Skip to content

MKE 3 Documentation

Security information

Initializing search

MKE 3 Documentation Contents

Product Overview
Reference Architecture
Reference Architecture
Installation Guide
Installation Guide
- Plan the deployment
  Plan the deployment
  - Default install directories
  - Host name strategy
  - MCR considerations
    
    MCR considerations
    
    default-address-pools
    
    docker0
    
    docker_gwbridge
    
    Docker swarm
    
    Kubernetes
    
    docker data-root
    
    no-new-privileges
    
    Device Mapper storage driver
    
    Memory metrics reporting
- Perform pre-deployment configuration
  Perform pre-deployment configuration
- Install the MKE image
- Obtain the license
- Install MKE on AWS
  Install MKE on AWS
  - Prerequisites
  - Install MKE
- MetalLB load-balancer for Kubernetes
- Install MKE offline
- Uninstall MKE
- Deploy Swarm-only mode
  Deploy Swarm-only mode
  - Swarm-only images
  - Prometheus
Operations Guide
Operations Guide
- Access an MKE cluster
  Access an MKE cluster
  - Access the MKE web UI
  - Download and configure the client bundle
    
    Download and configure the client bundle
    
    Download the client bundle
    
    Configure the client bundle
    
    Client bundle expiration
    
    Clean up expired client bundles
    
    Disable Client Bundle
  - Configure kubectl with MKE
- Administer an MKE cluster
  Administer an MKE cluster
  - Add labels to cluster nodes
    
    Add labels to cluster nodes
    
    Apply labels to a node
    
    Deploy a service with constraints
    
    Add Swarm placement constraints
    
    Add or remove a service constraint using the MKE web UI
  - Add SANs to cluster certificates
  - Collect MKE cluster metrics with Prometheus
    
    Collect MKE cluster metrics with Prometheus
    
    MKE metrics types
    
    Metrics labels
    
    Core MKE metrics
    
    MKE component metrics
    
    MKE cAdvsior metrics
    
    Deploy Prometheus on worker nodes
    
    Configure external Prometheus to scrape metrics from MKE
    
    Set up Grafana with MKE Prometheus
  - Collect MKE cluster metrics with metrics-server
    
    Collect MKE cluster metrics with metrics-server
    
    Enable metrics-server
    
    Verify metrics-server
    
    Use metrics from kubectl
    
    Disable metrics-server
  - Configure native Kubernetes role-based access control
    
    Configure native Kubernetes role-based access control
    
    Create a Kubernetes role
    
    Create a Kubernetes role grant
  - MKE audit logging
    
    MKE audit logging
    
    Logging levels
    
    Enable MKE audit logging
    
    Access audit logs using the docker CLI
    
    API endpoints logging constraints
  - Enable MKE telemetry
  - Enable and integrate SAML authentication
    
    Enable and integrate SAML authentication
    
    Configure SAML integration on identity provider
    
    Configure SAML integration on MKE
    
    SAML security considerations
    
    Set up SAML proxy
  - Enable Helm with MKE
  - Integrate SCIM
    
    Integrate SCIM
    
    Configure SCIM for MKE
    
    Supported SCIM API endpoints
  - Integrate with an LDAP directory
    
    Integrate with an LDAP directory
    
    MKE integration with LDAP
    
    Configure the LDAP integration
  - Configure an OpenID Connect identity provider
  - Use LDAP in conjunction with SAML
  - Manage services node deployment
    
    Manage services node deployment
    
    Restrict services deployment to Swarm worker nodes
    
    Restrict services deployment to Kubernetes worker nodes
    
    Allow services deployment on Kubernetes MKE manager or MSR nodes
  - Run only the images you trust
  - Set user session properties
  - Configure an MKE cluster
    
    Configure an MKE cluster
    
    Use an MKE configuration file
    
    Configuration options
  - Scale an MKE cluster
  - Configure KMS plugin for MKE
  - Use a local node network in a swarm
  - Manage MKE certificate authorities
  - Use your own TLS certificates
  - Manage and deploy private images
  - Set the node orchestrator
    
    Set the node orchestrator
    
    Select the node orchestrator
    
    Change the node orchestrator
  - View Kubernetes objects in a namespace
  - Join Nodes
    
    Join Nodes
    
    Set up high availability
    
    Join Linux nodes
    
    Join Windows worker nodes
    
    Use a load balancer
  - Use two-factor authentication
  - Account lockout
  - Custom kubelet profiles
    
    Custom kubelet profiles
    
    Add custom kubelet profiles
    
    Apply kubelet node profiles
    
    Modify kubelet node profiles
    
    Configure Graceful Node Shutdown with kubelet node profiles
    
    Delete kubelet node profiles
  - Configure Kubernetes descheduler
    
    Configure Kubernetes descheduler
    
    Descheduler policy configuration
    
    MKE descheduler lifecycle
    
    Enable the descheduler
    
    Verify the descheduler deployment
    
    Disable the descheduler
  - Configure and use OpsCare
  - Configure cluster and service networking in an existing cluster
  - Schedule image pruning
  - Exclude images from kubelet garbage collection
  - Manage etcd
    
    Manage etcd
    
    Configure etcd storage quota
    
    Configure etcd request size limit
    
    Cleanse etcd of Kubernetes events
    
    Apply etcd defragmentation
    
    etcd alarms response
  - Operate a hybrid Windows cluster
    
    Operate a hybrid Windows cluster
    
    Run hybrid workloads in Kubernetes
    
    Run hybrid workloads in Swarm
  - Manage NodeLocalDNS
    
    Manage NodeLocalDNS
    
    Enable and disable NodeLocalDNS
    
    Run DNS queries
  - Restrict weak CBC-mode ciphers
  - Configure Kubernetes secrets encryption provider
- Authorize role-based access
  Authorize role-based access
  - Create organizations, teams, and users
  - Enable LDAP and sync teams and users
  - Define roles with authorized API operations
    
    Define roles with authorized API operations
    
    Default roles
    
    Create a custom Swarm role
    
    Swarm operations roles
  - Use collections and namespaces
    
    Use collections and namespaces
    
    Swarm collection labels
    
    Default and built-in Swarm collections
    
    Group and isolate cluster resources
  - Create grants
  - Grant users permission to pull images
  - Reset passwords
  - RBAC tutorials
    
    RBAC tutorials
    
    Deploy a simple stateless app with RBAC
    
    Isolate volumes to specific teams
    
    Isolate nodes
    
    Isolate nodes
    
    Isolate cluster nodes with Swarm
    
    Isolate cluster nodes with Kubernetes
    
    Set up access control architecture
    
    Set up access control architecture with additional security requirements
- Upgrades and migrations
  Upgrades and migrations
- Deploy applications with Swarm
  Deploy applications with Swarm
  - Deploy a single-service application
  - Deploy a multi-service application
  - Deploy services to a Swarm collection
  - Use secrets in Swarm deployments
  - Interlock
    
    Interlock
    
    Layer 7 routing
    
    Single Interlock deployment
    
    Deploy
    
    Deploy
    
    Deploy a layer 7 routing solution
    
    Configure layer 7 routing for production
    
    Offline installation considerations
    
    Configure
    
    Configure
    
    Configure layer 7 routing service
    
    Configure layer 7 routing service
    
    Configure the Interlock service
    
    Configuration file options for layer 7 routing
    
    Create a proxy service
    
    Configure host mode networking
    
    Configure NGINX
    
    Tune the proxy service
    
    Update Interlock services
    
    Routing traffic to services
    
    Routing traffic to services
    
    Route traffic to a Swarm service
    
    Publish a service as a canary instance
    
    Use context or path-based routing
    
    Configure a routing mode
    
    Configure a routing mode
    
    Routing modes
    
    Specify a routing mode
    
    Use service labels
    
    Configure passive health checks for upstream servers
    
    Configure redirects
    
    Service clusters
    
    Service clusters
    
    Configure service clusters
    
    Deploy services in separate service clusters
    
    Remove a service cluster
    
    Use persistent sessions
    
    Secure services with TLS
    
    Secure services with TLS
    
    Proxy-managed TLS
    
    Service-managed TLS
    
    Deploy services with mTLS enabled
    
    Use websockets
- Deploy applications with Kubernetes
  Deploy applications with Kubernetes
  - Use Kubernetes on Windows Server nodes
  - Access Kubernetes resources
  - Deploy a workload to a Kubernetes cluster
    
    Deploy a workload to a Kubernetes cluster
    
    Deploy a workload using the MKE web UI
    
    Deploy a workload using the CLI
  - Deploy OPA Gatekeeper for policy enforcement
    
    Deploy OPA Gatekeeper for policy enforcement
    
    Install OPA Gatekeeper
    
    Use OPA Gatekeeper
  - Use admission controllers for access
  - Create a service account for a Kubernetes app
  - Install an unmanaged CNI plugin
  - Kubernetes network encryption
  - Persistent Kubernetes Storage
    
    Persistent Kubernetes Storage
    
    Use NFS Storage
    
    Use Azure Disk Storage
    
    Use Azure Files Storage
    
    Configure iSCSI
    
    Use CSI drivers
  - Enable GPU support using the NVIDIA GPU Operator
  - Envoy Gateway Controller
    
    Envoy Gateway Controller
    
    Configure Envoy Gateway Controller
    
    Create an EnvoyProxy
    
    Deploy Envoy Gateway and HTTPRoute
    
    Verify Envoy Gateway Controller functionality
  - NGINX Ingress Controller
    
    NGINX Ingress Controller
    
    Configure NGINX Ingress Controller
    
    Create a Kubernetes Ingress
    
    Configure a canary deployment
    
    Configure a sticky session
    
    TLS termination
    
    TLS passthrough
    
    Expose TCP and UDP services
    
    Re-enable the NGINX Ingress Controller
  - Deploy MetalLB
    
    Deploy MetalLB
    
    Create LoadBalancer services
    
    Request from a specific IP pool
    
    Add IP address pools
    
    Modify IP address pools
    
    Delete IP address pools
  - Use Multus CNI to create multi-homed Pods
- Monitor an MKE cluster
- Troubleshoot an MKE cluster
  Troubleshoot an MKE cluster
- Disaster recovery
  Disaster recovery
  - Swarm disaster recovery
    
    Swarm disaster recovery
    
    Recover from losing the quorum
    
    Force the swarm to rebalance
  - MKE disaster recovery
  - Back up Swarm
  - Back up MKE
    
    Back up MKE
    
    Backup considerations
    
    Backup procedure
  - Restore Swarm
  - Restore MKE
- Customer feedback
Launchpad
Launchpad
Open Source Components and Licenses
Get support
Reference
API Reference
API Reference
- MKE 3.9.7
- MKE 3.9.6
- MKE 3.9.5
- MKE 3.9.4
- MKE 3.9.3
- MKE 3.9.2
- MKE 3.9.1
- MKE 3.9.0
CLI Reference
CLI Reference
- backup
- ca
- dump-certs
- example-config
- id
- images
- install
- port-check-server
- restore
- support
- uninstall-ucp
- upgrade
Releases and Lifecycle
Release Notes
Release Notes
- 3.9.7
  3.9.7
- 3.9.6
  3.9.6
- 3.9.5
  3.9.5
- 3.9.4
  3.9.4
- 3.9.3
  3.9.3
- 3.9.2
  3.9.2
- 3.9.1
  3.9.1
- 3.9.0
  3.9.0
- Deprecation notes
Compatibility Matrix
Compatibility Matrix
Release Cadence and Support Lifecycle
Previous Versions
MKE 3.8
MKE 3.7 (EOL)
MKE 3.6 (EOL)
MKE 3.5 (EOL)
MKE 3.4 (EOL)
MKE 3.3 (EOL)

Home
Release Notes
3.9.4
Security information

Security information#

The MKE 3.9.4 patch release focuses exclusively on bug fixes.

Previous Major component versions Next 3.9.3

Copyright © 2026 Mirantis Inc. - All rights reserved

Made with Material for MkDocs