From f64e0a51dde5b39c46d876a2255f3d77c54c4d32 Mon Sep 17 00:00:00 2001 From: Frank Murphy Date: Thu, 27 Apr 2023 10:32:56 -0400 Subject: [PATCH 1/5] Update install guide to cover PSP.enabled flag for K8s v1.25 Added callout to include --set global.cattle.psp.enabled=false to Helm install command for K8s v1.25 or greater. Also removed stale CertManager reference and updated --version example to show a more recent Rancher version. --- ...install-upgrade-on-a-kubernetes-cluster.md | 26 ++++++++++++++----- 1 file changed, 19 insertions(+), 7 deletions(-) diff --git a/docs/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md b/docs/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md index 9207802bc03..ab1f80aa3f3 100644 --- a/docs/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md +++ b/docs/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md @@ -122,12 +122,6 @@ There are three recommended options for the source of the certificate used for T ### 4. Install cert-manager -:::note - -New in v2.6.4, cert-manager versions 1.6.2 and 1.7.1 are compatible. We recommend v1.7.x because v 1.6.x will reach end-of-life on March 30, 2022. - -::: - > You should skip this step if you are bringing your own certificate files (option `ingress.tls.source=secret`), or if you use [TLS termination on an external load balancer](../getting-started/installation-and-upgrade/installation-references/helm-chart-options.md#external-tls-termination). This step is only required to use certificates issued by Rancher's generated CA (`ingress.tls.source=rancher`) or to request Let's Encrypt issued certificates (`ingress.tls.source=letsEncrypt`). @@ -200,7 +194,13 @@ Because `rancher` is the default option for `ingress.tls.source`, we are not spe - Set the `hostname` to the DNS name you pointed at your load balancer. - Set the `bootstrapPassword` to something unique for the `admin` user. -- To install a specific Rancher version, use the `--version` flag, example: `--version 2.3.6` +- To install a specific Rancher version, use the `--version` flag, example: `--version 2.7.0` + +:::note + +If installing on Kubernetes >= v1.25, you must add '--set global.cattle.psp.enabled=false' to your Helm install command + +::: ``` helm install rancher rancher-/rancher \ @@ -242,6 +242,12 @@ In the following command, - `letsEncrypt.email` is set to the email address used for communication about your certificate (for example, expiry notices) - Set `letsEncrypt.ingress.class` to whatever your ingress controller is, e.g., `traefik`, `nginx`, `haproxy`, etc. +:::note + +If installing on Kubernetes >= v1.25, you must add '--set global.cattle.psp.enabled=false' to your Helm install command + +::: + ``` helm install rancher rancher-/rancher \ --namespace cattle-system \ @@ -284,6 +290,12 @@ If you want to check if your certificates are correct, see [How do I check Commo - Set the `bootstrapPassword` to something unique for the `admin` user. - Set `ingress.tls.source` to `secret`. +:::note + +If installing on Kubernetes >= v1.25, you must add '--set global.cattle.psp.enabled=false' to your Helm install command + +::: + ``` helm install rancher rancher-/rancher \ --namespace cattle-system \ From 5815783e2ac4bdf70995ed4bf096801c46635f5d Mon Sep 17 00:00:00 2001 From: Frank Murphy Date: Fri, 28 Apr 2023 08:26:19 -0400 Subject: [PATCH 2/5] Update docs/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md Co-authored-by: Marty Hernandez Avedon --- .../install-upgrade-on-a-kubernetes-cluster.md | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/docs/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md b/docs/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md index ab1f80aa3f3..2b4b5861894 100644 --- a/docs/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md +++ b/docs/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md @@ -196,11 +196,7 @@ Because `rancher` is the default option for `ingress.tls.source`, we are not spe - Set the `bootstrapPassword` to something unique for the `admin` user. - To install a specific Rancher version, use the `--version` flag, example: `--version 2.7.0` -:::note - -If installing on Kubernetes >= v1.25, you must add '--set global.cattle.psp.enabled=false' to your Helm install command - -::: +- For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false'. ``` helm install rancher rancher-/rancher \ From 1bcf8b183613e3beb8b91ed1374792fe949dfeb0 Mon Sep 17 00:00:00 2001 From: Frank Murphy Date: Fri, 28 Apr 2023 08:26:33 -0400 Subject: [PATCH 3/5] Update docs/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md Co-authored-by: Marty Hernandez Avedon --- .../install-upgrade-on-a-kubernetes-cluster.md | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/docs/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md b/docs/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md index 2b4b5861894..6102332bbf3 100644 --- a/docs/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md +++ b/docs/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md @@ -286,11 +286,7 @@ If you want to check if your certificates are correct, see [How do I check Commo - Set the `bootstrapPassword` to something unique for the `admin` user. - Set `ingress.tls.source` to `secret`. -:::note - -If installing on Kubernetes >= v1.25, you must add '--set global.cattle.psp.enabled=false' to your Helm install command - -::: +- For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false'. ``` helm install rancher rancher-/rancher \ From e27880befec5b2318d2d768818152883d8c72cdd Mon Sep 17 00:00:00 2001 From: Frank Murphy Date: Fri, 28 Apr 2023 08:26:41 -0400 Subject: [PATCH 4/5] Update docs/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md Co-authored-by: Marty Hernandez Avedon --- .../install-upgrade-on-a-kubernetes-cluster.md | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/docs/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md b/docs/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md index 6102332bbf3..8cd51cbdc61 100644 --- a/docs/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md +++ b/docs/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md @@ -238,11 +238,7 @@ In the following command, - `letsEncrypt.email` is set to the email address used for communication about your certificate (for example, expiry notices) - Set `letsEncrypt.ingress.class` to whatever your ingress controller is, e.g., `traefik`, `nginx`, `haproxy`, etc. -:::note - -If installing on Kubernetes >= v1.25, you must add '--set global.cattle.psp.enabled=false' to your Helm install command - -::: +- For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false'. ``` helm install rancher rancher-/rancher \ From ad1035e2ce4505b416a327fb798b5f47599d5a54 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Fri, 28 Apr 2023 14:18:26 -0700 Subject: [PATCH 5/5] Revert cert-manager note removal --- .../install-upgrade-on-a-kubernetes-cluster.md | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/docs/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md b/docs/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md index 8cd51cbdc61..64b9da1b53e 100644 --- a/docs/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md +++ b/docs/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md @@ -122,6 +122,12 @@ There are three recommended options for the source of the certificate used for T ### 4. Install cert-manager +:::note + +New in v2.6.4, cert-manager versions 1.6.2 and 1.7.1 are compatible. We recommend v1.7.x because v 1.6.x will reach end-of-life on March 30, 2022. + +::: + > You should skip this step if you are bringing your own certificate files (option `ingress.tls.source=secret`), or if you use [TLS termination on an external load balancer](../getting-started/installation-and-upgrade/installation-references/helm-chart-options.md#external-tls-termination). This step is only required to use certificates issued by Rancher's generated CA (`ingress.tls.source=rancher`) or to request Let's Encrypt issued certificates (`ingress.tls.source=letsEncrypt`). @@ -195,7 +201,7 @@ Because `rancher` is the default option for `ingress.tls.source`, we are not spe - Set the `hostname` to the DNS name you pointed at your load balancer. - Set the `bootstrapPassword` to something unique for the `admin` user. - To install a specific Rancher version, use the `--version` flag, example: `--version 2.7.0` - + - For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false'. ``` @@ -239,7 +245,7 @@ In the following command, - Set `letsEncrypt.ingress.class` to whatever your ingress controller is, e.g., `traefik`, `nginx`, `haproxy`, etc. - For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false'. - + ``` helm install rancher rancher-/rancher \ --namespace cattle-system \