mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-26 13:08:11 +00:00
Merge remote-tracking branch 'upstream/main' into discourage_third_party_sw
This commit is contained in:
Billy Tat
@@ -15,4 +15,4 @@ At this time, not all Rancher resources are available through the Rancher Kubern
|
||||
|
||||
import ApiDocMdx from '@theme/ApiDocMdx';
|
||||
|
||||
<ApiDocMdx id="rancher-api" />
|
||||
<ApiDocMdx id="rancher-api-v2-11" />
|
||||
|
||||
@@ -16,6 +16,7 @@ Rancher will publish deprecated features as part of the [release notes](https://
|
||||
|
||||
| Patch Version | Release Date |
|
||||
|---------------|---------------|
|
||||
| [2.11.3](https://github.com/rancher/rancher/releases/tag/v2.11.3) | June 25, 2025 |
|
||||
| [2.11.2](https://github.com/rancher/rancher/releases/tag/v2.11.2) | May 22, 2025 |
|
||||
| [2.11.1](https://github.com/rancher/rancher/releases/tag/v2.11.1) | Apr 24, 2025 |
|
||||
| [2.11.0](https://github.com/rancher/rancher/releases/tag/v2.11.0) | Mar 31, 2025 |
|
||||
|
||||
+19
-2
@@ -212,10 +212,11 @@ If you are using a Private CA signed certificate (or if `agent-tls-mode` is set
|
||||
|
||||
Your load balancer must support long lived websocket connections and will need to insert proxy headers so Rancher can route links correctly.
|
||||
|
||||
### Configuring Ingress for External TLS when Using NGINX v0.25
|
||||
### Configuring Ingress for External TLS when Using NGINX v0.22
|
||||
|
||||
In NGINX v0.25, the behavior of NGINX has [changed](https://github.com/kubernetes/ingress-nginx/blob/master/Changelog.md#0220) regarding forwarding headers and external TLS termination. Therefore, in the scenario that you are using external TLS termination configuration with NGINX v0.25, you must edit the `cluster.yml` to enable the `use-forwarded-headers` option for ingress:
|
||||
In NGINX v0.22, the behavior of NGINX has [changed](https://github.com/kubernetes/ingress-nginx/blob/06efac9f0b6f8f84b553f58ccecf79dc42c75cc6/Changelog.md) regarding forwarding headers and external TLS termination. Therefore, in the scenario that you are using external TLS termination configuration with NGINX v0.22, you must enable the `use-forwarded-headers` option for ingress:
|
||||
|
||||
For RKE installations, edit the `cluster.yml` to add the following settings.
|
||||
```yaml
|
||||
ingress:
|
||||
provider: nginx
|
||||
@@ -223,6 +224,22 @@ ingress:
|
||||
use-forwarded-headers: 'true'
|
||||
```
|
||||
|
||||
For RKE2 installations, you can create a custom `rke2-ingress-nginx-config.yaml` file at `/var/lib/rancher/rke2/server/manifests/rke2-ingress-nginx-config.yaml` containing this required setting to enable using forwarded headers with external TLS termination. Without this required setting applied, the external LB will continuously respond with redirect loops it receives from the ingress controller. (This can be created before or after rancher is installed, rke2 server agent will notice this addition and automatically apply it.)
|
||||
|
||||
```yaml
|
||||
---
|
||||
apiVersion: helm.cattle.io/v1
|
||||
kind: HelmChartConfig
|
||||
metadata:
|
||||
name: rke2-ingress-nginx
|
||||
namespace: kube-system
|
||||
spec:
|
||||
valuesContent: |-
|
||||
controller:
|
||||
config:
|
||||
use-forwarded-headers: "true"
|
||||
```
|
||||
|
||||
### Required Headers
|
||||
|
||||
- `Host`
|
||||
|
||||
+1
-1
@@ -7,7 +7,7 @@ title: ClusterRole Aggregation
|
||||
</head>
|
||||
|
||||
:::caution
|
||||
ClusterRole aggregation is a highly experimental feature that changes the RBAC architecture used for RoleTemplates, ClusterRoleTemplateBindings and ProjectRoleTemplateBindings. **It is not supported for production environments**. This feature is meant exclusively for internal testing in v2.11. It is expected to be available as a beta for users in v2.12 with a prospective GA in Rancher v2.13.
|
||||
ClusterRole aggregation is a highly experimental feature that changes the RBAC architecture used for RoleTemplates, ClusterRoleTemplateBindings and ProjectRoleTemplateBindings. **It is not supported for production environments**. This feature is meant exclusively for internal testing in v2.11 and v2.12. It is expected to be available as a beta for users in v2.13.
|
||||
:::
|
||||
|
||||
ClusterRole aggregation implements RoleTemplates, ClusterRoleTemplateBindings and ProjectRoleTemplateBindings using the Kubernetes feature [Aggregated ClusterRoles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles). The new architecture results in a net reduction in RBAC objects (Roles, RoleBindings, ClusterRoles and ClusterRoleBindings) both in the Rancher cluster and the downstream clusters.
|
||||
|
||||
+6
@@ -100,6 +100,12 @@ For details on which Kubernetes resources correspond to each global permission,
|
||||
|
||||
:::
|
||||
|
||||
:::danger
|
||||
|
||||
The built-in GlobalRole `Manage Users` allows users to create, modify and delete other users within the Rancher environment. While this permission may be necessary for administrative workflows in trusted environments, granting it to non-trusted or lower-privileged users, such as standard users, poses a serious security risk and may result in privilege escalation.
|
||||
|
||||
:::
|
||||
|
||||
### Custom GlobalRoles
|
||||
|
||||
You can create custom GlobalRoles to satisfy use cases not directly addressed by built-in GlobalRoles.
|
||||
|
||||
+1
@@ -120,6 +120,7 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit
|
||||
- `cert-manager`
|
||||
- `cis-operator-system`
|
||||
- `fleet-default`
|
||||
- `fleet-local`
|
||||
- `ingress-nginx`
|
||||
- `istio-system`
|
||||
- `kube-node-lease`
|
||||
|
||||
+2
-22
@@ -42,26 +42,6 @@ To display prerelease versions:
|
||||
1. Click **Preferences**.
|
||||
1. Under **Helm Charts**, select **Include Prerelease Versions**.
|
||||
|
||||
### Feature Charts
|
||||
|
||||
| **Name** | **Supported Minimum Version** | **Supported Maximum Version** |
|
||||
| ---------------- | ------------ | ------------ |
|
||||
| external-ip-webhook | 100.0.0+up1.0.0 | 100.0.1+up1.0.1 |
|
||||
| harvester-cloud-provider | 100.0.2+up0.1.12 | 100.0.2+up0.1.12 |
|
||||
| harvester-csi-driver | 100.0.2+up0.1.11 | 100.0.2+up0.1.11 |
|
||||
| neuvector | 100.0.0+up2.2.0 | 100.0.0+up2.2.0 |
|
||||
| rancher-alerting-drivers | 100.0.0 | 100.0.2 |
|
||||
| rancher-backup | 2.0.1 | 2.1.2 |
|
||||
| rancher-cis-benchmark | 2.0.1 | 2.0.4 |
|
||||
| rancher-istio | 105.0.0+up1.19.6 | 105.4.0+up1.23.2 |
|
||||
| rancher-logging | 100.0.0+up3.12.0 | 100.1.2+up3.17.4 |
|
||||
| rancher-longhorn | 100.0.0+up1.1.2 | 100.1.2+up1.2.4 |
|
||||
| rancher-monitoring | 100.0.0+up16.6.0 | 100.1.2+up19.0.3 |
|
||||
| rancher-sriov<sup>[1](#sriov-chart-deprecation-and-migration)</sup> | 100.0.0+up0.1.0 | 100.0.3+up0.1.0 |
|
||||
| rancher-vsphere-cpi | 100.3.0+up1.2.1 | 100.3.0+up1.2.1 |
|
||||
| rancher-vsphere-csi | 100.3.0+up2.5.1-rancher1 | 100.3.0+up2.5.1-rancher1 |
|
||||
| rancher-wins-upgrader | 0.0.100 | 100.0.1+up0.0.1 |
|
||||
|
||||
## Access Charts
|
||||
|
||||
The **Charts** page contains all Rancher, Partner, and Custom charts. You can filter charts by selecting the left-most dropdown menu:
|
||||
@@ -236,7 +216,7 @@ Rancher and Partner charts may have extra configurations available through custo
|
||||
|
||||
To view all recent changes, click **Apps > Recent Operations** in the left navigation menu. From there you can view the calls, conditions, events, and logs.
|
||||
|
||||
After installing a chart, you can view it by clicking **Apps > Installed Apps** in the left navigation menu. You can upgrade or delete the installation, and see further details. Upgrading uses the same forms and values as you saw during inital installation.
|
||||
After installing a chart, you can view it by clicking **Apps > Installed Apps** in the left navigation menu. You can upgrade or delete the installation, and see further details. Upgrading uses the same forms and values as you saw during initial installation.
|
||||
|
||||
Most Rancher tools have additional pages located in the toolbar below the **Apps** section to help manage and use the features. These pages include links to dashboards, forms to easily add Custom Resources, and additional information.
|
||||
|
||||
@@ -295,4 +275,4 @@ To migrate, follow these steps:
|
||||
- When determining the most recent version to display for the **Upgradable** column on the **Apps > Installed Apps** page, rather than only considering versions of the Helm chart from the repository it was installed from, Rancher considers versions of the Helm chart from all repositories on the cluster.
|
||||
|
||||
For example, suppose you install `cert-manager` v1.13.0 from repository A, where v1.14.0 is now the most recent version available. In this case, you expect **Upgradable** to display v1.14.0. However, if the cluster also has access to repository B where v1.15.0 of `cert-manager` is available, then **Upgradable** displays v1.15.0 even though the original installation used repository A.
|
||||
|
||||
|
||||
|
||||
+3
-3
@@ -18,7 +18,7 @@ Listed below are the primary RKE2 features for Windows cluster provisioning:
|
||||
|
||||
- Windows Containers with RKE2 powered by containerd
|
||||
- Added provisioning of Windows RKE2 custom clusters directly from the Rancher UI
|
||||
- Calico CNI for Windows RKE2 custom clusters
|
||||
- Calico and Flannel CNI for Windows RKE2 custom clusters
|
||||
- SAC releases of Windows Server (2004 and 20H2) are included in the technical preview
|
||||
|
||||
:::note
|
||||
@@ -57,7 +57,7 @@ Rancher will not provision the node if the node does not meet these requirements
|
||||
|
||||
Before provisioning a new cluster, be sure that you have already installed Rancher on a device that accepts inbound network traffic. This is required in order for the cluster nodes to communicate with Rancher. If you have not already installed Rancher, please refer to the [installation documentation](../../../../getting-started/installation-and-upgrade/installation-and-upgrade.md) before proceeding with this guide.
|
||||
|
||||
Rancher supports Windows using Calico as the network provider.
|
||||
Rancher supports Windows using Calico and Flannel as network providers.
|
||||
|
||||
If you are configuring DHCP options sets for an AWS virtual private cloud, note that in the `domain-name` option field, only one domain name can be specified. According to the DHCP options [documentation:](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_DHCP_Options.html)
|
||||
|
||||
@@ -163,7 +163,7 @@ The instructions for creating a Windows cluster on existing nodes are very simil
|
||||
1. Click **Custom**.
|
||||
1. Enter a name for your cluster in the **Cluster Name** field.
|
||||
1. In the **Kubernetes Version** dropdown menu, select a supported Kubernetes version.
|
||||
1. In the **Container Network** field, select **Calico**.
|
||||
1. In the **Container Network** field, select either **Calico** or **Flannel**.
|
||||
1. Click **Next**.
|
||||
|
||||
### 3. Add Nodes to the Cluster
|
||||
|
||||
+1
-1
@@ -65,7 +65,7 @@ RKE2 provisioning also includes installing RKE2 on clusters with Windows nodes.
|
||||
Windows features for RKE2 include:
|
||||
|
||||
- Windows supports the vSphere node driver
|
||||
- Calico CNI for Windows RKE2 custom clusters
|
||||
- Calico and Flannel CNI for Windows RKE2 custom clusters
|
||||
- Project Network Isolation (PNI) for Calico
|
||||
- Windows Containers with RKE2 powered by containerd
|
||||
- Provisioning of Windows RKE2 clusters through Terraform
|
||||
|
||||
+1
@@ -19,6 +19,7 @@ In order to deploy and run the adapter successfully, you need to ensure its vers
|
||||
|
||||
| Rancher Version | Adapter Version |
|
||||
|-----------------|------------------|
|
||||
| v2.11.3 | v106.0.0+up6.0.0 |
|
||||
| v2.11.2 | v106.0.0+up6.0.0 |
|
||||
| v2.11.1 | v106.0.0+up6.0.0 |
|
||||
| v2.11.0 | v106.0.0+up6.0.0 |
|
||||
|
||||
@@ -26,7 +26,7 @@ Users can leverage continuous delivery to deploy their applications to the Kuber
|
||||
|
||||
Follow the steps below to access Continuous Delivery in the Rancher UI:
|
||||
|
||||
1. Click **☰ > Continous Delivery**.
|
||||
1. Click **☰ > Continuous Delivery**.
|
||||
|
||||
1. Select your namespace at the top of the menu, noting the following:
|
||||
|
||||
|
||||
@@ -55,6 +55,37 @@ For help with configuring `Flows` and `ClusterFlows`, see [this page.](custom-re
|
||||
|
||||
For help with configuring `Outputs` and `ClusterOutputs`, see [this page.](custom-resource-configuration/outputs-and-clusteroutputs.md)
|
||||
|
||||
## Using a custom HostTailer image
|
||||
|
||||
To use a custom image for the `HostTailer` resource, you need to specify the image in the `containerOverrides` section of each `fileTailer` of the `HostTailer` resource.
|
||||
|
||||
```yaml
|
||||
apiVersion: logging-extensions.banzaicloud.io/v1alpha1
|
||||
kind: HostTailer
|
||||
metadata:
|
||||
name: cluster-system-log
|
||||
spec:
|
||||
workloadMetaOverrides:
|
||||
annotations: {}
|
||||
labels: {}
|
||||
fileTailers:
|
||||
- disabled: false
|
||||
name: kubelet-log
|
||||
path: /var/lib/rancher/rke2/agent/logs/*.log
|
||||
containerOverrides:
|
||||
image: <your_registry>/<your_image>:<your_tag>
|
||||
- disabled: false
|
||||
name: containerd-log
|
||||
path: /var/lib/rancher/rke2/agent/containerd/*.log
|
||||
containerOverrides:
|
||||
image: <your_registry>/<your_image>:<your_tag>
|
||||
- name: kube-audit
|
||||
path: /var/log/kube-audit/audit-log.json
|
||||
disabled: false
|
||||
containerOverrides:
|
||||
image: <your_registry>/<your_image>:<your_tag>
|
||||
```
|
||||
|
||||
## Configuring the Logging Helm Chart
|
||||
|
||||
For a list of options that can be configured when the logging application is installed or upgraded, see [this page.](logging-helm-chart-options.md)
|
||||
|
||||
@@ -20,6 +20,7 @@ Each Rancher version is designed to be compatible with a single version of the w
|
||||
|
||||
| Rancher Version | Webhook Version | Availability in Prime | Availability in Community |
|
||||
|-----------------|-----------------|-----------------------|---------------------------|
|
||||
| v2.11.3 | v0.7.3 | ✓ | ✓ |
|
||||
| v2.11.2 | v0.7.2 | ✓ | ✓ |
|
||||
| v2.11.1 | v0.7.1 | ✓ | ✓ |
|
||||
| v2.11.0 | v0.7.0 | ✗ | ✓ |
|
||||
|
||||
Reference in New Issue
Block a user