diff --git a/.drone.yml b/.drone.yml index e4dd2da5704..c8b5aa426c8 100644 --- a/.drone.yml +++ b/.drone.yml @@ -11,6 +11,18 @@ pipeline: when: event: [pull_request] + docker-publish-algolia: + group: publish + image: plugins/docker + dockerfile: Dockerfile.algolia + repo: rancher/docs + context: . + tag: algolia + secrets: [docker_username, docker_password] + when: + branch: master + event: push + docker-publish-dev: group: publish image: plugins/docker @@ -18,13 +30,7 @@ pipeline: repo: rancher/docs context: . tag: dev - secrets: [docker_username, docker_password, algolia_app_id, algolia_admin_key] - build_args: - - ALGOLIA_INDEX_NAME=dev_docs - - ALGOLIA_INDEX_FILE=public/algolia.json - build_args_from_env: - - ALGOLIA_APP_ID - - ALGOLIA_ADMIN_KEY + secrets: [docker_username, docker_password] when: branch: master event: push @@ -36,13 +42,7 @@ pipeline: repo: rancher/docs context: . tag: staging - secrets: [docker_username, docker_password, algolia_app_id, algolia_admin_key] - build_args: - - ALGOLIA_INDEX_NAME=dev_docs - - ALGOLIA_INDEX_FILE=public/algolia.json - build_args_from_env: - - ALGOLIA_APP_ID - - ALGOLIA_ADMIN_KEY + secrets: [docker_username, docker_password] when: branch: master event: push @@ -54,13 +54,7 @@ pipeline: repo: rancher/docs context: . tag: latest - secrets: [docker_username, docker_password, algolia_app_id, algolia_admin_key] - build_args: - - ALGOLIA_INDEX_NAME=prod_docs - - ALGOLIA_INDEX_FILE=public/algolia.json - build_args_from_env: - - ALGOLIA_APP_ID - - ALGOLIA_ADMIN_KEY + secrets: [docker_username, docker_password] when: branch: master event: push diff --git a/Dockerfile.algolia b/Dockerfile.algolia new file mode 100644 index 00000000000..9212eafcc24 --- /dev/null +++ b/Dockerfile.algolia @@ -0,0 +1,12 @@ +FROM rancher/docs:build + +VOLUME /usr/share/nginx/html/docs +WORKDIR /run + +ADD https://github.com/rancher/giddyup/releases/download/v0.19.0/giddyup /usr/bin/giddyup +RUN chmod +x /usr/bin/giddyup + +COPY gulpfile.babel.js /run/ + +ENTRYPOINT ["gulp"] +CMD ["publish:search-index"] diff --git a/Dockerfile.dev b/Dockerfile.dev index 30b14aee341..26ce67c09b6 100644 --- a/Dockerfile.dev +++ b/Dockerfile.dev @@ -1,8 +1,4 @@ FROM rancher/docs:build -ARG ALGOLIA_APP_ID -ARG ALGOLIA_INDEX_NAME -ARG ALGOLIA_INDEX_FILE -ARG ALGOLIA_ADMIN_KEY VOLUME ["/site"] WORKDIR /run @@ -25,11 +21,6 @@ COPY gulpfile.babel.js /run/ ADD https://github.com/rancherlabs/website-theme/archive/master.tar.gz master.tar.gz RUN mkdir -p /run/node_modules/rancher-website-theme && tar -xzf master.tar.gz --strip 1 -C /run/node_modules/rancher-website-theme && rm master.tar.gz -ENV ALGOLIA_APP_ID=$ALGOLIA_APP_ID -ENV ALGOLIA_INDEX_NAME=$ALGOLIA_INDEX_NAME -ENV ALGOLIA_INDEX_FILE=$ALGOLIA_INDEX_FILE -ENV ALGOLIA_ADMIN_KEY=$ALGOLIA_ADMIN_KEY - # Expose default hugo port EXPOSE 9001 diff --git a/Dockerfile.prod b/Dockerfile.prod index 9869a6412e5..65bc10b5b7a 100644 --- a/Dockerfile.prod +++ b/Dockerfile.prod @@ -1,11 +1,6 @@ FROM rancher/docs:build as build -ARG ALGOLIA_APP_ID -ARG ALGOLIA_INDEX_NAME -ARG ALGOLIA_INDEX_FILE -ARG ALGOLIA_ADMIN_KEY WORKDIR /run - COPY gulpfile.babel.js /run/ COPY .eslintrc.js /run/ COPY config.toml /run/ @@ -22,17 +17,12 @@ ENV HUGO_ENV production ADD https://github.com/rancherlabs/website-theme/archive/master.tar.gz master.tar.gz RUN tar -xzf master.tar.gz --strip 1 -C /run/node_modules/rancher-website-theme && rm master.tar.gz - -ENV ALGOLIA_APP_ID=$ALGOLIA_APP_ID -ENV ALGOLIA_INDEX_NAME=$ALGOLIA_INDEX_NAME -ENV ALGOLIA_INDEX_FILE=$ALGOLIA_INDEX_FILE -ENV ALGOLIA_ADMIN_KEY=$ALGOLIA_ADMIN_KEY - RUN gulp build # Make sure something got built RUN stat /run/public/index.html FROM nginx +VOLUME /usr/share/nginx/html/docs COPY --from=build /run/public /usr/share/nginx/html/docs/ COPY nginx.conf /etc/nginx/conf.d/default.conf diff --git a/Dockerfile.staging b/Dockerfile.staging index d400d2f4be5..fc2fbeee1df 100644 --- a/Dockerfile.staging +++ b/Dockerfile.staging @@ -1,11 +1,6 @@ FROM rancher/docs:build as build -ARG ALGOLIA_APP_ID -ARG ALGOLIA_INDEX_NAME -ARG ALGOLIA_INDEX_FILE -ARG ALGOLIA_ADMIN_KEY WORKDIR /run - COPY gulpfile.babel.js /run/ COPY .eslintrc.js /run/ COPY config.toml /run/ @@ -22,16 +17,12 @@ ENV HUGO_ENV production ADD https://github.com/rancherlabs/website-theme/archive/master.tar.gz master.tar.gz RUN tar -xzf master.tar.gz --strip 1 -C /run/node_modules/rancher-website-theme && rm master.tar.gz -ENV ALGOLIA_APP_ID=$ALGOLIA_APP_ID -ENV ALGOLIA_INDEX_NAME=$ALGOLIA_INDEX_NAME -ENV ALGOLIA_INDEX_FILE=$ALGOLIA_INDEX_FILE -ENV ALGOLIA_ADMIN_KEY=$ALGOLIA_ADMIN_KEY - RUN gulp build-staging # Make sure something got built RUN stat /run/public/index.html FROM nginx +VOLUME /usr/share/nginx/html/docs COPY --from=build /run/public /usr/share/nginx/html/docs/ COPY nginx.conf /etc/nginx/conf.d/default.conf diff --git a/content/os/v1.x/en/installation/running-rancheros/cloud/aws/_index.md b/content/os/v1.x/en/installation/running-rancheros/cloud/aws/_index.md index 69e691183ac..969fc387daa 100644 --- a/content/os/v1.x/en/installation/running-rancheros/cloud/aws/_index.md +++ b/content/os/v1.x/en/installation/running-rancheros/cloud/aws/_index.md @@ -14,7 +14,7 @@ Once you've installed your AWS CLI, use this command to launch an EC2 instance w > **Note:** Check the RancherOS [README](https://github.com/rancher/os/blob/master/README.md) for AMI names for each region. We support PV and HVM types of AMIs. ``` -$ aws ec2 run-instances --image-id ami-ID# --count 1 --instance-type t2.micro --key-name MySSHKeyName --security-groups sg-name +$ aws ec2 run-instances --image-id ami-ID# --count 1 --instance-type t2.small --key-name MySSHKeyName --security-groups sg-name ``` Your EC2 instance is now running RancherOS! diff --git a/content/rancher/v2.x/en/concepts/alerts-and-notifiers/_index.md b/content/rancher/v2.x/en/concepts/alerts-and-notifiers/_index.md index 1538a3ffe5b..de5c31fa308 100644 --- a/content/rancher/v2.x/en/concepts/alerts-and-notifiers/_index.md +++ b/content/rancher/v2.x/en/concepts/alerts-and-notifiers/_index.md @@ -3,3 +3,34 @@ title: Alerts and Notifiers weight: 2300 draft: true --- + +Alerts and notifications are built on top of the [Prometheus Alertmanager](https://prometheus.io/docs/alerting/alertmanager/). Leveraging these tools, Rancher is able to provide the first step in notifications for events operators and application owners need to know about. + +## Notifiers + +In Rancher 2.x, a user can configure `Notifiers` for each cluster that can receive alerts for various events. By configuring the notifiers at the cluster level, project owners do not need to know SMTP settings or have access to cloud accounts. At a project level, users can configure alerts and add recipients scoped to the relevant alerts. + +Available Notifiers: + +* Email +* Slack +* PagerDuty +* Webhooks + +## Alerts + +Rancher supports alerting on a cluster level or project level. + +On a cluster level, Rancher can monitor and alert on components that manage your Kubernetes cluster including: + +* System Services +* Resource Events +* Node conditions + +Operators of Kubernetes clusters can get alerts on the health of nodes and other system level components. + +On a project level, Rancher can monitor and alert on status on specific deployments including: + +* Deployment availability +* Workloads +* Pods diff --git a/content/rancher/v2.x/en/concepts/global-configuration/authentication/_index.md b/content/rancher/v2.x/en/concepts/global-configuration/authentication/_index.md index 06dbfa7591c..94840b7de1f 100644 --- a/content/rancher/v2.x/en/concepts/global-configuration/authentication/_index.md +++ b/content/rancher/v2.x/en/concepts/global-configuration/authentication/_index.md @@ -13,12 +13,17 @@ This centralized user authentication is accomplished using the Rancher authentic The Rancher authentication proxy integrates with the following external authentication services. - Microsoft Active Directory +- Microsoft Azure AD - GitHub +- FreeIPA +- OpenLDAP However, Rancher also provides local authentication. In most cases, you should use an external authentication service over local, as external authentication allows user management from a central location. However, you may want a few local authentication users for managing Rancher under rare circumstances, such as if Active Directory is down. +For more information on how to configure external authentication or local authentication, see [Authentication](../../../tasks/global-configuration/authentication/). + ### External Authentication Configuration and Principal Users Configuration of external authentication requires: diff --git a/content/rancher/v2.x/en/installation/_index.md b/content/rancher/v2.x/en/installation/_index.md index 911632a6c33..b3f63e9abbc 100644 --- a/content/rancher/v2.x/en/installation/_index.md +++ b/content/rancher/v2.x/en/installation/_index.md @@ -28,7 +28,7 @@ Choose from the following installation options: This section also includes help content for Rancher configuration and maintenance. -- [Backups and Restoration]({{< baseurl >}}/rancher/v2.x/en/installation/backups-and-restoration/) +- [Backups and Rollbacks]({{< baseurl >}}/rancher/v2.x/en/backups/) This page lists the ports you must open to operate Rancher. diff --git a/content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md index 5ff9d80fd12..2c44d75a711 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md @@ -5,7 +5,7 @@ weight: 276 This set of instructions creates a new Kubernetes cluster that's dedicated to running Rancher in a high-availability (HA) configuration. This procedure walks you through setting up a 3-node cluster using the Rancher Kubernetes Engine (RKE). The cluster's sole purpose is running pods for Rancher. The setup is based on: - Layer 7 Loadbalancer with SSL termination (HTTPS) -- NGINX Ingress controller (HTTP) +- [NGINX Ingress controller (HTTP)](https://kubernetes.github.io/ingress-nginx/) ![Rancher HA]({{< baseurl >}}/img/rancher/ha/rancher2ha-l7.svg) @@ -64,15 +64,15 @@ Before you install Rancher, confirm you meet the host requirements. Provision 3 ### Requirements -#### Operating System +#### Operating System {{< requirements_os >}} -#### Hardware +#### Hardware {{< requirements_hardware >}} -#### Software +#### Software {{< requirements_software >}} diff --git a/content/rancher/v2.x/en/installation/ha-server-install-external-lb/nginx/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-external-lb/nginx/_index.md index 454cf7552eb..796e0ab9437 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install-external-lb/nginx/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install-external-lb/nginx/_index.md @@ -24,18 +24,18 @@ to use Nginx as a Layer 7 load balancer with Rancher. For full documentation on server IP_NODE_2:80; server IP_NODE_3:80; } - + map $http_upgrade $connection_upgrade { default Upgrade; '' close; } - + server { listen 443 ssl http2; server_name FQDN; ssl_certificate /certs/fullchain.pem; ssl_certificate_key /certs/privkey.pem; - + location / { proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto $scheme; @@ -49,7 +49,7 @@ to use Nginx as a Layer 7 load balancer with Rancher. For full documentation on proxy_read_timeout 900s; } } - + server { listen 80; server_name FQDN; diff --git a/content/rancher/v2.x/en/installation/ha-server-install/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/_index.md index b0356a915d3..d4eecdcdc1d 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install/_index.md @@ -5,7 +5,7 @@ weight: 275 This set of instructions creates a new Kubernetes cluster that's dedicated to running Rancher in a high-availability (HA) configuration. This procedure walks you through setting up a 3-node cluster using the Rancher Kubernetes Engine (RKE). The cluster's sole purpose is running pods for Rancher. The setup is based on: - Layer 4 load balancer (TCP) -- NGINX ingress controller with SSL termination (HTTPS) +- [NGINX ingress controller with SSL termination (HTTPS)](https://kubernetes.github.io/ingress-nginx/) ![Rancher HA]({{< baseurl >}}/img/rancher/ha/rancher2ha.svg) @@ -108,6 +108,8 @@ After installing NGINX, you need to update the NGINX config file, `nginx.conf`, 2. From `nginx.conf`, replace `IP_NODE_1`, `IP_NODE_2`, and `IP_NODE_3` with the IPs of your [Linux hosts](#1-provision-linux-hosts). + >**Note:** This Nginx configuration is only an example and may not suit your environment. For complete documentation, see [NGINX Load Balancing - TCP and UDP Load Balancer](https://docs.nginx.com/nginx/admin-guide/load-balancer/tcp-udp-load-balancer/). + **Example NGINX config:** ``` worker_processes 4; @@ -194,7 +196,7 @@ RKE is a fast, versatile Kubernetes installer that you can use to install Kubern 2. Make the RKE binary that you just downloaded executable. Open Terminal, change directory to the location of the RKE binary, and then run one of the commands below. >**Using Windows?** - >The file is already an executable. Skip to [Download Config File Template](#5-download-config-file-template). + >The file is already an executable. Skip to [Download Config File Template](#5-download-rke-config-file-template). ``` # MacOS @@ -391,7 +393,7 @@ Save the `.yml` file and close it. ## 9. Back Up Your RKE Config File -After you close your `.yml` file, back it up to a secure location. You can use this file again when it's time to upgrade Rancher. +After you close your `.yml` file, back it up to a secure location. You can use this file again when it's time to upgrade Rancher. ## 10. Run RKE diff --git a/content/rancher/v2.x/en/installation/ha-server-install/nlb/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/nlb/_index.md index bbdb1813d81..1bef7366ae0 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install/nlb/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install/nlb/_index.md @@ -21,7 +21,7 @@ Configuring an Amazon NLB is a multistage process. We've broken it down into mul ## Create Target Groups -Your first NLB configuration step is to create two target groups. Technically, only port 443 is needed to access Rancher, but its convenient to add a listener for port 80 which will be redirected to port 443 automatically. The NGINX controller on the nodes will make sure that port 80 gets redirected to port 443. +Your first NLB configuration step is to create two target groups. Technically, only port 443 is needed to access Rancher, but its convenient to add a listener for port 80 which will be redirected to port 443 automatically. The NGINX ingress controller on the nodes will make sure that port 80 gets redirected to port 443. Log into the [Amazon AWS Console](https://console.aws.amazon.com/ec2/) to get started, make sure to select the **Region** where your EC2 instances (Linux nodes) are created. diff --git a/content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md b/content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md index 54eeed48a4f..2c3414f7395 100644 --- a/content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md +++ b/content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md @@ -131,6 +131,8 @@ The load balancer or proxy has to be configured to support the following: This Nginx configuration is tested on Nginx version 1.13 (mainline) and 1.14 (stable). + >**Note:** This Nginx configuration is only an example and may not suit your environment. For complete documentation, see [NGINX Load Balancing - TCP and UDP Load Balancer](https://docs.nginx.com/nginx/admin-guide/load-balancer/tcp-udp-load-balancer/). + ``` upstream rancher { server rancher-server:80; diff --git a/content/rancher/v2.x/en/installation/single-node-install/_index.md b/content/rancher/v2.x/en/installation/single-node-install/_index.md index eb24c5085a3..14ac78ebd1f 100644 --- a/content/rancher/v2.x/en/installation/single-node-install/_index.md +++ b/content/rancher/v2.x/en/installation/single-node-install/_index.md @@ -62,10 +62,10 @@ For security purposes, SSL (Secure Sockets Layer) is required when using Rancher Choose from the following options: -- [Option A—Default Self-Signed Certificate](#option-adefault-self-signed-certificate) -- [Option B—Bring Your Own Certificate: Self-Signed](#option-bbring-your-own-certificate--self-signed) -- [Option C—Bring Your Own Certificate: Signed by Recognized CA](#option-cbring-your-own-certificate--signed-by-recognized-ca) -- [Option D-Let's Encrypt Certificate](#option-d-lets-encrypt-certificate) +- [Option A—Default Self-Signed Certificate](#option-a-default-self-signed-certificate) +- [Option B—Bring Your Own Certificate: Self-Signed](#option-b-bring-your-own-certificate-self-signed) +- [Option C—Bring Your Own Certificate: Signed by Recognized CA](#option-c-bring-your-own-certificate-signed-by-recognized-ca) +- [Option D—Let's Encrypt Certificate](#option-d-let-s-encrypt-certificate) ### Option A—Default Self-Signed Certificate @@ -139,7 +139,7 @@ By default, Rancher automatically generates self-signed certificates for itself 2. Select **Settings** > **cacerts**. 3. Choose `Edit` and remove the contents. Then click `Save`. -### Option D-Let's Encrypt Certificate +### Option D—Let's Encrypt Certificate Rancher supports Let's Encrypt certificates. Let's Encrypt uses an `http-01 challenge` to verify that you have control over your domain. You can confirm that you control the domain by pointing the hostname that you want to use for Rancher access (for example, `rancher.mydomain.com`) to the IP of the machine it is running on. You can bind the hostname to the IP address by creating an A record in DNS. diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/_index.md index 2d27198d556..bb81cb76f9a 100644 --- a/content/rancher/v2.x/en/tasks/global-configuration/authentication/_index.md +++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/_index.md @@ -2,25 +2,30 @@ title: Authentication weight: 50 --- -You have three options for user authentication in Rancher: -- [Active Directory]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/) - - Enterprises can use Active Directory (AD) for authentication, allowing users to sign in using their corporate credentials. +You have multiple options for user authentication in Rancher: -- [GitHub]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/authentication/github/) +- [Active Directory](./active-directory/) - Open source projects or organizations that use GitHub for source control may prefer that users sign in using their GitHub accounts. + Enterprises can use Active Directory (AD) for authentication, allowing users to sign in using their corporate credentials. - + If you have an instance of Active Directory (AD) hosted in Azure, you can configure Rancher to allow your users to log in using their AD accounts. Configuration of Azure AD external authentication requires you to make configurations in both Azure and Rancher. + +- [GitHub](./github/) + + Open source projects or organizations that use GitHub for source control may prefer that users sign in using their GitHub accounts. + +- [OpenLDAP](./openlap/) + + Organizations can use OpenLDAP for authentication, allowing users to sign in using their corporate credentials. + +- [FreeIPA](./freeipa/) + + Organizations can use FreeIPA for authentication, allowing users to sign in using their corporate credentials. -- [Azure AD]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/authentication/azure-ad/) +- [Local Authentication](./local-authentication/) - If you have an instance of Active Directory (AD) hosted in Azure, you can configure Rancher to allow your users to log in using their AD accounts. Configuration of Azure AD external authentication requires you to make configurations in both Azure and Rancher. - -- [Local Authentication]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/authentication/local-authentication/) - - If you don't want to use external authentication, you can always add users directly to Rancher. We recommend using external authentication over local authentication. + If you don't want to use external authentication, you can always add users directly to Rancher. We recommend using external authentication over local authentication. diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/_index.md index 9105b6fb27a..c79513802ca 100644 --- a/content/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/_index.md +++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/_index.md @@ -1,13 +1,14 @@ --- -title: Configuring Active Directory Authentication -weight: 3075 +title: Configuring Active Directory (AD) +weight: 51 --- In environments using Microsoft Active Directory (AD), you can configure Rancher to allow sign on using AD credentials. >**Prerequisites:** > ->- Create a service account in Active Directory with `read-only` access. {{< product >}} uses this account to verify group membership when a user makes a request using an API key. +>- Have an Active Directory server configured. +>- Create a service account in Active Directory with `read-only` access. Rancher uses this account to verify group membership when a user makes a request using an API key. >- Read [External Authentication Configuration and Principal Users]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/authentication/#external-authentication-configuration-and-principal-users). 1. Sign into Rancher using a local user assigned `administrator` global permissions (i.e., the _local principal_). @@ -19,24 +20,21 @@ In environments using Microsoft Active Directory (AD), you can configure Rancher 4. Complete the **Configure an Active Directory server** form. You may need to log in to your domain controller to find the information requested in the form. - + >**Using TLS?** - >Make sure you have an LDAP certificate installed. + >If the certificate is self-signed or not from a recognized certificate authority, make sure you provide the complete chain. That chain is needed to verify the server's certificate.

>**User Search Base vs. Group Search Base** > - >When configuring AD authentication, you must enter a search base for your users. This search base allows Rancher to search for users that are in your Active Directory. -
-
- > **Note:** This field is only for search bases and not for search filters. + >Search base allows Rancher to search for users and groups that are in your Active Directory. These fields are only for search bases and not for search filters. > - >- If your users and groups are in the search base, complete only the User Search Base. - >- If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required. + >* If your users and groups are in the same search base, complete only the User Search Base. + >* If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required. 5. If your Active Directory deviates from the standard AD schema, complete the **Customize Schema** form to match it. Otherwise, skip this step. - >**Search Attribute** As of Rancher v2.0.1, the Search Attribute field defaults with three specific values by default: `sAMAccountName|sn|givenName`. After AD is configured, when a user enters text to add users or groups, Rancher automatically queries the AD server and attempts to match fields by sAMAccountName, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field. + >**Search Attribute** As of Rancher v2.0.1, the Search Attribute field defaults with three specific values: `sAMAccountName|sn|givenName`. After AD is configured, when a user enters text to add users or groups, Rancher automatically queries the AD server and attempts to match fields by sAMAccountName, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field. > >The default field value `sAMAccountName|sn|givenName`, but you can configure this field to a subset of these fields. The pipe (`|`) between the fields separates these fields. > @@ -46,7 +44,7 @@ In environments using Microsoft Active Directory (AD), you can configure Rancher > > With this search attribute, Rancher creates search filters for users and groups, but you *cannot* add your own search filters in this field. -6. Enter your AD username and password in **Test and enable authentication** to confirm that Rancher is configured to use AD authentication. +6. Enter your AD username and password in **Authenticate with Active Directory** to confirm that Rancher is configured to use AD authentication. **Result:** diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/azure-ad/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/azure-ad/_index.md index 587c9522b3d..3cf607630bb 100644 --- a/content/rancher/v2.x/en/tasks/global-configuration/authentication/azure-ad/_index.md +++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/azure-ad/_index.md @@ -1,10 +1,14 @@ --- -title: Configuring Azure Active Directory -weight: 3075 +title: Configuring Azure Active Directory (Azure AD) +weight: 52 --- +_Available as of v2.0.3_ + If you have an instance of Active Directory (AD) hosted in Azure, you can configure Rancher to allow your users to log in using their AD accounts. Configuration of Azure AD external authentication requires you to make configurations in both Azure and Rancher. +>**Prerequisite:** Have an instance of Azure AD configured. + >**Note:** Most of this procedure, with the exception of [Configure Azure AD in Rancher](#configure-azure-ad-in-rancher), takes place from the [Microsoft Azure Portal](https://portal.azure.com/). ## Azure Active Directory Configuration Outline @@ -13,7 +17,7 @@ Configuring Rancher to allow your users to authenticate with their Azure AD acco ->**Tip:** Before you start, we recommend creating an empty text file. You can use this file to copy values from Azure that you'll paste into Rancher later. +>**Tip:** Before you start, we recommend creating an empty text file. You can use this file to copy values from Azure that you'll paste into Rancher later. 1. [Register Rancher with Azure](#1-register-rancher-with-azure) @@ -54,7 +58,7 @@ Before enabling Azure AD within Rancher, you must register Rancher with Azure. 1. From **Application type**, make sure that **Web app / API** is selected. 1. In the **Sign-on URL** field, enter the URL of your Rancher Server. - + 1. Click **Create**. ### 2. Create an Azure API Key @@ -122,29 +126,29 @@ As your final step in Azure, copy the data that you'll use to configure Rancher 1. Use search to open the **Azure Active Directory** service. ![Open Azure Active Directory]({{< baseurl >}}/img/rancher/search-azure-ad.png) - + 1. From the **Azure Active Directory** menu, open **Properties**. - + 2. Copy the **Directory ID** and paste it into your [text file](#tip). - + You'll paste this value into Rancher as your **Tenant ID**. 1. Obtain your Rancher **Application ID**. - + 1. Use search to open **App registrations**. ![Open App Registrations]({{< baseurl >}}/img/rancher/search-app-registrations.png) - + 1. Find the entry you created for Rancher. - + 1. Copy the **Application ID** and paste it to your [text file](#tip). 1. Obtain your Rancher **Graph Endpoint**, **Token Endpoint**, and **Auth Endpoint**. - + 1. From **App registrations**, click **Endpoints**. ![Click Endpoints]({{< baseurl >}}/img/rancher/click-endpoints.png) - + 2. Copy the following endpoints to your clipboard and paste them into your [text file](#tip) (these values will be your Rancher endpoint values). - **Microsoft Azure AD Graph API Endpoint** (Graph Endpoint) diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/freeipa/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/freeipa/_index.md new file mode 100644 index 00000000000..5f4423261ac --- /dev/null +++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/freeipa/_index.md @@ -0,0 +1,54 @@ +--- +title: Configuring FreeIPA +weight: 55 +--- + +_Available as of v2.0.5_ + +If your organization uses FreeIPA for user authentication, you can configure Rancher to allow your users to login using their FreeIPA credentials. + +>**Prerequisites:** +> +>- You must have a [FreeIPA Server](https://www.freeipa.org/) configured. +>- Create a service account in FreeIPA with `read-only` access. Rancher uses this account to verify group membership when a user makes a request using an API key. +>- Read [External Authentication Configuration and Principal Users]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/authentication/#external-authentication-configuration-and-principal-users). + +1. Sign into Rancher using a local user assigned the `administrator` role (i.e., the _local principal_). + +2. From the **Global** view, select **Security > Authentication** from the main menu. + +3. Select **FreeIPA**. + +4. Complete the **Configure an FreeIPA server** form. + + You may need to log in to your domain controller to find the information requested in the form. + + >**Using TLS?** + >If the certificate is self-signed or not from a recognized certificate authority, make sure you provide the complete chain. That chain is needed to verify the server's certificate. +
+
+ >**User Search Base vs. Group Search Base** + > + >Search base allows Rancher to search for users and groups that are in your FreeIPA. These fields are only for search bases and not for search filters. + > + >* If your users and groups are in the same search base, complete only the User Search Base. + >* If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required. + +5. If your FreeIPA deviates from the standard AD schema, complete the **Customize Schema** form to match it. Otherwise, skip this step. + + >**Search Attribute** The Search Attribute field defaults with three specific values: `uid|sn|givenName`. After FreeIPA is configured, when a user enters text to add users or groups, Rancher automatically queries the FreeIPA server and attempts to match fields by user id, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field. + > + >The default field value `uid|sn|givenName`, but you can configure this field to a subset of these fields. The pipe (`|`) between the fields separates these fields. + > + > * `uid`: User ID + > * `sn`: Last Name + > * `givenName`: First Name + > + > With this search attribute, Rancher creates search filters for users and groups, but you *cannot* add your own search filters in this field. + +6. Enter your FreeIPA username and password in **Authenticate with FreeIPA** to confirm that Rancher is configured to use FreeIPA authentication. + +**Result:** + +- FreeIPA authentication is configured. +- You are signed into Rancher with your FreeIPA account (i.e., the _external principal_). diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/github/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/github/_index.md index 9e7876bd3e4..603bb20847f 100644 --- a/content/rancher/v2.x/en/tasks/global-configuration/authentication/github/_index.md +++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/github/_index.md @@ -1,6 +1,6 @@ --- -title: Configuring GitHub Authentication -weight: 3075 +title: Configuring GitHub +weight: 53 --- In environments using GitHub, you can configure Rancher to allow sign on using GitHub credentials. @@ -48,4 +48,4 @@ In environments using GitHub, you can configure Rancher to allow sign on using G **Result:** - GitHub authentication is configured. -- You are signed into Rancher with your GitHub account (i.e., the _external principal_). \ No newline at end of file +- You are signed into Rancher with your GitHub account (i.e., the _external principal_). diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/local-authentication/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/local-authentication/_index.md index 2356fdf5785..189371f7084 100644 --- a/content/rancher/v2.x/en/tasks/global-configuration/authentication/local-authentication/_index.md +++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/local-authentication/_index.md @@ -1,10 +1,10 @@ --- title: Configuring Local Authentication -weight: 3075 +weight: 56 --- -Regardless of whether you use external authentication, you should create a few local authentication users so that you can continue using Rancher if you your external authentication service encounters issues. +Regardless of whether you use external authentication, you should create a few local authentication users so that you can continue using Rancher if you your external authentication service encounters issues. 1. From the **Global** view, select **Users** from the main menu. -2. Click **Add User**. Then complete the **Add User** form. Click **Create** when you're done. \ No newline at end of file +2. Click **Add User**. Then complete the **Add User** form. Click **Create** when you're done. diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/openLDAP/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/openLDAP/_index.md new file mode 100644 index 00000000000..773ed4169e0 --- /dev/null +++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/openLDAP/_index.md @@ -0,0 +1,55 @@ +--- +title: Configuring OpenLDAP +weight: 54 +--- + +_Available as of v2.0.5_ + +If your organization uses OpenLDAP for user authentication, you can configure Rancher to allow your users to login using their OpenLDAP credentials. + +>**Prerequisites:** +> +>- You must have an [OpenLDAP Server](https://www.openldap.org/) configured. +>- Create a service account in OpenLDAP with `read-only` access. Rancher uses this account to verify group membership when a user makes a request using an API key. +>- Read [External Authentication Configuration and Principal Users]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/authentication/#external-authentication-configuration-and-principal-users). + +1. Sign into Rancher using a local user assigned the `administrator` role (i.e., the _local principal_). + +2. From the **Global** view, select **Security > Authentication** from the main menu. + +3. Select **OpenLDAP**. + +4. Complete the **Configure an OpenLDAP server** form. + + You may need to log in to your domain controller to find the information requested in the form. + + >**Using TLS?** + >If the certificate is self-signed or not from a recognized certificate authority, make sure you provide the complete chain. That chain is needed to verify the server's certificate. +
+
+ >**User Search Base vs. Group Search Base** + > + >Search base allows Rancher to search for users and groups that are in your openLDAP. These fields are only for search bases and not for search filters. + > + >* If your users and groups are in the same search base, complete only the User Search Base. + >* If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required. + + +5. If your OpenLDAP deviates from the standard OpenLDAP schema, complete the **Customize Schema** form to match it. Otherwise, skip this step. + + >**Search Attribute** The Search Attribute field defaults with three specific values: `uid|sn|givenName`. After openLDAP is configured, when a user enters text to add users or groups, Rancher automatically queries the openLDAP server and attempts to match fields by user id, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field. + > + >The default field value `uid|sn|givenName`, but you can configure this field to a subset of these fields. The pipe (`|`) between the fields separates these fields. + > + > * `uid`: User ID + > * `sn`: Last Name + > * `givenName`: First Name + > + > With this search attribute, Rancher creates search filters for users and groups, but you *cannot* add your own search filters in this field. + +6. Enter your OpenLDAP username and password in **Authenticate with OpenLDAP** to confirm that Rancher is configured to use OpenLDAP authentication. + +**Result:** + +- OpenLDAP authentication is configured. +- You are signed into Rancher with your OpenLDAP account (i.e., the _external principal_). diff --git a/content/rke/v0.1.x/en/config-options/add-ons/ingress-controllers/_index.md b/content/rke/v0.1.x/en/config-options/add-ons/ingress-controllers/_index.md index c54fe406d70..bcd3ed5ee3a 100644 --- a/content/rke/v0.1.x/en/config-options/add-ons/ingress-controllers/_index.md +++ b/content/rke/v0.1.x/en/config-options/add-ons/ingress-controllers/_index.md @@ -37,9 +37,9 @@ You can disable the default controller by specifying `none` to the ingress `pro ingress: provider: none ``` -## Nginx Ingress Controller +## Configuring NGINX Ingress Controller -For the configuration of nginx, there are some configuration options. There are a [list of options](https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/configmap.md) for the nginx config map and [command line extra_args](https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/cli-arguments.md). +For the configuration of nginx, there are configuration options available in Kubernetes. There are a [list of options for the NGINX config map](https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/configmap.md) , [command line extra_args](https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/cli-arguments.md) and [annotations](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/). ```yaml ingress: diff --git a/content/rke/v0.1.x/en/installation/os/_index.md b/content/rke/v0.1.x/en/installation/os/_index.md index 30f7f5c1b4d..1246195ae07 100644 --- a/content/rke/v0.1.x/en/installation/os/_index.md +++ b/content/rke/v0.1.x/en/installation/os/_index.md @@ -12,11 +12,30 @@ RKE runs on almost any Linux OS with Docker installed. Most of the development a ``` See [Manage Docker as a non-root user](https://docs.docker.com/install/linux/linux-postinstall/#manage-docker-as-a-non-root-user) to see how you can configure access to Docker without using the `root` user. + - Swap should be disabled on any worker nodes ### RedHat Enterprise Linux (RHEL) / CentOS -If using RedHat Enterprise Linux or CentOS, you cannot use the `root` user as [SSH user]({{< baseurl >}}/rke/v0.1.x/en/config-options/nodes/#ssh-user) due to [Bugzilla 1527565](https://bugzilla.redhat.com/show_bug.cgi?id=1527565). If you are using the Docker package supplied by RedHat / CentOS, the `dockerroot` group is automatically added to the system. You will need to edit (or create) `/etc/docker/daemon.json` to include the following: +If using RedHat Enterprise Linux or CentOS, you cannot use the `root` user as [SSH user]({{< baseurl >}}/rke/v0.1.x/en/config-options/nodes/#ssh-user) due to [Bugzilla 1527565](https://bugzilla.redhat.com/show_bug.cgi?id=1527565). Please follow the instructions below how to setup Docker correctly, based on the way you installed Docker on the node. + +#### Using upstream Docker +If you are using upstream Docker, the package name is `docker-ce` or `docker-ee`. You can check the installed package by executing: + +``` +rpm -q docker-ce +``` + +When using the upstream Docker packages, please follow [Manage Docker as a non-root user](https://docs.docker.com/install/linux/linux-postinstall/#manage-docker-as-a-non-root-user). + +#### Using RHEL/CentOS packaged Docker +If you are using the Docker Docker package supplied by RedHat / CentOS, the package name is `docker`. You can check the installed package by executing: + +``` +rpm -q docker +``` + +If you are using the Docker package supplied by RedHat / CentOS, the `dockerroot` group is automatically added to the system. You will need to edit (or create) `/etc/docker/daemon.json` to include the following: ``` { diff --git a/gulpfile.babel.js b/gulpfile.babel.js index 9a6c6f15b04..1bad647a806 100644 --- a/gulpfile.babel.js +++ b/gulpfile.babel.js @@ -5,29 +5,34 @@ import gulp from 'gulp'; import del from 'del'; import runSequence from 'run-sequence'; import gulpLoadPlugins from 'gulp-load-plugins'; -import { spawn } from "child_process"; +import { spawn, exec } from "child_process"; import tildeImporter from 'node-sass-tilde-importer'; import browserify from 'browserify'; import source from 'vinyl-source-stream'; import buffer from 'vinyl-buffer'; import babelify from 'babelify'; import watch from 'gulp-watch'; +const atomicalgolia = require("atomic-algolia"); +const fs = require('fs'); const $ = gulpLoadPlugins(); const browserSync = require('browser-sync').create(); const isProduction = process.env.NODE_ENV === 'production'; -const onError = (err) => { - console.log(err); -} + +process.on('SIGINT', (err) => { + console.log('Caught SIGINT, exiting', '\r\n', err); + process.exit(0); +}); + +process.on('uncaughtException', (err) => { + console.log('Uncaught Exception, exiting', '\r\n', err); + process.exit(1); +}); + console.log('&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&') console.log(process.env) console.log('&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&') -process.on('SIGINT', () => { - console.log('Caught SIGINT, exiting'); - process.exit(0); -}); - // -- gulp.task('dev', ['build-dev'], () => { gulp.start('init-watch'); @@ -103,7 +108,6 @@ gulp.task('sass', () => { return gulp.src([ 'src/sass/**/*.scss' ]) - .pipe($.plumber({ errorHandler: onError })) .pipe($.sassLint()) .pipe($.sassLint.format()) .pipe($.sass({ precision: 5, importer: tildeImporter })) @@ -169,7 +173,6 @@ gulp.task('pub-delete', () => { return del(['public/**', '!public']); }); - gulp.task('build:search-index', (cb) => { const env = process.env; @@ -181,3 +184,36 @@ gulp.task('build:search-index', (cb) => { cb(); }); }); + + +gulp.task('publish:search-index', (cb) => { + const env = process.env; + + const opts = { + stdio: 'inherit', + env: env + }; + + + console.log('Waiting'); + setTimeout(() => { + console.log('Done'); + exec('giddyup leader check', opts, function(err, stdout, stderr) { + console.log('Error:', err); + console.log('Stdout:', stdout); + console.log('Stderr:', stderr); + }).on('close', code => { + if (code === 0) { + console.log('Publishing to algolia', process.env.ALGOLIA_INDEX_NAME); + atomicalgolia(process.env.ALGOLIA_INDEX_NAME, process.env.ALGOLIA_INDEX_FILE, {verbose: true}, (err, result) => { + console.log(result); + cb(err); + }); + } else { + console.log('I am not the leader (' + code + ')'); + cb(new Error('Not the leader')); + } + }); + }, 10000); + +}); diff --git a/layouts/shortcodes/ssl_faq_ha.html b/layouts/shortcodes/ssl_faq_ha.html index 083994ae01a..b0f4525bfb6 100644 --- a/layouts/shortcodes/ssl_faq_ha.html +++ b/layouts/shortcodes/ssl_faq_ha.html @@ -73,7 +73,7 @@ certutil -decode FILENAME.base64 FILENAME.verify
Command:
-openssl s_client -CAfile ca.pem -connect rancher.yourdomain.com:443
+openssl s_client -CAfile ca.pem -connect rancher.yourdomain.com:443 -servername rancher.yourdomain.com
 ...
     Verify return code: 0 (ok)
diff --git a/package.json b/package.json index e914938dc52..6ef83f75291 100644 --- a/package.json +++ b/package.json @@ -26,7 +26,6 @@ "gulp-imagemin": "^4.1.0", "gulp-load-plugins": "^1.5.0", "gulp-newer": "^1.3.0", - "gulp-plumber": "^1.1.0", "gulp-sass": "^3.1.0", "gulp-sass-lint": "^1.3.2", "gulp-size": "^3.0.0", diff --git a/scripts/build-algolia.js b/scripts/build-algolia.js index 8432ac104fb..ebbf2fb4b5f 100755 --- a/scripts/build-algolia.js +++ b/scripts/build-algolia.js @@ -7,13 +7,11 @@ const { const md5 = require('md5'); const atomicalgolia = require("atomic-algolia"); const fs = require('fs'); -const nue = []; +const newNodes = []; +const newParagraphs = []; const rawdata = fs.readFileSync('public/algolia.json'); const nodes = JSON.parse(rawdata); -console.log('&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&') -console.log(process.env) -console.log('&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&') nodes.forEach(node => { const dom = new JSDOM(node.content); const content = dom.window.document.body; //post content wrapped in a body tag @@ -41,7 +39,7 @@ nodes.forEach(node => { let next = child.nextElementSibling; while(next && next.tagName !== 'H2') { - if (next) { + if (next && next.textContent) { paragraphOut.content += next.textContent; } next = next.nextElementSibling; @@ -68,8 +66,16 @@ nodes.forEach(node => { // objectID is not quite unique yet so hash the entire object paragraphOut.objectID = md5(JSON.stringify(paragraphOut)); + if (true || paragraphOut.objectID === "d41d8cd98f00b204e9800998ecf8427e") { + console.log('===================================='); + console.log('ID:',paragraphOut.objectID); + console.log('Paragraph:',paragraphOut) + console.log('JSON:',JSON.stringify(paragraphOut)) + console.log('===================================='); + } - nue.push(paragraphOut); + newParagraphs.push(paragraphOut); + newNodes.push(node); } @@ -81,12 +87,7 @@ nodes.forEach(node => { }); -const merged = [...nodes, ...nue]; +const merged = [...newParagraphs, ...newNodes]; -// fs.writeFileSync('public/combined.algolia.json', JSON.stringify(merged)); -// process.exit(0); -atomicalgolia(process.env.ALGOLIA_INDEX_NAME, merged, (err, result) => { - if (err) throw err; - console.log(result); - process.exit(0); -}); +fs.writeFileSync('public/final.algolia.json', JSON.stringify(merged)); +process.exit(0); diff --git a/src/img/os/Rancher_aws5.png b/src/img/os/Rancher_aws5.png index d3d88dcec15..5f12f339b21 100644 Binary files a/src/img/os/Rancher_aws5.png and b/src/img/os/Rancher_aws5.png differ diff --git a/src/js/app.js b/src/js/app.js index 3d84b04eec6..d5780117d18 100644 --- a/src/js/app.js +++ b/src/js/app.js @@ -4,21 +4,31 @@ import instantsearch from 'instantsearch.js'; // This is for any custom JS that may need to be added to individual apps. // Main JS is located in Rancher Website Theme const bootstrapDocsSearch = function() { + + var firstSearchRender = true; + const search = instantsearch({ appId: '30NEY6C9UY', apiKey: 'b7f43c16886fec97b87981e9e62ef1a5', indexName: window.location.host === 'rancher.com' ? 'prod_docs' : 'dev_docs', routing: true, - searchFunction: function(helper) { - if (helper.state.query === "") { + searchFunction: (helper) => { + + if (helper.state.query === "" && firstSearchRender) { + + firstSearchRender = false; + return; } + helper.search(); } }); search.addWidget( instantsearch.widgets.searchBox({ + autofocus: true, + loadingIndicator: true, container: '#search-box', placeholder: 'Search Docs...', magnifier: false, @@ -55,18 +65,26 @@ const bootstrapDocsSearch = function() { overlay.toggleClass('open'); if (container.hasClass('open')) { - $('input#search').focus(); + $('input#search-box').focus(); } overlay.css({top: 120}); }); - } -const bootstrapDocsJS = function() { - bootstrapDocsSearch(); +const bootstrapIdLinks = function() { + const container = '.wrapper ARTICLE'; + const selector = 'h2[id], h3[id], h4[id], h5[id], h6[id]'; + $(container).on('mouseenter', selector, function(e) { + $(e.target).append($('').addClass('header-anchor').attr('href', '#' + e.target.id).html('')); + }); + + $(container).on('mouseleave', selector, function(e) { + $(e.target).parent().find('.header-anchor').remove(); + }); } $(document).ready(() => { - bootstrapDocsJS(); + bootstrapDocsSearch(); + bootstrapIdLinks(); });