public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-26 13:08:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Make changes from #3372 (changes to v2.5 docs) to the v2.6 docs

Browse Source 
To see the authors of each change, look at the Git history
for the corresponding files in the v2.5 directory.
This commit is contained in:
Catherine Luse
2021-06-30 14:06:59 -07:00
parent 24ffd93eae
commit b441b5a2c9
9 changed files with 35 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/rancher/v2.6/en/admin-settings/rbac/default-custom-roles/_index.md
+10 -3
View File
@@ -9,6 +9,8 @@ Within Rancher, _roles_ determine what actions a user can make within a cluster
Note that _roles_ are different from _permissions_, which determine what clusters and projects you can access.
> It is possible for a custom role to enable privilege escalation. For details, see [this section.](#privilege-escalation)
This section covers the following topics:
- [Prerequisites](#prerequisites)
@@ -16,6 +18,7 @@ This section covers the following topics:
- [Creating a custom global role](#creating-a-custom-global-role)
- [Deleting a custom global role](#deleting-a-custom-global-role)
- [Assigning a custom global role to a group](#assigning-a-custom-global-role-to-a-group)
- [Privilege escalation](#privilege-escalation)
## Prerequisites
@@ -57,7 +60,7 @@ The steps to add custom roles differ depending on the version of Rancher.
1. Click **Create**.
## Creating a Custom Global Role
# Creating a Custom Global Role
### Creating a Custom Global Role that Copies Rules from an Existing Role
@@ -91,7 +94,7 @@ Custom global roles don't have to be based on existing roles. To create a custom
1. Click **Save.**
## Deleting a Custom Global Role
# Deleting a Custom Global Role
When deleting a custom global role, all global role bindings with this custom role are deleted.
@@ -105,7 +108,7 @@ To delete a custom global role,
2. On the **Global** tab, go to the custom global role that should be deleted and click **⋮ (…) > Delete.**
3. Click **Delete.**
## Assigning a Custom Global Role to a Group
# Assigning a Custom Global Role to a Group
If you have a group of individuals that need the same level of access in Rancher, it can save time to create a custom global role. When the role is assigned to a group, the users in the group have the appropriate level of access the first time they sign into Rancher.
@@ -129,3 +132,7 @@ To assign a custom global role to a group, follow these steps:
1. Click **Create.**
**Result:** The custom global role will take effect when the users in the group log into Rancher.
# Privilege Escalation
The `Configure Catalogs` custom permission is powerful and should be used with caution. When an admin assigns the `Configure Catalogs` permission to a standard user, it could result in privilege escalation in which the user could give themselves admin access to Rancher provisioned clusters. Anyone with this permission should be considered equivalent to an admin.
content/rancher/v2.6/en/faq/_index.md
+1 -1
View File
@@ -69,4 +69,4 @@ Our goal is to run any upstream Kubernetes clusters. Therefore, Rancher v2.x sho
**Are you going to integrate Longhorn?**
Yes. Longhorn was integrated into Rancher v2.5+.
Yes. Longhorn was integrated into Rancher v2.5+.
content/rancher/v2.6/en/installation/requirements/_index.md
+16 -8
View File
@@ -11,18 +11,26 @@ This page describes the software, hardware, and networking requirements for the
Make sure the node(s) for the Rancher server fulfill the following requirements:
- [Operating Systems and Container Runtime Requirements](#operating-systems-and-container-runtime-requirements)
- [RKE Specific Requirements](#rke-specific-requirements)
- [K3s Specific Requirements](#k3s-specific-requirements)
- [RancherD Specific Requirements](#rancherd-specific-requirements)
- [RKE2 Specific Requirements](#rke2-specific-requirements)
- [Installing Docker](#installing-docker)
- [Hardware Requirements](#hardware-requirements)
- [CPU and Memory](#cpu-and-memory)
- [RKE and Hosted Kubernetes](#rke-and-hosted-kubernetes)
- [K3s Kubernetes](#k3s-kubernetes)
- [RancherD](#rancherd)
- [RKE2](#rke2-kubernetes)
- [CPU and Memory for Rancher before v2.4.0](#cpu-and-memory-for-rancher-before-v2-4-0)
- [RKE2 Kubernetes](#rke2-kubernetes)
- [Docker](#docker)
- [Ingress](#ingress)
- [Ingress for RKE2](#ingress-for-rke2)
- [Ingress for EKS](#ingress-for-eks)
- [Disks](#disks)
- [Networking Requirements](#networking-requirements)
- [Node IP Addresses](#node-ip-addresses)
- [Port Requirements](#port-requirements)
- [RancherD on SELinux Enforcing CentOS 8 or RHEL 8 Nodes](#rancherd-on-selinux-enforcing-centos-8-or-rhel-8-nodes)
For a list of best practices that we recommend for running the Rancher server in production, refer to the [best practices section.]({{<baseurl>}}/rancher/v2.6/en/best-practices/deployment-types/)
@@ -42,7 +50,9 @@ All supported operating systems are 64-bit x86.
The `ntp` (Network Time Protocol) package should be installed. This prevents errors with certificate validation that can occur when the time is not synchronized between the client and server.
Some distributions of Linux may have default firewall rules that block communication with Helm. We recommend disabling firewalld. For Kubernetes 1.19, firewalld must be turned off.
Some distributions of Linux may have default firewall rules that block communication with Helm. We recommend disabling firewalld. For Kubernetes 1.19 and 1.20, firewalld must be turned off.
If you don't feel comfortable doing so you might check suggestions in the [respective issue](https://github.com/rancher/rancher/issues/28840). Some users were successful [creating a separate firewalld zone with a policy of ACCEPT for the Pod CIDR](https://github.com/rancher/rancher/issues/28840#issuecomment-787404822).
If you plan to run Rancher on ARM64, see [Running on ARM64 (Experimental).]({{<baseurl>}}/rancher/v2.6/en/installation/options/arm64-platform/)
@@ -97,8 +107,6 @@ These CPU and memory requirements apply to each host in the Kubernetes cluster w
These requirements apply to RKE Kubernetes clusters, as well as to hosted Kubernetes clusters such as EKS.
| Deployment Size | Clusters | Nodes | vCPUs | RAM |
| --------------- | ---------- | ------------ | -------| ------- |
| Small | Up to 150 | Up to 1500 | 2 | 8 GB |
@@ -107,7 +115,7 @@ These requirements apply to RKE Kubernetes clusters, as well as to hosted Kubern
| X-Large | Up to 1000 | Up to 10,000 | 16 | 64 GB |
| XX-Large | Up to 2000 | Up to 20,000 | 32 | 128 GB |
[Contact Rancher](https://rancher.com/contact/) for more than 2000 clusters and/or 20,000 nodes.
[Contact Rancher](https://rancher.com/contact/) for more than 2000 clusters and/or 20,000 nodes.
### K3s Kubernetes
@@ -121,7 +129,7 @@ These CPU and memory requirements apply to each host in a [K3s Kubernetes cluste
| X-Large | Up to 1000 | Up to 10,000 | 16 | 64 GB | 2 cores, 4 GB + 1000 IOPS |
| XX-Large | Up to 2000 | Up to 20,000 | 32 | 128 GB | 2 cores, 4 GB + 1000 IOPS |
[Contact Rancher](https://rancher.com/contact/) for more than 2000 clusters and/or 20,000 nodes.
[Contact Rancher](https://rancher.com/contact/) for more than 2000 clusters and/or 20,000 nodes.
### RancherD
@@ -187,7 +195,7 @@ To operate properly, Rancher requires a number of ports to be open on Rancher no
# RancherD on SELinux Enforcing CentOS 8 or RHEL 8 Nodes
Before installing Rancher on SELinux Enforcing CentOS 8 nodes or RHEL 8 nodes, you must install `container-selinux` and `iptables`:
Before installing Rancher on SELinux Enforcing CentOS 8 nodes or RHEL 8 nodes, you must install `container-selinux` and `iptables`:
```
sudo yum install iptables
content/rancher/v2.6/en/installation/requirements/ports/_index.md
+1 -1
View File
@@ -89,7 +89,7 @@ The following tables break down the port requirements for traffic between the Ra
| TCP | 6443 | Kubernetes apiserver |
| UDP | 8472 | Canal/Flannel VXLAN overlay networking |
| TCP | 9099 | Canal/Flannel livenessProbe/readinessProbe |
| TCP | 10250 | kubelet |
| TCP | 10250 | Metrics server communication with all nodes |
| TCP | 10254 | Ingress controller livenessProbe/readinessProbe |
The following tables break down the port requirements for inbound and outbound traffic:
content/rancher/v2.6/en/installation/requirements/ports/common-ports-table/index.md
+1 -1
View File
@@ -17,6 +17,6 @@ headless: true
| TCP | 9796 | Default port required by Monitoring to scrape metrics from Windows node-exporters |
| TCP | 6783 | Weave Port |
| UDP | 6783-6784 | Weave UDP Ports |
| TCP | 10250 | kubelet API |
| TCP | 10250 | Metrics server communication with all nodes API |
| TCP | 10254 | Ingress controller livenessProbe/readinessProbe |
| TCP/UDP | 30000-</br>32767 | NodePort port range |
content/rancher/v2.6/en/installation/resources/k8s-tutorials/ha-rke2/_index.md
+3 -2
View File
@@ -22,7 +22,7 @@ Rancher needs to be installed on a supported Kubernetes version. To find out whi
RKE2 server runs with embedded etcd so you will not need to set up an external datastore to run in HA mode.
1. On the first node, you should set up the configuration file with your own pre-shared secret as the token. The token argument can be set on startup.
On the first node, you should set up the configuration file with your own pre-shared secret as the token. The token argument can be set on startup.
If you do not specify a pre-shared secret, RKE2 will generate one and place it at /var/lib/rancher/rke2/server/node-token.
@@ -37,8 +37,9 @@ tls-san:
- another-kubernetes-domain.com
```
After that you need to run the install command and enable and start rke2:
```
curl -sfL https://get.rke2.io | sh -
curl -sfL https://get.rke2.io | INSTALL_RKE2_CHANNEL=v1.20 sh -
systemctl enable rke2-server.service
systemctl start rke2-server.service
```
content/rancher/v2.6/en/istio/resources/_index.md
+1 -1
View File
@@ -39,7 +39,7 @@ You can find more information about Istio configuration in the [official Istio d
To configure the resources allocated to an Istio component,
1. In the Rancher **Cluster Explorer**, navigate to your Istio installation in **Apps & Marketplace**
1. Click **Upgrade** to edit the base components via changes the values.yaml or add an [overlay file]({{<baseurl>}}/rancher/v2.6/en/istio/v2.5/configuration-reference/#overlay-file). For more information about editing the overlay file, see [this section.](./#editing-the-overlay-file)
1. Click **Upgrade** to edit the base components via changes to the values.yaml or add an [overlay file]({{<baseurl>}}/rancher/v2.6/en/istio/v2.5/configuration-reference/#overlay-file). For more information about editing the overlay file, see [this section.](./#editing-the-overlay-file)
1. Change the CPU or memory allocations, the nodes where each component will be scheduled to, or the node tolerations.
1. Click **Upgrade.** to rollout changes
content/rancher/v2.6/en/security/rancher-2.5/1.5-hardening-2.5/_index.md
+1 -1
View File
@@ -13,7 +13,7 @@ This hardening guide is intended to be used for RKE clusters and associated with
----------------|-----------------------|------------------
Rancher v2.5 | Benchmark v1.5 | Kubernetes 1.15
[Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.5/Rancher_Hardening_Guide_CIS_1.6.pdf)
[Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.5/Rancher_Hardening_Guide_CIS_1.5.pdf)
### Overview
content/rancher/v2.6/en/troubleshooting/networking/_index.md
+1 -1
View File
@@ -35,7 +35,7 @@ To test the overlay network, you can launch the following `DaemonSet` definition
tolerations:
- operator: Exists
containers:
- image: rancher/swiss-army-knife
- image: rancherlabs/swiss-army-knife
imagePullPolicy: Always
name: overlaytest
command: ["sh", "-c", "tail -f /dev/null"]