mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-25 12:38:05 +00:00
Merge branch 'rancher:main' into update-api-sidebar
This commit is contained in:
Sunil Singh
@@ -68,18 +68,24 @@ The following commands are available for use in Rancher CLI.
|
||||
| `catalog` | Performs operations on [catalogs](../../how-to-guides/new-user-guides/helm-charts-in-rancher/helm-charts-in-rancher.md). |
|
||||
| `clusters, [cluster]` | Performs operations on your [clusters](../../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/kubernetes-clusters-in-rancher-setup.md). |
|
||||
| `context` | Switches between Rancher [projects](../../how-to-guides/new-user-guides/manage-clusters/projects-and-namespaces.md). For an example, see [Project Selection](#project-selection). |
|
||||
| `globaldns` | Performs operations on global DNS providers and entries. |
|
||||
| `inspect [OPTIONS] [RESOURCEID RESOURCENAME]` | Displays details about [Kubernetes resources](https://kubernetes.io/docs/reference/kubectl/cheatsheet/#resource-types) or Rancher resources (i.e.: [projects](../../how-to-guides/new-user-guides/manage-clusters/projects-and-namespaces.md) and [workloads](../../how-to-guides/new-user-guides/kubernetes-resources-setup/workloads-and-pods/workloads-and-pods.md)). Specify resources by name or ID. |
|
||||
| `kubectl` |Runs [kubectl commands](https://kubernetes.io/docs/reference/kubectl/overview/#operations). |
|
||||
| `kubectl` | Runs [kubectl commands](https://kubernetes.io/docs/reference/kubectl/overview/#operations). |
|
||||
| `login, [l]` | Logs into a Rancher Server. For an example, see [CLI Authentication](#cli-authentication). |
|
||||
| `namespaces, [namespace]` |Performs operations on namespaces. |
|
||||
| `nodes, [node]` |Performs operations on nodes. |
|
||||
| `machines, [machine]` | Performs operations on machines. |
|
||||
| `multiclusterapps, [multiclusterapp mcapps mcapp]` | Performs operations with multi-cluster apps. |
|
||||
| `namespaces, [namespace]` | Performs operations on [namespaces](../../how-to-guides/new-user-guides/manage-namespaces.md). |
|
||||
| `nodes, [node]` | Performs operations on [nodes](../../how-to-guides/new-user-guides/manage-clusters/nodes-and-node-pools.md). |
|
||||
| `projects, [project]` | Performs operations on [projects](../../how-to-guides/new-user-guides/manage-clusters/projects-and-namespaces.md). |
|
||||
| `ps` | Displays [workloads](../../how-to-guides/new-user-guides/kubernetes-resources-setup/workloads-and-pods/workloads-and-pods.md) in a project. |
|
||||
| `server` | Performs operations for the server. |
|
||||
| `settings, [setting]` | Shows the current settings for your Rancher Server. |
|
||||
| `ssh` | Connects to one of your cluster nodes using the SSH protocol. |
|
||||
| `up` | Applies compose config. |
|
||||
| `wait` | Waits for resources cluster, app, project, multiClusterApp. |
|
||||
| `token` | Authenticates and generates new kubeconfig token. |
|
||||
| `help, [h]` | Shows a list of commands or help for one command. |
|
||||
|
||||
|
||||
### Rancher CLI Help
|
||||
|
||||
Once logged into Rancher Server using the CLI, enter `./rancher --help` for a list of commands.
|
||||
|
||||
+20
-1
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: EKS Cluster Configuration Reference | 2.6
|
||||
title: EKS Cluster Configuration Reference
|
||||
---
|
||||
|
||||
<head>
|
||||
@@ -147,6 +147,25 @@ The following settings are also configurable. All of these except for the "Node
|
||||
| Labels | Kubernetes labels applied to the nodes in the managed node group. |
|
||||
| Tags | These are tags for the managed node group and do not propagate to any of the associated resources. |
|
||||
|
||||
### Self-managed Amazon Linux Nodes
|
||||
|
||||
You can register an EKS cluster containing self-managed Amazon Linux nodes. You must configure this type of cluster according to the instructions in the official AWS documentation for [launching self-managed Amazon Linux nodes](https://docs.aws.amazon.com/eks/latest/userguide/launch-workers.html). EKS clusters containing self-managed Amazon Linux nodes are usually operated by the [Karpenter](https://karpenter.sh/docs/) project. After you provision an EKS cluster containing self-managed Amazon Linux nodes, [register the cluster](../../../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/register-existing-clusters.md) so it can be managed by Rancher. However, the nodes won't be visible in the Rancher UI.
|
||||
|
||||
### IAM Roles for Service Accounts
|
||||
|
||||
An Applications Deployment running on an EKS cluster can make requests to AWS services via IAM permissions. These applications must sign their requests with AWS credentials. IAM roles for service accounts manage these credentials using an AWS OIDC endpoint. Rather than distributing AWS credentials to containers or relying on an EC2 instance's role, you can link an [IAM role to a Kubernetes service account](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) and configure your Pods to use this account.
|
||||
|
||||
:::note
|
||||
|
||||
Linking to an IAM role is not supported for Rancher pods in an EKS cluster.
|
||||
|
||||
:::
|
||||
|
||||
To enable IAM roles for service accounts:
|
||||
1. [Create an IAM OIDC provider for your cluster](https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html)
|
||||
1. [Configure a Kubernetes service account to assume an IAM role](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html)
|
||||
1. [Configure Pods to use a Kubernetes service account](https://docs.aws.amazon.com/eks/latest/userguide/pod-configuration.html)
|
||||
1. [Use a supported AWS SDK](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-minimum-sdk.html)
|
||||
|
||||
### Configuring the Refresh Interval
|
||||
|
||||
|
||||
+1
-1
@@ -204,7 +204,7 @@ The node operating system image. For more information for the node image options
|
||||
|
||||
:::note
|
||||
|
||||
The default option is "Container-Optimized OS with Docker". The read-only filesystem on GCP's Container-Optimized OS is not compatible with the [legacy logging](/versioned_docs/version-2.0-2.4/pages-for-subheaders/cluster-logging.md) implementation in Rancher. If you need to use the legacy logging feature, select "Ubuntu with Docker" or "Ubuntu with Containerd". The [current logging feature](../../../../integrations-in-rancher/logging/logging.md) is compatible with the Container-Optimized OS image.
|
||||
The default option is "Container-Optimized OS with Docker". The read-only filesystem on GCP's Container-Optimized OS is not compatible with the [legacy logging](/versioned_docs/version-2.0-2.4/explanations/integrations-in-rancher/cluster-logging/cluster-logging.md) implementation in Rancher. If you need to use the legacy logging feature, select "Ubuntu with Docker" or "Ubuntu with Containerd". The [current logging feature](../../../../integrations-in-rancher/logging/logging.md) is compatible with the Container-Optimized OS image.
|
||||
|
||||
:::
|
||||
|
||||
|
||||
+2
@@ -78,6 +78,8 @@ Out of the box, Rancher is compatible with the following network providers:
|
||||
- [Calico](https://docs.projectcalico.org/v3.11/introduction/)
|
||||
- [Weave](https://github.com/weaveworks/weave)
|
||||
|
||||
<DeprecationWeave />
|
||||
|
||||
:::note Notes on Weave:
|
||||
|
||||
When Weave is selected as network provider, Rancher will automatically enable encryption by generating a random password. If you want to specify the password manually, please see how to configure your cluster using a [Config File](#rke-cluster-config-file-reference) and the [Weave Network Plug-in Options](https://rancher.com/docs/rke/latest/en/config-options/add-ons/network-plugins/#weave-network-plug-in-options).
|
||||
|
||||
@@ -24,8 +24,6 @@ This section assumes familiarity with how monitoring components work together. F
|
||||
|
||||
:::
|
||||
|
||||
To create notification receivers in the Rancher UI,
|
||||
|
||||
<Tabs>
|
||||
<TabItem value="Rancher v2.6.5+">
|
||||
|
||||
@@ -152,24 +150,20 @@ The Teams receiver is not a native receiver and must be enabled before it can be
|
||||
1. Select the **Teams** option and click **Install**.
|
||||
1. Take note of the namespace used as it will be required in a later step.
|
||||
|
||||
### Configure the Teams Receiver
|
||||
### Configuring the Teams Receiver
|
||||
|
||||
The Teams receiver can be configured by updating its ConfigMap. For example, the following is a minimal Teams receiver configuration.
|
||||
1. To configure the Teams receiver, update its ConfigMap. The following example is a minimal Teams receiver configuration:
|
||||
|
||||
```yaml
|
||||
[Microsoft Teams]
|
||||
teams-instance-1: https://your-teams-webhook-url
|
||||
```
|
||||
```yaml
|
||||
[Microsoft Teams]
|
||||
connector: https://your-teams-webhook-url
|
||||
```
|
||||
|
||||
When configuration is complete, add the receiver using the steps in [this section](#creating-receivers-in-the-rancher-ui).
|
||||
2. After you update the configuration, follow the instructions in [Creating Receivers in the Rancher UI](#creating-receivers-in-the-rancher-ui) to add the receiver. Use the example below to form your URL. Make sure to replace `<namespace>` with the namespace of the `rancher-alerting-drivers` app:
|
||||
|
||||
Use the example below as the URL where:
|
||||
|
||||
- `ns-1` is replaced with the namespace where the `rancher-alerting-drivers` app is installed
|
||||
|
||||
```yaml
|
||||
url: http://rancher-alerting-drivers-prom2teams.ns-1.svc:8089/v2/teams-instance-1
|
||||
```
|
||||
```yaml
|
||||
url: http://rancher-alerting-drivers-prom2teams.<namespace>.svc:8089/v2/connector
|
||||
```
|
||||
|
||||
<!-- https://github.com/idealista/prom2teams -->
|
||||
|
||||
@@ -187,7 +181,7 @@ The SMS receiver is not a native receiver and must be enabled before it can be u
|
||||
1. Select the **SMS** option and click **Install**.
|
||||
1. Take note of the namespace used as it will be required in a later step.
|
||||
|
||||
### Configure the SMS Receiver
|
||||
### Configuring the SMS Receiver
|
||||
|
||||
The SMS receiver can be configured by updating its ConfigMap. For example, the following is a minimal SMS receiver configuration.
|
||||
|
||||
|
||||
@@ -41,8 +41,11 @@ For more information, refer to the monitoring documentation [here.](../integrati
|
||||
Rancher's integration with Istio was improved in Rancher v2.5.
|
||||
|
||||
For more information, refer to the Istio documentation [here.](../integrations-in-rancher/istio/istio.md)
|
||||
|
||||
## OPA Gatekeeper
|
||||
|
||||
<DeprecationOPAGatekeeper link="../integrations-in-rancher/kubewarden" />
|
||||
|
||||
[OPA Gatekeeper](https://github.com/open-policy-agent/gatekeeper) is an open-source project that provides integration between OPA and Kubernetes to provide policy control via admission controller webhooks. For details on how to enable Gatekeeper in Rancher, refer to the [OPA Gatekeeper section.](../integrations-in-rancher/opa-gatekeeper.md)
|
||||
|
||||
## CIS Scans
|
||||
|
||||
@@ -10,6 +10,7 @@ Rancher is committed to informing the community of security issues in our produc
|
||||
|
||||
| ID | Description | Date | Resolution |
|
||||
|----|-------------|------|------------|
|
||||
| [CVE-2024-22030](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22030) | A vulnerability was discovered in Rancher's and Fleet's agents, currently deemed a medium to high severity CVE, that under very specific circumstances allows a malicious actor to take over existing Rancher nodes. The attacker would need to have control of an expired domain or execute a DNS spoofing/hijacking attack against the domain in order to exploit this vulnerability. The targeted domain is the one used as the Rancher URL (the server-url of the Rancher cluster). At the moment there is no fix available and it affects all supported versions of Rancher. Customers and users are advised to follow the recommendations and best practices described in our [blog post](https://www.suse.com/c/rancher-security-update/). | 16 Feb 2024 | Pending |
|
||||
| [CVE-2023-32193](https://github.com/rancher/norman/security/advisories/GHSA-r8f4-hv23-6qp6) | An issue was discovered in Rancher versions up to and including 2.6.13, 2.7.9 and 2.8.1, where multiple Cross-Site Scripting (XSS) vulnerabilities can be exploited via the Rancher UI (Norman). | 8 Feb 2024 | Rancher [v2.8.2](https://github.com/rancher/rancher/releases/tag/v2.8.2), [v2.7.10](https://github.com/rancher/rancher/releases/tag/v2.7.10) and [v2.6.14](https://github.com/rancher/rancher/releases/tag/v2.6.14) |
|
||||
| [CVE-2023-32192](https://github.com/rancher/apiserver/security/advisories/GHSA-833m-37f7-jq55) | An issue was discovered in Rancher versions up to and including 2.6.13, 2.7.9 and 2.8.1, where multiple Cross-Site Scripting (XSS) vulnerabilities can be exploited via the Rancher UI (Apiserver). | 8 Feb 2024 | Rancher [v2.8.2](https://github.com/rancher/rancher/releases/tag/v2.8.2), [v2.7.10](https://github.com/rancher/rancher/releases/tag/v2.7.10) and [v2.6.14](https://github.com/rancher/rancher/releases/tag/v2.6.14) |
|
||||
| [CVE-2023-22649](https://github.com/rancher/rancher/security/advisories/GHSA-xfj7-qf8w-2gcr) | An issue was discovered in Rancher versions up to and including 2.6.13, 2.7.9 and 2.8.1, in which sensitive data may be leaked into Rancher's audit logs. | 8 Feb 2024 | Rancher [v2.8.2](https://github.com/rancher/rancher/releases/tag/v2.8.2), [v2.7.10](https://github.com/rancher/rancher/releases/tag/v2.7.10) and [v2.6.14](https://github.com/rancher/rancher/releases/tag/v2.6.14) |
|
||||
|
||||
@@ -9,7 +9,7 @@ title: Rancher Webhook
|
||||
Rancher-Webhook is an essential component of Rancher that works in conjunction with Kubernetes to enhance security and enable critical features for Rancher-managed clusters.
|
||||
|
||||
It integrates with Kubernetes' extensible admission controllers, as described in the [Kubernetes documentation](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/), which allows Rancher-Webhook to inspect specific requests sent to the Kubernetes API server, and add custom, Rancher-specific validation and mutations to the requests that are specific to Rancher. Rancher-Webhook manages the resources to be validated using the `rancher.cattle.io` `ValidatingWebhookConfiguration` and the `rancher.cattle.io` `MutatingWebhookConfiguration`, and will override any manual edits.
|
||||
Rancher deploys Rancher-Webhook as a separate deployment and service in both local and downstream clusters. Rancher manages Rancher-Webhook using Helm. It's important to note that Rancher may override modifications made by users to the Helm release.
|
||||
Rancher deploys Rancher-Webhook as a separate deployment and service in both local and downstream clusters. Rancher manages Rancher-Webhook using Helm. It's important to note that Rancher may override modifications made by users to the Helm release. To safely modify these values see [Customizing Rancher-Webhook Configuration](#customizing-rancher-webhook-configuration).
|
||||
|
||||
Each Rancher version is designed to be compatible with a single version of the webhook. The compatible versions are provided below for convenience.
|
||||
|
||||
@@ -17,11 +17,11 @@ Each Rancher version is designed to be compatible with a single version of the w
|
||||
|
||||
<!-- releaseTask -->
|
||||
|
||||
| Rancher Version | Webhook Version |
|
||||
|-----------------|:---------------:|
|
||||
| v2.8.0 | v0.4.2 |
|
||||
| v2.8.1 | v0.4.2 |
|
||||
| v2.8.2 | v0.4.2 |
|
||||
| Rancher Version | Webhook Version | Availability in Prime | Availability in Community |
|
||||
|-----------------|-----------------|-----------------------|---------------------------|
|
||||
| v2.8.2 | v0.4.2 | ✓ | ✓ |
|
||||
| v2.8.1 | v0.4.2 | ✓ | ✓ |
|
||||
| v2.8.0 | v0.4.2 | ✗ | ✓ |
|
||||
|
||||
## Why Do We Need It?
|
||||
|
||||
@@ -49,20 +49,59 @@ To bypass the webhook, impersonate both the `rancher-webhook-sudo` service accou
|
||||
kubectl create -f example.yaml --as=system:serviceaccount:cattle-system:rancher-webhook-sudo --as-group=system:masters
|
||||
```
|
||||
|
||||
## Customizing Rancher-Webhook Configuration
|
||||
|
||||
You can add custom Helm values when you install Rancher-Webhook via Helm. During a Helm install of the Rancher-Webhook chart, Rancher checks for custom Helm values. These custom values must be defined in a ConfigMap named `rancher-config`, in the `cattle-system` namespace, under the data key, `rancher-webhook`. The value of this key must be valid YAML.
|
||||
``` yaml
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: rancher-config
|
||||
namespace: cattle-system
|
||||
labels:
|
||||
app.kubernetes.io/part-of: "rancher"
|
||||
data:
|
||||
rancher-webhook: '{"port": 9553, "priorityClassName": "system-node-critical"}'
|
||||
|
||||
```
|
||||
|
||||
Rancher redeploys the Rancher-Webhook chart when changes to the ConfigMap values are detected.
|
||||
|
||||
### Customizing Rancher-Webhook During Rancher Installation
|
||||
|
||||
When you use Helm to install the Rancher chart, you can add custom Helm values to the Rancher-Webhook of the local cluster. All values in the Rancher-Webhook chart are accessible as nested variables under the `webhook` name.
|
||||
These values are synced to the `rancher-config` ConfigMap during installation.
|
||||
|
||||
```bash
|
||||
helm install rancher rancher-<CHART_REPO>/rancher \
|
||||
--namespace cattle-system \
|
||||
...
|
||||
--set webhook.port=9553 \
|
||||
--set webhook.priorityClassName="system-node-critical"
|
||||
```
|
||||
|
||||
## Common Issues
|
||||
|
||||
### EKS Cluster with Calico CNI
|
||||
|
||||
Users running an EKS cluster with Calico CNI may run into errors when the Kubernetes API server attempts to contact the Rancher-Webhook.
|
||||
One workaround for this issue [documented by Calico](https://docs.tigera.io/calico/latest/getting-started/kubernetes/managed-public-cloud/eks#install-eks-with-calico-networking) involves setting `hostNetwork=true` for the webhook deployment. Users can change this using the Helm commands below on the affected clusters.
|
||||
One workaround for this issue, as [documented by Calico](https://docs.tigera.io/calico/latest/getting-started/kubernetes/managed-public-cloud/eks#install-eks-with-calico-networking) involves setting `hostNetwork=true` for the webhook deployment. You can change this value by adding the Helm value `global.hostNetwork=true` to the `rancher-config` ConfigMap. See [Customizing Rancher-Webhook Configuration](#customizing-rancher-webhook-configuration) for more info.
|
||||
|
||||
``` bash
|
||||
helm repo add rancher-charts https://charts.rancher.io
|
||||
helm upgrade --reuse-values rancher-webhook rancher-charts/rancher-webhook -n cattle-system --set global.hostNetwork=true
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: rancher-config
|
||||
namespace: cattle-system
|
||||
labels:
|
||||
app.kubernetes.io/part-of: "rancher"
|
||||
data:
|
||||
rancher-webhook: '{"global": {"hostNetwork": true}}'
|
||||
```
|
||||
|
||||
**Note:** This temporary workaround may violate an environment's security policy. This workaround also requires that port 9443 is unused on the host network.
|
||||
|
||||
**Note:** Helm uses secrets by default. This is a datatype that some webhook versions validate to store information. In these cases, directly update the deployment with the hostNetwork=true value using kubectl, then run the Helm commands listed above to prevent drift between the Helm configuration and the actual state of the cluster.
|
||||
**Note:** By default, Helm stores information as secrets. Secrets are a resource that some webhook versions validate. In these cases, directly update the deployment with the `hostNetwork=true` value using kubectl, then update the webhook configuration as specified above.
|
||||
|
||||
### Private GKE Cluster
|
||||
|
||||
|
||||
Reference in New Issue
Block a user