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/"><div class="navbar__logo"><img src="/img/rancher-logo-horiz-color.svg" alt="logo" class="themedImage_ToTc themedImage--light_HNdA"><img src="/img/rancher-logo-horiz-color.svg" alt="logo" class="themedImage_ToTc themedImage--dark_i4oU"></div><b class="navbar__title text--truncate"></b></a><div class="navbar__item dropdown dropdown--hoverable"><a aria-current="page" class="navbar__link active" aria-haspopup="true" aria-expanded="false" role="button" href="/">Latest</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/">Latest</a></li><li><a class="dropdown__link" href="/v2.7">v2.7</a></li><li><a class="dropdown__link" href="/v2.6">v2.6</a></li><li><a class="dropdown__link" href="/v2.5">v2.5</a></li><li><a class="dropdown__link" href="/v2.0-v2.4">v2.0-v2.4</a></li><li><a class="dropdown__link" href="/versions">All versions</a></li></ul></div></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a href="#" aria-haspopup="true" aria-expanded="false" role="button" class="navbar__link"><svg viewBox="0 0 24 24" width="20" height="20" aria-hidden="true" class="iconLanguage_nlXk"><path fill="currentColor" d="M12.87 15.07l-2.54-2.51.03-.03c1.74-1.94 2.98-4.17 3.71-6.53H17V4h-7V2H8v2H1v1.99h11.17C11.5 7.92 10.44 9.75 9 11.35 8.07 10.32 7.3 9.19 6.69 8h-2c.73 1.63 1.73 3.17 2.98 4.56l-5.09 5.02L4 19l5-5 3.11 3.11.76-2.04zM18.5 10h-2L12 22h2l1.12-3h4.75L21 22h2l-4.5-12zm-2.62 7l1.62-4.33L19.12 17h-3.24z"></path></svg>English</a><ul class="dropdown__menu"><li><a href="/404" target="_self" rel="noopener noreferrer" class="dropdown__link dropdown__link--active" lang="en">English</a></li><li><a href="/zh/404" target="_self" rel="noopener noreferrer" class="dropdown__link" lang="zh">简体中文</a></li></ul></div><a href="https://github.com/rancher/rancher-docs" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link navbar__github">GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a><a href="https://www.rancher.com" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">Rancher Home<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a><div class="searchBox_ZlJk"><button type="button" class="DocSearch DocSearch-Button" aria-label="Search"><span class="DocSearch-Button-Container"><svg width="20" height="20" class="DocSearch-Search-Icon" viewBox="0 0 20 20"><path d="M14.386 14.386l4.0877 4.0877-4.0877-4.0877c-2.9418 2.9419-7.7115 2.9419-10.6533 0-2.9419-2.9418-2.9419-7.7115 0-10.6533 2.9418-2.9419 7.7115-2.9419 10.6533 0 2.9419 2.9418 2.9419 7.7115 0 10.6533z" stroke="currentColor" fill="none" fill-rule="evenodd" stroke-linecap="round" stroke-linejoin="round"></path></svg><span class="DocSearch-Button-Placeholder">Search</span></span><span class="DocSearch-Button-Keys"></span></button></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div id="docusaurus_skipToContent_fallback" class="main-wrapper mainWrapper_z2l0"><main class="container margin-vert--xl"><div class="row"><div class="col col--6 col--offset-3"><h1 class="hero__title">Page Not Found</h1><p>We could not find what you were looking for.</p><p>Please contact the owner of the site that linked you to the original URL and let them know their link is broken.</p></div></div></main></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2023 SUSE Rancher. All Rights Reserved.</div></div></div></footer></div>
|
||||
<script src="/assets/js/runtime~main.34041f6f.js"></script>
|
||||
<script src="/assets/js/runtime~main.c4ddb06c.js"></script>
|
||||
<script src="/assets/js/main.dc85dcc0.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -324,8 +324,8 @@ const metadata = {
|
||||
"editUrl": "https://github.com/rancher/rancher-docs/edit/main/versioned_docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md",
|
||||
"tags": [],
|
||||
"version": "2.6",
|
||||
"lastUpdatedAt": 1695854524,
|
||||
"formattedLastUpdatedAt": "Sep 27, 2023",
|
||||
"lastUpdatedAt": 1695923358,
|
||||
"formattedLastUpdatedAt": "Sep 28, 2023",
|
||||
"frontMatter": {
|
||||
"title": "EKS Cluster Configuration Reference"
|
||||
},
|
||||
@@ -392,12 +392,12 @@ const toc = [
|
||||
level: 3
|
||||
},
|
||||
{
|
||||
value: 'Bring your own launch template',
|
||||
id: 'bring-your-own-launch-template',
|
||||
value: 'User-provided Launch Templates',
|
||||
id: 'user-provided-launch-templates',
|
||||
level: 4
|
||||
},
|
||||
{
|
||||
value: 'Rancher-managed launch templates',
|
||||
value: 'Rancher-managed Launch Templates',
|
||||
id: 'rancher-managed-launch-templates',
|
||||
level: 4
|
||||
},
|
||||
@@ -610,8 +610,8 @@ function MDXContent(_param) {
|
||||
parentName: "p",
|
||||
"href": "https://docs.aws.amazon.com/eks/latest/userguide/managed-node-groups.html"
|
||||
}, `EKS documentation.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
|
||||
"id": "bring-your-own-launch-template"
|
||||
}, `Bring your own launch template`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `A launch template ID and version can be provided in order to easily configure the EC2 instances in a node group. If a launch template is provided, then none of the settings below will be configurable in Rancher. Therefore, using a launch template would require that all the necessary and desired settings from the list below would need to be specified in the launch template. Also note that if a launch template ID and version is provided, then only the template version can be updated. Using a new template ID would require creating a new managed node group.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("table", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("thead", {
|
||||
"id": "user-provided-launch-templates"
|
||||
}, `User-provided Launch Templates`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `You can provide your own launch template ID and version to configure the EC2 instances in a node group. If you provide the launch template, none of the template settings will be configurable from Rancher. You must set all of the required options listed below in your launch template.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Also, if you provide the launch template, you can only update the template version, not the template ID. To use a new template ID, create a new managed node group.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("table", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("thead", {
|
||||
parentName: "table"
|
||||
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("tr", {
|
||||
parentName: "thead"
|
||||
@@ -703,7 +703,7 @@ function MDXContent(_param) {
|
||||
"align": null
|
||||
}, `Optional`)))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
|
||||
"id": "rancher-managed-launch-templates"
|
||||
}, `Rancher-managed launch templates`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `If you do not specify a launch template, then you will be able to configure the above options in the Rancher UI and all of them can be updated after creation. In order to take advantage of all of these options, Rancher will create and manage a launch template for you. Each cluster in Rancher will have one Rancher-managed launch template and each managed node group that does not have a specified launch template will have one version of the managed launch template. The name of this launch template will have the prefix "rancher-managed-lt-" followed by the display name of the cluster. In addition, the Rancher-managed launch template will be tagged with the key "rancher-managed-template" and value "do-not-modify-or-delete" to help identify it as Rancher-managed. It is important that this launch template and its versions not be modified, deleted, or used with any other clusters or managed node groups. Doing so could result in your node groups being "degraded" and needing to be destroyed and recreated.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
|
||||
}, `Rancher-managed Launch Templates`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `If you do not specify a launch template, then you will be able to configure the above options in the Rancher UI and all of them can be updated after creation. In order to take advantage of all of these options, Rancher will create and manage a launch template for you. Each cluster in Rancher will have one Rancher-managed launch template and each managed node group that does not have a specified launch template will have one version of the managed launch template. The name of this launch template will have the prefix "rancher-managed-lt-" followed by the display name of the cluster. In addition, the Rancher-managed launch template will be tagged with the key "rancher-managed-template" and value "do-not-modify-or-delete" to help identify it as Rancher-managed. It is important that this launch template and its versions not be modified, deleted, or used with any other clusters or managed node groups. Doing so could result in your node groups being "degraded" and needing to be destroyed and recreated.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
|
||||
"id": "custom-amis"
|
||||
}, `Custom AMIs`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `If you specify a custom AMI, whether in a launch template or in Rancher, then the image must be `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
||||
parentName: "p",
|
||||
@@ -324,8 +324,8 @@ const metadata = {
|
||||
"editUrl": "https://github.com/rancher/rancher-docs/edit/main/versioned_docs/version-2.7/reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md",
|
||||
"tags": [],
|
||||
"version": "2.7",
|
||||
"lastUpdatedAt": 1695854524,
|
||||
"formattedLastUpdatedAt": "Sep 27, 2023",
|
||||
"lastUpdatedAt": 1695931531,
|
||||
"formattedLastUpdatedAt": "Sep 28, 2023",
|
||||
"frontMatter": {
|
||||
"title": "Communicating with Downstream User Clusters"
|
||||
},
|
||||
@@ -361,6 +361,16 @@ const toc = [
|
||||
id: '4-authorized-cluster-endpoint',
|
||||
level: 3
|
||||
},
|
||||
{
|
||||
value: 'Impersonation',
|
||||
id: 'impersonation',
|
||||
level: 2
|
||||
},
|
||||
{
|
||||
value: 'Impersonation Troubleshooting',
|
||||
id: 'impersonation-troubleshooting',
|
||||
level: 3
|
||||
},
|
||||
{
|
||||
value: 'Important Files',
|
||||
id: 'important-files',
|
||||
@@ -441,7 +451,10 @@ function MDXContent(_param) {
|
||||
the pods. Bob is authenticated through Rancher's authentication proxy.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `The authentication proxy forwards all Kubernetes API calls to downstream clusters. It integrates with authentication services like local authentication, Active Directory, and GitHub. On every Kubernetes API call, the authentication proxy authenticates the caller and sets the proper Kubernetes impersonation headers before forwarding the call to Kubernetes masters.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Rancher communicates with Kubernetes clusters using a `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
||||
parentName: "p",
|
||||
"href": "https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/"
|
||||
}, `service account,`), ` which provides an identity for processes that run in a pod.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `By default, Rancher generates a `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
||||
}, `service account`), `. Each user account in Rancher correlates with an equivalent service account in the downstream cluster. Rancher uses the service account to `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
||||
parentName: "p",
|
||||
"href": "https://kubernetes.io/docs/reference/access-authn-authz/authentication/#user-impersonation"
|
||||
}, `impersonate`), ` the user, which provides all the permissions the user is intended to have.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `By default, Rancher generates a `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
||||
parentName: "p",
|
||||
"href": "/v2.7/how-to-guides/new-user-guides/manage-clusters/access-clusters/use-kubectl-and-kubeconfig"
|
||||
}, `kubeconfig file`), ` that contains credentials for proxying through the Rancher server to connect to the Kubernetes API server on a downstream user cluster. The kubeconfig file (`, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||||
@@ -506,6 +519,104 @@ the pods. Bob is authenticated through Rancher's authentication proxy.`), /*#__P
|
||||
parentName: "p",
|
||||
"href": "/v2.7/how-to-guides/new-user-guides/manage-clusters/access-clusters/use-kubectl-and-kubeconfig"
|
||||
}, `kubectl and the kubeconfig file.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h2", {
|
||||
"id": "impersonation"
|
||||
}, `Impersonation`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Users technically exist only on the upstream cluster. Rancher creates `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
||||
parentName: "p",
|
||||
"href": "https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding"
|
||||
}, `RoleBindings and ClusterRoleBindings`), ` that refer to Rancher users, even though there is `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
||||
parentName: "p",
|
||||
"href": "https://kubernetes.io/docs/reference/access-authn-authz/authentication/#users-in-kubernetes"
|
||||
}, `no actual User resource`), ` on the downstream cluster.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `When users interact with a downstream cluster through the authentication proxy, there needs to be some entity downstream to serve as the actor for those requests. Rancher creates service accounts to be that entity. Each service account is only granted one permission, which is to `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
|
||||
parentName: "p"
|
||||
}, `impersonate`), ` the user they belong to. If there was only one service account that could impersonate any user, then it would be possible for a malicious user to corrupt that account and escalate their privileges by impersonating another user. This issue was the basis for a `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
||||
parentName: "p",
|
||||
"href": "https://github.com/rancher/rancher/security/advisories/GHSA-pvxj-25m6-7vqr"
|
||||
}, `CVE`), `.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
|
||||
"id": "impersonation-troubleshooting"
|
||||
}, `Impersonation Troubleshooting`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `On the downstream cluster, five resources handle impersonation:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("ul", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
|
||||
parentName: "ul"
|
||||
}, `namespace: `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||||
parentName: "li"
|
||||
}, `cattle-impersonation-system`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
|
||||
parentName: "ul"
|
||||
}, `service account: `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||||
parentName: "li"
|
||||
}, `cattle-impersonation-system/cattle-impersonation-<user ID>`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
|
||||
parentName: "ul"
|
||||
}, `account token secret: `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||||
parentName: "li"
|
||||
}, `cattle-impersonation-system/cattle-impersonation-<user ID>-token-<hash>`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
|
||||
parentName: "ul"
|
||||
}, `cluster role: `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||||
parentName: "li"
|
||||
}, `cattle-impersonation-<user ID>`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
|
||||
parentName: "ul"
|
||||
}, `cluster role binding: `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||||
parentName: "li"
|
||||
}, `cattle-impersonation-<user ID>`))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `In this example of a typical impersonation cluster role, the system is configured to use `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||||
parentName: "p"
|
||||
}, `github`), ` as the auth provider:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("pre", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("code", {
|
||||
parentName: "pre",
|
||||
"className": "language-yaml"
|
||||
}, `apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
creationTimestamp: "2021-10-06T18:20:13Z"
|
||||
labels:
|
||||
authz.cluster.cattle.io/impersonator: "true"
|
||||
cattle.io/creator: norman
|
||||
name: cattle-impersonation-user-abcde
|
||||
resourceVersion: "3528"
|
||||
uid: a7478731-72a0-4343-b09f-c3bf12552d77
|
||||
rules:
|
||||
# allowed to impersonate user user-abcde
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- user-abcde
|
||||
resources:
|
||||
- users
|
||||
verbs:
|
||||
- impersonate
|
||||
# allowed to impersonate listed groups
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- github_team://123 # group from GitHub auth provider
|
||||
- system:authenticated # automatic group from Kubernetes
|
||||
- system:cattle:authenticated # automatic group from Rancher
|
||||
resources:
|
||||
- groups
|
||||
verbs:
|
||||
- impersonate
|
||||
# allowed to impersonate principal ID github_user://098
|
||||
- apiGroups:
|
||||
- authentication.k8s.io
|
||||
resourceNames:
|
||||
- github_user://098 # principal ID from GitHub auth provider
|
||||
resources:
|
||||
- userextras/principalid
|
||||
verbs:
|
||||
- impersonate
|
||||
# allowed to impersonate username example
|
||||
- apiGroups:
|
||||
- authentication.k8s.io
|
||||
resourceNames:
|
||||
- example # username from GitHub auth provider
|
||||
resources:
|
||||
- userextras/username
|
||||
verbs:
|
||||
- impersonate
|
||||
`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `When you troubleshoot impersonation issues, check whether these resources exist for the user, and whether the rules in the cluster role look similar to the above. For example:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("pre", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("code", {
|
||||
parentName: "pre",
|
||||
"className": "language-bash"
|
||||
}, `kubectl --namespace cattle-impersonation-system get serviceaccount cattle-impersonation-<user ID>
|
||||
kubectl --namespace cattle-impersonation-system get secret cattle-impersonation-<user ID>-token-<hash>
|
||||
kubectl get clusterrole cattle-impersonation-<user ID> --output yaml
|
||||
kubectl get clusterrolebinding cattle-impersonation-<user ID>
|
||||
`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `If you see an error related to "impersonation" in the UI, pay close attention to the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("em", {
|
||||
parentName: "p"
|
||||
}, `end`), ` of the error message, which should indicate the real reason that the request failed.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h2", {
|
||||
"id": "important-files"
|
||||
}, `Important Files`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `The files mentioned below are needed to maintain, troubleshoot and upgrade your cluster:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("ul", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
|
||||
parentName: "ul"
|
||||
@@ -324,8 +324,8 @@ const metadata = {
|
||||
"editUrl": "https://github.com/rancher/rancher-docs/edit/main/docs/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md",
|
||||
"tags": [],
|
||||
"version": "current",
|
||||
"lastUpdatedAt": 1695854524,
|
||||
"formattedLastUpdatedAt": "Sep 27, 2023",
|
||||
"lastUpdatedAt": 1695923358,
|
||||
"formattedLastUpdatedAt": "Sep 28, 2023",
|
||||
"frontMatter": {
|
||||
"title": "EKS Cluster Configuration Reference"
|
||||
},
|
||||
@@ -392,12 +392,12 @@ const toc = [
|
||||
level: 3
|
||||
},
|
||||
{
|
||||
value: 'Bring your own launch template',
|
||||
id: 'bring-your-own-launch-template',
|
||||
value: 'User-provided Launch Templates',
|
||||
id: 'user-provided-launch-templates',
|
||||
level: 4
|
||||
},
|
||||
{
|
||||
value: 'Rancher-managed launch templates',
|
||||
value: 'Rancher-managed Launch Templates',
|
||||
id: 'rancher-managed-launch-templates',
|
||||
level: 4
|
||||
},
|
||||
@@ -610,8 +610,8 @@ function MDXContent(_param) {
|
||||
parentName: "p",
|
||||
"href": "https://docs.aws.amazon.com/eks/latest/userguide/managed-node-groups.html"
|
||||
}, `EKS documentation.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
|
||||
"id": "bring-your-own-launch-template"
|
||||
}, `Bring your own launch template`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `A launch template ID and version can be provided in order to easily configure the EC2 instances in a node group. If a launch template is provided, then none of the settings below will be configurable in Rancher. Therefore, using a launch template would require that all the necessary and desired settings from the list below would need to be specified in the launch template. Also note that if a launch template ID and version is provided, then only the template version can be updated. Using a new template ID would require creating a new managed node group.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("table", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("thead", {
|
||||
"id": "user-provided-launch-templates"
|
||||
}, `User-provided Launch Templates`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `You can provide your own launch template ID and version to configure the EC2 instances in a node group. If you provide the launch template, none of the template settings will be configurable from Rancher. You must set all of the required options listed below in your launch template.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Also, if you provide the launch template, you can only update the template version, not the template ID. To use a new template ID, create a new managed node group.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("table", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("thead", {
|
||||
parentName: "table"
|
||||
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("tr", {
|
||||
parentName: "thead"
|
||||
@@ -698,12 +698,12 @@ function MDXContent(_param) {
|
||||
}, `Instance Resource Tags`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
|
||||
parentName: "tr",
|
||||
"align": null
|
||||
}, `Tag each EC2 instance in the node group`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
|
||||
}, `Tag each EC2 instance and its volumes in the node group`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
|
||||
parentName: "tr",
|
||||
"align": null
|
||||
}, `Optional`)))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
|
||||
"id": "rancher-managed-launch-templates"
|
||||
}, `Rancher-managed launch templates`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `If you do not specify a launch template, then you will be able to configure the above options in the Rancher UI and all of them can be updated after creation. In order to take advantage of all of these options, Rancher will create and manage a launch template for you. Each cluster in Rancher will have one Rancher-managed launch template and each managed node group that does not have a specified launch template will have one version of the managed launch template. The name of this launch template will have the prefix "rancher-managed-lt-" followed by the display name of the cluster. In addition, the Rancher-managed launch template will be tagged with the key "rancher-managed-template" and value "do-not-modify-or-delete" to help identify it as Rancher-managed. It is important that this launch template and its versions not be modified, deleted, or used with any other clusters or managed node groups. Doing so could result in your node groups being "degraded" and needing to be destroyed and recreated.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
|
||||
}, `Rancher-managed Launch Templates`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `If you do not specify a launch template, then you will be able to configure the above options in the Rancher UI and all of them can be updated after creation. In order to take advantage of all of these options, Rancher will create and manage a launch template for you. Each cluster in Rancher will have one Rancher-managed launch template and each managed node group that does not have a specified launch template will have one version of the managed launch template. The name of this launch template will have the prefix "rancher-managed-lt-" followed by the display name of the cluster. In addition, the Rancher-managed launch template will be tagged with the key "rancher-managed-template" and value "do-not-modify-or-delete" to help identify it as Rancher-managed. It is important that this launch template and its versions not be modified, deleted, or used with any other clusters or managed node groups. Doing so could result in your node groups being "degraded" and needing to be destroyed and recreated.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
|
||||
"id": "custom-amis"
|
||||
}, `Custom AMIs`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `If you specify a custom AMI, whether in a launch template or in Rancher, then the image must be `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
||||
parentName: "p",
|
||||
@@ -324,8 +324,8 @@ const metadata = {
|
||||
"editUrl": "https://github.com/rancher/rancher-docs/edit/main/versioned_docs/version-2.6/reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md",
|
||||
"tags": [],
|
||||
"version": "2.6",
|
||||
"lastUpdatedAt": 1695854524,
|
||||
"formattedLastUpdatedAt": "Sep 27, 2023",
|
||||
"lastUpdatedAt": 1695931531,
|
||||
"formattedLastUpdatedAt": "Sep 28, 2023",
|
||||
"frontMatter": {
|
||||
"title": "Communicating with Downstream User Clusters"
|
||||
},
|
||||
@@ -361,6 +361,16 @@ const toc = [
|
||||
id: '4-authorized-cluster-endpoint',
|
||||
level: 3
|
||||
},
|
||||
{
|
||||
value: 'Impersonation',
|
||||
id: 'impersonation',
|
||||
level: 2
|
||||
},
|
||||
{
|
||||
value: 'Impersonation Troubleshooting',
|
||||
id: 'impersonation-troubleshooting',
|
||||
level: 3
|
||||
},
|
||||
{
|
||||
value: 'Important Files',
|
||||
id: 'important-files',
|
||||
@@ -441,7 +451,10 @@ function MDXContent(_param) {
|
||||
the pods. Bob is authenticated through Rancher's authentication proxy.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `The authentication proxy forwards all Kubernetes API calls to downstream clusters. It integrates with authentication services like local authentication, Active Directory, and GitHub. On every Kubernetes API call, the authentication proxy authenticates the caller and sets the proper Kubernetes impersonation headers before forwarding the call to Kubernetes masters.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Rancher communicates with Kubernetes clusters using a `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
||||
parentName: "p",
|
||||
"href": "https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/"
|
||||
}, `service account,`), ` which provides an identity for processes that run in a pod.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `By default, Rancher generates a `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
||||
}, `service account`), `. Each user account in Rancher correlates with an equivalent service account in the downstream cluster. Rancher uses the service account to `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
||||
parentName: "p",
|
||||
"href": "https://kubernetes.io/docs/reference/access-authn-authz/authentication/#user-impersonation"
|
||||
}, `impersonate`), ` the user, which provides all the permissions the user is intended to have.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `By default, Rancher generates a `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
||||
parentName: "p",
|
||||
"href": "/v2.6/how-to-guides/new-user-guides/manage-clusters/access-clusters/use-kubectl-and-kubeconfig"
|
||||
}, `kubeconfig file`), ` that contains credentials for proxying through the Rancher server to connect to the Kubernetes API server on a downstream user cluster. The kubeconfig file (`, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||||
@@ -506,6 +519,104 @@ the pods. Bob is authenticated through Rancher's authentication proxy.`), /*#__P
|
||||
parentName: "p",
|
||||
"href": "/v2.6/how-to-guides/new-user-guides/manage-clusters/access-clusters/use-kubectl-and-kubeconfig"
|
||||
}, `kubectl and the kubeconfig file.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h2", {
|
||||
"id": "impersonation"
|
||||
}, `Impersonation`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Users technically exist only on the upstream cluster. Rancher creates `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
||||
parentName: "p",
|
||||
"href": "https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding"
|
||||
}, `RoleBindings and ClusterRoleBindings`), ` that refer to Rancher users, even though there is `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
||||
parentName: "p",
|
||||
"href": "https://kubernetes.io/docs/reference/access-authn-authz/authentication/#users-in-kubernetes"
|
||||
}, `no actual User resource`), ` on the downstream cluster.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `When users interact with a downstream cluster through the authentication proxy, there needs to be some entity downstream to serve as the actor for those requests. Rancher creates service accounts to be that entity. Each service account is only granted one permission, which is to `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
|
||||
parentName: "p"
|
||||
}, `impersonate`), ` the user they belong to. If there was only one service account that could impersonate any user, then it would be possible for a malicious user to corrupt that account and escalate their privileges by impersonating another user. This issue was the basis for a `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
||||
parentName: "p",
|
||||
"href": "https://github.com/rancher/rancher/security/advisories/GHSA-pvxj-25m6-7vqr"
|
||||
}, `CVE`), `.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
|
||||
"id": "impersonation-troubleshooting"
|
||||
}, `Impersonation Troubleshooting`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `On the downstream cluster, five resources handle impersonation:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("ul", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
|
||||
parentName: "ul"
|
||||
}, `namespace: `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||||
parentName: "li"
|
||||
}, `cattle-impersonation-system`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
|
||||
parentName: "ul"
|
||||
}, `service account: `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||||
parentName: "li"
|
||||
}, `cattle-impersonation-system/cattle-impersonation-<user ID>`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
|
||||
parentName: "ul"
|
||||
}, `account token secret: `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||||
parentName: "li"
|
||||
}, `cattle-impersonation-system/cattle-impersonation-<user ID>-token-<hash>`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
|
||||
parentName: "ul"
|
||||
}, `cluster role: `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||||
parentName: "li"
|
||||
}, `cattle-impersonation-<user ID>`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
|
||||
parentName: "ul"
|
||||
}, `cluster role binding: `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||||
parentName: "li"
|
||||
}, `cattle-impersonation-<user ID>`))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `In this example of a typical impersonation cluster role, the system is configured to use `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
|
||||
parentName: "p"
|
||||
}, `github`), ` as the auth provider:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("pre", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("code", {
|
||||
parentName: "pre",
|
||||
"className": "language-yaml"
|
||||
}, `apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
creationTimestamp: "2021-10-06T18:20:13Z"
|
||||
labels:
|
||||
authz.cluster.cattle.io/impersonator: "true"
|
||||
cattle.io/creator: norman
|
||||
name: cattle-impersonation-user-abcde
|
||||
resourceVersion: "3528"
|
||||
uid: a7478731-72a0-4343-b09f-c3bf12552d77
|
||||
rules:
|
||||
# allowed to impersonate user user-abcde
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- user-abcde
|
||||
resources:
|
||||
- users
|
||||
verbs:
|
||||
- impersonate
|
||||
# allowed to impersonate listed groups
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- github_team://123 # group from GitHub auth provider
|
||||
- system:authenticated # automatic group from Kubernetes
|
||||
- system:cattle:authenticated # automatic group from Rancher
|
||||
resources:
|
||||
- groups
|
||||
verbs:
|
||||
- impersonate
|
||||
# allowed to impersonate principal ID github_user://098
|
||||
- apiGroups:
|
||||
- authentication.k8s.io
|
||||
resourceNames:
|
||||
- github_user://098 # principal ID from GitHub auth provider
|
||||
resources:
|
||||
- userextras/principalid
|
||||
verbs:
|
||||
- impersonate
|
||||
# allowed to impersonate username example
|
||||
- apiGroups:
|
||||
- authentication.k8s.io
|
||||
resourceNames:
|
||||
- example # username from GitHub auth provider
|
||||
resources:
|
||||
- userextras/username
|
||||
verbs:
|
||||
- impersonate
|
||||
`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `When you troubleshoot impersonation issues, check whether these resources exist for the user, and whether the rules in the cluster role look similar to the above. For example:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("pre", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("code", {
|
||||
parentName: "pre",
|
||||
"className": "language-bash"
|
||||
}, `kubectl --namespace cattle-impersonation-system get serviceaccount cattle-impersonation-<user ID>
|
||||
kubectl --namespace cattle-impersonation-system get secret cattle-impersonation-<user ID>-token-<hash>
|
||||
kubectl get clusterrole cattle-impersonation-<user ID> --output yaml
|
||||
kubectl get clusterrolebinding cattle-impersonation-<user ID>
|
||||
`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `If you see an error related to "impersonation" in the UI, pay close attention to the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("em", {
|
||||
parentName: "p"
|
||||
}, `end`), ` of the error message, which should indicate the real reason that the request failed.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h2", {
|
||||
"id": "important-files"
|
||||
}, `Important Files`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `The files mentioned below are needed to maintain, troubleshoot and upgrade your cluster:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("ul", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
|
||||
parentName: "ul"
|
||||
@@ -324,8 +324,8 @@ const metadata = {
|
||||
"editUrl": "https://github.com/rancher/rancher-docs/edit/main/versioned_docs/version-2.5/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md",
|
||||
"tags": [],
|
||||
"version": "2.5",
|
||||
"lastUpdatedAt": 1695854524,
|
||||
"formattedLastUpdatedAt": "Sep 27, 2023",
|
||||
"lastUpdatedAt": 1695923358,
|
||||
"formattedLastUpdatedAt": "Sep 28, 2023",
|
||||
"frontMatter": {
|
||||
"title": "EKS Cluster Configuration Reference"
|
||||
},
|
||||
@@ -392,12 +392,12 @@ const toc = [
|
||||
level: 3
|
||||
},
|
||||
{
|
||||
value: 'Bring your own launch template',
|
||||
id: 'bring-your-own-launch-template',
|
||||
value: 'User-provided Launch Templates',
|
||||
id: 'user-provided-launch-templates',
|
||||
level: 4
|
||||
},
|
||||
{
|
||||
value: 'Rancher-managed launch templates',
|
||||
value: 'Rancher-managed Launch Templates',
|
||||
id: 'rancher-managed-launch-templates',
|
||||
level: 4
|
||||
},
|
||||
@@ -724,8 +724,8 @@ function MDXContent(_param) {
|
||||
parentName: "p",
|
||||
"href": "https://docs.aws.amazon.com/eks/latest/userguide/managed-node-groups.html"
|
||||
}, `EKS documentation.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
|
||||
"id": "bring-your-own-launch-template"
|
||||
}, `Bring your own launch template`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `A launch template ID and version can be provided in order to easily configure the EC2 instances in a node group. If a launch template is provided, then none of the settings below will be configurable in Rancher. Therefore, using a launch template would require that all the necessary and desired settings from the list below would need to be specified in the launch template. Also note that if a launch template ID and version is provided, then only the template version can be updated. Using a new template ID would require creating a new managed node group.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("table", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("thead", {
|
||||
"id": "user-provided-launch-templates"
|
||||
}, `User-provided Launch Templates`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `You can provide your own launch template ID and version to configure the EC2 instances in a node group. If you provide the launch template, none of the template settings will be configurable from Rancher. You must set all of the required options listed below in your launch template.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Also, if you provide the launch template, you can only update the template version, not the template ID. To use a new template ID, create a new managed node group.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("table", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("thead", {
|
||||
parentName: "table"
|
||||
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("tr", {
|
||||
parentName: "thead"
|
||||
@@ -817,7 +817,7 @@ function MDXContent(_param) {
|
||||
"align": null
|
||||
}, `Optional`)))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
|
||||
"id": "rancher-managed-launch-templates"
|
||||
}, `Rancher-managed launch templates`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `If you do not specify a launch template, then you will be able to configure the above options in the Rancher UI and all of them can be updated after creation. In order to take advantage of all of these options, Rancher will create and manage a launch template for you. Each cluster in Rancher will have one Rancher-managed launch template and each managed node group that does not have a specified launch template will have one version of the managed launch template. The name of this launch template will have the prefix "rancher-managed-lt-" followed by the display name of the cluster. In addition, the Rancher-managed launch template will be tagged with the key "rancher-managed-template" and value "do-not-modify-or-delete" to help identify it as Rancher-managed. It is important that this launch template and its versions not be modified, deleted, or used with any other clusters or managed node groups. Doing so could result in your node groups being "degraded" and needing to be destroyed and recreated.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
|
||||
}, `Rancher-managed Launch Templates`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `If you do not specify a launch template, then you will be able to configure the above options in the Rancher UI and all of them can be updated after creation. In order to take advantage of all of these options, Rancher will create and manage a launch template for you. Each cluster in Rancher will have one Rancher-managed launch template and each managed node group that does not have a specified launch template will have one version of the managed launch template. The name of this launch template will have the prefix "rancher-managed-lt-" followed by the display name of the cluster. In addition, the Rancher-managed launch template will be tagged with the key "rancher-managed-template" and value "do-not-modify-or-delete" to help identify it as Rancher-managed. It is important that this launch template and its versions not be modified, deleted, or used with any other clusters or managed node groups. Doing so could result in your node groups being "degraded" and needing to be destroyed and recreated.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
|
||||
"id": "custom-amis"
|
||||
}, `Custom AMIs`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `If you specify a custom AMI, whether in a launch template or in Rancher, then the image must be `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
||||
parentName: "p",
|
||||
@@ -324,8 +324,8 @@ const metadata = {
|
||||
"editUrl": "https://github.com/rancher/rancher-docs/edit/main/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md",
|
||||
"tags": [],
|
||||
"version": "2.7",
|
||||
"lastUpdatedAt": 1695854524,
|
||||
"formattedLastUpdatedAt": "Sep 27, 2023",
|
||||
"lastUpdatedAt": 1695923358,
|
||||
"formattedLastUpdatedAt": "Sep 28, 2023",
|
||||
"frontMatter": {
|
||||
"title": "EKS Cluster Configuration Reference"
|
||||
},
|
||||
@@ -392,12 +392,12 @@ const toc = [
|
||||
level: 3
|
||||
},
|
||||
{
|
||||
value: 'Bring your own launch template',
|
||||
id: 'bring-your-own-launch-template',
|
||||
value: 'User-provided Launch Templates',
|
||||
id: 'user-provided-launch-templates',
|
||||
level: 4
|
||||
},
|
||||
{
|
||||
value: 'Rancher-managed launch templates',
|
||||
value: 'Rancher-managed Launch Templates',
|
||||
id: 'rancher-managed-launch-templates',
|
||||
level: 4
|
||||
},
|
||||
@@ -610,8 +610,8 @@ function MDXContent(_param) {
|
||||
parentName: "p",
|
||||
"href": "https://docs.aws.amazon.com/eks/latest/userguide/managed-node-groups.html"
|
||||
}, `EKS documentation.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
|
||||
"id": "bring-your-own-launch-template"
|
||||
}, `Bring your own launch template`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `A launch template ID and version can be provided in order to easily configure the EC2 instances in a node group. If a launch template is provided, then none of the settings below will be configurable in Rancher. Therefore, using a launch template would require that all the necessary and desired settings from the list below would need to be specified in the launch template. Also note that if a launch template ID and version is provided, then only the template version can be updated. Using a new template ID would require creating a new managed node group.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("table", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("thead", {
|
||||
"id": "user-provided-launch-templates"
|
||||
}, `User-provided Launch Templates`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `You can provide your own launch template ID and version to configure the EC2 instances in a node group. If you provide the launch template, none of the template settings will be configurable from Rancher. You must set all of the required options listed below in your launch template.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Also, if you provide the launch template, you can only update the template version, not the template ID. To use a new template ID, create a new managed node group.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("table", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("thead", {
|
||||
parentName: "table"
|
||||
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("tr", {
|
||||
parentName: "thead"
|
||||
@@ -698,12 +698,12 @@ function MDXContent(_param) {
|
||||
}, `Instance Resource Tags`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
|
||||
parentName: "tr",
|
||||
"align": null
|
||||
}, `Tag each EC2 instance in the node group`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
|
||||
}, `Tag each EC2 instance and its volumes in the node group`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
|
||||
parentName: "tr",
|
||||
"align": null
|
||||
}, `Optional`)))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
|
||||
"id": "rancher-managed-launch-templates"
|
||||
}, `Rancher-managed launch templates`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `If you do not specify a launch template, then you will be able to configure the above options in the Rancher UI and all of them can be updated after creation. In order to take advantage of all of these options, Rancher will create and manage a launch template for you. Each cluster in Rancher will have one Rancher-managed launch template and each managed node group that does not have a specified launch template will have one version of the managed launch template. The name of this launch template will have the prefix "rancher-managed-lt-" followed by the display name of the cluster. In addition, the Rancher-managed launch template will be tagged with the key "rancher-managed-template" and value "do-not-modify-or-delete" to help identify it as Rancher-managed. It is important that this launch template and its versions not be modified, deleted, or used with any other clusters or managed node groups. Doing so could result in your node groups being "degraded" and needing to be destroyed and recreated.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
|
||||
}, `Rancher-managed Launch Templates`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `If you do not specify a launch template, then you will be able to configure the above options in the Rancher UI and all of them can be updated after creation. In order to take advantage of all of these options, Rancher will create and manage a launch template for you. Each cluster in Rancher will have one Rancher-managed launch template and each managed node group that does not have a specified launch template will have one version of the managed launch template. The name of this launch template will have the prefix "rancher-managed-lt-" followed by the display name of the cluster. In addition, the Rancher-managed launch template will be tagged with the key "rancher-managed-template" and value "do-not-modify-or-delete" to help identify it as Rancher-managed. It is important that this launch template and its versions not be modified, deleted, or used with any other clusters or managed node groups. Doing so could result in your node groups being "degraded" and needing to be destroyed and recreated.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
|
||||
"id": "custom-amis"
|
||||
}, `Custom AMIs`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `If you specify a custom AMI, whether in a launch template or in Rancher, then the image must be `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
||||
parentName: "p",
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
@@ -12,7 +12,7 @@
|
||||
|
||||
<script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" charset="UTF-8" data-domain-script="0f98beb0-fc4c-417d-a42e-564e2cae42d2" async></script>
|
||||
<script src="/scripts/optanonwrapper.js" async></script><link rel="stylesheet" href="/assets/css/styles.efd70281.css">
|
||||
<link rel="preload" href="/assets/js/runtime~main.34041f6f.js" as="script">
|
||||
<link rel="preload" href="/assets/js/runtime~main.c4ddb06c.js" as="script">
|
||||
<link rel="preload" href="/assets/js/main.dc85dcc0.js" as="script">
|
||||
</head>
|
||||
<body class="navigation-with-keyboard">
|
||||
@@ -26,7 +26,7 @@ will assign a resource quota that has a <strong>zero</strong> amount for any res
|
||||
requested quota limit, use the <code>field.cattle.io/resourceQuota</code> annotation.</p><p>Note that Rancher will only override limits for resources that are defined on the project quota.</p><div class="codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-text codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">apiVersion: v1</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">kind: Namespace</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">metadata:</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> annotations:</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> field.cattle.io/projectId: [your-cluster-ID]:[your-project-ID]</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> field.cattle.io/resourceQuota: '{"limit":{"limitsCpu":"100m", "configMaps": "50"}}'</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> name: my-ns</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>In this example, if the project's quota does not include configMaps in its list of resources, then Rancher will ignore <code>configMaps</code> in this override.</p><p>Users are advised to create dedicated <code>ResourceQuota</code> objects in namespaces to configure additional custom limits for resources not defined on the project.
|
||||
Resource quotas are native Kubernetes objects, and Rancher will ignore user-defined quotas in namespaces belonging to a project with a quota,
|
||||
thus giving users more control.</p><p>The following table explains the key differences between the two quota types.</p><table><thead><tr><th>Rancher Resource Quotas</th><th>Kubernetes Resource Quotas</th></tr></thead><tbody><tr><td>Applies to projects and namespace.</td><td>Applies to namespaces only.</td></tr><tr><td>Creates resource pool for all namespaces in project.</td><td>Applies static resource limits to individual namespaces.</td></tr><tr><td>Applies resource quotas to namespaces through propagation.</td><td>Applies only to the assigned namespace.</td></tr></tbody></table></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/rancher/rancher-docs/edit/main/docs/how-to-guides/advanced-user-guides/manage-projects/manage-project-resource-quotas/about-project-resource-quotas.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_Z9Sw" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_vwxv"><span class="theme-last-updated">Last updated<!-- --> on <b><time datetime="2023-08-25T18:07:44.000Z">Aug 25, 2023</time></b></span></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><a class="pagination-nav__link pagination-nav__link--prev" href="/pages-for-subheaders/manage-project-resource-quotas"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Project Resource Quotas</div></a><a class="pagination-nav__link pagination-nav__link--next" href="/how-to-guides/advanced-user-guides/manage-projects/manage-project-resource-quotas/override-default-limit-in-namespaces"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Overriding the Default Limit for a Namespace</div></a></nav></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2023 SUSE Rancher. All Rights Reserved.</div></div></div></footer></div>
|
||||
<script src="/assets/js/runtime~main.34041f6f.js"></script>
|
||||
<script src="/assets/js/runtime~main.c4ddb06c.js"></script>
|
||||
<script src="/assets/js/main.dc85dcc0.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
+2
-2
File diff suppressed because one or more lines are too long
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user