diff --git a/static/img/v1.3/image-hv/case1.png b/static/img/v1.3/image-hv/case1.png new file mode 100644 index 0000000..3ff4cce Binary files /dev/null and b/static/img/v1.3/image-hv/case1.png differ diff --git a/static/img/v1.3/image-hv/case2.png b/static/img/v1.3/image-hv/case2.png new file mode 100644 index 0000000..a2db7b2 Binary files /dev/null and b/static/img/v1.3/image-hv/case2.png differ diff --git a/static/img/v1.3/image-hv/create-decrypted-image.png b/static/img/v1.3/image-hv/create-decrypted-image.png new file mode 100644 index 0000000..9cc9609 Binary files /dev/null and b/static/img/v1.3/image-hv/create-decrypted-image.png differ diff --git a/static/img/v1.3/image-hv/create-encrypted-image.png b/static/img/v1.3/image-hv/create-encrypted-image.png new file mode 100644 index 0000000..59c77cd Binary files /dev/null and b/static/img/v1.3/image-hv/create-encrypted-image.png differ diff --git a/static/img/v1.3/image-hv/create-encryption-used-secret.png b/static/img/v1.3/image-hv/create-encryption-used-secret.png index 4fd931b..4e4bf48 100644 Binary files a/static/img/v1.3/image-hv/create-encryption-used-secret.png and b/static/img/v1.3/image-hv/create-encryption-used-secret.png differ diff --git a/static/img/v1.3/image-hv/create-storage-class.png b/static/img/v1.3/image-hv/create-storage-class.png index 5059cbb..f1320c5 100644 Binary files a/static/img/v1.3/image-hv/create-storage-class.png and b/static/img/v1.3/image-hv/create-storage-class.png differ diff --git a/static/img/v1.3/image-hv/create.png b/static/img/v1.3/image-hv/create.png new file mode 100644 index 0000000..a944eb3 Binary files /dev/null and b/static/img/v1.3/image-hv/create.png differ diff --git a/static/img/v1.3/image-hv/export-volume-to-image-1.png b/static/img/v1.3/image-hv/export-volume-to-image-1.png new file mode 100644 index 0000000..6d4d60d Binary files /dev/null and b/static/img/v1.3/image-hv/export-volume-to-image-1.png differ diff --git a/static/img/v1.3/image-hv/image-labels.png b/static/img/v1.3/image-hv/image-labels.png index 852a980..d99ec0f 100644 Binary files a/static/img/v1.3/image-hv/image-labels.png and b/static/img/v1.3/image-hv/image-labels.png differ diff --git a/static/img/v1.3/image-hv/image-storageclass.png b/static/img/v1.3/image-hv/image-storageclass.png new file mode 100644 index 0000000..28c1c8d Binary files /dev/null and b/static/img/v1.3/image-hv/image-storageclass.png differ diff --git a/static/img/v1.3/image-hv/img-413-code.png b/static/img/v1.3/image-hv/img-413-code.png new file mode 100644 index 0000000..5dd50cb Binary files /dev/null and b/static/img/v1.3/image-hv/img-413-code.png differ diff --git a/static/img/v1.3/image-hv/img-ingress-client-body.png b/static/img/v1.3/image-hv/img-ingress-client-body.png new file mode 100644 index 0000000..8883467 Binary files /dev/null and b/static/img/v1.3/image-hv/img-ingress-client-body.png differ diff --git a/static/img/v1.3/image-hv/img-ingress-request-proxy-buffering.png b/static/img/v1.3/image-hv/img-ingress-request-proxy-buffering.png new file mode 100644 index 0000000..5468293 Binary files /dev/null and b/static/img/v1.3/image-hv/img-ingress-request-proxy-buffering.png differ diff --git a/static/img/v1.3/image-hv/volume-detail.png b/static/img/v1.3/image-hv/volume-detail.png new file mode 100644 index 0000000..504f528 Binary files /dev/null and b/static/img/v1.3/image-hv/volume-detail.png differ diff --git a/versioned_docs/version-v1.6/image/image-security.md b/versioned_docs/version-v1.6/image/image-security.md index d8ba4cd..ace9199 100644 --- a/versioned_docs/version-v1.6/image/image-security.md +++ b/versioned_docs/version-v1.6/image/image-security.md @@ -4,7 +4,7 @@ sidebar_position: 2 sidebar_label: Image Security title: "Image Security" keywords: - - Harvester + - Hypervisor - harvester - Rancher - rancher @@ -17,7 +17,7 @@ keywords: _Available as of v1.4.0_ -Harvester allows you to encrypt and decrypt virtual machine images. The encryption mechanism utilizes the Linux kernel module dm_crypt and the command-line utility cryptsetup. +Hypervisor allows you to encrypt and decrypt virtual machine images. The encryption mechanism utilizes the Linux kernel module dm_crypt and the command-line utility cryptsetup. :::note @@ -60,7 +60,7 @@ Prepare the following resources: :::info important - The example contains the default YAML code for Kubernetes secrets. Aside from this, you can use [encryption options for LUKS mode](https://wiki.archlinux.org/title/Dm-crypt/Device_encryption#Encryption_options_for_LUKS_mode), which is a cryptsetup operating mode. Harvester v1.4.1 and later versions support these options, but you must verify that these are supported by your nodes. + The example contains the default YAML code for Kubernetes secrets. Aside from this, you can use [encryption options for LUKS mode](https://wiki.archlinux.org/title/Dm-crypt/Device_encryption#Encryption_options_for_LUKS_mode), which is a cryptsetup operating mode. Hypervisor v1.4.1 and later versions support these options, but you must verify that these are supported by your nodes. | Option | Possible Values | | --- | --- | @@ -69,7 +69,7 @@ Prepare the following resources: | CRYPTO_KEY_SIZE | 256, 384, 512 | | CRYPTO_PBKDF | argon2i, argon2id, pbkdf2 | - You can create a secret in the system namespace using kubectl or the Harvester UI (**Edit as YAML** feature). Resources in the system namespace are not displayed on the Harvester UI **Secrets** screen. + You can create a secret in the system namespace using kubectl or the Hypervisor UI (**Edit as YAML** feature). Resources in the system namespace are not displayed on the Hypervisor UI **Secrets** screen. ::: - StorageClass: Images are encrypted using Longhorn, so required fields must be passed to the Longhorn CSI Driver. You can specify the encryption secret when creating a StorageClass. For more information, see [Image StorageClass](./upload-image#image-storageclass). @@ -102,13 +102,13 @@ Prepare the following resources: :::info important - You can create a secret in the system namespace using the Harvester UI (**Edit as YAML** feature) and kubectl. Resources in the system namespace are not displayed on the Harvester UI **Secrets** screen. + You can create a secret in the system namespace using the Hypervisor UI (**Edit as YAML** feature) and kubectl. Resources in the system namespace are not displayed on the Hypervisor UI **Secrets** screen. ::: ## Encrypt a Virtual Machine Image -1. On the Harvester UI, go to **Images**. +1. On the Hypervisor UI, go to **Images**. 1. Click **Create**. @@ -116,19 +116,19 @@ Prepare the following resources: 1. On the **Basics** tab, select **Encrypt** and then select a source image. - ![](/img/v1.4/image/create-encrypted-image.png) + ![](/img/v1.3/image-hv/create-encrypted-image.png) 1. On the **Storage** tab, select a StorageClass that includes encryption-related fields. - Harvester passes the required fields to Longhorn. + Hypervisor passes the required fields to Longhorn. - ![](/img/v1.4/image/select-encryption-storage-class.png) + ![](/img/v1.3/image-hv/select-encryption-storage-class.png) 1. Click **Create**. ## Decrypt a Virtual Machine Image -1. On the Harvester UI, go to **Images**. +1. On the Hypervisor UI, go to **Images**. 1. Click **Create**. @@ -136,13 +136,13 @@ Prepare the following resources: 1. On the **Basics** tab, select **Decrypt** and then select a source image. - ![](/img/v1.4/image/create-decrypted-image.png) + ![](/img/v1.3/image-hv/create-decrypted-image.png) 1. On the **Storage** tab, select **harvester-longhorn (Default)** or another commonly used StorageClass. - Harvester uses the StorageClass of the source image that you want to decrypt. + Hypervisor uses the StorageClass of the source image that you want to decrypt. - ![](/img/v1.4/image/select-normal-storage-class.png) + ![](/img/v1.3/image-hv/select-normal-storage-class.png) 1. Click **Create**. @@ -150,17 +150,17 @@ Prepare the following resources: You must select the image that you want to use when creating a virtual machine. -![](/img/v1.4/image/create.png) +![](/img/v1.3/image-hv/create.png) The **Virtual Machines** screen displays the following icons and messages when volumes used by virtual machines are encrypted. -![](/img/v1.4/image/case1.png) +![](/img/v1.3/image-hv/case1.png) -![](/img/v1.4/image/case2.png) +![](/img/v1.3/image-hv/case2.png) To determine which volumes are encrypted, check the **Volumes** tab on the **Virtual Machine** details screen. -![](/img/v1.4/image/volume-detail.png) +![](/img/v1.3/image-hv/volume-detail.png) ## Advanced Usage with Rancher Integration diff --git a/versioned_docs/version-v1.6/image/upload-image.md b/versioned_docs/version-v1.6/image/upload-image.md index e2878b4..dfd887b 100644 --- a/versioned_docs/version-v1.6/image/upload-image.md +++ b/versioned_docs/version-v1.6/image/upload-image.md @@ -4,7 +4,7 @@ sidebar_position: 1 sidebar_label: Upload Images title: "Upload Images" keywords: - - Harvester + - Hypervisor - harvester - Rancher - rancher @@ -34,7 +34,7 @@ To import virtual machine images in the **Images** page, enter a URL that can be ::: caution -Large image files may cause memory issues in Harvester when you use third-party StorageClasses with download URLs that are hosted on servers that do not support HTTP range requests (for example, Python's `http.server`). For reliable downloads, use NGINX or Apache instead. +Large image files may cause memory issues in Hypervisor when you use third-party StorageClasses with download URLs that are hosted on servers that do not support HTTP range requests (for example, Python's `http.server`). For reliable downloads, use NGINX or Apache instead. This issue is fixed in v1.6.1. @@ -99,11 +99,11 @@ Currently, qcow2, raw, and ISO images are supported. You can upload images from the [**Multi-Cluster Management**](../rancher/virtualization-management.md#importing-harvester-cluster) screen on the **Rancher UI**. When the status of an image is *Uploading* but the progress indicator displays *0%* for an extended period, check the HTTP response status code. *413* indicates that the size of the request body exceeds the limit. -![](/img/v1.3/img-413-code.png) +![](/img/v1.3/image-hv/img-413-code.png) The maximum request body size should be specific to the cluster that is hosting Rancher (for example, RKE2 clusters have a default limit of 1 MB but no such limit exists in K3s clusters). -The current workaround is to upload images from the **Harvester UI**. If you choose to upload images from the Rancher UI, you may need to configure related settings on the ingress server (for example, [`proxy-body-size`](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#custom-max-body-size) in NGINX). +The current workaround is to upload images from the **Hypervisor UI**. If you choose to upload images from the Rancher UI, you may need to configure related settings on the ingress server (for example, [`proxy-body-size`](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#custom-max-body-size) in NGINX). If Rancher is deployed on an RKE2 cluster, perform the following steps: @@ -116,7 +116,7 @@ If Rancher is deployed on an RKE2 cluster, perform the following steps: 2. Specify a value for `nginx.ingress.kubernetes.io/proxy-body-size`. Example: - ![](/img/v1.3/img-ingress-client-body.png) + ![](/img/v1.3/image-hv/img-ingress-client-body.png) 3. Delete the stuck image, and then restart the upload process. @@ -126,7 +126,7 @@ If you upload a very large image (over 10 GB) from the **Multi-Cluster Managemen This behavior is related to *proxy-request-buffering* in the ingress configuration, which is also specific to the cluster that is hosting Rancher. -The current workaround is to upload images from the **Harvester UI**. If you choose to upload images from the Rancher UI, you may need to configure related settings on the ingress server (for example, [`proxy-request-buffering`](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_request_buffering) in NGINX). +The current workaround is to upload images from the **Hypervisor UI**. If you choose to upload images from the Rancher UI, you may need to configure related settings on the ingress server (for example, [`proxy-request-buffering`](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_request_buffering) in NGINX). If Rancher is deployed on an RKE2 cluster, perform the following steps: @@ -139,13 +139,13 @@ If Rancher is deployed on an RKE2 cluster, perform the following steps: 2. Turn off `nginx.ingress.kubernetes.io/proxy-request-buffering`. Example: - ![](/img/img-ingress-request-proxy-buffering.png) + ![](/img/v1.3/image-hv/img-ingress-request-proxy-buffering.png) 3. Delete the stuck image, and then restart the upload process. -#### Uploading Images Previously Downloaded from Harvester +#### Uploading Images Previously Downloaded from Hypervisor -Starting with **v1.5.5**, Longhorn [compresses backing images for downloading](https://github.com/longhorn/backing-image-manager/pull/153). If you attempt to upload a compressed backing image, Harvester rejects the attempt and displays the message **Upload failed: the uploaded file size xxxx should be a multiple of 512 bytes since Longhorn uses directIO by default** because the compressed data violates Longhorn's data alignment. +Starting with **v1.5.5**, Longhorn [compresses backing images for downloading](https://github.com/longhorn/backing-image-manager/pull/153). If you attempt to upload a compressed backing image, Hypervisor rejects the attempt and displays the message **Upload failed: the uploaded file size xxxx should be a multiple of 512 bytes since Longhorn uses directIO by default** because the compressed data violates Longhorn's data alignment. Before uploading, decompress backing images using the command `$ gzip -d `. @@ -153,7 +153,7 @@ Before uploading, decompress backing images using the command `$ gzip -d