From c2dd038c3d6607906a9f18db36b76148b01583b3 Mon Sep 17 00:00:00 2001 From: LucasSaintarbor Date: Thu, 11 Jan 2024 10:40:38 -0800 Subject: [PATCH 01/54] Update CLI commands for v2.6 - v2.8 --- .../cli-with-rancher/rancher-cli.md | 13 ++++++++++--- .../cli-with-rancher/rancher-cli.md | 13 ++++++++++--- .../cli-with-rancher/rancher-cli.md | 13 ++++++++++--- .../cli-with-rancher/rancher-cli.md | 13 ++++++++++--- 4 files changed, 40 insertions(+), 12 deletions(-) diff --git a/docs/reference-guides/cli-with-rancher/rancher-cli.md b/docs/reference-guides/cli-with-rancher/rancher-cli.md index 0c9a27c1694..09f2f33f70a 100644 --- a/docs/reference-guides/cli-with-rancher/rancher-cli.md +++ b/docs/reference-guides/cli-with-rancher/rancher-cli.md @@ -68,15 +68,22 @@ The following commands are available for use in Rancher CLI. | `catalog` | Performs operations on [catalogs](../../pages-for-subheaders/helm-charts-in-rancher.md). | | `clusters, [cluster]` | Performs operations on your [clusters](../../pages-for-subheaders/kubernetes-clusters-in-rancher-setup.md). | | `context` | Switches between Rancher [projects](../../how-to-guides/new-user-guides/manage-clusters/projects-and-namespaces.md). For an example, see [Project Selection](#project-selection). | +| `globaldns` | Performs operations on global DNS providers and entries. | | `inspect [OPTIONS] [RESOURCEID RESOURCENAME]` | Displays details about [Kubernetes resources](https://kubernetes.io/docs/reference/kubectl/cheatsheet/#resource-types) or Rancher resources (i.e.: [projects](../../how-to-guides/new-user-guides/manage-clusters/projects-and-namespaces.md) and [workloads](../../pages-for-subheaders/workloads-and-pods.md)). Specify resources by name or ID. | -| `kubectl` |Runs [kubectl commands](https://kubernetes.io/docs/reference/kubectl/overview/#operations). | +| `kubectl` | Runs [kubectl commands](https://kubernetes.io/docs/reference/kubectl/overview/#operations). | | `login, [l]` | Logs into a Rancher Server. For an example, see [CLI Authentication](#cli-authentication). | -| `namespaces, [namespace]` |Performs operations on namespaces. | -| `nodes, [node]` |Performs operations on nodes. | +| machines, [machine] | Performs operations on machines. | +| multiclusterapps, [multiclusterapp mcapps mcapp] | Performs operations with multi-cluster apps. | +| `namespaces, [namespace]` | Performs operations on namespaces. | +| `nodes, [node]` | Performs operations on nodes. | | `projects, [project]` | Performs operations on [projects](../../how-to-guides/new-user-guides/manage-clusters/projects-and-namespaces.md). | | `ps` | Displays [workloads](../../pages-for-subheaders/workloads-and-pods.md) in a project. | +| `server` | Performs operations for the server. | | `settings, [setting]` | Shows the current settings for your Rancher Server. | | `ssh` | Connects to one of your cluster nodes using the SSH protocol. | +| up | Applies compose config. | +| wait | Waits for resoruces clusters, app, project, multiClusterApp. | +| token | Authentictes and generates new kubeconfig token. | | `help, [h]` | Shows a list of commands or help for one command. | diff --git a/versioned_docs/version-2.6/reference-guides/cli-with-rancher/rancher-cli.md b/versioned_docs/version-2.6/reference-guides/cli-with-rancher/rancher-cli.md index 445d2b6446b..a4336208795 100644 --- a/versioned_docs/version-2.6/reference-guides/cli-with-rancher/rancher-cli.md +++ b/versioned_docs/version-2.6/reference-guides/cli-with-rancher/rancher-cli.md @@ -68,15 +68,22 @@ The following commands are available for use in Rancher CLI. | `catalog` | Performs operations on [catalogs](../../pages-for-subheaders/helm-charts-in-rancher.md). | | `clusters, [cluster]` | Performs operations on your [clusters](../../pages-for-subheaders/kubernetes-clusters-in-rancher-setup.md). | | `context` | Switches between Rancher [projects](../../how-to-guides/new-user-guides/manage-clusters/projects-and-namespaces.md). For an example, see [Project Selection](#project-selection). | +| `globaldns` | Performs operations on global DNS providers and entries. | | `inspect [OPTIONS] [RESOURCEID RESOURCENAME]` | Displays details about [Kubernetes resources](https://kubernetes.io/docs/reference/kubectl/cheatsheet/#resource-types) or Rancher resources (i.e.: [projects](../../how-to-guides/new-user-guides/manage-clusters/projects-and-namespaces.md) and [workloads](../../pages-for-subheaders/workloads-and-pods.md)). Specify resources by name or ID. | -| `kubectl` |Runs [kubectl commands](https://kubernetes.io/docs/reference/kubectl/overview/#operations). | +| `kubectl` | Runs [kubectl commands](https://kubernetes.io/docs/reference/kubectl/overview/#operations). | | `login, [l]` | Logs into a Rancher Server. For an example, see [CLI Authentication](#cli-authentication). | -| `namespaces, [namespace]` |Performs operations on namespaces. | -| `nodes, [node]` |Performs operations on nodes. | +| `machines, [machine]` | Operations on machines | +| `multiclusterapps, [multiclusterapp mcapps mcapp]` | Performs operations with multi-cluster apps. | +| `namespaces, [namespace]` | Performs operations on namespaces. | +| `nodes, [node]` | Performs operations on nodes. | | `projects, [project]` | Performs operations on [projects](../../how-to-guides/new-user-guides/manage-clusters/projects-and-namespaces.md). | | `ps` | Displays [workloads](../../pages-for-subheaders/workloads-and-pods.md) in a project. | +| `server` | Performs operations for the server. | | `settings, [setting]` | Shows the current settings for your Rancher Server. | | `ssh` | Connects to one of your cluster nodes using the SSH protocol. | +| up | Applies compose config. | +| wait | Waits for resoruces clusters, app, project, multiClusterApp. | +| token | Authentictes and generates new kubeconfig token. | | `help, [h]` | Shows a list of commands or help for one command. | diff --git a/versioned_docs/version-2.7/reference-guides/cli-with-rancher/rancher-cli.md b/versioned_docs/version-2.7/reference-guides/cli-with-rancher/rancher-cli.md index 0c9a27c1694..09f2f33f70a 100644 --- a/versioned_docs/version-2.7/reference-guides/cli-with-rancher/rancher-cli.md +++ b/versioned_docs/version-2.7/reference-guides/cli-with-rancher/rancher-cli.md @@ -68,15 +68,22 @@ The following commands are available for use in Rancher CLI. | `catalog` | Performs operations on [catalogs](../../pages-for-subheaders/helm-charts-in-rancher.md). | | `clusters, [cluster]` | Performs operations on your [clusters](../../pages-for-subheaders/kubernetes-clusters-in-rancher-setup.md). | | `context` | Switches between Rancher [projects](../../how-to-guides/new-user-guides/manage-clusters/projects-and-namespaces.md). For an example, see [Project Selection](#project-selection). | +| `globaldns` | Performs operations on global DNS providers and entries. | | `inspect [OPTIONS] [RESOURCEID RESOURCENAME]` | Displays details about [Kubernetes resources](https://kubernetes.io/docs/reference/kubectl/cheatsheet/#resource-types) or Rancher resources (i.e.: [projects](../../how-to-guides/new-user-guides/manage-clusters/projects-and-namespaces.md) and [workloads](../../pages-for-subheaders/workloads-and-pods.md)). Specify resources by name or ID. | -| `kubectl` |Runs [kubectl commands](https://kubernetes.io/docs/reference/kubectl/overview/#operations). | +| `kubectl` | Runs [kubectl commands](https://kubernetes.io/docs/reference/kubectl/overview/#operations). | | `login, [l]` | Logs into a Rancher Server. For an example, see [CLI Authentication](#cli-authentication). | -| `namespaces, [namespace]` |Performs operations on namespaces. | -| `nodes, [node]` |Performs operations on nodes. | +| machines, [machine] | Performs operations on machines. | +| multiclusterapps, [multiclusterapp mcapps mcapp] | Performs operations with multi-cluster apps. | +| `namespaces, [namespace]` | Performs operations on namespaces. | +| `nodes, [node]` | Performs operations on nodes. | | `projects, [project]` | Performs operations on [projects](../../how-to-guides/new-user-guides/manage-clusters/projects-and-namespaces.md). | | `ps` | Displays [workloads](../../pages-for-subheaders/workloads-and-pods.md) in a project. | +| `server` | Performs operations for the server. | | `settings, [setting]` | Shows the current settings for your Rancher Server. | | `ssh` | Connects to one of your cluster nodes using the SSH protocol. | +| up | Applies compose config. | +| wait | Waits for resoruces clusters, app, project, multiClusterApp. | +| token | Authentictes and generates new kubeconfig token. | | `help, [h]` | Shows a list of commands or help for one command. | diff --git a/versioned_docs/version-2.8/reference-guides/cli-with-rancher/rancher-cli.md b/versioned_docs/version-2.8/reference-guides/cli-with-rancher/rancher-cli.md index 0c9a27c1694..09f2f33f70a 100644 --- a/versioned_docs/version-2.8/reference-guides/cli-with-rancher/rancher-cli.md +++ b/versioned_docs/version-2.8/reference-guides/cli-with-rancher/rancher-cli.md @@ -68,15 +68,22 @@ The following commands are available for use in Rancher CLI. | `catalog` | Performs operations on [catalogs](../../pages-for-subheaders/helm-charts-in-rancher.md). | | `clusters, [cluster]` | Performs operations on your [clusters](../../pages-for-subheaders/kubernetes-clusters-in-rancher-setup.md). | | `context` | Switches between Rancher [projects](../../how-to-guides/new-user-guides/manage-clusters/projects-and-namespaces.md). For an example, see [Project Selection](#project-selection). | +| `globaldns` | Performs operations on global DNS providers and entries. | | `inspect [OPTIONS] [RESOURCEID RESOURCENAME]` | Displays details about [Kubernetes resources](https://kubernetes.io/docs/reference/kubectl/cheatsheet/#resource-types) or Rancher resources (i.e.: [projects](../../how-to-guides/new-user-guides/manage-clusters/projects-and-namespaces.md) and [workloads](../../pages-for-subheaders/workloads-and-pods.md)). Specify resources by name or ID. | -| `kubectl` |Runs [kubectl commands](https://kubernetes.io/docs/reference/kubectl/overview/#operations). | +| `kubectl` | Runs [kubectl commands](https://kubernetes.io/docs/reference/kubectl/overview/#operations). | | `login, [l]` | Logs into a Rancher Server. For an example, see [CLI Authentication](#cli-authentication). | -| `namespaces, [namespace]` |Performs operations on namespaces. | -| `nodes, [node]` |Performs operations on nodes. | +| machines, [machine] | Performs operations on machines. | +| multiclusterapps, [multiclusterapp mcapps mcapp] | Performs operations with multi-cluster apps. | +| `namespaces, [namespace]` | Performs operations on namespaces. | +| `nodes, [node]` | Performs operations on nodes. | | `projects, [project]` | Performs operations on [projects](../../how-to-guides/new-user-guides/manage-clusters/projects-and-namespaces.md). | | `ps` | Displays [workloads](../../pages-for-subheaders/workloads-and-pods.md) in a project. | +| `server` | Performs operations for the server. | | `settings, [setting]` | Shows the current settings for your Rancher Server. | | `ssh` | Connects to one of your cluster nodes using the SSH protocol. | +| up | Applies compose config. | +| wait | Waits for resoruces clusters, app, project, multiClusterApp. | +| token | Authentictes and generates new kubeconfig token. | | `help, [h]` | Shows a list of commands or help for one command. | From 0b9bdeab24a7eaa4bf8eff23006bc7fbbbddc88f Mon Sep 17 00:00:00 2001 From: martyav Date: Mon, 22 Jan 2024 16:26:08 -0500 Subject: [PATCH 02/54] Backport 844 Add aws out of tree cloud provider install/upgrade docs and 1025 refresh created/updated relevant docs pages, moved vsphere migration guide to new migration section --- .../migrate-to-out-of-tree-amazon.md | 193 +++++ .../set-up-cloud-providers/amazon.md | 732 ++++++++++++++++-- ...e.md => migrate-to-out-of-tree-vsphere.md} | 6 +- 3 files changed, 851 insertions(+), 80 deletions(-) create mode 100644 versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/migrate-to-an-out-of-tree-cloud-provider/migrate-to-out-of-tree-amazon.md rename versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/{migrate-from-in-tree-to-out-of-tree.md => migrate-to-out-of-tree-vsphere.md} (97%) diff --git a/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/migrate-to-an-out-of-tree-cloud-provider/migrate-to-out-of-tree-amazon.md b/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/migrate-to-an-out-of-tree-cloud-provider/migrate-to-out-of-tree-amazon.md new file mode 100644 index 00000000000..9a942641d0b --- /dev/null +++ b/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/migrate-to-an-out-of-tree-cloud-provider/migrate-to-out-of-tree-amazon.md @@ -0,0 +1,193 @@ +--- +title: Migrating Amazon In-tree to Out-of-tree +--- + + + + + +Kubernetes is moving away from maintaining cloud providers in-tree. In Kubernetes 1.27 and later, the in-tree cloud providers have been removed. + +You can migrate from an in-tree to an out-of-tree AWS cloud provider on Kubernetes 1.26 and earlier. All existing clusters must migrate prior to upgrading to v1.27 in order to stay functional. + +To migrate from the in-tree cloud provider to the out-of-tree AWS cloud provider, you must stop the existing cluster's kube controller manager and install the AWS cloud controller manager. There are many ways to do this. Refer to the official AWS documentation on the [external cloud controller manager](https://cloud-provider-aws.sigs.k8s.io/getting_started/) for details. + +If it's acceptable to have some downtime, you can [switch to an external cloud provider](../set-up-cloud-providers/amazon.md#using-the-out-of-tree-aws-cloud-provider), which removes in-tree components and then deploy charts to install the AWS cloud controller manager. + +If your setup can't tolerate any control plane downtime, you must enable leader migration. This facilitates a smooth transition from the controllers in the kube controller manager to their counterparts in the cloud controller manager. Refer to the official AWS documentation on [Using leader migration](https://cloud-provider-aws.sigs.k8s.io/getting_started/) for more details. + +:::note Important: +The Kubernetes [cloud controller migration documentation](https://kubernetes.io/docs/tasks/administer-cluster/controller-manager-leader-migration/#before-you-begin) states that it's possible to migrate with the same Kubernetes version, but assumes that the migration is part of a Kubernetes upgrade. Refer to the Kubernetes documentation on [migrating to use the cloud controller manager](https://kubernetes.io/docs/tasks/administer-cluster/controller-manager-leader-migration/) to see if you need to customize your setup before migrating. Confirm your [migration configuration values](https://kubernetes.io/docs/tasks/administer-cluster/controller-manager-leader-migration/#default-configuration). If your cloud provider provides an implementation of the Node IPAM controller, you also need to [migrate the IPAM controller](https://kubernetes.io/docs/tasks/administer-cluster/controller-manager-leader-migration/#node-ipam-controller-migration). +::: + + + + +1. Update the cluster config to enable leader migration: + +```yaml +spec: + rkeConfig: + machineSelectorConfig: + - config: + kube-controller-manager-arg: + - enable-leader-migration + machineLabelSelector: + matchExpressions: + - key: rke.cattle.io/control-plane-role + operator: In + values: + - 'true' +``` + +Note that the cloud provider is still `aws` at this step: + +```yaml +spec: + rkeConfig: + machineGlobalConfig: + cloud-provider-name: aws +``` + +2. Cordon control plane nodes so that AWS cloud controller pods run on nodes only after upgrading to the external cloud provider: + +```shell +kubectl cordon -l "node-role.kubernetes.io/controlplane=true" +``` + +3. To install the AWS cloud controller manager with leader migration enabled, follow Steps 1-3 for [deploying the cloud controller manager chart](../set-up-cloud-providers/amazon.md#using-the-out-of-tree-aws-cloud-provider). From Kubernetes 1.22 onwards, the kube-controller-manager will utilize a default configuration which will satisfy the controller-to-manager migration. Update container args of the `aws-cloud-controller-manager` under `spec.rkeConfig.additionalManifest` to enable leader migration: + +```shell +- '--enable-leader-migration=true' +``` + +4. Install the chart and confirm that the Daemonset `aws-cloud-controller-manager` successfully deployed: + +```shell +kubectl rollout status daemonset -n kube-system aws-cloud-controller-manager +``` + +5. Update the provisioning cluster to change the cloud provider and remove leader migration args from the kube controller. +If upgrading the Kubernetes version, set the Kubernetes version as well in the `spec.kubernetesVersion` section of the cluster YAML file + +:::note Important + +Only remove `cloud-provider-name: aws` if not relying on the rke2 supervisor to correctly set the providerID. + +::: + +Remove `enable-leader-migration` if you don't want it enabled in your cluster: + +```yaml +spec: + rkeConfig: + machineGlobalConfig: + cloud-provider-name: external +``` + +Remove `enable-leader-migration` from: + +```yaml +spec: + rkeConfig: + machineSelectorConfig: + - config: + kube-controller-manager-arg: + - enable-leader-migration + machineLabelSelector: + matchExpressions: + - key: rke.cattle.io/control-plane-role + operator: In + values: + - 'true' +``` + +:::tip +You can also disable leader migration after the upgrade, as leader migration is no longer required due to only one cloud-controller-manager and can be removed. +Upgrade the chart and remove the following section from the container arguments: + +```yaml +- --enable-leader-migration=true +``` +::: + +Verify the cloud controller manager update was successfully rolled out with the following command: + +```shell +kubectl rollout status daemonset -n kube-system aws-cloud-controller-manager +``` + +6. The cloud provider is responsible for setting the ProviderID of the node. Check if all nodes are initialized with the ProviderID: + +```shell +kubectl describe nodes | grep "ProviderID" +``` + + + + + +1. Update the cluster config to enable leader migration in `cluster.yml`: + +```yaml +services: + kube-controller: + extra_args: + enable-leader-migration: "true" +``` + +Note that the cloud provider is still `aws` at this step: + +```yaml +cloud_provider: + name: aws +``` + +2. Cordon the control plane nodes, so that AWS cloud controller pods run on nodes only after upgrading to the external cloud provider: + +```shell +kubectl cordon -l "node-role.kubernetes.io/controlplane=true" +``` + +3. To install the AWS cloud controller manager, you must enable leader migration and follow the same steps as when installing AWS on a new cluster. To enable leader migration, add the following to the container arguments in step 7 while following the [steps to install the chart](../set-up-cloud-providers/amazon.md#helm-chart-installation-from-ui): + +```yaml +- '--enable-leader-migration=true' +``` + +4. Confirm that the chart is installed but that the new pods aren't running yet due to cordoned controlplane nodes. After updating the cluster in the next step, RKE will upgrade and uncordon each node, and schedule `aws-controller-manager` pods. + +5. Update `cluster.yml` to change the cloud provider and remove the leader migration arguments from the kube-controller. + + Selecting **External Amazon (out-of-tree)** sets `--cloud-provider=external` and lets you enable `useInstanceMetadataHostname`. You must enable `useInstanceMetadataHostname` for node-driver clusters and for custom clusters if not you don't provide a custom node name via `--node-name`. Enabling `useInstanceMetadataHostname` will query ec2 metadata service and set `/hostname` as `hostname-override` for `kubelet` and `kube-proxy`: + +```yaml +rancher_kubernetes_engine_config: + cloud_provider: + name: external-aws + useInstanceMetadataHostname: true/false +``` + + Remove `enable-leader-migration` if you don't want it enabled in your cluster: + + ```yaml + services: + kube-controller: + extra_args: + enable-leader-migration: "true" + ``` + +:::tip +You can also disable leader migration after you finish the migration. Upgrade the chart and remove the following section from the container arguments: + +```yaml +- --enable-leader-migration=true +``` +::: + +6. If you're upgrading the cluster's Kubernetes version, set the Kubernetes version as well. + +7. Update the cluster. The `aws-cloud-controller-manager` pods should now be running. + + + diff --git a/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/amazon.md b/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/amazon.md index df31897b817..371f5e7f388 100644 --- a/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/amazon.md +++ b/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/amazon.md @@ -7,23 +7,27 @@ weight: 1 -When using the `Amazon` cloud provider, you can leverage the following capabilities: +:::note Important: -- **Load Balancers:** Launches an AWS Elastic Load Balancer (ELB) when choosing `Layer-4 Load Balancer` in **Port Mapping** or when launching a `Service` with `type: LoadBalancer`. -- **Persistent Volumes**: Allows you to use AWS Elastic Block Stores (EBS) for persistent volumes. +In Kubernetes 1.27 and later, you must use an out-of-tree AWS cloud provider. In-tree cloud providers have been deprecated. The Amazon cloud provider has been removed completely, and won't work after an upgrade to Kubernetes 1.27. The steps listed below are still required to set up an Amazon cloud provider. You can [set up an out-of-tree cloud provider for RKE](#using-the-out-of-tree-aws-cloud-provider-for-rke) after creating an IAM role and configuring the ClusterID. -See [cloud-provider-aws README](https://kubernetes.github.io/cloud-provider-aws/) for all information regarding the Amazon cloud provider. +You can also [migrate from an in-tree to an out-of-tree AWS cloud provider](../migrate-to-an-out-of-tree-cloud-provider/migrate-to-out-of-tree-amazon.md) on Kubernetes 1.26 and earlier. All existing clusters must migrate prior to upgrading to v1.27 in order to stay functional. + +Starting with Kubernetes 1.23, you must deactivate the `CSIMigrationAWS` feature gate to use the in-tree AWS cloud provider. You can do this by setting `feature-gates=CSIMigrationAWS=false` as an additional argument for the cluster's Kubelet, Controller Manager, API Server and Scheduler in the advanced cluster configuration. + +::: + +When you use Amazon as a cloud provider, you can leverage the following capabilities: + +- **Load Balancers:** Launch an AWS Elastic Load Balancer (ELB) when you select `Layer-4 Load Balancer` in **Port Mapping** or when you launch a `Service` with `type: LoadBalancer`. +- **Persistent Volumes**: Use AWS Elastic Block Stores (EBS) for persistent volumes. + +See the [cloud-provider-aws README](https://kubernetes.github.io/cloud-provider-aws/) for more information about the Amazon cloud provider. To set up the Amazon cloud provider, -1. [Create an IAM role and attach to the instances](#1-create-an-iam-role-and-attach-to-the-instances) -2. [Configure the ClusterID](#2-configure-the-clusterid) - -:::note Important: - -Starting with Kubernetes 1.23, you have to deactivate the `CSIMigrationAWS` feature gate in order to use the in-tree AWS cloud provider. You can do this by setting `feature-gates=CSIMigrationAWS=false` as an additional argument for the cluster's Kubelet, Controller Manager, API Server and Scheduler in the advanced cluster configuration. - -::: +1. [Create an IAM role and attach to the instances](#1-create-an-iam-role-and-attach-to-the-instances). +2. [Configure the ClusterID](#2-configure-the-clusterid). ### 1. Create an IAM Role and attach to the instances @@ -40,71 +44,71 @@ IAM Policy for nodes with the `controlplane` role: ```json { -"Version": "2012-10-17", -"Statement": [ - { - "Effect": "Allow", - "Action": [ - "autoscaling:DescribeAutoScalingGroups", - "autoscaling:DescribeLaunchConfigurations", - "autoscaling:DescribeTags", - "ec2:DescribeInstances", - "ec2:DescribeRegions", - "ec2:DescribeRouteTables", - "ec2:DescribeSecurityGroups", - "ec2:DescribeSubnets", - "ec2:DescribeVolumes", - "ec2:CreateSecurityGroup", - "ec2:CreateTags", - "ec2:CreateVolume", - "ec2:ModifyInstanceAttribute", - "ec2:ModifyVolume", - "ec2:AttachVolume", - "ec2:AuthorizeSecurityGroupIngress", - "ec2:CreateRoute", - "ec2:DeleteRoute", - "ec2:DeleteSecurityGroup", - "ec2:DeleteVolume", - "ec2:DetachVolume", - "ec2:RevokeSecurityGroupIngress", - "ec2:DescribeVpcs", - "elasticloadbalancing:AddTags", - "elasticloadbalancing:AttachLoadBalancerToSubnets", - "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", - "elasticloadbalancing:CreateLoadBalancer", - "elasticloadbalancing:CreateLoadBalancerPolicy", - "elasticloadbalancing:CreateLoadBalancerListeners", - "elasticloadbalancing:ConfigureHealthCheck", - "elasticloadbalancing:DeleteLoadBalancer", - "elasticloadbalancing:DeleteLoadBalancerListeners", - "elasticloadbalancing:DescribeLoadBalancers", - "elasticloadbalancing:DescribeLoadBalancerAttributes", - "elasticloadbalancing:DetachLoadBalancerFromSubnets", - "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", - "elasticloadbalancing:ModifyLoadBalancerAttributes", - "elasticloadbalancing:RegisterInstancesWithLoadBalancer", - "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer", - "elasticloadbalancing:AddTags", - "elasticloadbalancing:CreateListener", - "elasticloadbalancing:CreateTargetGroup", - "elasticloadbalancing:DeleteListener", - "elasticloadbalancing:DeleteTargetGroup", - "elasticloadbalancing:DescribeListeners", - "elasticloadbalancing:DescribeLoadBalancerPolicies", - "elasticloadbalancing:DescribeTargetGroups", - "elasticloadbalancing:DescribeTargetHealth", - "elasticloadbalancing:ModifyListener", - "elasticloadbalancing:ModifyTargetGroup", - "elasticloadbalancing:RegisterTargets", - "elasticloadbalancing:SetLoadBalancerPoliciesOfListener", - "iam:CreateServiceLinkedRole", - "kms:DescribeKey" - ], - "Resource": [ - "*" - ] - } -] + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "autoscaling:DescribeAutoScalingGroups", + "autoscaling:DescribeLaunchConfigurations", + "autoscaling:DescribeTags", + "ec2:DescribeInstances", + "ec2:DescribeRegions", + "ec2:DescribeRouteTables", + "ec2:DescribeSecurityGroups", + "ec2:DescribeSubnets", + "ec2:DescribeVolumes", + "ec2:CreateSecurityGroup", + "ec2:CreateTags", + "ec2:CreateVolume", + "ec2:ModifyInstanceAttribute", + "ec2:ModifyVolume", + "ec2:AttachVolume", + "ec2:AuthorizeSecurityGroupIngress", + "ec2:CreateRoute", + "ec2:DeleteRoute", + "ec2:DeleteSecurityGroup", + "ec2:DeleteVolume", + "ec2:DetachVolume", + "ec2:RevokeSecurityGroupIngress", + "ec2:DescribeVpcs", + "elasticloadbalancing:AddTags", + "elasticloadbalancing:AttachLoadBalancerToSubnets", + "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", + "elasticloadbalancing:CreateLoadBalancer", + "elasticloadbalancing:CreateLoadBalancerPolicy", + "elasticloadbalancing:CreateLoadBalancerListeners", + "elasticloadbalancing:ConfigureHealthCheck", + "elasticloadbalancing:DeleteLoadBalancer", + "elasticloadbalancing:DeleteLoadBalancerListeners", + "elasticloadbalancing:DescribeLoadBalancers", + "elasticloadbalancing:DescribeLoadBalancerAttributes", + "elasticloadbalancing:DetachLoadBalancerFromSubnets", + "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", + "elasticloadbalancing:ModifyLoadBalancerAttributes", + "elasticloadbalancing:RegisterInstancesWithLoadBalancer", + "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer", + "elasticloadbalancing:AddTags", + "elasticloadbalancing:CreateListener", + "elasticloadbalancing:CreateTargetGroup", + "elasticloadbalancing:DeleteListener", + "elasticloadbalancing:DeleteTargetGroup", + "elasticloadbalancing:DescribeListeners", + "elasticloadbalancing:DescribeLoadBalancerPolicies", + "elasticloadbalancing:DescribeTargetGroups", + "elasticloadbalancing:DescribeTargetHealth", + "elasticloadbalancing:ModifyListener", + "elasticloadbalancing:ModifyTargetGroup", + "elasticloadbalancing:RegisterTargets", + "elasticloadbalancing:SetLoadBalancerPoliciesOfListener", + "iam:CreateServiceLinkedRole", + "kms:DescribeKey" + ], + "Resource": [ + "*" + ] + } + ] } ``` @@ -161,6 +165,580 @@ If you share resources between clusters, you can change the tag to: The string value, ``, is the Kubernetes cluster's ID. +:::note + +Do not tag a resource with multiple owned or shared tags. + +::: + ### Using Amazon Elastic Container Registry (ECR) The kubelet component has the ability to automatically obtain ECR credentials, when the IAM profile mentioned in [Create an IAM Role and attach to the instances](#1-create-an-iam-role-and-attach-to-the-instances) is attached to the instance(s). When using a Kubernetes version older than v1.15.0, the Amazon cloud provider needs be configured in the cluster. Starting with Kubernetes version v1.15.0, the kubelet can obtain ECR credentials without having the Amazon cloud provider configured in the cluster. + +### Using the Out-of-Tree AWS Cloud Provider + + + + +1. [Node name conventions and other prerequisites](https://cloud-provider-aws.sigs.k8s.io/prerequisites/) must be followed for the cloud provider to find the instance correctly. + +2. Rancher managed RKE2/K3s clusters don't support configuring `providerID`. However, the engine will set the node name correctly if the following configuration is set on the provisioning cluster object: + +```yaml +spec: + rkeConfig: + machineGlobalConfig: + cloud-provider-name: aws +``` + +This option will be passed to the configuration of the various Kubernetes components that run on the node, and must be overridden per component to prevent the in-tree provider from running unintentionally: + + +**Override on Etcd:** + +```yaml +spec: + rkeConfig: + machineSelectorConfig: + - config: + kubelet-arg: + - cloud-provider=external + machineLabelSelector: + matchExpressions: + - key: rke.cattle.io/etcd-role + operator: In + values: + - 'true' +``` + +**Override on Control Plane:** + +```yaml +spec: + rkeConfig: + machineSelectorConfig: + - config: + disable-cloud-controller: true + kube-apiserver-arg: + - cloud-provider=external + kube-controller-manager-arg: + - cloud-provider=external + kubelet-arg: + - cloud-provider=external + machineLabelSelector: + matchExpressions: + - key: rke.cattle.io/control-plane-role + operator: In + values: + - 'true' +``` + +**Override on Worker:** + +```yaml +spec: + rkeConfig: + machineSelectorConfig: + - config: + kubelet-arg: + - cloud-provider=external + machineLabelSelector: + matchExpressions: + - key: rke.cattle.io/worker-role + operator: In + values: + - 'true' +``` + +2. Select `Amazon` if relying on the above mechanism to set the provider ID. Otherwise, select **External (out-of-tree)** cloud provider, which sets `--cloud-provider=external` for Kubernetes components. + +3. Specify the `aws-cloud-controller-manager` Helm chart as an additional manifest to install: + +```yaml +spec: + rkeConfig: + additionalManifest: |- + apiVersion: helm.cattle.io/v1 + kind: HelmChart + metadata: + name: aws-cloud-controller-manager + namespace: kube-system + spec: + chart: aws-cloud-controller-manager + repo: https://kubernetes.github.io/cloud-provider-aws + targetNamespace: kube-system + bootstrap: true + valuesContent: |- + hostNetworking: true + nodeSelector: + node-role.kubernetes.io/control-plane: "true" + args: + - --configure-cloud-routes=false + - --v=5 + - --cloud-provider=aws +``` + + + + + +1. [Node name conventions and other prerequisites ](https://cloud-provider-aws.sigs.k8s.io/prerequisites/) must be followed so that the cloud provider can find the instance. Rancher provisioned clusters don't support configuring `providerID`. + +:::note + +If you use IP-based naming, the nodes must be named after the instance followed by the regional domain name (`ip-xxx-xxx-xxx-xxx.ec2..internal`). If you have a custom domain name set in the DHCP options, you must set `--hostname-override` on `kube-proxy` and `kubelet` to match this naming convention. + +::: + +To meet node naming conventions, Rancher allows setting `useInstanceMetadataHostname` when the `External Amazon` cloud provider is selected. Enabling `useInstanceMetadataHostname` will query ec2 metadata service and set `/hostname` as `hostname-override` for `kubelet` and `kube-proxy`: + +```yaml +rancher_kubernetes_engine_config: + cloud_provider: + name: external-aws + useInstanceMetadataHostname: true +``` + +You must not enable `useInstanceMetadataHostname` when setting custom values for `hostname-override` for custom clusters. When you create a [custom cluster](../../../../pages-for-subheaders/use-existing-nodes.md), add [`--node-name`](../../../../reference-guides/cluster-configuration/rancher-server-configuration/use-existing-nodes/rancher-agent-options.md) to the `docker run` node registration command to set `hostname-override` — for example, `"$(hostname -f)"`. This can be done manually or by using **Show Advanced Options** in the Rancher UI to add **Node Name**. + +2. Select the cloud provider. + +Selecting **External Amazon (out-of-tree)** sets `--cloud-provider=external` and enables `useInstanceMetadataHostname`. As mentioned in step 1, enabling `useInstanceMetadataHostname` will query the EC2 metadata service and set `http://169.254.169.254/latest/meta-data/hostname` as `hostname-override` for `kubelet` and `kube-proxy`. + +:::note + +You must disable `useInstanceMetadataHostname` when setting a custom node name for custom clusters via `node-name`. + +::: + +```yaml +rancher_kubernetes_engine_config: + cloud_provider: + name: external-aws + useInstanceMetadataHostname: true/false +``` + +Existing clusters that use an **External** cloud provider will set `--cloud-provider=external` for Kubernetes components but won't set the node name. + +3. Install the AWS cloud controller manager after the cluster finishes provisioning. Note that the cluster isn't successfully provisioned and nodes are still in an `uninitialized` state until you deploy the cloud controller manager. This can be done manually, or via [Helm charts in UI](#helm-chart-installation-from-ui). + +Refer to the offical AWS upstream documentation for the [cloud controller manager](https://kubernetes.github.io/cloud-provider-aws). + + + + +### Helm Chart Installation from CLI + + + + +Official upstream docs for [Helm chart installation](https://github.com/kubernetes/cloud-provider-aws/tree/master/charts/aws-cloud-controller-manager) can be found on Github. + +1. Add the Helm repository: + +```shell +helm repo add aws-cloud-controller-manager https://kubernetes.github.io/cloud-provider-aws +helm repo update +``` + +2. Create a `values.yaml` file with the following contents to override the default `values.yaml`: + +```yaml +# values.yaml +hostNetworking: true +tolerations: + - effect: NoSchedule + key: node.cloudprovider.kubernetes.io/uninitialized + value: 'true' + - effect: NoSchedule + value: 'true' + key: node-role.kubernetes.io/controlplane +nodeSelector: + node-role.kubernetes.io/controlplane: 'true' +args: + - --configure-cloud-routes=false + - --use-service-account-credentials=true + - --v=2 + - --cloud-provider=aws +clusterRoleRules: + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch + - update + - apiGroups: + - "" + resources: + - nodes + verbs: + - '*' + - apiGroups: + - "" + resources: + - nodes/status + verbs: + - patch + - apiGroups: + - "" + resources: + - services + verbs: + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - services/status + verbs: + - list + - patch + - update + - watch + - apiGroups: + - '' + resources: + - serviceaccounts + verbs: + - create + - get + - apiGroups: + - "" + resources: + - persistentvolumes + verbs: + - get + - list + - update + - watch + - apiGroups: + - "" + resources: + - endpoints + verbs: + - create + - get + - list + - watch + - update + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - create + - get + - list + - watch + - update + - apiGroups: + - "" + resources: + - serviceaccounts/token + verbs: + - create +``` + +3. Install the Helm chart: + +```shell +helm upgrade --install aws-cloud-controller-manager aws-cloud-controller-manager/aws-cloud-controller-manager --values values.yaml +``` + +Verify that the Helm chart installed successfully: + +```shell +helm status -n kube-system aws-cloud-controller-manager +``` + +4. (Optional) Verify that the cloud controller manager update succeeded: + +```shell +kubectl rollout status daemonset -n kube-system aws-cloud-controller-manager +``` + + + + + +Official upstream docs for [Helm chart installation](https://github.com/kubernetes/cloud-provider-aws/tree/master/charts/aws-cloud-controller-manager) can be found on Github. + +1. Add the Helm repository: + +```shell +helm repo add aws-cloud-controller-manager https://kubernetes.github.io/cloud-provider-aws +helm repo update +``` + +2. Create a `values.yaml` file with the following contents, to override the default `values.yaml`: + +```yaml +# values.yaml +hostNetworking: true +tolerations: + - effect: NoSchedule + key: node.cloudprovider.kubernetes.io/uninitialized + value: 'true' + - effect: NoSchedule + value: 'true' + key: node-role.kubernetes.io/controlplane +nodeSelector: + node-role.kubernetes.io/controlplane: 'true' +args: + - --configure-cloud-routes=false + - --use-service-account-credentials=true + - --v=2 + - --cloud-provider=aws +clusterRoleRules: + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch + - update + - apiGroups: + - "" + resources: + - nodes + verbs: + - '*' + - apiGroups: + - "" + resources: + - nodes/status + verbs: + - patch + - apiGroups: + - "" + resources: + - services + verbs: + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - services/status + verbs: + - list + - patch + - update + - watch + - apiGroups: + - '' + resources: + - serviceaccounts + verbs: + - create + - get + - apiGroups: + - "" + resources: + - persistentvolumes + verbs: + - get + - list + - update + - watch + - apiGroups: + - "" + resources: + - endpoints + verbs: + - create + - get + - list + - watch + - update + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - create + - get + - list + - watch + - update + - apiGroups: + - "" + resources: + - serviceaccounts/token + verbs: + - create +``` + +3. Install the Helm chart: + +```shell +helm upgrade --install aws-cloud-controller-manager -n kube-system aws-cloud-controller-manager/aws-cloud-controller-manager --values values.yaml +``` + +Verify that the Helm chart installed successfully: + +```shell +helm status -n kube-system aws-cloud-controller-manager +``` + +4. If present, edit the Daemonset to remove the default node selector `node-role.kubernetes.io/control-plane: ""`: + +```shell +kubectl edit daemonset aws-cloud-controller-manager -n kube-system +``` + +5. (Optional) Verify that the cloud controller manager update succeeded: + +```shell +kubectl rollout status daemonset -n kube-system aws-cloud-controller-manager +``` + + + + +### Helm Chart Installation from UI + + + + +1. Click **☰**, then select the name of the cluster from the left navigation. + +2. Select **Apps** > **Repositories**. + +3. Click the **Create** button. + +4. Enter `https://kubernetes.github.io/cloud-provider-aws` in the **Index URL** field. + +5. Select **Apps** > **Charts** from the left navigation and install **aws-cloud-controller-manager**. + +6. Select the namespace, `kube-system`, and enable **Customize Helm options before install**. + +7. Add the following container arguments: + +```yaml + - '--use-service-account-credentials=true' + - '--configure-cloud-routes=false' +``` + +8. Add `get` to `verbs` for `serviceaccounts` resources in `clusterRoleRules`. This allows the cloud controller manager to get service accounts upon startup. + +```yaml + - apiGroups: + - '' + resources: + - serviceaccounts + verbs: + - create + - get +``` + +9. Rancher-provisioned RKE nodes are tainted `node-role.kubernetes.io/controlplane`. Update tolerations and the nodeSelector: + +```yaml +tolerations: + - effect: NoSchedule + key: node.cloudprovider.kubernetes.io/uninitialized + value: 'true' + - effect: NoSchedule + value: 'true' + key: node-role.kubernetes.io/controlplane + +``` + +```yaml +nodeSelector: + node-role.kubernetes.io/controlplane: 'true' +``` + +:::note + +There's currently a [known issue](https://github.com/rancher/dashboard/issues/9249) where nodeSelector can't be updated from the Rancher UI. Continue installing the chart and then edit the Daemonset manually to set the `nodeSelector`: + +```yaml +nodeSelector: + node-role.kubernetes.io/controlplane: 'true' +``` + +::: + +10. Install the chart and confirm that the Daemonset `aws-cloud-controller-manager` is running. Verify `aws-cloud-controller-manager` pods are running in target namespace (`kube-system` unless modified in step 6). + + + + + +1. Click **☰**, then select the name of the cluster from the left navigation. + +2. Select **Apps** > **Repositories**. + +3. Click the **Create** button. + +4. Enter `https://kubernetes.github.io/cloud-provider-aws` in the **Index URL** field. + +5. Select **Apps** > **Charts** from the left navigation and install **aws-cloud-controller-manager**. + +6. Select the namespace, `kube-system`, and enable **Customize Helm options before install**. + +7. Add the following container arguments: + +```yaml + - '--use-service-account-credentials=true' + - '--configure-cloud-routes=false' +``` + +8. Add `get` to `verbs` for `serviceaccounts` resources in `clusterRoleRules`. This allows the cloud controller manager to get service accounts upon startup: + +```yaml + - apiGroups: + - '' + resources: + - serviceaccounts + verbs: + - create + - get +``` + +9. Rancher-provisioned RKE nodes are tainted `node-role.kubernetes.io/controlplane`. Update tolerations and the nodeSelector: + +```yaml +tolerations: + - effect: NoSchedule + key: node.cloudprovider.kubernetes.io/uninitialized + value: 'true' + - effect: NoSchedule + value: 'true' + key: node-role.kubernetes.io/controlplane + +``` + +```yaml +nodeSelector: + node-role.kubernetes.io/controlplane: 'true' +``` + +:::note + +There's currently a [known issue](https://github.com/rancher/dashboard/issues/9249) where `nodeSelector` can't be updated from the Rancher UI. Continue installing the chart and then Daemonset manually to set the `nodeSelector`: + +``` yaml +nodeSelector: + node-role.kubernetes.io/controlplane: 'true' +``` + +::: + +10. Install the chart and confirm that the Daemonset `aws-cloud-controller-manager` deploys successfully: + +```shell +kubectl rollout status daemonset -n kube-system aws-cloud-controller-manager +``` + + + diff --git a/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/migrate-from-in-tree-to-out-of-tree.md b/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/migrate-to-out-of-tree-vsphere.md similarity index 97% rename from versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/migrate-from-in-tree-to-out-of-tree.md rename to versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/migrate-to-out-of-tree-vsphere.md index 0e9b162ecf1..c93da30901c 100644 --- a/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/migrate-from-in-tree-to-out-of-tree.md +++ b/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/migrate-to-out-of-tree-vsphere.md @@ -1,5 +1,5 @@ --- -title: Migrating vSphere In-tree Volumes to Out-of-tree +title: Migrating vSphere In-tree to Out-of-tree --- @@ -64,7 +64,7 @@ Once all nodes are tainted by the running the script, launch the Helm vSphere CP 1. Click **☰ > Cluster Management**. 1. Go to the cluster where the vSphere CPI chart will be installed and click **Explore**. 1. Click **Apps > Charts**. -1. Click **vSphere CPI**.. +1. Click **vSphere CPI**. 1. Click **Install**. 1. Fill out the required vCenter details and click **Install**. @@ -81,7 +81,7 @@ kubectl describe nodes | grep "ProviderID" 1. Click **☰ > Cluster Management**. 1. Go to the cluster where the vSphere CSI chart will be installed and click **Explore**. 1. Click **Apps > Charts**. -1. Click **vSphere CSI**.. +1. Click **vSphere CSI**. 1. Click **Install**. 1. Fill out the required vCenter details and click **Install**. 1. Check **Customize Helm options before install** and click **Next**. From cb914c11f69c2080caa675a06e00dc30378e0546 Mon Sep 17 00:00:00 2001 From: martyav Date: Mon, 22 Jan 2024 16:42:33 -0500 Subject: [PATCH 03/54] updated 2.7 sidebar w new migration section --- versioned_sidebars/version-2.7-sidebars.json | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/versioned_sidebars/version-2.7-sidebars.json b/versioned_sidebars/version-2.7-sidebars.json index 2a5a071cafe..7eadccdb38a 100644 --- a/versioned_sidebars/version-2.7-sidebars.json +++ b/versioned_sidebars/version-2.7-sidebars.json @@ -467,8 +467,15 @@ "how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/azure", "how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/google-compute-engine", "how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/configure-in-tree-vsphere", - "how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/configure-out-of-tree-vsphere", - "how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/migrate-from-in-tree-to-out-of-tree" + "how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/configure-out-of-tree-vsphere" + ] + }, + { + "type": "category", + "label": "Migrate to an Out-of-tree Cloud Provider", + "items": [ + "how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/migrate-to-an-out-of-tree-cloud-provider/migrate-to-out-of-tree-amazon", + "how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/migrate-to-an-out-of-tree-cloud-provider/migrate-to-out-of-tree-vsphere" ] }, "how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/register-existing-clusters" From fdb9532d8a7cb0200e17d2553f77e2b0a1e96fef Mon Sep 17 00:00:00 2001 From: martyav Date: Mon, 22 Jan 2024 17:08:51 -0500 Subject: [PATCH 04/54] typo in filename and location --- .../migrate-to-out-of-tree-vsphere.md | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/{set-up-cloud-providers => migrate-to-an-out-of-tree-cloud-provider}/migrate-to-out-of-tree-vsphere.md (100%) diff --git a/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/migrate-to-out-of-tree-vsphere.md b/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/migrate-to-an-out-of-tree-cloud-provider/migrate-to-out-of-tree-vsphere.md similarity index 100% rename from versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/migrate-to-out-of-tree-vsphere.md rename to versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/migrate-to-an-out-of-tree-cloud-provider/migrate-to-out-of-tree-vsphere.md From 2ae06b1abccbba7e2a17981f8389860dd2d4ad56 Mon Sep 17 00:00:00 2001 From: LucasSaintarbor Date: Thu, 1 Feb 2024 12:27:02 -0800 Subject: [PATCH 05/54] Review / update CLI commands --- .../cli-with-rancher/rancher-cli.md | 19 +++++++++---------- .../cli-with-rancher/rancher-cli.md | 18 +++++++++--------- .../cli-with-rancher/rancher-cli.md | 16 ++++++++-------- .../cli-with-rancher/rancher-cli.md | 19 +++++++++---------- 4 files changed, 35 insertions(+), 37 deletions(-) diff --git a/docs/reference-guides/cli-with-rancher/rancher-cli.md b/docs/reference-guides/cli-with-rancher/rancher-cli.md index 09f2f33f70a..1e5357c67de 100644 --- a/docs/reference-guides/cli-with-rancher/rancher-cli.md +++ b/docs/reference-guides/cli-with-rancher/rancher-cli.md @@ -68,25 +68,24 @@ The following commands are available for use in Rancher CLI. | `catalog` | Performs operations on [catalogs](../../pages-for-subheaders/helm-charts-in-rancher.md). | | `clusters, [cluster]` | Performs operations on your [clusters](../../pages-for-subheaders/kubernetes-clusters-in-rancher-setup.md). | | `context` | Switches between Rancher [projects](../../how-to-guides/new-user-guides/manage-clusters/projects-and-namespaces.md). For an example, see [Project Selection](#project-selection). | -| `globaldns` | Performs operations on global DNS providers and entries. | +| `globaldns` | Performs operations on global DNS providers and entries. | | `inspect [OPTIONS] [RESOURCEID RESOURCENAME]` | Displays details about [Kubernetes resources](https://kubernetes.io/docs/reference/kubectl/cheatsheet/#resource-types) or Rancher resources (i.e.: [projects](../../how-to-guides/new-user-guides/manage-clusters/projects-and-namespaces.md) and [workloads](../../pages-for-subheaders/workloads-and-pods.md)). Specify resources by name or ID. | | `kubectl` | Runs [kubectl commands](https://kubernetes.io/docs/reference/kubectl/overview/#operations). | | `login, [l]` | Logs into a Rancher Server. For an example, see [CLI Authentication](#cli-authentication). | -| machines, [machine] | Performs operations on machines. | -| multiclusterapps, [multiclusterapp mcapps mcapp] | Performs operations with multi-cluster apps. | -| `namespaces, [namespace]` | Performs operations on namespaces. | -| `nodes, [node]` | Performs operations on nodes. | +| `machines, [machine]` | Performs operations on machines. | +| `multiclusterapps, [multiclusterapp mcapps mcapp]` | Performs operations with multi-cluster apps. | +| `namespaces, [namespace]` | Performs operations on [namespaces](../../how-to-guides/new-user-guides/manage-namespaces.md). | +| `nodes, [node]` | Performs operations on [nodes](../../how-to-guides/new-user-guides/manage-clusters/nodes-and-node-pools.md). | | `projects, [project]` | Performs operations on [projects](../../how-to-guides/new-user-guides/manage-clusters/projects-and-namespaces.md). | | `ps` | Displays [workloads](../../pages-for-subheaders/workloads-and-pods.md) in a project. | -| `server` | Performs operations for the server. | +| `server` | Performs operations for the server. | | `settings, [setting]` | Shows the current settings for your Rancher Server. | | `ssh` | Connects to one of your cluster nodes using the SSH protocol. | -| up | Applies compose config. | -| wait | Waits for resoruces clusters, app, project, multiClusterApp. | -| token | Authentictes and generates new kubeconfig token. | +| `up` | Applies compose config. | +| `wait` | Waits for resoruces cluster, app, project, multiClusterApp. | +| `token` | Authentictes and generates new kubeconfig token. | | `help, [h]` | Shows a list of commands or help for one command. | - ### Rancher CLI Help Once logged into Rancher Server using the CLI, enter `./rancher --help` for a list of commands. diff --git a/versioned_docs/version-2.6/reference-guides/cli-with-rancher/rancher-cli.md b/versioned_docs/version-2.6/reference-guides/cli-with-rancher/rancher-cli.md index a4336208795..99e62147663 100644 --- a/versioned_docs/version-2.6/reference-guides/cli-with-rancher/rancher-cli.md +++ b/versioned_docs/version-2.6/reference-guides/cli-with-rancher/rancher-cli.md @@ -68,22 +68,22 @@ The following commands are available for use in Rancher CLI. | `catalog` | Performs operations on [catalogs](../../pages-for-subheaders/helm-charts-in-rancher.md). | | `clusters, [cluster]` | Performs operations on your [clusters](../../pages-for-subheaders/kubernetes-clusters-in-rancher-setup.md). | | `context` | Switches between Rancher [projects](../../how-to-guides/new-user-guides/manage-clusters/projects-and-namespaces.md). For an example, see [Project Selection](#project-selection). | -| `globaldns` | Performs operations on global DNS providers and entries. | +| `globaldns` | Performs operations on global DNS providers and entries. | | `inspect [OPTIONS] [RESOURCEID RESOURCENAME]` | Displays details about [Kubernetes resources](https://kubernetes.io/docs/reference/kubectl/cheatsheet/#resource-types) or Rancher resources (i.e.: [projects](../../how-to-guides/new-user-guides/manage-clusters/projects-and-namespaces.md) and [workloads](../../pages-for-subheaders/workloads-and-pods.md)). Specify resources by name or ID. | | `kubectl` | Runs [kubectl commands](https://kubernetes.io/docs/reference/kubectl/overview/#operations). | | `login, [l]` | Logs into a Rancher Server. For an example, see [CLI Authentication](#cli-authentication). | -| `machines, [machine]` | Operations on machines | -| `multiclusterapps, [multiclusterapp mcapps mcapp]` | Performs operations with multi-cluster apps. | -| `namespaces, [namespace]` | Performs operations on namespaces. | -| `nodes, [node]` | Performs operations on nodes. | +| `machines, [machine]` | Performs operations on machines. | +| `multiclusterapps, [multiclusterapp mcapps mcapp]` | Performs operations with multi-cluster apps. | +| `namespaces, [namespace]` | Performs operations on [namespaces](../../how-to-guides/new-user-guides/manage-namespaces.md). | +| `nodes, [node]` | Performs operations on [nodes](../../how-to-guides/new-user-guides/manage-clusters/nodes-and-node-pools.md). | | `projects, [project]` | Performs operations on [projects](../../how-to-guides/new-user-guides/manage-clusters/projects-and-namespaces.md). | | `ps` | Displays [workloads](../../pages-for-subheaders/workloads-and-pods.md) in a project. | -| `server` | Performs operations for the server. | +| `server` | Performs operations for the server. | | `settings, [setting]` | Shows the current settings for your Rancher Server. | | `ssh` | Connects to one of your cluster nodes using the SSH protocol. | -| up | Applies compose config. | -| wait | Waits for resoruces clusters, app, project, multiClusterApp. | -| token | Authentictes and generates new kubeconfig token. | +| `up` | Applies compose config. | +| `wait` | Waits for resoruces cluster, app, project, multiClusterApp. | +| `token` | Authentictes and generates new kubeconfig token. | | `help, [h]` | Shows a list of commands or help for one command. | diff --git a/versioned_docs/version-2.7/reference-guides/cli-with-rancher/rancher-cli.md b/versioned_docs/version-2.7/reference-guides/cli-with-rancher/rancher-cli.md index 09f2f33f70a..43989a19581 100644 --- a/versioned_docs/version-2.7/reference-guides/cli-with-rancher/rancher-cli.md +++ b/versioned_docs/version-2.7/reference-guides/cli-with-rancher/rancher-cli.md @@ -72,18 +72,18 @@ The following commands are available for use in Rancher CLI. | `inspect [OPTIONS] [RESOURCEID RESOURCENAME]` | Displays details about [Kubernetes resources](https://kubernetes.io/docs/reference/kubectl/cheatsheet/#resource-types) or Rancher resources (i.e.: [projects](../../how-to-guides/new-user-guides/manage-clusters/projects-and-namespaces.md) and [workloads](../../pages-for-subheaders/workloads-and-pods.md)). Specify resources by name or ID. | | `kubectl` | Runs [kubectl commands](https://kubernetes.io/docs/reference/kubectl/overview/#operations). | | `login, [l]` | Logs into a Rancher Server. For an example, see [CLI Authentication](#cli-authentication). | -| machines, [machine] | Performs operations on machines. | -| multiclusterapps, [multiclusterapp mcapps mcapp] | Performs operations with multi-cluster apps. | -| `namespaces, [namespace]` | Performs operations on namespaces. | -| `nodes, [node]` | Performs operations on nodes. | +| machines, [machine] | Performs operations on machines. | +| `multiclusterapps, [multiclusterapp mcapps mcapp]` | Performs operations with multi-cluster apps. | +| `namespaces, [namespace]` | Performs operations on [namespaces](../../how-to-guides/new-user-guides/manage-namespaces.md). | +| `nodes, [node]` | Performs operations on [nodes](../../how-to-guides/new-user-guides/manage-clusters/nodes-and-node-pools.md). | | `projects, [project]` | Performs operations on [projects](../../how-to-guides/new-user-guides/manage-clusters/projects-and-namespaces.md). | | `ps` | Displays [workloads](../../pages-for-subheaders/workloads-and-pods.md) in a project. | -| `server` | Performs operations for the server. | +| `server` | Performs operations for the server. | | `settings, [setting]` | Shows the current settings for your Rancher Server. | | `ssh` | Connects to one of your cluster nodes using the SSH protocol. | -| up | Applies compose config. | -| wait | Waits for resoruces clusters, app, project, multiClusterApp. | -| token | Authentictes and generates new kubeconfig token. | +| `up` | Applies compose config. | +| `wait` | Waits for resoruces cluster, app, project, multiClusterApp. | +| `token` | Authentictes and generates new kubeconfig token. | | `help, [h]` | Shows a list of commands or help for one command. | diff --git a/versioned_docs/version-2.8/reference-guides/cli-with-rancher/rancher-cli.md b/versioned_docs/version-2.8/reference-guides/cli-with-rancher/rancher-cli.md index 09f2f33f70a..1e5357c67de 100644 --- a/versioned_docs/version-2.8/reference-guides/cli-with-rancher/rancher-cli.md +++ b/versioned_docs/version-2.8/reference-guides/cli-with-rancher/rancher-cli.md @@ -68,25 +68,24 @@ The following commands are available for use in Rancher CLI. | `catalog` | Performs operations on [catalogs](../../pages-for-subheaders/helm-charts-in-rancher.md). | | `clusters, [cluster]` | Performs operations on your [clusters](../../pages-for-subheaders/kubernetes-clusters-in-rancher-setup.md). | | `context` | Switches between Rancher [projects](../../how-to-guides/new-user-guides/manage-clusters/projects-and-namespaces.md). For an example, see [Project Selection](#project-selection). | -| `globaldns` | Performs operations on global DNS providers and entries. | +| `globaldns` | Performs operations on global DNS providers and entries. | | `inspect [OPTIONS] [RESOURCEID RESOURCENAME]` | Displays details about [Kubernetes resources](https://kubernetes.io/docs/reference/kubectl/cheatsheet/#resource-types) or Rancher resources (i.e.: [projects](../../how-to-guides/new-user-guides/manage-clusters/projects-and-namespaces.md) and [workloads](../../pages-for-subheaders/workloads-and-pods.md)). Specify resources by name or ID. | | `kubectl` | Runs [kubectl commands](https://kubernetes.io/docs/reference/kubectl/overview/#operations). | | `login, [l]` | Logs into a Rancher Server. For an example, see [CLI Authentication](#cli-authentication). | -| machines, [machine] | Performs operations on machines. | -| multiclusterapps, [multiclusterapp mcapps mcapp] | Performs operations with multi-cluster apps. | -| `namespaces, [namespace]` | Performs operations on namespaces. | -| `nodes, [node]` | Performs operations on nodes. | +| `machines, [machine]` | Performs operations on machines. | +| `multiclusterapps, [multiclusterapp mcapps mcapp]` | Performs operations with multi-cluster apps. | +| `namespaces, [namespace]` | Performs operations on [namespaces](../../how-to-guides/new-user-guides/manage-namespaces.md). | +| `nodes, [node]` | Performs operations on [nodes](../../how-to-guides/new-user-guides/manage-clusters/nodes-and-node-pools.md). | | `projects, [project]` | Performs operations on [projects](../../how-to-guides/new-user-guides/manage-clusters/projects-and-namespaces.md). | | `ps` | Displays [workloads](../../pages-for-subheaders/workloads-and-pods.md) in a project. | -| `server` | Performs operations for the server. | +| `server` | Performs operations for the server. | | `settings, [setting]` | Shows the current settings for your Rancher Server. | | `ssh` | Connects to one of your cluster nodes using the SSH protocol. | -| up | Applies compose config. | -| wait | Waits for resoruces clusters, app, project, multiClusterApp. | -| token | Authentictes and generates new kubeconfig token. | +| `up` | Applies compose config. | +| `wait` | Waits for resoruces cluster, app, project, multiClusterApp. | +| `token` | Authentictes and generates new kubeconfig token. | | `help, [h]` | Shows a list of commands or help for one command. | - ### Rancher CLI Help Once logged into Rancher Server using the CLI, enter `./rancher --help` for a list of commands. From d3780fc27897136b19f625789338ac27faa539df Mon Sep 17 00:00:00 2001 From: martyav Date: Wed, 7 Feb 2024 15:28:40 -0500 Subject: [PATCH 06/54] note about prime --- .../migrate-to-out-of-tree-amazon.md | 6 +++++- .../migrate-to-out-of-tree-vsphere.md | 4 ++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/migrate-to-an-out-of-tree-cloud-provider/migrate-to-out-of-tree-amazon.md b/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/migrate-to-an-out-of-tree-cloud-provider/migrate-to-out-of-tree-amazon.md index 9a942641d0b..a29b64c2213 100644 --- a/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/migrate-to-an-out-of-tree-cloud-provider/migrate-to-out-of-tree-amazon.md +++ b/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/migrate-to-an-out-of-tree-cloud-provider/migrate-to-out-of-tree-amazon.md @@ -6,7 +6,11 @@ title: Migrating Amazon In-tree to Out-of-tree -Kubernetes is moving away from maintaining cloud providers in-tree. In Kubernetes 1.27 and later, the in-tree cloud providers have been removed. +:::note +Rancher Prime provides access to Rancher v2.7.11, a version of Rancher v2.7.x which has support for Kubernetes 1.27. If you use Rancher v2.7.11 and upgrade to Kubernetes 1.27, you must use an out-of-tree cloud provider. +::: + +Kubernetes is moving away from maintaining cloud providers in-tree. In Kubernetes 1.27 and later, the in-tree cloud providers have been removed. You can migrate from an in-tree to an out-of-tree AWS cloud provider on Kubernetes 1.26 and earlier. All existing clusters must migrate prior to upgrading to v1.27 in order to stay functional. diff --git a/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/migrate-to-an-out-of-tree-cloud-provider/migrate-to-out-of-tree-vsphere.md b/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/migrate-to-an-out-of-tree-cloud-provider/migrate-to-out-of-tree-vsphere.md index c93da30901c..ba05b036144 100644 --- a/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/migrate-to-an-out-of-tree-cloud-provider/migrate-to-out-of-tree-vsphere.md +++ b/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/migrate-to-an-out-of-tree-cloud-provider/migrate-to-out-of-tree-vsphere.md @@ -6,6 +6,10 @@ title: Migrating vSphere In-tree to Out-of-tree +:::note +Rancher Prime provides access to Rancher v2.7.11, a version of Rancher v2.7.x which has support for Kubernetes 1.27. If you use Rancher v2.7.11 and upgrade to Kubernetes 1.27, you must use an out-of-tree cloud provider. +::: + Kubernetes is moving away from maintaining cloud providers in-tree. vSphere has an out-of-tree cloud provider that can be used by installing the vSphere cloud provider and cloud storage plugins. This page covers how to migrate from the in-tree vSphere cloud provider to out-of-tree, and manage the existing VMs post migration. From 0cd21101cd330ccbee8a3623af68d4015f4abba1 Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Mon, 12 Feb 2024 10:03:12 -0800 Subject: [PATCH 07/54] Updating the version entry for 2.7.11. Signed-off-by: Sunil Singh --- src/pages/versions.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/pages/versions.md b/src/pages/versions.md index dab9f04161d..21eddf1f7ed 100644 --- a/src/pages/versions.md +++ b/src/pages/versions.md @@ -13,7 +13,7 @@ Below are the documentation and release notes for the currently released version v2.8.2 Documentation Release Notes -
N/A
+ Support Matrix @@ -21,7 +21,7 @@ Below are the documentation and release notes for the currently released version - + @@ -35,7 +35,7 @@ Below are the documentation and release notes for the currently released version - +
v2.7.10v2.7.11 Documentation Release Notes
N/A
v2.6.14 Documentation Release Notes
N/A
Support Matrix
From 8fcf90f7ac648fea14636686cbefeabdc32efa25 Mon Sep 17 00:00:00 2001 From: Lucas Saintarbor Date: Mon, 12 Feb 2024 10:57:10 -0800 Subject: [PATCH 08/54] Apply suggestions from code review Co-authored-by: Marty Hernandez Avedon Co-authored-by: Billy Tat --- docs/reference-guides/cli-with-rancher/rancher-cli.md | 4 ++-- .../reference-guides/cli-with-rancher/rancher-cli.md | 4 ++-- .../reference-guides/cli-with-rancher/rancher-cli.md | 8 ++++---- .../reference-guides/cli-with-rancher/rancher-cli.md | 4 ++-- 4 files changed, 10 insertions(+), 10 deletions(-) diff --git a/docs/reference-guides/cli-with-rancher/rancher-cli.md b/docs/reference-guides/cli-with-rancher/rancher-cli.md index 1e5357c67de..2cc1bd1ed7c 100644 --- a/docs/reference-guides/cli-with-rancher/rancher-cli.md +++ b/docs/reference-guides/cli-with-rancher/rancher-cli.md @@ -82,8 +82,8 @@ The following commands are available for use in Rancher CLI. | `settings, [setting]` | Shows the current settings for your Rancher Server. | | `ssh` | Connects to one of your cluster nodes using the SSH protocol. | | `up` | Applies compose config. | -| `wait` | Waits for resoruces cluster, app, project, multiClusterApp. | -| `token` | Authentictes and generates new kubeconfig token. | +| `wait` | Waits for resources cluster, app, project, multiClusterApp. | +| `token` | Authenticates and generates new kubeconfig token. | | `help, [h]` | Shows a list of commands or help for one command. | ### Rancher CLI Help diff --git a/versioned_docs/version-2.6/reference-guides/cli-with-rancher/rancher-cli.md b/versioned_docs/version-2.6/reference-guides/cli-with-rancher/rancher-cli.md index 99e62147663..f165979807d 100644 --- a/versioned_docs/version-2.6/reference-guides/cli-with-rancher/rancher-cli.md +++ b/versioned_docs/version-2.6/reference-guides/cli-with-rancher/rancher-cli.md @@ -82,8 +82,8 @@ The following commands are available for use in Rancher CLI. | `settings, [setting]` | Shows the current settings for your Rancher Server. | | `ssh` | Connects to one of your cluster nodes using the SSH protocol. | | `up` | Applies compose config. | -| `wait` | Waits for resoruces cluster, app, project, multiClusterApp. | -| `token` | Authentictes and generates new kubeconfig token. | +| `wait` | Waits for resources cluster, app, project, multiClusterApp. | +| `token` | Authenticates and generates new kubeconfig token. | | `help, [h]` | Shows a list of commands or help for one command. | diff --git a/versioned_docs/version-2.7/reference-guides/cli-with-rancher/rancher-cli.md b/versioned_docs/version-2.7/reference-guides/cli-with-rancher/rancher-cli.md index 43989a19581..2970348c8f9 100644 --- a/versioned_docs/version-2.7/reference-guides/cli-with-rancher/rancher-cli.md +++ b/versioned_docs/version-2.7/reference-guides/cli-with-rancher/rancher-cli.md @@ -68,11 +68,11 @@ The following commands are available for use in Rancher CLI. | `catalog` | Performs operations on [catalogs](../../pages-for-subheaders/helm-charts-in-rancher.md). | | `clusters, [cluster]` | Performs operations on your [clusters](../../pages-for-subheaders/kubernetes-clusters-in-rancher-setup.md). | | `context` | Switches between Rancher [projects](../../how-to-guides/new-user-guides/manage-clusters/projects-and-namespaces.md). For an example, see [Project Selection](#project-selection). | -| `globaldns` | Performs operations on global DNS providers and entries. | +| `globaldns` | Performs operations on global DNS providers and entries. | | `inspect [OPTIONS] [RESOURCEID RESOURCENAME]` | Displays details about [Kubernetes resources](https://kubernetes.io/docs/reference/kubectl/cheatsheet/#resource-types) or Rancher resources (i.e.: [projects](../../how-to-guides/new-user-guides/manage-clusters/projects-and-namespaces.md) and [workloads](../../pages-for-subheaders/workloads-and-pods.md)). Specify resources by name or ID. | | `kubectl` | Runs [kubectl commands](https://kubernetes.io/docs/reference/kubectl/overview/#operations). | | `login, [l]` | Logs into a Rancher Server. For an example, see [CLI Authentication](#cli-authentication). | -| machines, [machine] | Performs operations on machines. | +| `machines, [machine]` | Performs operations on machines. | | `multiclusterapps, [multiclusterapp mcapps mcapp]` | Performs operations with multi-cluster apps. | | `namespaces, [namespace]` | Performs operations on [namespaces](../../how-to-guides/new-user-guides/manage-namespaces.md). | | `nodes, [node]` | Performs operations on [nodes](../../how-to-guides/new-user-guides/manage-clusters/nodes-and-node-pools.md). | @@ -82,8 +82,8 @@ The following commands are available for use in Rancher CLI. | `settings, [setting]` | Shows the current settings for your Rancher Server. | | `ssh` | Connects to one of your cluster nodes using the SSH protocol. | | `up` | Applies compose config. | -| `wait` | Waits for resoruces cluster, app, project, multiClusterApp. | -| `token` | Authentictes and generates new kubeconfig token. | +| `wait` | Waits for resources cluster, app, project, multiClusterApp. | +| `token` | Authenticates and generates new kubeconfig token. | | `help, [h]` | Shows a list of commands or help for one command. | diff --git a/versioned_docs/version-2.8/reference-guides/cli-with-rancher/rancher-cli.md b/versioned_docs/version-2.8/reference-guides/cli-with-rancher/rancher-cli.md index 1e5357c67de..2cc1bd1ed7c 100644 --- a/versioned_docs/version-2.8/reference-guides/cli-with-rancher/rancher-cli.md +++ b/versioned_docs/version-2.8/reference-guides/cli-with-rancher/rancher-cli.md @@ -82,8 +82,8 @@ The following commands are available for use in Rancher CLI. | `settings, [setting]` | Shows the current settings for your Rancher Server. | | `ssh` | Connects to one of your cluster nodes using the SSH protocol. | | `up` | Applies compose config. | -| `wait` | Waits for resoruces cluster, app, project, multiClusterApp. | -| `token` | Authentictes and generates new kubeconfig token. | +| `wait` | Waits for resources cluster, app, project, multiClusterApp. | +| `token` | Authenticates and generates new kubeconfig token. | | `help, [h]` | Shows a list of commands or help for one command. | ### Rancher CLI Help From 813ceaa8358fb3efc0a83d2c94a677b7a8f2d97c Mon Sep 17 00:00:00 2001 From: martyav Date: Mon, 12 Feb 2024 16:13:12 -0500 Subject: [PATCH 09/54] sync with https://github.com/rancher/rancher-docs/pull/1112 --- .../migrate-to-out-of-tree-amazon.md | 4 ++-- .../migrate-to-out-of-tree-vsphere.md | 2 +- .../set-up-cloud-providers/amazon.md | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/migrate-to-an-out-of-tree-cloud-provider/migrate-to-out-of-tree-amazon.md b/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/migrate-to-an-out-of-tree-cloud-provider/migrate-to-out-of-tree-amazon.md index a29b64c2213..4bae5b14832 100644 --- a/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/migrate-to-an-out-of-tree-cloud-provider/migrate-to-out-of-tree-amazon.md +++ b/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/migrate-to-an-out-of-tree-cloud-provider/migrate-to-out-of-tree-amazon.md @@ -7,7 +7,7 @@ title: Migrating Amazon In-tree to Out-of-tree :::note -Rancher Prime provides access to Rancher v2.7.11, a version of Rancher v2.7.x which has support for Kubernetes 1.27. If you use Rancher v2.7.11 and upgrade to Kubernetes 1.27, you must use an out-of-tree cloud provider. +Rancher Prime provides access to Rancher v2.7.11, a version of Rancher v2.7.x which supports Kubernetes 1.27. If you use Rancher v2.7.11 and upgrade to Kubernetes 1.27, you must use an out-of-tree cloud provider. ::: Kubernetes is moving away from maintaining cloud providers in-tree. In Kubernetes 1.27 and later, the in-tree cloud providers have been removed. @@ -16,7 +16,7 @@ You can migrate from an in-tree to an out-of-tree AWS cloud provider on Kubernet To migrate from the in-tree cloud provider to the out-of-tree AWS cloud provider, you must stop the existing cluster's kube controller manager and install the AWS cloud controller manager. There are many ways to do this. Refer to the official AWS documentation on the [external cloud controller manager](https://cloud-provider-aws.sigs.k8s.io/getting_started/) for details. -If it's acceptable to have some downtime, you can [switch to an external cloud provider](../set-up-cloud-providers/amazon.md#using-the-out-of-tree-aws-cloud-provider), which removes in-tree components and then deploy charts to install the AWS cloud controller manager. +If it's acceptable to have some downtime during migration, follow the instructions to [set up an external cloud provider](../set-up-cloud-providers/amazon.md#using-the-out-of-tree-aws-cloud-provider). These instructions outline how to configure the out-of-tree cloud provider for a newly provisioned cluster. During set up, there will be some downtime, as there is a time gap between when the old cloud provider stops running and when the new cloud provider starts to run. If your setup can't tolerate any control plane downtime, you must enable leader migration. This facilitates a smooth transition from the controllers in the kube controller manager to their counterparts in the cloud controller manager. Refer to the official AWS documentation on [Using leader migration](https://cloud-provider-aws.sigs.k8s.io/getting_started/) for more details. diff --git a/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/migrate-to-an-out-of-tree-cloud-provider/migrate-to-out-of-tree-vsphere.md b/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/migrate-to-an-out-of-tree-cloud-provider/migrate-to-out-of-tree-vsphere.md index ba05b036144..568dd02a936 100644 --- a/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/migrate-to-an-out-of-tree-cloud-provider/migrate-to-out-of-tree-vsphere.md +++ b/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/migrate-to-an-out-of-tree-cloud-provider/migrate-to-out-of-tree-vsphere.md @@ -7,7 +7,7 @@ title: Migrating vSphere In-tree to Out-of-tree :::note -Rancher Prime provides access to Rancher v2.7.11, a version of Rancher v2.7.x which has support for Kubernetes 1.27. If you use Rancher v2.7.11 and upgrade to Kubernetes 1.27, you must use an out-of-tree cloud provider. +Rancher Prime provides access to Rancher v2.7.11, a version of Rancher v2.7.x which supports Kubernetes 1.27. If you use Rancher v2.7.11 and upgrade to Kubernetes 1.27, you must use an out-of-tree cloud provider. ::: Kubernetes is moving away from maintaining cloud providers in-tree. vSphere has an out-of-tree cloud provider that can be used by installing the vSphere cloud provider and cloud storage plugins. diff --git a/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/amazon.md b/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/amazon.md index 371f5e7f388..3155731d375 100644 --- a/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/amazon.md +++ b/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/amazon.md @@ -9,7 +9,7 @@ weight: 1 :::note Important: -In Kubernetes 1.27 and later, you must use an out-of-tree AWS cloud provider. In-tree cloud providers have been deprecated. The Amazon cloud provider has been removed completely, and won't work after an upgrade to Kubernetes 1.27. The steps listed below are still required to set up an Amazon cloud provider. You can [set up an out-of-tree cloud provider for RKE](#using-the-out-of-tree-aws-cloud-provider-for-rke) after creating an IAM role and configuring the ClusterID. +Rancher Prime provides access to Rancher v2.7.11, a version of Rancher v2.7.x which supports Kubernetes 1.27. If you use Rancher v2.7.11 and upgrade to Kubernetes 1.27, you must use an out-of-tree cloud provider. In Kubernetes 1.27, in-tree cloud providers have been deprecated. The Amazon cloud provider has been removed completely, and won't work after an upgrade to Kubernetes 1.27. The steps listed below are still required to set up an Amazon cloud provider. You can [set up an out-of-tree cloud provider for RKE](#using-the-out-of-tree-aws-cloud-provider-for-rke) after creating an IAM role and configuring the ClusterID. You can also [migrate from an in-tree to an out-of-tree AWS cloud provider](../migrate-to-an-out-of-tree-cloud-provider/migrate-to-out-of-tree-amazon.md) on Kubernetes 1.26 and earlier. All existing clusters must migrate prior to upgrading to v1.27 in order to stay functional. From 00ac7e524b84f35253c9488ed1ed81e88d7819df Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Mon, 12 Feb 2024 15:40:06 -0800 Subject: [PATCH 10/54] Updating the Rancher Webhook table for release 2.7.11. Signed-off-by: Sunil Singh --- versioned_docs/version-2.7/reference-guides/rancher-webhook.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/versioned_docs/version-2.7/reference-guides/rancher-webhook.md b/versioned_docs/version-2.7/reference-guides/rancher-webhook.md index f4c37a9311f..bba6fedf7c1 100644 --- a/versioned_docs/version-2.7/reference-guides/rancher-webhook.md +++ b/versioned_docs/version-2.7/reference-guides/rancher-webhook.md @@ -29,7 +29,8 @@ Each Rancher version is designed to be compatible with a single version of the w | v2.7.7 | v0.3.6 | | v2.7.8 | v0.3.6 | | v2.7.9 | v0.3.6 | -| v2.7.10 | v0.3.6 | +| v2.7.10 | v0.3.6 | +| v2.7.11 | v0.3.7 | ## Why Do We Need It? From cab46bd2912a83c747651c438a6132bcf6f2f9bb Mon Sep 17 00:00:00 2001 From: Marty Hernandez Avedon Date: Tue, 13 Feb 2024 14:05:07 -0500 Subject: [PATCH 11/54] #1108 Migrating Rancher to a new cluster lists old chart version (#1111) * 1108 Migrating Rancher to a new cluster lists old chart version * correction for 2.6.x based on https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/rancher-v2-6-13/ * updated with support matrix link, rm'd specific numbers * syncing * Apply suggestions from code review Co-authored-by: Billy Tat * Apply suggestions from code review Co-authored-by: Billy Tat --------- Co-authored-by: Billy Tat --- .../migrate-rancher-to-new-cluster.md | 12 +++++++----- .../migrate-rancher-to-new-cluster.md | 12 +++++++----- .../migrate-rancher-to-new-cluster.md | 12 +++++++----- .../migrate-rancher-to-new-cluster.md | 12 +++++++----- 4 files changed, 28 insertions(+), 20 deletions(-) diff --git a/docs/how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/migrate-rancher-to-new-cluster.md b/docs/how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/migrate-rancher-to-new-cluster.md index 9e670da901d..89faf8d11bf 100644 --- a/docs/how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/migrate-rancher-to-new-cluster.md +++ b/docs/how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/migrate-rancher-to-new-cluster.md @@ -27,7 +27,8 @@ Since Rancher can be installed on any Kubernetes cluster, you can use this backu ### 1. Install the rancher-backup Helm chart -Install the [rancher-backup chart](https://github.com/rancher/backup-restore-operator/tags), using a version in the 2.x.x major version range: + +Install the [`rancher-backup chart`](https://github.com/rancher/backup-restore-operator/tags): 1. Add the Helm repository: @@ -36,13 +37,14 @@ Install the [rancher-backup chart](https://github.com/rancher/backup-restore-ope helm repo update ``` - 1. Select and set `CHART_VERSION` variable with a 2.x.x rancher-backup release version: + 1. Set a `CHART_VERSION` variable, selecting a `rancher-backup` chart version compatible with your version of Rancher. See the [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions), within the **Rancher Apps / Cluster Tools** section, to see which `rancher-backup` versions are supported: + ```bash - helm search repo --versions rancher-charts/rancher-backup - CHART_VERSION=<2.x.x> + CHART_VERSION= ``` 1. Install the charts: + ```bash helm install rancher-backup-crd rancher-charts/rancher-backup-crd -n cattle-resources-system --create-namespace --version $CHART_VERSION helm install rancher-backup rancher-charts/rancher-backup -n cattle-resources-system --version $CHART_VERSION @@ -50,7 +52,7 @@ Install the [rancher-backup chart](https://github.com/rancher/backup-restore-ope :::note - The above assumes an environment with outbound connectivity to Docker Hub + The above assumes an environment with outbound connectivity to Docker Hub. For an **air-gapped environment**, use the Helm value below to pull the `backup-restore-operator` image from your private registry when installing the rancher-backup Helm chart. diff --git a/versioned_docs/version-2.6/how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/migrate-rancher-to-new-cluster.md b/versioned_docs/version-2.6/how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/migrate-rancher-to-new-cluster.md index 9b135096c62..346c54d50c7 100644 --- a/versioned_docs/version-2.6/how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/migrate-rancher-to-new-cluster.md +++ b/versioned_docs/version-2.6/how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/migrate-rancher-to-new-cluster.md @@ -25,7 +25,8 @@ Rancher can be installed on any Kubernetes cluster, including hosted Kubernetes Since Rancher can be installed on any Kubernetes cluster, you can use this backup and restore method to migrate Rancher from one Kubernetes cluster to any other Kubernetes cluster. This method *only* migrates Rancher-related resources and won't affect other applications on the cluster. Refer to the [support matrix](https://www.suse.com/lifecycle/) to identify which Kubernetes cluster types and versions are supported for your Rancher version. ### 1. Install the rancher-backup Helm chart -Install the [rancher-backup chart](https://github.com/rancher/backup-restore-operator/tags), using a version in the 2.x.x major version range: + +Install the [`rancher-backup chart`](https://github.com/rancher/backup-restore-operator/tags): 1. Add the Helm repository: @@ -34,13 +35,14 @@ Install the [rancher-backup chart](https://github.com/rancher/backup-restore-ope helm repo update ``` - 1. Select and set `CHART_VERSION` variable with a 2.x.x rancher-backup release version: + 1. Set a `CHART_VERSION` variable, selecting a `rancher-backup` chart version compatible with your version of Rancher. See the [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions), within the **Rancher Apps / Cluster Tools** section, to see which `rancher-backup` versions are supported: + ```bash - helm search repo --versions rancher-charts/rancher-backup - CHART_VERSION=<2.x.x> + CHART_VERSION= ``` 1. Install the charts: + ```bash helm install rancher-backup-crd rancher-charts/rancher-backup-crd -n cattle-resources-system --create-namespace --version $CHART_VERSION helm install rancher-backup rancher-charts/rancher-backup -n cattle-resources-system --version $CHART_VERSION @@ -48,7 +50,7 @@ Install the [rancher-backup chart](https://github.com/rancher/backup-restore-ope :::note - The above assumes an environment with outbound connectivity to Docker Hub + The above assumes an environment with outbound connectivity to Docker Hub. For an **air-gapped environment**, use the Helm value below to pull the `backup-restore-operator` image from your private registry when installing the rancher-backup Helm chart. diff --git a/versioned_docs/version-2.7/how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/migrate-rancher-to-new-cluster.md b/versioned_docs/version-2.7/how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/migrate-rancher-to-new-cluster.md index 9e670da901d..89faf8d11bf 100644 --- a/versioned_docs/version-2.7/how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/migrate-rancher-to-new-cluster.md +++ b/versioned_docs/version-2.7/how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/migrate-rancher-to-new-cluster.md @@ -27,7 +27,8 @@ Since Rancher can be installed on any Kubernetes cluster, you can use this backu ### 1. Install the rancher-backup Helm chart -Install the [rancher-backup chart](https://github.com/rancher/backup-restore-operator/tags), using a version in the 2.x.x major version range: + +Install the [`rancher-backup chart`](https://github.com/rancher/backup-restore-operator/tags): 1. Add the Helm repository: @@ -36,13 +37,14 @@ Install the [rancher-backup chart](https://github.com/rancher/backup-restore-ope helm repo update ``` - 1. Select and set `CHART_VERSION` variable with a 2.x.x rancher-backup release version: + 1. Set a `CHART_VERSION` variable, selecting a `rancher-backup` chart version compatible with your version of Rancher. See the [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions), within the **Rancher Apps / Cluster Tools** section, to see which `rancher-backup` versions are supported: + ```bash - helm search repo --versions rancher-charts/rancher-backup - CHART_VERSION=<2.x.x> + CHART_VERSION= ``` 1. Install the charts: + ```bash helm install rancher-backup-crd rancher-charts/rancher-backup-crd -n cattle-resources-system --create-namespace --version $CHART_VERSION helm install rancher-backup rancher-charts/rancher-backup -n cattle-resources-system --version $CHART_VERSION @@ -50,7 +52,7 @@ Install the [rancher-backup chart](https://github.com/rancher/backup-restore-ope :::note - The above assumes an environment with outbound connectivity to Docker Hub + The above assumes an environment with outbound connectivity to Docker Hub. For an **air-gapped environment**, use the Helm value below to pull the `backup-restore-operator` image from your private registry when installing the rancher-backup Helm chart. diff --git a/versioned_docs/version-2.8/how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/migrate-rancher-to-new-cluster.md b/versioned_docs/version-2.8/how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/migrate-rancher-to-new-cluster.md index 9e670da901d..89faf8d11bf 100644 --- a/versioned_docs/version-2.8/how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/migrate-rancher-to-new-cluster.md +++ b/versioned_docs/version-2.8/how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/migrate-rancher-to-new-cluster.md @@ -27,7 +27,8 @@ Since Rancher can be installed on any Kubernetes cluster, you can use this backu ### 1. Install the rancher-backup Helm chart -Install the [rancher-backup chart](https://github.com/rancher/backup-restore-operator/tags), using a version in the 2.x.x major version range: + +Install the [`rancher-backup chart`](https://github.com/rancher/backup-restore-operator/tags): 1. Add the Helm repository: @@ -36,13 +37,14 @@ Install the [rancher-backup chart](https://github.com/rancher/backup-restore-ope helm repo update ``` - 1. Select and set `CHART_VERSION` variable with a 2.x.x rancher-backup release version: + 1. Set a `CHART_VERSION` variable, selecting a `rancher-backup` chart version compatible with your version of Rancher. See the [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions), within the **Rancher Apps / Cluster Tools** section, to see which `rancher-backup` versions are supported: + ```bash - helm search repo --versions rancher-charts/rancher-backup - CHART_VERSION=<2.x.x> + CHART_VERSION= ``` 1. Install the charts: + ```bash helm install rancher-backup-crd rancher-charts/rancher-backup-crd -n cattle-resources-system --create-namespace --version $CHART_VERSION helm install rancher-backup rancher-charts/rancher-backup -n cattle-resources-system --version $CHART_VERSION @@ -50,7 +52,7 @@ Install the [rancher-backup chart](https://github.com/rancher/backup-restore-ope :::note - The above assumes an environment with outbound connectivity to Docker Hub + The above assumes an environment with outbound connectivity to Docker Hub. For an **air-gapped environment**, use the Helm value below to pull the `backup-restore-operator` image from your private registry when installing the rancher-backup Helm chart. From 3a6b7e866a075ba3c275b7737f659abacd7faa1e Mon Sep 17 00:00:00 2001 From: Jonathan Crowther Date: Tue, 13 Feb 2024 16:08:25 -0500 Subject: [PATCH 12/54] Add documentation for customizing the webhook (#1099) * Add documentation for customizing the webhook. * Apply suggestions from code review Co-authored-by: Marty Hernandez Avedon Co-authored-by: Jonathan Crowther * Address comments * Fix spacing issues * versioning -- 2.8 and 2.7 issue specifices 2.7.7 --------- Co-authored-by: Kevin Joiner <10265309+KevinJoiner@users.noreply.github.com> Co-authored-by: Marty Hernandez Avedon Co-authored-by: martyav --- docs/reference-guides/rancher-webhook.md | 49 +++++++++++++++++-- .../reference-guides/rancher-webhook.md | 36 +++++++++++++- .../reference-guides/rancher-webhook.md | 36 +++++++++++++- 3 files changed, 114 insertions(+), 7 deletions(-) diff --git a/docs/reference-guides/rancher-webhook.md b/docs/reference-guides/rancher-webhook.md index f8921c90692..fa37e7eba2c 100644 --- a/docs/reference-guides/rancher-webhook.md +++ b/docs/reference-guides/rancher-webhook.md @@ -9,7 +9,7 @@ title: Rancher Webhook Rancher-Webhook is an essential component of Rancher that works in conjunction with Kubernetes to enhance security and enable critical features for Rancher-managed clusters. It integrates with Kubernetes' extensible admission controllers, as described in the [Kubernetes documentation](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/), which allows Rancher-Webhook to inspect specific requests sent to the Kubernetes API server, and add custom, Rancher-specific validation and mutations to the requests that are specific to Rancher. Rancher-Webhook manages the resources to be validated using the `rancher.cattle.io` `ValidatingWebhookConfiguration` and the `rancher.cattle.io` `MutatingWebhookConfiguration`, and will override any manual edits. -Rancher deploys Rancher-Webhook as a separate deployment and service in both local and downstream clusters. Rancher manages Rancher-Webhook using Helm. It's important to note that Rancher may override modifications made by users to the Helm release. +Rancher deploys Rancher-Webhook as a separate deployment and service in both local and downstream clusters. Rancher manages Rancher-Webhook using Helm. It's important to note that Rancher may override modifications made by users to the Helm release. To safely modify these values see [Customizing Rancher-Webhook Configuration](#customizing-rancher-webhook-configuration). Each Rancher version is designed to be compatible with a single version of the webhook. The compatible versions are provided below for convenience. @@ -49,20 +49,59 @@ To bypass the webhook, impersonate both the `rancher-webhook-sudo` service accou kubectl create -f example.yaml --as=system:serviceaccount:cattle-system:rancher-webhook-sudo --as-group=system:masters ``` +## Customizing Rancher-Webhook Configuration + +You can add custom Helm values when you install Rancher-Webhook via Helm. During a Helm install of the Rancher-Webhook chart, Rancher checks for custom Helm values. These custom values must be defined in a ConfigMap named `rancher-config`, in the `cattle-system` namespace, under the data key, `rancher-webhook`. The value of this key must be valid YAML. +``` yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: rancher-config + namespace: cattle-system + labels: + app.kubernetes.io/part-of: "rancher" +data: + rancher-webhook: '{"port": 9553, "priorityClassName": "system-node-critical"}' + +``` + +Rancher redeploys the Rancher-Webhook chart when changes to the ConfigMap values are detected. + +### Customizing Rancher-Webhook During Rancher Installation + +When you use Helm to install the Rancher chart, you can add custom Helm values to the Rancher-Webhook of the local cluster. All values in the Rancher-Webhook chart are accessible as nested variables under the `webhook` name. +These values are synced to the `rancher-config` ConfigMap during installation. + +```bash +helm install rancher rancher-/rancher \ + --namespace cattle-system \ + ... + --set webhook.port=9553 \ + --set webhook.priorityClassName="system-node-critical" +``` + ## Common Issues ### EKS Cluster with Calico CNI Users running an EKS cluster with Calico CNI may run into errors when the Kubernetes API server attempts to contact the Rancher-Webhook. -One workaround for this issue [documented by Calico](https://docs.tigera.io/calico/latest/getting-started/kubernetes/managed-public-cloud/eks#install-eks-with-calico-networking) involves setting `hostNetwork=true` for the webhook deployment. Users can change this using the Helm commands below on the affected clusters. +One workaround for this issue, as [documented by Calico](https://docs.tigera.io/calico/latest/getting-started/kubernetes/managed-public-cloud/eks#install-eks-with-calico-networking) involves setting `hostNetwork=true` for the webhook deployment. You can change this value by adding the Helm value `global.hostNetwork=true` to the `rancher-config` ConfigMap. See [Customizing Rancher-Webhook Configuration](#customizing-rancher-webhook-configuration) for more info. ``` bash -helm repo add rancher-charts https://charts.rancher.io -helm upgrade --reuse-values rancher-webhook rancher-charts/rancher-webhook -n cattle-system --set global.hostNetwork=true +apiVersion: v1 +kind: ConfigMap +metadata: + name: rancher-config + namespace: cattle-system + labels: + app.kubernetes.io/part-of: "rancher" +data: + rancher-webhook: '{"global": {"hostNetwork": true}}' ``` + **Note:** This temporary workaround may violate an environment's security policy. This workaround also requires that port 9443 is unused on the host network. -**Note:** Helm uses secrets by default. This is a datatype that some webhook versions validate to store information. In these cases, directly update the deployment with the hostNetwork=true value using kubectl, then run the Helm commands listed above to prevent drift between the Helm configuration and the actual state of the cluster. +**Note:** By default, Helm stores information as secrets. Secrets are a resource that some webhook versions validate. In these cases, directly update the deployment with the `hostNetwork=true` value using kubectl, then update the webhook configuration as specified above. ### Private GKE Cluster diff --git a/versioned_docs/version-2.7/reference-guides/rancher-webhook.md b/versioned_docs/version-2.7/reference-guides/rancher-webhook.md index f4c37a9311f..32c77bc990f 100644 --- a/versioned_docs/version-2.7/reference-guides/rancher-webhook.md +++ b/versioned_docs/version-2.7/reference-guides/rancher-webhook.md @@ -9,7 +9,8 @@ title: Rancher Webhook Rancher-Webhook is an essential component of Rancher that works in conjunction with Kubernetes to enhance security and enable critical features for Rancher-managed clusters. It integrates with Kubernetes' extensible admission controllers, as described in the [Kubernetes documentation](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/), which allows Rancher-Webhook to inspect specific requests sent to the Kubernetes API server, and add custom, Rancher-specific validation and mutations to the requests that are specific to Rancher. Rancher-Webhook manages the resources to be validated using the `rancher.cattle.io` `ValidatingWebhookConfiguration` and the `rancher.cattle.io` `MutatingWebhookConfiguration`, and will override any manual edits. -Rancher deploys Rancher-Webhook as a separate deployment and service in both local and downstream clusters. Rancher manages Rancher-Webhook using Helm. It's important to note that Rancher may override modifications made by users to the Helm release. + +Rancher deploys Rancher-Webhook as a separate deployment and service in both local and downstream clusters. Rancher manages Rancher-Webhook using Helm. It's important to note that Rancher may override modifications made by users to the Helm release. To safely modify these values see [Customizing Rancher-Webhook Configuration](#customizing-rancher-webhook-configuration). Each Rancher version is designed to be compatible with a single version of the webhook. The compatible versions are provided below for convenience. @@ -57,6 +58,39 @@ To bypass the webhook, impersonate both the `rancher-webhook-sudo` service accou kubectl create -f example.yaml --as=system:serviceaccount:cattle-system:rancher-webhook-sudo --as-group=system:masters ``` +## Customizing Rancher-Webhook Configuration + +You can add custom Helm values when you install Rancher-Webhook via Helm. During a Helm install of the Rancher-Webhook chart, Rancher checks for custom Helm values. These custom values must be defined in a ConfigMap named `rancher-config`, in the `cattle-system` namespace, under the data key, `rancher-webhook`. The value of this key must be valid YAML. + +``` yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: rancher-config + namespace: cattle-system + labels: + app.kubernetes.io/part-of: "rancher" +data: + rancher-webhook: '{"port": 9553, "priorityClassName": "system-node-critical"}' + +``` + +Rancher redeploys the Rancher-Webhook chart when changes to the ConfigMap values are detected. + +### Customizing Rancher-Webhook During Rancher Installation + +When you use Helm to install the Rancher chart, you can add custom Helm values to the Rancher-Webhook of the local cluster. All values in the Rancher-Webhook chart are accessible as nested variables under the `webhook` name. + +These values are synced to the `rancher-config` ConfigMap during installation. + +```bash +helm install rancher rancher-/rancher \ + --namespace cattle-system \ + ... + --set webhook.port=9553 \ + --set webhook.priorityClassName="system-node-critical" +``` + ## Common Issues ### EKS Cluster with Calico CNI diff --git a/versioned_docs/version-2.8/reference-guides/rancher-webhook.md b/versioned_docs/version-2.8/reference-guides/rancher-webhook.md index f8921c90692..1693be6c5da 100644 --- a/versioned_docs/version-2.8/reference-guides/rancher-webhook.md +++ b/versioned_docs/version-2.8/reference-guides/rancher-webhook.md @@ -9,7 +9,8 @@ title: Rancher Webhook Rancher-Webhook is an essential component of Rancher that works in conjunction with Kubernetes to enhance security and enable critical features for Rancher-managed clusters. It integrates with Kubernetes' extensible admission controllers, as described in the [Kubernetes documentation](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/), which allows Rancher-Webhook to inspect specific requests sent to the Kubernetes API server, and add custom, Rancher-specific validation and mutations to the requests that are specific to Rancher. Rancher-Webhook manages the resources to be validated using the `rancher.cattle.io` `ValidatingWebhookConfiguration` and the `rancher.cattle.io` `MutatingWebhookConfiguration`, and will override any manual edits. -Rancher deploys Rancher-Webhook as a separate deployment and service in both local and downstream clusters. Rancher manages Rancher-Webhook using Helm. It's important to note that Rancher may override modifications made by users to the Helm release. + +Rancher deploys Rancher-Webhook as a separate deployment and service in both local and downstream clusters. Rancher manages Rancher-Webhook using Helm. It's important to note that Rancher may override modifications made by users to the Helm release. To safely modify these values see [Customizing Rancher-Webhook Configuration](#customizing-rancher-webhook-configuration). Each Rancher version is designed to be compatible with a single version of the webhook. The compatible versions are provided below for convenience. @@ -49,6 +50,39 @@ To bypass the webhook, impersonate both the `rancher-webhook-sudo` service accou kubectl create -f example.yaml --as=system:serviceaccount:cattle-system:rancher-webhook-sudo --as-group=system:masters ``` +## Customizing Rancher-Webhook Configuration + +You can add custom Helm values when you install Rancher-Webhook via Helm. During a Helm install of the Rancher-Webhook chart, Rancher checks for custom Helm values. These custom values must be defined in a ConfigMap named `rancher-config`, in the `cattle-system` namespace, under the data key, `rancher-webhook`. The value of this key must be valid YAML. + +``` yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: rancher-config + namespace: cattle-system + labels: + app.kubernetes.io/part-of: "rancher" +data: + rancher-webhook: '{"port": 9553, "priorityClassName": "system-node-critical"}' + +``` + +Rancher redeploys the Rancher-Webhook chart when changes to the ConfigMap values are detected. + +### Customizing Rancher-Webhook During Rancher Installation + +When you use Helm to install the Rancher chart, you can add custom Helm values to the Rancher-Webhook of the local cluster. All values in the Rancher-Webhook chart are accessible as nested variables under the `webhook` name. + +These values are synced to the `rancher-config` ConfigMap during installation. + +```bash +helm install rancher rancher-/rancher \ + --namespace cattle-system \ + ... + --set webhook.port=9553 \ + --set webhook.priorityClassName="system-node-critical" +``` + ## Common Issues ### EKS Cluster with Calico CNI From c3aff0b8e457a9ff9ef4e28fc9e95853441c8d37 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Wed, 14 Feb 2024 16:31:55 -0800 Subject: [PATCH 13/54] Indicate Prime/Community availability --- docs/reference-guides/rancher-webhook.md | 10 +++---- .../reference-guides/rancher-webhook.md | 26 +++++++++---------- .../reference-guides/rancher-webhook.md | 10 +++---- 3 files changed, 23 insertions(+), 23 deletions(-) diff --git a/docs/reference-guides/rancher-webhook.md b/docs/reference-guides/rancher-webhook.md index fa37e7eba2c..e1aeb7b6750 100644 --- a/docs/reference-guides/rancher-webhook.md +++ b/docs/reference-guides/rancher-webhook.md @@ -17,11 +17,11 @@ Each Rancher version is designed to be compatible with a single version of the w -| Rancher Version | Webhook Version | -|-----------------|:---------------:| -| v2.8.0 | v0.4.2 | -| v2.8.1 | v0.4.2 | -| v2.8.2 | v0.4.2 | +| Rancher Version | Webhook Version | Prime | Community | +|-----------------|-----------------|---------|-----------| +| v2.8.2 | v0.4.2 | ✓ | ✓ | +| v2.8.1 | v0.4.2 | ✓ | ✓ | +| v2.8.0 | v0.4.2 | | ✓ | ## Why Do We Need It? diff --git a/versioned_docs/version-2.7/reference-guides/rancher-webhook.md b/versioned_docs/version-2.7/reference-guides/rancher-webhook.md index 32c77bc990f..a79691713f2 100644 --- a/versioned_docs/version-2.7/reference-guides/rancher-webhook.md +++ b/versioned_docs/version-2.7/reference-guides/rancher-webhook.md @@ -18,19 +18,19 @@ Each Rancher version is designed to be compatible with a single version of the w -| Rancher Version | Webhook Version | -|-----------------|:---------------:| -| v2.7.0 | v0.3.0 | -| v2.7.1 | v0.3.0 | -| v2.7.2 | v0.3.2 | -| v2.7.3 | v0.3.3 | -| v2.7.4 | v0.3.4 | -| v2.7.5 | v0.3.5 | -| v2.7.6 | v0.3.5 | -| v2.7.7 | v0.3.6 | -| v2.7.8 | v0.3.6 | -| v2.7.9 | v0.3.6 | -| v2.7.10 | v0.3.6 | +| Rancher Version | Webhook Version | Prime | Community | +|-----------------|-----------------|---------|-----------| +| v2.7.10 | v0.3.6 | ✓ | ✓ | +| v2.7.9 | v0.3.6 | | ✓ | +| v2.7.8 | v0.3.6 | | ✓ | +| v2.7.7 | v0.3.6 | ✓ | ✓ | +| v2.7.6 | v0.3.5 | ✓ | ✓ | +| v2.7.5 | v0.3.5 | ✓ | ✓ | +| v2.7.4 | v0.3.4 | ✓ | ✓ | +| v2.7.3 | v0.3.3 | ✓ | ✓ | +| v2.7.2 | v0.3.2 | ✓ | ✓ | +| v2.7.1 | v0.3.0 | ✓ | ✓ | +| v2.7.0 | v0.3.0 | ✓ | ✓ | ## Why Do We Need It? diff --git a/versioned_docs/version-2.8/reference-guides/rancher-webhook.md b/versioned_docs/version-2.8/reference-guides/rancher-webhook.md index 1693be6c5da..b789245b4dd 100644 --- a/versioned_docs/version-2.8/reference-guides/rancher-webhook.md +++ b/versioned_docs/version-2.8/reference-guides/rancher-webhook.md @@ -18,11 +18,11 @@ Each Rancher version is designed to be compatible with a single version of the w -| Rancher Version | Webhook Version | -|-----------------|:---------------:| -| v2.8.0 | v0.4.2 | -| v2.8.1 | v0.4.2 | -| v2.8.2 | v0.4.2 | +| Rancher Version | Webhook Version | Prime | Community | +|-----------------|-----------------|---------|-----------| +| v2.8.2 | v0.4.2 | ✓ | ✓ | +| v2.8.1 | v0.4.2 | ✓ | ✓ | +| v2.8.0 | v0.4.2 | | ✓ | ## Why Do We Need It? From a4bb88e67d4d698a5f62180238a08d62275ce592 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Thu, 15 Feb 2024 09:24:55 -0800 Subject: [PATCH 14/54] Indicate Prime/Community availability --- src/pages/versions.md | 82 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 82 insertions(+) diff --git a/src/pages/versions.md b/src/pages/versions.md index 05bf9753061..1cd136486c3 100644 --- a/src/pages/versions.md +++ b/src/pages/versions.md @@ -9,28 +9,54 @@ title: Rancher Documentation Versions Below are the documentation and release notes for the currently released version of Rancher 2.8.x: + + + + + + + + + +
VersionDocumentationRelease NotesSupport MatrixPrimeCommunity
v2.8.2 Documentation Release Notes Support Matrix
✓
✓
Below are the documentation and release notes for the currently released version of Rancher 2.7.x: + + + + + + + + + +
VersionDocumentationRelease NotesSupport MatrixPrimeCommunity
v2.7.10 Documentation Release Notes Support Matrix
✓
✓
Below are the documentation and release notes for the currently released version of Rancher 2.6.x: + + + + + + @@ -44,17 +70,29 @@ Below are the documentation and release notes for the currently released version Below are the documentation and release notes for previous versions of Rancher 2.8.x:
VersionDocumentationRelease NotesSupport Matrix
v2.6.14 Documentation
+ + + + + + + + + + + +
VersionDocumentationRelease NotesSupport MatrixPrimeCommunity
v2.8.1 Documentation Release Notes Support Matrix
✓
✓
v2.8.0 Documentation Release Notes
N/A
N/A
✓
@@ -63,65 +101,93 @@ Below are the documentation and release notes for previous versions of Rancher 2 Below are the documentation and release notes for previous versions of Rancher 2.7.x: + + + + + + + + + + + + + + + + + + + + + + + + + + + +
VersionDocumentationRelease NotesSupport MatrixPrimeCommunity
v2.7.9 Documentation Release Notes Support Matrix
✓
✓
v2.7.8 Documentation Release Notes
N/A
N/A
✓
v2.7.7 Documentation Release Notes
N/A
N/A
✓
v2.7.6 Documentation Release Notes Support Matrix
✓
✓
v2.7.5 Documentation Release Notes Support Matrix
✓
✓
v2.7.4 Documentation Release Notes Support Matrix
✓
✓
v2.7.3 Documentation Release Notes Support Matrix
✓
✓
v2.7.2 Documentation Release Notes Support Matrix
✓
✓
v2.7.1 Documentation Release Notes Support Matrix
✓
✓
v2.7.0 Documentation Release Notes Support Matrix
✓
✓
@@ -130,6 +196,12 @@ Below are the documentation and release notes for previous versions of Rancher 2 Below are the documentation and release notes for previous versions of Rancher 2.6.x: + + + + + + @@ -223,6 +295,12 @@ Below are the documentation and release notes for previous versions of Rancher 2 Below are the documentation and release notes for legacy versions of Rancher 2.5.x:
VersionDocumentationRelease NotesSupport Matrix
v2.6.13 Documentation
+ + + + + + @@ -338,6 +416,10 @@ Below are the documentation and release notes for legacy versions of Rancher 2.5 Below is the documentation for legacy versions of Rancher 2.0 - 2.4.x:
VersionDocumentationRelease NotesSupport Matrix
v2.5.17 Documentation
+ + + + From 755080de3dd703ffba652ef53cdfef1b80414d53 Mon Sep 17 00:00:00 2001 From: Paulo Gomes Date: Fri, 16 Feb 2024 15:58:27 +0000 Subject: [PATCH 15/54] Update CVE page --- .../rancher-security/security-advisories-and-cves.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/reference-guides/rancher-security/security-advisories-and-cves.md b/docs/reference-guides/rancher-security/security-advisories-and-cves.md index a142092fa2d..0891c0d180c 100644 --- a/docs/reference-guides/rancher-security/security-advisories-and-cves.md +++ b/docs/reference-guides/rancher-security/security-advisories-and-cves.md @@ -10,6 +10,7 @@ Rancher is committed to informing the community of security issues in our produc | ID | Description | Date | Resolution | |----|-------------|------|------------| +| [CVE-2024-22030](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22030) | A vulnerability was discovered in Rancher's and Fleet's agents, currently deemed a medium to high severity CVE, that under very specific circumstances allows a malicious actor to take over existing Rancher nodes. The attacker would need to have control of an expired domain or execute a DNS spoofing/hijacking attack against the domain in order to exploit this vulnerability. The targeted domain is the one used as the Rancher URL (the server-url of the Rancher cluster). At the moment there is no fix available and it affects all supported versions of Rancher. Customers and users are advised to follow the recommendations and best practices described in our [blog post](https://www.suse.com/c/rancher-security-update/). | 16 Feb 2024 | Pending | | [CVE-2023-32193](https://github.com/rancher/norman/security/advisories/GHSA-r8f4-hv23-6qp6) | An issue was discovered in Rancher versions up to and including 2.6.13, 2.7.9 and 2.8.1, where multiple Cross-Site Scripting (XSS) vulnerabilities can be exploited via the Rancher UI (Norman). | 8 Feb 2024 | Rancher [v2.8.2](https://github.com/rancher/rancher/releases/tag/v2.8.2), [v2.7.10](https://github.com/rancher/rancher/releases/tag/v2.7.10) and [v2.6.14](https://github.com/rancher/rancher/releases/tag/v2.6.14) | | [CVE-2023-32192](https://github.com/rancher/apiserver/security/advisories/GHSA-833m-37f7-jq55) | An issue was discovered in Rancher versions up to and including 2.6.13, 2.7.9 and 2.8.1, where multiple Cross-Site Scripting (XSS) vulnerabilities can be exploited via the Rancher UI (Apiserver). | 8 Feb 2024 | Rancher [v2.8.2](https://github.com/rancher/rancher/releases/tag/v2.8.2), [v2.7.10](https://github.com/rancher/rancher/releases/tag/v2.7.10) and [v2.6.14](https://github.com/rancher/rancher/releases/tag/v2.6.14) | | [CVE-2023-22649](https://github.com/rancher/rancher/security/advisories/GHSA-xfj7-qf8w-2gcr) | An issue was discovered in Rancher versions up to and including 2.6.13, 2.7.9 and 2.8.1, in which sensitive data may be leaked into Rancher's audit logs. | 8 Feb 2024 | Rancher [v2.8.2](https://github.com/rancher/rancher/releases/tag/v2.8.2), [v2.7.10](https://github.com/rancher/rancher/releases/tag/v2.7.10) and [v2.6.14](https://github.com/rancher/rancher/releases/tag/v2.6.14) | From 2a02adeb721791411c1d42503486c6879507e02b Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Fri, 16 Feb 2024 15:34:04 -0800 Subject: [PATCH 16/54] Add purpose of Prime/Community columns in section intros. Also link to Prime page --- src/pages/versions.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/src/pages/versions.md b/src/pages/versions.md index 1cd136486c3..3738aecf1bd 100644 --- a/src/pages/versions.md +++ b/src/pages/versions.md @@ -6,7 +6,7 @@ title: Rancher Documentation Versions ### Current versions -Below are the documentation and release notes for the currently released version of Rancher 2.8.x: +Here you can find links to supporting documentation for the current released version of Rancher v2.8, and its availability for [Rancher Prime](/v2.8/getting-started/quick-start-guides/deploy-rancher-manager/prime) and the Community version of Rancher:
VersionDocumentation
v2.0 - v2.4 Documentation
@@ -27,7 +27,7 @@ Below are the documentation and release notes for the currently released version
-Below are the documentation and release notes for the currently released version of Rancher 2.7.x: +Here you can find links to supporting documentation for the current released version of Rancher v2.7, and its availability for [Rancher Prime](/v2.7/getting-started/quick-start-guides/deploy-rancher-manager/prime) and the Community version of Rancher: @@ -48,7 +48,7 @@ Below are the documentation and release notes for the currently released version
-Below are the documentation and release notes for the currently released version of Rancher 2.6.x: +Here you can find links to supporting documentation for the current released version of Rancher v2.6: @@ -67,7 +67,7 @@ Below are the documentation and release notes for the currently released version ### Past versions -Below are the documentation and release notes for previous versions of Rancher 2.8.x: +Here you can find links to supporting documentation for previous versions of Rancher v2.8, and their availability for [Rancher Prime](/v2.8/getting-started/quick-start-guides/deploy-rancher-manager/prime) and the Community version of Rancher:
@@ -98,7 +98,7 @@ Below are the documentation and release notes for previous versions of Rancher 2
-Below are the documentation and release notes for previous versions of Rancher 2.7.x: +Here you can find links to supporting documentation for previous versions of Rancher v2.7, and their availability for [Rancher Prime](/v2.7/getting-started/quick-start-guides/deploy-rancher-manager/prime) and the Community version of Rancher:
@@ -193,7 +193,7 @@ Below are the documentation and release notes for previous versions of Rancher 2
-Below are the documentation and release notes for previous versions of Rancher 2.6.x: +Here you can find links to supporting documentation for previous versions of Rancher v2.6:
@@ -292,7 +292,7 @@ Below are the documentation and release notes for previous versions of Rancher 2 ### Legacy versions (EOL) -Below are the documentation and release notes for legacy versions of Rancher 2.5.x: +Here you can find links to supporting documentation for legacy versions of Rancher v2.5:
@@ -413,7 +413,7 @@ Below are the documentation and release notes for legacy versions of Rancher 2.5
-Below is the documentation for legacy versions of Rancher 2.0 - 2.4.x: +Here you can find links to supporting documentation for legacy versions of v2.0-v2.4:
@@ -421,7 +421,7 @@ Below is the documentation for legacy versions of Rancher 2.0 - 2.4.x: - +
Documentation
v2.0 - v2.4v2.0-v2.4 Documentation
\ No newline at end of file From d9ba7f2e958095eca651a1cd48dc202576fb6d5e Mon Sep 17 00:00:00 2001 From: Yilin Zeng <36651058+yzeng25@users.noreply.github.com> Date: Wed, 21 Feb 2024 03:17:51 +0800 Subject: [PATCH 17/54] chore: update copyright message to 2024 (#1132) --- i18n/zh/docusaurus-theme-classic/footer.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/i18n/zh/docusaurus-theme-classic/footer.json b/i18n/zh/docusaurus-theme-classic/footer.json index 07aa991f00e..231806094e0 100644 --- a/i18n/zh/docusaurus-theme-classic/footer.json +++ b/i18n/zh/docusaurus-theme-classic/footer.json @@ -1,6 +1,6 @@ { "copyright": { - "message": "Copyright © 2023 SUSE Rancher. All Rights Reserved.", + "message": "Copyright © 2024 SUSE Rancher. All Rights Reserved.", "description": "The footer copyright" } } From 82ed34bc7bd975c03af5cd1755939dd0fe718ec9 Mon Sep 17 00:00:00 2001 From: Meera Belur Date: Tue, 20 Feb 2024 12:22:54 -0800 Subject: [PATCH 18/54] Update csp-adapter version --- .../cloud-marketplace/aws-cloud-marketplace/install-adapter.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/versioned_docs/version-2.7/integrations-in-rancher/cloud-marketplace/aws-cloud-marketplace/install-adapter.md b/versioned_docs/version-2.7/integrations-in-rancher/cloud-marketplace/aws-cloud-marketplace/install-adapter.md index a4240a0156e..f120b6f7417 100644 --- a/versioned_docs/version-2.7/integrations-in-rancher/cloud-marketplace/aws-cloud-marketplace/install-adapter.md +++ b/versioned_docs/version-2.7/integrations-in-rancher/cloud-marketplace/aws-cloud-marketplace/install-adapter.md @@ -29,6 +29,8 @@ In order to deploy and run the adapter successfully, you need to ensure its vers | v2.7.7 | v2.0.2 | | v2.7.8 | v2.0.2 | | v2.7.9 | v2.0.2 | +| v2.7.10 | v2.0.2 | +| v2.7.11 | v2.0.4 | ### 1. Gain Access to the Local Cluster From da7e68b04440126c2b3a9734ceaae9dcfb53afb6 Mon Sep 17 00:00:00 2001 From: Marty Hernandez Avedon Date: Tue, 20 Feb 2024 15:28:56 -0500 Subject: [PATCH 19/54] Apply suggestions from code review Co-authored-by: Billy Tat --- .../set-up-cloud-providers/amazon.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/amazon.md b/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/amazon.md index 3155731d375..064eec4332b 100644 --- a/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/amazon.md +++ b/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/amazon.md @@ -9,7 +9,7 @@ weight: 1 :::note Important: -Rancher Prime provides access to Rancher v2.7.11, a version of Rancher v2.7.x which supports Kubernetes 1.27. If you use Rancher v2.7.11 and upgrade to Kubernetes 1.27, you must use an out-of-tree cloud provider. In Kubernetes 1.27, in-tree cloud providers have been deprecated. The Amazon cloud provider has been removed completely, and won't work after an upgrade to Kubernetes 1.27. The steps listed below are still required to set up an Amazon cloud provider. You can [set up an out-of-tree cloud provider for RKE](#using-the-out-of-tree-aws-cloud-provider-for-rke) after creating an IAM role and configuring the ClusterID. +Rancher Prime provides access to Rancher v2.7.11, a version of Rancher v2.7.x which supports Kubernetes 1.27. If you use Rancher v2.7.11 and upgrade to Kubernetes 1.27, you must use an out-of-tree cloud provider. In-tree cloud providers have been deprecated. The Amazon cloud provider has been removed completely, and won't work after an upgrade to Kubernetes 1.27. The steps listed below are still required to set up an Amazon cloud provider. You can [set up an out-of-tree cloud provider for RKE](#using-the-out-of-tree-aws-cloud-provider-for-rke) after creating an IAM role and configuring the ClusterID. You can also [migrate from an in-tree to an out-of-tree AWS cloud provider](../migrate-to-an-out-of-tree-cloud-provider/migrate-to-out-of-tree-amazon.md) on Kubernetes 1.26 and earlier. All existing clusters must migrate prior to upgrading to v1.27 in order to stay functional. From 17af76d76f7d10cf115a197bb20902278614519e Mon Sep 17 00:00:00 2001 From: Meera Belur Date: Wed, 21 Feb 2024 09:04:19 -0800 Subject: [PATCH 20/54] Updated csp-adapter version table (#1134) --- .../cloud-marketplace/aws-cloud-marketplace/install-adapter.md | 1 + 1 file changed, 1 insertion(+) diff --git a/versioned_docs/version-2.7/integrations-in-rancher/cloud-marketplace/aws-cloud-marketplace/install-adapter.md b/versioned_docs/version-2.7/integrations-in-rancher/cloud-marketplace/aws-cloud-marketplace/install-adapter.md index a4240a0156e..09291fb0ecd 100644 --- a/versioned_docs/version-2.7/integrations-in-rancher/cloud-marketplace/aws-cloud-marketplace/install-adapter.md +++ b/versioned_docs/version-2.7/integrations-in-rancher/cloud-marketplace/aws-cloud-marketplace/install-adapter.md @@ -29,6 +29,7 @@ In order to deploy and run the adapter successfully, you need to ensure its vers | v2.7.7 | v2.0.2 | | v2.7.8 | v2.0.2 | | v2.7.9 | v2.0.2 | +| v2.7.10 | v2.0.2 | ### 1. Gain Access to the Local Cluster From d56729e94a0bee07ec0c68c96a71411c11e75ae2 Mon Sep 17 00:00:00 2001 From: Marty Hernandez Avedon Date: Wed, 21 Feb 2024 13:24:54 -0500 Subject: [PATCH 21/54] #995 Correct configure teams receiver commands (#1014) * 995 - Correct receivers.md * every heading uses the same verb form * rm'd sentence fragment --- .../monitoring-v2-configuration/receivers.md | 28 ++++++++----------- 1 file changed, 11 insertions(+), 17 deletions(-) diff --git a/docs/reference-guides/monitoring-v2-configuration/receivers.md b/docs/reference-guides/monitoring-v2-configuration/receivers.md index dc459f34378..79d9749dc18 100644 --- a/docs/reference-guides/monitoring-v2-configuration/receivers.md +++ b/docs/reference-guides/monitoring-v2-configuration/receivers.md @@ -24,8 +24,6 @@ This section assumes familiarity with how monitoring components work together. F ::: -To create notification receivers in the Rancher UI, - @@ -152,24 +150,20 @@ The Teams receiver is not a native receiver and must be enabled before it can be 1. Select the **Teams** option and click **Install**. 1. Take note of the namespace used as it will be required in a later step. -### Configure the Teams Receiver +### Configuring the Teams Receiver -The Teams receiver can be configured by updating its ConfigMap. For example, the following is a minimal Teams receiver configuration. +1. To configure the Teams receiver, update its ConfigMap. The following example is a minimal Teams receiver configuration: -```yaml -[Microsoft Teams] -teams-instance-1: https://your-teams-webhook-url -``` + ```yaml + [Microsoft Teams] + connector: https://your-teams-webhook-url + ``` -When configuration is complete, add the receiver using the steps in [this section](#creating-receivers-in-the-rancher-ui). +2. After you update the configuration, follow the instructions in [Creating Receivers in the Rancher UI](#creating-receivers-in-the-rancher-ui) to add the receiver. Use the example below to form your URL. Make sure to replace `` with the namespace of the `rancher-alerting-drivers` app: -Use the example below as the URL where: - -- `ns-1` is replaced with the namespace where the `rancher-alerting-drivers` app is installed - -```yaml -url: http://rancher-alerting-drivers-prom2teams.ns-1.svc:8089/v2/teams-instance-1 -``` + ```yaml + url: http://rancher-alerting-drivers-prom2teams..svc:8089/v2/connector + ``` @@ -187,7 +181,7 @@ The SMS receiver is not a native receiver and must be enabled before it can be u 1. Select the **SMS** option and click **Install**. 1. Take note of the namespace used as it will be required in a later step. -### Configure the SMS Receiver +### Configuring the SMS Receiver The SMS receiver can be configured by updating its ConfigMap. For example, the following is a minimal SMS receiver configuration. From 5a9d423cb63bd035f74bc0b6ed73d46ed4fc9ec9 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Wed, 21 Feb 2024 10:55:26 -0800 Subject: [PATCH 22/54] Globally import CNI popularity --- docs/faq/container-network-interface-providers.md | 2 -- src/theme/MDXComponents.js | 4 ++++ .../faq/container-network-interface-providers.md | 2 -- .../version-2.5/faq/container-network-interface-providers.md | 2 -- .../version-2.6/faq/container-network-interface-providers.md | 2 -- .../version-2.7/faq/container-network-interface-providers.md | 2 -- .../version-2.8/faq/container-network-interface-providers.md | 2 -- 7 files changed, 4 insertions(+), 12 deletions(-) diff --git a/docs/faq/container-network-interface-providers.md b/docs/faq/container-network-interface-providers.md index a8662eaf14a..cb65dd9238d 100644 --- a/docs/faq/container-network-interface-providers.md +++ b/docs/faq/container-network-interface-providers.md @@ -184,8 +184,6 @@ The following table summarizes the different features available for each CNI net ## CNI Community Popularity -import CNIPopularityTable from '/shared-files/_cni-popularity.md'; - ## Which CNI Provider Should I Use? diff --git a/src/theme/MDXComponents.js b/src/theme/MDXComponents.js index b2618e44a67..a3ad9fedc5d 100644 --- a/src/theme/MDXComponents.js +++ b/src/theme/MDXComponents.js @@ -6,6 +6,8 @@ import TabItem from '@theme/TabItem'; import { CardSection, Card } from '../components/CardComponents'; +import CNIPopularityTable from '/shared-files/_cni-popularity.md'; + export default { // Re-use the default mapping ...MDXComponents, @@ -15,4 +17,6 @@ export default { CardSection, Card, + + CNIPopularityTable, }; diff --git a/versioned_docs/version-2.0-2.4/faq/container-network-interface-providers.md b/versioned_docs/version-2.0-2.4/faq/container-network-interface-providers.md index 4c2662c0a91..8c9b3a5351b 100644 --- a/versioned_docs/version-2.0-2.4/faq/container-network-interface-providers.md +++ b/versioned_docs/version-2.0-2.4/faq/container-network-interface-providers.md @@ -136,8 +136,6 @@ The following table summarizes the different features available for each CNI net ### CNI Community Popularity -import CNIPopularityTable from '/shared-files/_cni-popularity.md'; - ### Which CNI Provider Should I Use? diff --git a/versioned_docs/version-2.5/faq/container-network-interface-providers.md b/versioned_docs/version-2.5/faq/container-network-interface-providers.md index 3e11f8cb90b..2368ea0fc81 100644 --- a/versioned_docs/version-2.5/faq/container-network-interface-providers.md +++ b/versioned_docs/version-2.5/faq/container-network-interface-providers.md @@ -134,8 +134,6 @@ The following table summarizes the different features available for each CNI net ### CNI Community Popularity -import CNIPopularityTable from '/shared-files/_cni-popularity.md'; - ### Which CNI Provider Should I Use? diff --git a/versioned_docs/version-2.6/faq/container-network-interface-providers.md b/versioned_docs/version-2.6/faq/container-network-interface-providers.md index a8662eaf14a..cb65dd9238d 100644 --- a/versioned_docs/version-2.6/faq/container-network-interface-providers.md +++ b/versioned_docs/version-2.6/faq/container-network-interface-providers.md @@ -184,8 +184,6 @@ The following table summarizes the different features available for each CNI net ## CNI Community Popularity -import CNIPopularityTable from '/shared-files/_cni-popularity.md'; - ## Which CNI Provider Should I Use? diff --git a/versioned_docs/version-2.7/faq/container-network-interface-providers.md b/versioned_docs/version-2.7/faq/container-network-interface-providers.md index a8662eaf14a..cb65dd9238d 100644 --- a/versioned_docs/version-2.7/faq/container-network-interface-providers.md +++ b/versioned_docs/version-2.7/faq/container-network-interface-providers.md @@ -184,8 +184,6 @@ The following table summarizes the different features available for each CNI net ## CNI Community Popularity -import CNIPopularityTable from '/shared-files/_cni-popularity.md'; - ## Which CNI Provider Should I Use? diff --git a/versioned_docs/version-2.8/faq/container-network-interface-providers.md b/versioned_docs/version-2.8/faq/container-network-interface-providers.md index a8662eaf14a..cb65dd9238d 100644 --- a/versioned_docs/version-2.8/faq/container-network-interface-providers.md +++ b/versioned_docs/version-2.8/faq/container-network-interface-providers.md @@ -184,8 +184,6 @@ The following table summarizes the different features available for each CNI net ## CNI Community Popularity -import CNIPopularityTable from '/shared-files/_cni-popularity.md'; - ## Which CNI Provider Should I Use? From afa972e2b203cf68dddaa0e8cc3660d7d20bd539 Mon Sep 17 00:00:00 2001 From: Marty Hernandez Avedon Date: Wed, 21 Feb 2024 15:42:51 -0500 Subject: [PATCH 23/54] Syncing versions for #1014 (#1136) Accidentally merged after confirmation w/o realizing that the PR needed to be versioned --- .../monitoring-v2-configuration/receivers.md | 26 ++++++++--------- .../monitoring-v2-configuration/receivers.md | 28 ++++++++----------- .../monitoring-v2-configuration/receivers.md | 28 ++++++++----------- 3 files changed, 33 insertions(+), 49 deletions(-) diff --git a/versioned_docs/version-2.6/reference-guides/monitoring-v2-configuration/receivers.md b/versioned_docs/version-2.6/reference-guides/monitoring-v2-configuration/receivers.md index 631e589009c..fa55d466451 100644 --- a/versioned_docs/version-2.6/reference-guides/monitoring-v2-configuration/receivers.md +++ b/versioned_docs/version-2.6/reference-guides/monitoring-v2-configuration/receivers.md @@ -167,24 +167,20 @@ The Teams receiver is not a native receiver and must be enabled before it can be -### Configure the Teams Receiver +### Configuring the Teams Receiver -The Teams receiver can be configured by updating its ConfigMap. For example, the following is a minimal Teams receiver configuration. +1. To configure the Teams receiver, update its ConfigMap. The following example is a minimal Teams receiver configuration: -```yaml -[Microsoft Teams] -teams-instance-1: https://your-teams-webhook-url -``` + ```yaml + [Microsoft Teams] + connector: https://your-teams-webhook-url + ``` -When configuration is complete, add the receiver using the steps in [this section](#creating-receivers-in-the-rancher-ui). +2. After you update the configuration, follow the instructions in [Creating Receivers in the Rancher UI](#creating-receivers-in-the-rancher-ui) to add the receiver. Use the example below to form your URL. Make sure to replace `` with the namespace of the `rancher-alerting-drivers` app: -Use the example below as the URL where: - -- `ns-1` is replaced with the namespace where the `rancher-alerting-drivers` app is installed - -```yaml -url: http://rancher-alerting-drivers-prom2teams.ns-1.svc:8089/v2/teams-instance-1 -``` + ```yaml + url: http://rancher-alerting-drivers-prom2teams..svc:8089/v2/connector + ``` @@ -202,7 +198,7 @@ The SMS receiver is not a native receiver and must be enabled before it can be u 1. Select the **SMS** option and click **Install**. 1. Take note of the namespace used as it will be required in a later step. -### Configure the SMS Receiver +### Configuring the SMS Receiver The SMS receiver can be configured by updating its ConfigMap. For example, the following is a minimal SMS receiver configuration. diff --git a/versioned_docs/version-2.7/reference-guides/monitoring-v2-configuration/receivers.md b/versioned_docs/version-2.7/reference-guides/monitoring-v2-configuration/receivers.md index dc459f34378..79d9749dc18 100644 --- a/versioned_docs/version-2.7/reference-guides/monitoring-v2-configuration/receivers.md +++ b/versioned_docs/version-2.7/reference-guides/monitoring-v2-configuration/receivers.md @@ -24,8 +24,6 @@ This section assumes familiarity with how monitoring components work together. F ::: -To create notification receivers in the Rancher UI, - @@ -152,24 +150,20 @@ The Teams receiver is not a native receiver and must be enabled before it can be 1. Select the **Teams** option and click **Install**. 1. Take note of the namespace used as it will be required in a later step. -### Configure the Teams Receiver +### Configuring the Teams Receiver -The Teams receiver can be configured by updating its ConfigMap. For example, the following is a minimal Teams receiver configuration. +1. To configure the Teams receiver, update its ConfigMap. The following example is a minimal Teams receiver configuration: -```yaml -[Microsoft Teams] -teams-instance-1: https://your-teams-webhook-url -``` + ```yaml + [Microsoft Teams] + connector: https://your-teams-webhook-url + ``` -When configuration is complete, add the receiver using the steps in [this section](#creating-receivers-in-the-rancher-ui). +2. After you update the configuration, follow the instructions in [Creating Receivers in the Rancher UI](#creating-receivers-in-the-rancher-ui) to add the receiver. Use the example below to form your URL. Make sure to replace `` with the namespace of the `rancher-alerting-drivers` app: -Use the example below as the URL where: - -- `ns-1` is replaced with the namespace where the `rancher-alerting-drivers` app is installed - -```yaml -url: http://rancher-alerting-drivers-prom2teams.ns-1.svc:8089/v2/teams-instance-1 -``` + ```yaml + url: http://rancher-alerting-drivers-prom2teams..svc:8089/v2/connector + ``` @@ -187,7 +181,7 @@ The SMS receiver is not a native receiver and must be enabled before it can be u 1. Select the **SMS** option and click **Install**. 1. Take note of the namespace used as it will be required in a later step. -### Configure the SMS Receiver +### Configuring the SMS Receiver The SMS receiver can be configured by updating its ConfigMap. For example, the following is a minimal SMS receiver configuration. diff --git a/versioned_docs/version-2.8/reference-guides/monitoring-v2-configuration/receivers.md b/versioned_docs/version-2.8/reference-guides/monitoring-v2-configuration/receivers.md index dc459f34378..79d9749dc18 100644 --- a/versioned_docs/version-2.8/reference-guides/monitoring-v2-configuration/receivers.md +++ b/versioned_docs/version-2.8/reference-guides/monitoring-v2-configuration/receivers.md @@ -24,8 +24,6 @@ This section assumes familiarity with how monitoring components work together. F ::: -To create notification receivers in the Rancher UI, - @@ -152,24 +150,20 @@ The Teams receiver is not a native receiver and must be enabled before it can be 1. Select the **Teams** option and click **Install**. 1. Take note of the namespace used as it will be required in a later step. -### Configure the Teams Receiver +### Configuring the Teams Receiver -The Teams receiver can be configured by updating its ConfigMap. For example, the following is a minimal Teams receiver configuration. +1. To configure the Teams receiver, update its ConfigMap. The following example is a minimal Teams receiver configuration: -```yaml -[Microsoft Teams] -teams-instance-1: https://your-teams-webhook-url -``` + ```yaml + [Microsoft Teams] + connector: https://your-teams-webhook-url + ``` -When configuration is complete, add the receiver using the steps in [this section](#creating-receivers-in-the-rancher-ui). +2. After you update the configuration, follow the instructions in [Creating Receivers in the Rancher UI](#creating-receivers-in-the-rancher-ui) to add the receiver. Use the example below to form your URL. Make sure to replace `` with the namespace of the `rancher-alerting-drivers` app: -Use the example below as the URL where: - -- `ns-1` is replaced with the namespace where the `rancher-alerting-drivers` app is installed - -```yaml -url: http://rancher-alerting-drivers-prom2teams.ns-1.svc:8089/v2/teams-instance-1 -``` + ```yaml + url: http://rancher-alerting-drivers-prom2teams..svc:8089/v2/connector + ``` @@ -187,7 +181,7 @@ The SMS receiver is not a native receiver and must be enabled before it can be u 1. Select the **SMS** option and click **Install**. 1. Take note of the namespace used as it will be required in a later step. -### Configure the SMS Receiver +### Configuring the SMS Receiver The SMS receiver can be configured by updating its ConfigMap. For example, the following is a minimal SMS receiver configuration. From ba0fefb289af19aea3332dfa27d54bf94cc9c7de Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Thu, 22 Feb 2024 10:39:31 -0800 Subject: [PATCH 24/54] Updating CNI table with current stats as part of maintenance check list for 2.7.11. Signed-off-by: Sunil Singh --- shared-files/_cni-popularity.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/shared-files/_cni-popularity.md b/shared-files/_cni-popularity.md index aebd14ed3fd..1135809c068 100644 --- a/shared-files/_cni-popularity.md +++ b/shared-files/_cni-popularity.md @@ -5,6 +5,6 @@ The following table summarizes different GitHub metrics to give you an idea of e | ---- | ---- | ---- | ---- | ---- | | Canal | https://github.com/projectcalico/canal | 708 | 103 | 20 | | Flannel | https://github.com/flannel-io/flannel | 8.4k | 2.9k | 231 | -| Calico | https://github.com/projectcalico/calico | 5.3k | 1.2k | 335 | -| Weave | https://github.com/weaveworks/weave/ | 6.5k | 670 | 87 | -| Cilium | https://github.com/cilium/cilium | 17.8k | 2.6k | 699 | +| Calico | https://github.com/projectcalico/calico | 5.3k | 1.2k | 336 | +| Weave | https://github.com/weaveworks/weave/ | 6.6k | 679 | 87 | +| Cilium | https://github.com/cilium/cilium | 18k | 2.6k | 706 | From b29b762dd6d608f1ba69a2fb8dd6979639536ea2 Mon Sep 17 00:00:00 2001 From: Max Sokolovsky Date: Thu, 22 Feb 2024 21:17:16 +0000 Subject: [PATCH 25/54] Add a note about project deletion in Public API Update docs/api/workflows/projects.md Co-authored-by: Marty Hernandez Avedon --- docs/api/workflows/projects.md | 2 ++ versioned_docs/version-2.8/api/workflows/projects.md | 2 ++ 2 files changed, 4 insertions(+) diff --git a/docs/api/workflows/projects.md b/docs/api/workflows/projects.md index f746ade11d6..549ceff5423 100644 --- a/docs/api/workflows/projects.md +++ b/docs/api/workflows/projects.md @@ -111,3 +111,5 @@ Delete the project under the cluster namespace: ```bash kubectl --namespace c-m-abcde delete project p-vwxyz ``` + +Note that this command doesn't delete the namespaces and resources that formerly belonged to the project. diff --git a/versioned_docs/version-2.8/api/workflows/projects.md b/versioned_docs/version-2.8/api/workflows/projects.md index f746ade11d6..b6f9a3b1d8b 100644 --- a/versioned_docs/version-2.8/api/workflows/projects.md +++ b/versioned_docs/version-2.8/api/workflows/projects.md @@ -111,3 +111,5 @@ Delete the project under the cluster namespace: ```bash kubectl --namespace c-m-abcde delete project p-vwxyz ``` + +Note that this command doesn't delete the namespaces and resources that formerly belonged to the project. From 1e76595c2fde07bd1b03dbf4775101c07e52799a Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Thu, 22 Feb 2024 16:20:11 -0800 Subject: [PATCH 26/54] Add OPA Gatekeeper deprecation notice --- docs/integrations-in-rancher/opa-gatekeeper.md | 2 ++ docs/reference-guides/rancher-cluster-tools.md | 3 +++ shared-files/_deprecation-opa-gatekeeper.md | 5 +++++ src/theme/MDXComponents.js | 2 ++ .../version-2.8/integrations-in-rancher/opa-gatekeeper.md | 2 ++ .../version-2.8/reference-guides/rancher-cluster-tools.md | 3 +++ 6 files changed, 17 insertions(+) create mode 100644 shared-files/_deprecation-opa-gatekeeper.md diff --git a/docs/integrations-in-rancher/opa-gatekeeper.md b/docs/integrations-in-rancher/opa-gatekeeper.md index f2185dff685..cea9732b36c 100644 --- a/docs/integrations-in-rancher/opa-gatekeeper.md +++ b/docs/integrations-in-rancher/opa-gatekeeper.md @@ -6,6 +6,8 @@ title: OPA Gatekeeper + + To ensure consistency and compliance, every organization needs the ability to define and enforce policies in its environment in an automated way. [OPA (Open Policy Agent)](https://www.openpolicyagent.org/) is a policy engine that facilitates policy-based control for cloud native environments. Rancher provides the ability to enable OPA Gatekeeper in Kubernetes clusters, and also installs a couple of built-in policy definitions, which are also called constraint templates. OPA provides a high-level declarative language that lets you specify policy as code and ability to extend simple APIs to offload policy decision-making. diff --git a/docs/reference-guides/rancher-cluster-tools.md b/docs/reference-guides/rancher-cluster-tools.md index ca037f533de..5221e0f150e 100644 --- a/docs/reference-guides/rancher-cluster-tools.md +++ b/docs/reference-guides/rancher-cluster-tools.md @@ -41,8 +41,11 @@ For more information, refer to the monitoring documentation [here.](../integrati Rancher's integration with Istio was improved in Rancher v2.5. For more information, refer to the Istio documentation [here.](../integrations-in-rancher/istio/istio.md) + ## OPA Gatekeeper + + [OPA Gatekeeper](https://github.com/open-policy-agent/gatekeeper) is an open-source project that provides integration between OPA and Kubernetes to provide policy control via admission controller webhooks. For details on how to enable Gatekeeper in Rancher, refer to the [OPA Gatekeeper section.](../integrations-in-rancher/opa-gatekeeper.md) ## CIS Scans diff --git a/shared-files/_deprecation-opa-gatekeeper.md b/shared-files/_deprecation-opa-gatekeeper.md new file mode 100644 index 00000000000..3a88f57b0d6 --- /dev/null +++ b/shared-files/_deprecation-opa-gatekeeper.md @@ -0,0 +1,5 @@ +:::warning + +OPA Gatekeeper is deprecated and will be removed in a future release. As a replacement for OPA Gatekeeper, consider switching to Kubewarden. + +::: diff --git a/src/theme/MDXComponents.js b/src/theme/MDXComponents.js index a3ad9fedc5d..540ac390d56 100644 --- a/src/theme/MDXComponents.js +++ b/src/theme/MDXComponents.js @@ -7,6 +7,7 @@ import TabItem from '@theme/TabItem'; import { CardSection, Card } from '../components/CardComponents'; import CNIPopularityTable from '/shared-files/_cni-popularity.md'; +import DeprecationOPAGatekeeper from '/shared-files/_deprecation-opa-gatekeeper.md'; export default { // Re-use the default mapping @@ -19,4 +20,5 @@ export default { Card, CNIPopularityTable, + DeprecationOPAGatekeeper, }; diff --git a/versioned_docs/version-2.8/integrations-in-rancher/opa-gatekeeper.md b/versioned_docs/version-2.8/integrations-in-rancher/opa-gatekeeper.md index f2185dff685..cea9732b36c 100644 --- a/versioned_docs/version-2.8/integrations-in-rancher/opa-gatekeeper.md +++ b/versioned_docs/version-2.8/integrations-in-rancher/opa-gatekeeper.md @@ -6,6 +6,8 @@ title: OPA Gatekeeper + + To ensure consistency and compliance, every organization needs the ability to define and enforce policies in its environment in an automated way. [OPA (Open Policy Agent)](https://www.openpolicyagent.org/) is a policy engine that facilitates policy-based control for cloud native environments. Rancher provides the ability to enable OPA Gatekeeper in Kubernetes clusters, and also installs a couple of built-in policy definitions, which are also called constraint templates. OPA provides a high-level declarative language that lets you specify policy as code and ability to extend simple APIs to offload policy decision-making. diff --git a/versioned_docs/version-2.8/reference-guides/rancher-cluster-tools.md b/versioned_docs/version-2.8/reference-guides/rancher-cluster-tools.md index ca037f533de..5221e0f150e 100644 --- a/versioned_docs/version-2.8/reference-guides/rancher-cluster-tools.md +++ b/versioned_docs/version-2.8/reference-guides/rancher-cluster-tools.md @@ -41,8 +41,11 @@ For more information, refer to the monitoring documentation [here.](../integrati Rancher's integration with Istio was improved in Rancher v2.5. For more information, refer to the Istio documentation [here.](../integrations-in-rancher/istio/istio.md) + ## OPA Gatekeeper + + [OPA Gatekeeper](https://github.com/open-policy-agent/gatekeeper) is an open-source project that provides integration between OPA and Kubernetes to provide policy control via admission controller webhooks. For details on how to enable Gatekeeper in Rancher, refer to the [OPA Gatekeeper section.](../integrations-in-rancher/opa-gatekeeper.md) ## CIS Scans From ff63f1111609de860f218babf7a116f29934995d Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Fri, 23 Feb 2024 13:23:23 -0800 Subject: [PATCH 27/54] Add Weave deprecation notice --- docs/faq/container-network-interface-providers.md | 2 ++ .../rke1-cluster-configuration.md | 2 ++ shared-files/_deprecation-weave.md | 5 +++++ src/theme/MDXComponents.js | 2 ++ .../version-2.7/faq/container-network-interface-providers.md | 2 ++ .../rke1-cluster-configuration.md | 2 ++ .../version-2.8/faq/container-network-interface-providers.md | 2 ++ .../rke1-cluster-configuration.md | 2 ++ 8 files changed, 19 insertions(+) create mode 100644 shared-files/_deprecation-weave.md diff --git a/docs/faq/container-network-interface-providers.md b/docs/faq/container-network-interface-providers.md index cb65dd9238d..c90060a6456 100644 --- a/docs/faq/container-network-interface-providers.md +++ b/docs/faq/container-network-interface-providers.md @@ -86,6 +86,8 @@ For more information, see the [Flannel GitHub Page](https://github.com/flannel-i #### Weave + + ![Weave Logo](/img/weave-logo.png) Weave enables networking and network policy in Kubernetes clusters across the cloud. Additionally, it support encrypting traffic between the peers. diff --git a/docs/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md b/docs/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md index d97170934a7..5668d117432 100644 --- a/docs/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md +++ b/docs/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md @@ -78,6 +78,8 @@ Out of the box, Rancher is compatible with the following network providers: - [Calico](https://docs.projectcalico.org/v3.11/introduction/) - [Weave](https://github.com/weaveworks/weave) + + :::note Notes on Weave: When Weave is selected as network provider, Rancher will automatically enable encryption by generating a random password. If you want to specify the password manually, please see how to configure your cluster using a [Config File](#rke-cluster-config-file-reference) and the [Weave Network Plug-in Options](https://rancher.com/docs/rke/latest/en/config-options/add-ons/network-plugins/#weave-network-plug-in-options). diff --git a/shared-files/_deprecation-weave.md b/shared-files/_deprecation-weave.md new file mode 100644 index 00000000000..ba0c5ff4f32 --- /dev/null +++ b/shared-files/_deprecation-weave.md @@ -0,0 +1,5 @@ +:::warning + +The Weave CNI plugin for RKE with Kubernetes v1.27 and later is now deprecated. Weave will be removed in RKE with Kubernetes v1.30. + +::: diff --git a/src/theme/MDXComponents.js b/src/theme/MDXComponents.js index 540ac390d56..bbaf55b56b7 100644 --- a/src/theme/MDXComponents.js +++ b/src/theme/MDXComponents.js @@ -8,6 +8,7 @@ import { CardSection, Card } from '../components/CardComponents'; import CNIPopularityTable from '/shared-files/_cni-popularity.md'; import DeprecationOPAGatekeeper from '/shared-files/_deprecation-opa-gatekeeper.md'; +import DeprecationWeave from '/shared-files/_deprecation-weave.md'; export default { // Re-use the default mapping @@ -21,4 +22,5 @@ export default { CNIPopularityTable, DeprecationOPAGatekeeper, + DeprecationWeave, }; diff --git a/versioned_docs/version-2.7/faq/container-network-interface-providers.md b/versioned_docs/version-2.7/faq/container-network-interface-providers.md index cb65dd9238d..c90060a6456 100644 --- a/versioned_docs/version-2.7/faq/container-network-interface-providers.md +++ b/versioned_docs/version-2.7/faq/container-network-interface-providers.md @@ -86,6 +86,8 @@ For more information, see the [Flannel GitHub Page](https://github.com/flannel-i #### Weave + + ![Weave Logo](/img/weave-logo.png) Weave enables networking and network policy in Kubernetes clusters across the cloud. Additionally, it support encrypting traffic between the peers. diff --git a/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md b/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md index d97170934a7..5668d117432 100644 --- a/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md +++ b/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md @@ -78,6 +78,8 @@ Out of the box, Rancher is compatible with the following network providers: - [Calico](https://docs.projectcalico.org/v3.11/introduction/) - [Weave](https://github.com/weaveworks/weave) + + :::note Notes on Weave: When Weave is selected as network provider, Rancher will automatically enable encryption by generating a random password. If you want to specify the password manually, please see how to configure your cluster using a [Config File](#rke-cluster-config-file-reference) and the [Weave Network Plug-in Options](https://rancher.com/docs/rke/latest/en/config-options/add-ons/network-plugins/#weave-network-plug-in-options). diff --git a/versioned_docs/version-2.8/faq/container-network-interface-providers.md b/versioned_docs/version-2.8/faq/container-network-interface-providers.md index cb65dd9238d..c90060a6456 100644 --- a/versioned_docs/version-2.8/faq/container-network-interface-providers.md +++ b/versioned_docs/version-2.8/faq/container-network-interface-providers.md @@ -86,6 +86,8 @@ For more information, see the [Flannel GitHub Page](https://github.com/flannel-i #### Weave + + ![Weave Logo](/img/weave-logo.png) Weave enables networking and network policy in Kubernetes clusters across the cloud. Additionally, it support encrypting traffic between the peers. diff --git a/versioned_docs/version-2.8/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md b/versioned_docs/version-2.8/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md index d97170934a7..5668d117432 100644 --- a/versioned_docs/version-2.8/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md +++ b/versioned_docs/version-2.8/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md @@ -78,6 +78,8 @@ Out of the box, Rancher is compatible with the following network providers: - [Calico](https://docs.projectcalico.org/v3.11/introduction/) - [Weave](https://github.com/weaveworks/weave) + + :::note Notes on Weave: When Weave is selected as network provider, Rancher will automatically enable encryption by generating a random password. If you want to specify the password manually, please see how to configure your cluster using a [Config File](#rke-cluster-config-file-reference) and the [Weave Network Plug-in Options](https://rancher.com/docs/rke/latest/en/config-options/add-ons/network-plugins/#weave-network-plug-in-options). From f2a8dfaa0a9130adda7070b8fcf1140a68630c71 Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Fri, 23 Feb 2024 14:15:15 -0800 Subject: [PATCH 28/54] Increasing the heap size as recent build failed due to heap allocation error. Signed-off-by: Sunil Singh --- .github/workflows/deploy.yml | 2 +- .github/workflows/test-deploy.yml | 2 +- package.json | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index bed50097307..f228eefae5f 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -22,7 +22,7 @@ jobs: run: yarn install --frozen-lockfile - name: Build website env: - NODE_OPTIONS: "--max_old_space_size=6144" + NODE_OPTIONS: "--max_old_space_size=7168" run: yarn build --no-minify # Popular action to deploy to GitHub Pages: diff --git a/.github/workflows/test-deploy.yml b/.github/workflows/test-deploy.yml index 3af251f1453..39e8fa97909 100644 --- a/.github/workflows/test-deploy.yml +++ b/.github/workflows/test-deploy.yml @@ -24,5 +24,5 @@ jobs: run: yarn run remark --quiet --use remark-lint-no-dead-urls ./docs - name: Test build website env: - NODE_OPTIONS: "--max_old_space_size=6144" + NODE_OPTIONS: "--max_old_space_size=7168" run: yarn build --no-minify \ No newline at end of file diff --git a/package.json b/package.json index e7d60f81353..4b7bac95674 100644 --- a/package.json +++ b/package.json @@ -5,7 +5,7 @@ "scripts": { "docusaurus": "docusaurus", "start": "docusaurus start", - "build": "NODE_OPTIONS='--max-old-space-size=6144' docusaurus build", + "build": "NODE_OPTIONS='--max-old-space-size=7168' docusaurus build", "swizzle": "docusaurus swizzle", "deploy": "docusaurus deploy", "clear": "docusaurus clear", From 53357bc7f06fbb67d99f5be7c3a51c6cd866e090 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Wed, 21 Feb 2024 10:53:01 -0800 Subject: [PATCH 29/54] Explicitly indicate when unavaiable. More descriptive headers --- docs/reference-guides/rancher-webhook.md | 10 +++---- .../reference-guides/rancher-webhook.md | 26 +++++++++---------- .../reference-guides/rancher-webhook.md | 10 +++---- 3 files changed, 23 insertions(+), 23 deletions(-) diff --git a/docs/reference-guides/rancher-webhook.md b/docs/reference-guides/rancher-webhook.md index e1aeb7b6750..b2237a1d442 100644 --- a/docs/reference-guides/rancher-webhook.md +++ b/docs/reference-guides/rancher-webhook.md @@ -17,11 +17,11 @@ Each Rancher version is designed to be compatible with a single version of the w -| Rancher Version | Webhook Version | Prime | Community | -|-----------------|-----------------|---------|-----------| -| v2.8.2 | v0.4.2 | ✓ | ✓ | -| v2.8.1 | v0.4.2 | ✓ | ✓ | -| v2.8.0 | v0.4.2 | | ✓ | +| Rancher Version | Webhook Version | Availability in Prime | Availability in Community | +|-----------------|-----------------|-----------------------|---------------------------| +| v2.8.2 | v0.4.2 | ✓ | ✓ | +| v2.8.1 | v0.4.2 | ✓ | ✓ | +| v2.8.0 | v0.4.2 | ✗ | ✓ | ## Why Do We Need It? diff --git a/versioned_docs/version-2.7/reference-guides/rancher-webhook.md b/versioned_docs/version-2.7/reference-guides/rancher-webhook.md index a79691713f2..f408f5893d5 100644 --- a/versioned_docs/version-2.7/reference-guides/rancher-webhook.md +++ b/versioned_docs/version-2.7/reference-guides/rancher-webhook.md @@ -18,19 +18,19 @@ Each Rancher version is designed to be compatible with a single version of the w -| Rancher Version | Webhook Version | Prime | Community | -|-----------------|-----------------|---------|-----------| -| v2.7.10 | v0.3.6 | ✓ | ✓ | -| v2.7.9 | v0.3.6 | | ✓ | -| v2.7.8 | v0.3.6 | | ✓ | -| v2.7.7 | v0.3.6 | ✓ | ✓ | -| v2.7.6 | v0.3.5 | ✓ | ✓ | -| v2.7.5 | v0.3.5 | ✓ | ✓ | -| v2.7.4 | v0.3.4 | ✓ | ✓ | -| v2.7.3 | v0.3.3 | ✓ | ✓ | -| v2.7.2 | v0.3.2 | ✓ | ✓ | -| v2.7.1 | v0.3.0 | ✓ | ✓ | -| v2.7.0 | v0.3.0 | ✓ | ✓ | +| Rancher Version | Webhook Version | Availability in Prime | Availability in Community | +|-----------------|-----------------|-----------------------|---------------------------| +| v2.7.10 | v0.3.6 | ✓ | ✓ | +| v2.7.9 | v0.3.6 | ✗ | ✓ | +| v2.7.8 | v0.3.6 | ✗ | ✓ | +| v2.7.7 | v0.3.6 | ✓ | ✓ | +| v2.7.6 | v0.3.5 | ✓ | ✓ | +| v2.7.5 | v0.3.5 | ✓ | ✓ | +| v2.7.4 | v0.3.4 | ✓ | ✓ | +| v2.7.3 | v0.3.3 | ✓ | ✓ | +| v2.7.2 | v0.3.2 | ✓ | ✓ | +| v2.7.1 | v0.3.0 | ✓ | ✓ | +| v2.7.0 | v0.3.0 | ✓ | ✓ | ## Why Do We Need It? diff --git a/versioned_docs/version-2.8/reference-guides/rancher-webhook.md b/versioned_docs/version-2.8/reference-guides/rancher-webhook.md index b789245b4dd..f998b2f2ed7 100644 --- a/versioned_docs/version-2.8/reference-guides/rancher-webhook.md +++ b/versioned_docs/version-2.8/reference-guides/rancher-webhook.md @@ -18,11 +18,11 @@ Each Rancher version is designed to be compatible with a single version of the w -| Rancher Version | Webhook Version | Prime | Community | -|-----------------|-----------------|---------|-----------| -| v2.8.2 | v0.4.2 | ✓ | ✓ | -| v2.8.1 | v0.4.2 | ✓ | ✓ | -| v2.8.0 | v0.4.2 | | ✓ | +| Rancher Version | Webhook Version | Availability in Prime | Availability in Community | +|-----------------|-----------------|-----------------------|---------------------------| +| v2.8.2 | v0.4.2 | ✓ | ✓ | +| v2.8.1 | v0.4.2 | ✓ | ✓ | +| v2.8.0 | v0.4.2 | ✗ | ✓ | ## Why Do We Need It? From a7ce4ff08f9717ea1762d071b9f21c85dfa6af60 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Mon, 26 Feb 2024 16:22:39 -0800 Subject: [PATCH 30/54] Add Helm 2 deprecation note --- .../install-upgrade-on-a-kubernetes-cluster/upgrades.md | 3 +++ .../rancher-behind-an-http-proxy/install-rancher.md | 2 ++ .../resources/helm-version-requirements.md | 2 ++ .../resources/upgrade-cert-manager.md | 2 ++ shared-files/_deprecation-helm2.md | 5 +++++ src/theme/MDXComponents.js | 2 ++ .../install-upgrade-on-a-kubernetes-cluster/upgrades.md | 3 +++ .../rancher-behind-an-http-proxy/install-rancher.md | 2 ++ .../resources/helm-version-requirements.md | 2 ++ .../resources/upgrade-cert-manager.md | 2 ++ .../install-upgrade-on-a-kubernetes-cluster/upgrades.md | 3 +++ .../rancher-behind-an-http-proxy/install-rancher.md | 2 ++ .../resources/helm-version-requirements.md | 2 ++ .../resources/upgrade-cert-manager.md | 2 ++ 14 files changed, 34 insertions(+) create mode 100644 shared-files/_deprecation-helm2.md diff --git a/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md b/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md index 3932fd5c4b9..6a5107aea05 100644 --- a/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md +++ b/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md @@ -28,10 +28,13 @@ The kubeconfig can also be manually targeted for the intended cluster with the ` Review the list of known issues for each Rancher version, which can be found in the release notes on [GitHub](https://github.com/rancher/rancher/releases) and on the [Rancher forums.](https://forums.rancher.com/c/announcements/12) Note that upgrades _to_ or _from_ any chart in the [rancher-alpha repository](../resources/choose-a-rancher-version.md#helm-chart-repositories) aren't supported. + ### Helm Version The upgrade instructions assume you are using Helm 3. + + For migration of installs started with Helm 2, refer to the official [Helm 2 to 3 migration docs.](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/) The [Helm 2 upgrade page here](/versioned_docs/version-2.0-2.4/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades/helm2.md)provides a copy of the older upgrade instructions that used Helm 2, and it is intended to be used if upgrading to Helm 3 is not feasible. ### For air-gapped installs: Populate private registry diff --git a/docs/getting-started/installation-and-upgrade/other-installation-methods/rancher-behind-an-http-proxy/install-rancher.md b/docs/getting-started/installation-and-upgrade/other-installation-methods/rancher-behind-an-http-proxy/install-rancher.md index 9d4a4c8393e..c2a6ace6343 100644 --- a/docs/getting-started/installation-and-upgrade/other-installation-methods/rancher-behind-an-http-proxy/install-rancher.md +++ b/docs/getting-started/installation-and-upgrade/other-installation-methods/rancher-behind-an-http-proxy/install-rancher.md @@ -10,6 +10,8 @@ Now that you have a running RKE cluster, you can install Rancher in it. For secu ### Install the Helm CLI + + Install the [Helm](https://helm.sh/docs/intro/install/) CLI on a host where you have a kubeconfig to access your Kubernetes cluster: ``` diff --git a/docs/getting-started/installation-and-upgrade/resources/helm-version-requirements.md b/docs/getting-started/installation-and-upgrade/resources/helm-version-requirements.md index 8d98fe60458..6118e567f0c 100644 --- a/docs/getting-started/installation-and-upgrade/resources/helm-version-requirements.md +++ b/docs/getting-started/installation-and-upgrade/resources/helm-version-requirements.md @@ -10,6 +10,8 @@ This section contains the requirements for Helm, which is the tool used to insta > The installation instructions have been updated for Helm 3. For migration of installs started with Helm 2, refer to the official [Helm 2 to 3 Migration Docs.](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/) [This section](/versioned_docs/version-2.0-2.4/pages-for-subheaders/helm2.md) provides a copy of the older high-availability Rancher installation instructions that used Helm 2, and it is intended to be used if upgrading to Helm 3 is not feasible. + + - Helm v3.2.x or higher is required to install or upgrade Rancher v2.5. - Helm v2.16.0 or higher is required for Kubernetes v1.16. For the default Kubernetes version, refer to the [release notes](https://github.com/rancher/rke/releases) for the version of RKE that you are using. - Helm v2.15.0 should not be used, because of an issue with converting/comparing numbers. diff --git a/docs/getting-started/installation-and-upgrade/resources/upgrade-cert-manager.md b/docs/getting-started/installation-and-upgrade/resources/upgrade-cert-manager.md index dd00964ef02..ff5f495f501 100644 --- a/docs/getting-started/installation-and-upgrade/resources/upgrade-cert-manager.md +++ b/docs/getting-started/installation-and-upgrade/resources/upgrade-cert-manager.md @@ -145,6 +145,8 @@ Before you can perform the upgrade, you must prepare your air gapped environment --set cainjector.image.repository=/quay.io/jetstack/cert-manager-cainjector ``` + + The Helm 2 command is as follows: ```plain diff --git a/shared-files/_deprecation-helm2.md b/shared-files/_deprecation-helm2.md new file mode 100644 index 00000000000..7bb9bb3a8e3 --- /dev/null +++ b/shared-files/_deprecation-helm2.md @@ -0,0 +1,5 @@ +:::warning + +Helm v2 support is deprecated as of the Rancher v2.7 line and will be removed in Rancher v2.9. + +::: diff --git a/src/theme/MDXComponents.js b/src/theme/MDXComponents.js index 540ac390d56..e13c8e76ba4 100644 --- a/src/theme/MDXComponents.js +++ b/src/theme/MDXComponents.js @@ -8,6 +8,7 @@ import { CardSection, Card } from '../components/CardComponents'; import CNIPopularityTable from '/shared-files/_cni-popularity.md'; import DeprecationOPAGatekeeper from '/shared-files/_deprecation-opa-gatekeeper.md'; +import DeprecationHelm2 from '/shared-files/_deprecation-helm2.md'; export default { // Re-use the default mapping @@ -21,4 +22,5 @@ export default { CNIPopularityTable, DeprecationOPAGatekeeper, + DeprecationHelm2, }; diff --git a/versioned_docs/version-2.7/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md b/versioned_docs/version-2.7/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md index 70c112fb611..bc75b3a4680 100644 --- a/versioned_docs/version-2.7/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md +++ b/versioned_docs/version-2.7/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md @@ -28,8 +28,11 @@ The kubeconfig can also be manually targeted for the intended cluster with the ` Review the list of known issues for each Rancher version, which can be found in the release notes on [GitHub](https://github.com/rancher/rancher/releases) and on the [Rancher forums.](https://forums.rancher.com/c/announcements/12) Note that upgrades _to_ or _from_ any chart in the [rancher-alpha repository](../resources/choose-a-rancher-version.md#helm-chart-repositories) aren't supported. + ### Helm Version + + The upgrade instructions assume you are using Helm 3. For migration of installs started with Helm 2, refer to the official [Helm 2 to 3 migration docs.](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/) The [Helm 2 upgrade page here](/versioned_docs/version-2.0-2.4/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades/helm2.md)provides a copy of the older upgrade instructions that used Helm 2, and it is intended to be used if upgrading to Helm 3 is not feasible. diff --git a/versioned_docs/version-2.7/getting-started/installation-and-upgrade/other-installation-methods/rancher-behind-an-http-proxy/install-rancher.md b/versioned_docs/version-2.7/getting-started/installation-and-upgrade/other-installation-methods/rancher-behind-an-http-proxy/install-rancher.md index 9d4a4c8393e..c2a6ace6343 100644 --- a/versioned_docs/version-2.7/getting-started/installation-and-upgrade/other-installation-methods/rancher-behind-an-http-proxy/install-rancher.md +++ b/versioned_docs/version-2.7/getting-started/installation-and-upgrade/other-installation-methods/rancher-behind-an-http-proxy/install-rancher.md @@ -10,6 +10,8 @@ Now that you have a running RKE cluster, you can install Rancher in it. For secu ### Install the Helm CLI + + Install the [Helm](https://helm.sh/docs/intro/install/) CLI on a host where you have a kubeconfig to access your Kubernetes cluster: ``` diff --git a/versioned_docs/version-2.7/getting-started/installation-and-upgrade/resources/helm-version-requirements.md b/versioned_docs/version-2.7/getting-started/installation-and-upgrade/resources/helm-version-requirements.md index 8d98fe60458..6118e567f0c 100644 --- a/versioned_docs/version-2.7/getting-started/installation-and-upgrade/resources/helm-version-requirements.md +++ b/versioned_docs/version-2.7/getting-started/installation-and-upgrade/resources/helm-version-requirements.md @@ -10,6 +10,8 @@ This section contains the requirements for Helm, which is the tool used to insta > The installation instructions have been updated for Helm 3. For migration of installs started with Helm 2, refer to the official [Helm 2 to 3 Migration Docs.](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/) [This section](/versioned_docs/version-2.0-2.4/pages-for-subheaders/helm2.md) provides a copy of the older high-availability Rancher installation instructions that used Helm 2, and it is intended to be used if upgrading to Helm 3 is not feasible. + + - Helm v3.2.x or higher is required to install or upgrade Rancher v2.5. - Helm v2.16.0 or higher is required for Kubernetes v1.16. For the default Kubernetes version, refer to the [release notes](https://github.com/rancher/rke/releases) for the version of RKE that you are using. - Helm v2.15.0 should not be used, because of an issue with converting/comparing numbers. diff --git a/versioned_docs/version-2.7/getting-started/installation-and-upgrade/resources/upgrade-cert-manager.md b/versioned_docs/version-2.7/getting-started/installation-and-upgrade/resources/upgrade-cert-manager.md index dd00964ef02..ff5f495f501 100644 --- a/versioned_docs/version-2.7/getting-started/installation-and-upgrade/resources/upgrade-cert-manager.md +++ b/versioned_docs/version-2.7/getting-started/installation-and-upgrade/resources/upgrade-cert-manager.md @@ -145,6 +145,8 @@ Before you can perform the upgrade, you must prepare your air gapped environment --set cainjector.image.repository=/quay.io/jetstack/cert-manager-cainjector ``` + + The Helm 2 command is as follows: ```plain diff --git a/versioned_docs/version-2.8/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md b/versioned_docs/version-2.8/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md index 157151bdc04..b629e768d54 100644 --- a/versioned_docs/version-2.8/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md +++ b/versioned_docs/version-2.8/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.md @@ -28,8 +28,11 @@ The kubeconfig can also be manually targeted for the intended cluster with the ` Review the list of known issues for each Rancher version, which can be found in the release notes on [GitHub](https://github.com/rancher/rancher/releases) and on the [Rancher forums.](https://forums.rancher.com/c/announcements/12) Note that upgrades _to_ or _from_ any chart in the [rancher-alpha repository](../resources/choose-a-rancher-version.md#helm-chart-repositories) aren't supported. + ### Helm Version + + The upgrade instructions assume you are using Helm 3. For migration of installs started with Helm 2, refer to the official [Helm 2 to 3 migration docs.](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/) The [Helm 2 upgrade page here](/versioned_docs/version-2.0-2.4/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades/helm2.md)provides a copy of the older upgrade instructions that used Helm 2, and it is intended to be used if upgrading to Helm 3 is not feasible. diff --git a/versioned_docs/version-2.8/getting-started/installation-and-upgrade/other-installation-methods/rancher-behind-an-http-proxy/install-rancher.md b/versioned_docs/version-2.8/getting-started/installation-and-upgrade/other-installation-methods/rancher-behind-an-http-proxy/install-rancher.md index 9d4a4c8393e..c2a6ace6343 100644 --- a/versioned_docs/version-2.8/getting-started/installation-and-upgrade/other-installation-methods/rancher-behind-an-http-proxy/install-rancher.md +++ b/versioned_docs/version-2.8/getting-started/installation-and-upgrade/other-installation-methods/rancher-behind-an-http-proxy/install-rancher.md @@ -10,6 +10,8 @@ Now that you have a running RKE cluster, you can install Rancher in it. For secu ### Install the Helm CLI + + Install the [Helm](https://helm.sh/docs/intro/install/) CLI on a host where you have a kubeconfig to access your Kubernetes cluster: ``` diff --git a/versioned_docs/version-2.8/getting-started/installation-and-upgrade/resources/helm-version-requirements.md b/versioned_docs/version-2.8/getting-started/installation-and-upgrade/resources/helm-version-requirements.md index 8d98fe60458..6118e567f0c 100644 --- a/versioned_docs/version-2.8/getting-started/installation-and-upgrade/resources/helm-version-requirements.md +++ b/versioned_docs/version-2.8/getting-started/installation-and-upgrade/resources/helm-version-requirements.md @@ -10,6 +10,8 @@ This section contains the requirements for Helm, which is the tool used to insta > The installation instructions have been updated for Helm 3. For migration of installs started with Helm 2, refer to the official [Helm 2 to 3 Migration Docs.](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/) [This section](/versioned_docs/version-2.0-2.4/pages-for-subheaders/helm2.md) provides a copy of the older high-availability Rancher installation instructions that used Helm 2, and it is intended to be used if upgrading to Helm 3 is not feasible. + + - Helm v3.2.x or higher is required to install or upgrade Rancher v2.5. - Helm v2.16.0 or higher is required for Kubernetes v1.16. For the default Kubernetes version, refer to the [release notes](https://github.com/rancher/rke/releases) for the version of RKE that you are using. - Helm v2.15.0 should not be used, because of an issue with converting/comparing numbers. diff --git a/versioned_docs/version-2.8/getting-started/installation-and-upgrade/resources/upgrade-cert-manager.md b/versioned_docs/version-2.8/getting-started/installation-and-upgrade/resources/upgrade-cert-manager.md index dd00964ef02..3590d08ce55 100644 --- a/versioned_docs/version-2.8/getting-started/installation-and-upgrade/resources/upgrade-cert-manager.md +++ b/versioned_docs/version-2.8/getting-started/installation-and-upgrade/resources/upgrade-cert-manager.md @@ -145,6 +145,8 @@ Before you can perform the upgrade, you must prepare your air gapped environment --set cainjector.image.repository=/quay.io/jetstack/cert-manager-cainjector ``` + + The Helm 2 command is as follows: ```plain From 43fc8c84bd57e5c0a44d416c95622153fc524aca Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Mon, 26 Feb 2024 17:19:44 -0800 Subject: [PATCH 31/54] Fix broken links --- .../resources/helm-version-requirements.md | 2 +- .../authentication-permissions-and-global-configuration.md | 2 +- .../monitoring-and-alerting/monitoring-and-alerting.md | 2 +- .../gke-cluster-configuration/gke-cluster-configuration.md | 2 +- .../resources/helm-version-requirements.md | 2 +- .../gke-cluster-configuration/gke-cluster-configuration.md | 2 +- .../resources/helm-version-requirements.md | 2 +- .../authentication-permissions-and-global-configuration.md | 2 +- .../monitoring-and-alerting/monitoring-and-alerting.md | 2 +- .../gke-cluster-configuration/gke-cluster-configuration.md | 2 +- 10 files changed, 10 insertions(+), 10 deletions(-) diff --git a/docs/getting-started/installation-and-upgrade/resources/helm-version-requirements.md b/docs/getting-started/installation-and-upgrade/resources/helm-version-requirements.md index 8d98fe60458..21fd44abe15 100644 --- a/docs/getting-started/installation-and-upgrade/resources/helm-version-requirements.md +++ b/docs/getting-started/installation-and-upgrade/resources/helm-version-requirements.md @@ -8,7 +8,7 @@ title: Helm Version Requirements This section contains the requirements for Helm, which is the tool used to install Rancher on a high-availability Kubernetes cluster. -> The installation instructions have been updated for Helm 3. For migration of installs started with Helm 2, refer to the official [Helm 2 to 3 Migration Docs.](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/) [This section](/versioned_docs/version-2.0-2.4/pages-for-subheaders/helm2.md) provides a copy of the older high-availability Rancher installation instructions that used Helm 2, and it is intended to be used if upgrading to Helm 3 is not feasible. +> The installation instructions have been updated for Helm 3. For migration of installs started with Helm 2, refer to the official [Helm 2 to 3 Migration Docs.](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/) [This section](/versioned_docs/version-2.0-2.4/getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/helm2/helm2.md) provides a copy of the older high-availability Rancher installation instructions that used Helm 2, and it is intended to be used if upgrading to Helm 3 is not feasible. - Helm v3.2.x or higher is required to install or upgrade Rancher v2.5. - Helm v2.16.0 or higher is required for Kubernetes v1.16. For the default Kubernetes version, refer to the [release notes](https://github.com/rancher/rke/releases) for the version of RKE that you are using. diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-permissions-and-global-configuration.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-permissions-and-global-configuration.md index d41f2373ee8..206c5c66709 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-permissions-and-global-configuration.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-permissions-and-global-configuration.md @@ -82,4 +82,4 @@ The following features are available under **Global Configuration**: - **Global DNS Entries** - **Global DNS Providers** -As these are legacy features, please see the Rancher v2.0—v2.4 docs on [catalogs](/versioned_docs/version-2.0-2.4/pages-for-subheaders/helm-charts-in-rancher.md), [global DNS entries](/versioned_docs/version-2.0-2.4/how-to-guides/new-user-guides/helm-charts-in-rancher/globaldns.md#adding-a-global-dns-entry), and [global DNS providers](/versioned_docs/version-2.0-2.4/how-to-guides/new-user-guides/helm-charts-in-rancher/globaldns.md#editing-a-global-dns-provider) for more details. +As these are legacy features, please see the Rancher v2.0—v2.4 docs on [catalogs](/versioned_docs/version-2.0-2.4/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md), [global DNS entries](/versioned_docs/version-2.0-2.4/how-to-guides/new-user-guides/helm-charts-in-rancher/globaldns.md#adding-a-global-dns-entry), and [global DNS providers](/versioned_docs/version-2.0-2.4/how-to-guides/new-user-guides/helm-charts-in-rancher/globaldns.md#editing-a-global-dns-provider) for more details. diff --git a/docs/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md b/docs/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md index 41b8662bcf5..07056fd3bdf 100644 --- a/docs/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md +++ b/docs/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md @@ -11,7 +11,7 @@ The `rancher-monitoring` application can quickly deploy leading open-source moni Introduced in Rancher v2.5, the application is powered by [Prometheus](https://prometheus.io/), [Grafana](https://grafana.com/grafana/), [Alertmanager](https://prometheus.io/docs/alerting/latest/alertmanager/), the [Prometheus Operator](https://github.com/prometheus-operator/prometheus-operator), and the [Prometheus adapter.](https://github.com/DirectXMan12/k8s-prometheus-adapter) -For information on V1 monitoring and alerting, available in Rancher v2.2 up to v2.4, please see the Rancher v2.0—v2.4 docs on [cluster monitoring](/versioned_docs/version-2.0-2.4/pages-for-subheaders/cluster-monitoring.md), [alerting](/versioned_docs/version-2.0-2.4/pages-for-subheaders/cluster-alerts.md), [notifiers](/versioned_docs/version-2.0-2.4/explanations/integrations-in-rancher/notifiers.md) and other [tools](/versioned_docs/version-2.0-2.4/pages-for-subheaders/project-tools.md). +For information on V1 monitoring and alerting, available in Rancher v2.2 up to v2.4, please see the Rancher v2.0—v2.4 docs on [cluster monitoring](/versioned_docs/version-2.0-2.4/explanations/integrations-in-rancher/cluster-monitoring/cluster-monitoring.md), [alerting](/versioned_docs/version-2.0-2.4/explanations/integrations-in-rancher/cluster-alerts/cluster-alerts.md), [notifiers](/versioned_docs/version-2.0-2.4/explanations/integrations-in-rancher/notifiers.md) and other [tools](/versioned_docs/version-2.0-2.4/reference-guides/rancher-project-tools/rancher-project-tools.md). Using the `rancher-monitoring` application, you can quickly deploy leading open-source monitoring and alerting solutions onto your cluster. diff --git a/docs/reference-guides/cluster-configuration/rancher-server-configuration/gke-cluster-configuration/gke-cluster-configuration.md b/docs/reference-guides/cluster-configuration/rancher-server-configuration/gke-cluster-configuration/gke-cluster-configuration.md index ad39397675d..9d7a2abb0d6 100644 --- a/docs/reference-guides/cluster-configuration/rancher-server-configuration/gke-cluster-configuration/gke-cluster-configuration.md +++ b/docs/reference-guides/cluster-configuration/rancher-server-configuration/gke-cluster-configuration/gke-cluster-configuration.md @@ -204,7 +204,7 @@ The node operating system image. For more information for the node image options :::note -The default option is "Container-Optimized OS with Docker". The read-only filesystem on GCP's Container-Optimized OS is not compatible with the [legacy logging](/versioned_docs/version-2.0-2.4/pages-for-subheaders/cluster-logging.md) implementation in Rancher. If you need to use the legacy logging feature, select "Ubuntu with Docker" or "Ubuntu with Containerd". The [current logging feature](../../../../integrations-in-rancher/logging/logging.md) is compatible with the Container-Optimized OS image. +The default option is "Container-Optimized OS with Docker". The read-only filesystem on GCP's Container-Optimized OS is not compatible with the [legacy logging](/versioned_docs/version-2.0-2.4/explanations/integrations-in-rancher/cluster-logging/cluster-logging.md) implementation in Rancher. If you need to use the legacy logging feature, select "Ubuntu with Docker" or "Ubuntu with Containerd". The [current logging feature](../../../../integrations-in-rancher/logging/logging.md) is compatible with the Container-Optimized OS image. ::: diff --git a/versioned_docs/version-2.7/getting-started/installation-and-upgrade/resources/helm-version-requirements.md b/versioned_docs/version-2.7/getting-started/installation-and-upgrade/resources/helm-version-requirements.md index 8d98fe60458..21fd44abe15 100644 --- a/versioned_docs/version-2.7/getting-started/installation-and-upgrade/resources/helm-version-requirements.md +++ b/versioned_docs/version-2.7/getting-started/installation-and-upgrade/resources/helm-version-requirements.md @@ -8,7 +8,7 @@ title: Helm Version Requirements This section contains the requirements for Helm, which is the tool used to install Rancher on a high-availability Kubernetes cluster. -> The installation instructions have been updated for Helm 3. For migration of installs started with Helm 2, refer to the official [Helm 2 to 3 Migration Docs.](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/) [This section](/versioned_docs/version-2.0-2.4/pages-for-subheaders/helm2.md) provides a copy of the older high-availability Rancher installation instructions that used Helm 2, and it is intended to be used if upgrading to Helm 3 is not feasible. +> The installation instructions have been updated for Helm 3. For migration of installs started with Helm 2, refer to the official [Helm 2 to 3 Migration Docs.](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/) [This section](/versioned_docs/version-2.0-2.4/getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/helm2/helm2.md) provides a copy of the older high-availability Rancher installation instructions that used Helm 2, and it is intended to be used if upgrading to Helm 3 is not feasible. - Helm v3.2.x or higher is required to install or upgrade Rancher v2.5. - Helm v2.16.0 or higher is required for Kubernetes v1.16. For the default Kubernetes version, refer to the [release notes](https://github.com/rancher/rke/releases) for the version of RKE that you are using. diff --git a/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/gke-cluster-configuration/gke-cluster-configuration.md b/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/gke-cluster-configuration/gke-cluster-configuration.md index ad39397675d..9d7a2abb0d6 100644 --- a/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/gke-cluster-configuration/gke-cluster-configuration.md +++ b/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/gke-cluster-configuration/gke-cluster-configuration.md @@ -204,7 +204,7 @@ The node operating system image. For more information for the node image options :::note -The default option is "Container-Optimized OS with Docker". The read-only filesystem on GCP's Container-Optimized OS is not compatible with the [legacy logging](/versioned_docs/version-2.0-2.4/pages-for-subheaders/cluster-logging.md) implementation in Rancher. If you need to use the legacy logging feature, select "Ubuntu with Docker" or "Ubuntu with Containerd". The [current logging feature](../../../../integrations-in-rancher/logging/logging.md) is compatible with the Container-Optimized OS image. +The default option is "Container-Optimized OS with Docker". The read-only filesystem on GCP's Container-Optimized OS is not compatible with the [legacy logging](/versioned_docs/version-2.0-2.4/explanations/integrations-in-rancher/cluster-logging/cluster-logging.md) implementation in Rancher. If you need to use the legacy logging feature, select "Ubuntu with Docker" or "Ubuntu with Containerd". The [current logging feature](../../../../integrations-in-rancher/logging/logging.md) is compatible with the Container-Optimized OS image. ::: diff --git a/versioned_docs/version-2.8/getting-started/installation-and-upgrade/resources/helm-version-requirements.md b/versioned_docs/version-2.8/getting-started/installation-and-upgrade/resources/helm-version-requirements.md index 8d98fe60458..21fd44abe15 100644 --- a/versioned_docs/version-2.8/getting-started/installation-and-upgrade/resources/helm-version-requirements.md +++ b/versioned_docs/version-2.8/getting-started/installation-and-upgrade/resources/helm-version-requirements.md @@ -8,7 +8,7 @@ title: Helm Version Requirements This section contains the requirements for Helm, which is the tool used to install Rancher on a high-availability Kubernetes cluster. -> The installation instructions have been updated for Helm 3. For migration of installs started with Helm 2, refer to the official [Helm 2 to 3 Migration Docs.](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/) [This section](/versioned_docs/version-2.0-2.4/pages-for-subheaders/helm2.md) provides a copy of the older high-availability Rancher installation instructions that used Helm 2, and it is intended to be used if upgrading to Helm 3 is not feasible. +> The installation instructions have been updated for Helm 3. For migration of installs started with Helm 2, refer to the official [Helm 2 to 3 Migration Docs.](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/) [This section](/versioned_docs/version-2.0-2.4/getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/helm2/helm2.md) provides a copy of the older high-availability Rancher installation instructions that used Helm 2, and it is intended to be used if upgrading to Helm 3 is not feasible. - Helm v3.2.x or higher is required to install or upgrade Rancher v2.5. - Helm v2.16.0 or higher is required for Kubernetes v1.16. For the default Kubernetes version, refer to the [release notes](https://github.com/rancher/rke/releases) for the version of RKE that you are using. diff --git a/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-permissions-and-global-configuration.md b/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-permissions-and-global-configuration.md index 594a2848536..a135c9d0125 100644 --- a/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-permissions-and-global-configuration.md +++ b/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-permissions-and-global-configuration.md @@ -82,4 +82,4 @@ The following features are available under **Global Configuration**: - **Global DNS Entries** - **Global DNS Providers** -As these are legacy features, please see the Rancher v2.0—v2.4 docs on [catalogs](/versioned_docs/version-2.0-2.4/pages-for-subheaders/helm-charts-in-rancher.md), [global DNS entries](/versioned_docs/version-2.0-2.4/how-to-guides/new-user-guides/helm-charts-in-rancher/globaldns.md#adding-a-global-dns-entry), and [global DNS providers](/versioned_docs/version-2.0-2.4/how-to-guides/new-user-guides/helm-charts-in-rancher/globaldns.md#editing-a-global-dns-provider) for more details. \ No newline at end of file +As these are legacy features, please see the Rancher v2.0—v2.4 docs on [catalogs](/versioned_docs/version-2.0-2.4/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md), [global DNS entries](/versioned_docs/version-2.0-2.4/how-to-guides/new-user-guides/helm-charts-in-rancher/globaldns.md#adding-a-global-dns-entry), and [global DNS providers](/versioned_docs/version-2.0-2.4/how-to-guides/new-user-guides/helm-charts-in-rancher/globaldns.md#editing-a-global-dns-provider) for more details. \ No newline at end of file diff --git a/versioned_docs/version-2.8/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md b/versioned_docs/version-2.8/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md index 41b8662bcf5..07056fd3bdf 100644 --- a/versioned_docs/version-2.8/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md +++ b/versioned_docs/version-2.8/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md @@ -11,7 +11,7 @@ The `rancher-monitoring` application can quickly deploy leading open-source moni Introduced in Rancher v2.5, the application is powered by [Prometheus](https://prometheus.io/), [Grafana](https://grafana.com/grafana/), [Alertmanager](https://prometheus.io/docs/alerting/latest/alertmanager/), the [Prometheus Operator](https://github.com/prometheus-operator/prometheus-operator), and the [Prometheus adapter.](https://github.com/DirectXMan12/k8s-prometheus-adapter) -For information on V1 monitoring and alerting, available in Rancher v2.2 up to v2.4, please see the Rancher v2.0—v2.4 docs on [cluster monitoring](/versioned_docs/version-2.0-2.4/pages-for-subheaders/cluster-monitoring.md), [alerting](/versioned_docs/version-2.0-2.4/pages-for-subheaders/cluster-alerts.md), [notifiers](/versioned_docs/version-2.0-2.4/explanations/integrations-in-rancher/notifiers.md) and other [tools](/versioned_docs/version-2.0-2.4/pages-for-subheaders/project-tools.md). +For information on V1 monitoring and alerting, available in Rancher v2.2 up to v2.4, please see the Rancher v2.0—v2.4 docs on [cluster monitoring](/versioned_docs/version-2.0-2.4/explanations/integrations-in-rancher/cluster-monitoring/cluster-monitoring.md), [alerting](/versioned_docs/version-2.0-2.4/explanations/integrations-in-rancher/cluster-alerts/cluster-alerts.md), [notifiers](/versioned_docs/version-2.0-2.4/explanations/integrations-in-rancher/notifiers.md) and other [tools](/versioned_docs/version-2.0-2.4/reference-guides/rancher-project-tools/rancher-project-tools.md). Using the `rancher-monitoring` application, you can quickly deploy leading open-source monitoring and alerting solutions onto your cluster. diff --git a/versioned_docs/version-2.8/reference-guides/cluster-configuration/rancher-server-configuration/gke-cluster-configuration/gke-cluster-configuration.md b/versioned_docs/version-2.8/reference-guides/cluster-configuration/rancher-server-configuration/gke-cluster-configuration/gke-cluster-configuration.md index ad39397675d..9d7a2abb0d6 100644 --- a/versioned_docs/version-2.8/reference-guides/cluster-configuration/rancher-server-configuration/gke-cluster-configuration/gke-cluster-configuration.md +++ b/versioned_docs/version-2.8/reference-guides/cluster-configuration/rancher-server-configuration/gke-cluster-configuration/gke-cluster-configuration.md @@ -204,7 +204,7 @@ The node operating system image. For more information for the node image options :::note -The default option is "Container-Optimized OS with Docker". The read-only filesystem on GCP's Container-Optimized OS is not compatible with the [legacy logging](/versioned_docs/version-2.0-2.4/pages-for-subheaders/cluster-logging.md) implementation in Rancher. If you need to use the legacy logging feature, select "Ubuntu with Docker" or "Ubuntu with Containerd". The [current logging feature](../../../../integrations-in-rancher/logging/logging.md) is compatible with the Container-Optimized OS image. +The default option is "Container-Optimized OS with Docker". The read-only filesystem on GCP's Container-Optimized OS is not compatible with the [legacy logging](/versioned_docs/version-2.0-2.4/explanations/integrations-in-rancher/cluster-logging/cluster-logging.md) implementation in Rancher. If you need to use the legacy logging feature, select "Ubuntu with Docker" or "Ubuntu with Containerd". The [current logging feature](../../../../integrations-in-rancher/logging/logging.md) is compatible with the Container-Optimized OS image. ::: From f9bb639344ee5aab57498694fe8467dc8fdc111c Mon Sep 17 00:00:00 2001 From: joshmeranda Date: Tue, 27 Feb 2024 19:27:18 -0500 Subject: [PATCH 32/54] clarify monitoring read only role limitations --- .../monitoring-and-alerting/rbac-for-monitoring.md | 8 ++++++-- .../monitoring-and-alerting/rbac-for-monitoring.md | 8 ++++++-- .../monitoring-and-alerting/rbac-for-monitoring.md | 8 ++++++-- 3 files changed, 18 insertions(+), 6 deletions(-) diff --git a/docs/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md b/docs/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md index 1caa47cc30b..3c538ba5d07 100644 --- a/docs/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md +++ b/docs/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md @@ -112,7 +112,7 @@ Monitoring also creates additional `ClusterRoles` that aren't assigned to users | Role | Purpose | | ------------------------------| ---------------------------| -| monitoring-ui-view | _Available as of Monitoring v2 14.5.100+_ This ClusterRole allows users with write access to the project to view metrics graphs for the specified cluster in the Rancher UI. This is done by granting Read-only access to external Monitoring UIs. Users with this role have permission to list the Prometheus, Alertmanager, and Grafana endpoints and make GET requests to Prometheus, Alertmanager, and Grafana UIs through the Rancher proxy. | +| monitoring-ui-view | _Available as of Monitoring v2 14.5.100+_ This ClusterRole allows users with write access to the project to view metrics graphs for the specified cluster in the Rancher UI. This is done by granting Read-only access to external Monitoring UIs. Users with this role have permission to list the Prometheus, Alertmanager, and Grafana endpoints and make GET requests to Prometheus, Alertmanager, and Grafana UIs through the Rancher proxy.

This role does not grant access to monitoring endpoints. As a result, users with this role will not be able to view cluster monitoring graphs and dashboards in the rancher UI; however, they are able to access the monitoring Grafana, Prometheus, and Alertmanager UIs if provided those links. | :::note @@ -216,7 +216,11 @@ In addition to these default roles, the following Rancher project roles can be a |--------------------------|-------------------------------|-------|------| | View Monitoring* | [monitoring-ui-view](#additional-monitoring-clusterroles) | 2.4.8+ | 9.4.204+ | -\* A user bound to the **View Monitoring** Rancher role and read-only project permissions can't view links in the Monitoring UI. They can still access external monitoring UIs if provided links to those UIs. If you wish to grant access to users with the **View Monitoring** role and read-only project permissions, move the `cattle-monitoring-system` namespace into the project. +:::note + +A user bound to the **View Monitoring** Rancher role and read-only project permissions can't view links in the Monitoring UI. They can still access external monitoring UIs if provided links to those UIs. If you wish to grant access to users with the **View Monitoring** role and read-only project permissions, move the `cattle-monitoring-system` namespace into the project. + +::: ### Differences in 2.5.x diff --git a/versioned_docs/version-2.7/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md b/versioned_docs/version-2.7/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md index 0072c5da17c..e7b59526286 100644 --- a/versioned_docs/version-2.7/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md +++ b/versioned_docs/version-2.7/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md @@ -112,7 +112,7 @@ Monitoring also creates additional `ClusterRoles` that aren't assigned to users | Role | Purpose | | ------------------------------| ---------------------------| -| monitoring-ui-view | _Available as of Monitoring v2 14.5.100+_ This ClusterRole allows users with write access to the project to view metrics graphs for the specified cluster in the Rancher UI. This is done by granting Read-only access to external Monitoring UIs. Users with this role have permission to list the Prometheus, Alertmanager, and Grafana endpoints and make GET requests to Prometheus, Grafana, and Alertmanager UIs through the Rancher proxy. | +| monitoring-ui-view | _Available as of Monitoring v2 14.5.100+_ This ClusterRole allows users with write access to the project to view metrics graphs for the specified cluster in the Rancher UI. This is done by granting Read-only access to external Monitoring UIs. Users with this role have permission to list the Prometheus, Alertmanager, and Grafana endpoints and make GET requests to Prometheus, Alertmanager, and Grafana UIs through the Rancher proxy.

This role does not grant access to monitoring endpoints. As a result, users with this role will not be able to view cluster monitoring graphs and dashboards in the rancher UI; however, they are able to access the monitoring Grafana, Prometheus, and Alertmanager UIs if provided those links. | :::note @@ -216,7 +216,11 @@ In addition to these default roles, the following Rancher project roles can be a |--------------------------|-------------------------------|-------|------| | View Monitoring* | [monitoring-ui-view](#additional-monitoring-clusterroles) | 2.4.8+ | 9.4.204+ | -\* A user bound to the **View Monitoring** Rancher role and read-only project permissions can't view links in the Monitoring UI. They can still access external monitoring UIs if provided links to those UIs. If you wish to grant access to users with the **View Monitoring** role and read-only project permissions, move the `cattle-monitoring-system` namespace into the project. +:::note + + A user bound to the **View Monitoring** Rancher role and read-only project permissions can't view links in the Monitoring UI. They can still access external monitoring UIs if provided links to those UIs. If you wish to grant access to users with the **View Monitoring** role and read-only project permissions, move the `cattle-monitoring-system` namespace into the project. + +:::note ### Differences in 2.5.x diff --git a/versioned_docs/version-2.8/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md b/versioned_docs/version-2.8/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md index a1711b57170..3c538ba5d07 100644 --- a/versioned_docs/version-2.8/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md +++ b/versioned_docs/version-2.8/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md @@ -112,7 +112,7 @@ Monitoring also creates additional `ClusterRoles` that aren't assigned to users | Role | Purpose | | ------------------------------| ---------------------------| -| monitoring-ui-view | _Available as of Monitoring v2 14.5.100+_ This ClusterRole allows users with write access to the project to view metrics graphs for the specified cluster in the Rancher UI. This is done by granting Read-only access to external Monitoring UIs. Users with this role have permission to list the Prometheus, Alertmanager, and Grafana endpoints and make GET requests to Prometheus, Grafana, and Alertmanager UIs through the Rancher proxy. | +| monitoring-ui-view | _Available as of Monitoring v2 14.5.100+_ This ClusterRole allows users with write access to the project to view metrics graphs for the specified cluster in the Rancher UI. This is done by granting Read-only access to external Monitoring UIs. Users with this role have permission to list the Prometheus, Alertmanager, and Grafana endpoints and make GET requests to Prometheus, Alertmanager, and Grafana UIs through the Rancher proxy.

This role does not grant access to monitoring endpoints. As a result, users with this role will not be able to view cluster monitoring graphs and dashboards in the rancher UI; however, they are able to access the monitoring Grafana, Prometheus, and Alertmanager UIs if provided those links. | :::note @@ -216,7 +216,11 @@ In addition to these default roles, the following Rancher project roles can be a |--------------------------|-------------------------------|-------|------| | View Monitoring* | [monitoring-ui-view](#additional-monitoring-clusterroles) | 2.4.8+ | 9.4.204+ | -\* A user bound to the **View Monitoring** Rancher role and read-only project permissions can't view links in the Monitoring UI. They can still access external monitoring UIs if provided links to those UIs. If you wish to grant access to users with the **View Monitoring** role and read-only project permissions, move the `cattle-monitoring-system` namespace into the project. +:::note + +A user bound to the **View Monitoring** Rancher role and read-only project permissions can't view links in the Monitoring UI. They can still access external monitoring UIs if provided links to those UIs. If you wish to grant access to users with the **View Monitoring** role and read-only project permissions, move the `cattle-monitoring-system` namespace into the project. + +::: ### Differences in 2.5.x From 48bb9052b4d67fe6debc2680583255cd14860ce7 Mon Sep 17 00:00:00 2001 From: joshmeranda Date: Wed, 28 Feb 2024 13:46:08 -0500 Subject: [PATCH 33/54] add visibility to monitoring-ui-view --- .../monitoring-and-alerting/monitoring-and-alerting.md | 8 +++++++- .../monitoring-and-alerting/monitoring-and-alerting.md | 8 +++++++- .../monitoring-and-alerting/monitoring-and-alerting.md | 8 +++++++- 3 files changed, 21 insertions(+), 3 deletions(-) diff --git a/docs/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md b/docs/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md index 41b8662bcf5..1081e252d52 100644 --- a/docs/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md +++ b/docs/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md @@ -55,7 +55,13 @@ For a list of monitoring components exposed in the Rancher UI, along with common ## Role-based Access Control -For information on configuring access to monitoring, see [this page.](rbac-for-monitoring.md) +For more information on configuring access to monitoring, see [this page.](rbac-for-monitoring.md) + +:::note + +Rancher and Project read permissions do not necessarily apply to monitoring resources. See [monitoring-ui-view](rbac-for-monitoring.md#additional-monitoring-clusterroles) for more details. + +::: ## Guides diff --git a/versioned_docs/version-2.7/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md b/versioned_docs/version-2.7/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md index 07056fd3bdf..9975a11b356 100644 --- a/versioned_docs/version-2.7/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md +++ b/versioned_docs/version-2.7/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md @@ -55,7 +55,13 @@ For a list of monitoring components exposed in the Rancher UI, along with common ## Role-based Access Control -For information on configuring access to monitoring, see [this page.](rbac-for-monitoring.md) +For more information on configuring access to monitoring, see [this page.](rbac-for-monitoring.md) + +:::note + +Rancher and Project read permissions do not necessarily apply to monitoring resources. See [monitoring-ui-view](rbac-for-monitoring.md#additional-monitoring-clusterroles) for more details. + +::: ## Guides diff --git a/versioned_docs/version-2.8/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md b/versioned_docs/version-2.8/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md index 41b8662bcf5..1081e252d52 100644 --- a/versioned_docs/version-2.8/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md +++ b/versioned_docs/version-2.8/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md @@ -55,7 +55,13 @@ For a list of monitoring components exposed in the Rancher UI, along with common ## Role-based Access Control -For information on configuring access to monitoring, see [this page.](rbac-for-monitoring.md) +For more information on configuring access to monitoring, see [this page.](rbac-for-monitoring.md) + +:::note + +Rancher and Project read permissions do not necessarily apply to monitoring resources. See [monitoring-ui-view](rbac-for-monitoring.md#additional-monitoring-clusterroles) for more details. + +::: ## Guides From de7cab18916e4a1967ba2336976fd7df6bc50575 Mon Sep 17 00:00:00 2001 From: Marty Hernandez Avedon Date: Wed, 28 Feb 2024 15:56:27 -0500 Subject: [PATCH 34/54] Update README.md (#1150) --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 5fea49ee99f..6e9adbc8dac 100644 --- a/README.md +++ b/README.md @@ -23,7 +23,7 @@ If a file is moved or renamed, you'll also need to edit the `sidebars.js` files ### Navigate the Repo -The file paths in the repo correspond to the URLs for pages on the docs website. The docs for the latest version of Rancher are located in `/docs`. Most index pages are found within the `/pages-for-subheaders` directory in `/docs`. All images are in `/static/img` in the top level of the repo. Older docs are found within `/versioned_docs` and generally follow the same structure as the files in `/docs`. +The file paths in the repo correspond to the URLs for pages on the docs website. The docs for the latest version of Rancher are located in `/docs`. All images are in `/static/img` in the top level of the repo. Older docs are found within `/versioned_docs` and generally follow the same structure as the files in `/docs`. ### Style & Formatting From d8180384be9efb042705e53f1abddfad1d5f40c9 Mon Sep 17 00:00:00 2001 From: Marty Hernandez Avedon Date: Thu, 29 Feb 2024 13:45:48 -0500 Subject: [PATCH 35/54] Apply suggestions from code review --- .../monitoring-and-alerting/monitoring-and-alerting.md | 2 +- .../monitoring-and-alerting/rbac-for-monitoring.md | 2 +- .../monitoring-and-alerting/monitoring-and-alerting.md | 2 +- .../monitoring-and-alerting/rbac-for-monitoring.md | 2 +- .../monitoring-and-alerting/monitoring-and-alerting.md | 2 +- .../monitoring-and-alerting/rbac-for-monitoring.md | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md b/docs/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md index 1081e252d52..06bd0ac2297 100644 --- a/docs/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md +++ b/docs/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md @@ -59,7 +59,7 @@ For more information on configuring access to monitoring, see [this page.](rbac- :::note -Rancher and Project read permissions do not necessarily apply to monitoring resources. See [monitoring-ui-view](rbac-for-monitoring.md#additional-monitoring-clusterroles) for more details. +Rancher and Project read permissions don't necessarily apply to monitoring resources. See [monitoring-ui-view](rbac-for-monitoring.md#additional-monitoring-clusterroles) for more details. ::: diff --git a/docs/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md b/docs/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md index 3c538ba5d07..583611b99c0 100644 --- a/docs/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md +++ b/docs/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md @@ -112,7 +112,7 @@ Monitoring also creates additional `ClusterRoles` that aren't assigned to users | Role | Purpose | | ------------------------------| ---------------------------| -| monitoring-ui-view | _Available as of Monitoring v2 14.5.100+_ This ClusterRole allows users with write access to the project to view metrics graphs for the specified cluster in the Rancher UI. This is done by granting Read-only access to external Monitoring UIs. Users with this role have permission to list the Prometheus, Alertmanager, and Grafana endpoints and make GET requests to Prometheus, Alertmanager, and Grafana UIs through the Rancher proxy.

This role does not grant access to monitoring endpoints. As a result, users with this role will not be able to view cluster monitoring graphs and dashboards in the rancher UI; however, they are able to access the monitoring Grafana, Prometheus, and Alertmanager UIs if provided those links. | +| monitoring-ui-view | _Available as of Monitoring v2 14.5.100+_ This ClusterRole allows users with write access to the project to view metrics graphs for the specified cluster in the Rancher UI. This is done by granting Read-only access to external Monitoring UIs. Users with this role have permission to list the Prometheus, Alertmanager, and Grafana endpoints and make GET requests to Prometheus, Alertmanager, and Grafana UIs through the Rancher proxy.

This role doesn't grant access to monitoring endpoints. As a result, users with this role won't be able to view cluster monitoring graphs and dashboards in the Rancher UI; however, they are able to access the monitoring Grafana, Prometheus, and Alertmanager UIs if provided those links. | :::note diff --git a/versioned_docs/version-2.7/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md b/versioned_docs/version-2.7/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md index 9975a11b356..da6460a0da7 100644 --- a/versioned_docs/version-2.7/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md +++ b/versioned_docs/version-2.7/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md @@ -59,7 +59,7 @@ For more information on configuring access to monitoring, see [this page.](rbac- :::note -Rancher and Project read permissions do not necessarily apply to monitoring resources. See [monitoring-ui-view](rbac-for-monitoring.md#additional-monitoring-clusterroles) for more details. +Rancher and Project read permissions don't necessarily apply to monitoring resources. See [monitoring-ui-view](rbac-for-monitoring.md#additional-monitoring-clusterroles) for more details. ::: diff --git a/versioned_docs/version-2.7/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md b/versioned_docs/version-2.7/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md index e7b59526286..01d7c5dd6e5 100644 --- a/versioned_docs/version-2.7/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md +++ b/versioned_docs/version-2.7/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md @@ -112,7 +112,7 @@ Monitoring also creates additional `ClusterRoles` that aren't assigned to users | Role | Purpose | | ------------------------------| ---------------------------| -| monitoring-ui-view | _Available as of Monitoring v2 14.5.100+_ This ClusterRole allows users with write access to the project to view metrics graphs for the specified cluster in the Rancher UI. This is done by granting Read-only access to external Monitoring UIs. Users with this role have permission to list the Prometheus, Alertmanager, and Grafana endpoints and make GET requests to Prometheus, Alertmanager, and Grafana UIs through the Rancher proxy.

This role does not grant access to monitoring endpoints. As a result, users with this role will not be able to view cluster monitoring graphs and dashboards in the rancher UI; however, they are able to access the monitoring Grafana, Prometheus, and Alertmanager UIs if provided those links. | +| monitoring-ui-view | _Available as of Monitoring v2 14.5.100+_ This ClusterRole allows users with write access to the project to view metrics graphs for the specified cluster in the Rancher UI. This is done by granting Read-only access to external Monitoring UIs. Users with this role have permission to list the Prometheus, Alertmanager, and Grafana endpoints and make GET requests to Prometheus, Alertmanager, and Grafana UIs through the Rancher proxy.

This role doesn't grant access to monitoring endpoints. As a result, users with this role won't be able to view cluster monitoring graphs and dashboards in the Rancher UI; however, they are able to access the monitoring Grafana, Prometheus, and Alertmanager UIs if provided those links. | :::note diff --git a/versioned_docs/version-2.8/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md b/versioned_docs/version-2.8/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md index 1081e252d52..06bd0ac2297 100644 --- a/versioned_docs/version-2.8/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md +++ b/versioned_docs/version-2.8/integrations-in-rancher/monitoring-and-alerting/monitoring-and-alerting.md @@ -59,7 +59,7 @@ For more information on configuring access to monitoring, see [this page.](rbac- :::note -Rancher and Project read permissions do not necessarily apply to monitoring resources. See [monitoring-ui-view](rbac-for-monitoring.md#additional-monitoring-clusterroles) for more details. +Rancher and Project read permissions don't necessarily apply to monitoring resources. See [monitoring-ui-view](rbac-for-monitoring.md#additional-monitoring-clusterroles) for more details. ::: diff --git a/versioned_docs/version-2.8/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md b/versioned_docs/version-2.8/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md index 3c538ba5d07..583611b99c0 100644 --- a/versioned_docs/version-2.8/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md +++ b/versioned_docs/version-2.8/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md @@ -112,7 +112,7 @@ Monitoring also creates additional `ClusterRoles` that aren't assigned to users | Role | Purpose | | ------------------------------| ---------------------------| -| monitoring-ui-view | _Available as of Monitoring v2 14.5.100+_ This ClusterRole allows users with write access to the project to view metrics graphs for the specified cluster in the Rancher UI. This is done by granting Read-only access to external Monitoring UIs. Users with this role have permission to list the Prometheus, Alertmanager, and Grafana endpoints and make GET requests to Prometheus, Alertmanager, and Grafana UIs through the Rancher proxy.

This role does not grant access to monitoring endpoints. As a result, users with this role will not be able to view cluster monitoring graphs and dashboards in the rancher UI; however, they are able to access the monitoring Grafana, Prometheus, and Alertmanager UIs if provided those links. | +| monitoring-ui-view | _Available as of Monitoring v2 14.5.100+_ This ClusterRole allows users with write access to the project to view metrics graphs for the specified cluster in the Rancher UI. This is done by granting Read-only access to external Monitoring UIs. Users with this role have permission to list the Prometheus, Alertmanager, and Grafana endpoints and make GET requests to Prometheus, Alertmanager, and Grafana UIs through the Rancher proxy.

This role doesn't grant access to monitoring endpoints. As a result, users with this role won't be able to view cluster monitoring graphs and dashboards in the Rancher UI; however, they are able to access the monitoring Grafana, Prometheus, and Alertmanager UIs if provided those links. | :::note From 004001a0470e16f85fe4397cbf74316ec9d336f3 Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Fri, 1 Mar 2024 12:37:26 -0800 Subject: [PATCH 36/54] Fixing versions page conflict. Signed-off-by: Sunil Singh --- src/pages/versions.md | 106 ++++++++++++++++++++++++++++++++++++++---- 1 file changed, 97 insertions(+), 9 deletions(-) diff --git a/src/pages/versions.md b/src/pages/versions.md index 0da17d2522c..7074ff8cde0 100644 --- a/src/pages/versions.md +++ b/src/pages/versions.md @@ -6,20 +6,38 @@ title: Rancher Documentation Versions ### Current versions -Below are the documentation and release notes for the currently released version of Rancher 2.8.x: +Here you can find links to supporting documentation for the current released version of Rancher v2.8, and its availability for [Rancher Prime](/v2.8/getting-started/quick-start-guides/deploy-rancher-manager/prime) and the Community version of Rancher: + + + + + + + + + +
VersionDocumentationRelease NotesSupport MatrixPrimeCommunity
v2.8.2 Documentation Release Notes Support Matrix
✓
✓
-Below are the documentation and release notes for the currently released version of Rancher 2.7.x: +Here you can find links to supporting documentation for the current released version of Rancher v2.7, and its availability for [Rancher Prime](/v2.7/getting-started/quick-start-guides/deploy-rancher-manager/prime) and the Community version of Rancher: + + + + + + + + @@ -28,9 +46,15 @@ Below are the documentation and release notes for the currently released version
VersionDocumentationRelease NotesSupport MatrixPrimeCommunity
v2.7.11 Documentation
-Below are the documentation and release notes for the currently released version of Rancher 2.6.x: +Here you can find links to supporting documentation for the current released version of Rancher v2.6: + + + + + + @@ -41,95 +65,149 @@ Below are the documentation and release notes for the currently released version ### Past versions -Below are the documentation and release notes for previous versions of Rancher 2.8.x: +Here you can find links to supporting documentation for previous versions of Rancher v2.8, and their availability for [Rancher Prime](/v2.8/getting-started/quick-start-guides/deploy-rancher-manager/prime) and the Community version of Rancher:
VersionDocumentationRelease NotesSupport Matrix
v2.6.14 Documentation
+ + + + + + + + + + + +
VersionDocumentationRelease NotesSupport MatrixPrimeCommunity
v2.8.1 Documentation Release Notes Support Matrix
✓
✓
v2.8.0 Documentation Release Notes
N/A
N/A
✓

-Below are the documentation and release notes for previous versions of Rancher 2.7.x: +Here you can find links to supporting documentation for previous versions of Rancher v2.7, and their availability for [Rancher Prime](/v2.7/getting-started/quick-start-guides/deploy-rancher-manager/prime) and the Community version of Rancher: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
VersionDocumentationRelease NotesSupport MatrixPrimeCommunity
v2.7.10DocumentationRelease NotesSupport Matrix
✓
✓
v2.7.9 Documentation Release Notes Support Matrix
✓
✓
v2.7.8 Documentation Release Notes
N/A
N/A
✓
v2.7.7 Documentation Release Notes
N/A
N/A
✓
v2.7.6 Documentation Release Notes Support Matrix
✓
✓
v2.7.5 Documentation Release Notes Support Matrix
✓
✓
v2.7.4 Documentation Release Notes Support Matrix
✓
✓
v2.7.3 Documentation Release Notes Support Matrix
✓
✓
v2.7.2 Documentation Release Notes Support Matrix
✓
✓
v2.7.1 Documentation Release Notes Support Matrix
✓
✓
v2.7.0 Documentation Release Notes Support Matrix
✓
✓

-Below are the documentation and release notes for previous versions of Rancher 2.6.x: +Here you can find links to supporting documentation for previous versions of Rancher v2.6: + + + + + + @@ -220,9 +298,15 @@ Below are the documentation and release notes for previous versions of Rancher 2 ### Legacy versions (EOL) -Below are the documentation and release notes for legacy versions of Rancher 2.5.x: +Here you can find links to supporting documentation for legacy versions of Rancher v2.5:
VersionDocumentationRelease NotesSupport Matrix
v2.6.13 Documentation
+ + + + + + @@ -335,11 +419,15 @@ Below are the documentation and release notes for legacy versions of Rancher 2.5
-Below is the documentation for legacy versions of Rancher 2.0 - 2.4.x: +Here you can find links to supporting documentation for legacy versions of v2.0-v2.4:
VersionDocumentationRelease NotesSupport Matrix
v2.5.17 Documentation
- + + + + +
v2.0 - v2.4VersionDocumentation
v2.0-v2.4 Documentation
\ No newline at end of file From 73f1cda91a3d55e0f752023b2794c5ebf6e2f7bb Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Fri, 1 Mar 2024 12:51:35 -0800 Subject: [PATCH 37/54] Fixing merge conflict. Signed-off-by: Sunil Singh --- src/pages/versions.md | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/src/pages/versions.md b/src/pages/versions.md index 7074ff8cde0..63abf0bfba1 100644 --- a/src/pages/versions.md +++ b/src/pages/versions.md @@ -39,10 +39,15 @@ Here you can find links to supporting documentation for the current released ver Community - v2.7.11 + v2.7.10 Documentation Release Notes Support Matrix +<<<<<<< HEAD +======= +
✓
+
✓
+>>>>>>> 9470bc3f1 (Fixing merge conflict.) @@ -107,14 +112,6 @@ Here you can find links to supporting documentation for previous versions of Ran Prime Community - - v2.7.10 - Documentation - Release Notes - Support Matrix -
✓
-
✓
- v2.7.9 Documentation From b9e7863ef8932544a84a3b2043c4fadd54fdd8ee Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Fri, 1 Mar 2024 12:58:00 -0800 Subject: [PATCH 38/54] Fixing merge conflict. Signed-off-by: Sunil Singh --- src/pages/versions.md | 5 ----- 1 file changed, 5 deletions(-) diff --git a/src/pages/versions.md b/src/pages/versions.md index 63abf0bfba1..6223d696b96 100644 --- a/src/pages/versions.md +++ b/src/pages/versions.md @@ -43,11 +43,6 @@ Here you can find links to supporting documentation for the current released ver Documentation Release Notes Support Matrix -<<<<<<< HEAD -======= -
✓
-
✓
->>>>>>> 9470bc3f1 (Fixing merge conflict.) From 5f19499158b8b401aee36c7b454c15dfe916bdee Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Fri, 1 Mar 2024 13:01:05 -0800 Subject: [PATCH 39/54] Updating with v2.7.11 information after fixing merge conflict. Signed-off-by: Sunil Singh --- src/pages/versions.md | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/src/pages/versions.md b/src/pages/versions.md index 6223d696b96..446d0180d4b 100644 --- a/src/pages/versions.md +++ b/src/pages/versions.md @@ -39,10 +39,12 @@ Here you can find links to supporting documentation for the current released ver Community - v2.7.10 + v2.7.11 Documentation - Release Notes - Support Matrix + Release Notes +
N/A
+
✓
+
N/A
@@ -107,6 +109,14 @@ Here you can find links to supporting documentation for previous versions of Ran Prime Community + + v2.7.10 + Documentation + Release Notes + Support Matrix +
✓
+
✓
+ v2.7.9 Documentation From 4d002aa11783b8a24d56795c5e2ee06f87433683 Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Fri, 1 Mar 2024 13:08:12 -0800 Subject: [PATCH 40/54] Revert "Updating with v2.7.11 information after fixing merge conflict." This reverts commit 5f19499158b8b401aee36c7b454c15dfe916bdee. --- src/pages/versions.md | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-) diff --git a/src/pages/versions.md b/src/pages/versions.md index 446d0180d4b..6223d696b96 100644 --- a/src/pages/versions.md +++ b/src/pages/versions.md @@ -39,12 +39,10 @@ Here you can find links to supporting documentation for the current released ver Community - v2.7.11 + v2.7.10 Documentation - Release Notes -
N/A
-
✓
-
N/A
+ Release Notes + Support Matrix @@ -109,14 +107,6 @@ Here you can find links to supporting documentation for previous versions of Ran Prime Community - - v2.7.10 - Documentation - Release Notes - Support Matrix -
✓
-
✓
- v2.7.9 Documentation From 34bd9c5aa8be3b3e0c54fc88843635e79860af05 Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Fri, 1 Mar 2024 13:18:32 -0800 Subject: [PATCH 41/54] Revert "Updating the Rancher Webhook table for release 2.7.11." This reverts commit 00ac7e524b84f35253c9488ed1ed81e88d7819df. --- versioned_docs/version-2.7/reference-guides/rancher-webhook.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/versioned_docs/version-2.7/reference-guides/rancher-webhook.md b/versioned_docs/version-2.7/reference-guides/rancher-webhook.md index bba6fedf7c1..f4c37a9311f 100644 --- a/versioned_docs/version-2.7/reference-guides/rancher-webhook.md +++ b/versioned_docs/version-2.7/reference-guides/rancher-webhook.md @@ -29,8 +29,7 @@ Each Rancher version is designed to be compatible with a single version of the w | v2.7.7 | v0.3.6 | | v2.7.8 | v0.3.6 | | v2.7.9 | v0.3.6 | -| v2.7.10 | v0.3.6 | -| v2.7.11 | v0.3.7 | +| v2.7.10 | v0.3.6 | ## Why Do We Need It? From a670421db3577eda3edb7b16556cf31ff7f721a1 Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Fri, 1 Mar 2024 14:00:12 -0800 Subject: [PATCH 42/54] Adding information for v2.7.11 versions table. Signed-off-by: Sunil Singh --- src/pages/versions.md | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/src/pages/versions.md b/src/pages/versions.md index 3738aecf1bd..446d0180d4b 100644 --- a/src/pages/versions.md +++ b/src/pages/versions.md @@ -39,12 +39,12 @@ Here you can find links to supporting documentation for the current released ver Community - v2.7.10 + v2.7.11 Documentation - Release Notes - Support Matrix -
✓
+ Release Notes +
N/A
✓
+
N/A
@@ -109,6 +109,14 @@ Here you can find links to supporting documentation for previous versions of Ran Prime Community + + v2.7.10 + Documentation + Release Notes + Support Matrix +
✓
+
✓
+ v2.7.9 Documentation From 1bd945da7dd7bfc6ec40e028bf3d85b47a8b5a85 Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Fri, 1 Mar 2024 14:05:44 -0800 Subject: [PATCH 43/54] Adding in webhook entry after fixing merge conflict. Signed-off-by: Sunil Singh --- versioned_docs/version-2.7/reference-guides/rancher-webhook.md | 1 + 1 file changed, 1 insertion(+) diff --git a/versioned_docs/version-2.7/reference-guides/rancher-webhook.md b/versioned_docs/version-2.7/reference-guides/rancher-webhook.md index f408f5893d5..000fd95d554 100644 --- a/versioned_docs/version-2.7/reference-guides/rancher-webhook.md +++ b/versioned_docs/version-2.7/reference-guides/rancher-webhook.md @@ -20,6 +20,7 @@ Each Rancher version is designed to be compatible with a single version of the w | Rancher Version | Webhook Version | Availability in Prime | Availability in Community | |-----------------|-----------------|-----------------------|---------------------------| +| v2.7.11 | v0.3.7 | ✓ | N/A | | v2.7.10 | v0.3.6 | ✓ | ✓ | | v2.7.9 | v0.3.6 | ✗ | ✓ | | v2.7.8 | v0.3.6 | ✗ | ✓ | From 056531401312b536dded5f222db36cf654ec60ad Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Mon, 4 Mar 2024 15:26:13 -0800 Subject: [PATCH 44/54] Updating the link now that the support matrix is published. Signed-off-by: Sunil Singh --- src/pages/versions.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/pages/versions.md b/src/pages/versions.md index 446d0180d4b..dabdd309ecb 100644 --- a/src/pages/versions.md +++ b/src/pages/versions.md @@ -42,7 +42,7 @@ Here you can find links to supporting documentation for the current released ver v2.7.11 Documentation Release Notes -
N/A
+ Support Matrix
✓
N/A
From 189d93d656a7577fd62905d91500708eb69d59e2 Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Tue, 5 Mar 2024 16:42:29 -0800 Subject: [PATCH 45/54] Updating the Helm Charts in Rancher page to include information about creating chart repositories through Git/Helm. Signed-off-by: Sunil Singh --- .../helm-charts-in-rancher.md | 18 ++++++++++++++++++ .../new-user-guides/helm-charts-in-rancher.md | 18 ++++++++++++++++++ .../helm-charts-in-rancher.md | 18 ++++++++++++++++++ .../helm-charts-in-rancher.md | 18 ++++++++++++++++++ .../helm-charts-in-rancher.md | 18 ++++++++++++++++++ 5 files changed, 90 insertions(+) diff --git a/docs/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md b/docs/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md index e96f0cab855..e8dbcf88af2 100644 --- a/docs/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md +++ b/docs/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md @@ -76,6 +76,24 @@ From the left sidebar select _"Repositories"_. These items represent Helm repositories, and can be either traditional Helm endpoints which have an index.yaml, or git repositories which will be cloned and can point to a specific branch. In order to use custom charts, simply add your repository here and they will become available in the Charts tab under the name of the repository. +#### Add Custom Git Repositories + +Click the `Create` button and be sure to select the target `Git repository containing Helm chart...` to add a custom Git repository that contains your Helm charts or cluster template definitions. The branch name can be specified here if necessary, and if no branch name is provided the main branch will be used by default. At minimum a name and Git repository URL will be needed to finalize creation. An optional field for describing the chart repository is also available. Whenever you add a chart repository to Rancher, it will be available immediately. + +#### Add Custom Helm Chart Repositories + +A Helm chart repository is an HTTP server that houses one or more packaged charts. Any HTTP server that can serve YAML files and tar files and can answer GET requests can be used as a repository server. + +Helm comes with Helm serve, a built-in package server for developer testing. The Helm team has tested other servers, including Google Cloud Storage with website mode enabled, S3 with website mode enabled or hosting custom chart repository server using open-source projects like [ChartMuseum](https://github.com/helm/chartmuseum). + +In Rancher, you can add the custom Helm chart repository by clicking the `Create` button and having the target `http(s) URL to an index generated by Helm` selected. You will need to input at minimum a repo name and the index URL address of the chart repository. + +#### Add Private Git/Helm Chart Repositories + +Private Git or Helm chart repositories can be added into Rancher using either SSH key credentials or an HTTP basic auth secret, i.e. Username and Password. + +#### Add a Private CA to Repositories + To add a private CA for Helm Chart repositories: - **HTTP-based chart repositories**: You must add a base64 encoded copy of the CA certificate in DER format to the spec.caBundle field of the chart repo, such as `openssl x509 -outform der -in ca.pem | base64 -w0`. Click **Edit YAML** for the chart repo and set, as in the following example:
diff --git a/versioned_docs/version-2.5/how-to-guides/new-user-guides/helm-charts-in-rancher.md b/versioned_docs/version-2.5/how-to-guides/new-user-guides/helm-charts-in-rancher.md index 5f0ed127c9d..c0254ebf887 100644 --- a/versioned_docs/version-2.5/how-to-guides/new-user-guides/helm-charts-in-rancher.md +++ b/versioned_docs/version-2.5/how-to-guides/new-user-guides/helm-charts-in-rancher.md @@ -36,6 +36,24 @@ From the left sidebar select _"Repositories"_. These items represent Helm repositories, and can be either traditional Helm endpoints which have an index.yaml, or git repositories which will be cloned and can point to a specific branch. In order to use custom charts, simply add your repository here and they will become available in the Charts tab under the name of the repository. +#### Add Custom Git Repositories + +Click the `Create` button and be sure to select the target `Git repository containing Helm chart...` to add a custom Git repository that contains your Helm charts or cluster template definitions. The branch name can be specified here if necessary, and if no branch name is provided the main branch will be used by default. At minimum a name and Git repository URL will be needed to finalize creation. An optional field for describing the chart repository is also available. Whenever you add a chart repository to Rancher, it will be available immediately. + +#### Add Custom Helm Chart Repositories + +A Helm chart repository is an HTTP server that houses one or more packaged charts. Any HTTP server that can serve YAML files and tar files and can answer GET requests can be used as a repository server. + +Helm comes with Helm serve, a built-in package server for developer testing. The Helm team has tested other servers, including Google Cloud Storage with website mode enabled, S3 with website mode enabled or hosting custom chart repository server using open-source projects like [ChartMuseum](https://github.com/helm/chartmuseum). + +In Rancher, you can add the custom Helm chart repository by clicking the `Create` button and having the target `http(s) URL to an index generated by Helm` selected. You will need to input at minimum a repo name and the index URL address of the chart repository. + +#### Add Private Git/Helm Chart Repositories + +Private Git or Helm chart repositories can be added into Rancher using either SSH key credentials or an HTTP basic auth secret, i.e. Username and Password. + +#### Add a Private CA to Repositories + To add a private CA for Helm Chart repositories: - **HTTP-based chart repositories**: You must add a base64 encoded copy of the CA certificate in DER format to the spec.caBundle field of the chart repo, such as `openssl x509 -outform der -in ca.pem | base64 -w0`. Click **Edit YAML** for the chart repo and set, as in the following example:
diff --git a/versioned_docs/version-2.6/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md b/versioned_docs/version-2.6/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md index a389601dec2..7cef3610279 100644 --- a/versioned_docs/version-2.6/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md +++ b/versioned_docs/version-2.6/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md @@ -84,6 +84,24 @@ From the left sidebar select _"Repositories"_. These items represent Helm repositories, and can be either traditional Helm endpoints which have an index.yaml, or git repositories which will be cloned and can point to a specific branch. In order to use custom charts, simply add your repository here and they will become available in the Charts tab under the name of the repository. +#### Add Custom Git Repositories + +Click the `Create` button and be sure to select the target `Git repository containing Helm chart...` to add a custom Git repository that contains your Helm charts or cluster template definitions. The branch name can be specified here if necessary, and if no branch name is provided the main branch will be used by default. At minimum a name and Git repository URL will be needed to finalize creation. An optional field for describing the chart repository is also available. Whenever you add a chart repository to Rancher, it will be available immediately. + +#### Add Custom Helm Chart Repositories + +A Helm chart repository is an HTTP server that houses one or more packaged charts. Any HTTP server that can serve YAML files and tar files and can answer GET requests can be used as a repository server. + +Helm comes with Helm serve, a built-in package server for developer testing. The Helm team has tested other servers, including Google Cloud Storage with website mode enabled, S3 with website mode enabled or hosting custom chart repository server using open-source projects like [ChartMuseum](https://github.com/helm/chartmuseum). + +In Rancher, you can add the custom Helm chart repository by clicking the `Create` button and having the target `http(s) URL to an index generated by Helm` selected. You will need to input at minimum a repo name and the index URL address of the chart repository. + +#### Add Private Git/Helm Chart Repositories + +Private Git or Helm chart repositories can be added into Rancher using either SSH key credentials or an HTTP basic auth secret, i.e. Username and Password. + +#### Add a Private CA to Repositories + To add a private CA for Helm Chart repositories: - **HTTP-based chart repositories**: You must add a base64 encoded copy of the CA certificate in DER format to the spec.caBundle field of the chart repo, such as `openssl x509 -outform der -in ca.pem | base64 -w0`. Click **Edit YAML** for the chart repo and set, as in the following example:
diff --git a/versioned_docs/version-2.7/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md b/versioned_docs/version-2.7/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md index e96f0cab855..e8dbcf88af2 100644 --- a/versioned_docs/version-2.7/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md +++ b/versioned_docs/version-2.7/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md @@ -76,6 +76,24 @@ From the left sidebar select _"Repositories"_. These items represent Helm repositories, and can be either traditional Helm endpoints which have an index.yaml, or git repositories which will be cloned and can point to a specific branch. In order to use custom charts, simply add your repository here and they will become available in the Charts tab under the name of the repository. +#### Add Custom Git Repositories + +Click the `Create` button and be sure to select the target `Git repository containing Helm chart...` to add a custom Git repository that contains your Helm charts or cluster template definitions. The branch name can be specified here if necessary, and if no branch name is provided the main branch will be used by default. At minimum a name and Git repository URL will be needed to finalize creation. An optional field for describing the chart repository is also available. Whenever you add a chart repository to Rancher, it will be available immediately. + +#### Add Custom Helm Chart Repositories + +A Helm chart repository is an HTTP server that houses one or more packaged charts. Any HTTP server that can serve YAML files and tar files and can answer GET requests can be used as a repository server. + +Helm comes with Helm serve, a built-in package server for developer testing. The Helm team has tested other servers, including Google Cloud Storage with website mode enabled, S3 with website mode enabled or hosting custom chart repository server using open-source projects like [ChartMuseum](https://github.com/helm/chartmuseum). + +In Rancher, you can add the custom Helm chart repository by clicking the `Create` button and having the target `http(s) URL to an index generated by Helm` selected. You will need to input at minimum a repo name and the index URL address of the chart repository. + +#### Add Private Git/Helm Chart Repositories + +Private Git or Helm chart repositories can be added into Rancher using either SSH key credentials or an HTTP basic auth secret, i.e. Username and Password. + +#### Add a Private CA to Repositories + To add a private CA for Helm Chart repositories: - **HTTP-based chart repositories**: You must add a base64 encoded copy of the CA certificate in DER format to the spec.caBundle field of the chart repo, such as `openssl x509 -outform der -in ca.pem | base64 -w0`. Click **Edit YAML** for the chart repo and set, as in the following example:
diff --git a/versioned_docs/version-2.8/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md b/versioned_docs/version-2.8/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md index e96f0cab855..e8dbcf88af2 100644 --- a/versioned_docs/version-2.8/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md +++ b/versioned_docs/version-2.8/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md @@ -76,6 +76,24 @@ From the left sidebar select _"Repositories"_. These items represent Helm repositories, and can be either traditional Helm endpoints which have an index.yaml, or git repositories which will be cloned and can point to a specific branch. In order to use custom charts, simply add your repository here and they will become available in the Charts tab under the name of the repository. +#### Add Custom Git Repositories + +Click the `Create` button and be sure to select the target `Git repository containing Helm chart...` to add a custom Git repository that contains your Helm charts or cluster template definitions. The branch name can be specified here if necessary, and if no branch name is provided the main branch will be used by default. At minimum a name and Git repository URL will be needed to finalize creation. An optional field for describing the chart repository is also available. Whenever you add a chart repository to Rancher, it will be available immediately. + +#### Add Custom Helm Chart Repositories + +A Helm chart repository is an HTTP server that houses one or more packaged charts. Any HTTP server that can serve YAML files and tar files and can answer GET requests can be used as a repository server. + +Helm comes with Helm serve, a built-in package server for developer testing. The Helm team has tested other servers, including Google Cloud Storage with website mode enabled, S3 with website mode enabled or hosting custom chart repository server using open-source projects like [ChartMuseum](https://github.com/helm/chartmuseum). + +In Rancher, you can add the custom Helm chart repository by clicking the `Create` button and having the target `http(s) URL to an index generated by Helm` selected. You will need to input at minimum a repo name and the index URL address of the chart repository. + +#### Add Private Git/Helm Chart Repositories + +Private Git or Helm chart repositories can be added into Rancher using either SSH key credentials or an HTTP basic auth secret, i.e. Username and Password. + +#### Add a Private CA to Repositories + To add a private CA for Helm Chart repositories: - **HTTP-based chart repositories**: You must add a base64 encoded copy of the CA certificate in DER format to the spec.caBundle field of the chart repo, such as `openssl x509 -outform der -in ca.pem | base64 -w0`. Click **Edit YAML** for the chart repo and set, as in the following example:
From 6b0b653e7cbd54267988b7ce762b4b64dc0802d6 Mon Sep 17 00:00:00 2001 From: Kevin A <9853029+kevinayres@users.noreply.github.com> Date: Wed, 6 Mar 2024 12:48:28 -0800 Subject: [PATCH 46/54] Update aws-marketplace.md (#1156) Removed reference to outdated Youtube video. New video will be referenced from Enceladus --- .../deploy-rancher-manager/aws-marketplace.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/docs/getting-started/quick-start-guides/deploy-rancher-manager/aws-marketplace.md b/docs/getting-started/quick-start-guides/deploy-rancher-manager/aws-marketplace.md index 8da9e993a43..ddc461d0a59 100644 --- a/docs/getting-started/quick-start-guides/deploy-rancher-manager/aws-marketplace.md +++ b/docs/getting-started/quick-start-guides/deploy-rancher-manager/aws-marketplace.md @@ -7,8 +7,5 @@ description: Deploy SUSE Rancher from the AWS Marketplace listing. -import YouTube from '@site/src/components/YouTube' - You can quickly deploy Rancher Prime on Amazon Elastic Kubernetes Service (EKS.) To learn more, see the [instructions](https://suse-enceladus.github.io/marketplace-docs/rancher-prime/aws/?repository=rancher-payg-billing-adapter-llc-prd) under Usage Information in the [AWS Marketplace listing](https://aws.amazon.com/marketplace/pp/prodview-f2bvszurj2p2c). -# From 8e216e1700667f211ebbeb3005fd133edc1aa984 Mon Sep 17 00:00:00 2001 From: Marty Hernandez Avedon Date: Wed, 6 Mar 2024 15:50:38 -0500 Subject: [PATCH 47/54] Versioning for Kevinayres/patch 3 (#1161) * Update aws-marketplace.md Removed reference to outdated Youtube video. New video will be referenced from Enceladus * versioning --------- Co-authored-by: Kevin A <9853029+kevinayres@users.noreply.github.com> --- .../deploy-rancher-manager/aws-marketplace.md | 4 ---- .../deploy-rancher-manager/aws-marketplace.md | 4 ---- .../deploy-rancher-manager/aws-marketplace.md | 4 ---- 3 files changed, 12 deletions(-) diff --git a/versioned_docs/version-2.6/getting-started/quick-start-guides/deploy-rancher-manager/aws-marketplace.md b/versioned_docs/version-2.6/getting-started/quick-start-guides/deploy-rancher-manager/aws-marketplace.md index 8da9e993a43..a4a32af8cff 100644 --- a/versioned_docs/version-2.6/getting-started/quick-start-guides/deploy-rancher-manager/aws-marketplace.md +++ b/versioned_docs/version-2.6/getting-started/quick-start-guides/deploy-rancher-manager/aws-marketplace.md @@ -7,8 +7,4 @@ description: Deploy SUSE Rancher from the AWS Marketplace listing. -import YouTube from '@site/src/components/YouTube' - You can quickly deploy Rancher Prime on Amazon Elastic Kubernetes Service (EKS.) To learn more, see the [instructions](https://suse-enceladus.github.io/marketplace-docs/rancher-prime/aws/?repository=rancher-payg-billing-adapter-llc-prd) under Usage Information in the [AWS Marketplace listing](https://aws.amazon.com/marketplace/pp/prodview-f2bvszurj2p2c). - -# diff --git a/versioned_docs/version-2.7/getting-started/quick-start-guides/deploy-rancher-manager/aws-marketplace.md b/versioned_docs/version-2.7/getting-started/quick-start-guides/deploy-rancher-manager/aws-marketplace.md index 8da9e993a43..a4a32af8cff 100644 --- a/versioned_docs/version-2.7/getting-started/quick-start-guides/deploy-rancher-manager/aws-marketplace.md +++ b/versioned_docs/version-2.7/getting-started/quick-start-guides/deploy-rancher-manager/aws-marketplace.md @@ -7,8 +7,4 @@ description: Deploy SUSE Rancher from the AWS Marketplace listing. -import YouTube from '@site/src/components/YouTube' - You can quickly deploy Rancher Prime on Amazon Elastic Kubernetes Service (EKS.) To learn more, see the [instructions](https://suse-enceladus.github.io/marketplace-docs/rancher-prime/aws/?repository=rancher-payg-billing-adapter-llc-prd) under Usage Information in the [AWS Marketplace listing](https://aws.amazon.com/marketplace/pp/prodview-f2bvszurj2p2c). - -# diff --git a/versioned_docs/version-2.8/getting-started/quick-start-guides/deploy-rancher-manager/aws-marketplace.md b/versioned_docs/version-2.8/getting-started/quick-start-guides/deploy-rancher-manager/aws-marketplace.md index 8da9e993a43..a4a32af8cff 100644 --- a/versioned_docs/version-2.8/getting-started/quick-start-guides/deploy-rancher-manager/aws-marketplace.md +++ b/versioned_docs/version-2.8/getting-started/quick-start-guides/deploy-rancher-manager/aws-marketplace.md @@ -7,8 +7,4 @@ description: Deploy SUSE Rancher from the AWS Marketplace listing. -import YouTube from '@site/src/components/YouTube' - You can quickly deploy Rancher Prime on Amazon Elastic Kubernetes Service (EKS.) To learn more, see the [instructions](https://suse-enceladus.github.io/marketplace-docs/rancher-prime/aws/?repository=rancher-payg-billing-adapter-llc-prd) under Usage Information in the [AWS Marketplace listing](https://aws.amazon.com/marketplace/pp/prodview-f2bvszurj2p2c). - -# From 224bc8168b561a031f5beea57d088946cc13b68f Mon Sep 17 00:00:00 2001 From: Marty Hernandez Avedon Date: Thu, 7 Mar 2024 10:28:26 -0500 Subject: [PATCH 48/54] #743 Role template management title updated (#1160) * 743 Role Templates management title updated In v2.7.7, the title of the Roles page under Users & Authentication, was updated to instead read Role Templates * updated for v2.7 pages * syncing v2.7 verbage * more syncing across versions --- .../creator-permissions.md | 4 ++-- .../cluster-and-project-roles.md | 6 +++--- .../custom-roles.md | 6 +++--- .../global-permissions.md | 14 +++++++------- .../locked-roles.md | 2 +- .../creator-permissions.md | 2 +- .../creator-permissions.md | 5 +++-- .../cluster-and-project-roles.md | 9 ++++++--- .../custom-roles.md | 13 ++++++++----- .../global-permissions.md | 19 ++++++++++++------- .../locked-roles.md | 3 ++- .../creator-permissions.md | 4 ++-- .../cluster-and-project-roles.md | 6 +++--- .../custom-roles.md | 6 +++--- .../global-permissions.md | 14 +++++++------- .../locked-roles.md | 2 +- 16 files changed, 64 insertions(+), 51 deletions(-) diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/creator-permissions.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/creator-permissions.md index eff8b84ee92..b4a0f290620 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/creator-permissions.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/creator-permissions.md @@ -40,8 +40,8 @@ An administrator can individually grant the role **Create RKE Templates** to any Alternatively, the administrator can give all new users the default permission to create RKE templates by following the following steps. This will not affect the permissions of existing users. 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. -1. Go to the role named **Create new RKE Cluster Templates and click **⋮ > Edit Config**. +1. In the left navigation bar, click **Role Templates**. +1. Select **Create new RKE Cluster Templates** and click **⋮ > Edit Config**. 1. Select the option **Yes: Default role for new users**. 1. Click **Save**. 1. If you would like new users to also be able to create RKE template revisions, enable that role as default as well. diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md index 74a2f048391..512a24f4b3d 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md @@ -11,7 +11,7 @@ Cluster and project roles define user authorization inside a cluster or project. To manage these roles, 1. Click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles** and go to the **Cluster** or **Project/Namespaces** tab. +1. In the left navigation bar, click **Role Templates** and go to the **Cluster** or **Project/Namespaces** tab. ### Membership and Role Assignment @@ -73,7 +73,7 @@ The following table lists the permissions available for the `Manage Nodes` role For details on how each cluster role can access Kubernetes resources, you can look them up in the Rancher UI: 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. +1. In the left navigation bar, click **Role Templates**. 1. Click the **Cluster** tab. 1. Click the name of an individual role. The table shows all of the operations and resources that are permitted by the role. @@ -220,7 +220,7 @@ There are two methods for changing default cluster/project roles: You can change the cluster or project role(s) that are automatically assigned to the creating user. 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. +1. In the left navigation bar, click **Role Templates**. 1. Click the **Cluster** or **Project/Namespaces** tab. 1. Find the custom or individual role that you want to use as default. Then edit the role by selecting **⋮ > Edit Config**. 1. In the **Cluster Creator Default** or **Project Creator Default** section, enable the role as the default. diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/custom-roles.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/custom-roles.md index 5e9c6c7a96d..7f44a211cf4 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/custom-roles.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/custom-roles.md @@ -31,7 +31,7 @@ While Rancher comes out-of-the-box with a set of default user roles, you can als The steps to add custom roles differ depending on the version of Rancher. 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. +1. In the left navigation bar, click **Role Templates**. 1. Select a tab to determine the scope of the role you're adding. The tabs are: - **Global:** The role is valid for allowing members to manage global scoped resources. @@ -65,7 +65,7 @@ The custom role can then be assigned to a user or group so that the role takes e To create a custom role based on an existing role, 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. +1. In the left navigation bar, click **Role Templates**. 1. Click the **Cluster** or **Project/Namespaces** tab. Click **Create Cluster Role** or **Create Project/Namespaces Role** depending on the scope. Note: Only cluster roles and project/namespace roles can inherit from another role. 1. Enter a name for the role. 1. In the **Inherit From** tab, select the role(s) that the custom role will inherit permissions from. @@ -86,7 +86,7 @@ Custom roles can be deleted, but built-in roles cannot be deleted. To delete a custom role, 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. +1. In the left navigation bar, click **Role Templates**. 2. Go to the custom global role that should be deleted and click **⋮ (…) > Delete**. 3. Click **Delete**. diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md index a516c10fe5b..f08099bfba4 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md @@ -31,8 +31,8 @@ When you create a new local user, you assign them a global permission as you com To see the default permissions for new users, 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. -1. The **Roles** page has tabs for roles grouped by scope. Each table lists the roles in that scope. In the **Global** tab, in the **New User Default** column, the permissions given to new users by default are indicated with a checkmark. +1. In the left navigation bar, click **Role Templates**. +1. The **Role Templates** page has tabs for roles grouped by scope. Each table lists the roles in that scope. In the **Global** tab, in the **New User Default** column, the permissions given to new users by default are indicated with a checkmark. You can [change the default global permissions to meet your needs.](#configuring-default-global-permissions) @@ -43,8 +43,8 @@ When a user logs into Rancher using an external authentication provider for the To see the default permissions for new users, 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. -1. The **Roles** page has tabs for roles grouped by scope. Each table lists the roles in that scope. In the **New User Default** column on each page, the permissions given to new users by default are indicated with a checkmark. +1. In the left navigation bar, click **Role Templates**. +1. The **Role Templates** page has tabs for roles grouped by scope. Each table lists the roles in that scope. In the **New User Default** column on each page, the permissions given to new users by default are indicated with a checkmark. You can [change the default permissions to meet your needs.](#configuring-default-global-permissions) @@ -92,7 +92,7 @@ The following table lists each built-in global permission and whether it is incl For details on which Kubernetes resources correspond to each global permission, 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. +1. In the left navigation bar, click **Role Templates**. 1. If you click the name of an individual role, a table shows all of the operations and resources that are permitted by the role. :::note Notes: @@ -221,7 +221,7 @@ Default roles are only assigned to users added from an external authentication p To change the default global permissions that are assigned to external users upon their first log in, follow these steps: 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. On the **Roles** page, make sure the **Global** tab is selected. +1. In the left navigation bar, click **Role Templates**. On the **Role Templates** page, make sure the **Global** tab is selected. 1. Find the permissions set that you want to add or remove as a default. Then edit the permission by selecting **⋮ > Edit Config**. 1. If you want to add the permission as a default, Select **Yes: Default role for new users** and then click **Save**. If you want to remove a default permission, edit the permission and select **No**. @@ -234,7 +234,7 @@ To configure permission for a user, 1. In the upper left corner, click **☰ > Users & Authentication**. 1. In the left navigation bar, click **Users**. 1. Go to the user whose access level you want to change and click **⋮ > Edit Config**. -1. In the **Global Permissions** and **Built-in** sections, check the boxes for each permission you want the user to have. If you have created roles from the **Roles** page, they will appear in the **Custom** section and you can choose from them as well. +1. In the **Global Permissions** and **Built-in** sections, check the boxes for each permission you want the user to have. If you have created roles from the **Role Templates** page, they will appear in the **Custom** section and you can choose from them as well. 1. Click **Save**. **Result:** The user's global permissions have been updated. diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/locked-roles.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/locked-roles.md index 4c4aec0be54..9cf6df0225f 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/locked-roles.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/locked-roles.md @@ -36,7 +36,7 @@ You can lock roles in two contexts: Cluster roles and project/namespace roles can be locked, but global roles cannot. 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. +1. In the left navigation bar, click **Role Templates**. 1. Go to the **Cluster** tab or the **Project/Namespaces** tab. 1. From the role that you want to lock (or unlock), select **⋮ > Edit Config**. 1. From the **Locked** option, choose the **Yes** or **No** radio button. Then click **Save**. diff --git a/versioned_docs/version-2.6/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/creator-permissions.md b/versioned_docs/version-2.6/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/creator-permissions.md index eff8b84ee92..416e26f40f8 100644 --- a/versioned_docs/version-2.6/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/creator-permissions.md +++ b/versioned_docs/version-2.6/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/creator-permissions.md @@ -41,7 +41,7 @@ Alternatively, the administrator can give all new users the default permission t 1. In the upper left corner, click **☰ > Users & Authentication**. 1. In the left navigation bar, click **Roles**. -1. Go to the role named **Create new RKE Cluster Templates and click **⋮ > Edit Config**. +1. Select **Create new RKE Cluster Templates** and click **⋮ > Edit Config**. 1. Select the option **Yes: Default role for new users**. 1. Click **Save**. 1. If you would like new users to also be able to create RKE template revisions, enable that role as default as well. diff --git a/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/creator-permissions.md b/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/creator-permissions.md index eff8b84ee92..5fd693a7c06 100644 --- a/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/creator-permissions.md +++ b/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/creator-permissions.md @@ -40,8 +40,9 @@ An administrator can individually grant the role **Create RKE Templates** to any Alternatively, the administrator can give all new users the default permission to create RKE templates by following the following steps. This will not affect the permissions of existing users. 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. -1. Go to the role named **Create new RKE Cluster Templates and click **⋮ > Edit Config**. +1. In the left navigation bar, click **Role Templates**. + * In Rancher v2.7.6 and earlier, the **Role Templates** page is labeled **Roles**. +1. Select **Create new RKE Cluster Templates** and click **⋮ > Edit Config**. 1. Select the option **Yes: Default role for new users**. 1. Click **Save**. 1. If you would like new users to also be able to create RKE template revisions, enable that role as default as well. diff --git a/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md b/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md index 74a2f048391..b3a579ce0ad 100644 --- a/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md +++ b/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md @@ -11,7 +11,8 @@ Cluster and project roles define user authorization inside a cluster or project. To manage these roles, 1. Click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles** and go to the **Cluster** or **Project/Namespaces** tab. +1. In the left navigation bar, click **Role Templates** and go to the **Cluster** or **Project/Namespaces** tab. + * In Rancher v2.7.6 and earlier, the **Role Templates** page is labeled **Roles**. ### Membership and Role Assignment @@ -73,7 +74,8 @@ The following table lists the permissions available for the `Manage Nodes` role For details on how each cluster role can access Kubernetes resources, you can look them up in the Rancher UI: 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. +1. In the left navigation bar, click **Role Templates**. + * In Rancher v2.7.6 and earlier, the **Role Templates** page is labeled **Roles**. 1. Click the **Cluster** tab. 1. Click the name of an individual role. The table shows all of the operations and resources that are permitted by the role. @@ -220,7 +222,8 @@ There are two methods for changing default cluster/project roles: You can change the cluster or project role(s) that are automatically assigned to the creating user. 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. +1. In the left navigation bar, click **Role Templates**. + * In Rancher v2.7.6 and earlier, the **Role Templates** page is labeled **Roles**. 1. Click the **Cluster** or **Project/Namespaces** tab. 1. Find the custom or individual role that you want to use as default. Then edit the role by selecting **⋮ > Edit Config**. 1. In the **Cluster Creator Default** or **Project Creator Default** section, enable the role as the default. diff --git a/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/custom-roles.md b/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/custom-roles.md index 5e9c6c7a96d..6597398f17f 100644 --- a/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/custom-roles.md +++ b/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/custom-roles.md @@ -31,7 +31,8 @@ While Rancher comes out-of-the-box with a set of default user roles, you can als The steps to add custom roles differ depending on the version of Rancher. 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. +1. In the left navigation bar, click **Role Templates**. + * In Rancher v2.7.6 and earlier, the **Role Templates** page is labeled **Roles**. 1. Select a tab to determine the scope of the role you're adding. The tabs are: - **Global:** The role is valid for allowing members to manage global scoped resources. @@ -65,7 +66,8 @@ The custom role can then be assigned to a user or group so that the role takes e To create a custom role based on an existing role, 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. +1. In the left navigation bar, click **Role Templates**. + * In Rancher v2.7.6 and earlier, the **Role Templates** page is labeled **Roles**. 1. Click the **Cluster** or **Project/Namespaces** tab. Click **Create Cluster Role** or **Create Project/Namespaces Role** depending on the scope. Note: Only cluster roles and project/namespace roles can inherit from another role. 1. Enter a name for the role. 1. In the **Inherit From** tab, select the role(s) that the custom role will inherit permissions from. @@ -86,9 +88,10 @@ Custom roles can be deleted, but built-in roles cannot be deleted. To delete a custom role, 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. -2. Go to the custom global role that should be deleted and click **⋮ (…) > Delete**. -3. Click **Delete**. +1. In the left navigation bar, click **Role Templates**. + * In Rancher v2.7.6 and earlier, the **Role Templates** page is labeled **Roles**. +1. Go to the custom global role that should be deleted and click **⋮ (…) > Delete**. +1. Click **Delete**. ## Assigning a Custom Role to a Group diff --git a/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md b/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md index dfae1c35f46..89cdfe4dbcb 100644 --- a/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md +++ b/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md @@ -102,8 +102,9 @@ When you create a new local user, you assign them a global permission as you com To see the default permissions for new users, 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. -1. The **Roles** page has tabs for roles grouped by scope. Each table lists the roles in that scope. In the **Global** tab, in the **New User Default** column, the permissions given to new users by default are indicated with a checkmark. +1. In the left navigation bar, click **Role Templates**. + * In Rancher v2.7.6 and earlier, the **Role Templates** page is labeled **Roles**. +1. The **Role Templates** page has tabs for roles grouped by scope. Each table lists the roles in that scope. In the **Global** tab, in the **New User Default** column, the permissions given to new users by default are indicated with a checkmark. You can [change the default global permissions to meet your needs.](#configuring-default-global-permissions) @@ -114,8 +115,9 @@ When a user logs into Rancher using an external authentication provider for the To see the default permissions for new users, 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. -1. The **Roles** page has tabs for roles grouped by scope. Each table lists the roles in that scope. In the **New User Default** column on each page, the permissions given to new users by default are indicated with a checkmark. +1. In the left navigation bar, click **Role Templates**. + * In Rancher v2.7.6 and earlier, the **Role Templates** page is labeled **Roles**. +1. The **Role Templates** page has tabs for roles grouped by scope. Each table lists the roles in that scope. In the **New User Default** column on each page, the permissions given to new users by default are indicated with a checkmark. You can [change the default permissions to meet your needs.](#configuring-default-global-permissions) @@ -161,7 +163,8 @@ The following table lists each custom global permission available and whether it For details on which Kubernetes resources correspond to each global permission, 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. +1. In the left navigation bar, click **Role Templates**. + * In Rancher v2.7.6 and earlier, the **Role Templates** page is labeled **Roles**. 1. If you click the name of an individual role, a table shows all of the operations and resources that are permitted by the role. :::note Notes: @@ -184,7 +187,8 @@ Default roles are only assigned to users added from an external authentication p To change the default global permissions that are assigned to external users upon their first log in, follow these steps: 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. On the **Roles** page, make sure the **Global** tab is selected. +1. In the left navigation bar, click **Roles**. On the **Role Templates** page, make sure the **Global** tab is selected. + * In Rancher v2.7.6 and earlier, the **Role Templates** page is labeled **Roles**. 1. Find the permissions set that you want to add or remove as a default. Then edit the permission by selecting **⋮ > Edit Config**. 1. If you want to add the permission as a default, Select **Yes: Default role for new users** and then click **Save**. If you want to remove a default permission, edit the permission and select **No**. @@ -197,7 +201,8 @@ To configure permission for a user, 1. In the upper left corner, click **☰ > Users & Authentication**. 1. In the left navigation bar, click **Users**. 1. Go to the user whose access level you want to change and click **⋮ > Edit Config**. -1. In the **Global Permissions** and **Built-in** sections, check the boxes for each permission you want the user to have. If you have created roles from the **Roles** page, they will appear in the **Custom** section and you can choose from them as well. +1. In the **Global Permissions** and **Built-in** sections, check the boxes for each permission you want the user to have. If you have created roles from the **Role Templates** page, they will appear in the **Custom** section and you can choose from them as well. + * In Rancher v2.7.6 and earlier, the **Role Templates** page is labeled **Roles**. 1. Click **Save**. **Result:** The user's global permissions have been updated. diff --git a/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/locked-roles.md b/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/locked-roles.md index 4c4aec0be54..e30702355f0 100644 --- a/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/locked-roles.md +++ b/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/locked-roles.md @@ -36,7 +36,8 @@ You can lock roles in two contexts: Cluster roles and project/namespace roles can be locked, but global roles cannot. 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. +1. In the left navigation bar, click **Role Templates**. + * In Rancher v2.7.6 and earlier, the **Role Templates** page is labeled **Roles**. 1. Go to the **Cluster** tab or the **Project/Namespaces** tab. 1. From the role that you want to lock (or unlock), select **⋮ > Edit Config**. 1. From the **Locked** option, choose the **Yes** or **No** radio button. Then click **Save**. diff --git a/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/creator-permissions.md b/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/creator-permissions.md index eff8b84ee92..b4a0f290620 100644 --- a/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/creator-permissions.md +++ b/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/creator-permissions.md @@ -40,8 +40,8 @@ An administrator can individually grant the role **Create RKE Templates** to any Alternatively, the administrator can give all new users the default permission to create RKE templates by following the following steps. This will not affect the permissions of existing users. 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. -1. Go to the role named **Create new RKE Cluster Templates and click **⋮ > Edit Config**. +1. In the left navigation bar, click **Role Templates**. +1. Select **Create new RKE Cluster Templates** and click **⋮ > Edit Config**. 1. Select the option **Yes: Default role for new users**. 1. Click **Save**. 1. If you would like new users to also be able to create RKE template revisions, enable that role as default as well. diff --git a/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md b/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md index 74a2f048391..512a24f4b3d 100644 --- a/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md +++ b/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md @@ -11,7 +11,7 @@ Cluster and project roles define user authorization inside a cluster or project. To manage these roles, 1. Click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles** and go to the **Cluster** or **Project/Namespaces** tab. +1. In the left navigation bar, click **Role Templates** and go to the **Cluster** or **Project/Namespaces** tab. ### Membership and Role Assignment @@ -73,7 +73,7 @@ The following table lists the permissions available for the `Manage Nodes` role For details on how each cluster role can access Kubernetes resources, you can look them up in the Rancher UI: 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. +1. In the left navigation bar, click **Role Templates**. 1. Click the **Cluster** tab. 1. Click the name of an individual role. The table shows all of the operations and resources that are permitted by the role. @@ -220,7 +220,7 @@ There are two methods for changing default cluster/project roles: You can change the cluster or project role(s) that are automatically assigned to the creating user. 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. +1. In the left navigation bar, click **Role Templates**. 1. Click the **Cluster** or **Project/Namespaces** tab. 1. Find the custom or individual role that you want to use as default. Then edit the role by selecting **⋮ > Edit Config**. 1. In the **Cluster Creator Default** or **Project Creator Default** section, enable the role as the default. diff --git a/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/custom-roles.md b/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/custom-roles.md index 5e9c6c7a96d..7f44a211cf4 100644 --- a/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/custom-roles.md +++ b/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/custom-roles.md @@ -31,7 +31,7 @@ While Rancher comes out-of-the-box with a set of default user roles, you can als The steps to add custom roles differ depending on the version of Rancher. 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. +1. In the left navigation bar, click **Role Templates**. 1. Select a tab to determine the scope of the role you're adding. The tabs are: - **Global:** The role is valid for allowing members to manage global scoped resources. @@ -65,7 +65,7 @@ The custom role can then be assigned to a user or group so that the role takes e To create a custom role based on an existing role, 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. +1. In the left navigation bar, click **Role Templates**. 1. Click the **Cluster** or **Project/Namespaces** tab. Click **Create Cluster Role** or **Create Project/Namespaces Role** depending on the scope. Note: Only cluster roles and project/namespace roles can inherit from another role. 1. Enter a name for the role. 1. In the **Inherit From** tab, select the role(s) that the custom role will inherit permissions from. @@ -86,7 +86,7 @@ Custom roles can be deleted, but built-in roles cannot be deleted. To delete a custom role, 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. +1. In the left navigation bar, click **Role Templates**. 2. Go to the custom global role that should be deleted and click **⋮ (…) > Delete**. 3. Click **Delete**. diff --git a/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md b/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md index a516c10fe5b..f08099bfba4 100644 --- a/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md +++ b/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md @@ -31,8 +31,8 @@ When you create a new local user, you assign them a global permission as you com To see the default permissions for new users, 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. -1. The **Roles** page has tabs for roles grouped by scope. Each table lists the roles in that scope. In the **Global** tab, in the **New User Default** column, the permissions given to new users by default are indicated with a checkmark. +1. In the left navigation bar, click **Role Templates**. +1. The **Role Templates** page has tabs for roles grouped by scope. Each table lists the roles in that scope. In the **Global** tab, in the **New User Default** column, the permissions given to new users by default are indicated with a checkmark. You can [change the default global permissions to meet your needs.](#configuring-default-global-permissions) @@ -43,8 +43,8 @@ When a user logs into Rancher using an external authentication provider for the To see the default permissions for new users, 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. -1. The **Roles** page has tabs for roles grouped by scope. Each table lists the roles in that scope. In the **New User Default** column on each page, the permissions given to new users by default are indicated with a checkmark. +1. In the left navigation bar, click **Role Templates**. +1. The **Role Templates** page has tabs for roles grouped by scope. Each table lists the roles in that scope. In the **New User Default** column on each page, the permissions given to new users by default are indicated with a checkmark. You can [change the default permissions to meet your needs.](#configuring-default-global-permissions) @@ -92,7 +92,7 @@ The following table lists each built-in global permission and whether it is incl For details on which Kubernetes resources correspond to each global permission, 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. +1. In the left navigation bar, click **Role Templates**. 1. If you click the name of an individual role, a table shows all of the operations and resources that are permitted by the role. :::note Notes: @@ -221,7 +221,7 @@ Default roles are only assigned to users added from an external authentication p To change the default global permissions that are assigned to external users upon their first log in, follow these steps: 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. On the **Roles** page, make sure the **Global** tab is selected. +1. In the left navigation bar, click **Role Templates**. On the **Role Templates** page, make sure the **Global** tab is selected. 1. Find the permissions set that you want to add or remove as a default. Then edit the permission by selecting **⋮ > Edit Config**. 1. If you want to add the permission as a default, Select **Yes: Default role for new users** and then click **Save**. If you want to remove a default permission, edit the permission and select **No**. @@ -234,7 +234,7 @@ To configure permission for a user, 1. In the upper left corner, click **☰ > Users & Authentication**. 1. In the left navigation bar, click **Users**. 1. Go to the user whose access level you want to change and click **⋮ > Edit Config**. -1. In the **Global Permissions** and **Built-in** sections, check the boxes for each permission you want the user to have. If you have created roles from the **Roles** page, they will appear in the **Custom** section and you can choose from them as well. +1. In the **Global Permissions** and **Built-in** sections, check the boxes for each permission you want the user to have. If you have created roles from the **Role Templates** page, they will appear in the **Custom** section and you can choose from them as well. 1. Click **Save**. **Result:** The user's global permissions have been updated. diff --git a/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/locked-roles.md b/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/locked-roles.md index 4c4aec0be54..9cf6df0225f 100644 --- a/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/locked-roles.md +++ b/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/locked-roles.md @@ -36,7 +36,7 @@ You can lock roles in two contexts: Cluster roles and project/namespace roles can be locked, but global roles cannot. 1. In the upper left corner, click **☰ > Users & Authentication**. -1. In the left navigation bar, click **Roles**. +1. In the left navigation bar, click **Role Templates**. 1. Go to the **Cluster** tab or the **Project/Namespaces** tab. 1. From the role that you want to lock (or unlock), select **⋮ > Edit Config**. 1. From the **Locked** option, choose the **Yes** or **No** radio button. Then click **Save**. From 5664965fa1fd5e4413e60fdbd7586a5742f45019 Mon Sep 17 00:00:00 2001 From: Marty Hernandez Avedon Date: Thu, 7 Mar 2024 11:18:37 -0500 Subject: [PATCH 49/54] #1128 Highlight expected behavior around permissions (#1130) * 1128 Highlight expected behavior around permissions * including test accounts * versioning * capitalization --- .../authentication-config/authentication-config.md | 12 ++++++++++-- .../about-authentication/about-authentication.md | 12 ++++++++++-- .../about-authentication/about-authentication.md | 12 ++++++++++-- .../authentication-config/authentication-config.md | 12 ++++++++++-- .../authentication-config/authentication-config.md | 12 ++++++++++-- .../authentication-config/authentication-config.md | 12 ++++++++++-- 6 files changed, 60 insertions(+), 12 deletions(-) diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/authentication-config.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/authentication-config.md index d569a9d8849..a05fc7c93a3 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/authentication-config.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/authentication-config.md @@ -11,6 +11,12 @@ One of the key features that Rancher adds to Kubernetes is centralized user auth This centralized user authentication is accomplished using the Rancher authentication proxy, which is installed along with the rest of Rancher. This proxy authenticates your users and forwards their requests to your Kubernetes clusters using a service account. +:::warning + +The account used to enable the external provider will be granted admin permissions. If you use a test account or non-admin account, that account will still be granted admin-level permissions. See [External Authentication Configuration and Principal Users](#external-authentication-configuration-and-principal-users) to understand why. + +::: + ## External vs. Local Authentication The Rancher authentication proxy integrates with the following external authentication services. @@ -77,12 +83,14 @@ To set the Rancher access level for users in the authorization service, follow t ## External Authentication Configuration and Principal Users -Configuration of external authentication requires: +Configuring external authentication requires: - A local user assigned the administrator role, called hereafter the _local principal_. - An external user that can authenticate with your external authentication service, called hereafter the _external principal_. -Configuration of external authentication affects how principal users are managed within Rancher. Follow the list below to better understand these effects. +The configuration of external authentication also affects how principal users are managed within Rancher. Specifically, when a user account enables an external provider, it is granted admin-level permissions. This is because the local principal and external principal share the same user ID and access rights. + +The following instructions demonstrate these effects: 1. Sign into Rancher as the local principal and complete configuration of external authentication. diff --git a/versioned_docs/version-2.0-2.4/how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-authentication/about-authentication.md b/versioned_docs/version-2.0-2.4/how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-authentication/about-authentication.md index c1a6e38d5ea..de887d7ad1e 100644 --- a/versioned_docs/version-2.0-2.4/how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-authentication/about-authentication.md +++ b/versioned_docs/version-2.0-2.4/how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-authentication/about-authentication.md @@ -10,6 +10,12 @@ One of the key features that Rancher adds to Kubernetes is centralized user auth This centralized user authentication is accomplished using the Rancher authentication proxy, which is installed along with the rest of Rancher. This proxy authenticates your users and forwards their requests to your Kubernetes clusters using a service account. +:::warning + +The account used to enable the external provider will be granted admin permissions. If you use a test account or non-admin account, that account will still be granted admin-level permissions. See [External Authentication Configuration and Principal Users](#external-authentication-configuration-and-principal-users) to understand why. + +::: + ## External vs. Local Authentication The Rancher authentication proxy integrates with the following external authentication services. The following table lists the first version of Rancher each service debuted. @@ -74,12 +80,14 @@ To set the Rancher access level for users in the authorization service, follow t ## External Authentication Configuration and Principal Users -Configuration of external authentication requires: +Configuring external authentication requires: - A local user assigned the administrator role, called hereafter the _local principal_. - An external user that can authenticate with your external authentication service, called hereafter the _external principal_. -Configuration of external authentication affects how principal users are managed within Rancher. Follow the list below to better understand these effects. +The configuration of external authentication also affects how principal users are managed within Rancher. Specifically, when a user account enables an external provider, it is granted admin-level permissions. This is because the local principal and external principal share the same user ID and access rights. + +The following instructions demonstrate these effects: 1. Sign into Rancher as the local principal and complete configuration of external authentication. diff --git a/versioned_docs/version-2.5/how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-authentication/about-authentication.md b/versioned_docs/version-2.5/how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-authentication/about-authentication.md index f31e3068520..443d130019b 100644 --- a/versioned_docs/version-2.5/how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-authentication/about-authentication.md +++ b/versioned_docs/version-2.5/how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-authentication/about-authentication.md @@ -6,6 +6,12 @@ One of the key features that Rancher adds to Kubernetes is centralized user auth This centralized user authentication is accomplished using the Rancher authentication proxy, which is installed along with the rest of Rancher. This proxy authenticates your users and forwards their requests to your Kubernetes clusters using a service account. +:::warning + +The account used to enable the external provider will be granted admin permissions. If you use a test account or non-admin account, that account will still be granted admin-level permissions. See [External Authentication Configuration and Principal Users](#external-authentication-configuration-and-principal-users) to understand why. + +::: + ## External vs. Local Authentication The Rancher authentication proxy integrates with the following external authentication services. The following table lists the first version of Rancher each service debuted. @@ -70,12 +76,14 @@ To set the Rancher access level for users in the authorization service, follow t ## External Authentication Configuration and Principal Users -Configuration of external authentication requires: +Configuring external authentication requires: - A local user assigned the administrator role, called hereafter the _local principal_. - An external user that can authenticate with your external authentication service, called hereafter the _external principal_. -Configuration of external authentication affects how principal users are managed within Rancher. Follow the list below to better understand these effects. +The configuration of external authentication also affects how principal users are managed within Rancher. Specifically, when a user account enables an external provider, it is granted admin-level permissions. This is because the local principal and external principal share the same user ID and access rights. + +The following instructions demonstrate these effects: 1. Sign into Rancher as the local principal and complete configuration of external authentication. diff --git a/versioned_docs/version-2.6/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/authentication-config.md b/versioned_docs/version-2.6/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/authentication-config.md index 910f2990b5a..3b35afe1952 100644 --- a/versioned_docs/version-2.6/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/authentication-config.md +++ b/versioned_docs/version-2.6/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/authentication-config.md @@ -11,6 +11,12 @@ One of the key features that Rancher adds to Kubernetes is centralized user auth This centralized user authentication is accomplished using the Rancher authentication proxy, which is installed along with the rest of Rancher. This proxy authenticates your users and forwards their requests to your Kubernetes clusters using a service account. +:::warning + +The account used to enable the external provider will be granted admin permissions. If you use a test account or non-admin account, that account will still be granted admin-level permissions. See [External Authentication Configuration and Principal Users](#external-authentication-configuration-and-principal-users) to understand why. + +::: + ## External vs. Local Authentication The Rancher authentication proxy integrates with the following external authentication services. @@ -77,12 +83,14 @@ To set the Rancher access level for users in the authorization service, follow t ## External Authentication Configuration and Principal Users -Configuration of external authentication requires: +Configuring external authentication requires: - A local user assigned the administrator role, called hereafter the _local principal_. - An external user that can authenticate with your external authentication service, called hereafter the _external principal_. -Configuration of external authentication affects how principal users are managed within Rancher. Follow the list below to better understand these effects. +The configuration of external authentication also affects how principal users are managed within Rancher. Specifically, when a user account enables an external provider, it is granted admin-level permissions. This is because the local principal and external principal share the same user ID and access rights. + +The following instructions demonstrate these effects: 1. Sign into Rancher as the local principal and complete configuration of external authentication. diff --git a/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/authentication-config.md b/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/authentication-config.md index d569a9d8849..a05fc7c93a3 100644 --- a/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/authentication-config.md +++ b/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/authentication-config.md @@ -11,6 +11,12 @@ One of the key features that Rancher adds to Kubernetes is centralized user auth This centralized user authentication is accomplished using the Rancher authentication proxy, which is installed along with the rest of Rancher. This proxy authenticates your users and forwards their requests to your Kubernetes clusters using a service account. +:::warning + +The account used to enable the external provider will be granted admin permissions. If you use a test account or non-admin account, that account will still be granted admin-level permissions. See [External Authentication Configuration and Principal Users](#external-authentication-configuration-and-principal-users) to understand why. + +::: + ## External vs. Local Authentication The Rancher authentication proxy integrates with the following external authentication services. @@ -77,12 +83,14 @@ To set the Rancher access level for users in the authorization service, follow t ## External Authentication Configuration and Principal Users -Configuration of external authentication requires: +Configuring external authentication requires: - A local user assigned the administrator role, called hereafter the _local principal_. - An external user that can authenticate with your external authentication service, called hereafter the _external principal_. -Configuration of external authentication affects how principal users are managed within Rancher. Follow the list below to better understand these effects. +The configuration of external authentication also affects how principal users are managed within Rancher. Specifically, when a user account enables an external provider, it is granted admin-level permissions. This is because the local principal and external principal share the same user ID and access rights. + +The following instructions demonstrate these effects: 1. Sign into Rancher as the local principal and complete configuration of external authentication. diff --git a/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/authentication-config.md b/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/authentication-config.md index d569a9d8849..23bc98fbdb3 100644 --- a/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/authentication-config.md +++ b/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/authentication-config.md @@ -11,6 +11,12 @@ One of the key features that Rancher adds to Kubernetes is centralized user auth This centralized user authentication is accomplished using the Rancher authentication proxy, which is installed along with the rest of Rancher. This proxy authenticates your users and forwards their requests to your Kubernetes clusters using a service account. + +:::warning + +The account used to enable the external provider will be granted admin permissions. If you use a test account or non-admin account, that account will still be granted admin-level permissions. See [External Authentication Configuration and Principal Users](#external-authentication-configuration-and-principal-users) to understand why. + +::: ## External vs. Local Authentication The Rancher authentication proxy integrates with the following external authentication services. @@ -77,12 +83,14 @@ To set the Rancher access level for users in the authorization service, follow t ## External Authentication Configuration and Principal Users -Configuration of external authentication requires: +Configuring external authentication requires: - A local user assigned the administrator role, called hereafter the _local principal_. - An external user that can authenticate with your external authentication service, called hereafter the _external principal_. -Configuration of external authentication affects how principal users are managed within Rancher. Follow the list below to better understand these effects. +The configuration of external authentication also affects how principal users are managed within Rancher. Specifically, when a user account enables an external provider, it is granted admin-level permissions. This is because the local principal and external principal share the same user ID and access rights. + +The following instructions demonstrate these effects: 1. Sign into Rancher as the local principal and complete configuration of external authentication. From 0e76fd2d59e6597216439551cd5a53326dfb5eb5 Mon Sep 17 00:00:00 2001 From: Michal Jura Date: Thu, 7 Mar 2024 17:56:04 +0100 Subject: [PATCH 50/54] Update eks cluster configuration (#1048) * Update eks cluster configuration Issue: https://github.com/rancher/eks-operator/issues/301 Update eks cluster configuration with section about: - Launching self-managed Amazon Linux nodes - IAM roles for service accounts * Apply suggestions from code review * Apply suggestions from code review * fixed bad link * versioning --------- Co-authored-by: Marty Hernandez Avedon --- .../eks-cluster-configuration.md | 21 ++++++++++++++++++- .../eks-cluster-configuration.md | 19 +++++++++++++++++ 2 files changed, 39 insertions(+), 1 deletion(-) diff --git a/docs/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md b/docs/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md index c7936942596..dd3bf822712 100644 --- a/docs/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md +++ b/docs/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md @@ -1,5 +1,5 @@ --- -title: EKS Cluster Configuration Reference | 2.6 +title: EKS Cluster Configuration Reference --- @@ -147,6 +147,25 @@ The following settings are also configurable. All of these except for the "Node | Labels | Kubernetes labels applied to the nodes in the managed node group. | | Tags | These are tags for the managed node group and do not propagate to any of the associated resources. | +### Self-managed Amazon Linux Nodes + +You can register an EKS cluster containing self-managed Amazon Linux nodes. You must configure this type of cluster according to the instructions in the official AWS documentation for [launching self-managed Amazon Linux nodes](https://docs.aws.amazon.com/eks/latest/userguide/launch-workers.html). EKS clusters containing self-managed Amazon Linux nodes are usually operated by the [Karpenter](https://karpenter.sh/docs/) project. After you provision an EKS cluster containing self-managed Amazon Linux nodes, [register the cluster](../../../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/register-existing-clusters.md) so it can be managed by Rancher. However, the nodes won't be visible in the Rancher UI. + +### IAM Roles for Service Accounts + +An Applications Deployment running on an EKS cluster can make requests to AWS services via IAM permissions. These applications must sign their requests with AWS credentials. IAM roles for service accounts manage these credentials using an AWS OIDC endpoint. Rather than distributing AWS credentials to containers or relying on an EC2 instance's role, you can link an [IAM role to a Kubernetes service account](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) and configure your Pods to use this account. + +:::note + +Linking to an IAM role is not supported for Rancher pods in an EKS cluster. + +::: + +To enable IAM roles for service accounts: +1. [Create an IAM OIDC provider for your cluster](https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html) +1. [Configure a Kubernetes service account to assume an IAM role](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) +1. [Configure Pods to use a Kubernetes service account](https://docs.aws.amazon.com/eks/latest/userguide/pod-configuration.html) +1. [Use a supported AWS SDK](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-minimum-sdk.html) ### Configuring the Refresh Interval diff --git a/versioned_docs/version-2.8/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md b/versioned_docs/version-2.8/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md index a67d997b6c1..cce47910f3d 100644 --- a/versioned_docs/version-2.8/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md +++ b/versioned_docs/version-2.8/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md @@ -146,6 +146,25 @@ The following settings are also configurable. All of these except for the "Node | Labels | Kubernetes labels applied to the nodes in the managed node group. | | Tags | These are tags for the managed node group and do not propagate to any of the associated resources. | +### Self-managed Amazon Linux Nodes + +You can register an EKS cluster containing self-managed Amazon Linux nodes. You must configure this type of cluster according to the instructions in the official AWS documentation for [launching self-managed Amazon Linux nodes](https://docs.aws.amazon.com/eks/latest/userguide/launch-workers.html). EKS clusters containing self-managed Amazon Linux nodes are usually operated by the [Karpenter](https://karpenter.sh/docs/) project. After you provision an EKS cluster containing self-managed Amazon Linux nodes, [register the cluster](../../../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/register-existing-clusters.md) so it can be managed by Rancher. However, the nodes won't be visible in the Rancher UI. + +### IAM Roles for Service Accounts + +An Applications Deployment running on an EKS cluster can make requests to AWS services via IAM permissions. These applications must sign their requests with AWS credentials. IAM roles for service accounts manage these credentials using an AWS OIDC endpoint. Rather than distributing AWS credentials to containers or relying on an EC2 instance's role, you can link an [IAM role to a Kubernetes service account](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) and configure your Pods to use this account. + +:::note + +Linking to an IAM role is not supported for Rancher pods in an EKS cluster. + +::: + +To enable IAM roles for service accounts: +1. [Create an IAM OIDC provider for your cluster](https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html) +1. [Configure a Kubernetes service account to assume an IAM role](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) +1. [Configure Pods to use a Kubernetes service account](https://docs.aws.amazon.com/eks/latest/userguide/pod-configuration.html) +1. [Use a supported AWS SDK](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-minimum-sdk.html) ### Configuring the Refresh Interval From e18bb7cc04434b9efd791d22ea31b6e175f6af4c Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Thu, 7 Mar 2024 11:10:55 -0800 Subject: [PATCH 51/54] Adding in rephrasing after review/citing sources. Signed-off-by: Sunil Singh --- .../helm-charts-in-rancher.md | 18 +++++++++++------- .../helm-charts-in-rancher/adding-catalogs.md | 4 ++-- .../new-user-guides/helm-charts-in-rancher.md | 18 +++++++++++------- .../helm-charts-in-rancher.md | 18 +++++++++++------- .../helm-charts-in-rancher.md | 18 +++++++++++------- .../helm-charts-in-rancher.md | 18 +++++++++++------- 6 files changed, 57 insertions(+), 37 deletions(-) diff --git a/docs/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md b/docs/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md index e8dbcf88af2..ba159df89cf 100644 --- a/docs/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md +++ b/docs/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md @@ -74,27 +74,31 @@ Apps managed by the Cluster Manager (the global view in the legacy Rancher UI) s From the left sidebar select _"Repositories"_. -These items represent Helm repositories, and can be either traditional Helm endpoints which have an index.yaml, or git repositories which will be cloned and can point to a specific branch. In order to use custom charts, simply add your repository here and they will become available in the Charts tab under the name of the repository. +These items represent Helm repositories, and can be either traditional Helm endpoints which have an index.yaml, or Git repositories which will be cloned and can point to a specific branch. In order to use custom charts, simply add your repository here and they will become available in the Charts tab under the name of the repository. #### Add Custom Git Repositories -Click the `Create` button and be sure to select the target `Git repository containing Helm chart...` to add a custom Git repository that contains your Helm charts or cluster template definitions. The branch name can be specified here if necessary, and if no branch name is provided the main branch will be used by default. At minimum a name and Git repository URL will be needed to finalize creation. An optional field for describing the chart repository is also available. Whenever you add a chart repository to Rancher, it will be available immediately. +Click **Create** and select the target, **Git repository containing Helm chart...** to add a custom Git repository that contains your Helm charts or cluster template definitions. + +You must enter a name and a Git repository URL. The other fields, including the description, are optional. Enter an alternative branch name if you don't want to pull from the default, `main`. + +Whenever you add a chart repository to Rancher, it becomes available immediately. #### Add Custom Helm Chart Repositories -A Helm chart repository is an HTTP server that houses one or more packaged charts. Any HTTP server that can serve YAML files and tar files and can answer GET requests can be used as a repository server. +You can add your own Helm chart repositories to serve chart packages to Rancher. You can use any HTTP server, as long as the server can respond to GET requests and serve YAML files and tar archives. -Helm comes with Helm serve, a built-in package server for developer testing. The Helm team has tested other servers, including Google Cloud Storage with website mode enabled, S3 with website mode enabled or hosting custom chart repository server using open-source projects like [ChartMuseum](https://github.com/helm/chartmuseum). +For more information on Helm chart repositories, see the [official Helm docs](https://helm.sh/docs/topics/chart_repository/). -In Rancher, you can add the custom Helm chart repository by clicking the `Create` button and having the target `http(s) URL to an index generated by Helm` selected. You will need to input at minimum a repo name and the index URL address of the chart repository. +To add a custom Helm chart repository to Rancher, click **Create** and select **http(s) URL to an index generated by Helm** as the target. Enter a repo name and the index URL address of the chart repository. #### Add Private Git/Helm Chart Repositories -Private Git or Helm chart repositories can be added into Rancher using either SSH key credentials or an HTTP basic auth secret, i.e. Username and Password. +You can add private Git or Helm chart repositories with SSH key credentials or an HTTP basic auth secret, such as a username and password. #### Add a Private CA to Repositories -To add a private CA for Helm Chart repositories: +To add a private CA to Helm chart repositories: - **HTTP-based chart repositories**: You must add a base64 encoded copy of the CA certificate in DER format to the spec.caBundle field of the chart repo, such as `openssl x509 -outform der -in ca.pem | base64 -w0`. Click **Edit YAML** for the chart repo and set, as in the following example:
``` diff --git a/versioned_docs/version-2.0-2.4/how-to-guides/new-user-guides/helm-charts-in-rancher/adding-catalogs.md b/versioned_docs/version-2.0-2.4/how-to-guides/new-user-guides/helm-charts-in-rancher/adding-catalogs.md index 9ff124e1e7e..bb727efa14d 100644 --- a/versioned_docs/version-2.0-2.4/how-to-guides/new-user-guides/helm-charts-in-rancher/adding-catalogs.md +++ b/versioned_docs/version-2.0-2.4/how-to-guides/new-user-guides/helm-charts-in-rancher/adding-catalogs.md @@ -15,9 +15,9 @@ The Git URL needs to be one that `git clone` [can handle](https://git-scm.com/do ### Add Custom Helm Chart Repositories -A Helm chart repository is an HTTP server that houses one or more packaged charts. Any HTTP server that can serve YAML files and tar files and can answer GET requests can be used as a repository server. +You can add your own Helm chart repositories to serve chart packages to Rancher. You can use any HTTP server, as long as the server can respond to GET requests and serve YAML files and tar archives. -Helm comes with Helm serve, a built-in package server for developer testing. The Helm team has tested other servers, including Google Cloud Storage with website mode enabled, S3 with website mode enabled or hosting custom chart repository server using open-source projects like [ChartMuseum](https://github.com/helm/chartmuseum). +For more information on Helm chart repositories, see the [official Helm docs](https://helm.sh/docs/topics/chart_repository/). In Rancher, you can add the custom Helm chart repository with only a catalog name and the URL address of the chart repository. diff --git a/versioned_docs/version-2.5/how-to-guides/new-user-guides/helm-charts-in-rancher.md b/versioned_docs/version-2.5/how-to-guides/new-user-guides/helm-charts-in-rancher.md index c0254ebf887..80fe5d50471 100644 --- a/versioned_docs/version-2.5/how-to-guides/new-user-guides/helm-charts-in-rancher.md +++ b/versioned_docs/version-2.5/how-to-guides/new-user-guides/helm-charts-in-rancher.md @@ -34,27 +34,31 @@ All three types are deployed and managed in the same way. From the left sidebar select _"Repositories"_. -These items represent Helm repositories, and can be either traditional Helm endpoints which have an index.yaml, or git repositories which will be cloned and can point to a specific branch. In order to use custom charts, simply add your repository here and they will become available in the Charts tab under the name of the repository. +These items represent Helm repositories, and can be either traditional Helm endpoints which have an index.yaml, or Git repositories which will be cloned and can point to a specific branch. In order to use custom charts, simply add your repository here and they will become available in the Charts tab under the name of the repository. #### Add Custom Git Repositories -Click the `Create` button and be sure to select the target `Git repository containing Helm chart...` to add a custom Git repository that contains your Helm charts or cluster template definitions. The branch name can be specified here if necessary, and if no branch name is provided the main branch will be used by default. At minimum a name and Git repository URL will be needed to finalize creation. An optional field for describing the chart repository is also available. Whenever you add a chart repository to Rancher, it will be available immediately. +Click **Create** and select the target, **Git repository containing Helm chart...** to add a custom Git repository that contains your Helm charts or cluster template definitions. + +You must enter a name and a Git repository URL. The other fields, including the description, are optional. Enter an alternative branch name if you don't want to pull from the default, `main`. + +Whenever you add a chart repository to Rancher, it becomes available immediately. #### Add Custom Helm Chart Repositories -A Helm chart repository is an HTTP server that houses one or more packaged charts. Any HTTP server that can serve YAML files and tar files and can answer GET requests can be used as a repository server. +You can add your own Helm chart repositories to serve chart packages to Rancher. You can use any HTTP server, as long as the server can respond to GET requests and serve YAML files and tar archives. -Helm comes with Helm serve, a built-in package server for developer testing. The Helm team has tested other servers, including Google Cloud Storage with website mode enabled, S3 with website mode enabled or hosting custom chart repository server using open-source projects like [ChartMuseum](https://github.com/helm/chartmuseum). +For more information on Helm chart repositories, see the [official Helm docs](https://helm.sh/docs/topics/chart_repository/). -In Rancher, you can add the custom Helm chart repository by clicking the `Create` button and having the target `http(s) URL to an index generated by Helm` selected. You will need to input at minimum a repo name and the index URL address of the chart repository. +To add a custom Helm chart repository to Rancher, click **Create** and select **http(s) URL to an index generated by Helm** as the target. Enter a repo name and the index URL address of the chart repository. #### Add Private Git/Helm Chart Repositories -Private Git or Helm chart repositories can be added into Rancher using either SSH key credentials or an HTTP basic auth secret, i.e. Username and Password. +You can add private Git or Helm chart repositories with SSH key credentials or an HTTP basic auth secret, such as a username and password. #### Add a Private CA to Repositories -To add a private CA for Helm Chart repositories: +To add a private CA to Helm chart repositories: - **HTTP-based chart repositories**: You must add a base64 encoded copy of the CA certificate in DER format to the spec.caBundle field of the chart repo, such as `openssl x509 -outform der -in ca.pem | base64 -w0`. Click **Edit YAML** for the chart repo and set, as in the following example:
``` diff --git a/versioned_docs/version-2.6/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md b/versioned_docs/version-2.6/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md index 7cef3610279..691c25eb268 100644 --- a/versioned_docs/version-2.6/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md +++ b/versioned_docs/version-2.6/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md @@ -82,27 +82,31 @@ Apps managed by the Cluster Manager (the global view in the legacy Rancher UI) s From the left sidebar select _"Repositories"_. -These items represent Helm repositories, and can be either traditional Helm endpoints which have an index.yaml, or git repositories which will be cloned and can point to a specific branch. In order to use custom charts, simply add your repository here and they will become available in the Charts tab under the name of the repository. +These items represent Helm repositories, and can be either traditional Helm endpoints which have an index.yaml, or Git repositories which will be cloned and can point to a specific branch. In order to use custom charts, simply add your repository here and they will become available in the Charts tab under the name of the repository. #### Add Custom Git Repositories -Click the `Create` button and be sure to select the target `Git repository containing Helm chart...` to add a custom Git repository that contains your Helm charts or cluster template definitions. The branch name can be specified here if necessary, and if no branch name is provided the main branch will be used by default. At minimum a name and Git repository URL will be needed to finalize creation. An optional field for describing the chart repository is also available. Whenever you add a chart repository to Rancher, it will be available immediately. +Click **Create** and select the target, **Git repository containing Helm chart...** to add a custom Git repository that contains your Helm charts or cluster template definitions. + +You must enter a name and a Git repository URL. The other fields, including the description, are optional. Enter an alternative branch name if you don't want to pull from the default, `main`. + +Whenever you add a chart repository to Rancher, it becomes available immediately. #### Add Custom Helm Chart Repositories -A Helm chart repository is an HTTP server that houses one or more packaged charts. Any HTTP server that can serve YAML files and tar files and can answer GET requests can be used as a repository server. +You can add your own Helm chart repositories to serve chart packages to Rancher. You can use any HTTP server, as long as the server can respond to GET requests and serve YAML files and tar archives. -Helm comes with Helm serve, a built-in package server for developer testing. The Helm team has tested other servers, including Google Cloud Storage with website mode enabled, S3 with website mode enabled or hosting custom chart repository server using open-source projects like [ChartMuseum](https://github.com/helm/chartmuseum). +For more information on Helm chart repositories, see the [official Helm docs](https://helm.sh/docs/topics/chart_repository/). -In Rancher, you can add the custom Helm chart repository by clicking the `Create` button and having the target `http(s) URL to an index generated by Helm` selected. You will need to input at minimum a repo name and the index URL address of the chart repository. +To add a custom Helm chart repository to Rancher, click **Create** and select **http(s) URL to an index generated by Helm** as the target. Enter a repo name and the index URL address of the chart repository. #### Add Private Git/Helm Chart Repositories -Private Git or Helm chart repositories can be added into Rancher using either SSH key credentials or an HTTP basic auth secret, i.e. Username and Password. +You can add private Git or Helm chart repositories with SSH key credentials or an HTTP basic auth secret, such as a username and password. #### Add a Private CA to Repositories -To add a private CA for Helm Chart repositories: +To add a private CA to Helm chart repositories: - **HTTP-based chart repositories**: You must add a base64 encoded copy of the CA certificate in DER format to the spec.caBundle field of the chart repo, such as `openssl x509 -outform der -in ca.pem | base64 -w0`. Click **Edit YAML** for the chart repo and set, as in the following example:
``` diff --git a/versioned_docs/version-2.7/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md b/versioned_docs/version-2.7/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md index e8dbcf88af2..ba159df89cf 100644 --- a/versioned_docs/version-2.7/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md +++ b/versioned_docs/version-2.7/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md @@ -74,27 +74,31 @@ Apps managed by the Cluster Manager (the global view in the legacy Rancher UI) s From the left sidebar select _"Repositories"_. -These items represent Helm repositories, and can be either traditional Helm endpoints which have an index.yaml, or git repositories which will be cloned and can point to a specific branch. In order to use custom charts, simply add your repository here and they will become available in the Charts tab under the name of the repository. +These items represent Helm repositories, and can be either traditional Helm endpoints which have an index.yaml, or Git repositories which will be cloned and can point to a specific branch. In order to use custom charts, simply add your repository here and they will become available in the Charts tab under the name of the repository. #### Add Custom Git Repositories -Click the `Create` button and be sure to select the target `Git repository containing Helm chart...` to add a custom Git repository that contains your Helm charts or cluster template definitions. The branch name can be specified here if necessary, and if no branch name is provided the main branch will be used by default. At minimum a name and Git repository URL will be needed to finalize creation. An optional field for describing the chart repository is also available. Whenever you add a chart repository to Rancher, it will be available immediately. +Click **Create** and select the target, **Git repository containing Helm chart...** to add a custom Git repository that contains your Helm charts or cluster template definitions. + +You must enter a name and a Git repository URL. The other fields, including the description, are optional. Enter an alternative branch name if you don't want to pull from the default, `main`. + +Whenever you add a chart repository to Rancher, it becomes available immediately. #### Add Custom Helm Chart Repositories -A Helm chart repository is an HTTP server that houses one or more packaged charts. Any HTTP server that can serve YAML files and tar files and can answer GET requests can be used as a repository server. +You can add your own Helm chart repositories to serve chart packages to Rancher. You can use any HTTP server, as long as the server can respond to GET requests and serve YAML files and tar archives. -Helm comes with Helm serve, a built-in package server for developer testing. The Helm team has tested other servers, including Google Cloud Storage with website mode enabled, S3 with website mode enabled or hosting custom chart repository server using open-source projects like [ChartMuseum](https://github.com/helm/chartmuseum). +For more information on Helm chart repositories, see the [official Helm docs](https://helm.sh/docs/topics/chart_repository/). -In Rancher, you can add the custom Helm chart repository by clicking the `Create` button and having the target `http(s) URL to an index generated by Helm` selected. You will need to input at minimum a repo name and the index URL address of the chart repository. +To add a custom Helm chart repository to Rancher, click **Create** and select **http(s) URL to an index generated by Helm** as the target. Enter a repo name and the index URL address of the chart repository. #### Add Private Git/Helm Chart Repositories -Private Git or Helm chart repositories can be added into Rancher using either SSH key credentials or an HTTP basic auth secret, i.e. Username and Password. +You can add private Git or Helm chart repositories with SSH key credentials or an HTTP basic auth secret, such as a username and password. #### Add a Private CA to Repositories -To add a private CA for Helm Chart repositories: +To add a private CA to Helm chart repositories: - **HTTP-based chart repositories**: You must add a base64 encoded copy of the CA certificate in DER format to the spec.caBundle field of the chart repo, such as `openssl x509 -outform der -in ca.pem | base64 -w0`. Click **Edit YAML** for the chart repo and set, as in the following example:
``` diff --git a/versioned_docs/version-2.8/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md b/versioned_docs/version-2.8/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md index e8dbcf88af2..ba159df89cf 100644 --- a/versioned_docs/version-2.8/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md +++ b/versioned_docs/version-2.8/how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md @@ -74,27 +74,31 @@ Apps managed by the Cluster Manager (the global view in the legacy Rancher UI) s From the left sidebar select _"Repositories"_. -These items represent Helm repositories, and can be either traditional Helm endpoints which have an index.yaml, or git repositories which will be cloned and can point to a specific branch. In order to use custom charts, simply add your repository here and they will become available in the Charts tab under the name of the repository. +These items represent Helm repositories, and can be either traditional Helm endpoints which have an index.yaml, or Git repositories which will be cloned and can point to a specific branch. In order to use custom charts, simply add your repository here and they will become available in the Charts tab under the name of the repository. #### Add Custom Git Repositories -Click the `Create` button and be sure to select the target `Git repository containing Helm chart...` to add a custom Git repository that contains your Helm charts or cluster template definitions. The branch name can be specified here if necessary, and if no branch name is provided the main branch will be used by default. At minimum a name and Git repository URL will be needed to finalize creation. An optional field for describing the chart repository is also available. Whenever you add a chart repository to Rancher, it will be available immediately. +Click **Create** and select the target, **Git repository containing Helm chart...** to add a custom Git repository that contains your Helm charts or cluster template definitions. + +You must enter a name and a Git repository URL. The other fields, including the description, are optional. Enter an alternative branch name if you don't want to pull from the default, `main`. + +Whenever you add a chart repository to Rancher, it becomes available immediately. #### Add Custom Helm Chart Repositories -A Helm chart repository is an HTTP server that houses one or more packaged charts. Any HTTP server that can serve YAML files and tar files and can answer GET requests can be used as a repository server. +You can add your own Helm chart repositories to serve chart packages to Rancher. You can use any HTTP server, as long as the server can respond to GET requests and serve YAML files and tar archives. -Helm comes with Helm serve, a built-in package server for developer testing. The Helm team has tested other servers, including Google Cloud Storage with website mode enabled, S3 with website mode enabled or hosting custom chart repository server using open-source projects like [ChartMuseum](https://github.com/helm/chartmuseum). +For more information on Helm chart repositories, see the [official Helm docs](https://helm.sh/docs/topics/chart_repository/). -In Rancher, you can add the custom Helm chart repository by clicking the `Create` button and having the target `http(s) URL to an index generated by Helm` selected. You will need to input at minimum a repo name and the index URL address of the chart repository. +To add a custom Helm chart repository to Rancher, click **Create** and select **http(s) URL to an index generated by Helm** as the target. Enter a repo name and the index URL address of the chart repository. #### Add Private Git/Helm Chart Repositories -Private Git or Helm chart repositories can be added into Rancher using either SSH key credentials or an HTTP basic auth secret, i.e. Username and Password. +You can add private Git or Helm chart repositories with SSH key credentials or an HTTP basic auth secret, such as a username and password. #### Add a Private CA to Repositories -To add a private CA for Helm Chart repositories: +To add a private CA to Helm chart repositories: - **HTTP-based chart repositories**: You must add a base64 encoded copy of the CA certificate in DER format to the spec.caBundle field of the chart repo, such as `openssl x509 -outform der -in ca.pem | base64 -w0`. Click **Edit YAML** for the chart repo and set, as in the following example:
``` From f37b7655f91f7c33657fc8132133a2bdcd9edf82 Mon Sep 17 00:00:00 2001 From: Trent V Date: Fri, 8 Mar 2024 12:48:48 -0600 Subject: [PATCH 52/54] Warn users that Rancher in Docker isn't supported (#1166) * Warn users that Rancher in Docker isn't supported Added a large Caution banner to the main Rancher in Docker page warning users that using the Rancher in docker method is not supported for production installs. * revised language to rancher in docker caution message Co-authored-by: Marty Hernandez Avedon * updated caution message for all versions of rancher Signed-off-by: Trenton VanderWert --------- Signed-off-by: Trenton VanderWert Co-authored-by: Marty Hernandez Avedon --- .../rancher-on-a-single-node-with-docker.md | 6 ++++++ .../rancher-on-a-single-node-with-docker.md | 6 ++++++ .../rancher-on-a-single-node-with-docker.md | 6 ++++++ .../rancher-on-a-single-node-with-docker.md | 6 ++++++ .../rancher-on-a-single-node-with-docker.md | 6 ++++++ .../rancher-on-a-single-node-with-docker.md | 6 ++++++ 6 files changed, 36 insertions(+) diff --git a/docs/getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker/rancher-on-a-single-node-with-docker.md b/docs/getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker/rancher-on-a-single-node-with-docker.md index 526b43b682c..9e5a5333e06 100644 --- a/docs/getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker/rancher-on-a-single-node-with-docker.md +++ b/docs/getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker/rancher-on-a-single-node-with-docker.md @@ -3,6 +3,12 @@ title: Installing Rancher on a Single Node Using Docker description: For development and testing environments only, use a Docker install. Install Docker on a single Linux host, and deploy Rancher with a single Docker container. --- +:::caution + +Docker installs are not supported in production environments. These instructions are provided for testing and development purposes only. Please don't use this method to install Rancher in production environments. + +::: + diff --git a/versioned_docs/version-2.0-2.4/getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker/rancher-on-a-single-node-with-docker.md b/versioned_docs/version-2.0-2.4/getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker/rancher-on-a-single-node-with-docker.md index 34350b4fef1..30e65741813 100644 --- a/versioned_docs/version-2.0-2.4/getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker/rancher-on-a-single-node-with-docker.md +++ b/versioned_docs/version-2.0-2.4/getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker/rancher-on-a-single-node-with-docker.md @@ -3,6 +3,12 @@ title: Installing Rancher on a Single Node Using Docker description: For development and testing environments only, use a Docker install. Install Docker on a single Linux host, and deploy Rancher with a single Docker container. --- +:::caution + +Docker installs are not supported in production environments. These instructions are provided for testing and development purposes only. Please don't use this method to install Rancher in production environments. + +::: + diff --git a/versioned_docs/version-2.5/getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker/rancher-on-a-single-node-with-docker.md b/versioned_docs/version-2.5/getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker/rancher-on-a-single-node-with-docker.md index 9876d863eb9..da5c32aef57 100644 --- a/versioned_docs/version-2.5/getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker/rancher-on-a-single-node-with-docker.md +++ b/versioned_docs/version-2.5/getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker/rancher-on-a-single-node-with-docker.md @@ -3,6 +3,12 @@ title: Installing Rancher on a Single Node Using Docker description: For development and testing environments only, use a Docker install. Install Docker on a single Linux host, and deploy Rancher with a single Docker container. --- +:::caution + +Docker installs are not supported in production environments. These instructions are provided for testing and development purposes only. Please don't use this method to install Rancher in production environments. + +::: + diff --git a/versioned_docs/version-2.6/getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker/rancher-on-a-single-node-with-docker.md b/versioned_docs/version-2.6/getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker/rancher-on-a-single-node-with-docker.md index 526b43b682c..9e5a5333e06 100644 --- a/versioned_docs/version-2.6/getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker/rancher-on-a-single-node-with-docker.md +++ b/versioned_docs/version-2.6/getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker/rancher-on-a-single-node-with-docker.md @@ -3,6 +3,12 @@ title: Installing Rancher on a Single Node Using Docker description: For development and testing environments only, use a Docker install. Install Docker on a single Linux host, and deploy Rancher with a single Docker container. --- +:::caution + +Docker installs are not supported in production environments. These instructions are provided for testing and development purposes only. Please don't use this method to install Rancher in production environments. + +::: + diff --git a/versioned_docs/version-2.7/getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker/rancher-on-a-single-node-with-docker.md b/versioned_docs/version-2.7/getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker/rancher-on-a-single-node-with-docker.md index 526b43b682c..9e5a5333e06 100644 --- a/versioned_docs/version-2.7/getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker/rancher-on-a-single-node-with-docker.md +++ b/versioned_docs/version-2.7/getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker/rancher-on-a-single-node-with-docker.md @@ -3,6 +3,12 @@ title: Installing Rancher on a Single Node Using Docker description: For development and testing environments only, use a Docker install. Install Docker on a single Linux host, and deploy Rancher with a single Docker container. --- +:::caution + +Docker installs are not supported in production environments. These instructions are provided for testing and development purposes only. Please don't use this method to install Rancher in production environments. + +::: + diff --git a/versioned_docs/version-2.8/getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker/rancher-on-a-single-node-with-docker.md b/versioned_docs/version-2.8/getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker/rancher-on-a-single-node-with-docker.md index 526b43b682c..9e5a5333e06 100644 --- a/versioned_docs/version-2.8/getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker/rancher-on-a-single-node-with-docker.md +++ b/versioned_docs/version-2.8/getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker/rancher-on-a-single-node-with-docker.md @@ -3,6 +3,12 @@ title: Installing Rancher on a Single Node Using Docker description: For development and testing environments only, use a Docker install. Install Docker on a single Linux host, and deploy Rancher with a single Docker container. --- +:::caution + +Docker installs are not supported in production environments. These instructions are provided for testing and development purposes only. Please don't use this method to install Rancher in production environments. + +::: + From 1f6a00bef3384cb1d98399d9a66d71dfb69c8b1c Mon Sep 17 00:00:00 2001 From: Marty Hernandez Avedon Date: Fri, 8 Mar 2024 15:47:36 -0500 Subject: [PATCH 53/54] Added redirects for AWS PAYG integration (#1168) * added redirects for aws payg * azure and aws redirects added * typos, rm'ing unnneeded redirects * Update docusaurus.config.js Co-authored-by: Lucas Saintarbor * Update docusaurus.config.js Co-authored-by: Lucas Saintarbor * Update docusaurus.config.js --------- Co-authored-by: Lucas Saintarbor --- docusaurus.config.js | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/docusaurus.config.js b/docusaurus.config.js index 215a647d839..b75e5b9676f 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -1325,6 +1325,14 @@ module.exports = { to: '/v2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-provisioning-drivers', from: '/v2.7/pages-for-subheaders/about-provisioning-drivers' }, + { + to: '/v2.7/integrations-in-rancher/cloud-marketplace/aws-marketplace-payg-integration', + from: '/v2.7/pages-for-subheaders/aws-marketplace-payg-integration' + }, // Redirect for aws pages-for-subheader removal + { + to: '/v2.7/integrations-in-rancher/cloud-marketplace/azure-marketplace-payg-integration', + from: '/v2.7/pages-for-subheaders/azure-marketplace-payg-integration' + }, // Redirect for azure pages-for-subheader removal { to: '/v2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates', from: '/v2.7/pages-for-subheaders/about-rke1-templates' From ef19e6525d0abacb1d7241bf9fe64fd24a814421 Mon Sep 17 00:00:00 2001 From: Marty Hernandez Avedon Date: Mon, 11 Mar 2024 10:15:29 -0400 Subject: [PATCH 54/54] #1153 update rancher kubernetes api project creation workflow doc to include annotation requirement for cluster member (#1167) * Update Rancher Kubernetes API Project creation workflow doc to include annotation requirement for Cluster Member * revised note * revised wording --- docs/api/workflows/projects.md | 20 +++++++++++++++++++ .../version-2.8/api/workflows/projects.md | 20 +++++++++++++++++++ 2 files changed, 40 insertions(+) diff --git a/docs/api/workflows/projects.md b/docs/api/workflows/projects.md index 549ceff5423..ea4b6fe66f3 100644 --- a/docs/api/workflows/projects.md +++ b/docs/api/workflows/projects.md @@ -29,6 +29,26 @@ Use `metadata.generateName` to ensure a unique project ID, but note that `kubect Set `metadata.namespace` and `spec.clusterName` to the ID for the cluster the project belongs to. +If you create a project through a cluster member account, you must include the annotation, `field.cattle.io/creatorId`, and set it to the cluster member account's user ID. + +```bash +kubectl create -f - <