diff --git a/content/rancher/v2.x/en/installation/air-gap/_index.md b/content/rancher/v2.x/en/installation/air-gap/_index.md index e4b72412447..49042ba5460 100644 --- a/content/rancher/v2.x/en/installation/air-gap/_index.md +++ b/content/rancher/v2.x/en/installation/air-gap/_index.md @@ -18,7 +18,7 @@ This section is about installations of Rancher server in an air gapped environme Rancher supports air gap installs using a private registry. You must have your own private registry or other means of distributing Docker images to your machines. If you need help with creating a private registry, please refer to the [Docker documentation](https://docs.docker.com/registry/). {{% tabs %}} -{{% tab "HA Install" %}} +{{% tab "For HA Install Only" %}} The following CLI tools are required for the HA install. Make sure these tools are installed on your workstation and available in your `$PATH`. diff --git a/content/rancher/v2.x/en/overview/_index.md b/content/rancher/v2.x/en/overview/_index.md index 8b0bb3e0bb9..5faff7de3f2 100644 --- a/content/rancher/v2.x/en/overview/_index.md +++ b/content/rancher/v2.x/en/overview/_index.md @@ -4,11 +4,11 @@ weight: 1 --- Rancher is a container management platform built for organizations that deploy containers in production. Rancher makes it easy to run Kubernetes everywhere, meet IT requirements, and empower DevOps teams. -## Run Kubernetes Everywhere +# Run Kubernetes Everywhere Kubernetes has become the container orchestration standard. Most cloud and virtualization vendors now offer it as standard infrastructure. Rancher users have the choice of creating Kubernetes clusters with Rancher Kubernetes Engine (RKE) or cloud Kubernetes services, such as GKE, AKS, and EKS. Rancher users can also import and manage their existing Kubernetes clusters created using any Kubernetes distribution or installer. -## Meet IT requirements +# Meet IT requirements Rancher supports centralized authentication, access control, and monitoring for all Kubernetes clusters under its control. For example, you can: @@ -16,7 +16,7 @@ Rancher supports centralized authentication, access control, and monitoring for - Setup and enforce access control and security policies across all users, groups, projects, clusters, and clouds. - View the health and capacity of your Kubernetes clusters from a single-pane-of-glass. -## Empower DevOps Teams +# Empower DevOps Teams Rancher provides an intuitive user interface for DevOps engineers to manage their application workload. The user does not need to have in-depth knowledge of Kubernetes concepts to start using Rancher. Rancher catalog contains a set of useful DevOps tools. Rancher is certified with a wide selection of cloud native ecosystem products, including, for example, security tools, monitoring systems, container registries, and storage and networking drivers. @@ -24,19 +24,47 @@ The following figure illustrates the role Rancher plays in IT and DevOps organiz ![Platform]({{< baseurl >}}/img/rancher/platform.png) -## Features of the Rancher API Server +# Features of the Rancher API Server The Rancher API server is built on top of an embedded Kubernetes API server and an etcd database. It implements the following functionalities: +### Authorization and Role-Based Access Control + - **User management:** The Rancher API server [manages user identities]({{}}/rancher/v2.x/en/admin-settings/authentication/) that correspond to external authentication providers like Active Directory or GitHub, in addition to local users. - **Authorization:** The Rancher API server manages [access control]({{}}/rancher/v2.x/en/admin-settings/rbac/) and [security]({{}}/rancher/v2.x/en/admin-settings/pod-security-policies/) policies. -- **Managing projects:** A project is a group of multiple namespaces and access control policies within a cluster. A project is a Rancher concept, not a Kubernetes concept, and it allows you manage multiple namespaces as a group. The Rancher UI provides features for [project administration]({{}}/rancher/v2.x/en/project-admin/) and for [managing applications within projects.]({{}}/rancher/v2.x/en/k8s-in-rancher/) + +### Working with Kubernetes Applications + +- **Provisioning Kubernetes clusters:** The Rancher API server can [provision Kubernetes]({{}}/rancher/v2.x/en/cluster-provisioning/) on existing nodes, or perform [Kubernetes upgrades.]({{}}/rancher/v2.x/en/cluster-admin/editing-clusters/#upgrading-kubernetes) +- **Managing projects:** A project is a group of multiple namespaces and access control policies within a cluster. A project is a Rancher concept, not a Kubernetes concept, which allows you manage multiple namespaces as a group and perform Kubernetes operations in them. The Rancher UI provides features for [project administration]({{}}/rancher/v2.x/en/project-admin/) and for [managing applications within projects.]({{}}/rancher/v2.x/en/k8s-in-rancher/) +- **Pipelines:** Setting up a [pipeline]({{}}/rancher/v2.x/en/project-admin/tools/pipelines/) can help developers deliver new software as quickly and efficiently as possible. Within Rancher, you can configure pipelines for each of your Rancher projects. + +### Working with Cloud Infrastructure + - **Tracking nodes:** The Rancher API server tracks identities of all the [nodes]({{}}/rancher/v2.x/en/cluster-admin/nodes/) in all clusters. -- **Provisioning Kubernetes clusters:** The Rancher API server can [provision Kubernetes]({{}}/rancher/v2.x/en/cluster-provisioning/) on existing nodes, [import existing Kubernetes clusters]({{}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/) into Rancher, or perform [Kubernetes upgrades.]({{}}/rancher/v2.x/en/cluster-admin/editing-clusters/#upgrading-kubernetes) - **Setting up infrastructure:** When configured to use a cloud provider, Rancher can dynamically provision [new nodes]({{}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/) and [persistent storage]({{}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/) in the cloud. + +### Catalogs + - **Catalog management:** Rancher provides the ability to use a [catalog of Helm charts]({{}}/rancher/v2.x/en/catalog/) that make it easy to repeatedly deploy applications. + +### Cluster Visibility + - **Logging:** Rancher can integrate with a variety of popular logging services and tools that exist outside of your Kubernetes clusters. Logging can be set up [at the cluster level]({{}}/rancher/v2.x/en/cluster-admin/tools/logging/) or [at the project level.]({{}}/rancher/v2.x/en/project-admin/tools/logging/) - **Monitoring:** Using Rancher, you can monitor the state and processes of your cluster nodes, Kubernetes components, and software deployments through integration with Prometheus, a leading open-source monitoring solution. Monitoring can be configured [at the cluster level]({{}}/rancher/v2.x/en/cluster-admin/tools/monitoring/) or [at the project level.]({{}}/rancher/v2.x/en/project-admin/tools/monitoring/) - **Alerting:** To keep your clusters and applications healthy and driving your organizational productivity forward, you need to stay informed of events occurring in your clusters and projects, both planned and unplanned. To help you stay informed of these events, you can configure alerts [at the cluster level]({{}}/rancher/v2.x/en/cluster-admin/tools/alerts/) or [at the project level.]({{}}/rancher/v2.x/en/project-admin/tools/alerts/) -- **Pipelines:** Setting up a [pipeline]({{}}/rancher/v2.x/en/project-admin/tools/pipelines/) can help developers deliver new software as quickly and efficiently as possible. Within Rancher, you can configure pipelines for each of your Rancher projects. -- **Istio:** Our [integration with Istio]({{}}/rancher/v2.x/en/cluster-admin/tools/istio/) is designed so that a Rancher operator, such as an administrator or cluster owner, can deliver Istio to developers. Then developers can use Istio to enforce security policies, troubleshoot problems, or manage traffic for green/blue deployments, canary deployments, or A/B testing. \ No newline at end of file +- **Istio:** Our [integration with Istio]({{}}/rancher/v2.x/en/cluster-admin/tools/istio/) is designed so that a Rancher operator, such as an administrator or cluster owner, can deliver Istio to developers. Then developers can use Istio to enforce security policies, troubleshoot problems, or manage traffic for green/blue deployments, canary deployments, or A/B testing. + +# Editing Downstream Clusters with Rancher + +The options and settings available for an existing cluster change based on the method that you used to provision it. For example, only clusters [provisioned by RKE]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) have **Cluster Options** available for editing. + +After a cluster is created with Rancher, a cluster administrator can manage cluster membership, enable pod security policies, and manage node pools, among [other options.]({{}}/rancher/v2.x/en/cluster-admin/editing-clusters/) + +The following table shows an overview of the options and settings available for each cluster type: + + Cluster Type | Member Roles | Cluster Options | Node Pools +---------|----------|---------|---------| + [RKE-Launched]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/#rancher-launched-kubernetes) | ✓ | ✓ | ✓ | + [Hosted Kubernetes Cluster]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/#hosted-kubernetes-cluster) | ✓ | | | + [Imported]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/#import-existing-cluster) | ✓ | | | \ No newline at end of file diff --git a/content/rancher/v2.x/en/overview/architecture-recommendations/_index.md b/content/rancher/v2.x/en/overview/architecture-recommendations/_index.md index 1ae162a6ddf..11a1494bb7c 100644 --- a/content/rancher/v2.x/en/overview/architecture-recommendations/_index.md +++ b/content/rancher/v2.x/en/overview/architecture-recommendations/_index.md @@ -30,13 +30,12 @@ In HA installations of Rancher, the Rancher server cluster should also be separa We recommend installing the Rancher server on a three-node Kubernetes cluster for production, primarily because it protects the data stored on etcd. The Rancher server stores its data in etcd in both single-node and HA installations. -When Rancher is installed on a single node, if the node goes down, there is no copy of the etcd data available on other nodes and you will lose all the data of your Rancher server. +When Rancher is installed on a single node, if the node goes down, there is no copy of the etcd data available on other nodes and you could lose the data on your Rancher server. By contrast, in the high-availability installation, - The etcd data is replicated on three nodes in the cluster, providing redundancy and data duplication in case one of the nodes fails. -- A load balancer serves as the single point of contact for clients, distributing network traffic across multiple servers in the cluster and helping to prevent any one server from becoming a point of failure. -- When one application server fails or becomes unavailable, the load balancer directs traffic to available servers using an algorithm. For example, the least connection method directs traffic to the service with the fewest active connections. The least connection method is indicated with the `least_conn` option in this [example]({{}}/rancher/v2.x/en/installation/ha/create-nodes-lb/nginx/) of how to configure an NGINX server as a basic layer 4 load balancer (TCP). The load balancer handles traffic so that each server can receive a manageable load. +- A load balancer serves as the single point of contact for clients, distributing network traffic across multiple servers in the cluster and helping to prevent any one server from becoming a point of failure. Note: This [example]({{}}/rancher/v2.x/en/installation/ha/create-nodes-lb/nginx/) of how to configure an NGINX server as a basic layer 4 load balancer (TCP). # Recommended Load Balancer Configuration for HA Installations diff --git a/static/img/rancher/rancher-architecture-cluster-controller.svg b/static/img/rancher/rancher-architecture-cluster-controller.svg index ce9fb2958f6..922cc572ef9 100644 --- a/static/img/rancher/rancher-architecture-cluster-controller.svg +++ b/static/img/rancher/rancher-architecture-cluster-controller.svg @@ -1,3 +1,3 @@ -
User Cluster 1
<font style="font-size: 20px">User Cluster 1</font>
kubectl get pods
[Not supported by viewer]
kube-api-auth
[Not supported by viewer]
Bob
[Not supported by viewer]
Alice
Alice
Kubelet
[Not supported by viewer]
Node Agent
[Not supported by viewer]
etcd Node
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node Agent
[Not supported by viewer]
etcd Node
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node Agent
[Not supported by viewer]
etcd Node
[Not supported by viewer]
4
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node Agent
[Not supported by viewer]
Worker Node
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node Agent
[Not supported by viewer]
Controlplane
Node
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node Agent
[Not supported by viewer]
Controlplane
Node
[Not supported by viewer]
Kubernetes API Server
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node Agent
[Not supported by viewer]
Worker Node
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node Agent
[Not supported by viewer]
Worker Node
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node Agent
[Not supported by viewer]
Worker Node
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node Agent
[Not supported by viewer]
Worker Node
[Not supported by viewer]
kubectl get pods
[Not supported by viewer]
Cluster Agent
[Not supported by viewer]
1
[Not supported by viewer]
Rancher Server
<font style="font-size: 20px">Rancher Server<br></font>
Cluster Controller 1
[Not supported by viewer]
Cluster Controller 2
[Not supported by viewer]
Cluster Controller 3
[Not supported by viewer]
2
[Not supported by viewer]
3
[Not supported by viewer]
Tunnel
Tunnel
Tunnel
Tunnel
Tunnel
Tunnel
Tunnel
Tunnel
User Cluster 2
[Not supported by viewer]
User Cluster 3
[Not supported by viewer]
Authentication Proxy
[Not supported by viewer]
Kubernetes provisioned
by Rancher Kubernetes
Engine
[Not supported by viewer]
\ No newline at end of file +
User Cluster 1
<font style="font-size: 20px">User Cluster 1</font>
kubectl get pods
[Not supported by viewer]
kube-api-auth
[Not supported by viewer]
Bob
[Not supported by viewer]
Alice
Alice
Kubelet
[Not supported by viewer]
Node Agent
[Not supported by viewer]
etcd Node
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node Agent
[Not supported by viewer]
etcd Node
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node Agent
[Not supported by viewer]
etcd Node
[Not supported by viewer]
4
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node Agent
[Not supported by viewer]
Worker Node
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node Agent
[Not supported by viewer]
Controlplane
Node
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node Agent
[Not supported by viewer]
Controlplane
Node
[Not supported by viewer]
Kubernetes API Server
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node Agent
[Not supported by viewer]
Worker Node
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node Agent
[Not supported by viewer]
Worker Node
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node Agent
[Not supported by viewer]
Worker Node
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node Agent
[Not supported by viewer]
Worker Node
[Not supported by viewer]
kubectl get pods
[Not supported by viewer]
Cluster Agent
[Not supported by viewer]
1
[Not supported by viewer]
Rancher Server
<font style="font-size: 20px">Rancher Server<br></font>
Cluster Controller 1
[Not supported by viewer]
Cluster Controller 2
[Not supported by viewer]
Cluster Controller 3
[Not supported by viewer]
2
[Not supported by viewer]
3
[Not supported by viewer]
Tunnel
Tunnel
Tunnel
Tunnel
Tunnel
Tunnel
Tunnel
Tunnel
User Cluster 2
[Not supported by viewer]
User Cluster 2
[Not supported by viewer]
Authentication Proxy
[Not supported by viewer]
Kubernetes provisioned
by Rancher Kubernetes
Engine
[Not supported by viewer]
\ No newline at end of file diff --git a/static/img/rancher/rancher-architecture-node-roles.svg b/static/img/rancher/rancher-architecture-node-roles.svg index a4ecef73357..b96c56d1d2c 100644 --- a/static/img/rancher/rancher-architecture-node-roles.svg +++ b/static/img/rancher/rancher-architecture-node-roles.svg @@ -1,3 +1,3 @@ -
Roles for Nodes in a High-Availability Rancher Server Cluster
<font style="font-size: 16px">Roles for Nodes in a High-Availability Rancher Server Cluster<br></font>
Roles for Nodes in a Downstream User Cluster
<font style="font-size: 16px">Roles for Nodes in a Downstream User Cluster<br></font>
Kubernetes Master
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node with etcd, worker, and controlplane roles
[Not supported by viewer]
Node with etcd, worker, and controlplane roles
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node with etcd, worker, and controlplane roles
[Not supported by viewer]
Note: A kubelet is an agent that runs on each node in the cluster. It makes sure that containers are running in a pod.
Note: A kubelet is an agent that runs on each node in the cluster. It makes sure that containers are running in a pod.
Kubernetes Master
[Not supported by viewer]
etcd Nodes
etcd Nodes
Kubelet
[Not supported by viewer]
etcd Nodes
etcd Nodes
Kubelet
[Not supported by viewer]
Node with etcd role
Node with etcd role
Kubelet
[Not supported by viewer]
etcd Nodes
etcd Nodes
Kubelet
[Not supported by viewer]
Node with controlplane role
Node with controlplane role
Kubelet
[Not supported by viewer]
Node with worker role
Node with worker role
Kubelet
[Not supported by viewer]
Node with worker role
Node with worker role
Kubelet
[Not supported by viewer]
Node with worker role
Node with worker role
Kubelet
[Not supported by viewer]
Node with worker role
Node with worker role
Kubelet
[Not supported by viewer]
Node with worker role
Node with worker role
Kubelet
[Not supported by viewer]
\ No newline at end of file +
Roles for Nodes in a High-Availability Rancher Server Cluster
<font style="font-size: 16px">Roles for Nodes in a High-Availability Rancher Server Cluster<br></font>
Roles for Nodes in a Downstream User Cluster
<font style="font-size: 16px">Roles for Nodes in a Downstream User Cluster<br></font>
Kubernetes Master
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node with etcd, worker, and controlplane roles
[Not supported by viewer]
Node with etcd, worker, and controlplane roles
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node with etcd, worker, and controlplane roles
[Not supported by viewer]
etcd Nodes
etcd Nodes
Kubelet
[Not supported by viewer]
etcd Nodes
etcd Nodes
Kubelet
[Not supported by viewer]
Node with etcd role
Node with etcd role
Kubelet
[Not supported by viewer]
etcd Nodes
etcd Nodes
Kubelet
[Not supported by viewer]
Node with controlplane role
Node with controlplane role
Kubelet
[Not supported by viewer]
Note: A kubelet is an agent that runs on each node in the cluster. It makes sure that containers are running in a pod.
Note: A kubelet is an agent that runs on each node in the cluster. It makes sure that containers are running in a pod.
Node with worker role
Node with worker role
Kubelet
[Not supported by viewer]
Node with worker role
Node with worker role
Kubelet
[Not supported by viewer]
Node with worker role
Node with worker role
Kubelet
[Not supported by viewer]
Node with worker role
Node with worker role
Kubelet
[Not supported by viewer]
Node with worker role
Node with worker role
Kubelet
[Not supported by viewer]
Kubernetes Master
[Not supported by viewer]
\ No newline at end of file diff --git a/static/img/rancher/rancher-architecture-rancher-api-server.svg b/static/img/rancher/rancher-architecture-rancher-api-server.svg index 1b89e28d84a..0433bbcd803 100644 --- a/static/img/rancher/rancher-architecture-rancher-api-server.svg +++ b/static/img/rancher/rancher-architecture-rancher-api-server.svg @@ -1,3 +1,3 @@ -
Rancher UI,
CLI, or API
[Not supported by viewer]
kubectl,
Kubernetes
API
[Not supported by viewer]
RKE Nodes
[Not supported by viewer]
Amazon
EKS Nodes
[Not supported by viewer]
RKE
Kubernetes API Server
[Not supported by viewer]
Cluster Agent 1
[Not supported by viewer]
Cluster Agent 2
[Not supported by viewer]
Cluster Controller 1
[Not supported by viewer]
Rancher API
Server
[Not supported by viewer]
Authentication Proxy
[Not supported by viewer]
Rancher Server
<font style="font-size: 20px">Rancher Server<br></font>
etcd
[Not supported by viewer]
Rancher Server
Data Store
[Not supported by viewer]
EKS
Kubernetes API Server
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node
[Not supported by viewer]
Cluster Controller 2
[Not supported by viewer]
Downstream User
Cluster 1
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node
[Not supported by viewer]
Downstream User
Cluster 2
[Not supported by viewer]
Rancher User
Rancher User
Kubernetes provisioned
by Rancher Kubernetes
Engine
[Not supported by viewer]
Kubernetes provisioned
by Amazon Elastic
Kubernetes Service
[Not supported by viewer]
\ No newline at end of file +
Rancher UI,
CLI, or API
[Not supported by viewer]
kubectl,
Kubernetes
API
[Not supported by viewer]
RKE Nodes
[Not supported by viewer]
Amazon
EKS Nodes
[Not supported by viewer]
RKE
Kubernetes API Server
[Not supported by viewer]
Cluster Agent 1
[Not supported by viewer]
Cluster Agent 2
[Not supported by viewer]
Cluster Controller 1
[Not supported by viewer]
Rancher API
Server
[Not supported by viewer]
Authentication Proxy
[Not supported by viewer]
Rancher Server
<font style="font-size: 20px">Rancher Server<br></font>
etcd
[Not supported by viewer]
Rancher Server
Data Store
[Not supported by viewer]
EKS
Control Plane
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node
[Not supported by viewer]
Cluster Controller 2
[Not supported by viewer]
Downstream User
Cluster 1
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node
[Not supported by viewer]
Kubelet
[Not supported by viewer]
Node
[Not supported by viewer]
Downstream User
Cluster 2
[Not supported by viewer]
Rancher User
Rancher User
Kubernetes provisioned
by Rancher Kubernetes
Engine
[Not supported by viewer]
Kubernetes provisioned
by Amazon Elastic
Kubernetes Service
[Not supported by viewer]
\ No newline at end of file