From 17e94a470494c411b590ddb90b3246d713f0c5f3 Mon Sep 17 00:00:00 2001 From: John Carew Date: Tue, 3 Jun 2025 15:08:11 -0500 Subject: [PATCH] Updating external TLS termination required settings Updating external TLS termination required settings. Updating the documentation to be clear on RKE configuration vs RKE2 configuration. Based on closed issue: https://github.com/rancher/rancher/issues/35088 --- .../helm-chart-options.md | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/docs/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md b/docs/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md index ae3d62a426c..61e9b25351e 100644 --- a/docs/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md +++ b/docs/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md @@ -214,8 +214,9 @@ Your load balancer must support long lived websocket connections and will need t ### Configuring Ingress for External TLS when Using NGINX v0.25 -In NGINX v0.25, the behavior of NGINX has [changed](https://github.com/kubernetes/ingress-nginx/blob/master/Changelog.md#0220) regarding forwarding headers and external TLS termination. Therefore, in the scenario that you are using external TLS termination configuration with NGINX v0.25, you must edit the `cluster.yml` to enable the `use-forwarded-headers` option for ingress: +In NGINX v0.25, the behavior of NGINX has [changed](https://github.com/kubernetes/ingress-nginx/blob/master/Changelog.md#0220) regarding forwarding headers and external TLS termination. Therefore, in the scenario that you are using external TLS termination configuration with NGINX v0.25, you must enable the `use-forwarded-headers` option for ingress: +For RKE installations, edit the `cluster.yml` to add the following settings. ```yaml ingress: provider: nginx @@ -223,6 +224,22 @@ ingress: use-forwarded-headers: 'true' ``` +For RKE2 installations, you can create a custom `rke2-ingress-nginx-config.yaml` file at `/var/lib/rancher/rke2/server/manifests/rke2-ingress-nginx-config.yaml` containing this required setting to enable using forwarded headers with external TLS termination. Without this required setting applied, the external LB will continuously respond with redirect loops it receives from the ingress controller. (This can be created before or after rancher is installed, rke2 server agent will notice this addition and automatically apply it.) + +```yaml +--- +apiVersion: helm.cattle.io/v1 +kind: HelmChartConfig +metadata: + name: rke2-ingress-nginx + namespace: kube-system +spec: + valuesContent: |- + controller: + config: + use-forwarded-headers: "true" +``` + ### Required Headers - `Host`