The documentation release for Rancher v2.3.0 adds the documentation for new Rancher features.
- CIS Scanning: Ensuring continuous CIS compliance is now possible directly in Rancher. Rancher operators can perform CIS scans of RKE clusters ad-hoc or on regularly scheduled intervals. Operators can see the history of compliance scans and produce a report for auditors. Continuously scanning clusters on an interval, an operator can be notified when a configuration drift is detected. The scans are customizable through configuration so that tests can be skipped if a control does not apply to your installation.
- Scale improvements: Rancher control plane now manages up to 2,000 clusters or 100,000 nodes. Rancher moved to a shared global context cluster state, reducing the memory footprint and Kubernetes API connections needed to manage each cluster. Rancher controllers were optimized to reduce the overall number of calls to the Kubernetes API. Based on these improvements, new sizing guidelines have been provided for installing Rancher.
- Zero downtime upgrades: Updates to RKE clusters can now be made without impacting the availability of the Kubernetes API and user workloads. The upgrade process of the cluster control plane has been modified to update a single node at a time. The number of worker nodes that can be upgraded at a time is now user-configurable. For clusters that need maximum availability, a single node can be upgraded at a time. For those working with larger RKE clusters, the number can be scaled up so that upgrades can happen in a shorter timeframe.
- Atomic Cluster Rollbacks: Rancher now supports rolling back both the etcd database and the Kubernetes configuration in a single operation. This operation can be used mid-upgrade if there are problems/complications and the operator needs to revert to the last known state. During the rollback process, there are no availability guarantees.
- Upgrade K3s clusters from Rancher: Imported K3s clusters are now upgradeable from within Rancher. Rancher now detects that a K3s cluster has been imported and presents new options to the operator when editing the cluster. The option to select the Kubernetes version is now available, along with a read-only view of the configuration parameters of the server.
- Helm 3 support to catalogs: Rancher catalog now supports Helm 3 charts. An admin, cluster or project owner can add catalogs to use Helm 3 to deploy charts. Any existing catalogs will continue to use Helm 2 to deploy charts.
- K3s is a supported Rancher HA distribution: Rancher HA is now supports K3s as an underlying Kubernetes distribution. A Rancher admin can create a K3s cluster using managed MySQL service and stateless nodes to deploy Rancher management. The need to manage an etcd cluster is no longer necessary.
- Authentication and RBAC enhancements:
- Assign groups to global roles: Global roles in Rancher now support group assignments from your auth provider. Assigning groups, means administrators do not need to modify assignments as team members come and go within your organization.
- Customize global roles: The default behavior can now be customized for all users by creating global roles.
- Shibboleth as an auth provider: Shibboleth is now available as an authentication provider.
- Shibboleth and OpenLDAP: OpenLDAP can be configured with Shibboleth to provide searching for users and groups that a user is not a member of. Note: Users in within a nested group will not be provided the same privileges as the group added. For example, group A includes group B. The members in group B will not get the same privileges as group A.
- OPA Gatekeeper (Experimental): Rancher now provides experimental support for the Open Policy Agent Gatekeeper operator. Rancher will deploy and manage the installation and setup a validating webhook for the cluster. Admins can interact with the custom resources through the next-gen UI to define policies in the cluster and apply them to various namespaces as needed.
RKE Documentation Updates
- How Upgrades Work: In this section, you’ll learn what happens when you edit or upgrade your RKE Kubernetes cluster.
- Maintaining Availability for Applications During Upgrades: In this section, you’ll learn the requirements to prevent downtime for your applications when you upgrade the cluster using rke up.
- Configuring the Upgrade Strategy: Learn how to configure the maximum number of unavailable controlplane and worker nodes, how to drain nodes before upgrading them, and how to configure the replicas for addons such as Ingress.