mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-25 12:38:05 +00:00
Catherine Luse
@@ -53,7 +53,7 @@ Setting `K3S_URL` without explicitly setting an exec command will default the co
|
||||
|
||||
When running the agent `K3S_TOKEN` must also be set.
|
||||
|
||||
# Installing K3s from the Binary
|
||||
### Options for installation from binary
|
||||
|
||||
As stated, the installation script is primarily concerned with configuring K3s to run as a service. If you choose to not use the script, you can run K3s simply by downloading the binary from our [release page](https://github.com/rancher/k3s/releases/latest), placing it on your path, and executing it. The K3s binary supports the following commands:
|
||||
|
||||
|
||||
+2
-2
@@ -51,5 +51,5 @@ After you complete [Configuring Microsoft AD FS for Rancher]({{<baseurl>}}/ranch
|
||||
**Tip:** You can generate a certificate using an openssl command. For example:
|
||||
|
||||
```
|
||||
openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=https://myservice.example.com"
|
||||
```
|
||||
openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
|
||||
```
|
||||
|
||||
@@ -32,7 +32,7 @@ To perform a backup, a custom resource of type Backup must be created.
|
||||
1. Click **Backup.**
|
||||
1. Create the Backup with the form, or with the YAML editor.
|
||||
1. For configuring the Backup details using the form, click **Create** and refer to the [configuration reference](../configuration/backup-config) and to the [examples.](../examples/#backup)
|
||||
1. For using the YAML editor, we can click **Create > Create from YAML.** Enter the Backup YAML. This example Backup custom resource would create encrypted recurring backups in S3:
|
||||
1. For using the YAML editor, we can click **Create > Create from YAML.** Enter the Backup YAML. This example Backup custom resource would create encrypted recurring backups in S3. The app uses the `credentialSecretNamespace` value to determine where to look for the S3 backup secret:
|
||||
|
||||
```yaml
|
||||
apiVersion: resources.cattle.io/v1
|
||||
|
||||
@@ -85,7 +85,7 @@ Selecting the first option stores this backup in the storage location configured
|
||||
|
||||
The S3 storage location contains the following configuration fields:
|
||||
|
||||
1. **Credential Secret** (optional): If you need to use the AWS Access keys Secret keys to access s3 bucket, create a secret with your credentials with keys and the directives `accessKey` and `secretKey`. It can be in any namespace. An example secret is [here.](#example-credentialsecret) This directive is unnecessary if the nodes running your operator are in EC2 and set up with IAM permissions that allow them to access S3, as described in [this section.](#iam-permissions-for-ec2-nodes-to-access-s3)
|
||||
1. **Credential Secret** (optional): If you need to use the AWS Access keys Secret keys to access s3 bucket, create a secret with your credentials with keys and the directives `accessKey` and `secretKey`. It can be in any namespace. An example secret is [here.](#example-credentialsecret) This directive is unnecessary if the nodes running your operator are in EC2 and set up with IAM permissions that allow them to access S3, as described in [this section.](#iam-permissions-for-ec2-nodes-to-access-s3) The Credential Secret dropdown lists the secrets in all namespaces.
|
||||
1. **Bucket Name**: The name of the S3 bucket where backup files will be stored.
|
||||
1. **Region** (optional): The AWS [region](https://aws.amazon.com/about-aws/global-infrastructure/regions_az/) where the S3 bucket is located. This field isn't needed for configuring MinIO.
|
||||
1. **Folder** (optional): The name of the folder in the S3 bucket where backup files will be stored.
|
||||
|
||||
@@ -5,7 +5,7 @@ weight: 1
|
||||
|
||||
_Available as of Rancher v2.5_
|
||||
|
||||
Fleet is GitOps at scale. Fleet is designed to manage up to a million clusters. It's also lightweight enough that is works great for a [single cluster](https://fleet.rancher.io/single-cluster-install/) too, but it really shines when you get to a [large scale.](https://fleet.rancher.io/multi-cluster-install/) By large scale we mean either a lot of clusters, a lot of deployments, or a lot of teams in a single organization.
|
||||
Fleet is GitOps at scale. Fleet is designed to manage up to a million clusters. It's also lightweight enough that it works great for a [single cluster](https://fleet.rancher.io/single-cluster-install/) too, but it really shines when you get to a [large scale.](https://fleet.rancher.io/multi-cluster-install/) By large scale we mean either a lot of clusters, a lot of deployments, or a lot of teams in a single organization.
|
||||
|
||||
Fleet is a separate project from Rancher, and can be installed on any Kubernetes cluster with Helm.
|
||||
|
||||
@@ -43,4 +43,4 @@ The Fleet Helm charts are available [here.](https://github.com/rancher/fleet/rel
|
||||
|
||||
### Documentation
|
||||
|
||||
The Fleet documentation is at [https://fleet.rancher.io/.](https://fleet.rancher.io/)
|
||||
The Fleet documentation is at [https://fleet.rancher.io/.](https://fleet.rancher.io/)
|
||||
|
||||
@@ -276,6 +276,27 @@ When using the [AWS EC2 node driver]({{<baseurl>}}/rancher/v2.5/en/cluster-provi
|
||||
|
||||
SUSE Linux may have a firewall that blocks all ports by default. To open the ports needed for adding the host to a custom cluster,
|
||||
|
||||
{{% tabs %}}
|
||||
{{% tab "SLES 15 / openSUSE Leap 15" %}}
|
||||
1. SSH into the instance.
|
||||
1. Start YaST in text mode:
|
||||
```
|
||||
sudo yast2
|
||||
```
|
||||
|
||||
1. Navigate to **Security and Users** > **Firewall** > **Zones:public** > **Ports**. To navigate within the interface, follow the instructions [here](https://doc.opensuse.org/documentation/leap/reference/html/book.opensuse.reference/cha-yast-text.html#sec-yast-cli-navigate).
|
||||
1. To open the required ports, enter them into the **TCP Ports** and **UDP Ports** fields. In this example, ports 9796 and 10250 are also opened for monitoring. The resulting fields should look similar to the following:
|
||||
```yaml
|
||||
TCP Ports
|
||||
22, 80, 443, 2376, 2379, 2380, 6443, 9099, 9796, 10250, 10254, 30000-32767
|
||||
UDP Ports
|
||||
8472, 30000-32767
|
||||
```
|
||||
|
||||
1. When all required ports are enter, select **Accept**.
|
||||
|
||||
{{% /tab %}}
|
||||
{{% tab "SLES 12 / openSUSE Leap 42" %}}
|
||||
1. SSH into the instance.
|
||||
1. Edit /`etc/sysconfig/SuSEfirewall2` and open the required ports. In this example, ports 9796 and 10250 are also opened for monitoring:
|
||||
```
|
||||
@@ -287,5 +308,7 @@ SUSE Linux may have a firewall that blocks all ports by default. To open the por
|
||||
```
|
||||
SuSEfirewall2
|
||||
```
|
||||
{{% /tab %}}
|
||||
{{% /tabs %}}
|
||||
|
||||
**Result:** The node has the open ports required to be added to a custom cluster.
|
||||
|
||||
@@ -15,18 +15,18 @@ Through the **Cluster Explorer,** when installing or upgrading Istio through **A
|
||||
apiVersion: install.istio.io/v1alpha1
|
||||
kind: IstioOperator
|
||||
spec:
|
||||
components:
|
||||
cni:
|
||||
enabled: true
|
||||
values:
|
||||
components:
|
||||
cni:
|
||||
image: rancher/istio-install-cni:1.7.3
|
||||
excludeNamespaces:
|
||||
enabled: true
|
||||
values:
|
||||
cni:
|
||||
image: rancher/istio-install-cni:1.7.3
|
||||
excludeNamespaces:
|
||||
- istio-system
|
||||
- kube-system
|
||||
logLevel: info
|
||||
cniBinDir: /opt/cni/bin
|
||||
cniConfDir: /etc/cni/net.d
|
||||
logLevel: info
|
||||
cniBinDir: /opt/cni/bin
|
||||
cniConfDir: /etc/cni/net.d
|
||||
```
|
||||
1. After installing Istio, you'll notice the cni-node pods in the istio-system namespace in a CrashLoopBackoff error. Manually edit the `istio-cni-node` daemonset to include the following on the `install-cni` container:
|
||||
```yaml
|
||||
|
||||
@@ -12,11 +12,18 @@ This section describes how to uninstall Istio in a cluster or disable a namespac
|
||||
To uninstall Istio,
|
||||
|
||||
1. From the **Cluster Explorer,** navigate to **Installed Apps** in **Apps & Marketplace** and locate the `rancher-istio` installation.
|
||||
1. Select all the apps in the `istio-system` namespace and click **Delete**.
|
||||
1. Select `rancher-istio` in the `istio-system namespace and click **Delete**
|
||||
1. After `rancher-istio` is deleted, you can then select all the remaining apps in the `istio-system` namespace and click **Delete**
|
||||
|
||||
**Result:** The `rancher-istio` app in the cluster gets removed. The Istio sidecar cannot be deployed on any workloads in the cluster.
|
||||
|
||||
**Note:** You can no longer disable and reenable your Istio installation. If you would like to save your settings for a future install, view and save individual YAMLs to refer back to / reuse for future installations.
|
||||
**Note:** You can no longer disable and re-enable your Istio installation. If you would like to save your settings for a future install, view and save individual YAMLs to refer back to / reuse for future installations.
|
||||
|
||||
**Troubleshooting Uninstall:** If you didn't follow the uninstall steps, you may encounter a warning during uninstall:
|
||||
|
||||
`Error: uninstallation completed with 1 error(s): unable to build kubernetes objects for delete: unable to recognize "": no matches for kind "MonitoringDashboard" in version "monitoring.kiali.io/v1alpha1"`
|
||||
|
||||
This could mean a few things. You either selected all the apps in the `istio-system` namespace and deleted them at the same time, or you deleted `rancher-istio` chart dependencies prior to deleting the `rancher-istio` chart. Since the uninstall did not complete properly, you will have resources remaining in the `istio-system` namespace that you will need to manually clean up. Another option to avoid manual clean up is to install `rancher-istio` again, then uninstall it in the correct order.
|
||||
|
||||
# Disable Istio in a Namespace
|
||||
|
||||
|
||||
@@ -26,7 +26,7 @@ The [Alertmanager Config](https://prometheus.io/docs/alerting/latest/configurati
|
||||
- [Receiver](#receiver)
|
||||
- [Grouping](#grouping)
|
||||
- [Matching](#matching)
|
||||
- [Example Alertmanager Config](#example-alertmanager-config)
|
||||
- [Example Alertmanager Configs](#example-alertmanager-configs)
|
||||
- [Example Route Config for CIS Scan Alerts](#example-route-config-for-cis-scan-alerts)
|
||||
|
||||
# Overview
|
||||
@@ -326,7 +326,7 @@ The YAML provided here will be directly appended to your receiver within the Ale
|
||||
|
||||
{{% /tab %}}
|
||||
{{% tab "Rancher v2.5.0-2.5.3" %}}
|
||||
The Alertmanager must be configured in YAML, as shown in this [example.](#example-alertmanager-config)
|
||||
The Alertmanager must be configured in YAML, as shown in these [examples.](#example-alertmanager-configs)
|
||||
{{% /tab %}}
|
||||
{{% /tabs %}}
|
||||
|
||||
@@ -366,12 +366,13 @@ match_re:
|
||||
|
||||
{{% /tab %}}
|
||||
{{% tab "Rancher v2.5.0-2.5.3" %}}
|
||||
The Alertmanager must be configured in YAML, as shown in this [example.](#example-alertmanager-config)
|
||||
The Alertmanager must be configured in YAML, as shown in these [examples.](#example-alertmanager-configs)
|
||||
{{% /tab %}}
|
||||
{{% /tabs %}}
|
||||
|
||||
# Example Alertmanager Config
|
||||
# Example Alertmanager Configs
|
||||
|
||||
### Slack
|
||||
To set up notifications via Slack, the following Alertmanager Config YAML can be placed into the `alertmanager.yaml` key of the Alertmanager Config Secret, where the `api_url` should be updated to use your Webhook URL from Slack:
|
||||
|
||||
```yaml
|
||||
@@ -391,6 +392,31 @@ templates:
|
||||
- /etc/alertmanager/config/*.tmpl
|
||||
```
|
||||
|
||||
### PagerDuty
|
||||
To set up notifications via PagerDuty, use the example below from the [PagerDuty documentation](https://www.pagerduty.com/docs/guides/prometheus-integration-guide/) as a guideline. This example sets up a route that captures alerts for a database service and sends them to a receiver linked to a service that will directly notify the DBAs in PagerDuty, while all other alerts will be directed to a default receiver with a different PagerDuty integration key.
|
||||
|
||||
The following Alertmanager Config YAML can be placed into the `alertmanager.yaml` key of the Alertmanager Config Secret. The `service_key` should be updated to use your PagerDuty integration key and can be found as per the "Integrating with Global Event Routing" section of the PagerDuty documentation. For the full list of configuration options, refer to the [Prometheus documentation](https://prometheus.io/docs/alerting/latest/configuration/#pagerduty_config).
|
||||
|
||||
```yaml
|
||||
route:
|
||||
group_by: [cluster]
|
||||
receiver: 'pagerduty-notifications'
|
||||
group_interval: 5m
|
||||
routes:
|
||||
- match:
|
||||
service: database
|
||||
receiver: 'database-notifcations'
|
||||
|
||||
receivers:
|
||||
- name: 'pagerduty-notifications'
|
||||
pagerduty_configs:
|
||||
- service_key: 'primary-integration-key'
|
||||
|
||||
- name: 'database-notifcations'
|
||||
pagerduty_configs:
|
||||
- service_key: 'database-integration-key'
|
||||
```
|
||||
|
||||
# Example Route Config for CIS Scan Alerts
|
||||
|
||||
While configuring the routes for `rancher-cis-benchmark` alerts, you can specify the matching using the key-value pair `job: rancher-cis-scan`.
|
||||
|
||||
@@ -71,7 +71,7 @@ Rancher v2.5.4 introduced the capability to configure PrometheusRules by filling
|
||||
|
||||
### Alerting Rules
|
||||
|
||||
[Alerting rules](https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/) allow you to define alert conditions based on PromQL (Prometheus expression language) expressions and to send notifications about firing alerts to an external service.
|
||||
[Alerting rules](https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/) allow you to define alert conditions based on PromQL (Prometheus Query Language) expressions and to send notifications about firing alerts to an external service.
|
||||
|
||||
| Field | Description |
|
||||
|-------|----------------|
|
||||
@@ -85,7 +85,7 @@ Rancher v2.5.4 introduced the capability to configure PrometheusRules by filling
|
||||
|
||||
### Recording Rules
|
||||
|
||||
[Recording rules](https://prometheus.io/docs/prometheus/latest/configuration/recording_rules/#recording-rules) allow you to precompute frequently needed or computationally expensive PromQL (Prometheus expression language) expressions and save their result as a new set of time series.
|
||||
[Recording rules](https://prometheus.io/docs/prometheus/latest/configuration/recording_rules/#recording-rules) allow you to precompute frequently needed or computationally expensive PromQL (Prometheus Query Language) expressions and save their result as a new set of time series.
|
||||
|
||||
| Field | Description |
|
||||
|-------|----------------|
|
||||
|
||||
@@ -180,7 +180,7 @@ services:
|
||||
path: ""
|
||||
uid: 52034
|
||||
gid: 52034
|
||||
snapshot: true
|
||||
snapshot: false
|
||||
retention: ""
|
||||
creation: ""
|
||||
backup_config: null
|
||||
|
||||
@@ -38,7 +38,8 @@ Kubernetes v1.18+ | CIS v1.6 | [Link](./1.6-benchmark-2.5) | [Link](./1.6-harden
|
||||
|
||||
Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guides
|
||||
---|---|---|---
|
||||
Kubernetes v1.18 | CIS v1.5 | [Link](https://docs.rke2.io/security/cis_self_assessment/) | [Link](https://docs.rke2.io/security/hardening_guide/)
|
||||
Kubernetes v1.18 | CIS v1.5 | [Link](https://docs.rke2.io/security/cis_self_assessment15/) | [Link](https://docs.rke2.io/security/hardening_guide/)
|
||||
Kubernetes v1.20 | CIS v1.6 | [Link](https://docs.rke2.io/security/cis_self_assessment16/) | [Link](https://docs.rke2.io/security/hardening_guide/)
|
||||
|
||||
### K3s Guides
|
||||
|
||||
@@ -53,4 +54,4 @@ _Available as of v2.5.8_
|
||||
|
||||
[Security-Enhanced Linux (SELinux)](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) is a security enhancement to Linux. After being historically used by government agencies, SELinux is now industry standard and is enabled by default on CentOS 7 and 8.
|
||||
|
||||
To use Rancher with SELinux, we recommend installing the `rancher-selinux` RPM according to the instructions on [this page.]({{<baseurl>}}/rancher/v2.5/en/security/selinux/#installing-the-rancher-selinux-rpm)
|
||||
To use Rancher with SELinux, we recommend installing the `rancher-selinux` RPM according to the instructions on [this page.]({{<baseurl>}}/rancher/v2.5/en/security/selinux/#installing-the-rancher-selinux-rpm)
|
||||
|
||||
+1
-1
@@ -52,5 +52,5 @@ After you complete [Configuring Microsoft AD FS for Rancher]({{<baseurl>}}/ranch
|
||||
**Tip:** You can generate a certificate using an openssl command. For example:
|
||||
|
||||
```
|
||||
openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=https://myservice.example.com"
|
||||
openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
|
||||
```
|
||||
|
||||
@@ -13,18 +13,18 @@ Through the **Cluster Explorer,** when installing or upgrading Istio through **A
|
||||
apiVersion: install.istio.io/v1alpha1
|
||||
kind: IstioOperator
|
||||
spec:
|
||||
components:
|
||||
cni:
|
||||
enabled: true
|
||||
values:
|
||||
components:
|
||||
cni:
|
||||
image: rancher/istio-install-cni:1.7.3
|
||||
excludeNamespaces:
|
||||
enabled: true
|
||||
values:
|
||||
cni:
|
||||
image: rancher/istio-install-cni:1.7.3
|
||||
excludeNamespaces:
|
||||
- istio-system
|
||||
- kube-system
|
||||
logLevel: info
|
||||
cniBinDir: /opt/cni/bin
|
||||
cniConfDir: /etc/cni/net.d
|
||||
logLevel: info
|
||||
cniBinDir: /opt/cni/bin
|
||||
cniConfDir: /etc/cni/net.d
|
||||
```
|
||||
1. After installing Istio, you'll notice the cni-node pods in the istio-system namespace in a CrashLoopBackoff error. Manually edit the `istio-cni-node` daemonset to include the following on the `install-cni` container:
|
||||
```yaml
|
||||
|
||||
+2
-2
@@ -69,7 +69,7 @@ Rancher v2.5.4 introduced the capability to configure PrometheusRules by filling
|
||||
|
||||
### Alerting Rules
|
||||
|
||||
[Alerting rules](https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/) allow you to define alert conditions based on PromQL (Prometheus expression language) expressions and to send notifications about firing alerts to an external service.
|
||||
[Alerting rules](https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/) allow you to define alert conditions based on PromQL (Prometheus Query Language) expressions and to send notifications about firing alerts to an external service.
|
||||
|
||||
| Field | Description |
|
||||
|-------|----------------|
|
||||
@@ -83,7 +83,7 @@ Rancher v2.5.4 introduced the capability to configure PrometheusRules by filling
|
||||
|
||||
### Recording Rules
|
||||
|
||||
[Recording rules](https://prometheus.io/docs/prometheus/latest/configuration/recording_rules/#recording-rules) allow you to precompute frequently needed or computationally expensive PromQL (Prometheus expression language) expressions and save their result as a new set of time series.
|
||||
[Recording rules](https://prometheus.io/docs/prometheus/latest/configuration/recording_rules/#recording-rules) allow you to precompute frequently needed or computationally expensive PromQL (Prometheus Query Language) expressions and save their result as a new set of time series.
|
||||
|
||||
| Field | Description |
|
||||
|-------|----------------|
|
||||
|
||||
@@ -181,7 +181,7 @@ services:
|
||||
path: ""
|
||||
uid: 52034
|
||||
gid: 52034
|
||||
snapshot: true
|
||||
snapshot: false
|
||||
retention: ""
|
||||
creation: ""
|
||||
backup_config: null
|
||||
|
||||
@@ -28,7 +28,8 @@ Kubernetes v1.18+ | CIS v1.6 | [Link](./1.6-benchmark-2.5) | [Link](./1.6-harden
|
||||
|
||||
Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guides
|
||||
---|---|---|---
|
||||
Kubernetes v1.18 | CIS v1.5 | [Link](https://docs.rke2.io/security/cis_self_assessment/) | [Link](https://docs.rke2.io/security/hardening_guide/)
|
||||
Kubernetes v1.18 | CIS v1.5 | [Link](https://docs.rke2.io/security/cis_self_assessment15/) | [Link](https://docs.rke2.io/security/hardening_guide/)
|
||||
Kubernetes v1.20 | CIS v1.6 | [Link](https://docs.rke2.io/security/cis_self_assessment16/) | [Link](https://docs.rke2.io/security/hardening_guide/)
|
||||
|
||||
### K3s Guides
|
||||
|
||||
|
||||
@@ -30,16 +30,20 @@ nodes:
|
||||
role:
|
||||
- controlplane
|
||||
- etcd
|
||||
ssh_key_path: /home/user/.ssh/id_rsa
|
||||
port: 2222
|
||||
docker_socket: /var/run/docker.sock
|
||||
- address: 2.2.2.2
|
||||
user: ubuntu
|
||||
role:
|
||||
- worker
|
||||
ssh_key_path: /home/user/.ssh/id_rsa
|
||||
ssh_key: |-
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
|
||||
-----END RSA PRIVATE KEY-----
|
||||
ssh_cert_path: /home/user/.ssh/test-key-cert.pub
|
||||
ssh_cert: |-
|
||||
ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3Bl....
|
||||
- address: example.com
|
||||
user: ubuntu
|
||||
role:
|
||||
@@ -48,6 +52,10 @@ nodes:
|
||||
internal_address: 192.168.1.6
|
||||
labels:
|
||||
app: ingress
|
||||
taints:
|
||||
- key: test-key
|
||||
value: test-value
|
||||
effect: NoSchedule
|
||||
|
||||
# If set to true, RKE will not fail when unsupported Docker version
|
||||
# are found
|
||||
@@ -132,6 +140,9 @@ system_images:
|
||||
|
||||
services:
|
||||
etcd:
|
||||
# Custom uid/guid for etcd directory and files
|
||||
uid: 52034
|
||||
gid: 52034
|
||||
# if external etcd is used
|
||||
# path: /etcdcluster
|
||||
# external_urls:
|
||||
@@ -159,6 +170,60 @@ services:
|
||||
# Expose a different port range for NodePort services
|
||||
service_node_port_range: 30000-32767
|
||||
pod_security_policy: false
|
||||
# Encrypt secret data at Rest
|
||||
# Available as of v0.3.1
|
||||
secrets_encryption_config:
|
||||
enabled: true
|
||||
custom_config:
|
||||
apiVersion: apiserver.config.k8s.io/v1
|
||||
kind: EncryptionConfiguration
|
||||
resources:
|
||||
- resources:
|
||||
- secrets
|
||||
providers:
|
||||
- aescbc:
|
||||
keys:
|
||||
- name: k-fw5hn
|
||||
secret: RTczRjFDODMwQzAyMDVBREU4NDJBMUZFNDhCNzM5N0I=
|
||||
- identity: {}
|
||||
# Enable audit logging
|
||||
# Available as of v1.0.0
|
||||
audit_log:
|
||||
enabled: true
|
||||
configuration:
|
||||
max_age: 6
|
||||
max_backup: 6
|
||||
max_size: 110
|
||||
path: /var/log/kube-audit/audit-log.json
|
||||
format: json
|
||||
policy:
|
||||
apiVersion: audit.k8s.io/v1 # This is required.
|
||||
kind: Policy
|
||||
omitStages:
|
||||
- "RequestReceived"
|
||||
rules:
|
||||
# Log pod changes at RequestResponse level
|
||||
- level: RequestResponse
|
||||
resources:
|
||||
- group: ""
|
||||
# Resource "pods" doesn't match requests to any subresource of pods,
|
||||
# which is consistent with the RBAC policy.
|
||||
resources: ["pods"]
|
||||
# Using the EventRateLimit admission control enforces a limit on the number of events
|
||||
# that the API Server will accept in a given time period
|
||||
# Available as of v1.0.0
|
||||
event_rate_limit:
|
||||
enabled: true
|
||||
configuration:
|
||||
apiVersion: eventratelimit.admission.k8s.io/v1alpha1
|
||||
kind: Configuration
|
||||
limits:
|
||||
- type: Server
|
||||
qps: 6000
|
||||
burst: 30000
|
||||
# Enable AlwaysPullImages Admission controller plugin
|
||||
# Available as of v0.2.0
|
||||
always_pull_images: false
|
||||
# Add additional arguments to the kubernetes API server
|
||||
# This WILL OVERRIDE any existing defaults
|
||||
extra_args:
|
||||
@@ -178,6 +243,13 @@ services:
|
||||
# IP range for any services created on Kubernetes
|
||||
# This must match the service_cluster_ip_range in kube-api
|
||||
service_cluster_ip_range: 10.43.0.0/16
|
||||
# Add additional arguments to the kubernetes API server
|
||||
# This WILL OVERRIDE any existing defaults
|
||||
extra_args:
|
||||
# Set the level of log output to debug-level
|
||||
v: 4
|
||||
# Enable RotateKubeletServerCertificate feature gate
|
||||
feature-gates: RotateKubeletServerCertificate=true
|
||||
kubelet:
|
||||
# Base domain for the cluster
|
||||
cluster_domain: cluster.local
|
||||
@@ -185,15 +257,28 @@ services:
|
||||
cluster_dns_server: 10.43.0.10
|
||||
# Fail if swap is on
|
||||
fail_swap_on: false
|
||||
# Configure pod-infra-container-image argument
|
||||
pod-infra-container-image: "k8s.gcr.io/pause:3.2"
|
||||
# Generate a certificate signed by the kube-ca Certificate Authority
|
||||
# for the kubelet to use as a server certificate
|
||||
# Available as of v1.0.0
|
||||
generate_serving_certificate: true
|
||||
# Set max pods to 250 instead of default 110
|
||||
extra_args:
|
||||
# Set max pods to 250 instead of default 110
|
||||
max-pods: 250
|
||||
# Enable RotateKubeletServerCertificate feature gate
|
||||
feature-gates: RotateKubeletServerCertificate=true
|
||||
# Optionally define additional volume binds to a service
|
||||
extra_binds:
|
||||
- "/usr/libexec/kubernetes/kubelet-plugins:/usr/libexec/kubernetes/kubelet-plugins"
|
||||
scheduler:
|
||||
extra_args:
|
||||
# Set the level of log output to debug-level
|
||||
v: 4
|
||||
kubeproxy:
|
||||
extra_args:
|
||||
# Set the level of log output to debug-level
|
||||
v: 4
|
||||
|
||||
# Currently, only authentication strategy supported is x509.
|
||||
# You can optionally create additional SANs (hostnames or IPs) to
|
||||
@@ -223,19 +308,69 @@ addon_job_timeout: 30
|
||||
|
||||
# Specify network plugin-in (canal, calico, flannel, weave, or none)
|
||||
network:
|
||||
plugin: canal
|
||||
plugin: canal
|
||||
# Specify MTU
|
||||
mtu: 1400
|
||||
options:
|
||||
# Configure interface to use for Canal
|
||||
canal_iface: eth1
|
||||
canal_flannel_backend_type: vxlan
|
||||
# Available as of v1.2.6
|
||||
canal_autoscaler_priority_class_name: system-cluster-critical
|
||||
canal_priority_class_name: system-cluster-critical
|
||||
# Available as of v1.2.4
|
||||
tolerations:
|
||||
- key: "node.kubernetes.io/unreachable"
|
||||
operator: "Exists"
|
||||
effect: "NoExecute"
|
||||
tolerationseconds: 300
|
||||
- key: "node.kubernetes.io/not-ready"
|
||||
operator: "Exists"
|
||||
effect: "NoExecute"
|
||||
tolerationseconds: 300
|
||||
# Available as of v1.1.0
|
||||
update_strategy:
|
||||
strategy: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxUnavailable: 6
|
||||
|
||||
# Specify DNS provider (coredns or kube-dns)
|
||||
dns:
|
||||
provider: coredns
|
||||
provider: coredns
|
||||
# Available as of v1.1.0
|
||||
update_strategy:
|
||||
strategy: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxUnavailable: 20%
|
||||
maxSurge: 15%
|
||||
linear_autoscaler_params:
|
||||
cores_per_replica: 0.34
|
||||
nodes_per_replica: 4
|
||||
prevent_single_point_failure: true
|
||||
min: 2
|
||||
max: 3
|
||||
|
||||
# Specify monitoring provider (metrics-server)
|
||||
monitoring:
|
||||
provider: metrics-server
|
||||
# Available as of v1.1.0
|
||||
update_strategy:
|
||||
strategy: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxUnavailable: 8
|
||||
|
||||
# Currently only nginx ingress provider is supported.
|
||||
# To disable ingress controller, set `provider: none`
|
||||
# `node_selector` controls ingress placement and is optional
|
||||
ingress:
|
||||
provider: nginx
|
||||
node_selector:
|
||||
app: ingress
|
||||
provider: nginx
|
||||
node_selector:
|
||||
app: ingress
|
||||
# Available as of v1.1.0
|
||||
update_strategy:
|
||||
strategy: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxUnavailable: 5
|
||||
|
||||
# All add-on manifests MUST specify a namespace
|
||||
addons: |-
|
||||
|
||||
@@ -52,54 +52,13 @@ RKE runs on almost any Linux OS with Docker installed. For details on which OS a
|
||||
|
||||
- Swap should be disabled on any worker nodes
|
||||
|
||||
- Following kernel modules should be present. This can be checked using:
|
||||
* `modprobe module_name`
|
||||
* `lsmod | grep module_name`
|
||||
* `grep module_name /lib/modules/$(uname -r)/modules.builtin`, if it's a built-in module
|
||||
* The following bash script
|
||||
- Please check the network plugin documentation for any additional requirements (for example, kernel modules)
|
||||
- [Calico](https://docs.projectcalico.org/getting-started/kubernetes/requirements#kernel-dependencies)
|
||||
- [Flannel](https://github.com/flannel-io/flannel/tree/master/Documentation)
|
||||
- Canal (Combination Calico and Flannel)
|
||||
- [Weave](https://www.weave.works/docs/net/latest/install/installing-weave/)
|
||||
|
||||
```bash
|
||||
for module in br_netfilter ip6_udp_tunnel ip_set ip_set_hash_ip ip_set_hash_net iptable_filter iptable_nat iptable_mangle iptable_raw nf_conntrack_netlink nf_conntrack nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat nf_nat_ipv4 nf_nat_masquerade_ipv4 nfnetlink udp_tunnel veth vxlan x_tables xt_addrtype xt_conntrack xt_comment xt_mark xt_multiport xt_nat xt_recent xt_set xt_statistic xt_tcpudp;
|
||||
do
|
||||
if ! lsmod | grep -q $module; then
|
||||
echo "module $module is not present";
|
||||
fi;
|
||||
done
|
||||
```
|
||||
|
||||
Module name |
|
||||
------------|
|
||||
br_netfilter |
|
||||
ip6_udp_tunnel |
|
||||
ip_set |
|
||||
ip_set_hash_ip |
|
||||
ip_set_hash_net |
|
||||
iptable_filter |
|
||||
iptable_nat |
|
||||
iptable_mangle |
|
||||
iptable_raw |
|
||||
nf_conntrack_netlink |
|
||||
nf_conntrack |
|
||||
nf_conntrack_ipv4 |
|
||||
nf_defrag_ipv4 |
|
||||
nf_nat |
|
||||
nf_nat_ipv4 |
|
||||
nf_nat_masquerade_ipv4 |
|
||||
nfnetlink |
|
||||
udp_tunnel |
|
||||
veth |
|
||||
vxlan |
|
||||
x_tables |
|
||||
xt_addrtype |
|
||||
xt_conntrack |
|
||||
xt_comment |
|
||||
xt_mark |
|
||||
xt_multiport |
|
||||
xt_nat |
|
||||
xt_recent |
|
||||
xt_set |
|
||||
xt_statistic |
|
||||
xt_tcpudp |
|
||||
> **Note:** If you or your cloud provider are using a custom minimal kernel, some required (network) kernel modules might not be present.
|
||||
|
||||
- Following sysctl settings must be applied
|
||||
|
||||
@@ -309,23 +268,12 @@ Each Kubernetes version supports different Docker versions. The Kubernetes relea
|
||||
|
||||
### Installing Docker
|
||||
|
||||
You can either follow the [Docker installation](https://docs.docker.com/install/) instructions or use one of Rancher's [install scripts](https://github.com/rancher/install-docker) to install Docker. For RHEL, please see [How to install Docker on Red Hat Enterprise Linux 7](https://access.redhat.com/solutions/3727511).
|
||||
|
||||
Docker Version | Install Script |
|
||||
----------|------------------
|
||||
18.09.2 | <code>curl https://releases.rancher.com/install-docker/18.09.2.sh | sh</code> |
|
||||
18.06.2 | <code>curl https://releases.rancher.com/install-docker/18.06.2.sh | sh</code> |
|
||||
17.03.2 | <code>curl https://releases.rancher.com/install-docker/17.03.2.sh | sh</code> |
|
||||
Refer to [Installing Docker]({{<baseurl>}}/rancher/v2.5/en/installation/requirements/installing-docker/)
|
||||
|
||||
### Checking the Installed Docker Version
|
||||
|
||||
Confirm that a Kubernetes supported version of Docker is installed on your machine, by running `docker version --format '{{.Server.Version}}'`.
|
||||
|
||||
```
|
||||
docker version --format '{{.Server.Version}}'
|
||||
17.03.2-ce
|
||||
```
|
||||
|
||||
## Ports
|
||||
{{< ports-rke-nodes >}}
|
||||
{{< requirements_ports_rke >}}
|
||||
|
||||
Reference in New Issue
Block a user