Hi folks. Is there any automated tool for rancher test? • context We automated K8s cluster deloyment and rancher deployment on it using Terraform. Then we run sonobuoy test for cluster conformance test and other scripts to test apps running on the k8s cluster. But for rancher test, we test rancher manually by visiting rancher UI and following test scenarios. • workaround/solution I found https://github.com/rancher/validation-tests project but not sure the scope of this project and if it is maintained by community or not.

Hi Folks, Rancher desktop is using set my Kubectl version to latest 1.26. But currently most of my K8s clusters are running in 1.19 and its giving few warning while running Kubectl command with old cluster.

-> kubectx
I0413 15:29:59.844450   64080 versioner.go:56] Remote kubernetes server unreachable
I0413 15:30:05.131215   64088 versioner.go:56] Remote kubernetes server unreachable

how can I set my kubectl version to 1.21 or similar

ls -la /usr/local/bin/kubectl
lrwxr-xr-x  1 root  admin  55 Nov 11 11:08 /usr/local/bin/kubectl -> /Applications/Docker.app/Contents/Resources/bin/kubectl

Hi Anyone has an idea how to resolve https://github.com/rancher/rancher/issues/39056 ? Thanks!

Hello 👋 Im trying to create a

AlertmanagerConfig

for use in the Monitoring V2 App but hitting a bit of a problem, hopefully someone can come to the rescue 🙂 I have a config that look something like this:

apiVersion: <http://monitoring.coreos.com/v1alpha1|monitoring.coreos.com/v1alpha1>
kind: AlertmanagerConfig
metadata:
  name: alertmanager-config
spec:
  receivers:
    - name: cloudops
      pagerdutyConfigs:
        - httpConfig: {}
          routingKey:
            key: routing-key
            name: pagerduty-routing-key
          sendResolved: true
    - name: opt
      slackConfigs:
        - apiURL:
            key: slack-webhook
            name: slack-webhook
          channel: '#...'
          httpConfig: {}
          sendResolved: true
          text: '{{ template "slack.rancher.text" . }}'
    - name: sws
      slackConfigs:
        - apiURL:
            key: slack-webhook
            name: slack-webhook
          channel: '#...'
          httpConfig: {}
          sendResolved: true
          text: '{{ template "slack.rancher.text" . }}'
  route:
    groupBy:
      - job
    groupInterval: 1m
    groupWait: 30s
    receiver: cloudops
    routes:
      - matchers:
          - name: namespace
            regex: true
            value: foo|bar
        receiver: sws
      - matchers:
          - name: namespace
            value: foo-prod
        receiver: opt

Which in turn results in this Routing tree:

/alertmanager $ amtool --alertmanager.url=<http://localhost:9093> config routes show
Routing tree:
.
└── default-route  receiver: null
    ├── {namespace="cattle-monitoring-system"}  continue: true  receiver: cattle-monitoring-system-alertmanager-config-cloudops
    │   ├── {namespace=~"^(?:foo|bar)$"}  receiver: cattle-monitoring-system-alertmanager-config-sws
    │   └── {namespace="foo-prod"}  receiver: cattle-monitoring-system-alertmanager-config-opt
    └── {alertname="Watchdog"}  receiver: null

It seems the

spec.route.receiver

is ignored and moved under the default-route node, and the other 2 routes becomes a child of that node which means i can't get the matching to act as expected:

/alertmanager $ amtool --alertmanager.url=<http://localhost:9093> config routes test namespace=foo-prod
null

Hi Team, I am currently working on RKE2 HA setup. Does RKE2 support in cluster loadbalancer ? If so, could you please point me to the right way of bringing up the load balancer required for HA

I have just finished upgrade rke k8s to

1.25.6

and now when attempting to upgrade rancher ui from v2.6.5 to latest stable I am getting the following error.

Error: UPGRADE FAILED: execution error at (rancher/templates/validate-psp-install.yaml:4:5): The target cluster does not have the PodSecurityPolicy API resource. Please disable PSPs in this chart before proceeding.

After some googling I ended up at https://github.com/rancher/rancher/issues/40331 which is closed I've attempted to

--set global.cattle.psp.enabled=false

but no luck. I do not use this PSP system or whatever any ideas how I can make this work without a fresh install?

Sounds like PSP were removed in k8s 1.25, prior to this update i was running on 1.23

When generating a kubeconfig via the rancher API, is there any way to set a shorter TTL than the global setting? I have some automated pipelines that generate a kubeconfig for use only in that pipeline and I would like them to expire very quickly.

Hi team, is this channel not for this kind of topic? https://rancher-users.slack.com/archives/C3ASABBD1/p1681373372612369 I'd appreciate if you can let me know the proper channel. Thanks

Anybody got neuvector running in rancher desktop’s moby docker’s k3d?

Hello, how to disable generating these namespaces? It happens automaticaly when you create a new project or a new user is added AFAIK.

Hi, is it possible to seperate the management network in multiple "vlans"? The Idea is to have cluster Network without the need of a physical switch that can be separted for multiple tenants

hi again 🙂 is there any readable and complete guide how to enable audit logs on downstream cluster which was setup through rancher? i have read multiple docs but cannot understand where to enable it or configure to log what i need

hi, silly question, how to generate full certificate from chapter B https://ranchermanager.docs.rancher.com/pages-for-subheaders/rancher-on-a-single-node-with-docker#option-b-bring-your-own-certificate-self-signed? I generated key and csr, signed csr with our private cert auth, what is the steps to create fullchain cert?

Hi having trouble composing a docker file any help will be appreciated!!

@acceptable-jordan-65878 share docker compose file

I have followed and test in my Laptop - https://www.crowdcast.io/e/02152023_mc_nginx_1/1 and https://www.crowdcast.io/e/02152023_mc_nginx_1/2

Labs works file

all rules works fine, I mean https://cafe.example.com tea and coffee works

like the same cafe VirtualServer i have a configures https://carts.example.com

but it doesnt work,

Any assistance is appreciated.

I'm not sure if my cluster is super messed up or if rke just doesn't have everything up to date yet for 1.25, but I have had a few rbac cluster role issues. Namely for canal to work properly I had to add this to the calico clusterrole:

- apiGroups: [""]
    resources:
      - serviceaccounts/token
    verbs:
      - create

Also nginx ingress wasn't able to properly list endpoint slices. I had to add this to the ingress-nginx clusterrole:

- apiGroups:
      - <http://discovery.k8s.io|discovery.k8s.io>
    resources:
      - endpointslices
    verbs:
      - list
      - watch
      - get

I tracked the definitions down to here <https://github.com/rancher/kontainer-driver-metadata/tree/dev-v2.7/rke/templates> and indeed I don't see any endpoint slices for anything ingress-nginx related But again my cluster is a few years old now and It might just be falling apart after the hell I put it through upgrading from 1.23 to 1.25

hi - has any deployed rancher across dual nics: one for public internet, and one for private lan / inter node?

Is there a page somewhere that gives a good overview of what resources pods are reserving?

Hey! I am new to k3s; after setting up my k3s cluster with 3 control-plane and 3 worker nodes everything works well except I want a strict separation between the control and data plane... In vanilla Kubernetes only pods in the kubernetes namespace are scheduled on control-plane nodes while all other pods will only be scheduled on worker nodes. I know I can achieve this by adding some node anti-affinity to my yaml files but how can I re-configure K3S to have the same behaviour as vanilla Kubernetes? I want to keep my yaml files agnostic to which kind of cluster they are applied to...

Hi, I'm new to HCI and decided to try Harvester for my homelab. I faced the following behavior, and there are some GitHub issues about it, but I'm not certain it is a bug or not. • There is only one machine with harvester installed. I have a Node IP address, but Management IP address is not ready. • Upon going to the Node IP address, I am greeted with a Rancher login. It asks for a bootstrap password, and I have to dive in a few GitHub ticket to know that it is "admin" (nowhere to be seen in official doc). • Upon signing in, it is Rancher management interface. I'm still trying to figure out what Rancher dashboard is, but still, I cannot locate the Harvester management dashboard. Does any of you have an idea on what I'm missing here?

Got that sorted out. But the behavior is still ... weird? Apparently, I skipped setting up VIP (DHCP) and there is no trivial way to assign post-installation. I reinstalled Harvester with VIP set as static. When finally booting into Harvester, node address was up while management address was not ready as before. Go to the node address returned the same Rancher interface. After about 30 minutes, management IP became ready, and I am able to reach the Harvester management dashboard. This time, using node IP also returned the Harvester dashboard, and Rancher is nowhere to be seen. 👀 It would be great if there is more information on this behavior.

I want to create a role to allow all users in an LDAP group be able to just view pod logs but only from a set of listed namespaces. I cant seem to create a role which limits the role privileges to one or more listed namespaces. Does anyone have an example Yaml or setup to set this up.?

Using the new version of rancher, the original service port is different from the target port. After updating the application, why does the port corresponding to the service become the same as the target port?