diff --git a/content/rancher/v2.6/en/admin-settings/rbac/default-custom-roles/_index.md b/content/rancher/v2.6/en/admin-settings/rbac/default-custom-roles/_index.md index 2836a39da80..b9b51dda0bd 100644 --- a/content/rancher/v2.6/en/admin-settings/rbac/default-custom-roles/_index.md +++ b/content/rancher/v2.6/en/admin-settings/rbac/default-custom-roles/_index.md @@ -9,6 +9,8 @@ Within Rancher, _roles_ determine what actions a user can make within a cluster Note that _roles_ are different from _permissions_, which determine what clusters and projects you can access. +> It is possible for a custom role to enable privilege escalation. For details, see [this section.](#privilege-escalation) + This section covers the following topics: - [Prerequisites](#prerequisites) @@ -16,6 +18,7 @@ This section covers the following topics: - [Creating a custom global role](#creating-a-custom-global-role) - [Deleting a custom global role](#deleting-a-custom-global-role) - [Assigning a custom global role to a group](#assigning-a-custom-global-role-to-a-group) +- [Privilege escalation](#privilege-escalation) ## Prerequisites @@ -57,7 +60,7 @@ The steps to add custom roles differ depending on the version of Rancher. 1. Click **Create**. -## Creating a Custom Global Role +# Creating a Custom Global Role ### Creating a Custom Global Role that Copies Rules from an Existing Role @@ -91,7 +94,7 @@ Custom global roles don't have to be based on existing roles. To create a custom 1. Click **Save.** -## Deleting a Custom Global Role +# Deleting a Custom Global Role When deleting a custom global role, all global role bindings with this custom role are deleted. @@ -105,7 +108,7 @@ To delete a custom global role, 2. On the **Global** tab, go to the custom global role that should be deleted and click **⋮ (…) > Delete.** 3. Click **Delete.** -## Assigning a Custom Global Role to a Group +# Assigning a Custom Global Role to a Group If you have a group of individuals that need the same level of access in Rancher, it can save time to create a custom global role. When the role is assigned to a group, the users in the group have the appropriate level of access the first time they sign into Rancher. @@ -129,3 +132,7 @@ To assign a custom global role to a group, follow these steps: 1. Click **Create.** **Result:** The custom global role will take effect when the users in the group log into Rancher. + +# Privilege Escalation + +The `Configure Catalogs` custom permission is powerful and should be used with caution. When an admin assigns the `Configure Catalogs` permission to a standard user, it could result in privilege escalation in which the user could give themselves admin access to Rancher provisioned clusters. Anyone with this permission should be considered equivalent to an admin. \ No newline at end of file diff --git a/content/rancher/v2.6/en/faq/_index.md b/content/rancher/v2.6/en/faq/_index.md index 08499b81aec..dc9d017ab5b 100644 --- a/content/rancher/v2.6/en/faq/_index.md +++ b/content/rancher/v2.6/en/faq/_index.md @@ -69,4 +69,4 @@ Our goal is to run any upstream Kubernetes clusters. Therefore, Rancher v2.x sho **Are you going to integrate Longhorn?** -Yes. Longhorn was integrated into Rancher v2.5+. \ No newline at end of file +Yes. Longhorn was integrated into Rancher v2.5+. diff --git a/content/rancher/v2.6/en/installation/requirements/_index.md b/content/rancher/v2.6/en/installation/requirements/_index.md index c54dcc8f771..a6c7e1cfcef 100644 --- a/content/rancher/v2.6/en/installation/requirements/_index.md +++ b/content/rancher/v2.6/en/installation/requirements/_index.md @@ -11,18 +11,26 @@ This page describes the software, hardware, and networking requirements for the Make sure the node(s) for the Rancher server fulfill the following requirements: - [Operating Systems and Container Runtime Requirements](#operating-systems-and-container-runtime-requirements) + - [RKE Specific Requirements](#rke-specific-requirements) + - [K3s Specific Requirements](#k3s-specific-requirements) + - [RancherD Specific Requirements](#rancherd-specific-requirements) + - [RKE2 Specific Requirements](#rke2-specific-requirements) + - [Installing Docker](#installing-docker) - [Hardware Requirements](#hardware-requirements) - [CPU and Memory](#cpu-and-memory) - [RKE and Hosted Kubernetes](#rke-and-hosted-kubernetes) - [K3s Kubernetes](#k3s-kubernetes) - [RancherD](#rancherd) - - [RKE2](#rke2-kubernetes) - - [CPU and Memory for Rancher before v2.4.0](#cpu-and-memory-for-rancher-before-v2-4-0) + - [RKE2 Kubernetes](#rke2-kubernetes) + - [Docker](#docker) - [Ingress](#ingress) + - [Ingress for RKE2](#ingress-for-rke2) + - [Ingress for EKS](#ingress-for-eks) - [Disks](#disks) - [Networking Requirements](#networking-requirements) - [Node IP Addresses](#node-ip-addresses) - [Port Requirements](#port-requirements) +- [RancherD on SELinux Enforcing CentOS 8 or RHEL 8 Nodes](#rancherd-on-selinux-enforcing-centos-8-or-rhel-8-nodes) For a list of best practices that we recommend for running the Rancher server in production, refer to the [best practices section.]({{}}/rancher/v2.6/en/best-practices/deployment-types/) @@ -42,7 +50,9 @@ All supported operating systems are 64-bit x86. The `ntp` (Network Time Protocol) package should be installed. This prevents errors with certificate validation that can occur when the time is not synchronized between the client and server. -Some distributions of Linux may have default firewall rules that block communication with Helm. We recommend disabling firewalld. For Kubernetes 1.19, firewalld must be turned off. +Some distributions of Linux may have default firewall rules that block communication with Helm. We recommend disabling firewalld. For Kubernetes 1.19 and 1.20, firewalld must be turned off. + +If you don't feel comfortable doing so you might check suggestions in the [respective issue](https://github.com/rancher/rancher/issues/28840). Some users were successful [creating a separate firewalld zone with a policy of ACCEPT for the Pod CIDR](https://github.com/rancher/rancher/issues/28840#issuecomment-787404822). If you plan to run Rancher on ARM64, see [Running on ARM64 (Experimental).]({{}}/rancher/v2.6/en/installation/options/arm64-platform/) @@ -97,8 +107,6 @@ These CPU and memory requirements apply to each host in the Kubernetes cluster w These requirements apply to RKE Kubernetes clusters, as well as to hosted Kubernetes clusters such as EKS. - - | Deployment Size | Clusters | Nodes | vCPUs | RAM | | --------------- | ---------- | ------------ | -------| ------- | | Small | Up to 150 | Up to 1500 | 2 | 8 GB | @@ -107,7 +115,7 @@ These requirements apply to RKE Kubernetes clusters, as well as to hosted Kubern | X-Large | Up to 1000 | Up to 10,000 | 16 | 64 GB | | XX-Large | Up to 2000 | Up to 20,000 | 32 | 128 GB | -[Contact Rancher](https://rancher.com/contact/) for more than 2000 clusters and/or 20,000 nodes. +[Contact Rancher](https://rancher.com/contact/) for more than 2000 clusters and/or 20,000 nodes. ### K3s Kubernetes @@ -121,7 +129,7 @@ These CPU and memory requirements apply to each host in a [K3s Kubernetes cluste | X-Large | Up to 1000 | Up to 10,000 | 16 | 64 GB | 2 cores, 4 GB + 1000 IOPS | | XX-Large | Up to 2000 | Up to 20,000 | 32 | 128 GB | 2 cores, 4 GB + 1000 IOPS | -[Contact Rancher](https://rancher.com/contact/) for more than 2000 clusters and/or 20,000 nodes. +[Contact Rancher](https://rancher.com/contact/) for more than 2000 clusters and/or 20,000 nodes. ### RancherD @@ -187,7 +195,7 @@ To operate properly, Rancher requires a number of ports to be open on Rancher no # RancherD on SELinux Enforcing CentOS 8 or RHEL 8 Nodes -Before installing Rancher on SELinux Enforcing CentOS 8 nodes or RHEL 8 nodes, you must install `container-selinux` and `iptables`: +Before installing Rancher on SELinux Enforcing CentOS 8 nodes or RHEL 8 nodes, you must install `container-selinux` and `iptables`: ``` sudo yum install iptables diff --git a/content/rancher/v2.6/en/installation/requirements/ports/_index.md b/content/rancher/v2.6/en/installation/requirements/ports/_index.md index c6a7695438f..325313f6dba 100644 --- a/content/rancher/v2.6/en/installation/requirements/ports/_index.md +++ b/content/rancher/v2.6/en/installation/requirements/ports/_index.md @@ -89,7 +89,7 @@ The following tables break down the port requirements for traffic between the Ra | TCP | 6443 | Kubernetes apiserver | | UDP | 8472 | Canal/Flannel VXLAN overlay networking | | TCP | 9099 | Canal/Flannel livenessProbe/readinessProbe | -| TCP | 10250 | kubelet | +| TCP | 10250 | Metrics server communication with all nodes | | TCP | 10254 | Ingress controller livenessProbe/readinessProbe | The following tables break down the port requirements for inbound and outbound traffic: diff --git a/content/rancher/v2.6/en/installation/requirements/ports/common-ports-table/index.md b/content/rancher/v2.6/en/installation/requirements/ports/common-ports-table/index.md index 86bb7177bbe..4819129eb27 100644 --- a/content/rancher/v2.6/en/installation/requirements/ports/common-ports-table/index.md +++ b/content/rancher/v2.6/en/installation/requirements/ports/common-ports-table/index.md @@ -17,6 +17,6 @@ headless: true | TCP | 9796 | Default port required by Monitoring to scrape metrics from Windows node-exporters | | TCP | 6783 | Weave Port | | UDP | 6783-6784 | Weave UDP Ports | -| TCP | 10250 | kubelet API | +| TCP | 10250 | Metrics server communication with all nodes API | | TCP | 10254 | Ingress controller livenessProbe/readinessProbe | | TCP/UDP | 30000-
32767 | NodePort port range | diff --git a/content/rancher/v2.6/en/installation/resources/k8s-tutorials/ha-rke2/_index.md b/content/rancher/v2.6/en/installation/resources/k8s-tutorials/ha-rke2/_index.md index f4549735775..f8a6b50bef5 100644 --- a/content/rancher/v2.6/en/installation/resources/k8s-tutorials/ha-rke2/_index.md +++ b/content/rancher/v2.6/en/installation/resources/k8s-tutorials/ha-rke2/_index.md @@ -22,7 +22,7 @@ Rancher needs to be installed on a supported Kubernetes version. To find out whi RKE2 server runs with embedded etcd so you will not need to set up an external datastore to run in HA mode. -1. On the first node, you should set up the configuration file with your own pre-shared secret as the token. The token argument can be set on startup. +On the first node, you should set up the configuration file with your own pre-shared secret as the token. The token argument can be set on startup. If you do not specify a pre-shared secret, RKE2 will generate one and place it at /var/lib/rancher/rke2/server/node-token. @@ -37,8 +37,9 @@ tls-san: - another-kubernetes-domain.com ``` After that you need to run the install command and enable and start rke2: + ``` -curl -sfL https://get.rke2.io | sh - +curl -sfL https://get.rke2.io | INSTALL_RKE2_CHANNEL=v1.20 sh - systemctl enable rke2-server.service systemctl start rke2-server.service ``` diff --git a/content/rancher/v2.6/en/istio/resources/_index.md b/content/rancher/v2.6/en/istio/resources/_index.md index 8dd81d292a8..c8f903e7d93 100644 --- a/content/rancher/v2.6/en/istio/resources/_index.md +++ b/content/rancher/v2.6/en/istio/resources/_index.md @@ -39,7 +39,7 @@ You can find more information about Istio configuration in the [official Istio d To configure the resources allocated to an Istio component, 1. In the Rancher **Cluster Explorer**, navigate to your Istio installation in **Apps & Marketplace** -1. Click **Upgrade** to edit the base components via changes the values.yaml or add an [overlay file]({{}}/rancher/v2.6/en/istio/v2.5/configuration-reference/#overlay-file). For more information about editing the overlay file, see [this section.](./#editing-the-overlay-file) +1. Click **Upgrade** to edit the base components via changes to the values.yaml or add an [overlay file]({{}}/rancher/v2.6/en/istio/v2.5/configuration-reference/#overlay-file). For more information about editing the overlay file, see [this section.](./#editing-the-overlay-file) 1. Change the CPU or memory allocations, the nodes where each component will be scheduled to, or the node tolerations. 1. Click **Upgrade.** to rollout changes diff --git a/content/rancher/v2.6/en/security/rancher-2.5/1.5-hardening-2.5/_index.md b/content/rancher/v2.6/en/security/rancher-2.5/1.5-hardening-2.5/_index.md index d4b6968d7c5..7f64bbbc6a9 100644 --- a/content/rancher/v2.6/en/security/rancher-2.5/1.5-hardening-2.5/_index.md +++ b/content/rancher/v2.6/en/security/rancher-2.5/1.5-hardening-2.5/_index.md @@ -13,7 +13,7 @@ This hardening guide is intended to be used for RKE clusters and associated with ----------------|-----------------------|------------------ Rancher v2.5 | Benchmark v1.5 | Kubernetes 1.15 -[Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.5/Rancher_Hardening_Guide_CIS_1.6.pdf) +[Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.5/Rancher_Hardening_Guide_CIS_1.5.pdf) ### Overview diff --git a/content/rancher/v2.6/en/troubleshooting/networking/_index.md b/content/rancher/v2.6/en/troubleshooting/networking/_index.md index 4aff8504815..bdaeffcd8d9 100644 --- a/content/rancher/v2.6/en/troubleshooting/networking/_index.md +++ b/content/rancher/v2.6/en/troubleshooting/networking/_index.md @@ -35,7 +35,7 @@ To test the overlay network, you can launch the following `DaemonSet` definition tolerations: - operator: Exists containers: - - image: rancher/swiss-army-knife + - image: rancherlabs/swiss-army-knife imagePullPolicy: Always name: overlaytest command: ["sh", "-c", "tail -f /dev/null"]