Commit Graph

181 Commits

Author SHA1 Message Date
Billy Tat 7467f99d89 Merge branch 'main' into 2023-Q4-2.8x 2023-10-06 10:19:22 -07:00
Billy Tat b27b00da87 Revert "Revert "Merge branch 'main' into main-to-2023-Q3-v2.7x""
This reverts commit 5eb3b2876f.
2023-10-05 16:32:09 -07:00
Colleen Murphy 70380d36a7 Add hardening guide for Rancher Webhook (#864) 2023-09-29 14:39:29 -04:00
Billy Tat 5eb3b2876f Revert "Merge branch 'main' into main-to-2023-Q3-v2.7x"
This reverts commit 45aa5bb9bd, reversing
changes made to 5380fffa27.
2023-09-27 15:42:04 -07:00
Andy Pitcher 47773f06fe Rebase and add cis-1.7 k8s v1.26/v1.27 to RKE2 rancher-hardening-guides 2023-09-20 23:50:18 -03:00
Andy Pitcher 81464c73d6 Merge branch 'main' into rke1-self-assessment-guide-with-cis-1.7 2023-09-20 17:28:57 -04:00
Andy Pitcher 35f27f4130 Merge branch 'main' into k3s-self-assessment-guide-with-cis-1.24 2023-09-20 16:24:04 -04:00
Andy Pitcher 00c18c19cd Merge pull request #860 from andypitcher/rke2-self-assessment-guide-with-cis-1.24
[cis-1.24] update rke2-self-assessment-guide
2023-09-20 15:33:55 -04:00
Andy Pitcher 1c2b3f3cce Merge pull request #854 from andypitcher/k3s-self-assessment-guide-with-cis-1.7
[cis-1.7] update k3s-self-assessment-guide
2023-09-20 15:33:40 -04:00
Guilherme Macedo a6369a0484 updates
Signed-off-by: Guilherme Macedo <guilherme@gmacedo.com>
2023-09-20 13:39:51 -03:00
Guilherme Macedo 484a832dff Update k3s-self-assessment-guide-with-cis-v1.24
Signed-off-by: Guilherme Macedo <guilherme@gmacedo.com>
2023-09-20 13:25:51 -03:00
Guilherme Macedo 685241022e updates
Signed-off-by: Guilherme Macedo <guilherme@gmacedo.com>
2023-09-20 13:18:43 -03:00
Andy Pitcher 67221fdd03 Add cis-1.27 to v2.7 (docusaurus, version-2.7) 2023-09-20 11:05:19 -04:00
Andy Pitcher 0fd25bbd39 Add cis-1.7 k8s v1.26/v1.27 to K3s rancher-hardening-guides 2023-09-19 15:00:34 -04:00
Tom Lebreux f6a70125b1 Convert all helm-template instructions to helm-install (#828)
* Adjust command to install cert-manager

The directory `cert-manager` is not created when using `helm install`
instead of `helm template --output-dir .`.

Also, the CRDs are downloaded in the current directory, so adjust the
commands as well.

* Convert helm template to helm upgrade/install

Since we're using Helm hooks, we cannot use `helm template`, otherwise
things will break. The commands are updated to use `helm install` and
`helm upgrade`.
2023-09-13 18:02:02 -04:00
Billy Tat 7922b74630 Merge pull request #832 from vickyhella/vk-bilingual
Fix broken links and update Chinese docs
2023-09-13 14:06:55 -07:00
Andy Pitcher 3840a41654 Merge pull request #796 from andypitcher/rke2-hardening-guide-cis-1.7
Update rke2-hardening-guide based on CIS-1.24 and CIS-1.7
2023-09-12 13:06:54 -04:00
Andy Pitcher 89af32fc1e Merge pull request #794 from andypitcher/rke1-hardening-guide-cis-1.7
Update rke-hardening-guide based on CIS-1.24 and CIS-1.7
2023-09-12 13:03:25 -04:00
Andy Pitcher 35067183ee Apply grammar recommendations:
- Remove latest to cis-1.7 version
- Improve wording

Co-authored-by: Marty Hernandez Avedon <martyavedon@gmail.com>
2023-09-11 18:18:27 -04:00
Andy Pitcher 7ae3799d6a rke2 protect-kernel-defaults and checks 2023-09-11 17:52:11 -04:00
Andy Pitcher cbe7fe5d69 Remove protect-kernel-defaults 2023-09-11 11:31:45 -04:00
Marty Hernandez Avedon 946c22780a sync v2.7 page with #797 Update k3s-hardening-guide based on CIS-1.24 and CIS-1.7 (#838) 2023-09-11 11:10:12 -04:00
vickyhella 5cd6c930f1 Fix broken links 2023-09-08 17:28:15 +08:00
Andy Pitcher a9da000dfe Fix markdown 2023-09-07 15:34:58 -04:00
Andy Pitcher ec43045b57 k3s doc: Update protect-kernel-defaults and remove failing checks note 2023-09-07 14:50:49 -04:00
Andy Pitcher ef47c32541 Merge branch 'rancher:main' into k3s-hardening-guide-cis-1.7 2023-09-07 09:55:23 -04:00
Marty Hernandez Avedon 5274e4e000 #726 - Getting Started UI instructions added to docs (#739)
* added ui instructions for cluster list to access-clusters

* re-org access-clusters so that 'Cluster List' becomes a searchable heading

* rewording

* added instructions and links for Global Settings

* added global config + retitle/rephrase

retitle to disambiguate global settings from global config

listed some relevant global config items that need more info

* correction: updated access-clusters page in /docs, not /versioned_docs

* added Nodes UI instructions

* download kubeconfig UI instructions added/modified

one file contained correct instructions but they were somewhat convoluted, as you can download the file from a page mentioned earlier in the suggested instructions and the button thery describe is an icon, not labeled with any text

* restoring formatting

* updated pathway for image list downloads

* finding rancher-images.txt

* added instructions for Apps Marketplace

* link pointing to v1 monitoring

* link pointing to v1 dashboards

* added links for v1 notifiers, logging tools

* global dns entries, global dns providers, catalog links added

* Rancher portal > Rancher UI

* updated access-clusters page

* rm note & add third way to access cluster dashboard

* heading levels

* addressed comments in global-configuration

* addressed comments for nodes-and-node-pools

* addressed comment on authorized-cluster-endpoint

* rm'd create apps steps

* updated kubeconfig download instructions

* adjusting headers

* updated images list instructions as version # is now an About link

* restored intro to monitoring-and-alerting

* KubeConfig > kubeconfig (except for naming the UI label)

* left navigation sidebar > left navigation

* Update docs/how-to-guides/new-user-guides/manage-clusters/access-clusters/authorized-cluster-endpoint.md

Co-authored-by: Billy Tat <btat@suse.com>

* applied changes to v2.7 docs

---------

Co-authored-by: Billy Tat <btat@suse.com>
2023-09-06 13:33:36 -04:00
Andy Pitcher 4ca8cfada3 Update docs/pages-for-subheaders/rke1-hardening-guide.md
Co-authored-by: Guilherme Macedo <guilherme@gmacedo.com>
2023-09-04 10:27:34 -04:00
Andy Pitcher b36876110e Update docs/pages-for-subheaders/k3s-hardening-guide.md
Co-authored-by: Guilherme Macedo <guilherme@gmacedo.com>
2023-09-04 10:15:24 -04:00
Andy Pitcher fef03ce751 Update k8s version in k3s-hardening-guide.md 2023-08-24 10:56:01 +02:00
Andy Pitcher c48f9f4162 Update notes in k3s-hardening-guide.md
Co-authored-by: Marty Hernandez Avedon <martyavedon@gmail.com>
2023-08-24 10:55:32 +02:00
Marty Hernandez Avedon d08532ac18 801 - correcting no-space between head tag and next line in file (#803) 2023-08-23 15:12:40 -04:00
Billy Tat 1fd885c669 Merge pull request #784 from martyav/420-pages-for-subheaders
#420 SEO Improvements: pages-for-subheaders
2023-08-22 15:23:32 -07:00
Marty Hernandez Avedon aca79758ee Update hardening guide links with broken redirects (#798)
While testing a build, I noticed that the self-assment guide redirects weren't resolving from pages-for-subheaders/rancher-hardening-guides.md. I updated the links on that page to point to the current name for those pages. When I tested the links in docusaurus.config, it seemed like the redirects were formatted correctly and pointed to the right paths. I know we had a similar issue some months ago with other redirects. Updating the links on pages-for-subheaders/rancher-hardening-guides.md is a quick fix -- we still need to look into why the redirects weren't resolving.
2023-08-22 12:13:10 -04:00
Andy Pitcher a09eb326a7 Update k3s-hardening-guide based on CIS-1.24 and CIS-1.7 by removing --protect-kernel-defaults and updating notes 2023-08-22 17:47:23 +02:00
Andy Pitcher 0b9a2bc991 Update rke-hardening-guide based on CIS-1.24 and CIS-1.7 by removing --protect-kernel-defaults and updating notes 2023-08-22 16:56:10 +02:00
martyav d6c2d05059 canonicized pages-for-subheaders 2023-08-15 15:24:51 -04:00
Frank Murphy e55e90fa29 Remove deprecated references to AWS Quickstart Guide (#735)
* Remove deprecated references to AWS Quickstart Guide

* Update docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.md

* /versioned_docs updated to sync w /docs

* added installation-and-upgrade.md versions

---------

Co-authored-by: Marty Hernandez Avedon <martyavedon@gmail.com>
Co-authored-by: martyav <marty.avedon@suse.com>
2023-08-02 11:34:38 -04:00
Billy Tat 47ad664d53 Merge pull request #714 from martyav/420-deploy-apps-across-clusters
#420 SEO Improvements: Canonical links for deploy apps across clusters directory. Part 1/1
2023-07-21 11:38:10 -07:00
Billy Tat 17611dbac6 Apply suggestions to versioned page
Co-authored-by: Marty Hernandez Avedon <martyavedon@gmail.com>
2023-07-18 13:21:48 -07:00
Billy Tat 5bf27acc72 Apply suggestions from code review
Co-authored-by: Marty Hernandez Avedon <martyavedon@gmail.com>
2023-07-18 13:20:35 -07:00
Billy Tat 90851156f9 Remove references to old versions 2023-07-17 16:32:00 -07:00
Marty Hernandez Avedon e915165bb8 #707 Cert-manager install instructions inconsistent with versions (#719) 2023-07-03 13:34:52 -04:00
martyav 2c4b7221f4 canonicized fleet.md and fleet-gitops-at-scale.md as their content is the same 2023-06-30 15:55:14 -04:00
Billy Tat e9c7803ded Merge pull request #710 from btat/install-process-psp
Update note on install process around PSPs
2023-06-29 10:01:40 -07:00
Billy Tat 6c68ad9863 Apply feedback: use shorter note on install process wrt PSPs 2023-06-29 09:54:15 -07:00
Marty Hernandez Avedon c53f47580e Apply suggestions from code review
– dash for ranges
2023-06-29 12:42:00 -04:00
Marty Hernandez Avedon 9fbb6b610e versioned doc + canonical link for #599 (#711) 2023-06-29 10:26:30 -04:00
nflynt 00609cd1b0 Document the new OpenLDAP configuration feature for Okta auth providers (#599)
* Update Shibboleth OpenLDAP instructions to reflect current UI

These settings would have, if followed verbatim, actually configured
an OpenLDAP Auth Provider, bypassing Shibboleth entirely. In order
to configure a Shibboleth provider with added OpenLDAP, one must start
with a Shibboleth base, not an OpenLDAP one.

* Document the new OpenLDAP functionality for Okta Auth Providers

These changes are pulled directly from the Shibboleth provider with
minimal touchups to ensure the correct UI elements are referenced
in steps. I've tried to include all relevant warnings and security
callouts, but I've otherwise left the language alone, as the original
text seems fine.

* Cleaned up language and updated several links, based on feedback

* Remove/cleanup language. OpenLDAP is not required for group permissions

Also some light rearrangement for flow, a few redundant statements
removed, and syntax cleanup on one of the lists.

* Add link to Okta user account creation instructions

Co-authored-by: Marty Hernandez Avedon <martyavedon@gmail.com>

* Edit TLS notice language for brevity

Co-authored-by: Marty Hernandez Avedon <martyavedon@gmail.com>

* Warn that the service account is shared across all of Rancher

---------

Co-authored-by: Marty Hernandez Avedon <martyavedon@gmail.com>
2023-06-29 10:17:44 -04:00
Billy Tat a3497524c8 Update note on install process around PSPs 2023-06-28 13:06:42 -07:00