Kubernetes Dashboards - Rancher

Know that sweet challenge your boss gave you at the beginning of the year to improve Security, Visibility, and Access for the folks in the back row? Well, let me give you a tip

USE RANCHER!

It's gorgeous; you can customize the logo, color, home page, who can access and what they can access, grant permissions, and delegate governance of parts of a cluster. What I'm going to give you are arguments to use against anyone who wants to install lens or any other monolithic, monocluster, monochromatic, mono-anything, bland, and boring tool. This article is part of a series where the Getup team covers the most important interfaces of the ecosystem. Don't miss any of them and choose the one that best fits your needs.

Let's go over the main points that I always like to evangelize:

1. Simplifying Kubernetes Complexity:

Due to its robust nature, Kubernetes can present "some complexity" for beginners. Rancher acts as an abstraction layer, masking Kubernetes intricacies and providing an intuitive interface that facilitates cluster management, application deployment, and resource visualization.

2. Unified Interface for Multiple Clusters:

Rancher centralizes the management of multiple Kubernetes clusters, whether they are local, in a hybrid cloud, or multi-cloud. Through a single interface, it is possible to view the overall state of the clusters, monitor application performance, and perform administrative tasks in a unified way, eliminating the need to switch between different consoles.

3. Automated Infrastructure Provisioning:

Rancher simplifies infrastructure provisioning for Kubernetes clusters, automating the creation and scaling of resources across various cloud providers, such as Amazon Web Services (AWS), Google Cloud Platform (GCP), Microsoft Azure, and VMware (look at that, a piece of cake). This automation eliminates repetitive manual tasks, optimizing time and team productivity.

4. App Marketplace and Service Catalog:

It has a built-in “helm installer”, which I personally don't like because I'm in favor of Full GitOps, but it's there. If you have doubts about how to use Helm, there's nothing like a drag-and-drop to speed up an installation, right?

5. Enhanced Security and Granular Governance:

It bolsters the security of Kubernetes clusters through granular access controls, integrated authentication, and audit tools. It allows the definition of comprehensive security policies, ensuring that only authorized users access specific resources, protecting your data and applications against unauthorized access.

6. Comprehensive Monitoring and Observability:

Although it has a monitoring system available called Rancher Monitoring, which is nothing more than a fork of the kube-prometheus-stack from prometheus-community, and integrations with the Rancher web UI, if you are really too lazy to study and set up prometheus, alertmanager, grafana, kube-state-metrics, node-exporter, thanos, and others, knowing what you are doing, then use it; it will make visualizing things easier. After a while, you will want to customize this installation.

7. Continuous Integration and Automatic Deployment:

Rancher facilitates integration with continuous integration (CI) and continuous delivery (CD) tools, automating the deployment of new application versions in Kubernetes clusters. This automation ensures that applications are always updated with the latest features and bug fixes, minimizing downtime and optimizing the development workflow.

At this point, it has a pretty decent GitOps tool called FleetManager, but I still prefer Flux and Argo with a CI behind them.

8. Multi-tenant and Support for Hybrid Environments:

Rancher offers native support for multi-cloud and on-premises environments, allowing the isolation of Kubernetes clusters for different teams or projects. This feature is really cool for organizations that need to manage multiple clusters in a single environment, ensuring security, autonomy, and granular control.

This is the part that makes the Security team cry with joy: you segregate access in a granular way, so the dev user will only see the deploy log and cannot see secrets, configmaps, or disks. Their manager or PM will have permission to add people to their project, which covers some namespaces and some clusters—look how cool that is.

9. Vibrant Community and Comprehensive Support:

Rancher has an active and constantly growing community that offers technical support and shares knowledge through forums, documentation, and events. Moreover, the team here at Getup helps you implement, maintain, discover, break, and fix Rancher—just call us.

Now let's look at the cons, those arguments that might make you build a deployment plan and a lifecycle strategy;

• It installs agents in your cluster

• It creates serviceaccounts, namespaces, and objects with the last name cattle, so keep an eye out

• The helm charts seem easy to install via the interface, but make no mistake, it might not work.

There are several ways and strategies that can be used to implement it, the most obvious is via helm, but there are some prerequisites;

• An ingress controller;

• Preferably cert-manager, even if only for a self-signed certificate;

So, in a Kubernetes cluster, you can;

helm repo add rancher-stable https://releases.rancher.com/server-charts/stable  --force-update
helm install rancher rancher-stable/rancher -n rancher --create-namespace --set hostname=meurancher.meu.dominio  --set bootstrapPassword=admin

If you don't want to install it on the cluster, you can run it via docker on your machine to test it;

docker run -d --restart=unless-stopped  -p 80:80 -p 443:443  --privileged rancher/rancher:latest  --no-cacerts

You can find more options and ways to install in the documentation at https://ranchermanager.docs.rancher.com/ .

In this example, we have Rancher itself as local and an on-premises cluster. And we can still manage several others from different providers.

An example of authentication configuration via OpenLDAP pointing to an ActiveDirectory, keeping in mind that it is possible to maintain and allow more than 1 authentication method, e.g., OpenLDAP + Google Workspace.

List of users and their origin.

Final tips:

• Rancher installs agents in the cluster it will manage. True; it installs agents that are obviously necessary and grant the permissions that you will delegate, give, install, etc. So, pay special attention to the resources used.

• It creates objects in the cluster, yes, plenty of CRDs to keep helping you;

• Install it in a dedicated cluster for it, or under a tools or infra cluster concept. There are many objects and namespaces created that can make you confused.

• Be careful with helm installations, the packages; if they are not well configured and you don't know what you are doing, it can be frustrating and can cause you problems.

To wrap up, be sure to follow our blog, as we are always sharing interesting content, and also listen to Kubicast, the podcast that brings knowledge in a different format.