From cea5a7563d0e3115be645fb1e4c48d66e7b2293c Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Thu, 13 May 2021 19:00:09 -0700 Subject: [PATCH 01/15] Add PagerDuty example for Rancher <2.5.4 --- .../configuration/alertmanager/_index.md | 34 ++++++++++++++++--- 1 file changed, 30 insertions(+), 4 deletions(-) diff --git a/content/rancher/v2.5/en/monitoring-alerting/configuration/alertmanager/_index.md b/content/rancher/v2.5/en/monitoring-alerting/configuration/alertmanager/_index.md index ba0c63dac06..d2414bfd56b 100644 --- a/content/rancher/v2.5/en/monitoring-alerting/configuration/alertmanager/_index.md +++ b/content/rancher/v2.5/en/monitoring-alerting/configuration/alertmanager/_index.md @@ -26,7 +26,7 @@ The [Alertmanager Config](https://prometheus.io/docs/alerting/latest/configurati - [Receiver](#receiver) - [Grouping](#grouping) - [Matching](#matching) -- [Example Alertmanager Config](#example-alertmanager-config) +- [Example Alertmanager Configs](#example-alertmanager-configs) - [Example Route Config for CIS Scan Alerts](#example-route-config-for-cis-scan-alerts) # Overview @@ -326,7 +326,7 @@ The YAML provided here will be directly appended to your receiver within the Ale {{% /tab %}} {{% tab "Rancher v2.5.0-2.5.3" %}} -The Alertmanager must be configured in YAML, as shown in this [example.](#example-alertmanager-config) +The Alertmanager must be configured in YAML, as shown in these [examples.](#example-alertmanager-configs) {{% /tab %}} {{% /tabs %}} @@ -366,12 +366,13 @@ match_re: {{% /tab %}} {{% tab "Rancher v2.5.0-2.5.3" %}} -The Alertmanager must be configured in YAML, as shown in this [example.](#example-alertmanager-config) +The Alertmanager must be configured in YAML, as shown in these [examples.](#example-alertmanager-configs) {{% /tab %}} {{% /tabs %}} -# Example Alertmanager Config +# Example Alertmanager Configs +### Slack To set up notifications via Slack, the following Alertmanager Config YAML can be placed into the `alertmanager.yaml` key of the Alertmanager Config Secret, where the `api_url` should be updated to use your Webhook URL from Slack: ```yaml @@ -391,6 +392,31 @@ templates: - /etc/alertmanager/config/*.tmpl ``` +### PagerDuty +To set up notifications via PagerDuty, use the example below from the [PagerDuty documentation](https://www.pagerduty.com/docs/guides/prometheus-integration-guide/) as a guideline. This example sets up a route that captures alerts for a database service and sends them to a receiver linked to a service that will directly notify the DBAs in PagerDuty, while all other alerts will be directed to a default receiver with a different PagerDuty integration key. + +The following Alertmanager Config YAML can be placed into the `alertmanager.yaml` key of the Alertmanager Config Secret. The `service_key` should be updated to use your PagerDuty integration key and can be found as per the "Integrating with Global Event Routing" section of the PagerDuty documentation. For the full list of configuration options, refer to the [Prometheus documentation](https://prometheus.io/docs/alerting/latest/configuration/#pagerduty_config). + +```yaml +route: + group_by: [cluster] + receiver: 'pagerduty-notifications' + group_interval: 5m + routes: + - match: + service: database + receiver: 'database-notifcations' + +receivers: +- name: 'pagerduty-notifications' + pagerduty_configs: + - service_key: 'primary-integration-key' + +- name: 'database-notifcations' + pagerduty_configs: + - service_key: 'database-integration-key' +``` + # Example Route Config for CIS Scan Alerts While configuring the routes for `rancher-cis-benchmark` alerts, you can specify the matching using the key-value pair `job: rancher-cis-scan`. From e06f43d23fbc16b6d81d7a78c3151848c445e5b8 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Fri, 14 May 2021 17:02:17 -0700 Subject: [PATCH 02/15] Update Istio uninstall steps --- .../rancher/v2.5/en/istio/disabling-istio/_index.md | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.5/en/istio/disabling-istio/_index.md b/content/rancher/v2.5/en/istio/disabling-istio/_index.md index 3a5930779ff..d0fe6ec9c63 100644 --- a/content/rancher/v2.5/en/istio/disabling-istio/_index.md +++ b/content/rancher/v2.5/en/istio/disabling-istio/_index.md @@ -12,11 +12,18 @@ This section describes how to uninstall Istio in a cluster or disable a namespac To uninstall Istio, 1. From the **Cluster Explorer,** navigate to **Installed Apps** in **Apps & Marketplace** and locate the `rancher-istio` installation. -1. Select all the apps in the `istio-system` namespace and click **Delete**. +1. Select `rancher-istio` in the `istio-system namespace and click **Delete** +1. After `rancher-istio` is deleted, you can then select all the remaining apps in the `istio-system` namespace and click **Delete** **Result:** The `rancher-istio` app in the cluster gets removed. The Istio sidecar cannot be deployed on any workloads in the cluster. -**Note:** You can no longer disable and reenable your Istio installation. If you would like to save your settings for a future install, view and save individual YAMLs to refer back to / reuse for future installations. +**Note:** You can no longer disable and re-enable your Istio installation. If you would like to save your settings for a future install, view and save individual YAMLs to refer back to / reuse for future installations. + +**Troubleshooting Uninstall:** If you didn't follow the uninstall steps, you may encounter a warning during uninstall: + +`Error: uninstallation completed with 1 error(s): unable to build kubernetes objects for delete: unable to recognize "": no matches for kind "MonitoringDashboard" in version "monitoring.kiali.io/v1alpha1"` + +This could mean a few things. You either selected all the apps in the `istio-system` namespace and deleted them at the same time, or you deleted `rancher-istio` chart dependencies prior to deleting the `rancher-istio` chart. Since the uninstall did not complete properly, you will have resources remaining in the `istio-system` namespace that you will need to manually clean up. Another option to avoid manual clean up is to install `rancher-istio` again, then uninstall it in the correct order. # Disable Istio in a Namespace From 05f653f1185cc55c73cd474b95b5f39dceaa85c7 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Mon, 17 May 2021 17:04:39 -0700 Subject: [PATCH 03/15] Update opening ports on newer SUSE linux distros --- .../installation/requirements/ports/_index.md | 23 +++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/content/rancher/v2.5/en/installation/requirements/ports/_index.md b/content/rancher/v2.5/en/installation/requirements/ports/_index.md index 7595afab4c1..ad874040492 100644 --- a/content/rancher/v2.5/en/installation/requirements/ports/_index.md +++ b/content/rancher/v2.5/en/installation/requirements/ports/_index.md @@ -276,6 +276,27 @@ When using the [AWS EC2 node driver]({{}}/rancher/v2.5/en/cluster-provi SUSE Linux may have a firewall that blocks all ports by default. To open the ports needed for adding the host to a custom cluster, +{{% tabs %}} +{{% tab "SLES 15 / openSUSE Leap 15" %}} +1. SSH into the instance. +1. Start YaST in text mode: +``` +sudo yast2 +``` + +1. Navigate to **Security and Users** > **Firewall** > **Zones:public** > **Ports**. To navigate within the interface, follow the instructions [here](https://doc.opensuse.org/documentation/leap/reference/html/book.opensuse.reference/cha-yast-text.html#sec-yast-cli-navigate). +1. To open the required ports, enter them into the **TCP Ports** and **UDP Ports** fields. In this example, ports 9796 and 10250 are also opened for monitoring. The resulting fields should look similar to the following: +```yaml +TCP Ports +22, 80, 443, 2376, 2379, 2380, 6443, 9099, 9796, 10250, 10254, 30000-32767 +UDP Ports +8472, 30000-32767 +``` + +1. When all required ports are enter, select **Accept**. + +{{% /tab %}} +{{% tab "SLES 12 / openSUSE Leap 42" %}} 1. SSH into the instance. 1. Edit /`etc/sysconfig/SuSEfirewall2` and open the required ports. In this example, ports 9796 and 10250 are also opened for monitoring: ``` @@ -287,5 +308,7 @@ SUSE Linux may have a firewall that blocks all ports by default. To open the por ``` SuSEfirewall2 ``` +{{% /tab %}} +{{% /tabs %}} **Result:** The node has the open ports required to be added to a custom cluster. From d4f0454946b0747a1163f11ae59b40d1444ad85f Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Wed, 19 May 2021 21:20:37 +0000 Subject: [PATCH 04/15] Change "is" to "it" --- .../rancher/v2.5/en/deploy-across-clusters/fleet/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md b/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md index 9af4a260e3d..e164ad6c169 100644 --- a/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md +++ b/content/rancher/v2.5/en/deploy-across-clusters/fleet/_index.md @@ -5,7 +5,7 @@ weight: 1 _Available as of Rancher v2.5_ -Fleet is GitOps at scale. Fleet is designed to manage up to a million clusters. It's also lightweight enough that is works great for a [single cluster](https://fleet.rancher.io/single-cluster-install/) too, but it really shines when you get to a [large scale.](https://fleet.rancher.io/multi-cluster-install/) By large scale we mean either a lot of clusters, a lot of deployments, or a lot of teams in a single organization. +Fleet is GitOps at scale. Fleet is designed to manage up to a million clusters. It's also lightweight enough that it works great for a [single cluster](https://fleet.rancher.io/single-cluster-install/) too, but it really shines when you get to a [large scale.](https://fleet.rancher.io/multi-cluster-install/) By large scale we mean either a lot of clusters, a lot of deployments, or a lot of teams in a single organization. Fleet is a separate project from Rancher, and can be installed on any Kubernetes cluster with Helm. @@ -43,4 +43,4 @@ The Fleet Helm charts are available [here.](https://github.com/rancher/fleet/rel ### Documentation -The Fleet documentation is at [https://fleet.rancher.io/.](https://fleet.rancher.io/) \ No newline at end of file +The Fleet documentation is at [https://fleet.rancher.io/.](https://fleet.rancher.io/) From 8ee63f468fe5875baafb69b14e5158a8379183d5 Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Wed, 19 May 2021 16:24:53 -0700 Subject: [PATCH 05/15] Fix meaning of PromQL #3245 --- .../configuration/prometheusrules/_index.md | 4 ++-- .../v2.5/configuration/prometheusrules/_index.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/content/rancher/v2.5/en/monitoring-alerting/configuration/prometheusrules/_index.md b/content/rancher/v2.5/en/monitoring-alerting/configuration/prometheusrules/_index.md index 16a76c10766..eef2549284b 100644 --- a/content/rancher/v2.5/en/monitoring-alerting/configuration/prometheusrules/_index.md +++ b/content/rancher/v2.5/en/monitoring-alerting/configuration/prometheusrules/_index.md @@ -71,7 +71,7 @@ Rancher v2.5.4 introduced the capability to configure PrometheusRules by filling ### Alerting Rules -[Alerting rules](https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/) allow you to define alert conditions based on PromQL (Prometheus expression language) expressions and to send notifications about firing alerts to an external service. +[Alerting rules](https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/) allow you to define alert conditions based on PromQL (Prometheus Query Language) expressions and to send notifications about firing alerts to an external service. | Field | Description | |-------|----------------| @@ -85,7 +85,7 @@ Rancher v2.5.4 introduced the capability to configure PrometheusRules by filling ### Recording Rules -[Recording rules](https://prometheus.io/docs/prometheus/latest/configuration/recording_rules/#recording-rules) allow you to precompute frequently needed or computationally expensive PromQL (Prometheus expression language) expressions and save their result as a new set of time series. +[Recording rules](https://prometheus.io/docs/prometheus/latest/configuration/recording_rules/#recording-rules) allow you to precompute frequently needed or computationally expensive PromQL (Prometheus Query Language) expressions and save their result as a new set of time series. | Field | Description | |-------|----------------| diff --git a/content/rancher/v2.x/en/monitoring-alerting/v2.5/configuration/prometheusrules/_index.md b/content/rancher/v2.x/en/monitoring-alerting/v2.5/configuration/prometheusrules/_index.md index 6e249101c48..e30a3e6dcfd 100644 --- a/content/rancher/v2.x/en/monitoring-alerting/v2.5/configuration/prometheusrules/_index.md +++ b/content/rancher/v2.x/en/monitoring-alerting/v2.5/configuration/prometheusrules/_index.md @@ -69,7 +69,7 @@ Rancher v2.5.4 introduced the capability to configure PrometheusRules by filling ### Alerting Rules -[Alerting rules](https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/) allow you to define alert conditions based on PromQL (Prometheus expression language) expressions and to send notifications about firing alerts to an external service. +[Alerting rules](https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/) allow you to define alert conditions based on PromQL (Prometheus Query Language) expressions and to send notifications about firing alerts to an external service. | Field | Description | |-------|----------------| @@ -83,7 +83,7 @@ Rancher v2.5.4 introduced the capability to configure PrometheusRules by filling ### Recording Rules -[Recording rules](https://prometheus.io/docs/prometheus/latest/configuration/recording_rules/#recording-rules) allow you to precompute frequently needed or computationally expensive PromQL (Prometheus expression language) expressions and save their result as a new set of time series. +[Recording rules](https://prometheus.io/docs/prometheus/latest/configuration/recording_rules/#recording-rules) allow you to precompute frequently needed or computationally expensive PromQL (Prometheus Query Language) expressions and save their result as a new set of time series. | Field | Description | |-------|----------------| From 11139f18c56333e9bc91da567ad8905daffc6852 Mon Sep 17 00:00:00 2001 From: Bastian Hofmann Date: Thu, 20 May 2021 15:49:35 +0200 Subject: [PATCH 06/15] Fix openssl certificate generation command in ADFS docs The CN must be a hostname without a protocol. With the protocol the command even fails because of the missing escaping of the forward slashes: openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj '/CN=https://myservice.example.com' Generating a 2048 bit RSA private key ..+++ ...........................+++ writing new private key to 'myservice.key' ----- end of string encountered while processing type of subject name element #1 problems making Certificate Request Signed-off-by: Bastian Hofmann --- .../microsoft-adfs/rancher-adfs-setup/_index.md | 4 ++-- .../microsoft-adfs/rancher-adfs-setup/_index.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/content/rancher/v2.5/en/admin-settings/authentication/microsoft-adfs/rancher-adfs-setup/_index.md b/content/rancher/v2.5/en/admin-settings/authentication/microsoft-adfs/rancher-adfs-setup/_index.md index b4f8655e59e..0f36d2631dd 100644 --- a/content/rancher/v2.5/en/admin-settings/authentication/microsoft-adfs/rancher-adfs-setup/_index.md +++ b/content/rancher/v2.5/en/admin-settings/authentication/microsoft-adfs/rancher-adfs-setup/_index.md @@ -51,5 +51,5 @@ After you complete [Configuring Microsoft AD FS for Rancher]({{}}/ranch **Tip:** You can generate a certificate using an openssl command. For example: ``` -openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=https://myservice.example.com" -``` \ No newline at end of file +openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com" +``` diff --git a/content/rancher/v2.x/en/admin-settings/authentication/microsoft-adfs/rancher-adfs-setup/_index.md b/content/rancher/v2.x/en/admin-settings/authentication/microsoft-adfs/rancher-adfs-setup/_index.md index 6dc6fe240df..4a9d9e6b03f 100644 --- a/content/rancher/v2.x/en/admin-settings/authentication/microsoft-adfs/rancher-adfs-setup/_index.md +++ b/content/rancher/v2.x/en/admin-settings/authentication/microsoft-adfs/rancher-adfs-setup/_index.md @@ -52,5 +52,5 @@ After you complete [Configuring Microsoft AD FS for Rancher]({{}}/ranch **Tip:** You can generate a certificate using an openssl command. For example: ``` -openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=https://myservice.example.com" +openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com" ``` From d0e7f18f236da56a5b232a4278a7035155ad2cee Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Thu, 20 May 2021 10:41:43 -0700 Subject: [PATCH 07/15] Fix YAML indentation for example for Istio and RKE2 --- .../configuration-reference/rke2/_index.md | 18 +++++++++--------- .../configuration-reference/rke2/_index.md | 18 +++++++++--------- 2 files changed, 18 insertions(+), 18 deletions(-) diff --git a/content/rancher/v2.5/en/istio/configuration-reference/rke2/_index.md b/content/rancher/v2.5/en/istio/configuration-reference/rke2/_index.md index c06e83a2e0e..ae4e1718794 100644 --- a/content/rancher/v2.5/en/istio/configuration-reference/rke2/_index.md +++ b/content/rancher/v2.5/en/istio/configuration-reference/rke2/_index.md @@ -15,18 +15,18 @@ Through the **Cluster Explorer,** when installing or upgrading Istio through **A apiVersion: install.istio.io/v1alpha1 kind: IstioOperator spec: - components: - cni: - enabled: true - values: + components: cni: - image: rancher/istio-install-cni:1.7.3 - excludeNamespaces: + enabled: true + values: + cni: + image: rancher/istio-install-cni:1.7.3 + excludeNamespaces: - istio-system - kube-system - logLevel: info - cniBinDir: /opt/cni/bin - cniConfDir: /etc/cni/net.d + logLevel: info + cniBinDir: /opt/cni/bin + cniConfDir: /etc/cni/net.d ``` 1. After installing Istio, you'll notice the cni-node pods in the istio-system namespace in a CrashLoopBackoff error. Manually edit the `istio-cni-node` daemonset to include the following on the `install-cni` container: ```yaml diff --git a/content/rancher/v2.x/en/istio/v2.5/configuration-reference/rke2/_index.md b/content/rancher/v2.x/en/istio/v2.5/configuration-reference/rke2/_index.md index 9260c2ec4da..7f6bab7fb00 100644 --- a/content/rancher/v2.x/en/istio/v2.5/configuration-reference/rke2/_index.md +++ b/content/rancher/v2.x/en/istio/v2.5/configuration-reference/rke2/_index.md @@ -13,18 +13,18 @@ Through the **Cluster Explorer,** when installing or upgrading Istio through **A apiVersion: install.istio.io/v1alpha1 kind: IstioOperator spec: - components: - cni: - enabled: true - values: + components: cni: - image: rancher/istio-install-cni:1.7.3 - excludeNamespaces: + enabled: true + values: + cni: + image: rancher/istio-install-cni:1.7.3 + excludeNamespaces: - istio-system - kube-system - logLevel: info - cniBinDir: /opt/cni/bin - cniConfDir: /etc/cni/net.d + logLevel: info + cniBinDir: /opt/cni/bin + cniConfDir: /etc/cni/net.d ``` 1. After installing Istio, you'll notice the cni-node pods in the istio-system namespace in a CrashLoopBackoff error. Manually edit the `istio-cni-node` daemonset to include the following on the `install-cni` container: ```yaml From d341f2e9c21788c1b87db44d8791431a37dfa12e Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Thu, 20 May 2021 11:54:23 -0700 Subject: [PATCH 08/15] Clarify that the S3 backup secret's namespace can be configured #3054 --- content/rancher/v2.5/en/backups/back-up-rancher/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.5/en/backups/back-up-rancher/_index.md b/content/rancher/v2.5/en/backups/back-up-rancher/_index.md index 661bbfbb13a..dee7c261fd1 100644 --- a/content/rancher/v2.5/en/backups/back-up-rancher/_index.md +++ b/content/rancher/v2.5/en/backups/back-up-rancher/_index.md @@ -32,7 +32,7 @@ To perform a backup, a custom resource of type Backup must be created. 1. Click **Backup.** 1. Create the Backup with the form, or with the YAML editor. 1. For configuring the Backup details using the form, click **Create** and refer to the [configuration reference](../configuration/backup-config) and to the [examples.](../examples/#backup) -1. For using the YAML editor, we can click **Create > Create from YAML.** Enter the Backup YAML. This example Backup custom resource would create encrypted recurring backups in S3: +1. For using the YAML editor, we can click **Create > Create from YAML.** Enter the Backup YAML. This example Backup custom resource would create encrypted recurring backups in S3. The app uses the `credentialSecretNamespace` value to determine where to look for the S3 backup secret: ```yaml apiVersion: resources.cattle.io/v1 From edc3b2a1ce9c3ce135b4554b07dda29c4c159bef Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Thu, 20 May 2021 11:56:44 -0700 Subject: [PATCH 09/15] Clarify that credential secret dropdown includes secrets from all namespaces #3054 --- .../v2.5/en/backups/configuration/backup-config/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.5/en/backups/configuration/backup-config/_index.md b/content/rancher/v2.5/en/backups/configuration/backup-config/_index.md index 8bce4417a53..5ad25999879 100644 --- a/content/rancher/v2.5/en/backups/configuration/backup-config/_index.md +++ b/content/rancher/v2.5/en/backups/configuration/backup-config/_index.md @@ -85,7 +85,7 @@ Selecting the first option stores this backup in the storage location configured The S3 storage location contains the following configuration fields: -1. **Credential Secret** (optional): If you need to use the AWS Access keys Secret keys to access s3 bucket, create a secret with your credentials with keys and the directives `accessKey` and `secretKey`. It can be in any namespace. An example secret is [here.](#example-credentialsecret) This directive is unnecessary if the nodes running your operator are in EC2 and set up with IAM permissions that allow them to access S3, as described in [this section.](#iam-permissions-for-ec2-nodes-to-access-s3) +1. **Credential Secret** (optional): If you need to use the AWS Access keys Secret keys to access s3 bucket, create a secret with your credentials with keys and the directives `accessKey` and `secretKey`. It can be in any namespace. An example secret is [here.](#example-credentialsecret) This directive is unnecessary if the nodes running your operator are in EC2 and set up with IAM permissions that allow them to access S3, as described in [this section.](#iam-permissions-for-ec2-nodes-to-access-s3) The Credential Secret dropdown lists the secrets in all namespaces. 1. **Bucket Name**: The name of the S3 bucket where backup files will be stored. 1. **Region** (optional): The AWS [region](https://aws.amazon.com/about-aws/global-infrastructure/regions_az/) where the S3 bucket is located. This field isn't needed for configuring MinIO. 1. **Folder** (optional): The name of the folder in the S3 bucket where backup files will be stored. From 465bb4686e579ffd25c8e316e74b117e17706c1c Mon Sep 17 00:00:00 2001 From: Farzad Majidfayyaz Date: Fri, 21 May 2021 07:59:34 -0400 Subject: [PATCH 10/15] Fix the header so that the link works --- content/k3s/latest/en/installation/install-options/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/k3s/latest/en/installation/install-options/_index.md b/content/k3s/latest/en/installation/install-options/_index.md index efab7e77072..ff08d9dd563 100644 --- a/content/k3s/latest/en/installation/install-options/_index.md +++ b/content/k3s/latest/en/installation/install-options/_index.md @@ -53,7 +53,7 @@ Setting `K3S_URL` without explicitly setting an exec command will default the co When running the agent `K3S_TOKEN` must also be set. -# Installing K3s from the Binary +### Options for installation from binary As stated, the installation script is primarily concerned with configuring K3s to run as a service. If you choose to not use the script, you can run K3s simply by downloading the binary from our [release page](https://github.com/rancher/k3s/releases/latest), placing it on your path, and executing it. The K3s binary supports the following commands: From 812dd849abe95396dbb0b9be465ddabfe4fe8b89 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Steenis Date: Tue, 25 May 2021 13:39:38 +0200 Subject: [PATCH 11/15] Refer to upstream for CNI requirements --- content/rke/latest/en/os/_index.md | 66 ++++-------------------------- 1 file changed, 7 insertions(+), 59 deletions(-) diff --git a/content/rke/latest/en/os/_index.md b/content/rke/latest/en/os/_index.md index 90882ed3340..843d66304e5 100644 --- a/content/rke/latest/en/os/_index.md +++ b/content/rke/latest/en/os/_index.md @@ -52,54 +52,13 @@ RKE runs on almost any Linux OS with Docker installed. For details on which OS a - Swap should be disabled on any worker nodes -- Following kernel modules should be present. This can be checked using: - * `modprobe module_name` - * `lsmod | grep module_name` - * `grep module_name /lib/modules/$(uname -r)/modules.builtin`, if it's a built-in module - * The following bash script +- Please check the network plugin documentation for any additional requirements (for example, kernel modules) + - [Calico](https://docs.projectcalico.org/getting-started/kubernetes/requirements#kernel-dependencies) + - [Flannel](https://github.com/flannel-io/flannel/tree/master/Documentation) + - Canal (Combination Calico and Flannel) + - [Weave](https://www.weave.works/docs/net/latest/install/installing-weave/) -```bash - for module in br_netfilter ip6_udp_tunnel ip_set ip_set_hash_ip ip_set_hash_net iptable_filter iptable_nat iptable_mangle iptable_raw nf_conntrack_netlink nf_conntrack nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat nf_nat_ipv4 nf_nat_masquerade_ipv4 nfnetlink udp_tunnel veth vxlan x_tables xt_addrtype xt_conntrack xt_comment xt_mark xt_multiport xt_nat xt_recent xt_set xt_statistic xt_tcpudp; - do - if ! lsmod | grep -q $module; then - echo "module $module is not present"; - fi; - done -``` - -Module name | -------------| -br_netfilter | -ip6_udp_tunnel | -ip_set | -ip_set_hash_ip | -ip_set_hash_net | -iptable_filter | -iptable_nat | -iptable_mangle | -iptable_raw | -nf_conntrack_netlink | -nf_conntrack | -nf_conntrack_ipv4 | -nf_defrag_ipv4 | -nf_nat | -nf_nat_ipv4 | -nf_nat_masquerade_ipv4 | -nfnetlink | -udp_tunnel | -veth | -vxlan | -x_tables | -xt_addrtype | -xt_conntrack | -xt_comment | -xt_mark | -xt_multiport | -xt_nat | -xt_recent | -xt_set | -xt_statistic | -xt_tcpudp | +> **Note:** If you or your cloud provider are using a custom minimal kernel, some required (network) kernel modules might not be present. - Following sysctl settings must be applied @@ -309,23 +268,12 @@ Each Kubernetes version supports different Docker versions. The Kubernetes relea ### Installing Docker -You can either follow the [Docker installation](https://docs.docker.com/install/) instructions or use one of Rancher's [install scripts](https://github.com/rancher/install-docker) to install Docker. For RHEL, please see [How to install Docker on Red Hat Enterprise Linux 7](https://access.redhat.com/solutions/3727511). - -Docker Version | Install Script | -----------|------------------ -18.09.2 | curl https://releases.rancher.com/install-docker/18.09.2.sh | sh | -18.06.2 | curl https://releases.rancher.com/install-docker/18.06.2.sh | sh | -17.03.2 | curl https://releases.rancher.com/install-docker/17.03.2.sh | sh | +Refer to [Installing Docker]({{}}/rancher/v2.5/en/installation/requirements/installing-docker/) ### Checking the Installed Docker Version Confirm that a Kubernetes supported version of Docker is installed on your machine, by running `docker version --format '{{.Server.Version}}'`. -``` -docker version --format '{{.Server.Version}}' -17.03.2-ce -``` - ## Ports {{< ports-rke-nodes >}} {{< requirements_ports_rke >}} From 7c5b064477693beada52dc3fd94b69e84f854878 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Steenis Date: Tue, 25 May 2021 14:57:53 +0200 Subject: [PATCH 12/15] Add more examples to RKE example YAML --- content/rke/latest/en/example-yamls/_index.md | 149 +++++++++++++++++- 1 file changed, 142 insertions(+), 7 deletions(-) diff --git a/content/rke/latest/en/example-yamls/_index.md b/content/rke/latest/en/example-yamls/_index.md index 989623a7f01..639935e2569 100644 --- a/content/rke/latest/en/example-yamls/_index.md +++ b/content/rke/latest/en/example-yamls/_index.md @@ -30,16 +30,20 @@ nodes: role: - controlplane - etcd - ssh_key_path: /home/user/.ssh/id_rsa port: 2222 + docker_socket: /var/run/docker.sock - address: 2.2.2.2 user: ubuntu role: - worker + ssh_key_path: /home/user/.ssh/id_rsa ssh_key: |- -----BEGIN RSA PRIVATE KEY----- -----END RSA PRIVATE KEY----- + ssh_cert_path: /home/user/.ssh/test-key-cert.pub + ssh_cert: |- + ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3Bl.... - address: example.com user: ubuntu role: @@ -48,6 +52,10 @@ nodes: internal_address: 192.168.1.6 labels: app: ingress + taints: + - key: test-key + value: test-value + effect: NoSchedule # If set to true, RKE will not fail when unsupported Docker version # are found @@ -132,6 +140,9 @@ system_images: services: etcd: + # Custom uid/guid for etcd directory and files + uid: 52034 + gid: 52034 # if external etcd is used # path: /etcdcluster # external_urls: @@ -159,6 +170,60 @@ services: # Expose a different port range for NodePort services service_node_port_range: 30000-32767 pod_security_policy: false + # Encrypt secret data at Rest + # Available as of v0.3.1 + secrets_encryption_config: + enabled: true + custom_config: + apiVersion: apiserver.config.k8s.io/v1 + kind: EncryptionConfiguration + resources: + - resources: + - secrets + providers: + - aescbc: + keys: + - name: k-fw5hn + secret: RTczRjFDODMwQzAyMDVBREU4NDJBMUZFNDhCNzM5N0I= + - identity: {} + # Enable audit logging + # Available as of v1.0.0 + audit_log: + enabled: true + configuration: + max_age: 6 + max_backup: 6 + max_size: 110 + path: /var/log/kube-audit/audit-log.json + format: json + policy: + apiVersion: audit.k8s.io/v1 # This is required. + kind: Policy + omitStages: + - "RequestReceived" + rules: + # Log pod changes at RequestResponse level + - level: RequestResponse + resources: + - group: "" + # Resource "pods" doesn't match requests to any subresource of pods, + # which is consistent with the RBAC policy. + resources: ["pods"] + # Using the EventRateLimit admission control enforces a limit on the number of events + # that the API Server will accept in a given time period + # Available as of v1.0.0 + event_rate_limit: + enabled: true + configuration: + apiVersion: eventratelimit.admission.k8s.io/v1alpha1 + kind: Configuration + limits: + - type: Server + qps: 6000 + burst: 30000 + # Enable AlwaysPullImages Admission controller plugin + # Available as of v0.2.0 + always_pull_images: false # Add additional arguments to the kubernetes API server # This WILL OVERRIDE any existing defaults extra_args: @@ -178,6 +243,13 @@ services: # IP range for any services created on Kubernetes # This must match the service_cluster_ip_range in kube-api service_cluster_ip_range: 10.43.0.0/16 + # Add additional arguments to the kubernetes API server + # This WILL OVERRIDE any existing defaults + extra_args: + # Set the level of log output to debug-level + v: 4 + # Enable RotateKubeletServerCertificate feature gate + feature-gates: RotateKubeletServerCertificate=true kubelet: # Base domain for the cluster cluster_domain: cluster.local @@ -185,15 +257,28 @@ services: cluster_dns_server: 10.43.0.10 # Fail if swap is on fail_swap_on: false + # Configure pod-infra-container-image argument + pod-infra-container-image: "k8s.gcr.io/pause:3.2" # Generate a certificate signed by the kube-ca Certificate Authority # for the kubelet to use as a server certificate + # Available as of v1.0.0 generate_serving_certificate: true - # Set max pods to 250 instead of default 110 extra_args: + # Set max pods to 250 instead of default 110 max-pods: 250 + # Enable RotateKubeletServerCertificate feature gate + feature-gates: RotateKubeletServerCertificate=true # Optionally define additional volume binds to a service extra_binds: - "/usr/libexec/kubernetes/kubelet-plugins:/usr/libexec/kubernetes/kubelet-plugins" + scheduler: + extra_args: + # Set the level of log output to debug-level + v: 4 + kubeproxy: + extra_args: + # Set the level of log output to debug-level + v: 4 # Currently, only authentication strategy supported is x509. # You can optionally create additional SANs (hostnames or IPs) to @@ -223,19 +308,69 @@ addon_job_timeout: 30 # Specify network plugin-in (canal, calico, flannel, weave, or none) network: - plugin: canal + plugin: canal + # Specify MTU + mtu: 1400 + options: + # Configure interface to use for Canal + canal_iface: eth1 + canal_flannel_backend_type: vxlan + # Available as of v1.2.6 + canal_autoscaler_priority_class_name: system-cluster-critical + canal_priority_class_name: system-cluster-critical + # Available as of v1.2.4 + tolerations: + - key: "node.kubernetes.io/unreachable" + operator: "Exists" + effect: "NoExecute" + tolerationseconds: 300 + - key: "node.kubernetes.io/not-ready" + operator: "Exists" + effect: "NoExecute" + tolerationseconds: 300 + # Available as of v1.1.0 + update_strategy: + strategy: RollingUpdate + rollingUpdate: + maxUnavailable: 6 # Specify DNS provider (coredns or kube-dns) dns: - provider: coredns + provider: coredns + # Available as of v1.1.0 + update_strategy: + strategy: RollingUpdate + rollingUpdate: + maxUnavailable: 20% + maxSurge: 15% + linear_autoscaler_params: + cores_per_replica: 0.34 + nodes_per_replica: 4 + prevent_single_point_failure: true + min: 2 + max: 3 + +# Specify monitoring provider (metrics-server) +monitoring: + provider: metrics-server + # Available as of v1.1.0 + update_strategy: + strategy: RollingUpdate + rollingUpdate: + maxUnavailable: 8 # Currently only nginx ingress provider is supported. # To disable ingress controller, set `provider: none` # `node_selector` controls ingress placement and is optional ingress: - provider: nginx - node_selector: - app: ingress + provider: nginx + node_selector: + app: ingress + # Available as of v1.1.0 + update_strategy: + strategy: RollingUpdate + rollingUpdate: + maxUnavailable: 5 # All add-on manifests MUST specify a namespace addons: |- From c9ec8e15395a4cfeb5f3c75f9f7078f89ed8088a Mon Sep 17 00:00:00 2001 From: MonzElmasry Date: Tue, 25 May 2021 00:10:44 +0200 Subject: [PATCH 13/15] add rke2 cis-1.6 docs --- content/rancher/v2.5/en/security/rancher-2.5/_index.md | 5 +++-- content/rancher/v2.x/en/security/rancher-2.5/_index.md | 3 ++- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/content/rancher/v2.5/en/security/rancher-2.5/_index.md b/content/rancher/v2.5/en/security/rancher-2.5/_index.md index 1cc1abf1372..299b1ba66c0 100644 --- a/content/rancher/v2.5/en/security/rancher-2.5/_index.md +++ b/content/rancher/v2.5/en/security/rancher-2.5/_index.md @@ -38,7 +38,8 @@ Kubernetes v1.18+ | CIS v1.6 | [Link](./1.6-benchmark-2.5) | [Link](./1.6-harden Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guides ---|---|---|--- -Kubernetes v1.18 | CIS v1.5 | [Link](https://docs.rke2.io/security/cis_self_assessment/) | [Link](https://docs.rke2.io/security/hardening_guide/) +Kubernetes v1.18 | CIS v1.5 | [Link](https://docs.rke2.io/security/cis_self_assessment15/) | [Link](https://docs.rke2.io/security/hardening_guide/) +Kubernetes v1.20 | CIS v1.6 | [Link](https://docs.rke2.io/security/cis_self_assessment16/) | [Link](https://docs.rke2.io/security/hardening_guide/) ### K3s Guides @@ -53,4 +54,4 @@ _Available as of v2.5.8_ [Security-Enhanced Linux (SELinux)](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) is a security enhancement to Linux. After being historically used by government agencies, SELinux is now industry standard and is enabled by default on CentOS 7 and 8. -To use Rancher with SELinux, we recommend installing the `rancher-selinux` RPM according to the instructions on [this page.]({{}}/rancher/v2.5/en/security/selinux/#installing-the-rancher-selinux-rpm) \ No newline at end of file +To use Rancher with SELinux, we recommend installing the `rancher-selinux` RPM according to the instructions on [this page.]({{}}/rancher/v2.5/en/security/selinux/#installing-the-rancher-selinux-rpm) diff --git a/content/rancher/v2.x/en/security/rancher-2.5/_index.md b/content/rancher/v2.x/en/security/rancher-2.5/_index.md index 8cff4bc6ec7..afff1ac7d2d 100644 --- a/content/rancher/v2.x/en/security/rancher-2.5/_index.md +++ b/content/rancher/v2.x/en/security/rancher-2.5/_index.md @@ -28,7 +28,8 @@ Kubernetes v1.18+ | CIS v1.6 | [Link](./1.6-benchmark-2.5) | [Link](./1.6-harden Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guides ---|---|---|--- -Kubernetes v1.18 | CIS v1.5 | [Link](https://docs.rke2.io/security/cis_self_assessment/) | [Link](https://docs.rke2.io/security/hardening_guide/) +Kubernetes v1.18 | CIS v1.5 | [Link](https://docs.rke2.io/security/cis_self_assessment15/) | [Link](https://docs.rke2.io/security/hardening_guide/) +Kubernetes v1.20 | CIS v1.6 | [Link](https://docs.rke2.io/security/cis_self_assessment16/) | [Link](https://docs.rke2.io/security/hardening_guide/) ### K3s Guides From 36b6baa1a6c48b6744dcca9c0dd011f4c5c41edc Mon Sep 17 00:00:00 2001 From: dkeightley <20566450+dkeightley@users.noreply.github.com> Date: Wed, 26 May 2021 12:23:12 +1200 Subject: [PATCH 14/15] Update snapshot to false for RKE cluster.yml example --- .../v2.x/en/security/rancher-2.5/1.6-hardening-2.5/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/security/rancher-2.5/1.6-hardening-2.5/_index.md b/content/rancher/v2.x/en/security/rancher-2.5/1.6-hardening-2.5/_index.md index 47a9efadf26..c49eb6a1d40 100644 --- a/content/rancher/v2.x/en/security/rancher-2.5/1.6-hardening-2.5/_index.md +++ b/content/rancher/v2.x/en/security/rancher-2.5/1.6-hardening-2.5/_index.md @@ -181,7 +181,7 @@ services: path: "" uid: 52034 gid: 52034 - snapshot: true + snapshot: false retention: "" creation: "" backup_config: null From f427dada8df1545950b2794682eb6dc12f525fce Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Wed, 26 May 2021 11:12:58 -0700 Subject: [PATCH 15/15] Update snapshot to false for RKE cluster.yml example in versioned docs --- .../v2.5/en/security/rancher-2.5/1.6-hardening-2.5/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.5/en/security/rancher-2.5/1.6-hardening-2.5/_index.md b/content/rancher/v2.5/en/security/rancher-2.5/1.6-hardening-2.5/_index.md index 6d20521a94d..59588fa422c 100644 --- a/content/rancher/v2.5/en/security/rancher-2.5/1.6-hardening-2.5/_index.md +++ b/content/rancher/v2.5/en/security/rancher-2.5/1.6-hardening-2.5/_index.md @@ -180,7 +180,7 @@ services: path: "" uid: 52034 gid: 52034 - snapshot: true + snapshot: false retention: "" creation: "" backup_config: null