Skip to content

Updated contents related to external TLS termination #4105

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Updated contents related to external TLS termination #4105

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4943c99
Updated contents related to external TLS termination
johnwc May 13, 2022
d16593c
Update content/rancher/v2.6/en/installation/install-rancher-on-k8s/ch…
johnwc Jul 2, 2022
e174032
Update content/rancher/v2.6/en/installation/install-rancher-on-k8s/ch…
johnwc Jul 2, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 14 additions & 7 deletions ...ent/rancher/v2.6/en/installation/install-rancher-on-k8s/chart-options/_index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -185,15 +185,22 @@ You may terminate the SSL/TLS on a L7 load balancer external to the Rancher clus

Your load balancer must support long lived websocket connections and will need to insert proxy headers so Rancher can route links correctly.

### Configuring Ingress for External TLS when Using NGINX v0.25
### Configuring Ingress for External TLS when Using NGINX

In NGINX v0.25, the behavior of NGINX has [changed](https://github.com/kubernetes/ingress-nginx/blob/master/Changelog.md#0220) regarding forwarding headers and external TLS termination. Therefore, in the scenario that you are using external TLS termination configuration with NGINX v0.25, you must edit the `cluster.yml` to enable the `use-forwarded-headers` option for ingress:
In the scenario that you are using external TLS termination configuration with NGINX, you must enable the `use-forwarded-headers` option for ingress:

Create a `/var/lib/rancher/rke2/server/manifests/rke2-ingress-nginx-config.yaml` file with the following contents on one of your rke2 nodes.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This assumes we're using RKE2 while this page doesn't seem to be RKE2 specific - the only occurrences of "RKE2" term are in added content.

I think we should cover non-RKE2 cases as well.

Adding @kinarashah as "all things NGINX" expert to review as well.

```yaml
ingress:
provider: nginx
options:
use-forwarded-headers: 'true'
apiVersion: helm.cattle.io/v1
kind: HelmChartConfig
metadata:
name: rke2-ingress-nginx
namespace: kube-system
spec:
valuesContent: |-
controller:
config:
use-forwarded-headers: "true"
```

### Required Headers
Expand All @@ -213,7 +220,7 @@ ingress:

Rancher will respond `200` to health checks on the `/healthz` endpoint.

### Example NGINX config
### Example NGINX config for your load balancer doing the TLS termination

This NGINX configuration is tested on NGINX 1.14.

Expand Down