public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-24 20:18:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #809 from rancher/staging

Browse Source 
Staging
This commit is contained in:
Denise
2018-09-18 14:03:21 -07:00
committed by GitHub
parent 12b377c287 db4ca034e7
commit befd9a5194
18 changed files with 719 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config.toml
+12
View File
@@ -131,6 +131,18 @@ name = "Customers"
url = "https://rancher.com/customers/"
weight = "3"
[[menu.main]]
identifier = "customers"
name = "Customers"
url = "/customers/"
weight = "4"
[[menu.main]]
identifier = "customers"
name = "Customers"
url = "/customers/"
weight = "4"
[[menu.main]]
identifier = "learn"
name = "Learn"
content/rancher/v2.x/en/admin-settings/authentication/_index.md
+13 -9
View File
@@ -14,17 +14,21 @@ This centralized user authentication is accomplished using the Rancher authentic
### External vs. Local Authentication
The Rancher authentication proxy integrates with the following external authentication services.
The Rancher authentication proxy integrates with the following external authentication services. The following table lists the first version of Rancher each service debuted.
- Microsoft Active Directory
- Microsoft Azure AD
- GitHub
- PingIdentity
<!-- - Keycloak -->
- Microsoft AD FS
- FreeIPA
- OpenLDAP
| Auth Service | First Appearance |
| ----------------------------------------------------------------------------------------------- | ---------------- |
| [Microsoft Active Directory]({{< baseurl >}}/rancher/v2.x/en/admin-settings/authentication/ad/) | v2.0.0 |
| [GitHub]({{< baseurl >}}/rancher/v2.x/en/admin-settings/authentication/github/) | v2.0.0 |
| [Microsoft Azure AD]({{< baseurl >}}/rancher/v2.x/en/admin-settings/authentication/azure-ad/) | v2.0.3 |
| [FreeIPA]({{< baseurl >}}/rancher/v2.x/en/admin-settings/authentication/freeipa/) | v2.0.5 |
| [OpenLDAP]({{< baseurl >}}/rancher/v2.x/en/admin-settings/authentication/openldap/) | v2.0.5 |
| [Microsoft AD FS]({{< baseurl >}}rancher/v2.x/en/admin-settings/authentication/microsoft-adfs/) | v2.0.7 |
| [PingIdentity]({{< baseurl >}}/rancher/v2.x/en/admin-settings/authentication/ping-federate/) | v2.0.7 |
<!-- | [Keycloak]({{< baseurl >}}/rancher/v2.x/en/admin-settings/authentication/keycloak/) | v2.1.0 -->
<br/>
However, Rancher also provides local authentication.
In most cases, you should use an external authentication service over local, as external authentication allows user management from a central location. However, you may want a few local authentication users for managing Rancher under rare circumstances, such as if Active Directory is down.
content/rancher/v2.x/en/installation/ha/helm-init/_index.md
+5 -1
View File
@@ -30,4 +30,8 @@ helm init --service-account tiller
> **Note:** This `tiller` install has full cluster access, which should be acceptable if the cluster is dedicated to Rancher server. Check out the [helm docs](https://docs.helm.sh/using_helm/#role-based-access-control) for restricting `tiller` access to suit your security requirements.
### [Next: Install Rancher]({{< baseurl >}}/rancher/v2.x/en/installation/ha//helm-rancher/)
### Issues or errors?
See the [Troubleshooting]({{< baseurl >}}/rancher/v2.x/en/installation/ha/helm-init/troubleshooting/) page.
### [Next: Install Rancher]({{< baseurl >}}/rancher/v2.x/en/installation/ha/helm-rancher/)
content/rancher/v2.x/en/installation/ha/helm-init/troubleshooting/_index.md
+23
View File
@@ -0,0 +1,23 @@
---
title: Troubleshooting
weight: 276
---
### Helm commands show forbidden
When Helm is initiated in the cluster without specifying the correct `ServiceAccount`, the command `helm init` will succeed but you won't be able to execute most of the other `helm` commands. The following error will be shown:
```
Error: configmaps is forbidden: User "system:serviceaccount:kube-system:default" cannot list configmaps in the namespace "kube-system"
```
To resolve this, the server component (`tiller`) needs to be removed and added with the correct `ServiceAccount`. You can use `helm reset --force` to remove the `tiller` from the cluster. Please check if it is removed using `helm version --server`.
```
helm reset --force
Tiller (the Helm server-side component) has been uninstalled from your Kubernetes Cluster.
helm version --server
Error: could not find tiller
```
When you have confirmed that `tiller` has been removed, please follow the steps provided in [Initialize Helm on the cluster]({{< baseurl >}}/rancher/v2.x/en/installation/ha/helm-init/#initialize-helm-on-the-cluster) to install `tiller` with the correct `ServiceAccount`.
content/rancher/v2.x/en/installation/ha/kubernetes-rke/troubleshooting/_index.md
+8 -8
View File
@@ -3,19 +3,19 @@ title: Troubleshooting
weight: 276
---
#### canal Pods show READY 2/3
### canal Pods show READY 2/3
The most common cause of this issue is port 8472/UDP is not open between the nodes. Check your local firewall, network routing or security groups.
Once the network issue is resolved, the `canal` pods should timeout and restart to establish their connections.
#### nginx-ingress-controller Pods show RESTARTS
### nginx-ingress-controller Pods show RESTARTS
The most common cause of this issue is the `canal` pods have failed to establish the overlay network. See [canal Pods show READY `2/3`](#canal-pods-show-ready-2-3) for troubleshooting.
#### Failed to set up SSH tunneling for host [xxx.xxx.xxx.xxx]: Can't retrieve Docker Info
### Failed to set up SSH tunneling for host [xxx.xxx.xxx.xxx]: Can't retrieve Docker Info
##### Failed to dial to /var/run/docker.sock: ssh: rejected: administratively prohibited (open failed)
#### Failed to dial to /var/run/docker.sock: ssh: rejected: administratively prohibited (open failed)
* User specified to connect with does not have permission to access the Docker socket. This can be checked by logging into the host and running the command `docker ps`:
@@ -35,18 +35,18 @@ $ nc xxx.xxx.xxx.xxx 22
SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.10
```
##### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: Error configuring SSH: ssh: no key found
#### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: Error configuring SSH: ssh: no key found
* The key file specified as `ssh_key_path` cannot be accessed. Make sure that you specified the private key file (not the public key, `.pub`), and that the user that is running the `rke` command can access the private key file.
##### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain
#### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain
* The key file specified as `ssh_key_path` is not correct for accessing the node. Double-check if you specified the correct `ssh_key_path` for the node and if you specified the correct user to connect with.
##### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: Error configuring SSH: ssh: cannot decode encrypted private keys
#### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: Error configuring SSH: ssh: cannot decode encrypted private keys
* If you want to use encrypted private keys, you should use `ssh-agent` to load your keys with your passphrase. If the `SSH_AUTH_SOCK` environment variable is found in the environment where the `rke` command is run, it will be used automatically to connect to the node.
##### Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
#### Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
* The node is not reachable on the configured `address` and `port`.
content/rancher/v2.x/en/installation/references/_index.md
+104 -7
View File
@@ -5,13 +5,110 @@ aliases:
- /rancher/v2.x/en/hosts/amazon/#required-ports-for-rancher-to-work/
---
To operate properly, Rancher requires certain ports to be open on your nodes. During creation of clusters using a cloud service (like Amazon EC2 or DigitalOcean), Rancher opens these ports for you.
To operate properly, Rancher requires a number of ports to be open on Rancher nodes and Kubernetes cluster nodes.
The ports that Rancher opens change according to the type of machines hosting your cluster nodes. The following diagram depicts the ports that are opened for each [cluster type]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning).
## Rancher Nodes
<sup>Cluster Type Port Requirements</sup>
![Basic Port Requirements]({{< baseurl >}}/img/rancher/port-communications.svg)
The following table lists the ports that need to be open to and from nodes that are running the Rancher server container for [single node installs]({{< baseurl >}}/rancher/v2.x/en/installation/single-node-install/) or pods for [high availability installs]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install/).
{{< requirements_ports_rancher >}}
{{< requirements_ports_rke >}}
{{< ports_aws_securitygroup_nodedriver >}}
{{< ports-rancher-nodes >}}
## Kubernetes Cluster Nodes
The ports required to be open for cluster nodes changes depending on how the cluster was launched. Each of the tabs below list the ports that need to be opened for different [cluster creation options]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/#cluster-creation-options).
>**Tip:**
>
>If security isn't a large concern and you're okay with opening a few additional ports, you can use the table in [Commonly Used Ports](#commonly-used-ports) as your port reference instead of the comprehensive tables below.
{{% tabs %}}
{{% tab "Node Pools" %}}
The following table depicts the port requirements for [Rancher Launched Kubernetes]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) with nodes created in an [Infrastructure Provider]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/).
>**Note:**
>The required ports are automatically opened by Rancher during creation of clusters in cloud providers like Amazon EC2 or DigitalOcean.
{{< ports-iaas-nodes >}}
{{% /tab %}}
{{% tab "Custom Nodes" %}}
The following table depicts the port requirements for [Rancher Launched Kubernetes]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) with [Custom Nodes]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/).
{{< ports-custom-nodes >}}
{{% /tab %}}
{{% tab "Hosted Clusters" %}}
The following table depicts the port requirements for [hosted clusters]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters).
{{< ports-imported-hosted >}}
{{% /tab %}}
{{% tab "Imported Clusters" %}}
The following table depicts the port requirements for [imported clusters]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/).
{{< ports-imported-hosted >}}
{{% /tab %}}
{{% /tabs %}}
## Other Port Considerations
### Commonly Used Ports
These ports are typically opened on your Kubernetes nodes, regardless of what type of cluster it is.
| Protocol | Port | Description |
|:--------: |:----------------: |------------------------------------------------- |
| TCP | 22 | Node driver SSH provisioning |
| TCP | 2376 | Node driver Docker daemon TLS port |
| TCP | 2379 | etcd client requests |
| TCP | 2380 | etcd peer communication |
| UDP | 8472 | Canal/Flannel VXLAN overlay networking |
| TCP | 9099 | Canal/Flannel livenessProbe/readinessProbe |
| TCP | 10250 | kubelet API |
| TCP | 10254 | Ingress controller livenessProbe/readinessProbe |
| TCP/UDP | 30000-</br>32767 | NodePort port range |
----
### Local Node Traffic
Ports marked as `local traffic` (i.e., `9099 TCP`) in the above requirements are used for Kubernetes healthchecks (`livenessProbe` and`readinessProbe`).
These healthchecks are executed on the node itself. In most cloud environments, this local traffic is allowed by default.
However, this traffic may be blocked when:
- You have applied strict host firewall policies on the node.
- You are using nodes that have multiple interfaces (multihomed).
In these cases, you have to explicitly allow this traffic in your host firewall, or in case of public/private cloud hosted machines (i.e. AWS or OpenStack), in your security group configuration. Keep in mind that when using a security group as source or destination in your security group, explicitly opening ports only applies to the private interface of the nodes / instances.
### Rancher AWS EC2 security group
When using the [AWS EC2 node driver]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/) to provision cluster nodes in Rancher, you can choose to let Rancher create a security group called `rancher-nodes`. The following rules are automatically added to this security group.
| Type | Protocol | Port Range | Source/Destination | Rule Type |
|-----------------|:--------:|:-----------:|------------------------|:---------:|
| SSH | TCP | 22 | 0.0.0.0/0 | Inbound |
| HTTP | TCP | 80 | 0.0.0.0/0 | Inbound |
| Custom TCP Rule | TCP | 443 | 0.0.0.0/0 | Inbound |
| Custom TCP Rule | TCP | 2376 | 0.0.0.0/0 | Inbound |
| Custom TCP Rule | TCP | 2379-2380 | sg-xxx (rancher-nodes) | Inbound |
| Custom UDP Rule | UDP | 4789 | sg-xxx (rancher-nodes) | Inbound |
| Custom TCP Rule | TCP | 6443 | 0.0.0.0/0 | Inbound |
| Custom UDP Rule | UDP | 8472 | sg-xxx (rancher-nodes) | Inbound |
| Custom TCP Rule | TCP | 10250-10252 | sg-xxx (rancher-nodes) | Inbound |
| Custom TCP Rule | TCP | 10256 | sg-xxx (rancher-nodes) | Inbound |
| Custom TCP Rule | TCP | 30000-32767 | 30000-32767 | Inbound |
| Custom UDP Rule | UDP | 30000-32767 | 30000-32767 | Inbound |
| All traffic | All | All | 0.0.0.0/0 | Outbound |
content/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/editing-projects/_index.md
+1 -1
View File
@@ -11,7 +11,7 @@ After projects are created, there are certain aspects that can be changed later.
Following project creation, you can add users as project members so that they can access its resources.
>**Ping and MS FS Caveats:**
>**Ping, Keycloak, and MS FS Caveats:**
>
>- IdP does not support search or lookup. When adding users to projects, the exact IDs must be entered correctly.
>- When adding users to a project, group IDs are not supported unless the admin who turned on access control is a member of the group.
content/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/project-quotas/_index.md
+62
View File
@@ -0,0 +1,62 @@
---
title: Project Quotas
weight: 5000
draft: true
---
_Available as of v2.1.0_
When you are creating or editing a project, you can configure a _resource quotas_, which is a Rancher feature that limits the resources available to a project and the namespaces within it.
In situations where several teams share a cluster, one team may overconsume the resources available. To prevent this overconsumption, you can apply a _project quota_, which creates a pool of resources that the project's namespaces can use, resources being things like data or processing power.
## Rancher Resource Quotas vs. Native Kubernetes Resource Quotas
Resource quotas in Rancher work similarly to how they do in the [native version of Kubernetes](https://kubernetes.io/docs/concepts/policy/resource-quotas/). However, Rancher's version of resource quotas have a few key differences from the Kubernetes version.
In a standard Kubernetes deployment, resource quotas are applied to individual namespaces. However, you cannot apply the quota to multiple namespaces with a single action. Instead, the resource quota must be applied each namespace, which can be tedious. The following diagram depict resource quotas in a native Kubernetes deployment. Notice that:
- Resource quotas apply only to namespaces they are directly assigned to.
- Quotas are applied to individual namespaces, rather than collectively. Even though each quota sets the same limits, a unique quota is applied to each namespace.
![Native Kubernetes Resource Quota Implementation]({{< baseurl >}}/img/rancher/kubernetes-resource-quota.svg)
<sup>Native Kubernetes Resource Quota Implementation Example</sup>
In Rancher's implementation of resource quotas, the quota is applied to a [project]({{< baseurl >}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#projects) instead. The resource quota includes two limits:
- **Project Limits:**
This set of values is the overall limit for the project. When the overall limit for the project is exceeded, Kubernetes uses logic to determine which namespaces to stop to get back under the quota.
- **Namespace Default Limits:**
This value is the default resource limit that an individual namespace inherits from the project. If an individual namespace exceeds its namespace limit, Kubernetes stops anything objects in the namespace from operating.
Each namespace inherits this default limit unless you [override it](#namespace-default-limit-overrides).
The following diagram depict resource quotas in a native Kubernetes deployment. Notice that:
- The resource quota is applied to the entire project.
- The project limit sets what resources are available for the entire project.
- Each namespace in the project inherits the namespace default limit, which sets the cap for resources available for each individual namespace. The same namespace default limit is automatically applied to each namespace.
![Rancher Resource Quota Implementation]({{< baseurl >}}/img/rancher/rancher-resource-quota.svg)
<sup>Rancher Resource Quota Implementation Example</sup>
The following table explains the key differences between the two quota types.
Rancher Resource Quotas | Native Kubernetes Resource Quotas
---------|----------
Applied to projects. | Applied to namespaces.
Applies resource limits to the project and all its namespaces. | Applies resource limits to individual namespaces.
Applies resource quotas to namespaces through inheritance. | Apply only to the assigned namespace.
## Resource Quota Types
When you create a resource quota, you are configuring the pool of resources available to the project. You can set limits for a variety of different resources, for both your project and your namespaces.
### Namespace Default Limit Overrides
Although each namespace in a project inherits the **Namespace Default Limit**, you can also override this setting for specific namespaces that require additional (or fewer) resources.
content/rke/v0.1.x/en/troubleshooting/_index.md
+6
View File
@@ -0,0 +1,6 @@
---
title: Troubleshooting
weight: 400
---
* [SSH Connectivity Errors]({{< baseurl >}}/rke/v0.1.x/en/troubleshooting/ssh-connectivity-errors/)
content/rancher/v2.x/en/installation/ha/rke-add-on/troubleshooting/ssh-tunneling/_index.md → content/rke/v0.1.x/en/troubleshooting/ssh-connectivity-errors/_index.md
+8 -6
View File
@@ -1,8 +1,9 @@
---
title: Failed to set up SSH tunneling for host
weight: 10
title: SSH Connectivity Errors
weight: 100
aliases:
- /rancher/v2.x/en/installation/troubleshooting-ha/ssh-tunneling/
- /rancher/v2.x/en/installation/ha/rke-add-on/troubleshooting/ssh-tunneling/
---
### Failed to set up SSH tunneling for host [xxx.xxx.xxx.xxx]: Can't retrieve Docker Info
@@ -12,14 +13,14 @@ aliases:
* User specified to connect with does not have permission to access the Docker socket. This can be checked by logging into the host and running the command `docker ps`:
```
$ ssh user@server
$ ssh -i ssh_privatekey_file user@server
user@server$ docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
```
See [Manage Docker as a non-root user](https://docs.docker.com/install/linux/linux-postinstall/#manage-docker-as-a-non-root-user) how to set this up properly.
* When using RedHat/CentOS as operating system, you cannot use the user `root` to connect to the nodes because of [Bugzilla #1527565](https://bugzilla.redhat.com/show_bug.cgi?id=1527565). You will need to add a separate user and configure it to access the Docker socket. See [Manage Docker as a non-root user](https://docs.docker.com/install/linux/linux-postinstall/#manage-docker-as-a-non-root-user) how to set this up properly.
* When using RedHat/CentOS as operating system, you cannot use the user `root` to connect to the nodes because of [Bugzilla #1527565](https://bugzilla.redhat.com/show_bug.cgi?id=1527565). You will need to add a separate user and configure it to access the Docker socket. See [Manage Docker as a non-root user](https://docs.docker.com/install/linux/linux-postinstall/#manage-docker-as-a-non-root-user) how to set this up properly.
* SSH server version is not version 6.7 or higher. This is needed for socket forwarding to work, which is used to connect to the Docker socket over SSH. This can be checked using `sshd -V` on the host you are connecting to, or using netcat:
```
@@ -30,6 +31,7 @@ SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.10
#### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: Error configuring SSH: ssh: no key found
* The key file specified as `ssh_key_path` cannot be accessed. Make sure that you specified the private key file (not the public key, `.pub`), and that the user that is running the `rke` command can access the private key file.
* The key file specified as `ssh_key_path` is malformed. Check if the key is valid by running `ssh-keygen -y -e -f private_key_file`. This will print the public key of the private key, which will fail if the private key file is not valid.
#### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain
@@ -37,7 +39,7 @@ SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.10
#### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: Error configuring SSH: ssh: cannot decode encrypted private keys
* If you want to use encrypted private keys, you should use `ssh-agent` to load your keys with your passphrase. If the `SSH_AUTH_SOCK` environment variable is found in the environment where the `rke` command is run, it will be used automatically to connect to the node.
* If you want to use encrypted private keys, you should use `ssh-agent` to load your keys with your passphrase. You can configure RKE to use that agent by specifying `--ssh-agent-auth` on the command-line, it will use the `SSH_AUTH_SOCK` environment variable in the environment where the `rke` command is run.
#### Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
layouts/shortcodes/ports-custom-nodes.html
+181
View File
@@ -0,0 +1,181 @@
<table>
<thead>
<tr>
<th>From / To</th>
<th>Rancher Nodes</th>
<th>etcd Plane Nodes</th>
<th>Control Plane Nodes</th>
<th>Worker Plane Nodes</th>
<th>External Load Balancer</th>
<th>Internet</th>
</tr>
</thead>
<tbody>
<tr>
<td >Rancher Nodes <sup>(1)</sup></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td style="background-color: #3497DA; color:#ffffff;">git.rancher.io <sup>(2)</sup>:<br>35.160.43.145:32<br>35.167.242.46:32<br>52.33.59.17:32</td>
</tr>
<tr>
<td rowspan="5">etcd Plane Nodes</td>
<td rowspan="5" style="background-color: #3497DA; color:#ffffff;">443 TCP <sup>(3)</sup></td>
<td style="background-color: #3497DA; color:#ffffff;">2379 TCP</td>
<td></td>
<td></td>
<td rowspan="5" style="background-color: #3497DA; color:#ffffff;">443 TCP</td>
<td></td>
</tr>
<tr>
<td style="background-color: #3497DA; color:#ffffff;">2380 TCP</td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td></td>
<td style="background-color: #3497DA; color:#ffffff;">6443 TCP</td>
<td></td>
<td></td>
</tr>
<tr>
<td colspan="3" style="background-color: #3497DA; color:#ffffff;">8472 UDP</td>
<td></td>
</tr>
<tr>
<td style="background-color: #3497DA; color:#ffffff;">9099 TCP <sup>(4)</sup></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td rowspan="7">Control Plane Nodes</td>
<td rowspan="7" style="background-color: #3497DA; color:#ffffff;">443 TCP <sup>(3)</sup></td>
<td style="background-color: #3497DA; color:#ffffff;">2379 TCP</td>
<td></td>
<td></td>
<td rowspan="7" style="background-color: #3497DA; color:#ffffff;">443 TCP</td>
<td></td>
</tr>
<tr>
<td style="background-color: #3497DA; color:#ffffff;">2380 TCP</td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td></td>
<td style="background-color: #3497DA; color:#ffffff;">6443 TCP</td>
<td></td>
<td></td>
</tr>
<tr>
<td colspan="3" style="background-color: #3497DA; color:#ffffff;">8472 UDP</td>
<td></td>
</tr>
<tr>
<td colspan="3" style="background-color: #3497DA; color:#ffffff;">10250 TCP</td>
<td></td>
</tr>
<tr>
<td></td>
<td style="background-color: #3497DA; color:#ffffff;">9099 TCP <sup>(4)</sup></td>
<td></td>
<td></td>
</tr>
<tr>
<td></td>
<td style="background-color: #3497DA; color:#ffffff;">10254 TCP <sup>(4)</sup></td>
<td></td>
<td></td>
</tr>
<tr>
<td rowspan="4">Worker Plane Nodes</td>
<td rowspan="4" style="background-color: #3497DA; color:#ffffff;">443 TCP <sup>(3)</sup></td>
<td></td>
<td style="background-color: #3497DA; color:#ffffff;">6443 TCP</td>
<td></td>
<td rowspan="4" style="background-color: #3497DA; color:#ffffff;">443 TCP</td>
<td></td>
</tr>
<tr>
<td colspan="3" style="background-color: #3497DA; color:#ffffff;">8472 UDP</td>
<td></td>
</tr>
<tr>
<td></td>
<td></td>
<td style="background-color: #3497DA; color:#ffffff;">9099 TCP <sup>(4)</sup></td>
<td></td>
</tr>
<tr>
<td></td>
<td></td>
<td style="background-color: #3497DA; color:#ffffff;">10254 TCP <sup>(4)</sup></td>
<td></td>
</tr>
<tr>
<td rowspan="2">External Load Balancer <sup>(5)</sup></td>
<td style="background-color: #3497DA; color:#ffffff;">80 TCP</td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td style="background-color: #3497DA; color:#ffffff;">443 TCP <sup>(6)</sup></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td rowspan="2">API / UI Clients</td>
<td style="background-color: #3497DA; color:#ffffff;">80 TCP <sup>(3)</sup></td>
<td></td>
<td></td>
<td></td>
<td style="background-color: #3497DA; color:#ffffff;">80 TCP<br></td>
<td></td>
</tr>
<tr>
<td style="background-color: #3497DA; color:#ffffff;">443 TCP <sup>(3)</sup></td>
<td></td>
<td></td>
<td></td>
<td style="background-color: #3497DA; color:#ffffff;">443 TCP</td>
<td></td>
</tr>
<tr>
<td rowspan="3">Workload Clients</td>
<td></td>
<td></td>
<td></td>
<td style="background-color: #3497DA; color:#ffffff;">30000-32767 TCP / UDP<br>(nodeport)</td>
<td></td>
<td></td>
</tr>
<tr>
<td></td>
<td></td>
<td colspan="2" style="background-color: #3497DA; color:#ffffff;">80 TCP (Ingress)</td>
<td></td>
<td></td>
</tr>
<tr>
<td></td>
<td></td>
<td colspan="2" style="background-color: #3497DA; color:#ffffff;">443 TCP (Ingress)</td>
<td></td>
<td></td>
</tr>
<tr>
<td colspan="7">Notes:<br><br>1. Nodes running standalone server or Rancher HA deployment.<br>2. Required to fetch Rancher chart library.<br>3. Only without external load balancer.<br>4. Local traffic to the node itself (not across nodes).<br>5. Load balancer / proxy that handles tragging to the Rancher UI / API.<br>6. Only if SSL is not terminated at external load balancer.</td>
</tr>
</tbody>
</table>
layouts/shortcodes/ports-iaas-nodes.html
+184
View File
@@ -0,0 +1,184 @@
<table style="border-style:solid;">
<thead>
<tr>
<th>From / To</th>
<th>Rancher Nodes</th>
<th>etcd Plane Nodes</th>
<th>Control Plane Nodes</th>
<th>Worker Plane Nodes</th>
<th>External Load Balancer</th>
<th>Internet</th>
</tr>
</thead>
<tbody>
<tr>
<td rowspan="2">Rancher Nodes <sup>(1)</sup></td>
<td></td>
<td colspan="3" style="background-color: #3497DA; color:#ffffff;">22 TCP</td>
<td></td>
<td rowspan="2" style="background-color: #3497DA; color:#ffffff;">git.rancher.io <sup>(2)</sup>:<br>35.160.43.145:32<br>35.167.242.46:32<br>52.33.59.17:32</td>
</tr>
<tr>
<td></td>
<td colspan="3" style="background-color: #3497DA; color:#ffffff;">2376 TCP</td>
<td></td>
</tr>
<tr>
<td rowspan="5">etcd Plane Nodes</td>
<td rowspan="5" style="background-color: #3497DA; color:#ffffff;">443 TCP <sup>(3)</sup></td>
<td style="background-color: #3497DA; color:#ffffff;">2379 TCP</td>
<td></td>
<td></td>
<td rowspan="5" style="background-color: #3497DA; color:#ffffff;">443 TCP</td>
<td></td>
</tr>
<tr>
<td style="background-color: #3497DA; color:#ffffff;">2380 TCP</td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td></td>
<td style="background-color: #3497DA; color:#ffffff;">6443 TCP</td>
<td></td>
<td></td>
</tr>
<tr>
<td colspan="3" style="background-color: #3497DA; color:#ffffff;">8472 UDP</td>
<td></td>
</tr>
<tr>
<td style="background-color: #3497DA; color:#ffffff;">9099 TCP <sup>(4)</sup></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td rowspan="7">Control Plane Nodes</td>
<td rowspan="7" style="background-color: #3497DA; color:#ffffff;">443 TCP <sup>(3)</sup></td>
<td style="background-color: #3497DA; color:#ffffff;">2379 TCP</td>
<td></td>
<td></td>
<td rowspan="7" style="background-color: #3497DA; color:#ffffff;">443 TCP</td>
<td></td>
</tr>
<tr>
<td style="background-color: #3497DA; color:#ffffff;">2380 TCP</td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td></td>
<td style="background-color: #3497DA; color:#ffffff;">6443 TCP</td>
<td></td>
<td></td>
</tr>
<tr>
<td colspan="3" style="background-color: #3497DA; color:#ffffff;">8472 UDP</td>
<td></td>
</tr>
<tr>
<td colspan="3" style="background-color: #3497DA; color:#ffffff;">10250 TCP</td>
<td></td>
</tr>
<tr>
<td></td>
<td style="background-color: #3497DA; color:#ffffff;">9099 TCP <sup>(4)</sup></td>
<td></td>
<td></td>
</tr>
<tr>
<td></td>
<td style="background-color: #3497DA; color:#ffffff;">10254 TCP <sup>(4)</sup></td>
<td></td>
<td></td>
</tr>
<tr>
<td rowspan="4">Worker Plane Nodes</td>
<td rowspan="4" style="background-color: #3497DA; color:#ffffff;">443 TCP <sup>(3)</sup></td>
<td></td>
<td style="background-color: #3497DA; color:#ffffff;">6443 TCP</td>
<td></td>
<td rowspan="4" style="background-color: #3497DA; color:#ffffff;">443 TCP</td>
<td></td>
</tr>
<tr>
<td colspan="3" style="background-color: #3497DA; color:#ffffff;">8472 UDP</td>
<td></td>
</tr>
<tr>
<td></td>
<td></td>
<td style="background-color: #3497DA; color:#ffffff;">9099 TCP <sup>(4)</sup></td>
<td></td>
</tr>
<tr>
<td></td>
<td></td>
<td style="background-color: #3497DA; color:#ffffff;">10254 TCP <sup>(4)</sup></td>
<td></td>
</tr>
<tr>
<td rowspan="2">External Load Balancer <sup>(5)</sup></td>
<td style="background-color: #3497DA; color:#ffffff;">80 TCP</td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td style="background-color: #3497DA; color:#ffffff;">443 TCP <sup>(6)</sup></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td rowspan="2">API / UI Clients</td>
<td style="background-color: #3497DA; color:#ffffff;">80 TCP <sup>(3)</sup></td>
<td></td>
<td></td>
<td></td>
<td style="background-color: #3497DA; color:#ffffff;">80 TCP<br></td>
<td></td>
</tr>
<tr>
<td style="background-color: #3497DA; color:#ffffff;">443 TCP <sup>(3)</sup></td>
<td></td>
<td></td>
<td></td>
<td style="background-color: #3497DA; color:#ffffff;">443 TCP</td>
<td></td>
</tr>
<tr>
<td rowspan="3">Workload Clients</td>
<td></td>
<td></td>
<td></td>
<td style="background-color: #3497DA; color:#ffffff;">30000-32767 TCP / UDP<br>(nodeport)</td>
<td></td>
<td></td>
</tr>
<tr>
<td></td>
<td></td>
<td colspan="2" style="background-color: #3497DA; color:#ffffff;">80 TCP (Ingress)</td>
<td></td>
<td></td>
</tr>
<tr>
<td></td>
<td></td>
<td colspan="2" style="background-color: #3497DA; color:#ffffff;">443 TCP (Ingress)</td>
<td></td>
<td></td>
</tr>
<tr>
<td colspan="7">Notes:<br><br>1. Nodes running standalone server or Rancher HA deployment.<br>2. Required to fetch Rancher chart library.<br>3. Only without external load balancer.<br>4. Local traffic to the node itself (not across nodes).<br>5. Load balancer / proxy that handles tragging to the Rancher UI / API.<br>6. Only if SSL is not terminated at external load balancer.</td>
</tr>
</tbody>
</table>
layouts/shortcodes/ports-imported-hosted.html
+51
View File
@@ -0,0 +1,51 @@
<table>
<thead>
<tr>
<th>From / To</th>
<th>Rancher Nodes</th>
<th>Hosted / Imported Cluster</th>
<th>External Load Balancer</th>
<th>Internet</th>
</tr>
</thead>
<tbody>
<tr>
<td>Rancher Nodes <sup>(1)</sup></td>
<td></td>
<td style="background-color: #3497DA; color:#ffffff;">Kubernetes API <br>Endpoint Port <sup>(2)</sup></td>
<td></td>
<td style="background-color: #3497DA; color:#ffffff;">git.rancher.io <sup>(3)</sup>:<br>35.160.43.145:32<br>35.167.242.46:32<br>52.33.59.17:32</td>
</tr>
<tr>
<td>Hosted / Imported Cluster</td>
<td style="background-color: #3497DA; color:#ffffff;">443 TCP <sup>(4)(5)</sup></td>
<td></td>
<td style="background-color: #3497DA; color:#ffffff;">443 TCP <sup>(5)</sup></td>
<td></td>
</tr>
<tr>
<td>External Load Balancer <sup>(5)</sup></td>
<td style="background-color: #3497DA; color:#ffffff;">80 TCP<br>443 TCP <sup>(6)</sup></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td>API / UI Clients</td>
<td style="background-color: #3497DA; color:#ffffff;">80 TCP <sup>(4)</sup><br>443 TCP <sup>(4)</sup></td>
<td></td>
<td style="background-color: #3497DA; color:#ffffff;">80 TCP<br>443 TCP</td>
<td></td>
</tr>
<tr>
<td>Workload Client</td>
<td></td>
<td style="background-color: #3497DA; color:#ffffff;">Cluster / Provider Specific <sup>(7)</sup></td>
<td></td>
<td></td>
</tr>
<tr>
<td colspan="5">Notes:<br><br>1. Nodes running standalone server or Rancher HA deployment.<br>2. Only for hosted clusters.<br>3. Required to fetch Rancher chart library.<br>4. Only without external load balancer.<br>5. From worker nodes.<br>6. Only if SSL is not terminated at external load balancer.<br>7. Usually Ingress backed by infrastructure load balancer and/or nodeport.</td>
</tr>
</tbody>
</table>
layouts/shortcodes/ports-rancher-nodes.html
+55
View File
@@ -0,0 +1,55 @@
<table>
<thead>
<tr>
<th>Protocol</th>
<th>Port</th>
<th>Source</th>
<th>Destination</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>TCP</td>
<td>80</td>
<td>Load Balancer / Reverse Proxy</td>
<td></td>
<td>HTTP traffic to Rancher UI / API.</td>
</tr>
<tr>
<td>TCP</td>
<td>443</td>
<td>Load Balancer / Reverse Proxy<br><br>Otherwise IPs of all cluster nodes and other Rancher API / UI clients.</td>
<td></td>
<td>HTTPS traffic to Rancher UI / API.</td>
</tr>
<tr>
<td>TCP</td>
<td>443</td>
<td></td>
<td>35.160.43.145<br>35.167.242.46<br>52.33.59.17</td>
<td>Rancher catalog (git.rancher.io).</td>
</tr>
<tr>
<td>TCP</td>
<td>22</td>
<td></td>
<td>Any node created using node driver.</td>
<td>SSH provisioning of node by node driver.</td>
</tr>
<tr>
<td>TCP</td>
<td>2376</td>
<td></td>
<td>Any node created using node driver.</td>
<td>Docker daemon TLS port used by node driver.</td>
</tr>
<tr>
<td>TCP</td>
<td>Provider Dependent</td>
<td></td>
<td>Port of the Kubernetes API endpoint in hosted clusters.</td>
<td>Kubernetes API.</td>
</tr>
</tbody>
</table>
src/diagrams/kubernetes-resource-quota.xml
+1
View File
@@ -0,0 +1 @@
<mxfile userAgent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36" version="9.1.3" editor="www.draw.io" type="device"><diagram id="e390a0ea-10c4-4c32-dbd2-2c5d3ea7f96f" name="Page-1">7VrbcpswEP0aP6YDCGz8GJNLZ9p00mYyfZZBxpoIRIV8Sb++KxAYbIip49rOFPsB+ezqsquze2YYD5AXre8FTuYPPCBsYBnBeoBuBpZlDu0RPBTymiOOjXIgFDTQThvgif4mGjQ0uqABSWuOknMmaVIHfR7HxJc1DAvBV3W3GWf1XRMckh3gycdsF/1JAznPUdcxNvhnQsN5sbNpaMsU+y+h4ItY7zew0Cz75OYIF2tp/3SOA76qQOh2gDzBucxH0dojTOW2SFs+767FWp5bkFh2mWDlE5aYLUhx4iGDqZOALtX55KvOyfDXQh1qIslaXmFGw3iArtUVwE5EwABsWapjeZVmF6qsppusN3NhFOpntodyzm6RcVHbBNKGAvXdnfsNS7okMOvLYkpETCTwxDI8tkizY+QLQ8D52vX9AM7CKlCrFqGV3RtRmTHBvJpTSZ4S7CvrCngO2FxGTJvLm1M/fB5RH8YqCakU/IV4ZUxo5Hpj7660FISyVAIoYxVPwxg51y7gOr83OrlosiRCUuDntTZInuj83eGIMlVmCU8SGgPxJwxPCZuUTCw2iHkMoUw4hESlmoGMMgtVxmgSqS3JugJpBt0THhEpXsFFVzfSZF5tSsUZa2xeKRM00iDW5RmWS20oCgPN0haKuw2U3bpIFXfSPbCyj+BpsYLRHLCeVfQBHb+7Gz8Euxu/aR0h/qbwq9XUvcKIPzNmZlOFRSTNeA/1u6eipqKhxuqObxbZPy4oZNtj53a7UgSfcsk1WvU21bep/EKBA0o2zrqUGijmtnCstXjsXfKYdkPxuEfgzmgPdxra/XY/Nzr08wNX+UFSvhAZ7b6DBWf0U/5tVNtFuooWIzPZHgaQPy4w7/EZ/L/SiMp8qqOk3gAmMap05/E5rTC/OrNNdN6sp+MH8EAinvEtj0El37Lh8UAnBx38OCds7Btd0nRpkq2baNcOU/SjjgL/rgZTWI2GDtMkT0dR5/H51Rma+CfnfAJdrHEihbb2dJReobdoNm7h2UUodFkFH0airV6ie4nuJfqwDnMOiW5859Mu0Z31uEHN/0Kiy0VOo9HopBpt9xq9V6MbeFblU07Sy9Bo+6NptN1rdK/R/71GH9hhzqLRzvk1eusl94kFenhSgUa9QL9boJ3LEegP954b9QLdC3Qv0Id1mBMINPzc/Ccjs1X++IJu/wA=</diagram></mxfile>
src/diagrams/rancher-resource-quota.xml
+1
View File
@@ -0,0 +1 @@
<mxfile userAgent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36" version="9.1.3" editor="www.draw.io" type="device"><diagram id="e390a0ea-10c4-4c32-dbd2-2c5d3ea7f96f" name="Page-1">7Zvdd6I4FMD/Gh9nDiSg8FhtO/Mw3dOdnjk78xglamYCYTFWu3/9JhDAQFBU/Oip7UPh5ovc/O5NbpL24Chcf0lQPH9iAaY9YAXrHrzvAWD3nYH4IyVvhQRmkllCAiUrBS/kP6yElpIuSYAXWkbOGOUk1oUTFkV4wjUZShK20rNNGdVbjdEM1wQvE0Tr0n9IwOeZ1HOtUv4Vk9k8b9m2VMoYTf7MEraMVHs9AKfpT5YcorwulX8xRwFbbYjgQw+OEsZ49hSuR5hK5eZqy8o9NqQW353giLcpALICr4gucf7FfSqKDgPyKr+Pvymd9P9dyo8acrzmnxAls6gH7+QQiJZwIh5EWqrqiH9apAMqU20vXpdlxdNM/U3bkJnTUaQs0RoRaoOB/K2X/Y6iyTxtcESXi7TprDLRyaw+vQ0hTruSS4HWK5COFZbasEXyak44fonRRKauBNxCNuchVcnFaMmXCQvJRDzLji94wv7gUdEPOPBG/uixSMkhArLThNKNnJY1cO88IVc6vVcKhcNXnHAimLxTCZzFSmePKCRU2lbM4phEAvYhRWNMhwV9eQMRi0RXhkx0iXBZAlqFFjYpUeDIJvF6Q6So+YJZiHnyJrKsSntwfUXxfMMW3BxtpGxwVpQtORQPCkUzlvAdY/mcsN/SJ92wPCeWKhW6WQk18eQOexNaYIDWgR1Aaw8M1FbGVaohbt/PYoZD47wGa3v/844oBYj+1jRge6CuAdtyj9eA32i2JhPYZmZ4MrWmdt3M/kIhXqSGACyww8TGicHo9Ixbre7EFgYdx3cfqqaTsDHjTEk3c9vy12SPswQFBJeZlW0ZIBs0UFanKafHAI9jMB+vC+txD4CnDkV98O/xFC2pJO0bCckuv3wsNBdw1cpW2oKUY1cD6ShiVKpfJ8YbGBYJXQDjXZ+7LeKAs7hbkwJO527tm7vdz916DZRdh7vt39zt1bnb9sSc393my+ZGYAxBWTXqAqao6ztesGWS0vS3SEFp3g/GgjmmapylanNZIyB9T5uffNswPRk8DOgkHmoOB/aN4psideGGolbk2SbyikhduSoNvKzq7UF7t50x+sIj2qN4yhs3QIwK0dVqXD4cqOrR8w9NzRaw5FLJEhZDidzLe/6x2L1j0v2YXJOOnnDIUtvV1OQIC7aeSPP8uJd2PqIDPWpDKZ9O8wU+NCzwT7VGK762XYTTOpzZZwKpRjjQBZ/PuaW05YTiFEEOvAU5O4OcHQuSKwpytpwj3IKcMwY5BxJzgSDHubzHHVzY4R6yD3u4w3VuDvdoh+tcj8O97Sq9C4fbQMwFNvFbLHGFumP5OKV4fScv9+ijUVGk7yOIvC22h9eE/1Rl5fMvOXjCxYq3SHz9TzWW6UuZpo158xipq0w22JOG9rvKSj3Zllk2YWQijpIZVrnUzgsOtGtO2y9zmO5yKFmCKeLkFWufYBp21cIzI+mssM6XYXoQBQZ9vYqsN6pUCU+tIuhUjlu8yoSX6aBWUUph0e12YJq2O29gHgumd11gOo4OZr/i0tqCCfxKRXalou7ABC1umXx4MCt8HUJqptaLkekCDSjh+T5XfF1rp+nqd6Jg36lW1SGdLQ7lL0Bn+forX6q9czrdS9JpV+Zh4B/qN/N74aoixwGnItPkNrvYte+mlv2in/Kgqh7p1CX7nYW0Oe+onea42w5z2p/aNIRz3XegctQiRsWSMVHlnOVUx03HHgB+mGD2XKc6xb7FCfZIxGv57xyZ3yr/aQY+/A8=</diagram></mxfile>
src/img/rancher/kubernetes-resource-quota.svg
+2
View File
File diff suppressed because one or more lines are too long
Side by Side

After

Width:  |  Height:  |  Size: 12 KiB

src/img/rancher/rancher-resource-quota.svg
+2
View File
File diff suppressed because one or more lines are too long
Side by Side

After

Width:  |  Height:  |  Size: 17 KiB