Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file added static/img/v1.3/image-hv/case1.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added static/img/v1.3/image-hv/case2.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file modified static/img/v1.3/image-hv/create-encryption-used-secret.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file modified static/img/v1.3/image-hv/create-storage-class.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added static/img/v1.3/image-hv/create.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file modified static/img/v1.3/image-hv/image-labels.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added static/img/v1.3/image-hv/image-storageclass.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added static/img/v1.3/image-hv/img-413-code.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added static/img/v1.3/image-hv/volume-detail.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
34 changes: 17 additions & 17 deletions versioned_docs/version-v1.6/image/image-security.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ sidebar_position: 2
sidebar_label: Image Security
title: "Image Security"
keywords:
- Harvester
- Hypervisor
- harvester
- Rancher
- rancher
Expand All @@ -17,7 +17,7 @@ keywords:

_Available as of v1.4.0_

Harvester allows you to encrypt and decrypt virtual machine images. The encryption mechanism utilizes the Linux kernel module dm_crypt and the command-line utility cryptsetup.
Hypervisor allows you to encrypt and decrypt virtual machine images. The encryption mechanism utilizes the Linux kernel module dm_crypt and the command-line utility cryptsetup.

:::note

Expand Down Expand Up @@ -60,7 +60,7 @@ Prepare the following resources:

:::info important

The example contains the default YAML code for Kubernetes secrets. Aside from this, you can use [encryption options for LUKS mode](https://wiki.archlinux.org/title/Dm-crypt/Device_encryption#Encryption_options_for_LUKS_mode), which is a cryptsetup operating mode. Harvester v1.4.1 and later versions support these options, but you must verify that these are supported by your nodes.
The example contains the default YAML code for Kubernetes secrets. Aside from this, you can use [encryption options for LUKS mode](https://wiki.archlinux.org/title/Dm-crypt/Device_encryption#Encryption_options_for_LUKS_mode), which is a cryptsetup operating mode. Hypervisor v1.4.1 and later versions support these options, but you must verify that these are supported by your nodes.

| Option | Possible Values |
| --- | --- |
Expand All @@ -69,7 +69,7 @@ Prepare the following resources:
| CRYPTO_KEY_SIZE | 256, 384, 512 |
| CRYPTO_PBKDF | argon2i, argon2id, pbkdf2 |

You can create a secret in the system namespace using kubectl or the Harvester UI (**Edit as YAML** feature). Resources in the system namespace are not displayed on the Harvester UI **Secrets** screen.
You can create a secret in the system namespace using kubectl or the Hypervisor UI (**Edit as YAML** feature). Resources in the system namespace are not displayed on the Hypervisor UI **Secrets** screen.
:::

- StorageClass: Images are encrypted using Longhorn, so required fields must be passed to the Longhorn CSI Driver. You can specify the encryption secret when creating a StorageClass. For more information, see [Image StorageClass](./upload-image#image-storageclass).
Expand Down Expand Up @@ -102,65 +102,65 @@ Prepare the following resources:

:::info important

You can create a secret in the system namespace using the Harvester UI (**Edit as YAML** feature) and kubectl. Resources in the system namespace are not displayed on the Harvester UI **Secrets** screen.
You can create a secret in the system namespace using the Hypervisor UI (**Edit as YAML** feature) and kubectl. Resources in the system namespace are not displayed on the Hypervisor UI **Secrets** screen.

:::

## Encrypt a Virtual Machine Image

1. On the Harvester UI, go to **Images**.
1. On the Hypervisor UI, go to **Images**.

1. Click **Create**.

1. Specify a namespace and a name.

1. On the **Basics** tab, select **Encrypt** and then select a source image.

![](/img/v1.4/image/create-encrypted-image.png)
![](/img/v1.3/image-hv/create-encrypted-image.png)

1. On the **Storage** tab, select a StorageClass that includes encryption-related fields.

Harvester passes the required fields to Longhorn.
Hypervisor passes the required fields to Longhorn.

![](/img/v1.4/image/select-encryption-storage-class.png)
![](/img/v1.3/image-hv/select-encryption-storage-class.png)

1. Click **Create**.

## Decrypt a Virtual Machine Image

1. On the Harvester UI, go to **Images**.
1. On the Hypervisor UI, go to **Images**.

1. Click **Create**.

1. Specify a namespace and a name.

1. On the **Basics** tab, select **Decrypt** and then select a source image.

![](/img/v1.4/image/create-decrypted-image.png)
![](/img/v1.3/image-hv/create-decrypted-image.png)

1. On the **Storage** tab, select **harvester-longhorn (Default)** or another commonly used StorageClass.

Harvester uses the StorageClass of the source image that you want to decrypt.
Hypervisor uses the StorageClass of the source image that you want to decrypt.

![](/img/v1.4/image/select-normal-storage-class.png)
![](/img/v1.3/image-hv/select-normal-storage-class.png)

1. Click **Create**.

## Use an Image with Encrypted Volumes

You must select the image that you want to use when creating a virtual machine.

![](/img/v1.4/image/create.png)
![](/img/v1.3/image-hv/create.png)

The **Virtual Machines** screen displays the following icons and messages when volumes used by virtual machines are encrypted.

![](/img/v1.4/image/case1.png)
![](/img/v1.3/image-hv/case1.png)

![](/img/v1.4/image/case2.png)
![](/img/v1.3/image-hv/case2.png)

To determine which volumes are encrypted, check the **Volumes** tab on the **Virtual Machine** details screen.

![](/img/v1.4/image/volume-detail.png)
![](/img/v1.3/image-hv/volume-detail.png)

## Advanced Usage with Rancher Integration

Expand Down
24 changes: 12 additions & 12 deletions versioned_docs/version-v1.6/image/upload-image.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ sidebar_position: 1
sidebar_label: Upload Images
title: "Upload Images"
keywords:
- Harvester
- Hypervisor
- harvester
- Rancher
- rancher
Expand Down Expand Up @@ -34,7 +34,7 @@ To import virtual machine images in the **Images** page, enter a URL that can be

::: caution

Large image files may cause memory issues in Harvester when you use third-party StorageClasses with download URLs that are hosted on servers that do not support HTTP range requests (for example, Python's `http.server`). For reliable downloads, use NGINX or Apache instead.
Large image files may cause memory issues in Hypervisor when you use third-party StorageClasses with download URLs that are hosted on servers that do not support HTTP range requests (for example, Python's `http.server`). For reliable downloads, use NGINX or Apache instead.

This issue is fixed in v1.6.1.

Expand Down Expand Up @@ -99,11 +99,11 @@ Currently, qcow2, raw, and ISO images are supported.

You can upload images from the [**Multi-Cluster Management**](../rancher/virtualization-management.md#importing-harvester-cluster) screen on the **Rancher UI**. When the status of an image is *Uploading* but the progress indicator displays *0%* for an extended period, check the HTTP response status code. *413* indicates that the size of the request body exceeds the limit.

![](/img/v1.3/img-413-code.png)
![](/img/v1.3/image-hv/img-413-code.png)

The maximum request body size should be specific to the cluster that is hosting Rancher (for example, RKE2 clusters have a default limit of 1 MB but no such limit exists in K3s clusters).

The current workaround is to upload images from the **Harvester UI**. If you choose to upload images from the Rancher UI, you may need to configure related settings on the ingress server (for example, [`proxy-body-size`](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#custom-max-body-size) in NGINX).
The current workaround is to upload images from the **Hypervisor UI**. If you choose to upload images from the Rancher UI, you may need to configure related settings on the ingress server (for example, [`proxy-body-size`](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#custom-max-body-size) in NGINX).

If Rancher is deployed on an RKE2 cluster, perform the following steps:

Expand All @@ -116,7 +116,7 @@ If Rancher is deployed on an RKE2 cluster, perform the following steps:
2. Specify a value for `nginx.ingress.kubernetes.io/proxy-body-size`.

Example:
![](/img/v1.3/img-ingress-client-body.png)
![](/img/v1.3/image-hv/img-ingress-client-body.png)

3. Delete the stuck image, and then restart the upload process.

Expand All @@ -126,7 +126,7 @@ If you upload a very large image (over 10 GB) from the **Multi-Cluster Managemen

This behavior is related to *proxy-request-buffering* in the ingress configuration, which is also specific to the cluster that is hosting Rancher.

The current workaround is to upload images from the **Harvester UI**. If you choose to upload images from the Rancher UI, you may need to configure related settings on the ingress server (for example, [`proxy-request-buffering`](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_request_buffering) in NGINX).
The current workaround is to upload images from the **Hypervisor UI**. If you choose to upload images from the Rancher UI, you may need to configure related settings on the ingress server (for example, [`proxy-request-buffering`](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_request_buffering) in NGINX).

If Rancher is deployed on an RKE2 cluster, perform the following steps:

Expand All @@ -139,21 +139,21 @@ If Rancher is deployed on an RKE2 cluster, perform the following steps:
2. Turn off `nginx.ingress.kubernetes.io/proxy-request-buffering`.

Example:
![](/img/img-ingress-request-proxy-buffering.png)
![](/img/v1.3/image-hv/img-ingress-request-proxy-buffering.png)

3. Delete the stuck image, and then restart the upload process.

#### Uploading Images Previously Downloaded from Harvester
#### Uploading Images Previously Downloaded from Hypervisor

Starting with **v1.5.5**, Longhorn [compresses backing images for downloading](https://github.com/longhorn/backing-image-manager/pull/153). If you attempt to upload a compressed backing image, Harvester rejects the attempt and displays the message **Upload failed: the uploaded file size xxxx should be a multiple of 512 bytes since Longhorn uses directIO by default** because the compressed data violates Longhorn's data alignment.
Starting with **v1.5.5**, Longhorn [compresses backing images for downloading](https://github.com/longhorn/backing-image-manager/pull/153). If you attempt to upload a compressed backing image, Hypervisor rejects the attempt and displays the message **Upload failed: the uploaded file size xxxx should be a multiple of 512 bytes since Longhorn uses directIO by default** because the compressed data violates Longhorn's data alignment.

Before uploading, decompress backing images using the command `$ gzip -d <file name>`.

### Create Images via Volumes

On the **Volumes** page, click **Export Image**. Enter the image name and select a StorageClass to create an image.

![](/img/v1.2/volume/export-volume-to-image-1.png)
![](/img/v1.3/image-hv/export-volume-to-image-1.png)

### Image StorageClass

Expand All @@ -163,11 +163,11 @@ When creating an image, you can select a [StorageClass](../advanced/storageclass

The image will not use the `StorageClass` selected here directly. It's just a `StorageClass` template.

Instead, it will create a special StorageClass under the hood with a prefix name of `longhorn-`. This is automatically done by the Harvester backend, but it will inherit the parameters from the StorageClass you have selected.
Instead, it will create a special StorageClass under the hood with a prefix name of `longhorn-`. This is automatically done by the Hypervisor backend, but it will inherit the parameters from the StorageClass you have selected.

:::

![](/img/v1.2/image-storageclass.png)
![](/img/v1.3/image-hv/image-storageclass.png)

### Image Labels

Expand Down
Loading