From 17e94a470494c411b590ddb90b3246d713f0c5f3 Mon Sep 17 00:00:00 2001 From: John Carew Date: Tue, 3 Jun 2025 15:08:11 -0500 Subject: [PATCH 1/5] Updating external TLS termination required settings Updating external TLS termination required settings. Updating the documentation to be clear on RKE configuration vs RKE2 configuration. Based on closed issue: https://github.com/rancher/rancher/issues/35088 --- .../helm-chart-options.md | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/docs/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md b/docs/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md index ae3d62a426c..61e9b25351e 100644 --- a/docs/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md +++ b/docs/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md @@ -214,8 +214,9 @@ Your load balancer must support long lived websocket connections and will need t ### Configuring Ingress for External TLS when Using NGINX v0.25 -In NGINX v0.25, the behavior of NGINX has [changed](https://github.com/kubernetes/ingress-nginx/blob/master/Changelog.md#0220) regarding forwarding headers and external TLS termination. Therefore, in the scenario that you are using external TLS termination configuration with NGINX v0.25, you must edit the `cluster.yml` to enable the `use-forwarded-headers` option for ingress: +In NGINX v0.25, the behavior of NGINX has [changed](https://github.com/kubernetes/ingress-nginx/blob/master/Changelog.md#0220) regarding forwarding headers and external TLS termination. Therefore, in the scenario that you are using external TLS termination configuration with NGINX v0.25, you must enable the `use-forwarded-headers` option for ingress: +For RKE installations, edit the `cluster.yml` to add the following settings. ```yaml ingress: provider: nginx @@ -223,6 +224,22 @@ ingress: use-forwarded-headers: 'true' ``` +For RKE2 installations, you can create a custom `rke2-ingress-nginx-config.yaml` file at `/var/lib/rancher/rke2/server/manifests/rke2-ingress-nginx-config.yaml` containing this required setting to enable using forwarded headers with external TLS termination. Without this required setting applied, the external LB will continuously respond with redirect loops it receives from the ingress controller. (This can be created before or after rancher is installed, rke2 server agent will notice this addition and automatically apply it.) + +```yaml +--- +apiVersion: helm.cattle.io/v1 +kind: HelmChartConfig +metadata: + name: rke2-ingress-nginx + namespace: kube-system +spec: + valuesContent: |- + controller: + config: + use-forwarded-headers: "true" +``` + ### Required Headers - `Host` From cb46b1030b90185d775855699e52515863bedfcb Mon Sep 17 00:00:00 2001 From: John Carew Date: Thu, 5 Jun 2025 03:12:08 -0500 Subject: [PATCH 2/5] Update docs/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md Co-authored-by: Petr Kovar --- .../installation-references/helm-chart-options.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md b/docs/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md index 61e9b25351e..427b06f4df1 100644 --- a/docs/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md +++ b/docs/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md @@ -214,7 +214,7 @@ Your load balancer must support long lived websocket connections and will need t ### Configuring Ingress for External TLS when Using NGINX v0.25 -In NGINX v0.25, the behavior of NGINX has [changed](https://github.com/kubernetes/ingress-nginx/blob/master/Changelog.md#0220) regarding forwarding headers and external TLS termination. Therefore, in the scenario that you are using external TLS termination configuration with NGINX v0.25, you must enable the `use-forwarded-headers` option for ingress: +In NGINX v0.22, the behavior of NGINX has [changed](https://github.com/kubernetes/ingress-nginx/blob/06efac9f0b6f8f84b553f58ccecf79dc42c75cc6/Changelog.md) regarding forwarding headers and external TLS termination. Therefore, in the scenario that you are using external TLS termination configuration with NGINX v0.22, you must enable the `use-forwarded-headers` option for ingress: For RKE installations, edit the `cluster.yml` to add the following settings. ```yaml From 73dba2e2a6df36fa4d60bf4bbe99f50424d8649b Mon Sep 17 00:00:00 2001 From: Petr Kovar Date: Thu, 5 Jun 2025 11:52:50 +0200 Subject: [PATCH 3/5] Fix #1773 --- .../use-windows-clusters/use-windows-clusters.md | 6 +++--- .../launch-kubernetes-with-rancher.md | 2 +- .../use-windows-clusters/use-windows-clusters.md | 6 +++--- .../launch-kubernetes-with-rancher.md | 2 +- .../use-windows-clusters/use-windows-clusters.md | 6 +++--- .../launch-kubernetes-with-rancher.md | 2 +- .../use-windows-clusters/use-windows-clusters.md | 6 +++--- .../launch-kubernetes-with-rancher.md | 2 +- 8 files changed, 16 insertions(+), 16 deletions(-) diff --git a/docs/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/use-windows-clusters/use-windows-clusters.md b/docs/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/use-windows-clusters/use-windows-clusters.md index 74cc199ef0e..49f642caecc 100644 --- a/docs/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/use-windows-clusters/use-windows-clusters.md +++ b/docs/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/use-windows-clusters/use-windows-clusters.md @@ -18,7 +18,7 @@ Listed below are the primary RKE2 features for Windows cluster provisioning: - Windows Containers with RKE2 powered by containerd - Added provisioning of Windows RKE2 custom clusters directly from the Rancher UI -- Calico CNI for Windows RKE2 custom clusters +- Calico and Flannel CNI for Windows RKE2 custom clusters - SAC releases of Windows Server (2004 and 20H2) are included in the technical preview :::note @@ -57,7 +57,7 @@ Rancher will not provision the node if the node does not meet these requirements Before provisioning a new cluster, be sure that you have already installed Rancher on a device that accepts inbound network traffic. This is required in order for the cluster nodes to communicate with Rancher. If you have not already installed Rancher, please refer to the [installation documentation](../../../../getting-started/installation-and-upgrade/installation-and-upgrade.md) before proceeding with this guide. -Rancher supports Windows using Calico as the network provider. +Rancher supports Windows using Calico and Flannel as network providers. If you are configuring DHCP options sets for an AWS virtual private cloud, note that in the `domain-name` option field, only one domain name can be specified. According to the DHCP options [documentation:](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_DHCP_Options.html) @@ -163,7 +163,7 @@ The instructions for creating a Windows cluster on existing nodes are very simil 1. Click **Custom**. 1. Enter a name for your cluster in the **Cluster Name** field. 1. In the **Kubernetes Version** dropdown menu, select a supported Kubernetes version. -1. In the **Container Network** field, select **Calico**. +1. In the **Container Network** field, select either **Calico** or **Flannel**. 1. Click **Next**. ### 3. Add Nodes to the Cluster diff --git a/docs/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md b/docs/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md index 7c7faea2e8d..66010c77149 100644 --- a/docs/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md +++ b/docs/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md @@ -65,7 +65,7 @@ RKE2 provisioning also includes installing RKE2 on clusters with Windows nodes. Windows features for RKE2 include: - Windows supports the vSphere node driver -- Calico CNI for Windows RKE2 custom clusters +- Calico and Flannel CNI for Windows RKE2 custom clusters - Project Network Isolation (PNI) for Calico - Windows Containers with RKE2 powered by containerd - Provisioning of Windows RKE2 clusters through Terraform diff --git a/versioned_docs/version-2.10/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/use-windows-clusters/use-windows-clusters.md b/versioned_docs/version-2.10/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/use-windows-clusters/use-windows-clusters.md index 74cc199ef0e..49f642caecc 100644 --- a/versioned_docs/version-2.10/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/use-windows-clusters/use-windows-clusters.md +++ b/versioned_docs/version-2.10/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/use-windows-clusters/use-windows-clusters.md @@ -18,7 +18,7 @@ Listed below are the primary RKE2 features for Windows cluster provisioning: - Windows Containers with RKE2 powered by containerd - Added provisioning of Windows RKE2 custom clusters directly from the Rancher UI -- Calico CNI for Windows RKE2 custom clusters +- Calico and Flannel CNI for Windows RKE2 custom clusters - SAC releases of Windows Server (2004 and 20H2) are included in the technical preview :::note @@ -57,7 +57,7 @@ Rancher will not provision the node if the node does not meet these requirements Before provisioning a new cluster, be sure that you have already installed Rancher on a device that accepts inbound network traffic. This is required in order for the cluster nodes to communicate with Rancher. If you have not already installed Rancher, please refer to the [installation documentation](../../../../getting-started/installation-and-upgrade/installation-and-upgrade.md) before proceeding with this guide. -Rancher supports Windows using Calico as the network provider. +Rancher supports Windows using Calico and Flannel as network providers. If you are configuring DHCP options sets for an AWS virtual private cloud, note that in the `domain-name` option field, only one domain name can be specified. According to the DHCP options [documentation:](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_DHCP_Options.html) @@ -163,7 +163,7 @@ The instructions for creating a Windows cluster on existing nodes are very simil 1. Click **Custom**. 1. Enter a name for your cluster in the **Cluster Name** field. 1. In the **Kubernetes Version** dropdown menu, select a supported Kubernetes version. -1. In the **Container Network** field, select **Calico**. +1. In the **Container Network** field, select either **Calico** or **Flannel**. 1. Click **Next**. ### 3. Add Nodes to the Cluster diff --git a/versioned_docs/version-2.10/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md b/versioned_docs/version-2.10/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md index 7c7faea2e8d..66010c77149 100644 --- a/versioned_docs/version-2.10/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md +++ b/versioned_docs/version-2.10/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md @@ -65,7 +65,7 @@ RKE2 provisioning also includes installing RKE2 on clusters with Windows nodes. Windows features for RKE2 include: - Windows supports the vSphere node driver -- Calico CNI for Windows RKE2 custom clusters +- Calico and Flannel CNI for Windows RKE2 custom clusters - Project Network Isolation (PNI) for Calico - Windows Containers with RKE2 powered by containerd - Provisioning of Windows RKE2 clusters through Terraform diff --git a/versioned_docs/version-2.11/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/use-windows-clusters/use-windows-clusters.md b/versioned_docs/version-2.11/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/use-windows-clusters/use-windows-clusters.md index 74cc199ef0e..49f642caecc 100644 --- a/versioned_docs/version-2.11/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/use-windows-clusters/use-windows-clusters.md +++ b/versioned_docs/version-2.11/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/use-windows-clusters/use-windows-clusters.md @@ -18,7 +18,7 @@ Listed below are the primary RKE2 features for Windows cluster provisioning: - Windows Containers with RKE2 powered by containerd - Added provisioning of Windows RKE2 custom clusters directly from the Rancher UI -- Calico CNI for Windows RKE2 custom clusters +- Calico and Flannel CNI for Windows RKE2 custom clusters - SAC releases of Windows Server (2004 and 20H2) are included in the technical preview :::note @@ -57,7 +57,7 @@ Rancher will not provision the node if the node does not meet these requirements Before provisioning a new cluster, be sure that you have already installed Rancher on a device that accepts inbound network traffic. This is required in order for the cluster nodes to communicate with Rancher. If you have not already installed Rancher, please refer to the [installation documentation](../../../../getting-started/installation-and-upgrade/installation-and-upgrade.md) before proceeding with this guide. -Rancher supports Windows using Calico as the network provider. +Rancher supports Windows using Calico and Flannel as network providers. If you are configuring DHCP options sets for an AWS virtual private cloud, note that in the `domain-name` option field, only one domain name can be specified. According to the DHCP options [documentation:](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_DHCP_Options.html) @@ -163,7 +163,7 @@ The instructions for creating a Windows cluster on existing nodes are very simil 1. Click **Custom**. 1. Enter a name for your cluster in the **Cluster Name** field. 1. In the **Kubernetes Version** dropdown menu, select a supported Kubernetes version. -1. In the **Container Network** field, select **Calico**. +1. In the **Container Network** field, select either **Calico** or **Flannel**. 1. Click **Next**. ### 3. Add Nodes to the Cluster diff --git a/versioned_docs/version-2.11/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md b/versioned_docs/version-2.11/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md index 7c7faea2e8d..66010c77149 100644 --- a/versioned_docs/version-2.11/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md +++ b/versioned_docs/version-2.11/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md @@ -65,7 +65,7 @@ RKE2 provisioning also includes installing RKE2 on clusters with Windows nodes. Windows features for RKE2 include: - Windows supports the vSphere node driver -- Calico CNI for Windows RKE2 custom clusters +- Calico and Flannel CNI for Windows RKE2 custom clusters - Project Network Isolation (PNI) for Calico - Windows Containers with RKE2 powered by containerd - Provisioning of Windows RKE2 clusters through Terraform diff --git a/versioned_docs/version-2.9/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/use-windows-clusters/use-windows-clusters.md b/versioned_docs/version-2.9/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/use-windows-clusters/use-windows-clusters.md index 74cc199ef0e..49f642caecc 100644 --- a/versioned_docs/version-2.9/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/use-windows-clusters/use-windows-clusters.md +++ b/versioned_docs/version-2.9/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/use-windows-clusters/use-windows-clusters.md @@ -18,7 +18,7 @@ Listed below are the primary RKE2 features for Windows cluster provisioning: - Windows Containers with RKE2 powered by containerd - Added provisioning of Windows RKE2 custom clusters directly from the Rancher UI -- Calico CNI for Windows RKE2 custom clusters +- Calico and Flannel CNI for Windows RKE2 custom clusters - SAC releases of Windows Server (2004 and 20H2) are included in the technical preview :::note @@ -57,7 +57,7 @@ Rancher will not provision the node if the node does not meet these requirements Before provisioning a new cluster, be sure that you have already installed Rancher on a device that accepts inbound network traffic. This is required in order for the cluster nodes to communicate with Rancher. If you have not already installed Rancher, please refer to the [installation documentation](../../../../getting-started/installation-and-upgrade/installation-and-upgrade.md) before proceeding with this guide. -Rancher supports Windows using Calico as the network provider. +Rancher supports Windows using Calico and Flannel as network providers. If you are configuring DHCP options sets for an AWS virtual private cloud, note that in the `domain-name` option field, only one domain name can be specified. According to the DHCP options [documentation:](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_DHCP_Options.html) @@ -163,7 +163,7 @@ The instructions for creating a Windows cluster on existing nodes are very simil 1. Click **Custom**. 1. Enter a name for your cluster in the **Cluster Name** field. 1. In the **Kubernetes Version** dropdown menu, select a supported Kubernetes version. -1. In the **Container Network** field, select **Calico**. +1. In the **Container Network** field, select either **Calico** or **Flannel**. 1. Click **Next**. ### 3. Add Nodes to the Cluster diff --git a/versioned_docs/version-2.9/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md b/versioned_docs/version-2.9/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md index 7c7faea2e8d..66010c77149 100644 --- a/versioned_docs/version-2.9/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md +++ b/versioned_docs/version-2.9/how-to-guides/new-user-guides/launch-kubernetes-with-rancher/launch-kubernetes-with-rancher.md @@ -65,7 +65,7 @@ RKE2 provisioning also includes installing RKE2 on clusters with Windows nodes. Windows features for RKE2 include: - Windows supports the vSphere node driver -- Calico CNI for Windows RKE2 custom clusters +- Calico and Flannel CNI for Windows RKE2 custom clusters - Project Network Isolation (PNI) for Calico - Windows Containers with RKE2 powered by containerd - Provisioning of Windows RKE2 clusters through Terraform From e73b7efaef46776ab0b9b062a5bad6606bb6de96 Mon Sep 17 00:00:00 2001 From: John Carew Date: Thu, 5 Jun 2025 13:34:10 -0500 Subject: [PATCH 4/5] Update Ingress TLS configuration documentation for NGINX v0.22 The documentation has been revised to provide clearer guidance on configuring Ingress for external TLS with NGINX v0.22. Key changes include: - Removed references to NGINX v0.25. - Added instructions for enabling the `use-forwarded-headers` option in the `cluster.yml` for RKE installations. - Included steps for creating a custom `rke2-ingress-nginx-config.yaml` for RKE2 installations. - Provided a YAML snippet for HelmChartConfig to demonstrate how to set the `use-forwarded-headers` option in Helm chart values. --- .../helm-chart-options.md | 2 +- .../helm-chart-options.md | 21 +++++++++++++++++-- .../helm-chart-options.md | 21 +++++++++++++++++-- .../helm-chart-options.md | 21 +++++++++++++++++-- .../helm-chart-options.md | 21 +++++++++++++++++-- .../helm-chart-options.md | 21 +++++++++++++++++-- .../helm-chart-options.md | 21 +++++++++++++++++-- 7 files changed, 115 insertions(+), 13 deletions(-) diff --git a/docs/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md b/docs/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md index 427b06f4df1..f903eb1e4ec 100644 --- a/docs/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md +++ b/docs/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md @@ -212,7 +212,7 @@ If you are using a Private CA signed certificate (or if `agent-tls-mode` is set Your load balancer must support long lived websocket connections and will need to insert proxy headers so Rancher can route links correctly. -### Configuring Ingress for External TLS when Using NGINX v0.25 +### Configuring Ingress for External TLS when Using NGINX v0.22 In NGINX v0.22, the behavior of NGINX has [changed](https://github.com/kubernetes/ingress-nginx/blob/06efac9f0b6f8f84b553f58ccecf79dc42c75cc6/Changelog.md) regarding forwarding headers and external TLS termination. Therefore, in the scenario that you are using external TLS termination configuration with NGINX v0.22, you must enable the `use-forwarded-headers` option for ingress: diff --git a/versioned_docs/version-2.10/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md b/versioned_docs/version-2.10/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md index d84c4e70792..f88467d50d9 100644 --- a/versioned_docs/version-2.10/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md +++ b/versioned_docs/version-2.10/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md @@ -213,10 +213,11 @@ If you are using a Private CA signed certificate (or if `agent-tls-mode` is set Your load balancer must support long lived websocket connections and will need to insert proxy headers so Rancher can route links correctly. -### Configuring Ingress for External TLS when Using NGINX v0.25 +### Configuring Ingress for External TLS when Using NGINX v0.22 -In NGINX v0.25, the behavior of NGINX has [changed](https://github.com/kubernetes/ingress-nginx/blob/master/Changelog.md#0220) regarding forwarding headers and external TLS termination. Therefore, in the scenario that you are using external TLS termination configuration with NGINX v0.25, you must edit the `cluster.yml` to enable the `use-forwarded-headers` option for ingress: +In NGINX v0.22, the behavior of NGINX has [changed](https://github.com/kubernetes/ingress-nginx/blob/06efac9f0b6f8f84b553f58ccecf79dc42c75cc6/Changelog.md) regarding forwarding headers and external TLS termination. Therefore, in the scenario that you are using external TLS termination configuration with NGINX v0.22, you must enable the `use-forwarded-headers` option for ingress: +For RKE installations, edit the `cluster.yml` to add the following settings. ```yaml ingress: provider: nginx @@ -224,6 +225,22 @@ ingress: use-forwarded-headers: 'true' ``` +For RKE2 installations, you can create a custom `rke2-ingress-nginx-config.yaml` file at `/var/lib/rancher/rke2/server/manifests/rke2-ingress-nginx-config.yaml` containing this required setting to enable using forwarded headers with external TLS termination. Without this required setting applied, the external LB will continuously respond with redirect loops it receives from the ingress controller. (This can be created before or after rancher is installed, rke2 server agent will notice this addition and automatically apply it.) + +```yaml +--- +apiVersion: helm.cattle.io/v1 +kind: HelmChartConfig +metadata: + name: rke2-ingress-nginx + namespace: kube-system +spec: + valuesContent: |- + controller: + config: + use-forwarded-headers: "true" +``` + ### Required Headers - `Host` diff --git a/versioned_docs/version-2.11/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md b/versioned_docs/version-2.11/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md index ae3d62a426c..f903eb1e4ec 100644 --- a/versioned_docs/version-2.11/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md +++ b/versioned_docs/version-2.11/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md @@ -212,10 +212,11 @@ If you are using a Private CA signed certificate (or if `agent-tls-mode` is set Your load balancer must support long lived websocket connections and will need to insert proxy headers so Rancher can route links correctly. -### Configuring Ingress for External TLS when Using NGINX v0.25 +### Configuring Ingress for External TLS when Using NGINX v0.22 -In NGINX v0.25, the behavior of NGINX has [changed](https://github.com/kubernetes/ingress-nginx/blob/master/Changelog.md#0220) regarding forwarding headers and external TLS termination. Therefore, in the scenario that you are using external TLS termination configuration with NGINX v0.25, you must edit the `cluster.yml` to enable the `use-forwarded-headers` option for ingress: +In NGINX v0.22, the behavior of NGINX has [changed](https://github.com/kubernetes/ingress-nginx/blob/06efac9f0b6f8f84b553f58ccecf79dc42c75cc6/Changelog.md) regarding forwarding headers and external TLS termination. Therefore, in the scenario that you are using external TLS termination configuration with NGINX v0.22, you must enable the `use-forwarded-headers` option for ingress: +For RKE installations, edit the `cluster.yml` to add the following settings. ```yaml ingress: provider: nginx @@ -223,6 +224,22 @@ ingress: use-forwarded-headers: 'true' ``` +For RKE2 installations, you can create a custom `rke2-ingress-nginx-config.yaml` file at `/var/lib/rancher/rke2/server/manifests/rke2-ingress-nginx-config.yaml` containing this required setting to enable using forwarded headers with external TLS termination. Without this required setting applied, the external LB will continuously respond with redirect loops it receives from the ingress controller. (This can be created before or after rancher is installed, rke2 server agent will notice this addition and automatically apply it.) + +```yaml +--- +apiVersion: helm.cattle.io/v1 +kind: HelmChartConfig +metadata: + name: rke2-ingress-nginx + namespace: kube-system +spec: + valuesContent: |- + controller: + config: + use-forwarded-headers: "true" +``` + ### Required Headers - `Host` diff --git a/versioned_docs/version-2.6/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md b/versioned_docs/version-2.6/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md index 911c5dc2477..7aa4ee57baf 100644 --- a/versioned_docs/version-2.6/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md +++ b/versioned_docs/version-2.6/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md @@ -209,10 +209,11 @@ If you are using a Private CA signed certificate, add `--set privateCA=true` and Your load balancer must support long lived websocket connections and will need to insert proxy headers so Rancher can route links correctly. -### Configuring Ingress for External TLS when Using NGINX v0.25 +### Configuring Ingress for External TLS when Using NGINX v0.22 -In NGINX v0.25, the behavior of NGINX has [changed](https://github.com/kubernetes/ingress-nginx/blob/master/Changelog.md#0220) regarding forwarding headers and external TLS termination. Therefore, in the scenario that you are using external TLS termination configuration with NGINX v0.25, you must edit the `cluster.yml` to enable the `use-forwarded-headers` option for ingress: +In NGINX v0.22, the behavior of NGINX has [changed](https://github.com/kubernetes/ingress-nginx/blob/06efac9f0b6f8f84b553f58ccecf79dc42c75cc6/Changelog.md) regarding forwarding headers and external TLS termination. Therefore, in the scenario that you are using external TLS termination configuration with NGINX v0.22, you must enable the `use-forwarded-headers` option for ingress: +For RKE installations, edit the `cluster.yml` to add the following settings. ```yaml ingress: provider: nginx @@ -220,6 +221,22 @@ ingress: use-forwarded-headers: 'true' ``` +For RKE2 installations, you can create a custom `rke2-ingress-nginx-config.yaml` file at `/var/lib/rancher/rke2/server/manifests/rke2-ingress-nginx-config.yaml` containing this required setting to enable using forwarded headers with external TLS termination. Without this required setting applied, the external LB will continuously respond with redirect loops it receives from the ingress controller. (This can be created before or after rancher is installed, rke2 server agent will notice this addition and automatically apply it.) + +```yaml +--- +apiVersion: helm.cattle.io/v1 +kind: HelmChartConfig +metadata: + name: rke2-ingress-nginx + namespace: kube-system +spec: + valuesContent: |- + controller: + config: + use-forwarded-headers: "true" +``` + ### Required Headers - `Host` diff --git a/versioned_docs/version-2.7/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md b/versioned_docs/version-2.7/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md index c6ff10ea455..b1145be7fd2 100644 --- a/versioned_docs/version-2.7/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md +++ b/versioned_docs/version-2.7/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md @@ -212,10 +212,11 @@ If you are using a Private CA signed certificate, add `--set privateCA=true` and Your load balancer must support long lived websocket connections and will need to insert proxy headers so Rancher can route links correctly. -### Configuring Ingress for External TLS when Using NGINX v0.25 +### Configuring Ingress for External TLS when Using NGINX v0.22 -In NGINX v0.25, the behavior of NGINX has [changed](https://github.com/kubernetes/ingress-nginx/blob/master/Changelog.md#0220) regarding forwarding headers and external TLS termination. Therefore, in the scenario that you are using external TLS termination configuration with NGINX v0.25, you must edit the `cluster.yml` to enable the `use-forwarded-headers` option for ingress: +In NGINX v0.22, the behavior of NGINX has [changed](https://github.com/kubernetes/ingress-nginx/blob/06efac9f0b6f8f84b553f58ccecf79dc42c75cc6/Changelog.md) regarding forwarding headers and external TLS termination. Therefore, in the scenario that you are using external TLS termination configuration with NGINX v0.22, you must enable the `use-forwarded-headers` option for ingress: +For RKE installations, edit the `cluster.yml` to add the following settings. ```yaml ingress: provider: nginx @@ -223,6 +224,22 @@ ingress: use-forwarded-headers: 'true' ``` +For RKE2 installations, you can create a custom `rke2-ingress-nginx-config.yaml` file at `/var/lib/rancher/rke2/server/manifests/rke2-ingress-nginx-config.yaml` containing this required setting to enable using forwarded headers with external TLS termination. Without this required setting applied, the external LB will continuously respond with redirect loops it receives from the ingress controller. (This can be created before or after rancher is installed, rke2 server agent will notice this addition and automatically apply it.) + +```yaml +--- +apiVersion: helm.cattle.io/v1 +kind: HelmChartConfig +metadata: + name: rke2-ingress-nginx + namespace: kube-system +spec: + valuesContent: |- + controller: + config: + use-forwarded-headers: "true" +``` + ### Required Headers - `Host` diff --git a/versioned_docs/version-2.8/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md b/versioned_docs/version-2.8/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md index 94ed2a8d64e..f1e5443f40c 100644 --- a/versioned_docs/version-2.8/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md +++ b/versioned_docs/version-2.8/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md @@ -213,10 +213,11 @@ If you are using a Private CA signed certificate (or if `agent-tls-mode` is set Your load balancer must support long lived websocket connections and will need to insert proxy headers so Rancher can route links correctly. -### Configuring Ingress for External TLS when Using NGINX v0.25 +### Configuring Ingress for External TLS when Using NGINX v0.22 -In NGINX v0.25, the behavior of NGINX has [changed](https://github.com/kubernetes/ingress-nginx/blob/master/Changelog.md#0220) regarding forwarding headers and external TLS termination. Therefore, in the scenario that you are using external TLS termination configuration with NGINX v0.25, you must edit the `cluster.yml` to enable the `use-forwarded-headers` option for ingress: +In NGINX v0.22, the behavior of NGINX has [changed](https://github.com/kubernetes/ingress-nginx/blob/06efac9f0b6f8f84b553f58ccecf79dc42c75cc6/Changelog.md) regarding forwarding headers and external TLS termination. Therefore, in the scenario that you are using external TLS termination configuration with NGINX v0.22, you must enable the `use-forwarded-headers` option for ingress: +For RKE installations, edit the `cluster.yml` to add the following settings. ```yaml ingress: provider: nginx @@ -224,6 +225,22 @@ ingress: use-forwarded-headers: 'true' ``` +For RKE2 installations, you can create a custom `rke2-ingress-nginx-config.yaml` file at `/var/lib/rancher/rke2/server/manifests/rke2-ingress-nginx-config.yaml` containing this required setting to enable using forwarded headers with external TLS termination. Without this required setting applied, the external LB will continuously respond with redirect loops it receives from the ingress controller. (This can be created before or after rancher is installed, rke2 server agent will notice this addition and automatically apply it.) + +```yaml +--- +apiVersion: helm.cattle.io/v1 +kind: HelmChartConfig +metadata: + name: rke2-ingress-nginx + namespace: kube-system +spec: + valuesContent: |- + controller: + config: + use-forwarded-headers: "true" +``` + ### Required Headers - `Host` diff --git a/versioned_docs/version-2.9/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md b/versioned_docs/version-2.9/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md index d84c4e70792..f88467d50d9 100644 --- a/versioned_docs/version-2.9/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md +++ b/versioned_docs/version-2.9/getting-started/installation-and-upgrade/installation-references/helm-chart-options.md @@ -213,10 +213,11 @@ If you are using a Private CA signed certificate (or if `agent-tls-mode` is set Your load balancer must support long lived websocket connections and will need to insert proxy headers so Rancher can route links correctly. -### Configuring Ingress for External TLS when Using NGINX v0.25 +### Configuring Ingress for External TLS when Using NGINX v0.22 -In NGINX v0.25, the behavior of NGINX has [changed](https://github.com/kubernetes/ingress-nginx/blob/master/Changelog.md#0220) regarding forwarding headers and external TLS termination. Therefore, in the scenario that you are using external TLS termination configuration with NGINX v0.25, you must edit the `cluster.yml` to enable the `use-forwarded-headers` option for ingress: +In NGINX v0.22, the behavior of NGINX has [changed](https://github.com/kubernetes/ingress-nginx/blob/06efac9f0b6f8f84b553f58ccecf79dc42c75cc6/Changelog.md) regarding forwarding headers and external TLS termination. Therefore, in the scenario that you are using external TLS termination configuration with NGINX v0.22, you must enable the `use-forwarded-headers` option for ingress: +For RKE installations, edit the `cluster.yml` to add the following settings. ```yaml ingress: provider: nginx @@ -224,6 +225,22 @@ ingress: use-forwarded-headers: 'true' ``` +For RKE2 installations, you can create a custom `rke2-ingress-nginx-config.yaml` file at `/var/lib/rancher/rke2/server/manifests/rke2-ingress-nginx-config.yaml` containing this required setting to enable using forwarded headers with external TLS termination. Without this required setting applied, the external LB will continuously respond with redirect loops it receives from the ingress controller. (This can be created before or after rancher is installed, rke2 server agent will notice this addition and automatically apply it.) + +```yaml +--- +apiVersion: helm.cattle.io/v1 +kind: HelmChartConfig +metadata: + name: rke2-ingress-nginx + namespace: kube-system +spec: + valuesContent: |- + controller: + config: + use-forwarded-headers: "true" +``` + ### Required Headers - `Host` From 551d60f1937130adcb1ee4b1027e88fa94de89b8 Mon Sep 17 00:00:00 2001 From: John Carew Date: Thu, 5 Jun 2025 13:37:59 -0500 Subject: [PATCH 5/5] Update TLS termination documentation for NGINX v0.22 Clarify the configuration for external TLS termination with NGINX v0.22, including: - Instructions to enable the `use-forwarded-headers` option for ingress in both RKE and RKE2 installations. - A new section for RKE2 detailing how to create a custom configuration file for this setting. - Updates to the required headers section to include `X-Forwarded-Proto` and `X-Forwarded-Port`. --- .../helm2/helm-rancher/chart-options.md | 23 ++++++++++++++++--- .../helm-chart-options.md | 21 +++++++++++++++-- 2 files changed, 39 insertions(+), 5 deletions(-) diff --git a/archived_docs/en/version-2.0-2.4/getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/helm2/helm-rancher/chart-options.md b/archived_docs/en/version-2.0-2.4/getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/helm2/helm-rancher/chart-options.md index d231b49854f..883f194c364 100644 --- a/archived_docs/en/version-2.0-2.4/getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/helm2/helm-rancher/chart-options.md +++ b/archived_docs/en/version-2.0-2.4/getting-started/installation-and-upgrade/advanced-options/advanced-use-cases/helm2/helm-rancher/chart-options.md @@ -155,15 +155,32 @@ You may terminate the SSL/TLS on a L7 load balancer external to the Rancher clus Your load balancer must support long lived websocket connections and will need to insert proxy headers so Rancher can route links correctly. -#### Configuring Ingress for External TLS when Using NGINX v0.25 +### Configuring Ingress for External TLS when Using NGINX v0.22 -In NGINX v0.25, the behavior of NGINX has [changed](https://github.com/kubernetes/ingress-nginx/blob/main/Changelog.md#0220) regarding forwarding headers and external TLS termination. Therefore, in the scenario that you are using external TLS termination configuration with NGINX v0.25, you must edit the `cluster.yml` to enable the `use-forwarded-headers` option for ingress: +In NGINX v0.22, the behavior of NGINX has [changed](https://github.com/kubernetes/ingress-nginx/blob/06efac9f0b6f8f84b553f58ccecf79dc42c75cc6/Changelog.md) regarding forwarding headers and external TLS termination. Therefore, in the scenario that you are using external TLS termination configuration with NGINX v0.22, you must enable the `use-forwarded-headers` option for ingress: +For RKE installations, edit the `cluster.yml` to add the following settings. ```yaml ingress: provider: nginx options: - use-forwarded-headers: "true" + use-forwarded-headers: 'true' +``` + +For RKE2 installations, you can create a custom `rke2-ingress-nginx-config.yaml` file at `/var/lib/rancher/rke2/server/manifests/rke2-ingress-nginx-config.yaml` containing this required setting to enable using forwarded headers with external TLS termination. Without this required setting applied, the external LB will continuously respond with redirect loops it receives from the ingress controller. (This can be created before or after rancher is installed, rke2 server agent will notice this addition and automatically apply it.) + +```yaml +--- +apiVersion: helm.cattle.io/v1 +kind: HelmChartConfig +metadata: + name: rke2-ingress-nginx + namespace: kube-system +spec: + valuesContent: |- + controller: + config: + use-forwarded-headers: "true" ``` #### Required Headers diff --git a/archived_docs/en/version-2.5/reference-guides/installation-references/helm-chart-options.md b/archived_docs/en/version-2.5/reference-guides/installation-references/helm-chart-options.md index 2a6bf024c59..1dbec3b6740 100644 --- a/archived_docs/en/version-2.5/reference-guides/installation-references/helm-chart-options.md +++ b/archived_docs/en/version-2.5/reference-guides/installation-references/helm-chart-options.md @@ -160,10 +160,11 @@ You may terminate the SSL/TLS on a L7 load balancer external to the Rancher clus Your load balancer must support long lived websocket connections and will need to insert proxy headers so Rancher can route links correctly. -### Configuring Ingress for External TLS when Using NGINX v0.25 +### Configuring Ingress for External TLS when Using NGINX v0.22 -In NGINX v0.25, the behavior of NGINX has [changed](https://github.com/kubernetes/ingress-nginx/blob/master/Changelog.md#0220) regarding forwarding headers and external TLS termination. Therefore, in the scenario that you are using external TLS termination configuration with NGINX v0.25, you must edit the `cluster.yml` to enable the `use-forwarded-headers` option for ingress: +In NGINX v0.22, the behavior of NGINX has [changed](https://github.com/kubernetes/ingress-nginx/blob/06efac9f0b6f8f84b553f58ccecf79dc42c75cc6/Changelog.md) regarding forwarding headers and external TLS termination. Therefore, in the scenario that you are using external TLS termination configuration with NGINX v0.22, you must enable the `use-forwarded-headers` option for ingress: +For RKE installations, edit the `cluster.yml` to add the following settings. ```yaml ingress: provider: nginx @@ -171,6 +172,22 @@ ingress: use-forwarded-headers: 'true' ``` +For RKE2 installations, you can create a custom `rke2-ingress-nginx-config.yaml` file at `/var/lib/rancher/rke2/server/manifests/rke2-ingress-nginx-config.yaml` containing this required setting to enable using forwarded headers with external TLS termination. Without this required setting applied, the external LB will continuously respond with redirect loops it receives from the ingress controller. (This can be created before or after rancher is installed, rke2 server agent will notice this addition and automatically apply it.) + +```yaml +--- +apiVersion: helm.cattle.io/v1 +kind: HelmChartConfig +metadata: + name: rke2-ingress-nginx + namespace: kube-system +spec: + valuesContent: |- + controller: + config: + use-forwarded-headers: "true" +``` + ### Required Headers - `Host`