2

I have a Rancher running inside a Kubernetes cluster. It is installed using helm chart. The Rancher web UI is exposed using an ingress.

There is a DNS record for this ingress in an external DNS: rancher.myexample.com (this is just en example! DNS name)

I have a wildcard TLS certificate that covers *.myexample.com

How to use this TLS certificate for Rancher exposed via ingress?

Harsh Manvar
  • 27,020
  • 6
  • 48
  • 102
Michael Chudinov
  • 2,620
  • 28
  • 43

2 Answers2

2

You can add the certificate from Resources > Secrets > Certificates. Click Add Certificate.

You can check same path based on the version of the rancher you are using.

Read more at : https://rancher.com/docs/rancher/v2.5/en/k8s-in-rancher/certificates/

Option : 2

Create secret with the certificate details, and attach cert to ingress.

Setting default certificate of the Nginx ingress : https://rancher.com/docs/rke/latest/en/config-options/add-ons/ingress-controllers/#configuring-an-nginx-default-certificate

Harsh Manvar
  • 27,020
  • 6
  • 48
  • 102
  • The option 2 is the only reasonable, because certificate integration must be automated. However this option assumes that cluster.yml used to create the cluster is available. Where to get this cluster.yml file ? The one that was used for my cluster installation with default helm – Michael Chudinov Oct 09 '21 at 15:08
1

The only workable solution for Rancher with private custom CA certificate is described here https://rancher.com/docs/rancher/v2.5/en/installation/resources/update-ca-cert/

Solution has 3 steps:

  1. Create the certificate secret resource
  2. Create the CA certificate secret resource
  3. Run the Rancher deployment

example script

kubectl create namespace cattle-system

kubectl -n cattle-system create secret tls tls-rancher-ingress \
  --cert=manifests/certs/tls.crt \
  --key=manifests/certs/tls.key

kubectl -n cattle-system create secret generic tls-ca \
  --from-file=manifests/certs/ca.crt

helm install rancher rancher-latest/rancher \
  --namespace cattle-system \
  --set hostname="rancher.$DOMAIN" \
  --set ingress.tls.source=secret \
  --set replicas=3

This works as well for an existing cluster, but secrets must be updated and helm deployment must be updated.

Michael Chudinov
  • 2,620
  • 28
  • 43