mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-28 22:18:52 +00:00
Merge branch 'main' into release/v2.7.2
This commit is contained in:
Marty Hernandez Avedon
+6
-5
@@ -10,10 +10,11 @@ You can enable monitoring with or without SSL.
|
||||
|
||||
## Requirements
|
||||
|
||||
- Make sure that you are allowing traffic on port 9796 for each of your nodes because Prometheus will scrape metrics from here.
|
||||
- Make sure your cluster fulfills the resource requirements. The cluster should have at least 1950Mi memory available, 2700m CPU, and 50Gi storage. A breakdown of the resource limits and requests is [here.](../../../reference-guides/monitoring-v2-configuration/helm-chart-options.md#configuring-resource-limits-and-requests)
|
||||
- When installing monitoring on an RKE cluster using RancherOS or Flatcar Linux nodes, change the etcd node certificate directory to `/opt/rke/etc/kubernetes/ssl`.
|
||||
- For clusters provisioned with the RKE CLI and the address is set to a hostname instead of an IP address, set `rkeEtcd.clients.useLocalhost` to `true` during the Values configuration step of the installation. The YAML snippet will look like the following:
|
||||
- Allow traffic on port 9796 for each of your nodes. Prometheus scrapes metrics from these ports.
|
||||
- You may also need to allow traffic on port 10254 for each of your nodes, if [PushProx](../../../integrations-in-rancher/monitoring-and-alerting/how-monitoring-works.md#pushprox) is disabled (`ingressNginx.enabled` set to `false`), or you've upgraded from a previous Rancher version that had v1 monitoring already installed.
|
||||
- Make sure that your cluster fulfills the resource requirements. The cluster should have at least 1950Mi memory available, 2700m CPU, and 50Gi storage. See [Configuring Resource Limits and Requests](../../../reference-guides/monitoring-v2-configuration/helm-chart-options.md#configuring-resource-limits-and-requests) for a breakdown of the resource limits and requests.
|
||||
- When you install monitoring on an RKE cluster that uses RancherOS or Flatcar Linux nodes, change the etcd node certificate directory to `/opt/rke/etc/kubernetes/ssl`.
|
||||
- For clusters that have been provisioned with the RKE CLI and that have the address set to a hostname instead of an IP address, set `rkeEtcd.clients.useLocalhost` to `true` when you configure the Values during installation. For example:
|
||||
|
||||
```yaml
|
||||
rkeEtcd:
|
||||
@@ -27,7 +28,7 @@ If you want to set up Alertmanager, Grafana or Ingress, it has to be done with t
|
||||
|
||||
:::
|
||||
|
||||
#Setting Resource Limits and Requests
|
||||
## Setting Resource Limits and Requests
|
||||
|
||||
The resource requests and limits can be configured when installing `rancher-monitoring`. To configure Prometheus resources from the Rancher UI, click **Apps > Monitoring** in the upper left corner.
|
||||
|
||||
|
||||
+1
@@ -276,6 +276,7 @@ If you upgrade to Rancher v2.7.0+ with an existing Azure AD setup, and choose to
|
||||
|
||||
:::
|
||||
|
||||
|
||||
#### Global:
|
||||
|
||||
Rancher Field | Deprecated Endpoints
|
||||
|
||||
+37
-17
@@ -2,36 +2,56 @@
|
||||
title: Configuring a Global Default Private Registry
|
||||
---
|
||||
|
||||
You might want to use a private container image registry to share your custom base images within your organization. With a private registry, you can keep a private, consistent, and centralized source of truth for the container images that are used in your clusters.
|
||||
:::note
|
||||
This page describes how to configure a global default private registry from the Rancher UI, after Rancher is already installed.
|
||||
|
||||
There are two main ways to set up private registries in Rancher: by setting up the global default registry through the **Settings** tab in the global view, and by setting up a private registry in the advanced options in the cluster-level settings. The global default registry is intended to be used for air-gapped setups, for registries that do not require credentials. The cluster-level private registry is intended to be used in all setups in which the private registry requires credentials.
|
||||
For instructions on how to set up a private registry during Rancher installation, refer to the [air-gapped installation guide](../../../pages-for-subheaders/air-gapped-helm-cli-install.md).
|
||||
|
||||
This section is about configuring the global default private registry, and focuses on how to configure the registry from the Rancher UI after Rancher is installed.
|
||||
:::
|
||||
|
||||
For instructions on setting up a private registry with command line options during the installation of Rancher, refer to the [air-gapped installation guide](../../../pages-for-subheaders/air-gapped-helm-cli-install.md).
|
||||
A private registry is a private, consistent, and centralized source of truth for the container images in your clusters. You can use a private container image registry to share custom base images within your organization.
|
||||
|
||||
If your private registry requires credentials, it cannot be used as the default registry. There is no global way to set up a private registry with authorization for every Rancher-provisioned cluster. Therefore, if you want a Rancher-provisioned cluster to pull images from a private registry with credentials, you will have to [pass in the registry credentials through the advanced cluster options](#setting-a-private-registry-with-credentials-when-deploying-a-cluster) every time you create a new cluster.
|
||||
There are two main ways to set up a private registry in Rancher:
|
||||
|
||||
## Setting a Private Registry with No Credentials as the Default Registry
|
||||
* Set up a global default registry through the **Settings** tab in the global view.
|
||||
* Set up a private registry in the advanced options under cluster-level settings.
|
||||
|
||||
The global default registry is intended to be used in air-gapped setups, for registries that don't require credentials. The cluster-level private registry is intended to be used in setups where the private registry requires credentials.
|
||||
|
||||
## Set a Private Registry with No Credentials as the Default Registry
|
||||
|
||||
1. Log into Rancher and configure the default administrator password.
|
||||
1. Click **☰ > Global Settings**.
|
||||
1. Go to the setting called `system-default-registry` and choose **⋮ > Edit Setting**.
|
||||
1. Change the value to your registry (e.g. `registry.yourdomain.com:port`). Do not prefix the registry with `http://` or `https://`.
|
||||
1. Select **☰ > Global Settings**.
|
||||
1. Go to `system-default-registry` and choose **⋮ > Edit Setting**.
|
||||
1. Enter your registry's hostname and port (e.g. `registry.yourdomain.com:port`). Do not prefix the text with `http://` or `https://`.
|
||||
|
||||
**Result:** Rancher will use your private registry to pull system images.
|
||||
**Result:** Rancher pulls system images from your private registry.
|
||||
|
||||
## Setting a Private Registry with Credentials when Deploying a Cluster
|
||||
### Namespaced Private Registry with RKE2 Downstream Clusters
|
||||
|
||||
You can follow these steps to configure a private registry when you create a cluster:
|
||||
Most private registries should work, by default, with RKE2 downstream clusters.
|
||||
|
||||
1. Click **☰ > Cluster Management**.
|
||||
However, you'll need to do some additional steps if you're trying to set a namespaced private registry whose URL is formated like this: `website/subdomain:portnumber`.
|
||||
|
||||
1. Select **☰ > Cluster Management**.
|
||||
1. Find the RKE2 cluster in the list and click **⋮ >Edit Config**.
|
||||
1. From the **Cluster config** menu, select **Registries**.
|
||||
1. In the **Registries** pane, select the **Configure advanced containerd mirroring and registry authentication options** option.
|
||||
1. In the text fields under **Mirrors**, enter the **Registry Hostname** and **Mirror Endpoints**.
|
||||
1. Click **Save**.
|
||||
1. Repeat as necessary for each downstream RKE2 cluster.
|
||||
|
||||
## Configure a Private Registry with Credentials when Creating a Cluster
|
||||
|
||||
There is no global way to set up a private registry with authorization for every Rancher-provisioned cluster. Therefore, if you want a Rancher-provisioned cluster to pull images from a private registry that requires credentials, you'll have to pass the registry credentials through the advanced cluster options every time you create a new cluster.
|
||||
|
||||
Since the private registry cannot be configured after the cluster is created, you'll need to perform these steps during initial cluster setup.
|
||||
|
||||
1. Select **☰ > Cluster Management**.
|
||||
1. On the **Clusters** page, click **Create**.
|
||||
1. Choose a cluster type.
|
||||
1. In the **Cluster Configuration** go to the **Registries** tab and click **Pull images for Rancher from a private registry**.
|
||||
1. In the **Cluster Configuration** go to the **Registries** tab and select **Pull images for Rancher from a private registry**.
|
||||
1. Enter the registry hostname and credentials.
|
||||
1. Click **Create**.
|
||||
|
||||
**Result:** The new cluster will be able to pull images from the private registry.
|
||||
|
||||
The private registry cannot be configured after the cluster is created.
|
||||
**Result:** The new cluster pulls images from the private registry.
|
||||
|
||||
+7
-13
@@ -17,9 +17,7 @@ For more information on RKE node roles, see the [best practices.](../../../pages
|
||||
|
||||
### Permissions
|
||||
|
||||
If your existing Kubernetes cluster already has a `cluster-admin` role defined, you must have this `cluster-admin` privilege to register the cluster in Rancher.
|
||||
|
||||
In order to apply the privilege, you need to run:
|
||||
To register a cluster in Rancher, you must have `cluster-admin` privileges within that cluster. If you don't, grant these privileges to your user by running:
|
||||
|
||||
```plain
|
||||
kubectl create clusterrolebinding cluster-admin-binding \
|
||||
@@ -27,13 +25,11 @@ kubectl create clusterrolebinding cluster-admin-binding \
|
||||
--user [USER_ACCOUNT]
|
||||
```
|
||||
|
||||
before running the `kubectl` command to register the cluster.
|
||||
|
||||
By default, GKE users are not given this privilege, so you will need to run the command before registering GKE clusters. To learn more about role-based access control for GKE, please click [here](https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control).
|
||||
Since, by default, Google Kubernetes Engine (GKE) doesn't grant the `cluster-admin` role, you must run these commands on GKE clusters before you can register them. To learn more about role-based access control for GKE, please see [the official Google documentation](https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control).
|
||||
|
||||
### EKS, AKS and GKE Clusters
|
||||
|
||||
EKS, AKS and GKE clusters must have at least one managed node group to be imported into Rancher or provisioned from Rancher successfully.
|
||||
To successfully import them into or provision them from Rancher, Elastic Kubernetes Service (EKS), Azure Kubernetes Service (AKS), and Google Kubernetes Engine (GKE) clusters must have at least one managed node group.
|
||||
|
||||
## Registering a Cluster
|
||||
|
||||
@@ -126,15 +122,13 @@ When an RKE2 or K3s cluster is registered in Rancher, Rancher will recognize it.
|
||||
- The ability to configure the maximum number of nodes that will be upgraded concurrently
|
||||
- The ability to see a read-only version of the cluster's configuration arguments and environment variables used to launch each node in the cluster
|
||||
|
||||
### Additional Features for Registered EKS, AKS and GKE Clusters
|
||||
### Additional Features for Registered EKS, AKS, and GKE Clusters
|
||||
|
||||
Registering an Amazon EKS, Azure AKS or GKE cluster allows Rancher to treat it as though it were created in Rancher.
|
||||
Rancher handles registered EKS, AKS, or GKE clusters similarly to clusters created in Rancher. However, Rancher doesn't destroy registered clusters when you delete them through the Rancher UI.
|
||||
|
||||
Amazon EKS, Azure AKS and GKE clusters can now be registered in Rancher. For the most part, these registered clusters are treated the same way as clusters created in the Rancher UI, except for deletion.
|
||||
When you create an EKS, AKS, or GKE cluster in Rancher, then delete it, Rancher destroys the cluster. When you delete a registered cluster through Rancher, the Rancher server _disconnects_ from the cluster. The cluster remains live, although it's no longer in Rancher. You can still access the deregistered cluster in the same way you did before you registered it.
|
||||
|
||||
When you delete an EKS, AKS or GKE cluster that was created in Rancher, the cluster is destroyed. When you delete a cluster that was registered in Rancher, it is disconnected from the Rancher server, but it still exists, and you can still access it in the same way you did before it was registered in Rancher.
|
||||
|
||||
The capabilities for registered clusters are listed in the table on [this page.](../../../pages-for-subheaders/kubernetes-clusters-in-rancher-setup.md)
|
||||
See [Cluster Management Capabilities by Cluster Type](../../../pages-for-subheaders/kubernetes-clusters-in-rancher-setup.md) for more information about what features are available for managing registered clusters.
|
||||
|
||||
## Configuring RKE2 and K3s Cluster Upgrades
|
||||
|
||||
|
||||
Reference in New Issue
Block a user