mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-30 15:04:51 +00:00
Merge branch 'master' into enhance-helm-cli-docs
This commit is contained in:
Catherine Luse
@@ -27,25 +27,6 @@ This section covers the following topics:
|
||||
- [Configuring global permissions for groups](#configuring-global-permissions-for-groups)
|
||||
- [Refreshing group memberships](#refreshing-group-memberships)
|
||||
|
||||
### List of `restricted-admin` Permissions
|
||||
|
||||
The `restricted-admin` permissions are as follows:
|
||||
|
||||
- Has full admin access to all downstream clusters managed by Rancher.
|
||||
- Has very limited access to the local Kubernetes cluster. Can access Rancher custom resource definitions, but has no access to any Kubernetes native types.
|
||||
- Can add other users and assign them to clusters outside of the local cluster.
|
||||
- Can create other restricted admins.
|
||||
- Cannot grant any permissions in the local cluster they don't currently have. (This is how Kubernetes normally operates)
|
||||
|
||||
|
||||
### Changing Global Administrators to Restricted Admins
|
||||
|
||||
If Rancher already has a global administrator, they should change all global administrators over to the new `restricted-admin` role.
|
||||
|
||||
This can be done through **Security > Users** and moving any Administrator role over to Restricted Administrator.
|
||||
|
||||
Signed-in users can change themselves over to the `restricted-admin` if they wish, but they should only do that as the last step, otherwise they won't have the permissions to do so.
|
||||
|
||||
# Global Permission Assignment
|
||||
|
||||
Global permissions for local users are assigned differently than users who log in to Rancher using external authentication.
|
||||
|
||||
@@ -3,7 +3,7 @@ title: Opening Ports with firewalld
|
||||
weight: 1
|
||||
---
|
||||
|
||||
> We recommend disabling firewalld. For Kubernetes 1.19, firewalld must be turned off.
|
||||
> We recommend disabling firewalld. For Kubernetes 1.19.x and higher, firewalld must be turned off.
|
||||
|
||||
Some distributions of Linux [derived from RHEL,](https://en.wikipedia.org/wiki/Red_Hat_Enterprise_Linux#Rebuilds) including Oracle Linux, may have default firewall rules that block communication with Helm.
|
||||
|
||||
|
||||
@@ -25,36 +25,87 @@ If your organization uses Keycloak Identity Provider (IdP) for user authenticati
|
||||
|
||||
><sup>1</sup>: Optionally, you can enable either one or both of these settings.
|
||||
><sup>2</sup>: Rancher SAML metadata won't be generated until a SAML provider is configured and saved.
|
||||
|
||||
|
||||
{{< img "/img/rancher/keycloak/keycloak-saml-client-configuration.png" "">}}
|
||||
|
||||
|
||||
- In the new SAML client, create Mappers to expose the users fields
|
||||
- Add all "Builtin Protocol Mappers"
|
||||
{{< img "/img/rancher/keycloak/keycloak-saml-client-builtin-mappers.png" "">}}
|
||||
- Create a new "Group list" mapper to map the member attribute to a user's groups
|
||||
{{< img "/img/rancher/keycloak/keycloak-saml-client-group-mapper.png" "">}}
|
||||
- Export a `metadata.xml` file from your Keycloak client:
|
||||
From the `Installation` tab, choose the `SAML Metadata IDPSSODescriptor` format option and download your file.
|
||||
|
||||
>**Note**
|
||||
> Keycloak versions 6.0.0 and up no longer provide the IDP metadata under the `Installation` tab.
|
||||
> You can still get the XML from the following url:
|
||||
>
|
||||
> `https://{KEYCLOAK-URL}/auth/realms/{REALM-NAME}/protocol/saml/descriptor`
|
||||
>
|
||||
> The XML obtained from this URL contains `EntitiesDescriptor` as the root element. Rancher expects the root element to be `EntityDescriptor` rather than `EntitiesDescriptor`. So before passing this XML to Rancher, follow these steps to adjust it:
|
||||
>
|
||||
> * Copy all the attributes from `EntitiesDescriptor` to the `EntityDescriptor` that are not present.
|
||||
> * Remove the `<EntitiesDescriptor>` tag from the beginning.
|
||||
> * Remove the `</EntitiesDescriptor>` from the end of the xml.
|
||||
>
|
||||
> You are left with something similar as the example below:
|
||||
>
|
||||
> ```
|
||||
> <EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" entityID="https://{KEYCLOAK-URL}/auth/realms/{REALM-NAME}">
|
||||
> ....
|
||||
> </EntityDescriptor>
|
||||
> ```
|
||||
{{< img "/img/rancher/keycloak/keycloak-saml-client-group-mapper.png" "">}}
|
||||
|
||||
## Getting the IDP Metadata
|
||||
|
||||
{{% tabs %}}
|
||||
{{% tab "Keycloak 5 and earlier" %}}
|
||||
To get the IDP metadata, export a `metadata.xml` file from your Keycloak client.
|
||||
From the **Installation** tab, choose the **SAML Metadata IDPSSODescriptor** format option and download your file.
|
||||
{{% /tab %}}
|
||||
{{% tab "Keycloak 6-13" %}}
|
||||
|
||||
1. From the **Configure** section, click the **Realm Settings** tab.
|
||||
1. Click the **General** tab.
|
||||
1. From the **Endpoints** field, click **SAML 2.0 Identity Provider Metadata**.
|
||||
|
||||
Verify the IDP metadata contains the following attributes:
|
||||
|
||||
```
|
||||
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
|
||||
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
|
||||
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
|
||||
```
|
||||
|
||||
Some browsers, such as Firefox, may render/process the document such that the contents appear to have been modified, and some attributes appear to be missing. In this situation, use the raw response data that can be found using your browser.
|
||||
|
||||
The following is an example process for Firefox, but will vary slightly for other browsers:
|
||||
|
||||
1. Press **F12** to access the developer console.
|
||||
1. Click the **Network** tab.
|
||||
1. From the table, click the row containing `descriptor`.
|
||||
1. From the details pane, click the **Response** tab.
|
||||
1. Copy the raw response data.
|
||||
|
||||
The XML obtained contains `EntitiesDescriptor` as the root element. Rancher expects the root element to be `EntityDescriptor` rather than `EntitiesDescriptor`. So before passing this XML to Rancher, follow these steps to adjust it:
|
||||
|
||||
1. Copy all the attributes from `EntitiesDescriptor` to the `EntityDescriptor` that are not present.
|
||||
1. Remove the `<EntitiesDescriptor>` tag from the beginning.
|
||||
1. Remove the `</EntitiesDescriptor>` from the end of the xml.
|
||||
|
||||
You are left with something similar as the example below:
|
||||
|
||||
```
|
||||
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" entityID="https://{KEYCLOAK-URL}/auth/realms/{REALM-NAME}">
|
||||
....
|
||||
</EntityDescriptor>
|
||||
```
|
||||
|
||||
{{% /tab %}}
|
||||
{{% tab "Keycloak 14+" %}}
|
||||
|
||||
1. From the **Configure** section, click the **Realm Settings** tab.
|
||||
1. Click the **General** tab.
|
||||
1. From the **Endpoints** field, click **SAML 2.0 Identity Provider Metadata**.
|
||||
|
||||
Verify the IDP metadata contains the following attributes:
|
||||
|
||||
```
|
||||
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
|
||||
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
|
||||
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
|
||||
```
|
||||
|
||||
Some browsers, such as Firefox, may render/process the document such that the contents appear to have been modified, and some attributes appear to be missing. In this situation, use the raw response data that can be found using your browser.
|
||||
|
||||
The following is an example process for Firefox, but will vary slightly for other browsers:
|
||||
|
||||
1. Press **F12** to access the developer console.
|
||||
1. Click the **Network** tab.
|
||||
1. From the table, click the row containing `descriptor`.
|
||||
1. From the details pane, click the **Response** tab.
|
||||
1. Copy the raw response data.
|
||||
|
||||
{{% /tab %}}
|
||||
{{% /tabs %}}
|
||||
|
||||
## Configuring Keycloak in Rancher
|
||||
|
||||
|
||||
@@ -19,3 +19,22 @@ Certificates can be rotated for the following services:
|
||||
- kube-scheduler
|
||||
- kube-controller-manager
|
||||
|
||||
|
||||
### Certificate Rotation
|
||||
|
||||
Rancher launched Kubernetes clusters have the ability to rotate the auto-generated certificates through the UI.
|
||||
|
||||
1. In the **Global** view, navigate to the cluster that you want to rotate certificates.
|
||||
|
||||
2. Select **⋮ > Rotate Certificates**.
|
||||
|
||||
3. Select which certificates that you want to rotate.
|
||||
|
||||
* Rotate all Service certificates (keep the same CA)
|
||||
* Rotate an individual service and choose one of the services from the drop-down menu
|
||||
|
||||
4. Click **Save**.
|
||||
|
||||
**Results:** The selected certificates will be rotated and the related services will be restarted to start using the new certificate.
|
||||
|
||||
> **Note:** Even though the RKE CLI can use custom certificates for the Kubernetes cluster components, Rancher currently doesn't allow the ability to upload these in Rancher launched Kubernetes clusters.
|
||||
|
||||
+4
-1
@@ -13,7 +13,10 @@ This page covers how to install the Cloud Provider Interface (CPI) and Cloud Sto
|
||||
|
||||
# Prerequisites
|
||||
|
||||
The vSphere version must be 7.0u1 or higher.
|
||||
The vSphere versions supported:
|
||||
|
||||
* 6.7u3
|
||||
* 7.0u1 or higher.
|
||||
|
||||
The Kubernetes version must be 1.19 or higher.
|
||||
|
||||
|
||||
@@ -27,7 +27,7 @@ The capability to access a downstream cluster without Rancher depends on the typ
|
||||
|
||||
- **Registered clusters:** The cluster will be unaffected and you can access the cluster using the same methods that you did before the cluster was registered into Rancher.
|
||||
- **Hosted Kubernetes clusters:** If you created the cluster in a cloud-hosted Kubernetes provider such as EKS, GKE, or AKS, you can continue to manage the cluster using your provider's cloud credentials.
|
||||
- **RKE clusters:** To access an [RKE cluster,]({{<baseurl>}}/rancher/v2.5/en/cluster-provisioning/rke-clusters/) the cluster must have the [authorized cluster endpoint]({{<baseurl>}}/rancher/v2.5/en/overview/architecture/#4-authorized-cluster-endpoint) enabled, and you must have already downloaded the cluster's kubeconfig file from the Rancher UI. (The authorized cluster endpoint is enabled by default for RKE clusters.) With this endpoint, you can access your cluster with kubectl directly instead of communicating through the Rancher server's [authentication proxy.]({{<baseurl>}}/rancher/v2.5/en/overview/architecture/#1-the-authentication-proxy) For instructions on how to configure kubectl to use the authorized cluster endpoint, refer to the section about directly accessing clusters with [kubectl and the kubeconfig file.]({{<baseurl>}}/rancher/v2.5/en/cluster-admin/cluster-access/kubectl/#authenticating-directly-with-a-downstream-cluster) These clusters will use a snapshot of the authentication as it was configured when Rancher was removed.
|
||||
- **RKE clusters:** Please note that you will no longer be able to manage the individual Kubernetes components or perform any upgrades on them after the deletion of the Rancher server. However, you can still access the cluster to manage your workloads. To access an [RKE cluster,]({{<baseurl>}}/rancher/v2.5/en/cluster-provisioning/rke-clusters/) the cluster must have the [authorized cluster endpoint]({{<baseurl>}}/rancher/v2.5/en/overview/architecture/#4-authorized-cluster-endpoint) enabled, and you must have already downloaded the cluster's kubeconfig file from the Rancher UI. (The authorized cluster endpoint is enabled by default for RKE clusters.) With this endpoint, you can access your cluster with kubectl directly instead of communicating through the Rancher server's [authentication proxy.]({{<baseurl>}}/rancher/v2.5/en/overview/architecture/#1-the-authentication-proxy) For instructions on how to configure kubectl to use the authorized cluster endpoint, refer to the section about directly accessing clusters with [kubectl and the kubeconfig file.]({{<baseurl>}}/rancher/v2.5/en/cluster-admin/cluster-access/kubectl/#authenticating-directly-with-a-downstream-cluster) These clusters will use a snapshot of the authentication as it was configured when Rancher was removed.
|
||||
|
||||
### What if I don't want Rancher anymore?
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@ aliases:
|
||||
- /rancher/v2.5/en/installation/k8s-install/
|
||||
- /rancher/v2.5/en/installation/k8s-install/helm-rancher
|
||||
- /rancher/v2.5/en/installation/k8s-install/kubernetes-rke
|
||||
- /rancher/v2.5/en/installation/ha-server-install
|
||||
- /rancher/v2.5/en/installation/ha-server-install
|
||||
- /rancher/v2.5/en/installation/install-rancher-on-k8s/install
|
||||
- /rancher/v2.x/en/installation/install-rancher-on-k8s/
|
||||
---
|
||||
@@ -24,7 +24,7 @@ In this section, you'll learn how to deploy Rancher on a Kubernetes cluster usin
|
||||
|
||||
### Kubernetes Cluster
|
||||
|
||||
Set up the Rancher server's local Kubernetes cluster.
|
||||
Set up the Rancher server's local Kubernetes cluster.
|
||||
|
||||
Rancher can be installed on any Kubernetes cluster. This cluster can use upstream Kubernetes, or it can use one of Rancher's Kubernetes distributions, or it can be a managed Kubernetes cluster from a provider such as Amazon EKS.
|
||||
|
||||
@@ -113,7 +113,7 @@ There are three recommended options for the source of the certificate used for T
|
||||
|
||||
### 4. Install cert-manager
|
||||
|
||||
> You should skip this step if you are bringing your own certificate files (option `ingress.tls.source=secret`), or if you use [TLS termination on an external load balancer]({{<baseurl>}}/rancher/v2.5/en/installation/install-rancher-on-k8s/chart-options/#external-tls-termination).
|
||||
> You should skip this step if you are bringing your own certificate files (option `ingress.tls.source=secret`), or if you use [TLS termination on an external load balancer]({{<baseurl>}}/rancher/v2.5/en/installation/install-rancher-on-k8s/chart-options/#external-tls-termination).
|
||||
|
||||
This step is only required to use certificates issued by Rancher's generated CA (`ingress.tls.source=rancher`) or to request Let's Encrypt issued certificates (`ingress.tls.source=letsEncrypt`).
|
||||
|
||||
@@ -157,6 +157,8 @@ cert-manager-webhook-787858fcdb-nlzsq 1/1 Running 0 2m
|
||||
|
||||
The exact command to install Rancher differs depending on the certificate configuration.
|
||||
|
||||
However, irrespective of the certificate configuration, the name of the Rancher installation in the `cattle-system` namespace should always be `rancher`.
|
||||
|
||||
{{% tabs %}}
|
||||
{{% tab "Rancher-generated Certificates" %}}
|
||||
|
||||
@@ -168,7 +170,7 @@ Because `rancher` is the default option for `ingress.tls.source`, we are not spe
|
||||
- Set `hostname` to the DNS record that resolves to your load balancer.
|
||||
- Set `replicas` to the number of replicas to use for the Rancher Deployment. This defaults to 3; if you have less than 3 nodes in your cluster you should reduce it accordingly.
|
||||
- To install a specific Rancher version, use the `--version` flag, example: `--version 2.3.6`.
|
||||
- If you are installing an alpha version, Helm requires adding the `--devel` option to the command.
|
||||
- If you are installing an alpha version, Helm requires adding the `--devel` option to the command.
|
||||
|
||||
```
|
||||
helm install rancher rancher-<CHART_REPO>/rancher \
|
||||
@@ -200,7 +202,7 @@ In the following command,
|
||||
- Set `letsEncrypt.email` to the email address used for communication about your certificate (for example, expiry notices).
|
||||
- Set `letsEncrypt.ingress.class` to whatever your ingress controller is, e.g., `traefik`, `nginx`, `haproxy`, etc.
|
||||
- To install a specific Rancher version, use the `--version` flag, example: `--version 2.3.6`.
|
||||
- If you are installing an alpha version, Helm requires adding the `--devel` option to the command.
|
||||
- If you are installing an alpha version, Helm requires adding the `--devel` option to the command.
|
||||
|
||||
```
|
||||
helm install rancher rancher-<CHART_REPO>/rancher \
|
||||
@@ -234,7 +236,7 @@ Although an entry in the `Subject Alternative Names` is technically required, ha
|
||||
- Set `replicas` to the number of replicas to use for the Rancher Deployment. This defaults to 3; if you have less than 3 nodes in your cluster you should reduce it accordingly.
|
||||
- Set `ingress.tls.source` to `secret`.
|
||||
- To install a specific Rancher version, use the `--version` flag, example: `--version 2.3.6`.
|
||||
- If you are installing an alpha version, Helm requires adding the `--devel` option to the command.
|
||||
- If you are installing an alpha version, Helm requires adding the `--devel` option to the command.
|
||||
|
||||
```
|
||||
helm install rancher rancher-<CHART_REPO>/rancher \
|
||||
|
||||
@@ -5,7 +5,7 @@ aliases:
|
||||
- /rancher/v2.x/en/installation/resources/advanced/firewall/
|
||||
---
|
||||
|
||||
> We recommend disabling firewalld. For Kubernetes 1.19, firewalld must be turned off.
|
||||
> We recommend disabling firewalld. For Kubernetes 1.19.x and higher, firewalld must be turned off.
|
||||
|
||||
Some distributions of Linux [derived from RHEL,](https://en.wikipedia.org/wiki/Red_Hat_Enterprise_Linux#Rebuilds) including Oracle Linux, may have default firewall rules that block communication with Helm.
|
||||
|
||||
|
||||
@@ -13,6 +13,7 @@ A summary of the steps is as follows:
|
||||
2. Create or update the `tls-ca` Kubernetes secret resource with the root CA certificate (only required when using a private CA).
|
||||
3. Update the Rancher installation using the Helm CLI.
|
||||
4. Reconfigure the Rancher agents to trust the new CA certificate.
|
||||
5. Select Force Update of Fleet clusters to connect fleet-agent to Rancher.
|
||||
|
||||
The details of these instructions are below.
|
||||
|
||||
@@ -145,3 +146,12 @@ First, generate the agent definitions as described here: https://gist.github.com
|
||||
|
||||
Then, connect to a controlplane node of the downstream cluster via SSH, create a Kubeconfig and apply the definitions:
|
||||
https://gist.github.com/superseb/b14ed3b5535f621ad3d2aa6a4cd6443b
|
||||
|
||||
|
||||
# 5. Select Force Update of Fleet clusters to connect fleet-agent to Rancher
|
||||
|
||||
Select 'Force Update' for the clusters within the [Continuous Delivery]({{<baseurl>}}/rancher/v2.5/en/deploy-across-clusters/fleet/#accessing-fleet-in-the-rancher-ui) view under Cluster Explorer in the Rancher UI to allow the fleet-agent in downstream clusters to successfully connect to Rancher.
|
||||
|
||||
### Why is this step required?
|
||||
|
||||
Fleet agents in Rancher managed clusters store kubeconfig that is used to connect to the Rancher proxied kube-api in the fleet-agent secret of the fleet-system namespace. The kubeconfig contains a certificate-authority-data block containing the Rancher CA. When changing the Rancher CA, this block needs to be updated for a successful connection of the fleet-agent to Rancher.
|
||||
|
||||
@@ -1281,7 +1281,7 @@ on the master node and ensure the correct value for the `--bind-address` paramet
|
||||
**Expected result**:
|
||||
|
||||
```
|
||||
'--bind-address' is present OR '--bind-address' is not present
|
||||
'--bind-address' argument is set to 127.0.0.1
|
||||
```
|
||||
|
||||
### 1.4 Scheduler
|
||||
@@ -1327,7 +1327,7 @@ on the master node and ensure the correct value for the `--bind-address` paramet
|
||||
**Expected result**:
|
||||
|
||||
```
|
||||
'--bind-address' is present OR '--bind-address' is not present
|
||||
'--bind-address' argument is set to 127.0.0.1
|
||||
```
|
||||
|
||||
## 2 Etcd Node Configuration
|
||||
|
||||
@@ -667,6 +667,7 @@ rancher_kubernetes_engine_config:
|
||||
service_node_port_range: 30000-32767
|
||||
kube_controller:
|
||||
extra_args:
|
||||
bind-address: 127.0.0.1
|
||||
address: 127.0.0.1
|
||||
feature-gates: RotateKubeletServerCertificate=true
|
||||
profiling: 'false'
|
||||
@@ -685,6 +686,7 @@ rancher_kubernetes_engine_config:
|
||||
generate_serving_certificate: true
|
||||
scheduler:
|
||||
extra_args:
|
||||
bind-address: 127.0.0.1
|
||||
address: 127.0.0.1
|
||||
profiling: 'false'
|
||||
ssh_agent_auth: false
|
||||
|
||||
@@ -1803,13 +1803,13 @@ on the master node and ensure the correct value for the --bind-address parameter
|
||||
**Expected Result**:
|
||||
|
||||
```console
|
||||
'--bind-address' is not present OR '--bind-address' is not present
|
||||
'--bind-address' argument is set to 127.0.0.1
|
||||
```
|
||||
|
||||
**Returned Value**:
|
||||
|
||||
```console
|
||||
root 4788 4773 4 16:16 ? 00:00:09 kube-controller-manager --configure-cloud-routes=false --cloud-provider= --service-cluster-ip-range=10.43.0.0/16 --v=2 --pod-eviction-timeout=5m0s --leader-elect=true --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --profiling=false --node-monitor-grace-period=40s --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --address=0.0.0.0 --allow-untagged-cloud=true --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --enable-hostpath-provisioner=false --terminated-pod-gc-threshold=1000 --feature-gates=RotateKubeletServerCertificate=true --use-service-account-credentials=true
|
||||
root 4788 4773 4 16:16 ? 00:00:09 kube-controller-manager --configure-cloud-routes=false --cloud-provider= --service-cluster-ip-range=10.43.0.0/16 --v=2 --bind-address=127.0.0.1 --pod-eviction-timeout=5m0s --leader-elect=true --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --profiling=false --node-monitor-grace-period=40s --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --address=127.0.0.1 --allow-untagged-cloud=true --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --enable-hostpath-provisioner=false --terminated-pod-gc-threshold=1000 --feature-gates=RotateKubeletServerCertificate=true --use-service-account-credentials=true
|
||||
|
||||
```
|
||||
## 1.4 Scheduler
|
||||
@@ -1859,13 +1859,13 @@ on the master node and ensure the correct value for the --bind-address parameter
|
||||
**Expected Result**:
|
||||
|
||||
```console
|
||||
'--bind-address' is not present OR '--bind-address' is not present
|
||||
'--bind-address' argument is set to 127.0.0.1
|
||||
```
|
||||
|
||||
**Returned Value**:
|
||||
|
||||
```console
|
||||
root 4947 4930 1 16:16 ? 00:00:02 kube-scheduler --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --leader-elect=true --profiling=false --v=2 --address=0.0.0.0
|
||||
root 4947 4930 1 16:16 ? 00:00:02 kube-scheduler --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --leader-elect=true --profiling=false --v=2 --address=127.0.0.1 --bind-address=127.0.0.1
|
||||
|
||||
```
|
||||
## 2 Etcd Node Configuration Files
|
||||
|
||||
@@ -511,6 +511,8 @@ rancher_kubernetes_engine_config:
|
||||
kube_controller:
|
||||
extra_args:
|
||||
feature-gates: RotateKubeletServerCertificate=true
|
||||
bind-address: 127.0.0.1
|
||||
address: 127.0.0.1
|
||||
kubelet:
|
||||
extra_args:
|
||||
feature-gates: RotateKubeletServerCertificate=true
|
||||
@@ -519,6 +521,10 @@ rancher_kubernetes_engine_config:
|
||||
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
fail_swap_on: false
|
||||
generate_serving_certificate: true
|
||||
scheduler:
|
||||
extra_args:
|
||||
bind-address: 127.0.0.1
|
||||
address: 127.0.0.1
|
||||
ssh_agent_auth: false
|
||||
upgrade_strategy:
|
||||
max_unavailable_controlplane: '1'
|
||||
|
||||
@@ -23,36 +23,87 @@ If your organization uses Keycloak Identity Provider (IdP) for user authenticati
|
||||
|
||||
><sup>1</sup>: Optionally, you can enable either one or both of these settings.
|
||||
><sup>2</sup>: Rancher SAML metadata won't be generated until a SAML provider is configured and saved.
|
||||
|
||||
|
||||
{{< img "/img/rancher/keycloak/keycloak-saml-client-configuration.png" "">}}
|
||||
|
||||
|
||||
- In the new SAML client, create Mappers to expose the users fields
|
||||
- Add all "Builtin Protocol Mappers"
|
||||
{{< img "/img/rancher/keycloak/keycloak-saml-client-builtin-mappers.png" "">}}
|
||||
- Create a new "Group list" mapper to map the member attribute to a user's groups
|
||||
{{< img "/img/rancher/keycloak/keycloak-saml-client-group-mapper.png" "">}}
|
||||
- Export a `metadata.xml` file from your Keycloak client:
|
||||
From the `Installation` tab, choose the `SAML Metadata IDPSSODescriptor` format option and download your file.
|
||||
|
||||
>**Note**
|
||||
> Keycloak versions 6.0.0 and up no longer provide the IDP metadata under the `Installation` tab.
|
||||
> You can still get the XML from the following url:
|
||||
>
|
||||
> `https://{KEYCLOAK-URL}/auth/realms/{REALM-NAME}/protocol/saml/descriptor`
|
||||
>
|
||||
> The XML obtained from this URL contains `EntitiesDescriptor` as the root element. Rancher expects the root element to be `EntityDescriptor` rather than `EntitiesDescriptor`. So before passing this XML to Rancher, follow these steps to adjust it:
|
||||
>
|
||||
> * Copy all the attributes from `EntitiesDescriptor` to the `EntityDescriptor` that are not present.
|
||||
> * Remove the `<EntitiesDescriptor>` tag from the beginning.
|
||||
> * Remove the `</EntitiesDescriptor>` from the end of the xml.
|
||||
>
|
||||
> You are left with something similar as the example below:
|
||||
>
|
||||
> ```
|
||||
> <EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" entityID="https://{KEYCLOAK-URL}/auth/realms/{REALM-NAME}">
|
||||
> ....
|
||||
> </EntityDescriptor>
|
||||
> ```
|
||||
{{< img "/img/rancher/keycloak/keycloak-saml-client-group-mapper.png" "">}}
|
||||
|
||||
## Getting the IDP Metadata
|
||||
|
||||
{{% tabs %}}
|
||||
{{% tab "Keycloak 5 and earlier" %}}
|
||||
To get the IDP metadata, export a `metadata.xml` file from your Keycloak client.
|
||||
From the **Installation** tab, choose the **SAML Metadata IDPSSODescriptor** format option and download your file.
|
||||
{{% /tab %}}
|
||||
{{% tab "Keycloak 6-13" %}}
|
||||
|
||||
1. From the **Configure** section, click the **Realm Settings** tab.
|
||||
1. Click the **General** tab.
|
||||
1. From the **Endpoints** field, click **SAML 2.0 Identity Provider Metadata**.
|
||||
|
||||
Verify the IDP metadata contains the following attributes:
|
||||
|
||||
```
|
||||
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
|
||||
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
|
||||
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
|
||||
```
|
||||
|
||||
Some browsers, such as Firefox, may render/process the document such that the contents appear to have been modified, and some attributes appear to be missing. In this situation, use the raw response data that can be found using your browser.
|
||||
|
||||
The following is an example process for Firefox, but will vary slightly for other browsers:
|
||||
|
||||
1. Press **F12** to access the developer console.
|
||||
1. Click the **Network** tab.
|
||||
1. From the table, click the row containing `descriptor`.
|
||||
1. From the details pane, click the **Response** tab.
|
||||
1. Copy the raw response data.
|
||||
|
||||
The XML obtained contains `EntitiesDescriptor` as the root element. Rancher expects the root element to be `EntityDescriptor` rather than `EntitiesDescriptor`. So before passing this XML to Rancher, follow these steps to adjust it:
|
||||
|
||||
1. Copy all the attributes from `EntitiesDescriptor` to the `EntityDescriptor` that are not present.
|
||||
1. Remove the `<EntitiesDescriptor>` tag from the beginning.
|
||||
1. Remove the `</EntitiesDescriptor>` from the end of the xml.
|
||||
|
||||
You are left with something similar as the example below:
|
||||
|
||||
```
|
||||
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" entityID="https://{KEYCLOAK-URL}/auth/realms/{REALM-NAME}">
|
||||
....
|
||||
</EntityDescriptor>
|
||||
```
|
||||
|
||||
{{% /tab %}}
|
||||
{{% tab "Keycloak 14+" %}}
|
||||
|
||||
1. From the **Configure** section, click the **Realm Settings** tab.
|
||||
1. Click the **General** tab.
|
||||
1. From the **Endpoints** field, click **SAML 2.0 Identity Provider Metadata**.
|
||||
|
||||
Verify the IDP metadata contains the following attributes:
|
||||
|
||||
```
|
||||
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
|
||||
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
|
||||
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
|
||||
```
|
||||
|
||||
Some browsers, such as Firefox, may render/process the document such that the contents appear to have been modified, and some attributes appear to be missing. In this situation, use the raw response data that can be found using your browser.
|
||||
|
||||
The following is an example process for Firefox, but will vary slightly for other browsers:
|
||||
|
||||
1. Press **F12** to access the developer console.
|
||||
1. Click the **Network** tab.
|
||||
1. From the table, click the row containing `descriptor`.
|
||||
1. From the details pane, click the **Response** tab.
|
||||
1. Copy the raw response data.
|
||||
|
||||
{{% /tab %}}
|
||||
{{% /tabs %}}
|
||||
|
||||
## Configuring Keycloak in Rancher
|
||||
|
||||
|
||||
@@ -40,7 +40,21 @@ You can override the primary color used throughout the UI with a custom color of
|
||||
|
||||
### Fixed Banners
|
||||
|
||||
{{% tabs %}}
|
||||
{{% tab "Rancher before v2.6.4" %}}
|
||||
Display a custom fixed banner in the header, footer, or both.
|
||||
{{% /tab %}}
|
||||
{{% tab "Rancher v2.6.4+" %}}
|
||||
Display a custom fixed banner in the header, footer, or both.
|
||||
|
||||
As of Rancher v2.6.4, configuration of fixed banners has moved from the **Branding** tab to the **Banners** tab.
|
||||
|
||||
To configure banner settings,
|
||||
|
||||
1. Click **☰ > Global settings**.
|
||||
2. Click **Banners**.
|
||||
{{% /tab %}}
|
||||
{{% /tabs %}}
|
||||
|
||||
# Custom Navigation Links
|
||||
|
||||
|
||||
@@ -85,16 +85,30 @@ spec:
|
||||
>**Important:** The field `encryptionConfigSecretName` must be set only if your backup was created with encryption enabled. Provide the name of the Secret containing the encryption config file. If you only have the encryption config file, but don't have a secret created with it in this cluster, use the following steps to create the secret:
|
||||
|
||||
1. The encryption configuration file must be named `encryption-provider-config.yaml`, and the `--from-file` flag must be used to create this secret. So save your `EncryptionConfiguration` in a file called `encryption-provider-config.yaml` and run this command:
|
||||
```
|
||||
kubectl create secret generic encryptionconfig \
|
||||
--from-file=./encryption-provider-config.yaml \
|
||||
-n cattle-resources-system
|
||||
```
|
||||
|
||||
1. Then apply the resource:
|
||||
```
|
||||
kubectl apply -f migrationResource.yaml
|
||||
```
|
||||
```
|
||||
kubectl create secret generic encryptionconfig \
|
||||
--from-file=./encryption-provider-config.yaml \
|
||||
-n cattle-resources-system
|
||||
```
|
||||
|
||||
1. Apply the manifest, and watch for the Restore resources status:
|
||||
|
||||
Apply the resource:
|
||||
```
|
||||
kubectl apply -f migrationResource.yaml
|
||||
```
|
||||
|
||||
Watch the Restore status:
|
||||
```
|
||||
kubectl get restore
|
||||
```
|
||||
|
||||
Watch the restoration logs:
|
||||
```
|
||||
kubectl logs -n cattle-resources-system --tail 100 -f rancher-backup-xxx-xxx
|
||||
```
|
||||
|
||||
Once the Restore resource has the status `Completed`, you can continue the Rancher installation.
|
||||
|
||||
### 3. Install cert-manager
|
||||
|
||||
|
||||
@@ -19,3 +19,22 @@ Certificates can be rotated for the following services:
|
||||
|
||||
> **Note:** For users who didn't rotate their webhook certificates, and they have expired after one year, please see this [page]({{<baseurl>}}/rancher/v2.6/en/troubleshooting/expired-webhook-certificates/) for help.
|
||||
|
||||
|
||||
### Certificate Rotation
|
||||
|
||||
Rancher launched Kubernetes clusters have the ability to rotate the auto-generated certificates through the UI.
|
||||
|
||||
1. In the **Global** view, navigate to the cluster that you want to rotate certificates.
|
||||
|
||||
2. Select **⋮ > Rotate Certificates**.
|
||||
|
||||
3. Select which certificates that you want to rotate.
|
||||
|
||||
* Rotate all Service certificates (keep the same CA)
|
||||
* Rotate an individual service and choose one of the services from the drop-down menu
|
||||
|
||||
4. Click **Save**.
|
||||
|
||||
**Results:** The selected certificates will be rotated and the related services will be restarted to start using the new certificate.
|
||||
|
||||
> **Note:** Even though the RKE CLI can use custom certificates for the Kubernetes cluster components, Rancher currently doesn't allow the ability to upload these in Rancher launched Kubernetes clusters.
|
||||
|
||||
+4
-1
@@ -341,7 +341,10 @@ Example:
|
||||
local_cluster_auth_endpoint:
|
||||
enabled: true
|
||||
fqdn: "FQDN"
|
||||
ca_certs: "BASE64_CACERT"
|
||||
ca_certs: |-
|
||||
-----BEGIN CERTIFICATE-----
|
||||
...
|
||||
-----END CERTIFICATE-----
|
||||
```
|
||||
|
||||
### Custom Network Plug-in
|
||||
|
||||
@@ -14,7 +14,6 @@ You can use Rancher to create a cluster hosted in Microsoft Azure Kubernetes Ser
|
||||
- [Role-based Access Control](#role-based-access-control)
|
||||
- [AKS Cluster Configuration Reference](#aks-cluster-configuration-reference)
|
||||
- [Private Clusters](#private-clusters)
|
||||
- [Minimum AKS Permissions](#minimum-aks-permissions)
|
||||
- [Syncing](#syncing)
|
||||
- [Programmatically Creating AKS Clusters](#programmatically-creating-aks-clusters)
|
||||
|
||||
|
||||
@@ -168,7 +168,7 @@ Also in the K3s documentation, nodes with the worker role are called agent nodes
|
||||
|
||||
# Debug Logging and Troubleshooting for Registered K3s Clusters
|
||||
|
||||
Nodes are upgraded by the system upgrade controller running in the downstream cluster. Based on the cluster configuration, Rancher deploys two [plans](https://github.com/rancher/system-upgrade-controller#example-upgrade-plan) to upgrade K3s nodes: one for controlplane nodes and one for workers. The system upgrade controller follows the plans and upgrades the nodes.
|
||||
Nodes are upgraded by the system upgrade controller running in the downstream cluster. Based on the cluster configuration, Rancher deploys two [plans](https://github.com/rancher/system-upgrade-controller#example-upgrade-plan) to upgrade K3s nodes: one for controlplane nodes and one for workers. The system upgrade controller follows the plans and upgrades the nodes.
|
||||
|
||||
To enable debug logging on the system upgrade controller deployment, edit the [configmap](https://github.com/rancher/system-upgrade-controller/blob/50a4c8975543d75f1d76a8290001d87dc298bdb4/manifests/system-upgrade-controller.yaml#L32) to set the debug environment variable to true. Then restart the `system-upgrade-controller` pod.
|
||||
|
||||
@@ -196,7 +196,7 @@ Authorized Cluster Endpoint (ACE) support has been added for registered RKE2 and
|
||||
|
||||
> **Note:**
|
||||
>
|
||||
> - These steps only need to be performed on the control plane nodes of the downstream cluster. You must configure each control plane node individually.
|
||||
> - These steps only need to be performed on the control plane nodes of the downstream cluster. You must configure each control plane node individually.
|
||||
>
|
||||
> - The following steps will work on both RKE2 and K3s clusters registered in v2.6.x as well as those registered (or imported) from a previous version of Rancher with an upgrade to v2.6.x.
|
||||
>
|
||||
@@ -223,19 +223,19 @@ Authorized Cluster Endpoint (ACE) support has been added for registered RKE2 and
|
||||
context:
|
||||
user: Default
|
||||
cluster: Default
|
||||
|
||||
|
||||
1. Add the following to the config file (or create one if it doesn’t exist); note that the default location is `/etc/rancher/{rke2,k3s}/config.yaml`:
|
||||
|
||||
kube-apiserver-arg:
|
||||
- authentication-token-webhook-config-file=/var/lib/rancher/{rke2,k3s}/kube-api-authn-webhook.yaml
|
||||
|
||||
|
||||
1. Run the following commands:
|
||||
|
||||
sudo systemctl stop {rke2,k3s}-server
|
||||
sudo systemctl start {rke2,k3s}-server
|
||||
|
||||
1. Finally, you **must** go back to the Rancher UI and edit the imported cluster there to complete the ACE enablement. Click on **⋮ > Edit Config**, then click the **Networking** tab under Cluster Configuration. Finally, click the **Enabled** button for **Authorized Endpoint**. Once the ACE is enabled, you then have the option of entering a fully qualified domain name (FQDN) and certificate information.
|
||||
|
||||
|
||||
>**Note:** The <b>FQDN</b> field is optional, and if one is entered, it should point to the downstream cluster. Certificate information is only needed if there is a load balancer in front of the downstream cluster that is using an untrusted certificate. If you have a valid certificate, then nothing needs to be added to the <b>CA Certificates</b> field.
|
||||
|
||||
# Annotating Registered Clusters
|
||||
@@ -286,4 +286,3 @@ To annotate a registered cluster,
|
||||
1. Click **Save**.
|
||||
|
||||
**Result:** The annotation does not give the capabilities to the cluster, but it does indicate to Rancher that the cluster has those capabilities.
|
||||
|
||||
|
||||
+34
@@ -0,0 +1,34 @@
|
||||
---
|
||||
title: Behavior Differences Between RKE1 and RKE2
|
||||
weight: 2450
|
||||
---
|
||||
|
||||
RKE2, also known as RKE Government, is a Kubernetes distribution that focuses on security and compliance for U.S. Federal Government entities. It is considered the next iteration of the Rancher Kubernetes Engine, now known as RKE1.
|
||||
|
||||
RKE1 and RKE2 have several slight behavioral differences to note, and this page will highlight some of these at a high level.
|
||||
|
||||
### Control Plane Components
|
||||
|
||||
RKE1 uses Docker for deploying and managing control plane components, and it also uses Docker as the container runtime for Kubernetes. By contrast, RKE2 launches control plane components as static pods that are managed by the kubelet. RKE2's container runtime is containerd, which allows things such as container registry mirroring (RKE1 with Docker does not).
|
||||
|
||||
### Cluster API
|
||||
|
||||
RKE2/K3s provisioning is built on top of the Cluster API (CAPI) upstream framework which often makes RKE2-provisioned clusters behave differently than RKE1-provisioned clusters.
|
||||
|
||||
When you make changes to your cluster configuration in RKE2, this **may** result in nodes reprovisioning. This is controlled by CAPI controllers and not by Rancher itself. Note that for etcd nodes, the same behavior does not apply.
|
||||
|
||||
The following are some specific example configuration changes that may cause the described behavior:
|
||||
|
||||
- When editing the cluster and enabling `drain before delete`, the existing control plane nodes and worker are deleted and new nodes are created.
|
||||
|
||||
- When nodes are being provisioned and a scale down operation is performed, rather than scaling down the desired number of nodes, it is possible that the currently provisioning nodes get deleted and new nodes are provisioned to reach the desired node count. Please note that this is a bug in Cluster API, and it will be fixed in an upcoming release. Once fixed, Rancher will update the documentation.
|
||||
|
||||
Users who are used to RKE1 provisioning should take note of this new RKE2 behavior which may be unexpected.
|
||||
|
||||
### Terminology
|
||||
|
||||
You will notice that some terms have changed or gone away going from RKE1 to RKE2. For example, in RKE1 provisioning, you use **node templates**; in RKE2 provisioning, you can configure your cluster node pools when creating or editing the cluster. Another example is that the term **node pool** in RKE1 is now known as **machine pool** in RKE2.
|
||||
|
||||
|
||||
|
||||
|
||||
+4
-1
@@ -10,7 +10,10 @@ This page covers how to install the Cloud Provider Interface (CPI) and Cloud Sto
|
||||
|
||||
# Prerequisites
|
||||
|
||||
The vSphere version must be 7.0u1 or higher.
|
||||
The vSphere versions supported:
|
||||
|
||||
* 6.7u3
|
||||
* 7.0u1 or higher.
|
||||
|
||||
The Kubernetes version must be 1.19 or higher.
|
||||
|
||||
|
||||
+5
@@ -34,6 +34,11 @@ Choose the default security group or configure a security group.
|
||||
|
||||
Please refer to [Amazon EC2 security group when using Node Driver]({{<baseurl>}}/rancher/v2.6/en/installation/requirements/ports/#rancher-aws-ec2-security-group) to see what rules are created in the `rancher-nodes` Security Group.
|
||||
|
||||
---
|
||||
**_New in v2.6.4_**
|
||||
|
||||
If you provide your own security group for an EC2 instance, please note that Rancher will not modify it. As such, you will be responsible for ensuring that your security group is set to allow the [necessary ports for Rancher to provision the instance]({{<baseurl>}}/rancher/v2.6/en/installation/requirements/ports/#ports-for-rancher-server-nodes-on-rke). For more information on controlling inbound and outbound traffic to EC2 instances with security groups, refer [here](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html#WorkingWithSecurityGroups).
|
||||
|
||||
### Instance Options
|
||||
|
||||
Configure the instances that will be created. Make sure you configure the correct **SSH User** for the configured AMI. It is possible that a selected region does not support the default instance type. In this scenario you must select an instance type that does exist, otherwise an error will occur stating the requested configuration is not supported.
|
||||
|
||||
@@ -74,11 +74,14 @@ To add a private CA for Helm Chart repositories:
|
||||
[...]
|
||||
```
|
||||
|
||||
- **Git-based chart repositories**: It is not currently possible to add a private CA. For git-based chart repositories with a certificate signed by a private CA, you must disable TLS verification. Click **Edit YAML** for the chart repo, and add the key/value pair as follows:
|
||||
- **Git-based chart repositories**: You must add a base64 encoded copy of the CA certificate in DER format to the spec.caBundle field of the chart repo, such as `openssl x509 -outform der -in ca.pem | base64 -w0`. Click **Edit YAML** for the chart repo and set, as in the following example:</br>
|
||||
```
|
||||
[...]
|
||||
spec:
|
||||
insecureSkipTLSVerify: true
|
||||
caBundle:
|
||||
MIIFXzCCA0egAwIBAgIUWNy8WrvSkgNzV0zdWRP79j9cVcEwDQYJKoZIhvcNAQELBQAwPzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQKDAtNeU9yZywgSW5jLjENMAsGA1UEAwwEcm9vdDAeFw0yMTEyMTQwODMyMTdaFw0yNDEwMDMwODMyMT
|
||||
...
|
||||
nDxZ/tNXt/WPJr/PgEB3hQdInDWYMg7vGO0Oz00G5kWg0sJ0ZTSoA10ZwdjIdGEeKlj1NlPyAqpQ+uDnmx6DW+zqfYtLnc/g6GuLLVPamraqN+gyU8CHwAWPNjZonFN9Vpg0PIk1I2zuOc4EHifoTAXSpnjfzfyAxCaZsnTptimlPFJJqAMj+FfDArGmr4=
|
||||
[...]
|
||||
```
|
||||
|
||||
|
||||
@@ -17,7 +17,7 @@ In this section, you'll learn how to deploy Rancher on a Kubernetes cluster usin
|
||||
|
||||
### Kubernetes Cluster
|
||||
|
||||
Set up the Rancher server's local Kubernetes cluster.
|
||||
Set up the Rancher server's local Kubernetes cluster.
|
||||
|
||||
Rancher can be installed on any Kubernetes cluster. This cluster can use upstream Kubernetes, or it can use one of Rancher's Kubernetes distributions, or it can be a managed Kubernetes cluster from a provider such as Amazon EKS.
|
||||
|
||||
@@ -104,7 +104,7 @@ There are three recommended options for the source of the certificate used for T
|
||||
|
||||
### 4. Install cert-manager
|
||||
|
||||
> You should skip this step if you are bringing your own certificate files (option `ingress.tls.source=secret`), or if you use [TLS termination on an external load balancer]({{<baseurl>}}/rancher/v2.6/en/installation/install-rancher-on-k8s/chart-options/#external-tls-termination).
|
||||
> You should skip this step if you are bringing your own certificate files (option `ingress.tls.source=secret`), or if you use [TLS termination on an external load balancer]({{<baseurl>}}/rancher/v2.6/en/installation/install-rancher-on-k8s/chart-options/#external-tls-termination).
|
||||
|
||||
This step is only required to use certificates issued by Rancher's generated CA (`ingress.tls.source=rancher`) or to request Let's Encrypt issued certificates (`ingress.tls.source=letsEncrypt`).
|
||||
|
||||
@@ -148,6 +148,8 @@ cert-manager-webhook-787858fcdb-nlzsq 1/1 Running 0 2m
|
||||
|
||||
The exact command to install Rancher differs depending on the certificate configuration.
|
||||
|
||||
However, irrespective of the certificate configuration, the name of the Rancher installation in the `cattle-system` namespace should always be `rancher`.
|
||||
|
||||
> **Tip for testing and development:** This final command to install Rancher requires a domain name that forwards traffic to Rancher. If you are using the Helm CLI to set up a proof-of-concept, you can use a fake domain name when passing the `hostname` option. An example of a fake domain name would be `<IP_OF_LINUX_NODE>.sslip.io`, which would expose Rancher on an IP where it is running. Production installs would require a real domain name.
|
||||
|
||||
{{% tabs %}}
|
||||
@@ -160,7 +162,7 @@ Because `rancher` is the default option for `ingress.tls.source`, we are not spe
|
||||
|
||||
- Set the `hostname` to the DNS name you pointed at your load balancer.
|
||||
- Set the `bootstrapPassword` to something unique for the `admin` user.
|
||||
- If you are installing an alpha version, Helm requires adding the `--devel` option to the command.
|
||||
- If you are installing an alpha version, Helm requires adding the `--devel` option to the command.
|
||||
- To install a specific Rancher version, use the `--version` flag, example: `--version 2.3.6`
|
||||
|
||||
```
|
||||
@@ -192,7 +194,7 @@ In the following command,
|
||||
- `ingress.tls.source` is set to `letsEncrypt`
|
||||
- `letsEncrypt.email` is set to the email address used for communication about your certificate (for example, expiry notices)
|
||||
- Set `letsEncrypt.ingress.class` to whatever your ingress controller is, e.g., `traefik`, `nginx`, `haproxy`, etc.
|
||||
- If you are installing an alpha version, Helm requires adding the `--devel` option to the command.
|
||||
- If you are installing an alpha version, Helm requires adding the `--devel` option to the command.
|
||||
|
||||
```
|
||||
helm install rancher rancher-<CHART_REPO>/rancher \
|
||||
@@ -225,7 +227,7 @@ Although an entry in the `Subject Alternative Names` is technically required, ha
|
||||
- Set the `hostname`.
|
||||
- Set the `bootstrapPassword` to something unique for the `admin` user.
|
||||
- Set `ingress.tls.source` to `secret`.
|
||||
- If you are installing an alpha version, Helm requires adding the `--devel` option to the command.
|
||||
- If you are installing an alpha version, Helm requires adding the `--devel` option to the command.
|
||||
|
||||
```
|
||||
helm install rancher rancher-<CHART_REPO>/rancher \
|
||||
|
||||
+1
-1
@@ -65,7 +65,7 @@ helm upgrade --install rancher rancher-latest/rancher \
|
||||
--namespace cattle-system \
|
||||
--set hostname=rancher.example.com \
|
||||
--set proxy=http://${proxy_host}
|
||||
--set no_proxy=127.0.0.0/8\\,10.0.0.0/8\\,cattle-system.svc\\,172.16.0.0/12\\,192.168.0.0/16\\,.svc\\,.cluster.local
|
||||
--set noProxy=127.0.0.0/8\\,10.0.0.0/8\\,cattle-system.svc\\,172.16.0.0/12\\,192.168.0.0/16\\,.svc\\,.cluster.local
|
||||
```
|
||||
|
||||
After waiting for the deployment to finish:
|
||||
|
||||
+19
-1
@@ -9,7 +9,7 @@ Once the infrastructure is ready, you can continue with setting up an RKE cluste
|
||||
|
||||
First, you have to install Docker and setup the HTTP proxy on all three Linux nodes. For this perform the following steps on all three nodes.
|
||||
|
||||
For convenience export the IP address and port of your proxy into an environment variable and set up the HTTP_PROXY variables for your current shell:
|
||||
For convenience, export the IP address and port of your proxy into an environment variable and set up the HTTP_PROXY variables for your current shell:
|
||||
|
||||
```
|
||||
export proxy_host="10.0.0.5:8888"
|
||||
@@ -58,6 +58,24 @@ sudo systemctl daemon-reload
|
||||
sudo systemctl restart docker
|
||||
```
|
||||
|
||||
#### Air-gapped proxy
|
||||
|
||||
_New in v2.6.4_
|
||||
|
||||
You can now provision node driver clusters from an air-gapped cluster configured to use a proxy for outbound connections.
|
||||
|
||||
In addition to setting the default rules for a proxy server, you will need to add additional rules, shown below, to provision node driver clusters from a proxied Rancher environment.
|
||||
|
||||
You will configure your filepath according to your setup, e.g., `/etc/apt/apt.conf.d/proxy.conf`:
|
||||
|
||||
```
|
||||
acl SSL_ports port 22
|
||||
acl SSL_ports port 2376
|
||||
|
||||
acl Safe_ports port 22 # ssh
|
||||
acl Safe_ports port 2376 # docker port
|
||||
```
|
||||
|
||||
### Creating the RKE Cluster
|
||||
|
||||
You need several command line tools on the host where you have SSH access to the Linux nodes to create and interact with the cluster:
|
||||
|
||||
+18
@@ -40,3 +40,21 @@ docker run -d --restart=unless-stopped \
|
||||
```
|
||||
|
||||
Privileged access is [required.]({{<baseurl>}}/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/#privileged-access-for-rancher)
|
||||
|
||||
### Air-gapped proxy configuration
|
||||
|
||||
_New in v2.6.4_
|
||||
|
||||
You can now provision node driver clusters from an air-gapped cluster configured to use a proxy for outbound connections.
|
||||
|
||||
In addition to setting the default rules for a proxy server as shown above, you will need to add additional rules, shown below, to provision node driver clusters from a proxied Rancher environment.
|
||||
|
||||
You will configure your filepath according to your setup, e.g., `/etc/apt/apt.conf.d/proxy.conf`:
|
||||
|
||||
```
|
||||
acl SSL_ports port 22
|
||||
acl SSL_ports port 2376
|
||||
|
||||
acl Safe_ports port 22 # ssh
|
||||
acl Safe_ports port 2376 # docker port
|
||||
```
|
||||
@@ -3,7 +3,7 @@ title: Opening Ports with firewalld
|
||||
weight: 1
|
||||
---
|
||||
|
||||
> We recommend disabling firewalld. For Kubernetes 1.19, firewalld must be turned off.
|
||||
> We recommend disabling firewalld. For Kubernetes 1.19.x and higher, firewalld must be turned off.
|
||||
|
||||
Some distributions of Linux [derived from RHEL,](https://en.wikipedia.org/wiki/Red_Hat_Enterprise_Linux#Rebuilds) including Oracle Linux, may have default firewall rules that block communication with Helm.
|
||||
|
||||
|
||||
@@ -11,6 +11,7 @@ A summary of the steps is as follows:
|
||||
2. Create or update the `tls-ca` Kubernetes secret resource with the root CA certificate (only required when using a private CA).
|
||||
3. Update the Rancher installation using the Helm CLI.
|
||||
4. Reconfigure the Rancher agents to trust the new CA certificate.
|
||||
5. Select Force Update of Fleet clusters to connect fleet-agent to Rancher.
|
||||
|
||||
The details of these instructions are below.
|
||||
|
||||
@@ -143,3 +144,11 @@ First, generate the agent definitions as described here: https://gist.github.com
|
||||
|
||||
Then, connect to a controlplane node of the downstream cluster via SSH, create a Kubeconfig and apply the definitions:
|
||||
https://gist.github.com/superseb/b14ed3b5535f621ad3d2aa6a4cd6443b
|
||||
|
||||
# 5. Select Force Update of Fleet clusters to connect fleet-agent to Rancher
|
||||
|
||||
Select 'Force Update' for the clusters within the [Continuous Delivery]({{<baseurl>}}/rancher/v2.6/en/deploy-across-clusters/fleet/#accessing-fleet-in-the-rancher-ui) view of the Rancher UI to allow the fleet-agent in downstream clusters to successfully connect to Rancher.
|
||||
|
||||
### Why is this step required?
|
||||
|
||||
Fleet agents in Rancher managed clusters store kubeconfig that is used to connect to the Rancher proxied kube-api in the fleet-agent secret of the fleet-system namespace. The kubeconfig contains a certificate-authority-data block containing the Rancher CA. When changing the Rancher CA, this block needs to be updated for a successful connection of the fleet-agent to Rancher.
|
||||
|
||||
+23
-3
@@ -19,18 +19,38 @@ The resource quota includes two limits, which you set while creating or editing
|
||||
|
||||
- **Project Limits:**
|
||||
|
||||
This set of values configures an overall resource limit for the project. If you try to add a new namespace to the project, Rancher uses the limits you've set to validate that the project has enough resources to accommodate the namespace. In other words, if you try to move a namespace into a project near its resource quota, Rancher blocks you from moving the namespace.
|
||||
This set of values configures a total limit for each specified resource shared among all namespaces in the project.
|
||||
|
||||
- **Namespace Default Limits:**
|
||||
|
||||
This value is the default resource limit available for each namespace. When the resource quota is created at the project level, this limit is automatically propagated to each namespace in the project. Each namespace is bound to this default limit unless you override it.
|
||||
This set of values configures the default quota limit available for each namespace for each specified resource.
|
||||
When a namespace is created in the project without overrides, this limit is automatically bound to the namespace and enforced.
|
||||
|
||||
|
||||
In the following diagram, a Rancher administrator wants to apply a resource quota that sets the same CPU and memory limit for every namespace in their project (`Namespace 1-4`). However, in Rancher, the administrator can set a resource quota for the project (`Project Resource Quota`) rather than individual namespaces. This quota includes resource limits for both the entire project (`Project Limit`) and individual namespaces (`Namespace Default Limit`). Rancher then propagates the `Namespace Default Limit` quotas to each namespace (`Namespace Resource Quota`) when created.
|
||||
|
||||
<sup>Rancher: Resource Quotas Propagating to Each Namespace</sup>
|
||||
|
||||
|
||||
Let's highlight some more nuanced functionality. If a quota is deleted at the project level, it will also be removed from all namespaces contained within that project, despite any overrides that may exist. Further, updating an existing namespace default limit for a quota at the project level will not result in that value being propagated to existing namespaces in the project; the updated value will only be applied to newly created namespaces in that project. To update a namespace default limit for existing namespaces you can delete and subsequently recreate the quota at the project level with the new default value. This will result in the new default value being applied to all existing namespaces in the project.
|
||||
Let's highlight some more nuanced functionality for namespaces created **_within_** the Rancher UI. If a quota is deleted at the project level, it will also be removed from all namespaces contained within that project, despite any overrides that may exist. Further, updating an existing namespace default limit for a quota at the project level will not result in that value being propagated to existing namespaces in the project; the updated value will only be applied to newly created namespaces in that project. To update a namespace default limit for existing namespaces you can delete and subsequently recreate the quota at the project level with the new default value. This will result in the new default value being applied to all existing namespaces in the project.
|
||||
|
||||
Before creating a namespace in a project, Rancher compares the amounts of the project's available resources and requested resources, regardless of whether they come from the default or overridden limits.
|
||||
If the requested resources exceed the remaining capacity in the project for those resources, Rancher will assign the namespace the remaining capacity for that resource.
|
||||
|
||||
However, this is not the case with namespaces created **_outside_** of Rancher's UI. For namespaces created via `kubectl`, Rancher
|
||||
will assign a resource quota that has a **zero** amount for any resource that requested more capacity than what remains in the project.
|
||||
|
||||
To create a namespace in an existing project via `kubectl`, use the `field.cattle.io/projectId` annotation. To override the default
|
||||
requested quota limit, use the `field.cattle.io/resourceQuota` annotation.
|
||||
```
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
annotations:
|
||||
field.cattle.io/projectId: [your-cluster-ID]:[your-project-ID]
|
||||
field.cattle.io/resourceQuota: '{"limit":{"limitsCpu":"100m", "limitsMemory":"100Mi", "configMaps": "50"}}'
|
||||
name: my-ns
|
||||
```
|
||||
|
||||
The following table explains the key differences between the two quota types.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user