diff --git a/content/k3s/latest/en/installation/install-options/_index.md b/content/k3s/latest/en/installation/install-options/_index.md index efab7e77072..ff08d9dd563 100644 --- a/content/k3s/latest/en/installation/install-options/_index.md +++ b/content/k3s/latest/en/installation/install-options/_index.md @@ -53,7 +53,7 @@ Setting `K3S_URL` without explicitly setting an exec command will default the co When running the agent `K3S_TOKEN` must also be set. -# Installing K3s from the Binary +### Options for installation from binary As stated, the installation script is primarily concerned with configuring K3s to run as a service. If you choose to not use the script, you can run K3s simply by downloading the binary from our [release page](https://github.com/rancher/k3s/releases/latest), placing it on your path, and executing it. The K3s binary supports the following commands: diff --git a/content/rancher/v2.5/en/admin-settings/authentication/microsoft-adfs/rancher-adfs-setup/_index.md b/content/rancher/v2.5/en/admin-settings/authentication/microsoft-adfs/rancher-adfs-setup/_index.md index b4f8655e59e..0f36d2631dd 100644 --- a/content/rancher/v2.5/en/admin-settings/authentication/microsoft-adfs/rancher-adfs-setup/_index.md +++ b/content/rancher/v2.5/en/admin-settings/authentication/microsoft-adfs/rancher-adfs-setup/_index.md @@ -51,5 +51,5 @@ After you complete [Configuring Microsoft AD FS for Rancher]({{}}/ranch **Tip:** You can generate a certificate using an openssl command. For example: ``` -openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=https://myservice.example.com" -``` \ No newline at end of file +openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com" +``` diff --git a/content/rancher/v2.5/en/backups/back-up-rancher/_index.md b/content/rancher/v2.5/en/backups/back-up-rancher/_index.md index 661bbfbb13a..dee7c261fd1 100644 --- a/content/rancher/v2.5/en/backups/back-up-rancher/_index.md +++ b/content/rancher/v2.5/en/backups/back-up-rancher/_index.md @@ -32,7 +32,7 @@ To perform a backup, a custom resource of type Backup must be created. 1. Click **Backup.** 1. Create the Backup with the form, or with the YAML editor. 1. For configuring the Backup details using the form, click **Create** and refer to the [configuration reference](../configuration/backup-config) and to the [examples.](../examples/#backup) -1. For using the YAML editor, we can click **Create > Create from YAML.** Enter the Backup YAML. This example Backup custom resource would create encrypted recurring backups in S3: +1. For using the YAML editor, we can click **Create > Create from YAML.** Enter the Backup YAML. This example Backup custom resource would create encrypted recurring backups in S3. The app uses the `credentialSecretNamespace` value to determine where to look for the S3 backup secret: ```yaml apiVersion: resources.cattle.io/v1 diff --git a/content/rancher/v2.5/en/backups/configuration/backup-config/_index.md b/content/rancher/v2.5/en/backups/configuration/backup-config/_index.md index 8bce4417a53..5ad25999879 100644 --- a/content/rancher/v2.5/en/backups/configuration/backup-config/_index.md +++ b/content/rancher/v2.5/en/backups/configuration/backup-config/_index.md @@ -85,7 +85,7 @@ Selecting the first option stores this backup in the storage location configured The S3 storage location contains the following configuration fields: -1. **Credential Secret** (optional): If you need to use the AWS Access keys Secret keys to access s3 bucket, create a secret with your credentials with keys and the directives `accessKey` and `secretKey`. It can be in any namespace. An example secret is [here.](#example-credentialsecret) This directive is unnecessary if the nodes running your operator are in EC2 and set up with IAM permissions that allow them to access S3, as described in [this section.](#iam-permissions-for-ec2-nodes-to-access-s3) +1. **Credential Secret** (optional): If you need to use the AWS Access keys Secret keys to access s3 bucket, create a secret with your credentials with keys and the directives `accessKey` and `secretKey`. It can be in any namespace. An example secret is [here.](#example-credentialsecret) This directive is unnecessary if the nodes running your operator are in EC2 and set up with IAM permissions that allow them to access S3, as described in [this section.](#iam-permissions-for-ec2-nodes-to-access-s3) The Credential Secret dropdown lists the secrets in all namespaces. 1. **Bucket Name**: The name of the S3 bucket where backup files will be stored. 1. **Region** (optional): The AWS [region](https://aws.amazon.com/about-aws/global-infrastructure/regions_az/) where the S3 bucket is located. This field isn't needed for configuring MinIO. 1. **Folder** (optional): The name of the folder in the S3 bucket where backup files will be stored. diff --git a/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md b/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md index 9af4a260e3d..e164ad6c169 100644 --- a/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md +++ b/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md @@ -5,7 +5,7 @@ weight: 1 _Available as of Rancher v2.5_ -Fleet is GitOps at scale. Fleet is designed to manage up to a million clusters. It's also lightweight enough that is works great for a [single cluster](https://fleet.rancher.io/single-cluster-install/) too, but it really shines when you get to a [large scale.](https://fleet.rancher.io/multi-cluster-install/) By large scale we mean either a lot of clusters, a lot of deployments, or a lot of teams in a single organization. +Fleet is GitOps at scale. Fleet is designed to manage up to a million clusters. It's also lightweight enough that it works great for a [single cluster](https://fleet.rancher.io/single-cluster-install/) too, but it really shines when you get to a [large scale.](https://fleet.rancher.io/multi-cluster-install/) By large scale we mean either a lot of clusters, a lot of deployments, or a lot of teams in a single organization. Fleet is a separate project from Rancher, and can be installed on any Kubernetes cluster with Helm. @@ -43,4 +43,4 @@ The Fleet Helm charts are available [here.](https://github.com/rancher/fleet/rel ### Documentation -The Fleet documentation is at [https://fleet.rancher.io/.](https://fleet.rancher.io/) \ No newline at end of file +The Fleet documentation is at [https://fleet.rancher.io/.](https://fleet.rancher.io/) diff --git a/content/rancher/v2.5/en/installation/requirements/ports/_index.md b/content/rancher/v2.5/en/installation/requirements/ports/_index.md index 7595afab4c1..ad874040492 100644 --- a/content/rancher/v2.5/en/installation/requirements/ports/_index.md +++ b/content/rancher/v2.5/en/installation/requirements/ports/_index.md @@ -276,6 +276,27 @@ When using the [AWS EC2 node driver]({{}}/rancher/v2.5/en/cluster-provi SUSE Linux may have a firewall that blocks all ports by default. To open the ports needed for adding the host to a custom cluster, +{{% tabs %}} +{{% tab "SLES 15 / openSUSE Leap 15" %}} +1. SSH into the instance. +1. Start YaST in text mode: +``` +sudo yast2 +``` + +1. Navigate to **Security and Users** > **Firewall** > **Zones:public** > **Ports**. To navigate within the interface, follow the instructions [here](https://doc.opensuse.org/documentation/leap/reference/html/book.opensuse.reference/cha-yast-text.html#sec-yast-cli-navigate). +1. To open the required ports, enter them into the **TCP Ports** and **UDP Ports** fields. In this example, ports 9796 and 10250 are also opened for monitoring. The resulting fields should look similar to the following: +```yaml +TCP Ports +22, 80, 443, 2376, 2379, 2380, 6443, 9099, 9796, 10250, 10254, 30000-32767 +UDP Ports +8472, 30000-32767 +``` + +1. When all required ports are enter, select **Accept**. + +{{% /tab %}} +{{% tab "SLES 12 / openSUSE Leap 42" %}} 1. SSH into the instance. 1. Edit /`etc/sysconfig/SuSEfirewall2` and open the required ports. In this example, ports 9796 and 10250 are also opened for monitoring: ``` @@ -287,5 +308,7 @@ SUSE Linux may have a firewall that blocks all ports by default. To open the por ``` SuSEfirewall2 ``` +{{% /tab %}} +{{% /tabs %}} **Result:** The node has the open ports required to be added to a custom cluster. diff --git a/content/rancher/v2.5/en/istio/configuration-reference/rke2/_index.md b/content/rancher/v2.5/en/istio/configuration-reference/rke2/_index.md index c06e83a2e0e..ae4e1718794 100644 --- a/content/rancher/v2.5/en/istio/configuration-reference/rke2/_index.md +++ b/content/rancher/v2.5/en/istio/configuration-reference/rke2/_index.md @@ -15,18 +15,18 @@ Through the **Cluster Explorer,** when installing or upgrading Istio through **A apiVersion: install.istio.io/v1alpha1 kind: IstioOperator spec: - components: - cni: - enabled: true - values: + components: cni: - image: rancher/istio-install-cni:1.7.3 - excludeNamespaces: + enabled: true + values: + cni: + image: rancher/istio-install-cni:1.7.3 + excludeNamespaces: - istio-system - kube-system - logLevel: info - cniBinDir: /opt/cni/bin - cniConfDir: /etc/cni/net.d + logLevel: info + cniBinDir: /opt/cni/bin + cniConfDir: /etc/cni/net.d ``` 1. After installing Istio, you'll notice the cni-node pods in the istio-system namespace in a CrashLoopBackoff error. Manually edit the `istio-cni-node` daemonset to include the following on the `install-cni` container: ```yaml diff --git a/content/rancher/v2.5/en/istio/disabling-istio/_index.md b/content/rancher/v2.5/en/istio/disabling-istio/_index.md index 3a5930779ff..d0fe6ec9c63 100644 --- a/content/rancher/v2.5/en/istio/disabling-istio/_index.md +++ b/content/rancher/v2.5/en/istio/disabling-istio/_index.md @@ -12,11 +12,18 @@ This section describes how to uninstall Istio in a cluster or disable a namespac To uninstall Istio, 1. From the **Cluster Explorer,** navigate to **Installed Apps** in **Apps & Marketplace** and locate the `rancher-istio` installation. -1. Select all the apps in the `istio-system` namespace and click **Delete**. +1. Select `rancher-istio` in the `istio-system namespace and click **Delete** +1. After `rancher-istio` is deleted, you can then select all the remaining apps in the `istio-system` namespace and click **Delete** **Result:** The `rancher-istio` app in the cluster gets removed. The Istio sidecar cannot be deployed on any workloads in the cluster. -**Note:** You can no longer disable and reenable your Istio installation. If you would like to save your settings for a future install, view and save individual YAMLs to refer back to / reuse for future installations. +**Note:** You can no longer disable and re-enable your Istio installation. If you would like to save your settings for a future install, view and save individual YAMLs to refer back to / reuse for future installations. + +**Troubleshooting Uninstall:** If you didn't follow the uninstall steps, you may encounter a warning during uninstall: + +`Error: uninstallation completed with 1 error(s): unable to build kubernetes objects for delete: unable to recognize "": no matches for kind "MonitoringDashboard" in version "monitoring.kiali.io/v1alpha1"` + +This could mean a few things. You either selected all the apps in the `istio-system` namespace and deleted them at the same time, or you deleted `rancher-istio` chart dependencies prior to deleting the `rancher-istio` chart. Since the uninstall did not complete properly, you will have resources remaining in the `istio-system` namespace that you will need to manually clean up. Another option to avoid manual clean up is to install `rancher-istio` again, then uninstall it in the correct order. # Disable Istio in a Namespace diff --git a/content/rancher/v2.5/en/monitoring-alerting/configuration/alertmanager/_index.md b/content/rancher/v2.5/en/monitoring-alerting/configuration/alertmanager/_index.md index ba0c63dac06..d2414bfd56b 100644 --- a/content/rancher/v2.5/en/monitoring-alerting/configuration/alertmanager/_index.md +++ b/content/rancher/v2.5/en/monitoring-alerting/configuration/alertmanager/_index.md @@ -26,7 +26,7 @@ The [Alertmanager Config](https://prometheus.io/docs/alerting/latest/configurati - [Receiver](#receiver) - [Grouping](#grouping) - [Matching](#matching) -- [Example Alertmanager Config](#example-alertmanager-config) +- [Example Alertmanager Configs](#example-alertmanager-configs) - [Example Route Config for CIS Scan Alerts](#example-route-config-for-cis-scan-alerts) # Overview @@ -326,7 +326,7 @@ The YAML provided here will be directly appended to your receiver within the Ale {{% /tab %}} {{% tab "Rancher v2.5.0-2.5.3" %}} -The Alertmanager must be configured in YAML, as shown in this [example.](#example-alertmanager-config) +The Alertmanager must be configured in YAML, as shown in these [examples.](#example-alertmanager-configs) {{% /tab %}} {{% /tabs %}} @@ -366,12 +366,13 @@ match_re: {{% /tab %}} {{% tab "Rancher v2.5.0-2.5.3" %}} -The Alertmanager must be configured in YAML, as shown in this [example.](#example-alertmanager-config) +The Alertmanager must be configured in YAML, as shown in these [examples.](#example-alertmanager-configs) {{% /tab %}} {{% /tabs %}} -# Example Alertmanager Config +# Example Alertmanager Configs +### Slack To set up notifications via Slack, the following Alertmanager Config YAML can be placed into the `alertmanager.yaml` key of the Alertmanager Config Secret, where the `api_url` should be updated to use your Webhook URL from Slack: ```yaml @@ -391,6 +392,31 @@ templates: - /etc/alertmanager/config/*.tmpl ``` +### PagerDuty +To set up notifications via PagerDuty, use the example below from the [PagerDuty documentation](https://www.pagerduty.com/docs/guides/prometheus-integration-guide/) as a guideline. This example sets up a route that captures alerts for a database service and sends them to a receiver linked to a service that will directly notify the DBAs in PagerDuty, while all other alerts will be directed to a default receiver with a different PagerDuty integration key. + +The following Alertmanager Config YAML can be placed into the `alertmanager.yaml` key of the Alertmanager Config Secret. The `service_key` should be updated to use your PagerDuty integration key and can be found as per the "Integrating with Global Event Routing" section of the PagerDuty documentation. For the full list of configuration options, refer to the [Prometheus documentation](https://prometheus.io/docs/alerting/latest/configuration/#pagerduty_config). + +```yaml +route: + group_by: [cluster] + receiver: 'pagerduty-notifications' + group_interval: 5m + routes: + - match: + service: database + receiver: 'database-notifcations' + +receivers: +- name: 'pagerduty-notifications' + pagerduty_configs: + - service_key: 'primary-integration-key' + +- name: 'database-notifcations' + pagerduty_configs: + - service_key: 'database-integration-key' +``` + # Example Route Config for CIS Scan Alerts While configuring the routes for `rancher-cis-benchmark` alerts, you can specify the matching using the key-value pair `job: rancher-cis-scan`. diff --git a/content/rancher/v2.5/en/monitoring-alerting/configuration/prometheusrules/_index.md b/content/rancher/v2.5/en/monitoring-alerting/configuration/prometheusrules/_index.md index 16a76c10766..eef2549284b 100644 --- a/content/rancher/v2.5/en/monitoring-alerting/configuration/prometheusrules/_index.md +++ b/content/rancher/v2.5/en/monitoring-alerting/configuration/prometheusrules/_index.md @@ -71,7 +71,7 @@ Rancher v2.5.4 introduced the capability to configure PrometheusRules by filling ### Alerting Rules -[Alerting rules](https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/) allow you to define alert conditions based on PromQL (Prometheus expression language) expressions and to send notifications about firing alerts to an external service. +[Alerting rules](https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/) allow you to define alert conditions based on PromQL (Prometheus Query Language) expressions and to send notifications about firing alerts to an external service. | Field | Description | |-------|----------------| @@ -85,7 +85,7 @@ Rancher v2.5.4 introduced the capability to configure PrometheusRules by filling ### Recording Rules -[Recording rules](https://prometheus.io/docs/prometheus/latest/configuration/recording_rules/#recording-rules) allow you to precompute frequently needed or computationally expensive PromQL (Prometheus expression language) expressions and save their result as a new set of time series. +[Recording rules](https://prometheus.io/docs/prometheus/latest/configuration/recording_rules/#recording-rules) allow you to precompute frequently needed or computationally expensive PromQL (Prometheus Query Language) expressions and save their result as a new set of time series. | Field | Description | |-------|----------------| diff --git a/content/rancher/v2.5/en/security/rancher-2.5/1.6-hardening-2.5/_index.md b/content/rancher/v2.5/en/security/rancher-2.5/1.6-hardening-2.5/_index.md index 6d20521a94d..59588fa422c 100644 --- a/content/rancher/v2.5/en/security/rancher-2.5/1.6-hardening-2.5/_index.md +++ b/content/rancher/v2.5/en/security/rancher-2.5/1.6-hardening-2.5/_index.md @@ -180,7 +180,7 @@ services: path: "" uid: 52034 gid: 52034 - snapshot: true + snapshot: false retention: "" creation: "" backup_config: null diff --git a/content/rancher/v2.5/en/security/rancher-2.5/_index.md b/content/rancher/v2.5/en/security/rancher-2.5/_index.md index 1cc1abf1372..299b1ba66c0 100644 --- a/content/rancher/v2.5/en/security/rancher-2.5/_index.md +++ b/content/rancher/v2.5/en/security/rancher-2.5/_index.md @@ -38,7 +38,8 @@ Kubernetes v1.18+ | CIS v1.6 | [Link](./1.6-benchmark-2.5) | [Link](./1.6-harden Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guides ---|---|---|--- -Kubernetes v1.18 | CIS v1.5 | [Link](https://docs.rke2.io/security/cis_self_assessment/) | [Link](https://docs.rke2.io/security/hardening_guide/) +Kubernetes v1.18 | CIS v1.5 | [Link](https://docs.rke2.io/security/cis_self_assessment15/) | [Link](https://docs.rke2.io/security/hardening_guide/) +Kubernetes v1.20 | CIS v1.6 | [Link](https://docs.rke2.io/security/cis_self_assessment16/) | [Link](https://docs.rke2.io/security/hardening_guide/) ### K3s Guides @@ -53,4 +54,4 @@ _Available as of v2.5.8_ [Security-Enhanced Linux (SELinux)](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) is a security enhancement to Linux. After being historically used by government agencies, SELinux is now industry standard and is enabled by default on CentOS 7 and 8. -To use Rancher with SELinux, we recommend installing the `rancher-selinux` RPM according to the instructions on [this page.]({{}}/rancher/v2.5/en/security/selinux/#installing-the-rancher-selinux-rpm) \ No newline at end of file +To use Rancher with SELinux, we recommend installing the `rancher-selinux` RPM according to the instructions on [this page.]({{}}/rancher/v2.5/en/security/selinux/#installing-the-rancher-selinux-rpm) diff --git a/content/rancher/v2.x/en/admin-settings/authentication/microsoft-adfs/rancher-adfs-setup/_index.md b/content/rancher/v2.x/en/admin-settings/authentication/microsoft-adfs/rancher-adfs-setup/_index.md index 6dc6fe240df..4a9d9e6b03f 100644 --- a/content/rancher/v2.x/en/admin-settings/authentication/microsoft-adfs/rancher-adfs-setup/_index.md +++ b/content/rancher/v2.x/en/admin-settings/authentication/microsoft-adfs/rancher-adfs-setup/_index.md @@ -52,5 +52,5 @@ After you complete [Configuring Microsoft AD FS for Rancher]({{}}/ranch **Tip:** You can generate a certificate using an openssl command. For example: ``` -openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=https://myservice.example.com" +openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com" ``` diff --git a/content/rancher/v2.x/en/istio/v2.5/configuration-reference/rke2/_index.md b/content/rancher/v2.x/en/istio/v2.5/configuration-reference/rke2/_index.md index 9260c2ec4da..7f6bab7fb00 100644 --- a/content/rancher/v2.x/en/istio/v2.5/configuration-reference/rke2/_index.md +++ b/content/rancher/v2.x/en/istio/v2.5/configuration-reference/rke2/_index.md @@ -13,18 +13,18 @@ Through the **Cluster Explorer,** when installing or upgrading Istio through **A apiVersion: install.istio.io/v1alpha1 kind: IstioOperator spec: - components: - cni: - enabled: true - values: + components: cni: - image: rancher/istio-install-cni:1.7.3 - excludeNamespaces: + enabled: true + values: + cni: + image: rancher/istio-install-cni:1.7.3 + excludeNamespaces: - istio-system - kube-system - logLevel: info - cniBinDir: /opt/cni/bin - cniConfDir: /etc/cni/net.d + logLevel: info + cniBinDir: /opt/cni/bin + cniConfDir: /etc/cni/net.d ``` 1. After installing Istio, you'll notice the cni-node pods in the istio-system namespace in a CrashLoopBackoff error. Manually edit the `istio-cni-node` daemonset to include the following on the `install-cni` container: ```yaml diff --git a/content/rancher/v2.x/en/monitoring-alerting/v2.5/configuration/prometheusrules/_index.md b/content/rancher/v2.x/en/monitoring-alerting/v2.5/configuration/prometheusrules/_index.md index 6e249101c48..e30a3e6dcfd 100644 --- a/content/rancher/v2.x/en/monitoring-alerting/v2.5/configuration/prometheusrules/_index.md +++ b/content/rancher/v2.x/en/monitoring-alerting/v2.5/configuration/prometheusrules/_index.md @@ -69,7 +69,7 @@ Rancher v2.5.4 introduced the capability to configure PrometheusRules by filling ### Alerting Rules -[Alerting rules](https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/) allow you to define alert conditions based on PromQL (Prometheus expression language) expressions and to send notifications about firing alerts to an external service. +[Alerting rules](https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/) allow you to define alert conditions based on PromQL (Prometheus Query Language) expressions and to send notifications about firing alerts to an external service. | Field | Description | |-------|----------------| @@ -83,7 +83,7 @@ Rancher v2.5.4 introduced the capability to configure PrometheusRules by filling ### Recording Rules -[Recording rules](https://prometheus.io/docs/prometheus/latest/configuration/recording_rules/#recording-rules) allow you to precompute frequently needed or computationally expensive PromQL (Prometheus expression language) expressions and save their result as a new set of time series. +[Recording rules](https://prometheus.io/docs/prometheus/latest/configuration/recording_rules/#recording-rules) allow you to precompute frequently needed or computationally expensive PromQL (Prometheus Query Language) expressions and save their result as a new set of time series. | Field | Description | |-------|----------------| diff --git a/content/rancher/v2.x/en/security/rancher-2.5/1.6-hardening-2.5/_index.md b/content/rancher/v2.x/en/security/rancher-2.5/1.6-hardening-2.5/_index.md index 47a9efadf26..c49eb6a1d40 100644 --- a/content/rancher/v2.x/en/security/rancher-2.5/1.6-hardening-2.5/_index.md +++ b/content/rancher/v2.x/en/security/rancher-2.5/1.6-hardening-2.5/_index.md @@ -181,7 +181,7 @@ services: path: "" uid: 52034 gid: 52034 - snapshot: true + snapshot: false retention: "" creation: "" backup_config: null diff --git a/content/rancher/v2.x/en/security/rancher-2.5/_index.md b/content/rancher/v2.x/en/security/rancher-2.5/_index.md index 8cff4bc6ec7..afff1ac7d2d 100644 --- a/content/rancher/v2.x/en/security/rancher-2.5/_index.md +++ b/content/rancher/v2.x/en/security/rancher-2.5/_index.md @@ -28,7 +28,8 @@ Kubernetes v1.18+ | CIS v1.6 | [Link](./1.6-benchmark-2.5) | [Link](./1.6-harden Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guides ---|---|---|--- -Kubernetes v1.18 | CIS v1.5 | [Link](https://docs.rke2.io/security/cis_self_assessment/) | [Link](https://docs.rke2.io/security/hardening_guide/) +Kubernetes v1.18 | CIS v1.5 | [Link](https://docs.rke2.io/security/cis_self_assessment15/) | [Link](https://docs.rke2.io/security/hardening_guide/) +Kubernetes v1.20 | CIS v1.6 | [Link](https://docs.rke2.io/security/cis_self_assessment16/) | [Link](https://docs.rke2.io/security/hardening_guide/) ### K3s Guides diff --git a/content/rke/latest/en/example-yamls/_index.md b/content/rke/latest/en/example-yamls/_index.md index 989623a7f01..639935e2569 100644 --- a/content/rke/latest/en/example-yamls/_index.md +++ b/content/rke/latest/en/example-yamls/_index.md @@ -30,16 +30,20 @@ nodes: role: - controlplane - etcd - ssh_key_path: /home/user/.ssh/id_rsa port: 2222 + docker_socket: /var/run/docker.sock - address: 2.2.2.2 user: ubuntu role: - worker + ssh_key_path: /home/user/.ssh/id_rsa ssh_key: |- -----BEGIN RSA PRIVATE KEY----- -----END RSA PRIVATE KEY----- + ssh_cert_path: /home/user/.ssh/test-key-cert.pub + ssh_cert: |- + ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3Bl.... - address: example.com user: ubuntu role: @@ -48,6 +52,10 @@ nodes: internal_address: 192.168.1.6 labels: app: ingress + taints: + - key: test-key + value: test-value + effect: NoSchedule # If set to true, RKE will not fail when unsupported Docker version # are found @@ -132,6 +140,9 @@ system_images: services: etcd: + # Custom uid/guid for etcd directory and files + uid: 52034 + gid: 52034 # if external etcd is used # path: /etcdcluster # external_urls: @@ -159,6 +170,60 @@ services: # Expose a different port range for NodePort services service_node_port_range: 30000-32767 pod_security_policy: false + # Encrypt secret data at Rest + # Available as of v0.3.1 + secrets_encryption_config: + enabled: true + custom_config: + apiVersion: apiserver.config.k8s.io/v1 + kind: EncryptionConfiguration + resources: + - resources: + - secrets + providers: + - aescbc: + keys: + - name: k-fw5hn + secret: RTczRjFDODMwQzAyMDVBREU4NDJBMUZFNDhCNzM5N0I= + - identity: {} + # Enable audit logging + # Available as of v1.0.0 + audit_log: + enabled: true + configuration: + max_age: 6 + max_backup: 6 + max_size: 110 + path: /var/log/kube-audit/audit-log.json + format: json + policy: + apiVersion: audit.k8s.io/v1 # This is required. + kind: Policy + omitStages: + - "RequestReceived" + rules: + # Log pod changes at RequestResponse level + - level: RequestResponse + resources: + - group: "" + # Resource "pods" doesn't match requests to any subresource of pods, + # which is consistent with the RBAC policy. + resources: ["pods"] + # Using the EventRateLimit admission control enforces a limit on the number of events + # that the API Server will accept in a given time period + # Available as of v1.0.0 + event_rate_limit: + enabled: true + configuration: + apiVersion: eventratelimit.admission.k8s.io/v1alpha1 + kind: Configuration + limits: + - type: Server + qps: 6000 + burst: 30000 + # Enable AlwaysPullImages Admission controller plugin + # Available as of v0.2.0 + always_pull_images: false # Add additional arguments to the kubernetes API server # This WILL OVERRIDE any existing defaults extra_args: @@ -178,6 +243,13 @@ services: # IP range for any services created on Kubernetes # This must match the service_cluster_ip_range in kube-api service_cluster_ip_range: 10.43.0.0/16 + # Add additional arguments to the kubernetes API server + # This WILL OVERRIDE any existing defaults + extra_args: + # Set the level of log output to debug-level + v: 4 + # Enable RotateKubeletServerCertificate feature gate + feature-gates: RotateKubeletServerCertificate=true kubelet: # Base domain for the cluster cluster_domain: cluster.local @@ -185,15 +257,28 @@ services: cluster_dns_server: 10.43.0.10 # Fail if swap is on fail_swap_on: false + # Configure pod-infra-container-image argument + pod-infra-container-image: "k8s.gcr.io/pause:3.2" # Generate a certificate signed by the kube-ca Certificate Authority # for the kubelet to use as a server certificate + # Available as of v1.0.0 generate_serving_certificate: true - # Set max pods to 250 instead of default 110 extra_args: + # Set max pods to 250 instead of default 110 max-pods: 250 + # Enable RotateKubeletServerCertificate feature gate + feature-gates: RotateKubeletServerCertificate=true # Optionally define additional volume binds to a service extra_binds: - "/usr/libexec/kubernetes/kubelet-plugins:/usr/libexec/kubernetes/kubelet-plugins" + scheduler: + extra_args: + # Set the level of log output to debug-level + v: 4 + kubeproxy: + extra_args: + # Set the level of log output to debug-level + v: 4 # Currently, only authentication strategy supported is x509. # You can optionally create additional SANs (hostnames or IPs) to @@ -223,19 +308,69 @@ addon_job_timeout: 30 # Specify network plugin-in (canal, calico, flannel, weave, or none) network: - plugin: canal + plugin: canal + # Specify MTU + mtu: 1400 + options: + # Configure interface to use for Canal + canal_iface: eth1 + canal_flannel_backend_type: vxlan + # Available as of v1.2.6 + canal_autoscaler_priority_class_name: system-cluster-critical + canal_priority_class_name: system-cluster-critical + # Available as of v1.2.4 + tolerations: + - key: "node.kubernetes.io/unreachable" + operator: "Exists" + effect: "NoExecute" + tolerationseconds: 300 + - key: "node.kubernetes.io/not-ready" + operator: "Exists" + effect: "NoExecute" + tolerationseconds: 300 + # Available as of v1.1.0 + update_strategy: + strategy: RollingUpdate + rollingUpdate: + maxUnavailable: 6 # Specify DNS provider (coredns or kube-dns) dns: - provider: coredns + provider: coredns + # Available as of v1.1.0 + update_strategy: + strategy: RollingUpdate + rollingUpdate: + maxUnavailable: 20% + maxSurge: 15% + linear_autoscaler_params: + cores_per_replica: 0.34 + nodes_per_replica: 4 + prevent_single_point_failure: true + min: 2 + max: 3 + +# Specify monitoring provider (metrics-server) +monitoring: + provider: metrics-server + # Available as of v1.1.0 + update_strategy: + strategy: RollingUpdate + rollingUpdate: + maxUnavailable: 8 # Currently only nginx ingress provider is supported. # To disable ingress controller, set `provider: none` # `node_selector` controls ingress placement and is optional ingress: - provider: nginx - node_selector: - app: ingress + provider: nginx + node_selector: + app: ingress + # Available as of v1.1.0 + update_strategy: + strategy: RollingUpdate + rollingUpdate: + maxUnavailable: 5 # All add-on manifests MUST specify a namespace addons: |- diff --git a/content/rke/latest/en/os/_index.md b/content/rke/latest/en/os/_index.md index 90882ed3340..843d66304e5 100644 --- a/content/rke/latest/en/os/_index.md +++ b/content/rke/latest/en/os/_index.md @@ -52,54 +52,13 @@ RKE runs on almost any Linux OS with Docker installed. For details on which OS a - Swap should be disabled on any worker nodes -- Following kernel modules should be present. This can be checked using: - * `modprobe module_name` - * `lsmod | grep module_name` - * `grep module_name /lib/modules/$(uname -r)/modules.builtin`, if it's a built-in module - * The following bash script +- Please check the network plugin documentation for any additional requirements (for example, kernel modules) + - [Calico](https://docs.projectcalico.org/getting-started/kubernetes/requirements#kernel-dependencies) + - [Flannel](https://github.com/flannel-io/flannel/tree/master/Documentation) + - Canal (Combination Calico and Flannel) + - [Weave](https://www.weave.works/docs/net/latest/install/installing-weave/) -```bash - for module in br_netfilter ip6_udp_tunnel ip_set ip_set_hash_ip ip_set_hash_net iptable_filter iptable_nat iptable_mangle iptable_raw nf_conntrack_netlink nf_conntrack nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat nf_nat_ipv4 nf_nat_masquerade_ipv4 nfnetlink udp_tunnel veth vxlan x_tables xt_addrtype xt_conntrack xt_comment xt_mark xt_multiport xt_nat xt_recent xt_set xt_statistic xt_tcpudp; - do - if ! lsmod | grep -q $module; then - echo "module $module is not present"; - fi; - done -``` - -Module name | -------------| -br_netfilter | -ip6_udp_tunnel | -ip_set | -ip_set_hash_ip | -ip_set_hash_net | -iptable_filter | -iptable_nat | -iptable_mangle | -iptable_raw | -nf_conntrack_netlink | -nf_conntrack | -nf_conntrack_ipv4 | -nf_defrag_ipv4 | -nf_nat | -nf_nat_ipv4 | -nf_nat_masquerade_ipv4 | -nfnetlink | -udp_tunnel | -veth | -vxlan | -x_tables | -xt_addrtype | -xt_conntrack | -xt_comment | -xt_mark | -xt_multiport | -xt_nat | -xt_recent | -xt_set | -xt_statistic | -xt_tcpudp | +> **Note:** If you or your cloud provider are using a custom minimal kernel, some required (network) kernel modules might not be present. - Following sysctl settings must be applied @@ -309,23 +268,12 @@ Each Kubernetes version supports different Docker versions. The Kubernetes relea ### Installing Docker -You can either follow the [Docker installation](https://docs.docker.com/install/) instructions or use one of Rancher's [install scripts](https://github.com/rancher/install-docker) to install Docker. For RHEL, please see [How to install Docker on Red Hat Enterprise Linux 7](https://access.redhat.com/solutions/3727511). - -Docker Version | Install Script | -----------|------------------ -18.09.2 | curl https://releases.rancher.com/install-docker/18.09.2.sh | sh | -18.06.2 | curl https://releases.rancher.com/install-docker/18.06.2.sh | sh | -17.03.2 | curl https://releases.rancher.com/install-docker/17.03.2.sh | sh | +Refer to [Installing Docker]({{}}/rancher/v2.5/en/installation/requirements/installing-docker/) ### Checking the Installed Docker Version Confirm that a Kubernetes supported version of Docker is installed on your machine, by running `docker version --format '{{.Server.Version}}'`. -``` -docker version --format '{{.Server.Version}}' -17.03.2-ce -``` - ## Ports {{< ports-rke-nodes >}} {{< requirements_ports_rke >}}