From c3a853d67b38ef1451befc4d6287872de2f67048 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Steenis Date: Wed, 4 Jul 2018 12:17:04 +0200 Subject: [PATCH] Add requirements for RHEL/CentOS --- .../ha-server-install-external-lb/_index.md | 14 +++++--- .../installation/ha-server-install/_index.md | 16 ++++++---- .../rke/v0.1.x/en/installation/os/_index.md | 32 +++++++++++++++++++ 3 files changed, 51 insertions(+), 11 deletions(-) diff --git a/content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md index 868ce25ae97..5ff9d80fd12 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md @@ -187,18 +187,22 @@ Once you have the `rancher-cluster.yml` config file template, edit the nodes sec 2. Update the `nodes` section with the information of your [Linux hosts](#provision-linux-hosts). - For each node in your cluster, update the following placeholders: `IP_ADDRESS_X` and `USER`. + For each node in your cluster, update the following placeholders: `IP_ADDRESS_X` and `USER`. The specified user should be able to access the Docket socket, you can test this by logging in with the specified user and run `docker ps`. + + >**Note:** + > When using RHEL/CentOS, the SSH user can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565. See [Operating System Requirements]({{< baseurl >}}/rke/v0.1.x/en/installation/os#redhat-enterprise-linux-rhel-centos) for RHEL/CentOS specific requirements. + ``` nodes: + # The IP address or hostname of the node - address: IP_ADDRESS_1 - # THE IP ADDRESS OR HOSTNAME OF THE NODE + # User that can login to the node and has access to the Docker socket (i.e. can execute `docker ps` on the node) + # When using RHEL/CentOS, this can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565 user: USER - # USER WITH ADMIN ACCESS. USUALLY `root` role: [controlplane,etcd,worker] + # Path the SSH key that can be used to access to node with the specified user ssh_key_path: ~/.ssh/id_rsa - # PATH TO SSH KEY THAT AUTHENTICATES ON YOUR WORKSTATION - # USUALLY THE VALUE ABOVE - address: IP_ADDRESS_2 user: USER role: [controlplane,etcd,worker] diff --git a/content/rancher/v2.x/en/installation/ha-server-install/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/_index.md index e2b416fcdf6..b0356a915d3 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install/_index.md @@ -236,18 +236,22 @@ Once you have the `rancher-cluster.yml` config file template, edit the nodes sec 2. Update the `nodes` section with the information of your [Linux hosts](#provision-linux-hosts). - For each node in your cluster, update the following placeholders: `IP_ADDRESS_X` and `USER`. + For each node in your cluster, update the following placeholders: `IP_ADDRESS_X` and `USER`. The specified user should be able to access the Docket socket, you can test this by logging in with the specified user and run `docker ps`. + + >**Note:** + > When using RHEL/CentOS, the SSH user can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565. See [Operating System Requirements]({{< baseurl >}}/rke/v0.1.x/en/installation/os#redhat-enterprise-linux-rhel-centos) for RHEL/CentOS specific requirements. + ``` nodes: + # The IP address or hostname of the node - address: IP_ADDRESS_1 - # THE IP ADDRESS OR HOSTNAME OF THE NODE + # User that can login to the node and has access to the Docker socket (i.e. can execute `docker ps` on the node) + # When using RHEL/CentOS, this can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565 user: USER - # USER WITH ADMIN ACCESS. USUALLY `root` role: [controlplane,etcd,worker] + # Path the SSH key that can be used to access to node with the specified user ssh_key_path: ~/.ssh/id_rsa - # PATH TO SSH KEY THAT AUTHENTICATES ON YOUR WORKSTATION - # USUALLY THE VALUE ABOVE - address: IP_ADDRESS_2 user: USER role: [controlplane,etcd,worker] @@ -426,7 +430,7 @@ During installation, RKE automatically generates a config file named `kube_confi You have a couple of options: - Create a backup of your Rancher Server in case of a disaster scenario: [High Availablility Back Up and Restoration]({{< baseurl >}}/rancher/v2.x/en/installation/backups-and-restoration/ha-backup-and-restoration). -- Create a Kubernetes cluster: [Creating a Cluster]({{ < baseurl > }}/rancher/v2.x/en/tasks/clusters/creating-a-cluster/). +- Create a Kubernetes cluster: [Creating a Cluster]({{< baseurl >}}/rancher/v2.x/en/tasks/clusters/creating-a-cluster/).
diff --git a/content/rke/v0.1.x/en/installation/os/_index.md b/content/rke/v0.1.x/en/installation/os/_index.md index 6c9af64ac81..30f7f5c1b4d 100644 --- a/content/rke/v0.1.x/en/installation/os/_index.md +++ b/content/rke/v0.1.x/en/installation/os/_index.md @@ -10,8 +10,40 @@ RKE runs on almost any Linux OS with Docker installed. Most of the development a ``` usermod -aG docker ``` + + See [Manage Docker as a non-root user](https://docs.docker.com/install/linux/linux-postinstall/#manage-docker-as-a-non-root-user) to see how you can configure access to Docker without using the `root` user. - Swap should be disabled on any worker nodes +### RedHat Enterprise Linux (RHEL) / CentOS + +If using RedHat Enterprise Linux or CentOS, you cannot use the `root` user as [SSH user]({{< baseurl >}}/rke/v0.1.x/en/config-options/nodes/#ssh-user) due to [Bugzilla 1527565](https://bugzilla.redhat.com/show_bug.cgi?id=1527565). If you are using the Docker package supplied by RedHat / CentOS, the `dockerroot` group is automatically added to the system. You will need to edit (or create) `/etc/docker/daemon.json` to include the following: + +``` +{ + "group": "dockerroot" +} +``` + +Restart Docker after editing or creating the file. After restarting Docker, you can check the group permission of the Docker socket (`/var/run/docker.sock`), which should show `dockerroot` as group: + +``` +srw-rw----. 1 root dockerroot 0 Jul 4 09:57 /var/run/docker.sock +``` + +Add the SSH user you want to use to this group, this can't be the `root` user. + +``` +usermod -aG dockerroot +``` + +To verify that the user is correctly configured, log out of the node and login with your SSH user, and execute `docker ps`: + +``` +ssh @node +$ docker ps +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +``` + ### Software - Docker - Each Kubernetes version supports different Docker versions.