Rancher - Revision history

Christoph: /* Miscellaneous */

2020-08-20T22:30:22Z

‎Miscellaneous

Christoph: /* Rancher State File */

2020-08-20T22:29:45Z

‎Rancher State File

Christoph: /* External links */

2020-07-25T02:01:21Z

‎External links

Christoph: /* Miscellaneous */

2020-04-17T20:31:24Z

‎Miscellaneous

Christoph at 19:32, 19 December 2019

2019-12-19T19:32:07Z

Christoph at 19:31, 19 December 2019

2019-12-19T19:31:09Z

Christoph: /* Encryption at rest */

2019-08-06T23:17:45Z

‎Encryption at rest

Christoph: /* Encryption at rest */

2019-08-02T23:44:26Z

‎Encryption at rest

Christoph: /* Encryption at rest */

2019-08-02T23:41:07Z

‎Encryption at rest

Christoph: /* Encryption at rest */

2019-08-02T23:36:40Z

‎Encryption at rest

@@ Line 984: / Line 984: @@
     --set 'extraEnv[0].name=CATTLE_SYSTEM_DEFAULT_REGISTRY' \
     --set 'extraEnv[0].value=<nowiki>http://private-registry.example.com/</nowiki>'
 ===Rancher State File===
@@ Line 1,016: / Line 1,021: @@
      python -c 'import sys,json,yaml;data=json.loads(sys.stdin.read());print(yaml.dump(yaml.load(json.dumps(data)),default_flow_style=False))' \
      > rancher-cluster.rkestate_bkup_$(date +%f) 2>/dev/null
 </pre>

@@ Line 1,007: / Line 1,007: @@
      get configmap -n kube-system full-cluster-state -o json | \
      jq -r .data.\"full-cluster-state\" > rancher-cluster.rkestate_bkup_$(date +%f)
 </pre>

@@ Line 1,011: / Line 1,011: @@
 ==External links==
 *[http://rancher.com/ Official website]
 [[Category:Technical and Specialized Skills]]
 [[Category:DevOps]]

@@ Line 984: / Line 984: @@
     --set 'extraEnv[0].name=CATTLE_SYSTEM_DEFAULT_REGISTRY' \
     --set 'extraEnv[0].value=<nowiki>http://private-registry.example.com/</nowiki>'
 ==External links==

@@ Line 1: / Line 1: @@
 '''Rancher''' is a container management platform.
-* Rancher 1.6 natively supports and manages all of your Cattle, Kubernetes, Mesos, and Swarm clusters.
+* Rancher 1.6 natively supports and manages all of your Cattle, Kubernetes, Mesos, and Swarm clusters. Note: Rancher 1.6 has been deprecated.
 * Rancher 2.x is [[Kubernetes]]-as-a-Service.

← Older revision		Revision as of 19:31, 19 December 2019
Line 1:		Line 1:
−	'''Rancher''' is a container management platform. Rancher natively supports and manages all of your Cattle, Kubernetes, Mesos, and Swarm clusters.	+	'''Rancher''' is a container management platform.
		+
		+	* Rancher 1.6 natively supports and manages all of your Cattle, Kubernetes, Mesos, and Swarm clusters.
		+	* Rancher 2.x is [[Kubernetes]]-as-a-Service.

	==Container management==		==Container management==

← Older revision		Revision as of 23:17, 6 August 2019
Line 970:		Line 970:

	If the above works on the <tt>default</tt> namespace, you ''should'' be okay updating all ''Secrets'' in all namespaces (including <tt>kube-system</tt>).		If the above works on the <tt>default</tt> namespace, you ''should'' be okay updating all ''Secrets'' in all namespaces (including <tt>kube-system</tt>).
		+
		+	==Miscellaneous==
		+
		+	* Install Rancher using [[Helm]] with default registry set (useful for private registries):
		+	$ helm install rancher \
		+	--name rancher \
		+	--namespace cattle-system \
		+	--set hostname=rancher.example.com \
		+	--set rancherImageTag=master \
		+	--set 'extraEnv[0].name=CATTLE_SYSTEM_DEFAULT_REGISTRY' \
		+	--set 'extraEnv[0].value=<nowiki>http://private-registry.example.com/</nowiki>'

	==External links==		==External links==

← Older revision		Revision as of 23:44, 2 August 2019
Line 896:		Line 896:

	; After encryption		; After encryption
		+
		+	<div style="margin: 10px; padding: 5px; border: 2px solid red;">'''WARNING!''' You probably should ''not'' (and most likely cannot) enable encryption-at-rest in the way described below on managed Kubernetes clusters in the Public Cloud (e.g., on GKE, EKS, AKS, etc.)
		+	</div>

	* Run the following command on ''all'' of your Rancher HA master nodes (aka the "controller" nodes):		* Run the following command on ''all'' of your Rancher HA master nodes (aka the "controller" nodes):

@@ Line 851: / Line 851: @@
 This section will show how to setup encryption-at-rest for [[Kubernetes]] ''Secrets''.
-; Before
+; Before encryption
 * Check if the Kubernetes API Server (aka "<code>kube-apiserver</code>") is already using encryption at rest:
@@ Line 880: / Line 880: @@
 <pre>
 / # ETCDCTL_API=3 etcdctl get /registry/secrets/default/secret-before -w json
-{"header":{"cluster_id":10635379586599678010,"member_id":17312218561102223823,"revision":13935321,"raft_term":5},"kvs":[{"key":"L3JlZ2lzdHJ5L3NlY3JldHMvZGVmYXVsdC9zZWNyZXQtYmVmb3Jl","create_revision":13935228,"mod_revision":13935228,"version":1,"value":"azhzAAoMCgJ2MRIGU2VjcmV0EqsCCpMCCg1zZWNyZXQtYmVmb3JlEgAaB2RlZmF1bHQiACokNWJhYTZhM2QtYjU3Yi0xMWU5LWFiOGYtMDJmOGZjNjdmNGI4MgA4AEIICPeHk+oFEABivgEKMGt1YmVjdGwua3ViZXJuZXRlcy5pby9sYXN0LWFwcGxpZWQtY29uZmlndXJhdGlvbhKJAXsiYXBpVmVyc2lvbiI6InYxIiwiZGF0YSI6eyJmb28iOiJZbUZ5Q2c9PSJ9LCJraW5kIjoiU2VjcmV0IiwibWV0YWRhdGEiOnsiYW5ub3RhdGlvbnMiOnt9LCJuYW1lIjoic2VjcmV0LWJlZm9yZSIsIm5hbWVzcGFjZSI6ImRlZmF1bHQifX0KegASCwoDZm9vEgRiYXIKGgZPcGFxdWUaACIA"}],"count":1}
+{"header":{"cluster_id":10635379586599678010,"member_id":17312218561102223823,"revision":13935321,"raft_term":5},"kvs":[{"key":"L3JlZ2lzdHJ5L3NlY3JldHMvZGVmYXVsdC9zZWNyZXQtYmVmb3Jl","create_revision":13935228,"mod_revision":13935228,"version":1,
 / # echo "azhzAAoM..." | base64 -d  #<- show the mangled contents
@@ Line 894: / Line 895: @@
 As you can see, anyone with access to your ETCD cluster (aka your distributed key-value store) can easily view your ''Secrets''. That is, your Kubernetes cluster is ''not'' using encryption-at-rest for your ''Secrets''.
-; After
+; After encryption
 * Run the following command on ''all'' of your Rancher HA master nodes (aka the "controller" nodes):
@@ Line 964: / Line 965: @@
 '''IMPORTANT NOTE:''' Be careful with the above command! If you have mis-configured something with your encryption at rest, you could lock yourself out of your entire Kubernetes cluster. A better way to test that you have everything setup correctly is to ''only'' run the above command (i.e., update your ''Secrets'') for the <code>default</code> namespace:
   $ kubectl -n default get secrets -o json | kubectl replace -f -
 ==External links==