From 4e28cab675e38c5bdfdc72cc66ed2fb74b75ba08 Mon Sep 17 00:00:00 2001 From: haydndup Date: Sun, 25 Oct 2020 14:27:22 +0100 Subject: [PATCH 1/6] Fix small typo --- .../v2.x/en/installation/resources/troubleshooting/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/installation/resources/troubleshooting/_index.md b/content/rancher/v2.x/en/installation/resources/troubleshooting/_index.md index c4fe4af00c9..df6aa08e731 100644 --- a/content/rancher/v2.x/en/installation/resources/troubleshooting/_index.md +++ b/content/rancher/v2.x/en/installation/resources/troubleshooting/_index.md @@ -76,7 +76,7 @@ kubectl -n cattle-system logs -f rancher-784d94f59b-vgqzh Use your browser to check the certificate details. If it says the Common Name is "Kubernetes Ingress Controller Fake Certificate", something may have gone wrong with reading or issuing your SSL cert. -> **Note:** if you are using LetsEncrypt to issue certs it can sometimes take a few minuets to issue the cert. +> **Note:** if you are using LetsEncrypt to issue certs it can sometimes take a few minutes to issue the cert. ### Checking for issues with cert-manager issued certs (Rancher Generated or LetsEncrypt) From c25cbe4d6d7178c628caa5c63a65067044c11b98 Mon Sep 17 00:00:00 2001 From: catherineluse Date: Mon, 26 Oct 2020 12:00:27 -0700 Subject: [PATCH 2/6] Delete inaccurate paragraphs from logging page --- content/rancher/v2.x/en/logging/v2.5/_index.md | 8 -------- 1 file changed, 8 deletions(-) diff --git a/content/rancher/v2.x/en/logging/v2.5/_index.md b/content/rancher/v2.x/en/logging/v2.5/_index.md index 329b5fce0c3..f186543081b 100644 --- a/content/rancher/v2.x/en/logging/v2.5/_index.md +++ b/content/rancher/v2.x/en/logging/v2.5/_index.md @@ -5,13 +5,11 @@ weight: 1 --- - [Changes in Rancher v2.5](#changes-in-rancher-v2-5) -- [Configuring the Logging Output for the Rancher Kubernetes Cluster](#configuring-the-logging-output-for-the-rancher-kubernetes-cluster) - [Enabling Logging for Rancher Managed Clusters](#enabling-logging-for-rancher-managed-clusters) - [Uninstall Logging](#uninstall-logging) - [Configuring the Logging Application](#configuring-the-logging-application) - [Working with Taints and Tolerations](#working-with-taints-and-tolerations) - ### Changes in Rancher v2.5 The following changes were introduced to logging in Rancher v2.5: @@ -30,12 +28,6 @@ The following figure from the [Banzai documentation](https://banzaicloud.com/doc ![How the Banzai Cloud Logging Operator Works with Fluentd]({{}}/img/rancher/banzai-cloud-logging-operator.png) -### Configuring the Logging Output for the Rancher Kubernetes Cluster - -If you install Rancher as a Helm chart, you'll configure the Helm chart options to select a logging output for all the logs in the local Kubernetes cluster. - -If you install Rancher using the Rancher CLI on an Linux OS, the Rancher Helm chart will be installed on a Kubernetes cluster with default options. Then when the Rancher UI is available, you'll enable the logging app from the Apps section of the UI. Then during the process of installing the logging application, you will configure the logging output. - ### Enabling Logging for Rancher Managed Clusters You can enable the logging for a Rancher managed cluster by going to the Apps page and installing the logging app. From 5778f20dd3f4edf7216b9f0233f8501ffbf2b7ef Mon Sep 17 00:00:00 2001 From: catherineluse Date: Mon, 26 Oct 2020 13:15:06 -0700 Subject: [PATCH 3/6] Edit Rancher v2.5 logging docs --- .../rancher/v2.x/en/logging/v2.5/_index.md | 48 +++++++++++++------ 1 file changed, 33 insertions(+), 15 deletions(-) diff --git a/content/rancher/v2.x/en/logging/v2.5/_index.md b/content/rancher/v2.x/en/logging/v2.5/_index.md index f186543081b..cc8b7a446c6 100644 --- a/content/rancher/v2.x/en/logging/v2.5/_index.md +++ b/content/rancher/v2.x/en/logging/v2.5/_index.md @@ -7,10 +7,12 @@ weight: 1 - [Changes in Rancher v2.5](#changes-in-rancher-v2-5) - [Enabling Logging for Rancher Managed Clusters](#enabling-logging-for-rancher-managed-clusters) - [Uninstall Logging](#uninstall-logging) +- [Role-based Access Control](#role-based-access-control) - [Configuring the Logging Application](#configuring-the-logging-application) - [Working with Taints and Tolerations](#working-with-taints-and-tolerations) -### Changes in Rancher v2.5 + +# Changes in Rancher v2.5 The following changes were introduced to logging in Rancher v2.5: @@ -28,7 +30,7 @@ The following figure from the [Banzai documentation](https://banzaicloud.com/doc ![How the Banzai Cloud Logging Operator Works with Fluentd]({{}}/img/rancher/banzai-cloud-logging-operator.png) -### Enabling Logging for Rancher Managed Clusters +# Enabling Logging for Rancher Managed Clusters You can enable the logging for a Rancher managed cluster by going to the Apps page and installing the logging app. @@ -39,7 +41,7 @@ You can enable the logging for a Rancher managed cluster by going to the Apps pa **Result:** The logging app is deployed in the `cattle-logging-system` namespace. -### Uninstall Logging +# Uninstall Logging 1. From the **Cluster Explorer,** click **Apps & Marketplace.** 1. Click **Installed Apps.** @@ -49,7 +51,27 @@ You can enable the logging for a Rancher managed cluster by going to the Apps pa **Result** `rancher-logging` is uninstalled. -### Configuring the Logging Application +# Role-based Access Control + +Rancher logging has two roles, `logging-admin` and `logging-view`. + +`logging-admin` allows users full access to namespaced flows and outputs. + +The `logging-view` role allows users to view namespaced flows and outputs, and cluster flows and outputs. + +Edit access to the cluster flow and cluster output resources is powerful as it allows any user with edit access control of all logs in the cluster. + +In Rancher, the cluster administrator role is the only role with full access to all rancher-logging resources. + +Cluster members are not able to edit or read any logging resources. + +Project owners are able to create namespaced flows and outputs in the namespaces under their projects. This means that project owners can collect logs from anything in their project namespaces. Project members are able to view the flows and outputs in the namespaces under their projects. Project owners and project members require at least 1 namespace in their project to use logging. If they do not have at least one namespace in their project they may not see the logging button in the top nav dropdown. + +# Configuring the Logging Application + +To configure the logging application, go to the **Cluster Explorer** in the Rancher UI. In the upper left corner, click **Cluster Explorer > Logging.** + +### Overview of Logging Custom Resources The following Custom Resource Definitions are used to configure logging: @@ -60,11 +82,7 @@ According to the [Banzai Cloud documentation,](https://banzaicloud.com/docs/one- > You can define `outputs` (destinations where you want to send your log messages, for example, Elasticsearch, or and Amazon S3 bucket), and `flows` that use filters and selectors to route log messages to the appropriate outputs. You can also define cluster-wide outputs and flows, for example, to use a centralized output that namespaced users cannot modify. -**RBAC** - -Rancher logging has two roles, `logging-admin` and `logging-view`. `logging-admin` allows users full access to namespaced flows and outputs. The `logging-view` role allows users to view namespaced flows and outputs, and cluster flows and outputs. Edit access to the cluster flow and cluster output resources is powerful as it allows any user with edit access control of all logs in the cluster. Cluster admin is the only role with full access to all rancher-logging resources. Cluster members are not able to edit or read any logging resources. Project owners are able to create namespaced flows and outputs in the namespaces under their projects. This means that project owners can collect logs from anything in their project namespaces. Project members are able to view the flows and outputs in the namespaces under their projects. Project owners and project members require at least 1 namespace in their project to use logging. If they do not have at least one namespace in their project they may not see the logging button in the top nav dropdown. - -**Examples** +### Examples Let's say you wanted to send all logs in your cluster to an elasticsearch cluster. @@ -249,7 +267,7 @@ spec: if we break down what is happening, first we create a deployment of a container that has the additional syslog plugin and accepts logs forwarded from another fluentd. Next we create an output configured as a forwarder to our deployment. The deployment fluentd will then forward all logs to the configured syslog destination. -### Working with Taints and Tolerations +# Working with Taints and Tolerations "Tainting" a Kubernetes node causes pods to repel running on that node. Unless the pods have a ```toleration``` for that node's taint, they will run on other nodes in the cluster. @@ -257,7 +275,7 @@ Unless the pods have a ```toleration``` for that node's taint, they will run on Using ```nodeSelector``` gives pods an affinity towards certain nodes. Both provide choice for the what node(s) the pod will run on. -**Default Implementation in Rancher's Logging Stack** +### Default Implementation in Rancher's Logging Stack By default, Rancher taints all Linux nodes with ```cattle.io/os=linux```, and does not taint Windows nodes. The logging stack pods have ```tolerations``` for this taint, which enables them to run on Linux nodes. @@ -282,14 +300,14 @@ spec: In the above example, we ensure that our pod only runs on Linux nodes, and we add a ```toleration``` for the taint we have on all of our Linux nodes. You can do the same with Rancher's existing taints, or with your own custom ones. -**Are clusters with Windows worker nodes supported?** +### Windows Support -Yes, clusters with Windows worker support logging with some small caveats... +Clusters with Windows worker support logging with some small caveats: 1. Windows node logs are currently unable to be exported. 2. ```fluentd-configcheck``` pod(s) will fail due to an [upstream issue](https://github.com/banzaicloud/logging-operator/issues/592), where ```tolerations``` and ```nodeSelector``` settings are not inherited from the ```logging-operator```. -**Adding NodeSelector Settings and Tolerations for Custom Taints** +### Adding NodeSelector Settings and Tolerations for Custom Taints If you would like to add your own ```nodeSelector``` settings, or if you would like to add ```tolerations``` for additional taints, you can pass the following to the chart's values. @@ -308,4 +326,4 @@ However, if you would like to add tolerations for *only* the ```fluentbit``` con ```yaml fluentbit_tolerations: # insert tolerations list for fluentbit containers only -``` +``` \ No newline at end of file From 193d7f6a1d5ef7477bc81903491e2b6d3dddbb64 Mon Sep 17 00:00:00 2001 From: Chris Kim Date: Tue, 27 Oct 2020 15:02:54 -0400 Subject: [PATCH 4/6] Add selinux documentation Signed-off-by: Chris Kim --- content/k3s/latest/en/advanced/_index.md | 14 ++++++++++++-- .../en/installation/install-options/_index.md | 6 ++++-- 2 files changed, 16 insertions(+), 4 deletions(-) diff --git a/content/k3s/latest/en/advanced/_index.md b/content/k3s/latest/en/advanced/_index.md index 8d39be5ea44..6ae8c6946cb 100644 --- a/content/k3s/latest/en/advanced/_index.md +++ b/content/k3s/latest/en/advanced/_index.md @@ -306,14 +306,24 @@ sudo reboot # Experimental SELinux Support -As of release v1.17.4+k3s1, experimental support for SELinux has been added to K3s's embedded containerd. If you are installing K3s on a system where SELinux is enabled by default (such as CentOS), you must ensure the proper SELinux policies have been installed. The [install script]({{}}/k3s/latest/en/installation/install-options/#installation-script-options) will fail if they are not. The necessary policies can be installed with the following commands: +As of release v1.17.4+k3s1, experimental support for SELinux has been added to K3s's embedded containerd. If you are installing K3s on a system where SELinux is enabled by default (such as CentOS), you must ensure the proper SELinux policies have been installed. + +{{% tabs %}} +{{% tab "automatic installation" %}} +As of release v1.19.3+k3s2, the [install script]({{}}/k3s/latest/en/installation/install-options/#installation-script-options) will automatically install the SELinux RPM from the Rancher RPM repository if on a compatible system if not performing an air-gapped install. Automatic installation can be skipped by setting `INSTALL_K3S_SKIP_SELINUX_RPM=true`. +{{%/tab%}} +{{% tab "manual installation" %}} +The necessary policies can be installed with the following commands: ``` yum install -y container-selinux selinux-policy-base -rpm -i https://rpm.rancher.io/k3s-selinux-0.1.1-rc1.el7.noarch.rpm +yum install -y https://rpm.rancher.io/k3s/latest/common/centos/7/noarch/k3s-selinux-0.2-1.el7_8.noarch.rpm ``` To force the install script to log a warning rather than fail, you can set the following environment variable: `INSTALL_K3S_SELINUX_WARN=true`. +{{%/tab%}} +{{% /tabs %}} + The way that SELinux enforcement is enabled or disabled depends on the K3s version. Prior to v1.19.x, SELinux enablement for the builtin containerd was automatic but could be disabled by passing `--disable-selinux`. With v1.19.x and beyond, enabling SELinux must be affirmatively configured via the `--selinux` flag or config file entry. Servers and agents that specify both the `--selinux` and (deprecated) `--disable-selinux` flags will fail to start. Using a custom `--data-dir` under SELinux is not supported. To customize it, you would most likely need to write your own custom policy. For guidance, you could refer to the [containers/container-selinux](https://github.com/containers/container-selinux) repository, which contains the SELinux policy files for Container Runtimes, and the [rancher/k3s-selinux](https://github.com/rancher/k3s-selinux) repository, which contains the SELinux policy for K3s . diff --git a/content/k3s/latest/en/installation/install-options/_index.md b/content/k3s/latest/en/installation/install-options/_index.md index 096ba7da4a6..cffd0b436d5 100644 --- a/content/k3s/latest/en/installation/install-options/_index.md +++ b/content/k3s/latest/en/installation/install-options/_index.md @@ -40,8 +40,10 @@ When using this method to install K3s, the following environment variables can b | `INSTALL_K3S_SYSTEMD_DIR` | Directory to install systemd service and environment files to, or use `/etc/systemd/system` as the default. | | `INSTALL_K3S_EXEC` | Command with flags to use for launching K3s in the service. If the command is not specified, and the `K3S_URL` is set, it will default to "agent." If `K3S_URL` not set, it will default to "server." For help, refer to [this example.]({{}}/k3s/latest/en/installation/install-options/how-to-flags/#example-b-install-k3s-exec) | | `INSTALL_K3S_NAME` | Name of systemd service to create, will default to 'k3s' if running k3s as a server and 'k3s-agent' if running k3s as an agent. If specified the name will be prefixed with 'k3s-'. | -| `INSTALL_K3S_TYPE` | Type of systemd service to create, will default from the K3s exec command if not specified. -| `INSTALL_K3S_CHANNEL_URL` | Channel URL for fetching K3s download URL. Defaults to https://update.k3s.io/v1-release/channels. +| `INSTALL_K3S_TYPE` | Type of systemd service to create, will default from the K3s exec command if not specified. | +| `INSTALL_K3S_SELINUX_WARN` | If set to true will continue if k3s-selinux policy is not found. | +| `INSTALL_K3S_SKIP_SELINUX_RPM` | If set to true will skip automatic installation of the k3s RPM. | +| `INSTALL_K3S_CHANNEL_URL` | Channel URL for fetching K3s download URL. Defaults to https://update.k3s.io/v1-release/channels. | | `INSTALL_K3S_CHANNEL` | Channel to use for fetching K3s download URL. Defaults to "stable". Options include: `stable`, `latest`, `testing`. | From ce2cf57bc70420941ae84cf1735a273db1bb48ec Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Tue, 27 Oct 2020 15:42:46 -0700 Subject: [PATCH 5/6] Add spaces --- content/k3s/latest/en/advanced/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/k3s/latest/en/advanced/_index.md b/content/k3s/latest/en/advanced/_index.md index 6ae8c6946cb..178e58c4e38 100644 --- a/content/k3s/latest/en/advanced/_index.md +++ b/content/k3s/latest/en/advanced/_index.md @@ -311,7 +311,7 @@ As of release v1.17.4+k3s1, experimental support for SELinux has been added to K {{% tabs %}} {{% tab "automatic installation" %}} As of release v1.19.3+k3s2, the [install script]({{}}/k3s/latest/en/installation/install-options/#installation-script-options) will automatically install the SELinux RPM from the Rancher RPM repository if on a compatible system if not performing an air-gapped install. Automatic installation can be skipped by setting `INSTALL_K3S_SKIP_SELINUX_RPM=true`. -{{%/tab%}} +{{% /tab %}} {{% tab "manual installation" %}} The necessary policies can be installed with the following commands: ``` @@ -321,7 +321,7 @@ yum install -y https://rpm.rancher.io/k3s/latest/common/centos/7/noarch/k3s-seli To force the install script to log a warning rather than fail, you can set the following environment variable: `INSTALL_K3S_SELINUX_WARN=true`. -{{%/tab%}} +{{% /tab %}} {{% /tabs %}} The way that SELinux enforcement is enabled or disabled depends on the K3s version. Prior to v1.19.x, SELinux enablement for the builtin containerd was automatic but could be disabled by passing `--disable-selinux`. With v1.19.x and beyond, enabling SELinux must be affirmatively configured via the `--selinux` flag or config file entry. Servers and agents that specify both the `--selinux` and (deprecated) `--disable-selinux` flags will fail to start. From 08443382cd1ba5d4fca2e87a3ad11e4d698e571d Mon Sep 17 00:00:00 2001 From: Ansil H Date: Wed, 28 Oct 2020 23:04:17 +0530 Subject: [PATCH 6/6] Removed yaml file names Removed YAML file names as the link point to a new page --- .../resources/advanced/rke-add-on/layer-4-lb/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.x/en/installation/resources/advanced/rke-add-on/layer-4-lb/_index.md b/content/rancher/v2.x/en/installation/resources/advanced/rke-add-on/layer-4-lb/_index.md index c6e43f7248a..0c5000fd3d6 100644 --- a/content/rancher/v2.x/en/installation/resources/advanced/rke-add-on/layer-4-lb/_index.md +++ b/content/rancher/v2.x/en/installation/resources/advanced/rke-add-on/layer-4-lb/_index.md @@ -166,8 +166,8 @@ RKE uses a `.yml` config file to install and configure your Kubernetes cluster. 1. Download one of following templates, depending on the SSL certificate you're using. - - [Template for self-signed certificate
`3-node-certificate.yml`]({{}}/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate) - - [Template for certificate signed by recognized CA
`3-node-certificate-recognizedca.yml`]({{}}/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate-recognizedca) + - [Template for self-signed certificate
]({{}}/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate) + - [Template for certificate signed by recognized CA
]({{}}/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate-recognizedca)