Refactoring notes

2026-09-12 04:05:50 +00:00 · 2022-07-06 13:39:07 -04:00
parent 7a2966aea6
commit e3d2aff995
6 changed files with 57 additions and 22 deletions
@@ -9,7 +9,11 @@ After installation, the [system administrator]({{<baseurl>}}/rancher/v2.6/en/adm

 After you log into Rancher for the first time, Rancher will prompt you for a **Rancher Server URL**.You should set the URL to the main entry point to the Rancher Server. When a load balancer sits in front a Rancher Server cluster, the URL should resolve to the load balancer. The system will automatically try to infer the Rancher Server URL from the IP address or host name of the host running the Rancher Server. This is only correct if you are running a single node Rancher Server installation. In most cases, therefore, you need to set the Rancher Server URL to the correct value yourself.

->**Important!** After you set the Rancher Server URL, we do not support updating it. Set the URL with extreme care.
+:::danger
+
+After you set the Rancher Server URL, we do not support updating it. Set the URL with extreme care.
+
+:::

 ## Authentication

@@ -7,7 +7,11 @@ Within Rancher, _roles_ determine what actions a user can make within a cluster

 Note that _roles_ are different from _permissions_, which determine what clusters and projects you can access.

-> It is possible for a custom role to enable privilege escalation. For details, see [this section.](#privilege-escalation)
+:::tip
+
+It is possible for a custom role to enable privilege escalation. For details, see [this section.](#privilege-escalation)
+
+:::

 This section covers the following topics:

@@ -99,11 +103,15 @@ When a user in the group logs in, they get the built-in Standard User global rol

 If a user is removed from the external authentication provider group, they would lose their permissions from the custom role that was assigned to the group. They would continue to have their individual Standard User role.

-> **Prerequisites:** You can only assign a global role to a group if:
->
-> * You have set up an [external authentication provider]({{<baseurl>}}/rancher/v2.6/en/admin-settings/authentication/#external-vs-local-authentication)
-> * The external authentication provider supports [user groups]({{<baseurl>}}/rancher/v2.6/en/admin-settings/authentication/user-groups/)
-> * You have already set up at least one user group with the authentication provider
+:::note Prerequisites:
+
+You can only assign a global role to a group if:
+
+* You have set up an [external authentication provider]({{<baseurl>}}/rancher/v2.6/en/admin-settings/authentication/#external-vs-local-authentication)
+* The external authentication provider supports [user groups]({{<baseurl>}}/rancher/v2.6/en/admin-settings/authentication/user-groups/)
+* You have already set up at least one user group with the authentication provider
+
+:::

 To assign a custom role to a group, follow these steps:

@@ -177,16 +177,22 @@ For details on which Kubernetes resources correspond to each global permission,
 1. In the left navigation bar, click **Roles**.
 1.  If you click the name of an individual role, a table shows all of the operations and resources that are permitted by the role.

-> **Notes:**
->
-> - Each permission listed above is comprised of multiple individual permissions not listed in the Rancher UI. For a full list of these permissions and the rules they are comprised of, access through the API at `/v3/globalRoles`.
-> - When viewing the resources associated with default roles created by Rancher, if there are multiple Kubernetes API resources on one line item, the resource will have `(Custom)` appended to it. These are not custom resources but just an indication that there are multiple Kubernetes API resources as one resource.
+:::note Notes:
+
+- Each permission listed above is comprised of multiple individual permissions not listed in the Rancher UI. For a full list of these permissions and the rules they are comprised of, access through the API at `/v3/globalRoles`.
+- When viewing the resources associated with default roles created by Rancher, if there are multiple Kubernetes API resources on one line item, the resource will have `(Custom)` appended to it. These are not custom resources but just an indication that there are multiple Kubernetes API resources as one resource.
+
+:::

 ### Configuring Default Global Permissions

 If you want to restrict the default permissions for new users, you can remove the `user` permission as default role and then assign multiple individual permissions as default instead. Conversely, you can also add administrative permissions on top of a set of other standard permissions.

-> **Note:** Default roles are only assigned to users added from an external authentication provider. For local users, you must explicitly assign global permissions when adding a user to Rancher. You can customize these global permissions when adding the user.
+:::note
+
+Default roles are only assigned to users added from an external authentication provider. For local users, you must explicitly assign global permissions when adding a user to Rancher. You can customize these global permissions when adding the user.
+
+:::

 To change the default global permissions that are assigned to external users upon their first log in, follow these steps:

@@ -207,7 +213,7 @@ To configure permission for a user,
 1. In the **Global Permissions** and **Built-in** sections, check the boxes for each permission you want the user to have. If you have created roles from the **Roles** page, they will appear in the **Custom** section and you can choose from them as well.
 1. Click **Save**.

-> **Result:** The user's global permissions have been updated.
+**Result:** The user's global permissions have been updated.

 ### Configuring Global Permissions for Groups

@@ -221,11 +227,15 @@ For new users, the new permissions take effect when the users log in to Rancher

 If a user is removed from the external authentication provider group, they would lose their permissions from the custom global role that was assigned to the group. They would continue to have any remaining roles that were assigned to them, which would typically include the roles marked as **New User Default**. Rancher will remove the permissions that are associated with the group when the user logs out, or when an administrator [refreshes group memberships,](#refreshing-group-memberships) whichever comes first.

-> **Prerequisites:** You can only assign a global role to a group if:
->
-> * You have set up an [external authentication provider]({{<baseurl>}}/rancher/v2.6/en/admin-settings/authentication/#external-vs-local-authentication)
-> * The external authentication provider supports [user groups]({{<baseurl>}}/rancher/v2.6/en/admin-settings/authentication/user-groups/)
-> * You have already set up at least one user group with the authentication provider
+:::note Prerequisites: 
+
+You can only assign a global role to a group if:
+
+* You have set up an [external authentication provider]({{<baseurl>}}/rancher/v2.6/en/admin-settings/authentication/#external-vs-local-authentication)
+* The external authentication provider supports [user groups]({{<baseurl>}}/rancher/v2.6/en/admin-settings/authentication/user-groups/)
+* You have already set up at least one user group with the authentication provider
+
+:::

 To assign a custom global role to a group, follow these steps:

@@ -40,7 +40,11 @@ If a cluster was created from an RKE template, you can edit the cluster to updat

 An existing cluster's settings can be [saved as an RKE template.](#converting-an-existing-cluster-to-use-an-rke-template) In that situation, you can also edit the cluster to update the cluster to a new revision of the template.

-> **Note:** You can't change the cluster to use a different RKE template. You can only update the cluster to a new revision of the same template.
+:::note
+
+You can't change the cluster to use a different RKE template. You can only update the cluster to a new revision of the same template.
+
+:::

 ### Converting an Existing Cluster to Use an RKE Template

@@ -140,8 +140,13 @@ To permanently delete a revision,

 ### Upgrading a Cluster to Use a New Template Revision

-> This section assumes that you already have a cluster that [has an RKE template applied.]({{<baseurl>}}/rancher/v2.6/en/admin-settings/rke-templates/applying-templates)
-> This section also assumes that you have [updated the template that the cluster is using](#updating-a-template) so that a new template revision is available.
+:::note
+
+This section assumes that you already have a cluster that [has an RKE template applied.]({{<baseurl>}}/rancher/v2.6/en/admin-settings/rke-templates/applying-templates)
+
+This section also assumes that you have [updated the template that the cluster is using](#updating-a-template) so that a new template revision is available.
+
+:::

 To upgrade a cluster to use a new template revision,

@@ -25,8 +25,12 @@ To require new clusters to use an RKE template, administrators can turn on RKE t
 1. Go to the `cluster-template-enforcement` setting. Click **⋮ > Edit Setting**.
 1. Set the value to **True** and click **Save**.

-    >**Important:** When the admin sets the `cluster-template-enforcement` to <b>True</b>, they also need to share the `clusterTemplates` with users so that users can select one of these templates to create the cluster.
+    :::note Important:
+    
+    When the admin sets the `cluster-template-enforcement` to <b>True</b>, they also need to share the `clusterTemplates` with users so that users can select one of these templates to create the cluster.

+    :::
+    
 **Result:** All clusters provisioned by Rancher must use a template, unless the creator is an administrator.

 # Disabling RKE Template Enforcement