diff --git a/content/rancher/concepts/clusters/_index.md b/content/rancher/concepts/clusters/_index.md index 56cdd08836d..1224656f179 100644 --- a/content/rancher/concepts/clusters/_index.md +++ b/content/rancher/concepts/clusters/_index.md @@ -2,18 +2,15 @@ title: Clusters weight: 2100 --- - # Clusters -Coming Soon - ## What's a Cluster? -Coming Soon +A cluster is a group of computing resources that work as a team to accomplish a goal. Each individual computer in a cluster is called a _node_. ## Cluster Creation -Coming Soon +Rancher simplifies creation of Kubernetes clusters by allowing you to create them with the Rancher UI rather than a config file. ### Node Components @@ -45,6 +42,57 @@ Rancher integrates with cloud APIs so users can provision GKE, EKS, and AKS clus Users can existing Kubernetes cluster into Rancher. Rancher does not automate the provisioning, scaling, and upgrade of imported Kubernetes clusters. All other cluster management, policy management, and workload management capabilities of Rancher apply to imported clustered. +##### RKE and Amazon AWS EC2: Adding Hosts + +When setting up a custom cluster configured to run with an AWS cloud provider, any hosts you add to the cluster: + +- Must be an AWS EC2 instance. +- Must have the following IAM policy at minimum: + +``` +{ + "Effect": "Allow", + "Action": "ec2:Describe*", + "Resource": "*" +} +``` +In order to use Amazon Elastic Load Balancers (ELBs) and EBS with Kubernetes, the host requires the IAM role with appropriate access. + +**Example Policy for IAM Role** + +``` +{ + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": "ec2:Describe*", + "Resource": "*" + }, + { + "Effect": "Allow", + "Action": "ec2:AttachVolume", + "Resource": "*" + }, + { + "Effect": "Allow", + "Action": "ec2:DetachVolume", + "Resource": "*" + }, + { + "Effect": "Allow", + "Action": ["ec2:*"], + "Resource": ["*"] + }, + { + "Effect": "Allow", + "Action": ["elasticloadbalancing:*"], + "Resource": ["*"] + } + ] +} +``` + ### Kubeconfig File -Coming Soon +Coming Soon! diff --git a/content/rancher/concepts/global-configuration/_index.md b/content/rancher/concepts/global-configuration/_index.md index 8413eb8eb0f..0a8b6bd5132 100644 --- a/content/rancher/concepts/global-configuration/_index.md +++ b/content/rancher/concepts/global-configuration/_index.md @@ -5,48 +5,79 @@ weight: 2075 # Global Configuration -Coming Soon +After installing Rancher 2.0, you should configure it to support your users and environment. This section describes the global configurations you should make after installation. -## Authentication +# Authentication -Coming Soon +One of the key features that Rancher adds to Kubernetes is centralized user authentication. This feature allows your users to use one set of credentials to authenticate with any of your Kubernetes clusters. -### External vs. Local Authentication +This centralized user authentication is accomplished using the Rancher authentication proxy, which is installed with the rest of Rancher. This proxy authenticates your users and forwards their requests to your Kubernetes clusters using a service account. -Coming Soon +## External vs. Local Authentication + +The Rancher authentication proxy integrates with the following external authentication services. + +- Microsoft Active Directory +- GitHub + +However, Rancher also provides local authentication. + +In most cases, you should use an external authentication service over local, as external authentication allows user management from a central location. However, you may want a few local authentication accounts for managing Rancher under rare circumstances, such as if Active Directory is down. ## Users and Roles -Coming Soon +Within Rancher, each user autheticates as a _user_, which is an object that grants you access within the Rancher system. As mentioned in the previous sections, users can either be local or external. + +Once the user logs in to Rancher, their _authorization_, or their access rights within the system, are determined by _roles_. Roles are sets of permissions that the user can perform in Rancher + +There are two types of roles in Rancher: default roles and custom roles. ### Default Roles -Coming Soon +Out-of-the-box, Rancher comes with two default roles: + +- **Administrator:** + + These users have full control over the entire Rancher system and all clusters within it. + +- **Standard User:** + + These users can create new clusters or manage clusters and projects that an administrator has given them access to. ### Custom Roles -Coming Soon +Rancher lets you create _custom roles_ that let you assing individual permissions to a user. These roles are convenient for defining narrow or specialized persmissions to user within Rancher. ### Membership -Coming Soon +The projects and clusters accessible to a standard or custom users is determined by _membership_. Membership is a list of users who have access to a specific project or cluster. Each project and cluster includes a tab that Rancher administrators can use to assign membership. + +Non-administrative users do not have access to any existing projects/clusters by default. An administrator must explicitly assign the user membership. ## Rancher Server URL -Coming Soon +This is the URL of your Rancher Server. All nodes in your cluster must resolve to this URL. + +- You are prompted for this URL upon the very first Rancher login. +- You can edit this URL later by selecting **Settings**. ## Pod Security Policies -Coming Soon +_Pod Security Policies_ are objects that control security-sensitive aspects of pod specification. Pods only run within Kubernetes if they meet the conditions specified in their assigned Pod Security Policy. -### Best Practice: Set Pod Security as Cluster Level +Read more about Pod Security Policies in the [Kubernetes Documentation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/). -Coming Soon +>**Best Practice:** +>Set Pod Security at the cluster level. ## Node Drivers -Coming Soon +Out-of-the-box, Rancher provides support for creating clusters using many popular cloud providers: Amazon EC2, Azure, DigitalOcean, and so on. However, you may want to create a cluster using another cloud provider. In these scenarios, you can create a custom node driver for the cloud provider and point Rancher toward it. + +For more information on creating node drivers, see [https://github.com/rancher/ui-driver-skel](https://github.com/rancher/ui-driver-skel). ## Node Templates -Coming Soon +You can create new clusters within Rancher using _node templates_. A node template is a virtual machine image used to create a Kubernetes cluster. While creating a cluster, Rancher will prompt you for an image to use as a template. Follow the directions on screen to create the template. During cluster creation, Rancher clones the template and installs different Kubernettes components. + +After you add a node template to Rancher, its stored by the system so that you can use it when creating another cluster later. Node templates are bound to your login. After you add a template, you can remove them from your user profile. diff --git a/content/rancher/concepts/projects/_index.md b/content/rancher/concepts/projects/_index.md index 02b716e5e42..2867c3a1c55 100644 --- a/content/rancher/concepts/projects/_index.md +++ b/content/rancher/concepts/projects/_index.md @@ -7,15 +7,18 @@ weight: 2150 ## What's a Project? -Project is a new concept introduced by Rancher. It is not a native Kubernetes construct. A project captures a set of policies for a set of namespaces. A user can be assigned a specific role in a project. A role can be owner, member, read-only, or custom. Policies include Kubernetes Role-Based Access Control (RBAC) policies and pod security policies. Rancher 2.0 also implements a canned network policy that isolated containers in different projects. Future version of Rancher will implement more flexible network policies. +Project is a new concept introduced by Rancher. It is not a native Kubernetes construct. A project captures a set of policies for a set of namespaces. A user can be assigned a specific role in a project. A role can be owner, member, read-only, or custom. Policies include Kubernetes Role-Based Access Control (RBAC) policies and pod security policies. Rancher 2.0 also implements a canned network policy that isolates containers in different projects. Future versions of Rancher will implement more flexible network policies. ### Authorization -Coming Soon +Non-administrative users are only authorized for project access after an administrator explicitly adds them to the project's **Members** tab. + +>**Exception:** +> Non-administrative users can access projects that they create themselves. ### Pod Security Policies -Coming Soon +Rancher extends Kubernetes to allow the application of [Pod Sercurity Policies](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) at the project level in additiona to the cluster level. However, as a best practice, we recommend applying Pod Security Policies at the cluster level. ## Namespaces diff --git a/content/rancher/installation/server-installation/kubernetes-install.md b/content/rancher/installation/server-installation/kubernetes-install.md deleted file mode 100644 index c530d8ffac8..00000000000 --- a/content/rancher/installation/server-installation/kubernetes-install.md +++ /dev/null @@ -1,217 +0,0 @@ ---- -title: Option 2—Install by K8s Cluster Addon -weight: 275 ---- - -# Install by Kubernetes Cluster Addon - -For environments already running a Kubernettes cluster, you can deploy Rancher using the Rancher Kubernetes Engine (RKE). RKE is our light-weight, lightening-fast installer. During install, you can point RKE toward a config file that installs Rancher as an Addon. - -## Provision Linux Hosts - -Provision a minimum of three Linux hosts. Use the requirements below. - -### Requirements - -{{< requirements_os >}} - -{{< requirements_hardware >}} - -{{< requirements_software >}} - -{{< requirements_ports >}} - -{{< requirements_ha >}} - -## Get RKE - -Rancher Kubernetes Engine (RKE) is a fast, versatile Kubernetes installer you can use to install Kubernetes on your Linux hosts. You can download RKE from GitHub. - -1. From your workstation, open a web browser and navigate to [https://github.com/rancher/rke/releases](https://github.com/rancher/rke/releases). Download the latest RKE installer. - -2. Make the RKE binary that you just downloaded executable. Open Terminal, change directory to the location of the RKE binary, and then run the following command: - - ``` - $ chmod +x rke - ``` - - >**Note:** adjust the command for the version of RKE that you downloaded (e.g., `rke_darwin-amd64`) - -3. Confirm that RKE is now executable by running the following command: - - ``` - $ ./rke -version - ``` - -**Result:** You receive output similar to what follows: -``` -rke version v -``` - -## Get YAML Template - -During installation, RKE reads from a .yml file to install and configure your Kubernetes cluster. Download one of the `.yml` templates that we provide to get you started. Choose a template based on the type of certificate you plan on using: - -- Auto-Generated Self-Signed Certifcates (i.e. SSL passthrough): - [rancher-minimal-passthrough.yml](https://github.com/rancher/rke/blob/master/rancher-minimal-passthrough.yml) - -- Bring Your Own Certificate (either CA- or Self-Signed): - [rancher-minimal-ssl.yml](https://github.com/rancher/rke/blob/master/rancher-minimal-ssl.yml) - -## Edit YAML Template - -Once you have a template, customize it to suit your needs. - -1. Open the `.yml` file that you just downloaded. - -2. Update the `Nodes` section with your [Linux hosts](#provision-linux-hosts). Add an entry for each host. - - **Example:** - - ``` - nodes: - - address: - user: root - role: - - controlplane - - etcd - - worker - ssh_key_path: /home/user/.ssh/id_rsa #PATH TO PUBLIC KEY, I.E. PEM FILE - - address: - user: root - role: - - controlplane - - etcd - - worker - ssh_key_path: /home/user/.ssh/id_rsa #PATH TO PUBLIC KEY, I.E. PEM FILE - - address: - user: root - role: - - controlplane - - etcd - - worker - ssh_key_path: /home/user/.ssh/id_rsa #PATH TO PUBLIC KEY, I.E. PEM FILE - ``` - -3. Scroll to `- host: # FQDN to access cattle server`. Replace `` with the fully qualified domain name of each host you assigned the `controlplane` and/or `worker` role. - - **Example** - - ``` - - host: host-one.domain.com - http: - paths: - - backend: - serviceName: cattle-service - servicePort: 443 - - host: host-two.domain.com - http: - paths: - - backend: - serviceName: cattle-service - servicePort: 443 - - host: host-three.domain.com - http: - paths: - - backend: - serviceName: cattle-service - servicePort: 443 - ``` - - >**Using Auto-Generated Self-Signed Certificates?** - > - >The next two steps don't apply to you. Save the `.yml` file and continue to [Run RKE](#run-rke). - -4. **Bring Your Own Certificate only:** Scroll to the codeblock that follows. - - ``` - apiVersion: v1 - kind: Secret - metadata: - name: cattle-keys-server - namespace: cattle-system - type: Opaque - data: - cert.pem: # ssl cert for cattle server. - key.pem: # ssl key for cattle server. - cacerts.pem: # CA cert used to sign cattle server cert and key - ``` - - Replace each placeholder with the applicable `.pem`. - - >**Important:** - > - > - Each `.pem` must be in base-64: `cat | base64` - > - If you're using a self-signed certificate, both `cattle-keys-server` and `cattle-keys-ingress` must use certificates and keys signed by the same CA. - - - `` - - `` - - `` - - - **Example:** - - ``` - apiVersion: v1 - kind: Secret - metadata: - name: cattle-keys-server - namespace: cattle-system - type: Opaque - data: - cert.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZYVENDQkVXZ0F3SUJBZ0lKQU5QTE5EZnJoL2gzTUEwR0NTcUdTSWIzRFFFQkN3VUFNSUhHTVFzd0NRWUQKVlFRR0V3SlZVekVRTUE0R0ExVUVDQk1IUVhKcGVtOXVZVEVUTUJFR0ExVUVCeE1LVTJOdmRIUnpaR0ZzWlRFbApNQ01HQTFVRUNoTWNVM1JoY21acFpXeGtJRlJsWTJodWIyeHZaMmxsY3l3Z1NXNWpMakV6TURFR0ExVUVDeE1xCmFIUjBjRG92TDJObGNuUnpMbk4wWVhKbWFXVnNaSFJsWTJndVkyOXRMM0psY0c5emFYUnZjbmt2TVRRd01nWUQKVlFRREV5dFRkR0Z5Wm1sbGJHUWdVMlZqZFhKbElFTmxjblJwWm1sallYUmxJRUYxZEdodmNtbDBlU0F0SUVjeQpNQjRYRFRFM01EZ3hPREU0TVRnd01Wb1hEVEl3TURneE9ERTRNVEV3TUZvd1BURWhNQjhHQTFVRUN4TVlSRzl0CllXbHVJRU52Ym5SeWIyd2dWbUZzYVdSaGRHVmtNUmd3RmdZRFZRUUREQThxTG5KaGJtTm9aWEl1YzNCaFkyVXcKZ2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLQW9JQkFRRFF6aW81TDhMYTFya0ZFQVR4SXZBbQpVdTJHUnYwQVZsZTI2RjdsN3I1VEhoUDZPUWZUK2R2S01hU3Q3aWEyK3VuZEl3cGlkWENGLy9TVklXTEsxKzFQCmZ1blFaQy8yaUhnQ1N0Smk2U0JHUXFhekFrVUhpOG1oMVVCUHdkNmtBTi9KNGtCWEJ5aGxtZGRzT2hDeXpuSTgKTE5RdzBFeDcyUEZRMnh1Qm9KNWIvOEdCMnhkMC8yU0V0bmdmaWFzTk9wOEYxY2JQSVpGdm5FMDlaR3ljWWszSgpUSU9NdjNXME9xYVg4OEQ3K29oM0R0V05Bc0Jlc01ZVlBhUmxyTkJhUXFjemg3VEhZcUR0OGIyRUdmNXBxS2pFCm5pSVY5Yk9PUlpab2xrZzlzQUFHcWF5SjVJS3Q2YmNtVENIYXRBcGpRZ3NWWjk5QnRZQzZiSWFudXRDWllUOVoKQWdNQkFBR2pnZ0hVTUlJQjBEQU1CZ05WSFJNQkFmOEVBakFBTUIwR0ExVWRKUVFXTUJRR0NDc0dBUVVGQndNQgpCZ2dyQmdFRkJRY0RBakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdQQVlEVlIwZkJEVXdNekF4b0MrZ0xZWXJhSFIwCmNEb3ZMMk55YkM1emRHRnlabWxsYkdSMFpXTm9MbU52YlM5elptbG5Nbk14TFRZeUxtTnliREJqQmdOVkhTQUUKWERCYU1FNEdDMkNHU0FHRy9XNEJCeGNCTUQ4d1BRWUlLd1lCQlFVSEFnRVdNV2gwZEhBNkx5OWpaWEowYVdacApZMkYwWlhNdWMzUmhjbVpwWld4a2RHVmphQzVqYjIwdmNtVndiM05wZEc5eWVTOHdDQVlHWjRFTUFRSUJNSUdDCkJnZ3JCZ0VGQlFjQkFRUjJNSFF3S2dZSUt3WUJCUVVITUFHR0htaDBkSEE2THk5dlkzTndMbk4wWVhKbWFXVnMKWkhSbFkyZ3VZMjl0THpCR0JnZ3JCZ0VGQlFjd0FvWTZhSFIwY0RvdkwyTmxjblJwWm1sallYUmxjeTV6ZEdGeQpabWxsYkdSMFpXTm9MbU52YlM5eVpYQnZjMmwwYjNKNUwzTm1hV2N5TG1OeWREQWZCZ05WSFNNRUdEQVdnQlFsClJZRm9VQ1k0UFRzdExMN05hdG0yUGJObVl6QXBCZ05WSFJFRUlqQWdnZzhxTG5KaGJtTm9aWEl1YzNCaFkyV0MKRFhKaGJtTm9aWEl1YzNCaFkyVXdIUVlEVlIwT0JCWUVGQnplTmxRNUI0dnVIQVcvQ3RPakN3ZTV2QVZkTUEwRwpDU3FHU0liM0RRRUJDd1VBQTRJQkFRQjhWRE1VU3JQbFIyVHdLbVl6bDg4Q1FMSUZRUWlpSEFhQkZ3T3FLNGxuCmRoSVpuZEtvOTFKTS9CY1lrWEtnN3BSVmhZMVdkdFQ2dUpoUnF2bWg3SHlWWS80VGdlK3UzTFVRYlNOeFdaamkKWEUxK3ptRUEvQ2lQSjRWMkg1dldhL0d4Z25yNVBrekhpSzM3VHJWWXgxOUpPa0NUcnhYd1A1b0MwZUorSHNpaApsZWJlVWtlbkJDNmtqbGRqelV5YldEWThMbnY3QVFydHhUdmQrWS9iQjFyMlVoOENSeXUyaDdlbVpzcTBVUHpuCml5R1E5OEcraEx6U0dESjRqcEdEUUIwc3k5R1gzYSt2RWlVanFTd3hlMkJkaTNPYUQxbDVYVlRiWjBSNnUydjAKWDdwVEtEcVBRaFRoWUJxdDJod3ducTBkWlRnUEdMWEZ3clZxemNrczdHK3kKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= # ssl cert for cattle server. - key.pem: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBME00cU9TL0MydGE1QlJBRThTTHdKbEx0aGtiOUFGWlh0dWhlNWU2K1V4NFQramtICjAvbmJ5akdrcmU0bXR2cnAzU01LWW5Wd2hmLzBsU0ZpeXRmdFQzN3AwR1F2OW9oNEFrclNZdWtnUmtLbXN3SkYKQjR2Sm9kVkFUOEhlcEFEZnllSkFWd2NvWlpuWGJEb1FzczV5UEN6VU1OQk1lOWp4VU5zYmdhQ2VXLy9CZ2RzWApkUDlraExaNEg0bXJEVHFmQmRYR3p5R1JiNXhOUFdSc25HSk55VXlEakw5MXREcW1sL1BBKy9xSWR3N1ZqUUxBClhyREdGVDJrWmF6UVdrS25NNGUweDJLZzdmRzloQm4rYWFpb3hKNGlGZld6amtXV2FKWklQYkFBQnFtc2llU0MKcmVtM0prd2gyclFLWTBJTEZXZmZRYldBdW15R3A3clFtV0UvV1FJREFRQUJBb0lCQVFDNWFjamVuUVduTTdKNQp4MTdNRFYwNGVyMEdWblVFM3FibStYS0ROTHYycktmS3N1ZTdtSXhPQUVVZVdYSXhXNTlkU1dkSVJNYVZodEpWCnRwNjJSb1VvNlNhUWNOYVNVVjVYa3I4OUs0d0lOOWswN2RnRU9tSGlmYTJzNVJkaGhKRTBBTjluS0NqOEIxN2UKY0xVeFFkYjRqa29oeW1XUU4vVVkrbWR6ZFFBSjZmZjE2RGtxY3RGZkpONnhPSlFnM2h0L0E2NEl5OU8vL0ZRcgoxMnlDelJQT3ZCUnJjelBuM05qVm9mUkF1UVhreUR0bkVwSlVUa1c5OXVtTzQ0NS9qOU5RTDdIMnYvOU9rdjAyCnlPSWVaUDY2cVVoSGY2NmF1NlZ4NFRSOEdqQXhUcnZXSkJCVFB3eGw2bGhHWUd2UzAzQkdqVFN5WVByUnl0U2gKSEZweVpxSGRBb0dCQU9uTmE3TEVxTGdEaTVmMTRWNUlrei9VcC8zaVMxRkc4TlIyc240bHNPaVFXQWptUTg3TQpFNzhId0RIc013RFRUZjljbW9zdWlUakZqSUFWV0F5cFlvQnZiMzVQK2hHU05nTXYydUI5RUxScGxHeFBRRUlyCmJWS01ZNW9IbWZYTWhaRVZRbCtnZldGNHE5eFh0Ykc4cTFmTTBQNGxVK1VBdGpzQVduVjJNeGxYQW9HQkFPU2gKTUUxdjZBeHFpL2Q5Z0ZEWUZtb09ucGU2bjNhSktENlNld3hJazFzNFVEQllMSEpFb1FBT0NTdW9wZUVRUHM1RAo0STNPZXhSKys1YVp6R0ZpeUhhZDNPRGJBSVgzNVlseXg1UXNMa0FVNGZCZUZDR0p1Tm5jQk9jakxqelJYK3ljCmRUMFgyZ0RldUZadmxpTXVCUWJoMjNudkh4RnZXbFkvTXdOVm13N1BBb0dBTk5oZWVHaWs3ZnEzS2FERTBNZTgKcUpmTFpNSXFYZk9YNlozdW1ENnlyczQ1WjhHTUlBaldpYjRadmU3eVZFUnVnOEtObDlucjRDNGVwTEN1VnlaTwpBbE90c3JJbkJxT3ltNlBNYUNNOGpGcTAxb3BQTHVXYjd5V1dPYkZ3SmpPVkdRYmlHclV1d2NKQnJpc1JBVnh3CnFnYThVa1Zqb2dZNEtqdlpObVdDQlQ4Q2dZQnB6ZktsazRsRzNiUUNoOUR2R09GZW1YOXBabE5QcnUreDdXWUcKYkR2TmRrVWQ2bUEvVFdWWXVpWWlUenpjNkFDNHdnN1VjVjdpUUZXNy8xYm5KcWp3dytPcEo1Q1pidnlKM0ZWaQpUQVBuWWdLaGsxZ3JvU21yb0xlZ0k5Yk5ESFFnOHRNS3Y5UUNuUStmNktvSmc4Mk52czRzSXE0MUNsdzdGNnBLCis3M3pYd0tCZ1FDQm9JQWdHL1R4d3hDbytUODZNNWZOTlJJYkZBbWJOTzFRQ252Z1djSThCUGxzeS9STFFHNXIKdVpQUEJvYkluWWtuQU56NzlYRFBpM0R2MTFwUUlJaHdLdGtVVmRaL09lNnlZdUJvZWdEQVJMa2d6bytyTXRtdApLWUVHL3NwMjVNUGlwMkdFd3p2RUc4aHlaZHRMbGNNcFUrQTdVMmpWd1lUMWNaL2lNQkVQckE9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo= # ssl key for cattle server. - cacerts.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZBRENDQStpZ0F3SUJBZ0lCQnpBTkJna3Foa2lHOXcwQkFRc0ZBRENCanpFTE1Ba0dBMVVFQmhNQ1ZWTXgKRURBT0JnTlZCQWdUQjBGeWFYcHZibUV4RXpBUkJnTlZCQWNUQ2xOamIzUjBjMlJoYkdVeEpUQWpCZ05WQkFvVApIRk4wWVhKbWFXVnNaQ0JVWldOb2JtOXNiMmRwWlhNc0lFbHVZeTR4TWpBd0JnTlZCQU1US1ZOMFlYSm1hV1ZzClpDQlNiMjkwSUVObGNuUnBabWxqWVhSbElFRjFkR2h2Y21sMGVTQXRJRWN5TUI0WERURXhNRFV3TXpBM01EQXcKTUZvWERUTXhNRFV3TXpBM01EQXdNRm93Z2NZeEN6QUpCZ05WQkFZVEFsVlRNUkF3RGdZRFZRUUlFd2RCY21sNgpiMjVoTVJNd0VRWURWUVFIRXdwVFkyOTBkSE5rWVd4bE1TVXdJd1lEVlFRS0V4eFRkR0Z5Wm1sbGJHUWdWR1ZqCmFHNXZiRzluYVdWekxDQkpibU11TVRNd01RWURWUVFMRXlwb2RIUndPaTh2WTJWeWRITXVjM1JoY21acFpXeGsKZEdWamFDNWpiMjB2Y21Wd2IzTnBkRzl5ZVM4eE5EQXlCZ05WQkFNVEsxTjBZWEptYVdWc1pDQlRaV04xY21VZwpRMlZ5ZEdsbWFXTmhkR1VnUVhWMGFHOXlhWFI1SUMwZ1J6SXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRGxrR1pMN1BsR2Nha2dnNzdwYkw5S3lVaHBnWFZPYlNUMnl4Y1QrTEJ4V1lSNmF5dUYKcERTMUZ1WEx6T2xCY0N5a0x0YjZNbjNocU42VUVLd3h3Y0RZYXY5Wko2dDIxdndMZEd1NHA2NC94RlQwdERGRQozWk5XaktSTVhwdUp5eVNEbStKWGZiZllFaC9KaFczMDBZRHhVSnVIcnRRTEVBWDdKN29vYlJmcER0Wk51VGxWCkJ2OEtKQVYrTDhZZGNtelVpeW1NVjMzYTJldG1HdE5QcDk5L1VzUXd4YVhKRGdMRlU3OTNPR2dHSk1ObXlEZCsKTUI1RmNTTTEvNURZS3AyTjU3Q1NUVHgvS2dxVDNNMFdSbVgzWUlTTGRrdVJKM01Va3VEcTdvOFc2bzBPUG5ZWAp2MzJKZ0lCRVErY3Q0RU1KZGRvMjZLM2JpVHIxWFJLT0l3U0RBZ01CQUFHamdnRXNNSUlCS0RBUEJnTlZIUk1CCkFmOEVCVEFEQVFIL01BNEdBMVVkRHdFQi93UUVBd0lCQmpBZEJnTlZIUTRFRmdRVUpVV0JhRkFtT0QwN0xTeSsKeldyWnRqMnpabU13SHdZRFZSMGpCQmd3Rm9BVWZBd3lINmZaTUgvRWZXaWpZcWloenFzSFd5Y3dPZ1lJS3dZQgpCUVVIQVFFRUxqQXNNQ29HQ0NzR0FRVUZCekFCaGg1b2RIUndPaTh2YjJOemNDNXpkR0Z5Wm1sbGJHUjBaV05vCkxtTnZiUzh3T3dZRFZSMGZCRFF3TWpBd29DNmdMSVlxYUhSMGNEb3ZMMk55YkM1emRHRnlabWxsYkdSMFpXTm8KTG1OdmJTOXpabkp2YjNRdFp6SXVZM0pzTUV3R0ExVWRJQVJGTUVNd1FRWUVWUjBnQURBNU1EY0dDQ3NHQVFVRgpCd0lCRml0b2RIUndjem92TDJObGNuUnpMbk4wWVhKbWFXVnNaSFJsWTJndVkyOXRMM0psY0c5emFYUnZjbmt2Ck1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQldaY3IrOHo4S3FKT0xHTWZlUTJrVE5DQytUbDk0cUd1YzIycE4KUWR2QkUremNNUUFpWHZjQW5nemdOR1UwK2JFNlRraklFb0dJWEZzK0NGTjY5eHBrMzdoUVljeFRVVUFwUzhMMApyanBmNU1xdEpzeE9ZVVBsL1ZlbU4zRE9ReXV3bE1PUzZlRmZxaEJKdDJuazROQWZaS1FyelI5dm9QaUVKQmpPCmVUMnBrYjlVR0JPSm1WUVJEVlhGSmd0NVQxb2NidmxqMnhTQXBBZXIrcktsdVlqZGtmNWxPNlNqZWI2SlRlSFEKc1BUSUZ3d0tsaFI4Q2JkczRjTFlWZFFZb0twQmFYQWtvN252NlZyY1B1dVVTdkMzM2w4T2R2cjcrMmtEUlVCUQo3bklNcEJLR2djMFQwVTdFUE1wT0RkSW04UUMzdEthaTRXNTZnZjB3ckhvZngxbDcKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQotLS0tLUJFR0lOIENFUlRJRklDQVRFLS0tLS0KTUlJRW9EQ0NBNGlnQXdJQkFnSURPUlNFTUEwR0NTcUdTSWIzRFFFQkN3VUFNR2d4Q3pBSkJnTlZCQVlUQWxWVApNU1V3SXdZRFZRUUtFeHhUZEdGeVptbGxiR1FnVkdWamFHNXZiRzluYVdWekxDQkpibU11TVRJd01BWURWUVFMCkV5bFRkR0Z5Wm1sbGJHUWdRMnhoYzNNZ01pQkRaWEowYVdacFkyRjBhVzl1SUVGMWRHaHZjbWwwZVRBZUZ3MHgKTkRBeE1ERXdOekF3TURCYUZ3MHpNVEExTXpBd056QXdNREJhTUlHUE1Rc3dDUVlEVlFRR0V3SlZVekVRTUE0RwpBMVVFQ0JNSFFYSnBlbTl1WVRFVE1CRUdBMVVFQnhNS1UyTnZkSFJ6WkdGc1pURWxNQ01HQTFVRUNoTWNVM1JoCmNtWnBaV3hrSUZSbFkyaHViMnh2WjJsbGN5d2dTVzVqTGpFeU1EQUdBMVVFQXhNcFUzUmhjbVpwWld4a0lGSnYKYjNRZ1EyVnlkR2xtYVdOaGRHVWdRWFYwYUc5eWFYUjVJQzBnUnpJd2dnRWlNQTBHQ1NxR1NJYjNEUUVCQVFVQQpBNElCRHdBd2dnRUtBb0lCQVFDOTdjRUQvUGFQL0FLeGIxdWZTTm1kZWVLaXR3TmhWaGpEUjdiWHlqMDFMb2xECjk2RnBtOTZLR3YwVElKeTBTWGN5S1ZiOXVleU0zU0w2Y3R3bllaZnU5bHFFN0c0WnVZa3MzSVJiMVhUN2ExL0YKaWFVUVVvbEdWZlM0ZFJ6bWYrUlVya3Y0VlhKWEFobjRGM0ZaNng0b0IzVEZuVWkrYkxUMHBMRHpaRGQ1a3NEcwpSbDUvNFcxVFRHS3Z6UjhMWTdzNm5mdjhlUUNZWVhUUEpvSkFZL095Y21vWkRabksxQTUxekRmN2k0bkJXZkZpCmYxK3pYMlV3K0tlM1RYWmFIblplTk1Eb2xsYVppclB3ZjZUTnZkd3lNWHlSeitCZkVmaHJxa2xjMFptVTBhTGoKWTFzSmRyVldZdUZMZEIyVzFDYlVDQVJaMEpnT0R1YmUvTVBzSDVEeEFnTUJBQUdqZ2dFcE1JSUJKVEFQQmdOVgpIUk1CQWY4RUJUQURBUUgvTUE0R0ExVWREd0VCL3dRRUF3SUJCakFkQmdOVkhRNEVGZ1FVZkF3eUg2ZlpNSC9FCmZXaWpZcWloenFzSFd5Y3dId1lEVlIwakJCZ3dGb0FVdjErMzBjN2RINGIwVzFXczNOY1F3ZzZwaU9jd09nWUkKS3dZQkJRVUhBUUVFTGpBc01Db0dDQ3NHQVFVRkJ6QUJoaDVvZEhSd09pOHZiMk56Y0M1emRHRnlabWxsYkdSMApaV05vTG1OdmJTOHdPQVlEVlIwZkJERXdMekF0b0N1Z0tZWW5hSFIwY0RvdkwyTnliQzV6ZEdGeVptbGxiR1IwClpXTm9MbU52YlM5elpuSnZiM1F1WTNKc01Fd0dBMVVkSUFSRk1FTXdRUVlFVlIwZ0FEQTVNRGNHQ0NzR0FRVUYKQndJQkZpdG9kSFJ3Y3pvdkwyTmxjblJ6TG5OMFlYSm1hV1ZzWkhSbFkyZ3VZMjl0TDNKbGNHOXphWFJ2Y25rdgpNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUJBUUNGWThIWjNibi9xYjJtR2R5L0V6b1JPQ0pVc2F3RkVQdDhzNVkvCk1ZdG0vNGp6NGIvN3h4OEEvMFpxaTJFeXlRRlJkdnVheHZvZ1VjaEd4SmpYZWFQakJISS9pMDAwVTJmc015eDcKNkpRQktIdzZORnNDZHhhTlFDVXpzTHhzbDljRmV2K01oYzV2b0ZNQUYyNGViTDBpMXdxSU4vWjk2NWxCN3lmTApqR0JyVEFGK1pWQUxUN2lWbXBwdU5QMXpPalB4a2RYelRpMTA2Ty9Ua0RYeEJtaGsxTkFUL1ZMVHhtM0JPb294CjNRVW1OVXFNWmJoU2E0SHMwcHkxTkJDWG5EN0dMKzJPUWtJa0x1bHptaVg1RWZIeUkybkw1WlJwb05MY3NQeEUKaWF3WHFNelZOM2NXeFlDNURJOVhBbFdaaFh0SjhDNWJvTUpYVTEyaTZLWTN3d0g2Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVEekNDQXZlZ0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRVUZBREJvTVFzd0NRWURWUVFHRXdKVlV6RWwKTUNNR0ExVUVDaE1jVTNSaGNtWnBaV3hrSUZSbFkyaHViMnh2WjJsbGN5d2dTVzVqTGpFeU1EQUdBMVVFQ3hNcApVM1JoY21acFpXeGtJRU5zWVhOeklESWdRMlZ5ZEdsbWFXTmhkR2x2YmlCQmRYUm9iM0pwZEhrd0hoY05NRFF3Ck5qSTVNVGN6T1RFMldoY05NelF3TmpJNU1UY3pPVEUyV2pCb01Rc3dDUVlEVlFRR0V3SlZVekVsTUNNR0ExVUUKQ2hNY1UzUmhjbVpwWld4a0lGUmxZMmh1YjJ4dloybGxjeXdnU1c1akxqRXlNREFHQTFVRUN4TXBVM1JoY21acApaV3hrSUVOc1lYTnpJRElnUTJWeWRHbG1hV05oZEdsdmJpQkJkWFJvYjNKcGRIa3dnZ0VnTUEwR0NTcUdTSWIzCkRRRUJBUVVBQTRJQkRRQXdnZ0VJQW9JQkFRQzNNc2orNlhHbUJJV3REQkZrMzg1Tjc4Z0RHSWMvb2F2N1BLYWYKOE1PaDJ0VFliaXRUa1Bza3BENkU4SjdvWCt6bEowVDFLS1kvZTk3Z0t2RElyMU12bnNvRkFaTWVqMlljT2FkTgorbHEyY3dRbFp1dDNmK2RaeGtxWkpSUlU2eWJIODM4WjFUQndqNit3UmlyL3Jlc3A3ZGVmcWdTSG85VDVpYVUwClg5dERrWUkyMldZOHNiaTVndjJjT2o0UXlEdnZCbVZtZXBzWkdEMy9jVkU4TUM1ZnZqMTNjN0pkQm16REkxYWEKSzRVbWtoeW5BclBrUHcydkNIbUN1RFk5NnB6VE5iTzhhY3Ixekozby9XU05GNEF6Ymw1S1habkpIb2UwblJyQQoxVzRUTlNOZTM1dGZQZS9XOTNiQzZqNjdlQTBjUW1kckJOajQxdHB2aS9KRW9BR3JBZ0VEbzRIRk1JSENNQjBHCkExVWREZ1FXQkJTL1g3ZlJ6dDBmaHZSYlZhemMxeERDRHFtSTV6Q0JrZ1lEVlIwakJJR0tNSUdIZ0JTL1g3ZlIKenQwZmh2UmJWYXpjMXhEQ0RxbUk1NkZzcEdvd2FERUxNQWtHQTFVRUJoTUNWVk14SlRBakJnTlZCQW9USEZOMApZWEptYVdWc1pDQlVaV05vYm05c2IyZHBaWE1zSUVsdVl5NHhNakF3QmdOVkJBc1RLVk4wWVhKbWFXVnNaQ0JECmJHRnpjeUF5SUVObGNuUnBabWxqWVhScGIyNGdRWFYwYUc5eWFYUjVnZ0VBTUF3R0ExVWRFd1FGTUFNQkFmOHcKRFFZSktvWklodmNOQVFFRkJRQURnZ0VCQUFXZFA0aWQwY2thVmFHc2FmUHpXZHFiQVljYVQxZXBvWGtKS3R2MwpMN0llek1kZWF0aURoNkdYNzBrMVBuY0dRVmhpdjQ1WXVBcG5QK3l6M1NGbUg4bFUrbkxNUFV4QTJJR3ZkNTZECmVydWl4L1UwRjQ3WkVVRDAvQ3dxVFJWL3AySmRMaVhUQUFzZ0doMW8rUmU0OUwyTDdTaFozVTBXaXhlRHlMSmwKeHkxNnBhcThVNFp0M1Zla3l2Z2dRUXRvOFBUN2RMNVdYWHA1OWZrZGhlTXRsYjcxY1pCRHpJMGZtZ0FLaHlucApWU0pZQUNQcTR4SkRLVnRIQ04yTVFXcGxCcWpsSWFwQnRKVWhsYmw5MFRTckU5YXR2TnppUFRuTnZUNTFjS0VZCldRUEpJclNQbk5WZUt0ZWx0dFFLYmZpM1FCRkdtaDk1RG1LL0Q1ZnM0QzhmRjVRPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - ``` - -5. **Bring Your Own Certificate only:** Scroll to the codeblock that follows. - - ``` - apiVersion: v1 - kind: Secret - metadata: - name: cattle-keys-ingress - namespace: cattle-system - type: Opaque - data: - tls.crt: # ssl cert for ingress. If selfsigned, must be signed by same CA as cattle server - tls.key: # ssl key for ingress. If selfsigned, must be signed by same CA as cattle server - ``` - - Replace each placeholder with the applicable `.pem`. - - >**Important:** - > - > - Each `.pem` must be in base-64: `cat | base64` - > - If you're using a self-signed certificate, both `cattle-keys-server` and `cattle-keys-ingress` must use certificates and keys signed by the same CA. - - - `` - - `` - - **Example:** - - ``` - apiVersion: v1 - kind: Secret - metadata: - name: cattle-keys-ingress - namespace: cattle-system - type: Opaque - data: - tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZYVENDQkVXZ0F3SUJBZ0lKQU5QTE5EZnJoL2gzTUEwR0NTcUdTSWIzRFFFQkN3VUFNSUhHTVFzd0NRWUQKVlFRR0V3SlZVekVRTUE0R0ExVUVDQk1IUVhKcGVtOXVZVEVUTUJFR0ExVUVCeE1LVTJOdmRIUnpaR0ZzWlRFbApNQ01HQTFVRUNoTWNVM1JoY21acFpXeGtJRlJsWTJodWIyeHZaMmxsY3l3Z1NXNWpMakV6TURFR0ExVUVDeE1xCmFIUjBjRG92TDJObGNuUnpMbk4wWVhKbWFXVnNaSFJsWTJndVkyOXRMM0psY0c5emFYUnZjbmt2TVRRd01nWUQKVlFRREV5dFRkR0Z5Wm1sbGJHUWdVMlZqZFhKbElFTmxjblJwWm1sallYUmxJRUYxZEdodmNtbDBlU0F0SUVjeQpNQjRYRFRFM01EZ3hPREU0TVRnd01Wb1hEVEl3TURneE9ERTRNVEV3TUZvd1BURWhNQjhHQTFVRUN4TVlSRzl0CllXbHVJRU52Ym5SeWIyd2dWbUZzYVdSaGRHVmtNUmd3RmdZRFZRUUREQThxTG5KaGJtTm9aWEl1YzNCaFkyVXcKZ2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLQW9JQkFRRFF6aW81TDhMYTFya0ZFQVR4SXZBbQpVdTJHUnYwQVZsZTI2RjdsN3I1VEhoUDZPUWZUK2R2S01hU3Q3aWEyK3VuZEl3cGlkWENGLy9TVklXTEsxKzFQCmZ1blFaQy8yaUhnQ1N0Smk2U0JHUXFhekFrVUhpOG1oMVVCUHdkNmtBTi9KNGtCWEJ5aGxtZGRzT2hDeXpuSTgKTE5RdzBFeDcyUEZRMnh1Qm9KNWIvOEdCMnhkMC8yU0V0bmdmaWFzTk9wOEYxY2JQSVpGdm5FMDlaR3ljWWszSgpUSU9NdjNXME9xYVg4OEQ3K29oM0R0V05Bc0Jlc01ZVlBhUmxyTkJhUXFjemg3VEhZcUR0OGIyRUdmNXBxS2pFCm5pSVY5Yk9PUlpab2xrZzlzQUFHcWF5SjVJS3Q2YmNtVENIYXRBcGpRZ3NWWjk5QnRZQzZiSWFudXRDWllUOVoKQWdNQkFBR2pnZ0hVTUlJQjBEQU1CZ05WSFJNQkFmOEVBakFBTUIwR0ExVWRKUVFXTUJRR0NDc0dBUVVGQndNQgpCZ2dyQmdFRkJRY0RBakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdQQVlEVlIwZkJEVXdNekF4b0MrZ0xZWXJhSFIwCmNEb3ZMMk55YkM1emRHRnlabWxsYkdSMFpXTm9MbU52YlM5elptbG5Nbk14TFRZeUxtTnliREJqQmdOVkhTQUUKWERCYU1FNEdDMkNHU0FHRy9XNEJCeGNCTUQ4d1BRWUlLd1lCQlFVSEFnRVdNV2gwZEhBNkx5OWpaWEowYVdacApZMkYwWlhNdWMzUmhjbVpwWld4a2RHVmphQzVqYjIwdmNtVndiM05wZEc5eWVTOHdDQVlHWjRFTUFRSUJNSUdDCkJnZ3JCZ0VGQlFjQkFRUjJNSFF3S2dZSUt3WUJCUVVITUFHR0htaDBkSEE2THk5dlkzTndMbk4wWVhKbWFXVnMKWkhSbFkyZ3VZMjl0THpCR0JnZ3JCZ0VGQlFjd0FvWTZhSFIwY0RvdkwyTmxjblJwWm1sallYUmxjeTV6ZEdGeQpabWxsYkdSMFpXTm9MbU52YlM5eVpYQnZjMmwwYjNKNUwzTm1hV2N5TG1OeWREQWZCZ05WSFNNRUdEQVdnQlFsClJZRm9VQ1k0UFRzdExMN05hdG0yUGJObVl6QXBCZ05WSFJFRUlqQWdnZzhxTG5KaGJtTm9aWEl1YzNCaFkyV0MKRFhKaGJtTm9aWEl1YzNCaFkyVXdIUVlEVlIwT0JCWUVGQnplTmxRNUI0dnVIQVcvQ3RPakN3ZTV2QVZkTUEwRwpDU3FHU0liM0RRRUJDd1VBQTRJQkFRQjhWRE1VU3JQbFIyVHdLbVl6bDg4Q1FMSUZRUWlpSEFhQkZ3T3FLNGxuCmRoSVpuZEtvOTFKTS9CY1lrWEtnN3BSVmhZMVdkdFQ2dUpoUnF2bWg3SHlWWS80VGdlK3UzTFVRYlNOeFdaamkKWEUxK3ptRUEvQ2lQSjRWMkg1dldhL0d4Z25yNVBrekhpSzM3VHJWWXgxOUpPa0NUcnhYd1A1b0MwZUorSHNpaApsZWJlVWtlbkJDNmtqbGRqelV5YldEWThMbnY3QVFydHhUdmQrWS9iQjFyMlVoOENSeXUyaDdlbVpzcTBVUHpuCml5R1E5OEcraEx6U0dESjRqcEdEUUIwc3k5R1gzYSt2RWlVanFTd3hlMkJkaTNPYUQxbDVYVlRiWjBSNnUydjAKWDdwVEtEcVBRaFRoWUJxdDJod3ducTBkWlRnUEdMWEZ3clZxemNrczdHK3kKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= # ssl cert for ingress. If selfsigned, must be signed by same CA as cattle server - tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBME00cU9TL0MydGE1QlJBRThTTHdKbEx0aGtiOUFGWlh0dWhlNWU2K1V4NFQramtICjAvbmJ5akdrcmU0bXR2cnAzU01LWW5Wd2hmLzBsU0ZpeXRmdFQzN3AwR1F2OW9oNEFrclNZdWtnUmtLbXN3SkYKQjR2Sm9kVkFUOEhlcEFEZnllSkFWd2NvWlpuWGJEb1FzczV5UEN6VU1OQk1lOWp4VU5zYmdhQ2VXLy9CZ2RzWApkUDlraExaNEg0bXJEVHFmQmRYR3p5R1JiNXhOUFdSc25HSk55VXlEakw5MXREcW1sL1BBKy9xSWR3N1ZqUUxBClhyREdGVDJrWmF6UVdrS25NNGUweDJLZzdmRzloQm4rYWFpb3hKNGlGZld6amtXV2FKWklQYkFBQnFtc2llU0MKcmVtM0prd2gyclFLWTBJTEZXZmZRYldBdW15R3A3clFtV0UvV1FJREFRQUJBb0lCQVFDNWFjamVuUVduTTdKNQp4MTdNRFYwNGVyMEdWblVFM3FibStYS0ROTHYycktmS3N1ZTdtSXhPQUVVZVdYSXhXNTlkU1dkSVJNYVZodEpWCnRwNjJSb1VvNlNhUWNOYVNVVjVYa3I4OUs0d0lOOWswN2RnRU9tSGlmYTJzNVJkaGhKRTBBTjluS0NqOEIxN2UKY0xVeFFkYjRqa29oeW1XUU4vVVkrbWR6ZFFBSjZmZjE2RGtxY3RGZkpONnhPSlFnM2h0L0E2NEl5OU8vL0ZRcgoxMnlDelJQT3ZCUnJjelBuM05qVm9mUkF1UVhreUR0bkVwSlVUa1c5OXVtTzQ0NS9qOU5RTDdIMnYvOU9rdjAyCnlPSWVaUDY2cVVoSGY2NmF1NlZ4NFRSOEdqQXhUcnZXSkJCVFB3eGw2bGhHWUd2UzAzQkdqVFN5WVByUnl0U2gKSEZweVpxSGRBb0dCQU9uTmE3TEVxTGdEaTVmMTRWNUlrei9VcC8zaVMxRkc4TlIyc240bHNPaVFXQWptUTg3TQpFNzhId0RIc013RFRUZjljbW9zdWlUakZqSUFWV0F5cFlvQnZiMzVQK2hHU05nTXYydUI5RUxScGxHeFBRRUlyCmJWS01ZNW9IbWZYTWhaRVZRbCtnZldGNHE5eFh0Ykc4cTFmTTBQNGxVK1VBdGpzQVduVjJNeGxYQW9HQkFPU2gKTUUxdjZBeHFpL2Q5Z0ZEWUZtb09ucGU2bjNhSktENlNld3hJazFzNFVEQllMSEpFb1FBT0NTdW9wZUVRUHM1RAo0STNPZXhSKys1YVp6R0ZpeUhhZDNPRGJBSVgzNVlseXg1UXNMa0FVNGZCZUZDR0p1Tm5jQk9jakxqelJYK3ljCmRUMFgyZ0RldUZadmxpTXVCUWJoMjNudkh4RnZXbFkvTXdOVm13N1BBb0dBTk5oZWVHaWs3ZnEzS2FERTBNZTgKcUpmTFpNSXFYZk9YNlozdW1ENnlyczQ1WjhHTUlBaldpYjRadmU3eVZFUnVnOEtObDlucjRDNGVwTEN1VnlaTwpBbE90c3JJbkJxT3ltNlBNYUNNOGpGcTAxb3BQTHVXYjd5V1dPYkZ3SmpPVkdRYmlHclV1d2NKQnJpc1JBVnh3CnFnYThVa1Zqb2dZNEtqdlpObVdDQlQ4Q2dZQnB6ZktsazRsRzNiUUNoOUR2R09GZW1YOXBabE5QcnUreDdXWUcKYkR2TmRrVWQ2bUEvVFdWWXVpWWlUenpjNkFDNHdnN1VjVjdpUUZXNy8xYm5KcWp3dytPcEo1Q1pidnlKM0ZWaQpUQVBuWWdLaGsxZ3JvU21yb0xlZ0k5Yk5ESFFnOHRNS3Y5UUNuUStmNktvSmc4Mk52czRzSXE0MUNsdzdGNnBLCis3M3pYd0tCZ1FDQm9JQWdHL1R4d3hDbytUODZNNWZOTlJJYkZBbWJOTzFRQ252Z1djSThCUGxzeS9STFFHNXIKdVpQUEJvYkluWWtuQU56NzlYRFBpM0R2MTFwUUlJaHdLdGtVVmRaL09lNnlZdUJvZWdEQVJMa2d6bytyTXRtdApLWUVHL3NwMjVNUGlwMkdFd3p2RUc4aHlaZHRMbGNNcFUrQTdVMmpWd1lUMWNaL2lNQkVQckE9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo= # ssl key for ingress. If selfsigned, must be signed by same CA as cattle server - ``` -6. Save the `.yml` file and close it. - -## Run RKE - -Enter the command to run RKE while pointing to your `.yml` file. RKE will install Kubernetes and Rancher using your parameters. - -1. From your workstation, make sure your `.yml` file and RKE are in the same directory. - -2. Open a Terminal instance. Change to the directory that contains your `.yml` and RKE. - -3. Enter the one of the following commands, depending on the name of your `.yml` file: - - - `rke up --config rancher-minimal-passthrough.yml` - - `rke up --config rancher-minimal-ssl.yml` diff --git a/content/rancher/installation/server-installation/rke-install.md b/content/rancher/installation/server-installation/rke-install.md new file mode 100644 index 00000000000..8a3220daa20 --- /dev/null +++ b/content/rancher/installation/server-installation/rke-install.md @@ -0,0 +1,223 @@ +--- +title: Option 2—Install by RKE +weight: 275 +--- +# Install by RKE + +You can deploy Rancher using the Rancher Kubernetes Engine (RKE). RKE is Rancher's own fast and light-weight Kubernetes installer. Rancher installation using RKE is the best install option for two different use cases: + +- When installing Rancher on a Kubernettes cluster that is already running. + +- When you want to set up a new production Kubernettes cluster running in a high-availablity configuration. + + +## Objectives + +We've broken installation of Rancher by RKE into a series of smaller tasks. Here's what you'll do during your RKE install. + +1. [Provision Linux Hosts](#provision-linux-hosts) + + Begin by provisioning Linux hosts or an existing Kubernettes cluster. Make sure your hosts meet Rancher requirements. + +2. [Get RKE](#get-rke) + + Download the RKE installer from GitHub. + +3. [Get YAML Template](#get-yaml-template) + + During installation, the RKE uploads a `.yml` config file containing specifications for your cluster. You'll have to configure this file. We have a variety of config file templates available for download. + +4. [Edit YAML Template](#edit-yaml-template) + + After you download a config file template, edit it according to how you want to configure Rancher and your Kubernetes cluster. + +5. [Run RKE](#run-rke) + + Finally, run the RKE installer with it pointing toward your config file. + +### Provision Linux Hosts + +Before you install Rancher, confirm you meet the requirements. + +- If you want to install Rancher on a Kubernettes cluster that's already running, make sure its nodes meet the requirements below. + +- If you want to install Rancher on a new Kubernettes cluster in a high-availabilty configuration, provision three new Linux hosts using the requirements below. + +#### Requirements + +{{< requirements_os >}} + +{{< requirements_hardware >}} + +{{< requirements_software >}} + +{{< requirements_ports >}} + +{{< requirements_ha >}} + +### Get RKE + +Rancher Kubernetes Engine (RKE) is a fast, versatile Kubernetes installer you can use to install Kubernetes on your Linux hosts. You can download RKE from GitHub. + +1. From your workstation, open a web browser and navigate to [https://github.com/rancher/rke/releases](https://github.com/rancher/rke/releases). Download the latest RKE installer. + +2. Make the RKE binary that you just downloaded executable. Open Terminal, change directory to the location of the RKE binary, and then run the following command: + + ``` + $ chmod +x rke + ``` + + >**Note:** adjust the command for the version of RKE that you downloaded (e.g., `rke_darwin-amd64`) + +3. Confirm that RKE is now executable by running the following command: + + ``` + $ ./rke -version + ``` + +**Result:** You receive output similar to what follows: +``` +rke version v +``` + +### Get YAML Template + +During installation, RKE uploads a `.yml` config file to install and configure your Kubernetes cluster. Download one of the `.yml` templates that we provide to get you started. Choose a template based on how many nodes are in your cluster and the type of certificate you plan on using: + +- Auto-Generated Self-Signed Certifcates (i.e. SSL passthrough): + + - [3-node-passthrough.yml]({{< baseurl >}}/rke-yml/3-node-passthrough.yml) + - [5-node-passthrough.yml]({{< baseurl >}}/rke-yml/5-node-passthrough.yml) + - [7-node-passthrough.yml]({{< baseurl >}}/rke-yml/7-node-passthrough.yml) +
+
+- Bring Your Own Certificate (either CA- or Self-Signed): + + - [3-node-certificate.yml]({{< baseurl >}}/rke-yml/3-node-certificate.yml) + - [5-node-certificate.yml]({{< baseurl >}}/rke-yml/5-node-certificate.yml) + - [7-node-certificate.yml]({{< baseurl >}}/rke-yml/7-node-certificate.yml) + +### Edit YAML Template + +Once you have a template, customize it to suit your needs. + +1. Open the `.yml` file that you just downloaded. + +2. Update the `nodes` section with your [Linux hosts](#provision-linux-hosts). + + 1. For each node in your cluster, update the following placeholders: + + - ``: The IP address or hostname of the node. + - ``: The node root user (usually `root`). + - ``: The path of the `.pem` file used to authenticate. + + 2. For each node in your cluster, choose what roles each node should fill. Delete any roles that aren't needed on the node. + + **Example YAML** + + nodes: + - address: # IP to access nodes + user: # root user (usually 'root') + role: [controlplane,etcd,worker] # K8s roles for node + ssh_key_path: # path to PEM file + - address: + user: + role: [controlplane,etcd,worker] + ssh_key_path: + - address: + user: + role: [controlplane,etcd,worker] + ssh_key_path: + +3. Scroll to `kind: Ingress`. Replace the two `` placeholders with the FQDN mapped to each IP address for `controlplane` and/or `worker` nodes on your DNS. On your DNS Server, each node should be added to the DNS entry for the FQDN. + + **Example YAML** + + spec: + rules: + - host: # FQDN to access cattle server + http: + paths: + - backend: + serviceName: cattle-service + servicePort: 80 + tls: + - secretName: cattle-keys-ingress + hosts: + - # FQDN to access cattle server + + + >**Using Auto-Generated Self-Signed Certificates?** + > + >The next two steps don't apply to you. Save the `.yml` config file and continue to [Run RKE](#run-rke). + +4. **Bring Your Own Certificate only:** Scroll to the codeblock that follows. + + ``` + apiVersion: v1 + kind: Secret + metadata: + name: cattle-keys-server + namespace: cattle-system + type: Opaque + data: + cert.pem: # ssl cert for cattle server. + key.pem: # ssl key for cattle server. + cacerts.pem: # CA cert used to sign cattle server cert and key + ``` + + Replace each placeholder with the applicable `.pem`. + + - `` + - `` + - `` + + >**Important:** + > + > - Each `.pem` must be in base-64: `cat | base64` + > - If you're using a self-signed certificate, the `cattle-keys-server` in this step and `cattle-keys-ingress` in the next step must use certificates and keys signed by the same CA. + +5. **Bring Your Own Certificate only:** Scroll to the codeblock that follows. + + ``` + apiVersion: v1 + kind: Secret + metadata: + name: cattle-keys-ingress + namespace: cattle-system + type: Opaque + data: + tls.crt: # ssl cert for ingress. If selfsigned, must be signed by same CA as cattle server + tls.key: # ssl key for ingress. If selfsigned, must be signed by same CA as cattle server + ``` + + Replace each placeholder with the applicable `.pem`. + + - `` + - `` + + + >**Reminder:** + > + > - Each `.pem` must be in base-64: `cat | base64` + > If you're using a self-signed certificate, the `cattle-keys-server` from last step and `cattle-keys-ingress` from this step must use certificates and keys signed by the same CA. + +6. Save the `.yml` file and close it. + +### Run RKE + +Enter the command to run RKE while pointing to your `.yml` file. RKE will install Kubernetes and Rancher using your parameters. + +1. From your workstation, make sure your `.yml` config file and RKE are in the same directory. + +2. Open a Terminal instance. Change to the directory that contains your config file and RKE. + +3. Enter the following command, replacing the placeholder name with the name of the `.yml` config template that you used. + + ``` + rke up --config + ``` + +### What's Next? + +Log in to Rancher to make sure it deployed successfully. Open a web browser and navigate to the FQDN used earlier in this procedure. diff --git a/content/rancher/quick-start-guide/_index.md b/content/rancher/quick-start-guide/_index.md index e3278540138..580e507ca0e 100644 --- a/content/rancher/quick-start-guide/_index.md +++ b/content/rancher/quick-start-guide/_index.md @@ -17,115 +17,73 @@ This Quick Start Guide is divided into different tasks for easier consumption. 1. [Provision a Linux Host](#provision-a-linux-host) + Begin by provisioning a Linux host. -1. [Review Requirements](#host-and-node-requirements) +2. [Install Rancher](#install-rancher) - Before you do anything, review the requirements. + From your Linux host, run the Docker command for installing Rancher. -2. [Prepare a Linux Host](#prepare-a-linux-host) +3. [Log In](#log-in) - First, you need to provision a Linux host. + Browse to your Linux host to access the Rancher UI. -3. [Install Rancher](#install-rancher) +4. [Create the Cluster](#create-the-cluster) - Run the Docker command for installing Rancher. + Use the versatile **Custom** option to clone your Linux host into a new Kubernetes cluster. -4. [Log In](#log-in) +5. [Deploy a Workload](#deploy-a-workload) - Browse to your Linux host to access the Rancher UI. + Create a workload so that Kubernetes can distribute NGINX among your cluster nodes. -5. [Create a Cluster](#create-a-cluster) +6. [View Your Application](#view-your-application) - Use Rancher to create your first cluster. + When your workload finishes deployment, browse to your node IP to make sure NGINX is running. -6. [Deploy a Workload](#deploy-a-workload) +7. [What's Next?](#whats-next) - Create a workload so that Kubernetes can distribute an application and its dependencies among your nodes. + Now that you've created a cluster and deployed NGINX, find out what else you can do with Rancher v2.0. -7. [View Your Application](#view-your-application) +## Provision a Linux Host - When your workload finishes deployment, browse to your application to make sure it works. - -8. [What's Next?](#whats-next) - - Now that you've created a cluster and deployed a workload, find out what else you can do with Rancher v2.0. +Begin creation of a custom cluster by provisioning a Linux host. Your host can be: +- A cloud-host virtual machine (VM) +- An on-premise VM +- A bare-metal server Provision the host according to the requirements below. #### Hardware Requirements -- Memory: 4GB +- Memory: 4GB #### Software requirements -- Operating System: Ubuntu 16.04 (64-bit) -- Software: Docker +- Operating System: Ubuntu 16.04 (64-bit) +- Software: Docker - **Supported Versions:** + **Supported Versions:** - - `1.12.6` - - `1.13.1` - - `17.03.2` + - `1.12.6` + - `1.13.1` + - `17.03.2` - >**Notes:** - > - > * For Docker installation instructions, visit their [documentation](https://docs.docker.com/install/). - > * Docker requirements apply to both your Linux host and your cluster nodes. - -#### Port Requirements - -When provisioning your Linux host, open the ports listed below so that your master and worker nodes can communicate. - -##### Master Nodes (etcd and controlplane nodes) - -Protocol | Direction | Port Range | Purpose ---|---|---|-- -TCP | Inbound | 22 | SSH server -TCP | Inbound | 80 | Canal -TCP | Inbound | 443 | Canal -TCP | Inbound | 6443 | Kubernetes API server -TCP | Inbound | 2379-2380 | etcd server client API -TCP | Inbound | 10250 | kubelet API -TCP | Inbound | 10251 | scheduler -TCP | Inbound | 10252 | controller -TCP | Inbound | 10256 | kubeproxy - -##### Worker Nodes - -Protocol | Direction | Port Range | Purpose ---|---|---|-- -TCP | Inbound | 22 | SSH Server -TCP | Inbound | 80 | Canal -TCP | Inbound | 443 | Canal -TCP | Inbound | 10250 | kubelet API -TCP | Inbound | 10256 | kubeproxy -TCP | Inbound | 30000-32767 | NodePort Services - -### Prepare a Linux Host - -Begin by provisioning a Linux host to be your Rancher server and a template for your cluster nodes. This host can be: - -- A virtual machine hosted by a cloud service. -- An on-premise virtual machine. -- An on-premise bare-metal server. - -Provision the server according to the [requirements above](#host-and-node-requirements). + >**Notes:** + > + > * For Docker installation instructions, visit their [documentation](https://docs.docker.com/install/). + > * Docker requirements apply to both your Linux host and your cluster nodes. ### Install Rancher To install Rancher on your host, connect to it and then use a shell to install. -1. Log in to your Linux host using your preferred shell, such as PuTTy or a remote Terminal connection. +1. Log in to your Linux host using your preferred shell, such as PuTTy or a remote Terminal connection. -2. From your shell, enter the following command: +2. From your shell, enter the following command: - ``` - $ sudo docker run -d --restart=unless-stopped -p 80:80 -p 443:443 rancher/server:preview - ``` - - >**Note:** - > Although Rancher v2.0 is in beta, the `preview` tag is still used for installation. + ``` + $ sudo docker run -d --restart=unless-stopped -p 80:80 -p 443:443 rancher/server + ``` **Result:** Rancher is installed. @@ -133,106 +91,43 @@ To install Rancher on your host, connect to it and then use a shell to install. Log in to Rancher to begin using the application. After you log in, you'll make some one-time configurations. -1. Open a web browser and enter the IP address of your host: +1. Open a web browser and enter the IP address of your host: - `https://` + `https://` - Replace `` with your host IP address. + Replace `` with your host IP address. - > **Note:** Rancher v2.0 beta: - > - > - Supports only the HTTPS protocol. - > - Uses a self-signed certificate. Due to this signature, the browser prompts you to trust the certificate before login. Following GA, you'll be able to use your own certificate. - -2. When prompted, create a password for the default `admin` account there cowpoke! +2. When prompted, create a password for the default `admin` account there cowpoke! 3. Set the **Rancher Server URL**. The URL can either be an IP address or a host name. However, each node in your cluster must be able to resolve to the URL. - ![login](../../../../img/rancher/server-url.png) +## Create the Cluster Welcome to {{< product >}}! Use our application to clone your Linux host and configure them as a Kubernetes cluster. In this task, use the versatile **Custom** option. This option lets you convert _any_ Linux host (cloud-hosted VM, on-premise VM, or bare-metal) into a cluster. -1. Click **+ Add Cluster**. +1. From the **Clusters** page, click **Add Cluster**. - ![add cluster](../../../../img/rancher/click-add-cluster.png) +2. Choose **Custom**. - **Step Result:** The **Add Cluster** page opens. +3. Enter a **Cluster Name**. -2. From the **Add Cluster** menu, choose a service or source from which to create your first cluster. +4. Skip **Member Roles** and **Cluster Options**. We'll tell you about them later. - * If you're using a virtual machine hosted on a major cloud service, choose the tile for the service you want to use (e.g. **Digital Ocean**, **Azure Container Service**). - * If you're using bare-metal server, an on-premise virtual machine, or a cloud service that isn't explicitly listed, choose **Custom**. +5. Click **Next**. - > **Note:** - > - > - For Rancher v2.0 beta, Amazon EKS is not supported. This option will be available after GA. - > - For this tutorial, the Import option is out of scope. For now, create a cluster using one of the other options. We'll address Import later. +6. From **Node Role**, select _all_ the roles: **etcd**, **Control**, and **Worker**. -3. Enter a **Cluster Name**. No spaces allowed. +7. Skip the **Labels** stuff. It's not important for now. - > **Tip:** Skip adding **Member Roles** for now. This option isn't essential for your first cluster. - > - > ![skip member roles](../../../../img/rancher/skip-member-roles.png) +8. Copy the command displayed on screen to your clipboard. -4. **For those using Google Container Engine or Azure Container Service:** +9. Log in to your Linux host using your preferred shell, such as PuTTy or a remote Terminal connection. Run the command copied to your clipboard. - Complete the form asking for account information. The form includes links to instructions detailing how to obtain this info. +10. When you finish running the command on your Linux host, click **Done**. - ![gce-azure-instructions](../../../../img/rancher/gce-azure-instructions.png) - - **Did you choose one of the other tiles (like Digital Ocean)?** This step doesn't apply to you. Skip to the next step. - -5. Select **Cluster Options**. - - Use these options to choose things like the version of Kubernetes that's installed in your cluster, along with other Kubernetes options such as pod security policies. Some services have more options than others. If you're unsure of what to choose, use the default options. - -6. Add at least one **Node Pool**. - - A *Node Pool* is a group of nodes that are configured identically. Your cluster can contain as many node pools as you'd like. Each object in the grid represents a single node configuration. You can use the node pool to choose the number (i.e. **Count**) of nodes running a given configuration (i.e. **Template**). - - > **Note:** The instructions below don't apply to Google Container Engine, Azure Container Service, or the Custom option. - > - >* For Azure Container Server, no additional steps are needed. Proceed to this task's [final step](#create-cluster). - >* For Google Container Engine, complete the Nodes form. The options are pretty self-explanatory. When you're done, proceed to this task's [final step](#create-cluster). - >* For Custom, see [Appendix A: Add Custom Cluster](#appendix-a-add-custom-cluster). - - 1. Enter a **Node Prefix**. When the cluster is created, each node in the pool is named after the prefix. An incremented number is appended to each node. - - 2. Enter the node **Count** for the pool. - - 3. Click **Add Node Template**. A node template is just the a virtual machine configuration you're using to create your nodes (i.e. other virtual machines). - - Depending on the cluster option that you choose, the Rancher UI displays instructions on how to create a template. The process is different for each cloud service. You may need to log in to your cloud service to find the data Rancher needs. - - 4. Choose the **Template** that you just added. - - ![choose template](../../../../img/rancher/choose-template.gif) - - 5. Select roles for the node pool. - - Kubernetes functions using different [components](https://kubernetes.io/docs/concepts/overview/components/), which are divided into *master components* and *node components*. When setting up your node pool, select a pool to fill each component role. You can install all components one a single pool, or you can spread them around. - - The roles are: - - - **etcd**: One of the master components. Etcd is a distributed reliable key-value store that stores all Kubernetes states. - - - **Control**: The remaining master components as well as the node components. These nodes help manage the Kubernetes cluster and where your applications can be launched. - - - **Worker**: On these nodes, only node components are launched. These nodes run only applications. - - 6. **Optional:** Click **+ Add Node Pool** to add more pools. - - ![add-second-node-pool](../../../../img/rancher/add-second-node-pool.gif) - - 7. Click **Create**. - -**Result:** - -- Your cluster is created and assigned a state of **Provisioning**. Rancher is standing up your cluster. -- You can access your cluster after its state is updated to **Active**. -- **Active** clusters are assigned a **Project** and **Namespace**, both of which are named `Default`. +{{< result_create-cluster >}} ### Deploy a Workload @@ -256,11 +151,11 @@ For this workload, you'll be deploying the application NGINX. 7. From **Port Mapping**, click **Add Port**. - ![enter-docker-image](../../../../img/rancher/enter-docker-image.png) +8. From the **Publish on** drop-down, make sure that **Every node** is selected. 8. From the **Source Port** field, leave the **Random** value in place. - >**Note:** During Rancher v2.0 beta, only port 80 is supported. Other ports will be supported at GA. +7. From the **Container Port** field, enter port `80`. 8. Leave the remaining options on their default setting. We'll tell you about them later. @@ -281,116 +176,5 @@ From the **Workloads** page, click the link underneath your workload. If your de Congratulations! You have: -- Created your first cluster. -- Deployed an application to your cluster using a workload. - -Now you can use the rest of Rancher v2.0 to orchestrate and manage your pods. - -(Moooooo-re coming soon!) - -![cow](../../../../img/rancher/cow.jpg) - - -### Appendix A: Add Custom Cluster - -When creating a custom cluster, follow these instructions to complete its creation. These instructions will create one or more node that will be used to image your cluster. - ->**Note:** When creating a custom cluster, make sure each node meets the [Host Requirements](#host-requirements). - -1. From **Node Roles**, choose the Kubernetes component roles that you want the node to fill. You must fill each role. - - A more detailed description of each [role](#roles) is available earlier in this guide. - - >**Note:** If you want to spread the roles among different nodes, provision additional Linux hosts and enter the command on each of your nodes. - -3. **Optional:** Add labels to the node template. - -4. Copy the command for installing Docker to your clipboard. - - >**Remember:** The version of Docker installed on your nodes must be [supported](#node-requirements). - -5. Log in to your Linux host using your preferred shell, such as PuTTy or a remote Terminal connection. - -6. Enter the command on your Linux host. - -7. From you Rancher session, click **Done**. - -8. Resume the Quick Start Guide from [Deploy a Workload](#deploy-a-workload). - - +- Created your first cluster. +- Deployed NGINX to your cluster using a workload. diff --git a/layouts/shortcodes/requirements_ha.html b/layouts/shortcodes/requirements_ha.html index 1504015c10c..f9e7665f88a 100644 --- a/layouts/shortcodes/requirements_ha.html +++ b/layouts/shortcodes/requirements_ha.html @@ -1,5 +1,5 @@
-

High Availablity Requirements

+

High Availablity Requirements

  • RKE Cluster
      • diff --git a/layouts/shortcodes/requirements_hardware.html b/layouts/shortcodes/requirements_hardware.html index bbcfaa73af2..5ea4f6ef049 100644 --- a/layouts/shortcodes/requirements_hardware.html +++ b/layouts/shortcodes/requirements_hardware.html @@ -1,5 +1,5 @@
      -

      Hardware Requirements

      +

      Hardware Requirements

      • Memory: 4GB
      diff --git a/layouts/shortcodes/requirements_os.html b/layouts/shortcodes/requirements_os.html index 398033ad65d..99fe9232434 100644 --- a/layouts/shortcodes/requirements_os.html +++ b/layouts/shortcodes/requirements_os.html @@ -1,5 +1,5 @@
      -

      Operating System Requirements

      +

      Operating System Requirements

      • Ubuntu 16.04 (64-bit)
      • Red Hat Enterprise Linux 7.5 (64-bit)
        • diff --git a/layouts/shortcodes/requirements_ports.html b/layouts/shortcodes/requirements_ports.html index 31eb9a5dfc3..f88ec957497 100644 --- a/layouts/shortcodes/requirements_ports.html +++ b/layouts/shortcodes/requirements_ports.html @@ -1,48 +1,59 @@
        -

        Master Nodes (etcd and controlplane nodes)

        -
        +
        Port Requirements
        +
        Master Nodes (etcd and controlplane nodes)
        - - - + - - - - - - - - + + - + + - + + - + + - + + + + + + + + + + + + + + + + + @@ -52,38 +63,65 @@
        protocoldirection port range purpose
        tcpinboundtcp 22 ssh server
        80http
        443https
        tcp 6443 kubernetes api server
        tcp 2379-2380 etcd server client api
        tcp 10250 kubelet api
        tcp 10251 scheduler
        tcp 10252controllerkube-controller-manager
        tcp10253federation
        tcp10254ingress
        tcp10255read-only kubelet api
        tcp 10256 kubeproxy
        canal
        -

        Worker Nodes

        -
        +
        Worker Nodes
        - - - - + + + - - + + - + + - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/layouts/shortcodes/requirements_software.html b/layouts/shortcodes/requirements_software.html index ae6d4f989cd..6c746fa5268 100644 --- a/layouts/shortcodes/requirements_software.html +++ b/layouts/shortcodes/requirements_software.html @@ -1,5 +1,5 @@
        -

        Software Requestions

        +

        Software Requestions

        • Docker

          diff --git a/src/rke-yml/3-node-certificate.yml b/src/rke-yml/3-node-certificate.yml new file mode 100644 index 00000000000..8c2dd66f7e9 --- /dev/null +++ b/src/rke-yml/3-node-certificate.yml @@ -0,0 +1,137 @@ +# default k8s version: v1.8.9-rancher1-1 +# default network plugin: flannel +nodes: + - address: # hostname or IP to access nodes + user: # root user (usually 'root') + role: [controlplane,etcd,worker] # K8s roles for node + ssh_key_path: # path to PEM file + - address: + user: + role: [controlplane,etcd,worker] + ssh_key_path: + - address: + user: + role: [etcd,worker] + ssh_key_path: + +addons: |- + --- + kind: Namespace + apiVersion: v1 + metadata: + name: cattle-system + --- + kind: ServiceAccount + apiVersion: v1 + metadata: + name: cattle-admin + namespace: cattle-system + --- + kind: ClusterRoleBinding + apiVersion: rbac.authorization.k8s.io/v1 + metadata: + name: cattle-crb + namespace: cattle-system + subjects: + - kind: ServiceAccount + name: cattle-admin + namespace: cattle-system + roleRef: + kind: ClusterRole + name: cluster-admin + apiGroup: rbac.authorization.k8s.io + --- + apiVersion: v1 + kind: Secret + metadata: + name: cattle-keys-ingress + namespace: cattle-system + type: Opaque + data: + tls.crt: # ssl cert for ingress. If selfsigned, must be signed by same CA as cattle server + tls.key: # ssl key for ingress. If selfsigned, must be signed by same CA as cattle server + --- + apiVersion: v1 + kind: Secret + metadata: + name: cattle-keys-server + namespace: cattle-system + type: Opaque + data: + cert.pem: # ssl cert for cattle server. + key.pem: # ssl key for cattle server. + cacerts.pem: # CA cert used to sign cattle server cert and key + --- + apiVersion: v1 + kind: Service + metadata: + namespace: cattle-system + name: cattle-service + labels: + app: cattle + spec: + ports: + - port: 80 + targetPort: 80 + protocol: TCP + name: http + - port: 443 + targetPort: 443 + protocol: TCP + name: https + selector: + app: cattle + --- + apiVersion: extensions/v1beta1 + kind: Ingress + metadata: + namespace: cattle-system + name: cattle-ingress-http + annotations: + nginx.ingress.kubernetes.io/proxy-connect-timeout: "30" + nginx.ingress.kubernetes.io/proxy-read-timeout: "1800" # Max time in seconds for ws to remain shell window open + nginx.ingress.kubernetes.io/proxy-send-timeout: "1800" # Max time in seconds for ws to remain shell window open + spec: + rules: + - host: # FQDN to access cattle server + http: + paths: + - backend: + serviceName: cattle-service + servicePort: 80 + tls: + - secretName: cattle-keys-ingress + hosts: + - # FQDN to access cattle server + --- + kind: Deployment + apiVersion: extensions/v1beta1 + metadata: + namespace: cattle-system + name: cattle + spec: + replicas: 1 + template: + metadata: + labels: + app: cattle + spec: + serviceAccountName: cattle-admin + containers: + - image: rancher/rancher:master + imagePullPolicy: Always + name: cattle-server + ports: + - containerPort: 80 + protocol: TCP + - containerPort: 443 + protocol: TCP + volumeMounts: + - mountPath: /etc/rancher/ssl + name: cattle-keys-volume + readOnly: true + volumes: + - name: cattle-keys-volume + secret: + defaultMode: 420 + secretName: cattle-keys-server diff --git a/src/rke-yml/3-node-passthrough.yml b/src/rke-yml/3-node-passthrough.yml new file mode 100644 index 00000000000..8f88ca78473 --- /dev/null +++ b/src/rke-yml/3-node-passthrough.yml @@ -0,0 +1,110 @@ +# default k8s version: v1.8.9-rancher1-1 +# default network plugin: flannel + +nodes: + - address: # hostname or IP to access nodes + user: # root user (usually 'root') + role: [controlplane,etcd,worker] # K8s roles for node + ssh_key_path: # path to PEM file + - address: + user: + role: [controlplane,etcd,worker] + ssh_key_path: + - address: + user: + role: [etcd,worker] + ssh_key_path: + +ingress: + provider: nginx + extra_args: + enable-ssl-passthrough: "" + +addons: |- + --- + kind: Namespace + apiVersion: v1 + metadata: + name: cattle-system + --- + kind: ServiceAccount + apiVersion: v1 + metadata: + name: cattle-admin + namespace: cattle-system + --- + kind: ClusterRoleBinding + apiVersion: rbac.authorization.k8s.io/v1 + metadata: + name: cattle-crb + namespace: cattle-system + subjects: + - kind: ServiceAccount + name: cattle-admin + namespace: cattle-system + roleRef: + kind: ClusterRole + name: cluster-admin + apiGroup: rbac.authorization.k8s.io + --- + apiVersion: v1 + kind: Service + metadata: + namespace: cattle-system + name: cattle-service + labels: + app: cattle + spec: + ports: + - port: 80 + targetPort: 80 + protocol: TCP + name: http + - port: 443 + targetPort: 443 + protocol: TCP + name: https + selector: + app: cattle + --- + apiVersion: extensions/v1beta1 + kind: Ingress + metadata: + namespace: cattle-system + name: cattle-ingress-http + annotations: + nginx.ingress.kubernetes.io/proxy-connect-timeout: "30" + nginx.ingress.kubernetes.io/proxy-read-timeout: "1800" # Max time in seconds for ws to remain shell window open + nginx.ingress.kubernetes.io/proxy-send-timeout: "1800" # Max time in seconds for ws to remain shell window open + nginx.ingress.kubernetes.io/ssl-passthrough: "true" # Enable ssl-passthrough to backend. + spec: + rules: + - host: # FQDN to access cattle server + http: + paths: + - backend: + serviceName: cattle-service + servicePort: 443 + --- + kind: Deployment + apiVersion: extensions/v1beta1 + metadata: + namespace: cattle-system + name: cattle + spec: + replicas: 1 + template: + metadata: + labels: + app: cattle + spec: + serviceAccountName: cattle-admin + containers: + - image: rancher/rancher:master + imagePullPolicy: Always + name: cattle-server + ports: + - containerPort: 80 + protocol: TCP + - containerPort: 443 + protocol: TCP diff --git a/src/rke-yml/5-node-certificate.yml b/src/rke-yml/5-node-certificate.yml new file mode 100644 index 00000000000..8144210cc2d --- /dev/null +++ b/src/rke-yml/5-node-certificate.yml @@ -0,0 +1,145 @@ +# default k8s version: v1.8.9-rancher1-1 +# default network plugin: flannel +nodes: + - address: # hostname or IP to access nodes + user: # root user (usually 'root') + role: [controlplane,etcd,worker] # K8s roles for node + ssh_key_path: # path to PEM file + - address: + user: + role: [controlplane,etcd,worker] + ssh_key_path: + - address: + user: + role: [etcd,worker] + ssh_key_path: + - address: + user: + role: [etcd,worker] + ssh_key_path: + - address: + user: + role: [etcd,worker] + ssh_key_path: + +addons: |- + --- + kind: Namespace + apiVersion: v1 + metadata: + name: cattle-system + --- + kind: ServiceAccount + apiVersion: v1 + metadata: + name: cattle-admin + namespace: cattle-system + --- + kind: ClusterRoleBinding + apiVersion: rbac.authorization.k8s.io/v1 + metadata: + name: cattle-crb + namespace: cattle-system + subjects: + - kind: ServiceAccount + name: cattle-admin + namespace: cattle-system + roleRef: + kind: ClusterRole + name: cluster-admin + apiGroup: rbac.authorization.k8s.io + --- + apiVersion: v1 + kind: Secret + metadata: + name: cattle-keys-ingress + namespace: cattle-system + type: Opaque + data: + tls.crt: # ssl cert for ingress. If selfsigned, must be signed by same CA as cattle server + tls.key: # ssl key for ingress. If selfsigned, must be signed by same CA as cattle server + --- + apiVersion: v1 + kind: Secret + metadata: + name: cattle-keys-server + namespace: cattle-system + type: Opaque + data: + cert.pem: # ssl cert for cattle server. + key.pem: # ssl key for cattle server. + cacerts.pem: # CA cert used to sign cattle server cert and key + --- + apiVersion: v1 + kind: Service + metadata: + namespace: cattle-system + name: cattle-service + labels: + app: cattle + spec: + ports: + - port: 80 + targetPort: 80 + protocol: TCP + name: http + - port: 443 + targetPort: 443 + protocol: TCP + name: https + selector: + app: cattle + --- + apiVersion: extensions/v1beta1 + kind: Ingress + metadata: + namespace: cattle-system + name: cattle-ingress-http + annotations: + nginx.ingress.kubernetes.io/proxy-connect-timeout: "30" + nginx.ingress.kubernetes.io/proxy-read-timeout: "1800" # Max time in seconds for ws to remain shell window open + nginx.ingress.kubernetes.io/proxy-send-timeout: "1800" # Max time in seconds for ws to remain shell window open + spec: + rules: + - host: # FQDN to access cattle server + http: + paths: + - backend: + serviceName: cattle-service + servicePort: 80 + tls: + - secretName: cattle-keys-ingress + hosts: + - # FQDN to access cattle server + --- + kind: Deployment + apiVersion: extensions/v1beta1 + metadata: + namespace: cattle-system + name: cattle + spec: + replicas: 1 + template: + metadata: + labels: + app: cattle + spec: + serviceAccountName: cattle-admin + containers: + - image: rancher/rancher:master + imagePullPolicy: Always + name: cattle-server + ports: + - containerPort: 80 + protocol: TCP + - containerPort: 443 + protocol: TCP + volumeMounts: + - mountPath: /etc/rancher/ssl + name: cattle-keys-volume + readOnly: true + volumes: + - name: cattle-keys-volume + secret: + defaultMode: 420 + secretName: cattle-keys-server diff --git a/src/rke-yml/5-node-passthrough.yml b/src/rke-yml/5-node-passthrough.yml new file mode 100644 index 00000000000..9031a42bccd --- /dev/null +++ b/src/rke-yml/5-node-passthrough.yml @@ -0,0 +1,118 @@ +# default k8s version: v1.8.9-rancher1-1 +# default network plugin: flannel + +nodes: + - address: # hostname or IP to access nodes + user: # root user (usually 'root') + role: [controlplane,etcd,worker] # K8s roles for node + ssh_key_path: # path to PEM file + - address: + user: + role: [controlplane,etcd,worker] + ssh_key_path: + - address: + user: + role: [etcd,worker] + ssh_key_path: + - address: + user: + role: [etcd,worker] + ssh_key_path: + - address: + user: + role: [etcd,worker] + ssh_key_path: + +ingress: + provider: nginx + extra_args: + enable-ssl-passthrough: "" + +addons: |- + --- + kind: Namespace + apiVersion: v1 + metadata: + name: cattle-system + --- + kind: ServiceAccount + apiVersion: v1 + metadata: + name: cattle-admin + namespace: cattle-system + --- + kind: ClusterRoleBinding + apiVersion: rbac.authorization.k8s.io/v1 + metadata: + name: cattle-crb + namespace: cattle-system + subjects: + - kind: ServiceAccount + name: cattle-admin + namespace: cattle-system + roleRef: + kind: ClusterRole + name: cluster-admin + apiGroup: rbac.authorization.k8s.io + --- + apiVersion: v1 + kind: Service + metadata: + namespace: cattle-system + name: cattle-service + labels: + app: cattle + spec: + ports: + - port: 80 + targetPort: 80 + protocol: TCP + name: http + - port: 443 + targetPort: 443 + protocol: TCP + name: https + selector: + app: cattle + --- + apiVersion: extensions/v1beta1 + kind: Ingress + metadata: + namespace: cattle-system + name: cattle-ingress-http + annotations: + nginx.ingress.kubernetes.io/proxy-connect-timeout: "30" + nginx.ingress.kubernetes.io/proxy-read-timeout: "1800" # Max time in seconds for ws to remain shell window open + nginx.ingress.kubernetes.io/proxy-send-timeout: "1800" # Max time in seconds for ws to remain shell window open + nginx.ingress.kubernetes.io/ssl-passthrough: "true" # Enable ssl-passthrough to backend. + spec: + rules: + - host: # FQDN to access cattle server + http: + paths: + - backend: + serviceName: cattle-service + servicePort: 443 + --- + kind: Deployment + apiVersion: extensions/v1beta1 + metadata: + namespace: cattle-system + name: cattle + spec: + replicas: 1 + template: + metadata: + labels: + app: cattle + spec: + serviceAccountName: cattle-admin + containers: + - image: rancher/rancher:master + imagePullPolicy: Always + name: cattle-server + ports: + - containerPort: 80 + protocol: TCP + - containerPort: 443 + protocol: TCP diff --git a/src/rke-yml/7-node-certificate.yml b/src/rke-yml/7-node-certificate.yml new file mode 100644 index 00000000000..636059271b0 --- /dev/null +++ b/src/rke-yml/7-node-certificate.yml @@ -0,0 +1,153 @@ +# default k8s version: v1.8.9-rancher1-1 +# default network plugin: flannel +nodes: + - address: # hostname or IP to access nodes + user: # root user (usually 'root') + role: [controlplane,etcd,worker] # K8s roles for node + ssh_key_path: # path to PEM file + - address: + user: + role: [controlplane,etcd,worker] + ssh_key_path: + - address: + user: + role: [etcd,worker] + ssh_key_path: + - address: + user: + role: [etcd,worker] + ssh_key_path: + - address: + user: + role: [etcd,worker] + ssh_key_path: + - address: + user: + role: [etcd,worker] + ssh_key_path: + - address: + user: + role: [etcd,worker] + ssh_key_path: + +addons: |- + --- + kind: Namespace + apiVersion: v1 + metadata: + name: cattle-system + --- + kind: ServiceAccount + apiVersion: v1 + metadata: + name: cattle-admin + namespace: cattle-system + --- + kind: ClusterRoleBinding + apiVersion: rbac.authorization.k8s.io/v1 + metadata: + name: cattle-crb + namespace: cattle-system + subjects: + - kind: ServiceAccount + name: cattle-admin + namespace: cattle-system + roleRef: + kind: ClusterRole + name: cluster-admin + apiGroup: rbac.authorization.k8s.io + --- + apiVersion: v1 + kind: Secret + metadata: + name: cattle-keys-ingress + namespace: cattle-system + type: Opaque + data: + tls.crt: # ssl cert for ingress. If selfsigned, must be signed by same CA as cattle server + tls.key: # ssl key for ingress. If selfsigned, must be signed by same CA as cattle server + --- + apiVersion: v1 + kind: Secret + metadata: + name: cattle-keys-server + namespace: cattle-system + type: Opaque + data: + cert.pem: # ssl cert for cattle server. + key.pem: # ssl key for cattle server. + cacerts.pem: # CA cert used to sign cattle server cert and key + --- + apiVersion: v1 + kind: Service + metadata: + namespace: cattle-system + name: cattle-service + labels: + app: cattle + spec: + ports: + - port: 80 + targetPort: 80 + protocol: TCP + name: http + - port: 443 + targetPort: 443 + protocol: TCP + name: https + selector: + app: cattle + --- + apiVersion: extensions/v1beta1 + kind: Ingress + metadata: + namespace: cattle-system + name: cattle-ingress-http + annotations: + nginx.ingress.kubernetes.io/proxy-connect-timeout: "30" + nginx.ingress.kubernetes.io/proxy-read-timeout: "1800" # Max time in seconds for ws to remain shell window open + nginx.ingress.kubernetes.io/proxy-send-timeout: "1800" # Max time in seconds for ws to remain shell window open + spec: + rules: + - host: # FQDN to access cattle server + http: + paths: + - backend: + serviceName: cattle-service + servicePort: 80 + tls: + - secretName: cattle-keys-ingress + hosts: + - # FQDN to access cattle server + --- + kind: Deployment + apiVersion: extensions/v1beta1 + metadata: + namespace: cattle-system + name: cattle + spec: + replicas: 1 + template: + metadata: + labels: + app: cattle + spec: + serviceAccountName: cattle-admin + containers: + - image: rancher/rancher:master + imagePullPolicy: Always + name: cattle-server + ports: + - containerPort: 80 + protocol: TCP + - containerPort: 443 + protocol: TCP + volumeMounts: + - mountPath: /etc/rancher/ssl + name: cattle-keys-volume + readOnly: true + volumes: + - name: cattle-keys-volume + secret: + defaultMode: 420 + secretName: cattle-keys-server diff --git a/src/rke-yml/7-node-passthrough.yml b/src/rke-yml/7-node-passthrough.yml new file mode 100644 index 00000000000..a7b29da8bdf --- /dev/null +++ b/src/rke-yml/7-node-passthrough.yml @@ -0,0 +1,125 @@ +# default k8s version: v1.8.9-rancher1-1 +# default network plugin: flannel +nodes: + - address: # hostname or IP to access nodes + user: # root user (usually 'root') + role: [controlplane,etcd,worker] # K8s roles for node + ssh_key_path: # path to PEM file + - address: + user: + role: [controlplane,etcd,worker] + ssh_key_path: + - address: + user: + role: [etcd,worker] + ssh_key_path: + - address: + user: + role: [etcd,worker] + ssh_key_path: + - address: + user: + role: [etcd,worker] + ssh_key_path: + - address: + user: + role: [etcd,worker] + ssh_key_path: + - address: + user: + role: [etcd,worker] + ssh_key_path: + +ingress: + provider: nginx + extra_args: + enable-ssl-passthrough: "" + +addons: |- + --- + kind: Namespace + apiVersion: v1 + metadata: + name: cattle-system + --- + kind: ServiceAccount + apiVersion: v1 + metadata: + name: cattle-admin + namespace: cattle-system + --- + kind: ClusterRoleBinding + apiVersion: rbac.authorization.k8s.io/v1 + metadata: + name: cattle-crb + namespace: cattle-system + subjects: + - kind: ServiceAccount + name: cattle-admin + namespace: cattle-system + roleRef: + kind: ClusterRole + name: cluster-admin + apiGroup: rbac.authorization.k8s.io + --- + apiVersion: v1 + kind: Service + metadata: + namespace: cattle-system + name: cattle-service + labels: + app: cattle + spec: + ports: + - port: 80 + targetPort: 80 + protocol: TCP + name: http + - port: 443 + targetPort: 443 + protocol: TCP + name: https + selector: + app: cattle + --- + apiVersion: extensions/v1beta1 + kind: Ingress + metadata: + namespace: cattle-system + name: cattle-ingress-http + annotations: + nginx.ingress.kubernetes.io/proxy-connect-timeout: "30" + nginx.ingress.kubernetes.io/proxy-read-timeout: "1800" # Max time in seconds for ws to remain shell window open + nginx.ingress.kubernetes.io/proxy-send-timeout: "1800" # Max time in seconds for ws to remain shell window open + nginx.ingress.kubernetes.io/ssl-passthrough: "true" # Enable ssl-passthrough to backend. + spec: + rules: + - host: # FQDN to access cattle server + http: + paths: + - backend: + serviceName: cattle-service + servicePort: 443 + --- + kind: Deployment + apiVersion: extensions/v1beta1 + metadata: + namespace: cattle-system + name: cattle + spec: + replicas: 1 + template: + metadata: + labels: + app: cattle + spec: + serviceAccountName: cattle-admin + containers: + - image: rancher/rancher:master + imagePullPolicy: Always + name: cattle-server + ports: + - containerPort: 80 + protocol: TCP + - containerPort: 443 + protocol: TCP
        protocoldirectionport rangepurposeprotocolport rangepurpose
        tcpinboundtcp 22 ssh server
        tcp 80httpingress
        tcp 443httpsingress
        tcp 10250 kubelet api
        tcp10251scheduler
        tcp10252kube-controller-manager
        tcp10253federation
        tcp10254ingress
        tcp10255read-only kubelet api
        tcp 10256 kubeproxy
        tcp 30000-32767 nodeport services