mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-28 14:08:55 +00:00
30 lines
55 KiB
HTML
30 lines
55 KiB
HTML
<!doctype html>
|
||
<html lang="en" dir="ltr" class="docs-wrapper docs-doc-page docs-version-2.0-2.4 plugin-docs plugin-id-default docs-doc-id-reference-guides/best-practices/management" data-has-hydrated="false">
|
||
<head>
|
||
<meta charset="UTF-8">
|
||
<meta name="generator" content="Docusaurus v2.4.3">
|
||
<title data-rh="true">Tips for Scaling, Security and Reliability | Rancher</title><meta data-rh="true" name="viewport" content="width=device-width,initial-scale=1"><meta data-rh="true" name="twitter:card" content="summary_large_image"><meta data-rh="true" property="og:url" content="https://ranchermanager.docs.rancher.com/v2.0-v2.4/reference-guides/best-practices/management"><meta data-rh="true" name="docusaurus_locale" content="en"><meta data-rh="true" name="docsearch:language" content="en"><meta data-rh="true" name="docusaurus_version" content="2.0-2.4"><meta data-rh="true" name="docusaurus_tag" content="docs-default-2.0-2.4"><meta data-rh="true" name="docsearch:version" content="2.0-2.4"><meta data-rh="true" name="docsearch:docusaurus_tag" content="docs-default-2.0-2.4"><meta data-rh="true" property="og:title" content="Tips for Scaling, Security and Reliability | Rancher"><meta data-rh="true" name="description" content="Rancher allows you to set up numerous combinations of configurations. Some configurations are more appropriate for development and testing, while there are other best practices for production environments for maximum availability and fault tolerance. The following best practices should be followed for production."><meta data-rh="true" property="og:description" content="Rancher allows you to set up numerous combinations of configurations. Some configurations are more appropriate for development and testing, while there are other best practices for production environments for maximum availability and fault tolerance. The following best practices should be followed for production."><link data-rh="true" rel="icon" href="/img/favicon.png"><link data-rh="true" rel="canonical" href="https://ranchermanager.docs.rancher.com/v2.0-v2.4/reference-guides/best-practices/management"><link data-rh="true" rel="alternate" href="https://ranchermanager.docs.rancher.com/v2.0-v2.4/reference-guides/best-practices/management" hreflang="en"><link data-rh="true" rel="alternate" href="https://ranchermanager.docs.rancher.com/zh/v2.0-v2.4/reference-guides/best-practices/management" hreflang="zh"><link data-rh="true" rel="alternate" href="https://ranchermanager.docs.rancher.com/v2.0-v2.4/reference-guides/best-practices/management" hreflang="x-default"><link data-rh="true" rel="preconnect" href="https://30NEY6C9UY-dsn.algolia.net" crossorigin="anonymous"><link rel="preconnect" href="https://www.googletagmanager.com">
|
||
<script>window.dataLayer=window.dataLayer||[]</script>
|
||
<script>!function(e,t,a,n,g){e[n]=e[n]||[],e[n].push({"gtm.start":(new Date).getTime(),event:"gtm.js"});var m=t.getElementsByTagName(a)[0],r=t.createElement(a);r.async=!0,r.src="https://www.googletagmanager.com/gtm.js?id=GTM-57KS2MW",m.parentNode.insertBefore(r,m)}(window,document,"script","dataLayer")</script>
|
||
|
||
|
||
|
||
<link rel="search" type="application/opensearchdescription+xml" title="Rancher" href="/opensearch.xml">
|
||
|
||
|
||
|
||
<script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" charset="UTF-8" data-domain-script="0f98beb0-fc4c-417d-a42e-564e2cae42d2" async></script>
|
||
<script src="/scripts/optanonwrapper.js" async></script><link rel="stylesheet" href="/assets/css/styles.dea80607.css">
|
||
<link rel="preload" href="/assets/js/runtime~main.d98f8a34.js" as="script">
|
||
<link rel="preload" href="/assets/js/main.e9ebdfba.js" as="script">
|
||
</head>
|
||
<body class="navigation-with-keyboard">
|
||
<noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-57KS2MW" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
|
||
|
||
|
||
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=new URLSearchParams(window.location.search).get("docusaurus-theme")}catch(t){}return t}()||function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
|
||
<div role="region" aria-label="Skip to main content"><a class="skipToContent_fXgn" href="#__docusaurus_skipToContent_fallback">Skip to main content</a></div><nav aria-label="Main" class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Toggle navigation bar" aria-expanded="false" class="navbar__toggle clean-btn" type="button"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/"><div class="navbar__logo"><img src="/img/rancher-logo-horiz-color.svg" alt="logo" class="themedImage_ToTc themedImage--light_HNdA"><img src="/img/rancher-logo-horiz-color.svg" alt="logo" class="themedImage_ToTc themedImage--dark_i4oU"></div><b class="navbar__title text--truncate"></b></a><div class="navbar__item dropdown dropdown--hoverable"><a aria-current="page" class="navbar__link active" aria-haspopup="true" aria-expanded="false" role="button" href="/v2.0-v2.4">v2.0-v2.4</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/">Latest</a></li><li><a class="dropdown__link" href="/v2.9">v2.9 (Preview)</a></li><li><a class="dropdown__link" href="/v2.8">v2.8</a></li><li><a class="dropdown__link" href="/v2.7">v2.7</a></li><li><a class="dropdown__link" href="/v2.6">v2.6</a></li><li><a class="dropdown__link" href="/v2.5">v2.5</a></li><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/v2.0-v2.4/reference-guides/best-practices/management">v2.0-v2.4</a></li><li><a class="dropdown__link" href="/versions">All versions</a></li></ul></div><div class="navbar__item dropdown dropdown--hoverable"><a href="#" aria-haspopup="true" aria-expanded="false" role="button" class="navbar__link"><svg viewBox="0 0 24 24" width="20" height="20" aria-hidden="true" class="iconLanguage_nlXk"><path fill="currentColor" d="M12.87 15.07l-2.54-2.51.03-.03c1.74-1.94 2.98-4.17 3.71-6.53H17V4h-7V2H8v2H1v1.99h11.17C11.5 7.92 10.44 9.75 9 11.35 8.07 10.32 7.3 9.19 6.69 8h-2c.73 1.63 1.73 3.17 2.98 4.56l-5.09 5.02L4 19l5-5 3.11 3.11.76-2.04zM18.5 10h-2L12 22h2l1.12-3h4.75L21 22h2l-4.5-12zm-2.62 7l1.62-4.33L19.12 17h-3.24z"></path></svg>English</a><ul class="dropdown__menu"><li><a href="/v2.0-v2.4/reference-guides/best-practices/management" target="_self" rel="noopener noreferrer" class="dropdown__link dropdown__link--active" lang="en">English</a></li><li><a href="/zh/v2.0-v2.4/reference-guides/best-practices/management" target="_self" rel="noopener noreferrer" class="dropdown__link" lang="zh">简体中文</a></li></ul></div><div class="searchBox_ZlJk"><button type="button" class="DocSearch DocSearch-Button" aria-label="Search"><span class="DocSearch-Button-Container"><svg width="20" height="20" class="DocSearch-Search-Icon" viewBox="0 0 20 20"><path d="M14.386 14.386l4.0877 4.0877-4.0877-4.0877c-2.9418 2.9419-7.7115 2.9419-10.6533 0-2.9419-2.9418-2.9419-7.7115 0-10.6533 2.9418-2.9419 7.7115-2.9419 10.6533 0 2.9419 2.9418 2.9419 7.7115 0 10.6533z" stroke="currentColor" fill="none" fill-rule="evenodd" stroke-linecap="round" stroke-linejoin="round"></path></svg><span class="DocSearch-Button-Placeholder">Search</span></span><span class="DocSearch-Button-Keys"></span></button></div></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a href="#" aria-haspopup="true" aria-expanded="false" role="button" class="navbar__link">Quick Links</a><ul class="dropdown__menu"><li><a href="https://github.com/rancher/rancher" target="_blank" rel="noopener noreferrer" class="dropdown__link">GitHub<svg width="12" height="12" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a></li><li><a href="https://github.com/rancher/rancher-docs" target="_blank" rel="noopener noreferrer" class="dropdown__link">Docs GitHub<svg width="12" height="12" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a></li></ul></div><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a href="#" aria-haspopup="true" aria-expanded="false" role="button" class="navbar__link">More from SUSE</a><ul class="dropdown__menu"><li><a href="https://www.rancher.com" target="_blank" rel="noopener noreferrer" class="dropdown__link navbar__icon navbar__rancher">Rancher<svg width="12" height="12" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a></li><li><hr style="margin: 0.3rem 0;"></li><li><a href="https://elemental.docs.rancher.com/" target="_blank" rel="noopener noreferrer" class="dropdown__link navbar__icon navbar__elemental">Elemental<svg width="12" height="12" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a></li><li><a href="https://fleet.rancher.io/" target="_blank" rel="noopener noreferrer" class="dropdown__link navbar__icon navbar__fleet">Fleet<svg width="12" height="12" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a></li><li><a href="https://harvesterhci.io" target="_blank" rel="noopener noreferrer" class="dropdown__link navbar__icon navbar__harvester">Harvester<svg width="12" height="12" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a></li><li><a href="https://rancherdesktop.io/" target="_blank" rel="noopener noreferrer" class="dropdown__link navbar__icon navbar__rancher__desktop">Rancher Desktop<svg width="12" height="12" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a></li><li><hr style="margin: 0.3rem 0;"></li><li><a href="https://opensource.suse.com" target="_blank" rel="noopener noreferrer" class="dropdown__link navbar__icon navbar__suse">More Projects...<svg width="12" height="12" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a></li></ul></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div id="__docusaurus_skipToContent_fallback" class="main-wrapper mainWrapper_z2l0 docsWrapper_BCFX"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_sjWU" type="button"></button><div class="docPage__5DB"><aside class="theme-doc-sidebar-container docSidebarContainer_b6E3"><div class="sidebarViewport_Xe31"><div class="sidebar_njMd"><nav aria-label="Docs sidebar" class="menu thin-scrollbar menu_SIkG"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/v2.0-v2.4">Rancher 2.0-2.4</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" href="/v2.0-v2.4/getting-started">Getting Started</a><button aria-label="Toggle the collapsible sidebar category 'Getting Started'" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" href="/v2.0-v2.4/how-to-guides">How-to Guides</a><button aria-label="Toggle the collapsible sidebar category 'How-to Guides'" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--active" aria-expanded="true" href="/v2.0-v2.4/reference-guides">Reference Guides</a><button aria-label="Toggle the collapsible sidebar category 'Reference Guides'" type="button" class="clean-btn menu__caret"></button></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--active" aria-expanded="true" tabindex="0" href="/v2.0-v2.4/reference-guides/best-practices">Best Practice Guides</a><button aria-label="Toggle the collapsible sidebar category 'Best Practice Guides'" type="button" class="clean-btn menu__caret"></button></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/v2.0-v2.4/reference-guides/best-practices/containers">Tips for Setting Up Containers</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/v2.0-v2.4/reference-guides/best-practices/deployment-strategies">Rancher Deployment Strategies</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/v2.0-v2.4/reference-guides/best-practices/deployment-types">Tips for Running Rancher</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" tabindex="0" href="/v2.0-v2.4/reference-guides/best-practices/management">Tips for Scaling, Security and Reliability</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/v2.0-v2.4/reference-guides/rancher-manager-architecture">Rancher Architecture</a><button aria-label="Toggle the collapsible sidebar category 'Rancher Architecture'" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/v2.0-v2.4/reference-guides/cluster-configuration">Cluster Configuration</a><button aria-label="Toggle the collapsible sidebar category 'Cluster Configuration'" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/v2.0-v2.4/reference-guides/single-node-rancher-in-docker">Single-Node Rancher in Docker</a><button aria-label="Toggle the collapsible sidebar category 'Single-Node Rancher in Docker'" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/v2.0-v2.4/reference-guides/installation-references">Installation References</a><button aria-label="Toggle the collapsible sidebar category 'Installation References'" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/v2.0-v2.4/reference-guides/installation-references/amazon-eks-permissions">Creating an EKS Cluster</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/v2.0-v2.4/reference-guides/configure-openldap">Configuring OpenLDAP</a><button aria-label="Toggle the collapsible sidebar category 'Configuring OpenLDAP'" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/v2.0-v2.4/reference-guides/kubernetes-concepts">Kubernetes Concepts</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/v2.0-v2.4/reference-guides/user-settings">User Settings</a><button aria-label="Toggle the collapsible sidebar category 'User Settings'" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/v2.0-v2.4/reference-guides/cli-with-rancher">CLI with Rancher</a><button aria-label="Toggle the collapsible sidebar category 'CLI with Rancher'" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/v2.0-v2.4/reference-guides/about-the-api">About the API</a><button aria-label="Toggle the collapsible sidebar category 'About the API'" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/v2.0-v2.4/reference-guides/rancher-cluster-tools">Tools for Logging, Monitoring, and More</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/v2.0-v2.4/reference-guides/rancher-project-tools">Project Tools</a><button aria-label="Toggle the collapsible sidebar category 'Project Tools'" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/v2.0-v2.4/reference-guides/system-tools">System Tools</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/v2.0-v2.4/reference-guides/rke1-template-example-yaml">RKE1 Example YAML</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/v2.0-v2.4/reference-guides/pipelines">Pipelines</a><button aria-label="Toggle the collapsible sidebar category 'Pipelines'" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/v2.0-v2.4/reference-guides/rancher-security">Rancher Security Guides</a><button aria-label="Toggle the collapsible sidebar category 'Rancher Security Guides'" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/v2.0-v2.4/reference-guides/v1.6-migration/migration-tools-cli-reference">Migration Tools CLI Reference</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" href="/v2.0-v2.4/explanations">Explanations</a><button aria-label="Toggle the collapsible sidebar category 'Explanations'" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" href="/v2.0-v2.4/faq">FAQ</a><button aria-label="Toggle the collapsible sidebar category 'FAQ'" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" href="/v2.0-v2.4/troubleshooting">Troubleshooting</a><button aria-label="Toggle the collapsible sidebar category 'Troubleshooting'" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/v2.0-v2.4/contribute-to-rancher">Contributing to Rancher</a></li></ul></nav></div></div></aside><main class="docMainContainer_gTbr"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_VOVn"><div class="theme-doc-version-banner alert alert--warning margin-bottom--md" role="alert"><div>This is documentation for <!-- -->Rancher<!-- --> <b>v2.0-v2.4</b>, which is no longer actively maintained.</div><div class="margin-top--md">For up-to-date documentation, see the <b><a href="/">latest version</a></b> (<!-- -->Latest<!-- -->).</div></div><div class="docItemContainer_Djhp"><article><nav class="theme-doc-breadcrumbs breadcrumbsContainer_Z_bl" aria-label="Breadcrumbs"><ul class="breadcrumbs" itemscope="" itemtype="https://schema.org/BreadcrumbList"><li class="breadcrumbs__item"><a aria-label="Home page" class="breadcrumbs__link" href="/"><svg viewBox="0 0 24 24" class="breadcrumbHomeIcon_YNFT"><path d="M10 19v-5h4v5c0 .55.45 1 1 1h3c.55 0 1-.45 1-1v-7h1.7c.46 0 .68-.57.33-.87L12.67 3.6c-.38-.34-.96-.34-1.34 0l-8.36 7.53c-.34.3-.13.87.33.87H5v7c0 .55.45 1 1 1h3c.55 0 1-.45 1-1z" fill="currentColor"></path></svg></a></li><li itemscope="" itemprop="itemListElement" itemtype="https://schema.org/ListItem" class="breadcrumbs__item"><a class="breadcrumbs__link" itemprop="item" href="/v2.0-v2.4/reference-guides"><span itemprop="name">Reference Guides</span></a><meta itemprop="position" content="1"></li><li itemscope="" itemprop="itemListElement" itemtype="https://schema.org/ListItem" class="breadcrumbs__item"><a class="breadcrumbs__link" itemprop="item" href="/v2.0-v2.4/reference-guides/best-practices"><span itemprop="name">Best Practice Guides</span></a><meta itemprop="position" content="2"></li><li itemscope="" itemprop="itemListElement" itemtype="https://schema.org/ListItem" class="breadcrumbs__item breadcrumbs__item--active"><span class="breadcrumbs__link" itemprop="name">Tips for Scaling, Security and Reliability</span><meta itemprop="position" content="3"></li></ul></nav><span class="theme-doc-version-badge badge badge--secondary">Version: v2.0-v2.4</span><div class="tocCollapsible_ETCw theme-doc-toc-mobile tocMobile_ITEo"><button type="button" class="clean-btn tocCollapsibleButton_TO0P">On this page</button></div><div class="theme-doc-markdown markdown"><header><h1>Tips for Scaling, Security and Reliability</h1></header><p>Rancher allows you to set up numerous combinations of configurations. Some configurations are more appropriate for development and testing, while there are other best practices for production environments for maximum availability and fault tolerance. The following best practices should be followed for production.</p><ul><li><a href="#tips-for-preventing-and-handling-problems">Tips for Preventing and Handling Problems</a></li><li><a href="#network-topology">Network Topology</a></li><li><a href="#tips-for-scaling-and-reliability">Tips for Scaling and Reliability</a></li><li><a href="#tips-for-security">Tips for Security</a></li><li><a href="#tips-for-multi-tenant-clusters">Tips for Multi-Tenant Clusters</a></li><li><a href="#class-of-service-and-kubernetes-clusters">Class of Service and Kubernetes Clusters</a></li><li><a href="#network-security">Network Security</a></li></ul><h2 class="anchor anchorWithStickyNavbar_LWe7" id="tips-for-preventing-and-handling-problems">Tips for Preventing and Handling Problems<a href="#tips-for-preventing-and-handling-problems" class="hash-link" aria-label="Direct link to Tips for Preventing and Handling Problems" title="Direct link to Tips for Preventing and Handling Problems"></a></h2><p>These tips can help you solve problems before they happen.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="run-rancher-on-a-supported-os-and-supported-docker-version">Run Rancher on a Supported OS and Supported Docker Version<a href="#run-rancher-on-a-supported-os-and-supported-docker-version" class="hash-link" aria-label="Direct link to Run Rancher on a Supported OS and Supported Docker Version" title="Direct link to Run Rancher on a Supported OS and Supported Docker Version"></a></h3><p>Rancher is container-based and can potentially run on any Linux-based operating system. However, only operating systems listed in the <a href="/v2.0-v2.4/getting-started/installation-and-upgrade/installation-requirements">requirements documentation</a> should be used for running Rancher, along with a supported version of Docker. These versions have been most thoroughly tested and can be properly supported by the Rancher Support team.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="upgrade-your-kubernetes-version">Upgrade Your Kubernetes Version<a href="#upgrade-your-kubernetes-version" class="hash-link" aria-label="Direct link to Upgrade Your Kubernetes Version" title="Direct link to Upgrade Your Kubernetes Version"></a></h3><p>Keep your Kubernetes cluster up to date with a recent and supported version. Typically the Kubernetes community will support the current version and previous three minor releases (for example, 1.14.x, 1.13.x, 1.12.x, and 1.11.x). After a new version is released, the third-oldest supported version reaches EOL (End of Life) status. Running on an EOL release can be a risk if a security issues are found and patches are not available. The community typically makes minor releases every quarter (every three months).</p><p>Rancher’s SLAs are not community dependent, but as Kubernetes is a community-driven software, the quality of experience will degrade as you get farther away from the community's supported target.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="kill-pods-randomly-during-testing">Kill Pods Randomly During Testing<a href="#kill-pods-randomly-during-testing" class="hash-link" aria-label="Direct link to Kill Pods Randomly During Testing" title="Direct link to Kill Pods Randomly During Testing"></a></h3><p>Run chaoskube or a similar mechanism to randomly kill pods in your test environment. This will test the resiliency of your infrastructure and the ability of Kubernetes to self-heal. It's not recommended to run this in your production environment.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="deploy-complicated-clusters-with-terraform">Deploy Complicated Clusters with Terraform<a href="#deploy-complicated-clusters-with-terraform" class="hash-link" aria-label="Direct link to Deploy Complicated Clusters with Terraform" title="Direct link to Deploy Complicated Clusters with Terraform"></a></h3><p>Rancher's "Add Cluster" UI is preferable for getting started with Kubernetes cluster orchestration or for simple use cases. However, for more complex or demanding use cases, it is recommended to use a CLI/API driven approach. <a href="https://www.terraform.io/" target="_blank" rel="noopener noreferrer">Terraform</a> is recommended as the tooling to implement this. When you use Terraform with version control and a CI/CD environment, you can have high assurances of consistency and reliability when deploying Kubernetes clusters. This approach also gives you the most customization options.</p><p>Rancher <a href="https://rancher.com/blog/2019/rancher-2-terraform-provider/" target="_blank" rel="noopener noreferrer">maintains a Terraform provider</a> for working with Rancher 2.0 Kubernetes. It is called the <a href="https://www.terraform.io/docs/providers/rancher2/index.html" target="_blank" rel="noopener noreferrer">Rancher2 Provider.</a></p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="upgrade-rancher-in-a-staging-environment">Upgrade Rancher in a Staging Environment<a href="#upgrade-rancher-in-a-staging-environment" class="hash-link" aria-label="Direct link to Upgrade Rancher in a Staging Environment" title="Direct link to Upgrade Rancher in a Staging Environment"></a></h3><p>All upgrades, both patch and feature upgrades, should be first tested on a staging environment before production is upgraded. The more closely the staging environment mirrors production, the higher chance your production upgrade will be successful.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="renew-certificates-before-they-expire">Renew Certificates Before they Expire<a href="#renew-certificates-before-they-expire" class="hash-link" aria-label="Direct link to Renew Certificates Before they Expire" title="Direct link to Renew Certificates Before they Expire"></a></h3><p>Multiple people in your organization should set up calendar reminders for certificate renewal. Consider renewing the certificate two weeks to one month in advance. If you have multiple certificates to track, consider using <a href="/v2.0-v2.4/reference-guides/rancher-cluster-tools">monitoring and alerting mechanisms</a> to track certificate expiration.</p><p>Rancher-provisioned Kubernetes clusters will use certificates that expire in one year. Clusters provisioned by other means may have a longer or shorter expiration.</p><p>Certificates can be renewed for Rancher-provisioned clusters <a href="/v2.0-v2.4/how-to-guides/advanced-user-guides/manage-clusters/rotate-certificates">through the Rancher user interface</a>.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="enable-recurring-snapshots-for-backing-up-and-restoring-the-cluster">Enable Recurring Snapshots for Backing up and Restoring the Cluster<a href="#enable-recurring-snapshots-for-backing-up-and-restoring-the-cluster" class="hash-link" aria-label="Direct link to Enable Recurring Snapshots for Backing up and Restoring the Cluster" title="Direct link to Enable Recurring Snapshots for Backing up and Restoring the Cluster"></a></h3><p>Make sure etcd recurring snapshots are enabled. Extend the snapshot retention to a period of time that meets your business needs. In the event of a catastrophic failure or deletion of data, this may be your only recourse for recovery. For details about configuring snapshots, refer to the <a href="https://rancher.com/docs/rke/latest/en/etcd-snapshots/" target="_blank" rel="noopener noreferrer">RKE documentation</a> or the <a href="/v2.0-v2.4/how-to-guides/new-user-guides/backup-restore-and-disaster-recovery">Rancher documentation on backups</a>.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="provision-clusters-with-rancher">Provision Clusters with Rancher<a href="#provision-clusters-with-rancher" class="hash-link" aria-label="Direct link to Provision Clusters with Rancher" title="Direct link to Provision Clusters with Rancher"></a></h3><p>When possible, use Rancher to provision your Kubernetes cluster rather than importing a cluster. This will ensure the best compatibility and supportability.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="use-stable-and-supported-rancher-versions-for-production">Use Stable and Supported Rancher Versions for Production<a href="#use-stable-and-supported-rancher-versions-for-production" class="hash-link" aria-label="Direct link to Use Stable and Supported Rancher Versions for Production" title="Direct link to Use Stable and Supported Rancher Versions for Production"></a></h3><p>Do not upgrade production environments to alpha, beta, release candidate (rc), or "latest" versions. These early releases are often not stable and may not have a future upgrade path.</p><p>When installing or upgrading a non-production environment to an early release, anticipate problems such as features not working, data loss, outages, and inability to upgrade without a reinstall.</p><p>Make sure the feature version you are upgrading to is considered "stable" as determined by Rancher. Use the beta, release candidate, and "latest" versions in a testing, development, or demo environment to try out new features. Feature version upgrades, for example 2.1.x to 2.2.x, should be considered as and when they are released. Some bug fixes and most features are not back ported into older versions.</p><p>Keep in mind that Rancher does End of Life support for old versions, so you will eventually want to upgrade if you want to continue to receive patches.</p><p>For more detail on what happens during the Rancher product lifecycle, refer to the <a href="https://rancher.com/support-maintenance-terms/" target="_blank" rel="noopener noreferrer">Support Maintenance Terms</a>.</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="network-topology">Network Topology<a href="#network-topology" class="hash-link" aria-label="Direct link to Network Topology" title="Direct link to Network Topology"></a></h2><p>These tips can help Rancher work more smoothly with your network.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="use-low-latency-networks-for-communication-within-clusters">Use Low-latency Networks for Communication Within Clusters<a href="#use-low-latency-networks-for-communication-within-clusters" class="hash-link" aria-label="Direct link to Use Low-latency Networks for Communication Within Clusters" title="Direct link to Use Low-latency Networks for Communication Within Clusters"></a></h3><p>Kubernetes clusters are best served by low-latency networks. This is especially true for the control plane components and etcd, where lots of coordination and leader election traffic occurs. Networking between Rancher server and the Kubernetes clusters it manages are more tolerant of latency.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="allow-rancher-to-communicate-directly-with-clusters">Allow Rancher to Communicate Directly with Clusters<a href="#allow-rancher-to-communicate-directly-with-clusters" class="hash-link" aria-label="Direct link to Allow Rancher to Communicate Directly with Clusters" title="Direct link to Allow Rancher to Communicate Directly with Clusters"></a></h3><p>Limit the use of proxies or load balancers between Rancher server and Kubernetes clusters. As Rancher is maintaining a long-lived web sockets connection, these intermediaries can interfere with the connection lifecycle as they often weren't configured with this use case in mind.</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="tips-for-scaling-and-reliability">Tips for Scaling and Reliability<a href="#tips-for-scaling-and-reliability" class="hash-link" aria-label="Direct link to Tips for Scaling and Reliability" title="Direct link to Tips for Scaling and Reliability"></a></h2><p>These tips can help you scale your cluster more easily.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="use-one-kubernetes-role-per-host">Use One Kubernetes Role Per Host<a href="#use-one-kubernetes-role-per-host" class="hash-link" aria-label="Direct link to Use One Kubernetes Role Per Host" title="Direct link to Use One Kubernetes Role Per Host"></a></h3><p>Separate the etcd, control plane, and worker roles onto different hosts. Don't assign multiple roles to the same host, such as a worker and control plane. This will give you maximum scalability.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="run-the-control-plane-and-etcd-on-virtual-machines">Run the Control Plane and etcd on Virtual Machines<a href="#run-the-control-plane-and-etcd-on-virtual-machines" class="hash-link" aria-label="Direct link to Run the Control Plane and etcd on Virtual Machines" title="Direct link to Run the Control Plane and etcd on Virtual Machines"></a></h3><p>Run your etcd and control plane nodes on virtual machines where you can scale vCPU and memory easily if needed in the future.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="use-at-least-three-etcd-nodes">Use at Least Three etcd Nodes<a href="#use-at-least-three-etcd-nodes" class="hash-link" aria-label="Direct link to Use at Least Three etcd Nodes" title="Direct link to Use at Least Three etcd Nodes"></a></h3><p>Provision 3 or 5 etcd nodes. Etcd requires a quorum to determine a leader by the majority of nodes, therefore it is not recommended to have clusters of even numbers. Three etcd nodes is generally sufficient for smaller clusters and five etcd nodes for large clusters.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="use-at-least-three-control-plane-nodes">Use at Least Three Control Plane Nodes<a href="#use-at-least-three-control-plane-nodes" class="hash-link" aria-label="Direct link to Use at Least Three Control Plane Nodes" title="Direct link to Use at Least Three Control Plane Nodes"></a></h3><p>Provision three or more control plane nodes. Some control plane components, such as the <code>kube-apiserver</code>, run in <a href="https://www.jscape.com/blog/active-active-vs-active-passive-high-availability-cluster" target="_blank" rel="noopener noreferrer">active-active</a> mode and will give you more scalability. Other components such as kube-scheduler and kube-controller run in active-passive mode (leader elect) and give you more fault tolerance.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="monitor-your-cluster">Monitor Your Cluster<a href="#monitor-your-cluster" class="hash-link" aria-label="Direct link to Monitor Your Cluster" title="Direct link to Monitor Your Cluster"></a></h3><p>Closely monitor and scale your nodes as needed. You should <a href="/v2.0-v2.4/explanations/integrations-in-rancher/cluster-monitoring">enable cluster monitoring</a> and use the Prometheus metrics and Grafana visualization options as a starting point.</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="tips-for-security">Tips for Security<a href="#tips-for-security" class="hash-link" aria-label="Direct link to Tips for Security" title="Direct link to Tips for Security"></a></h2><p>Below are some basic tips for increasing security in Rancher. For more detailed information about securing your cluster, you can refer to these resources:</p><ul><li>Rancher's <a href="/v2.0-v2.4/reference-guides/rancher-security">security documentation and Kubernetes cluster hardening guide</a></li><li><a href="https://rancher.com/blog/2019/2019-01-17-101-more-kubernetes-security-best-practices/" target="_blank" rel="noopener noreferrer">101 More Security Best Practices for Kubernetes</a></li></ul><h3 class="anchor anchorWithStickyNavbar_LWe7" id="update-rancher-with-security-patches">Update Rancher with Security Patches<a href="#update-rancher-with-security-patches" class="hash-link" aria-label="Direct link to Update Rancher with Security Patches" title="Direct link to Update Rancher with Security Patches"></a></h3><p>Keep your Rancher installation up to date with the latest patches. Patch updates have important software fixes and sometimes have security fixes. When patches with security fixes are released, customers with Rancher licenses are notified by e-mail. These updates are also posted on Rancher's <a href="https://forums.rancher.com/" target="_blank" rel="noopener noreferrer">forum</a>.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="report-security-issues-directly-to-rancher">Report Security Issues Directly to Rancher<a href="#report-security-issues-directly-to-rancher" class="hash-link" aria-label="Direct link to Report Security Issues Directly to Rancher" title="Direct link to Report Security Issues Directly to Rancher"></a></h3><p>If you believe you have uncovered a security-related problem in Rancher, please communicate this immediately and discretely to the Rancher team (<a href="mailto:security@rancher.com" target="_blank" rel="noopener noreferrer">security@rancher.com</a>). Posting security issues on public forums such as Twitter, Rancher Slack, GitHub, etc. can potentially compromise security for all Rancher customers. Reporting security issues discretely allows Rancher to assess and mitigate the problem. Security patches are typically given high priority and released as quickly as possible.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="only-upgrade-one-component-at-a-time">Only Upgrade One Component at a Time<a href="#only-upgrade-one-component-at-a-time" class="hash-link" aria-label="Direct link to Only Upgrade One Component at a Time" title="Direct link to Only Upgrade One Component at a Time"></a></h3><p>In addition to Rancher software updates, closely monitor security fixes for related software, such as Docker, Linux, and any libraries used by your workloads. For production environments, try to avoid upgrading too many entities during a single maintenance window. Upgrading multiple components can make it difficult to root cause an issue in the event of a failure. As business requirements allow, upgrade one component at a time.</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="tips-for-multi-tenant-clusters">Tips for Multi-Tenant Clusters<a href="#tips-for-multi-tenant-clusters" class="hash-link" aria-label="Direct link to Tips for Multi-Tenant Clusters" title="Direct link to Tips for Multi-Tenant Clusters"></a></h2><h3 class="anchor anchorWithStickyNavbar_LWe7" id="namespaces">Namespaces<a href="#namespaces" class="hash-link" aria-label="Direct link to Namespaces" title="Direct link to Namespaces"></a></h3><p>Each tenant should have their own unique namespaces within the cluster. This avoids naming conflicts and allows resources to be only visible to their owner through use of RBAC policy</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="project-isolation">Project Isolation<a href="#project-isolation" class="hash-link" aria-label="Direct link to Project Isolation" title="Direct link to Project Isolation"></a></h3><p>Use Rancher's Project Isolation to automatically generate Network Policy between Projects (sets of Namespaces). This further protects workloads from interference</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="resource-limits">Resource Limits<a href="#resource-limits" class="hash-link" aria-label="Direct link to Resource Limits" title="Direct link to Resource Limits"></a></h3><p>Enforce use of sane resource limit definitions for every deployment in your cluster. This not only protects the owners of the deployment, but the neighboring resources from other tenants as well. Remember, namespaces do not isolate at the node level, so over-consumption of resources on a node affects other namespace deployments. Admission controllers can be written to require resource limit definitions</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="resource-requirements">Resource Requirements<a href="#resource-requirements" class="hash-link" aria-label="Direct link to Resource Requirements" title="Direct link to Resource Requirements"></a></h3><p>Enforce use of resource requirement definitions for each deployment in your cluster. This enables the scheduler to appropriately schedule workloads. Otherwise you will eventually end up with over-provisioned nodes.</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="class-of-service-and-kubernetes-clusters">Class of Service and Kubernetes Clusters<a href="#class-of-service-and-kubernetes-clusters" class="hash-link" aria-label="Direct link to Class of Service and Kubernetes Clusters" title="Direct link to Class of Service and Kubernetes Clusters"></a></h2><p>A class of service describes the expectations around cluster uptime, durability, and duration of maintenance windows. Typically organizations group these characteristics into labels such as "dev" or "prod"</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="consider-fault-domains">Consider fault domains<a href="#consider-fault-domains" class="hash-link" aria-label="Direct link to Consider fault domains" title="Direct link to Consider fault domains"></a></h3><p>Kubernetes clusters can span multiple classes of service, however it is important to consider the ability for one workload to affect another. Without proper deployment practices such as resource limits, requirements, etc, a deployment that is not behaving well has the potential to impact the health of the cluster. In a "dev" environment it is common for end-users to exercise less caution with deployments, thus increasing the chance of such behavior. Sharing this behavior with your production workload increases risk.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="upgrade-risks">Upgrade risks<a href="#upgrade-risks" class="hash-link" aria-label="Direct link to Upgrade risks" title="Direct link to Upgrade risks"></a></h3><p>Upgrades of Kubernetes are not without risk, the best way to predict the outcome of an upgrade is try it on a cluster of similar load and use case as your production cluster. This is where having non-prod class of service clusters can be advantageous.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="resource-efficiency">Resource Efficiency<a href="#resource-efficiency" class="hash-link" aria-label="Direct link to Resource Efficiency" title="Direct link to Resource Efficiency"></a></h3><p>Clusters can be built with varying degrees of redundancy. In a class of service with low expectations for uptime, resources and cost can be conserved by building clusters without redundant Kubernetes control components. This approach may also free up more budget/resources to increase the redundancy at the production level</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="network-security">Network Security<a href="#network-security" class="hash-link" aria-label="Direct link to Network Security" title="Direct link to Network Security"></a></h2><p>In general, you can use network security best practices in your Rancher and Kubernetes clusters. Consider the following:</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="use-a-firewall-between-your-hosts-and-the-internet">Use a Firewall Between your Hosts and the Internet<a href="#use-a-firewall-between-your-hosts-and-the-internet" class="hash-link" aria-label="Direct link to Use a Firewall Between your Hosts and the Internet" title="Direct link to Use a Firewall Between your Hosts and the Internet"></a></h3><p>Firewalls should be used between your hosts and the Internet (or corporate Intranet). This could be enterprise firewall appliances in a datacenter or SDN constructs in the cloud, such as VPCs, security groups, ingress, and egress rules. Try to limit inbound access only to ports and IP addresses that require it. Outbound access can be shut off (air gap) if environment sensitive information that requires this restriction. If available, use firewalls with intrusion detection and DDoS prevention.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="run-periodic-security-scans">Run Periodic Security Scans<a href="#run-periodic-security-scans" class="hash-link" aria-label="Direct link to Run Periodic Security Scans" title="Direct link to Run Periodic Security Scans"></a></h3><p>Run security and penetration scans on your environment periodically. Even with well design infrastructure, a poorly designed microservice could compromise the entire environment.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/rancher/rancher-docs/edit/main/versioned_docs/version-2.0-2.4/reference-guides/best-practices/management.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_Z9Sw" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_vwxv"><span class="theme-last-updated">Last updated<!-- --> on <b><time datetime="2024-01-13T00:07:44.000Z">Jan 13, 2024</time></b></span></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages"><a class="pagination-nav__link pagination-nav__link--prev" href="/v2.0-v2.4/reference-guides/best-practices/deployment-types"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Tips for Running Rancher</div></a><a class="pagination-nav__link pagination-nav__link--next" href="/v2.0-v2.4/reference-guides/rancher-manager-architecture"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Rancher Architecture</div></a></nav></div></div><div class="col col--3"><div class="tableOfContents_bqdL thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#tips-for-preventing-and-handling-problems" class="table-of-contents__link toc-highlight">Tips for Preventing and Handling Problems</a><ul><li><a href="#run-rancher-on-a-supported-os-and-supported-docker-version" class="table-of-contents__link toc-highlight">Run Rancher on a Supported OS and Supported Docker Version</a></li><li><a href="#upgrade-your-kubernetes-version" class="table-of-contents__link toc-highlight">Upgrade Your Kubernetes Version</a></li><li><a href="#kill-pods-randomly-during-testing" class="table-of-contents__link toc-highlight">Kill Pods Randomly During Testing</a></li><li><a href="#deploy-complicated-clusters-with-terraform" class="table-of-contents__link toc-highlight">Deploy Complicated Clusters with Terraform</a></li><li><a href="#upgrade-rancher-in-a-staging-environment" class="table-of-contents__link toc-highlight">Upgrade Rancher in a Staging Environment</a></li><li><a href="#renew-certificates-before-they-expire" class="table-of-contents__link toc-highlight">Renew Certificates Before they Expire</a></li><li><a href="#enable-recurring-snapshots-for-backing-up-and-restoring-the-cluster" class="table-of-contents__link toc-highlight">Enable Recurring Snapshots for Backing up and Restoring the Cluster</a></li><li><a href="#provision-clusters-with-rancher" class="table-of-contents__link toc-highlight">Provision Clusters with Rancher</a></li><li><a href="#use-stable-and-supported-rancher-versions-for-production" class="table-of-contents__link toc-highlight">Use Stable and Supported Rancher Versions for Production</a></li></ul></li><li><a href="#network-topology" class="table-of-contents__link toc-highlight">Network Topology</a><ul><li><a href="#use-low-latency-networks-for-communication-within-clusters" class="table-of-contents__link toc-highlight">Use Low-latency Networks for Communication Within Clusters</a></li><li><a href="#allow-rancher-to-communicate-directly-with-clusters" class="table-of-contents__link toc-highlight">Allow Rancher to Communicate Directly with Clusters</a></li></ul></li><li><a href="#tips-for-scaling-and-reliability" class="table-of-contents__link toc-highlight">Tips for Scaling and Reliability</a><ul><li><a href="#use-one-kubernetes-role-per-host" class="table-of-contents__link toc-highlight">Use One Kubernetes Role Per Host</a></li><li><a href="#run-the-control-plane-and-etcd-on-virtual-machines" class="table-of-contents__link toc-highlight">Run the Control Plane and etcd on Virtual Machines</a></li><li><a href="#use-at-least-three-etcd-nodes" class="table-of-contents__link toc-highlight">Use at Least Three etcd Nodes</a></li><li><a href="#use-at-least-three-control-plane-nodes" class="table-of-contents__link toc-highlight">Use at Least Three Control Plane Nodes</a></li><li><a href="#monitor-your-cluster" class="table-of-contents__link toc-highlight">Monitor Your Cluster</a></li></ul></li><li><a href="#tips-for-security" class="table-of-contents__link toc-highlight">Tips for Security</a><ul><li><a href="#update-rancher-with-security-patches" class="table-of-contents__link toc-highlight">Update Rancher with Security Patches</a></li><li><a href="#report-security-issues-directly-to-rancher" class="table-of-contents__link toc-highlight">Report Security Issues Directly to Rancher</a></li><li><a href="#only-upgrade-one-component-at-a-time" class="table-of-contents__link toc-highlight">Only Upgrade One Component at a Time</a></li></ul></li><li><a href="#tips-for-multi-tenant-clusters" class="table-of-contents__link toc-highlight">Tips for Multi-Tenant Clusters</a><ul><li><a href="#namespaces" class="table-of-contents__link toc-highlight">Namespaces</a></li><li><a href="#project-isolation" class="table-of-contents__link toc-highlight">Project Isolation</a></li><li><a href="#resource-limits" class="table-of-contents__link toc-highlight">Resource Limits</a></li><li><a href="#resource-requirements" class="table-of-contents__link toc-highlight">Resource Requirements</a></li></ul></li><li><a href="#class-of-service-and-kubernetes-clusters" class="table-of-contents__link toc-highlight">Class of Service and Kubernetes Clusters</a><ul><li><a href="#consider-fault-domains" class="table-of-contents__link toc-highlight">Consider fault domains</a></li><li><a href="#upgrade-risks" class="table-of-contents__link toc-highlight">Upgrade risks</a></li><li><a href="#resource-efficiency" class="table-of-contents__link toc-highlight">Resource Efficiency</a></li></ul></li><li><a href="#network-security" class="table-of-contents__link toc-highlight">Network Security</a><ul><li><a href="#use-a-firewall-between-your-hosts-and-the-internet" class="table-of-contents__link toc-highlight">Use a Firewall Between your Hosts and the Internet</a></li><li><a href="#run-periodic-security-scans" class="table-of-contents__link toc-highlight">Run Periodic Security Scans</a></li></ul></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2024 SUSE Rancher. All Rights Reserved.</div></div></div></footer></div>
|
||
<script src="/assets/js/runtime~main.d98f8a34.js"></script>
|
||
<script src="/assets/js/main.e9ebdfba.js"></script>
|
||
</body>
|
||
</html> |