public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-25 12:38:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #556 from btat/broken-links

Browse Source 
Fix broken links
This commit is contained in:
Billy Tat
2023-04-24 14:23:04 -07:00
committed by GitHub
parent ea7d4485b3 83a2cad80a
commit fe594e44ee
3 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.md
+5 -5
View File
@@ -2,13 +2,13 @@
title: Upgrade a Hardened Custom/Imported Cluster to Kubernetes v1.25
---
Kubernetes v1.25 changes how clusters describe and implement security policies. From this version forward, [Pod Security Policies (PSPs)](https://kubernetes.io/docs/concepts/security/pod-security-policy/) are no longer available. Kubernetes v1.25 replaces them with new security objects: [Pod Security Standards (PSS)](https://kubernetes.io/docs/concepts/security/pod-security-standards/), and [Pod Security Admissions (PSAs)](https://kubernetes.io/docs/concepts/security/pod-security-admission/).
Kubernetes v1.25 changes how clusters describe and implement security policies. From this version forward, [Pod Security Policies (PSPs)](https://kubernetes.io/docs/concepts/security/pod-security-policy/) are no longer available. Kubernetes v1.25 replaces them with new security objects: [Pod Security Standards (PSS)](https://kubernetes.io/docs/concepts/security/pod-security-standards/), and [Pod Security Admissions (PSAs)](https://kubernetes.io/docs/concepts/security/pod-security-admission/).
If you have custom or imported hardened clusters, you must take special preparations to ensure that the upgrade from an earlier version of Kubernetes to v1.25 or later goes smoothly.
:::note
After you upgrade to v1.25, add the necessary Rancher namespace exemptions. See [Pod Security Admission (PSA) Configuration Templates](./psa-config-templates.md#exempting-required-rancher-namespaces) for more details.
After you upgrade to v1.25, add the necessary Rancher namespace exemptions. See [Pod Security Admission (PSA) Configuration Templates](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md#exempting-required-rancher-namespaces) for more details.
:::
@@ -17,12 +17,12 @@ After you upgrade to v1.25, add the necessary Rancher namespace exemptions. See
<Tabs groupId="k8s-distro">
<TabItem value="RKE2" default>
Perform the following on each node in the cluster:
Perform the following on each node in the cluster:
1. Save [`rancher-psact.yaml`](./rancher-psact.yaml) in `/etc/rancher/rke2`.
1. Edit the RKE2 configuration file:
1. Update the `profile` field to `cis-1.23`.
1. Specify the path for the configuration file that you just added: `pod-security-admission-config-file: /etc/rancher/rke2/rancher-psact.yaml`.
</TabItem>
<TabItem value="K3s">
@@ -48,7 +48,7 @@ After you perform these steps, you can upgrade the cluster's Kubernetes version
1. In the upper left corner, click **☰ > Cluster Management**.
1. Find the cluster you want to update in the **Clusters** table, and click the **⋮**.
1. Select **Edit Config**.
1. Under **Basics > Security**, in the **CIS Profile** dropdown menu, select `cis-1.23`.
1. Under **Basics > Security**, in the **CIS Profile** dropdown menu, select `cis-1.23`.
1. In the **Default Pod Security Admission** dropdown menu, select `rancher-restricted`.
1. In the **Kubernetes Version** dropdown menu, select the version that you would like to use.
1. Click **Save**.
docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md
+1 -1
View File
@@ -81,7 +81,7 @@ Any user that is bound to the above permission will be able to change the restri
## Required Rancher Namespaces
When you run Rancher on a Kubernetes cluster that enforces a restrictive security policy by default, you'll need to [exempt the following namespaces](./psa-config-templates.md#exempting-namespaces), otherwise the policy might prevent Rancher system pods from running properly.
When you run Rancher on a Kubernetes cluster that enforces a restrictive security policy by default, you'll need to [exempt the following namespaces](#exempting-namespaces), otherwise the policy might prevent Rancher system pods from running properly.
- `calico-apiserver`
- `calico-system`