mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-14 13:04:31 +00:00
Merge pull request #678 from rancher/release/v2.7.5
Merge release/v2.7.5 to main
This commit is contained in:
Billy Tat
@@ -20,3 +20,6 @@ yarn-debug.log*
|
||||
yarn-error.log*
|
||||
|
||||
.idea/
|
||||
|
||||
/dev-resources/algolia-search/.env
|
||||
/dev-resources/algolia-search/algolia-index.sh
|
||||
+10
-4
@@ -154,7 +154,7 @@ helm upgrade --install \
|
||||
--namespace ingress-nginx \
|
||||
--set controller.service.type=LoadBalancer \
|
||||
--version 4.0.18 \
|
||||
--create-namespace
|
||||
--create-namespace
|
||||
```
|
||||
|
||||
## 8. Get the Load Balancer IP
|
||||
@@ -188,12 +188,18 @@ Next, install the Rancher Helm chart by following the instructions on [this page
|
||||
|
||||
Use the DNS name from the previous step as the Rancher server URL when you install Rancher. It can be passed in as a Helm option. For example, if the DNS name is `rancher.my.org`, you could run the Helm installation command with the option `--set hostname=rancher.my.org`.
|
||||
|
||||
**_New in v2.6.7_**
|
||||
|
||||
When installing Rancher on top of this setup, you will also need to pass the value below into the Rancher Helm install command in order to set the name of the ingress controller to be used with Rancher's ingress resource:
|
||||
When installing Rancher on top of this setup, you will also need to set the name of the ingress controller to be used with Rancher's ingress resource:
|
||||
|
||||
```
|
||||
--set ingress.ingressClassName=nginx
|
||||
```
|
||||
|
||||
Refer [here for the Helm install command](../../../pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md#5-install-rancher-with-helm-and-your-chosen-certificate-option) for your chosen certificate option.
|
||||
|
||||
In Rancher v2.7.5, if you intend to use the default GKE ingress on your cluster without enabling VPC-native cluster mode, you need to set the following flag:
|
||||
|
||||
```
|
||||
--set service.type=NodePort
|
||||
```
|
||||
|
||||
This is necessary because of compatibility issues between this setup and ClusterIP, the default type for `cattle-system/rancher`.
|
||||
+2
-2
@@ -140,7 +140,7 @@ Upgrade Rancher to the latest version with all your settings.
|
||||
|
||||
Take all the values from the previous step and append them to the command using `--set key=value`.
|
||||
|
||||
For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false`.
|
||||
For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false` when using Rancher v2.7.2-v2.7.4. This is not necessary for Rancher v2.7.5 and above, but you can still manually set the option if you choose.
|
||||
|
||||
```
|
||||
helm upgrade rancher rancher-<CHART_REPO>/rancher \
|
||||
@@ -162,7 +162,7 @@ Alternatively, it's possible to export the current values to a file and referenc
|
||||
```
|
||||
1. Update only the Rancher version:
|
||||
|
||||
For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false`.
|
||||
For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false` when using Rancher v2.7.2-v2.7.4. This is not necessary for Rancher v2.7.5 and above, but you can still manually set the option if you choose.
|
||||
|
||||
```
|
||||
helm upgrade rancher rancher-<CHART_REPO>/rancher \
|
||||
|
||||
+1
-1
@@ -62,7 +62,7 @@ For information on enabling experimental features, refer to [this page.](../../.
|
||||
| `systemDefaultRegistry` | "" | `string` - private registry to be used for all system container images, e.g., http://registry.example.com/ |
|
||||
| `tls` | "ingress" | `string` - See [External TLS Termination](#external-tls-termination) for details. - "ingress, external" |
|
||||
| `useBundledSystemChart` | `false` | `bool` - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations. |
|
||||
| `global.cattle.psp.enabled` | `true` | `bool` - select 'false' to disable PSP for RKE/RKE2 (K8s) versions `v1.25` and higher. |
|
||||
| `global.cattle.psp.enabled` | `true` | `bool` - select 'false' to disable PSPs for Kubernetes v1.25 and above when using Rancher v2.7.2-v2.7.4. When using Rancher v2.7.5 and above, Rancher attempts to detect if a cluster is running a Kubernetes version where PSPs are not supported, and will default it's usage of PSPs to false if it can determine that PSPs are not supported in the cluster. Users can still manually override this by explicitly providing `true` or `false` for this value. Rancher will still use PSPs by default in clusters which support PSPs (such as clusters running Kubernetes v1.24 or lower).|
|
||||
|
||||
|
||||
### Bootstrap Password
|
||||
|
||||
+2
-2
@@ -177,7 +177,7 @@ kubectl create namespace cattle-system
|
||||
|
||||
Next, install Rancher, declaring your chosen options. Use the reference table below to replace each placeholder. Rancher needs to be configured to use the private registry in order to provision any Rancher launched Kubernetes clusters or Rancher tools.
|
||||
|
||||
For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false`.
|
||||
For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false` when using Rancher v2.7.2-v2.7.4. This is not necessary for Rancher v2.7.5 and above, but you can still manually set the option if you choose.
|
||||
|
||||
Placeholder | Description
|
||||
------------|-------------
|
||||
@@ -208,7 +208,7 @@ Create Kubernetes secrets from your own certificates for Rancher to use. The com
|
||||
|
||||
Install Rancher, declaring your chosen options. Use the reference table below to replace each placeholder. Rancher needs to be configured to use the private registry in order to provision any Rancher launched Kubernetes clusters or Rancher tools.
|
||||
|
||||
For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false`.
|
||||
For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false` when using Rancher v2.7.2-v2.7.4. This is not necessary for Rancher v2.7.5 and above, but you can still manually set the option if you choose.
|
||||
|
||||
| Placeholder | Description |
|
||||
| -------------------------------- | ----------------------------------------------- |
|
||||
|
||||
@@ -130,7 +130,7 @@ The final command to install Rancher is below. The command requires a domain nam
|
||||
|
||||
To install a specific Rancher version, use the `--version` flag (e.g., `--version 2.6.6`). Otherwise, the latest Rancher is installed by default. Refer to [Choosing a Rancher Version](../../installation-and-upgrade/resources/choose-a-rancher-version.md).
|
||||
|
||||
For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false`.
|
||||
For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false` when using Rancher v2.7.2-v2.7.4. This is not necessary for Rancher v2.7.5 and above, but you can still manually set the option if you choose.
|
||||
|
||||
Note the password requires a minimum of 12 characters.
|
||||
|
||||
|
||||
+42
-3
@@ -24,10 +24,12 @@ Setting | Value
|
||||
|
||||
## Configuring Okta in Rancher
|
||||
|
||||
1. In the top left corner, click **☰ > Users & Authentication**.
|
||||
You can integrate Okta with Rancher, so that authenticated users can access Rancher resources through their group permissions. Okta returns a SAML assertion that authenticates a user, including which groups a user belongs to.
|
||||
|
||||
1. In the top left corner, click **☰ > Users & Authentication**.
|
||||
1. In the left navigation menu, click **Auth Provider**.
|
||||
1. Click **Okta**.
|
||||
1. Complete the **Configure Okta Account** form. The examples below describe how you can map Okta attributes from attribute statements to fields within Rancher.
|
||||
1. Complete the **Configure Okta Account** form. The examples below describe how you can map Okta attributes from attribute statements to fields within Rancher.
|
||||
|
||||
| Field | Description |
|
||||
| ------------------------- | ----------------------------------------------------------------------------- |
|
||||
@@ -64,9 +66,46 @@ Setting | Value
|
||||
|
||||
:::note SAML Provider Caveats:
|
||||
|
||||
- SAML Protocol does not support search or lookup for users or groups. Therefore, there is no validation on users or groups when adding them to Rancher.
|
||||
If you configure Okta without OpenLDAP, you won't be able to search for or directly lookup users or groups. This brings several caveats:
|
||||
|
||||
- Users and groups aren't validated when you assign permissions to them in Rancher.
|
||||
- When adding users, the exact user IDs (i.e. `UID Field`) must be entered correctly. As you type the user ID, there will be no search for other user IDs that may match.
|
||||
- When adding groups, you must select the group from the drop-down that is next to the text box. Rancher assumes that any input from the text box is a user.
|
||||
- The group drop-down shows only the groups that you are a member of. You will not be able to add groups that you are not a member of.
|
||||
|
||||
:::
|
||||
|
||||
## Okta with OpenLDAP search
|
||||
|
||||
You can add an OpenLDAP backend to assist with user and group search. Rancher will display additional users and groups from the OpenLDAP service. This allows assigning permissions to groups that the logged-in user is not already a member of.
|
||||
|
||||
### OpenLDAP Prerequisites
|
||||
|
||||
If you use Okta as your IdP, you can [set up an LDAP interface](https://help.okta.com/en-us/Content/Topics/Directory/LDAP-interface-main.htm) for Rancher to use. You can also configure an external OpenLDAP server.
|
||||
|
||||
You must configure Rancher with a LDAP bind account (aka service account) so that you can search and retrieve LDAP entries for users and groups that should have access. Don't use an administrator account or personal account as an LDAP bind account. [Create](https://help.okta.com/en-us/Content/Topics/users-groups-profiles/usgp-add-users.htm) a dedicated account in OpenLDAP, with read-only access to users and groups under the configured searchbase.
|
||||
|
||||
:::warning Security Considerations
|
||||
|
||||
The OpenLDAP service account is used for all searches. Rancher users will see users and groups that the OpenLDAP service account can view, regardless of their individual SAML permissions.
|
||||
|
||||
:::
|
||||
|
||||
|
||||
> **Using TLS?**
|
||||
>
|
||||
> If the certificate used by the OpenLDAP server is self-signed or from an unrecognized certificate authority, Rancher needs the CA certificate (concatenated with any intermediate certificates) in PEM format. Provide this certificate during the configuration so that Rancher can validate the certificate chain.
|
||||
|
||||
### Configure OpenLDAP in Rancher
|
||||
|
||||
[Configure the settings](../configure-openldap/openldap-config-reference.md) for the OpenLDAP server, groups and users. Note that nested group membership isn't available.
|
||||
|
||||
> Before you proceed with the configuration, please familiarise yourself with [external authentication configuration and principal users](../../../../pages-for-subheaders/authentication-config.md#external-authentication-configuration-and-principal-users).
|
||||
|
||||
1. Sign into Rancher using a local user assigned the [administrator](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions) role (i.e., the _local principal_).
|
||||
1. In the top left corner, click **☰ > Users & Authentication**.
|
||||
1. In the left navigation menu, click **Auth Provider**.
|
||||
1. Click **Okta** or, if SAML is already configured, **Edit Config**
|
||||
1. Under **User and Group Search**, check **Configure an OpenLDAP server**
|
||||
|
||||
If you experience issues when you test the connection to the OpenLDAP server, ensure that you entered the credentials for the service account and configured the search base correctly. Inspecting the Rancher logs can help pinpoint the root cause. Debug logs may contain more detailed information about the error. Please refer to [How can I enable debug logging](../../../../faq/technical-items.md#how-can-i-enable-debug-logging) for more information.
|
||||
|
||||
+1
-1
@@ -158,7 +158,7 @@ Follow the steps to [install cert-manager](../../../pages-for-subheaders/install
|
||||
|
||||
Use the same version of Helm to install Rancher, that was used on the first cluster.
|
||||
|
||||
For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false`.
|
||||
For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false` when using Rancher v2.7.2-v2.7.4. This is not necessary for Rancher v2.7.5 and above, but you can still manually set the option if you choose.
|
||||
|
||||
```bash
|
||||
helm install rancher rancher-latest/rancher \
|
||||
|
||||
+9
@@ -2,6 +2,10 @@
|
||||
title: Installing the Adapter
|
||||
---
|
||||
|
||||
<head>
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/integrations-in-rancher/cloud-marketplace/aws-cloud-marketplace/install-adapter"/>
|
||||
</head>
|
||||
|
||||
> **Important:** If you are attempting to re-install the adapter, you may experience errant out-of-compliance messages for up to an hour.
|
||||
|
||||
### Rancher vs. Adapter Compatibility Matrix
|
||||
@@ -16,6 +20,11 @@ In order to deploy and run the adapter successfully, you need to ensure its vers
|
||||
| Rancher Version | Adapter Version |
|
||||
|-----------------|:---------------:|
|
||||
| v2.7.0 | v2.0.0 |
|
||||
| v2.7.1 | v2.0.0 |
|
||||
| v2.7.2 | v2.0.1 |
|
||||
| v2.7.3 | v2.0.1 |
|
||||
| v2.7.4 | v2.0.1 |
|
||||
| v2.7.5 | v2.0.2 |
|
||||
|
||||
|
||||
### 1. Gain Access to the Local Cluster
|
||||
|
||||
@@ -2,6 +2,10 @@
|
||||
title: Configuring Shibboleth (SAML)
|
||||
---
|
||||
|
||||
<head>
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/pages-for-subheaders/configure-shibboleth-saml"/>
|
||||
</head>
|
||||
|
||||
If your organization uses Shibboleth Identity Provider (IdP) for user authentication, you can configure Rancher to allow your users to log in to Rancher using their Shibboleth credentials.
|
||||
|
||||
In this configuration, when Rancher users log in, they will be redirected to the Shibboleth IdP to enter their credentials. After authentication, they will be redirected back to the Rancher UI.
|
||||
@@ -94,7 +98,8 @@ Configure the settings for the OpenLDAP server, groups and users. For help filli
|
||||
1. Log into the Rancher UI using the initial local `admin` account.
|
||||
1. In the top left corner, click **☰ > Users & Authentication**.
|
||||
1. In the left navigation menu, click **Auth Provider**.
|
||||
1. Click **OpenLDAP**. The **Configure an OpenLDAP server** form will be displayed.
|
||||
1. Click **Shibboleth** or, if SAML is already configured, **Edit Config**
|
||||
1. Under **User and Group Search**, check **Configure an OpenLDAP server**
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
|
||||
@@ -34,7 +34,7 @@ Values set from the Rancher API will override the value passed in through the co
|
||||
|
||||
When installing Rancher with a Helm chart, use the `--set` option. In the below example, two features are enabled by passing the feature flag names in a comma separated list:
|
||||
|
||||
For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false`.
|
||||
For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false` when using Rancher v2.7.2-v2.7.4. This is not necessary for Rancher v2.7.5 and above, but you can still manually set the option if you choose.
|
||||
|
||||
```
|
||||
helm install rancher rancher-latest/rancher \
|
||||
|
||||
@@ -201,7 +201,7 @@ Because `rancher` is the default option for `ingress.tls.source`, we are not spe
|
||||
- Set the `hostname` to the DNS name you pointed at your load balancer.
|
||||
- Set the `bootstrapPassword` to something unique for the `admin` user.
|
||||
- To install a specific Rancher version, use the `--version` flag, example: `--version 2.7.0`
|
||||
- For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false`.
|
||||
- For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false` when using Rancher v2.7.2-v2.7.4. This is not necessary for Rancher v2.7.5 and above, but you can still manually set the option if you choose.
|
||||
|
||||
```
|
||||
helm install rancher rancher-<CHART_REPO>/rancher \
|
||||
@@ -242,7 +242,7 @@ In the following command,
|
||||
- `ingress.tls.source` is set to `letsEncrypt`
|
||||
- `letsEncrypt.email` is set to the email address used for communication about your certificate (for example, expiry notices)
|
||||
- Set `letsEncrypt.ingress.class` to whatever your ingress controller is, e.g., `traefik`, `nginx`, `haproxy`, etc.
|
||||
- For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false`.
|
||||
- For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false` when using Rancher v2.7.2-v2.7.4. This is not necessary for Rancher v2.7.5 and above, but you can still manually set the option if you choose.
|
||||
|
||||
```
|
||||
helm install rancher rancher-<CHART_REPO>/rancher \
|
||||
@@ -285,7 +285,7 @@ If you want to check if your certificates are correct, see [How do I check Commo
|
||||
- Set the `hostname`.
|
||||
- Set the `bootstrapPassword` to something unique for the `admin` user.
|
||||
- Set `ingress.tls.source` to `secret`.
|
||||
- For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false`.
|
||||
- For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false` when using Rancher v2.7.2-v2.7.4. This is not necessary for Rancher v2.7.5 and above, but you can still manually set the option if you choose.
|
||||
|
||||
```
|
||||
helm install rancher rancher-<CHART_REPO>/rancher \
|
||||
|
||||
+12
-2
@@ -2,6 +2,10 @@
|
||||
title: K3s Cluster Configuration Reference
|
||||
---
|
||||
|
||||
<head>
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/reference-guides/cluster-configuration/rancher-server-configuration/k3s-cluster-configuration"/>
|
||||
</head>
|
||||
|
||||
This section covers the configuration options that are available in Rancher for a new or existing K3s Kubernetes cluster.
|
||||
|
||||
## Overview
|
||||
@@ -98,6 +102,14 @@ Select the domain for the cluster. The default is `cluster.local`.
|
||||
|
||||
Option to change the range of ports that can be used for [NodePort services](https://kubernetes.io/docs/concepts/services-networking/service/#nodeport). The default is `30000-32767`.
|
||||
|
||||
#### Truncate Hostnames
|
||||
|
||||
Option to truncate hostnames to 15 characters or less. You can only set this field during the initial creation of the cluster. You can't enable or disable the 15 character limit after cluster creation.
|
||||
|
||||
This setting only affects machine-provisioned clusters. Since custom clusters set hostnames during their own node creation process, which occurs outside of Rancher, this field doesn't restrict custom cluster hostname length.
|
||||
|
||||
Truncating hostnames in a cluster improves compatibility with Windows-based systems. Although Kubernetes allows hostnames up to 63 characters in length, systems that use NetBIOS restrict hostnames to 15 characters or less.
|
||||
|
||||
#### TLS Alternate Names
|
||||
|
||||
Add additional hostnames or IPv4/IPv6 addresses as Subject Alternative Names on the server TLS cert.
|
||||
@@ -141,5 +153,3 @@ Option to set kubelet options for different nodes. For available options, refer
|
||||
Instead of using the Rancher UI forms to choose Kubernetes options for the cluster, advanced users can create an K3s config file. Using a config file allows you to set any of the [options](https://rancher.com/docs/k3s/latest/en/installation/install-options/) available in an K3s installation.
|
||||
|
||||
To edit an K3s config file directly from the Rancher UI, click **Edit as YAML**.
|
||||
|
||||
|
||||
|
||||
+18
-1
@@ -2,6 +2,10 @@
|
||||
title: RKE Cluster Configuration Reference
|
||||
---
|
||||
|
||||
<head>
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration"/>
|
||||
</head>
|
||||
|
||||
When Rancher installs Kubernetes, it uses [RKE](../../../pages-for-subheaders/launch-kubernetes-with-rancher.md) or [RKE2](https://docs.rke2.io/) as the Kubernetes distribution.
|
||||
|
||||
This section covers the configuration options that are available in Rancher for a new or existing RKE Kubernetes cluster.
|
||||
@@ -183,6 +187,19 @@ Clusters that were created before Kubernetes 1.16 will have an `ingress-nginx` `
|
||||
|
||||
If the `updateStrategy` of `ingress-nginx` is `OnDelete`, you will need to delete these pods to get the correct version for your deployment.
|
||||
|
||||
### Cluster Agent Configuration and Fleet Agent Configuration
|
||||
|
||||
You can configure the scheduling fields and resource limits for the Cluster Agent and the cluster's Fleet Agent. You can use these fields to customize tolerations, affinity rules, and resource requirements. Additional tolerations are appended to a list of default tolerations and control plane node taints. If you define custom affinity rules, they override the global default affinity setting. Defining resource requirements sets requests or limits where there previously were none.
|
||||
|
||||
:::note
|
||||
With this option, it's possible to override or remove rules that are required for the functioning of the cluster. We strongly recommend against removing or overriding these and any other affinity rules, as this may cause unwanted side effects:
|
||||
|
||||
- `affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution` for `cattle-cluster-agent`
|
||||
- `cluster-agent-default-affinity` for `cattle-cluster-agent`
|
||||
- `fleet-agent-default-affinity` for `fleet-agent`
|
||||
:::
|
||||
|
||||
If you downgrade Rancher to v2.7.4 or below, your changes will be lost and the agents will re-deploy without your customizations. The Fleet agent will fallback to using its built-in default values when it re-deploys. If the Fleet version doesn't change during the downgrade, the re-deploy won't be immediate.
|
||||
|
||||
|
||||
## RKE Cluster Config File Reference
|
||||
@@ -343,4 +360,4 @@ There are two ways that you can specify an add-on:
|
||||
- [In-line Add-ons](https://rancher.com/docs/rke/latest/en/config-options/add-ons/user-defined-add-ons/#in-line-add-ons)
|
||||
- [Referencing YAML Files for Add-ons](https://rancher.com/docs/rke/latest/en/config-options/add-ons/user-defined-add-ons/#referencing-yaml-files-for-add-ons)
|
||||
|
||||
For an example of how to configure a custom network plug-in by editing the `cluster.yml`, refer to the [RKE documentation.](https://rancher.com/docs/rke/latest/en/config-options/add-ons/network-plugins/custom-network-plugin-example)
|
||||
For an example of how to configure a custom network plug-in by editing the `cluster.yml`, refer to the [RKE documentation.](https://rancher.com/docs/rke/latest/en/config-options/add-ons/network-plugins/custom-network-plugin-example)
|
||||
+12
@@ -2,6 +2,10 @@
|
||||
title: RKE2 Cluster Configuration Reference
|
||||
---
|
||||
|
||||
<head>
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/reference-guides/cluster-configuration/rancher-server-configuration/rke2-cluster-configuration"/>
|
||||
</head>
|
||||
|
||||
This section covers the configuration options that are available in Rancher for a new or existing RKE2 Kubernetes cluster.
|
||||
|
||||
## Overview
|
||||
@@ -206,6 +210,14 @@ Select the domain for the cluster. The default is `cluster.local`.
|
||||
|
||||
Option to change the range of ports that can be used for [NodePort services](https://kubernetes.io/docs/concepts/services-networking/service/#nodeport). The default is `30000-32767`.
|
||||
|
||||
#### Truncate Hostnames
|
||||
|
||||
Option to truncate hostnames to 15 characters or less. You can only set this field during the initial creation of the cluster. You can't enable or disable the 15 character limit after cluster creation.
|
||||
|
||||
This setting only affects machine-provisioned clusters. Since custom clusters set hostnames during their own node creation process, which occurs outside of Rancher, this field doesn't restrict custom cluster hostname length.
|
||||
|
||||
Truncating hostnames in a cluster improves compatibility with Windows-based systems. Although Kubernetes allows hostnames up to 63 characters in length, systems that use NetBIOS restrict hostnames to 15 characters or less.
|
||||
|
||||
#### TLS Alternate Names
|
||||
|
||||
Add additional hostnames or IPv4/IPv6 addresses as Subject Alternative Names on the server TLS cert.
|
||||
|
||||
+10
-4
@@ -10,10 +10,10 @@ Below are the documentation and release notes for the currently released version
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>v2.7.4</b></td>
|
||||
<td><b>v2.7.5</b></td>
|
||||
<td><a href="https://ranchermanager.docs.rancher.com/v2.7">Documentation</a></td>
|
||||
<td><a href="https://github.com/rancher/rancher/releases/tag/v2.7.4">Release Notes</a></td>
|
||||
<td><a href="https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/rancher-v2-7-4/">Support Matrix</a></td>
|
||||
<td><a href="https://github.com/rancher/rancher/releases/tag/v2.7.5">Release Notes</a></td>
|
||||
<td><a href="https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/rancher-v2-7-5/">Support Matrix</a></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@@ -33,7 +33,13 @@ Below are the documentation and release notes for the currently released version
|
||||
Below are the documentation and release notes for previous versions of Rancher 2.7.x:
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<tr>
|
||||
<td><b>v2.7.4</b></td>
|
||||
<td><a href="https://ranchermanager.docs.rancher.com/v2.7">Documentation</a></td>
|
||||
<td><a href="https://github.com/rancher/rancher/releases/tag/v2.7.4">Release Notes</a></td>
|
||||
<td><a href="https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/rancher-v2-7-4/">Support Matrix</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>v2.7.3</b></td>
|
||||
<td><a href="https://ranchermanager.docs.rancher.com/v2.7">Documentation</a></td>
|
||||
<td><a href="https://github.com/rancher/rancher/releases/tag/v2.7.3">Release Notes</a></td>
|
||||
|
||||
+4
@@ -2,6 +2,10 @@
|
||||
title: RKE Cluster Configuration Reference
|
||||
---
|
||||
|
||||
<head>
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration"/>
|
||||
</head>
|
||||
|
||||
When Rancher installs Kubernetes, it uses [RKE](../../../pages-for-subheaders/launch-kubernetes-with-rancher.md) as the Kubernetes distribution.
|
||||
|
||||
This section covers the configuration options that are available in Rancher for a new or existing RKE Kubernetes cluster.
|
||||
|
||||
@@ -2,6 +2,10 @@
|
||||
title: RKE Cluster Configuration Reference
|
||||
---
|
||||
|
||||
<head>
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration"/>
|
||||
</head>
|
||||
|
||||
When Rancher installs Kubernetes, it uses [RKE](../../../pages-for-subheaders/launch-kubernetes-with-rancher.md) as the Kubernetes distribution.
|
||||
|
||||
This section covers the configuration options that are available in Rancher for a new or existing RKE Kubernetes cluster.
|
||||
|
||||
+4
@@ -2,6 +2,10 @@
|
||||
title: K3s Cluster Configuration Reference
|
||||
---
|
||||
|
||||
<head>
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/reference-guides/cluster-configuration/rancher-server-configuration/k3s-cluster-configuration"/>
|
||||
</head>
|
||||
|
||||
This section covers the configuration options that are available in Rancher for a new or existing K3s Kubernetes cluster.
|
||||
|
||||
## Overview
|
||||
|
||||
+4
@@ -2,6 +2,10 @@
|
||||
title: RKE Cluster Configuration Reference
|
||||
---
|
||||
|
||||
<head>
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration"/>
|
||||
</head>
|
||||
|
||||
When Rancher installs Kubernetes, it uses [RKE](../../../pages-for-subheaders/launch-kubernetes-with-rancher.md) or [RKE2](https://docs.rke2.io/) as the Kubernetes distribution.
|
||||
|
||||
This section covers the configuration options that are available in Rancher for a new or existing RKE Kubernetes cluster.
|
||||
|
||||
+4
@@ -2,6 +2,10 @@
|
||||
title: RKE2 Cluster Configuration Reference
|
||||
---
|
||||
|
||||
<head>
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/reference-guides/cluster-configuration/rancher-server-configuration/rke2-cluster-configuration"/>
|
||||
</head>
|
||||
|
||||
This section covers the configuration options that are available in Rancher for a new or existing RKE2 Kubernetes cluster.
|
||||
|
||||
## Overview
|
||||
|
||||
+9
-3
@@ -188,12 +188,18 @@ Next, install the Rancher Helm chart by following the instructions on [this page
|
||||
|
||||
Use the DNS name from the previous step as the Rancher server URL when you install Rancher. It can be passed in as a Helm option. For example, if the DNS name is `rancher.my.org`, you could run the Helm installation command with the option `--set hostname=rancher.my.org`.
|
||||
|
||||
**_New in v2.6.7_**
|
||||
|
||||
When installing Rancher on top of this setup, you will also need to pass the value below into the Rancher Helm install command in order to set the name of the ingress controller to be used with Rancher's ingress resource:
|
||||
When installing Rancher on top of this setup, you will also need to set the name of the ingress controller to be used with Rancher's ingress resource:
|
||||
|
||||
```
|
||||
--set ingress.ingressClassName=nginx
|
||||
```
|
||||
|
||||
Refer [here for the Helm install command](../../../pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster.md#5-install-rancher-with-helm-and-your-chosen-certificate-option) for your chosen certificate option.
|
||||
|
||||
In Rancher v2.7.5, if you intend to use the default GKE ingress on your cluster without enabling VPC-native cluster mode, you need to set the following flag:
|
||||
|
||||
```
|
||||
--set service.type=NodePort
|
||||
```
|
||||
|
||||
This is necessary because of compatibility issues between this setup and ClusterIP, the default type for `cattle-system/rancher`.
|
||||
|
||||
+2
-2
@@ -140,7 +140,7 @@ Upgrade Rancher to the latest version with all your settings.
|
||||
|
||||
Take all the values from the previous step and append them to the command using `--set key=value`.
|
||||
|
||||
For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false`.
|
||||
For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false` when using Rancher v2.7.2-v2.7.4. This is not necessary for Rancher v2.7.5 and above, but you can still manually set the option if you choose.
|
||||
|
||||
```
|
||||
helm upgrade rancher rancher-<CHART_REPO>/rancher \
|
||||
@@ -162,7 +162,7 @@ Alternatively, it's possible to export the current values to a file and referenc
|
||||
```
|
||||
1. Update only the Rancher version:
|
||||
|
||||
For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false`.
|
||||
For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false` when using Rancher v2.7.2-v2.7.4. This is not necessary for Rancher v2.7.5 and above, but you can still manually set the option if you choose.
|
||||
|
||||
```
|
||||
helm upgrade rancher rancher-<CHART_REPO>/rancher \
|
||||
|
||||
+1
-1
@@ -62,7 +62,7 @@ For information on enabling experimental features, refer to [this page.](../../.
|
||||
| `systemDefaultRegistry` | "" | `string` - private registry to be used for all system container images, e.g., http://registry.example.com/ |
|
||||
| `tls` | "ingress" | `string` - See [External TLS Termination](#external-tls-termination) for details. - "ingress, external" |
|
||||
| `useBundledSystemChart` | `false` | `bool` - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations. |
|
||||
| `global.cattle.psp.enabled` | `true` | `bool` - select 'false' to disable PSP for RKE/RKE2 (K8s) versions `v1.25` and higher. |
|
||||
| `global.cattle.psp.enabled` | `true` | `bool` - select 'false' to disable PSPs for Kubernetes v1.25 and above when using Rancher v2.7.2-v2.7.4. When using Rancher v2.7.5 and above, Rancher attempts to detect if a cluster is running a Kubernetes version where PSPs are not supported, and will default it's usage of PSPs to false if it can determine that PSPs are not supported in the cluster. Users can still manually override this by explicitly providing `true` or `false` for this value. Rancher will still use PSPs by default in clusters which support PSPs (such as clusters running Kubernetes v1.24 or lower). |
|
||||
|
||||
|
||||
### Bootstrap Password
|
||||
|
||||
+2
-2
@@ -177,7 +177,7 @@ kubectl create namespace cattle-system
|
||||
|
||||
Next, install Rancher, declaring your chosen options. Use the reference table below to replace each placeholder. Rancher needs to be configured to use the private registry in order to provision any Rancher launched Kubernetes clusters or Rancher tools.
|
||||
|
||||
For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false`.
|
||||
For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false` when using Rancher v2.7.2-v2.7.4. This is not necessary for Rancher v2.7.5 and above, but you can still manually set the option if you choose.
|
||||
|
||||
Placeholder | Description
|
||||
------------|-------------
|
||||
@@ -208,7 +208,7 @@ Create Kubernetes secrets from your own certificates for Rancher to use. The com
|
||||
|
||||
Install Rancher, declaring your chosen options. Use the reference table below to replace each placeholder. Rancher needs to be configured to use the private registry in order to provision any Rancher launched Kubernetes clusters or Rancher tools.
|
||||
|
||||
For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false`.
|
||||
For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false` when using Rancher v2.7.2-v2.7.4. This is not necessary for Rancher v2.7.5 and above, but you can still manually set the option if you choose.
|
||||
|
||||
| Placeholder | Description |
|
||||
| -------------------------------- | ----------------------------------------------- |
|
||||
|
||||
+1
-1
@@ -130,7 +130,7 @@ The final command to install Rancher is below. The command requires a domain nam
|
||||
|
||||
To install a specific Rancher version, use the `--version` flag (e.g., `--version 2.6.6`). Otherwise, the latest Rancher is installed by default. Refer to [Choosing a Rancher Version](../../installation-and-upgrade/resources/choose-a-rancher-version.md).
|
||||
|
||||
For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false`.
|
||||
For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false` when using Rancher v2.7.2-v2.7.4. This is not necessary for Rancher v2.7.5 and above, but you can still manually set the option if you choose.
|
||||
|
||||
Note the password requires a minimum of 12 characters.
|
||||
|
||||
|
||||
+42
-3
@@ -24,10 +24,12 @@ Setting | Value
|
||||
|
||||
## Configuring Okta in Rancher
|
||||
|
||||
1. In the top left corner, click **☰ > Users & Authentication**.
|
||||
You can integrate Okta with Rancher, so that authenticated users can access Rancher resources through their group permissions. Okta returns a SAML assertion that authenticates a user, including which groups a user belongs to.
|
||||
|
||||
1. In the top left corner, click **☰ > Users & Authentication**.
|
||||
1. In the left navigation menu, click **Auth Provider**.
|
||||
1. Click **Okta**.
|
||||
1. Complete the **Configure Okta Account** form. The examples below describe how you can map Okta attributes from attribute statements to fields within Rancher.
|
||||
1. Complete the **Configure Okta Account** form. The examples below describe how you can map Okta attributes from attribute statements to fields within Rancher.
|
||||
|
||||
| Field | Description |
|
||||
| ------------------------- | ----------------------------------------------------------------------------- |
|
||||
@@ -64,9 +66,46 @@ Setting | Value
|
||||
|
||||
:::note SAML Provider Caveats:
|
||||
|
||||
- SAML Protocol does not support search or lookup for users or groups. Therefore, there is no validation on users or groups when adding them to Rancher.
|
||||
If you configure Okta without OpenLDAP, you won't be able to search for or directly lookup users or groups. This brings several caveats:
|
||||
|
||||
- Users and groups aren't validated when you assign permissions to them in Rancher.
|
||||
- When adding users, the exact user IDs (i.e. `UID Field`) must be entered correctly. As you type the user ID, there will be no search for other user IDs that may match.
|
||||
- When adding groups, you must select the group from the drop-down that is next to the text box. Rancher assumes that any input from the text box is a user.
|
||||
- The group drop-down shows only the groups that you are a member of. You will not be able to add groups that you are not a member of.
|
||||
|
||||
:::
|
||||
|
||||
## Okta with OpenLDAP search
|
||||
|
||||
You can add an OpenLDAP backend to assist with user and group search. Rancher will display additional users and groups from the OpenLDAP service. This allows assigning permissions to groups that the logged-in user is not already a member of.
|
||||
|
||||
### OpenLDAP Prerequisites
|
||||
|
||||
If you use Okta as your IdP, you can [set up an LDAP interface](https://help.okta.com/en-us/Content/Topics/Directory/LDAP-interface-main.htm) for Rancher to use. You can also configure an external OpenLDAP server.
|
||||
|
||||
You must configure Rancher with a LDAP bind account (aka service account) so that you can search and retrieve LDAP entries for users and groups that should have access. Don't use an administrator account or personal account as an LDAP bind account. [Create](https://help.okta.com/en-us/Content/Topics/users-groups-profiles/usgp-add-users.htm) a dedicated account in OpenLDAP, with read-only access to users and groups under the configured searchbase.
|
||||
|
||||
:::warning Security Considerations
|
||||
|
||||
The OpenLDAP service account is used for all searches. Rancher users will see users and groups that the OpenLDAP service account can view, regardless of their individual SAML permissions.
|
||||
|
||||
:::
|
||||
|
||||
|
||||
> **Using TLS?**
|
||||
>
|
||||
> If the certificate used by the OpenLDAP server is self-signed or from an unrecognized certificate authority, Rancher needs the CA certificate (concatenated with any intermediate certificates) in PEM format. Provide this certificate during the configuration so that Rancher can validate the certificate chain.
|
||||
|
||||
### Configure OpenLDAP in Rancher
|
||||
|
||||
[Configure the settings](../configure-openldap/openldap-config-reference.md) for the OpenLDAP server, groups and users. Note that nested group membership isn't available.
|
||||
|
||||
> Before you proceed with the configuration, please familiarise yourself with [external authentication configuration and principal users](../../../../pages-for-subheaders/authentication-config.md#external-authentication-configuration-and-principal-users).
|
||||
|
||||
1. Sign into Rancher using a local user assigned the [administrator](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions) role (i.e., the _local principal_).
|
||||
1. In the top left corner, click **☰ > Users & Authentication**.
|
||||
1. In the left navigation menu, click **Auth Provider**.
|
||||
1. Click **Okta** or, if SAML is already configured, **Edit Config**
|
||||
1. Under **User and Group Search**, check **Configure an OpenLDAP server**
|
||||
|
||||
If you experience issues when you test the connection to the OpenLDAP server, ensure that you entered the credentials for the service account and configured the search base correctly. Inspecting the Rancher logs can help pinpoint the root cause. Debug logs may contain more detailed information about the error. Please refer to [How can I enable debug logging](../../../../faq/technical-items.md#how-can-i-enable-debug-logging) for more information.
|
||||
+1
-1
@@ -158,7 +158,7 @@ Follow the steps to [install cert-manager](../../../pages-for-subheaders/install
|
||||
|
||||
Use the same version of Helm to install Rancher, that was used on the first cluster.
|
||||
|
||||
For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false`.
|
||||
For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false` when using Rancher v2.7.2-v2.7.4. This is not necessary for Rancher v2.7.5 and above, but you can still manually set the option if you choose.
|
||||
|
||||
```bash
|
||||
helm install rancher rancher-latest/rancher \
|
||||
|
||||
+10
-1
@@ -2,6 +2,10 @@
|
||||
title: Installing the Adapter
|
||||
---
|
||||
|
||||
<head>
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/integrations-in-rancher/cloud-marketplace/aws-cloud-marketplace/install-adapter"/>
|
||||
</head>
|
||||
|
||||
> **Important:** If you are attempting to re-install the adapter, you may experience errant out-of-compliance messages for up to an hour.
|
||||
|
||||
### Rancher vs. Adapter Compatibility Matrix
|
||||
@@ -16,6 +20,11 @@ In order to deploy and run the adapter successfully, you need to ensure its vers
|
||||
| Rancher Version | Adapter Version |
|
||||
|-----------------|:---------------:|
|
||||
| v2.7.0 | v2.0.0 |
|
||||
| v2.7.1 | v2.0.0 |
|
||||
| v2.7.2 | v2.0.1 |
|
||||
| v2.7.3 | v2.0.1 |
|
||||
| v2.7.4 | v2.0.1 |
|
||||
| v2.7.5 | v2.0.2 |
|
||||
|
||||
|
||||
### 1. Gain Access to the Local Cluster
|
||||
@@ -147,4 +156,4 @@ Finally, restart the rancher-csp-adapter deployment to ensure that the updated v
|
||||
kubectl rollout restart deploy rancher-csp-adapter -n cattle-csp-adapter-system
|
||||
```
|
||||
|
||||
> **Note:** There are methods such as cert-manager's [trust operator](https://cert-manager.io/docs/projects/trust/) which can help reduce the number of manual rotation tasks over time. While these options are not officially supported, they may be useful to users wishing to automate some of these tasks.
|
||||
> **Note:** There are methods such as cert-manager's [trust operator](https://cert-manager.io/docs/projects/trust/) which can help reduce the number of manual rotation tasks over time. While these options are not officially supported, they may be useful to users wishing to automate some of these tasks.
|
||||
@@ -2,6 +2,10 @@
|
||||
title: Configuring Shibboleth (SAML)
|
||||
---
|
||||
|
||||
<head>
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/pages-for-subheaders/configure-shibboleth-saml"/>
|
||||
</head>
|
||||
|
||||
If your organization uses Shibboleth Identity Provider (IdP) for user authentication, you can configure Rancher to allow your users to log in to Rancher using their Shibboleth credentials.
|
||||
|
||||
In this configuration, when Rancher users log in, they will be redirected to the Shibboleth IdP to enter their credentials. After authentication, they will be redirected back to the Rancher UI.
|
||||
@@ -94,8 +98,9 @@ Configure the settings for the OpenLDAP server, groups and users. For help filli
|
||||
1. Log into the Rancher UI using the initial local `admin` account.
|
||||
1. In the top left corner, click **☰ > Users & Authentication**.
|
||||
1. In the left navigation menu, click **Auth Provider**.
|
||||
1. Click **OpenLDAP**. The **Configure an OpenLDAP server** form will be displayed.
|
||||
1. Click **Shibboleth** or, if SAML is already configured, **Edit Config**
|
||||
1. Under **User and Group Search**, check **Configure an OpenLDAP server**
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
If you are experiencing issues while testing the connection to the OpenLDAP server, first double-check the credentials entered for the service account as well as the search base configuration. You may also inspect the Rancher logs to help pinpointing the problem cause. Debug logs may contain more detailed information about the error. Please refer to [How can I enable debug logging](../faq/technical-items.md#how-can-i-enable-debug-logging) in this documentation.
|
||||
If you are experiencing issues while testing the connection to the OpenLDAP server, first double-check the credentials entered for the service account as well as the search base configuration. You may also inspect the Rancher logs to help pinpointing the problem cause. Debug logs may contain more detailed information about the error. Please refer to [How can I enable debug logging](../faq/technical-items.md#how-can-i-enable-debug-logging) in this documentation.
|
||||
@@ -34,7 +34,7 @@ Values set from the Rancher API will override the value passed in through the co
|
||||
|
||||
When installing Rancher with a Helm chart, use the `--set` option. In the below example, two features are enabled by passing the feature flag names in a comma separated list:
|
||||
|
||||
For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false`.
|
||||
For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false` when using Rancher v2.7.2-v2.7.4. This is not necessary for Rancher v2.7.5 and above, but you can still manually set the option if you choose.
|
||||
|
||||
```
|
||||
helm install rancher rancher-latest/rancher \
|
||||
|
||||
+3
-3
@@ -201,7 +201,7 @@ Because `rancher` is the default option for `ingress.tls.source`, we are not spe
|
||||
- Set the `hostname` to the DNS name you pointed at your load balancer.
|
||||
- Set the `bootstrapPassword` to something unique for the `admin` user.
|
||||
- To install a specific Rancher version, use the `--version` flag, example: `--version 2.7.0`
|
||||
- For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false`.
|
||||
- For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false` when using Rancher v2.7.2-v2.7.4. This is not necessary for Rancher v2.7.5 and above, but you can still manually set the option if you choose.
|
||||
|
||||
```
|
||||
helm install rancher rancher-<CHART_REPO>/rancher \
|
||||
@@ -242,7 +242,7 @@ In the following command,
|
||||
- `ingress.tls.source` is set to `letsEncrypt`
|
||||
- `letsEncrypt.email` is set to the email address used for communication about your certificate (for example, expiry notices)
|
||||
- Set `letsEncrypt.ingress.class` to whatever your ingress controller is, e.g., `traefik`, `nginx`, `haproxy`, etc.
|
||||
- For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false`.
|
||||
- For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false` when using Rancher v2.7.2-v2.7.4. This is not necessary for Rancher v2.7.5 and above, but you can still manually set the option if you choose.
|
||||
|
||||
```
|
||||
helm install rancher rancher-<CHART_REPO>/rancher \
|
||||
@@ -285,7 +285,7 @@ If you want to check if your certificates are correct, see [How do I check Commo
|
||||
- Set the `hostname`.
|
||||
- Set the `bootstrapPassword` to something unique for the `admin` user.
|
||||
- Set `ingress.tls.source` to `secret`.
|
||||
- For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false`.
|
||||
- For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false` when using Rancher v2.7.2-v2.7.4. This is not necessary for Rancher v2.7.5 and above, but you can still manually set the option if you choose.
|
||||
|
||||
```
|
||||
helm install rancher rancher-<CHART_REPO>/rancher \
|
||||
|
||||
+12
-2
@@ -2,6 +2,10 @@
|
||||
title: K3s Cluster Configuration Reference
|
||||
---
|
||||
|
||||
<head>
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/reference-guides/cluster-configuration/rancher-server-configuration/k3s-cluster-configuration"/>
|
||||
</head>
|
||||
|
||||
This section covers the configuration options that are available in Rancher for a new or existing K3s Kubernetes cluster.
|
||||
|
||||
## Overview
|
||||
@@ -98,6 +102,14 @@ Select the domain for the cluster. The default is `cluster.local`.
|
||||
|
||||
Option to change the range of ports that can be used for [NodePort services](https://kubernetes.io/docs/concepts/services-networking/service/#nodeport). The default is `30000-32767`.
|
||||
|
||||
#### Truncate Hostnames
|
||||
|
||||
Option to truncate hostnames to 15 characters or less. You can only set this field during the initial creation of the cluster. You can't enable or disable the 15 character limit after cluster creation.
|
||||
|
||||
This setting only affects machine-provisioned clusters. Since custom clusters set hostnames during their own node creation process, which occurs outside of Rancher, this field doesn't restrict custom cluster hostname length.
|
||||
|
||||
Truncating hostnames in a cluster improves compatibility with Windows-based systems. Although Kubernetes allows hostnames up to 63 characters in length, systems that use NetBIOS restrict hostnames to 15 characters or less.
|
||||
|
||||
#### TLS Alternate Names
|
||||
|
||||
Add additional hostnames or IPv4/IPv6 addresses as Subject Alternative Names on the server TLS cert.
|
||||
@@ -141,5 +153,3 @@ Option to set kubelet options for different nodes. For available options, refer
|
||||
Instead of using the Rancher UI forms to choose Kubernetes options for the cluster, advanced users can create an K3s config file. Using a config file allows you to set any of the [options](https://rancher.com/docs/k3s/latest/en/installation/install-options/) available in an K3s installation.
|
||||
|
||||
To edit an K3s config file directly from the Rancher UI, click **Edit as YAML**.
|
||||
|
||||
|
||||
|
||||
+18
-1
@@ -2,6 +2,10 @@
|
||||
title: RKE Cluster Configuration Reference
|
||||
---
|
||||
|
||||
<head>
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration"/>
|
||||
</head>
|
||||
|
||||
When Rancher installs Kubernetes, it uses [RKE](../../../pages-for-subheaders/launch-kubernetes-with-rancher.md) or [RKE2](https://docs.rke2.io/) as the Kubernetes distribution.
|
||||
|
||||
This section covers the configuration options that are available in Rancher for a new or existing RKE Kubernetes cluster.
|
||||
@@ -183,6 +187,19 @@ Clusters that were created before Kubernetes 1.16 will have an `ingress-nginx` `
|
||||
|
||||
If the `updateStrategy` of `ingress-nginx` is `OnDelete`, you will need to delete these pods to get the correct version for your deployment.
|
||||
|
||||
### Cluster Agent Configuration and Fleet Agent Configuration
|
||||
|
||||
You can configure the scheduling fields and resource limits for the Cluster Agent and the cluster's Fleet Agent. You can use these fields to customize tolerations, affinity rules, and resource requirements. Additional tolerations are appended to a list of default tolerations and control plane node taints. If you define custom affinity rules, they override the global default affinity setting. Defining resource requirements sets requests or limits where there previously were none.
|
||||
|
||||
:::note
|
||||
With this option, it's possible to override or remove rules that are required for the functioning of the cluster. We strongly recommend against removing or overriding these and any other affinity rules, as this may cause unwanted side effects:
|
||||
|
||||
- `affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution` for `cattle-cluster-agent`
|
||||
- `cluster-agent-default-affinity` for `cattle-cluster-agent`
|
||||
- `fleet-agent-default-affinity` for `fleet-agent`
|
||||
:::
|
||||
|
||||
If you downgrade Rancher to v2.7.4 or below, your changes will be lost and the agents will re-deploy without your customizations. The Fleet agent will fallback to using its built-in default values when it re-deploys. If the Fleet version doesn't change during the downgrade, the re-deploy won't be immediate.
|
||||
|
||||
|
||||
## RKE Cluster Config File Reference
|
||||
@@ -343,4 +360,4 @@ There are two ways that you can specify an add-on:
|
||||
- [In-line Add-ons](https://rancher.com/docs/rke/latest/en/config-options/add-ons/user-defined-add-ons/#in-line-add-ons)
|
||||
- [Referencing YAML Files for Add-ons](https://rancher.com/docs/rke/latest/en/config-options/add-ons/user-defined-add-ons/#referencing-yaml-files-for-add-ons)
|
||||
|
||||
For an example of how to configure a custom network plug-in by editing the `cluster.yml`, refer to the [RKE documentation.](https://rancher.com/docs/rke/latest/en/config-options/add-ons/network-plugins/custom-network-plugin-example)
|
||||
For an example of how to configure a custom network plug-in by editing the `cluster.yml`, refer to the [RKE documentation.](https://rancher.com/docs/rke/latest/en/config-options/add-ons/network-plugins/custom-network-plugin-example)
|
||||
+12
@@ -2,6 +2,10 @@
|
||||
title: RKE2 Cluster Configuration Reference
|
||||
---
|
||||
|
||||
<head>
|
||||
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/reference-guides/cluster-configuration/rancher-server-configuration/rke2-cluster-configuration"/>
|
||||
</head>
|
||||
|
||||
This section covers the configuration options that are available in Rancher for a new or existing RKE2 Kubernetes cluster.
|
||||
|
||||
## Overview
|
||||
@@ -206,6 +210,14 @@ Select the domain for the cluster. The default is `cluster.local`.
|
||||
|
||||
Option to change the range of ports that can be used for [NodePort services](https://kubernetes.io/docs/concepts/services-networking/service/#nodeport). The default is `30000-32767`.
|
||||
|
||||
#### Truncate Hostnames
|
||||
|
||||
Option to truncate hostnames to 15 characters or less. You can only set this field during the initial creation of the cluster. You can't enable or disable the 15 character limit after cluster creation.
|
||||
|
||||
This setting only affects machine-provisioned clusters. Since custom clusters set hostnames during their own node creation process, which occurs outside of Rancher, this field doesn't restrict custom cluster hostname length.
|
||||
|
||||
Truncating hostnames in a cluster improves compatibility with Windows-based systems. Although Kubernetes allows hostnames up to 63 characters in length, systems that use NetBIOS restrict hostnames to 15 characters or less.
|
||||
|
||||
#### TLS Alternate Names
|
||||
|
||||
Add additional hostnames or IPv4/IPv6 addresses as Subject Alternative Names on the server TLS cert.
|
||||
|
||||
Reference in New Issue
Block a user