diff --git a/content/rancher/v2.x/en/concepts/global-configuration/_index.md b/content/rancher/v2.x/en/concepts/global-configuration/_index.md index 24b5bf64fbf..5c8d1edc9d0 100644 --- a/content/rancher/v2.x/en/concepts/global-configuration/_index.md +++ b/content/rancher/v2.x/en/concepts/global-configuration/_index.md @@ -4,14 +4,11 @@ weight: 2075 --- After installing Rancher 2.0, you should configure it to support your users and environment. This section describes the global configurations you should make after installation. -# Authentication - +## Authentication One of the key features that Rancher adds to Kubernetes is centralized user authentication. This feature allows your users to use one set of credentials to authenticate with any of your Kubernetes clusters. This centralized user authentication is accomplished using the Rancher authentication proxy, which is installed with the rest of Rancher. This proxy authenticates your users and forwards their requests to your Kubernetes clusters using a service account. - -## External vs. Local Authentication - +### External vs. Local Authentication The Rancher authentication proxy integrates with the following external authentication services. - Microsoft Active Directory diff --git a/content/rancher/v2.x/en/tasks/clusters/creating-a-cluster/create-cluster-azure-container-service/_index.md b/content/rancher/v2.x/en/tasks/clusters/creating-a-cluster/create-cluster-azure-container-service/_index.md index 2465363251b..9d5a5cbb5e8 100644 --- a/content/rancher/v2.x/en/tasks/clusters/creating-a-cluster/create-cluster-azure-container-service/_index.md +++ b/content/rancher/v2.x/en/tasks/clusters/creating-a-cluster/create-cluster-azure-container-service/_index.md @@ -1,11 +1,9 @@ --- -title: Creating an AKS Cluster +title: Creating an Azure Container Service Cluster shortTitle: Azure Container Service weight: 3350 --- -# Creating an Azure Container Service Cluster - You can use Rancher to create a cluster using Microsoft Azure Container Service. diff --git a/content/rancher/v2.x/en/tasks/clusters/creating-a-cluster/create-cluster-azure/_index.md b/content/rancher/v2.x/en/tasks/clusters/creating-a-cluster/create-cluster-azure/_index.md index 8a6f0314c40..d44fde15ba9 100644 --- a/content/rancher/v2.x/en/tasks/clusters/creating-a-cluster/create-cluster-azure/_index.md +++ b/content/rancher/v2.x/en/tasks/clusters/creating-a-cluster/create-cluster-azure/_index.md @@ -4,8 +4,6 @@ shortTitle: Azure weight: 3300 --- -# Creating an Azure Cluster - Use {{< product >}} to create a Kubernetes cluster in Azure. 1. From the **Clusters** page, click **Add Cluster**. diff --git a/content/rancher/v2.x/en/tasks/clusters/creating-a-cluster/create-cluster-custom/_index.md b/content/rancher/v2.x/en/tasks/clusters/creating-a-cluster/create-cluster-custom/_index.md index ec359df617e..376068c1ed4 100644 --- a/content/rancher/v2.x/en/tasks/clusters/creating-a-cluster/create-cluster-custom/_index.md +++ b/content/rancher/v2.x/en/tasks/clusters/creating-a-cluster/create-cluster-custom/_index.md @@ -4,8 +4,6 @@ shortTitle: Custom Cluster weight: 3225 --- -# Creating a Custom Cluster - ## Objectives 1. [Provision a Linux Host](#provision-a-linux-host) diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication.md deleted file mode 100644 index d8cdea2560f..00000000000 --- a/content/rancher/v2.x/en/tasks/global-configuration/authentication.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: Authentication -weight: 3075 ---- diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/authentication.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/authentication.md deleted file mode 100644 index d8cdea2560f..00000000000 --- a/content/rancher/v2.x/en/tasks/global-configuration/authentication/authentication.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: Authentication -weight: 3075 ---- diff --git a/content/rancher/v2.x/en/tasks/global-configuration/configure-user-authentication.md b/content/rancher/v2.x/en/tasks/global-configuration/configure-user-authentication.md deleted file mode 100644 index 9d92dc4229b..00000000000 --- a/content/rancher/v2.x/en/tasks/global-configuration/configure-user-authentication.md +++ /dev/null @@ -1,89 +0,0 @@ ---- -title: Authentication -weight: 3075 ---- -You have three options for user authentication in {{< product >}}: - -- **Active Directory**: Enterprises can use Active Directory (AD) for authentication, allowing users to sign in using their corporate credentials. - -- **GitHub**: Open source projects or organizations that use GitHub for source control may prefer that users sign in using their GitHub accounts. - -- **Basic Authentication**: If you don't want to use external authentication, you can always add users directly to {{< product >}}. We recommend using external authentication over basic authentication. - -## Configure an Authentication Method - -### To Configure Active Directory - ->**Prerequisites:** Create a service account in Active Directory with **read-only** access. {{< product >}} uses this account to verify group membership when a user makes a request using an API key. - -1. From the **Global** view, select **Security > Authentication** from the main menu. - -2. Select **Active Directory**. - -3. Complete the **Configure an Active Directory server** form. - - You may need to log in to your domain controller to find the information requested in the form. - - >**Using TLS?** - > - Make sure you have an [LDAP certificate installed](placeholder.md). - - >**User Search Base vs. Group Search Base** - > - >When configuring AD authentication, you must enter a search base for your users. This base allows Rancher to search for users that are in your Active Directory. - - If your users and groups are in the search base, complete only the User Search Base. - - If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required. - -4. If your Active Directory deviates from the standard AD schema, complete the **Customize Schema** form to match it. Otherwise, skip this step. - -5. Enter your AD username and password in **Test and enable authentication** to confirm that Rancher is configured to use AD authentication. - -### To Configure GitHub - -1. From the **Global** view, select **Security > Authentication** from the main menu. - -2. Select **GitHub**. - -3. Follow the directions displayed to **Setup a GitHub Application**. Rancher redirects you to GitHub to complete registration. - - >**What's an Authorization Callback URL?** - > - >The Authorization Callback URL is the URL where users to begin using your application (i.e. the splash screen). - - >When you use external authentication, sign on authentication does not actually take place in your application. Instead, authentication takes place externally (in this case, GitHub). After this external authorization completes successfully, the Authorization Callback URL is the location that the user reenters your application. - -4. From GitHub, copy the **Client ID** and **Client Secret**. Paste them into {{< product >}}. - - >**Where do I find the Client ID and Client Secret?** - > - >From GitHub, select Settings > Developer Settings > OAuth Apps. The Client ID and Client Secret are displayed prominently. - -5. Click **Authenticate with GitHub**. - -6. Use the **Site Access** options to configure the scope of user authorization. - - - **Allow any valid Users** - - _Any_ GitHub user can access Rancher. We generally discourage use of this setting! - - - **Allow members of Clusters, Projects, plus Authorized Users and Organizations** - - Any GitHub user or group added as a **Cluster Member** or **Project Member** can log in to Rancher. Additionally, any GitHub user or group you add to the **Authorized Users and Organizations** list may log in to Rancher. - - - **Restrict access to only Authorized Users and Organizations** - - Only GitHub users or groups added to the Authorized Users and Organizations can log in to Rancher. -
-7. Click **Save**. - -**Result:** - -- GitHub authentication is configured. -- You are signed into Rancher with your GitHub account. -- Your GitHub account is added to Rancher as an administrator. - -### To Configure Local Authentication - -1. From the **Global** view, select **Users** from the main menu. - -2. Click **Add User**. Then complete the **Add User** form. Click **Create** when you're done. diff --git a/content/rancher/v2.x/en/tasks/global-configuration/configure-user-authentication/configure-user-authentication.md b/content/rancher/v2.x/en/tasks/global-configuration/configure-user-authentication/configure-user-authentication.md deleted file mode 100644 index 9d92dc4229b..00000000000 --- a/content/rancher/v2.x/en/tasks/global-configuration/configure-user-authentication/configure-user-authentication.md +++ /dev/null @@ -1,89 +0,0 @@ ---- -title: Authentication -weight: 3075 ---- -You have three options for user authentication in {{< product >}}: - -- **Active Directory**: Enterprises can use Active Directory (AD) for authentication, allowing users to sign in using their corporate credentials. - -- **GitHub**: Open source projects or organizations that use GitHub for source control may prefer that users sign in using their GitHub accounts. - -- **Basic Authentication**: If you don't want to use external authentication, you can always add users directly to {{< product >}}. We recommend using external authentication over basic authentication. - -## Configure an Authentication Method - -### To Configure Active Directory - ->**Prerequisites:** Create a service account in Active Directory with **read-only** access. {{< product >}} uses this account to verify group membership when a user makes a request using an API key. - -1. From the **Global** view, select **Security > Authentication** from the main menu. - -2. Select **Active Directory**. - -3. Complete the **Configure an Active Directory server** form. - - You may need to log in to your domain controller to find the information requested in the form. - - >**Using TLS?** - > - Make sure you have an [LDAP certificate installed](placeholder.md). - - >**User Search Base vs. Group Search Base** - > - >When configuring AD authentication, you must enter a search base for your users. This base allows Rancher to search for users that are in your Active Directory. - - If your users and groups are in the search base, complete only the User Search Base. - - If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required. - -4. If your Active Directory deviates from the standard AD schema, complete the **Customize Schema** form to match it. Otherwise, skip this step. - -5. Enter your AD username and password in **Test and enable authentication** to confirm that Rancher is configured to use AD authentication. - -### To Configure GitHub - -1. From the **Global** view, select **Security > Authentication** from the main menu. - -2. Select **GitHub**. - -3. Follow the directions displayed to **Setup a GitHub Application**. Rancher redirects you to GitHub to complete registration. - - >**What's an Authorization Callback URL?** - > - >The Authorization Callback URL is the URL where users to begin using your application (i.e. the splash screen). - - >When you use external authentication, sign on authentication does not actually take place in your application. Instead, authentication takes place externally (in this case, GitHub). After this external authorization completes successfully, the Authorization Callback URL is the location that the user reenters your application. - -4. From GitHub, copy the **Client ID** and **Client Secret**. Paste them into {{< product >}}. - - >**Where do I find the Client ID and Client Secret?** - > - >From GitHub, select Settings > Developer Settings > OAuth Apps. The Client ID and Client Secret are displayed prominently. - -5. Click **Authenticate with GitHub**. - -6. Use the **Site Access** options to configure the scope of user authorization. - - - **Allow any valid Users** - - _Any_ GitHub user can access Rancher. We generally discourage use of this setting! - - - **Allow members of Clusters, Projects, plus Authorized Users and Organizations** - - Any GitHub user or group added as a **Cluster Member** or **Project Member** can log in to Rancher. Additionally, any GitHub user or group you add to the **Authorized Users and Organizations** list may log in to Rancher. - - - **Restrict access to only Authorized Users and Organizations** - - Only GitHub users or groups added to the Authorized Users and Organizations can log in to Rancher. -
-7. Click **Save**. - -**Result:** - -- GitHub authentication is configured. -- You are signed into Rancher with your GitHub account. -- Your GitHub account is added to Rancher as an administrator. - -### To Configure Local Authentication - -1. From the **Global** view, select **Users** from the main menu. - -2. Click **Add User**. Then complete the **Add User** form. Click **Create** when you're done. diff --git a/content/rancher/v2.x/en/tasks/global-configuration/node-drivers.md b/content/rancher/v2.x/en/tasks/global-configuration/node-drivers.md deleted file mode 100644 index 50970e9d5e8..00000000000 --- a/content/rancher/v2.x/en/tasks/global-configuration/node-drivers.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -title: Node Drivers -weight: 3050 ---- -## Adding Custom Node Drivers - -If you create a cluster using a cloud provider that {{< product >}} doesn't support out-of-the-box, you may need to add the provider's drivers (or create them yourself) so that your nodes function properly. - -1. From the **Global** view, select **Node Drivers** from the main menu. - -2. Click **Add Node Driver**. - -3. Complete the **Add Node Driver** form. Then click **Create**. - -## Activating Node Drivers - -Using the **Custom** option, you can create a cluster using virtually any cloud provider. However, by default, {{< product >}} only activates drivers for the most popular cloud providers. If you want to use another provider, you'll have to activate their drivers. - -1. From the **Global** view, select **Node Drivers** from the main menu. - -2. Select the inactive drivers that you want to use. Then click **Add Node Driver**. diff --git a/content/rancher/v2.x/en/tasks/global-configuration/node-drivers/node-drivers.md b/content/rancher/v2.x/en/tasks/global-configuration/node-drivers/node-drivers.md deleted file mode 100644 index 50970e9d5e8..00000000000 --- a/content/rancher/v2.x/en/tasks/global-configuration/node-drivers/node-drivers.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -title: Node Drivers -weight: 3050 ---- -## Adding Custom Node Drivers - -If you create a cluster using a cloud provider that {{< product >}} doesn't support out-of-the-box, you may need to add the provider's drivers (or create them yourself) so that your nodes function properly. - -1. From the **Global** view, select **Node Drivers** from the main menu. - -2. Click **Add Node Driver**. - -3. Complete the **Add Node Driver** form. Then click **Create**. - -## Activating Node Drivers - -Using the **Custom** option, you can create a cluster using virtually any cloud provider. However, by default, {{< product >}} only activates drivers for the most popular cloud providers. If you want to use another provider, you'll have to activate their drivers. - -1. From the **Global** view, select **Node Drivers** from the main menu. - -2. Select the inactive drivers that you want to use. Then click **Add Node Driver**. diff --git a/content/rancher/v2.x/en/tasks/global-configuration/pod-security-policies.md b/content/rancher/v2.x/en/tasks/global-configuration/pod-security-policies.md deleted file mode 100644 index 4ab77f15b9d..00000000000 --- a/content/rancher/v2.x/en/tasks/global-configuration/pod-security-policies.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Adding Pod Security Policies -weight: 3150 ---- -## Adding Pod Security Policies - -Using {{< product >}}, you can create a Pod Security Policy using our GUI rather than creating a .yaml file. - -1. From the **Global** view, select **Security** > **Pod Security Policies** from the main menu. Then click **Add Policy**. - - **Step Result:** The **Add Policy** form opens. - -2. Name the policy. - -3. Complete each section of the form. Refer to the Kubernetes documentation linked below for more information on what each policy does. - - - Basic Policies: - - - [Privilege Escalation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation) - - [Host Namespaces][2] - - [Read Only Root Filesystems][1] - - - [Capability Policies](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#capabilities) - - [Volume Policy][1] - - [Allowed Host Paths Policy][1] - - [FS Group Policy][1] - - [Run As User Policy][1] - - [Host Ports Policy][2] - - [Run As User Policy][3] - - [SELinux Policy](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#selinux) - - [Supplemental Groups Policy][3] - -### What's Next? - -Now that you've created a Pod Security Policy, you can apply it to: - -- An existing cluster -- A brand new cluster. For more details, see [Creating a Cluster](../../clusters/creating-a-cluster/_index) - - - - -[1]: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems -[2]: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces -[3]: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#users-and-groups diff --git a/content/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/pod-security-policies.md b/content/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/pod-security-policies.md deleted file mode 100644 index 4ab77f15b9d..00000000000 --- a/content/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/pod-security-policies.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Adding Pod Security Policies -weight: 3150 ---- -## Adding Pod Security Policies - -Using {{< product >}}, you can create a Pod Security Policy using our GUI rather than creating a .yaml file. - -1. From the **Global** view, select **Security** > **Pod Security Policies** from the main menu. Then click **Add Policy**. - - **Step Result:** The **Add Policy** form opens. - -2. Name the policy. - -3. Complete each section of the form. Refer to the Kubernetes documentation linked below for more information on what each policy does. - - - Basic Policies: - - - [Privilege Escalation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation) - - [Host Namespaces][2] - - [Read Only Root Filesystems][1] - - - [Capability Policies](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#capabilities) - - [Volume Policy][1] - - [Allowed Host Paths Policy][1] - - [FS Group Policy][1] - - [Run As User Policy][1] - - [Host Ports Policy][2] - - [Run As User Policy][3] - - [SELinux Policy](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#selinux) - - [Supplemental Groups Policy][3] - -### What's Next? - -Now that you've created a Pod Security Policy, you can apply it to: - -- An existing cluster -- A brand new cluster. For more details, see [Creating a Cluster](../../clusters/creating-a-cluster/_index) - - - - -[1]: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems -[2]: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces -[3]: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#users-and-groups diff --git a/content/rancher/v2.x/en/tasks/global-configuration/roles.md b/content/rancher/v2.x/en/tasks/global-configuration/roles.md deleted file mode 100644 index 9574766bbdb..00000000000 --- a/content/rancher/v2.x/en/tasks/global-configuration/roles.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: Roles -weight: 3100 ---- -While _users_ determine who can log into Rancher, _roles_ determine which Kubernetes API endpoints and Rancher roles that a user can access after login. In other words, roles determine the user's _permissions_ when using Rancher. - -## Adding A Custom Role - -While Rancher comes out-of-the-box with a set of default user roles, you can also create custom roles to provide users with very specific permissions within Rancher. - -1. From the **Global** view, select **Security** > **Roles** from the main menu. - -2. Click **Add Role**. - -3. **Name** the role. - -4. Assign the role a **Context**. Context determines the scope of permissions assigned to the user. The contexts are: - - - **All** - - The user can use their assigned permissions regardless of context. The user's permissions are valid in all clusters and projects. - - - **Cluster** - - The user can use their assigned permissions within a selected cluster. - - - **Project** - - The user can use their assigned permissions within a selected project. - -5. Use the **Grant Resources** options to assign individual [Kubernetes API endpoints](https://kubernetes.io/docs/reference/) to the role. - - You can also choose the individual cURL methods (`Create`, `Delete`, `Get`, etc.) available for use with each endpoint you assign. - -6. Use the **Inherit from a Role** options to assign individual Rancher roles to your custom roles. - -7. Click **Create**. diff --git a/content/rancher/v2.x/en/tasks/global-configuration/roles/roles.md b/content/rancher/v2.x/en/tasks/global-configuration/roles/roles.md deleted file mode 100644 index 9574766bbdb..00000000000 --- a/content/rancher/v2.x/en/tasks/global-configuration/roles/roles.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: Roles -weight: 3100 ---- -While _users_ determine who can log into Rancher, _roles_ determine which Kubernetes API endpoints and Rancher roles that a user can access after login. In other words, roles determine the user's _permissions_ when using Rancher. - -## Adding A Custom Role - -While Rancher comes out-of-the-box with a set of default user roles, you can also create custom roles to provide users with very specific permissions within Rancher. - -1. From the **Global** view, select **Security** > **Roles** from the main menu. - -2. Click **Add Role**. - -3. **Name** the role. - -4. Assign the role a **Context**. Context determines the scope of permissions assigned to the user. The contexts are: - - - **All** - - The user can use their assigned permissions regardless of context. The user's permissions are valid in all clusters and projects. - - - **Cluster** - - The user can use their assigned permissions within a selected cluster. - - - **Project** - - The user can use their assigned permissions within a selected project. - -5. Use the **Grant Resources** options to assign individual [Kubernetes API endpoints](https://kubernetes.io/docs/reference/) to the role. - - You can also choose the individual cURL methods (`Create`, `Delete`, `Get`, etc.) available for use with each endpoint you assign. - -6. Use the **Inherit from a Role** options to assign individual Rancher roles to your custom roles. - -7. Click **Create**. diff --git a/content/rancher/v2.x/en/tasks/global-configuration/server-url.md b/content/rancher/v2.x/en/tasks/global-configuration/server-url.md deleted file mode 100644 index c980796ef8a..00000000000 --- a/content/rancher/v2.x/en/tasks/global-configuration/server-url.md +++ /dev/null @@ -1,13 +0,0 @@ ---- -title: Rancher Server URL -weight: 3125 ---- -## Updating the {{< product >}} Server URL - -The first time that you log into {{< product >}}, the system prompts for the {{< product >}} Server URL, which is the IP address or host name that your Kubernetes nodes register with. - -If you need to update this URL, select **Settings** from the **Global** view. - -### When Should I Update the {{< product >}} Server URL? - -If URL of your {{< product >}} Server changes, you must update the {{< product >}} Server URL so that your nodes can continue communication with the {{< product >}} Server. diff --git a/content/rancher/v2.x/en/tasks/global-configuration/server-url/server-url.md b/content/rancher/v2.x/en/tasks/global-configuration/server-url/server-url.md deleted file mode 100644 index c980796ef8a..00000000000 --- a/content/rancher/v2.x/en/tasks/global-configuration/server-url/server-url.md +++ /dev/null @@ -1,13 +0,0 @@ ---- -title: Rancher Server URL -weight: 3125 ---- -## Updating the {{< product >}} Server URL - -The first time that you log into {{< product >}}, the system prompts for the {{< product >}} Server URL, which is the IP address or host name that your Kubernetes nodes register with. - -If you need to update this URL, select **Settings** from the **Global** view. - -### When Should I Update the {{< product >}} Server URL? - -If URL of your {{< product >}} Server changes, you must update the {{< product >}} Server URL so that your nodes can continue communication with the {{< product >}} Server.