Merge branch 'master' into sangeethah-wokload_ingress_dns_sidecar

.drone.yml

@@ -11,6 +11,18 @@ pipeline:
     when:
       event: [pull_request]
 
+  docker-publish-algolia:
+    group: publish
+    image: plugins/docker
+    dockerfile: Dockerfile.algolia
+    repo: rancher/docs
+    context: .
+    tag: algolia
+    secrets: [docker_username, docker_password]
+    when:
+      branch: master
+      event: push
+
   docker-publish-dev:
     group: publish
     image: plugins/docker
@@ -18,13 +30,7 @@ pipeline:
     repo: rancher/docs
     context: .
     tag: dev
-    secrets: [docker_username, docker_password, algolia_app_id, algolia_admin_key]
+    secrets: [docker_username, docker_password]
-    build_args:
-      - ALGOLIA_INDEX_NAME=dev_docs
-      - ALGOLIA_INDEX_FILE=public/algolia.json
-    build_args_from_env:
-      - ALGOLIA_APP_ID
-      - ALGOLIA_ADMIN_KEY
     when:
       branch: master
       event: push
@@ -36,13 +42,7 @@ pipeline:
     repo: rancher/docs
     context: .
     tag: staging
-    secrets: [docker_username, docker_password, algolia_app_id, algolia_admin_key]
+    secrets: [docker_username, docker_password]
-    build_args:
-      - ALGOLIA_INDEX_NAME=dev_docs
-      - ALGOLIA_INDEX_FILE=public/algolia.json
-    build_args_from_env:
-      - ALGOLIA_APP_ID
-      - ALGOLIA_ADMIN_KEY
     when:
       branch: master
       event: push
@@ -54,13 +54,7 @@ pipeline:
     repo: rancher/docs
     context: .
     tag: latest
-    secrets: [docker_username, docker_password, algolia_app_id, algolia_admin_key]
+    secrets: [docker_username, docker_password]
-    build_args:
-      - ALGOLIA_INDEX_NAME=prod_docs
-      - ALGOLIA_INDEX_FILE=public/algolia.json
-    build_args_from_env:
-      - ALGOLIA_APP_ID
-      - ALGOLIA_ADMIN_KEY
     when:
       branch: master
       event: push

Dockerfile.algolia

@@ -0,0 +1,12 @@
+FROM rancher/docs:build
+
+VOLUME /usr/share/nginx/html/docs
+WORKDIR /run
+
+ADD https://github.com/rancher/giddyup/releases/download/v0.19.0/giddyup /usr/bin/giddyup
+RUN chmod +x /usr/bin/giddyup
+
+COPY gulpfile.babel.js /run/
+
+ENTRYPOINT ["gulp"]
+CMD ["publish:search-index"]

Dockerfile.dev

@@ -1,8 +1,4 @@
 FROM rancher/docs:build
-ARG ALGOLIA_APP_ID
-ARG ALGOLIA_INDEX_NAME
-ARG ALGOLIA_INDEX_FILE
-ARG ALGOLIA_ADMIN_KEY
 
 VOLUME ["/site"]
 WORKDIR /run
@@ -25,11 +21,6 @@ COPY gulpfile.babel.js /run/
 ADD https://github.com/rancherlabs/website-theme/archive/master.tar.gz master.tar.gz
 RUN mkdir -p /run/node_modules/rancher-website-theme && tar -xzf master.tar.gz --strip 1 -C /run/node_modules/rancher-website-theme && rm master.tar.gz
 
-ENV ALGOLIA_APP_ID=$ALGOLIA_APP_ID
-ENV ALGOLIA_INDEX_NAME=$ALGOLIA_INDEX_NAME
-ENV ALGOLIA_INDEX_FILE=$ALGOLIA_INDEX_FILE
-ENV ALGOLIA_ADMIN_KEY=$ALGOLIA_ADMIN_KEY
-
 # Expose default hugo port
 EXPOSE 9001
 

Dockerfile.prod

@@ -1,11 +1,6 @@
 FROM rancher/docs:build as build
-ARG ALGOLIA_APP_ID
-ARG ALGOLIA_INDEX_NAME
-ARG ALGOLIA_INDEX_FILE
-ARG ALGOLIA_ADMIN_KEY
 
 WORKDIR /run
-
 COPY gulpfile.babel.js /run/
 COPY .eslintrc.js /run/
 COPY config.toml /run/
@@ -22,17 +17,12 @@ ENV HUGO_ENV production
 ADD https://github.com/rancherlabs/website-theme/archive/master.tar.gz master.tar.gz
 RUN tar -xzf master.tar.gz --strip 1 -C /run/node_modules/rancher-website-theme && rm master.tar.gz
 
-
-ENV ALGOLIA_APP_ID=$ALGOLIA_APP_ID
-ENV ALGOLIA_INDEX_NAME=$ALGOLIA_INDEX_NAME
-ENV ALGOLIA_INDEX_FILE=$ALGOLIA_INDEX_FILE
-ENV ALGOLIA_ADMIN_KEY=$ALGOLIA_ADMIN_KEY
-
 RUN gulp build
 
 # Make sure something got built
 RUN stat /run/public/index.html
 
 FROM nginx
+VOLUME /usr/share/nginx/html/docs
 COPY --from=build /run/public /usr/share/nginx/html/docs/
 COPY nginx.conf /etc/nginx/conf.d/default.conf

Dockerfile.staging

@@ -1,11 +1,6 @@
 FROM rancher/docs:build as build
-ARG ALGOLIA_APP_ID
-ARG ALGOLIA_INDEX_NAME
-ARG ALGOLIA_INDEX_FILE
-ARG ALGOLIA_ADMIN_KEY
 
 WORKDIR /run
-
 COPY gulpfile.babel.js /run/
 COPY .eslintrc.js /run/
 COPY config.toml /run/
@@ -22,16 +17,12 @@ ENV HUGO_ENV production
 ADD https://github.com/rancherlabs/website-theme/archive/master.tar.gz master.tar.gz
 RUN tar -xzf master.tar.gz --strip 1 -C /run/node_modules/rancher-website-theme && rm master.tar.gz
 
-ENV ALGOLIA_APP_ID=$ALGOLIA_APP_ID
-ENV ALGOLIA_INDEX_NAME=$ALGOLIA_INDEX_NAME
-ENV ALGOLIA_INDEX_FILE=$ALGOLIA_INDEX_FILE
-ENV ALGOLIA_ADMIN_KEY=$ALGOLIA_ADMIN_KEY
-
 RUN gulp build-staging
 
 # Make sure something got built
 RUN stat /run/public/index.html
 
 FROM nginx
+VOLUME /usr/share/nginx/html/docs
 COPY --from=build /run/public /usr/share/nginx/html/docs/
 COPY nginx.conf /etc/nginx/conf.d/default.conf

content/os/v1.x/en/installation/running-rancheros/cloud/aws/_index.md

@@ -14,7 +14,7 @@ Once you've installed your AWS CLI, use this command to launch an EC2 instance w
 > **Note:** Check the RancherOS [README](https://github.com/rancher/os/blob/master/README.md) for AMI names for each region. We support PV and HVM types of AMIs.
 
 ```
-$ aws ec2 run-instances --image-id ami-ID# --count 1 --instance-type t2.micro --key-name MySSHKeyName --security-groups sg-name
+$ aws ec2 run-instances --image-id ami-ID# --count 1 --instance-type t2.small --key-name MySSHKeyName --security-groups sg-name
 ```
 
 Your EC2 instance is now running RancherOS!

content/rancher/v2.x/en/concepts/alerts-and-notifiers/_index.md

@@ -3,3 +3,34 @@ title: Alerts and Notifiers
 weight: 2300
 draft: true
 ---
+
+Alerts and notifications are built on top of the [Prometheus Alertmanager](https://prometheus.io/docs/alerting/alertmanager/). Leveraging these tools, Rancher is able to provide the first step in notifications for events operators and application owners need to know about.
+
+## Notifiers
+
+In Rancher 2.x, a user can configure `Notifiers` for each cluster that can receive alerts for various events. By configuring the notifiers at the cluster level, project owners do not need to know SMTP settings or have access to cloud accounts. At a project level, users can configure alerts and add recipients scoped to the relevant alerts.
+
+Available Notifiers:
+
+* Email
+* Slack
+* PagerDuty
+* Webhooks
+
+## Alerts
+
+Rancher supports alerting on a cluster level or project level.
+
+On a cluster level, Rancher can monitor and alert on components that manage your Kubernetes cluster including:
+
+* System Services
+* Resource Events
+* Node conditions
+
+Operators of Kubernetes clusters can get alerts on the health of nodes and other system level components.
+
+On a project level, Rancher can monitor and alert on status on specific deployments including:
+
+* Deployment availability
+* Workloads
+* Pods

content/rancher/v2.x/en/concepts/global-configuration/authentication/_index.md

@@ -13,12 +13,17 @@ This centralized user authentication is accomplished using the Rancher authentic
 The Rancher authentication proxy integrates with the following external authentication services.
 
 - Microsoft Active Directory
+- Microsoft Azure AD
 - GitHub
+- FreeIPA
+- OpenLDAP
 
 However, Rancher also provides local authentication.
 
 In most cases, you should use an external authentication service over local, as external authentication allows user management from a central location. However, you may want a few local authentication users for managing Rancher under rare circumstances, such as if Active Directory is down.
 
+For more information on how to configure external authentication or local authentication, see [Authentication](../../../tasks/global-configuration/authentication/). 
+
 ### External Authentication Configuration and Principal Users
 
 Configuration of external authentication requires:

content/rancher/v2.x/en/installation/_index.md

@@ -28,7 +28,7 @@ Choose from the following installation options:
 
 This section also includes help content for Rancher configuration and maintenance.
 
--  [Backups and Restoration]({{< baseurl >}}/rancher/v2.x/en/installation/backups-and-restoration/)
+-  [Backups and Rollbacks]({{< baseurl >}}/rancher/v2.x/en/backups/)
 
  	This page lists the ports you must open to operate Rancher.
 

content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md

@@ -5,7 +5,7 @@ weight: 276
 This set of instructions creates a new Kubernetes cluster that's dedicated to running Rancher in a high-availability (HA) configuration. This procedure walks you through setting up a 3-node cluster using the Rancher Kubernetes Engine (RKE). The cluster's sole purpose is running pods for Rancher. The setup is based on:
 
 - Layer 7 Loadbalancer with SSL termination (HTTPS)
-- NGINX Ingress controller (HTTP)
+- [NGINX Ingress controller (HTTP)](https://kubernetes.github.io/ingress-nginx/)
 
 ![Rancher HA]({{< baseurl >}}/img/rancher/ha/rancher2ha-l7.svg)
 
@@ -64,15 +64,15 @@ Before you install Rancher, confirm you meet the host requirements. Provision 3
 
 ### Requirements
 
-#### Operating System 
+#### Operating System
 
 {{< requirements_os >}}
 
-#### Hardware 
+#### Hardware
 
 {{< requirements_hardware >}}
 
-#### Software 
+#### Software
 
 {{< requirements_software >}}
 

content/rancher/v2.x/en/installation/ha-server-install-external-lb/nginx/_index.md

@@ -24,18 +24,18 @@ to use Nginx as a Layer 7 load balancer with Rancher. For full documentation on
         server IP_NODE_2:80;
         server IP_NODE_3:80;
     }
-    
+
     map $http_upgrade $connection_upgrade {
         default Upgrade;
         ''      close;
     }
-    
+
     server {
         listen 443 ssl http2;
         server_name FQDN;
         ssl_certificate /certs/fullchain.pem;
         ssl_certificate_key /certs/privkey.pem;
-    
+
         location / {
             proxy_set_header Host $host;
             proxy_set_header X-Forwarded-Proto $scheme;
@@ -49,7 +49,7 @@ to use Nginx as a Layer 7 load balancer with Rancher. For full documentation on
             proxy_read_timeout 900s;
         }
     }
-    
+
     server {
         listen 80;
         server_name FQDN;

content/rancher/v2.x/en/installation/ha-server-install/_index.md

@@ -5,7 +5,7 @@ weight: 275
 This set of instructions creates a new Kubernetes cluster that's dedicated to running Rancher in a high-availability (HA) configuration. This procedure walks you through setting up a 3-node cluster using the Rancher Kubernetes Engine (RKE). The cluster's sole purpose is running pods for Rancher. The setup is based on:
 
 - Layer 4 load balancer (TCP)
-- NGINX ingress controller with SSL termination (HTTPS)
+- [NGINX ingress controller with SSL termination (HTTPS)](https://kubernetes.github.io/ingress-nginx/)
 
 ![Rancher HA]({{< baseurl >}}/img/rancher/ha/rancher2ha.svg)
 
@@ -108,6 +108,8 @@ After installing NGINX, you need to update the NGINX config file, `nginx.conf`,
 
 2. From `nginx.conf`, replace `IP_NODE_1`, `IP_NODE_2`, and `IP_NODE_3` with the IPs of your [Linux hosts](#1-provision-linux-hosts).
 
+    >**Note:** This Nginx configuration is only an example and may not suit your environment. For complete documentation, see [NGINX Load Balancing - TCP and UDP Load Balancer](https://docs.nginx.com/nginx/admin-guide/load-balancer/tcp-udp-load-balancer/).
+		
     **Example NGINX config:**
     ```
     worker_processes 4;
@@ -194,7 +196,7 @@ RKE is a fast, versatile Kubernetes installer that you can use to install Kubern
 2. Make the RKE binary that you just downloaded executable. Open Terminal, change directory to the location of the RKE binary, and then run one of the commands below.
 
     >**Using Windows?**
-    >The file is already an executable. Skip to [Download Config File Template](#5-download-config-file-template).
+    >The file is already an executable. Skip to [Download Config File Template](#5-download-rke-config-file-template).
 
     ```
     # MacOS
@@ -391,7 +393,7 @@ Save the `.yml` file and close it.
 
 ## 9. Back Up Your RKE Config File
 
-After you close your `.yml` file, back it up to a secure location. You can use this file again when it's time to upgrade Rancher. 
+After you close your `.yml` file, back it up to a secure location. You can use this file again when it's time to upgrade Rancher.
 
 ## 10. Run RKE
 

content/rancher/v2.x/en/installation/ha-server-install/nlb/_index.md

@@ -21,7 +21,7 @@ Configuring an Amazon NLB is a multistage process. We've broken it down into mul
 
 ## Create Target Groups
 
-Your first NLB configuration step is to create two target groups. Technically, only port 443 is needed to access Rancher, but its convenient to add a listener for port 80 which will be redirected to port 443 automatically. The NGINX controller on the nodes will make sure that port 80 gets redirected to port 443.
+Your first NLB configuration step is to create two target groups. Technically, only port 443 is needed to access Rancher, but its convenient to add a listener for port 80 which will be redirected to port 443 automatically. The NGINX ingress controller on the nodes will make sure that port 80 gets redirected to port 443.
 
 Log into the [Amazon AWS Console](https://console.aws.amazon.com/ec2/) to get started, make sure to select the **Region** where your EC2 instances (Linux nodes) are created.
 

content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md

@@ -131,6 +131,8 @@ The load balancer or proxy has to be configured to support the following:
 
 This Nginx configuration is tested on Nginx version 1.13 (mainline) and 1.14 (stable).
 
+ >**Note:** This Nginx configuration is only an example and may not suit your environment. For complete documentation, see [NGINX Load Balancing - TCP and UDP Load Balancer](https://docs.nginx.com/nginx/admin-guide/load-balancer/tcp-udp-load-balancer/).
+ 
 ```
 upstream rancher {
     server rancher-server:80;

content/rancher/v2.x/en/installation/single-node-install/_index.md

@@ -62,10 +62,10 @@ For security purposes, SSL (Secure Sockets Layer) is required when using Rancher
 
 Choose from the following options:
 
-- [Option A—Default Self-Signed Certificate](#option-adefault-self-signed-certificate)
+- [Option A—Default Self-Signed Certificate](#option-a-default-self-signed-certificate)
-- [Option B—Bring Your Own Certificate: Self-Signed](#option-bbring-your-own-certificate--self-signed)
+- [Option B—Bring Your Own Certificate: Self-Signed](#option-b-bring-your-own-certificate-self-signed)
-- [Option C—Bring Your Own Certificate: Signed by Recognized CA](#option-cbring-your-own-certificate--signed-by-recognized-ca)
+- [Option C—Bring Your Own Certificate: Signed by Recognized CA](#option-c-bring-your-own-certificate-signed-by-recognized-ca)
-- [Option D-Let's Encrypt Certificate](#option-d-lets-encrypt-certificate)
+- [Option D—Let's Encrypt Certificate](#option-d-let-s-encrypt-certificate)
 
 ### Option A—Default Self-Signed Certificate
 
@@ -139,7 +139,7 @@ By default, Rancher automatically generates self-signed certificates for itself
 2. Select  **Settings** > **cacerts**.
 3. Choose `Edit` and remove the contents. Then click `Save`.
 
-### Option D-Let's Encrypt Certificate
+### Option D—Let's Encrypt Certificate
 
 Rancher supports Let's Encrypt certificates. Let's Encrypt uses an `http-01 challenge` to verify that you have control over your domain. You can confirm that you control the domain by pointing the hostname that you want to use for Rancher access (for example, `rancher.mydomain.com`) to the IP of the machine it is running on. You can bind the hostname to the IP address by creating an A record in DNS.
 

content/rancher/v2.x/en/tasks/global-configuration/authentication/_index.md

@@ -2,25 +2,30 @@
 title: Authentication
 weight: 50
 ---
-You have three options for user authentication in Rancher:
 
--	[Active Directory]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/)
+You have multiple options for user authentication in Rancher:
-	
-	Enterprises can use Active Directory (AD) for authentication, allowing users to sign in using their corporate credentials.
 
--	[GitHub]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/authentication/github/)
+-   [Active Directory](./active-directory/)
 
-	Open source projects or organizations that use GitHub for source control may prefer that users sign in using their GitHub accounts.
+    Enterprises can use Active Directory (AD) for authentication, allowing users to sign in using their corporate credentials.
 
-<!-- - **SAML**:
+-   [Azure AD](./azure-ad/)
 
-- **OpenLDAP**:-->
+   	If you have an instance of Active Directory (AD) hosted in Azure, you can configure Rancher to allow your users to log in using their AD accounts. Configuration of Azure AD external authentication requires you to make configurations in both Azure and Rancher.
+
+-   [GitHub](./github/)
+
+    Open source projects or organizations that use GitHub for source control may prefer that users sign in using their GitHub accounts.
+
+-   [OpenLDAP](./openlap/)
+
+    Organizations can use OpenLDAP for authentication, allowing users to sign in using their corporate credentials.
+
+-	  [FreeIPA](./freeipa/)
+
+    Organizations can use FreeIPA for authentication, allowing users to sign in using their corporate credentials.
 
 
-- [Azure AD]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/authentication/azure-ad/)
+-   [Local Authentication](./local-authentication/)
 
-	If you have an instance of Active Directory (AD) hosted in Azure, you can configure Rancher to allow your users to log in using their AD accounts. Configuration of Azure AD external authentication requires you to make configurations in both Azure and Rancher.
+    If you don't want to use external authentication, you can always add users directly to Rancher. We recommend using external authentication over local authentication.
-
--	[Local Authentication]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/authentication/local-authentication/)
-
-	If you don't want to use external authentication, you can always add users directly to Rancher. We recommend using external authentication over local authentication.

content/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/_index.md

@@ -1,13 +1,14 @@
 ---
-title: Configuring Active Directory Authentication
+title: Configuring Active Directory (AD)
-weight: 3075
+weight: 51
 ---
 
 In environments using Microsoft Active Directory (AD), you can configure Rancher to allow sign on using AD credentials.
 
 >**Prerequisites:**
 >
->- Create a service account in Active Directory with `read-only` access. {{< product >}} uses this account to verify group membership when a user makes a request using an API key.
+>- Have an Active Directory server configured.
+>- Create a service account in Active Directory with `read-only` access. Rancher uses this account to verify group membership when a user makes a request using an API key.
 >- Read [External Authentication Configuration and Principal Users]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/authentication/#external-authentication-configuration-and-principal-users).
 
 1.  Sign into Rancher using a local user assigned `administrator` global permissions (i.e., the _local principal_).
@@ -19,24 +20,21 @@ In environments using Microsoft Active Directory (AD), you can configure Rancher
 4.	Complete the **Configure an Active Directory server** form.
 
 	You may need to log in to your domain controller to find the information requested in the form.
-	
+
 	>**Using TLS?**
- 	>Make sure you have an LDAP certificate installed.
+ 	>If the certificate is self-signed or not from a recognized certificate authority, make sure you provide the complete chain. That chain is needed to verify the server's certificate.
 	<br/>
 	<br/>
 	>**User Search Base vs. Group Search Base**
 	>
-	>When configuring AD authentication, you must enter a search base for your users. This search base allows Rancher to search for users that are in your Active Directory.
+	>Search base allows Rancher to search for users and groups that are in your Active Directory.  These fields are only for search bases and not for search filters.
-    <br/>
-	<br/>
-  	> **Note:** This field is only for search bases and not for search filters.
 	>
-	>- If your users and groups are in the search base, complete only the User Search Base.
+	>* If your users and groups are in the same search base, complete only the User Search Base.
-	>- If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required.
+	>* If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required.
 
 5.	If your Active Directory deviates from the standard AD schema, complete the **Customize Schema** form to match it. Otherwise, skip this step.
 
-	>**Search Attribute** As of Rancher v2.0.1, the Search Attribute field defaults with three specific values by default: `sAMAccountName|sn|givenName`. After AD is configured, when a user enters text to add users or groups, Rancher automatically queries the AD server and attempts to match fields by sAMAccountName, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field.
+	>**Search Attribute** As of Rancher v2.0.1, the Search Attribute field defaults with three specific values: `sAMAccountName|sn|givenName`. After AD is configured, when a user enters text to add users or groups, Rancher automatically queries the AD server and attempts to match fields by sAMAccountName, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field.
 	>
 	>The default field value `sAMAccountName|sn|givenName`, but you can configure this field to a subset of these fields. The pipe (`|`) between the fields separates these fields.
 	>
@@ -46,7 +44,7 @@ In environments using Microsoft Active Directory (AD), you can configure Rancher
 	>
 	> With this search attribute, Rancher creates search filters for users and groups, but you *cannot* add your own search filters in this field.
 
-6.	Enter your AD username and password in **Test and enable authentication** to confirm that Rancher is configured to use AD authentication.
+6.	Enter your AD username and password in **Authenticate with Active Directory** to confirm that Rancher is configured to use AD authentication.
 
 **Result:**
 

content/rancher/v2.x/en/tasks/global-configuration/authentication/azure-ad/_index.md

@@ -1,10 +1,14 @@
 ---
-title: Configuring Azure Active Directory
+title: Configuring Azure Active Directory (Azure AD)
-weight: 3075
+weight: 52
 ---
 
+_Available as of v2.0.3_
+
 If you have an instance of Active Directory (AD) hosted in Azure, you can configure Rancher to allow your users to log in using their AD accounts. Configuration of Azure AD external authentication requires you to make configurations in both Azure and Rancher.
 
+>**Prerequisite:** Have an instance of Azure AD configured.
+
 >**Note:** Most of this procedure, with the exception of [Configure Azure AD in Rancher](#configure-azure-ad-in-rancher), takes place from the [Microsoft Azure Portal](https://portal.azure.com/).
 
 ## Azure Active Directory Configuration Outline
@@ -13,7 +17,7 @@ Configuring Rancher to allow your users to authenticate with their Azure AD acco
 
 <a id="tip"></a>
 
->**Tip:** Before you start, we recommend creating an empty text file. You can use this file to copy values from Azure that you'll paste into Rancher later. 
+>**Tip:** Before you start, we recommend creating an empty text file. You can use this file to copy values from Azure that you'll paste into Rancher later.
 
 1. [Register Rancher with Azure](#1-register-rancher-with-azure)
 
@@ -54,7 +58,7 @@ Before enabling Azure AD within Rancher, you must register Rancher with Azure.
     1. From **Application type**, make sure that **Web app / API** is selected.
 
     1. In the **Sign-on URL** field, enter the URL of your Rancher Server.
-    
+
     1. Click **Create**.
 
 ### 2. Create an Azure API Key
@@ -122,29 +126,29 @@ As your final step in Azure, copy the data that you'll use to configure Rancher
     1. Use search to open the **Azure Active Directory** service.
 
          ![Open Azure Active Directory]({{< baseurl >}}/img/rancher/search-azure-ad.png)
-    
+
     1. From the **Azure Active Directory** menu, open **Properties**.
-    
+
     2. Copy the **Directory ID** and paste it into your [text file](#tip).
-    
+
         You'll paste this value into Rancher as your **Tenant ID**.
 
 1. Obtain your Rancher **Application ID**.
-    
+
     1. Use search to open **App registrations**.
 
          ![Open App Registrations]({{< baseurl >}}/img/rancher/search-app-registrations.png)
-    
+
     1. Find the entry you created for Rancher.
-    
+
     1. Copy the **Application ID** and paste it to your [text file](#tip).
 
 1. Obtain your Rancher **Graph Endpoint**, **Token Endpoint**, and **Auth Endpoint**.
-    
+
     1. From **App registrations**, click **Endpoints**.
 
         ![Click Endpoints]({{< baseurl >}}/img/rancher/click-endpoints.png)
-    
+
     2. Copy the following endpoints to your clipboard and paste them into your [text file](#tip) (these values will be your Rancher endpoint values).
 
         - **Microsoft Azure AD Graph API Endpoint** (Graph Endpoint)

content/rancher/v2.x/en/tasks/global-configuration/authentication/freeipa/_index.md

@@ -0,0 +1,54 @@
+---
+title: Configuring FreeIPA
+weight: 55
+---
+
+_Available as of v2.0.5_
+
+If your organization uses FreeIPA for user authentication, you can configure Rancher to allow your users to login using their FreeIPA credentials.
+
+>**Prerequisites:**
+>
+>- You must have a [FreeIPA Server](https://www.freeipa.org/) configured.
+>- Create a service account in FreeIPA with `read-only` access. Rancher uses this account to verify group membership when a user makes a request using an API key.
+>- Read [External Authentication Configuration and Principal Users]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/authentication/#external-authentication-configuration-and-principal-users).
+
+1.  Sign into Rancher using a local user assigned the `administrator` role (i.e., the _local principal_).
+
+2.	From the **Global** view, select **Security > Authentication** from the main menu.
+
+3.	Select **FreeIPA**.
+
+4.	Complete the **Configure an FreeIPA server** form.
+
+	You may need to log in to your domain controller to find the information requested in the form.
+
+	>**Using TLS?**
+ 	>If the certificate is self-signed or not from a recognized certificate authority, make sure you provide the complete chain. That chain is needed to verify the server's certificate.
+	<br/>
+	<br/>
+	>**User Search Base vs. Group Search Base**
+	>
+	>Search base allows Rancher to search for users and groups that are in your FreeIPA.  These fields are only for search bases and not for search filters.
+	>
+	>* If your users and groups are in the same search base, complete only the User Search Base.
+	>* If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required.
+
+5.	If your FreeIPA deviates from the standard AD schema, complete the **Customize Schema** form to match it. Otherwise, skip this step.
+
+	>**Search Attribute** The Search Attribute field defaults with three specific values: `uid|sn|givenName`. After FreeIPA is configured, when a user enters text to add users or groups, Rancher automatically queries the FreeIPA server and attempts to match fields by user id, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field.
+	>
+	>The default field value `uid|sn|givenName`, but you can configure this field to a subset of these fields. The pipe (`|`) between the fields separates these fields.
+	>
+	> * `uid`: User ID
+	> * `sn`: Last Name
+	> * `givenName`: First Name
+	>
+	> With this search attribute, Rancher creates search filters for users and groups, but you *cannot* add your own search filters in this field.
+
+6.	Enter your FreeIPA username and password in **Authenticate with FreeIPA** to confirm that Rancher is configured to use FreeIPA authentication.
+
+**Result:**
+
+- FreeIPA authentication is configured.
+- You are signed into Rancher with your FreeIPA account (i.e., the _external principal_).

content/rancher/v2.x/en/tasks/global-configuration/authentication/github/_index.md

@@ -1,6 +1,6 @@
 ---
-title: Configuring GitHub Authentication
+title: Configuring GitHub 
-weight: 3075
+weight: 53
 ---
 
 In environments using GitHub, you can configure Rancher to allow sign on using GitHub credentials.
@@ -48,4 +48,4 @@ In environments using GitHub, you can configure Rancher to allow sign on using G
 **Result:**
 
 - GitHub authentication is configured.
-- You are signed into Rancher with your GitHub account (i.e., the _external principal_).
+- You are signed into Rancher with your GitHub account (i.e., the _external principal_).

content/rancher/v2.x/en/tasks/global-configuration/authentication/local-authentication/_index.md

@@ -1,10 +1,10 @@
 ---
 title: Configuring Local Authentication
-weight: 3075
+weight: 56
 ---
 
-Regardless of whether you use external authentication, you should create a few local authentication users so that you can continue using Rancher if you your external authentication service encounters issues. 
+Regardless of whether you use external authentication, you should create a few local authentication users so that you can continue using Rancher if you your external authentication service encounters issues.
 
 1.	From the **Global** view, select **Users** from the main menu.
 
-2.	Click **Add User**. Then complete the **Add User** form. Click **Create** when you're done.
+2.	Click **Add User**. Then complete the **Add User** form. Click **Create** when you're done.

content/rancher/v2.x/en/tasks/global-configuration/authentication/openLDAP/_index.md

@@ -0,0 +1,55 @@
+---
+title: Configuring OpenLDAP
+weight: 54
+---
+
+_Available as of v2.0.5_
+
+If your organization uses OpenLDAP for user authentication, you can configure Rancher to allow your users to login using their OpenLDAP credentials.
+
+>**Prerequisites:**
+>
+>- You must have an [OpenLDAP Server](https://www.openldap.org/) configured.
+>- Create a service account in OpenLDAP with `read-only` access. Rancher uses this account to verify group membership when a user makes a request using an API key.
+>- Read [External Authentication Configuration and Principal Users]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/authentication/#external-authentication-configuration-and-principal-users).
+
+1.  Sign into Rancher using a local user assigned the `administrator` role (i.e., the _local principal_).
+
+2.	From the **Global** view, select **Security > Authentication** from the main menu.
+
+3.	Select **OpenLDAP**.
+
+4.	Complete the **Configure an OpenLDAP server** form.
+
+	You may need to log in to your domain controller to find the information requested in the form.
+
+	>**Using TLS?**
+ 	>If the certificate is self-signed or not from a recognized certificate authority, make sure you provide the complete chain. That chain is needed to verify the server's certificate.
+	<br/>
+	<br/>
+	>**User Search Base vs. Group Search Base**
+	>
+	>Search base allows Rancher to search for users and groups that are in your openLDAP.  These fields are only for search bases and not for search filters.
+	>
+	>* If your users and groups are in the same search base, complete only the User Search Base.
+	>* If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required.
+
+
+5.	If your OpenLDAP deviates from the standard OpenLDAP schema, complete the **Customize Schema** form to match it. Otherwise, skip this step.
+
+	>**Search Attribute** The Search Attribute field defaults with three specific values: `uid|sn|givenName`. After openLDAP is configured, when a user enters text to add users or groups, Rancher automatically queries the openLDAP server and attempts to match fields by user id, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field.
+	>
+	>The default field value `uid|sn|givenName`, but you can configure this field to a subset of these fields. The pipe (`|`) between the fields separates these fields.
+	>
+	> * `uid`: User ID
+	> * `sn`: Last Name
+	> * `givenName`: First Name
+	>
+	> With this search attribute, Rancher creates search filters for users and groups, but you *cannot* add your own search filters in this field.
+
+6.	Enter your OpenLDAP username and password in **Authenticate with OpenLDAP** to confirm that Rancher is configured to use OpenLDAP authentication.
+
+**Result:**
+
+- OpenLDAP authentication is configured.
+- You are signed into Rancher with your OpenLDAP account (i.e., the _external principal_).

content/rke/v0.1.x/en/config-options/add-ons/ingress-controllers/_index.md

@@ -37,9 +37,9 @@ You can disable the default controller by specifying `none` to  the ingress `pro
 ingress:
     provider: none
 ```
-## Nginx Ingress Controller
+## Configuring NGINX Ingress Controller
 
-For the configuration of nginx, there are some configuration options. There are a [list of options](https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/configmap.md) for the nginx config map and [command line extra_args](https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/cli-arguments.md).
+For the configuration of nginx, there are configuration options available in Kubernetes. There are a [list of options for the NGINX config map](https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/configmap.md) , [command line extra_args](https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/cli-arguments.md) and [annotations](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/).
 
 ```yaml
 ingress:

content/rke/v0.1.x/en/installation/os/_index.md

@@ -12,11 +12,30 @@ RKE runs on almost any Linux OS with Docker installed. Most of the development a
    ```
 
    See [Manage Docker as a non-root user](https://docs.docker.com/install/linux/linux-postinstall/#manage-docker-as-a-non-root-user) to see how you can configure access to Docker without using the `root` user.
+
 - Swap should be disabled on any worker nodes
 
 ### RedHat Enterprise Linux (RHEL) / CentOS
 
-If using RedHat Enterprise Linux or CentOS, you cannot use the `root` user as [SSH user]({{< baseurl >}}/rke/v0.1.x/en/config-options/nodes/#ssh-user) due to [Bugzilla 1527565](https://bugzilla.redhat.com/show_bug.cgi?id=1527565). If you are using the Docker package supplied by RedHat / CentOS, the `dockerroot` group is automatically added to the system. You will need to edit (or create) `/etc/docker/daemon.json` to include the following:
+If using RedHat Enterprise Linux or CentOS, you cannot use the `root` user as [SSH user]({{< baseurl >}}/rke/v0.1.x/en/config-options/nodes/#ssh-user) due to [Bugzilla 1527565](https://bugzilla.redhat.com/show_bug.cgi?id=1527565). Please follow the instructions below how to setup Docker correctly, based on the way you installed Docker on the node.
+
+#### Using upstream Docker
+If you are using upstream Docker, the package name is `docker-ce` or `docker-ee`. You can check the installed package by executing:
+
+```
+rpm -q docker-ce
+```
+
+When using the upstream Docker packages, please follow [Manage Docker as a non-root user](https://docs.docker.com/install/linux/linux-postinstall/#manage-docker-as-a-non-root-user).
+
+#### Using RHEL/CentOS packaged Docker
+If you are using the Docker Docker package supplied by RedHat / CentOS, the package name is `docker`. You can check the installed package by executing:
+
+```
+rpm -q docker
+```
+
+If you are using the Docker package supplied by RedHat / CentOS, the `dockerroot` group is automatically added to the system. You will need to edit (or create) `/etc/docker/daemon.json` to include the following:
 
 ```
 {

gulpfile.babel.js

@@ -5,29 +5,34 @@ import gulp from 'gulp';
 import del from 'del';
 import runSequence from 'run-sequence';
 import gulpLoadPlugins from 'gulp-load-plugins';
-import { spawn } from "child_process";
+import { spawn, exec } from "child_process";
 import tildeImporter from 'node-sass-tilde-importer';
 import browserify from 'browserify';
 import source from 'vinyl-source-stream';
 import buffer from 'vinyl-buffer';
 import babelify from 'babelify';
 import watch from 'gulp-watch';
+const atomicalgolia = require("atomic-algolia");
+const fs            = require('fs');
 
 const $            = gulpLoadPlugins();
 const browserSync  = require('browser-sync').create();
 const isProduction = process.env.NODE_ENV === 'production';
-const onError      = (err) => {
+
-  console.log(err);
+process.on('SIGINT', (err) => {
-}
+  console.log('Caught SIGINT, exiting', '\r\n', err);
+  process.exit(0);
+});
+
+process.on('uncaughtException', (err) => {
+  console.log('Uncaught Exception, exiting', '\r\n', err);
+  process.exit(1);
+});
+
 console.log('&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&')
 console.log(process.env)
 console.log('&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&')
 
-process.on('SIGINT', () => {
-  console.log('Caught SIGINT, exiting');
-  process.exit(0);
-});
-
 // --
 gulp.task('dev', ['build-dev'], () => {
   gulp.start('init-watch');
@@ -103,7 +108,6 @@ gulp.task('sass', () => {
   return gulp.src([
     'src/sass/**/*.scss'
   ])
-    .pipe($.plumber({ errorHandler: onError }))
     .pipe($.sassLint())
     .pipe($.sassLint.format())
     .pipe($.sass({ precision: 5, importer: tildeImporter }))
@@ -169,7 +173,6 @@ gulp.task('pub-delete', () => {
   return del(['public/**', '!public']);
 });
 
-
 gulp.task('build:search-index', (cb) => {
   const env = process.env;
 
@@ -181,3 +184,36 @@ gulp.task('build:search-index', (cb) => {
     cb();
   });
 });
+
+
+gulp.task('publish:search-index', (cb) => {
+  const env = process.env;
+
+  const opts = {
+    stdio: 'inherit',
+    env: env
+  };
+
+
+  console.log('Waiting');
+  setTimeout(() => {
+    console.log('Done');
+    exec('giddyup leader check', opts, function(err, stdout, stderr) {
+      console.log('Error:', err);
+      console.log('Stdout:', stdout);
+      console.log('Stderr:', stderr);
+    }).on('close', code => {
+      if (code === 0) {
+        console.log('Publishing to algolia', process.env.ALGOLIA_INDEX_NAME);
+        atomicalgolia(process.env.ALGOLIA_INDEX_NAME, process.env.ALGOLIA_INDEX_FILE, {verbose: true},  (err, result) => {
+          console.log(result);
+          cb(err);
+        });
+      } else {
+        console.log('I am not the leader (' + code + ')');
+        cb(new Error('Not the leader'));
+      }
+    });
+  }, 10000);
+
+});

layouts/shortcodes/ssl_faq_ha.html

@@ -73,7 +73,7 @@ certutil -decode FILENAME.base64 FILENAME.verify
 
 <h5>Command:</h5>
 <pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4">
-openssl s_client -CAfile ca.pem -connect rancher.yourdomain.com:443
+openssl s_client -CAfile ca.pem -connect rancher.yourdomain.com:443 -servername rancher.yourdomain.com
 ...
     Verify return code: 0 (ok)
 </pre>

package.json

@@ -26,7 +26,6 @@
     "gulp-imagemin": "^4.1.0",
     "gulp-load-plugins": "^1.5.0",
     "gulp-newer": "^1.3.0",
-    "gulp-plumber": "^1.1.0",
     "gulp-sass": "^3.1.0",
     "gulp-sass-lint": "^1.3.2",
     "gulp-size": "^3.0.0",

scripts/build-algolia.js

@@ -7,13 +7,11 @@ const {
 const md5           = require('md5');
 const atomicalgolia = require("atomic-algolia");
 const fs            = require('fs');
-const nue           = [];
+const newNodes           = [];
+const newParagraphs = [];
 const rawdata       = fs.readFileSync('public/algolia.json');
 const nodes         = JSON.parse(rawdata);
 
-console.log('&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&')
-console.log(process.env)
-console.log('&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&')
 nodes.forEach(node => {
   const dom             = new JSDOM(node.content);
   const content         = dom.window.document.body; //post content wrapped in a body tag
@@ -41,7 +39,7 @@ nodes.forEach(node => {
       let next = child.nextElementSibling;
 
       while(next && next.tagName !== 'H2') {
-        if (next) {
+        if (next && next.textContent) {
           paragraphOut.content += next.textContent;
         }
         next = next.nextElementSibling;
@@ -68,8 +66,16 @@ nodes.forEach(node => {
     // objectID is not quite unique yet so hash the entire object
     paragraphOut.objectID = md5(JSON.stringify(paragraphOut));
 
+    if (true || paragraphOut.objectID === "d41d8cd98f00b204e9800998ecf8427e") {
+      console.log('====================================');
+      console.log('ID:',paragraphOut.objectID);
+      console.log('Paragraph:',paragraphOut)
+      console.log('JSON:',JSON.stringify(paragraphOut))
+      console.log('====================================');
+    }
 
-    nue.push(paragraphOut);
+    newParagraphs.push(paragraphOut);
+    newNodes.push(node);
   }
 
 
@@ -81,12 +87,7 @@ nodes.forEach(node => {
 
 });
 
-const merged = [...nodes, ...nue];
+const merged = [...newParagraphs, ...newNodes];
 
-// fs.writeFileSync('public/combined.algolia.json', JSON.stringify(merged));
+fs.writeFileSync('public/final.algolia.json', JSON.stringify(merged));
-// process.exit(0);
+process.exit(0);
-atomicalgolia(process.env.ALGOLIA_INDEX_NAME, merged, (err, result) => {
-  if (err) throw err;
-  console.log(result);
-  process.exit(0);
-});

src/js/app.js

@@ -4,21 +4,31 @@ import instantsearch from 'instantsearch.js';
 // This is for any custom JS that may need to be added to individual apps.
 // Main JS is located in Rancher Website Theme
 const bootstrapDocsSearch = function() {
+
+  var firstSearchRender = true;
+
   const search = instantsearch({
     appId: '30NEY6C9UY',
     apiKey: 'b7f43c16886fec97b87981e9e62ef1a5',
     indexName: window.location.host === 'rancher.com' ? 'prod_docs' : 'dev_docs',
     routing: true,
-    searchFunction: function(helper) {
+    searchFunction: (helper) => {
-      if (helper.state.query === "") {
+
+      if (helper.state.query === "" && firstSearchRender) {
+
+        firstSearchRender = false;
+
         return;
       }
+
       helper.search();
     }
   });
 
   search.addWidget(
     instantsearch.widgets.searchBox({
+      autofocus: true,
+      loadingIndicator: true,
       container: '#search-box',
       placeholder: 'Search Docs...',
       magnifier: false,
@@ -55,18 +65,26 @@ const bootstrapDocsSearch = function() {
     overlay.toggleClass('open');
 
     if (container.hasClass('open')) {
-      $('input#search').focus();
+      $('input#search-box').focus();
     }
 
     overlay.css({top: 120});
   });
-
 }
 
-const bootstrapDocsJS = function() {
+const bootstrapIdLinks = function() {
-  bootstrapDocsSearch();
+  const container = '.wrapper ARTICLE';
+  const selector = 'h2[id], h3[id], h4[id], h5[id], h6[id]';
+  $(container).on('mouseenter', selector, function(e) {
+    $(e.target).append($('<a />').addClass('header-anchor').attr('href', '#' + e.target.id).html('<i class="material-icons p-l-xs" aria-hidden="true">link</i>'));
+  });
+
+  $(container).on('mouseleave', selector, function(e) {
+    $(e.target).parent().find('.header-anchor').remove();
+  });
 }
 
 $(document).ready(() => {
-  bootstrapDocsJS();
+  bootstrapDocsSearch();
+  bootstrapIdLinks();
 });