From a7b235e1b634c228476ae954f91d27e149178378 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Mon, 13 Sep 2021 17:16:49 -0400 Subject: [PATCH 1/6] Added note on RKE2 snapshots --- .../editing-clusters/rke2-config-reference/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke2-config-reference/_index.md b/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke2-config-reference/_index.md index b0afd7b152c..8e400eaeb5f 100644 --- a/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke2-config-reference/_index.md +++ b/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke2-config-reference/_index.md @@ -91,7 +91,7 @@ Option to set environment variables for [Rancher agents](https://rancher.com/doc #### Automatic Snapshots -Option to enable or disable recurring etcd snapshots. If enabled, users have the option to configure the frequency of snapshots. For details, refer to the [RKE2 documentation](https://docs.rke2.io/backup_restore/#creating-snapshots). +Option to enable or disable recurring etcd snapshots. If enabled, users have the option to configure the frequency of snapshots. For details, refer to the [RKE2 documentation](https://docs.rke2.io/backup_restore/#creating-snapshots). Note that in RKE2, snapshots are stored on each etcd node. #### Metrics From c111aaabc73e464312f50e8abf42dffe7d5cce01 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 14 Sep 2021 16:56:57 -0400 Subject: [PATCH 2/6] Updated note for RKE2 snapshots --- .../editing-clusters/rke2-config-reference/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke2-config-reference/_index.md b/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke2-config-reference/_index.md index 8e400eaeb5f..41b95e82421 100644 --- a/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke2-config-reference/_index.md +++ b/content/rancher/v2.6/en/cluster-admin/editing-clusters/rke2-config-reference/_index.md @@ -91,7 +91,7 @@ Option to set environment variables for [Rancher agents](https://rancher.com/doc #### Automatic Snapshots -Option to enable or disable recurring etcd snapshots. If enabled, users have the option to configure the frequency of snapshots. For details, refer to the [RKE2 documentation](https://docs.rke2.io/backup_restore/#creating-snapshots). Note that in RKE2, snapshots are stored on each etcd node. +Option to enable or disable recurring etcd snapshots. If enabled, users have the option to configure the frequency of snapshots. For details, refer to the [RKE2 documentation](https://docs.rke2.io/backup_restore/#creating-snapshots). Note that with RKE2, snapshots are stored on each etcd node. This varies from RKE1 which only stores one snapshot per cluster. #### Metrics From deecfd02896e06bade8119095c3682e88e17c09a Mon Sep 17 00:00:00 2001 From: Jen Travinski Date: Mon, 20 Sep 2021 18:39:50 -0400 Subject: [PATCH 3/6] Provided example yaml and kubectl commands on how to configure additional monitoring roles (#3518) * Added examples and hard breaks between elements, removed duplicate header in TOC v2.6 * Added examples of YAML for Roles & RoleBindings * Added hard breaks between elements, removed duplicate header in TOC v2.5 * Added new section for YAML/kubectl * Updated 2.5, 2.6 yaml examples * Updated for 2.5 * Updated for 2.6 * Updated yaml and kubectl files for 2.5/2.6 * Updated v2.5, v2.6 to remove CRB label from Roles --- .../en/monitoring-alerting/rbac/_index.md | 33 ++++++++++++++++-- .../en/monitoring-alerting/rbac/_index.md | 34 +++++++++++++++++-- 2 files changed, 61 insertions(+), 6 deletions(-) diff --git a/content/rancher/v2.5/en/monitoring-alerting/rbac/_index.md b/content/rancher/v2.5/en/monitoring-alerting/rbac/_index.md index 4c703ba37fe..4bc0e009c2a 100644 --- a/content/rancher/v2.5/en/monitoring-alerting/rbac/_index.md +++ b/content/rancher/v2.5/en/monitoring-alerting/rbac/_index.md @@ -16,7 +16,6 @@ This section describes the expectations for RBAC for Rancher Monitoring. - [Users with Kubernetes View Permissions](#users-with-kubernetes-view-permissions) - [Additional Monitoring Roles](#additional-monitoring-roles) - [Additional Monitoring ClusterRoles](#additional-monitoring-clusterroles) -- [Additional Monitoring Roles](#additional-monitoring-roles) - [Users with Rancher Cluster Manager Based Permissions](#users-with-rancher-cluster-manager-based-permissions) - [Differences in 2.5.x](#differences-in-2-5-x) - [Assigning Additional Access](#assigning-additional-access) @@ -70,7 +69,7 @@ Only those with who have some Kubernetes `ClusterRole` should be able to: ### Additional Monitoring Roles -Monitoring also creates additional `Roles` that are not assigned to users by default but are created within the cluster. They can be bound to a namespace by deploying a RoleBinding that references it. +Monitoring also creates additional `Roles` that are not assigned to users by default but are created within the cluster. They can be bound to a namespace by deploying a `RoleBinding` that references it. To define a `RoleBinding` with `kubectl` instead of through Rancher, click [here](#assigning-roles-and-clusterroles-with-kubectl). Admins should use these roles to provide more fine-grained access to users: @@ -85,12 +84,40 @@ Admins should use these roles to provide more fine-grained access to users: ### Additional Monitoring ClusterRoles -Monitoring also creates additional `ClusterRoles` that are not assigned to users by default but are created within the cluster. They are not aggregated by default but can be bound to a namespace by deploying a RoleBinding that references it. +Monitoring also creates additional `ClusterRoles` that are not assigned to users by default but are created within the cluster. They are not aggregated by default but can be bound to a namespace by deploying a `RoleBinding` or `ClusterRoleBinding` that references it. To define a `RoleBinding` with `kubectl` instead of through Rancher, click [here](#assigning-roles-and-clusterroles-with-kubectl). | Role | Purpose | | ------------------------------| ---------------------------| | monitoring-ui-view | _Available as of Monitoring v2 14.5.100+_ Provides read-only access to external Monitoring UIs by giving a user permission to list the Prometheus, Alertmanager, and Grafana endpoints and make GET requests to Prometheus, Grafana, and Alertmanager UIs through the Rancher proxy. | +### Assigning Roles and ClusterRoles with kubectl + +An alternative method to using Rancher to attach a `Role` or `ClusterRole` to a user or group is by defining bindings in YAML files that you create. You must first configure the `RoleBinding` with the YAML file, then you apply the config changes by running the `kubectl apply` command. + + +* **Roles**: Below is an example of a YAML file to help you configure `RoleBindings` in Kubernetes to attach to a user. You will need to fill in the name below, and name is case-sensitive. + +``` +# monitoring-config-view-role-binding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: monitoring-config-view + namespace: cattle-monitoring-system +roleRef: + kind: Role + name: monitoring-config-view + apiGroup: rbac.authorization.k8s.io +subjects: +- kind: User + name: u-b4qkhsnliz # this can be found via `kubectl get users -A` + apiGroup: rbac.authorization.k8s.io +``` + +* **kubectl**: Below is an example of a `kubectl` command used to apply the binding you've created in the YAML file. As noted, you will need to fill in your YAML filename accordingly. + + * **`kubectl apply -f monitoring-config-view-role-binding.yaml` + # Users with Rancher Cluster Manager Based Permissions The relationship between the default roles deployed by Rancher Cluster Manager (i.e. cluster-owner, cluster-member, project-owner, project-member), the default k8s roles, and the roles deployed by the rancher-monitoring chart are detailed in the table below: diff --git a/content/rancher/v2.6/en/monitoring-alerting/rbac/_index.md b/content/rancher/v2.6/en/monitoring-alerting/rbac/_index.md index cca1942fff3..ba487525225 100644 --- a/content/rancher/v2.6/en/monitoring-alerting/rbac/_index.md +++ b/content/rancher/v2.6/en/monitoring-alerting/rbac/_index.md @@ -11,7 +11,6 @@ This section describes the expectations for RBAC for Rancher Monitoring. - [Users with Kubernetes View Permissions](#users-with-kubernetes-view-permissions) - [Additional Monitoring Roles](#additional-monitoring-roles) - [Additional Monitoring ClusterRoles](#additional-monitoring-clusterroles) -- [Additional Monitoring Roles](#additional-monitoring-roles) - [Users with Rancher Based Permissions](#users-with-rancher-based-permissions) - [Differences in 2.5.x](#differences-in-2-5-x) - [Assigning Additional Access](#assigning-additional-access) @@ -65,7 +64,7 @@ Only those with who have some Kubernetes `ClusterRole` should be able to: ### Additional Monitoring Roles -Monitoring also creates additional `Roles` that are not assigned to users by default but are created within the cluster. They can be bound to a namespace by deploying a RoleBinding that references it. +Monitoring also creates additional `Roles` that are not assigned to users by default but are created within the cluster. They can be bound to a namespace by deploying a `RoleBinding` that references it. To define a `RoleBinding` with `kubectl` instead of through Rancher, click [here](#assigning-roles-and-clusterroles-with-kubectl). Admins should use these roles to provide more fine-grained access to users: @@ -80,12 +79,41 @@ Admins should use these roles to provide more fine-grained access to users: ### Additional Monitoring ClusterRoles -Monitoring also creates additional `ClusterRoles` that are not assigned to users by default but are created within the cluster. They are not aggregated by default but can be bound to a namespace by deploying a RoleBinding that references it. +Monitoring also creates additional `ClusterRoles` that are not assigned to users by default but are created within the cluster. They are not aggregated by default but can be bound to a namespace by deploying a `RoleBinding` or `ClusterRoleBinding` that references it. To define a `RoleBinding` with `kubectl` instead of through Rancher, click [here](#assigning-roles-and-clusterroles-with-kubectl). | Role | Purpose | | ------------------------------| ---------------------------| | monitoring-ui-view | _Available as of Monitoring v2 14.5.100+_ Provides read-only access to external Monitoring UIs by giving a user permission to list the Prometheus, Alertmanager, and Grafana endpoints and make GET requests to Prometheus, Grafana, and Alertmanager UIs through the Rancher proxy. | +### Assigning Roles and ClusterRoles with kubectl + +An alternative method to using Rancher to attach a `Role` or `ClusterRole` to a user or group is by defining bindings in YAML files that you create. You must first configure the `RoleBinding` with the YAML file, then you apply the config changes by running the `kubectl apply` command. + + +* **Roles**: Below is an example of a YAML file to help you configure `RoleBindings` in Kubernetes. You will need to fill in the name below, and name is case-sensitive. + +``` +# monitoring-config-view-role-binding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: monitoring-config-view + namespace: cattle-monitoring-system +roleRef: + kind: Role + name: monitoring-config-view + apiGroup: rbac.authorization.k8s.io +subjects: +- kind: User + name: u-b4qkhsnliz # this can be found via `kubectl get users -A` + apiGroup: rbac.authorization.k8s.io +``` + +* **kubectl**: Below is an example of a `kubectl` command used to apply the binding you've created in the YAML file. As noted, you will need to fill in your YAML filename accordingly. + + * **`kubectl apply -f monitoring-config-view-role-binding.yaml` + + # Users with Rancher Based Permissions The relationship between the default roles deployed by Rancher (i.e. cluster-owner, cluster-member, project-owner, project-member), the default Kubernetes roles, and the roles deployed by the rancher-monitoring chart are detailed in the table below: From 74898347669661a08c2288d371fc3314d4a42afe Mon Sep 17 00:00:00 2001 From: Jen Travinski Date: Thu, 23 Sep 2021 12:38:32 -0400 Subject: [PATCH 4/6] Documented that cluster templates can be managed in Cluster Management (#3537) * Added note for restricted admins * Revised wording for restricted admin navigation * Revised note on restricted admin --- .../rancher/v2.6/en/admin-settings/cluster-templates/_index.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/rancher/v2.6/en/admin-settings/cluster-templates/_index.md b/content/rancher/v2.6/en/admin-settings/cluster-templates/_index.md index 9173fe65f45..ae050be8a8f 100644 --- a/content/rancher/v2.6/en/admin-settings/cluster-templates/_index.md +++ b/content/rancher/v2.6/en/admin-settings/cluster-templates/_index.md @@ -56,6 +56,8 @@ In this section, you'll learn how to add the cluster template to the `local` clu **Result:** The cluster template available from the **Apps & Marketplace** in Rancher's `local` cluster. It can now be used to deploy clusters. +> * **Restricted Admin access:** If you are a restricted admin and don’t have access to the `local` cluster, you may still add new RKE2 templates and manage cluster repositories. To navigate to the chart repository, go to the left navigation bar and click **☰ > Cluster Management > Advanced > Repositories**. You will bypass steps 1 - 6 above, then proceed to follow steps 7 - 12 to create the cluster template. + # Creating a Cluster from a Cluster Template > **Prerequisites:** From 9ed690c625e57a0f6d284623832c6a0973b39ea6 Mon Sep 17 00:00:00 2001 From: Jen Travinski Date: Fri, 24 Sep 2021 16:43:29 -0400 Subject: [PATCH 5/6] Documented RKE2 feature flag and new RKE2 options for Windows clusters (#3545) * Notes for RKE2 options for Windows clusters * Added feature flag for RKE2 * Added new section for 2.6.1 changes * Updated feature flag * Revised RKE2 Windows Clusters * Made requested changes --- .../rke-clusters/windows-clusters/_index.md | 4 +++- .../v2.6/en/installation/resources/feature-flags/_index.md | 2 ++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md index 56228d49c21..c63fccff494 100644 --- a/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md +++ b/content/rancher/v2.6/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md @@ -34,7 +34,9 @@ _Tech Preview_ Rancher v2.6 introduces provisioning for [RKE2](https://docs.rke2.io/) clusters directly from the Rancher UI. RKE2, also known as RKE Government, is a fully conformant Kubernetes distribution that focuses on security and compliance within the U.S. Federal Government sector. -The RKE2 provisioning tech preview also includes installing RKE2 on Windows clusters. Windows features for RKE2 include: +The RKE2 provisioning tech preview also includes installing RKE2 on Windows clusters. When provisioning a new Windows cluster, users can select "Windows" and then choose the appropriate options to configure the custom cluster under the Cluster Management page. Only Windows worker nodes may be registered. + +Windows features for RKE2 include: - Windows Containers with RKE2 powered by containerd - Added provisioning of Windows RKE2 custom clusters directly from the Rancher UI diff --git a/content/rancher/v2.6/en/installation/resources/feature-flags/_index.md b/content/rancher/v2.6/en/installation/resources/feature-flags/_index.md index eae48b246e9..74840feea9f 100644 --- a/content/rancher/v2.6/en/installation/resources/feature-flags/_index.md +++ b/content/rancher/v2.6/en/installation/resources/feature-flags/_index.md @@ -25,6 +25,7 @@ For example, if you install Rancher, then set a feature flag to true with the Ra The following is a list of the feature flags available in Rancher: +- `rke2`: We have introduced the ability to provision RKE2 clusters as tech preview. By default, this feature flag is enabled, which allows users to attempt to provision these type of clusters. - `token-hashing`: This feature enables one-way [hashing of tokens]({{}}/rancher/v2.6/en/api/api-tokens) and cannot be disabled once enabled. - `fleet`: Rancher comes with [Fleet]({{}}/rancher/v2.6/en/deploy-across-clusters/fleet) preinstalled in v2.5+. Rancher v2.6's new provisioning system leverages Fleet's bundle deployment capabilities in order to manage clusters at scale. Therefore, in Rancher v2.6, Fleet can no longer be disabled. If Fleet was disabled in Rancher v2.5.x, it will become enabled if Rancher is upgraded to v2.6.x. - `continuous-delivery`: In Rancher v2.5.x, Fleet came with a GitOps feature that could not be disabled separately from Fleet. In Rancher v2.6, the `continuous-delivery` feature flag was introduced to allow the GitOps feature of Fleet to be disabled. For more information, see [this page.](./continuous-delivery) @@ -46,6 +47,7 @@ The below table shows the availability and default value for feature flags in Ra | `fleet` | `true` | Can no longer be disabled | v2.6.0 | N/A | | `continuous-delivery` | `true` | GA* | v2.6.0 | | | `token-hashing` | `false` | GA* | v2.6.0 | | +| `rke2` | `true` | Experimental | v2.6.0 | | \* Generally Available. This feature is included in Rancher and it is not experimental. From 255936e3fd9ed1a324b4ab3327232a30e38653e1 Mon Sep 17 00:00:00 2001 From: Jen Travinski Date: Tue, 28 Sep 2021 14:46:07 -0400 Subject: [PATCH 6/6] [Rancher2] Document Harvester integration features (#3534) * Added Harvester feature flag into list and table * Updated wording for feature flag * Added comment on Harvester list page * Removed link * Renamed Harvester list page --- .../v2.6/en/installation/resources/feature-flags/_index.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/rancher/v2.6/en/installation/resources/feature-flags/_index.md b/content/rancher/v2.6/en/installation/resources/feature-flags/_index.md index 74840feea9f..de576a7bad7 100644 --- a/content/rancher/v2.6/en/installation/resources/feature-flags/_index.md +++ b/content/rancher/v2.6/en/installation/resources/feature-flags/_index.md @@ -25,6 +25,7 @@ For example, if you install Rancher, then set a feature flag to true with the Ra The following is a list of the feature flags available in Rancher: +- `harvester`: This feature flag is available starting in v2.6.1. It is used to manage access to the Virtualization Management page where users can navigate directly to Harvester clusters and access the Harvester UI. - `rke2`: We have introduced the ability to provision RKE2 clusters as tech preview. By default, this feature flag is enabled, which allows users to attempt to provision these type of clusters. - `token-hashing`: This feature enables one-way [hashing of tokens]({{}}/rancher/v2.6/en/api/api-tokens) and cannot be disabled once enabled. - `fleet`: Rancher comes with [Fleet]({{}}/rancher/v2.6/en/deploy-across-clusters/fleet) preinstalled in v2.5+. Rancher v2.6's new provisioning system leverages Fleet's bundle deployment capabilities in order to manage clusters at scale. Therefore, in Rancher v2.6, Fleet can no longer be disabled. If Fleet was disabled in Rancher v2.5.x, it will become enabled if Rancher is upgraded to v2.6.x. @@ -47,6 +48,7 @@ The below table shows the availability and default value for feature flags in Ra | `fleet` | `true` | Can no longer be disabled | v2.6.0 | N/A | | `continuous-delivery` | `true` | GA* | v2.6.0 | | | `token-hashing` | `false` | GA* | v2.6.0 | | +| `harvester` | `true` | Experimental | v2.6.1 | | | `rke2` | `true` | Experimental | v2.6.0 | | \* Generally Available. This feature is included in Rancher and it is not experimental.