Change tab indentations to space indentations

2026-09-10 11:15:49 +00:00 · 2022-09-13 22:40:56 +08:00
parent 76b33211be
commit efb87b2abd
65 changed files with 422 additions and 415 deletions
@@ -77,15 +77,15 @@ Please remove any sensitive data as it will be publicly viewable.
 - **Steps to reproduce the issue:** Provide as much detail on how you got into the reported situation. This helps the person to reproduce the situation you are in.
  - Provide manual steps or automation scripts used to get from a newly created setup to the situation you reported.
 - **Logs:** Provide data/logs from the used resources.
-  - Rancher
-      - Docker install
+    - Rancher
+        - Docker install

        ```
        docker logs \
        --timestamps \
        $(docker ps | grep -E "rancher/rancher:|rancher/rancher " | awk '{ print $1 }')
        ```
-      - Kubernetes install using `kubectl`
+        - Kubernetes install using `kubectl`

        :::note
        
@@ -99,14 +99,14 @@ Please remove any sensitive data as it will be publicly viewable.
        -l app=rancher \
        --timestamps=true
        ```
-      - Docker install using `docker` on each of the nodes in the RKE cluster
+        - Docker install using `docker` on each of the nodes in the RKE cluster

        ```
        docker logs \
        --timestamps \
        $(docker ps | grep -E "rancher/rancher@|rancher_rancher" | awk '{ print $1 }')
        ```
-      - Kubernetes Install with RKE Add-On
+        - Kubernetes Install with RKE Add-On

        :::note
        
@@ -120,12 +120,12 @@ Please remove any sensitive data as it will be publicly viewable.
        --timestamps=true \
        -f $(kubectl --kubeconfig $KUBECONFIG get pods -n cattle-system -o json | jq -r '.items[] | select(.spec.containers[].name="cattle-server") | .metadata.name')
        ```
-  - System logging (these might not all exist, depending on operating system)
-      - `/var/log/messages`
-      - `/var/log/syslog`
-      - `/var/log/kern.log`
-  - Docker daemon logging (these might not all exist, depending on operating system)
-      - `/var/log/docker.log`
+    - System logging (these might not all exist, depending on operating system)
+        - `/var/log/messages`
+        - `/var/log/syslog`
+        - `/var/log/kern.log`
+    - Docker daemon logging (these might not all exist, depending on operating system)
+        - `/var/log/docker.log`
 - **Metrics:** If you are experiencing performance issues, please provide as much of data (files or screenshots) of metrics which can help determining what is going on. If you have an issue related to a machine, it helps to supply output of `top`, `free -m`, `df` which shows processes/memory/disk usage.

 ## Docs
@@ -31,8 +31,8 @@ The Rancher API server is built on top of an embedded Kubernetes API server and

 ### Authorization and Role-Based Access Control

-  **User management:** The Rancher API server [manages user identities](../../pages-for-subheaders/about-authentication.md) that correspond to external authentication providers like Active Directory or GitHub, in addition to local users.
-	**Authorization:** The Rancher API server manages [access control](../../pages-for-subheaders/manage-role-based-access-control-rbac.md) and [security](../../how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/create-pod-security-policies.md) policies.
+- **User management:** The Rancher API server [manages user identities](../../pages-for-subheaders/about-authentication.md) that correspond to external authentication providers like Active Directory or GitHub, in addition to local users.
+- **Authorization:** The Rancher API server manages [access control](../../pages-for-subheaders/manage-role-based-access-control-rbac.md) and [security](../../how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/create-pod-security-policies.md) policies.

 ### Working with Kubernetes

@@ -44,7 +44,7 @@ The Rancher API server is built on top of an embedded Kubernetes API server and

 ### Working with Cloud Infrastructure

-  **Tracking nodes:** The Rancher API server tracks identities of all the [nodes](../../how-to-guides/advanced-user-guides/manage-clusters/nodes-and-node-pools.md) in all clusters.
+- **Tracking nodes:** The Rancher API server tracks identities of all the [nodes](../../how-to-guides/advanced-user-guides/manage-clusters/nodes-and-node-pools.md) in all clusters.
 - **Setting up infrastructure:**  When configured to use a cloud provider, Rancher can dynamically provision [new nodes](../../pages-for-subheaders/use-new-nodes-in-an-infra-provider.md) and [persistent storage](../../pages-for-subheaders/create-kubernetes-persistent-storage.md) in the cloud.

 ### Cluster Visibility
@@ -22,11 +22,11 @@ For this workload, you'll be deploying the application Rancher Hello-World.
 1.  Click **Add Port**.
 1.  From the **Service Type** drop-down, make sure that **NodePort** is selected.

-	![As a dropdown, NodePort (On every node selected)](/img/nodeport-dropdown.png)
+    ![As a dropdown, NodePort (On every node selected)](/img/nodeport-dropdown.png)

 1. From the **Publish the container port** field, enter port `80`.

-	![Publish the container port, 80 entered](/img/container-port-field.png)
+    ![Publish the container port, 80 entered](/img/container-port-field.png)

 1. Click **Create**.

@@ -13,46 +13,46 @@ If your organization uses FreeIPA for user authentication, you can configure Ran

 :::

-1.  Sign into Rancher using a local user assigned the `administrator` role (i.e., the _local principal_).
-1.	In the top left corner, click **☰ > Users & Authentication**.
+1. Sign into Rancher using a local user assigned the `administrator` role (i.e., the _local principal_).
+1. In the top left corner, click **☰ > Users & Authentication**.
 1. In the left navigation menu, click **Auth Provider**.
 1. Click **FreeIPA**.
-1.	Complete the **Configure an FreeIPA server** form.
+1. Complete the **Configure an FreeIPA server** form.

-	You may need to log in to your domain controller to find the information requested in the form.
+    You may need to log in to your domain controller to find the information requested in the form.

-	:::note Using TLS?
+    :::note Using TLS?

-	If the certificate is self-signed or not from a recognized certificate authority, make sure you provide the complete chain. That chain is needed to verify the server's certificate.
+    If the certificate is self-signed or not from a recognized certificate authority, make sure you provide the complete chain. That chain is needed to verify the server's certificate.

-	:::
+    :::

-	:::note User Search Base vs. Group Search Base
-	
-	Search base allows Rancher to search for users and groups that are in your FreeIPA.  These fields are only for search bases and not for search filters.
-	
-	* If your users and groups are in the same search base, complete only the User Search Base.
-	* If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required.
+    :::note User Search Base vs. Group Search Base

-	:::
+    Search base allows Rancher to search for users and groups that are in your FreeIPA.  These fields are only for search bases and not for search filters.

-1.	If your FreeIPA deviates from the standard AD schema, complete the **Customize Schema** form to match it. Otherwise, skip this step.
+    * If your users and groups are in the same search base, complete only the User Search Base.
+    * If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required.

-	:::note Search Attribute
-	
-	The Search Attribute field defaults with three specific values: `uid|sn|givenName`. After FreeIPA is configured, when a user enters text to add users or groups, Rancher automatically queries the FreeIPA server and attempts to match fields by user id, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field.
-	
-	The default field value `uid|sn|givenName`, but you can configure this field to a subset of these fields. The pipe (`|`) between the fields separates these fields.
-	
-	* `uid`: User ID
-	* `sn`: Last Name
-	* `givenName`: First Name
-	
-	With this search attribute, Rancher creates search filters for users and groups, but you *cannot* add your own search filters in this field.
+    :::

-	:::
+1. If your FreeIPA deviates from the standard AD schema, complete the **Customize Schema** form to match it. Otherwise, skip this step.

-1.	Enter your FreeIPA username and password in **Authenticate with FreeIPA** to confirm that Rancher is configured to use FreeIPA authentication.
+    :::note Search Attribute
+
+    The Search Attribute field defaults with three specific values: `uid|sn|givenName`. After FreeIPA is configured, when a user enters text to add users or groups, Rancher automatically queries the FreeIPA server and attempts to match fields by user id, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field.
+
+    The default field value `uid|sn|givenName`, but you can configure this field to a subset of these fields. The pipe (`|`) between the fields separates these fields.
+
+    * `uid`: User ID
+    * `sn`: Last Name
+    * `givenName`: First Name
+
+    With this search attribute, Rancher creates search filters for users and groups, but you *cannot* add your own search filters in this field.
+
+    :::
+
+1. Enter your FreeIPA username and password in **Authenticate with FreeIPA** to confirm that Rancher is configured to use FreeIPA authentication.
 1. Click **Enable**.

 **Result:**
@@ -11,44 +11,44 @@ Read [External Authentication Configuration and Principal Users](../../../../../

 :::

-1.  Sign into Rancher using a local user assigned the `administrator` role (i.e., the _local principal_).
-1.	In the top left corner, click **☰ > Users & Authentication**.
+1. Sign into Rancher using a local user assigned the `administrator` role (i.e., the _local principal_).
+1. In the top left corner, click **☰ > Users & Authentication**.
 1. In the left navigation menu, click **Auth Provider**.
 1. Click **GitHub**.
-1.	Follow the directions displayed to set up a GitHub Application. Rancher redirects you to GitHub to complete registration.
+1. Follow the directions displayed to set up a GitHub Application. Rancher redirects you to GitHub to complete registration.

-	:::note What's an Authorization Callback URL?
-	
-	The Authorization Callback URL is the URL where users go to begin using your application (i.e. the splash screen).
+    :::note What's an Authorization Callback URL?

-	When you use external authentication, authentication does not actually take place in your application. Instead, authentication takes place externally (in this case, GitHub). After this external authentication completes successfully, the Authorization Callback URL is the location where the user re-enters your application.
+    The Authorization Callback URL is the URL where users go to begin using your application (i.e. the splash screen).

-	:::
+    When you use external authentication, authentication does not actually take place in your application. Instead, authentication takes place externally (in this case, GitHub). After this external authentication completes successfully, the Authorization Callback URL is the location where the user re-enters your application.
+
+    :::

 1. From GitHub, copy the **Client ID** and **Client Secret**. Paste them into Rancher.

-	:::note Where do I find the Client ID and Client Secret?
-	
-	From GitHub, select Settings > Developer Settings > OAuth Apps. The Client ID and Client Secret are displayed prominently.
+    :::note Where do I find the Client ID and Client Secret?

-	:::
+    From GitHub, select Settings > Developer Settings > OAuth Apps. The Client ID and Client Secret are displayed prominently.
+
+    :::

 1.	Click **Authenticate with GitHub**.

 1.	Use the **Site Access** options to configure the scope of user authorization.

-	-	**Allow any valid Users**
+    - **Allow any valid Users**

-		_Any_ GitHub user can access Rancher. We generally discourage use of this setting!
+        _Any_ GitHub user can access Rancher. We generally discourage use of this setting!

-	-	**Allow members of Clusters, Projects, plus Authorized Users and Organizations**
+    - **Allow members of Clusters, Projects, plus Authorized Users and Organizations**

-		Any GitHub user or group added as a **Cluster Member** or **Project Member** can log in to Rancher. Additionally, any GitHub user or group you add to the **Authorized Users and Organizations** list may log in to Rancher.
+        Any GitHub user or group added as a **Cluster Member** or **Project Member** can log in to Rancher. Additionally, any GitHub user or group you add to the **Authorized Users and Organizations** list may log in to Rancher.

-	-	**Restrict access to only Authorized Users and Organizations**
+    - **Restrict access to only Authorized Users and Organizations**

-		Only GitHub users or groups added to the Authorized Users and Organizations can log in to Rancher.
-		<br/>
+        Only GitHub users or groups added to the Authorized Users and Organizations can log in to Rancher.
+        <br/>
 1.	Click **Enable**.

 **Result:**
@@ -83,7 +83,7 @@ Using the Unique ID of the service account key, register it as an Oauth Client u

 1. Get the Unique ID of the key you just created. If it's not displayed in the list of keys right next to the one you created, you will have to enable it. To enable it, click **Unique ID** and click **OK**. This will add a **Unique ID** column to the list of service account keys. Save the one listed for the service account you created. NOTE: This is a numeric key, not to be confused with the alphanumeric field **Key ID**.

-	![Service account Unique ID](/img/Google-Select-UniqueID-column.png)
+    ![Service account Unique ID](/img/Google-Select-UniqueID-column.png)
 1. Go to the [**Domain-wide Delegation** page.](https://admin.google.com/ac/owl/domainwidedelegation)
 1. Add the Unique ID obtained in the previous step in the **Client Name** field.
 1. In the **One or More API Scopes** field, add the following scopes:
@@ -30,9 +30,9 @@ Cluster administrators can edit the membership for a cluster, controlling which
 1. In the **Member Roles** tab, click **Add Member**.
 1. Search for the user or group that you want to add to the cluster.

- 	If external authentication is configured:
+    If external authentication is configured:

-	-  Rancher returns users from your [external authentication](../../../../pages-for-subheaders/about-authentication.md) source as you type.
+    - Rancher returns users from your [external authentication](../../../../pages-for-subheaders/about-authentication.md) source as you type.

 		:::note Using AD but can't find your users?

@@ -40,7 +40,7 @@ Cluster administrators can edit the membership for a cluster, controlling which

 		:::

-	- A drop-down allows you to add groups instead of individual users. The drop-down only lists groups that you, the logged in user, are part of.
+    - A drop-down allows you to add groups instead of individual users. The drop-down only lists groups that you, the logged in user, are part of.

 		:::note

@@ -50,16 +50,16 @@ Cluster administrators can edit the membership for a cluster, controlling which

 1. Assign the user or group **Cluster** roles.

-	[What are Cluster Roles?](../../authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md)
+    [What are Cluster Roles?](../../authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md)

-	:::tip
+    :::tip

-	For Custom Roles, you can modify the list of individual roles available for assignment.
+    For Custom Roles, you can modify the list of individual roles available for assignment.

-	- To add roles to the list, [Add a Custom Role](../../authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/custom-roles.md).
-	- To remove roles from the list, [Lock/Unlock Roles](../../authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/locked-roles.md).
+    - To add roles to the list, [Add a Custom Role](../../authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/custom-roles.md).
+    - To remove roles from the list, [Lock/Unlock Roles](../../authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/locked-roles.md).

-	:::
+    :::

 **Result:** The chosen users are added to the cluster.

@@ -25,7 +25,7 @@ You can assign a pod security policy when you provision a cluster. However, if y

 4. From the **Default Pod Security Policy** drop-down, select the policy you want to apply to the cluster.

-	Rancher ships with [policies](../authentication-permissions-and-global-configuration/create-pod-security-policies.md#default-pod-security-policies) of `restricted` and `unrestricted`, although you can [create custom policies](../authentication-permissions-and-global-configuration/create-pod-security-policies.md#default-pod-security-policies) as well.
+    Rancher ships with [policies](../authentication-permissions-and-global-configuration/create-pod-security-policies.md#default-pod-security-policies) of `restricted` and `unrestricted`, although you can [create custom policies](../authentication-permissions-and-global-configuration/create-pod-security-policies.md#default-pod-security-policies) as well.

 5. Click **Save**.

@@ -28,13 +28,13 @@ Following project creation, you can add users as project members so that they ca
 1. In the **Members** tab, click **Add**.
 1. Search for the user or group that you want to add to the project.

- 	If external authentication is configured:
+    If external authentication is configured:

-	-  Rancher returns users from your external authentication source as you type.  
+    -  Rancher returns users from your external authentication source as you type.  

-	- A drop-down allows you to add groups instead of individual users. The dropdown only lists groups that you, the logged in user, are included in.
+    - A drop-down allows you to add groups instead of individual users. The dropdown only lists groups that you, the logged in user, are included in.

-	:::note
+    :::note
    
    If you are logged in as a local user, external users do not display in your search results.

@@ -42,7 +42,7 @@ Following project creation, you can add users as project members so that they ca

 1. Assign the user or group **Project** roles.  

-	[What are Project Roles?](../authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md)
+    [What are Project Roles?](../authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md)

    :::note Notes:
    
@@ -45,21 +45,21 @@ A restore is performed by creating a Restore custom resource.

    ```yaml
    apiVersion: resources.cattle.io/v1
-	kind: Restore
-	metadata:
-	  name: restore-migration
-	spec:
-	  backupFilename: backup-b0450532-cee1-4aa1-a881-f5f48a007b1c-2020-09-15T07-27-09Z.tar.gz
-	  encryptionConfigSecretName: encryptionconfig
-	  storageLocation:
-	    s3:
-	      credentialSecretName: s3-creds
-	      credentialSecretNamespace: default
-	      bucketName: rancher-backups
-	      folder: rancher
-	      region: us-west-2
-	      endpoint: s3.us-west-2.amazonaws.com
-      ```
+    kind: Restore
+    metadata:
+      name: restore-migration
+    spec:
+      backupFilename: backup-b0450532-cee1-4aa1-a881-f5f48a007b1c-2020-09-15T07-27-09Z.tar.gz
+      encryptionConfigSecretName: encryptionconfig
+      storageLocation:
+        s3:
+          credentialSecretName: s3-creds
+          credentialSecretNamespace: default
+          bucketName: rancher-backups
+          folder: rancher
+          region: us-west-2
+          endpoint: s3.us-west-2.amazonaws.com
+    ```

      For help configuring the Restore, refer to the [configuration reference](../../../reference-guides/backup-restore-configuration/restore-configuration.md) and to the [examples.](../../../reference-guides/backup-restore-configuration/examples.md)

@@ -125,11 +125,11 @@ The ability to use the same configuration to deploy the same application across

 2. For each override, you can select the following:

-	- **Scope**: Select which target projects you want to override the answer in the configuration option.
+    - **Scope**: Select which target projects you want to override the answer in the configuration option.

-	- **Question**: Select which question you want to override.
+    - **Question**: Select which question you want to override.

-	- **Answer**: Enter the answer that you want to be used instead.
+    - **Answer**: Enter the answer that you want to be used instead.

 ## Upgrading Multi-Cluster App Roles and Projects

@@ -62,10 +62,10 @@ Before you create your own custom catalog, you should have a basic understanding
    A file that contains questions for a form. These form questions simplify deployment of a chart. Without it, you must configure the deployment using a values YAML config, which is more difficult. The following image displays the difference between a Rancher chart (which includes `questions.yml`) and a native Helm chart (which does not).


-	<figcaption>Rancher Chart with <code>questions.yml</code> (top) vs. Helm Chart without (bottom)</figcaption>
+    <figcaption>Rancher Chart with <code>questions.yml</code> (top) vs. Helm Chart without (bottom)</figcaption>

-	![questions.yml](/img/rancher-app-2.6.png)
-	![values.yaml](/img/helm-app-2.6.png)
+    ![questions.yml](/img/rancher-app-2.6.png)
+    ![values.yaml](/img/helm-app-2.6.png)


 ### Chart.yaml annotations
@@ -83,22 +83,22 @@ Configuration of external authentication affects how principal users are managed

 1. Sign into Rancher as the local principal and complete configuration of external authentication.

-	![Sign In](/img/sign-in.png)
+    ![Sign In](/img/sign-in.png)

 2. Rancher associates the external principal with the local principal. These two users share the local principal's user ID.

-	![Principal ID Sharing](/img/principal-ID.png)
+    ![Principal ID Sharing](/img/principal-ID.png)

 3. After you complete configuration, Rancher automatically signs out the local principal.

-	![Sign Out Local Principal](/img/sign-out-local.png)
+    ![Sign Out Local Principal](/img/sign-out-local.png)

 4. Then, Rancher automatically signs you back in as the external principal.

-	![Sign In External Principal](/img/sign-in-external.png)
+    ![Sign In External Principal](/img/sign-in-external.png)

 5. Because the external principal and the local principal share an ID, no unique object for the external principal displays on the Users page.

-	![Sign In External Principal](/img/users-page.png)
+    ![Sign In External Principal](/img/users-page.png)

 6. The external principal and the local principal share the same access rights.
@@ -61,8 +61,8 @@ If you're using Amazon EC2 as your host and want to use the [dual-stack](https:/

 7.	From **Node Role**, choose the roles that you want filled by a cluster node. You must provision at least one node for each role: `etcd`, `worker`, and `control plane`. All three roles are required for a custom cluster to finish provisioning. For more information on roles, see [this section.](../reference-guides/kubernetes-concepts.md#roles-for-nodes-in-kubernetes-clusters)

-:::note Notes:
-	
+:::note
+
 - Using Windows nodes as Kubernetes workers? See [this section](use-windows-clusters.md).
 - Bare-Metal Server Reminder: If you plan on dedicating bare-metal servers to each role, you must provision a bare-metal server for each role (i.e. provision multiple bare-metal servers).

@@ -47,6 +47,6 @@ In order to delete cloud credentials, there must not be any node template associ
 1. Click **Cloud Credentials**.
 1. You can either individually delete a cloud credential or bulk delete.

-	- To individually delete one, choose the cloud credential you want to edit and click the **⋮ > Delete**.
-	- To bulk delete cloud credentials, select one or more cloud credentials from the list. Click **Delete**.
+    - To individually delete one, choose the cloud credential you want to edit and click the **⋮ > Delete**.
+    - To bulk delete cloud credentials, select one or more cloud credentials from the list. Click **Delete**.
 1. Confirm that you want to delete these cloud credentials.
@@ -25,12 +25,12 @@ When you create a node template, it is bound to your user profile. Node template
 1. Click **RKE1 Configuration > Node Templates**.
 1. Choose the node template that you want to edit and click the **⋮ > Edit**.

-	   :::note
-	   
-	   The default `active` [node drivers](../../how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-provisioning-drivers/manage-node-drivers.md) and any node driver, that has fields marked as `password`, are required to use [cloud credentials](../../pages-for-subheaders/use-new-nodes-in-an-infra-provider.md#cloud-credentials).
+    :::note
+    
+    The default `active` [node drivers](../../how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-provisioning-drivers/manage-node-drivers.md) and any node driver, that has fields marked as `password`, are required to use [cloud credentials](../../pages-for-subheaders/use-new-nodes-in-an-infra-provider.md#cloud-credentials).

-	   :::
-	   
+    :::
+    
 1. Edit the required information and click **Save**.

 **Result:** The node template is updated. All node pools using this node template will automatically use the updated information when new nodes are added.
@@ -11,15 +11,15 @@ Configuring an Amazon NLB is a multistage process. We've broken it down into mul

 1. [Create Target Groups](#create-target-groups)

-	Begin by creating two target groups for the **TCP** protocol, one regarding TCP port 443 and one regarding TCP port 80 (providing redirect to TCP port 443). You'll add your Linux nodes to these groups.
+    Begin by creating two target groups for the **TCP** protocol, one regarding TCP port 443 and one regarding TCP port 80 (providing redirect to TCP port 443). You'll add your Linux nodes to these groups.

 2. [Register Targets](#register-targets)

-	Add your Linux nodes to the target groups.
+    Add your Linux nodes to the target groups.

 3. [Create Your NLB](#create-your-nlb)

-	Use Amazon's Wizard to create an Network Load Balancer. As part of this process, you'll add the target groups you created in **1. Create Target Groups**.
+    Use Amazon's Wizard to create an Network Load Balancer. As part of this process, you'll add the target groups you created in **1. Create Target Groups**.

 > **Note:** Rancher only supports using the Amazon NLB when terminating traffic in `tcp` mode for port 443 rather than `tls` mode. This is due to the fact that the NLB does not inject the correct headers into requests when terminated at the NLB. This means that if you want to use certificates managed by the Amazon Certificate Manager (ACM), you should use an ELB or ALB.

@@ -134,28 +134,28 @@ Use Amazon's Wizard to create an Network Load Balancer. As part of this process,
 4. Choose **Network Load Balancer** and click **Create**.

 5. Complete the **Step 1: Configure Load Balancer** form.
-	- **Basic Configuration**
+    - **Basic Configuration**

-	   - Name: `rancher`
-	   - Scheme: `internal` or `internet-facing`
+       - Name: `rancher`
+       - Scheme: `internal` or `internet-facing`

-	     The Scheme that you choose for your NLB is dependent on the configuration of your instances/VPC. If your instances do not have public IPs associated with them, or you will only be accessing Rancher internally, you should set your NLB Scheme to `internal` rather than `internet-facing`.
-	- **Listeners**
+         The Scheme that you choose for your NLB is dependent on the configuration of your instances/VPC. If your instances do not have public IPs associated with them, or you will only be accessing Rancher internally, you should set your NLB Scheme to `internal` rather than `internet-facing`.
+    - **Listeners**

-		Add the **Load Balancer Protocols** and **Load Balancer Ports** below.
-		- `TCP`: `443`
+        Add the **Load Balancer Protocols** and **Load Balancer Ports** below.
+        - `TCP`: `443`

-	- **Availability Zones**
+    - **Availability Zones**

-	   - Select Your **VPC** and **Availability Zones**.
+       - Select Your **VPC** and **Availability Zones**.

 6. Complete the **Step 2: Configure Routing** form.

-	- From the **Target Group** drop-down, choose **Existing target group**.
+    - From the **Target Group** drop-down, choose **Existing target group**.

-	- From the **Name** drop-down, choose `rancher-tcp-443`.
+    - From the **Name** drop-down, choose `rancher-tcp-443`.

-	- Open **Advanced health check settings**, and configure **Interval** to `10 seconds`.
+    - Open **Advanced health check settings**, and configure **Interval** to `10 seconds`.

 7. Complete **Step 3: Register Targets**. Since you registered your targets earlier, all you have to do is click **Next: Review**.

@@ -19,15 +19,15 @@ Configuring an Amazon NLB is a multistage process. We've broken it down into mul

 1. [Create Target Groups](#create-target-groups)

-	Begin by creating two target groups for the **TCP** protocol, one regarding TCP port 443 and one regarding TCP port 80 (providing redirect to TCP port 443). You'll add your Linux nodes to these groups.
+    Begin by creating two target groups for the **TCP** protocol, one regarding TCP port 443 and one regarding TCP port 80 (providing redirect to TCP port 443). You'll add your Linux nodes to these groups.

 2. [Register Targets](#register-targets)

-	Add your Linux nodes to the target groups.
+    Add your Linux nodes to the target groups.

 3. [Create Your NLB](#create-your-nlb)

-	Use Amazon's Wizard to create an Network Load Balancer. As part of this process, you'll add the target groups you created in **1. Create Target Groups**.
+    Use Amazon's Wizard to create an Network Load Balancer. As part of this process, you'll add the target groups you created in **1. Create Target Groups**.


 ## Create Target Groups
@@ -141,26 +141,26 @@ Use Amazon's Wizard to create an Network Load Balancer. As part of this process,
 4. Choose **Network Load Balancer** and click **Create**.

 5. Complete the **Step 1: Configure Load Balancer** form.
-	- **Basic Configuration**
+    - **Basic Configuration**

-	   - Name: `rancher`
-	   - Scheme: `internet-facing`
-	- **Listeners**
+       - Name: `rancher`
+       - Scheme: `internet-facing`
+    - **Listeners**

-		Add the **Load Balancer Protocols** and **Load Balancer Ports** below.
-		- `TCP`: `443`
+        Add the **Load Balancer Protocols** and **Load Balancer Ports** below.
+        - `TCP`: `443`

-	- **Availability Zones**
+    - **Availability Zones**

-	   - Select Your **VPC** and **Availability Zones**.
+       - Select Your **VPC** and **Availability Zones**.

 6. Complete the **Step 2: Configure Routing** form.

-	- From the **Target Group** drop-down, choose **Existing target group**.
+    - From the **Target Group** drop-down, choose **Existing target group**.

-	- From the **Name** drop-down, choose `rancher-tcp-443`.
+    - From the **Name** drop-down, choose `rancher-tcp-443`.

-	- Open **Advanced health check settings**, and configure **Interval** to `10 seconds`.
+    - Open **Advanced health check settings**, and configure **Interval** to `10 seconds`.

 7. Complete **Step 3: Register Targets**. Since you registered your targets earlier, all you have to do is click **Next: Review**.

@@ -19,15 +19,15 @@ Configuring an Amazon ALB is a multistage process. We've broken it down into mul

 1. [Create Target Group](#create-target-group)

-	Begin by creating one target group for the http protocol. You'll add your Linux nodes to this group.
+    Begin by creating one target group for the http protocol. You'll add your Linux nodes to this group.

 2. [Register Targets](#register-targets)

-	Add your Linux nodes to the target group.
+    Add your Linux nodes to the target group.

 3. [Create Your ALB](#create-your-alb)

-	Use Amazon's Wizard to create an Application Load Balancer. As part of this process, you'll add the target groups you created in **1. Create Target Groups**.
+    Use Amazon's Wizard to create an Application Load Balancer. As part of this process, you'll add the target groups you created in **1. Create Target Groups**.


 ## Create Target Group
@@ -71,32 +71,32 @@ Use Amazon's Wizard to create an Application Load Balancer. As part of this proc
 4. Choose **Application Load Balancer**.

 5. Complete the **Step 1: Configure Load Balancer** form.
-	- **Basic Configuration**
+    - **Basic Configuration**

-	   - Name: `rancher-http`
-	   - Scheme: `internet-facing`
-	   - IP address type: `ipv4`
-	- **Listeners**
+       - Name: `rancher-http`
+       - Scheme: `internet-facing`
+       - IP address type: `ipv4`
+    - **Listeners**

-		Add the **Load Balancer Protocols** and **Load Balancer Ports** below.
-		- `HTTP`: `80`
-		- `HTTPS`: `443`
+        Add the **Load Balancer Protocols** and **Load Balancer Ports** below.
+        - `HTTP`: `80`
+        - `HTTPS`: `443`

-	- **Availability Zones**
+    - **Availability Zones**

-	   - Select Your **VPC** and **Availability Zones**.
+       - Select Your **VPC** and **Availability Zones**.

 6. Complete the **Step 2: Configure Security Settings** form.

-	Configure the certificate you want to use for SSL termination.
+    Configure the certificate you want to use for SSL termination.

 7. Complete the **Step 3: Configure Security Groups** form.

 8. Complete the **Step 4: Configure Routing** form.

-	- From the **Target Group** drop-down, choose **Existing target group**.
+    - From the **Target Group** drop-down, choose **Existing target group**.

-	- Add target group `rancher-http-80`.
+    - Add target group `rancher-http-80`.

 9. Complete **Step 5: Register Targets**. Since you registered your targets earlier, all you have to do it click **Next: Review**.

@@ -152,8 +152,8 @@ RKE uses a `.yml` config file to install and configure your Kubernetes cluster.

 1. Download one of following templates, depending on the SSL certificate you're using.

-	- [Template for self-signed certificate<br/>](../cluster-yml-templates/node-certificate.md)
-	- [Template for certificate signed by recognized CA<br/> ](../cluster-yml-templates/node-certificate-recognizedca.md)
+    - [Template for self-signed certificate<br/>](../cluster-yml-templates/node-certificate.md)
+    - [Template for certificate signed by recognized CA<br/> ](../cluster-yml-templates/node-certificate-recognizedca.md)



@@ -99,8 +99,8 @@ RKE uses a YAML config file to install and configure your Kubernetes cluster. Th

 1. Download one of following templates, depending on the SSL certificate you're using.

-	- [Template for self-signed certificate<br/> `3-node-externalssl-certificate.yml`](../cluster-yml-templates/node-externalssl-certificate.md)installation/options/cluster-yml-templates/3-node-externalssl-certificate)
-	- [Template for certificate signed by recognized CA<br/> `3-node-externalssl-recognizedca.yml`](../cluster-yml-templates/node-externalssl-recognizedca.md)
+    - [Template for self-signed certificate<br/> `3-node-externalssl-certificate.yml`](../cluster-yml-templates/node-externalssl-certificate.md)installation/options/cluster-yml-templates/3-node-externalssl-certificate)
+    - [Template for certificate signed by recognized CA<br/> `3-node-externalssl-recognizedca.yml`](../cluster-yml-templates/node-externalssl-recognizedca.md)



@@ -30,8 +30,8 @@ The Rancher API server is built on top of an embedded Kubernetes API server and

 ### Authorization and Role-Based Access Control

-  **User management:** The Rancher API server [manages user identities](../../pages-for-subheaders/about-authentication.md) that correspond to external authentication providers like Active Directory or GitHub, in addition to local users.
-	**Authorization:** The Rancher API server manages [access control](../../pages-for-subheaders/manage-role-based-access-control-rbac.md) and [security](../../how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/create-pod-security-policies.md) policies.
+- **User management:** The Rancher API server [manages user identities](../../pages-for-subheaders/about-authentication.md) that correspond to external authentication providers like Active Directory or GitHub, in addition to local users.
+- **Authorization:** The Rancher API server manages [access control](../../pages-for-subheaders/manage-role-based-access-control-rbac.md) and [security](../../how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/create-pod-security-policies.md) policies.

 ### Working with Kubernetes

@@ -23,7 +23,7 @@ For this workload, you'll be deploying the application Rancher Hello-World.

 5.  Click **Deploy**.

-	**Step Result:** The **Deploy Workload** page opens.
+    **Step Result:** The **Deploy Workload** page opens.

 6.  Enter a **Name** for your workload.

@@ -33,15 +33,15 @@ For this workload, you'll be deploying the application Rancher Hello-World.

 9.  From the **As a** drop-down, make sure that **NodePort (On every node)** is selected.

-	![As a dropdown, NodePort (On every node selected)](/img/nodeport-dropdown.png)
+    ![As a dropdown, NodePort (On every node selected)](/img/nodeport-dropdown.png)

 10.  From the **On Listening Port** field, leave the **Random** value in place.

-	![On Listening Port, Random selected](/img/listening-port-field.png)
+    ![On Listening Port, Random selected](/img/listening-port-field.png)

 11. From the **Publish the container port** field, enter port `80`.

-	![Publish the container port, 80 entered](/img/container-port-field.png)
+    ![Publish the container port, 80 entered](/img/container-port-field.png)

 12. Leave the remaining options on their default setting. We'll tell you about them later.

@@ -23,7 +23,7 @@ For this workload, you'll be deploying the application Rancher Hello-World.

 5.  Click **Deploy**.

-	**Step Result:** The **Deploy Workload** page opens.
+    **Step Result:** The **Deploy Workload** page opens.

 6.  Enter a **Name** for your workload.

@@ -15,40 +15,40 @@ If your organization uses FreeIPA for user authentication, you can configure Ran
 >- Create a service account in FreeIPA with `read-only` access. Rancher uses this account to verify group membership when a user makes a request using an API key.
 >- Read [External Authentication Configuration and Principal Users](../../../../../pages-for-subheaders/about-authentication.md#external-authentication-configuration-and-principal-users).

-1.  Sign into Rancher using a local user assigned the `administrator` role (i.e., the _local principal_).
+1. Sign into Rancher using a local user assigned the `administrator` role (i.e., the _local principal_).

-2.	From the **Global** view, select **Security > Authentication** from the main menu.
+2. From the **Global** view, select **Security > Authentication** from the main menu.

-3.	Select **FreeIPA**.
+3. Select **FreeIPA**.

-4.	Complete the **Configure an FreeIPA server** form.
+4. Complete the **Configure an FreeIPA server** form.

-	You may need to log in to your domain controller to find the information requested in the form.
+    You may need to log in to your domain controller to find the information requested in the form.

-	>**Using TLS?**
- 	>If the certificate is self-signed or not from a recognized certificate authority, make sure you provide the complete chain. That chain is needed to verify the server's certificate.
-	<br/>
-	<br/>
-	>**User Search Base vs. Group Search Base**
-	>
-	>Search base allows Rancher to search for users and groups that are in your FreeIPA.  These fields are only for search bases and not for search filters.
-	>
-	>* If your users and groups are in the same search base, complete only the User Search Base.
-	>* If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required.
+    >**Using TLS?**
+    >If the certificate is self-signed or not from a recognized certificate authority, make sure you provide the complete chain. That chain is needed to verify the server's certificate.
+    <br/>
+    <br/>
+    >**User Search Base vs. Group Search Base**
+    >
+    >Search base allows Rancher to search for users and groups that are in your FreeIPA.  These fields are only for search bases and not for search filters.
+    >
+    >* If your users and groups are in the same search base, complete only the User Search Base.
+    >* If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required.

-5.	If your FreeIPA deviates from the standard AD schema, complete the **Customize Schema** form to match it. Otherwise, skip this step.
+5. If your FreeIPA deviates from the standard AD schema, complete the **Customize Schema** form to match it. Otherwise, skip this step.

-	>**Search Attribute** The Search Attribute field defaults with three specific values: `uid|sn|givenName`. After FreeIPA is configured, when a user enters text to add users or groups, Rancher automatically queries the FreeIPA server and attempts to match fields by user id, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field.
-	>
-	>The default field value `uid|sn|givenName`, but you can configure this field to a subset of these fields. The pipe (`|`) between the fields separates these fields.
-	>
-	> * `uid`: User ID
-	> * `sn`: Last Name
-	> * `givenName`: First Name
-	>
-	> With this search attribute, Rancher creates search filters for users and groups, but you *cannot* add your own search filters in this field.
+    >**Search Attribute** The Search Attribute field defaults with three specific values: `uid|sn|givenName`. After FreeIPA is configured, when a user enters text to add users or groups, Rancher automatically queries the FreeIPA server and attempts to match fields by user id, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field.
+    >
+    >The default field value `uid|sn|givenName`, but you can configure this field to a subset of these fields. The pipe (`|`) between the fields separates these fields.
+    >
+    > * `uid`: User ID
+    > * `sn`: Last Name
+    > * `givenName`: First Name
+    >
+    > With this search attribute, Rancher creates search filters for users and groups, but you *cannot* add your own search filters in this field.

-6.	Enter your FreeIPA username and password in **Authenticate with FreeIPA** to confirm that Rancher is configured to use FreeIPA authentication.
+6. Enter your FreeIPA username and password in **Authenticate with FreeIPA** to confirm that Rancher is configured to use FreeIPA authentication.

 **Result:**

@@ -9,43 +9,43 @@ In environments using GitHub, you can configure Rancher to allow sign on using G

 >**Prerequisites:** Read [External Authentication Configuration and Principal Users](../../../../../pages-for-subheaders/about-authentication.md#external-authentication-configuration-and-principal-users).

-1.  Sign into Rancher using a local user assigned the `administrator` role (i.e., the _local principal_).
+1. Sign into Rancher using a local user assigned the `administrator` role (i.e., the _local principal_).

-2.	From the **Global** view, select **Security > Authentication** from the main menu.
+2. From the **Global** view, select **Security > Authentication** from the main menu.

-3.	Select **GitHub**.
+3. Select **GitHub**.

-4.	Follow the directions displayed to **Setup a GitHub Application**. Rancher redirects you to GitHub to complete registration.
+4. Follow the directions displayed to **Setup a GitHub Application**. Rancher redirects you to GitHub to complete registration.

-	>**What's an Authorization Callback URL?**
-	>
-	>The Authorization Callback URL is the URL where users go to begin using your application (i.e. the splash screen).
+    >**What's an Authorization Callback URL?**
+    >
+    >The Authorization Callback URL is the URL where users go to begin using your application (i.e. the splash screen).

-	>When you use external authentication, authentication does not actually take place in your application. Instead, authentication takes place externally (in this case, GitHub). After this external authentication completes successfully, the Authorization Callback URL is the location where the user re-enters your application.
+    >When you use external authentication, authentication does not actually take place in your application. Instead, authentication takes place externally (in this case, GitHub). After this external authentication completes successfully, the Authorization Callback URL is the location where the user re-enters your application.

 5. From GitHub, copy the **Client ID** and **Client Secret**. Paste them into Rancher.

-	>**Where do I find the Client ID and Client Secret?**
-	>
-	>From GitHub, select Settings > Developer Settings > OAuth Apps. The Client ID and Client Secret are displayed prominently.
+    >**Where do I find the Client ID and Client Secret?**
+    >
+    >From GitHub, select Settings > Developer Settings > OAuth Apps. The Client ID and Client Secret are displayed prominently.

-6.	Click **Authenticate with GitHub**.
+6. Click **Authenticate with GitHub**.

-7.	Use the **Site Access** options to configure the scope of user authorization.
+7. Use the **Site Access** options to configure the scope of user authorization.

-	-	**Allow any valid Users**
+    - **Allow any valid Users**

-		_Any_ GitHub user can access Rancher. We generally discourage use of this setting!
+        _Any_ GitHub user can access Rancher. We generally discourage use of this setting!

-	-	**Allow members of Clusters, Projects, plus Authorized Users and Organizations**
+    - **Allow members of Clusters, Projects, plus Authorized Users and Organizations**

-		Any GitHub user or group added as a **Cluster Member** or **Project Member** can log in to Rancher. Additionally, any GitHub user or group you add to the **Authorized Users and Organizations** list may log in to Rancher.
+        Any GitHub user or group added as a **Cluster Member** or **Project Member** can log in to Rancher. Additionally, any GitHub user or group you add to the **Authorized Users and Organizations** list may log in to Rancher.

-	-	**Restrict access to only Authorized Users and Organizations**
+    - **Restrict access to only Authorized Users and Organizations**

-		Only GitHub users or groups added to the Authorized Users and Organizations can log in to Rancher.
-		<br/>
-8.	Click **Save**.
+        Only GitHub users or groups added to the Authorized Users and Organizations can log in to Rancher.
+        <br/>
+8. Click **Save**.

 **Result:**

@@ -79,7 +79,7 @@ Using the Unique ID of the service account key, register it as an Oauth Client u

 1. Get the Unique ID of the key you just created. If it's not displayed in the list of keys right next to the one you created, you will have to enable it. To enable it, click **Unique ID** and click **OK.** This will add a **Unique ID** column to the list of service account keys. Save the one listed for the service account you created. NOTE: This is a numeric key, not to be confused with the alphanumeric field **Key ID.**

-	![Service account Unique ID](/img/Google-Select-UniqueID-column.png)
+    ![Service account Unique ID](/img/Google-Select-UniqueID-column.png)
 1. Go to the [**Manage OAuth Client Access** page.](https://admin.google.com/AdminHome?chromeless=1#OGX:ManageOauthClients)
 1. Add the Unique ID obtained in the previous step in the **Client Name** field.
 1. In the **One or More API Scopes** field, add the following scopes:
@@ -61,7 +61,7 @@ We recommend adding PSPs during cluster and project creation instead of adding i

 1.	From the **Global** view, select **Security** > **Pod Security Policies** from the main menu. Then click **Add Policy**.

-	**Step Result:** The **Add Policy** form opens.
+    **Step Result:** The **Add Policy** form opens.

 2. Name the policy.

@@ -31,25 +31,25 @@ Cluster administrators can edit the membership for a cluster, controlling which

 3. Search for the user or group that you want to add to the cluster.

- 	If external authentication is configured:
+    If external authentication is configured:

-	-  Rancher returns users from your [external authentication](../../../../pages-for-subheaders/about-authentication.md) source as you type.
+    - Rancher returns users from your [external authentication](../../../../pages-for-subheaders/about-authentication.md) source as you type.

-		>**Using AD but can't find your users?**
-		>There may be an issue with your search attribute configuration. See [Configuring Active Directory Authentication: Step 5](../../authentication-permissions-and-global-configuration/about-authentication/authentication-config/configure-active-directory.md).
+        >**Using AD but can't find your users?**
+        >There may be an issue with your search attribute configuration. See [Configuring Active Directory Authentication: Step 5](../../authentication-permissions-and-global-configuration/about-authentication/authentication-config/configure-active-directory.md).

-	- A drop-down allows you to add groups instead of individual users. The drop-down only lists groups that you, the logged in user, are part of.
+    - A drop-down allows you to add groups instead of individual users. The drop-down only lists groups that you, the logged in user, are part of.

-		>**Note:** If you are logged in as a local user, external users do not display in your search results. For more information, see [External Authentication Configuration and Principal Users](../../../../pages-for-subheaders/about-authentication.md#external-authentication-configuration-and-principal-users).
+        >**Note:** If you are logged in as a local user, external users do not display in your search results. For more information, see [External Authentication Configuration and Principal Users](../../../../pages-for-subheaders/about-authentication.md#external-authentication-configuration-and-principal-users).

 4. Assign the user or group **Cluster** roles.

-	[What are Cluster Roles?](../../authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md)
+    [What are Cluster Roles?](../../authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md)

-	>**Tip:** For Custom Roles, you can modify the list of individual roles available for assignment.
-	>
-	> - To add roles to the list, [Add a Custom Role](../../authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/custom-roles.md).
-	> - To remove roles from the list, [Lock/Unlock Roles](../../authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/locked-roles.md).
+    >**Tip:** For Custom Roles, you can modify the list of individual roles available for assignment.
+    >
+    > - To add roles to the list, [Add a Custom Role](../../authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/custom-roles.md).
+    > - To remove roles from the list, [Lock/Unlock Roles](../../authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/locked-roles.md).

 **Result:** The chosen users are added to the cluster.

@@ -19,7 +19,7 @@ You can assign a pod security policy when you provision a cluster. However, if y

 4. From the **Default Pod Security Policy** drop-down, select the policy you want to apply to the cluster.

-	Rancher ships with [policies](../authentication-permissions-and-global-configuration/create-pod-security-policies.md#default-pod-security-policies) of `restricted` and `unrestricted`, although you can [create custom policies](../authentication-permissions-and-global-configuration/create-pod-security-policies.md#default-pod-security-policies) as well.
+    Rancher ships with [policies](../authentication-permissions-and-global-configuration/create-pod-security-policies.md#default-pod-security-policies) of `restricted` and `unrestricted`, although you can [create custom policies](../authentication-permissions-and-global-configuration/create-pod-security-policies.md#default-pod-security-policies) as well.

 5. Click **Save**.

@@ -26,17 +26,17 @@ Following project creation, you can add users as project members so that they ca

 3. Search for the user or group that you want to add to the project.

- 	If external authentication is configured:
+    If external authentication is configured:

-	-  Rancher returns users from your external authentication source as you type.
+    -  Rancher returns users from your external authentication source as you type.

-	- A drop-down allows you to add groups instead of individual users. The dropdown only lists groups that you, the logged in user, are included in.
+    - A drop-down allows you to add groups instead of individual users. The dropdown only lists groups that you, the logged in user, are included in.

-	>**Note:** If you are logged in as a local user, external users do not display in your search results.
+    >**Note:** If you are logged in as a local user, external users do not display in your search results.

 1. Assign the user or group **Project** roles.

-	[What are Project Roles?](../authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md)
+    [What are Project Roles?](../authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md)

    >**Notes:**
    >
@@ -42,11 +42,11 @@ Backing up your high-availability Rancher cluster is process that involves compl

 1.  [Take Snapshots of the `etcd` Database](#1-take-snapshots-of-the-etcd-database)

-	Take snapshots of your current `etcd` database using Rancher Kubernetes Engine (RKE).
+    Take snapshots of your current `etcd` database using Rancher Kubernetes Engine (RKE).

 1.  [Store Snapshot(s) Externally](#2-back-up-local-snapshots-to-a-safe-location)

-	After taking your snapshots, export them to a safe location that won't be affected if your cluster encounters issues.
+    After taking your snapshots, export them to a safe location that won't be affected if your cluster encounters issues.


 # 1. Take Snapshots of the `etcd` Database
@@ -55,11 +55,11 @@ Take snapshots of your `etcd` database. You can use these snapshots later to rec

 - [Option A: Recurring Snapshots](#option-a-recurring-snapshots)

-	After you stand up a high-availability Rancher install, we recommend configuring RKE to automatically take recurring snapshots so that you always have a safe restore point available.
+    After you stand up a high-availability Rancher install, we recommend configuring RKE to automatically take recurring snapshots so that you always have a safe restore point available.

 - [Option B: One-Time Snapshots](#option-b-one-time-snapshots)

-	We advise taking one-time snapshots before events like upgrades or restore of another snapshot.
+    We advise taking one-time snapshots before events like upgrades or restore of another snapshot.

 ### Option A: Recurring Snapshots

@@ -127,11 +127,11 @@ The ability to use the same configuration to deploy the same application across

 2. For each override, you can select the following:

-	- **Scope**: Select which target projects you want to override the answer in the configuration option.
+    - **Scope**: Select which target projects you want to override the answer in the configuration option.

-	- **Question**: Select which question you want to override.
+    - **Question**: Select which question you want to override.

-	- **Answer**: Enter the answer that you want to be used instead.
+    - **Answer**: Enter the answer that you want to be used instead.

 # Upgrading Multi-Cluster App Roles and Projects

@@ -60,18 +60,18 @@ Before you create your own custom catalog, you should have a basic understanding

    A file that provides descriptive text in the chart's UI header. The following image displays the difference between a Rancher chart (which includes `app-readme.md`) and a native Helm chart (which does not).

-	<figcaption>Rancher Chart with <code>app-readme.md</code> (left) vs. Helm Chart without (right)</figcaption>
+    <figcaption>Rancher Chart with <code>app-readme.md</code> (left) vs. Helm Chart without (right)</figcaption>

-	![app-readme.md](/img/app-readme.png)
+    ![app-readme.md](/img/app-readme.png)

 - `questions.yml`

    A file that contains questions for a form. These form questions simplify deployment of a chart. Without it, you must configure the deployment using key value pairs, which is more difficult. The following image displays the difference between a Rancher chart (which includes `questions.yml`) and a native Helm chart (which does not).


-	<figcaption>Rancher Chart with <code>questions.yml</code> (left) vs. Helm Chart without (right)</figcaption>
+    <figcaption>Rancher Chart with <code>questions.yml</code> (left) vs. Helm Chart without (right)</figcaption>

-	![questions.yml](/img/questions.png)
+    ![questions.yml](/img/questions.png)


 ### questions.yml
@@ -133,7 +133,7 @@ Use Rancher to set up and configure your Kubernetes cluster.

 1. Use **Nodes** to provision each node in your cluster and choose a geographical region.

-	[Microsoft Documentation: How to create and use an SSH public and private key pair](https://docs.microsoft.com/en-us/azure/virtual-machines/linux/mac-create-ssh-keys)
+    [Microsoft Documentation: How to create and use an SSH public and private key pair](https://docs.microsoft.com/en-us/azure/virtual-machines/linux/mac-create-ssh-keys)
 <br/>
 1. Click **Create**.
 <br/>
@@ -36,11 +36,11 @@ Use Rancher to set up and configure your Kubernetes cluster.

 5. Either paste your service account private key in the **Service Account** text box or **Read from a file**. Then click **Next: Configure Nodes**.

-	>**Note:** After submitting your private key, you may have to enable the Google Kubernetes Engine API. If prompted, browse to the URL displayed in the Rancher UI to enable the API.
+    >**Note:** After submitting your private key, you may have to enable the Google Kubernetes Engine API. If prompted, browse to the URL displayed in the Rancher UI to enable the API.

 6. Select your **Cluster Options**
 7. Customize your **Node Options**
-	* Enabling the Auto Upgrade feature for Nodes is not recommended.
+    * Enabling the Auto Upgrade feature for Nodes is not recommended.
 8. Select your **Security Options**
 9. Review your options to confirm they're correct. Then click **Create**.

@@ -26,10 +26,10 @@ ConfigMaps accept key value pairs in common string formats, like config files or

 1. Click **Save**.

-	>**Note:** Don't use ConfigMaps to store sensitive data [use a secret](secrets.md).
-	>
-	>**Tip:** You can add multiple key value pairs to the ConfigMap by copying and pasting.
-	>
+    >**Note:** Don't use ConfigMaps to store sensitive data [use a secret](secrets.md).
+    >
+    >**Tip:** You can add multiple key value pairs to the ConfigMap by copying and pasting.
+    >
    > ![](/img/bulk-key-values.gif)

 **Result:** Your ConfigMap is added to the namespace. You can view it in the Rancher UI from the **Resources > Config Maps** view.
@@ -83,22 +83,22 @@ Configuration of external authentication affects how principal users are managed

 1. Sign into Rancher as the local principal and complete configuration of external authentication.

-	![Sign In](/img/sign-in.png)
+    ![Sign In](/img/sign-in.png)

 2. Rancher associates the external principal with the local principal. These two users share the local principal's user ID.

-	![Principal ID Sharing](/img/principal-ID.png)
+    ![Principal ID Sharing](/img/principal-ID.png)

 3. After you complete configuration, Rancher automatically signs out the local principal.

-	![Sign Out Local Principal](/img/sign-out-local.png)
+    ![Sign Out Local Principal](/img/sign-out-local.png)

 4. Then, Rancher automatically signs you back in as the external principal.

-	![Sign In External Principal](/img/sign-in-external.png)
+    ![Sign In External Principal](/img/sign-in-external.png)

 5. Because the external principal and the local principal share an ID, no unique object for the external principal displays on the Users page.

-	![Sign In External Principal](/img/users-page.png)
+    ![Sign In External Principal](/img/users-page.png)

 6. The external principal and the local principal share the same access rights.
@@ -145,8 +145,8 @@ RKE uses a `.yml` config file to install and configure your Kubernetes cluster.

 1. Download one of following templates, depending on the SSL certificate you're using.

-	- [Template for self-signed certificate<br/> `3-node-certificate.yml`](https://raw.githubusercontent.com/rancher/rancher/master/rke-templates/3-node-certificate.yml)
-	- [Template for certificate signed by recognized CA<br/> `3-node-certificate-recognizedca.yml`](https://raw.githubusercontent.com/rancher/rancher/master/rke-templates/3-node-certificate-recognizedca.yml)
+    - [Template for self-signed certificate<br/> `3-node-certificate.yml`](https://raw.githubusercontent.com/rancher/rancher/master/rke-templates/3-node-certificate.yml)
+    - [Template for certificate signed by recognized CA<br/> `3-node-certificate-recognizedca.yml`](https://raw.githubusercontent.com/rancher/rancher/master/rke-templates/3-node-certificate-recognizedca.yml)

    >**Advanced Config Options:**
    >
@@ -94,8 +94,8 @@ RKE uses a YAML config file to install and configure your Kubernetes cluster. Th

 1. Download one of following templates, depending on the SSL certificate you're using.

-	- [Template for self-signed certificate<br/> `3-node-externalssl-certificate.yml`](https://raw.githubusercontent.com/rancher/rancher/master/rke-templates/3-node-externalssl-certificate.yml)
-	- [Template for certificate signed by recognized CA<br/> `3-node-externalssl-recognizedca.yml`](https://raw.githubusercontent.com/rancher/rancher/master/rke-templates/3-node-externalssl-recognizedca.yml)
+    - [Template for self-signed certificate<br/> `3-node-externalssl-certificate.yml`](https://raw.githubusercontent.com/rancher/rancher/master/rke-templates/3-node-externalssl-certificate.yml)
+    - [Template for certificate signed by recognized CA<br/> `3-node-externalssl-recognizedca.yml`](https://raw.githubusercontent.com/rancher/rancher/master/rke-templates/3-node-externalssl-recognizedca.yml)

    >**Advanced Config Options:**
    >
@@ -20,16 +20,16 @@ Choose from the following options:

 - [Generic troubleshooting](../getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/helm2/rke-add-on/troubleshooting/generic-troubleshooting.md)

-	In this section, you can find generic ways to debug your Kubernetes cluster.
+    In this section, you can find generic ways to debug your Kubernetes cluster.

 - [Failed to set up SSH tunneling for host](https://rancher.com/docs/rke/latest/en/troubleshooting/ssh-connectivity-errors/)

-	In this section, you can find errors related to SSH tunneling when you run the `rke` command to setup your nodes.
+    In this section, you can find errors related to SSH tunneling when you run the `rke` command to setup your nodes.

 - [Failed to get job complete status](../getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/helm2/rke-add-on/troubleshooting/job-complete-status.md)

-	In this section, you can find errors related to deploying addons.
+    In this section, you can find errors related to deploying addons.

 - [404 - default backend](../getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/helm2/rke-add-on/troubleshooting/404-default-backend.md)

-	In this section, you can find errors related to the `404 - default backend` page that is shown when trying to access Rancher.
+    In this section, you can find errors related to the `404 - default backend` page that is shown when trying to access Rancher.
@@ -53,10 +53,10 @@ Provision the host according to the [installation requirements](../how-to-guides

 7.	From **Node Role**, choose the roles that you want filled by a cluster node.

-	>**Notes:**
-	>
+    >**Notes:**
+    >
    >- Using Windows nodes as Kubernetes workers? See [this section](use-windows-clusters.md).
-	>- Bare-Metal Server Reminder: If you plan on dedicating bare-metal servers to each role, you must provision a bare-metal server for each role (i.e. provision multiple bare-metal servers).
+    >- Bare-Metal Server Reminder: If you plan on dedicating bare-metal servers to each role, you must provision a bare-metal server for each role (i.e. provision multiple bare-metal servers).

 8.	<a id="step-8"></a>**Optional**: Click **[Show advanced options](admin-settings/agent-options/)** to specify IP address(es) to use when registering the node, override the hostname of the node, or to add [labels](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/) or [taints](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/) to the node.

@@ -64,7 +64,7 @@ Provision the host according to the [installation requirements](../how-to-guides

 10. Log in to your Linux host using your preferred shell, such as PuTTy or a remote Terminal connection. Run the command copied to your clipboard.

-	>**Note:** Repeat steps 7-10 if you want to dedicate specific hosts to specific node roles. Repeat the steps as many times as needed.
+    >**Note:** Repeat steps 7-10 if you want to dedicate specific hosts to specific node roles. Repeat the steps as many times as needed.

 11. When you finish running the command(s) on your Linux host(s), click **Done**.

@@ -95,7 +95,7 @@ The following resources need to tagged with a `ClusterID`:
 - **Subnet**: The subnet used for your cluster
 - **Security Group**: The security group used for your cluster.

-	>**Note:** Do not tag multiple security groups. Tagging multiple groups generates an error when creating Elastic Load Balancer.
+    >**Note:** Do not tag multiple security groups. Tagging multiple groups generates an error when creating Elastic Load Balancer.

 The tag that should be used is:

@@ -17,12 +17,12 @@ Pipelines help you automate the software delivery process. You can integrate Ran
 You can set up your pipeline to run a series of stages and steps to test your code and deploy it.

 <dl>
-	<dt>Pipelines</dt>
-	<dd>Contain a series of stages and steps. Out-of-the-box, the pipelines feature supports fan out and in capabilities.</dd>
-	<dt>Stages</dt>
-	<dd>Executed sequentially. The next stage will not execute until all of the steps within the stage execute.</dd>
-	<dt>Steps</dt>
-	<dd>Are executed in parallel within a stage. </dd>
+    <dt>Pipelines</dt>
+    <dd>Contain a series of stages and steps. Out-of-the-box, the pipelines feature supports fan out and in capabilities.</dd>
+    <dt>Stages</dt>
+    <dd>Executed sequentially. The next stage will not execute until all of the steps within the stage execute.</dd>
+    <dt>Steps</dt>
+    <dd>Are executed in parallel within a stage. </dd>
 </dl>

 ## Enabling CI Pipelines
@@ -46,32 +46,32 @@ You can set up your pipeline to run a series of stages and steps to test your co

 6. Select Branch options.

-	-	Only the branch {BRANCH NAME}: Only events triggered by changes to this branch will be built.
+    - Only the branch {BRANCH NAME}: Only events triggered by changes to this branch will be built.

-	-	Everything but {BRANCH NAME}: Build any branch that triggered an event EXCEPT events from this branch.
+    - Everything but {BRANCH NAME}: Build any branch that triggered an event EXCEPT events from this branch.

-	-	All branches: Regardless of the branch that triggered the event always build.
+    - All branches: Regardless of the branch that triggered the event always build.

-	>**Note:** If you want one path for master, but another for PRs or development/test/feature branches, create two separate pipelines.
+    >**Note:** If you want one path for master, but another for PRs or development/test/feature branches, create two separate pipelines.

 7. Select the build trigger events. By default, builds will only happen by manually clicking build now in Rancher UI.

-	- Automatically build this pipeline whenever there is a git commit. (This respects the branch selection above)
+    - Automatically build this pipeline whenever there is a git commit. (This respects the branch selection above)

-	- Automatically build this pipeline whenever there is a new PR.
+    - Automatically build this pipeline whenever there is a new PR.

-	- Automatically build the pipeline. (Allows you to configure scheduled builds similar to Cron)
+    - Automatically build the pipeline. (Allows you to configure scheduled builds similar to Cron)

 8. Click Add button.

-	By default, Rancher provides a three stage pipeline for you. It consists of a build stage where you would compile, unit test, and scan code. The publish stage has a single step to publish a docker image.
+    By default, Rancher provides a three stage pipeline for you. It consists of a build stage where you would compile, unit test, and scan code. The publish stage has a single step to publish a docker image.


 8. Add a name to the pipeline in order to complete adding a pipeline.

 9. Click on the ‘run a script’ box under the ‘Build’ stage.

-	Here you can set the image, or select from pre-packaged envs.
+    Here you can set the image, or select from pre-packaged envs.

 10. Configure a shell script to run inside the container when building.

@@ -83,8 +83,8 @@ You can set up your pipeline to run a series of stages and steps to test your co

 14. Set the image information.

-	The registry is the remote registry URL. It is defaulted to Docker hub.
-	Repository is the `<org>/<repo>` in the repository.
+    The registry is the remote registry URL. It is defaulted to Docker hub.
+    Repository is the `<org>/<repo>` in the repository.

 15. Select the Tag. You can hard code a tag like ‘latest’ or select from a list of available variables.

@@ -46,6 +46,6 @@ In order to delete cloud credentials, there must not be any node template associ
 1. From your user settings, select **User Avatar > Cloud Credentials**.
 1. You can either individually delete a cloud credential or bulk delete.

-	- To individually delete one, choose the cloud credential you want to edit and click the **&#8942; > Delete**.
-	- To bulk delete cloud credentials, select one or more cloud credentials from the list. Click **Delete**.
+    - To individually delete one, choose the cloud credential you want to edit and click the **&#8942; > Delete**.
+    - To bulk delete cloud credentials, select one or more cloud credentials from the list. Click **Delete**.
 1. Confirm that you want to delete these cloud credentials.
@@ -23,7 +23,11 @@ When you create a node template, it is bound to your user profile. Node template
 1. From your user settings, select **User Avatar > Node Templates**.
 1. Choose the node template that you want to edit and click the **&#8942; > Edit**.

-	   > **Note:** As of v2.2.0, the default `active` [node drivers](../../how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-provisioning-drivers/manage-node-drivers.md) and any node driver, that has fields marked as `password`, are required to use [cloud credentials](../../pages-for-subheaders/use-new-nodes-in-an-infra-provider.md#cloud-credentials). If you have upgraded to v2.2.0, existing node templates will continue to work with the previous account access  information, but when you edit the node template, you will be required to create a cloud credential and the node template will start using it.
+    :::note
+
+    As of v2.2.0, the default `active` [node drivers](../../how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-provisioning-drivers/manage-node-drivers.md) and any node driver, that has fields marked as `password`, are required to use [cloud credentials](../../pages-for-subheaders/use-new-nodes-in-an-infra-provider.md#cloud-credentials). If you have upgraded to v2.2.0, existing node templates will continue to work with the previous account access  information, but when you edit the node template, you will be required to create a cloud credential and the node template will start using it.
+
+    :::

 1. Edit the required information and click **Save**.

@@ -32,8 +32,8 @@ The Rancher API server is built on top of an embedded Kubernetes API server and

 ### Authorization and Role-Based Access Control

-  **User management:** The Rancher API server [manages user identities](../../pages-for-subheaders/about-authentication.md) that correspond to external authentication providers like Active Directory or GitHub, in addition to local users.
-	**Authorization:** The Rancher API server manages [access control](../../pages-for-subheaders/manage-role-based-access-control-rbac.md) and [security](../../how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/create-pod-security-policies.md) policies.
+- **User management:** The Rancher API server [manages user identities](../../pages-for-subheaders/about-authentication.md) that correspond to external authentication providers like Active Directory or GitHub, in addition to local users.
+- **Authorization:** The Rancher API server manages [access control](../../pages-for-subheaders/manage-role-based-access-control-rbac.md) and [security](../../how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/create-pod-security-policies.md) policies.

 ### Working with Kubernetes

@@ -15,35 +15,35 @@ You're ready to create your first Kubernetes [workload](https://kubernetes.io/do

 For this workload, you'll be deploying the application Rancher Hello-World.

-1.  From the **Clusters** page, open the cluster that you just created.
+1. From the **Clusters** page, open the cluster that you just created.

-2.  From the main menu of the **Dashboard**, select **Projects/Namespaces**.
+2. From the main menu of the **Dashboard**, select **Projects/Namespaces**.

-3.  Open the **Project: Default** project.
+3. Open the **Project: Default** project.

-4.  Click **Resources > Workloads.**
+4. Click **Resources > Workloads.**

-5.  Click **Deploy**.
+5. Click **Deploy**.

-	**Step Result:** The **Deploy Workload** page opens.
+    **Step Result:** The **Deploy Workload** page opens.

-6.  Enter a **Name** for your workload.
+6. Enter a **Name** for your workload.

-7.  From the **Docker Image** field, enter `rancher/hello-world`. This field is case-sensitive.
+7. From the **Docker Image** field, enter `rancher/hello-world`. This field is case-sensitive.

-8.  From **Port Mapping**, click **Add Port**.
+8. From **Port Mapping**, click **Add Port**.

-9.  From the **As a** drop-down, make sure that **NodePort (On every node)** is selected.
+9. From the **As a** drop-down, make sure that **NodePort (On every node)** is selected.

-	![As a dropdown, NodePort (On every node selected)](/img/nodeport-dropdown.png)
+    ![As a dropdown, NodePort (On every node selected)](/img/nodeport-dropdown.png)

 10.  From the **On Listening Port** field, leave the **Random** value in place.

-	![On Listening Port, Random selected](/img/listening-port-field.png)
+    ![On Listening Port, Random selected](/img/listening-port-field.png)

 11. From the **Publish the container port** field, enter port `80`.

-	![Publish the container port, 80 entered](/img/container-port-field.png)
+    ![Publish the container port, 80 entered](/img/container-port-field.png)

 12. Leave the remaining options on their default setting. We'll tell you about them later.

@@ -25,7 +25,7 @@ For this workload, you'll be deploying the application Rancher Hello-World.

 5.  Click **Deploy**.

-	**Step Result:** The **Deploy Workload** page opens.
+    **Step Result:** The **Deploy Workload** page opens.

 6.  Enter a **Name** for your workload.

@@ -14,40 +14,40 @@ If your organization uses FreeIPA for user authentication, you can configure Ran
 >- Create a service account in FreeIPA with `read-only` access. Rancher uses this account to verify group membership when a user makes a request using an API key.
 >- Read [External Authentication Configuration and Principal Users](../../../../../pages-for-subheaders/about-authentication.md#external-authentication-configuration-and-principal-users).

-1.  Sign into Rancher using a local user assigned the `administrator` role (i.e., the _local principal_).
+1. Sign into Rancher using a local user assigned the `administrator` role (i.e., the _local principal_).

-2.	From the **Global** view, select **Security > Authentication** from the main menu.
+2. From the **Global** view, select **Security > Authentication** from the main menu.

-3.	Select **FreeIPA**.
+3. Select **FreeIPA**.

-4.	Complete the **Configure an FreeIPA server** form.
+4. Complete the **Configure an FreeIPA server** form.

-	You may need to log in to your domain controller to find the information requested in the form.
+    You may need to log in to your domain controller to find the information requested in the form.

-	>**Using TLS?**
- 	>If the certificate is self-signed or not from a recognized certificate authority, make sure you provide the complete chain. That chain is needed to verify the server's certificate.
-	<br/>
-	<br/>
-	>**User Search Base vs. Group Search Base**
-	>
-	>Search base allows Rancher to search for users and groups that are in your FreeIPA.  These fields are only for search bases and not for search filters.
-	>
-	>* If your users and groups are in the same search base, complete only the User Search Base.
-	>* If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required.
+    >**Using TLS?**
+    >If the certificate is self-signed or not from a recognized certificate authority, make sure you provide the complete chain. That chain is needed to verify the server's certificate.
+    <br/>
+    <br/>
+    >**User Search Base vs. Group Search Base**
+    >
+    >Search base allows Rancher to search for users and groups that are in your FreeIPA.  These fields are only for search bases and not for search filters.
+    >
+    >* If your users and groups are in the same search base, complete only the User Search Base.
+    >* If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required.

-5.	If your FreeIPA deviates from the standard AD schema, complete the **Customize Schema** form to match it. Otherwise, skip this step.
+5. If your FreeIPA deviates from the standard AD schema, complete the **Customize Schema** form to match it. Otherwise, skip this step.

-	>**Search Attribute** The Search Attribute field defaults with three specific values: `uid|sn|givenName`. After FreeIPA is configured, when a user enters text to add users or groups, Rancher automatically queries the FreeIPA server and attempts to match fields by user id, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field.
-	>
-	>The default field value `uid|sn|givenName`, but you can configure this field to a subset of these fields. The pipe (`|`) between the fields separates these fields.
-	>
-	> * `uid`: User ID
-	> * `sn`: Last Name
-	> * `givenName`: First Name
-	>
-	> With this search attribute, Rancher creates search filters for users and groups, but you *cannot* add your own search filters in this field.
+    >**Search Attribute** The Search Attribute field defaults with three specific values: `uid|sn|givenName`. After FreeIPA is configured, when a user enters text to add users or groups, Rancher automatically queries the FreeIPA server and attempts to match fields by user id, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field.
+    >
+    >The default field value `uid|sn|givenName`, but you can configure this field to a subset of these fields. The pipe (`|`) between the fields separates these fields.
+    >
+    > * `uid`: User ID
+    > * `sn`: Last Name
+    > * `givenName`: First Name
+    >
+    > With this search attribute, Rancher creates search filters for users and groups, but you *cannot* add your own search filters in this field.

-6.	Enter your FreeIPA username and password in **Authenticate with FreeIPA** to confirm that Rancher is configured to use FreeIPA authentication.
+6. Enter your FreeIPA username and password in **Authenticate with FreeIPA** to confirm that Rancher is configured to use FreeIPA authentication.

 **Result:**

@@ -18,34 +18,34 @@ In environments using GitHub, you can configure Rancher to allow sign on using G

 4.	Follow the directions displayed to **Setup a GitHub Application**. Rancher redirects you to GitHub to complete registration.

-	>**What's an Authorization Callback URL?**
-	>
-	>The Authorization Callback URL is the URL where users go to begin using your application (i.e. the splash screen).
+    >**What's an Authorization Callback URL?**
+    >
+    >The Authorization Callback URL is the URL where users go to begin using your application (i.e. the splash screen).

-	>When you use external authentication, authentication does not actually take place in your application. Instead, authentication takes place externally (in this case, GitHub). After this external authentication completes successfully, the Authorization Callback URL is the location where the user re-enters your application.
+    >When you use external authentication, authentication does not actually take place in your application. Instead, authentication takes place externally (in this case, GitHub). After this external authentication completes successfully, the Authorization Callback URL is the location where the user re-enters your application.

 5. From GitHub, copy the **Client ID** and **Client Secret**. Paste them into Rancher.

-	>**Where do I find the Client ID and Client Secret?**
-	>
-	>From GitHub, select Settings > Developer Settings > OAuth Apps. The Client ID and Client Secret are displayed prominently.
+    >**Where do I find the Client ID and Client Secret?**
+    >
+    >From GitHub, select Settings > Developer Settings > OAuth Apps. The Client ID and Client Secret are displayed prominently.

 6.	Click **Authenticate with GitHub**.

 7.	Use the **Site Access** options to configure the scope of user authorization.

-	-	**Allow any valid Users**
+    - **Allow any valid Users**

-		_Any_ GitHub user can access Rancher. We generally discourage use of this setting!
+        _Any_ GitHub user can access Rancher. We generally discourage use of this setting!

-	-	**Allow members of Clusters, Projects, plus Authorized Users and Organizations**
+    - **Allow members of Clusters, Projects, plus Authorized Users and Organizations**

-		Any GitHub user or group added as a **Cluster Member** or **Project Member** can log in to Rancher. Additionally, any GitHub user or group you add to the **Authorized Users and Organizations** list may log in to Rancher.
+        Any GitHub user or group added as a **Cluster Member** or **Project Member** can log in to Rancher. Additionally, any GitHub user or group you add to the **Authorized Users and Organizations** list may log in to Rancher.

-	-	**Restrict access to only Authorized Users and Organizations**
+    - **Restrict access to only Authorized Users and Organizations**

-		Only GitHub users or groups added to the Authorized Users and Organizations can log in to Rancher.
-		<br/>
+        Only GitHub users or groups added to the Authorized Users and Organizations can log in to Rancher.
+        <br/>
 8.	Click **Save**.

 **Result:**
@@ -81,7 +81,7 @@ Using the Unique ID of the service account key, register it as an Oauth Client u

 1. Get the Unique ID of the key you just created. If it's not displayed in the list of keys right next to the one you created, you will have to enable it. To enable it, click **Unique ID** and click **OK.** This will add a **Unique ID** column to the list of service account keys. Save the one listed for the service account you created. NOTE: This is a numeric key, not to be confused with the alphanumeric field **Key ID.**

-	![Service account Unique ID](/img/Google-Select-UniqueID-column.png)
+    ![Service account Unique ID](/img/Google-Select-UniqueID-column.png)
 1. Go to the [**Manage OAuth Client Access** page.](https://admin.google.com/AdminHome?chromeless=1#OGX:ManageOauthClients)
 1. Add the Unique ID obtained in the previous step in the **Client Name** field.
 1. In the **One or More API Scopes** field, add the following scopes:
@@ -60,7 +60,7 @@ We recommend adding PSPs during cluster and project creation instead of adding i

 1.	From the **Global** view, select **Security** > **Pod Security Policies** from the main menu. Then click **Add Policy**.

-	**Step Result:** The **Add Policy** form opens.
+    **Step Result:** The **Add Policy** form opens.

 2. Name the policy.

@@ -33,25 +33,25 @@ Cluster administrators can edit the membership for a cluster, controlling which

 3. Search for the user or group that you want to add to the cluster.

- 	If external authentication is configured:
+    If external authentication is configured:

-	-  Rancher returns users from your [external authentication](../../../../pages-for-subheaders/about-authentication.md) source as you type.
+    - Rancher returns users from your [external authentication](../../../../pages-for-subheaders/about-authentication.md) source as you type.

-		>**Using AD but can't find your users?**
-		>There may be an issue with your search attribute configuration. See [Configuring Active Directory Authentication: Step 5](../../authentication-permissions-and-global-configuration/about-authentication/authentication-config/configure-active-directory.md).
+        >**Using AD but can't find your users?**
+        >There may be an issue with your search attribute configuration. See [Configuring Active Directory Authentication: Step 5](../../authentication-permissions-and-global-configuration/about-authentication/authentication-config/configure-active-directory.md).

-	- A drop-down allows you to add groups instead of individual users. The drop-down only lists groups that you, the logged in user, are part of.
+    - A drop-down allows you to add groups instead of individual users. The drop-down only lists groups that you, the logged in user, are part of.

-		>**Note:** If you are logged in as a local user, external users do not display in your search results. For more information, see [External Authentication Configuration and Principal Users](../../../../pages-for-subheaders/about-authentication.md#external-authentication-configuration-and-principal-users).
+        >**Note:** If you are logged in as a local user, external users do not display in your search results. For more information, see [External Authentication Configuration and Principal Users](../../../../pages-for-subheaders/about-authentication.md#external-authentication-configuration-and-principal-users).

 4. Assign the user or group **Cluster** roles.  

-	[What are Cluster Roles?](../../authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md)
+    [What are Cluster Roles?](../../authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md)

-	>**Tip:** For Custom Roles, you can modify the list of individual roles available for assignment.
-	>
-	> - To add roles to the list, [Add a Custom Role](../../authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/custom-roles.md).
-	> - To remove roles from the list, [Lock/Unlock Roles](../../authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/locked-roles.md).
+    >**Tip:** For Custom Roles, you can modify the list of individual roles available for assignment.
+    >
+    > - To add roles to the list, [Add a Custom Role](../../authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/custom-roles.md).
+    > - To remove roles from the list, [Lock/Unlock Roles](../../authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/locked-roles.md).

 **Result:** The chosen users are added to the cluster.

@@ -21,7 +21,7 @@ You can assign a pod security policy when you provision a cluster. However, if y

 4. From the **Default Pod Security Policy** drop-down, select the policy you want to apply to the cluster.

-	Rancher ships with [policies](../authentication-permissions-and-global-configuration/create-pod-security-policies.md#default-pod-security-policies) of `restricted` and `unrestricted`, although you can [create custom policies](../authentication-permissions-and-global-configuration/create-pod-security-policies.md#default-pod-security-policies) as well.
+    Rancher ships with [policies](../authentication-permissions-and-global-configuration/create-pod-security-policies.md#default-pod-security-policies) of `restricted` and `unrestricted`, although you can [create custom policies](../authentication-permissions-and-global-configuration/create-pod-security-policies.md#default-pod-security-policies) as well.

 5. Click **Save**.

@@ -27,17 +27,17 @@ Following project creation, you can add users as project members so that they ca

 3. Search for the user or group that you want to add to the project.

- 	If external authentication is configured:
+    If external authentication is configured:

-	-  Rancher returns users from your external authentication source as you type.
+    - Rancher returns users from your external authentication source as you type.

-	- A drop-down allows you to add groups instead of individual users. The dropdown only lists groups that you, the logged in user, are included in.
+    - A drop-down allows you to add groups instead of individual users. The dropdown only lists groups that you, the logged in user, are included in.

-	>**Note:** If you are logged in as a local user, external users do not display in your search results.
+    >**Note:** If you are logged in as a local user, external users do not display in your search results.

 1. Assign the user or group **Project** roles.

-	[What are Project Roles?](../authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md)
+    [What are Project Roles?](../authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md)

    >**Notes:**
    >
@@ -24,21 +24,21 @@ A restore is performed by creating a Restore custom resource.

    ```yaml
    apiVersion: resources.cattle.io/v1
-	kind: Restore
-	metadata:
-	  name: restore-migration
-	spec:
-	  backupFilename: backup-b0450532-cee1-4aa1-a881-f5f48a007b1c-2020-09-15T07-27-09Z.tar.gz
-	  encryptionConfigSecretName: encryptionconfig
-	  storageLocation:
-	    s3:
-	      credentialSecretName: s3-creds
-	      credentialSecretNamespace: default
-	      bucketName: rancher-backups
-	      folder: rancher
-	      region: us-west-2
-	      endpoint: s3.us-west-2.amazonaws.com
-      ```
+    kind: Restore
+    metadata:
+      name: restore-migration
+    spec:
+      backupFilename: backup-b0450532-cee1-4aa1-a881-f5f48a007b1c-2020-09-15T07-27-09Z.tar.gz
+      encryptionConfigSecretName: encryptionconfig
+      storageLocation:
+        s3:
+          credentialSecretName: s3-creds
+          credentialSecretNamespace: default
+          bucketName: rancher-backups
+          folder: rancher
+          region: us-west-2
+          endpoint: s3.us-west-2.amazonaws.com
+    ```

      For help configuring the Restore, refer to the [configuration reference](../../../reference-guides/backup-restore-configuration/restore-configuration.md) and to the [examples.](../../../reference-guides/backup-restore-configuration/examples.md)

@@ -112,11 +112,11 @@ The ability to use the same configuration to deploy the same application across

 2. For each override, you can select the following:

-	- **Scope**: Select which target projects you want to override the answer in the configuration option.
+    - **Scope**: Select which target projects you want to override the answer in the configuration option.

-	- **Question**: Select which question you want to override.
+    - **Question**: Select which question you want to override.

-	- **Answer**: Enter the answer that you want to be used instead.
+    - **Answer**: Enter the answer that you want to be used instead.

 ## Upgrading Multi-Cluster App Roles and Projects

@@ -135,7 +135,7 @@ Use Rancher to set up and configure your Kubernetes cluster.

 1. Use **Nodes** to provision each node in your cluster and choose a geographical region.

-	[Microsoft Documentation: How to create and use an SSH public and private key pair](https://docs.microsoft.com/en-us/azure/virtual-machines/linux/mac-create-ssh-keys)
+    [Microsoft Documentation: How to create and use an SSH public and private key pair](https://docs.microsoft.com/en-us/azure/virtual-machines/linux/mac-create-ssh-keys)
 <br/>
 1. Click **Create**.
 <br/>
@@ -139,7 +139,7 @@ Use Rancher to set up and configure your Kubernetes cluster.

 5. Either paste your service account private key in the **Service Account** text box or **Read from a file**. Then click **Next: Configure Nodes**.

-	>**Note:** After submitting your private key, you may have to enable the Google Kubernetes Engine API. If prompted, browse to the URL displayed in the Rancher UI to enable the API.
+    >**Note:** After submitting your private key, you may have to enable the Google Kubernetes Engine API. If prompted, browse to the URL displayed in the Rancher UI to enable the API.

 6. Select your cluster options, node options and security options. For help, refer to the [GKE Cluster Configuration Reference.](#gke-before-v2-5-8)
 9. Review your options to confirm they're correct. Then click **Create**.
@@ -27,10 +27,10 @@ ConfigMaps accept key value pairs in common string formats, like config files or

 1. Click **Save**.

-	>**Note:** Don't use ConfigMaps to store sensitive data [use a secret](secrets.md).
-	>
-	>**Tip:** You can add multiple key value pairs to the ConfigMap by copying and pasting.
-	>
+    >**Note:** Don't use ConfigMaps to store sensitive data [use a secret](secrets.md).
+    >
+    >**Tip:** You can add multiple key value pairs to the ConfigMap by copying and pasting.
+    >
    > ![](/img/bulk-key-values.gif)

 **Result:** Your ConfigMap is added to the namespace. You can view it in the Rancher UI from the **Resources > Config Maps** view.
@@ -84,22 +84,22 @@ Configuration of external authentication affects how principal users are managed

 1. Sign into Rancher as the local principal and complete configuration of external authentication.

-	![Sign In](/img/sign-in.png)
+    ![Sign In](/img/sign-in.png)

 2. Rancher associates the external principal with the local principal. These two users share the local principal's user ID.

-	![Principal ID Sharing](/img/principal-ID.png)
+    ![Principal ID Sharing](/img/principal-ID.png)

 3. After you complete configuration, Rancher automatically signs out the local principal.

-	![Sign Out Local Principal](/img/sign-out-local.png)
+    ![Sign Out Local Principal](/img/sign-out-local.png)

 4. Then, Rancher automatically signs you back in as the external principal.

-	![Sign In External Principal](/img/sign-in-external.png)
+    ![Sign In External Principal](/img/sign-in-external.png)

 5. Because the external principal and the local principal share an ID, no unique object for the external principal displays on the Users page.

-	![Sign In External Principal](/img/users-page.png)
+    ![Sign In External Principal](/img/users-page.png)

 6. The external principal and the local principal share the same access rights.
@@ -12,17 +12,17 @@ import TabItem from '@theme/TabItem';

 # Changes in v2.5.8

-   We now support private GKE clusters. Note: This advanced setup can require more steps during the cluster provisioning process. For details, see [this section.](../reference-guides/cluster-configuration/rancher-server-configuration/gke-cluster-configuration/gke-private-clusters.md)
-   [Shared VPCs](https://cloud.google.com/vpc/docs/shared-vpc) are now supported.
-   We now support more configuration options for Rancher managed GKE clusters:
-    -   Project
-    -   Network policy
-    -   Network policy config
-    -   Node pools and node configuration options:
-        -   More image types are available for the nodes
-        -   The maximum number of pods per node can be configured
-	-   Node pools can be added while configuring the GKE cluster
-   When provisioning a GKE cluster, you can now use reusable cloud credentials instead of using a service account token directly to create the cluster.
+- We now support private GKE clusters. Note: This advanced setup can require more steps during the cluster provisioning process. For details, see [this section.](../reference-guides/cluster-configuration/rancher-server-configuration/gke-cluster-configuration/gke-private-clusters.md)
+- [Shared VPCs](https://cloud.google.com/vpc/docs/shared-vpc) are now supported.
+- We now support more configuration options for Rancher managed GKE clusters:
+    - Project
+    - Network policy
+    - Network policy config
+    - Node pools and node configuration options:
+        - More image types are available for the nodes
+        - The maximum number of pods per node can be configured
+    - Node pools can be added while configuring the GKE cluster
+- When provisioning a GKE cluster, you can now use reusable cloud credentials instead of using a service account token directly to create the cluster.

 # Cluster Location

@@ -56,10 +56,10 @@ Clusters won't begin provisioning until all three node roles (worker, etcd and c

 7.	From **Node Role**, choose the roles that you want filled by a cluster node. You must provision at least one node for each role: `etcd`, `worker`, and `control plane`. All three roles are required for a custom cluster to finish provisioning. For more information on roles, see [this section.](../reference-guides/kubernetes-concepts.md#roles-for-nodes-in-kubernetes-clusters)

-	>**Notes:**
-	>
+    >**Notes:**
+    >
    >- Using Windows nodes as Kubernetes workers? See [this section](use-windows-clusters.md).
-	>- Bare-Metal Server Reminder: If you plan on dedicating bare-metal servers to each role, you must provision a bare-metal server for each role (i.e. provision multiple bare-metal servers).
+    >- Bare-Metal Server Reminder: If you plan on dedicating bare-metal servers to each role, you must provision a bare-metal server for each role (i.e. provision multiple bare-metal servers).

 8.	<a id="step-8"></a>**Optional**: Click **[Show advanced options](admin-settings/agent-options/)** to specify IP address(es) to use when registering the node, override the hostname of the node, or to add [labels](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/) or [taints](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/) to the node.

@@ -67,7 +67,7 @@ Clusters won't begin provisioning until all three node roles (worker, etcd and c

 10. Log in to your Linux host using your preferred shell, such as PuTTy or a remote Terminal connection. Run the command copied to your clipboard.

-	>**Note:** Repeat steps 7-10 if you want to dedicate specific hosts to specific node roles. Repeat the steps as many times as needed.
+    >**Note:** Repeat steps 7-10 if you want to dedicate specific hosts to specific node roles. Repeat the steps as many times as needed.

 11. When you finish running the command(s) on your Linux host(s), click **Done**.

@@ -98,7 +98,7 @@ The following resources need to be tagged with a `ClusterID`:
 - **Subnet**: The subnet used for your cluster
 - **Security Group**: The security group used for your cluster.

-	>**Note:** Do not tag multiple security groups. Tagging multiple groups generates an error when creating Elastic Load Balancer.
+    >**Note:** Do not tag multiple security groups. Tagging multiple groups generates an error when creating Elastic Load Balancer.

 The tag that should be used is:

@@ -46,6 +46,6 @@ In order to delete cloud credentials, there must not be any node template associ
 1. From your user settings, select **User Avatar > Cloud Credentials**.
 1. You can either individually delete a cloud credential or bulk delete.

-	- To individually delete one, choose the cloud credential you want to edit and click the **&#8942; > Delete**.
-	- To bulk delete cloud credentials, select one or more cloud credentials from the list. Click **Delete**.
+    - To individually delete one, choose the cloud credential you want to edit and click the **&#8942; > Delete**.
+    - To bulk delete cloud credentials, select one or more cloud credentials from the list. Click **Delete**.
 1. Confirm that you want to delete these cloud credentials.
@@ -25,7 +25,10 @@ When you create a node template, it is bound to your user profile. Node template
 1. From your user settings, select **User Avatar > Node Templates**.
 1. Choose the node template that you want to edit and click the **&#8942; > Edit**.

-	   > **Note:** As of v2.2.0, the default `active` [node drivers](../../how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-provisioning-drivers/manage-node-drivers.md) and any node driver, that has fields marked as `password`, are required to use [cloud credentials](../../pages-for-subheaders/use-new-nodes-in-an-infra-provider.md#cloud-credentials). If you have upgraded to v2.2.0, existing node templates will continue to work with the previous account access  information, but when you edit the node template, you will be required to create a cloud credential and the node template will start using it.
+    :::note
+    
+    As of v2.2.0, the default `active` [node drivers](../../how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/about-provisioning-drivers/manage-node-drivers.md) and any node driver, that has fields marked as `password`, are required to use [cloud credentials](../../pages-for-subheaders/use-new-nodes-in-an-infra-provider.md#cloud-credentials). If you have upgraded to v2.2.0, existing node templates will continue to work with the previous account access  information, but when you edit the node template, you will be required to create a cloud credential and the node template will start using it.
+    :::

 1. Edit the required information and click **Save**.