From b014afd41a232395bf50a5170ad7b439b763d489 Mon Sep 17 00:00:00 2001 From: Nick Gerace Date: Wed, 17 Feb 2021 19:27:17 -0500 Subject: [PATCH 1/4] Add dockerRootDirectory to logging --- content/rancher/v2.x/en/logging/v2.5/_index.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/content/rancher/v2.x/en/logging/v2.5/_index.md b/content/rancher/v2.x/en/logging/v2.5/_index.md index 01771387ab4..a84570df8e4 100644 --- a/content/rancher/v2.x/en/logging/v2.5/_index.md +++ b/content/rancher/v2.x/en/logging/v2.5/_index.md @@ -276,6 +276,11 @@ Let's break down what is happening here. First, we create a deployment of a cont > **Note on syslog** Official `syslog` support is coming in Rancher v2.5.4. However, this example still provides an overview on using unsupported plugins. +# Working with a Custom Docker Root Directory + +If using a custom Docker root directory, you can set `global.dockerRootDirectory` in `values.yaml`. +This will ensure that the Logging CRs created will use your specified path rather than the default Docker `data-root` location. + # Working with Taints and Tolerations "Tainting" a Kubernetes node causes pods to repel running on that node. From d05764867fc10cd506894a6a80d6b34f03e8cea9 Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Fri, 12 Feb 2021 18:58:06 -0700 Subject: [PATCH 2/4] Update restricted-admin permissions for Rancher v2.5.6 --- .../rbac/global-permissions/_index.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/content/rancher/v2.5/en/admin-settings/rbac/global-permissions/_index.md b/content/rancher/v2.5/en/admin-settings/rbac/global-permissions/_index.md index acb01dce836..c9b0b19803b 100644 --- a/content/rancher/v2.5/en/admin-settings/rbac/global-permissions/_index.md +++ b/content/rancher/v2.5/en/admin-settings/rbac/global-permissions/_index.md @@ -43,6 +43,20 @@ CATTLE_RESTRICTED_DEFAULT_ADMIN=true ``` ### List of `restricted-admin` Permissions +The permissions for the `restricted-admin` role differ based on the Rancher version. + +{{% tabs %}} +{{% tab "v2.5.6" %}} + +The `restricted-admin` permissions are as follows: + +- Has full admin access to all downstream clusters managed by Rancher. +- Can add other users and assign them to clusters outside of the local cluster. +- Can create other restricted admins. + +{{% /tab %}} +{{% tab "v2.5.0-v2.5.5" %}} + The `restricted-admin` permissions are as follows: - Has full admin access to all downstream clusters managed by Rancher. @@ -51,6 +65,9 @@ The `restricted-admin` permissions are as follows: - Can create other restricted admins. - Cannot grant any permissions in the local cluster they don't currently have. (This is how Kubernetes normally operates) +{{% /tab %}} +{{% /tabs %}} + ### Upgrading from Rancher with a Hidden Local Cluster Prior to Rancher v2.5, it was possible to run the Rancher server using this flag to hide the local cluster: From 8815dd9454fb3a008f30ae60eefcdd3893053f36 Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Wed, 17 Feb 2021 21:10:42 -0700 Subject: [PATCH 3/4] Istio CPU / Memory Usage updates #2999 --- .../rancher/v2.5/en/istio/resources/_index.md | 33 +++++++++++++---- .../v2.x/en/istio/v2.5/resources/_index.md | 35 ++++++++++++++----- 2 files changed, 53 insertions(+), 15 deletions(-) diff --git a/content/rancher/v2.5/en/istio/resources/_index.md b/content/rancher/v2.5/en/istio/resources/_index.md index fba30f972b7..0a4bdd57f17 100644 --- a/content/rancher/v2.5/en/istio/resources/_index.md +++ b/content/rancher/v2.5/en/istio/resources/_index.md @@ -20,14 +20,33 @@ The table below shows a summary of the minimum recommended resource requests and In Kubernetes, the resource request indicates that the workload will not deployed on a node unless the node has at least the specified amount of memory and CPU available. If the workload surpasses the limit for CPU or memory, it can be terminated or evicted from the node. For more information on managing resource limits for containers, refer to the [Kubernetes documentation.](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/) -Workload | CPU - Request | Mem - Request | CPU - Limit | Mem - Limit | Configurable +{{% tabs %}} +{{% tab "v2.5.6+" %}} + +| Workload | CPU - Request | Memory - Request | CPU - Limit | Memory - Limit | +|----------------------|---------------|------------|-----------------|-------------------| +| ingress gateway | 100m | 128mi | 2000m | 1024mi | +| egress gateway | 100m | 128mi | 2000m | 1024mi | +| istiod | 500m | 2048mi | | | +| proxy | 10m | 10mi | 2000m | 1024mi | +| **Totals:** | **710m** | **2314Mi** | **6000m** | **3072Mi** | + +{{% /tab %}} +{{% tab "v2.5.0-v2.5.5" %}} + +Workload | CPU - Request | Memory - Request | CPU - Limit | Mem - Limit | Configurable ---------:|---------------:|---------------:|-------------:|-------------:|-------------: -Istiod | 610m | 2186Mi | 4000m | 2048Mi | Y | Y -Istio-policy | 1000m | 1024Mi | 4800m | 4096Mi | Y -Istio-telemetry | 1000m | 10214Mi | 4800m | 4096Mi | Y -Istio-ingressgateway | 2000m | 1024Mi | 10m | 40Mi | Y -Others | 500m | 500Mi | - | - | Y -**Total** | **4500m** | **5620Mi** | **>12300m** | **>14848Mi** | **-** +Istiod | 610m | 2186Mi | 4000m | 2048Mi | Y | +Istio-policy | 1000m | 1024Mi | 4800m | 4096Mi | Y | +Istio-telemetry | 1000m | 10214Mi | 4800m | 4096Mi | Y | +Istio-ingressgateway | 2000m | 1024Mi | 10m | 40Mi | Y | +Others | 500m | 500Mi | - | - | Y | +**Totals:** | **4500m** | **5620Mi** | **>12300m** | **>14848Mi** | **-** + +{{% /tab %}} +{{% /tabs %}} + + # Configuring Resource Allocations diff --git a/content/rancher/v2.x/en/istio/v2.5/resources/_index.md b/content/rancher/v2.x/en/istio/v2.5/resources/_index.md index 19dde46e0d2..4654d7d1a8c 100644 --- a/content/rancher/v2.x/en/istio/v2.5/resources/_index.md +++ b/content/rancher/v2.x/en/istio/v2.5/resources/_index.md @@ -7,7 +7,7 @@ aliases: - /rancher/v2.x/en/cluster-admin/tools/istio/resources - /rancher/v2.x/en/istio/resources --- -_This section applies to Istio in Rancher v2.5.0. If you are using Rancher v2.4.x, refer to [this section.]({{}}/rancher/v2.x/en/cluster-admin/tools/istio/)_ +_This section applies to Istio in Rancher v2.5.x. If you are using Rancher v2.4.x, refer to [this section.]({{}}/rancher/v2.x/en/cluster-admin/tools/istio/)_ This section describes the minimum recommended computing resources for the Istio components in a cluster. @@ -21,14 +21,33 @@ The table below shows a summary of the minimum recommended resource requests and In Kubernetes, the resource request indicates that the workload will not deployed on a node unless the node has at least the specified amount of memory and CPU available. If the workload surpasses the limit for CPU or memory, it can be terminated or evicted from the node. For more information on managing resource limits for containers, refer to the [Kubernetes documentation.](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/) -Workload | CPU - Request | Mem - Request | CPU - Limit | Mem - Limit | Configurable +{{% tabs %}} +{{% tab "v2.5.6+" %}} + +| Workload | CPU - Request | Memory - Request | CPU - Limit | Memory - Limit | +|----------------------|---------------|------------|-----------------|-------------------| +| ingress gateway | 100m | 128mi | 2000m | 1024mi | +| egress gateway | 100m | 128mi | 2000m | 1024mi | +| istiod | 500m | 2048mi | | | +| proxy | 10m | 10mi | 2000m | 1024mi | +| **Totals:** | **710m** | **2314Mi** | **6000m** | **3072Mi** | + +{{% /tab %}} +{{% tab "v2.5.0-v2.5.5" %}} + +Workload | CPU - Request | Memory - Request | CPU - Limit | Mem - Limit | Configurable ---------:|---------------:|---------------:|-------------:|-------------:|-------------: -Istiod | 610m | 2186Mi | 4000m | 2048Mi | Y | Y -Istio-policy | 1000m | 1024Mi | 4800m | 4096Mi | Y -Istio-telemetry | 1000m | 10214Mi | 4800m | 4096Mi | Y -Istio-ingressgateway | 2000m | 1024Mi | 10m | 40Mi | Y -Others | 500m | 500Mi | - | - | Y -**Total** | **4500m** | **5620Mi** | **>12300m** | **>14848Mi** | **-** +Istiod | 610m | 2186Mi | 4000m | 2048Mi | Y | +Istio-policy | 1000m | 1024Mi | 4800m | 4096Mi | Y | +Istio-telemetry | 1000m | 10214Mi | 4800m | 4096Mi | Y | +Istio-ingressgateway | 2000m | 1024Mi | 10m | 40Mi | Y | +Others | 500m | 500Mi | - | - | Y | +**Totals:** | **4500m** | **5620Mi** | **>12300m** | **>14848Mi** | **-** + +{{% /tab %}} +{{% /tabs %}} + + # Configuring Resource Allocations From 84f908742f7ce0e0e8c1a1a34c4c69843591019c Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Thu, 18 Feb 2021 16:49:09 -0700 Subject: [PATCH 4/4] Add dockerRootDirectory to logging in versioned docs #3044 --- content/rancher/v2.5/en/logging/_index.md | 7 +++++++ content/rancher/v2.x/en/logging/v2.5/_index.md | 2 ++ 2 files changed, 9 insertions(+) diff --git a/content/rancher/v2.5/en/logging/_index.md b/content/rancher/v2.5/en/logging/_index.md index e6cb389914c..a5303c9f620 100644 --- a/content/rancher/v2.5/en/logging/_index.md +++ b/content/rancher/v2.5/en/logging/_index.md @@ -314,6 +314,13 @@ spec: In the above example, we ensure that our pod only runs on Linux nodes, and we add a `toleration` for the taint we have on all of our Linux nodes. You can do the same with Rancher's existing taints, or with your own custom ones. +# Working with a Custom Docker Root Directory + +_Applies to v2.5.6+_ + +If using a custom Docker root directory, you can set `global.dockerRootDirectory` in `values.yaml`. +This will ensure that the Logging CRs created will use your specified path rather than the default Docker `data-root` location. + ### Windows Support Clusters with Windows workers support exporting logs from Linux nodes, but Windows node logs are currently unable to be exported. diff --git a/content/rancher/v2.x/en/logging/v2.5/_index.md b/content/rancher/v2.x/en/logging/v2.5/_index.md index a84570df8e4..6ea1e23b884 100644 --- a/content/rancher/v2.x/en/logging/v2.5/_index.md +++ b/content/rancher/v2.x/en/logging/v2.5/_index.md @@ -278,6 +278,8 @@ Let's break down what is happening here. First, we create a deployment of a cont # Working with a Custom Docker Root Directory +_Applies to v2.5.6+_ + If using a custom Docker root directory, you can set `global.dockerRootDirectory` in `values.yaml`. This will ensure that the Logging CRs created will use your specified path rather than the default Docker `data-root` location.