From b457c9eb684cdf21c02a91d31d19ee4814aead7c Mon Sep 17 00:00:00 2001 From: Diogo Souza Date: Wed, 19 Feb 2025 16:37:20 -0300 Subject: [PATCH 01/32] adding rancher-istio deprecation notice (#1627) * adding rancher-istio deprecation notice * Rebased / Added changes to v2.11 directory --------- Co-authored-by: LucasSaintarbor --- .../istio-setup-guide/istio-setup-guide.md | 8 ++++++++ docs/integrations-in-rancher/istio/istio.md | 8 ++++++++ .../istio-setup-guide/istio-setup-guide.md | 8 ++++++++ .../version-2.11/integrations-in-rancher/istio/istio.md | 8 ++++++++ 4 files changed, 32 insertions(+) diff --git a/docs/how-to-guides/advanced-user-guides/istio-setup-guide/istio-setup-guide.md b/docs/how-to-guides/advanced-user-guides/istio-setup-guide/istio-setup-guide.md index cb01f789246..a489738cae2 100644 --- a/docs/how-to-guides/advanced-user-guides/istio-setup-guide/istio-setup-guide.md +++ b/docs/how-to-guides/advanced-user-guides/istio-setup-guide/istio-setup-guide.md @@ -6,6 +6,14 @@ title: Istio Setup Guides +:::note + +[Rancher-Istio](https://github.com/rancher/charts/tree/release-v2.11/charts/rancher-istio) will be deprecated in Rancher v2.12.0; turn to the [SUSE Rancher Application Collection](https://apps.rancher.io) build of Istio for enhanced security (included in SUSE Rancher Prime subscriptions). + +Detailed information can be found in [this announcement](https://forums.rancher.com/t/deprecation-of-rancher-istio/45043/1). + +::: + This section describes how to enable Istio and start using it in your projects. If you use Istio for traffic management, you will need to allow external traffic to the cluster. In that case, you will need to follow all of the steps below. diff --git a/docs/integrations-in-rancher/istio/istio.md b/docs/integrations-in-rancher/istio/istio.md index ec3cdaa0ba4..9516f582f81 100644 --- a/docs/integrations-in-rancher/istio/istio.md +++ b/docs/integrations-in-rancher/istio/istio.md @@ -6,6 +6,14 @@ title: Istio +:::note + +[Rancher-Istio](https://github.com/rancher/charts/tree/release-v2.11/charts/rancher-istio) will be deprecated in Rancher v2.12.0; turn to the [SUSE Rancher Application Collection](https://apps.rancher.io) build of Istio for enhanced security (included in SUSE Rancher Prime subscriptions). + +Detailed information can be found in [this announcement](https://forums.rancher.com/t/deprecation-of-rancher-istio/45043/1). + +::: + [Istio](https://istio.io/) is an open-source tool that makes it easier for DevOps teams to observe, secure, control, and troubleshoot the traffic within a complex network of microservices. As a network of microservices changes and grows, the interactions between them can become increasingly difficult to manage and understand. In such a situation, it is useful to have a service mesh as a separate infrastructure layer. Istio's service mesh lets you manipulate traffic between microservices without changing the microservices directly. diff --git a/versioned_docs/version-2.11/how-to-guides/advanced-user-guides/istio-setup-guide/istio-setup-guide.md b/versioned_docs/version-2.11/how-to-guides/advanced-user-guides/istio-setup-guide/istio-setup-guide.md index cb01f789246..a489738cae2 100644 --- a/versioned_docs/version-2.11/how-to-guides/advanced-user-guides/istio-setup-guide/istio-setup-guide.md +++ b/versioned_docs/version-2.11/how-to-guides/advanced-user-guides/istio-setup-guide/istio-setup-guide.md @@ -6,6 +6,14 @@ title: Istio Setup Guides +:::note + +[Rancher-Istio](https://github.com/rancher/charts/tree/release-v2.11/charts/rancher-istio) will be deprecated in Rancher v2.12.0; turn to the [SUSE Rancher Application Collection](https://apps.rancher.io) build of Istio for enhanced security (included in SUSE Rancher Prime subscriptions). + +Detailed information can be found in [this announcement](https://forums.rancher.com/t/deprecation-of-rancher-istio/45043/1). + +::: + This section describes how to enable Istio and start using it in your projects. If you use Istio for traffic management, you will need to allow external traffic to the cluster. In that case, you will need to follow all of the steps below. diff --git a/versioned_docs/version-2.11/integrations-in-rancher/istio/istio.md b/versioned_docs/version-2.11/integrations-in-rancher/istio/istio.md index ec3cdaa0ba4..9516f582f81 100644 --- a/versioned_docs/version-2.11/integrations-in-rancher/istio/istio.md +++ b/versioned_docs/version-2.11/integrations-in-rancher/istio/istio.md @@ -6,6 +6,14 @@ title: Istio +:::note + +[Rancher-Istio](https://github.com/rancher/charts/tree/release-v2.11/charts/rancher-istio) will be deprecated in Rancher v2.12.0; turn to the [SUSE Rancher Application Collection](https://apps.rancher.io) build of Istio for enhanced security (included in SUSE Rancher Prime subscriptions). + +Detailed information can be found in [this announcement](https://forums.rancher.com/t/deprecation-of-rancher-istio/45043/1). + +::: + [Istio](https://istio.io/) is an open-source tool that makes it easier for DevOps teams to observe, secure, control, and troubleshoot the traffic within a complex network of microservices. As a network of microservices changes and grows, the interactions between them can become increasingly difficult to manage and understand. In such a situation, it is useful to have a service mesh as a separate infrastructure layer. Istio's service mesh lets you manipulate traffic between microservices without changing the microservices directly. From 0d84fe35ac61bd3f8e6e847fa41b96194ad4a3e6 Mon Sep 17 00:00:00 2001 From: Alessio Greggi Date: Thu, 20 Feb 2025 11:24:37 +0100 Subject: [PATCH 02/32] docs: add auth-user-session-idle-ttl-minutes setting Signed-off-by: Alessio Greggi --- docs/api/api-tokens.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/docs/api/api-tokens.md b/docs/api/api-tokens.md index cecfd9af3cc..65932092303 100644 --- a/docs/api/api-tokens.md +++ b/docs/api/api-tokens.md @@ -63,6 +63,7 @@ These global settings affect Rancher token behavior. | Setting | Description | | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | [`auth-user-session-ttl-minutes`](#auth-user-session-ttl-minutes) | TTL in minutes on a user auth session token. | +| [`auth-user-session-idle-ttl-minutes`](#auth-user-session-idle-ttl-minutes) | TTL in minutes on a user auth session token, without user activity. | | [`kubeconfig-default-token-ttl-minutes`](#kubeconfig-default-token-ttl-minutes) | Default TTL applied to all kubeconfig tokens except for tokens [generated by Rancher CLI](#disable-tokens-in-generated-kubeconfigs). | | [`auth-token-max-ttl-minutes`](#auth-token-max-ttl-minutes) | Max TTL for all tokens except those controlled by [`auth-user-session-ttl-minutes`](#auth-user-session-ttl-minutes). | | [`kubeconfig-generate-token`](#kubeconfig-generate-token) | If true, automatically generate tokens when a user downloads a kubeconfig. | @@ -71,6 +72,11 @@ These global settings affect Rancher token behavior. Time to live (TTL) duration in minutes, used to determine when a user auth session token expires. When expired, the user must log in and obtain a new token. This setting is not affected by [`auth-token-max-ttl-minutes`](#auth-token-max-ttl-minutes). Session tokens are created when a user logs into Rancher. +### auth-user-session-idle-ttl-minutes + +Time to live (TTL) without user activity for tokens controlling a login session, in minutes. +By default, the value for [`auth-user-session-idle-ttl-minutes`](#auth-user-session-idle-ttl-minutes) is be set to the same value as [`auth-user-session-ttl-minutes`](#auth-user-session-ttl-minutes) (for backward compatibility reasons), and it must never be greater than this value. + ### kubeconfig-default-token-ttl-minutes Time to live (TTL) duration in minutes, used to determine when a kubeconfig token expires. When the token is expired, the API rejects the token. This setting can't be larger than [`auth-token-max-ttl-minutes`](#auth-token-max-ttl-minutes). This setting applies to tokens generated in a requested kubeconfig file, except for tokens [generated by Rancher CLI](#disable-tokens-in-generated-kubeconfigs). As of Rancher v2.8, the default duration is `43200`, which means that tokens expire in 30 days. From d4a7f7023adf169e5d2c5f55b041ead3c5432539 Mon Sep 17 00:00:00 2001 From: Alessio Greggi Date: Fri, 21 Feb 2025 16:38:24 +0100 Subject: [PATCH 03/32] Update docs/api/api-tokens.md Co-authored-by: Enrico Candino --- docs/api/api-tokens.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/api/api-tokens.md b/docs/api/api-tokens.md index 65932092303..d5125542ee8 100644 --- a/docs/api/api-tokens.md +++ b/docs/api/api-tokens.md @@ -74,8 +74,8 @@ Time to live (TTL) duration in minutes, used to determine when a user auth sessi ### auth-user-session-idle-ttl-minutes -Time to live (TTL) without user activity for tokens controlling a login session, in minutes. -By default, the value for [`auth-user-session-idle-ttl-minutes`](#auth-user-session-idle-ttl-minutes) is be set to the same value as [`auth-user-session-ttl-minutes`](#auth-user-session-ttl-minutes) (for backward compatibility reasons), and it must never be greater than this value. +Time to live (TTL) without user activity for login sessions tokens, in minutes. +By default, [`auth-user-session-idle-ttl-minutes`](#auth-user-session-idle-ttl-minutes) is set to the same value as [`auth-user-session-ttl-minutes`](#auth-user-session-ttl-minutes) (for backward compatibility). It must never exceed the value of `auth-user-session-ttl-minutes`. ### kubeconfig-default-token-ttl-minutes From 16fa2b39ae42a2e6607e2f77255e0b166ab6e646 Mon Sep 17 00:00:00 2001 From: Alessio Greggi Date: Tue, 25 Feb 2025 18:18:38 +0100 Subject: [PATCH 04/32] update versioned_docs Signed-off-by: Alessio Greggi --- versioned_docs/version-2.11/api/api-tokens.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/versioned_docs/version-2.11/api/api-tokens.md b/versioned_docs/version-2.11/api/api-tokens.md index cecfd9af3cc..65932092303 100644 --- a/versioned_docs/version-2.11/api/api-tokens.md +++ b/versioned_docs/version-2.11/api/api-tokens.md @@ -63,6 +63,7 @@ These global settings affect Rancher token behavior. | Setting | Description | | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | [`auth-user-session-ttl-minutes`](#auth-user-session-ttl-minutes) | TTL in minutes on a user auth session token. | +| [`auth-user-session-idle-ttl-minutes`](#auth-user-session-idle-ttl-minutes) | TTL in minutes on a user auth session token, without user activity. | | [`kubeconfig-default-token-ttl-minutes`](#kubeconfig-default-token-ttl-minutes) | Default TTL applied to all kubeconfig tokens except for tokens [generated by Rancher CLI](#disable-tokens-in-generated-kubeconfigs). | | [`auth-token-max-ttl-minutes`](#auth-token-max-ttl-minutes) | Max TTL for all tokens except those controlled by [`auth-user-session-ttl-minutes`](#auth-user-session-ttl-minutes). | | [`kubeconfig-generate-token`](#kubeconfig-generate-token) | If true, automatically generate tokens when a user downloads a kubeconfig. | @@ -71,6 +72,11 @@ These global settings affect Rancher token behavior. Time to live (TTL) duration in minutes, used to determine when a user auth session token expires. When expired, the user must log in and obtain a new token. This setting is not affected by [`auth-token-max-ttl-minutes`](#auth-token-max-ttl-minutes). Session tokens are created when a user logs into Rancher. +### auth-user-session-idle-ttl-minutes + +Time to live (TTL) without user activity for tokens controlling a login session, in minutes. +By default, the value for [`auth-user-session-idle-ttl-minutes`](#auth-user-session-idle-ttl-minutes) is be set to the same value as [`auth-user-session-ttl-minutes`](#auth-user-session-ttl-minutes) (for backward compatibility reasons), and it must never be greater than this value. + ### kubeconfig-default-token-ttl-minutes Time to live (TTL) duration in minutes, used to determine when a kubeconfig token expires. When the token is expired, the API rejects the token. This setting can't be larger than [`auth-token-max-ttl-minutes`](#auth-token-max-ttl-minutes). This setting applies to tokens generated in a requested kubeconfig file, except for tokens [generated by Rancher CLI](#disable-tokens-in-generated-kubeconfigs). As of Rancher v2.8, the default duration is `43200`, which means that tokens expire in 30 days. From 4cc1d07215bb71aada334152c5123c800678434c Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Tue, 4 Mar 2025 09:05:49 -0800 Subject: [PATCH 05/32] Revert "update versioned_docs" This reverts commit 16fa2b39ae42a2e6607e2f77255e0b166ab6e646. --- versioned_docs/version-2.11/api/api-tokens.md | 6 ------ 1 file changed, 6 deletions(-) diff --git a/versioned_docs/version-2.11/api/api-tokens.md b/versioned_docs/version-2.11/api/api-tokens.md index 65932092303..cecfd9af3cc 100644 --- a/versioned_docs/version-2.11/api/api-tokens.md +++ b/versioned_docs/version-2.11/api/api-tokens.md @@ -63,7 +63,6 @@ These global settings affect Rancher token behavior. | Setting | Description | | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | [`auth-user-session-ttl-minutes`](#auth-user-session-ttl-minutes) | TTL in minutes on a user auth session token. | -| [`auth-user-session-idle-ttl-minutes`](#auth-user-session-idle-ttl-minutes) | TTL in minutes on a user auth session token, without user activity. | | [`kubeconfig-default-token-ttl-minutes`](#kubeconfig-default-token-ttl-minutes) | Default TTL applied to all kubeconfig tokens except for tokens [generated by Rancher CLI](#disable-tokens-in-generated-kubeconfigs). | | [`auth-token-max-ttl-minutes`](#auth-token-max-ttl-minutes) | Max TTL for all tokens except those controlled by [`auth-user-session-ttl-minutes`](#auth-user-session-ttl-minutes). | | [`kubeconfig-generate-token`](#kubeconfig-generate-token) | If true, automatically generate tokens when a user downloads a kubeconfig. | @@ -72,11 +71,6 @@ These global settings affect Rancher token behavior. Time to live (TTL) duration in minutes, used to determine when a user auth session token expires. When expired, the user must log in and obtain a new token. This setting is not affected by [`auth-token-max-ttl-minutes`](#auth-token-max-ttl-minutes). Session tokens are created when a user logs into Rancher. -### auth-user-session-idle-ttl-minutes - -Time to live (TTL) without user activity for tokens controlling a login session, in minutes. -By default, the value for [`auth-user-session-idle-ttl-minutes`](#auth-user-session-idle-ttl-minutes) is be set to the same value as [`auth-user-session-ttl-minutes`](#auth-user-session-ttl-minutes) (for backward compatibility reasons), and it must never be greater than this value. - ### kubeconfig-default-token-ttl-minutes Time to live (TTL) duration in minutes, used to determine when a kubeconfig token expires. When the token is expired, the API rejects the token. This setting can't be larger than [`auth-token-max-ttl-minutes`](#auth-token-max-ttl-minutes). This setting applies to tokens generated in a requested kubeconfig file, except for tokens [generated by Rancher CLI](#disable-tokens-in-generated-kubeconfigs). As of Rancher v2.8, the default duration is `43200`, which means that tokens expire in 30 days. From 94763d89fdbe1c3669aa32432460f581be03fbb3 Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Tue, 4 Mar 2025 09:05:49 -0800 Subject: [PATCH 06/32] Revert "Update docs/api/api-tokens.md" This reverts commit d4a7f7023adf169e5d2c5f55b041ead3c5432539. --- docs/api/api-tokens.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/api/api-tokens.md b/docs/api/api-tokens.md index d5125542ee8..65932092303 100644 --- a/docs/api/api-tokens.md +++ b/docs/api/api-tokens.md @@ -74,8 +74,8 @@ Time to live (TTL) duration in minutes, used to determine when a user auth sessi ### auth-user-session-idle-ttl-minutes -Time to live (TTL) without user activity for login sessions tokens, in minutes. -By default, [`auth-user-session-idle-ttl-minutes`](#auth-user-session-idle-ttl-minutes) is set to the same value as [`auth-user-session-ttl-minutes`](#auth-user-session-ttl-minutes) (for backward compatibility). It must never exceed the value of `auth-user-session-ttl-minutes`. +Time to live (TTL) without user activity for tokens controlling a login session, in minutes. +By default, the value for [`auth-user-session-idle-ttl-minutes`](#auth-user-session-idle-ttl-minutes) is be set to the same value as [`auth-user-session-ttl-minutes`](#auth-user-session-ttl-minutes) (for backward compatibility reasons), and it must never be greater than this value. ### kubeconfig-default-token-ttl-minutes From d946eb97c5c4243a37aa086b9dfb5cfdf633c89e Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Tue, 4 Mar 2025 09:05:49 -0800 Subject: [PATCH 07/32] Revert "docs: add auth-user-session-idle-ttl-minutes setting" This reverts commit 0d84fe35ac61bd3f8e6e847fa41b96194ad4a3e6. --- docs/api/api-tokens.md | 6 ------ 1 file changed, 6 deletions(-) diff --git a/docs/api/api-tokens.md b/docs/api/api-tokens.md index 65932092303..cecfd9af3cc 100644 --- a/docs/api/api-tokens.md +++ b/docs/api/api-tokens.md @@ -63,7 +63,6 @@ These global settings affect Rancher token behavior. | Setting | Description | | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | [`auth-user-session-ttl-minutes`](#auth-user-session-ttl-minutes) | TTL in minutes on a user auth session token. | -| [`auth-user-session-idle-ttl-minutes`](#auth-user-session-idle-ttl-minutes) | TTL in minutes on a user auth session token, without user activity. | | [`kubeconfig-default-token-ttl-minutes`](#kubeconfig-default-token-ttl-minutes) | Default TTL applied to all kubeconfig tokens except for tokens [generated by Rancher CLI](#disable-tokens-in-generated-kubeconfigs). | | [`auth-token-max-ttl-minutes`](#auth-token-max-ttl-minutes) | Max TTL for all tokens except those controlled by [`auth-user-session-ttl-minutes`](#auth-user-session-ttl-minutes). | | [`kubeconfig-generate-token`](#kubeconfig-generate-token) | If true, automatically generate tokens when a user downloads a kubeconfig. | @@ -72,11 +71,6 @@ These global settings affect Rancher token behavior. Time to live (TTL) duration in minutes, used to determine when a user auth session token expires. When expired, the user must log in and obtain a new token. This setting is not affected by [`auth-token-max-ttl-minutes`](#auth-token-max-ttl-minutes). Session tokens are created when a user logs into Rancher. -### auth-user-session-idle-ttl-minutes - -Time to live (TTL) without user activity for tokens controlling a login session, in minutes. -By default, the value for [`auth-user-session-idle-ttl-minutes`](#auth-user-session-idle-ttl-minutes) is be set to the same value as [`auth-user-session-ttl-minutes`](#auth-user-session-ttl-minutes) (for backward compatibility reasons), and it must never be greater than this value. - ### kubeconfig-default-token-ttl-minutes Time to live (TTL) duration in minutes, used to determine when a kubeconfig token expires. When the token is expired, the API rejects the token. This setting can't be larger than [`auth-token-max-ttl-minutes`](#auth-token-max-ttl-minutes). This setting applies to tokens generated in a requested kubeconfig file, except for tokens [generated by Rancher CLI](#disable-tokens-in-generated-kubeconfigs). As of Rancher v2.8, the default duration is `43200`, which means that tokens expire in 30 days. From e5beb733e3bc7616ca672e23c1f325498cb34fa2 Mon Sep 17 00:00:00 2001 From: Diogo Souza Date: Wed, 5 Mar 2025 18:47:45 -0300 Subject: [PATCH 08/32] fix broken link to rancher forums --- .../advanced-user-guides/istio-setup-guide/istio-setup-guide.md | 2 +- docs/integrations-in-rancher/istio/istio.md | 2 +- .../advanced-user-guides/istio-setup-guide/istio-setup-guide.md | 2 +- .../version-2.11/integrations-in-rancher/istio/istio.md | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/how-to-guides/advanced-user-guides/istio-setup-guide/istio-setup-guide.md b/docs/how-to-guides/advanced-user-guides/istio-setup-guide/istio-setup-guide.md index a489738cae2..7cf26d0ffe5 100644 --- a/docs/how-to-guides/advanced-user-guides/istio-setup-guide/istio-setup-guide.md +++ b/docs/how-to-guides/advanced-user-guides/istio-setup-guide/istio-setup-guide.md @@ -10,7 +10,7 @@ title: Istio Setup Guides [Rancher-Istio](https://github.com/rancher/charts/tree/release-v2.11/charts/rancher-istio) will be deprecated in Rancher v2.12.0; turn to the [SUSE Rancher Application Collection](https://apps.rancher.io) build of Istio for enhanced security (included in SUSE Rancher Prime subscriptions). -Detailed information can be found in [this announcement](https://forums.rancher.com/t/deprecation-of-rancher-istio/45043/1). +Detailed information can be found in [this announcement](https://forums.suse.com/t/deprecation-of-rancher-istio/45043). ::: diff --git a/docs/integrations-in-rancher/istio/istio.md b/docs/integrations-in-rancher/istio/istio.md index 9516f582f81..2792d298aa4 100644 --- a/docs/integrations-in-rancher/istio/istio.md +++ b/docs/integrations-in-rancher/istio/istio.md @@ -10,7 +10,7 @@ title: Istio [Rancher-Istio](https://github.com/rancher/charts/tree/release-v2.11/charts/rancher-istio) will be deprecated in Rancher v2.12.0; turn to the [SUSE Rancher Application Collection](https://apps.rancher.io) build of Istio for enhanced security (included in SUSE Rancher Prime subscriptions). -Detailed information can be found in [this announcement](https://forums.rancher.com/t/deprecation-of-rancher-istio/45043/1). +Detailed information can be found in [this announcement](https://forums.suse.com/t/deprecation-of-rancher-istio/45043). ::: diff --git a/versioned_docs/version-2.11/how-to-guides/advanced-user-guides/istio-setup-guide/istio-setup-guide.md b/versioned_docs/version-2.11/how-to-guides/advanced-user-guides/istio-setup-guide/istio-setup-guide.md index a489738cae2..7cf26d0ffe5 100644 --- a/versioned_docs/version-2.11/how-to-guides/advanced-user-guides/istio-setup-guide/istio-setup-guide.md +++ b/versioned_docs/version-2.11/how-to-guides/advanced-user-guides/istio-setup-guide/istio-setup-guide.md @@ -10,7 +10,7 @@ title: Istio Setup Guides [Rancher-Istio](https://github.com/rancher/charts/tree/release-v2.11/charts/rancher-istio) will be deprecated in Rancher v2.12.0; turn to the [SUSE Rancher Application Collection](https://apps.rancher.io) build of Istio for enhanced security (included in SUSE Rancher Prime subscriptions). -Detailed information can be found in [this announcement](https://forums.rancher.com/t/deprecation-of-rancher-istio/45043/1). +Detailed information can be found in [this announcement](https://forums.suse.com/t/deprecation-of-rancher-istio/45043). ::: diff --git a/versioned_docs/version-2.11/integrations-in-rancher/istio/istio.md b/versioned_docs/version-2.11/integrations-in-rancher/istio/istio.md index 9516f582f81..2792d298aa4 100644 --- a/versioned_docs/version-2.11/integrations-in-rancher/istio/istio.md +++ b/versioned_docs/version-2.11/integrations-in-rancher/istio/istio.md @@ -10,7 +10,7 @@ title: Istio [Rancher-Istio](https://github.com/rancher/charts/tree/release-v2.11/charts/rancher-istio) will be deprecated in Rancher v2.12.0; turn to the [SUSE Rancher Application Collection](https://apps.rancher.io) build of Istio for enhanced security (included in SUSE Rancher Prime subscriptions). -Detailed information can be found in [this announcement](https://forums.rancher.com/t/deprecation-of-rancher-istio/45043/1). +Detailed information can be found in [this announcement](https://forums.suse.com/t/deprecation-of-rancher-istio/45043). ::: From dc05dfb53f24cdf8c22b4155e6c1d4beea58fca7 Mon Sep 17 00:00:00 2001 From: Venkata Krishna Rohit Sakala Date: Fri, 13 Dec 2024 10:35:51 -0800 Subject: [PATCH 09/32] Remove experimental banner for OCI --- .../helm-charts-in-rancher/oci-repositories.md | 6 ------ 1 file changed, 6 deletions(-) diff --git a/docs/how-to-guides/new-user-guides/helm-charts-in-rancher/oci-repositories.md b/docs/how-to-guides/new-user-guides/helm-charts-in-rancher/oci-repositories.md index 4626e592b8d..1ccf43e4a89 100644 --- a/docs/how-to-guides/new-user-guides/helm-charts-in-rancher/oci-repositories.md +++ b/docs/how-to-guides/new-user-guides/helm-charts-in-rancher/oci-repositories.md @@ -6,12 +6,6 @@ title: Using OCI-Based Helm Chart Repositories -:::caution - -This feature is currently experimental and is not officially supported in Rancher. - -::: - Helm v3 introduced storing Helm charts as [Open Container Initiative (OCI)](https://opencontainers.org/about/overview/) artifacts in container registries. With Rancher v2.9.0, you can add [OCI-based Helm chart repositories](https://helm.sh/docs/topics/registries/) alongside HTTP-based and Git-based repositories. This means that you can deploy apps that are stored as OCI artifacts. ## Add an OCI-Based Helm Chart Repository From edbc6eb35e804f399818ae0c8ec8433238c012a3 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Thu, 6 Mar 2025 11:38:11 -0800 Subject: [PATCH 10/32] Apply dc05dfb5 (Remove experimental banner for OCI) to version-2.11 --- .../helm-charts-in-rancher/oci-repositories.md | 6 ------ 1 file changed, 6 deletions(-) diff --git a/versioned_docs/version-2.11/how-to-guides/new-user-guides/helm-charts-in-rancher/oci-repositories.md b/versioned_docs/version-2.11/how-to-guides/new-user-guides/helm-charts-in-rancher/oci-repositories.md index 4626e592b8d..1ccf43e4a89 100644 --- a/versioned_docs/version-2.11/how-to-guides/new-user-guides/helm-charts-in-rancher/oci-repositories.md +++ b/versioned_docs/version-2.11/how-to-guides/new-user-guides/helm-charts-in-rancher/oci-repositories.md @@ -6,12 +6,6 @@ title: Using OCI-Based Helm Chart Repositories -:::caution - -This feature is currently experimental and is not officially supported in Rancher. - -::: - Helm v3 introduced storing Helm charts as [Open Container Initiative (OCI)](https://opencontainers.org/about/overview/) artifacts in container registries. With Rancher v2.9.0, you can add [OCI-based Helm chart repositories](https://helm.sh/docs/topics/registries/) alongside HTTP-based and Git-based repositories. This means that you can deploy apps that are stored as OCI artifacts. ## Add an OCI-Based Helm Chart Repository From f7f3bbd5abbd8da25e8dbf4d82b5a9d6ba54d891 Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Tue, 11 Mar 2025 16:32:48 -0700 Subject: [PATCH 11/32] Adding note to PSA template on users handling policy exemptions, tied to Rancher docs issue 1632. Signed-off-by: Sunil Singh --- .../psa-config-templates.md | 4 ++++ .../psa-config-templates.md | 4 ++++ .../psa-config-templates.md | 4 ++++ .../psa-config-templates.md | 4 ++++ .../psa-config-templates.md | 4 ++++ .../psa-config-templates.md | 4 ++++ .../psa-config-templates.md | 4 ++++ .../psa-config-templates.md | 4 ++++ .../psa-config-templates.md | 4 ++++ .../psa-config-templates.md | 4 ++++ .../psa-config-templates.md | 4 ++++ .../psa-config-templates.md | 4 ++++ 12 files changed, 48 insertions(+) diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md index 963bebfd316..67949dbbff4 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md @@ -8,6 +8,10 @@ title: Pod Security Admission (PSA) Configuration Templates [Pod Security admission (PSA)](./pod-security-standards.md) configuration templates are a Rancher custom-defined resource (CRD), available in Rancher v2.7.2 and above. The templates provide pre-defined security configurations that you can apply to a cluster: +:::info important +The policies shipped by default in Rancher aim to provide a trade-off between security and convenience. If a more strict policy configuration is needed, users are able to craft such policies themselves based on their specific requirements. In the case Rancher policies are preferred, you will need to deploy admission controllers that block the creation of any [exempted namespaces](#exempting-required-rancher-namespaces) that won't be used within your environments. +::: + - `rancher-privileged`: The most permissive configuration. It doesn't restrict the behavior of any pods. This allows for known privilege escalations. This policy has no exemptions. - `rancher-restricted`: A heavily restricted configuration that follows current best practices for hardening pods. You must make [namespace-level exemptions](./pod-security-standards.md#rancher-on-psa-restricted-clusters) for Rancher components. diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md b/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md index 5089f8e11d7..e38b0fd3113 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md +++ b/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md @@ -4,6 +4,10 @@ title: Pod 安全准入 (PSA) 配置模板 [Pod Security admission (PSA)](./pod-security-standards.md) 配置模板是 Rancher 自定义资源 (CRD)，在 Rancher v2.7.2 及更高版本中可用。这些模板提供了可应用于集群的预定义安全配置： +:::info important +The policies shipped by default in Rancher aim to provide a trade-off between security and convenience. If a more strict policy configuration is needed, users are able to craft such policies themselves based on their specific requirements. In the case Rancher policies are preferred, you will need to deploy admission controllers that block the creation of any [exempted namespaces](#豁免必须的-rancher-命名空间) that won't be used within your environments. +::: + - `rancher-privileged`：最宽松的配置。它不限制任何 Pod 行为，允许已知的权限升级。该策略没有豁免。 - `rancher-restricted`：严格限制的配置，遵循当前加固 pod 的最佳实践。你必须对 Rancher 组件进行[命名空间级别豁免](./pod-security-standards.md#受-psa-限制的集群上的-rancher)。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md index 5089f8e11d7..e38b0fd3113 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md @@ -4,6 +4,10 @@ title: Pod 安全准入 (PSA) 配置模板 [Pod Security admission (PSA)](./pod-security-standards.md) 配置模板是 Rancher 自定义资源 (CRD)，在 Rancher v2.7.2 及更高版本中可用。这些模板提供了可应用于集群的预定义安全配置： +:::info important +The policies shipped by default in Rancher aim to provide a trade-off between security and convenience. If a more strict policy configuration is needed, users are able to craft such policies themselves based on their specific requirements. In the case Rancher policies are preferred, you will need to deploy admission controllers that block the creation of any [exempted namespaces](#豁免必须的-rancher-命名空间) that won't be used within your environments. +::: + - `rancher-privileged`：最宽松的配置。它不限制任何 Pod 行为，允许已知的权限升级。该策略没有豁免。 - `rancher-restricted`：严格限制的配置，遵循当前加固 pod 的最佳实践。你必须对 Rancher 组件进行[命名空间级别豁免](./pod-security-standards.md#受-psa-限制的集群上的-rancher)。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md index 5089f8e11d7..e38b0fd3113 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md @@ -4,6 +4,10 @@ title: Pod 安全准入 (PSA) 配置模板 [Pod Security admission (PSA)](./pod-security-standards.md) 配置模板是 Rancher 自定义资源 (CRD)，在 Rancher v2.7.2 及更高版本中可用。这些模板提供了可应用于集群的预定义安全配置： +:::info important +The policies shipped by default in Rancher aim to provide a trade-off between security and convenience. If a more strict policy configuration is needed, users are able to craft such policies themselves based on their specific requirements. In the case Rancher policies are preferred, you will need to deploy admission controllers that block the creation of any [exempted namespaces](#豁免必须的-rancher-命名空间) that won't be used within your environments. +::: + - `rancher-privileged`：最宽松的配置。它不限制任何 Pod 行为，允许已知的权限升级。该策略没有豁免。 - `rancher-restricted`：严格限制的配置，遵循当前加固 pod 的最佳实践。你必须对 Rancher 组件进行[命名空间级别豁免](./pod-security-standards.md#受-psa-限制的集群上的-rancher)。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md index c3b4d6252f4..2b99324f266 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md @@ -4,6 +4,10 @@ title: Pod 安全准入 (PSA) 配置模板 [Pod Security admission (PSA)](./pod-security-standards.md) 配置模板是 Rancher 自定义资源 (CRD)，在 Rancher v2.7.2 及更高版本中可用。这些模板提供了可应用于集群的预定义安全配置： +:::info important +The policies shipped by default in Rancher aim to provide a trade-off between security and convenience. If a more strict policy configuration is needed, users are able to craft such policies themselves based on their specific requirements. In the case Rancher policies are preferred, you will need to deploy admission controllers that block the creation of any [exempted namespaces](#豁免必须的-rancher-命名空间) that won't be used within your environments. +::: + - `rancher-privileged`：最宽松的配置。它不限制任何 Pod 行为，允许已知的权限升级。该策略没有豁免。 - `rancher-restricted`：严格限制的配置，遵循当前加固 pod 的最佳实践。你必须对 Rancher 组件进行[命名空间级别豁免](./pod-security-standards.md#受-psa-限制的集群上的-rancher)。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md index 5089f8e11d7..e38b0fd3113 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md @@ -4,6 +4,10 @@ title: Pod 安全准入 (PSA) 配置模板 [Pod Security admission (PSA)](./pod-security-standards.md) 配置模板是 Rancher 自定义资源 (CRD)，在 Rancher v2.7.2 及更高版本中可用。这些模板提供了可应用于集群的预定义安全配置： +:::info important +The policies shipped by default in Rancher aim to provide a trade-off between security and convenience. If a more strict policy configuration is needed, users are able to craft such policies themselves based on their specific requirements. In the case Rancher policies are preferred, you will need to deploy admission controllers that block the creation of any [exempted namespaces](#豁免必须的-rancher-命名空间) that won't be used within your environments. +::: + - `rancher-privileged`：最宽松的配置。它不限制任何 Pod 行为，允许已知的权限升级。该策略没有豁免。 - `rancher-restricted`：严格限制的配置，遵循当前加固 pod 的最佳实践。你必须对 Rancher 组件进行[命名空间级别豁免](./pod-security-standards.md#受-psa-限制的集群上的-rancher)。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md index c3b4d6252f4..2b99324f266 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md @@ -4,6 +4,10 @@ title: Pod 安全准入 (PSA) 配置模板 [Pod Security admission (PSA)](./pod-security-standards.md) 配置模板是 Rancher 自定义资源 (CRD)，在 Rancher v2.7.2 及更高版本中可用。这些模板提供了可应用于集群的预定义安全配置： +:::info important +The policies shipped by default in Rancher aim to provide a trade-off between security and convenience. If a more strict policy configuration is needed, users are able to craft such policies themselves based on their specific requirements. In the case Rancher policies are preferred, you will need to deploy admission controllers that block the creation of any [exempted namespaces](#豁免必须的-rancher-命名空间) that won't be used within your environments. +::: + - `rancher-privileged`：最宽松的配置。它不限制任何 Pod 行为，允许已知的权限升级。该策略没有豁免。 - `rancher-restricted`：严格限制的配置，遵循当前加固 pod 的最佳实践。你必须对 Rancher 组件进行[命名空间级别豁免](./pod-security-standards.md#受-psa-限制的集群上的-rancher)。 diff --git a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md index 963bebfd316..67949dbbff4 100644 --- a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md +++ b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md @@ -8,6 +8,10 @@ title: Pod Security Admission (PSA) Configuration Templates [Pod Security admission (PSA)](./pod-security-standards.md) configuration templates are a Rancher custom-defined resource (CRD), available in Rancher v2.7.2 and above. The templates provide pre-defined security configurations that you can apply to a cluster: +:::info important +The policies shipped by default in Rancher aim to provide a trade-off between security and convenience. If a more strict policy configuration is needed, users are able to craft such policies themselves based on their specific requirements. In the case Rancher policies are preferred, you will need to deploy admission controllers that block the creation of any [exempted namespaces](#exempting-required-rancher-namespaces) that won't be used within your environments. +::: + - `rancher-privileged`: The most permissive configuration. It doesn't restrict the behavior of any pods. This allows for known privilege escalations. This policy has no exemptions. - `rancher-restricted`: A heavily restricted configuration that follows current best practices for hardening pods. You must make [namespace-level exemptions](./pod-security-standards.md#rancher-on-psa-restricted-clusters) for Rancher components. diff --git a/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md b/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md index 963bebfd316..67949dbbff4 100644 --- a/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md +++ b/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md @@ -8,6 +8,10 @@ title: Pod Security Admission (PSA) Configuration Templates [Pod Security admission (PSA)](./pod-security-standards.md) configuration templates are a Rancher custom-defined resource (CRD), available in Rancher v2.7.2 and above. The templates provide pre-defined security configurations that you can apply to a cluster: +:::info important +The policies shipped by default in Rancher aim to provide a trade-off between security and convenience. If a more strict policy configuration is needed, users are able to craft such policies themselves based on their specific requirements. In the case Rancher policies are preferred, you will need to deploy admission controllers that block the creation of any [exempted namespaces](#exempting-required-rancher-namespaces) that won't be used within your environments. +::: + - `rancher-privileged`: The most permissive configuration. It doesn't restrict the behavior of any pods. This allows for known privilege escalations. This policy has no exemptions. - `rancher-restricted`: A heavily restricted configuration that follows current best practices for hardening pods. You must make [namespace-level exemptions](./pod-security-standards.md#rancher-on-psa-restricted-clusters) for Rancher components. diff --git a/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md b/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md index 963bebfd316..67949dbbff4 100644 --- a/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md +++ b/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md @@ -8,6 +8,10 @@ title: Pod Security Admission (PSA) Configuration Templates [Pod Security admission (PSA)](./pod-security-standards.md) configuration templates are a Rancher custom-defined resource (CRD), available in Rancher v2.7.2 and above. The templates provide pre-defined security configurations that you can apply to a cluster: +:::info important +The policies shipped by default in Rancher aim to provide a trade-off between security and convenience. If a more strict policy configuration is needed, users are able to craft such policies themselves based on their specific requirements. In the case Rancher policies are preferred, you will need to deploy admission controllers that block the creation of any [exempted namespaces](#exempting-required-rancher-namespaces) that won't be used within your environments. +::: + - `rancher-privileged`: The most permissive configuration. It doesn't restrict the behavior of any pods. This allows for known privilege escalations. This policy has no exemptions. - `rancher-restricted`: A heavily restricted configuration that follows current best practices for hardening pods. You must make [namespace-level exemptions](./pod-security-standards.md#rancher-on-psa-restricted-clusters) for Rancher components. diff --git a/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md b/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md index 18b869c600b..2b02b9abfc2 100644 --- a/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md +++ b/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md @@ -8,6 +8,10 @@ title: Pod Security Admission (PSA) Configuration Templates [Pod Security admission (PSA)](./pod-security-standards.md) configuration templates are a Rancher custom-defined resource (CRD), available in Rancher v2.7.2 and above. The templates provide pre-defined security configurations that you can apply to a cluster: +:::info important +The policies shipped by default in Rancher aim to provide a trade-off between security and convenience. If a more strict policy configuration is needed, users are able to craft such policies themselves based on their specific requirements. In the case Rancher policies are preferred, you will need to deploy admission controllers that block the creation of any [exempted namespaces](#exempting-required-rancher-namespaces) that won't be used within your environments. +::: + - `rancher-privileged`: The most permissive configuration. It doesn't restrict the behavior of any pods. This allows for known privilege escalations. This policy has no exemptions. - `rancher-restricted`: A heavily restricted configuration that follows current best practices for hardening pods. You must make [namespace-level exemptions](./pod-security-standards.md#rancher-on-psa-restricted-clusters) for Rancher components. diff --git a/versioned_docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md b/versioned_docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md index 963bebfd316..67949dbbff4 100644 --- a/versioned_docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md +++ b/versioned_docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md @@ -8,6 +8,10 @@ title: Pod Security Admission (PSA) Configuration Templates [Pod Security admission (PSA)](./pod-security-standards.md) configuration templates are a Rancher custom-defined resource (CRD), available in Rancher v2.7.2 and above. The templates provide pre-defined security configurations that you can apply to a cluster: +:::info important +The policies shipped by default in Rancher aim to provide a trade-off between security and convenience. If a more strict policy configuration is needed, users are able to craft such policies themselves based on their specific requirements. In the case Rancher policies are preferred, you will need to deploy admission controllers that block the creation of any [exempted namespaces](#exempting-required-rancher-namespaces) that won't be used within your environments. +::: + - `rancher-privileged`: The most permissive configuration. It doesn't restrict the behavior of any pods. This allows for known privilege escalations. This policy has no exemptions. - `rancher-restricted`: A heavily restricted configuration that follows current best practices for hardening pods. You must make [namespace-level exemptions](./pod-security-standards.md#rancher-on-psa-restricted-clusters) for Rancher components. From b5c2511793ff48a723c4e06c917e53ec7b60d262 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Thu, 13 Mar 2025 14:02:46 -0700 Subject: [PATCH 12/32] Remove restricted admin references --- .../installation-and-upgrade.md | 2 - .../helm-chart-options.md | 1 - .../global-permissions.md | 80 +------------------ .../manage-cluster-templates.md | 6 -- ...and-best-practices-for-rancher-at-scale.md | 2 - .../installation-and-upgrade.md | 2 - .../helm-chart-options.md | 1 - .../global-permissions.md | 80 +------------------ .../manage-cluster-templates.md | 6 -- ...and-best-practices-for-rancher-at-scale.md | 2 - 10 files changed, 2 insertions(+), 180 deletions(-) diff --git a/docs/getting-started/installation-and-upgrade/installation-and-upgrade.md b/docs/getting-started/installation-and-upgrade/installation-and-upgrade.md index 6a930db2b05..3a2a15d644d 100644 --- a/docs/getting-started/installation-and-upgrade/installation-and-upgrade.md +++ b/docs/getting-started/installation-and-upgrade/installation-and-upgrade.md @@ -18,8 +18,6 @@ In this section, - **K3s (Lightweight Kubernetes)** is also a fully compliant Kubernetes distribution. It is newer than RKE, easier to use, and more lightweight, with a binary size of less than 100 MB. - **RKE2** is a fully conformant Kubernetes distribution that focuses on security and compliance within the U.S. Federal Government sector. -Note the `restrictedAdmin` Helm chart option available for **the Rancher Server**. When this option is set to true, the initial Rancher user has restricted access to the local Kubernetes cluster to prevent privilege escalation. For more information, see the section about the [restricted-admin role.](../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md#restricted-admin) - ## Overview of Installation Options Rancher can be installed on these main architectures: diff --git a/docs/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md b/docs/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md index d84c4e70792..ae3d62a426c 100644 --- a/docs/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md +++ b/docs/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md @@ -59,7 +59,6 @@ For information on enabling experimental features, refer to [this page.](../../. | `rancherImageTag` | same as chart version | `string` - rancher/rancher image tag | | `replicas` | 3 | `int` - Number of Rancher server replicas. Setting to -1 will dynamically choose 1, 2, or 3 based on the number of available nodes in the cluster. | | `resources` | {} | `map` - rancher pod resource requests & limits | -| `restrictedAdmin` | `false` | `bool` - When this option is set to `true`, the initial Rancher user has restricted access to the local Kubernetes cluster to prevent privilege escalation. For more information, see the section about the [restricted-admin role](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md#restricted-admin). | | `systemDefaultRegistry` | "" | `string` - private registry to be used for all system container images, e.g., http://registry.example.com/ | | `tls` | "ingress" | `string` - See [External TLS Termination](#external-tls-termination) for details. - "ingress, external" | | `useBundledSystemChart` | `false` | `bool` - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations. | diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md index f08099bfba4..19e9ee261f8 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md @@ -8,12 +8,10 @@ title: Global Permissions _Permissions_ are individual access rights that you can assign when selecting a custom permission for a user. -Global Permissions define user authorization outside the scope of any particular cluster. Out-of-the-box, there are four default global permissions: `Administrator`, `Restricted Admin`,`Standard User` and `User-base`. +Global Permissions define user authorization outside the scope of any particular cluster. Out-of-the-box, there are four default global permissions: `Administrator`, `Standard User` and `User-base`. - **Administrator:** These users have full control over the entire Rancher system and all clusters within it. -- **Restricted Admin (Deprecated) :** These users have full control over downstream clusters, but cannot alter the local Kubernetes cluster. - - **Standard User:** These users can create new clusters and use them. Standard users can also assign other users permissions to their clusters. - **User-Base:** User-Base users have login-access only. @@ -286,79 +284,3 @@ To refresh group memberships, 1. Click **Refresh Group Memberships**. **Result:** Any changes to the group members' permissions will take effect. - -## Restricted Admin - -:::warning Deprecated - -The Restricted Admin role is deprecated, and will be removed in a future version of Rancher (2.10 or higher). You should make a custom role with the desired permissions instead of relying on this built-in role. - -::: - -A new `restricted-admin` role was created in Rancher v2.5 in order to prevent privilege escalation on the local Rancher server Kubernetes cluster. This role has full administrator access to all downstream clusters managed by Rancher, but it does not have permission to alter the local Kubernetes cluster. - -The `restricted-admin` can create other `restricted-admin` users with an equal level of access. - -A new setting was added to Rancher to set the initial bootstrapped administrator to have the `restricted-admin` role. This applies to the first user created when the Rancher server is started for the first time. If the environment variable is set, then no global administrator would be created, and it would be impossible to create the global administrator through Rancher. - -To bootstrap Rancher with the `restricted-admin` as the initial user, the Rancher server should be started with the following environment variable: - -``` -CATTLE_RESTRICTED_DEFAULT_ADMIN=true -``` -### List of `restricted-admin` Permissions - -The following table lists the permissions and actions that a `restricted-admin` should have in comparison with the `Administrator` and `Standard User` roles: - -| Category | Action | Global Admin | Standard User | Restricted Admin | Notes for Restricted Admin role | -| -------- | ------ | ------------ | ------------- | ---------------- | ------------------------------- | -| Local Cluster functions | Manage Local Cluster (List, Edit, Import Host) | Yes | No | No | | -| | Create Projects/namespaces | Yes | No | No | | -| | Add cluster/project members | Yes | No | No | | -| | Global DNS | Yes | No | No | | -| | Access to management cluster for CRDs and CRs | Yes | No | Yes | | -| | Save as RKE Template | Yes | No | No | | -| Security | | | | | | -| Enable auth | Configure Authentication | Yes | No | Yes | | -| Roles | Create/Assign GlobalRoles | Yes | No (Can list) | Yes | Auth webhook allows creating globalrole for perms already present | -| | Create/Assign ClusterRoles | Yes | No (Can list) | Yes | Not in local cluster | -| | Create/Assign ProjectRoles | Yes | No (Can list) | Yes | Not in local cluster | -| Users | Add User/Edit/Delete/Deactivate User | Yes | No | Yes | | -| Groups | Assign Global role to groups | Yes | No | Yes | As allowed by the webhook | -| | Refresh Groups | Yes | No | Yes | | -| PSP's | Manage PSP templates | Yes | No (Can list) | Yes | Same privileges as Global Admin for PSPs | -| Tools | | | | | | -| | Manage RKE Templates | Yes | No | Yes | | -| | Manage Global Catalogs | Yes | No | Yes | Cannot edit/delete built-in system catalog. Can manage Helm library | -| | Cluster Drivers | Yes | No | Yes | | -| | Node Drivers | Yes | No | Yes | | -| | GlobalDNS Providers | Yes | Yes (Self) | Yes | | -| | GlobalDNS Entries | Yes | Yes (Self) | Yes | | -| Settings | | | | | | -| | Manage Settings | Yes | No (Can list) | No (Can list) | | -| User | | | | | | -| | Manage API Keys | Yes (Manage all) | Yes (Manage self) | Yes (Manage self) | | -| | Manage Node Templates | Yes | Yes (Manage self) | Yes (Manage self) | Can only manage their own node templates and not those created by other users | -| | Manage Cloud Credentials | Yes | Yes (Manage self) | Yes (Manage self) | Can only manage their own cloud credentials and not those created by other users | -| Downstream Cluster | Create Cluster | Yes | Yes | Yes | | -| | Edit Cluster | Yes | Yes | Yes | | -| | Rotate Certificates | Yes | | Yes | | -| | Snapshot Now | Yes | | Yes | | -| | Restore Snapshot | Yes | | Yes | | -| | Save as RKE Template | Yes | No | Yes | | -| | Run CIS Scan | Yes | Yes | Yes | | -| | Add Members | Yes | Yes | Yes | | -| | Create Projects | Yes | Yes | Yes | | -| Feature Charts since v2.5 | | | | | | -| | Install Fleet | Yes | | Yes | Should not be able to run Fleet in local cluster | -| | Deploy EKS cluster | Yes | Yes | Yes | | -| | Deploy GKE cluster | Yes | Yes | Yes | | -| | Deploy AKS cluster | Yes | Yes | Yes | | - -### Changing Global Administrators to Restricted Admins - -In previous version, the docs recommended that all users should be changed over to Restricted Admin if the role was in use. Users are now encouraged to use a custom-built role using the cluster permissions feature, and migrate any current restricted admins to use that approach. - -This can be done through **Security > Users** and moving any Administrator role over to Restricted Administrator. - -Signed-in users can change themselves over to the `restricted-admin` if they wish, but they should only do that as the last step, otherwise they won't have the permissions to do so. diff --git a/docs/how-to-guides/new-user-guides/manage-clusters/manage-cluster-templates.md b/docs/how-to-guides/new-user-guides/manage-clusters/manage-cluster-templates.md index 0d4b15bc48c..83bf07410b2 100644 --- a/docs/how-to-guides/new-user-guides/manage-clusters/manage-cluster-templates.md +++ b/docs/how-to-guides/new-user-guides/manage-clusters/manage-cluster-templates.md @@ -52,12 +52,6 @@ In this section, you'll learn how to add the cluster template to the `local` clu **Result:** The cluster template available from the **Apps** in Rancher's `local` cluster. It can now be used to deploy clusters. -:::note Restricted Admin access: - -If you are a restricted admin and don’t have access to the `local` cluster, you may still add new RKE2 templates and manage cluster repositories. To navigate to the chart repository, go to the left navigation bar and click **☰ > Cluster Management > Advanced > Repositories**. You will bypass steps 1 - 6 above, then proceed to follow steps 7 - 12 to create the cluster template. - -::: - ## Creating a Cluster from a Cluster Template :::note Prerequisites: diff --git a/docs/reference-guides/best-practices/rancher-server/tuning-and-best-practices-for-rancher-at-scale.md b/docs/reference-guides/best-practices/rancher-server/tuning-and-best-practices-for-rancher-at-scale.md index 07dd8265986..55deb80c8d3 100644 --- a/docs/reference-guides/best-practices/rancher-server/tuning-and-best-practices-for-rancher-at-scale.md +++ b/docs/reference-guides/best-practices/rancher-server/tuning-and-best-practices-for-rancher-at-scale.md @@ -48,7 +48,6 @@ Etcd is the backing database for Kubernetes and for Rancher. The database may ev This is typical in Rancher, as many operations create new `RoleBinding` objects in the upstream cluster as a side effect. You can reduce the number of `RoleBindings` in the upstream cluster in the following ways: -* Limit the use of the [Restricted Admin](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md#restricted-admin) role. Apply other roles wherever possible. * Only add users to clusters and projects when necessary. * Remove clusters and projects when they are no longer needed. * Only use custom roles if necessary. @@ -73,7 +72,6 @@ Predicting how many `RoleBinding` objects a given configuration will create is c * `Ua` is the average number of users with a membership on a cluster. * `P` is the total number of projects. * `Pa` is the average number of users with a membership on a project. -* The Restricted Admin role follows a different formula, as every user with this role results in at least `7C + 2P + 2` additional `RoleBinding` objects. * The number of `RoleBindings` increases linearly with the number of clusters, projects, and users. ### Using New Apps Over Legacy Apps diff --git a/versioned_docs/version-2.11/getting-started/installation-and-upgrade/installation-and-upgrade.md b/versioned_docs/version-2.11/getting-started/installation-and-upgrade/installation-and-upgrade.md index 6a930db2b05..3a2a15d644d 100644 --- a/versioned_docs/version-2.11/getting-started/installation-and-upgrade/installation-and-upgrade.md +++ b/versioned_docs/version-2.11/getting-started/installation-and-upgrade/installation-and-upgrade.md @@ -18,8 +18,6 @@ In this section, - **K3s (Lightweight Kubernetes)** is also a fully compliant Kubernetes distribution. It is newer than RKE, easier to use, and more lightweight, with a binary size of less than 100 MB. - **RKE2** is a fully conformant Kubernetes distribution that focuses on security and compliance within the U.S. Federal Government sector. -Note the `restrictedAdmin` Helm chart option available for **the Rancher Server**. When this option is set to true, the initial Rancher user has restricted access to the local Kubernetes cluster to prevent privilege escalation. For more information, see the section about the [restricted-admin role.](../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md#restricted-admin) - ## Overview of Installation Options Rancher can be installed on these main architectures: diff --git a/versioned_docs/version-2.11/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md b/versioned_docs/version-2.11/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md index d84c4e70792..ae3d62a426c 100644 --- a/versioned_docs/version-2.11/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md +++ b/versioned_docs/version-2.11/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md @@ -59,7 +59,6 @@ For information on enabling experimental features, refer to [this page.](../../. | `rancherImageTag` | same as chart version | `string` - rancher/rancher image tag | | `replicas` | 3 | `int` - Number of Rancher server replicas. Setting to -1 will dynamically choose 1, 2, or 3 based on the number of available nodes in the cluster. | | `resources` | {} | `map` - rancher pod resource requests & limits | -| `restrictedAdmin` | `false` | `bool` - When this option is set to `true`, the initial Rancher user has restricted access to the local Kubernetes cluster to prevent privilege escalation. For more information, see the section about the [restricted-admin role](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md#restricted-admin). | | `systemDefaultRegistry` | "" | `string` - private registry to be used for all system container images, e.g., http://registry.example.com/ | | `tls` | "ingress" | `string` - See [External TLS Termination](#external-tls-termination) for details. - "ingress, external" | | `useBundledSystemChart` | `false` | `bool` - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations. | diff --git a/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md b/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md index f08099bfba4..19e9ee261f8 100644 --- a/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md +++ b/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md @@ -8,12 +8,10 @@ title: Global Permissions _Permissions_ are individual access rights that you can assign when selecting a custom permission for a user. -Global Permissions define user authorization outside the scope of any particular cluster. Out-of-the-box, there are four default global permissions: `Administrator`, `Restricted Admin`,`Standard User` and `User-base`. +Global Permissions define user authorization outside the scope of any particular cluster. Out-of-the-box, there are four default global permissions: `Administrator`, `Standard User` and `User-base`. - **Administrator:** These users have full control over the entire Rancher system and all clusters within it. -- **Restricted Admin (Deprecated) :** These users have full control over downstream clusters, but cannot alter the local Kubernetes cluster. - - **Standard User:** These users can create new clusters and use them. Standard users can also assign other users permissions to their clusters. - **User-Base:** User-Base users have login-access only. @@ -286,79 +284,3 @@ To refresh group memberships, 1. Click **Refresh Group Memberships**. **Result:** Any changes to the group members' permissions will take effect. - -## Restricted Admin - -:::warning Deprecated - -The Restricted Admin role is deprecated, and will be removed in a future version of Rancher (2.10 or higher). You should make a custom role with the desired permissions instead of relying on this built-in role. - -::: - -A new `restricted-admin` role was created in Rancher v2.5 in order to prevent privilege escalation on the local Rancher server Kubernetes cluster. This role has full administrator access to all downstream clusters managed by Rancher, but it does not have permission to alter the local Kubernetes cluster. - -The `restricted-admin` can create other `restricted-admin` users with an equal level of access. - -A new setting was added to Rancher to set the initial bootstrapped administrator to have the `restricted-admin` role. This applies to the first user created when the Rancher server is started for the first time. If the environment variable is set, then no global administrator would be created, and it would be impossible to create the global administrator through Rancher. - -To bootstrap Rancher with the `restricted-admin` as the initial user, the Rancher server should be started with the following environment variable: - -``` -CATTLE_RESTRICTED_DEFAULT_ADMIN=true -``` -### List of `restricted-admin` Permissions - -The following table lists the permissions and actions that a `restricted-admin` should have in comparison with the `Administrator` and `Standard User` roles: - -| Category | Action | Global Admin | Standard User | Restricted Admin | Notes for Restricted Admin role | -| -------- | ------ | ------------ | ------------- | ---------------- | ------------------------------- | -| Local Cluster functions | Manage Local Cluster (List, Edit, Import Host) | Yes | No | No | | -| | Create Projects/namespaces | Yes | No | No | | -| | Add cluster/project members | Yes | No | No | | -| | Global DNS | Yes | No | No | | -| | Access to management cluster for CRDs and CRs | Yes | No | Yes | | -| | Save as RKE Template | Yes | No | No | | -| Security | | | | | | -| Enable auth | Configure Authentication | Yes | No | Yes | | -| Roles | Create/Assign GlobalRoles | Yes | No (Can list) | Yes | Auth webhook allows creating globalrole for perms already present | -| | Create/Assign ClusterRoles | Yes | No (Can list) | Yes | Not in local cluster | -| | Create/Assign ProjectRoles | Yes | No (Can list) | Yes | Not in local cluster | -| Users | Add User/Edit/Delete/Deactivate User | Yes | No | Yes | | -| Groups | Assign Global role to groups | Yes | No | Yes | As allowed by the webhook | -| | Refresh Groups | Yes | No | Yes | | -| PSP's | Manage PSP templates | Yes | No (Can list) | Yes | Same privileges as Global Admin for PSPs | -| Tools | | | | | | -| | Manage RKE Templates | Yes | No | Yes | | -| | Manage Global Catalogs | Yes | No | Yes | Cannot edit/delete built-in system catalog. Can manage Helm library | -| | Cluster Drivers | Yes | No | Yes | | -| | Node Drivers | Yes | No | Yes | | -| | GlobalDNS Providers | Yes | Yes (Self) | Yes | | -| | GlobalDNS Entries | Yes | Yes (Self) | Yes | | -| Settings | | | | | | -| | Manage Settings | Yes | No (Can list) | No (Can list) | | -| User | | | | | | -| | Manage API Keys | Yes (Manage all) | Yes (Manage self) | Yes (Manage self) | | -| | Manage Node Templates | Yes | Yes (Manage self) | Yes (Manage self) | Can only manage their own node templates and not those created by other users | -| | Manage Cloud Credentials | Yes | Yes (Manage self) | Yes (Manage self) | Can only manage their own cloud credentials and not those created by other users | -| Downstream Cluster | Create Cluster | Yes | Yes | Yes | | -| | Edit Cluster | Yes | Yes | Yes | | -| | Rotate Certificates | Yes | | Yes | | -| | Snapshot Now | Yes | | Yes | | -| | Restore Snapshot | Yes | | Yes | | -| | Save as RKE Template | Yes | No | Yes | | -| | Run CIS Scan | Yes | Yes | Yes | | -| | Add Members | Yes | Yes | Yes | | -| | Create Projects | Yes | Yes | Yes | | -| Feature Charts since v2.5 | | | | | | -| | Install Fleet | Yes | | Yes | Should not be able to run Fleet in local cluster | -| | Deploy EKS cluster | Yes | Yes | Yes | | -| | Deploy GKE cluster | Yes | Yes | Yes | | -| | Deploy AKS cluster | Yes | Yes | Yes | | - -### Changing Global Administrators to Restricted Admins - -In previous version, the docs recommended that all users should be changed over to Restricted Admin if the role was in use. Users are now encouraged to use a custom-built role using the cluster permissions feature, and migrate any current restricted admins to use that approach. - -This can be done through **Security > Users** and moving any Administrator role over to Restricted Administrator. - -Signed-in users can change themselves over to the `restricted-admin` if they wish, but they should only do that as the last step, otherwise they won't have the permissions to do so. diff --git a/versioned_docs/version-2.11/how-to-guides/new-user-guides/manage-clusters/manage-cluster-templates.md b/versioned_docs/version-2.11/how-to-guides/new-user-guides/manage-clusters/manage-cluster-templates.md index 0d4b15bc48c..83bf07410b2 100644 --- a/versioned_docs/version-2.11/how-to-guides/new-user-guides/manage-clusters/manage-cluster-templates.md +++ b/versioned_docs/version-2.11/how-to-guides/new-user-guides/manage-clusters/manage-cluster-templates.md @@ -52,12 +52,6 @@ In this section, you'll learn how to add the cluster template to the `local` clu **Result:** The cluster template available from the **Apps** in Rancher's `local` cluster. It can now be used to deploy clusters. -:::note Restricted Admin access: - -If you are a restricted admin and don’t have access to the `local` cluster, you may still add new RKE2 templates and manage cluster repositories. To navigate to the chart repository, go to the left navigation bar and click **☰ > Cluster Management > Advanced > Repositories**. You will bypass steps 1 - 6 above, then proceed to follow steps 7 - 12 to create the cluster template. - -::: - ## Creating a Cluster from a Cluster Template :::note Prerequisites: diff --git a/versioned_docs/version-2.11/reference-guides/best-practices/rancher-server/tuning-and-best-practices-for-rancher-at-scale.md b/versioned_docs/version-2.11/reference-guides/best-practices/rancher-server/tuning-and-best-practices-for-rancher-at-scale.md index 07dd8265986..55deb80c8d3 100644 --- a/versioned_docs/version-2.11/reference-guides/best-practices/rancher-server/tuning-and-best-practices-for-rancher-at-scale.md +++ b/versioned_docs/version-2.11/reference-guides/best-practices/rancher-server/tuning-and-best-practices-for-rancher-at-scale.md @@ -48,7 +48,6 @@ Etcd is the backing database for Kubernetes and for Rancher. The database may ev This is typical in Rancher, as many operations create new `RoleBinding` objects in the upstream cluster as a side effect. You can reduce the number of `RoleBindings` in the upstream cluster in the following ways: -* Limit the use of the [Restricted Admin](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md#restricted-admin) role. Apply other roles wherever possible. * Only add users to clusters and projects when necessary. * Remove clusters and projects when they are no longer needed. * Only use custom roles if necessary. @@ -73,7 +72,6 @@ Predicting how many `RoleBinding` objects a given configuration will create is c * `Ua` is the average number of users with a membership on a cluster. * `P` is the total number of projects. * `Pa` is the average number of users with a membership on a project. -* The Restricted Admin role follows a different formula, as every user with this role results in at least `7C + 2P + 2` additional `RoleBinding` objects. * The number of `RoleBindings` increases linearly with the number of clusters, projects, and users. ### Using New Apps Over Legacy Apps From 691629015521c3730f6e8be98574dbbefa443369 Mon Sep 17 00:00:00 2001 From: Jiaqi Luo Date: Fri, 14 Mar 2025 16:09:53 -0700 Subject: [PATCH 13/32] new feature in 2.11: imported cluster version management --- .../register-existing-clusters.md | 53 +++++++++++++------ .../register-existing-clusters.md | 53 +++++++++++++------ 2 files changed, 74 insertions(+), 32 deletions(-) diff --git a/docs/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/register-existing-clusters.md b/docs/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/register-existing-clusters.md index b38111027d0..5574028f050 100644 --- a/docs/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/register-existing-clusters.md +++ b/docs/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/register-existing-clusters.md @@ -31,13 +31,13 @@ kubectl create clusterrolebinding cluster-admin-binding \ Since, by default, Google Kubernetes Engine (GKE) doesn't grant the `cluster-admin` role, you must run these commands on GKE clusters before you can register them. To learn more about role-based access control for GKE, please see [the official Google documentation](https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control). -### Elastic Kubernetes Service (EKS), Azure Kubernetes Service (AKS), and Google Kubernetes Engine (GKE) +### Elastic Kubernetes Service (EKS), Azure Kubernetes Service (AKS), and Google Kubernetes Engine (GKE) -To successfully import or provision EKS, AKS, and GKE clusters from Rancher, the cluster must have at least one managed node group. +To successfully import or provision EKS, AKS, and GKE clusters from Rancher, the cluster must have at least one managed node group. AKS clusters can only be imported if local accounts are enabled. If a cluster is configured to use Microsoft Entra ID for authentication, Rancher will not be able to import the cluster and report an error. -EKS Anywhere clusters can be imported/registered into Rancher with an API address and credentials, as with any downstream cluster. EKS Anywhere clusters are treated as imported clusters and do not have full lifecycle support from Rancher. +EKS Anywhere clusters can be imported/registered into Rancher with an API address and credentials, as with any downstream cluster. EKS Anywhere clusters are treated as imported clusters and do not have full lifecycle support from Rancher. GKE Autopilot clusters aren't supported. See [Compare GKE Autopilot and Standard](https://cloud.google.com/kubernetes-engine/docs/resources/autopilot-standard-feature-comparison) for more information about the differences between GKE modes. @@ -47,9 +47,10 @@ GKE Autopilot clusters aren't supported. See [Compare GKE Autopilot and Standard 2. On the **Clusters** page, **Import Existing**. 3. Choose the type of cluster. 4. Use **Member Roles** to configure user authorization for the cluster. Click **Add Member** to add users that can access the cluster. Use the **Role** drop-down to set permissions for each user. -5. If you are importing a generic Kubernetes cluster in Rancher, perform the following steps for setup:
- a. Click **Agent Environment Variables** under **Cluster Options** to set environment variables for [rancher cluster agent](../launch-kubernetes-with-rancher/about-rancher-agents.md). The environment variables can be set using key value pairs. If rancher agent requires use of proxy to communicate with Rancher server, `HTTP_PROXY`, `HTTPS_PROXY` and `NO_PROXY` environment variables can be set using agent environment variables.
- b. Enable Project Network Isolation to ensure the cluster supports Kubernetes `NetworkPolicy` resources. Users can select the **Project Network Isolation** option under the **Advanced Options** dropdown to do so. +5. If you are importing a generic Kubernetes cluster in Rancher, perform the following steps for setup: + 1. Click **Agent Environment Variables** under **Cluster Options** to set environment variables for [rancher cluster agent](../launch-kubernetes-with-rancher/about-rancher-agents.md). The environment variables can be set using key value pairs. If rancher agent requires use of proxy to communicate with Rancher server, `HTTP_PROXY`, `HTTPS_PROXY` and `NO_PROXY` environment variables can be set using agent environment variables. + 1. Enable Project Network Isolation to ensure the cluster supports Kubernetes `NetworkPolicy` resources. Users can select the **Project Network Isolation** option under the **Advanced Options** dropdown to do so. + 1. [Configure the version management feature for imported RKE2 and K3s clusters](#configuring-version-management-for-rke2-and-k3s-clusters). 6. Click **Create**. 7. The prerequisite for `cluster-admin` privileges is shown (see **Prerequisites** above), including an example command to fulfil the prerequisite. 8. Copy the `kubectl` command to your clipboard and run it on a node where kubeconfig is configured to point to the cluster you want to import. If you are unsure it is configured correctly, run `kubectl get nodes` to verify before running the command shown in Rancher. @@ -124,18 +125,16 @@ After registering a cluster, the cluster owner can: ### Additional Features for Registered RKE2 and K3s Clusters [K3s](https://rancher.com/docs/k3s/latest/en/) is a lightweight, fully compliant Kubernetes distribution for edge installations. + [RKE2](https://docs.rke2.io) is Rancher's next-generation Kubernetes distribution for datacenter and cloud installations. -When an RKE2 or K3s cluster is registered in Rancher, Rancher will recognize it. The Rancher UI will expose the features for [all registered clusters,](#features-for-all-registered-clusters) in addition to the following features for editing and upgrading the cluster: +When an RKE2 or K3s cluster is registered in Rancher, Rancher will recognize it. +The Rancher UI will expose features available to [all registered clusters](#features-for-all-registered-clusters), along with the following options for editing and upgrading the cluster: -- The ability to [upgrade the Kubernetes version](../../../getting-started/installation-and-upgrade/upgrade-and-roll-back-kubernetes.md) - :::danger - - After a cluster has been imported into Rancher, upgrades should be performed using Rancher. Upgrading an imported cluster outside of Rancher is **not** supported. - - ::: -- The ability to configure the maximum number of nodes that will be upgraded concurrently -- The ability to see a read-only version of the cluster's configuration arguments and environment variables used to launch each node in the cluster +- Enable or disable [version management](#configuring-version-management-for-rke2-and-k3s-clusters) +- [Upgrade the Kubernetes version](../../../getting-started/installation-and-upgrade/upgrade-and-roll-back-kubernetes.md) when version management is enabled +- Configure the [upgrade strategy](#configuring-rke2-and-k3s-cluster-upgrades) when version management is enabled +- View a read-only version of the cluster’s configuration arguments and environment variables used to launch each node ### Additional Features for Registered EKS, AKS, and GKE Clusters @@ -145,6 +144,24 @@ When you create an EKS, AKS, or GKE cluster in Rancher, then delete it, Rancher See [Cluster Management Capabilities by Cluster Type](kubernetes-clusters-in-rancher-setup.md) for more information about what features are available for managing registered clusters. +## Configuring Version Management for RKE2 and K3s Clusters + +:::danger + +When version management is enabled for an imported cluster, upgrading it outside of Rancher may lead to unexpected consequences. + +::: + +The version management feature for imported RKE2 and K3s clusters can be configured using one of the following options: + +- **Global default** (default): Inherits behavior from the global **imported-cluster-version-management** setting. +- **True**: Enables version management, allowing users to control the Kubernetes version and upgrade strategy of the cluster through Rancher. +- **False**: Disables version management, enabling users to manage the cluster’s Kubernetes version independently, outside of Rancher. + +You can define the default behavior for newly created clusters or existing ones set to "Global default" by modifying the **imported-cluster-version-management** setting. + +Changes to the global **imported-cluster-version-management** setting take effect during the cluster’s next reconciliation cycle. + ## Configuring RKE2 and K3s Cluster Upgrades :::tip @@ -180,8 +197,12 @@ The current status of the plans can be viewed with this command: kubectl get plans -A -o yaml ``` +:::tip + If the cluster becomes stuck in upgrading, restart the `system-upgrade-controller`. +::: + To prevent issues when upgrading, the [Kubernetes upgrade best practices](https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/) should be followed. ## Authorized Cluster Endpoint Support for RKE2 and K3s Clusters @@ -304,4 +325,4 @@ This section lists some of the most common errors that may occur when importing ```sh az aks update --resource-group --name --enable-local-accounts - ``` \ No newline at end of file + ``` diff --git a/versioned_docs/version-2.11/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/register-existing-clusters.md b/versioned_docs/version-2.11/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/register-existing-clusters.md index b38111027d0..5574028f050 100644 --- a/versioned_docs/version-2.11/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/register-existing-clusters.md +++ b/versioned_docs/version-2.11/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/register-existing-clusters.md @@ -31,13 +31,13 @@ kubectl create clusterrolebinding cluster-admin-binding \ Since, by default, Google Kubernetes Engine (GKE) doesn't grant the `cluster-admin` role, you must run these commands on GKE clusters before you can register them. To learn more about role-based access control for GKE, please see [the official Google documentation](https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control). -### Elastic Kubernetes Service (EKS), Azure Kubernetes Service (AKS), and Google Kubernetes Engine (GKE) +### Elastic Kubernetes Service (EKS), Azure Kubernetes Service (AKS), and Google Kubernetes Engine (GKE) -To successfully import or provision EKS, AKS, and GKE clusters from Rancher, the cluster must have at least one managed node group. +To successfully import or provision EKS, AKS, and GKE clusters from Rancher, the cluster must have at least one managed node group. AKS clusters can only be imported if local accounts are enabled. If a cluster is configured to use Microsoft Entra ID for authentication, Rancher will not be able to import the cluster and report an error. -EKS Anywhere clusters can be imported/registered into Rancher with an API address and credentials, as with any downstream cluster. EKS Anywhere clusters are treated as imported clusters and do not have full lifecycle support from Rancher. +EKS Anywhere clusters can be imported/registered into Rancher with an API address and credentials, as with any downstream cluster. EKS Anywhere clusters are treated as imported clusters and do not have full lifecycle support from Rancher. GKE Autopilot clusters aren't supported. See [Compare GKE Autopilot and Standard](https://cloud.google.com/kubernetes-engine/docs/resources/autopilot-standard-feature-comparison) for more information about the differences between GKE modes. @@ -47,9 +47,10 @@ GKE Autopilot clusters aren't supported. See [Compare GKE Autopilot and Standard 2. On the **Clusters** page, **Import Existing**. 3. Choose the type of cluster. 4. Use **Member Roles** to configure user authorization for the cluster. Click **Add Member** to add users that can access the cluster. Use the **Role** drop-down to set permissions for each user. -5. If you are importing a generic Kubernetes cluster in Rancher, perform the following steps for setup:
- a. Click **Agent Environment Variables** under **Cluster Options** to set environment variables for [rancher cluster agent](../launch-kubernetes-with-rancher/about-rancher-agents.md). The environment variables can be set using key value pairs. If rancher agent requires use of proxy to communicate with Rancher server, `HTTP_PROXY`, `HTTPS_PROXY` and `NO_PROXY` environment variables can be set using agent environment variables.
- b. Enable Project Network Isolation to ensure the cluster supports Kubernetes `NetworkPolicy` resources. Users can select the **Project Network Isolation** option under the **Advanced Options** dropdown to do so. +5. If you are importing a generic Kubernetes cluster in Rancher, perform the following steps for setup: + 1. Click **Agent Environment Variables** under **Cluster Options** to set environment variables for [rancher cluster agent](../launch-kubernetes-with-rancher/about-rancher-agents.md). The environment variables can be set using key value pairs. If rancher agent requires use of proxy to communicate with Rancher server, `HTTP_PROXY`, `HTTPS_PROXY` and `NO_PROXY` environment variables can be set using agent environment variables. + 1. Enable Project Network Isolation to ensure the cluster supports Kubernetes `NetworkPolicy` resources. Users can select the **Project Network Isolation** option under the **Advanced Options** dropdown to do so. + 1. [Configure the version management feature for imported RKE2 and K3s clusters](#configuring-version-management-for-rke2-and-k3s-clusters). 6. Click **Create**. 7. The prerequisite for `cluster-admin` privileges is shown (see **Prerequisites** above), including an example command to fulfil the prerequisite. 8. Copy the `kubectl` command to your clipboard and run it on a node where kubeconfig is configured to point to the cluster you want to import. If you are unsure it is configured correctly, run `kubectl get nodes` to verify before running the command shown in Rancher. @@ -124,18 +125,16 @@ After registering a cluster, the cluster owner can: ### Additional Features for Registered RKE2 and K3s Clusters [K3s](https://rancher.com/docs/k3s/latest/en/) is a lightweight, fully compliant Kubernetes distribution for edge installations. + [RKE2](https://docs.rke2.io) is Rancher's next-generation Kubernetes distribution for datacenter and cloud installations. -When an RKE2 or K3s cluster is registered in Rancher, Rancher will recognize it. The Rancher UI will expose the features for [all registered clusters,](#features-for-all-registered-clusters) in addition to the following features for editing and upgrading the cluster: +When an RKE2 or K3s cluster is registered in Rancher, Rancher will recognize it. +The Rancher UI will expose features available to [all registered clusters](#features-for-all-registered-clusters), along with the following options for editing and upgrading the cluster: -- The ability to [upgrade the Kubernetes version](../../../getting-started/installation-and-upgrade/upgrade-and-roll-back-kubernetes.md) - :::danger - - After a cluster has been imported into Rancher, upgrades should be performed using Rancher. Upgrading an imported cluster outside of Rancher is **not** supported. - - ::: -- The ability to configure the maximum number of nodes that will be upgraded concurrently -- The ability to see a read-only version of the cluster's configuration arguments and environment variables used to launch each node in the cluster +- Enable or disable [version management](#configuring-version-management-for-rke2-and-k3s-clusters) +- [Upgrade the Kubernetes version](../../../getting-started/installation-and-upgrade/upgrade-and-roll-back-kubernetes.md) when version management is enabled +- Configure the [upgrade strategy](#configuring-rke2-and-k3s-cluster-upgrades) when version management is enabled +- View a read-only version of the cluster’s configuration arguments and environment variables used to launch each node ### Additional Features for Registered EKS, AKS, and GKE Clusters @@ -145,6 +144,24 @@ When you create an EKS, AKS, or GKE cluster in Rancher, then delete it, Rancher See [Cluster Management Capabilities by Cluster Type](kubernetes-clusters-in-rancher-setup.md) for more information about what features are available for managing registered clusters. +## Configuring Version Management for RKE2 and K3s Clusters + +:::danger + +When version management is enabled for an imported cluster, upgrading it outside of Rancher may lead to unexpected consequences. + +::: + +The version management feature for imported RKE2 and K3s clusters can be configured using one of the following options: + +- **Global default** (default): Inherits behavior from the global **imported-cluster-version-management** setting. +- **True**: Enables version management, allowing users to control the Kubernetes version and upgrade strategy of the cluster through Rancher. +- **False**: Disables version management, enabling users to manage the cluster’s Kubernetes version independently, outside of Rancher. + +You can define the default behavior for newly created clusters or existing ones set to "Global default" by modifying the **imported-cluster-version-management** setting. + +Changes to the global **imported-cluster-version-management** setting take effect during the cluster’s next reconciliation cycle. + ## Configuring RKE2 and K3s Cluster Upgrades :::tip @@ -180,8 +197,12 @@ The current status of the plans can be viewed with this command: kubectl get plans -A -o yaml ``` +:::tip + If the cluster becomes stuck in upgrading, restart the `system-upgrade-controller`. +::: + To prevent issues when upgrading, the [Kubernetes upgrade best practices](https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/) should be followed. ## Authorized Cluster Endpoint Support for RKE2 and K3s Clusters @@ -304,4 +325,4 @@ This section lists some of the most common errors that may occur when importing ```sh az aks update --resource-group --name --enable-local-accounts - ``` \ No newline at end of file + ``` From 1391623ae5999341aa29c050eb4626789426db5e Mon Sep 17 00:00:00 2001 From: Tom Lebreux Date: Mon, 17 Mar 2025 13:18:11 -0400 Subject: [PATCH 14/32] Document extension APIserver --- docs/api/extension-apiserver.md | 25 +++++++++++++++++++ .../installation-references/feature-flags.md | 2 ++ sidebars.js | 1 + 3 files changed, 28 insertions(+) create mode 100644 docs/api/extension-apiserver.md diff --git a/docs/api/extension-apiserver.md b/docs/api/extension-apiserver.md new file mode 100644 index 00000000000..7331577ba37 --- /dev/null +++ b/docs/api/extension-apiserver.md @@ -0,0 +1,25 @@ +--- +title: Extension Apiserver +--- + + + + + +Rancher extends Kubernetes with additional APIs by registering an extension +apiserver using [Kubernetes's Aggregation +layer](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation/). + +## Disabling the extension apiserver + +The [aggregation layer must be +configured](https://kubernetes.io/docs/tasks/extend-kubernetes/configure-aggregation-layer/) +on the local Kubernetes cluster for the `imperative-api-extension` feature to be +enabled and to work correctly. The feature assumes this is configured and is +enabled by default. If it is not possible to configure the aggregation layer for +your local Kubernetes cluster, then you must turn off the feature. + +It will still be possible to access the additional APIs when the feature is +turned off. The additional APIs are available at `https:///ext` and +they are compatible with Kubernetes apiserver. This means you can use `curl` or +even `kubectl` to interact with the APIs. diff --git a/docs/getting-started/installation-and-upgrade/installation-references/feature-flags.md b/docs/getting-started/installation-and-upgrade/installation-references/feature-flags.md index 969252b53e9..ae325c0ae44 100644 --- a/docs/getting-started/installation-and-upgrade/installation-references/feature-flags.md +++ b/docs/getting-started/installation-and-upgrade/installation-references/feature-flags.md @@ -22,6 +22,7 @@ The following is a list of feature flags available in Rancher. If you've upgrade - `continuous-delivery`: Allows Fleet GitOps to be disabled separately from Fleet. See [Continuous Delivery.](../../../how-to-guides/advanced-user-guides/enable-experimental-features/continuous-delivery.md) for more information. - `fleet`: The Rancher provisioning framework in v2.6 and later requires Fleet. The flag will be automatically enabled when you upgrade, even if you disabled this flag in an earlier version of Rancher. See [Continuous Delivery with Fleet](../../../integrations-in-rancher/fleet/fleet.md) for more information. - `harvester`: Manages access to the Virtualization Management page, where users can navigate directly to Harvester clusters and access the Harvester UI. See [Harvester Integration Overview](../../../integrations-in-rancher/harvester/overview.md) for more information. +- `imperative-api-extension`: Enables Rancher's [extension API server](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation/) to register new APIs to Kubernetes. See [Extension Apiserver](../../../api/extension-apiserver.md) for more information. - `istio-virtual-service-ui`: Enables a [visual interface](../../../how-to-guides/advanced-user-guides/enable-experimental-features/istio-traffic-management-features.md) to create, read, update, and delete Istio virtual services and destination rules, which are Istio traffic management features. - `legacy`: Enables a set of features from 2.5.x and earlier, that are slowly being phased out in favor of newer implementations. These are a mix of deprecated features as well as features that will eventually be available to newer versions. This flag is disabled by default on new Rancher installations. If you're upgrading from a previous version of Rancher, this flag is enabled. - `managed-system-upgrade-controller`: Enables the installation of the system-upgrade-controller app in downstream RKE2/K3s clusters, currently limited to imported clusters and the local cluster, with plans to expand support to node-driver clusters. @@ -44,6 +45,7 @@ The following table shows the availability and default values for some feature f | `fleet` | `true` | Can no longer be disabled | v2.6.0 | | | `fleet` | `true` | GA | v2.5.0 | | | `harvester` | `true` | Experimental | v2.6.1 | | +| `imperative-api-extension` | `true` | GA | v2.11.0 | | | `legacy` | `false` for new installs, `true` for upgrades | GA | v2.6.0 | | | `managed-system-upgrade-controller` | `true` | GA | v2.10.0 | | | `rke1-custom-node-cleanup`| `true` | GA | v2.6.0 | | diff --git a/sidebars.js b/sidebars.js index 3e636d11f0b..3020098cd5a 100644 --- a/sidebars.js +++ b/sidebars.js @@ -1359,6 +1359,7 @@ const sidebars = { }, "api/api-reference", "api/api-tokens", + "api/extension-apiserver", "api/v3-rancher-api-guide", ] }, From 919ad434586cc60b1a7a3b29eb7cbdf538dbe233 Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Tue, 18 Mar 2025 15:15:58 -0700 Subject: [PATCH 15/32] Adding partial file for RKE1 EOL warning message. Signed-off-by: Sunil Singh --- shared-files/_eol-rke1-warning.md | 5 +++++ src/theme/MDXComponents.js | 2 ++ 2 files changed, 7 insertions(+) create mode 100644 shared-files/_eol-rke1-warning.md diff --git a/shared-files/_eol-rke1-warning.md b/shared-files/_eol-rke1-warning.md new file mode 100644 index 00000000000..863ca5a811d --- /dev/null +++ b/shared-files/_eol-rke1-warning.md @@ -0,0 +1,5 @@ +:::warning + +Rancher Kubernetes Engine (RKE/RKE1) will reach end of life on **July 31, 2025**. Rancher 2.12.0 and later will no longer support provisioning or managing downstream RKE1 clusters. We recommend replatforming RKE1 clusters to RKE2 to ensure continued support and security updates. Learn more about the transition [here](https://www.suse.com/support/kb/doc/?id=000021518). + +::: diff --git a/src/theme/MDXComponents.js b/src/theme/MDXComponents.js index 96351a57170..3754b00650c 100644 --- a/src/theme/MDXComponents.js +++ b/src/theme/MDXComponents.js @@ -12,6 +12,7 @@ import DeprecationWeave from '/shared-files/_deprecation-weave.md'; import DeprecationHelm2 from '/shared-files/_deprecation-helm2.md'; import DockerSupportWarning from '/shared-files/_docker-support-warning.md'; import ConfigureSLO from '/shared-files/_configure-slo.md'; +import EOLRKE1Warning from '/shared-files/_eol-rke1-warning.md'; export default { // Re-use the default mapping @@ -29,4 +30,5 @@ export default { DeprecationWeave, DeprecationHelm2, DockerSupportWarning, + EOLRKE1Warning, }; From d77072be9d8b90802ba019d70fda4f04c84bb7f7 Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Tue, 18 Mar 2025 15:17:13 -0700 Subject: [PATCH 16/32] Adding EOL warning message tag to relevant RKE1 pages across versions/i18n folders. Signed-off-by: Sunil Singh --- .../upgrade-kubernetes-without-upgrading-rancher.md | 2 ++ .../about-rke1-templates/about-rke1-templates.md | 2 ++ .../about-rke1-templates/manage-rke1-templates.md | 2 ++ .../ha-rke1-kubernetes-cluster.md | 2 ++ .../kubernetes-cluster-setup/rke1-for-rancher.md | 2 ++ .../rke1-vs-rke2-differences.md | 2 ++ .../rke1-cluster-configuration.md | 2 ++ .../rke1-hardening-guide/rke1-hardening-guide.md | 2 ++ ...self-assessment-guide-with-cis-v1.23-k8s-v1.23.md | 2 ++ ...self-assessment-guide-with-cis-v1.24-k8s-v1.24.md | 12 +++++++----- ...ment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md | 12 +++++++----- docs/reference-guides/rke1-template-example-yaml.md | 2 ++ .../upgrade-kubernetes-without-upgrading-rancher.md | 2 ++ .../about-rke1-templates/about-rke1-templates.md | 3 +++ .../about-rke1-templates/manage-rke1-templates.md | 2 ++ .../ha-rke1-kubernetes-cluster.md | 2 ++ .../kubernetes-cluster-setup/rke1-for-rancher.md | 2 ++ .../rke1-vs-rke2-differences.md | 2 ++ .../rke1-cluster-configuration.md | 2 ++ .../rke1-hardening-guide/rke1-hardening-guide.md | 2 ++ ...self-assessment-guide-with-cis-v1.23-k8s-v1.23.md | 2 ++ ...self-assessment-guide-with-cis-v1.24-k8s-v1.24.md | 2 ++ ...ment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md | 2 ++ .../reference-guides/rke1-template-example-yaml.md | 2 ++ .../upgrade-kubernetes-without-upgrading-rancher.md | 2 ++ .../about-rke1-templates/about-rke1-templates.md | 3 +++ .../about-rke1-templates/manage-rke1-templates.md | 2 ++ .../ha-rke1-kubernetes-cluster.md | 2 ++ .../kubernetes-cluster-setup/rke1-for-rancher.md | 2 ++ .../rke1-vs-rke2-differences.md | 2 ++ .../rke1-cluster-configuration.md | 2 ++ .../rke1-hardening-guide/rke1-hardening-guide.md | 2 ++ ...self-assessment-guide-with-cis-v1.23-k8s-v1.23.md | 2 ++ ...self-assessment-guide-with-cis-v1.24-k8s-v1.24.md | 2 ++ ...ment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md | 2 ++ .../reference-guides/rke1-template-example-yaml.md | 2 ++ .../upgrade-kubernetes-without-upgrading-rancher.md | 2 ++ .../about-rke1-templates/about-rke1-templates.md | 3 +++ .../about-rke1-templates/manage-rke1-templates.md | 2 ++ .../ha-rke1-kubernetes-cluster.md | 2 ++ .../kubernetes-cluster-setup/rke1-for-rancher.md | 2 ++ .../rke1-vs-rke2-differences.md | 2 ++ .../rke1-cluster-configuration.md | 2 ++ .../rke1-hardening-guide/rke1-hardening-guide.md | 2 ++ ...self-assessment-guide-with-cis-v1.23-k8s-v1.23.md | 2 ++ ...self-assessment-guide-with-cis-v1.24-k8s-v1.24.md | 2 ++ ...ment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md | 2 ++ .../reference-guides/rke1-template-example-yaml.md | 2 ++ .../upgrade-kubernetes-without-upgrading-rancher.md | 2 ++ .../about-rke1-templates/about-rke1-templates.md | 3 +++ .../about-rke1-templates/manage-rke1-templates.md | 2 ++ .../ha-rke1-kubernetes-cluster.md | 2 ++ .../kubernetes-cluster-setup/rke1-for-rancher.md | 2 ++ .../rke1-vs-rke2-differences.md | 2 ++ .../pages-for-subheaders/about-rke1-templates.md | 2 ++ .../rke1-cluster-configuration.md | 2 ++ .../rke1-hardening-guide-with-cis-v1.6-benchmark.md | 2 ++ ...-self-assessment-guide-with-cis-v1.6-benchmark.md | 2 ++ .../reference-guides/rke1-template-example-yaml.md | 2 ++ .../upgrade-kubernetes-without-upgrading-rancher.md | 2 ++ .../about-rke1-templates/about-rke1-templates.md | 3 +++ .../about-rke1-templates/manage-rke1-templates.md | 2 ++ .../ha-rke1-kubernetes-cluster.md | 2 ++ .../kubernetes-cluster-setup/rke1-for-rancher.md | 2 ++ .../rke1-vs-rke2-differences.md | 2 ++ .../pages-for-subheaders/about-rke1-templates.md | 2 ++ .../pages-for-subheaders/rke1-hardening-guide.md | 2 ++ .../rke1-cluster-configuration.md | 2 ++ .../rke1-hardening-guide/rke1-hardening-guide.md | 2 ++ ...self-assessment-guide-with-cis-v1.23-k8s-v1.23.md | 2 ++ ...self-assessment-guide-with-cis-v1.23-k8s-v1.24.md | 2 ++ ...self-assessment-guide-with-cis-v1.23-k8s-v1.25.md | 2 ++ ...self-assessment-guide-with-cis-v1.24-k8s-v1.24.md | 2 ++ ...ment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md | 2 ++ .../reference-guides/rke1-template-example-yaml.md | 2 ++ .../upgrade-kubernetes-without-upgrading-rancher.md | 2 ++ .../about-rke1-templates/about-rke1-templates.md | 3 +++ .../about-rke1-templates/manage-rke1-templates.md | 2 ++ .../ha-rke1-kubernetes-cluster.md | 2 ++ .../kubernetes-cluster-setup/rke1-for-rancher.md | 2 ++ .../rke1-vs-rke2-differences.md | 2 ++ .../rke1-cluster-configuration.md | 2 ++ .../rke1-hardening-guide/rke1-hardening-guide.md | 2 ++ ...self-assessment-guide-with-cis-v1.23-k8s-v1.23.md | 2 ++ ...self-assessment-guide-with-cis-v1.24-k8s-v1.24.md | 2 ++ ...ment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md | 2 ++ .../reference-guides/rke1-template-example-yaml.md | 2 ++ .../upgrade-kubernetes-without-upgrading-rancher.md | 2 ++ .../about-rke1-templates/about-rke1-templates.md | 3 +++ .../about-rke1-templates/manage-rke1-templates.md | 2 ++ .../ha-rke1-kubernetes-cluster.md | 2 ++ .../kubernetes-cluster-setup/rke1-for-rancher.md | 2 ++ .../rke1-vs-rke2-differences.md | 2 ++ .../pages-for-subheaders/about-rke1-templates.md | 2 ++ .../pages-for-subheaders/rke1-hardening-guide.md | 2 ++ .../rke1-cluster-configuration.md | 2 ++ .../rke1-hardening-guide/rke1-hardening-guide.md | 2 ++ ...self-assessment-guide-with-cis-v1.23-k8s-v1.23.md | 2 ++ ...self-assessment-guide-with-cis-v1.24-k8s-v1.24.md | 2 ++ ...ment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md | 2 ++ .../reference-guides/rke1-template-example-yaml.md | 2 ++ .../upgrade-kubernetes-without-upgrading-rancher.md | 2 ++ .../about-rke1-templates/about-rke1-templates.md | 2 ++ .../about-rke1-templates/manage-rke1-templates.md | 2 ++ .../ha-rke1-kubernetes-cluster.md | 2 ++ .../kubernetes-cluster-setup/rke1-for-rancher.md | 2 ++ .../rke1-vs-rke2-differences.md | 2 ++ .../rke1-cluster-configuration.md | 2 ++ .../rke1-hardening-guide/rke1-hardening-guide.md | 2 ++ ...self-assessment-guide-with-cis-v1.23-k8s-v1.23.md | 2 ++ ...self-assessment-guide-with-cis-v1.24-k8s-v1.24.md | 12 +++++++----- ...ment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md | 12 +++++++----- .../reference-guides/rke1-template-example-yaml.md | 2 ++ .../upgrade-kubernetes-without-upgrading-rancher.md | 2 ++ .../about-rke1-templates/about-rke1-templates.md | 2 ++ .../about-rke1-templates/manage-rke1-templates.md | 2 ++ .../ha-rke1-kubernetes-cluster.md | 2 ++ .../kubernetes-cluster-setup/rke1-for-rancher.md | 2 ++ .../rke1-vs-rke2-differences.md | 2 ++ .../rke1-cluster-configuration.md | 2 ++ .../rke1-hardening-guide/rke1-hardening-guide.md | 2 ++ ...self-assessment-guide-with-cis-v1.23-k8s-v1.23.md | 2 ++ ...self-assessment-guide-with-cis-v1.24-k8s-v1.24.md | 12 +++++++----- ...ment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md | 12 +++++++----- .../reference-guides/rke1-template-example-yaml.md | 2 ++ .../upgrade-kubernetes-without-upgrading-rancher.md | 2 ++ .../about-rke1-templates/about-rke1-templates.md | 2 ++ .../about-rke1-templates/manage-rke1-templates.md | 2 ++ .../ha-rke1-kubernetes-cluster.md | 2 ++ .../kubernetes-cluster-setup/rke1-for-rancher.md | 2 ++ .../rke1-vs-rke2-differences.md | 2 ++ .../rke1-cluster-configuration.md | 2 ++ .../rke1-hardening-guide-with-cis-v1.6-benchmark.md | 2 ++ ...-self-assessment-guide-with-cis-v1.6-benchmark.md | 2 ++ .../reference-guides/rke1-template-example-yaml.md | 2 ++ .../upgrade-kubernetes-without-upgrading-rancher.md | 2 ++ .../about-rke1-templates/about-rke1-templates.md | 2 ++ .../about-rke1-templates/manage-rke1-templates.md | 2 ++ .../ha-rke1-kubernetes-cluster.md | 2 ++ .../kubernetes-cluster-setup/rke1-for-rancher.md | 2 ++ .../rke1-vs-rke2-differences.md | 2 ++ .../rke1-cluster-configuration.md | 2 ++ .../rke1-hardening-guide/rke1-hardening-guide.md | 2 ++ ...self-assessment-guide-with-cis-v1.23-k8s-v1.23.md | 2 ++ ...self-assessment-guide-with-cis-v1.24-k8s-v1.24.md | 12 +++++++----- ...ment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md | 12 +++++++----- .../reference-guides/rke1-template-example-yaml.md | 2 ++ .../upgrade-kubernetes-without-upgrading-rancher.md | 2 ++ .../about-rke1-templates/about-rke1-templates.md | 2 ++ .../about-rke1-templates/manage-rke1-templates.md | 2 ++ .../ha-rke1-kubernetes-cluster.md | 2 ++ .../kubernetes-cluster-setup/rke1-for-rancher.md | 2 ++ .../rke1-vs-rke2-differences.md | 2 ++ .../rke1-cluster-configuration.md | 2 ++ .../rke1-hardening-guide/rke1-hardening-guide.md | 2 ++ ...self-assessment-guide-with-cis-v1.23-k8s-v1.23.md | 2 ++ ...self-assessment-guide-with-cis-v1.24-k8s-v1.24.md | 12 +++++++----- ...ment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md | 12 +++++++----- .../reference-guides/rke1-template-example-yaml.md | 2 ++ .../upgrade-kubernetes-without-upgrading-rancher.md | 2 ++ .../about-rke1-templates/about-rke1-templates.md | 2 ++ .../about-rke1-templates/manage-rke1-templates.md | 2 ++ .../ha-rke1-kubernetes-cluster.md | 2 ++ .../kubernetes-cluster-setup/rke1-for-rancher.md | 2 ++ .../rke1-vs-rke2-differences.md | 2 ++ .../rke1-cluster-configuration.md | 2 ++ .../rke1-hardening-guide/rke1-hardening-guide.md | 2 ++ ...self-assessment-guide-with-cis-v1.23-k8s-v1.23.md | 2 ++ ...self-assessment-guide-with-cis-v1.24-k8s-v1.24.md | 12 +++++++----- ...ment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md | 12 +++++++----- .../reference-guides/rke1-template-example-yaml.md | 2 ++ 171 files changed, 409 insertions(+), 60 deletions(-) diff --git a/docs/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md b/docs/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md index 71b3a37204c..53ad99dc445 100644 --- a/docs/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md +++ b/docs/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md @@ -6,6 +6,8 @@ title: Upgrading Kubernetes without Upgrading Rancher + + The RKE metadata feature allows you to provision clusters with new versions of Kubernetes as soon as they are released, without upgrading Rancher. This feature is useful for taking advantage of patch versions of Kubernetes, for example, if you want to upgrade to Kubernetes v1.14.7 when your Rancher server originally supported v1.14.6. :::note diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md index e67a2da5d6d..1ecbe229d25 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md @@ -6,6 +6,8 @@ title: About RKE1 Templates + + RKE templates are designed to allow DevOps and security teams to standardize and simplify the creation of Kubernetes clusters. RKE is the [Rancher Kubernetes Engine,](https://rancher.com/docs/rke/latest/en/) which is the tool that Rancher uses to provision Kubernetes clusters. diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md index 6e8c75fe8d7..d729fababc1 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md @@ -6,6 +6,8 @@ title: Creating and Revising RKE Templates + + This section describes how to manage RKE templates and revisions. You an create, share, update, and delete templates from the **Cluster Management** view under **RKE1 Configuration > RKE Templates**. Template updates are handled through a revision system. When template owners want to change or update a template, they create a new revision of the template. Individual revisions cannot be edited. However, if you want to prevent a revision from being used to create a new cluster, you can disable it. diff --git a/docs/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md b/docs/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md index d1bd489bd16..a2e638b9073 100644 --- a/docs/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md +++ b/docs/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md @@ -6,6 +6,8 @@ title: Setting up Infrastructure for a High Availability RKE Kubernetes Cluster + + This tutorial is intended to help you create a high-availability RKE cluster that can be used to install a Rancher server. :::note Important: diff --git a/docs/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md b/docs/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md index e61bdb43e0a..9455eaef0be 100644 --- a/docs/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md +++ b/docs/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md @@ -6,6 +6,8 @@ title: Setting up a High-availability RKE Kubernetes Cluster + + This section describes how to install a Kubernetes cluster. This cluster should be dedicated to run only the Rancher server. :::note diff --git a/docs/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md b/docs/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md index 738178fdc41..ed8db366fbc 100644 --- a/docs/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md +++ b/docs/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md @@ -6,6 +6,8 @@ title: Behavior Differences Between RKE1 and RKE2 + + RKE2, also known as RKE Government, is a Kubernetes distribution that focuses on security and compliance for U.S. Federal Government entities. It is considered the next iteration of the Rancher Kubernetes Engine, now known as RKE1. RKE1 and RKE2 have several slight behavioral differences to note, and this page will highlight some of these at a high level. diff --git a/docs/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md b/docs/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md index 5668d117432..d47f71b679b 100644 --- a/docs/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md +++ b/docs/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md @@ -6,6 +6,8 @@ title: RKE Cluster Configuration Reference + + When Rancher installs Kubernetes, it uses [RKE](../../../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) or [RKE2](https://docs.rke2.io/) as the Kubernetes distribution. This section covers the configuration options that are available in Rancher for a new or existing RKE Kubernetes cluster. diff --git a/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md b/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md index 22c465eb07d..690c90f0f82 100644 --- a/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md +++ b/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md @@ -2,6 +2,8 @@ title: RKE Hardening Guides --- + + diff --git a/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md b/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md index 774f12f8be9..c71bf5a9d23 100644 --- a/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md +++ b/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md @@ -6,6 +6,8 @@ title: RKE Self-Assessment Guide - CIS Benchmark v1.23 - K8s v1.23 + + This document is a companion to the [RKE Hardening Guide](rke1-hardening-guide.md), which provides prescriptive guidance on how to harden RKE clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: diff --git a/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md b/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md index e37a56d277e..c98de564bf1 100644 --- a/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md +++ b/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md @@ -1,10 +1,12 @@ --- title: RKE Self-Assessment Guide - CIS Benchmark v1.24 - K8s v1.24 ---- - - - - +--- + + + + + + This document is a companion to the [RKE Hardening Guide](rke1-hardening-guide.md), which provides prescriptive guidance on how to harden RKE clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. diff --git a/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md b/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md index bfb274d96fa..ac002a20369 100644 --- a/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md +++ b/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md @@ -1,10 +1,12 @@ --- title: RKE Self-Assessment Guide - CIS Benchmark v1.7 - K8s v1.25/v1.26/v1.27 ---- - - - - +--- + + + + + + This document is a companion to the [RKE Hardening Guide](rke1-hardening-guide.md), which provides prescriptive guidance on how to harden RKE clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. diff --git a/docs/reference-guides/rke1-template-example-yaml.md b/docs/reference-guides/rke1-template-example-yaml.md index 5827dc55fcc..ec16ba61081 100644 --- a/docs/reference-guides/rke1-template-example-yaml.md +++ b/docs/reference-guides/rke1-template-example-yaml.md @@ -6,6 +6,8 @@ title: RKE1 Example YAML + + Below is an example RKE template configuration file for reference. The YAML in the RKE template uses the same customization that is used when you create an RKE cluster. However, since the YAML is within the context of a Rancher provisioned RKE cluster, the customization from the RKE docs needs to be nested under the `rancher_kubernetes_engine` directive. diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md b/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md index 7ea8aaaf817..3f7dc752616 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md +++ b/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md @@ -2,6 +2,8 @@ title: 在不升级 Rancher 的情况下升级 Kubernetes --- + + RKE 元数据功能允许你在新版本 Kubernetes 发布后立即为集群配置新版本，而无需升级 Rancher。此功能对于使用 Kubernetes 的补丁版本非常有用，例如，在原本支持 Kubernetes v1.14.6 的 Rancher Server 版本中，将 Kubernetes 升级到 v1.14.7。 :::note diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md b/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md index de9bc25d31a..aeef11c9c35 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md +++ b/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md @@ -6,6 +6,9 @@ title: RKE 模板 + + + RKE 模板旨在让 DevOps 和安全团队标准化和简化 Kubernetes 集群创建的流程。 RKE 的全称是 [Rancher Kubernetes Engine](https://rancher.com/docs/rke/latest/en/)，它是 Rancher 用来配置 Kubernetes 集群的工具。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md b/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md index 0e2393f74c4..0ae0c786814 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md +++ b/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md @@ -2,6 +2,8 @@ title: 创建和修改 RKE 模板 --- + + 本节介绍如何管理 RKE 模板和修订版。你可以从 **RKE1 配置 > RKE 模板**下的**集群管理**视图创建、共享、更新和删除模板。 模板更新通过修订系统处理。当模板所有者想要更改或更新模板时，他们会创建模板的新版本。单个修订无法编辑。但是，如果你想防止使用修订来创建新集群，你可以禁用它。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md b/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md index fb64922e7eb..0f27336f53e 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md +++ b/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md @@ -2,6 +2,8 @@ title: 为高可用 RKE Kubernetes 集群设置基础设施 --- + + 本教程旨在帮助你创建一个高可用的 RKE 集群，用于安装 Rancher Server。 :::note 重要提示： diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md b/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md index 0ad61709567..9aa7c5d65a9 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md +++ b/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md @@ -2,6 +2,8 @@ title: 配置高可用的 RKE Kubernetes 集群 --- + + 本文介绍如何安装 Kubernetes 集群。该集群应专用于运行 Rancher Server。 :::note diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md b/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md index 3ea34605985..57c3c855491 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md +++ b/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md @@ -2,6 +2,8 @@ title: RKE1 和 RKE2 差​​异 --- + + RKE2，也称为 RKE Government，是一个完全符合标准的 Kubernetes 发行版，它专注于安全性和合规性。它被认为是 Rancher Kubernetes Engine（即 RKE1）的下一个迭代。 RKE1 和 RKE2 有一些细微的差异，本文将重点介绍这些差异。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md b/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md index 6d4f2525bed..7c90c343705 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md +++ b/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md @@ -2,6 +2,8 @@ title: RKE 集群配置参考 --- + + Rancher 安装 Kubernetes 时，它使用 [RKE](../../../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) 或 [RKE2](https://docs.rke2.io/) 作为 Kubernetes 发行版。 本文介绍 Rancher 中可用于新的或现有的 RKE Kubernetes 集群的配置选项。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md b/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md index 903e42374f3..6e45d33b81c 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md +++ b/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md @@ -6,6 +6,8 @@ title: RKE 加固指南 + + 本文档提供了针对生产环境的 RKE 集群进行加固的具体指导，以便在使用 Rancher 部署之前进行配置。它概述了满足信息安全中心（Center for Information Security, CIS）Kubernetes benchmark controls 所需的配置和控制。 :::note diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md b/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md index 7dfb1204916..a006ce01005 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md +++ b/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md @@ -6,6 +6,8 @@ title: RKE 自我评估指南 - CIS Benchmark v1.23 - K8s v1.23 + + 本文档是 [RKE 加固指南](rke1-hardening-guide.md)的配套文档，该指南提供了关于如何加固正在生产环境中运行并由 Rancher 管理的 RKE 集群的指导方针。本 benchmark 指南可帮助你根据 CIS Kubernetes Benchmark 中的每个 control 来评估加固集群的安全性。 本指南对应以下版本的 Rancher、CIS Benchmarks 和 Kubernetes： diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md b/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md index 2246a13f6d0..c9c73b276f6 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md +++ b/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md @@ -6,6 +6,8 @@ title: RKE 自我评估指南 - CIS Benchmark v1.24 - K8s v1.24 + + 本文档是 [RKE 加固指南](rke1-hardening-guide.md)的配套文档，该指南提供了关于如何加固正在生产环境中运行并由 Rancher 管理的 RKE 集群的指导方针。本 benchmark 指南可帮助你根据 CIS Kubernetes Benchmark 中的每个 control 来评估加固集群的安全性。 本指南对应以下版本的 Rancher、CIS Benchmarks 和 Kubernetes： diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md b/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md index 5e5a6b1eed2..cb3a548a8b1 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md +++ b/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md @@ -6,6 +6,8 @@ title: RKE 自我评估指南 - CIS Benchmark v1.7 - K8s v1.25/v1.26/v1.27 + + 本文档是 [RKE 加固指南](rke1-hardening-guide.md)的配套文档，该指南提供了关于如何加固正在生产环境中运行并由 Rancher 管理的 RKE 集群的指导方针。本 benchmark 指南可帮助你根据 CIS Kubernetes Benchmark 中的每个 control 来评估加固集群的安全性。 本指南对应以下版本的 Rancher、CIS Benchmarks 和 Kubernetes： diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rke1-template-example-yaml.md b/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rke1-template-example-yaml.md index 5efdc493a95..55a616f36f5 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rke1-template-example-yaml.md +++ b/i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rke1-template-example-yaml.md @@ -2,6 +2,8 @@ title: RKE1 示例 YAML --- + + 以下是一个供参考的 RKE 模板配置文件示例。 RKE 模板中的 YAML 使用与创建 RKE 集群时相同的自定义项。但是，由于 YAML 位于 Rancher 配置的 RKE 集群的上下文中，因此 RKE 文档中的自定义项需要嵌套在 `rancher_kubernetes_engine` 指令下。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md index 7ea8aaaf817..3f7dc752616 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md @@ -2,6 +2,8 @@ title: 在不升级 Rancher 的情况下升级 Kubernetes --- + + RKE 元数据功能允许你在新版本 Kubernetes 发布后立即为集群配置新版本，而无需升级 Rancher。此功能对于使用 Kubernetes 的补丁版本非常有用，例如，在原本支持 Kubernetes v1.14.6 的 Rancher Server 版本中，将 Kubernetes 升级到 v1.14.7。 :::note diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md index de9bc25d31a..aeef11c9c35 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md @@ -6,6 +6,9 @@ title: RKE 模板 + + + RKE 模板旨在让 DevOps 和安全团队标准化和简化 Kubernetes 集群创建的流程。 RKE 的全称是 [Rancher Kubernetes Engine](https://rancher.com/docs/rke/latest/en/)，它是 Rancher 用来配置 Kubernetes 集群的工具。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md index 0e2393f74c4..0ae0c786814 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md @@ -2,6 +2,8 @@ title: 创建和修改 RKE 模板 --- + + 本节介绍如何管理 RKE 模板和修订版。你可以从 **RKE1 配置 > RKE 模板**下的**集群管理**视图创建、共享、更新和删除模板。 模板更新通过修订系统处理。当模板所有者想要更改或更新模板时，他们会创建模板的新版本。单个修订无法编辑。但是，如果你想防止使用修订来创建新集群，你可以禁用它。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md index fb64922e7eb..0f27336f53e 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md @@ -2,6 +2,8 @@ title: 为高可用 RKE Kubernetes 集群设置基础设施 --- + + 本教程旨在帮助你创建一个高可用的 RKE 集群，用于安装 Rancher Server。 :::note 重要提示： diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md index 0ad61709567..9aa7c5d65a9 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md @@ -2,6 +2,8 @@ title: 配置高可用的 RKE Kubernetes 集群 --- + + 本文介绍如何安装 Kubernetes 集群。该集群应专用于运行 Rancher Server。 :::note diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md index 3ea34605985..57c3c855491 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md @@ -2,6 +2,8 @@ title: RKE1 和 RKE2 差​​异 --- + + RKE2，也称为 RKE Government，是一个完全符合标准的 Kubernetes 发行版，它专注于安全性和合规性。它被认为是 Rancher Kubernetes Engine（即 RKE1）的下一个迭代。 RKE1 和 RKE2 有一些细微的差异，本文将重点介绍这些差异。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md index 6d4f2525bed..7c90c343705 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md @@ -2,6 +2,8 @@ title: RKE 集群配置参考 --- + + Rancher 安装 Kubernetes 时，它使用 [RKE](../../../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) 或 [RKE2](https://docs.rke2.io/) 作为 Kubernetes 发行版。 本文介绍 Rancher 中可用于新的或现有的 RKE Kubernetes 集群的配置选项。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md index 903e42374f3..6e45d33b81c 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md @@ -6,6 +6,8 @@ title: RKE 加固指南 + + 本文档提供了针对生产环境的 RKE 集群进行加固的具体指导，以便在使用 Rancher 部署之前进行配置。它概述了满足信息安全中心（Center for Information Security, CIS）Kubernetes benchmark controls 所需的配置和控制。 :::note diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md index 7dfb1204916..a006ce01005 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md @@ -6,6 +6,8 @@ title: RKE 自我评估指南 - CIS Benchmark v1.23 - K8s v1.23 + + 本文档是 [RKE 加固指南](rke1-hardening-guide.md)的配套文档，该指南提供了关于如何加固正在生产环境中运行并由 Rancher 管理的 RKE 集群的指导方针。本 benchmark 指南可帮助你根据 CIS Kubernetes Benchmark 中的每个 control 来评估加固集群的安全性。 本指南对应以下版本的 Rancher、CIS Benchmarks 和 Kubernetes： diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md index 2246a13f6d0..c9c73b276f6 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md @@ -6,6 +6,8 @@ title: RKE 自我评估指南 - CIS Benchmark v1.24 - K8s v1.24 + + 本文档是 [RKE 加固指南](rke1-hardening-guide.md)的配套文档，该指南提供了关于如何加固正在生产环境中运行并由 Rancher 管理的 RKE 集群的指导方针。本 benchmark 指南可帮助你根据 CIS Kubernetes Benchmark 中的每个 control 来评估加固集群的安全性。 本指南对应以下版本的 Rancher、CIS Benchmarks 和 Kubernetes： diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md index 5e5a6b1eed2..cb3a548a8b1 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md @@ -6,6 +6,8 @@ title: RKE 自我评估指南 - CIS Benchmark v1.7 - K8s v1.25/v1.26/v1.27 + + 本文档是 [RKE 加固指南](rke1-hardening-guide.md)的配套文档，该指南提供了关于如何加固正在生产环境中运行并由 Rancher 管理的 RKE 集群的指导方针。本 benchmark 指南可帮助你根据 CIS Kubernetes Benchmark 中的每个 control 来评估加固集群的安全性。 本指南对应以下版本的 Rancher、CIS Benchmarks 和 Kubernetes： diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/reference-guides/rke1-template-example-yaml.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/reference-guides/rke1-template-example-yaml.md index 5efdc493a95..55a616f36f5 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/reference-guides/rke1-template-example-yaml.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/reference-guides/rke1-template-example-yaml.md @@ -2,6 +2,8 @@ title: RKE1 示例 YAML --- + + 以下是一个供参考的 RKE 模板配置文件示例。 RKE 模板中的 YAML 使用与创建 RKE 集群时相同的自定义项。但是，由于 YAML 位于 Rancher 配置的 RKE 集群的上下文中，因此 RKE 文档中的自定义项需要嵌套在 `rancher_kubernetes_engine` 指令下。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md index 7ea8aaaf817..3f7dc752616 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md @@ -2,6 +2,8 @@ title: 在不升级 Rancher 的情况下升级 Kubernetes --- + + RKE 元数据功能允许你在新版本 Kubernetes 发布后立即为集群配置新版本，而无需升级 Rancher。此功能对于使用 Kubernetes 的补丁版本非常有用，例如，在原本支持 Kubernetes v1.14.6 的 Rancher Server 版本中，将 Kubernetes 升级到 v1.14.7。 :::note diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md index de9bc25d31a..aeef11c9c35 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md @@ -6,6 +6,9 @@ title: RKE 模板 + + + RKE 模板旨在让 DevOps 和安全团队标准化和简化 Kubernetes 集群创建的流程。 RKE 的全称是 [Rancher Kubernetes Engine](https://rancher.com/docs/rke/latest/en/)，它是 Rancher 用来配置 Kubernetes 集群的工具。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md index 0e2393f74c4..0ae0c786814 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md @@ -2,6 +2,8 @@ title: 创建和修改 RKE 模板 --- + + 本节介绍如何管理 RKE 模板和修订版。你可以从 **RKE1 配置 > RKE 模板**下的**集群管理**视图创建、共享、更新和删除模板。 模板更新通过修订系统处理。当模板所有者想要更改或更新模板时，他们会创建模板的新版本。单个修订无法编辑。但是，如果你想防止使用修订来创建新集群，你可以禁用它。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md index fb64922e7eb..0f27336f53e 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md @@ -2,6 +2,8 @@ title: 为高可用 RKE Kubernetes 集群设置基础设施 --- + + 本教程旨在帮助你创建一个高可用的 RKE 集群，用于安装 Rancher Server。 :::note 重要提示： diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md index 0ad61709567..9aa7c5d65a9 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md @@ -2,6 +2,8 @@ title: 配置高可用的 RKE Kubernetes 集群 --- + + 本文介绍如何安装 Kubernetes 集群。该集群应专用于运行 Rancher Server。 :::note diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md index 3ea34605985..57c3c855491 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md @@ -2,6 +2,8 @@ title: RKE1 和 RKE2 差​​异 --- + + RKE2，也称为 RKE Government，是一个完全符合标准的 Kubernetes 发行版，它专注于安全性和合规性。它被认为是 Rancher Kubernetes Engine（即 RKE1）的下一个迭代。 RKE1 和 RKE2 有一些细微的差异，本文将重点介绍这些差异。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md index 6d4f2525bed..7c90c343705 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md @@ -2,6 +2,8 @@ title: RKE 集群配置参考 --- + + Rancher 安装 Kubernetes 时，它使用 [RKE](../../../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) 或 [RKE2](https://docs.rke2.io/) 作为 Kubernetes 发行版。 本文介绍 Rancher 中可用于新的或现有的 RKE Kubernetes 集群的配置选项。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md index 903e42374f3..6e45d33b81c 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md @@ -6,6 +6,8 @@ title: RKE 加固指南 + + 本文档提供了针对生产环境的 RKE 集群进行加固的具体指导，以便在使用 Rancher 部署之前进行配置。它概述了满足信息安全中心（Center for Information Security, CIS）Kubernetes benchmark controls 所需的配置和控制。 :::note diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md index 7dfb1204916..a006ce01005 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md @@ -6,6 +6,8 @@ title: RKE 自我评估指南 - CIS Benchmark v1.23 - K8s v1.23 + + 本文档是 [RKE 加固指南](rke1-hardening-guide.md)的配套文档，该指南提供了关于如何加固正在生产环境中运行并由 Rancher 管理的 RKE 集群的指导方针。本 benchmark 指南可帮助你根据 CIS Kubernetes Benchmark 中的每个 control 来评估加固集群的安全性。 本指南对应以下版本的 Rancher、CIS Benchmarks 和 Kubernetes： diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md index 2246a13f6d0..c9c73b276f6 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md @@ -6,6 +6,8 @@ title: RKE 自我评估指南 - CIS Benchmark v1.24 - K8s v1.24 + + 本文档是 [RKE 加固指南](rke1-hardening-guide.md)的配套文档，该指南提供了关于如何加固正在生产环境中运行并由 Rancher 管理的 RKE 集群的指导方针。本 benchmark 指南可帮助你根据 CIS Kubernetes Benchmark 中的每个 control 来评估加固集群的安全性。 本指南对应以下版本的 Rancher、CIS Benchmarks 和 Kubernetes： diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md index 5e5a6b1eed2..cb3a548a8b1 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md @@ -6,6 +6,8 @@ title: RKE 自我评估指南 - CIS Benchmark v1.7 - K8s v1.25/v1.26/v1.27 + + 本文档是 [RKE 加固指南](rke1-hardening-guide.md)的配套文档，该指南提供了关于如何加固正在生产环境中运行并由 Rancher 管理的 RKE 集群的指导方针。本 benchmark 指南可帮助你根据 CIS Kubernetes Benchmark 中的每个 control 来评估加固集群的安全性。 本指南对应以下版本的 Rancher、CIS Benchmarks 和 Kubernetes： diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/reference-guides/rke1-template-example-yaml.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/reference-guides/rke1-template-example-yaml.md index 5efdc493a95..55a616f36f5 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/reference-guides/rke1-template-example-yaml.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/reference-guides/rke1-template-example-yaml.md @@ -2,6 +2,8 @@ title: RKE1 示例 YAML --- + + 以下是一个供参考的 RKE 模板配置文件示例。 RKE 模板中的 YAML 使用与创建 RKE 集群时相同的自定义项。但是，由于 YAML 位于 Rancher 配置的 RKE 集群的上下文中，因此 RKE 文档中的自定义项需要嵌套在 `rancher_kubernetes_engine` 指令下。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.6/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.6/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md index 1945c1422f0..38abbbd4154 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.6/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.6/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md @@ -2,6 +2,8 @@ title: 在不升级 Rancher 的情况下升级 Kubernetes --- + + RKE 元数据功能允许你在新版本 Kubernetes 发布后立即为集群配置新版本，而无需升级 Rancher。此功能对于使用 Kubernetes 的补丁版本非常有用，例如，在原本支持 Kubernetes v1.14.6 的 Rancher Server 版本中，将 Kubernetes 升级到 v1.14.7。 :::note diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.6/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.6/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md index 921ab1cc00a..b9de09a7584 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.6/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.6/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md @@ -6,6 +6,9 @@ title: RKE 模板 + + + RKE 模板旨在让 DevOps 和安全团队标准化和简化 Kubernetes 集群创建的流程。 RKE 的全称是 [Rancher Kubernetes Engine](https://rancher.com/docs/rke/latest/en/)，它是 Rancher 用来配置 Kubernetes 集群的工具。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.6/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.6/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md index 6e4adb98239..c47aadd6055 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.6/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.6/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md @@ -2,6 +2,8 @@ title: 创建和修改 RKE 模板 --- + + 本节介绍如何管理 RKE 模板和修订版。你可以从 **RKE1 配置 > RKE 模板**下的**集群管理**视图创建、共享、更新和删除模板。 模板更新通过修订系统处理。当模板所有者想要更改或更新模板时，他们会创建模板的新版本。单个修订无法编辑。但是，如果你想防止使用修订来创建新集群，你可以禁用它。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.6/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.6/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md index 24387c1f786..f531f8fbf4b 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.6/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.6/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md @@ -2,6 +2,8 @@ title: 为高可用 RKE Kubernetes 集群设置基础设施 --- + + 本教程旨在帮助你创建一个高可用的 RKE 集群，用于安装 Rancher Server。 :::note 重要提示： diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.6/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.6/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md index 7c2e2399bfd..1c7dbc09486 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.6/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.6/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md @@ -2,6 +2,8 @@ title: 配置高可用的 RKE Kubernetes 集群 --- + + 本文介绍如何安装 Kubernetes 集群。该集群应专用于运行 Rancher Server。 :::note diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.6/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.6/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md index 1d6d0cee6a5..4def6e1151d 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.6/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.6/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md @@ -2,6 +2,8 @@ title: RKE1 和 RKE2 差​​异 --- + + RKE2，也称为 RKE Government，是一个完全符合标准的 Kubernetes 发行版，它专注于安全性和合规性。它被认为是 Rancher Kubernetes Engine（即 RKE1）的下一个迭代。 RKE1 和 RKE2 有一些细微的差异，本文将重点介绍这些差异。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.6/pages-for-subheaders/about-rke1-templates.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.6/pages-for-subheaders/about-rke1-templates.md index 3f4012ac5dd..b6953192696 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.6/pages-for-subheaders/about-rke1-templates.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.6/pages-for-subheaders/about-rke1-templates.md @@ -2,6 +2,8 @@ title: RKE 模板 --- + + RKE 模板旨在让 DevOps 和安全团队标准化和简化 Kubernetes 集群创建的流程。 RKE 的全称是 [Rancher Kubernetes Engine](https://rancher.com/docs/rke/latest/en/)，它是 Rancher 用来配置 Kubernetes 集群的工具。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md index 3469bc78a74..b7d10137bfa 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md @@ -2,6 +2,8 @@ title: RKE 集群配置参考 --- + + Rancher 安装 Kubernetes 时，它使用 [RKE](../../../pages-for-subheaders/launch-kubernetes-with-rancher.md) 或 [RKE2](https://docs.rke2.io/) 作为 Kubernetes 发行版。 本文介绍 Rancher 中可用于新的或现有的 RKE Kubernetes 集群的配置选项。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.6/reference-guides/rancher-security/rancher-v2.6-hardening-guides/rke1-hardening-guide-with-cis-v1.6-benchmark.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.6/reference-guides/rancher-security/rancher-v2.6-hardening-guides/rke1-hardening-guide-with-cis-v1.6-benchmark.md index 8dd4c881420..993cea70176 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.6/reference-guides/rancher-security/rancher-v2.6-hardening-guides/rke1-hardening-guide-with-cis-v1.6-benchmark.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.6/reference-guides/rancher-security/rancher-v2.6-hardening-guides/rke1-hardening-guide-with-cis-v1.6-benchmark.md @@ -2,6 +2,8 @@ title: 使用 CIS 1.6 Benchmark 的 RKE 强化指南 --- + + 本文档提供了用于强化 RKE 集群（使用 Rancher 2.6 进行配置）生产安装的说明。此处概述了遵循 CIS 的 Kubernetes Benchmark 管控所需的配置和控制。 :::note diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.6/reference-guides/rancher-security/rancher-v2.6-hardening-guides/rke1-self-assessment-guide-with-cis-v1.6-benchmark.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.6/reference-guides/rancher-security/rancher-v2.6-hardening-guides/rke1-self-assessment-guide-with-cis-v1.6-benchmark.md index 2aaee70b263..d23b74f3a39 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.6/reference-guides/rancher-security/rancher-v2.6-hardening-guides/rke1-self-assessment-guide-with-cis-v1.6-benchmark.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.6/reference-guides/rancher-security/rancher-v2.6-hardening-guides/rke1-self-assessment-guide-with-cis-v1.6-benchmark.md @@ -2,6 +2,8 @@ title: RKE CIS 1.6 Benchmark - 自我评估指南 - Rancher 2.6 --- + + ### RKE CIS 1.6 Kubernetes Benchmark - Rancher 2.6 与 Kubernetes 1.18 到 1.23 [点击此处下载本文档的 PDF 版本](https://releases.rancher.com/documents/security/2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf)。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.6/reference-guides/rke1-template-example-yaml.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.6/reference-guides/rke1-template-example-yaml.md index 5efdc493a95..55a616f36f5 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.6/reference-guides/rke1-template-example-yaml.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.6/reference-guides/rke1-template-example-yaml.md @@ -2,6 +2,8 @@ title: RKE1 示例 YAML --- + + 以下是一个供参考的 RKE 模板配置文件示例。 RKE 模板中的 YAML 使用与创建 RKE 集群时相同的自定义项。但是，由于 YAML 位于 Rancher 配置的 RKE 集群的上下文中，因此 RKE 文档中的自定义项需要嵌套在 `rancher_kubernetes_engine` 指令下。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md index 30c5baffa62..d49f6a7e03f 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md @@ -2,6 +2,8 @@ title: 在不升级 Rancher 的情况下升级 Kubernetes --- + + diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md index de9bc25d31a..aeef11c9c35 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md @@ -6,6 +6,9 @@ title: RKE 模板 + + + RKE 模板旨在让 DevOps 和安全团队标准化和简化 Kubernetes 集群创建的流程。 RKE 的全称是 [Rancher Kubernetes Engine](https://rancher.com/docs/rke/latest/en/)，它是 Rancher 用来配置 Kubernetes 集群的工具。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md index 6e4adb98239..c47aadd6055 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md @@ -2,6 +2,8 @@ title: 创建和修改 RKE 模板 --- + + 本节介绍如何管理 RKE 模板和修订版。你可以从 **RKE1 配置 > RKE 模板**下的**集群管理**视图创建、共享、更新和删除模板。 模板更新通过修订系统处理。当模板所有者想要更改或更新模板时，他们会创建模板的新版本。单个修订无法编辑。但是，如果你想防止使用修订来创建新集群，你可以禁用它。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md index 24387c1f786..f531f8fbf4b 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md @@ -2,6 +2,8 @@ title: 为高可用 RKE Kubernetes 集群设置基础设施 --- + + 本教程旨在帮助你创建一个高可用的 RKE 集群，用于安装 Rancher Server。 :::note 重要提示： diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md index 397fe2aa0d0..d842bf607b3 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md @@ -2,6 +2,8 @@ title: 配置高可用的 RKE Kubernetes 集群 --- + + 本文介绍如何安装 Kubernetes 集群。该集群应专用于运行 Rancher Server。 :::note diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md index 3941f3b37c3..f00267249c3 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md @@ -2,6 +2,8 @@ title: RKE1 和 RKE2 差​​异 --- + + RKE2，也称为 RKE Government，是一个完全符合标准的 Kubernetes 发行版，它专注于安全性和合规性。它被认为是 Rancher Kubernetes Engine（即 RKE1）的下一个迭代。 RKE1 和 RKE2 有一些细微的差异，本文将重点介绍这些差异。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/pages-for-subheaders/about-rke1-templates.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/pages-for-subheaders/about-rke1-templates.md index 3f4012ac5dd..b6953192696 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/pages-for-subheaders/about-rke1-templates.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/pages-for-subheaders/about-rke1-templates.md @@ -2,6 +2,8 @@ title: RKE 模板 --- + + RKE 模板旨在让 DevOps 和安全团队标准化和简化 Kubernetes 集群创建的流程。 RKE 的全称是 [Rancher Kubernetes Engine](https://rancher.com/docs/rke/latest/en/)，它是 Rancher 用来配置 Kubernetes 集群的工具。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/pages-for-subheaders/rke1-hardening-guide.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/pages-for-subheaders/rke1-hardening-guide.md index 6a187df3273..9e154564cc8 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/pages-for-subheaders/rke1-hardening-guide.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/pages-for-subheaders/rke1-hardening-guide.md @@ -2,6 +2,8 @@ title: RKE Hardening Guide --- + + This document provides prescriptive guidance for how to harden an RKE cluster intended for production, before provisioning it with Rancher. It outlines the configurations and controls required for Center for Information Security (CIS) Kubernetes benchmark controls. :::note diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md index 7cdc1ec7c64..39ec784cf7c 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md @@ -2,6 +2,8 @@ title: RKE 集群配置参考 --- + + Rancher 安装 Kubernetes 时，它使用 [RKE](../../../pages-for-subheaders/launch-kubernetes-with-rancher.md) 或 [RKE2](https://docs.rke2.io/) 作为 Kubernetes 发行版。 本文介绍 Rancher 中可用于新的或现有的 RKE Kubernetes 集群的配置选项。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md index 903e42374f3..6e45d33b81c 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md @@ -6,6 +6,8 @@ title: RKE 加固指南 + + 本文档提供了针对生产环境的 RKE 集群进行加固的具体指导，以便在使用 Rancher 部署之前进行配置。它概述了满足信息安全中心（Center for Information Security, CIS）Kubernetes benchmark controls 所需的配置和控制。 :::note diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md index 7dfb1204916..a006ce01005 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md @@ -6,6 +6,8 @@ title: RKE 自我评估指南 - CIS Benchmark v1.23 - K8s v1.23 + + 本文档是 [RKE 加固指南](rke1-hardening-guide.md)的配套文档，该指南提供了关于如何加固正在生产环境中运行并由 Rancher 管理的 RKE 集群的指导方针。本 benchmark 指南可帮助你根据 CIS Kubernetes Benchmark 中的每个 control 来评估加固集群的安全性。 本指南对应以下版本的 Rancher、CIS Benchmarks 和 Kubernetes： diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.24.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.24.md index 25108b848b5..0d92d0c2cba 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.24.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.24.md @@ -2,6 +2,8 @@ title: RKE Self-Assessment Guide - CIS Benchmark v1.23 - K8s v1.24 --- + + This document is a companion to the [RKE Hardening Guide](../../../../pages-for-subheaders/rke1-hardening-guide.md), which provides prescriptive guidance on how to harden RKE clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.25.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.25.md index 0cec041061f..77c78a965bc 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.25.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.25.md @@ -2,6 +2,8 @@ title: RKE Self-Assessment Guide - CIS Benchmark v1.23 - K8s v1.25 --- + + This document is a companion to the [RKE Hardening Guide](../../../../pages-for-subheaders/rke1-hardening-guide.md), which provides prescriptive guidance on how to harden RKE clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md index 2246a13f6d0..c9c73b276f6 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md @@ -6,6 +6,8 @@ title: RKE 自我评估指南 - CIS Benchmark v1.24 - K8s v1.24 + + 本文档是 [RKE 加固指南](rke1-hardening-guide.md)的配套文档，该指南提供了关于如何加固正在生产环境中运行并由 Rancher 管理的 RKE 集群的指导方针。本 benchmark 指南可帮助你根据 CIS Kubernetes Benchmark 中的每个 control 来评估加固集群的安全性。 本指南对应以下版本的 Rancher、CIS Benchmarks 和 Kubernetes： diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md index 5e5a6b1eed2..cb3a548a8b1 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md @@ -6,6 +6,8 @@ title: RKE 自我评估指南 - CIS Benchmark v1.7 - K8s v1.25/v1.26/v1.27 + + 本文档是 [RKE 加固指南](rke1-hardening-guide.md)的配套文档，该指南提供了关于如何加固正在生产环境中运行并由 Rancher 管理的 RKE 集群的指导方针。本 benchmark 指南可帮助你根据 CIS Kubernetes Benchmark 中的每个 control 来评估加固集群的安全性。 本指南对应以下版本的 Rancher、CIS Benchmarks 和 Kubernetes： diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/rke1-template-example-yaml.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/rke1-template-example-yaml.md index 5efdc493a95..55a616f36f5 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/rke1-template-example-yaml.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.7/reference-guides/rke1-template-example-yaml.md @@ -2,6 +2,8 @@ title: RKE1 示例 YAML --- + + 以下是一个供参考的 RKE 模板配置文件示例。 RKE 模板中的 YAML 使用与创建 RKE 集群时相同的自定义项。但是，由于 YAML 位于 Rancher 配置的 RKE 集群的上下文中，因此 RKE 文档中的自定义项需要嵌套在 `rancher_kubernetes_engine` 指令下。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.8/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.8/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md index 7ea8aaaf817..3f7dc752616 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.8/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.8/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md @@ -2,6 +2,8 @@ title: 在不升级 Rancher 的情况下升级 Kubernetes --- + + RKE 元数据功能允许你在新版本 Kubernetes 发布后立即为集群配置新版本，而无需升级 Rancher。此功能对于使用 Kubernetes 的补丁版本非常有用，例如，在原本支持 Kubernetes v1.14.6 的 Rancher Server 版本中，将 Kubernetes 升级到 v1.14.7。 :::note diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md index de9bc25d31a..aeef11c9c35 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md @@ -6,6 +6,9 @@ title: RKE 模板 + + + RKE 模板旨在让 DevOps 和安全团队标准化和简化 Kubernetes 集群创建的流程。 RKE 的全称是 [Rancher Kubernetes Engine](https://rancher.com/docs/rke/latest/en/)，它是 Rancher 用来配置 Kubernetes 集群的工具。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md index 0e2393f74c4..0ae0c786814 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md @@ -2,6 +2,8 @@ title: 创建和修改 RKE 模板 --- + + 本节介绍如何管理 RKE 模板和修订版。你可以从 **RKE1 配置 > RKE 模板**下的**集群管理**视图创建、共享、更新和删除模板。 模板更新通过修订系统处理。当模板所有者想要更改或更新模板时，他们会创建模板的新版本。单个修订无法编辑。但是，如果你想防止使用修订来创建新集群，你可以禁用它。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.8/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.8/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md index fb64922e7eb..0f27336f53e 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.8/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.8/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md @@ -2,6 +2,8 @@ title: 为高可用 RKE Kubernetes 集群设置基础设施 --- + + 本教程旨在帮助你创建一个高可用的 RKE 集群，用于安装 Rancher Server。 :::note 重要提示： diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.8/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.8/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md index 0ad61709567..9aa7c5d65a9 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.8/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.8/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md @@ -2,6 +2,8 @@ title: 配置高可用的 RKE Kubernetes 集群 --- + + 本文介绍如何安装 Kubernetes 集群。该集群应专用于运行 Rancher Server。 :::note diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.8/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.8/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md index 8c0e9478de5..f46190e77d3 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.8/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.8/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md @@ -2,6 +2,8 @@ title: RKE1 和 RKE2 差​​异 --- + + RKE2，也称为 RKE Government，是一个完全符合标准的 Kubernetes 发行版，它专注于安全性和合规性。它被认为是 Rancher Kubernetes Engine（即 RKE1）的下一个迭代。 RKE1 和 RKE2 有一些细微的差异，本文将重点介绍这些差异。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.8/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.8/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md index 6d4f2525bed..7c90c343705 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.8/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.8/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md @@ -2,6 +2,8 @@ title: RKE 集群配置参考 --- + + Rancher 安装 Kubernetes 时，它使用 [RKE](../../../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) 或 [RKE2](https://docs.rke2.io/) 作为 Kubernetes 发行版。 本文介绍 Rancher 中可用于新的或现有的 RKE Kubernetes 集群的配置选项。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md index 903e42374f3..6e45d33b81c 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md @@ -6,6 +6,8 @@ title: RKE 加固指南 + + 本文档提供了针对生产环境的 RKE 集群进行加固的具体指导，以便在使用 Rancher 部署之前进行配置。它概述了满足信息安全中心（Center for Information Security, CIS）Kubernetes benchmark controls 所需的配置和控制。 :::note diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md index 7dfb1204916..a006ce01005 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md @@ -6,6 +6,8 @@ title: RKE 自我评估指南 - CIS Benchmark v1.23 - K8s v1.23 + + 本文档是 [RKE 加固指南](rke1-hardening-guide.md)的配套文档，该指南提供了关于如何加固正在生产环境中运行并由 Rancher 管理的 RKE 集群的指导方针。本 benchmark 指南可帮助你根据 CIS Kubernetes Benchmark 中的每个 control 来评估加固集群的安全性。 本指南对应以下版本的 Rancher、CIS Benchmarks 和 Kubernetes： diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md index 2246a13f6d0..c9c73b276f6 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md @@ -6,6 +6,8 @@ title: RKE 自我评估指南 - CIS Benchmark v1.24 - K8s v1.24 + + 本文档是 [RKE 加固指南](rke1-hardening-guide.md)的配套文档，该指南提供了关于如何加固正在生产环境中运行并由 Rancher 管理的 RKE 集群的指导方针。本 benchmark 指南可帮助你根据 CIS Kubernetes Benchmark 中的每个 control 来评估加固集群的安全性。 本指南对应以下版本的 Rancher、CIS Benchmarks 和 Kubernetes： diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md index 5e5a6b1eed2..cb3a548a8b1 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md @@ -6,6 +6,8 @@ title: RKE 自我评估指南 - CIS Benchmark v1.7 - K8s v1.25/v1.26/v1.27 + + 本文档是 [RKE 加固指南](rke1-hardening-guide.md)的配套文档，该指南提供了关于如何加固正在生产环境中运行并由 Rancher 管理的 RKE 集群的指导方针。本 benchmark 指南可帮助你根据 CIS Kubernetes Benchmark 中的每个 control 来评估加固集群的安全性。 本指南对应以下版本的 Rancher、CIS Benchmarks 和 Kubernetes： diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.8/reference-guides/rke1-template-example-yaml.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.8/reference-guides/rke1-template-example-yaml.md index 5efdc493a95..55a616f36f5 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.8/reference-guides/rke1-template-example-yaml.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.8/reference-guides/rke1-template-example-yaml.md @@ -2,6 +2,8 @@ title: RKE1 示例 YAML --- + + 以下是一个供参考的 RKE 模板配置文件示例。 RKE 模板中的 YAML 使用与创建 RKE 集群时相同的自定义项。但是，由于 YAML 位于 Rancher 配置的 RKE 集群的上下文中，因此 RKE 文档中的自定义项需要嵌套在 `rancher_kubernetes_engine` 指令下。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md index 3d01c38aed8..303543ec07b 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md @@ -2,6 +2,8 @@ title: 在不升级 Rancher 的情况下升级 Kubernetes --- + + RKE 元数据功能允许你在新版本 Kubernetes 发布后立即为集群配置新版本，而无需升级 Rancher。此功能对于使用 Kubernetes 的补丁版本非常有用，例如，在原本支持 Kubernetes v1.14.6 的 Rancher Server 版本中，将 Kubernetes 升级到 v1.14.7。 :::note diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md index de9bc25d31a..aeef11c9c35 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md @@ -6,6 +6,9 @@ title: RKE 模板 + + + RKE 模板旨在让 DevOps 和安全团队标准化和简化 Kubernetes 集群创建的流程。 RKE 的全称是 [Rancher Kubernetes Engine](https://rancher.com/docs/rke/latest/en/)，它是 Rancher 用来配置 Kubernetes 集群的工具。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md index 6e4adb98239..c47aadd6055 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md @@ -2,6 +2,8 @@ title: 创建和修改 RKE 模板 --- + + 本节介绍如何管理 RKE 模板和修订版。你可以从 **RKE1 配置 > RKE 模板**下的**集群管理**视图创建、共享、更新和删除模板。 模板更新通过修订系统处理。当模板所有者想要更改或更新模板时，他们会创建模板的新版本。单个修订无法编辑。但是，如果你想防止使用修订来创建新集群，你可以禁用它。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md index 24387c1f786..f531f8fbf4b 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md @@ -2,6 +2,8 @@ title: 为高可用 RKE Kubernetes 集群设置基础设施 --- + + 本教程旨在帮助你创建一个高可用的 RKE 集群，用于安装 Rancher Server。 :::note 重要提示： diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md index 397fe2aa0d0..d842bf607b3 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md @@ -2,6 +2,8 @@ title: 配置高可用的 RKE Kubernetes 集群 --- + + 本文介绍如何安装 Kubernetes 集群。该集群应专用于运行 Rancher Server。 :::note diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md index 3941f3b37c3..f00267249c3 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md @@ -2,6 +2,8 @@ title: RKE1 和 RKE2 差​​异 --- + + RKE2，也称为 RKE Government，是一个完全符合标准的 Kubernetes 发行版，它专注于安全性和合规性。它被认为是 Rancher Kubernetes Engine（即 RKE1）的下一个迭代。 RKE1 和 RKE2 有一些细微的差异，本文将重点介绍这些差异。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/pages-for-subheaders/about-rke1-templates.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/pages-for-subheaders/about-rke1-templates.md index 3f4012ac5dd..b6953192696 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/pages-for-subheaders/about-rke1-templates.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/pages-for-subheaders/about-rke1-templates.md @@ -2,6 +2,8 @@ title: RKE 模板 --- + + RKE 模板旨在让 DevOps 和安全团队标准化和简化 Kubernetes 集群创建的流程。 RKE 的全称是 [Rancher Kubernetes Engine](https://rancher.com/docs/rke/latest/en/)，它是 Rancher 用来配置 Kubernetes 集群的工具。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/pages-for-subheaders/rke1-hardening-guide.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/pages-for-subheaders/rke1-hardening-guide.md index 6a187df3273..9e154564cc8 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/pages-for-subheaders/rke1-hardening-guide.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/pages-for-subheaders/rke1-hardening-guide.md @@ -2,6 +2,8 @@ title: RKE Hardening Guide --- + + This document provides prescriptive guidance for how to harden an RKE cluster intended for production, before provisioning it with Rancher. It outlines the configurations and controls required for Center for Information Security (CIS) Kubernetes benchmark controls. :::note diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md index 7cdc1ec7c64..39ec784cf7c 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md @@ -2,6 +2,8 @@ title: RKE 集群配置参考 --- + + Rancher 安装 Kubernetes 时，它使用 [RKE](../../../pages-for-subheaders/launch-kubernetes-with-rancher.md) 或 [RKE2](https://docs.rke2.io/) 作为 Kubernetes 发行版。 本文介绍 Rancher 中可用于新的或现有的 RKE Kubernetes 集群的配置选项。 diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md index 903e42374f3..6e45d33b81c 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md @@ -6,6 +6,8 @@ title: RKE 加固指南 + + 本文档提供了针对生产环境的 RKE 集群进行加固的具体指导，以便在使用 Rancher 部署之前进行配置。它概述了满足信息安全中心（Center for Information Security, CIS）Kubernetes benchmark controls 所需的配置和控制。 :::note diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md index 7dfb1204916..a006ce01005 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md @@ -6,6 +6,8 @@ title: RKE 自我评估指南 - CIS Benchmark v1.23 - K8s v1.23 + + 本文档是 [RKE 加固指南](rke1-hardening-guide.md)的配套文档，该指南提供了关于如何加固正在生产环境中运行并由 Rancher 管理的 RKE 集群的指导方针。本 benchmark 指南可帮助你根据 CIS Kubernetes Benchmark 中的每个 control 来评估加固集群的安全性。 本指南对应以下版本的 Rancher、CIS Benchmarks 和 Kubernetes： diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md index 2246a13f6d0..c9c73b276f6 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md @@ -6,6 +6,8 @@ title: RKE 自我评估指南 - CIS Benchmark v1.24 - K8s v1.24 + + 本文档是 [RKE 加固指南](rke1-hardening-guide.md)的配套文档，该指南提供了关于如何加固正在生产环境中运行并由 Rancher 管理的 RKE 集群的指导方针。本 benchmark 指南可帮助你根据 CIS Kubernetes Benchmark 中的每个 control 来评估加固集群的安全性。 本指南对应以下版本的 Rancher、CIS Benchmarks 和 Kubernetes： diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md index 5e5a6b1eed2..cb3a548a8b1 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md @@ -6,6 +6,8 @@ title: RKE 自我评估指南 - CIS Benchmark v1.7 - K8s v1.25/v1.26/v1.27 + + 本文档是 [RKE 加固指南](rke1-hardening-guide.md)的配套文档，该指南提供了关于如何加固正在生产环境中运行并由 Rancher 管理的 RKE 集群的指导方针。本 benchmark 指南可帮助你根据 CIS Kubernetes Benchmark 中的每个 control 来评估加固集群的安全性。 本指南对应以下版本的 Rancher、CIS Benchmarks 和 Kubernetes： diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/reference-guides/rke1-template-example-yaml.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/reference-guides/rke1-template-example-yaml.md index 5efdc493a95..55a616f36f5 100644 --- a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/reference-guides/rke1-template-example-yaml.md +++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/reference-guides/rke1-template-example-yaml.md @@ -2,6 +2,8 @@ title: RKE1 示例 YAML --- + + 以下是一个供参考的 RKE 模板配置文件示例。 RKE 模板中的 YAML 使用与创建 RKE 集群时相同的自定义项。但是，由于 YAML 位于 Rancher 配置的 RKE 集群的上下文中，因此 RKE 文档中的自定义项需要嵌套在 `rancher_kubernetes_engine` 指令下。 diff --git a/versioned_docs/version-2.10/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md b/versioned_docs/version-2.10/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md index 71b3a37204c..53ad99dc445 100644 --- a/versioned_docs/version-2.10/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md +++ b/versioned_docs/version-2.10/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md @@ -6,6 +6,8 @@ title: Upgrading Kubernetes without Upgrading Rancher + + The RKE metadata feature allows you to provision clusters with new versions of Kubernetes as soon as they are released, without upgrading Rancher. This feature is useful for taking advantage of patch versions of Kubernetes, for example, if you want to upgrade to Kubernetes v1.14.7 when your Rancher server originally supported v1.14.6. :::note diff --git a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md index e67a2da5d6d..1ecbe229d25 100644 --- a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md +++ b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md @@ -6,6 +6,8 @@ title: About RKE1 Templates + + RKE templates are designed to allow DevOps and security teams to standardize and simplify the creation of Kubernetes clusters. RKE is the [Rancher Kubernetes Engine,](https://rancher.com/docs/rke/latest/en/) which is the tool that Rancher uses to provision Kubernetes clusters. diff --git a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md index 6e8c75fe8d7..d729fababc1 100644 --- a/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md +++ b/versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md @@ -6,6 +6,8 @@ title: Creating and Revising RKE Templates + + This section describes how to manage RKE templates and revisions. You an create, share, update, and delete templates from the **Cluster Management** view under **RKE1 Configuration > RKE Templates**. Template updates are handled through a revision system. When template owners want to change or update a template, they create a new revision of the template. Individual revisions cannot be edited. However, if you want to prevent a revision from being used to create a new cluster, you can disable it. diff --git a/versioned_docs/version-2.10/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md b/versioned_docs/version-2.10/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md index d1bd489bd16..a2e638b9073 100644 --- a/versioned_docs/version-2.10/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md +++ b/versioned_docs/version-2.10/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md @@ -6,6 +6,8 @@ title: Setting up Infrastructure for a High Availability RKE Kubernetes Cluster + + This tutorial is intended to help you create a high-availability RKE cluster that can be used to install a Rancher server. :::note Important: diff --git a/versioned_docs/version-2.10/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md b/versioned_docs/version-2.10/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md index e61bdb43e0a..9455eaef0be 100644 --- a/versioned_docs/version-2.10/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md +++ b/versioned_docs/version-2.10/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md @@ -6,6 +6,8 @@ title: Setting up a High-availability RKE Kubernetes Cluster + + This section describes how to install a Kubernetes cluster. This cluster should be dedicated to run only the Rancher server. :::note diff --git a/versioned_docs/version-2.10/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md b/versioned_docs/version-2.10/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md index 738178fdc41..ed8db366fbc 100644 --- a/versioned_docs/version-2.10/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md +++ b/versioned_docs/version-2.10/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md @@ -6,6 +6,8 @@ title: Behavior Differences Between RKE1 and RKE2 + + RKE2, also known as RKE Government, is a Kubernetes distribution that focuses on security and compliance for U.S. Federal Government entities. It is considered the next iteration of the Rancher Kubernetes Engine, now known as RKE1. RKE1 and RKE2 have several slight behavioral differences to note, and this page will highlight some of these at a high level. diff --git a/versioned_docs/version-2.10/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md b/versioned_docs/version-2.10/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md index 5668d117432..d47f71b679b 100644 --- a/versioned_docs/version-2.10/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md +++ b/versioned_docs/version-2.10/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md @@ -6,6 +6,8 @@ title: RKE Cluster Configuration Reference + + When Rancher installs Kubernetes, it uses [RKE](../../../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) or [RKE2](https://docs.rke2.io/) as the Kubernetes distribution. This section covers the configuration options that are available in Rancher for a new or existing RKE Kubernetes cluster. diff --git a/versioned_docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md b/versioned_docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md index 22c465eb07d..690c90f0f82 100644 --- a/versioned_docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md +++ b/versioned_docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md @@ -2,6 +2,8 @@ title: RKE Hardening Guides --- + + diff --git a/versioned_docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md b/versioned_docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md index 774f12f8be9..c71bf5a9d23 100644 --- a/versioned_docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md +++ b/versioned_docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md @@ -6,6 +6,8 @@ title: RKE Self-Assessment Guide - CIS Benchmark v1.23 - K8s v1.23 + + This document is a companion to the [RKE Hardening Guide](rke1-hardening-guide.md), which provides prescriptive guidance on how to harden RKE clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: diff --git a/versioned_docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md b/versioned_docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md index e37a56d277e..c98de564bf1 100644 --- a/versioned_docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md +++ b/versioned_docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md @@ -1,10 +1,12 @@ --- title: RKE Self-Assessment Guide - CIS Benchmark v1.24 - K8s v1.24 ---- - - - - +--- + + + + + + This document is a companion to the [RKE Hardening Guide](rke1-hardening-guide.md), which provides prescriptive guidance on how to harden RKE clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. diff --git a/versioned_docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md b/versioned_docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md index bfb274d96fa..ac002a20369 100644 --- a/versioned_docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md +++ b/versioned_docs/version-2.10/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md @@ -1,10 +1,12 @@ --- title: RKE Self-Assessment Guide - CIS Benchmark v1.7 - K8s v1.25/v1.26/v1.27 ---- - - - - +--- + + + + + + This document is a companion to the [RKE Hardening Guide](rke1-hardening-guide.md), which provides prescriptive guidance on how to harden RKE clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. diff --git a/versioned_docs/version-2.10/reference-guides/rke1-template-example-yaml.md b/versioned_docs/version-2.10/reference-guides/rke1-template-example-yaml.md index 5827dc55fcc..ec16ba61081 100644 --- a/versioned_docs/version-2.10/reference-guides/rke1-template-example-yaml.md +++ b/versioned_docs/version-2.10/reference-guides/rke1-template-example-yaml.md @@ -6,6 +6,8 @@ title: RKE1 Example YAML + + Below is an example RKE template configuration file for reference. The YAML in the RKE template uses the same customization that is used when you create an RKE cluster. However, since the YAML is within the context of a Rancher provisioned RKE cluster, the customization from the RKE docs needs to be nested under the `rancher_kubernetes_engine` directive. diff --git a/versioned_docs/version-2.11/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md b/versioned_docs/version-2.11/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md index 71b3a37204c..53ad99dc445 100644 --- a/versioned_docs/version-2.11/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md +++ b/versioned_docs/version-2.11/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md @@ -6,6 +6,8 @@ title: Upgrading Kubernetes without Upgrading Rancher + + The RKE metadata feature allows you to provision clusters with new versions of Kubernetes as soon as they are released, without upgrading Rancher. This feature is useful for taking advantage of patch versions of Kubernetes, for example, if you want to upgrade to Kubernetes v1.14.7 when your Rancher server originally supported v1.14.6. :::note diff --git a/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md b/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md index e67a2da5d6d..1ecbe229d25 100644 --- a/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md +++ b/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md @@ -6,6 +6,8 @@ title: About RKE1 Templates + + RKE templates are designed to allow DevOps and security teams to standardize and simplify the creation of Kubernetes clusters. RKE is the [Rancher Kubernetes Engine,](https://rancher.com/docs/rke/latest/en/) which is the tool that Rancher uses to provision Kubernetes clusters. diff --git a/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md b/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md index 6e8c75fe8d7..d729fababc1 100644 --- a/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md +++ b/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md @@ -6,6 +6,8 @@ title: Creating and Revising RKE Templates + + This section describes how to manage RKE templates and revisions. You an create, share, update, and delete templates from the **Cluster Management** view under **RKE1 Configuration > RKE Templates**. Template updates are handled through a revision system. When template owners want to change or update a template, they create a new revision of the template. Individual revisions cannot be edited. However, if you want to prevent a revision from being used to create a new cluster, you can disable it. diff --git a/versioned_docs/version-2.11/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md b/versioned_docs/version-2.11/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md index d1bd489bd16..a2e638b9073 100644 --- a/versioned_docs/version-2.11/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md +++ b/versioned_docs/version-2.11/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md @@ -6,6 +6,8 @@ title: Setting up Infrastructure for a High Availability RKE Kubernetes Cluster + + This tutorial is intended to help you create a high-availability RKE cluster that can be used to install a Rancher server. :::note Important: diff --git a/versioned_docs/version-2.11/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md b/versioned_docs/version-2.11/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md index e61bdb43e0a..9455eaef0be 100644 --- a/versioned_docs/version-2.11/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md +++ b/versioned_docs/version-2.11/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md @@ -6,6 +6,8 @@ title: Setting up a High-availability RKE Kubernetes Cluster + + This section describes how to install a Kubernetes cluster. This cluster should be dedicated to run only the Rancher server. :::note diff --git a/versioned_docs/version-2.11/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md b/versioned_docs/version-2.11/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md index 738178fdc41..ed8db366fbc 100644 --- a/versioned_docs/version-2.11/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md +++ b/versioned_docs/version-2.11/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md @@ -6,6 +6,8 @@ title: Behavior Differences Between RKE1 and RKE2 + + RKE2, also known as RKE Government, is a Kubernetes distribution that focuses on security and compliance for U.S. Federal Government entities. It is considered the next iteration of the Rancher Kubernetes Engine, now known as RKE1. RKE1 and RKE2 have several slight behavioral differences to note, and this page will highlight some of these at a high level. diff --git a/versioned_docs/version-2.11/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md b/versioned_docs/version-2.11/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md index 5668d117432..d47f71b679b 100644 --- a/versioned_docs/version-2.11/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md +++ b/versioned_docs/version-2.11/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md @@ -6,6 +6,8 @@ title: RKE Cluster Configuration Reference + + When Rancher installs Kubernetes, it uses [RKE](../../../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) or [RKE2](https://docs.rke2.io/) as the Kubernetes distribution. This section covers the configuration options that are available in Rancher for a new or existing RKE Kubernetes cluster. diff --git a/versioned_docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md b/versioned_docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md index 22c465eb07d..690c90f0f82 100644 --- a/versioned_docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md +++ b/versioned_docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md @@ -2,6 +2,8 @@ title: RKE Hardening Guides --- + + diff --git a/versioned_docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md b/versioned_docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md index 774f12f8be9..c71bf5a9d23 100644 --- a/versioned_docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md +++ b/versioned_docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md @@ -6,6 +6,8 @@ title: RKE Self-Assessment Guide - CIS Benchmark v1.23 - K8s v1.23 + + This document is a companion to the [RKE Hardening Guide](rke1-hardening-guide.md), which provides prescriptive guidance on how to harden RKE clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: diff --git a/versioned_docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md b/versioned_docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md index e37a56d277e..c98de564bf1 100644 --- a/versioned_docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md +++ b/versioned_docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md @@ -1,10 +1,12 @@ --- title: RKE Self-Assessment Guide - CIS Benchmark v1.24 - K8s v1.24 ---- - - - - +--- + + + + + + This document is a companion to the [RKE Hardening Guide](rke1-hardening-guide.md), which provides prescriptive guidance on how to harden RKE clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. diff --git a/versioned_docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md b/versioned_docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md index bfb274d96fa..ac002a20369 100644 --- a/versioned_docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md +++ b/versioned_docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md @@ -1,10 +1,12 @@ --- title: RKE Self-Assessment Guide - CIS Benchmark v1.7 - K8s v1.25/v1.26/v1.27 ---- - - - - +--- + + + + + + This document is a companion to the [RKE Hardening Guide](rke1-hardening-guide.md), which provides prescriptive guidance on how to harden RKE clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. diff --git a/versioned_docs/version-2.11/reference-guides/rke1-template-example-yaml.md b/versioned_docs/version-2.11/reference-guides/rke1-template-example-yaml.md index 5827dc55fcc..ec16ba61081 100644 --- a/versioned_docs/version-2.11/reference-guides/rke1-template-example-yaml.md +++ b/versioned_docs/version-2.11/reference-guides/rke1-template-example-yaml.md @@ -6,6 +6,8 @@ title: RKE1 Example YAML + + Below is an example RKE template configuration file for reference. The YAML in the RKE template uses the same customization that is used when you create an RKE cluster. However, since the YAML is within the context of a Rancher provisioned RKE cluster, the customization from the RKE docs needs to be nested under the `rancher_kubernetes_engine` directive. diff --git a/versioned_docs/version-2.6/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md b/versioned_docs/version-2.6/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md index d25a7f03196..cafb9728863 100644 --- a/versioned_docs/version-2.6/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md +++ b/versioned_docs/version-2.6/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md @@ -6,6 +6,8 @@ title: Upgrading Kubernetes without Upgrading Rancher + + The RKE metadata feature allows you to provision clusters with new versions of Kubernetes as soon as they are released, without upgrading Rancher. This feature is useful for taking advantage of patch versions of Kubernetes, for example, if you want to upgrade to Kubernetes v1.14.7 when your Rancher server originally supported v1.14.6. :::note diff --git a/versioned_docs/version-2.6/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md b/versioned_docs/version-2.6/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md index e67a2da5d6d..1ecbe229d25 100644 --- a/versioned_docs/version-2.6/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md +++ b/versioned_docs/version-2.6/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md @@ -6,6 +6,8 @@ title: About RKE1 Templates + + RKE templates are designed to allow DevOps and security teams to standardize and simplify the creation of Kubernetes clusters. RKE is the [Rancher Kubernetes Engine,](https://rancher.com/docs/rke/latest/en/) which is the tool that Rancher uses to provision Kubernetes clusters. diff --git a/versioned_docs/version-2.6/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md b/versioned_docs/version-2.6/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md index 6e8c75fe8d7..d729fababc1 100644 --- a/versioned_docs/version-2.6/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md +++ b/versioned_docs/version-2.6/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md @@ -6,6 +6,8 @@ title: Creating and Revising RKE Templates + + This section describes how to manage RKE templates and revisions. You an create, share, update, and delete templates from the **Cluster Management** view under **RKE1 Configuration > RKE Templates**. Template updates are handled through a revision system. When template owners want to change or update a template, they create a new revision of the template. Individual revisions cannot be edited. However, if you want to prevent a revision from being used to create a new cluster, you can disable it. diff --git a/versioned_docs/version-2.6/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md b/versioned_docs/version-2.6/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md index d1bd489bd16..a2e638b9073 100644 --- a/versioned_docs/version-2.6/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md +++ b/versioned_docs/version-2.6/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md @@ -6,6 +6,8 @@ title: Setting up Infrastructure for a High Availability RKE Kubernetes Cluster + + This tutorial is intended to help you create a high-availability RKE cluster that can be used to install a Rancher server. :::note Important: diff --git a/versioned_docs/version-2.6/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md b/versioned_docs/version-2.6/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md index c01e5d9d61d..538692de60c 100644 --- a/versioned_docs/version-2.6/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md +++ b/versioned_docs/version-2.6/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md @@ -6,6 +6,8 @@ title: Setting up a High-availability RKE Kubernetes Cluster + + This section describes how to install a Kubernetes cluster. This cluster should be dedicated to run only the Rancher server. :::note diff --git a/versioned_docs/version-2.6/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md b/versioned_docs/version-2.6/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md index 6a160e75230..44ca64356d6 100644 --- a/versioned_docs/version-2.6/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md +++ b/versioned_docs/version-2.6/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md @@ -6,6 +6,8 @@ title: Behavior Differences Between RKE1 and RKE2 + + RKE2, also known as RKE Government, is a Kubernetes distribution that focuses on security and compliance for U.S. Federal Government entities. It is considered the next iteration of the Rancher Kubernetes Engine, now known as RKE1. RKE1 and RKE2 have several slight behavioral differences to note, and this page will highlight some of these at a high level. diff --git a/versioned_docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md b/versioned_docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md index 01858baf54d..0d12add0776 100644 --- a/versioned_docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md +++ b/versioned_docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md @@ -6,6 +6,8 @@ title: RKE Cluster Configuration Reference + + When Rancher installs Kubernetes, it uses [RKE](../../../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) or [RKE2](https://docs.rke2.io/) as the Kubernetes distribution. This section covers the configuration options that are available in Rancher for a new or existing RKE Kubernetes cluster. diff --git a/versioned_docs/version-2.6/reference-guides/rancher-security/rancher-v2.6-hardening-guides/rke1-hardening-guide-with-cis-v1.6-benchmark.md b/versioned_docs/version-2.6/reference-guides/rancher-security/rancher-v2.6-hardening-guides/rke1-hardening-guide-with-cis-v1.6-benchmark.md index c9e1bbb3962..e196d2233b1 100644 --- a/versioned_docs/version-2.6/reference-guides/rancher-security/rancher-v2.6-hardening-guides/rke1-hardening-guide-with-cis-v1.6-benchmark.md +++ b/versioned_docs/version-2.6/reference-guides/rancher-security/rancher-v2.6-hardening-guides/rke1-hardening-guide-with-cis-v1.6-benchmark.md @@ -2,6 +2,8 @@ title: RKE Hardening Guide with CIS v1.6 Benchmark --- + + This document provides prescriptive guidance for hardening a production installation of a RKE cluster to be used with Rancher v2.6. It outlines the configurations and controls required to address Kubernetes benchmark controls from the Center for Information Security (CIS). :::note diff --git a/versioned_docs/version-2.6/reference-guides/rancher-security/rancher-v2.6-hardening-guides/rke1-self-assessment-guide-with-cis-v1.6-benchmark.md b/versioned_docs/version-2.6/reference-guides/rancher-security/rancher-v2.6-hardening-guides/rke1-self-assessment-guide-with-cis-v1.6-benchmark.md index 7f8f793509e..05396466797 100644 --- a/versioned_docs/version-2.6/reference-guides/rancher-security/rancher-v2.6-hardening-guides/rke1-self-assessment-guide-with-cis-v1.6-benchmark.md +++ b/versioned_docs/version-2.6/reference-guides/rancher-security/rancher-v2.6-hardening-guides/rke1-self-assessment-guide-with-cis-v1.6-benchmark.md @@ -2,6 +2,8 @@ title: RKE CIS v1.6 Benchmark - Self-Assessment Guide - Rancher v2.6 --- + + ### RKE CIS v1.6 Kubernetes Benchmark - Rancher v2.6 with Kubernetes v1.18 to v1.23 [Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf). diff --git a/versioned_docs/version-2.6/reference-guides/rke1-template-example-yaml.md b/versioned_docs/version-2.6/reference-guides/rke1-template-example-yaml.md index 5827dc55fcc..ec16ba61081 100644 --- a/versioned_docs/version-2.6/reference-guides/rke1-template-example-yaml.md +++ b/versioned_docs/version-2.6/reference-guides/rke1-template-example-yaml.md @@ -6,6 +6,8 @@ title: RKE1 Example YAML + + Below is an example RKE template configuration file for reference. The YAML in the RKE template uses the same customization that is used when you create an RKE cluster. However, since the YAML is within the context of a Rancher provisioned RKE cluster, the customization from the RKE docs needs to be nested under the `rancher_kubernetes_engine` directive. diff --git a/versioned_docs/version-2.7/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md b/versioned_docs/version-2.7/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md index 71b3a37204c..53ad99dc445 100644 --- a/versioned_docs/version-2.7/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md +++ b/versioned_docs/version-2.7/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md @@ -6,6 +6,8 @@ title: Upgrading Kubernetes without Upgrading Rancher + + The RKE metadata feature allows you to provision clusters with new versions of Kubernetes as soon as they are released, without upgrading Rancher. This feature is useful for taking advantage of patch versions of Kubernetes, for example, if you want to upgrade to Kubernetes v1.14.7 when your Rancher server originally supported v1.14.6. :::note diff --git a/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md b/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md index e67a2da5d6d..1ecbe229d25 100644 --- a/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md +++ b/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md @@ -6,6 +6,8 @@ title: About RKE1 Templates + + RKE templates are designed to allow DevOps and security teams to standardize and simplify the creation of Kubernetes clusters. RKE is the [Rancher Kubernetes Engine,](https://rancher.com/docs/rke/latest/en/) which is the tool that Rancher uses to provision Kubernetes clusters. diff --git a/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md b/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md index 6e8c75fe8d7..d729fababc1 100644 --- a/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md +++ b/versioned_docs/version-2.7/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md @@ -6,6 +6,8 @@ title: Creating and Revising RKE Templates + + This section describes how to manage RKE templates and revisions. You an create, share, update, and delete templates from the **Cluster Management** view under **RKE1 Configuration > RKE Templates**. Template updates are handled through a revision system. When template owners want to change or update a template, they create a new revision of the template. Individual revisions cannot be edited. However, if you want to prevent a revision from being used to create a new cluster, you can disable it. diff --git a/versioned_docs/version-2.7/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md b/versioned_docs/version-2.7/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md index d1bd489bd16..a2e638b9073 100644 --- a/versioned_docs/version-2.7/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md +++ b/versioned_docs/version-2.7/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md @@ -6,6 +6,8 @@ title: Setting up Infrastructure for a High Availability RKE Kubernetes Cluster + + This tutorial is intended to help you create a high-availability RKE cluster that can be used to install a Rancher server. :::note Important: diff --git a/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md b/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md index e61bdb43e0a..9455eaef0be 100644 --- a/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md +++ b/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md @@ -6,6 +6,8 @@ title: Setting up a High-availability RKE Kubernetes Cluster + + This section describes how to install a Kubernetes cluster. This cluster should be dedicated to run only the Rancher server. :::note diff --git a/versioned_docs/version-2.7/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md b/versioned_docs/version-2.7/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md index 738178fdc41..ed8db366fbc 100644 --- a/versioned_docs/version-2.7/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md +++ b/versioned_docs/version-2.7/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md @@ -6,6 +6,8 @@ title: Behavior Differences Between RKE1 and RKE2 + + RKE2, also known as RKE Government, is a Kubernetes distribution that focuses on security and compliance for U.S. Federal Government entities. It is considered the next iteration of the Rancher Kubernetes Engine, now known as RKE1. RKE1 and RKE2 have several slight behavioral differences to note, and this page will highlight some of these at a high level. diff --git a/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md b/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md index 5668d117432..d47f71b679b 100644 --- a/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md +++ b/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md @@ -6,6 +6,8 @@ title: RKE Cluster Configuration Reference + + When Rancher installs Kubernetes, it uses [RKE](../../../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) or [RKE2](https://docs.rke2.io/) as the Kubernetes distribution. This section covers the configuration options that are available in Rancher for a new or existing RKE Kubernetes cluster. diff --git a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md index 22c465eb07d..690c90f0f82 100644 --- a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md +++ b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md @@ -2,6 +2,8 @@ title: RKE Hardening Guides --- + + diff --git a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md index 774f12f8be9..c71bf5a9d23 100644 --- a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md +++ b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md @@ -6,6 +6,8 @@ title: RKE Self-Assessment Guide - CIS Benchmark v1.23 - K8s v1.23 + + This document is a companion to the [RKE Hardening Guide](rke1-hardening-guide.md), which provides prescriptive guidance on how to harden RKE clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: diff --git a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md index e37a56d277e..c98de564bf1 100644 --- a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md +++ b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md @@ -1,10 +1,12 @@ --- title: RKE Self-Assessment Guide - CIS Benchmark v1.24 - K8s v1.24 ---- - - - - +--- + + + + + + This document is a companion to the [RKE Hardening Guide](rke1-hardening-guide.md), which provides prescriptive guidance on how to harden RKE clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. diff --git a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md index bfb274d96fa..ac002a20369 100644 --- a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md +++ b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md @@ -1,10 +1,12 @@ --- title: RKE Self-Assessment Guide - CIS Benchmark v1.7 - K8s v1.25/v1.26/v1.27 ---- - - - - +--- + + + + + + This document is a companion to the [RKE Hardening Guide](rke1-hardening-guide.md), which provides prescriptive guidance on how to harden RKE clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. diff --git a/versioned_docs/version-2.7/reference-guides/rke1-template-example-yaml.md b/versioned_docs/version-2.7/reference-guides/rke1-template-example-yaml.md index 5827dc55fcc..ec16ba61081 100644 --- a/versioned_docs/version-2.7/reference-guides/rke1-template-example-yaml.md +++ b/versioned_docs/version-2.7/reference-guides/rke1-template-example-yaml.md @@ -6,6 +6,8 @@ title: RKE1 Example YAML + + Below is an example RKE template configuration file for reference. The YAML in the RKE template uses the same customization that is used when you create an RKE cluster. However, since the YAML is within the context of a Rancher provisioned RKE cluster, the customization from the RKE docs needs to be nested under the `rancher_kubernetes_engine` directive. diff --git a/versioned_docs/version-2.8/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md b/versioned_docs/version-2.8/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md index 71b3a37204c..53ad99dc445 100644 --- a/versioned_docs/version-2.8/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md +++ b/versioned_docs/version-2.8/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md @@ -6,6 +6,8 @@ title: Upgrading Kubernetes without Upgrading Rancher + + The RKE metadata feature allows you to provision clusters with new versions of Kubernetes as soon as they are released, without upgrading Rancher. This feature is useful for taking advantage of patch versions of Kubernetes, for example, if you want to upgrade to Kubernetes v1.14.7 when your Rancher server originally supported v1.14.6. :::note diff --git a/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md b/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md index e67a2da5d6d..1ecbe229d25 100644 --- a/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md +++ b/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md @@ -6,6 +6,8 @@ title: About RKE1 Templates + + RKE templates are designed to allow DevOps and security teams to standardize and simplify the creation of Kubernetes clusters. RKE is the [Rancher Kubernetes Engine,](https://rancher.com/docs/rke/latest/en/) which is the tool that Rancher uses to provision Kubernetes clusters. diff --git a/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md b/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md index 6e8c75fe8d7..d729fababc1 100644 --- a/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md +++ b/versioned_docs/version-2.8/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md @@ -6,6 +6,8 @@ title: Creating and Revising RKE Templates + + This section describes how to manage RKE templates and revisions. You an create, share, update, and delete templates from the **Cluster Management** view under **RKE1 Configuration > RKE Templates**. Template updates are handled through a revision system. When template owners want to change or update a template, they create a new revision of the template. Individual revisions cannot be edited. However, if you want to prevent a revision from being used to create a new cluster, you can disable it. diff --git a/versioned_docs/version-2.8/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md b/versioned_docs/version-2.8/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md index d1bd489bd16..a2e638b9073 100644 --- a/versioned_docs/version-2.8/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md +++ b/versioned_docs/version-2.8/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md @@ -6,6 +6,8 @@ title: Setting up Infrastructure for a High Availability RKE Kubernetes Cluster + + This tutorial is intended to help you create a high-availability RKE cluster that can be used to install a Rancher server. :::note Important: diff --git a/versioned_docs/version-2.8/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md b/versioned_docs/version-2.8/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md index e61bdb43e0a..9455eaef0be 100644 --- a/versioned_docs/version-2.8/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md +++ b/versioned_docs/version-2.8/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md @@ -6,6 +6,8 @@ title: Setting up a High-availability RKE Kubernetes Cluster + + This section describes how to install a Kubernetes cluster. This cluster should be dedicated to run only the Rancher server. :::note diff --git a/versioned_docs/version-2.8/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md b/versioned_docs/version-2.8/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md index 738178fdc41..ed8db366fbc 100644 --- a/versioned_docs/version-2.8/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md +++ b/versioned_docs/version-2.8/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md @@ -6,6 +6,8 @@ title: Behavior Differences Between RKE1 and RKE2 + + RKE2, also known as RKE Government, is a Kubernetes distribution that focuses on security and compliance for U.S. Federal Government entities. It is considered the next iteration of the Rancher Kubernetes Engine, now known as RKE1. RKE1 and RKE2 have several slight behavioral differences to note, and this page will highlight some of these at a high level. diff --git a/versioned_docs/version-2.8/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md b/versioned_docs/version-2.8/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md index 5668d117432..d47f71b679b 100644 --- a/versioned_docs/version-2.8/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md +++ b/versioned_docs/version-2.8/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md @@ -6,6 +6,8 @@ title: RKE Cluster Configuration Reference + + When Rancher installs Kubernetes, it uses [RKE](../../../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) or [RKE2](https://docs.rke2.io/) as the Kubernetes distribution. This section covers the configuration options that are available in Rancher for a new or existing RKE Kubernetes cluster. diff --git a/versioned_docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md b/versioned_docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md index 138c9439271..477e12c7ce6 100644 --- a/versioned_docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md +++ b/versioned_docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md @@ -2,6 +2,8 @@ title: RKE Hardening Guides --- + + diff --git a/versioned_docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md b/versioned_docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md index 774f12f8be9..c71bf5a9d23 100644 --- a/versioned_docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md +++ b/versioned_docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md @@ -6,6 +6,8 @@ title: RKE Self-Assessment Guide - CIS Benchmark v1.23 - K8s v1.23 + + This document is a companion to the [RKE Hardening Guide](rke1-hardening-guide.md), which provides prescriptive guidance on how to harden RKE clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: diff --git a/versioned_docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md b/versioned_docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md index e37a56d277e..c98de564bf1 100644 --- a/versioned_docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md +++ b/versioned_docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md @@ -1,10 +1,12 @@ --- title: RKE Self-Assessment Guide - CIS Benchmark v1.24 - K8s v1.24 ---- - - - - +--- + + + + + + This document is a companion to the [RKE Hardening Guide](rke1-hardening-guide.md), which provides prescriptive guidance on how to harden RKE clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. diff --git a/versioned_docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md b/versioned_docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md index bfb274d96fa..ac002a20369 100644 --- a/versioned_docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md +++ b/versioned_docs/version-2.8/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md @@ -1,10 +1,12 @@ --- title: RKE Self-Assessment Guide - CIS Benchmark v1.7 - K8s v1.25/v1.26/v1.27 ---- - - - - +--- + + + + + + This document is a companion to the [RKE Hardening Guide](rke1-hardening-guide.md), which provides prescriptive guidance on how to harden RKE clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. diff --git a/versioned_docs/version-2.8/reference-guides/rke1-template-example-yaml.md b/versioned_docs/version-2.8/reference-guides/rke1-template-example-yaml.md index 5827dc55fcc..ec16ba61081 100644 --- a/versioned_docs/version-2.8/reference-guides/rke1-template-example-yaml.md +++ b/versioned_docs/version-2.8/reference-guides/rke1-template-example-yaml.md @@ -6,6 +6,8 @@ title: RKE1 Example YAML + + Below is an example RKE template configuration file for reference. The YAML in the RKE template uses the same customization that is used when you create an RKE cluster. However, since the YAML is within the context of a Rancher provisioned RKE cluster, the customization from the RKE docs needs to be nested under the `rancher_kubernetes_engine` directive. diff --git a/versioned_docs/version-2.9/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md b/versioned_docs/version-2.9/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md index 71b3a37204c..53ad99dc445 100644 --- a/versioned_docs/version-2.9/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md +++ b/versioned_docs/version-2.9/getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.md @@ -6,6 +6,8 @@ title: Upgrading Kubernetes without Upgrading Rancher + + The RKE metadata feature allows you to provision clusters with new versions of Kubernetes as soon as they are released, without upgrading Rancher. This feature is useful for taking advantage of patch versions of Kubernetes, for example, if you want to upgrade to Kubernetes v1.14.7 when your Rancher server originally supported v1.14.6. :::note diff --git a/versioned_docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md b/versioned_docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md index e67a2da5d6d..1ecbe229d25 100644 --- a/versioned_docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md +++ b/versioned_docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/about-rke1-templates.md @@ -6,6 +6,8 @@ title: About RKE1 Templates + + RKE templates are designed to allow DevOps and security teams to standardize and simplify the creation of Kubernetes clusters. RKE is the [Rancher Kubernetes Engine,](https://rancher.com/docs/rke/latest/en/) which is the tool that Rancher uses to provision Kubernetes clusters. diff --git a/versioned_docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md b/versioned_docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md index 6e8c75fe8d7..d729fababc1 100644 --- a/versioned_docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md +++ b/versioned_docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-rke1-templates/manage-rke1-templates.md @@ -6,6 +6,8 @@ title: Creating and Revising RKE Templates + + This section describes how to manage RKE templates and revisions. You an create, share, update, and delete templates from the **Cluster Management** view under **RKE1 Configuration > RKE Templates**. Template updates are handled through a revision system. When template owners want to change or update a template, they create a new revision of the template. Individual revisions cannot be edited. However, if you want to prevent a revision from being used to create a new cluster, you can disable it. diff --git a/versioned_docs/version-2.9/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md b/versioned_docs/version-2.9/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md index d1bd489bd16..a2e638b9073 100644 --- a/versioned_docs/version-2.9/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md +++ b/versioned_docs/version-2.9/how-to-guides/new-user-guides/infrastructure-setup/ha-rke1-kubernetes-cluster.md @@ -6,6 +6,8 @@ title: Setting up Infrastructure for a High Availability RKE Kubernetes Cluster + + This tutorial is intended to help you create a high-availability RKE cluster that can be used to install a Rancher server. :::note Important: diff --git a/versioned_docs/version-2.9/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md b/versioned_docs/version-2.9/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md index e61bdb43e0a..9455eaef0be 100644 --- a/versioned_docs/version-2.9/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md +++ b/versioned_docs/version-2.9/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher.md @@ -6,6 +6,8 @@ title: Setting up a High-availability RKE Kubernetes Cluster + + This section describes how to install a Kubernetes cluster. This cluster should be dedicated to run only the Rancher server. :::note diff --git a/versioned_docs/version-2.9/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md b/versioned_docs/version-2.9/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md index 738178fdc41..ed8db366fbc 100644 --- a/versioned_docs/version-2.9/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md +++ b/versioned_docs/version-2.9/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences.md @@ -6,6 +6,8 @@ title: Behavior Differences Between RKE1 and RKE2 + + RKE2, also known as RKE Government, is a Kubernetes distribution that focuses on security and compliance for U.S. Federal Government entities. It is considered the next iteration of the Rancher Kubernetes Engine, now known as RKE1. RKE1 and RKE2 have several slight behavioral differences to note, and this page will highlight some of these at a high level. diff --git a/versioned_docs/version-2.9/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md b/versioned_docs/version-2.9/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md index 5668d117432..d47f71b679b 100644 --- a/versioned_docs/version-2.9/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md +++ b/versioned_docs/version-2.9/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md @@ -6,6 +6,8 @@ title: RKE Cluster Configuration Reference + + When Rancher installs Kubernetes, it uses [RKE](../../../how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md) or [RKE2](https://docs.rke2.io/) as the Kubernetes distribution. This section covers the configuration options that are available in Rancher for a new or existing RKE Kubernetes cluster. diff --git a/versioned_docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md b/versioned_docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md index 22c465eb07d..690c90f0f82 100644 --- a/versioned_docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md +++ b/versioned_docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md @@ -2,6 +2,8 @@ title: RKE Hardening Guides --- + + diff --git a/versioned_docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md b/versioned_docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md index 774f12f8be9..c71bf5a9d23 100644 --- a/versioned_docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md +++ b/versioned_docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md @@ -6,6 +6,8 @@ title: RKE Self-Assessment Guide - CIS Benchmark v1.23 - K8s v1.23 + + This document is a companion to the [RKE Hardening Guide](rke1-hardening-guide.md), which provides prescriptive guidance on how to harden RKE clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: diff --git a/versioned_docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md b/versioned_docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md index e37a56d277e..c98de564bf1 100644 --- a/versioned_docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md +++ b/versioned_docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md @@ -1,10 +1,12 @@ --- title: RKE Self-Assessment Guide - CIS Benchmark v1.24 - K8s v1.24 ---- - - - - +--- + + + + + + This document is a companion to the [RKE Hardening Guide](rke1-hardening-guide.md), which provides prescriptive guidance on how to harden RKE clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. diff --git a/versioned_docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md b/versioned_docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md index bfb274d96fa..ac002a20369 100644 --- a/versioned_docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md +++ b/versioned_docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md @@ -1,10 +1,12 @@ --- title: RKE Self-Assessment Guide - CIS Benchmark v1.7 - K8s v1.25/v1.26/v1.27 ---- - - - - +--- + + + + + + This document is a companion to the [RKE Hardening Guide](rke1-hardening-guide.md), which provides prescriptive guidance on how to harden RKE clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. diff --git a/versioned_docs/version-2.9/reference-guides/rke1-template-example-yaml.md b/versioned_docs/version-2.9/reference-guides/rke1-template-example-yaml.md index 5827dc55fcc..ec16ba61081 100644 --- a/versioned_docs/version-2.9/reference-guides/rke1-template-example-yaml.md +++ b/versioned_docs/version-2.9/reference-guides/rke1-template-example-yaml.md @@ -6,6 +6,8 @@ title: RKE1 Example YAML + + Below is an example RKE template configuration file for reference. The YAML in the RKE template uses the same customization that is used when you create an RKE cluster. However, since the YAML is within the context of a Rancher provisioned RKE cluster, the customization from the RKE docs needs to be nested under the `rancher_kubernetes_engine` directive. From 826ae8e86c74ebee807fa48d52cec8989446e2a3 Mon Sep 17 00:00:00 2001 From: Jonathan Crowther Date: Mon, 17 Feb 2025 13:25:07 -0500 Subject: [PATCH 17/32] Add documentation for aggregated clusterroles --- .../installation-references/feature-flags.md | 2 ++ .../cluster-role-aggregation.md | 19 +++++++++++++++++++ 2 files changed, 21 insertions(+) create mode 100644 docs/how-to-guides/advanced-user-guides/enable-experimental-features/cluster-role-aggregation.md diff --git a/docs/getting-started/installation-and-upgrade/installation-references/feature-flags.md b/docs/getting-started/installation-and-upgrade/installation-references/feature-flags.md index 969252b53e9..0a3fa8e2281 100644 --- a/docs/getting-started/installation-and-upgrade/installation-references/feature-flags.md +++ b/docs/getting-started/installation-and-upgrade/installation-references/feature-flags.md @@ -18,6 +18,7 @@ Some feature flags require a restart of the Rancher container. Features that req The following is a list of feature flags available in Rancher. If you've upgraded from a previous Rancher version, you may see additional flags in the Rancher UI, such as `proxy` or `dashboard` (both [discontinued](https://github.com/rancher/rancher-docs/tree/main/archived_docs/en/version-2.5/reference-guides/installation-references/feature-flags.md)): +- `aggregated-roletemplates`: Use cluster role aggregation architecture for RoleTemplates, ProjectRoleTemplateBindings, and ClusterRoleTemplateBindings. See [Cluster Role Aggregation](../../../how-to-guides/advanced-user-guides/enable-experimental-features/cluster-role-aggregation.md) for more information. - `clean-stale-secrets`: Removes stale secrets from the `cattle-impersonation-system` namespace. This slowly cleans up old secrets which are no longer being used by the impersonation system. - `continuous-delivery`: Allows Fleet GitOps to be disabled separately from Fleet. See [Continuous Delivery.](../../../how-to-guides/advanced-user-guides/enable-experimental-features/continuous-delivery.md) for more information. - `fleet`: The Rancher provisioning framework in v2.6 and later requires Fleet. The flag will be automatically enabled when you upgrade, even if you disabled this flag in an earlier version of Rancher. See [Continuous Delivery with Fleet](../../../integrations-in-rancher/fleet/fleet.md) for more information. @@ -38,6 +39,7 @@ The following table shows the availability and default values for some feature f | Feature Flag Name | Default Value | Status | Available As Of | Additional Information | | ----------------------------- | ------------- | ------------ | --------------- | ---------------------- | +| `aggregated-roletemplates | `false` | Highly experimentatl | v2.11.0 | This flag value is locked on install and can't be changed. | | `clean-stale-secrets` | `true` | GA | v2.10.2 | | | `continuous-delivery` | `true` | GA | v2.6.0 | | | `external-rules` | v2.7.14: `false`, v2.8.5: `true` | Removed | v2.7.14, v2.8.5 | This flag affected [external `RoleTemplate` behavior](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md#external-roletemplate-behavior). It is removed in Rancher v2.9.0 and later as the behavior is enabled by default. | diff --git a/docs/how-to-guides/advanced-user-guides/enable-experimental-features/cluster-role-aggregation.md b/docs/how-to-guides/advanced-user-guides/enable-experimental-features/cluster-role-aggregation.md new file mode 100644 index 00000000000..7b11c57a96a --- /dev/null +++ b/docs/how-to-guides/advanced-user-guides/enable-experimental-features/cluster-role-aggregation.md @@ -0,0 +1,19 @@ +--- +title: ClusterRole Aggregation +--- + + + + + +:::caution +ClusterRole Aggregation is a highly experimental feature that changes the RBAC architecture used for RoleTemplates, ClusterRoleTemplateBindings and ProjectRoleTemplateBindings. **Not supported for production environments**. Meant exclusively for internal testing in v2.11. Expected to be available as a beta for users in v2.12 with a prospective GA in Rancher v2.13. +::: + +ClusterRole aggregation implements RoleTemplates, ClusterRoleTemplateBindings and ProjectRoleTemplateBindings using the Kubernetes feature [Aggregated ClusterRoles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles). The new architecture results in a net reduction in RBAC objects (Roles, RoleBindings, ClusterRoles and ClusterRoleBindings) both in the Rancher cluster and the downstream clusters. + +Environment Variable Key | Default Value | Description +--- | --- | --- +`aggregated-roletemplates` | `false` | [Experimental] Make RoleTemplates use aggregation for generated RBAC roles + +The value of this feature flag is locked on install, which shows up in the UI as a lock symbol beside the feature flag. That means the feature can only be set on the first ever installation of Rancher. After that, attempting to modify the value will be denied. From d0a35e1a3e7aaa3aab30d53237de085500e6441c Mon Sep 17 00:00:00 2001 From: Jonathan Crowther Date: Mon, 17 Mar 2025 13:53:07 -0400 Subject: [PATCH 18/32] Missing quote --- .../installation-references/feature-flags.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/getting-started/installation-and-upgrade/installation-references/feature-flags.md b/docs/getting-started/installation-and-upgrade/installation-references/feature-flags.md index 0a3fa8e2281..9af792a8a1d 100644 --- a/docs/getting-started/installation-and-upgrade/installation-references/feature-flags.md +++ b/docs/getting-started/installation-and-upgrade/installation-references/feature-flags.md @@ -39,7 +39,7 @@ The following table shows the availability and default values for some feature f | Feature Flag Name | Default Value | Status | Available As Of | Additional Information | | ----------------------------- | ------------- | ------------ | --------------- | ---------------------- | -| `aggregated-roletemplates | `false` | Highly experimentatl | v2.11.0 | This flag value is locked on install and can't be changed. | +| `aggregated-roletemplates` | `false` | Highly experimentatl | v2.11.0 | This flag value is locked on install and can't be changed. | | `clean-stale-secrets` | `true` | GA | v2.10.2 | | | `continuous-delivery` | `true` | GA | v2.6.0 | | | `external-rules` | v2.7.14: `false`, v2.8.5: `true` | Removed | v2.7.14, v2.8.5 | This flag affected [external `RoleTemplate` behavior](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md#external-roletemplate-behavior). It is removed in Rancher v2.9.0 and later as the behavior is enabled by default. | From 81c14ffd09951c906bd268baeed3e6b52400f4ec Mon Sep 17 00:00:00 2001 From: Jonathan Crowther Date: Wed, 19 Mar 2025 09:41:47 -0400 Subject: [PATCH 19/32] Fix some wording --- .../cluster-role-aggregation.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/how-to-guides/advanced-user-guides/enable-experimental-features/cluster-role-aggregation.md b/docs/how-to-guides/advanced-user-guides/enable-experimental-features/cluster-role-aggregation.md index 7b11c57a96a..b28f285bb72 100644 --- a/docs/how-to-guides/advanced-user-guides/enable-experimental-features/cluster-role-aggregation.md +++ b/docs/how-to-guides/advanced-user-guides/enable-experimental-features/cluster-role-aggregation.md @@ -7,13 +7,13 @@ title: ClusterRole Aggregation :::caution -ClusterRole Aggregation is a highly experimental feature that changes the RBAC architecture used for RoleTemplates, ClusterRoleTemplateBindings and ProjectRoleTemplateBindings. **Not supported for production environments**. Meant exclusively for internal testing in v2.11. Expected to be available as a beta for users in v2.12 with a prospective GA in Rancher v2.13. +ClusterRole aggregation is a highly experimental feature that changes the RBAC architecture used for RoleTemplates, ClusterRoleTemplateBindings and ProjectRoleTemplateBindings. **It is not supported for production environments**. This feature is meant exclusively for internal testing in v2.11. It is expected to be available as a beta for users in v2.12 with a prospective GA in Rancher v2.13. ::: ClusterRole aggregation implements RoleTemplates, ClusterRoleTemplateBindings and ProjectRoleTemplateBindings using the Kubernetes feature [Aggregated ClusterRoles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles). The new architecture results in a net reduction in RBAC objects (Roles, RoleBindings, ClusterRoles and ClusterRoleBindings) both in the Rancher cluster and the downstream clusters. -Environment Variable Key | Default Value | Description ---- | --- | --- -`aggregated-roletemplates` | `false` | [Experimental] Make RoleTemplates use aggregation for generated RBAC roles +| Environment Variable Key | Default Value | Description | +| --- | --- | --- | +| `aggregated-roletemplates` | `false` | [Experimental] Make RoleTemplates use aggregation for generated RBAC roles. | -The value of this feature flag is locked on install, which shows up in the UI as a lock symbol beside the feature flag. That means the feature can only be set on the first ever installation of Rancher. After that, attempting to modify the value will be denied. +The value of this feature flag is locked on installation, which shows up in the UI as a lock symbol beside the feature flag. That means the feature can only be set on the first ever installation of Rancher. After that, attempting to modify the value will be denied. From d55be97e14cb08e6fdb8b93f55e3ef5e326edc25 Mon Sep 17 00:00:00 2001 From: Jonathan Crowther Date: Wed, 19 Mar 2025 09:46:07 -0400 Subject: [PATCH 20/32] Added versioned docs and sidebar --- sidebars.js | 1 + .../installation-references/feature-flags.md | 2 ++ .../cluster-role-aggregation.md | 19 +++++++++++++++++++ versioned_sidebars/version-2.11-sidebars.json | 3 ++- 4 files changed, 24 insertions(+), 1 deletion(-) create mode 100644 versioned_docs/version-2.11/how-to-guides/advanced-user-guides/enable-experimental-features/cluster-role-aggregation.md diff --git a/sidebars.js b/sidebars.js index 3e636d11f0b..e9e1733089d 100644 --- a/sidebars.js +++ b/sidebars.js @@ -796,6 +796,7 @@ const sidebars = { "how-to-guides/advanced-user-guides/enable-experimental-features/unsupported-storage-drivers", "how-to-guides/advanced-user-guides/enable-experimental-features/istio-traffic-management-features", "how-to-guides/advanced-user-guides/enable-experimental-features/continuous-delivery", + "how-to-guides/advanced-user-guides/enable-experimental-features/cluster-role-aggregation", ] }, "how-to-guides/advanced-user-guides/open-ports-with-firewalld", diff --git a/versioned_docs/version-2.11/getting-started/installation-and-upgrade/installation-references/feature-flags.md b/versioned_docs/version-2.11/getting-started/installation-and-upgrade/installation-references/feature-flags.md index 969252b53e9..9af792a8a1d 100644 --- a/versioned_docs/version-2.11/getting-started/installation-and-upgrade/installation-references/feature-flags.md +++ b/versioned_docs/version-2.11/getting-started/installation-and-upgrade/installation-references/feature-flags.md @@ -18,6 +18,7 @@ Some feature flags require a restart of the Rancher container. Features that req The following is a list of feature flags available in Rancher. If you've upgraded from a previous Rancher version, you may see additional flags in the Rancher UI, such as `proxy` or `dashboard` (both [discontinued](https://github.com/rancher/rancher-docs/tree/main/archived_docs/en/version-2.5/reference-guides/installation-references/feature-flags.md)): +- `aggregated-roletemplates`: Use cluster role aggregation architecture for RoleTemplates, ProjectRoleTemplateBindings, and ClusterRoleTemplateBindings. See [Cluster Role Aggregation](../../../how-to-guides/advanced-user-guides/enable-experimental-features/cluster-role-aggregation.md) for more information. - `clean-stale-secrets`: Removes stale secrets from the `cattle-impersonation-system` namespace. This slowly cleans up old secrets which are no longer being used by the impersonation system. - `continuous-delivery`: Allows Fleet GitOps to be disabled separately from Fleet. See [Continuous Delivery.](../../../how-to-guides/advanced-user-guides/enable-experimental-features/continuous-delivery.md) for more information. - `fleet`: The Rancher provisioning framework in v2.6 and later requires Fleet. The flag will be automatically enabled when you upgrade, even if you disabled this flag in an earlier version of Rancher. See [Continuous Delivery with Fleet](../../../integrations-in-rancher/fleet/fleet.md) for more information. @@ -38,6 +39,7 @@ The following table shows the availability and default values for some feature f | Feature Flag Name | Default Value | Status | Available As Of | Additional Information | | ----------------------------- | ------------- | ------------ | --------------- | ---------------------- | +| `aggregated-roletemplates` | `false` | Highly experimentatl | v2.11.0 | This flag value is locked on install and can't be changed. | | `clean-stale-secrets` | `true` | GA | v2.10.2 | | | `continuous-delivery` | `true` | GA | v2.6.0 | | | `external-rules` | v2.7.14: `false`, v2.8.5: `true` | Removed | v2.7.14, v2.8.5 | This flag affected [external `RoleTemplate` behavior](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md#external-roletemplate-behavior). It is removed in Rancher v2.9.0 and later as the behavior is enabled by default. | diff --git a/versioned_docs/version-2.11/how-to-guides/advanced-user-guides/enable-experimental-features/cluster-role-aggregation.md b/versioned_docs/version-2.11/how-to-guides/advanced-user-guides/enable-experimental-features/cluster-role-aggregation.md new file mode 100644 index 00000000000..b28f285bb72 --- /dev/null +++ b/versioned_docs/version-2.11/how-to-guides/advanced-user-guides/enable-experimental-features/cluster-role-aggregation.md @@ -0,0 +1,19 @@ +--- +title: ClusterRole Aggregation +--- + + + + + +:::caution +ClusterRole aggregation is a highly experimental feature that changes the RBAC architecture used for RoleTemplates, ClusterRoleTemplateBindings and ProjectRoleTemplateBindings. **It is not supported for production environments**. This feature is meant exclusively for internal testing in v2.11. It is expected to be available as a beta for users in v2.12 with a prospective GA in Rancher v2.13. +::: + +ClusterRole aggregation implements RoleTemplates, ClusterRoleTemplateBindings and ProjectRoleTemplateBindings using the Kubernetes feature [Aggregated ClusterRoles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles). The new architecture results in a net reduction in RBAC objects (Roles, RoleBindings, ClusterRoles and ClusterRoleBindings) both in the Rancher cluster and the downstream clusters. + +| Environment Variable Key | Default Value | Description | +| --- | --- | --- | +| `aggregated-roletemplates` | `false` | [Experimental] Make RoleTemplates use aggregation for generated RBAC roles. | + +The value of this feature flag is locked on installation, which shows up in the UI as a lock symbol beside the feature flag. That means the feature can only be set on the first ever installation of Rancher. After that, attempting to modify the value will be denied. diff --git a/versioned_sidebars/version-2.11-sidebars.json b/versioned_sidebars/version-2.11-sidebars.json index 394116ed4be..6a603a8a71d 100644 --- a/versioned_sidebars/version-2.11-sidebars.json +++ b/versioned_sidebars/version-2.11-sidebars.json @@ -759,7 +759,8 @@ "how-to-guides/advanced-user-guides/enable-experimental-features/rancher-on-arm64", "how-to-guides/advanced-user-guides/enable-experimental-features/unsupported-storage-drivers", "how-to-guides/advanced-user-guides/enable-experimental-features/istio-traffic-management-features", - "how-to-guides/advanced-user-guides/enable-experimental-features/continuous-delivery" + "how-to-guides/advanced-user-guides/enable-experimental-features/continuous-delivery", + "how-to-guides/advanced-user-guides/enable-experimental-features/cluster-role-aggregation" ] }, "how-to-guides/advanced-user-guides/open-ports-with-firewalld", From 1bf1ac8ba339fb1a47bb2536e6d96943e3015605 Mon Sep 17 00:00:00 2001 From: Tom Lebreux Date: Wed, 19 Mar 2025 15:09:50 -0400 Subject: [PATCH 21/32] Apply feedback --- docs/api/extension-apiserver.md | 20 +++++-------------- .../installation-references/feature-flags.md | 2 +- 2 files changed, 6 insertions(+), 16 deletions(-) diff --git a/docs/api/extension-apiserver.md b/docs/api/extension-apiserver.md index 7331577ba37..326380650ee 100644 --- a/docs/api/extension-apiserver.md +++ b/docs/api/extension-apiserver.md @@ -1,25 +1,15 @@ --- -title: Extension Apiserver +title: Extension API Server --- -Rancher extends Kubernetes with additional APIs by registering an extension -apiserver using [Kubernetes's Aggregation -layer](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation/). +Rancher extends Kubernetes with additional APIs by registering an extension API server using the [Kubernetes API Aggregation Layer](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation/). -## Disabling the extension apiserver +## Disabling the extension API server -The [aggregation layer must be -configured](https://kubernetes.io/docs/tasks/extend-kubernetes/configure-aggregation-layer/) -on the local Kubernetes cluster for the `imperative-api-extension` feature to be -enabled and to work correctly. The feature assumes this is configured and is -enabled by default. If it is not possible to configure the aggregation layer for -your local Kubernetes cluster, then you must turn off the feature. +The [aggregation layer must be configured](https://kubernetes.io/docs/tasks/extend-kubernetes/configure-aggregation-layer/) on the local Kubernetes cluster for the `imperative-api-extension` feature to be enabled and to work correctly. The feature assumes this is configured and is enabled by default. If it is not possible to configure the aggregation layer for your local Kubernetes cluster, then you must disable the feature. The `imperative-api-extension` feature flag can be disabled by either using the [Rancher UI](../how-to-guides/advanced-user-guides/enable-experimental-features#disabling-features-with-the-rancher-ui) or [Rancher API](../how-to-guides/advanced-user-guides/enable-experimental-features#disabling-features-with-the-rancher-api). -It will still be possible to access the additional APIs when the feature is -turned off. The additional APIs are available at `https:///ext` and -they are compatible with Kubernetes apiserver. This means you can use `curl` or -even `kubectl` to interact with the APIs. +It will still be possible to access the additional APIs when the feature is disabled. The additional APIs are available at `https:///ext` and they are compatible with the Kubernetes apiserver. This means you can use `curl` or `kubectl` to interact with the APIs. diff --git a/docs/getting-started/installation-and-upgrade/installation-references/feature-flags.md b/docs/getting-started/installation-and-upgrade/installation-references/feature-flags.md index ae325c0ae44..cb391cbf2a0 100644 --- a/docs/getting-started/installation-and-upgrade/installation-references/feature-flags.md +++ b/docs/getting-started/installation-and-upgrade/installation-references/feature-flags.md @@ -22,7 +22,7 @@ The following is a list of feature flags available in Rancher. If you've upgrade - `continuous-delivery`: Allows Fleet GitOps to be disabled separately from Fleet. See [Continuous Delivery.](../../../how-to-guides/advanced-user-guides/enable-experimental-features/continuous-delivery.md) for more information. - `fleet`: The Rancher provisioning framework in v2.6 and later requires Fleet. The flag will be automatically enabled when you upgrade, even if you disabled this flag in an earlier version of Rancher. See [Continuous Delivery with Fleet](../../../integrations-in-rancher/fleet/fleet.md) for more information. - `harvester`: Manages access to the Virtualization Management page, where users can navigate directly to Harvester clusters and access the Harvester UI. See [Harvester Integration Overview](../../../integrations-in-rancher/harvester/overview.md) for more information. -- `imperative-api-extension`: Enables Rancher's [extension API server](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation/) to register new APIs to Kubernetes. See [Extension Apiserver](../../../api/extension-apiserver.md) for more information. +- `imperative-api-extension`: Enables Rancher's [extension API server](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation/) to register new APIs to Kubernetes. This flag is enabled by default. See the [Extension API Server](../../../api/extension-apiserver.md) page for more information. - `istio-virtual-service-ui`: Enables a [visual interface](../../../how-to-guides/advanced-user-guides/enable-experimental-features/istio-traffic-management-features.md) to create, read, update, and delete Istio virtual services and destination rules, which are Istio traffic management features. - `legacy`: Enables a set of features from 2.5.x and earlier, that are slowly being phased out in favor of newer implementations. These are a mix of deprecated features as well as features that will eventually be available to newer versions. This flag is disabled by default on new Rancher installations. If you're upgrading from a previous version of Rancher, this flag is enabled. - `managed-system-upgrade-controller`: Enables the installation of the system-upgrade-controller app in downstream RKE2/K3s clusters, currently limited to imported clusters and the local cluster, with plans to expand support to node-driver clusters. From d43f53d0faa8c91aacbd963d64357234b364aebb Mon Sep 17 00:00:00 2001 From: Tom Lebreux Date: Wed, 19 Mar 2025 15:14:30 -0400 Subject: [PATCH 22/32] Document extension API server for 2.11 --- .../version-2.11/api/extension-apiserver.md | 15 +++++++++++++++ .../installation-references/feature-flags.md | 2 ++ versioned_sidebars/version-2.11-sidebars.json | 1 + 3 files changed, 18 insertions(+) create mode 100644 versioned_docs/version-2.11/api/extension-apiserver.md diff --git a/versioned_docs/version-2.11/api/extension-apiserver.md b/versioned_docs/version-2.11/api/extension-apiserver.md new file mode 100644 index 00000000000..326380650ee --- /dev/null +++ b/versioned_docs/version-2.11/api/extension-apiserver.md @@ -0,0 +1,15 @@ +--- +title: Extension API Server +--- + + + + + +Rancher extends Kubernetes with additional APIs by registering an extension API server using the [Kubernetes API Aggregation Layer](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation/). + +## Disabling the extension API server + +The [aggregation layer must be configured](https://kubernetes.io/docs/tasks/extend-kubernetes/configure-aggregation-layer/) on the local Kubernetes cluster for the `imperative-api-extension` feature to be enabled and to work correctly. The feature assumes this is configured and is enabled by default. If it is not possible to configure the aggregation layer for your local Kubernetes cluster, then you must disable the feature. The `imperative-api-extension` feature flag can be disabled by either using the [Rancher UI](../how-to-guides/advanced-user-guides/enable-experimental-features#disabling-features-with-the-rancher-ui) or [Rancher API](../how-to-guides/advanced-user-guides/enable-experimental-features#disabling-features-with-the-rancher-api). + +It will still be possible to access the additional APIs when the feature is disabled. The additional APIs are available at `https:///ext` and they are compatible with the Kubernetes apiserver. This means you can use `curl` or `kubectl` to interact with the APIs. diff --git a/versioned_docs/version-2.11/getting-started/installation-and-upgrade/installation-references/feature-flags.md b/versioned_docs/version-2.11/getting-started/installation-and-upgrade/installation-references/feature-flags.md index 969252b53e9..cb391cbf2a0 100644 --- a/versioned_docs/version-2.11/getting-started/installation-and-upgrade/installation-references/feature-flags.md +++ b/versioned_docs/version-2.11/getting-started/installation-and-upgrade/installation-references/feature-flags.md @@ -22,6 +22,7 @@ The following is a list of feature flags available in Rancher. If you've upgrade - `continuous-delivery`: Allows Fleet GitOps to be disabled separately from Fleet. See [Continuous Delivery.](../../../how-to-guides/advanced-user-guides/enable-experimental-features/continuous-delivery.md) for more information. - `fleet`: The Rancher provisioning framework in v2.6 and later requires Fleet. The flag will be automatically enabled when you upgrade, even if you disabled this flag in an earlier version of Rancher. See [Continuous Delivery with Fleet](../../../integrations-in-rancher/fleet/fleet.md) for more information. - `harvester`: Manages access to the Virtualization Management page, where users can navigate directly to Harvester clusters and access the Harvester UI. See [Harvester Integration Overview](../../../integrations-in-rancher/harvester/overview.md) for more information. +- `imperative-api-extension`: Enables Rancher's [extension API server](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation/) to register new APIs to Kubernetes. This flag is enabled by default. See the [Extension API Server](../../../api/extension-apiserver.md) page for more information. - `istio-virtual-service-ui`: Enables a [visual interface](../../../how-to-guides/advanced-user-guides/enable-experimental-features/istio-traffic-management-features.md) to create, read, update, and delete Istio virtual services and destination rules, which are Istio traffic management features. - `legacy`: Enables a set of features from 2.5.x and earlier, that are slowly being phased out in favor of newer implementations. These are a mix of deprecated features as well as features that will eventually be available to newer versions. This flag is disabled by default on new Rancher installations. If you're upgrading from a previous version of Rancher, this flag is enabled. - `managed-system-upgrade-controller`: Enables the installation of the system-upgrade-controller app in downstream RKE2/K3s clusters, currently limited to imported clusters and the local cluster, with plans to expand support to node-driver clusters. @@ -44,6 +45,7 @@ The following table shows the availability and default values for some feature f | `fleet` | `true` | Can no longer be disabled | v2.6.0 | | | `fleet` | `true` | GA | v2.5.0 | | | `harvester` | `true` | Experimental | v2.6.1 | | +| `imperative-api-extension` | `true` | GA | v2.11.0 | | | `legacy` | `false` for new installs, `true` for upgrades | GA | v2.6.0 | | | `managed-system-upgrade-controller` | `true` | GA | v2.10.0 | | | `rke1-custom-node-cleanup`| `true` | GA | v2.6.0 | | diff --git a/versioned_sidebars/version-2.11-sidebars.json b/versioned_sidebars/version-2.11-sidebars.json index 394116ed4be..c2f76f9f669 100644 --- a/versioned_sidebars/version-2.11-sidebars.json +++ b/versioned_sidebars/version-2.11-sidebars.json @@ -1320,6 +1320,7 @@ }, "api/api-reference", "api/api-tokens", + "api/extension-apiserver", "api/v3-rancher-api-guide" ] }, From 5a8a96fc0a7de0a0819f2b1b97878df2c100d5a6 Mon Sep 17 00:00:00 2001 From: Tom Lebreux Date: Wed, 19 Mar 2025 16:02:08 -0400 Subject: [PATCH 23/32] Fix link reference --- docs/api/extension-apiserver.md | 2 +- versioned_docs/version-2.11/api/extension-apiserver.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/api/extension-apiserver.md b/docs/api/extension-apiserver.md index 326380650ee..8f8786bd328 100644 --- a/docs/api/extension-apiserver.md +++ b/docs/api/extension-apiserver.md @@ -10,6 +10,6 @@ Rancher extends Kubernetes with additional APIs by registering an extension API ## Disabling the extension API server -The [aggregation layer must be configured](https://kubernetes.io/docs/tasks/extend-kubernetes/configure-aggregation-layer/) on the local Kubernetes cluster for the `imperative-api-extension` feature to be enabled and to work correctly. The feature assumes this is configured and is enabled by default. If it is not possible to configure the aggregation layer for your local Kubernetes cluster, then you must disable the feature. The `imperative-api-extension` feature flag can be disabled by either using the [Rancher UI](../how-to-guides/advanced-user-guides/enable-experimental-features#disabling-features-with-the-rancher-ui) or [Rancher API](../how-to-guides/advanced-user-guides/enable-experimental-features#disabling-features-with-the-rancher-api). +The [aggregation layer must be configured](https://kubernetes.io/docs/tasks/extend-kubernetes/configure-aggregation-layer/) on the local Kubernetes cluster for the `imperative-api-extension` feature to be enabled and to work correctly. The feature assumes this is configured and is enabled by default. If it is not possible to configure the aggregation layer for your local Kubernetes cluster, then you must disable the feature. The `imperative-api-extension` feature flag can be disabled by either using the [Rancher UI](../how-to-guides/advanced-user-guides/enable-experimental-features/enable-experimental-features.md#disabling-features-with-the-rancher-ui) or [Rancher API](../how-to-guides/advanced-user-guides/enable-experimental-features/enable-experimental-features.md#disabling-features-with-the-rancher-api). It will still be possible to access the additional APIs when the feature is disabled. The additional APIs are available at `https:///ext` and they are compatible with the Kubernetes apiserver. This means you can use `curl` or `kubectl` to interact with the APIs. diff --git a/versioned_docs/version-2.11/api/extension-apiserver.md b/versioned_docs/version-2.11/api/extension-apiserver.md index 326380650ee..8f8786bd328 100644 --- a/versioned_docs/version-2.11/api/extension-apiserver.md +++ b/versioned_docs/version-2.11/api/extension-apiserver.md @@ -10,6 +10,6 @@ Rancher extends Kubernetes with additional APIs by registering an extension API ## Disabling the extension API server -The [aggregation layer must be configured](https://kubernetes.io/docs/tasks/extend-kubernetes/configure-aggregation-layer/) on the local Kubernetes cluster for the `imperative-api-extension` feature to be enabled and to work correctly. The feature assumes this is configured and is enabled by default. If it is not possible to configure the aggregation layer for your local Kubernetes cluster, then you must disable the feature. The `imperative-api-extension` feature flag can be disabled by either using the [Rancher UI](../how-to-guides/advanced-user-guides/enable-experimental-features#disabling-features-with-the-rancher-ui) or [Rancher API](../how-to-guides/advanced-user-guides/enable-experimental-features#disabling-features-with-the-rancher-api). +The [aggregation layer must be configured](https://kubernetes.io/docs/tasks/extend-kubernetes/configure-aggregation-layer/) on the local Kubernetes cluster for the `imperative-api-extension` feature to be enabled and to work correctly. The feature assumes this is configured and is enabled by default. If it is not possible to configure the aggregation layer for your local Kubernetes cluster, then you must disable the feature. The `imperative-api-extension` feature flag can be disabled by either using the [Rancher UI](../how-to-guides/advanced-user-guides/enable-experimental-features/enable-experimental-features.md#disabling-features-with-the-rancher-ui) or [Rancher API](../how-to-guides/advanced-user-guides/enable-experimental-features/enable-experimental-features.md#disabling-features-with-the-rancher-api). It will still be possible to access the additional APIs when the feature is disabled. The additional APIs are available at `https:///ext` and they are compatible with the Kubernetes apiserver. This means you can use `curl` or `kubectl` to interact with the APIs. From bfccf4adbf3bdbe3988f9fcad3514c86de5e4439 Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Fri, 21 Mar 2025 10:14:37 -0700 Subject: [PATCH 24/32] [2.11.0] versions update Signed-off-by: Sunil Singh --- src/pages/versions.md | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/src/pages/versions.md b/src/pages/versions.md index 53927ff7f45..9177c2ea757 100644 --- a/src/pages/versions.md +++ b/src/pages/versions.md @@ -3,9 +3,29 @@ title: Rancher Documentation Versions --- - ### Current Versions +Here you can find links to supporting documentation for the current released version of Rancher v2.11, and its availability for [Rancher Prime](/v2.11/getting-started/quick-start-guides/deploy-rancher-manager/prime) and the Community version of Rancher: + + + + + + + + + + + + + + + + + + +
VersionDocumentationRelease NotesSupport MatrixPrimeCommunity
v2.11.0DocumentationRelease Notes
N/A
N/A
✓
+ Here you can find links to supporting documentation for the current released version of Rancher v2.10, and its availability for [Rancher Prime](/v2.10/getting-started/quick-start-guides/deploy-rancher-manager/prime) and the Community version of Rancher: From fb653154e79ac4f8bf3ab030a4ac7c8752d157c9 Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Fri, 21 Mar 2025 10:17:56 -0700 Subject: [PATCH 25/32] [2.11.0] webhook update Signed-off-by: Sunil Singh --- docs/reference-guides/rancher-webhook.md | 5 +---- .../version-2.11/reference-guides/rancher-webhook.md | 4 +--- 2 files changed, 2 insertions(+), 7 deletions(-) diff --git a/docs/reference-guides/rancher-webhook.md b/docs/reference-guides/rancher-webhook.md index d41b2bbc69e..2ba055c7e1b 100644 --- a/docs/reference-guides/rancher-webhook.md +++ b/docs/reference-guides/rancher-webhook.md @@ -20,10 +20,7 @@ Each Rancher version is designed to be compatible with a single version of the w | Rancher Version | Webhook Version | Availability in Prime | Availability in Community | |-----------------|-----------------|-----------------------|---------------------------| -| v2.10.3 | v0.6.4 | ✓ | ✓ | -| v2.10.2 | v0.6.3 | ✓ | ✓ | -| v2.10.1 | v0.6.2 | ✓ | ✓ | -| v2.10.0 | v0.6.1 | ✗ | ✓ | +| v2.11.0 | v0.7.0 | N/A | ✓ | ## Why Do We Need It? diff --git a/versioned_docs/version-2.11/reference-guides/rancher-webhook.md b/versioned_docs/version-2.11/reference-guides/rancher-webhook.md index cc4c446ea81..2ba055c7e1b 100644 --- a/versioned_docs/version-2.11/reference-guides/rancher-webhook.md +++ b/versioned_docs/version-2.11/reference-guides/rancher-webhook.md @@ -20,9 +20,7 @@ Each Rancher version is designed to be compatible with a single version of the w | Rancher Version | Webhook Version | Availability in Prime | Availability in Community | |-----------------|-----------------|-----------------------|---------------------------| -| v2.10.2 | v0.6.3 | ✓ | ✓ | -| v2.10.1 | v0.6.2 | ✓ | ✓ | -| v2.10.0 | v0.6.1 | ✗ | ✓ | +| v2.11.0 | v0.7.0 | N/A | ✓ | ## Why Do We Need It? From c9ec3422b1af37d10334e3f5c5b43637a17d1a6f Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Fri, 21 Mar 2025 10:26:56 -0700 Subject: [PATCH 26/32] [2.11.0] CSP adapter update Signed-off-by: Sunil Singh --- .../aws-cloud-marketplace/install-adapter.md | 5 +---- .../aws-cloud-marketplace/install-adapter.md | 4 +--- 2 files changed, 2 insertions(+), 7 deletions(-) diff --git a/docs/integrations-in-rancher/cloud-marketplace/aws-cloud-marketplace/install-adapter.md b/docs/integrations-in-rancher/cloud-marketplace/aws-cloud-marketplace/install-adapter.md index 4cca57cda83..0d04f9f3fe7 100644 --- a/docs/integrations-in-rancher/cloud-marketplace/aws-cloud-marketplace/install-adapter.md +++ b/docs/integrations-in-rancher/cloud-marketplace/aws-cloud-marketplace/install-adapter.md @@ -19,10 +19,7 @@ In order to deploy and run the adapter successfully, you need to ensure its vers | Rancher Version | Adapter Version | |-----------------|------------------| -| v2.10.3 | v105.0.0+up5.0.1 | -| v2.10.2 | v105.0.0+up5.0.1 | -| v2.10.1 | v105.0.0+up5.0.1 | -| v2.10.0 | v105.0.0+up5.0.1 | +| v2.11.0 | v106.0.0+up6.0.0 | ### 1. Gain Access to the Local Cluster diff --git a/versioned_docs/version-2.11/integrations-in-rancher/cloud-marketplace/aws-cloud-marketplace/install-adapter.md b/versioned_docs/version-2.11/integrations-in-rancher/cloud-marketplace/aws-cloud-marketplace/install-adapter.md index 472dce754aa..0d04f9f3fe7 100644 --- a/versioned_docs/version-2.11/integrations-in-rancher/cloud-marketplace/aws-cloud-marketplace/install-adapter.md +++ b/versioned_docs/version-2.11/integrations-in-rancher/cloud-marketplace/aws-cloud-marketplace/install-adapter.md @@ -19,9 +19,7 @@ In order to deploy and run the adapter successfully, you need to ensure its vers | Rancher Version | Adapter Version | |-----------------|------------------| -| v2.10.2 | v105.0.0+up5.0.1 | -| v2.10.1 | v105.0.0+up5.0.1 | -| v2.10.0 | v105.0.0+up5.0.1 | +| v2.11.0 | v106.0.0+up6.0.0 | ### 1. Gain Access to the Local Cluster From b51410aabec32265585da18bf5882c029ad84c54 Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Fri, 21 Mar 2025 10:29:30 -0700 Subject: [PATCH 27/32] [2.11.0] deprecated features update Signed-off-by: Sunil Singh --- docs/faq/deprecated-features.md | 5 +---- versioned_docs/version-2.11/faq/deprecated-features.md | 4 +--- 2 files changed, 2 insertions(+), 7 deletions(-) diff --git a/docs/faq/deprecated-features.md b/docs/faq/deprecated-features.md index c0cc6b2f7a5..f9053fd3618 100644 --- a/docs/faq/deprecated-features.md +++ b/docs/faq/deprecated-features.md @@ -16,10 +16,7 @@ Rancher will publish deprecated features as part of the [release notes](https:// | Patch Version | Release Date | |---------------|---------------| -| [2.10.3](https://github.com/rancher/rancher/releases/tag/v2.10.3) | Feb 27, 2025 | -| [2.10.2](https://github.com/rancher/rancher/releases/tag/v2.10.2) | Jan 29, 2025 | -| [2.10.1](https://github.com/rancher/rancher/releases/tag/v2.10.1) | Dec 19, 2024 | -| [2.10.0](https://github.com/rancher/rancher/releases/tag/v2.10.0) | Nov 18, 2024 | +| [2.11.0](https://github.com/rancher/rancher/releases/tag/v2.11.0) | Mar 26, 2025 | ## What can I expect when a feature is marked for deprecation? diff --git a/versioned_docs/version-2.11/faq/deprecated-features.md b/versioned_docs/version-2.11/faq/deprecated-features.md index 1687b79592d..f9053fd3618 100644 --- a/versioned_docs/version-2.11/faq/deprecated-features.md +++ b/versioned_docs/version-2.11/faq/deprecated-features.md @@ -16,9 +16,7 @@ Rancher will publish deprecated features as part of the [release notes](https:// | Patch Version | Release Date | |---------------|---------------| -| [2.10.2](https://github.com/rancher/rancher/releases/tag/v2.10.2) | Jan 29, 2025 | -| [2.10.1](https://github.com/rancher/rancher/releases/tag/v2.10.1) | Dec 19, 2024 | -| [2.10.0](https://github.com/rancher/rancher/releases/tag/v2.10.0) | Nov 18, 2024 | +| [2.11.0](https://github.com/rancher/rancher/releases/tag/v2.11.0) | Mar 26, 2025 | ## What can I expect when a feature is marked for deprecation? From 22f8ded14068d700166f3617672caf65d601961f Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Fri, 21 Mar 2025 10:33:33 -0700 Subject: [PATCH 28/32] [2.11.0] CNI update Signed-off-by: Sunil Singh --- shared-files/_cni-popularity.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/shared-files/_cni-popularity.md b/shared-files/_cni-popularity.md index 917c38c3699..d0b352eb67e 100644 --- a/shared-files/_cni-popularity.md +++ b/shared-files/_cni-popularity.md @@ -1,10 +1,10 @@ -The following table summarizes different GitHub metrics to give you an idea of each project's popularity and activity levels. This data was collected in February 2025. +The following table summarizes different GitHub metrics to give you an idea of each project's popularity and activity levels. This data was collected in March 2025. | Provider | Project | Stars | Forks | Contributors | | ---- | ---- | ---- | ---- | ---- | -| Canal | https://github.com/projectcalico/canal | 719 | 100 | 20 | -| Flannel | https://github.com/flannel-io/flannel | 9k | 2.9k | 236 | -| Calico | https://github.com/projectcalico/calico | 6.2k | 1.4k | 369 | -| Weave | https://github.com/weaveworks/weave | 6.6k | 674 | 84 | -| Cilium | https://github.com/cilium/cilium | 21k | 3.1k | 896 | +| Canal | https://github.com/projectcalico/canal | 720 | 100 | 20 | +| Flannel | https://github.com/flannel-io/flannel | 9k | 2.9k | 237 | +| Calico | https://github.com/projectcalico/calico | 6.3k | 1.4k | 373 | +| Weave | https://github.com/weaveworks/weave | 6.6k | 679 | 84 | +| Cilium | https://github.com/cilium/cilium | 21.2k | 3.1k | 909 | From 3a051ce759c40aad3c061b04e38fc820c052ffe6 Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Fri, 21 Mar 2025 16:09:51 -0700 Subject: [PATCH 29/32] Updating webhook after review Signed-off-by: Sunil Singh --- docs/reference-guides/rancher-webhook.md | 2 +- versioned_docs/version-2.11/reference-guides/rancher-webhook.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/reference-guides/rancher-webhook.md b/docs/reference-guides/rancher-webhook.md index 2ba055c7e1b..ebe826e6147 100644 --- a/docs/reference-guides/rancher-webhook.md +++ b/docs/reference-guides/rancher-webhook.md @@ -20,7 +20,7 @@ Each Rancher version is designed to be compatible with a single version of the w | Rancher Version | Webhook Version | Availability in Prime | Availability in Community | |-----------------|-----------------|-----------------------|---------------------------| -| v2.11.0 | v0.7.0 | N/A | ✓ | +| v2.11.0 | v0.7.0 | ✗ | ✓ | ## Why Do We Need It? diff --git a/versioned_docs/version-2.11/reference-guides/rancher-webhook.md b/versioned_docs/version-2.11/reference-guides/rancher-webhook.md index 2ba055c7e1b..ebe826e6147 100644 --- a/versioned_docs/version-2.11/reference-guides/rancher-webhook.md +++ b/versioned_docs/version-2.11/reference-guides/rancher-webhook.md @@ -20,7 +20,7 @@ Each Rancher version is designed to be compatible with a single version of the w | Rancher Version | Webhook Version | Availability in Prime | Availability in Community | |-----------------|-----------------|-----------------------|---------------------------| -| v2.11.0 | v0.7.0 | N/A | ✓ | +| v2.11.0 | v0.7.0 | ✗ | ✓ | ## Why Do We Need It? From 5bb67118ca58ed2511699bdf8bd0f35aa285f55d Mon Sep 17 00:00:00 2001 From: Harrison Affel Date: Tue, 11 Mar 2025 10:49:53 -0400 Subject: [PATCH 30/32] Add documentation for 2.11 scheduling customization feature --- ...-cluster-agent-scheduling-customization.md | 78 +++++++++++++++++++ sidebars.js | 1 + ...-cluster-agent-scheduling-customization.md | 78 +++++++++++++++++++ versioned_sidebars/version-2.11-sidebars.json | 1 + 4 files changed, 158 insertions(+) create mode 100644 docs/how-to-guides/advanced-user-guides/enable-cluster-agent-scheduling-customization.md create mode 100644 versioned_docs/version-2.11/how-to-guides/advanced-user-guides/enable-cluster-agent-scheduling-customization.md diff --git a/docs/how-to-guides/advanced-user-guides/enable-cluster-agent-scheduling-customization.md b/docs/how-to-guides/advanced-user-guides/enable-cluster-agent-scheduling-customization.md new file mode 100644 index 00000000000..c91e2d53b2c --- /dev/null +++ b/docs/how-to-guides/advanced-user-guides/enable-cluster-agent-scheduling-customization.md @@ -0,0 +1,78 @@ +--- +title: Enabling Cluster Agent Scheduling Customization +--- + + + + + +In Rancher v2.11.0 and later, you can enable the automatic deployment of a Priority Class and Pod Disruption Budget for the `cattle-cluster-agent`. + +When this feature is enabled, all newly provisioned Node Driver, Custom, and Imported RKE2 and K3s clusters will automatically deploy a Priority Class and Pod Disruption Budget during the provisioning process. Existing clusters can be gradually updated with this new behavior using the [Rancher UI or by setting a specific annotation](#updating-existing-clusters) on cluster objects. + +This feature is disabled by default. + +## Enabling Cluster Agent Scheduling Customization + +:::info +Enabling or disabling this feature only impacts new clusters. Existing downstream clusters will not be automatically updated. See [_Updating Existing Clusters_](#updating-existing-clusters). +::: + +1. In the upper left corner, click **☰ > Global Settings** +1. Select **Feature Flags** +1. Find the `cluster-agent-scheduling-customization` feature and click **⋮ > Activate** + +## Configuring the Global Settings + +You can customize the default Priority Class (PC) and Pod Disruption Budget (PDB) by updating the `cluster-agent-default-priority-class` and `cluster-agent-default-pod-disruption-budget` global settings in the Rancher UI. Note that both the Priority Class and Pod Disruption Budget have configuration restrictions: + ++ The `Value` set for the default PC cannot be less than negative 1 billion, or greater than 1 billion. ++ The `PreemptionPolicy` set for the PC must be equal to `PreemptLowerPriority` or `Never`. ++ You cannot configure the PDB `minAvailable` and `maxUnavailable` fields to both have a non-zero value. ++ The PDB `minAvailable` must either be a non-negative whole number integer, or a non-negative whole number percent (e.g. `1` or `100%`). ++ The PDB `maxUnavailable` must either be a non-negative whole number integer, or a non-negative whole number percent (e.g. `1` or `100%`). + + +## Updating Existing Clusters + +:::info +When this feature is disabled, you cannot modify the cluster agent scheduling customization fields for existing clusters. However, you can always remove the configuration, regardless of the feature's status. +::: + +After enabling this feature, you can configure scheduling customization for existing clusters in two ways: + ++ **Using the Rancher UI** + + Edit the desired cluster and navigate to the **Cluster Agent** tab within the **Cluster Configuration** section. + + Enable the `Prevent Rancher cluster agent pod eviction` checkbox. + + The necessary fields on the associated `clusters.provisioning.cattle.io` or `clusters.management.cattle.io` object will be automatically configured using the values set in the global settings. + + Save the cluster. ++ **Using an annotation** + + The `provisioning.cattle.io/enable-scheduling-customization` annotation can be used to update clusters without requiring the use of the Rancher UI. This annotation will be automatically removed from the cluster after the Priority Class and Pod Disruption Budget are configured. + + The value of this annotation can be either `true` or `false`, to add or remove scheduling customization automatically. + + For Node Driver Provisioned and Custom clusters, apply this annotation on the associated `clusters.provisioning.cattle.io` object. + + For Imported clusters, apply the annotation on the associated `clusters.management.cattle.io` object. + +## Applying Updated Global Settings + +In order to prevent unexpected changes in scheduler behavior, Rancher does not update existing downstream clusters when the `cluster-agent-default-priority-class` and `cluster-agent-default-pod-disruption-budget` global settings are changed. There are two ways to update existing clusters to use the most recent global settings: + ++ **Using the Rancher UI** + + When configuring a cluster, an additional checkbox will be shown in the **Cluster Agent** tab within the **Cluster Configuration** section. Checking the `Apply global settings for Priority Class and Pod Disruption Budget` checkbox will automatically update the Priority Class and Pod Disruption Budget to match the global settings once the cluster is saved. ++ **Adjusting the cluster yaml** + + You may manually adjust the relevant fields in the cluster object using `kubectl` or the Rancher UI 'Edit As Yaml' feature. Scheduling customization can be found in the `spec.ClusterAgentDeploymentCustomization.SchedulingCustomization` section of the cluster object. + + Alternatively, the `provisioning.cattle.io/enable-scheduling-customization` annotation can be used to remove and re-add the updated scheduling customization fields set on a specific cluster. + +## Downstream Objects + +When this feature is enabled for a given cluster, two downstream resources will be automatically created by Rancher: + ++ A Pod Disruption Budget will be automatically created in the `cattle-system` namespace, named `cattle-cluster-agent-pod-disruption-budget`. ++ A Priority Class will be automatically created, named `cattle-cluster-agent-priority-class`. + +These objects are maintained by Rancher and must not be modified or deleted. The Rancher server will automatically update these objects to match the configuration set on the Cluster object and remove them when they are no longer needed. + +### RBAC considerations + +Before enabling this feature on a downstream cluster, cluster administrators should assess their current RBAC configuration to prevent common access to the `cattle-cluster-agent-priority-class`. In cases where external users have access to a cluster, such as when offering clusters as a service, it is recommended to limit access to the `cattle-cluster-agent-priority-class` object to prevent changes or deletion. + +Similar considerations do not need to be made for the `cattle-cluster-agent-pod-disruption-budget` object, as Pod Disruption Budgets are namespaced objects. Rancher will create the `cattle-cluster-agent-pod-disruption-budget` in the privileged `cattle-system` namespace. diff --git a/sidebars.js b/sidebars.js index 3e636d11f0b..1bb07d254d7 100644 --- a/sidebars.js +++ b/sidebars.js @@ -803,6 +803,7 @@ const sidebars = { "how-to-guides/advanced-user-guides/enable-api-audit-log", "how-to-guides/advanced-user-guides/enable-api-audit-log-in-downstream-clusters", "how-to-guides/advanced-user-guides/enable-user-retention", + "how-to-guides/advanced-user-guides/enable-cluster-agent-scheduling-customization", "how-to-guides/advanced-user-guides/configure-layer-7-nginx-load-balancer", ] } diff --git a/versioned_docs/version-2.11/how-to-guides/advanced-user-guides/enable-cluster-agent-scheduling-customization.md b/versioned_docs/version-2.11/how-to-guides/advanced-user-guides/enable-cluster-agent-scheduling-customization.md new file mode 100644 index 00000000000..160621204f1 --- /dev/null +++ b/versioned_docs/version-2.11/how-to-guides/advanced-user-guides/enable-cluster-agent-scheduling-customization.md @@ -0,0 +1,78 @@ +--- +title: Enabling Cluster Agent Scheduling Customization +--- + + + + + +In Rancher v2.11.0 and later, you can enable the automatic deployment of a Priority Class and Pod Disruption Budget for the `cattle-cluster-agent`. + +When this feature is enabled, all newly provisioned Node Driver, Custom, and Imported RKE2 and K3s clusters will automatically deploy a Priority Class and Pod Disruption Budget during the provisioning process. Existing clusters can be gradually updated with this new behavior using the [Rancher UI or by setting a specific annotation](#updating-existing-clusters) on cluster objects. + +This feature is disabled by default. + +## Enabling Cluster Agent Scheduling Customization + +:::info +Enabling or disabling this feature only impacts new clusters. Existing downstream clusters will not be automatically updated. See [_Updating Existing Clusters_](#updating-existing-clusters). +::: + +1. In the upper left corner, click **☰ > Global Settings** +1. Select **Feature Flags** +1. Find the `cluster-agent-scheduling-customization` feature and click **⋮ > Activate** + +## Configuring the Global Settings + +You can customize the default Priority Class (PC) and Pod Disruption Budget (PDB) by updating the `cluster-agent-default-priority-class` and `cluster-agent-default-pod-disruption-budget` global settings in the Rancher UI. Note that both the Priority Class and Pod Disruption Budget have configuration restrictions: + ++ The `Value` set for the default PC cannot be less than negative 1 billion, or greater than 1 billion. ++ The `PreemptionPolicy` set for the PC must be equal to `PreemptLowerPriority` or `Never`. ++ You cannot configure the PDB `minAvailable` and `maxUnavailable` fields to both have a non-zero value. ++ The PDB `minAvailable` must either be a non-negative whole number integer, or a non-negative whole number percent (e.g. `1` or `100%`). ++ The PDB `maxUnavailable` must either be a non-negative whole number integer, or a non-negative whole number percent (e.g. `1` or `100%`). + + +## Updating Existing Clusters + +:::info +When this feature is disabled, you cannot modify the cluster agent scheduling customization fields for existing clusters. However, you can always remove the configuration, regardless of the feature's status. +::: + +After enabling this feature, you can configure scheduling customization for existing clusters in two ways: + ++ **Using the Rancher UI** + + Edit the desired cluster and navigate to the **Cluster Agent** tab within the **Cluster Configuration** section. + + Enable the `Prevent Rancher cluster agent pod eviction` checkbox. + + The necessary fields on the associated `clusters.provisioning.cattle.io` or `clusters.management.cattle.io` object will be automatically configured using the values set in the global settings. + + Save the cluster. ++ **Using an annotation** + + The `provisioning.cattle.io/enable-scheduling-customization` annotation can be used to update clusters without requiring the use of the Rancher UI. This annotation will be automatically removed from the cluster after the Priority Class and Pod Disruption Budget are configured. + + The value of this annotation can be either `true` or `false`, to add or remove scheduling customization automatically. + + For Node Driver Provisioned and Custom clusters, apply this annotation on the associated `clusters.provisioning.cattle.io` object. + + For Imported clusters, apply the annotation on the associated `clusters.management.cattle.io` object. + +## Applying Updated Global Settings + +In order to prevent unexpected changes in scheduler behavior, Rancher does not update existing downstream clusters when the `cluster-agent-default-priority-class` and `cluster-agent-default-pod-disruption-budget` global settings are changed. There are two ways to update existing clusters to use the most recent global settings: + ++ **Using the Rancher UI** + + When configuring a cluster, an additional checkbox will be shown in the **Cluster Agent** tab within the **Cluster Configuration** section. Checking the `Apply global settings for Priority Class and Pod Disruption Budget` checkbox will automatically update the Priority Class and Pod Disruption Budget to match the global settings once the cluster is saved. ++ **Adjusting the cluster yaml** + + You may manually adjust the relevant fields in the cluster object using `kubectl` or the Rancher UI 'Edit As Yaml' feature. Scheduling customization can be found in the `spec.ClusterAgentDeploymentCustomization.SchedulingCustomization` section of the cluster object. + + Alternatively, the `provisioning.cattle.io/enable-scheduling-customization` annotation can be used to remove and re-add the updated scheduling customization fields set on a specific cluster. + +## Downstream Objects + +When this feature is enabled for a given cluster, two downstream resources will be automatically created by Rancher: + ++ A Pod Disruption Budget will be automatically created in the `cattle-system` namespace, named `cattle-cluster-agent-pod-disruption-budget`. ++ A Priority Class will be automatically created, named `cattle-cluster-agent-priority-class`. + +These objects are maintained by Rancher and must not be modified or deleted. The Rancher server will automatically update these objects to match the configuration set on the Cluster object and remove them when they are no longer needed. + +### RBAC considerations + +Before enabling this feature on a downstream cluster, cluster administrators should assess their current RBAC configuration to prevent common access to the `cattle-cluster-agent-priority-class`. In cases where external users have access to a cluster, such as when offering clusters as a service, it is recommended to limit access to the `cattle-cluster-agent-priority-class` object to prevent changes or deletion. + +Similar considerations do not need to be made for the `cattle-cluster-agent-pod-disruption-budget` object, as Pod Disruption Budgets are namespaced objects. Rancher will create the `cattle-cluster-agent-pod-disruption-budget` in the privileged `cattle-system` namespace. diff --git a/versioned_sidebars/version-2.11-sidebars.json b/versioned_sidebars/version-2.11-sidebars.json index 394116ed4be..16a1e9c7e39 100644 --- a/versioned_sidebars/version-2.11-sidebars.json +++ b/versioned_sidebars/version-2.11-sidebars.json @@ -767,6 +767,7 @@ "how-to-guides/advanced-user-guides/enable-api-audit-log", "how-to-guides/advanced-user-guides/enable-api-audit-log-in-downstream-clusters", "how-to-guides/advanced-user-guides/enable-user-retention", + "how-to-guides/advanced-user-guides/enable-cluster-agent-scheduling-customization", "how-to-guides/advanced-user-guides/configure-layer-7-nginx-load-balancer" ] } From 84995b6b4d14b59c27e90d0d1ad2faf7849ee372 Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Thu, 27 Mar 2025 10:32:57 -0700 Subject: [PATCH 31/32] [2.11.0] Updating deprecated features date field. Signed-off-by: Sunil Singh --- docs/faq/deprecated-features.md | 2 +- versioned_docs/version-2.11/faq/deprecated-features.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/faq/deprecated-features.md b/docs/faq/deprecated-features.md index f9053fd3618..ebfba7239c8 100644 --- a/docs/faq/deprecated-features.md +++ b/docs/faq/deprecated-features.md @@ -16,7 +16,7 @@ Rancher will publish deprecated features as part of the [release notes](https:// | Patch Version | Release Date | |---------------|---------------| -| [2.11.0](https://github.com/rancher/rancher/releases/tag/v2.11.0) | Mar 26, 2025 | +| [2.11.0](https://github.com/rancher/rancher/releases/tag/v2.11.0) | Mar 28, 2025 | ## What can I expect when a feature is marked for deprecation? diff --git a/versioned_docs/version-2.11/faq/deprecated-features.md b/versioned_docs/version-2.11/faq/deprecated-features.md index f9053fd3618..ebfba7239c8 100644 --- a/versioned_docs/version-2.11/faq/deprecated-features.md +++ b/versioned_docs/version-2.11/faq/deprecated-features.md @@ -16,7 +16,7 @@ Rancher will publish deprecated features as part of the [release notes](https:// | Patch Version | Release Date | |---------------|---------------| -| [2.11.0](https://github.com/rancher/rancher/releases/tag/v2.11.0) | Mar 26, 2025 | +| [2.11.0](https://github.com/rancher/rancher/releases/tag/v2.11.0) | Mar 28, 2025 | ## What can I expect when a feature is marked for deprecation? From 8db890f12eca8457d68574b84d2724cff3bf80e8 Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Mon, 31 Mar 2025 08:38:56 -0700 Subject: [PATCH 32/32] [2.11.0] Updating Deprecated Features Date Signed-off-by: Sunil Singh --- docs/faq/deprecated-features.md | 2 +- versioned_docs/version-2.11/faq/deprecated-features.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/faq/deprecated-features.md b/docs/faq/deprecated-features.md index ebfba7239c8..7a7446c1681 100644 --- a/docs/faq/deprecated-features.md +++ b/docs/faq/deprecated-features.md @@ -16,7 +16,7 @@ Rancher will publish deprecated features as part of the [release notes](https:// | Patch Version | Release Date | |---------------|---------------| -| [2.11.0](https://github.com/rancher/rancher/releases/tag/v2.11.0) | Mar 28, 2025 | +| [2.11.0](https://github.com/rancher/rancher/releases/tag/v2.11.0) | Mar 31, 2025 | ## What can I expect when a feature is marked for deprecation? diff --git a/versioned_docs/version-2.11/faq/deprecated-features.md b/versioned_docs/version-2.11/faq/deprecated-features.md index ebfba7239c8..7a7446c1681 100644 --- a/versioned_docs/version-2.11/faq/deprecated-features.md +++ b/versioned_docs/version-2.11/faq/deprecated-features.md @@ -16,7 +16,7 @@ Rancher will publish deprecated features as part of the [release notes](https:// | Patch Version | Release Date | |---------------|---------------| -| [2.11.0](https://github.com/rancher/rancher/releases/tag/v2.11.0) | Mar 28, 2025 | +| [2.11.0](https://github.com/rancher/rancher/releases/tag/v2.11.0) | Mar 31, 2025 | ## What can I expect when a feature is marked for deprecation?