Merge pull request #1524 from rancher/v2.9.3

Merge v2.9.3 release branch into main
Merge pull request #1523 from rancher/v2.8.9
2026-09-30 06:54:09 +00:00 · 2024-10-24 19:22:08 -07:00 · 2024-10-24 19:22:03 -07:00 · 2024-10-24 19:21:56 -07:00 · 2024-10-24 14:36:06 -07:00 · 2024-10-24 14:36:03 -07:00
301 changed files with 979 additions and 979 deletions
@@ -1,61 +0,0 @@
-# This action gets all changed markdown files in /docs and /versioned_docs using tj-actions/changed-files@v42
-# It compares new commits in the PR with the base commit (github.event.pull_request.base.sha)
-# It checks if no markdown files are changed 
-# It shows a count of markdown files and lists all changed markdown files
-# It uses Vale (https://vale.sh/docs/vale-cli/installation/) to provide feedback base off the SUSE Style Guide / OpenSUSE style rules (https://github.com/openSUSE/suse-vale-styleguide)
-
-name: Style check
-on:
-  pull_request:
-    paths-ignore:
-      - '**/README.md'
-
-jobs:
-  vale-lint:
-    name: runner / vale
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        continue-on-error: true
-        with:
-          fetch-depth: 0  # OR "2" -> To retrieve the preceding commit.
-          submodules: true
-      - name: Get all changed markdown files
-        continue-on-error: true
-        id: changed-markdown-files
-        uses: tj-actions/changed-files@v42
-        with:
-            # Avoid using single or double quotes for multiline patterns
-            files: |
-               docs/**
-               versioned_docs/**
-            separator: ","
-            base_sha: ${{ github.event.pull_request.base.sha }}
-        env:
-            ALL_CHANGED_FILES: ${{ 0 }}
-      - name: No files changed?
-        continue-on-error: true
-        if: steps.changed-markdown-files.outputs.any_changed == 'false'
-        run: |
-              echo "No files changed"
-              echo "ALL_CHANGED_FILES=$ALL_CHANGED_FILES" >> $GITHUB_ENV
-      - name: List all changed files markdown files
-        continue-on-error: true
-        if: steps.changed-markdown-files.outputs.any_changed == 'true'
-        env:
-            ALL_CHANGED_FILES: ${{ steps.changed-markdown-files.outputs.all_changed_files }}
-            ALL_CHANGED_FILES_COUNT: ${{ steps.changed-markdown-files.outputs.all_changed_files_count }}
-            SHA: ${{ github.head_ref }}
-            HEAD: ${{ github.base_ref }}
-        run: |
-            echo "Total Files Changed:" ${ALL_CHANGED_FILES_COUNT}
-            echo ${ALL_CHANGED_FILES}
-            echo "ALL_CHANGED_FILES=$ALL_CHANGED_FILES" >> $GITHUB_ENV
-      - uses: errata-ai/vale-action@v2.1.0
-        continue-on-error: true
-        if: steps.changed-markdown-files.outputs.any_changed == 'true'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          separator: ", "
-          files: ${{ env.ALL_CHANGED_FILES }}
@@ -6,7 +6,7 @@ title: Using API Tokens
  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/api/api-tokens"/>
 </head>

-Rancher v2.8.0 introduced the [Rancher Kubernetes API](./api-reference.mdx) which can be used to manage Rancher resources through `kubectl`. This page covers information on API tokens used with the [Rancher CLI](../reference-guides/cli-with-rancher), [kubeconfig files](../how-to-guides/new-user-guides/manage-clusters/access-clusters/authorized-cluster-endpoint.md#about-the-kubeconfig-file), Terraform and the [v3 API browser](./v3-rancher-api-guide.md#enable-view-in-api).
+Rancher v2.8.0 introduced the [Rancher Kubernetes API](./api-reference.mdx) which can be used to manage Rancher resources through `kubectl`. This page covers information on API tokens used with the [Rancher CLI](../reference-guides/cli-with-rancher/cli-with-rancher.md), [kubeconfig files](../how-to-guides/new-user-guides/manage-clusters/access-clusters/authorized-cluster-endpoint.md#about-the-kubeconfig-file), Terraform and the [v3 API browser](./v3-rancher-api-guide.md#enable-view-in-api).

 By default, some cluster-level API tokens are generated with infinite time-to-live (`ttl=0`). In other words, API tokens with `ttl=0` never expire unless you invalidate them. Tokens are not invalidated by changing a password.

@@ -10,7 +10,7 @@ Rancher v2.8.0 introduced the Rancher Kubernetes API (RK-API). The previous v3 R

 ## How to Use the API

-The previous v3 API has its own user interface accessible from a [web browser](./v3-rancher-api-guide.md#enable-view-in-api). This is an easy way to see resources, perform actions, and see the equivalent `curl` or HTTP request & response. To access it:
+The previous v3 API has its own user interface accessible from a [web browser](#enable-view-in-api). This is an easy way to see resources, perform actions, and see the equivalent `curl` or HTTP request & response. To access it:

 <Tabs>
 <TabItem value="Rancher v2.6.4+">
@@ -16,6 +16,7 @@ Rancher will publish deprecated features as part of the [release notes](https://

 | Patch Version |  Release Date |
 |---------------|---------------|
+| [2.9.3](https://github.com/rancher/rancher/releases/tag/v2.9.3) | Oct 24, 2024 |
 | [2.9.2](https://github.com/rancher/rancher/releases/tag/v2.9.2) | Sep 19, 2024 |
 | [2.9.1](https://github.com/rancher/rancher/releases/tag/v2.9.1) | Aug 26, 2024 |
 | [2.9.0](https://github.com/rancher/rancher/releases/tag/v2.9.0) | Jul 31, 2024 |
@@ -22,15 +22,15 @@ For users looking to use another container runtime, Rancher has the edge-focused

 <br/>

-Q. Do I have to upgrade Rancher to get Rancher’s support of the upstream Dockershim?
+Q: Do I have to upgrade Rancher to get Rancher’s support of the upstream Dockershim?

 The upstream support of Dockershim begins for RKE in Kubernetes 1.21. You will need to be on Rancher 2.6 or above to have support for RKE with Kubernetes 1.21. See our [support matrix](https://rancher.com/support-maintenance-terms/all-supported-versions/rancher-v2.6.0/) for details.

 <br/>

-Q. I am currently on RKE with Kubernetes 1.20. Do I need to upgrade to RKE with Kubernetes 1.21 sooner to avoid being out of support for Dockershim?
+Q: I am currently on RKE with Kubernetes 1.20. Do I need to upgrade to RKE with Kubernetes 1.21 sooner to avoid being out of support for Dockershim?

-A. The version of Dockershim in RKE with Kubernetes 1.20 will continue to work and is not scheduled for removal upstream until Kubernetes 1.24. It will only emit a warning of its future deprecation, which Rancher has mitigated in RKE with Kubernetes 1.21. You can plan your upgrade to Kubernetes 1.21 as you would normally, but should consider enabling the external Dockershim by Kubernetes 1.22. The external Dockershim will need to be enabled before upgrading to Kubernetes 1.24, at which point the existing implementation will be removed.
+A: The version of Dockershim in RKE with Kubernetes 1.20 will continue to work and is not scheduled for removal upstream until Kubernetes 1.24. It will only emit a warning of its future deprecation, which Rancher has mitigated in RKE with Kubernetes 1.21. You can plan your upgrade to Kubernetes 1.21 as you would normally, but should consider enabling the external Dockershim by Kubernetes 1.22. The external Dockershim will need to be enabled before upgrading to Kubernetes 1.24, at which point the existing implementation will be removed.

 For more information on the deprecation and its timeline, see the [Kubernetes Dockershim Deprecation FAQ](https://kubernetes.io/blog/2020/12/02/dockershim-faq/#when-will-dockershim-be-removed).

@@ -57,7 +57,7 @@ The AWS module just creates an EC2 KeyPair, an EC2 SecurityGroup and an EC2 inst

    - `aws_access_key` - Amazon AWS Access Key
    - `aws_secret_key` - Amazon AWS Secret Key
-    - `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirments.
+    - `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirements.

 5. **Optional:** Modify optional variables within `terraform.tfvars`. See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [AWS Quickstart Readme](https://github.com/rancher/quickstart/tree/master/rancher/aws) for more information.
 Suggestions include:
@@ -43,7 +43,7 @@ Deploying to Microsoft Azure will incur charges.
    - `azure_client_id` - Microsoft Azure Client ID
    - `azure_client_secret` - Microsoft Azure Client Secret
    - `azure_tenant_id` - Microsoft Azure Tenant ID
-    - `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirments.
+    - `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirements.

 5. **Optional:** Modify optional variables within `terraform.tfvars`.
 See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [Azure Quickstart Readme](https://github.com/rancher/quickstart/tree/master/rancher/azure) for more information. Suggestions include:
@@ -38,7 +38,7 @@ Deploying to DigitalOcean will incur charges.

 4. Edit `terraform.tfvars` and customize the following variables:
    - `do_token` - DigitalOcean access key
-    - `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirments.
+    - `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirements.

 5. **Optional:** Modify optional variables within `terraform.tfvars`.
 See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [DO Quickstart Readme](https://github.com/rancher/quickstart/tree/master/rancher/do) for more information. Suggestions include:
@@ -39,7 +39,7 @@ Deploying to Google GCP will incur charges.

 4. Edit `terraform.tfvars` and customize the following variables:
    - `gcp_account_json` - GCP service account file path and file name
-    - `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirments.
+    - `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirements.

 5. **Optional:** Modify optional variables within `terraform.tfvars`.
 See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [GCP Quickstart Readme](https://github.com/rancher/quickstart/tree/master/rancher/gcp) for more information.
@@ -130,7 +130,7 @@ To install a specific Rancher version, use the `--version` flag (e.g., `--versio

 For Kubernetes v1.25 or later, set `global.cattle.psp.enabled` to `false` when using Rancher v2.7.2-v2.7.4. This is not necessary for Rancher v2.7.5 and above, but you can still manually set the option if you choose.

-See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirments.
+See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirements.

 ```
 helm install rancher rancher-latest/rancher \
@@ -38,7 +38,7 @@ Deploying to Hetzner Cloud will incur charges.

 4. Edit `terraform.tfvars` and customize the following variables:
    - `hcloud_token` - Hetzner API access key
-    - `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirments.
+    - `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirements.

 5. **Optional:** Modify optional variables within `terraform.tfvars`.
 See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [Hetzner Quickstart Readme](https://github.com/rancher/quickstart/tree/master/rancher/hcloud) for more information.
@@ -38,7 +38,7 @@ Deploying to Linode will incur charges.

 4. Edit `terraform.tfvars` and customize the following variables:
    - `linode_token` - The Linode Personal Access Token mentioned above.
-    - `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirments.
+    - `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirements.

 5. **Optional:** Modify optional variables within `terraform.tfvars`.
 See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [Linode Quickstart Readme](https://github.com/rancher/quickstart/tree/master/rancher/linode) for more information. Suggestions include:
@@ -39,7 +39,7 @@ Deploying to Outscale will incur charges.
 4. Edit `terraform.tfvars` and customize the following variables:
    - `access_key_id` - Outscale access key
    - `secret_key_id` - Outscale secret key
-    - `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirments.
+    - `rancher_server_admin_password` - Admin password for created Rancher server. See [Setting up the Bootstrap Password](../../installation-and-upgrade/resources/bootstrap-password.md#password-requirements) for password requirements.

 5. **Optional:** Modify optional variables within `terraform.tfvars`.
 See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [Outscale Quickstart Readme](https://github.com/rancher/quickstart/tree/master/rancher/outscale) for more information.
@@ -80,11 +80,11 @@ If you use a certificate signed by a recognized CA, installing your certificate

 1.  Enter the following command.

-        ```
-        docker run -d --restart=unless-stopped \
-        -p 80:80 -p 443:443 \
-        rancher/rancher:latest --no-cacerts
-        ```
+    ```
+    docker run -d --restart=unless-stopped \
+      -p 80:80 -p 443:443 \
+      rancher/rancher:latest --no-cacerts
+    ```

 </details>

@@ -16,11 +16,11 @@ Want to provide a user with access to _all_ projects within a cluster? See [Addi

 :::

-### Adding Members to a New Project
+## Adding Members to a New Project

 You can add members to a project as you create it (recommended if possible). For details on creating a new project, refer to the [cluster administration section.](../../how-to-guides/new-user-guides/manage-clusters/projects-and-namespaces.md)

-### Adding Members to an Existing Project
+## Adding Members to an Existing Project

 Following project creation, you can add users as project members so that they can access its resources.

@@ -35,7 +35,7 @@ There are several other hosted Kubernetes cloud providers that are disabled by d

 ### Node Drivers

-Node drivers are used to provision hosts, which Rancher uses to launch and manage Kubernetes clusters. A node driver is the same as a [Docker Machine driver](https://docs.docker.com/machine/drivers/). The availability of which node driver to display when creating node templates is defined based on the node driver's status. Only `active` node drivers will be displayed as an option for creating node templates. By default, Rancher is packaged with many existing Docker Machine drivers, but you can also create custom node drivers to add to Rancher.
+Node drivers are used to provision hosts, which Rancher uses to launch and manage Kubernetes clusters. A node driver is the same as a [Docker Machine driver](https://github.com/docker/docs/blob/vnext-engine/machine/drivers/index.md). The availability of which node driver to display when creating node templates is defined based on the node driver's status. Only `active` node drivers will be displayed as an option for creating node templates. By default, Rancher is packaged with many existing Docker Machine drivers, but you can also create custom node drivers to add to Rancher.

 If there are specific node drivers that you don't want to show to your users, you would need to de-activate these node drivers.

@@ -6,7 +6,7 @@ title: Node Drivers
  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/about-provisioning-drivers/manage-node-drivers"/>
 </head>

-A node driver is the same as a [Docker Machine driver](https://docs.docker.com/machine/drivers/). Node drivers are used to provision hosts, which Rancher uses to launch and manage Kubernetes clusters. By default, Rancher is packaged with many node drivers, but you can also create and add custom node drivers to Rancher.
+A node driver is the same as a [Docker Machine driver](https://github.com/docker/docs/blob/vnext-engine/machine/drivers/index.md). Node drivers are used to provision hosts, which Rancher uses to launch and manage Kubernetes clusters. By default, Rancher is packaged with many node drivers, but you can also create and add custom node drivers to Rancher.

 Only `Active` node drivers are displayed in the Rancher UI when you create node templates. If there are specific node drivers that you don't want to show your users, you must deactivate these node drivers.

@@ -60,4 +60,4 @@ To convert an existing cluster to use an RKE template,

 - A new RKE template is created.
 - The cluster is converted to use the new template.
- New clusters can be [created from the new template.](apply-templates.md#creating-a-cluster-from-an-rke-template)
+- New clusters can be [created from the new template.](#creating-a-cluster-from-an-rke-template)
@@ -35,6 +35,7 @@ If you have an existing configuration using the SAML protocol and want to switch
    `Name` | `Groups Mapper`
    `Mapper Type` | `Group Membership`
    `Token Claim Name` | `groups`
+    `Full group path` | `OFF`
    `Add to ID token` | `OFF`
    `Add to access token` | `OFF`
    `Add to user info` | `ON`
@@ -46,6 +47,7 @@ If you have an existing configuration using the SAML protocol and want to switch
    `Name` | `Client Audience`
    `Mapper Type` | `Audience`
    `Included Client Audience` | &lt;CLIENT_NAME>
+    `Add to ID token` | `OFF`
    `Add to access token` | `ON`

  - Create a new "Groups Path" with the settings below.
@@ -56,8 +58,15 @@ If you have an existing configuration using the SAML protocol and want to switch
    `Mapper Type` | `Group Membership`
    `Token Claim Name` | `full_group_path`
    `Full group path` | `ON`
+    `Add to ID token` | `ON`
+    `Add to access token` | `ON`
    `Add to user info` | `ON`

+- Go to **Role Mappings > Client Roles >  realm-management** and add the following Role Mappings to all users or groups that need to query the Keycloak users.
+  - query-users
+  - query-groups
+  - view-users
+
 ## Configuring Keycloak in Rancher

 1. In the Rancher UI, click **☰ > Users & Authentication**.
@@ -69,7 +69,7 @@ To view Helm charts in the OCI-based Helm chart repository after it achieves an

 Rancher automatically refreshes the OCI-based Helm chart repository every 6 hours. 

-If you need to update immediately, you can [perform a manual refresh](../helm-charts-in-rancher/helm-charts-in-rancher.md#refresh-chart-repositories).
+If you need to update immediately, you can [perform a manual refresh](./helm-charts-in-rancher.md#refresh-chart-repositories).

 ## Update an OCI-Based Helm Chart Repository Configuration

@@ -37,7 +37,7 @@ Rancher uses the [Rancher Kubernetes Engine (RKE)](https://rancher.com/docs/rke/

 In RKE clusters, Rancher manages the deployment of Kubernetes. These clusters can be deployed on any bare metal server, cloud provider, or virtualization platform.

-These nodes can be dynamically provisioned through Rancher's UI, which calls [Docker Machine](https://docs.docker.com/machine/) to launch nodes on various cloud providers.
+These nodes can be dynamically provisioned through Rancher's UI, which calls [Docker Machine](https://github.com/docker/docs/blob/vnext-engine/machine/overview.md) to launch nodes on various cloud providers.

 If you already have a node that you want to add to an RKE cluster, you can add it to the cluster by running a Rancher agent container on it.

@@ -6,32 +6,21 @@ title: Launching Kubernetes on Windows Clusters
  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/use-windows-clusters"/>
 </head>

-When provisioning a [custom cluster](../../../../reference-guides/cluster-configuration/rancher-server-configuration/use-existing-nodes/use-existing-nodes.md) using Rancher, Rancher uses RKE (the Rancher Kubernetes Engine) to install Kubernetes on your existing nodes.
+When provisioning a [custom cluster](../../../../reference-guides/cluster-configuration/rancher-server-configuration/use-existing-nodes/use-existing-nodes.md) Rancher uses RKE2 to install Kubernetes on your existing nodes.

 In a Windows cluster provisioned with Rancher, the cluster must contain both Linux and Windows nodes. The Kubernetes controlplane can only run on Linux nodes, and the Windows nodes can only have the worker role. Windows nodes can only be used for deploying workloads.

-Some other requirements for Windows clusters include:
-
- You can only add Windows nodes to a cluster if Windows support is enabled when the cluster is created. Windows support cannot be enabled for existing clusters.
- Kubernetes 1.15+ is required.
- The Flannel network provider must be used.
- Windows nodes must have 50 GB of disk space.
-
-For the full list of requirements, see [this section.](#requirements-for-windows-clusters)
-
 For a summary of Kubernetes features supported in Windows, see the Kubernetes documentation on [supported functionality and limitations for using Kubernetes with Windows](https://kubernetes.io/docs/setup/production-environment/windows/intro-windows-in-kubernetes/#supported-functionality-and-limitations) or the [guide for scheduling Windows containers in Kubernetes](https://kubernetes.io/docs/setup/production-environment/windows/user-guide-windows-containers/).

-### RKE2 Windows
+### RKE2 Features for Windows Clusters

-The RKE2 provisioning feature also includes installing RKE2 on Windows clusters. Windows features for RKE2 include:
+Listed below are the primary RKE2 features for Windows cluster provisioning:

 - Windows Containers with RKE2 powered by containerd
 - Added provisioning of Windows RKE2 custom clusters directly from the Rancher UI
 - Calico CNI for Windows RKE2 custom clusters
 - SAC releases of Windows Server (2004 and 20H2) are included in the technical preview

-Windows Support for RKE2 Custom Clusters requires choosing Calico as the CNI.
-
 :::note

 Rancher will allow Windows workload pods to deploy on both Windows and Linux worker nodes by default. When creating mixed clusters in RKE2, you must edit the `nodeSelector` in the chart to direct the pods to be placed onto a compatible Windows node. Refer to the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector) for more information on how to use `nodeSelector` to assign pods to nodes.
@@ -40,11 +29,11 @@ Rancher will allow Windows workload pods to deploy on both Windows and Linux wor

 - HostProcess containers in Windows RKE2 are supported in Kubernetes v1.24.1 and up. See [the upstream documentation](https://kubernetes.io/docs/tasks/configure-pod-container/create-hostprocess-pod/) for more information.

-## Requirements for Windows Clusters
+## General Requirements

-The general node requirements for networking, operating systems, and Docker are the same as the node requirements for a [Rancher installation](../../../../getting-started/installation-and-upgrade/installation-requirements/installation-requirements.md).
+The general networking and operating system requirements for Windows nodes are the same as for other [Rancher installations](../../../../getting-started/installation-and-upgrade/installation-requirements/installation-requirements.md).

-### OS and Docker Requirements
+### OS Requirements

 Our support for Windows Server and Windows containers match the Microsoft official lifecycle for LTSC (Long-Term Servicing Channel) and SAC (Semi-Annual Channel).

@@ -52,9 +41,7 @@ For the support lifecycle dates for Windows Server, see the [Microsoft Documenta

 ### Kubernetes Version

-Kubernetes v1.15+ is required.
-
-If you are using Kubernetes v1.21 with Windows Server 20H2 Standard Core, the patch "2019-08 Servicing Stack Update for Windows Server" must be installed on the node.
+For more information regarding Kubernetes component versions, see the [support matrices for RKE2 versions](https://www.suse.com/suse-rke2/support-matrix/all-supported-versions/).

 ### Node Requirements

@@ -70,13 +57,7 @@ Rancher will not provision the node if the node does not meet these requirements

 Before provisioning a new cluster, be sure that you have already installed Rancher on a device that accepts inbound network traffic. This is required in order for the cluster nodes to communicate with Rancher. If you have not already installed Rancher, please refer to the [installation documentation](../../../../getting-started/installation-and-upgrade/installation-and-upgrade.md) before proceeding with this guide.

-Rancher only supports Windows using Flannel as the network provider.
-
-There are two network options: [**Host Gateway (L2bridge)**](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#host-gw) and [**VXLAN (Overlay)**](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#vxlan). The default option is **VXLAN (Overlay)** mode.
-
-For **Host Gateway (L2bridge)** networking, it's best to use the same Layer 2 network for all nodes. Otherwise, you need to configure the route rules for them. For details, refer to the [documentation on configuring cloud-hosted VM routes.](network-requirements-for-host-gateway.md#cloud-hosted-vm-routes-configuration) You will also need to [disable private IP address checks](network-requirements-for-host-gateway.md#disabling-private-ip-address-checks) if you are using Amazon EC2, Google GCE, or Azure VM.
-
-For **VXLAN (Overlay)** networking, the [KB4489899](https://support.microsoft.com/en-us/help/4489899) hotfix must be installed. Most cloud-hosted VMs already have this hotfix.
+Rancher supports Windows using Calico as the network provider.

 If you are configuring DHCP options sets for an AWS virtual private cloud, note that in the `domain-name` option field, only one domain name can be specified. According to the DHCP options [documentation:](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_DHCP_Options.html)

@@ -134,7 +115,7 @@ Windows requires that containers must be built on the same Windows Server versio

 ### Cloud Provider Specific Requirements

-If you set a Kubernetes cloud provider in your cluster, some additional steps are required. You might want to set a cloud provider if you want to want to leverage a cloud provider's capabilities, for example, to automatically provision storage, load balancers, or other infrastructure for your cluster. Refer to [this page](../set-up-cloud-providers/set-up-cloud-providers.md) for details on how to configure a cloud provider cluster of nodes that meet the prerequisites.
+If you set a Kubernetes cloud provider in your cluster, some additional steps are required. You may wish to setup a cloud provider to leverage capabilities to automatically provision storage, load balancers, or other infrastructure for your cluster. Refer to [this page](../set-up-cloud-providers/set-up-cloud-providers.md) for details on how to configure a cloud provider cluster of nodes that meet the prerequisites.

 If you are using the GCE (Google Compute Engine) cloud provider, you must do the following:

@@ -145,11 +126,10 @@ If you are using the GCE (Google Compute Engine) cloud provider, you must do the

 This tutorial describes how to create a Rancher-provisioned cluster with the three nodes in the [recommended architecture.](#recommended-architecture)

-When you provision a cluster with Rancher on existing nodes, you will add nodes to the cluster by installing the [Rancher agent](../../../../reference-guides/cluster-configuration/rancher-server-configuration/use-existing-nodes/rancher-agent-options.md) on each one. When you create or edit your cluster from the Rancher UI, you will see a **Customize Node Run Command** that you can run on each server to add it to your cluster.
+When you provision a cluster with Rancher on existing nodes, you add nodes to the cluster by installing the [Rancher agent](../../../../reference-guides/cluster-configuration/rancher-server-configuration/use-existing-nodes/rancher-agent-options.md) on each one. To create or edit your cluster from the Rancher UI, run the **Registration Command** on each server to add it to your cluster.

 To set up a cluster with support for Windows nodes and containers, you will need to complete the tasks below.

-
 ### 1. Provision Hosts

 To begin provisioning a cluster on existing nodes with Windows support, prepare your hosts.
@@ -182,18 +162,10 @@ The instructions for creating a Windows cluster on existing nodes are very simil
 1. On the **Clusters** page, click **Create**.
 1. Click **Custom**.
 1. Enter a name for your cluster in the **Cluster Name** field.
-1. In the **Kubernetes Version** dropdown menu, select v1.19 or above.
-1. In the **Network Provider** field, select **Flannel**.
-1. In the **Windows Support** section, click **Enabled**.
-1. Optional: After you enable Windows support, you will be able to choose the Flannel backend. There are two network options: [**Host Gateway (L2bridge)**](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#host-gw) and [**VXLAN (Overlay)**](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#vxlan). The default option is **VXLAN (Overlay)** mode.
+1. In the **Kubernetes Version** dropdown menu, select a supported Kubernetes version.
+1. In the **Container Network** field, select **Calico**.
 1. Click **Next**.

-:::note Important:
-
-For <b>Host Gateway (L2bridge)</b> networking, it's best to use the same Layer 2 network for all nodes. Otherwise, you need to configure the route rules for them. For details, refer to the [documentation on configuring cloud-hosted VM routes.](network-requirements-for-host-gateway.md#cloud-hosted-vm-routes-configuration) You will also need to [disable private IP address checks](network-requirements-for-host-gateway.md#disabling-private-ip-address-checks) if you are using Amazon EC2, Google GCE, or Azure VM.
-
-:::
-
 ### 3. Add Nodes to the Cluster

 This section describes how to register your Linux and Worker nodes to your cluster. You will run a command on each node, which will install the Rancher agent and allow Rancher to manage each node.
@@ -202,14 +174,13 @@ This section describes how to register your Linux and Worker nodes to your clust

 In this section, we fill out a form on the Rancher UI to get a custom command to install the Rancher agent on the Linux master node. Then we will copy the command and run it on our Linux master node to register the node in the cluster.

-The first node in your cluster should be a Linux host has both the **Control Plane** and **etcd** roles. At a minimum, both of these roles must be enabled for this node, and this node must be added to your cluster before you can add Windows hosts.
+The first node in your cluster should be a Linux host that has both the **Control Plane** and **etcd** roles. At a minimum, both of these roles must be enabled for this node, and this node must be added to your cluster before you can add Windows hosts.

-1. In the **Node Operating System** section, click **Linux**.
-1. In the **Node Role** section, choose at least **etcd** and **Control Plane**. We recommend selecting all three.
+1. After cluster creation, navigate to the **Registration** tab.
+1. In **Step 1** under the **Node Role** section, select at least **etcd** and **Control Plane**. We recommend selecting all three.
 1. Optional: If you click **Show advanced options,** you can customize the settings for the [Rancher agent](../../../../reference-guides/cluster-configuration/rancher-server-configuration/use-existing-nodes/rancher-agent-options.md) and [node labels.](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/)
-1. Copy the command displayed on the screen to your clipboard.
+1. In **Step 2**, under the **Registration** section, copy the command displayed on the screen to your clipboard.
 1. SSH into your Linux host and run the command that you copied to your clipboard.
-1. When you are finished provisioning your Linux node(s), select **Done**.

 **Result:**

@@ -222,22 +193,19 @@ You can access your cluster after its state is updated to **Active**.
 - `Default`, containing the `default` namespace
 - `System`, containing the `cattle-system`, `ingress-nginx`, `kube-public`, and `kube-system` namespaces

-
 It may take a few minutes for the node to be registered in your cluster.

 #### Add Linux Worker Node

 In this section, we run a command to register the Linux worker node to the cluster.

-After the initial provisioning of your cluster, your cluster only has a single Linux host. Next, we add another Linux `worker` host, which will be used to support _Rancher cluster agent_, _Metrics server_, _DNS_ and _Ingress_ for your cluster.
+After the initial provisioning of your cluster, your cluster only has a single Linux host. Add another Linux `worker` host to support the _Rancher cluster agent_, _Metrics server_, _DNS_ and _Ingress_ for your cluster.

-1. In the upper left corner, click **☰ > Cluster Management**.
-1. Go to the cluster that you created and click **⋮ > Edit Config**.
-1. Scroll down to **Node Operating System**. Choose **Linux**.
-1. In the **Customize Node Run Command** section, go to the **Node Options** and select the **Worker** role.
-1. Copy the command displayed on screen to your clipboard.
-1. Log in to your Linux host using a remote Terminal connection. Run the command copied to your clipboard.
-1. From **Rancher**, click **Save**.
+1. After cluster creation, navigate to the **Registration** tab.
+1. In **Step 1** under the **Node Role** section, select **Worker**.
+1. Optional: If you click **Show advanced options,** you can customize the settings for the [Rancher agent](../../../../reference-guides/cluster-configuration/rancher-server-configuration/use-existing-nodes/rancher-agent-options.md) and [node labels.](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/)
+1. In **Step 2**, under the **Registration** section, copy the command displayed on the screen to your clipboard.
+1. SSH into your Linux host and run the command that you copied to your clipboard.

 **Result:** The **Worker** role is installed on your Linux host, and the node registers with Rancher. It may take a few minutes for the node to be registered in your cluster.

@@ -257,14 +225,15 @@ For each Linux worker node added into the cluster, the following taints will be

 In this section, we run a command to register the Windows worker node to the cluster.

-You can add Windows hosts to the cluster by editing the cluster and choosing the **Windows** option.
+:::note
+The registration command to add the Windows workers only appears after the cluster is running with Linux etcd, control plane, and worker nodes.
+:::

-1. In the upper left corner, click **☰ > Cluster Management**.
-1. Go to the cluster that you created and click **⋮ > Edit Config**.
-1. Scroll down to **Node Operating System**. Choose **Windows**. Note: You will see that the **worker** role is the only available role.
-1. Copy the command displayed on screen to your clipboard.
+1. After cluster creation, navigate to the **Registration** tab.
+1. In **Step 1** under the **Node Role** section, select **Worker**.
+1. Optional: If you click **Show advanced options,** you can customize the settings for the [Rancher agent](../../../../reference-guides/cluster-configuration/rancher-server-configuration/use-existing-nodes/rancher-agent-options.md) and [node labels.](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/)
+1. In **Step 2**, under the **Registration** section, copy the command for Windows workers displayed on the screen to your clipboard.
 1. Log in to your Windows host using your preferred tool, such as [Microsoft Remote Desktop](https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/remote-desktop-clients). Run the command copied to your clipboard in the **Command Prompt (CMD)**.
-1. From Rancher, click **Save**.
 1. Optional: Repeat these instructions if you want to add more Windows nodes to your cluster.

 **Result:** The **Worker** role is installed on your Windows host, and the node registers with Rancher. It may take a few minutes for the node to be registered in your cluster. You now have a Windows Kubernetes cluster.
@@ -21,7 +21,7 @@ The available cloud providers to create a node template are decided based on act

 ### Node Templates

-A node template is the saved configuration for the parameters to use when provisioning nodes in a specific cloud provider. These nodes can be launched from the UI. Rancher uses [Docker Machine](https://docs.docker.com/machine/) to provision these nodes. The available cloud providers to create node templates are based on the active node drivers in Rancher.
+A node template is the saved configuration for the parameters to use when provisioning nodes in a specific cloud provider. These nodes can be launched from the UI. Rancher uses [Docker Machine](https://github.com/docker/docs/blob/vnext-engine/machine/overview.md) to provision these nodes. The available cloud providers to create node templates are based on the active node drivers in Rancher.

 After you create a node template in Rancher, it's saved so that you can use this template again to create node pools. Node templates are bound to your login. After you add a template, you can remove them from your user profile.

@@ -23,7 +23,7 @@ You need a separate kubeconfig file for each cluster that you have access to in

 After you download the kubeconfig file, you are able to use the kubeconfig file and its Kubernetes [contexts](https://kubernetes.io/docs/reference/kubectl/cheatsheet/#kubectl-context-and-configuration) to access your downstream cluster.

-If admins have [kubeconfig token generation turned off](../../../../api/api-tokens.md#disable-tokens-in-generated-kubeconfigs), the kubeconfig file requires that the [Rancher CLI](./authorized-cluster-endpoint.md) to be present in your PATH.
+If admins have [kubeconfig token generation turned off](../../../../api/api-tokens.md#disable-tokens-in-generated-kubeconfigs), the kubeconfig file requires that the [Rancher CLI](../../../../reference-guides/cli-with-rancher/rancher-cli.md) to be present in your PATH.

 ### Two Authentication Methods for RKE Clusters

@@ -19,7 +19,7 @@ To provision new storage for your workloads, follow these steps:
 1. [Add a storage class and configure it to use your storage.](#1-add-a-storage-class-and-configure-it-to-use-your-storage)
 2. [Use the Storage Class for Pods Deployed with a StatefulSet.](#2-use-the-storage-class-for-pods-deployed-with-a-statefulset)

-### Prerequisites
+## Prerequisites

 - To set up persistent storage, the `Manage Volumes` [role](../../../authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md#project-role-reference) is required.
 - If you are provisioning storage for a cluster hosted in the cloud, the storage and cluster hosts must have the same cloud provider.
@@ -42,7 +42,7 @@ hostPath | `host-path`

 To use a storage provisioner that is not on the above list, you will need to use a [feature flag to enable unsupported storage drivers.](../../../../advanced-user-guides/enable-experimental-features/unsupported-storage-drivers.md)

-### 1. Add a storage class and configure it to use your storage
+## 1. Add a storage class and configure it to use your storage

 These steps describe how to set up a storage class at the cluster level.

@@ -59,7 +59,7 @@ These steps describe how to set up a storage class at the cluster level.

 For full information about the storage class parameters, refer to the official [Kubernetes documentation.](https://kubernetes.io/docs/concepts/storage/storage-classes/#parameters).

-### 2. Use the Storage Class for Pods Deployed with a StatefulSet
+## 2. Use the Storage Class for Pods Deployed with a StatefulSet

 StatefulSets manage the deployment and scaling of Pods while maintaining a sticky identity for each Pod. In this StatefulSet, we will configure a VolumeClaimTemplate. Each Pod managed by the StatefulSet will be deployed with a PersistentVolumeClaim based on this VolumeClaimTemplate. The PersistentVolumeClaim will refer to the StorageClass that we created. Therefore, when each Pod managed by the StatefulSet is deployed, it will be bound to dynamically provisioned storage using the StorageClass defined in its PersistentVolumeClaim.

@@ -88,4 +88,4 @@ To attach the PVC to an existing workload,
 1. In the **Mount Point** field, enter the path that the workload will use to access the volume.
 1. Click **Save**.

-**Result:** The workload will make a request for the specified amount of disk space to the Kubernetes master. If a PV with the specified resources is available when the workload is deployed, the Kubernetes master will bind the PV to the PVC. If not, Rancher will provision new persistent storage.
+**Result:** The workload will make a request for the specified amount of disk space to the Kubernetes master. If a PV with the specified resources is available when the workload is deployed, the Kubernetes master will bind the PV to the PVC. If not, Rancher will provision new persistent storage.
@@ -20,12 +20,12 @@ To set up storage, follow these steps:
 2. [Add a PersistentVolume that refers to the persistent storage.](#2-add-a-persistentvolume-that-refers-to-the-persistent-storage)
 3. [Use the Storage Class for Pods Deployed with a StatefulSet.](#3-use-the-storage-class-for-pods-deployed-with-a-statefulset)

-### Prerequisites
+## Prerequisites

 - To create a persistent volume as a Kubernetes resource, you must have the `Manage Volumes` [role.](../../../authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md#project-role-reference)
 - If you are provisioning storage for a cluster hosted in the cloud, the storage and cluster hosts must have the same cloud provider.

-### 1. Set up persistent storage
+## 1. Set up persistent storage

 Creating a persistent volume in Rancher will not create a storage volume. It only creates a Kubernetes resource that maps to an existing volume. Therefore, before you can create a persistent volume as a Kubernetes resource, you must have storage provisioned.

@@ -33,7 +33,7 @@ The steps to set up a persistent storage device will differ based on your infras

 If you have a pool of block storage, and you don't want to use a cloud provider, Longhorn could help you provide persistent storage to your Kubernetes cluster. For more information, see [Cloud Native Storage with Longhorn](../../../../../integrations-in-rancher/longhorn/longhorn.md).

-### 2. Add a PersistentVolume that refers to the persistent storage
+## 2. Add a PersistentVolume that refers to the persistent storage

 These steps describe how to set up a PersistentVolume at the cluster level in Kubernetes.

@@ -52,7 +52,7 @@ These steps describe how to set up a PersistentVolume at the cluster level in Ku
 **Result:** Your new persistent volume is created.


-### 3. Use the Storage Class for Pods Deployed with a StatefulSet
+## 3. Use the Storage Class for Pods Deployed with a StatefulSet

 StatefulSets manage the deployment and scaling of Pods while maintaining a sticky identity for each Pod. In this StatefulSet, we will configure a VolumeClaimTemplate. Each Pod managed by the StatefulSet will be deployed with a PersistentVolumeClaim based on this VolumeClaimTemplate. The PersistentVolumeClaim will refer to the PersistentVolume that we created. Therefore, when each Pod managed by the StatefulSet is deployed, it will be bound a PersistentVolume as defined in its PersistentVolumeClaim.

@@ -86,4 +86,4 @@ The following steps describe how to assign persistent storage to an existing wor
 1. In the **Mount Point** field, enter the path that the workload will use to access the volume.
 1. Click **Launch**.

-**Result:** The workload will make a request for the specified amount of disk space to the Kubernetes master. If a PV with the specified resources is available when the workload is deployed, the Kubernetes master will bind the PV to the PVC.
+**Result:** The workload will make a request for the specified amount of disk space to the Kubernetes master. If a PV with the specified resources is available when the workload is deployed, the Kubernetes master will bind the PV to the PVC.
@@ -173,12 +173,12 @@ To add members:

 ### 4. Optional: Add Resource Quotas

-Resource quotas limit the resources that a project (and its namespaces) can consume. For more information, see [Resource Quotas](projects-and-namespaces.md).
+Resource quotas limit the resources that a project (and its namespaces) can consume. For more information, see [Resource Quotas](../../advanced-user-guides/manage-projects/manage-project-resource-quotas/manage-project-resource-quotas.md).

 To add a resource quota,

 1. In the **Resource Quotas** tab, click **Add Resource**.
-1. Select a **Resource Type**. For more information, see [Resource Quotas.](projects-and-namespaces.md).
+1. Select a **Resource Type**. For more information, see [Resource Quotas.](../../advanced-user-guides/manage-projects/manage-project-resource-quotas/manage-project-resource-quotas.md).
 1. Enter values for the **Project Limit** and the **Namespace Default Limit**.
 1. **Optional:** Specify **Container Default Resource Limit**, which will be applied to every container started in the project. The parameter is recommended if you have CPU or Memory limits set by the Resource Quota. It can be overridden on per an individual namespace or a container level. For more information, see [Container Default Resource Limit](../../advanced-user-guides/manage-projects/manage-project-resource-quotas/manage-project-resource-quotas.md)
 1. Click **Create**.
@@ -25,7 +25,7 @@ To manage permissions in a vanilla Kubernetes cluster, cluster admins configure

 :::note

-If you create a namespace with `kubectl`, it may be unusable because `kubectl` doesn't require your new namespace to be scoped within a project that you have access to. If your permissions are restricted to the project level, it is better to [create a namespace through Rancher](manage-namespaces.md) to ensure that you will have permission to access the namespace.
+If you create a namespace with `kubectl`, it may be unusable because `kubectl` doesn't require your new namespace to be scoped within a project that you have access to. If your permissions are restricted to the project level, it is better to [create a namespace through Rancher](#creating-namespaces) to ensure that you will have permission to access the namespace.

 :::

@@ -19,6 +19,7 @@ In order to deploy and run the adapter successfully, you need to ensure its vers

 | Rancher Version | Adapter Version  |
 |-----------------|------------------|
+| v2.9.3          | v104.0.0+up4.0.0 |
 | v2.9.2          | v104.0.0+up4.0.0 |
 | v2.9.1          | v104.0.0+up4.0.0 |
 | v2.9.0          | v104.0.0+up4.0.0 |
@@ -45,7 +45,7 @@ To configure the resources allocated to an Istio component,
 1. In the left navigation bar, click **Apps**.
 1. Click **Installed Apps**.
 1. Go to the `istio-system` namespace. In one of the Istio workloads, such as `rancher-istio`, click **⋮ > Edit/Upgrade**.
-1. Click **Upgrade** to edit the base components via changes to the values.yaml or add an [overlay file](configuration-options/configuration-options.md#overlay-file). For more information about editing the overlay file, see [this section.](cpu-and-memory-allocations.md#editing-the-overlay-file)
+1. Click **Upgrade** to edit the base components via changes to the values.yaml or add an [overlay file](configuration-options/configuration-options.md#overlay-file). For more information about editing the overlay file, see [this section.](#editing-the-overlay-file)
 1. Change the CPU or memory allocations, the nodes where each component will be scheduled to, or the node tolerations.
 1. Click **Upgrade**. to rollout changes

@@ -95,4 +95,4 @@ If any value not described above is returned, Rancher Logging will not be able t
 * Reboot your machine.
 * Set `systemdLogPath` to `/run/log/journal`.

-:::
+:::
@@ -8,11 +8,11 @@ title: DigitalOcean Node Template Configuration

 Account access information is stored as a cloud credential. Cloud credentials are stored as Kubernetes secrets. Multiple node templates can use the same cloud credential. You can use an existing cloud credential or create a new one.

-### Droplet Options
+## Droplet Options

 The **Droplet Options** provision your cluster's geographical region and specifications.

-### Docker Daemon
+## Docker Daemon

 If you use Docker, the [Docker daemon](https://docs.docker.com/engine/docker-overview/#the-docker-daemon) configuration options include:

@@ -8,11 +8,11 @@ title: Private Clusters

 In GKE, [private clusters](https://cloud.google.com/kubernetes-engine/docs/concepts/private-cluster-concept) are clusters whose nodes are isolated from inbound and outbound traffic by assigning them internal IP addresses only. Private clusters in GKE have the option of exposing the control plane endpoint as a publicly accessible address or as a private address. This is different from other Kubernetes providers, which may refer to clusters with private control plane endpoints as "private clusters" but still allow traffic to and from nodes. You may want to create a cluster with private nodes, with or without a public control plane endpoint, depending on your organization's networking and security requirements. A GKE cluster provisioned from Rancher can use isolated nodes by selecting "Private Cluster" in the Cluster Options (under "Show advanced options"). The control plane endpoint can optionally be made private by selecting "Enable Private Endpoint".

-### Private Nodes
+## Private Nodes

 Because the nodes in a private cluster only have internal IP addresses, they will not be able to install the cluster agent and Rancher will not be able to fully manage the cluster. This can be overcome in a few ways.

-#### Cloud NAT
+### Cloud NAT

 :::caution

@@ -22,7 +22,7 @@ Cloud NAT will [incur charges](https://cloud.google.com/nat/pricing).

 If restricting outgoing internet access is not a concern for your organization, use Google's [Cloud NAT](https://cloud.google.com/nat/docs/using-nat) service to allow nodes in the private network to access the internet, enabling them to download the required images from Docker Hub and contact the Rancher management server. This is the simplest solution.

-#### Private registry
+### Private Registry

 :::caution

@@ -32,11 +32,11 @@ This scenario is not officially supported, but is described for cases in which u

 If restricting both incoming and outgoing traffic to nodes is a requirement, follow the air-gapped installation instructions to set up a private container image [registry](../../../../getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/air-gapped-helm-cli-install.md) on the VPC where the cluster is going to be, allowing the cluster nodes to access and download the images they need to run the cluster agent. If the control plane endpoint is also private, Rancher will need [direct access](#direct-access) to it.

-### Private Control Plane Endpoint
+## Private Control Plane Endpoint

 If the cluster has a public endpoint exposed, Rancher will be able to reach the cluster, and no additional steps need to be taken. However, if the cluster has no public endpoint, then considerations must be made to ensure Rancher can access the cluster.

-#### Cloud NAT
+### Cloud NAT

 :::caution

@@ -47,7 +47,7 @@ Cloud NAT will [incur charges](https://cloud.google.com/nat/pricing).
 As above, if restricting outgoing internet access to the nodes is not a concern, then Google's [Cloud NAT](https://cloud.google.com/nat/docs/using-nat) service can be used to allow the nodes to access the internet. While the cluster is provisioning, Rancher will provide a registration command to run on the cluster. Download the [kubeconfig](https://cloud.google.com/kubernetes-engine/docs/how-to/cluster-access-for-kubectl) for the new cluster and run the provided kubectl command on the cluster. Gaining access
 to the cluster in order to run this command can be done by creating a temporary node or using an existing node in the VPC, or by logging on to or creating an SSH tunnel through one of the cluster nodes.

-#### Direct access
+### Direct Access

 If the Rancher server is run on the same VPC as the cluster's control plane, it will have direct access to the control plane's private endpoint. The cluster nodes will need to have access to a [private registry](#private-registry) to download images as described above.

@@ -26,18 +26,18 @@ Prometheus Federator is designed to be deployed alongside an existing Prometheus
 2. On seeing each ProjectHelmChartCR, the operator will automatically deploy a Project Prometheus stack on the Project Owner's behalf in the **Project Release Namespace (`cattle-project-<id>-monitoring`)** based on a HelmChart CR and a HelmRelease CR automatically created by the ProjectHelmChart controller in the **Operator / System Namespace**.
 3. RBAC will automatically be assigned in the Project Release Namespace to allow users to view the Prometheus, Alertmanager, and Grafana UIs of the Project Monitoring Stack deployed; this will be based on RBAC defined on the Project Registration Namespace against the [default Kubernetes user-facing roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles). For more information, see the section on [configuring RBAC](rbac.md).

-### What is a Project?
+## What is a Project?

 In Prometheus Federator, a Project is a group of namespaces that can be identified by a `metav1.LabelSelector`. By default, the label used to identify projects is `field.cattle.io/projectId`, the label used to identify namespaces that are contained within a given Rancher Project.

-### Configuring the Helm release created by a ProjectHelmChart
+## Configuring the Helm release created by a ProjectHelmChart

 The `spec.values` of this ProjectHelmChart's resources will correspond to the `values.yaml` override to be supplied to the underlying Helm chart deployed by the operator on the user's behalf; to see the underlying chart's `values.yaml` spec, either:

 - View the chart's definition located at [`rancher/prometheus-federator` under `charts/rancher-project-monitoring`](https://github.com/rancher/prometheus-federator/blob/main/charts/rancher-project-monitoring) (where the chart version will be tied to the version of this operator).
 - Look for the ConfigMap named `monitoring.cattle.io.v1alpha1` that is automatically created in each Project Registration Namespace, which will contain both the `values.yaml` and `questions.yaml` that was used to configure the chart (which was embedded directly into the `prometheus-federator` binary).

-### Namespaces
+## Namespaces

 As a Project Operator based on [rancher/helm-project-operator](https://github.com/rancher/helm-project-operator), Prometheus Federator has three different classifications of namespaces that the operator looks out for:

@@ -65,7 +65,7 @@ As a Project Operator based on [rancher/helm-project-operator](https://github.co

    :::

-### Helm Resources (HelmChart, HelmRelease)
+## Helm Resources (HelmChart, HelmRelease)

 On deploying a ProjectHelmChart, the Prometheus Federator will automatically create and manage two child custom resources that manage the underlying Helm resources in turn:

@@ -103,6 +103,6 @@ For more information on advanced configurations, refer to [this page](https://gi
 |`helmProjectOperator.hardenedNamespaces.configuration`| The configuration to be supplied to the default ServiceAccount or auto-generated NetworkPolicy on managing a namespace. |
 -->

-### Prometheus Federator on the Local Cluster
+## Prometheus Federator on the Local Cluster

 Prometheus Federator is a resource intensive application. Installing it to the local cluster is possible, but **not recommended**.
@@ -21,7 +21,7 @@ The following descriptions correspond to the numbers in the diagram above:
 3. [Node Agents](#3-node-agents)
 4. [Authorized Cluster Endpoint](#4-authorized-cluster-endpoint)

-### 1. The Authentication Proxy
+## 1. The Authentication Proxy

 In this diagram, a user named Bob wants to see all pods running on a downstream user cluster called User Cluster 1. From within Rancher, he can run a `kubectl` command to see
 the pods. Bob is authenticated through Rancher's authentication proxy.
@@ -32,7 +32,7 @@ Rancher communicates with Kubernetes clusters using a [service account](https://

 By default, Rancher generates a [kubeconfig file](../../how-to-guides/new-user-guides/manage-clusters/access-clusters/use-kubectl-and-kubeconfig.md) that contains credentials for proxying through the Rancher server to connect to the Kubernetes API server on a downstream user cluster. The kubeconfig file (`kube_config_rancher-cluster.yml`) contains full access to the cluster.

-### 2. Cluster Controllers and Cluster Agents
+## 2. Cluster Controllers and Cluster Agents

 Each downstream user cluster has a cluster agent, which opens a tunnel to the corresponding cluster controller within the Rancher server.

@@ -52,13 +52,13 @@ The cluster agent, also called `cattle-cluster-agent`, is a component that runs
 -  Applies the roles and bindings defined in each cluster's global policies
 - Communicates between the cluster and Rancher server (through a tunnel to the cluster controller) about events, stats, node info, and health

-### 3. Node Agents
+## 3. Node Agents

 If the cluster agent (also called `cattle-cluster-agent`) is not available, one of the node agents creates a tunnel to the cluster controller to communicate with Rancher.

 The `cattle-node-agent` is deployed using a [DaemonSet](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/) resource to make sure it runs on every node in a Rancher-launched Kubernetes cluster. It is used to interact with the nodes when performing cluster operations. Examples of cluster operations include upgrading the Kubernetes version and creating or restoring etcd snapshots.

-### 4. Authorized Cluster Endpoint
+## 4. Authorized Cluster Endpoint

 An authorized cluster endpoint (ACE) allows users to connect to the Kubernetes API server of a downstream cluster without having to route their requests through the Rancher authentication proxy.

@@ -6,7 +6,7 @@ title: Kubernetes Security Best Practices
  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/reference-guides/rancher-security/kubernetes-security-best-practices"/>
 </head>

-### Restricting cloud metadata API access
+## Restricting Cloud Metadata API Access

 Cloud providers such as AWS, Azure, DigitalOcean or GCP often expose metadata services locally to instances. By default, this endpoint is accessible by pods running on a cloud instance, including pods in hosted Kubernetes providers such as EKS, AKS, DigitalOcean Kubernetes or GKE, and can contain cloud credentials for that node, provisioning data such as kubelet credentials, or other sensitive data. To mitigate this risk when running on a cloud platform, follow the [Kubernetes security recommendations](https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/#restricting-cloud-metadata-api-access): limit permissions given to instance credentials, use network policies to restrict pod access to the metadata API, and avoid using provisioning data to deliver secrets.

@@ -27,11 +27,11 @@ Security is at the heart of all Rancher features. From integrating with all the

 On this page, we provide security related documentation along with resources to help you secure your Rancher installation and your downstream Kubernetes clusters.

-### NeuVector Integration with Rancher
+## NeuVector Integration with Rancher

 NeuVector is an open-source, container-focused security application that is now integrated into Rancher. NeuVector provides production security, DevOps vulnerability protection, and a container firewall, et al. Please see the [Rancher docs](../../integrations-in-rancher/neuvector/neuvector.md) and the [NeuVector docs](https://open-docs.neuvector.com/) for more information.

-### Running a CIS Security Scan on a Kubernetes Cluster
+## Running a CIS Security Scan on a Kubernetes Cluster

 Rancher leverages [kube-bench](https://github.com/aquasecurity/kube-bench) to run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the [CIS](https://www.cisecurity.org/cis-benchmarks/) (Center for Internet Security) Kubernetes Benchmark.

@@ -47,13 +47,13 @@ When Rancher runs a CIS security scan on a cluster, it generates a report showin

 For details, refer to the section on [security scans](../../how-to-guides/advanced-user-guides/cis-scan-guides/cis-scan-guides.md).

-### SELinux RPM
+## SELinux RPM

 [Security-Enhanced Linux (SELinux)](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) is a security enhancement to Linux. After being historically used by government agencies, SELinux is now industry standard and is enabled by default on CentOS 7 and 8.

 We provide two RPMs (Red Hat packages) that enable Rancher products to function properly on SELinux-enforcing hosts: `rancher-selinux` and `rke2-selinux`. For details, see [this page](selinux-rpm/selinux-rpm.md).

-### Rancher Hardening Guide
+## Rancher Hardening Guide

 The Rancher Hardening Guide is based on controls and best practices found in the <a href="https://www.cisecurity.org/benchmark/kubernetes/" target="_blank">CIS Kubernetes Benchmark</a> from the Center for Internet Security.

@@ -63,7 +63,7 @@ The hardening guides provide prescriptive guidance for hardening a production in

 Each version of the hardening guide is intended to be used with specific versions of the CIS Kubernetes Benchmark, Kubernetes, and Rancher.

-### The CIS Benchmark and Self-Assessment
+## The CIS Benchmark and Self-Assessment

 The benchmark self-assessment is a companion to the Rancher security hardening guide. While the hardening guide shows you how to harden the cluster, the benchmark guide is meant to help you evaluate the level of security of the hardened cluster.

@@ -71,7 +71,7 @@ Because Rancher and RKE install Kubernetes services as Docker containers, many o

 Each version of Rancher's self-assessment guide corresponds to specific versions of the hardening guide, Rancher, Kubernetes, and the CIS Benchmark.

-### Third-party Penetration Test Reports
+## Third-party Penetration Test Reports

 Rancher periodically hires third parties to perform security audits and penetration tests of the Rancher software stack. The environments under test follow the Rancher provided hardening guides at the time of the testing. Previous penetration test reports are available below.

@@ -82,14 +82,14 @@ Results:

 Please note that new reports are no longer shared or made publicly available.

-### Rancher Security Advisories and CVEs
+## Rancher Security Advisories and CVEs

 Rancher is committed to informing the community of security issues in our products. For the list of CVEs (Common Vulnerabilities and Exposures) for issues we have resolved, refer to [this page.](security-advisories-and-cves.md)

-### Kubernetes Security Best Practices
+## Kubernetes Security Best Practices

 For recommendations on securing your Kubernetes cluster, refer to the [Kubernetes Security Best Practices](kubernetes-security-best-practices.md) guide.

-### Rancher Security Best Practices
+## Rancher Security Best Practices

 For recommendations on securing your Rancher Manager deployments, refer to the [Rancher Security Best Practices](rancher-security-best-practices.md) guide.
@@ -10,11 +10,11 @@ Rancher is committed to informing the community of security issues in our produc

 | ID | Description | Date | Resolution |
 |----|-------------|------|------------|
+[CVE-2024-22030](https://github.com/rancher/rancher/security/advisories/GHSA-h4h5-9833-v2p4) | A high severity vulnerability was discovered in Rancher's agents that under very specific circumstances allows a malicious actor to take over existing Rancher nodes. The attacker needs to have control of an expired domain or execute a DNS spoofing/hijacking attack against the domain in order to exploit this vulnerability. The targeted domain is the one used as the Rancher URL (the `server-url` of the Rancher cluster). | 19 Sep 2024 | Rancher [v2.9.2](https://github.com/rancher/rancher/releases/tag/v2.9.2), [v2.8.8](https://github.com/rancher/rancher/releases/tag/v2.8.8) and [v2.7.15](https://github.com/rancher/rancher/releases/tag/v2.7.15) |
 | [CVE-2024-22032](https://github.com/rancher/rancher/security/advisories/GHSA-q6c7-56cq-g2wm) | An issue was discovered in Rancher versions up to and including 2.7.13 and 2.8.4, where custom secrets encryption configurations are stored in plaintext under the clusters `AppliedSpec`. This also causes clusters to continuously reconcile, as the `AppliedSpec` would never match the desired cluster `Spec`. The stored information contains the encryption configuration for secrets within etcd, and could potentially expose sensitive data if the etcd database was exposed directly. | 17 Jun 2024 | Rancher [v2.8.5](https://github.com/rancher/rancher/releases/tag/v2.8.5) and [v2.7.14](https://github.com/rancher/rancher/releases/tag/v2.7.14) |
 | [CVE-2023-32196](https://github.com/rancher/rancher/security/advisories/GHSA-64jq-m7rq-768h) | An issue was discovered in Rancher versions up to and including 2.7.13 and 2.8.4, where the webhook rule resolver ignores rules from a `ClusterRole` for an external `RoleTemplate` set with `.context=project` or `.context=""`. This allows a user to create an external `ClusterRole` with `.context=project` or `.context=""`, depending on the use of the new feature flag `external-rules` and backing `ClusterRole`. | 17 Jun 2024 | Rancher [v2.8.5](https://github.com/rancher/rancher/releases/tag/v2.8.5) and [v2.7.14](https://github.com/rancher/rancher/releases/tag/v2.7.14) |
 | [CVE-2023-22650](https://github.com/rancher/rancher/security/advisories/GHSA-9ghh-mmcq-8phc) | An issue was discovered in Rancher versions up to and including 2.7.13 and 2.8.4, where Rancher did not have a user retention process for when external authentication providers are used, that could be configured to run periodically and disable and/or delete inactive users. The new user retention process added in Rancher v2.8.5 and Rancher v2.7.14 is disabled by default. If enabled, a user becomes subject to the retention process if they don't log in for a configurable period of time. It's possible to set overrides for user accounts that are primarily intended for programmatic access (e.g. CI, scripts, etc.) so that they don't become subject to the retention process for a longer period of time or at all. | 17 Jun 2024 | Rancher [v2.8.5](https://github.com/rancher/rancher/releases/tag/v2.8.5) and [v2.7.14](https://github.com/rancher/rancher/releases/tag/v2.7.14) |
 | [CVE-2023-32191](https://github.com/rancher/rke/security/advisories/GHSA-6gr4-52w6-vmqx) | An issue was discovered in Rancher versions up to and including 2.7.13 and 2.8.4, in which supported RKE versions store credentials inside a ConfigMap that can be accessible by non-administrative users in Rancher. This vulnerability only affects an RKE-provisioned cluster. | 17 Jun 2024 | Rancher [v2.8.5](https://github.com/rancher/rancher/releases/tag/v2.8.5) and [v2.7.14](https://github.com/rancher/rancher/releases/tag/v2.7.14) |
-| [CVE-2024-22030](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22030) | A vulnerability was discovered in Rancher's and Fleet's agents, currently deemed a medium to high severity CVE, that under very specific circumstances allows a malicious actor to take over existing Rancher nodes. The attacker would need to have control of an expired domain or execute a DNS spoofing/hijacking attack against the domain in order to exploit this vulnerability. The targeted domain is the one used as the Rancher URL (the server-url of the Rancher cluster). At the moment there is no fix available and it affects all supported versions of Rancher. Customers and users are advised to follow the recommendations and best practices described in our [blog post](https://www.suse.com/c/rancher-security-update/). | 16 Feb 2024 | Pending |
 | [CVE-2023-32193](https://github.com/rancher/norman/security/advisories/GHSA-r8f4-hv23-6qp6) | An issue was discovered in Rancher versions up to and including 2.6.13, 2.7.9 and 2.8.1, where multiple Cross-Site Scripting (XSS) vulnerabilities can be exploited via the Rancher UI (Norman). | 8 Feb 2024 | Rancher [v2.8.2](https://github.com/rancher/rancher/releases/tag/v2.8.2), [v2.7.10](https://github.com/rancher/rancher/releases/tag/v2.7.10) and [v2.6.14](https://github.com/rancher/rancher/releases/tag/v2.6.14) |
 | [CVE-2023-32192](https://github.com/rancher/apiserver/security/advisories/GHSA-833m-37f7-jq55) | An issue was discovered in Rancher versions up to and including 2.6.13, 2.7.9 and 2.8.1, where multiple Cross-Site Scripting (XSS) vulnerabilities can be exploited via the Rancher UI (Apiserver). | 8 Feb 2024 | Rancher [v2.8.2](https://github.com/rancher/rancher/releases/tag/v2.8.2), [v2.7.10](https://github.com/rancher/rancher/releases/tag/v2.7.10) and [v2.6.14](https://github.com/rancher/rancher/releases/tag/v2.6.14) |
 | [CVE-2023-22649](https://github.com/rancher/rancher/security/advisories/GHSA-xfj7-qf8w-2gcr) | An issue was discovered in Rancher versions up to and including 2.6.13, 2.7.9 and 2.8.1, in which sensitive data may be leaked into Rancher's audit logs. | 8 Feb 2024 | Rancher [v2.8.2](https://github.com/rancher/rancher/releases/tag/v2.8.2), [v2.7.10](https://github.com/rancher/rancher/releases/tag/v2.7.10) and [v2.6.14](https://github.com/rancher/rancher/releases/tag/v2.6.14) |
@@ -20,6 +20,7 @@ Each Rancher version is designed to be compatible with a single version of the w

 | Rancher Version | Webhook Version | Availability in Prime | Availability in Community |
 |-----------------|-----------------|-----------------------|---------------------------|
+| v2.9.3          |     v0.5.3      | &check;               | &check;                   |
 | v2.9.2          |     v0.5.2      | &check;               | &check;                   |
 | v2.9.1          |     v0.5.1      | &check;               | &check;                   |
 | v2.9.0          |     v0.5.0      | &cross;               | &check;                   |
@@ -126,6 +127,8 @@ The webhook provides extra validations on [namespaces](https://github.com/ranche
 - A user account with the proper permissions can pre-create the namespace with the appropriate configuration.
  - This option depends on the ability of the application to handle existing resources.

+Another one of these validations ensures that the user has the proper permissions to update the `field.cattle.io/projectId` annotation on a namespace. This is the `manage-namespaces` permission for `projects` in `management.cattle.io`.
+
 ## Issues on Specific Versions

 **Note:** The following is an incomplete list of high-severity issues affecting specific Rancher/webhook versions. In most cases, these issues can be resolved by upgrading to a more recent Rancher version.
@@ -6,7 +6,7 @@ title: Advanced Options for Docker Installs
  <link rel="canonical" href="https://ranchermanager.docs.rancher.com/reference-guides/single-node-rancher-in-docker/advanced-options"/>
 </head>

-### Custom CA Certificate
+## Custom CA Certificate

 If you want to configure Rancher to use a CA root certificate to be used when validating services, you would start the Rancher container sharing the directory that contains the CA root certificate.

@@ -30,7 +30,7 @@ docker run -d --restart=unless-stopped \
  rancher/rancher:latest
 ```

-### API Audit Log
+## API Audit Log

 The API Audit Log records all the user and system transactions made through Rancher server.

@@ -49,7 +49,7 @@ docker run -d --restart=unless-stopped \
  rancher/rancher:latest
 ```

-### TLS settings
+## TLS settings

 To set a different TLS configuration, you can use the `CATTLE_TLS_MIN_VERSION` and `CATTLE_TLS_CIPHERS` environment variables. For example, to configure TLS 1.0 as minimum accepted TLS version:

@@ -65,7 +65,7 @@ Privileged access is [required.](../../getting-started/installation-and-upgrade/

 See [TLS settings](../../getting-started/installation-and-upgrade/installation-references/tls-settings.md) for more information and options.

-### Air Gap
+## Air Gap

 If you are visiting this page to complete an air gap installation, you must prepend your private registry URL to the server tag when running the installation command in the option that you choose. Add `<REGISTRY.DOMAIN.COM:PORT>` with your private registry URL in front of `rancher/rancher:latest`.

@@ -73,7 +73,7 @@ If you are visiting this page to complete an air gap installation, you must prep

     <REGISTRY.DOMAIN.COM:PORT>/rancher/rancher:latest

-### Persistent Data
+## Persistent Data

 Rancher uses etcd as a datastore. When Rancher is installed with Docker, the embedded etcd is being used. The persistent data is at the following path in the container: `/var/lib/rancher`.

@@ -89,7 +89,7 @@ docker run -d --restart=unless-stopped \

 Privileged access is [required.](../../getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker/rancher-on-a-single-node-with-docker.md#privileged-access-for-rancher)

-### Running `rancher/rancher` and `rancher/rancher-agent` on the Same Node
+## Running `rancher/rancher` and `rancher/rancher-agent` on the Same Node

 In the situation where you want to use a single node to run Rancher and to be able to add the same node to a cluster, you have to adjust the host ports mapped for the `rancher/rancher` container.

@@ -10,14 +10,15 @@ For Rancher versions that have `rancher-webhook` installed, certain versions cre

 In Rancher v2.6.3 and up, rancher-webhook deployments will automatically renew their TLS certificate when it is within 30 or fewer days of its expiration date. If you are using v2.6.2 or below, there are two methods to work around this issue:

-##### 1. Users with cluster access, run the following commands:
+## 1. Users with Cluster Access, Run the Following Commands:
+
 ```
 kubectl delete secret -n cattle-system cattle-webhook-tls
 kubectl delete mutatingwebhookconfigurations.admissionregistration.k8s.io --ignore-not-found=true rancher.cattle.io
 kubectl delete pod -n cattle-system -l app=rancher-webhook
 ```

-##### 2. Users with no cluster access via `kubectl`:
+## 2. Users with No Cluster Access Via `kubectl`:

 1. Delete the `cattle-webhook-tls` secret in the `cattle-system` namespace in the local cluster.

@@ -10,11 +10,12 @@ The commands/steps listed on this page can be used to check networking related i

 Make sure you configured the correct kubeconfig (for example, `export KUBECONFIG=$PWD/kube_config_cluster.yml` for Rancher HA) or are using the embedded kubectl via the UI.

-### Double check if all the required ports are opened in your (host) firewall
+## Double Check if All the Required Ports are Opened in Your (Host) Firewall

 Double check if all the [required ports](../../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/node-requirements-for-rancher-managed-clusters.md#networking-requirements) are opened in your (host) firewall. The overlay network uses UDP in comparison to all other required ports which are TCP.

-### Check if overlay network is functioning correctly
+
+## Check if Overlay Network is Functioning Correctly

 The pod can be scheduled to any of the hosts you used for your cluster, but that means that the NGINX ingress controller needs to be able to route the request from `NODE_1` to `NODE_2`. This happens over the overlay network. If the overlay network is not functioning, you will experience intermittent TCP/HTTP connection failures due to the NGINX ingress controller not being able to route to the pod.

@@ -98,7 +99,7 @@ The `swiss-army-knife` container does not support Windows nodes. It also [does n
 6. You can now clean up the DaemonSet by running `kubectl delete ds/overlaytest`.


-### Check if MTU is correctly configured on hosts and on peering/tunnel appliances/devices
+### Check if MTU is Correctly Configured on Hosts and on Peering/Tunnel Appliances/Devices

 When the MTU is incorrectly configured (either on hosts running Rancher, nodes in created/imported clusters or on appliances/devices in between), error messages will be logged in Rancher and in the agents, similar to:

@@ -10,7 +10,7 @@ The commands/steps listed on this page can be used to check your Rancher Kuberne

 Make sure you configured the correct kubeconfig (for example, `export KUBECONFIG=$PWD/kube_config_cluster.yml`).

-### Check Rancher pods
+## Check Rancher Pods

 Rancher pods are deployed as a Deployment in the `cattle-system` namespace.

@@ -31,25 +31,25 @@ rancher-7dbd7875f7-qw7wb   1/1     Running   0          8m    x.x.x.x     x.x.x.

 If a pod is unable to run (Status is not **Running**, Ready status is not showing `1/1` or you see a high count of Restarts), check the pod details, logs and namespace events.

-#### Pod details
+### Pod Details

 ```
 kubectl -n cattle-system describe pods -l app=rancher
 ```

-#### Pod container logs
+### Pod Container Logs

 ```
 kubectl -n cattle-system logs -l app=rancher
 ```

-#### Namespace events
+### Namespace Events

 ```
 kubectl -n cattle-system get events
 ```

-### Check ingress
+## Check Ingress

 Ingress should have the correct `HOSTS` (showing the configured FQDN) and `ADDRESS` (host address(es) it will be routed to).

@@ -64,7 +64,7 @@ NAME      HOSTS                    ADDRESS                   PORTS     AGE
 rancher   rancher.yourdomain.com   x.x.x.x,x.x.x.x,x.x.x.x   80, 443   2m
 ```

-### Check ingress controller logs
+## Check Ingress Controller Logs

 When accessing your configured Rancher FQDN does not show you the UI, check the ingress controller logging to see what happens when you try to access Rancher:

@@ -72,7 +72,7 @@ When accessing your configured Rancher FQDN does not show you the UI, check the
 kubectl -n ingress-nginx logs -l app=ingress-nginx
 ```

-### Leader election
+## Leader Election

 The leader is determined by a leader election process. After the leader has been determined, the leader (`holderIdentity`) is saved in the `cattle-controllers` Lease in the `kube-system` namespace (in this example, `rancher-dbc7ff869-gvg6k`).

@@ -87,7 +87,7 @@ NAME                 HOLDER                    AGE
 cattle-controllers   rancher-dbc7ff869-gvg6k   6h10m
 ```

-#### Configuration
+### Configuration

 _Available as of Rancher 2.8.3_

@@ -10,13 +10,13 @@ The commands/steps listed on this page can be used to check clusters that you ar

 Make sure you configured the correct kubeconfig (for example, `export KUBECONFIG=$PWD/kubeconfig_from_imported_cluster.yml`)

-### Rancher agents
+## Rancher Agents

 Communication to the cluster (Kubernetes API via cattle-cluster-agent) and communication to the nodes is done through Rancher agents.

 If the cattle-cluster-agent cannot connect to the configured `server-url`, the cluster will remain in **Pending** state, showing `Waiting for full cluster configuration`.

-#### cattle-node-agent
+### cattle-node-agent

 :::note

@@ -49,7 +49,7 @@ Check logging of a specific cattle-node-agent pod or all cattle-node-agent pods:
 kubectl -n cattle-system logs -l app=cattle-agent
 ```

-#### cattle-cluster-agent
+### cattle-cluster-agent

 Check if the cattle-cluster-agent pod is present in the cluster, has status **Running** and doesn't have a high count of Restarts:

@@ -20,7 +20,7 @@ Now with this feature, a downstream cluster admin should be able to look at the
 If the audit logs are shipped off of the cluster, a user of the logging system should be able to identify the user in the external Identity Provider system.
 A Rancher Admin should now be able to view Rancher audit logs and follow through to the Kubernetes audit log by using the external Identity Provider username.

-### Feature Description
+## Feature Description

 - When Kubernetes Audit logs are enabled on the downstream cluster, in each event that is logged, the external Identity Provider's username is now logged for each request, at the "metadata" level.
 - When Rancher API Audit logs are enabled on the Rancher installation, the external Identity Provider's username is also logged now at the `auditLog.level=1` for each request that hits the Rancher API server, including the login requests.
@@ -2394,6 +2394,19 @@ module.exports = {
            to: '/how-to-guides/new-user-guides/kubernetes-resources-setup/workloads-and-pods',
            from: '/pages-for-subheaders/workloads-and-pods'
          }, // Redirects for pages-for-subheaders removal [latest] (end)
+
+          { // Redirects for dashboard#12040 (start)
+            to: '/v2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-google-oauth',
+            from: '/v2.9/admin-settings/authentication/google',
+          },
+          {
+            to: '/v2.9/how-to-guides/advanced-user-guides/monitoring-v2-configuration-guides',
+            from: '/v2.9/monitoring-alerting/configuration',
+          }, 
+          {
+            to: '/v2.9/integrations-in-rancher/monitoring-and-alerting',
+            from: '/v2.9/monitoring-alerting',
+          }, // Redirects for dashboard#12040 (end)
          { // Redirects for dashboard#9970
            to: '/v2.8/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/rke1-vs-rke2-differences',
            from: '/v2.8/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/'
@@ -18,15 +18,15 @@ enable_cri_dockerd: true

 <br/>

-Q. 如果要获得 Rancher 对上游 Dockershim 的支持，我需要升级 Rancher 吗？
+Q: 如果要获得 Rancher 对上游 Dockershim 的支持，我需要升级 Rancher 吗？

 对于 RKE，Dockershim 的上游支持从 Kubernetes 1.21 开始。你需要使用 Rancher 2.6 或更高版本才能获取使用 Kubernetes 1.21 的 RKE 的支持。详情请参阅我们的[支持矩阵](https://rancher.com/support-maintenance-terms/all-supported-versions/rancher-v2.6.0/)。

 <br/>

-Q. 我目前的 RKE 使用 Kubernetes 1.20。为了避免出现不再支持 Dockershim 的情况，我是否需要尽早将 RKE 升级到 Kubernetes 1.21？
+Q: 我目前的 RKE 使用 Kubernetes 1.20。为了避免出现不再支持 Dockershim 的情况，我是否需要尽早将 RKE 升级到 Kubernetes 1.21？

-A. 在使用 Kubernetes 1.20 的 RKE 中，Dockershim 版本依然可用，而且在 Kubernetes 1.24 之前不会在上游弃用。Kubernetes 会发出弃用 Dockershim 的警告，而 Rancher 在使用 Kubernetes 1.21 的 RKE 中已经缓解了这个问题。你可以按照计划正常升级到 Kubernetes 1.21，但也应该考虑在升级到 Kubernetes 1.22 时启用外部 Dockershim。在升级到 Kubernetes 1.24 之前，你需要启用外部 Dockershim，此时现有的实现都会被删除。
+A: 在使用 Kubernetes 1.20 的 RKE 中，Dockershim 版本依然可用，而且在 Kubernetes 1.24 之前不会在上游弃用。Kubernetes 会发出弃用 Dockershim 的警告，而 Rancher 在使用 Kubernetes 1.21 的 RKE 中已经缓解了这个问题。你可以按照计划正常升级到 Kubernetes 1.21，但也应该考虑在升级到 Kubernetes 1.22 时启用外部 Dockershim。在升级到 Kubernetes 1.24 之前，你需要启用外部 Dockershim，此时现有的实现都会被删除。

 有关此移除的更多信息以及时间线，请参见 [Kubernetes Dockershim 弃用相关的常见问题](https://kubernetes.io/blog/2020/12/02/dockershim-faq/#when-will-dockershim-be-removed)。

@@ -76,11 +76,11 @@ title: 7 层 NGINX 负载均衡器上的 TLS 终止（Docker 安装）

 1. 输入以下命令：

-       ```
-       docker run -d --restart=unless-stopped \
-       -p 80:80 -p 443:443 \
-       rancher/rancher:latest --no-cacerts
-       ```
+    ```
+    docker run -d --restart=unless-stopped \
+      -p 80:80 -p 443:443 \
+      rancher/rancher:latest --no-cacerts
+    ```

 </details>

@@ -35,7 +35,7 @@ Rancher 中有两种类型的驱动：

 ## 主机驱动

-主机驱动用于配置主机，Rancher 使用这些主机启动和管理 Kubernetes 集群。主机驱动与 [Docker Machine 驱动](https://docs.docker.com/machine/drivers/)相同。创建主机模板时可以显示的主机驱动，是由主机驱动的状态定义的。只有 `active` 主机驱动将显示为创建节点模板的选项。默认情况下，Rancher 与许多现有的 Docker Machine 驱动打包在一起，但你也可以创建自定义主机驱动并添加到 Rancher。
+主机驱动用于配置主机，Rancher 使用这些主机启动和管理 Kubernetes 集群。主机驱动与 [Docker Machine 驱动](https://github.com/docker/docs/blob/vnext-engine/machine/drivers/index.md)相同。创建主机模板时可以显示的主机驱动，是由主机驱动的状态定义的。只有 `active` 主机驱动将显示为创建节点模板的选项。默认情况下，Rancher 与许多现有的 Docker Machine 驱动打包在一起，但你也可以创建自定义主机驱动并添加到 Rancher。

 如果你不想向用户显示特定的主机驱动，则需要停用这些主机驱动。

@@ -2,7 +2,7 @@
 title: 主机驱动
 ---

-主机驱动用于配置主机，Rancher 使用这些主机启动和管理 Kubernetes 集群。主机驱动与 [Docker Machine 驱动](https://docs.docker.com/machine/drivers/)相同。创建主机模板时可以显示的主机驱动，是由主机驱动的状态定义的。只有 `active` 主机驱动将显示为创建节点模板的选项。默认情况下，Rancher 与许多现有的 Docker Machine 驱动打包在一起，但你也可以创建自定义主机驱动并添加到 Rancher。
+主机驱动用于配置主机，Rancher 使用这些主机启动和管理 Kubernetes 集群。主机驱动与 [Docker Machine 驱动](https://github.com/docker/docs/blob/vnext-engine/machine/drivers/index.md)相同。创建主机模板时可以显示的主机驱动，是由主机驱动的状态定义的。只有 `active` 主机驱动将显示为创建节点模板的选项。默认情况下，Rancher 与许多现有的 Docker Machine 驱动打包在一起，但你也可以创建自定义主机驱动并添加到 Rancher。

 如果你不想向用户显示特定的主机驱动，则需要停用这些主机驱动。

@@ -38,4 +38,4 @@ title: 主机驱动

 ## 开发自己的主机驱动

-主机驱动使用 [Docker Machine](https://docs.docker.com/machine/) 来实现。
+主机驱动使用 [Docker Machine](https://github.com/docker/docs/blob/vnext-engine/machine/overview.md) 来实现。
@@ -55,4 +55,4 @@ RKE 模板可以应用于新集群。

 - 创建了一个新的 RKE 模板。
 - 将集群转换为使用该新模板。
- 可以[使用新模板创建新集群](apply-templates.md#使用-rke-模板创建集群)。
+- 可以[使用新模板创建新集群](#使用-rke-模板创建集群)。
@@ -31,6 +31,7 @@ description: 创建 Keycloak OpenID Connect (OIDC) 客户端并配置 Rancher
      | `Name` | `Groups Mapper` |
      | `Mapper Type` | `Group Membership` |
      | `Token Claim Name` | `groups` |
+      | `Full group path` | `OFF` |
      | `Add to ID token` | `OFF` |
      | `Add to access token` | `OFF` |
      | `Add to user info` | `ON` |
@@ -42,6 +43,7 @@ description: 创建 Keycloak OpenID Connect (OIDC) 客户端并配置 Rancher
      | `Name` | `Client Audience` |
      | `Mapper Type` | `Audience` |
      | `Included Client Audience` | &lt;CLIENT_NAME> |
+      | `Add to ID token` | `OFF` |
      | `Add to access token` | `ON` |

   - 使用以下设置创建一个新的 "Groups Path"：
@@ -52,8 +54,15 @@ description: 创建 Keycloak OpenID Connect (OIDC) 客户端并配置 Rancher
      | `Mapper Type` | `Group Membership` |
      | `Token Claim Name` | `full_group_path` |
      | `Full group path` | `ON` |
+      | `Add to ID token` | `ON` |
+      | `Add to access token` | `ON` |
      | `Add to user info` | `ON` |

+- Go to **Role Mappings > Client Roles >  realm-management** and add the following Role Mappings to all users or groups that need to query the Keycloak users.
+  - query-users
+  - query-groups
+  - view-users
+  
 ## 在 Rancher 中配置 Keycloak

 1. 在 Rancher UI 中，单击 **☰ > 用户 & 认证**。
@@ -35,7 +35,7 @@ import ClusterCapabilitiesTable from '../../../shared-files/\_cluster-capabiliti

 在 RKE 集群中，Rancher 管理 Kubernetes 的部署。这些集群可以部署在任何裸机服务器、云提供商或虚拟化平台上。

-这些节点可以通过 Rancher 的 UI 动态配置，该 UI 调用 [Docker Machine](https://docs.docker.com/machine/) 在各种云提供商上启动节点。
+这些节点可以通过 Rancher 的 UI 动态配置，该 UI 调用 [Docker Machine](https://github.com/docker/docs/blob/vnext-engine/machine/overview.md) 在各种云提供商上启动节点。

 如果你已经有一个想要添加到 RKE 集群的节点，你可以通过在节点上运行 Rancher Agent 容器将节点添加到集群中。

@@ -21,7 +21,7 @@ title: 在云厂商的新节点上启动 Kubernetes

 ### 节点模板

-节点模板保存了用于在特定云提供商中配置节点时要使用的参数。这些节点可以从 UI 启动。Rancher 使用 [Docker Machine](https://docs.docker.com/machine/) 来配置这些节点。可用于创建节点模板的云提供商取决于 Rancher 中状态是 Active 的主机驱动。
+节点模板保存了用于在特定云提供商中配置节点时要使用的参数。这些节点可以从 UI 启动。Rancher 使用 [Docker Machine](https://github.com/docker/docs/blob/vnext-engine/machine/overview.md) 来配置这些节点。可用于创建节点模板的云提供商取决于 Rancher 中状态是 Active 的主机驱动。

 在 Rancher 中创建节点模板后，模板会被保存，以便你可以再次使用该模板来创建节点池。节点模板绑定到你的登录名。添加模板后，你可以将其从用户配置文件中删除。

@@ -19,7 +19,7 @@ kubeconfig 文件及其内容特定于各个集群。你可以从 Rancher 的**

 下载 kubeconfig 文件后，你将能够使用 kubeconfig 文件及其 Kubernetes [上下文](https://kubernetes.io/docs/reference/kubectl/cheatsheet/#kubectl-context-and-configuration)访问下游集群。

-如果管理员[关闭了 kubeconfig 令牌生成](../../../../api/api-tokens.md#在生成的-kubeconfig-中禁用令牌)，则 kubeconfig 文件要求 [Rancher CLI](./authorized-cluster-endpoint.md) 存在于你的 PATH 中。
+如果管理员[关闭了 kubeconfig 令牌生成](../../../../api/api-tokens.md#在生成的-kubeconfig-中禁用令牌)，则 kubeconfig 文件要求 [Rancher CLI](../../../../reference-guides/cli-with-rancher/rancher-cli.md) 存在于你的 PATH 中。

 ## RKE 集群的两种身份验证方法

@@ -169,12 +169,12 @@ Rancher 在 Kubernetes 之上进行了扩展，除了集群级别之外，还允

 ### 4. 可选：添加资源配额

-资源配额用于限制项目（及其命名空间）可以使用的资源。有关详细信息，请参阅[资源配额](projects-and-namespaces.md)。
+资源配额用于限制项目（及其命名空间）可以使用的资源。有关详细信息，请参阅[资源配额](../../advanced-user-guides/manage-projects/manage-project-resource-quotas/manage-project-resource-quotas.md)。

 要添加资源配额：

 1. 在**资源配额**选项卡中，单击**添加资源**。
-1. 选择一个**资源类型**。有关详细信息，请参阅[资源配额](projects-and-namespaces.md)。
+1. 选择一个**资源类型**。有关详细信息，请参阅[资源配额](../../advanced-user-guides/manage-projects/manage-project-resource-quotas/manage-project-resource-quotas.md)。
 1. 输入**项目限制**和**命名空间默认限制**的值。
 1. **可选**：指定**容器默认资源限制**，这将应用于项目中启动的所有容器。如果资源配额设置了 CPU 或内存限制，则建议使用该参数。可以在单个命名空间或容器级别上覆盖它。有关详细信息，请参阅[容器默认资源限制](../../advanced-user-guides/manage-projects/manage-project-resource-quotas/manage-project-resource-quotas.md)。
 1. 单击**创建**。
@@ -21,7 +21,7 @@ title: 命名空间

 :::note

-如果你使用 `kubectl`创建命名空间，由于 `kubectl` 不要求将新命名空间限定在你可以访问的项目内，因此你可能无法使用该命名空间。如果你的权限仅限于项目级别，则最好[通过 Rancher 创建命名空间](manage-namespaces.md)，以确保你有权访问该命名空间。
+如果你使用 `kubectl`创建命名空间，由于 `kubectl` 不要求将新命名空间限定在你可以访问的项目内，因此你可能无法使用该命名空间。如果你的权限仅限于项目级别，则最好[通过 Rancher 创建命名空间](#创建命名空间)，以确保你有权访问该命名空间。

 :::

@@ -41,7 +41,7 @@ Kubernetes 中的资源请求指的是，除非该节点至少具有指定数量
 1. 在左侧导航栏中，点击 **Apps**。
 1. 点击**已安装的应用**。
 1. 转到 `istio-system` 命名空间。在某个 Istio 工作负载中（例如 `rancher-istio`），点击**⋮ > 编辑/升级**。
-1. 点击**升级**，然后通过更改 values.yaml 或添加[覆盖文件](./configuration-options/configuration-options.md#覆盖文件)来编辑基本组件。有关编辑覆盖文件的更多信息，请参阅[本节](cpu-and-memory-allocations.md#编辑覆盖文件)。
+1. 点击**升级**，然后通过更改 values.yaml 或添加[覆盖文件](./configuration-options/configuration-options.md#覆盖文件)来编辑基本组件。有关编辑覆盖文件的更多信息，请参阅[本节](#编辑覆盖文件)。
 1. 更改 CPU 或内存分配、调度各个组件的节点，或节点容忍度。
 1. 点击**升级**。然后，更改就能启用。

@@ -120,6 +120,8 @@ webhook 在 [namespaces](https://github.com/rancher/webhook/blob/release/v0.4/do
 - 具有适当权限的用户帐户可以使用适当的配置预先创建命名空间。
  - 此选项取决于应用程序处理现有资源的能力。

+Another one of these validations ensures that the user has the proper permissions to update the `field.cattle.io/projectId` annotation on a namespace. This is the `manage-namespaces` permission for `projects` in `management.cattle.io`.
+
 ## 特定版本的问题

 **注意：** 以下是影响特定 Rancher/webhook 版本的高严重性问题的不完整列表。在大多数情况下，这些问题可以通过升级到更新的 Rancher 版本来解决。
@@ -18,15 +18,15 @@ enable_cri_dockerd: true

 <br/>

-Q. 如果要获得 Rancher 对上游 Dockershim 的支持，我需要升级 Rancher 吗？
+Q: 如果要获得 Rancher 对上游 Dockershim 的支持，我需要升级 Rancher 吗？

 对于 RKE，Dockershim 的上游支持从 Kubernetes 1.21 开始。你需要使用 Rancher 2.6 或更高版本才能获取使用 Kubernetes 1.21 的 RKE 的支持。详情请参阅我们的[支持矩阵](https://rancher.com/support-maintenance-terms/all-supported-versions/rancher-v2.6.0/)。

 <br/>

-Q. 我目前的 RKE 使用 Kubernetes 1.20。为了避免出现不再支持 Dockershim 的情况，我是否需要尽早将 RKE 升级到 Kubernetes 1.21？
+Q: 我目前的 RKE 使用 Kubernetes 1.20。为了避免出现不再支持 Dockershim 的情况，我是否需要尽早将 RKE 升级到 Kubernetes 1.21？

-A. 在使用 Kubernetes 1.20 的 RKE 中，Dockershim 版本依然可用，而且在 Kubernetes 1.24 之前不会在上游弃用。Kubernetes 会发出弃用 Dockershim 的警告，而 Rancher 在使用 Kubernetes 1.21 的 RKE 中已经缓解了这个问题。你可以按照计划正常升级到 Kubernetes 1.21，但也应该考虑在升级到 Kubernetes 1.22 时启用外部 Dockershim。在升级到 Kubernetes 1.24 之前，你需要启用外部 Dockershim，此时现有的实现都会被删除。
+A: 在使用 Kubernetes 1.20 的 RKE 中，Dockershim 版本依然可用，而且在 Kubernetes 1.24 之前不会在上游弃用。Kubernetes 会发出弃用 Dockershim 的警告，而 Rancher 在使用 Kubernetes 1.21 的 RKE 中已经缓解了这个问题。你可以按照计划正常升级到 Kubernetes 1.21，但也应该考虑在升级到 Kubernetes 1.22 时启用外部 Dockershim。在升级到 Kubernetes 1.24 之前，你需要启用外部 Dockershim，此时现有的实现都会被删除。

 有关此移除的更多信息以及时间线，请参见 [Kubernetes Dockershim 弃用相关的常见问题](https://kubernetes.io/blog/2020/12/02/dockershim-faq/#when-will-dockershim-be-removed)。

@@ -76,11 +76,11 @@ title: 7 层 NGINX 负载均衡器上的 TLS 终止（Docker 安装）

 1. 输入以下命令：

-       ```
-       docker run -d --restart=unless-stopped \
-       -p 80:80 -p 443:443 \
-       rancher/rancher:latest --no-cacerts
-       ```
+    ```
+    docker run -d --restart=unless-stopped \
+      -p 80:80 -p 443:443 \
+      rancher/rancher:latest --no-cacerts
+    ```

 </details>

@@ -35,7 +35,7 @@ Rancher 中有两种类型的驱动：

 ### 主机驱动

-主机驱动用于配置主机，Rancher 使用这些主机启动和管理 Kubernetes 集群。主机驱动与 [Docker Machine 驱动](https://docs.docker.com/machine/drivers/)相同。创建主机模板时可以显示的主机驱动，是由主机驱动的状态定义的。只有 `active` 主机驱动将显示为创建节点模板的选项。默认情况下，Rancher 与许多现有的 Docker Machine 驱动打包在一起，但你也可以创建自定义主机驱动并添加到 Rancher。
+主机驱动用于配置主机，Rancher 使用这些主机启动和管理 Kubernetes 集群。主机驱动与 [Docker Machine 驱动](https://github.com/docker/docs/blob/vnext-engine/machine/drivers/index.md)相同。创建主机模板时可以显示的主机驱动，是由主机驱动的状态定义的。只有 `active` 主机驱动将显示为创建节点模板的选项。默认情况下，Rancher 与许多现有的 Docker Machine 驱动打包在一起，但你也可以创建自定义主机驱动并添加到 Rancher。

 如果你不想向用户显示特定的主机驱动，则需要停用这些主机驱动。

@@ -2,7 +2,7 @@
 title: 主机驱动
 ---

-主机驱动用于配置主机，Rancher 使用这些主机启动和管理 Kubernetes 集群。主机驱动与 [Docker Machine 驱动](https://docs.docker.com/machine/drivers/)相同。创建主机模板时可以显示的主机驱动，是由主机驱动的状态定义的。只有 `active` 主机驱动将显示为创建节点模板的选项。默认情况下，Rancher 与许多现有的 Docker Machine 驱动打包在一起，但你也可以创建自定义主机驱动并添加到 Rancher。
+主机驱动用于配置主机，Rancher 使用这些主机启动和管理 Kubernetes 集群。主机驱动与 [Docker Machine 驱动](https://github.com/docker/docs/blob/vnext-engine/machine/drivers/index.md)相同。创建主机模板时可以显示的主机驱动，是由主机驱动的状态定义的。只有 `active` 主机驱动将显示为创建节点模板的选项。默认情况下，Rancher 与许多现有的 Docker Machine 驱动打包在一起，但你也可以创建自定义主机驱动并添加到 Rancher。

 如果你不想向用户显示特定的主机驱动，则需要停用这些主机驱动。

@@ -38,4 +38,4 @@ title: 主机驱动

 ### 开发自己的主机驱动

-主机驱动使用 [Docker Machine](https://docs.docker.com/machine/) 来实现。
+主机驱动使用 [Docker Machine](https://github.com/docker/docs/blob/vnext-engine/machine/overview.md) 来实现。
@@ -56,4 +56,4 @@ RKE 模板可以应用于新集群。

 - 创建了一个新的 RKE 模板。
 - 将集群转换为使用该新模板。
- 可以[使用新模板创建新集群](apply-templates.md#使用-rke-模板创建集群)。
+- 可以[使用新模板创建新集群](#使用-rke-模板创建集群)。
@@ -31,6 +31,7 @@ description: 创建 Keycloak OpenID Connect (OIDC) 客户端并配置 Rancher
      | `Name` | `Groups Mapper` |
      | `Mapper Type` | `Group Membership` |
      | `Token Claim Name` | `groups` |
+      | `Full group path` | `OFF` |
      | `Add to ID token` | `OFF` |
      | `Add to access token` | `OFF` |
      | `Add to user info` | `ON` |
@@ -42,6 +43,7 @@ description: 创建 Keycloak OpenID Connect (OIDC) 客户端并配置 Rancher
      | `Name` | `Client Audience` |
      | `Mapper Type` | `Audience` |
      | `Included Client Audience` | &lt;CLIENT_NAME> |
+      | `Add to ID token` | `OFF` |
      | `Add to access token` | `ON` |

   - 使用以下设置创建一个新的 "Groups Path"：
@@ -52,8 +54,15 @@ description: 创建 Keycloak OpenID Connect (OIDC) 客户端并配置 Rancher
      | `Mapper Type` | `Group Membership` |
      | `Token Claim Name` | `full_group_path` |
      | `Full group path` | `ON` |
+      | `Add to ID token` | `ON` |
+      | `Add to access token` | `ON` |
      | `Add to user info` | `ON` |

+- Go to **Role Mappings > Client Roles >  realm-management** and add the following Role Mappings to all users or groups that need to query the Keycloak users.
+  - query-users
+  - query-groups
+  - view-users
+  
 ## 在 Rancher 中配置 Keycloak

 1. 在 Rancher UI 中，单击 **☰ > 用户 & 认证**。
@@ -37,7 +37,7 @@ import ClusterCapabilitiesTable from '../../../shared-files/_cluster-capabilitie

 在 RKE 集群中，Rancher 管理 Kubernetes 的部署。这些集群可以部署在任何裸机服务器、云提供商或虚拟化平台上。

-这些节点可以通过 Rancher 的 UI 动态配置，该 UI 调用 [Docker Machine](https://docs.docker.com/machine/) 在各种云提供商上启动节点。
+这些节点可以通过 Rancher 的 UI 动态配置，该 UI 调用 [Docker Machine](https://github.com/docker/docs/blob/vnext-engine/machine/overview.md) 在各种云提供商上启动节点。

 如果你已经有一个想要添加到 RKE 集群的节点，你可以通过在节点上运行 Rancher Agent 容器将节点添加到集群中。

@@ -21,7 +21,7 @@ title: 在云厂商的新节点上启动 Kubernetes

 ### 节点模板

-节点模板保存了用于在特定云提供商中配置节点时要使用的参数。这些节点可以从 UI 启动。Rancher 使用 [Docker Machine](https://docs.docker.com/machine/) 来配置这些节点。可用于创建节点模板的云提供商取决于 Rancher 中状态是 Active 的主机驱动。
+节点模板保存了用于在特定云提供商中配置节点时要使用的参数。这些节点可以从 UI 启动。Rancher 使用 [Docker Machine](https://github.com/docker/docs/blob/vnext-engine/machine/overview.md) 来配置这些节点。可用于创建节点模板的云提供商取决于 Rancher 中状态是 Active 的主机驱动。

 在 Rancher 中创建节点模板后，模板会被保存，以便你可以再次使用该模板来创建节点池。节点模板绑定到你的登录名。添加模板后，你可以将其从用户配置文件中删除。

@@ -12,7 +12,7 @@ _kubeconfig 文件_ 是与 kubectl 命令行工具（或其他客户端）结合

 下载 kubeconfig 文件后，你将能够使用 kubeconfig 文件及其 Kubernetes [上下文](https://kubernetes.io/docs/reference/kubectl/cheatsheet/#kubectl-context-and-configuration)访问下游集群。

-如果管理员[关闭了 kubeconfig 令牌生成](../../../../reference-guides/about-the-api/api-tokens.md#在生成的-kubeconfig-中禁用令牌)，则 kubeconfig 文件要求 [Rancher CLI](./authorized-cluster-endpoint.md) 存在于你的 PATH 中。
+如果管理员[关闭了 kubeconfig 令牌生成](../../../../reference-guides/about-the-api/api-tokens.md#在生成的-kubeconfig-中禁用令牌)，则 kubeconfig 文件要求 [Rancher CLI](../../../../reference-guides/cli-with-rancher/rancher-cli.md) 存在于你的 PATH 中。

 ### RKE 集群的两种身份验证方法

@@ -169,12 +169,12 @@ Rancher 在 Kubernetes 之上进行了扩展，除了集群级别之外，还允

 ### 4. 可选：添加资源配额

-资源配额用于限制项目（及其命名空间）可以使用的资源。有关详细信息，请参阅[资源配额](projects-and-namespaces.md)。
+资源配额用于限制项目（及其命名空间）可以使用的资源。有关详细信息，请参阅[资源配额](../../advanced-user-guides/manage-projects/manage-project-resource-quotas/manage-project-resource-quotas.md)。

 要添加资源配额：

 1. 在**资源配额**选项卡中，单击**添加资源**。
-1. 选择一个**资源类型**。有关详细信息，请参阅[资源配额](projects-and-namespaces.md)。
+1. 选择一个**资源类型**。有关详细信息，请参阅[资源配额](../../advanced-user-guides/manage-projects/manage-project-resource-quotas/manage-project-resource-quotas.md)。
 1. 输入**项目限制**和**命名空间默认限制**的值。
 1. **可选**：指定**容器默认资源限制**，这将应用于项目中启动的所有容器。如果资源配额设置了 CPU 或内存限制，则建议使用该参数。可以在单个命名空间或容器级别上覆盖它。有关详细信息，请参阅[容器默认资源限制](../../../pages-for-subheaders/manage-project-resource-quotas.md)。
 1. 单击**创建**。
@@ -1,4 +1,4 @@
---
+(#creating-namespaces)---
 title: 命名空间
 ---

@@ -21,7 +21,7 @@ title: 命名空间

 :::note

-如果你使用 `kubectl`创建命名空间，由于 `kubectl` 不要求将新命名空间限定在你可以访问的项目内，因此你可能无法使用该命名空间。如果你的权限仅限于项目级别，则最好[通过 Rancher 创建命名空间](manage-namespaces.md)，以确保你有权访问该命名空间。
+如果你使用 `kubectl`创建命名空间，由于 `kubectl` 不要求将新命名空间限定在你可以访问的项目内，因此你可能无法使用该命名空间。如果你的权限仅限于项目级别，则最好[通过 Rancher 创建命名空间](#创建命名空间)，以确保你有权访问该命名空间。

 :::

@@ -44,7 +44,7 @@ Kubernetes 中的资源请求指的是，除非该节点至少具有指定数量
 1. 在左侧导航栏中，点击 **Apps**。
 1. 点击**已安装的应用**。
 1. 转到 `istio-system` 命名空间。在某个 Istio 工作负载中（例如 `rancher-istio`），点击**⋮ > 编辑/升级**。
-1. 点击**升级**，然后通过更改 values.yaml 或添加[覆盖文件](../../pages-for-subheaders/configuration-options.md#覆盖文件)来编辑基本组件。有关编辑覆盖文件的更多信息，请参阅[本节](cpu-and-memory-allocations.md#编辑覆盖文件)。
+1. 点击**升级**，然后通过更改 values.yaml 或添加[覆盖文件](../../pages-for-subheaders/configuration-options.md#覆盖文件)来编辑基本组件。有关编辑覆盖文件的更多信息，请参阅[本节](#编辑覆盖文件)。
 1. 更改 CPU 或内存分配、调度各个组件的节点，或节点容忍度。
 1. 点击**升级**。然后，更改就能启用。

@@ -56,7 +56,7 @@ Kubernetes 中的资源请求指的是，除非该节点至少具有指定数量
 1. 在左侧导航栏中，点击**应用 & 应用市场**。
 1. 点击**已安装的应用**。
 1. 转到 `istio-system` 命名空间。在某个 Istio 工作负载中（例如 `rancher-istio`），点击**⋮ > 编辑/升级**。
-1. 点击**升级**，然后通过更改 values.yaml 或添加[覆盖文件](../../pages-for-subheaders/configuration-options.md#覆盖文件)来编辑基本组件。有关编辑覆盖文件的更多信息，请参阅[本节](cpu-and-memory-allocations.md#编辑覆盖文件)。
+1. 点击**升级**，然后通过更改 values.yaml 或添加[覆盖文件](../../pages-for-subheaders/configuration-options.md#覆盖文件)来编辑基本组件。有关编辑覆盖文件的更多信息，请参阅[本节](#编辑覆盖文件)。
 1. 更改 CPU 或内存分配、调度各个组件的节点，或节点容忍度。
 1. 点击**升级**。然后，更改就能启用。

@@ -31,7 +31,7 @@ Rancher 中有两种类型的驱动：

 ### 主机驱动

-主机驱动用于配置主机，Rancher 使用这些主机启动和管理 Kubernetes 集群。主机驱动与 [Docker Machine 驱动](https://docs.docker.com/machine/drivers/)相同。创建主机模板时可以显示的主机驱动，是由主机驱动的状态定义的。只有 `active` 主机驱动将显示为创建节点模板的选项。默认情况下，Rancher 与许多现有的 Docker Machine 驱动打包在一起，但你也可以创建自定义主机驱动并添加到 Rancher。
+主机驱动用于配置主机，Rancher 使用这些主机启动和管理 Kubernetes 集群。主机驱动与 [Docker Machine 驱动](https://github.com/docker/docs/blob/vnext-engine/machine/drivers/index.md)相同。创建主机模板时可以显示的主机驱动，是由主机驱动的状态定义的。只有 `active` 主机驱动将显示为创建节点模板的选项。默认情况下，Rancher 与许多现有的 Docker Machine 驱动打包在一起，但你也可以创建自定义主机驱动并添加到 Rancher。

 如果你不想向用户显示特定的主机驱动，则需要停用这些主机驱动。

@@ -33,7 +33,7 @@ import ClusterCapabilitiesTable from '../shared-files/_cluster-capabilities-tabl

 在 RKE 集群中，Rancher 管理 Kubernetes 的部署。这些集群可以部署在任何裸机服务器、云提供商或虚拟化平台上。

-这些节点可以通过 Rancher 的 UI 动态配置，该 UI 调用 [Docker Machine](https://docs.docker.com/machine/) 在各种云提供商上启动节点。
+这些节点可以通过 Rancher 的 UI 动态配置，该 UI 调用 [Docker Machine](https://github.com/docker/docs/blob/vnext-engine/machine/overview.md) 在各种云提供商上启动节点。

 如果你已经有一个想要添加到 RKE 集群的节点，你可以通过在节点上运行 Rancher Agent 容器将节点添加到集群中。

@@ -17,7 +17,7 @@ title: 在云厂商的新节点上启动 Kubernetes

 ### 节点模板

-节点模板保存了用于在特定云提供商中配置节点时要使用的参数。这些节点可以从 UI 启动。Rancher 使用 [Docker Machine](https://docs.docker.com/machine/) 来配置这些节点。可用于创建节点模板的云提供商取决于 Rancher 中状态是 Active 的主机驱动。
+节点模板保存了用于在特定云提供商中配置节点时要使用的参数。这些节点可以从 UI 启动。Rancher 使用 [Docker Machine](https://github.com/docker/docs/blob/vnext-engine/machine/overview.md) 来配置这些节点。可用于创建节点模板的云提供商取决于 Rancher 中状态是 Active 的主机驱动。

 在 Rancher 中创建节点模板后，模板会被保存，以便你可以再次使用该模板来创建节点池。节点模板绑定到你的登录名。添加模板后，你可以将其从用户配置文件中删除。

@@ -181,15 +181,15 @@ spec:

 ## CNI 社区人气

-下表总结了不同的 GitHub 指标，让你了解每个项目的受欢迎程度和活动。数据收集于 2022 年 1 月。
+下表总结了不同的 GitHub 指标，让你了解每个项目的受欢迎程度和活动。数据收集于 2024 年 10 月。

 | 提供商 | 项目 | Stars | Forks | Contributors |
 | ---- | ---- | ---- | ---- | ---- |
-| Canal | https://github.com/projectcalico/canal | 679 | 100 | 21 |
-| Flannel | https://github.com/flannel-io/flannel | 7k | 2.5k | 185 |
-| Calico | https://github.com/projectcalico/calico | 3.1k | 741 | 224 |
-| Weave | https://github.com/weaveworks/weave/ | 6.2k | 635 | 84 |
-| Cilium | https://github.com/cilium/cilium | 10.6k | 1.3k | 352 |
+| Canal | https://github.com/projectcalico/canal | 716 | 100 | 20 |
+| Flannel | https://github.com/flannel-io/flannel | 8.8k | 2.9k | 234 |
+| Calico | https://github.com/projectcalico/calico | 6.0k | 1.3k | 353 |
+| Weave | https://github.com/weaveworks/weave/ | 6.6k | 670 | 85 |
+| Cilium | https://github.com/cilium/cilium | 20.0k | 2.9k | 832 |

 <br/>

@@ -14,8 +14,12 @@ title: Rancher 中已弃用的功能

 Rancher 将在 GitHub 上发布的 Rancher 的[发版说明](https://github.com/rancher/rancher/releases)中发布已弃用的功能。有关已弃用的功能，请参阅以下的补丁版本：

-| Patch Version                                                     | Release Date        |
-| ----------------------------------------------------------------- | ------------------- |
+| Patch Version                                                     | Release Date       |
+| ----------------------------------------------------------------- | -------------------|
+| [2.7.16](https://github.com/rancher/rancher/releases/tag/v2.7.16) | 2024 年 10 月 24 日 |
+| [2.7.15](https://github.com/rancher/rancher/releases/tag/v2.7.15) | 2024 年 7 月 31 日  |
+| [2.7.14](https://github.com/rancher/rancher/releases/tag/v2.7.14) | 2024 年 6 月 17 日  |
+| [2.7.13](https://github.com/rancher/rancher/releases/tag/v2.7.13) | 2024 年 5 月 16 日  |
 | [2.7.12](https://github.com/rancher/rancher/releases/tag/v2.7.12) | 2024 年 3 月 28 日  |
 | [2.7.11](https://github.com/rancher/rancher/releases/tag/v2.7.11) | 2024 年 3 月 1 日   |
 | [2.7.10](https://github.com/rancher/rancher/releases/tag/v2.7.10) | 2024 年 2 月 8 日   |
@@ -18,15 +18,15 @@ enable_cri_dockerd: true

 <br/>

-Q. 如果要获得 Rancher 对上游 Dockershim 的支持，我需要升级 Rancher 吗？
+Q: 如果要获得 Rancher 对上游 Dockershim 的支持，我需要升级 Rancher 吗？

 对于 RKE，Dockershim 的上游支持从 Kubernetes 1.21 开始。你需要使用 Rancher 2.6 或更高版本才能获取使用 Kubernetes 1.21 的 RKE 的支持。详情请参阅我们的[支持矩阵](https://rancher.com/support-maintenance-terms/all-supported-versions/rancher-v2.6.0/)。

 <br/>

-Q. 我目前的 RKE 使用 Kubernetes 1.20。为了避免出现不再支持 Dockershim 的情况，我是否需要尽早将 RKE 升级到 Kubernetes 1.21？
+Q: 我目前的 RKE 使用 Kubernetes 1.20。为了避免出现不再支持 Dockershim 的情况，我是否需要尽早将 RKE 升级到 Kubernetes 1.21？

-A. 在使用 Kubernetes 1.20 的 RKE 中，Dockershim 版本依然可用，而且在 Kubernetes 1.24 之前不会在上游弃用。Kubernetes 会发出弃用 Dockershim 的警告，而 Rancher 在使用 Kubernetes 1.21 的 RKE 中已经缓解了这个问题。你可以按照计划正常升级到 Kubernetes 1.21，但也应该考虑在升级到 Kubernetes 1.22 时启用外部 Dockershim。在升级到 Kubernetes 1.24 之前，你需要启用外部 Dockershim，此时现有的实现都会被删除。
+A: 在使用 Kubernetes 1.20 的 RKE 中，Dockershim 版本依然可用，而且在 Kubernetes 1.24 之前不会在上游弃用。Kubernetes 会发出弃用 Dockershim 的警告，而 Rancher 在使用 Kubernetes 1.21 的 RKE 中已经缓解了这个问题。你可以按照计划正常升级到 Kubernetes 1.21，但也应该考虑在升级到 Kubernetes 1.22 时启用外部 Dockershim。在升级到 Kubernetes 1.24 之前，你需要启用外部 Dockershim，此时现有的实现都会被删除。

 有关此移除的更多信息以及时间线，请参见 [Kubernetes Dockershim 弃用相关的常见问题](https://kubernetes.io/blog/2020/12/02/dockershim-faq/#when-will-dockershim-be-removed)。

@@ -76,11 +76,11 @@ title: 7 层 NGINX 负载均衡器上的 TLS 终止（Docker 安装）

 1. 输入以下命令：

-       ```
-       docker run -d --restart=unless-stopped \
-       -p 80:80 -p 443:443 \
-       rancher/rancher:latest --no-cacerts
-       ```
+    ```
+    docker run -d --restart=unless-stopped \
+      -p 80:80 -p 443:443 \
+      rancher/rancher:latest --no-cacerts
+    ```

 </details>

@@ -35,7 +35,7 @@ Rancher 中有两种类型的驱动：

 ### 主机驱动

-主机驱动用于配置主机，Rancher 使用这些主机启动和管理 Kubernetes 集群。主机驱动与 [Docker Machine 驱动](https://docs.docker.com/machine/drivers/)相同。创建主机模板时可以显示的主机驱动，是由主机驱动的状态定义的。只有 `active` 主机驱动将显示为创建节点模板的选项。默认情况下，Rancher 与许多现有的 Docker Machine 驱动打包在一起，但你也可以创建自定义主机驱动并添加到 Rancher。
+主机驱动用于配置主机，Rancher 使用这些主机启动和管理 Kubernetes 集群。主机驱动与 [Docker Machine 驱动](https://github.com/docker/docs/blob/vnext-engine/machine/drivers/index.md)相同。创建主机模板时可以显示的主机驱动，是由主机驱动的状态定义的。只有 `active` 主机驱动将显示为创建节点模板的选项。默认情况下，Rancher 与许多现有的 Docker Machine 驱动打包在一起，但你也可以创建自定义主机驱动并添加到 Rancher。

 如果你不想向用户显示特定的主机驱动，则需要停用这些主机驱动。

@@ -2,7 +2,7 @@
 title: 主机驱动
 ---

-主机驱动用于配置主机，Rancher 使用这些主机启动和管理 Kubernetes 集群。主机驱动与 [Docker Machine 驱动](https://docs.docker.com/machine/drivers/)相同。创建主机模板时可以显示的主机驱动，是由主机驱动的状态定义的。只有 `active` 主机驱动将显示为创建节点模板的选项。默认情况下，Rancher 与许多现有的 Docker Machine 驱动打包在一起，但你也可以创建自定义主机驱动并添加到 Rancher。
+主机驱动用于配置主机，Rancher 使用这些主机启动和管理 Kubernetes 集群。主机驱动与 [Docker Machine 驱动](https://github.com/docker/docs/blob/vnext-engine/machine/drivers/index.md)相同。创建主机模板时可以显示的主机驱动，是由主机驱动的状态定义的。只有 `active` 主机驱动将显示为创建节点模板的选项。默认情况下，Rancher 与许多现有的 Docker Machine 驱动打包在一起，但你也可以创建自定义主机驱动并添加到 Rancher。

 如果你不想向用户显示特定的主机驱动，则需要停用这些主机驱动。

@@ -38,4 +38,4 @@ title: 主机驱动

 ### 开发自己的主机驱动

-主机驱动使用 [Docker Machine](https://docs.docker.com/machine/) 来实现。
+主机驱动使用 [Docker Machine](https://github.com/docker/docs/blob/vnext-engine/machine/overview.md) 来实现。
@@ -56,4 +56,4 @@ RKE 模板可以应用于新集群。

 - 创建了一个新的 RKE 模板。
 - 将集群转换为使用该新模板。
- 可以[使用新模板创建新集群](apply-templates.md#使用-rke-模板创建集群)。
+- 可以[使用新模板创建新集群](#使用-rke-模板创建集群)。
@@ -31,6 +31,7 @@ description: 创建 Keycloak OpenID Connect (OIDC) 客户端并配置 Rancher
      | `Name` | `Groups Mapper` |
      | `Mapper Type` | `Group Membership` |
      | `Token Claim Name` | `groups` |
+      | `Full group path` | `OFF` |
      | `Add to ID token` | `OFF` |
      | `Add to access token` | `OFF` |
      | `Add to user info` | `ON` |
@@ -42,6 +43,7 @@ description: 创建 Keycloak OpenID Connect (OIDC) 客户端并配置 Rancher
      | `Name` | `Client Audience` |
      | `Mapper Type` | `Audience` |
      | `Included Client Audience` | &lt;CLIENT_NAME> |
+      | `Add to ID token` | `OFF` |
      | `Add to access token` | `ON` |

   - 使用以下设置创建一个新的 "Groups Path"：
@@ -52,8 +54,15 @@ description: 创建 Keycloak OpenID Connect (OIDC) 客户端并配置 Rancher
      | `Mapper Type` | `Group Membership` |
      | `Token Claim Name` | `full_group_path` |
      | `Full group path` | `ON` |
+      | `Add to ID token` | `ON` |
+      | `Add to access token` | `ON` |
      | `Add to user info` | `ON` |

+- Go to **Role Mappings > Client Roles >  realm-management** and add the following Role Mappings to all users or groups that need to query the Keycloak users.
+  - query-users
+  - query-groups
+  - view-users
+  
 ## 在 Rancher 中配置 Keycloak

 1. 在 Rancher UI 中，单击 **☰ > 用户 & 认证**。
@@ -35,7 +35,7 @@ import ClusterCapabilitiesTable from '../../../shared-files/\_cluster-capabiliti

 在 RKE 集群中，Rancher 负责管理 Kubernetes 的部署。这些集群可以部署在任何裸机服务器、云提供商或虚拟化平台上。

-这些节点可以通过 Rancher 的用户界面动态配置，它可以调用 [Docker Machine](https://docs.docker.com/machine/) 在各种云提供商上启动节点。
+这些节点可以通过 Rancher 的用户界面动态配置，它可以调用 [Docker Machine](https://github.com/docker/docs/blob/vnext-engine/machine/overview.md) 在各种云提供商上启动节点。

 如果你已经有了一个要添加到 RKE 集群的节点，可以通过在该节点上运行 Rancher 代理容器将其添加到集群中。

@@ -21,7 +21,7 @@ title: 在云厂商的新节点上启动 Kubernetes

 ### 节点模板

-节点模板保存了用于在特定云提供商中配置节点时要使用的参数。这些节点可以从 UI 启动。Rancher 使用 [Docker Machine](https://docs.docker.com/machine/) 来配置这些节点。可用于创建节点模板的云提供商取决于 Rancher 中状态是 Active 的主机驱动。
+节点模板保存了用于在特定云提供商中配置节点时要使用的参数。这些节点可以从 UI 启动。Rancher 使用 [Docker Machine](https://github.com/docker/docs/blob/vnext-engine/machine/overview.md) 来配置这些节点。可用于创建节点模板的云提供商取决于 Rancher 中状态是 Active 的主机驱动。

 在 Rancher 中创建节点模板后，模板会被保存，以便你可以再次使用该模板来创建节点池。节点模板绑定到你的登录名。添加模板后，你可以将其从用户配置文件中删除。

@@ -19,7 +19,7 @@ kubeconfig 文件及其内容特定于各个集群。你可以从 Rancher 的**

 下载 kubeconfig 文件后，你将能够使用 kubeconfig 文件及其 Kubernetes [上下文](https://kubernetes.io/docs/reference/kubectl/cheatsheet/#kubectl-context-and-configuration)访问下游集群。

-如果管理员[关闭了 kubeconfig 令牌生成](../../../../reference-guides/about-the-api/api-tokens.md#在生成的-kubeconfig-中禁用令牌)，则 kubeconfig 文件要求 [Rancher CLI](./authorized-cluster-endpoint.md) 存在于你的 PATH 中。
+如果管理员[关闭了 kubeconfig 令牌生成](../../../../reference-guides/about-the-api/api-tokens.md#在生成的-kubeconfig-中禁用令牌)，则 kubeconfig 文件要求 [Rancher CLI](../../../../reference-guides/cli-with-rancher/rancher-cli.md) 存在于你的 PATH 中。

 ### RKE 集群的两种身份验证方法

@@ -169,12 +169,12 @@ Rancher 在 Kubernetes 之上进行了扩展，除了集群级别之外，还允

 ### 4. 可选：添加资源配额

-资源配额用于限制项目（及其命名空间）可以使用的资源。有关详细信息，请参阅[资源配额](projects-and-namespaces.md)。
+资源配额用于限制项目（及其命名空间）可以使用的资源。有关详细信息，请参阅[资源配额](../../advanced-user-guides/manage-projects/manage-project-resource-quotas/manage-project-resource-quotas.md)。

 要添加资源配额：

 1. 在**资源配额**选项卡中，单击**添加资源**。
-1. 选择一个**资源类型**。有关详细信息，请参阅[资源配额](projects-and-namespaces.md)。
+1. 选择一个**资源类型**。有关详细信息，请参阅[资源配额](../../advanced-user-guides/manage-projects/manage-project-resource-quotas/manage-project-resource-quotas.md)。
 1. 输入**项目限制**和**命名空间默认限制**的值。
 1. **可选**：指定**容器默认资源限制**，这将应用于项目中启动的所有容器。如果资源配额设置了 CPU 或内存限制，则建议使用该参数。可以在单个命名空间或容器级别上覆盖它。有关详细信息，请参阅[容器默认资源限制](../../../pages-for-subheaders/manage-project-resource-quotas.md)。
 1. 单击**创建**。
@@ -21,7 +21,7 @@ title: 命名空间

 :::note

-如果你使用 `kubectl`创建命名空间，由于 `kubectl` 不要求将新命名空间限定在你可以访问的项目内，因此你可能无法使用该命名空间。如果你的权限仅限于项目级别，则最好[通过 Rancher 创建命名空间](manage-namespaces.md)，以确保你有权访问该命名空间。
+如果你使用 `kubectl`创建命名空间，由于 `kubectl` 不要求将新命名空间限定在你可以访问的项目内，因此你可能无法使用该命名空间。如果你的权限仅限于项目级别，则最好[通过 Rancher 创建命名空间](#创建命名空间)，以确保你有权访问该命名空间。

 :::

@@ -19,19 +19,23 @@ title: 安装 Adapter

 | Rancher 版本 | Adapter 版本 |
 | ------------ | :----------: |
-| v2.7.0       |    v2.0.0    |
-| v2.7.1       |    v2.0.0    |
-| v2.7.2       |    v2.0.1    |
-| v2.7.3       |    v2.0.1    |
-| v2.7.4       |    v2.0.1    |
-| v2.7.5       |    v2.0.2    |
-| v2.7.6       |    v2.0.2    |
-| v2.7.7       |    v2.0.2    |
-| v2.7.8       |    v2.0.2    |
-| v2.7.9       |    v2.0.2    |
-| v2.7.10      |    v2.0.2    |
-| v2.7.11      |    v2.0.4    |
-| v2.7.12      |    v2.0.4    |
+| v2.7.16         |     v2.0.4      |
+| v2.7.15         |     v2.0.4      |
+| v2.7.14         |     v2.0.4      |
+| v2.7.13         |     v2.0.4      |
+| v2.7.12         |     v2.0.4      |
+| v2.7.11         |     v2.0.4      |
+| v2.7.10         |     v2.0.2      |
+| v2.7.9          |     v2.0.2      |
+| v2.7.8          |     v2.0.2      |
+| v2.7.7          |     v2.0.2      |
+| v2.7.6          |     v2.0.2      |
+| v2.7.5          |     v2.0.2      |
+| v2.7.4          |     v2.0.1      |
+| v2.7.3          |     v2.0.1      |
+| v2.7.2          |     v2.0.1      |
+| v2.7.1          |     v2.0.0      |
+| v2.7.0          |     v2.0.0      |

 ### 1. 获取对 Local 集群的访问权限

@@ -41,7 +41,7 @@ Kubernetes 中的资源请求指的是，除非该节点至少具有指定数量
 1. 在左侧导航栏中，点击 **Apps**。
 1. 点击**已安装的应用**。
 1. 转到 `istio-system` 命名空间。在某个 Istio 工作负载中（例如 `rancher-istio`），点击**⋮ > 编辑/升级**。
-1. 点击**升级**，然后通过更改 values.yaml 或添加[覆盖文件](../../pages-for-subheaders/configuration-options.md#覆盖文件)来编辑基本组件。有关编辑覆盖文件的更多信息，请参阅[本节](cpu-and-memory-allocations.md#编辑覆盖文件)。
+1. 点击**升级**，然后通过更改 values.yaml 或添加[覆盖文件](../../pages-for-subheaders/configuration-options.md#覆盖文件)来编辑基本组件。有关编辑覆盖文件的更多信息，请参阅[本节](#编辑覆盖文件)。
 1. 更改 CPU 或内存分配、调度各个组件的节点，或节点容忍度。
 1. 点击**升级**。然后，更改就能启用。

@@ -31,7 +31,7 @@ Rancher 中有两种类型的驱动：

 ### 主机驱动

-主机驱动用于配置主机，Rancher 使用这些主机启动和管理 Kubernetes 集群。主机驱动与 [Docker Machine 驱动](https://docs.docker.com/machine/drivers/)相同。创建主机模板时可以显示的主机驱动，是由主机驱动的状态定义的。只有 `active` 主机驱动将显示为创建节点模板的选项。默认情况下，Rancher 与许多现有的 Docker Machine 驱动打包在一起，但你也可以创建自定义主机驱动并添加到 Rancher。
+主机驱动用于配置主机，Rancher 使用这些主机启动和管理 Kubernetes 集群。主机驱动与 [Docker Machine 驱动](https://github.com/docker/docs/blob/vnext-engine/machine/drivers/index.md)相同。创建主机模板时可以显示的主机驱动，是由主机驱动的状态定义的。只有 `active` 主机驱动将显示为创建节点模板的选项。默认情况下，Rancher 与许多现有的 Docker Machine 驱动打包在一起，但你也可以创建自定义主机驱动并添加到 Rancher。

 如果你不想向用户显示特定的主机驱动，则需要停用这些主机驱动。

@@ -33,7 +33,7 @@ import ClusterCapabilitiesTable from '../shared-files/_cluster-capabilities-tabl

 在 RKE 集群中，Rancher 管理 Kubernetes 的部署。这些集群可以部署在任何裸机服务器、云提供商或虚拟化平台上。

-这些节点可以通过 Rancher 的 UI 动态配置，该 UI 调用 [Docker Machine](https://docs.docker.com/machine/) 在各种云提供商上启动节点。
+这些节点可以通过 Rancher 的 UI 动态配置，该 UI 调用 [Docker Machine](https://github.com/docker/docs/blob/vnext-engine/machine/overview.md) 在各种云提供商上启动节点。

 如果你已经有一个想要添加到 RKE 集群的节点，你可以通过在节点上运行 Rancher Agent 容器将节点添加到集群中。

@@ -17,7 +17,7 @@ title: 在云厂商的新节点上启动 Kubernetes

 ### 节点模板

-节点模板保存了用于在特定云提供商中配置节点时要使用的参数。这些节点可以从 UI 启动。Rancher 使用 [Docker Machine](https://docs.docker.com/machine/) 来配置这些节点。可用于创建节点模板的云提供商取决于 Rancher 中状态是 Active 的主机驱动。
+节点模板保存了用于在特定云提供商中配置节点时要使用的参数。这些节点可以从 UI 启动。Rancher 使用 [Docker Machine](https://github.com/docker/docs/blob/vnext-engine/machine/overview.md) 来配置这些节点。可用于创建节点模板的云提供商取决于 Rancher 中状态是 Active 的主机驱动。

 在 Rancher 中创建节点模板后，模板会被保存，以便你可以再次使用该模板来创建节点池。节点模板绑定到你的登录名。添加模板后，你可以将其从用户配置文件中删除。

@@ -19,20 +19,24 @@ Rancher 将 Rancher-Webhook 作为单独的 deployment 和服务部署在 local
 <!-- releaseTask -->

 | Rancher Version | Webhook Version | Availability in Prime | Availability in Community |
-| --------------- | --------------- | --------------------- | ------------------------- |
-| v2.7.12         | v0.3.7          | &check;               | N/A                       |
-| v2.7.11         | v0.3.7          | &check;               | N/A                       |
-| v2.7.10         | v0.3.6          | &check;               | &check;                   |
-| v2.7.9          | v0.3.6          | &cross;               | &check;                   |
-| v2.7.8          | v0.3.6          | &cross;               | &check;                   |
-| v2.7.7          | v0.3.6          | &check;               | &check;                   |
-| v2.7.6          | v0.3.5          | &check;               | &check;                   |
-| v2.7.5          | v0.3.5          | &check;               | &check;                   |
-| v2.7.4          | v0.3.4          | &check;               | &check;                   |
-| v2.7.3          | v0.3.3          | &check;               | &check;                   |
-| v2.7.2          | v0.3.2          | &check;               | &check;                   |
-| v2.7.1          | v0.3.0          | &check;               | &check;                   |
-| v2.7.0          | v0.3.0          | &check;               | &check;                   |
+|-----------------|-----------------|-----------------------|---------------------------|
+| v2.7.16         |     v0.3.12     | &check;               | N/A                       |
+| v2.7.15         |     v0.3.11     | &check;               | N/A                       |
+| v2.7.14         |     v0.3.11     | &check;               | N/A                       |
+| v2.7.13         |     v0.3.8      | &check;               | N/A                       |
+| v2.7.12         |     v0.3.7      | &check;               | N/A                       |
+| v2.7.11         |     v0.3.7      | &check;               | N/A                       |
+| v2.7.10         |     v0.3.6      | &check;               | &check;                   |
+| v2.7.9          |     v0.3.6      | &cross;               | &check;                   |
+| v2.7.8          |     v0.3.6      | &cross;               | &check;                   |
+| v2.7.7          |     v0.3.6      | &check;               | &check;                   |
+| v2.7.6          |     v0.3.5      | &check;               | &check;                   |
+| v2.7.5          |     v0.3.5      | &check;               | &check;                   |
+| v2.7.4          |     v0.3.4      | &check;               | &check;                   |
+| v2.7.3          |     v0.3.3      | &check;               | &check;                   |
+| v2.7.2          |     v0.3.2      | &check;               | &check;                   |
+| v2.7.1          |     v0.3.0      | &check;               | &check;                   |
+| v2.7.0          |     v0.3.0      | &check;               | &check;                   |

 ## 为什么我们需要它？

@@ -129,6 +133,8 @@ webhook 在 [namespaces](https://github.com/rancher/webhook/blob/release/v0.4/do
 - 具有适当权限的用户帐户可以使用适当的配置预先创建命名空间。
  - 此选项取决于应用程序处理现有资源的能力。

+Another one of these validations ensures that the user has the proper permissions to update the `field.cattle.io/projectId` annotation on a namespace. This is the `manage-namespaces` permission for `projects` in `management.cattle.io`.
+
 ## 特定版本的问题

 **注意：** 以下是影响特定 Rancher/webhook 版本的高严重性问题的不完整列表。在大多数情况下，这些问题可以通过升级到更新的 Rancher 版本来解决。
@@ -181,15 +181,15 @@ spec:

 ## CNI 社区人气

-下表总结了不同的 GitHub 指标，让你了解每个项目的受欢迎程度和活动。数据收集于 2022 年 1 月。
+下表总结了不同的 GitHub 指标，让你了解每个项目的受欢迎程度和活动。数据收集于 2024 年 10 月。

 | 提供商 | 项目 | Stars | Forks | Contributors |
 | ---- | ---- | ---- | ---- | ---- |
-| Canal | https://github.com/projectcalico/canal | 679 | 100 | 21 |
-| Flannel | https://github.com/flannel-io/flannel | 7k | 2.5k | 185 |
-| Calico | https://github.com/projectcalico/calico | 3.1k | 741 | 224 |
-| Weave | https://github.com/weaveworks/weave/ | 6.2k | 635 | 84 |
-| Cilium | https://github.com/cilium/cilium | 10.6k | 1.3k | 352 |
+| Canal | https://github.com/projectcalico/canal | 716 | 100 | 20 |
+| Flannel | https://github.com/flannel-io/flannel | 8.8k | 2.9k | 234 |
+| Calico | https://github.com/projectcalico/calico | 6.0k | 1.3k | 353 |
+| Weave | https://github.com/weaveworks/weave/ | 6.6k | 670 | 85 |
+| Cilium | https://github.com/cilium/cilium | 20.0k | 2.9k | 832 |

 <br/>

@@ -15,7 +15,13 @@ title: Rancher 中已弃用的功能
 Rancher 将在 GitHub 上发布的 Rancher 的[发版说明](https://github.com/rancher/rancher/releases)中发布已弃用的功能。有关已弃用的功能，请参阅以下的补丁版本：

 | Patch 版本                                                      | 发布时间           |
-| --------------------------------------------------------------- | ------------------ |
+| --------------------------------------------------------------- | ------------------|
+| [2.8.9](https://github.com/rancher/rancher/releases/tag/v2.8.9) | 2024 年 10 月 24   |
+| [2.8.8](https://github.com/rancher/rancher/releases/tag/v2.8.8) | 2024 年 9 月 19    |
+| [2.8.7](https://github.com/rancher/rancher/releases/tag/v2.8.7) | 2024 年 9 月 26    |
+| [2.8.6](https://github.com/rancher/rancher/releases/tag/v2.8.6) | 2024 年 7 月 31    |
+| [2.8.5](https://github.com/rancher/rancher/releases/tag/v2.8.5) | 2024 年 6 月 17    |
+| [2.8.4](https://github.com/rancher/rancher/releases/tag/v2.8.4) | 2024 年 5 月 16    |
 | [2.8.3](https://github.com/rancher/rancher/releases/tag/v2.8.3) | 2024 年 3 月 28 日 |
 | [2.8.2](https://github.com/rancher/rancher/releases/tag/v2.8.2) | 2024 年 2 月 8 日  |
 | [2.8.1](https://github.com/rancher/rancher/releases/tag/v2.8.1) | 2024 年 1 月 22 日 |
@@ -18,15 +18,15 @@ enable_cri_dockerd: true

 <br/>

-Q. 如果要获得 Rancher 对上游 Dockershim 的支持，我需要升级 Rancher 吗？
+Q: 如果要获得 Rancher 对上游 Dockershim 的支持，我需要升级 Rancher 吗？

 对于 RKE，Dockershim 的上游支持从 Kubernetes 1.21 开始。你需要使用 Rancher 2.6 或更高版本才能获取使用 Kubernetes 1.21 的 RKE 的支持。详情请参阅我们的[支持矩阵](https://rancher.com/support-maintenance-terms/all-supported-versions/rancher-v2.6.0/)。

 <br/>

-Q. 我目前的 RKE 使用 Kubernetes 1.20。为了避免出现不再支持 Dockershim 的情况，我是否需要尽早将 RKE 升级到 Kubernetes 1.21？
+Q: 我目前的 RKE 使用 Kubernetes 1.20。为了避免出现不再支持 Dockershim 的情况，我是否需要尽早将 RKE 升级到 Kubernetes 1.21？

-A. 在使用 Kubernetes 1.20 的 RKE 中，Dockershim 版本依然可用，而且在 Kubernetes 1.24 之前不会在上游弃用。Kubernetes 会发出弃用 Dockershim 的警告，而 Rancher 在使用 Kubernetes 1.21 的 RKE 中已经缓解了这个问题。你可以按照计划正常升级到 Kubernetes 1.21，但也应该考虑在升级到 Kubernetes 1.22 时启用外部 Dockershim。在升级到 Kubernetes 1.24 之前，你需要启用外部 Dockershim，此时现有的实现都会被删除。
+A: 在使用 Kubernetes 1.20 的 RKE 中，Dockershim 版本依然可用，而且在 Kubernetes 1.24 之前不会在上游弃用。Kubernetes 会发出弃用 Dockershim 的警告，而 Rancher 在使用 Kubernetes 1.21 的 RKE 中已经缓解了这个问题。你可以按照计划正常升级到 Kubernetes 1.21，但也应该考虑在升级到 Kubernetes 1.22 时启用外部 Dockershim。在升级到 Kubernetes 1.24 之前，你需要启用外部 Dockershim，此时现有的实现都会被删除。

 有关此移除的更多信息以及时间线，请参见 [Kubernetes Dockershim 弃用相关的常见问题](https://kubernetes.io/blog/2020/12/02/dockershim-faq/#when-will-dockershim-be-removed)。

@@ -76,11 +76,11 @@ title: 7 层 NGINX 负载均衡器上的 TLS 终止（Docker 安装）

 1. 输入以下命令：

-       ```
-       docker run -d --restart=unless-stopped \
-       -p 80:80 -p 443:443 \
-       rancher/rancher:latest --no-cacerts
-       ```
+    ```
+    docker run -d --restart=unless-stopped \
+      -p 80:80 -p 443:443 \
+      rancher/rancher:latest --no-cacerts
+    ```

 </details>

@@ -35,7 +35,7 @@ Rancher 中有两种类型的驱动：

 ## 主机驱动

-主机驱动用于配置主机，Rancher 使用这些主机启动和管理 Kubernetes 集群。主机驱动与 [Docker Machine 驱动](https://docs.docker.com/machine/drivers/)相同。创建主机模板时可以显示的主机驱动，是由主机驱动的状态定义的。只有 `active` 主机驱动将显示为创建节点模板的选项。默认情况下，Rancher 与许多现有的 Docker Machine 驱动打包在一起，但你也可以创建自定义主机驱动并添加到 Rancher。
+主机驱动用于配置主机，Rancher 使用这些主机启动和管理 Kubernetes 集群。主机驱动与 [Docker Machine 驱动](https://github.com/docker/docs/blob/vnext-engine/machine/drivers/index.md)相同。创建主机模板时可以显示的主机驱动，是由主机驱动的状态定义的。只有 `active` 主机驱动将显示为创建节点模板的选项。默认情况下，Rancher 与许多现有的 Docker Machine 驱动打包在一起，但你也可以创建自定义主机驱动并添加到 Rancher。

 如果你不想向用户显示特定的主机驱动，则需要停用这些主机驱动。

@@ -2,7 +2,7 @@
 title: 主机驱动
 ---

-主机驱动用于配置主机，Rancher 使用这些主机启动和管理 Kubernetes 集群。主机驱动与 [Docker Machine 驱动](https://docs.docker.com/machine/drivers/)相同。创建主机模板时可以显示的主机驱动，是由主机驱动的状态定义的。只有 `active` 主机驱动将显示为创建节点模板的选项。默认情况下，Rancher 与许多现有的 Docker Machine 驱动打包在一起，但你也可以创建自定义主机驱动并添加到 Rancher。
+主机驱动用于配置主机，Rancher 使用这些主机启动和管理 Kubernetes 集群。主机驱动与 [Docker Machine 驱动](https://github.com/docker/docs/blob/vnext-engine/machine/drivers/index.md)相同。创建主机模板时可以显示的主机驱动，是由主机驱动的状态定义的。只有 `active` 主机驱动将显示为创建节点模板的选项。默认情况下，Rancher 与许多现有的 Docker Machine 驱动打包在一起，但你也可以创建自定义主机驱动并添加到 Rancher。

 如果你不想向用户显示特定的主机驱动，则需要停用这些主机驱动。

@@ -38,4 +38,4 @@ title: 主机驱动

 ## 开发自己的主机驱动

-主机驱动使用 [Docker Machine](https://docs.docker.com/machine/) 来实现。
+主机驱动使用 [Docker Machine](https://github.com/docker/docs/blob/vnext-engine/machine/overview.md) 来实现。
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Billy Tat	a9463f72f3	Merge pull request #1524 from rancher/v2.9.3 Merge v2.9.3 release branch into main	2024-10-24 19:22:08 -07:00
Billy Tat	17bc799d18	Merge pull request #1523 from rancher/v2.8.9 Merge v2.8.9 release branch into main	2024-10-24 19:22:03 -07:00
Billy Tat	bb9532832a	Merge pull request #1522 from rancher/v2.7.16 Merge v2.7.16 release branch into main	2024-10-24 19:21:56 -07:00
Billy Tat	c015335fd6	Merge pull request #1519 from btat/zh-2.9.3-release-maintenance Apply PR#1514 to zh docs	2024-10-24 14:36:06 -07:00
Billy Tat	b628e5795b	Merge pull request #1518 from btat/zh-2.8.9-release-maintenance Apply PR#1515 to zh docs	2024-10-24 14:36:03 -07:00
Billy Tat	bd79ca0af6	Merge pull request #1517 from btat/zh-2.7.16-release-maintenance Apply PR#1516 to zh docs	2024-10-24 14:36:00 -07:00
Billy Tat	85e9da8ebc	Merge pull request #1520 from rancher/dependabot/submodules/dot-github/styles/suse-vale-styleguide-c13923f Bump .github/styles/suse-vale-styleguide from `45136e8` to `c13923f`	2024-10-23 10:55:29 -07:00
dependabot[bot]	046978765b	Bump .github/styles/suse-vale-styleguide from `45136e8` to `c13923f` Bumps [.github/styles/suse-vale-styleguide](https://github.com/openSUSE/suse-vale-styleguide) from `45136e8` to `c13923f`. - [Release notes](https://github.com/openSUSE/suse-vale-styleguide/releases) - [Commits](https://github.com/openSUSE/suse-vale-styleguide/compare/45136e8ea14ebbe0851ae87791f068507b02d636...c13923f36932ef4eaa5e5e50ab0e5445bb0eb70b) --- updated-dependencies: - dependency-name: ".github/styles/suse-vale-styleguide" dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>	2024-10-23 16:45:12 +00:00
Billy Tat	ea6b368ce5	Apply PR#1514 (2.9.3 release maintenace tasks) to zh docs	2024-10-22 18:58:02 -07:00
Billy Tat	833d6f0e1b	Apply PR#1516 (2.7.16 release maintenace tasks) to zh docs	2024-10-22 18:55:03 -07:00
Billy Tat	f4e61ac811	Apply PR#1515 (2.8.9 release maintenace tasks) to zh docs	2024-10-22 18:54:07 -07:00
Billy Tat	893acac987	Merge pull request #1514 from btat/2.9.3-release-maintenace 2.9.3 release maintenace tasks	2024-10-22 16:16:02 -07:00
Billy Tat	7c7af1349f	Merge pull request #1515 from btat/2.8.9-maintenance 2.8.9 release maintenace tasks	2024-10-22 16:15:49 -07:00
Billy Tat	0af60cc5e4	Merge pull request #1516 from btat/2.7.16-maintenance 2.7.16 release maintenace tasks	2024-10-22 16:15:38 -07:00
Billy Tat	f02c9fa903	[2.7.16] deprecated features table entry	2024-10-21 15:52:45 -07:00
Billy Tat	5fdee777bd	[2.7.16] csp adapter table entry	2024-10-21 15:52:43 -07:00
Billy Tat	f1bb58afb8	[2.7.16] webhook table entry	2024-10-21 15:52:40 -07:00
Billy Tat	d1b91c66ca	[2.7.16] versions table entry	2024-10-21 15:52:32 -07:00
Billy Tat	0027e75e1b	[2.8.9] deprecated features table entry	2024-10-21 14:58:03 -07:00
Billy Tat	41f2fc445c	[2.8.9] csp adapter table entry	2024-10-21 14:47:50 -07:00
Billy Tat	0804f66af1	[2.8.9] webhook table entry	2024-10-21 14:47:22 -07:00
Billy Tat	1307c56eb4	[2.8.9] versions table entry	2024-10-21 14:46:22 -07:00
Billy Tat	f9cc03d60a	[2.9.3] CNI popularity	2024-10-21 14:10:43 -07:00
Billy Tat	9446177dc4	[2.9.3] deprecated features table entry	2024-10-21 14:06:30 -07:00
Billy Tat	99800a17ef	[2.9.3] csp adapter table entry	2024-10-21 14:01:23 -07:00
Billy Tat	8abdd21d8a	[2.9.3] webhook table entry	2024-10-21 14:00:01 -07:00
Billy Tat	c6ba83859b	[2.9.3] versions table	2024-10-21 13:56:07 -07:00
Billy Tat	94b65faa44	Merge pull request #827 from eliaoggian/patch-1 Add client roles mapping section	2024-10-18 16:53:10 -07:00
Billy Tat	11d4078f46	Apply `da5890332` (Add client roles mapping section) to other doc versions/languages	2024-10-18 15:08:32 -07:00
eliaoggian	da58903325	Add client roles mapping section	2024-10-18 13:40:50 -07:00
Billy Tat	945315f245	Merge pull request #1513 from btat/docker-links [SURE-9212] Use GitHub links for upstream Docker Machine docs (404s)	2024-10-18 10:07:55 -07:00
Billy Tat	b4ce792df2	Use GitHub links for upstream Docker Machine docs (404s)	2024-10-17 16:41:11 -07:00
Billy Tat	1a843f0a4d	Merge pull request #1509 from btat/disable-vale-workflow Remove vale workflow - contains unapproved GHA	2024-10-16 07:46:36 -07:00
Billy Tat	c23bc94ea0	Remove vale workflow - contains unapproved GHA	2024-10-15 16:48:28 -07:00
Billy Tat	71ac7dcbfc	Merge pull request #1499 from inichols/patch-1 Add manage-namespaces documentation	2024-10-15 15:30:48 -07:00
Billy Tat	bda113856e	Merge pull request #1306 from sunilarjun/windows_clusters Windows Clusters Page Refresh - RKE2 Instructions	2024-10-15 14:02:38 -07:00
Billy Tat	277b580982	Port `93710057` (Add manage-namespaces documentation) to other en/zh 2.7-2.9	2024-10-15 13:53:49 -07:00
Billy Tat	344d8a459e	Merge pull request #1503 from sunilarjun/fix-spelling Fix Spelling Error	2024-10-15 13:23:46 -07:00
Sunil Singh	a38f3e99fe	Fixing spelling error Signed-off-by: Sunil Singh <sunil.singh@suse.com>	2024-10-15 08:56:00 -07:00
Sunil Singh	67d40678bd	Merge pull request #1502 from sharuzzaman/patch-1 fix minor typo in aws.md	2024-10-15 08:45:32 -07:00
Sharuzzaman Ahmat Raslan	55134189c4	fix minor typo in aws.md fix minor typo for "requirements"	2024-10-15 17:45:31 +08:00
Sunil Singh	ffe10f7547	Rephrasing sentence with repeated words Signed-off-by: Sunil Singh <sunil.singh@suse.com>	2024-10-14 11:52:08 -07:00
Sunil Singh	a490c41345	Adding update to v2.9 Signed-off-by: Sunil Singh <sunil.singh@suse.com>	2024-10-14 11:45:38 -07:00
Sunil Singh	7550ebdc0d	Merge branch 'rancher:main' into windows_clusters	2024-10-14 10:30:42 -07:00
Sunil Singh	1a616407fb	Merge pull request #1500 from rancher/dependabot/submodules/dot-github/styles/suse-vale-styleguide-45136e8 Bump .github/styles/suse-vale-styleguide from `f773efe` to `45136e8`	2024-10-11 10:09:10 -07:00
dependabot[bot]	5c65a6af95	Bump .github/styles/suse-vale-styleguide from `f773efe` to `45136e8` Bumps [.github/styles/suse-vale-styleguide](https://github.com/openSUSE/suse-vale-styleguide) from `f773efe` to `45136e8`. - [Release notes](https://github.com/openSUSE/suse-vale-styleguide/releases) - [Commits](https://github.com/openSUSE/suse-vale-styleguide/compare/f773efe265a8aa99ee6f9ebd0decd28ec23dc161...45136e8ea14ebbe0851ae87791f068507b02d636) --- updated-dependencies: - dependency-name: ".github/styles/suse-vale-styleguide" dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>	2024-10-11 16:15:23 +00:00
Ian	937100578f	Add manage-namespaces documentation https://github.com/rancher/webhook/blob/release/v0.4/docs.md#project-annotation	2024-10-10 12:23:48 -04:00
Billy Tat	20d079f793	Merge pull request #1498 from btat/support-matrix-link Add missing support matrix links 2.9.2, 2.8.8, 2.8.6, 2.7.15	2024-10-09 12:48:43 -07:00
Billy Tat	fc3da395f2	Merge pull request #1496 from btat/2.9-ui-redirects Add redirects used in dashboard#12040	2024-10-09 12:48:34 -07:00
Billy Tat	6304229950	Add missing support matrix links 2.9.2, 2.8.8, 2.8.6, 2.7.15 - Fix incorrect syntax on 2.9.1, 2.8.7 links - Move 2.6.x under EOL	2024-10-08 13:27:42 -07:00
Billy Tat	c633a956f0	Add redirects used in dashboard#12040	2024-10-03 14:11:47 -07:00
pdellamoreandGuilherme Macedo	854582ad8e	Update Rancher CVE Status (#1493 ) * Update Rancher CVE Status * Update versioned docs * Update versioned_docs/version-2.9/reference-guides/rancher-security/security-advisories-and-cves.md --------- Co-authored-by: Guilherme Macedo <guilherme@gmacedo.com>	2024-10-01 13:32:38 -07:00
Billy Tat	c58f080356	Merge pull request #1492 from martyav/fix-order-of-headings-2 Fix order of headings 2	2024-09-23 10:24:47 -07:00
martyav	6c694a48fb	merge conflicts	2024-09-23 12:12:01 -04:00
martyav	05367ada1f	fixed neuvector.overview.md	2024-09-23 12:05:04 -04:00
Billy Tat	cefe2dede2	Merge pull request #1491 from btat/misc-fixes Misc fixes	2024-09-23 09:04:47 -07:00
martyav	064f8d154e	fixed monitoring-and-alerting.md	2024-09-23 12:01:43 -04:00
martyav	0e6787fb1a	fixed longhorn/overview.md	2024-09-23 11:51:37 -04:00
martyav	7ed34be460	fixed taints-and-tolerations.md	2024-09-23 11:32:45 -04:00
martyav	0a583cfd96	fix logging-helm-chart-options.md	2024-09-23 11:25:29 -04:00
martyav	d30297a7ec	fix logging-architecture.md	2024-09-23 11:22:53 -04:00
martyav	25ca84160c	fix harvester/overview.md	2024-09-23 11:20:06 -04:00
martyav	e56ee25390	fix custom-benchmark.md	2024-09-23 11:17:40 -04:00
martyav	1b842c7a60	fixed cis-scans/configuration-reference.md	2024-09-23 10:54:45 -04:00
martyav	3c7ae53ca7	fixed supportconfig.md	2024-09-23 10:48:45 -04:00
martyav	e0a8ee2fec	Revert "fixed http-proxy-configuration.md" This reverts commit `e0b46a9019`.	2024-09-23 10:38:57 -04:00
martyav	a6415414bc	Revert "fixed prometheus-operator.md again -- broken admonition in adoc version of file due to ':::note Important:' syntax" This reverts commit `870c79d7f4`.	2024-09-23 10:38:18 -04:00
Billy Tat	7d05add335	Filepath not needed for link to section on same page	2024-09-22 15:37:25 -07:00
Billy Tat	616971b754	Incorrect link location	2024-09-22 13:51:49 -07:00
Billy Tat	a852001c41	Replace roundabout link path	2024-09-22 10:52:51 -07:00
Billy Tat	65012c0616	Link to correct file instead of self-reference	2024-09-22 10:46:27 -07:00
Billy Tat	efd2bd289e	Incorrect/self-referencing link	2024-09-22 10:17:26 -07:00
Billy Tat	2b36bf35c1	Fix indentation: causing triple backtick to render in codeblock	2024-09-20 15:48:20 -07:00
Billy Tat	4a06d3b5fb	Remove self-reference in link	2024-09-20 15:35:44 -07:00
Billy Tat	7040fd6ef6	Use filepath syntax for link	2024-09-20 15:27:20 -07:00
Billy Tat	f5b5da0e71	Use consistent Q/A syntax	2024-09-20 15:23:39 -07:00
Billy Tat	03c7c1e64b	Merge pull request #1490 from btat/ui-experimental-sidebar Add missing sidebar entry for ui server side pagination	2024-09-20 11:28:31 -07:00
Billy Tat	bf56b00211	Add missing sidebar entry for ui server side pagination	2024-09-20 10:42:40 -07:00
martyav	4bf87b13c4	fixed air-gapped-upgrades.md	2024-09-20 11:24:20 -04:00
martyav	e0b46a9019	fixed http-proxy-configuration.md	2024-09-20 11:21:27 -04:00
martyav	870c79d7f4	fixed prometheus-operator.md again -- broken admonition in adoc version of file due to ':::note Important:' syntax	2024-09-20 11:13:15 -04:00
martyav	8d94b3ce83	fixed node-template-configuration/digital-ocean.md	2024-09-19 15:31:56 -04:00
martyav	07b62b0443	fixed gke-private-clusters.md	2024-09-19 15:25:43 -04:00
martyav	49156a110c	fixed dynamically-provision-new-storage,md	2024-09-19 15:16:57 -04:00
martyav	ac7f517184	fixed set-up-existing-storage.md	2024-09-19 15:16:46 -04:00
martyav	b978a56e85	fixed advanced-options.md	2024-09-19 15:16:32 -04:00
martyav	9bd7ddaf83	fixed prometheus-federator.md	2024-09-19 15:16:19 -04:00
martyav	eac601179f	fixed add-users-to-projects	2024-09-19 15:16:07 -04:00
martyav	21ec1b7320	fixed other-troubleshooting-tips/registered-clusters.md	2024-09-19 12:41:31 -04:00
martyav	9c3281e07e	fixed user-id-tracking-in-audit-logs.md	2024-09-19 12:27:48 -04:00
martyav	cc9e0ea135	fixed other-troubleshooting-tips/networking.md	2024-09-19 12:25:02 -04:00
martyav	e6ffc6456c	fixed other-troubleshooting-tips/rancher-ha.md	2024-09-17 17:31:27 -04:00
martyav	4a6721f6ab	fixed expired-webhook-certificate-rotation.md	2024-09-17 16:30:17 -04:00
martyav	40901b29f7	fixed rancher-security.md	2024-09-17 16:25:05 -04:00
martyav	3552897924	fixed kubernetes-security-best-practices.md	2024-09-17 16:18:39 -04:00
martyav	7920b689cc	Fix order of headings part 2 - next 30 commits fixed communicating-with-downstream-user-clusters.md	2024-09-17 16:15:24 -04:00
Sunil Singh	1c6891d6c4	Applying phrasing updates after review. Signed-off-by: Sunil Singh <sunil.singh@suse.com>	2024-06-24 16:08:56 -06:00
Sunil Singh	df0a01ef27	Updating after review and clarification from support on CNI use/k8s versioning. Signed-off-by: Sunil Singh <sunil.singh@suse.com>	2024-06-04 15:18:07 -07:00
Sunil Singh	81cc1f2175	Updating across versions after review. Signed-off-by: Sunil Singh <sunil.singh@suse.com>	2024-05-28 09:28:16 -07:00
Sunil Singh	79b33ad924	Syncing versions Signed-off-by: Sunil Singh <sunil.singh@suse.com>	2024-05-24 16:06:31 -07:00
Sunil Singh	436651447d	Updating Add Nodes to the Cluster section with updated UI instructions on registering master and worker nodes for Linux/Windows. Added note for Windows worker that Linux etcd, controlplane, and worker roles must be active to display Windows worker registration command. Signed-off-by: Sunil Singh <sunil.singh@suse.com>	2024-05-24 13:37:59 -07:00
Sunil Singh	4ccdc3817d	Updating section Create the Cluster... with removing changed UI items in Rancher and rephrasing steps with new UI fields. Signed-off-by: Sunil Singh <sunil.singh@suse.com>	2024-05-22 14:37:16 -07:00
Sunil Singh	2543c1baf8	Updating with Calico/Flannel CNI support and updating UI command. Signed-off-by: Sunil Singh <sunil.singh@suse.com>	2024-05-22 13:23:15 -07:00
Sunil Singh	74c17ebeee	Updating initial section with removal of RKE1 instructions and requirements, and rephrasing with RKE2 terminology and support matrix. Signed-off-by: Sunil Singh <sunil.singh@suse.com>	2024-05-22 13:05:57 -07:00