Rancher and NGINX Ingress

It's been a while now since the community edition of ingress-nginx was retired. SUSE has decided to move to Traefik for the ingress controller in the future, and RKE2 will default to Traefik for new installations beginning with 1.36.

Traefik is a great choice, but you may already be fully invested in the F5 ecosystem and want to migrate from ingress-nginx to nginx-ingress, the OSS version of the F5 NGINX Ingress controller, instead.

F5 has a migration guide, but let's look at a fresh Rancher install using nginx-ingress as an example.

Installing NGINX Ingress

For preparation, since we want to use nginx-ingress as our default ingress controller, we'll disable Traefik on RKE2 by setting ingress-controller: none in its configuration file.

Get Christian Frank’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Choosing an installation with Helm, we then create a values file for the installation to have NGINX Ingress use the host network and act as the default controller:

## Ref: https://github.com/nginx/kubernetes-ingress/blob/main/charts/nginx-ingress/values.yaml
controller:
  hostNetwork: true
  ingressClass:
    setAsDefaultIngress: true
  service:
    type: ClusterIP

After creating the namespace, we install NGINX Ingress OSS and wait for completion:

kubectl create namespace nginx-ingress

helm install -f values.yaml nginx-ingress oci://ghcr.io/nginx/charts/nginx-ingress --namespace nginx-ingress

kubectl -n nginx-ingress rollout status deploy/nginx-ingress-controller

Installing Rancher

Now that we have a working NGINX Ingress controller, we'll install Rancher.

Access to the UI will work right away; however, to enable WebSocket support for log viewing and the kubectl shell, we need to add a couple of annotations to the Helm install:

helm install rancher rancher-stable/rancher \
  --namespace cattle-system \
  --set hostname=rancher.host.name \
  --set ingress.extraAnnotations."nginx\\.org/websocket-services"="rancher" \
  --set ingress.extraAnnotations."nginx\\.org/proxy-read-timeout"="1800s" \
  --set ingress.extraAnnotations."nginx\\.org/proxy-send-timeout"="1800s" \
  --set ingress.extraAnnotations."nginx\\.org/sticky-cookie-services"="serviceName=rancher cattle_id"

The ingress definition for Rancher will then look somewhat similar to this example:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    meta.helm.sh/release-name: rancher
    meta.helm.sh/release-namespace: cattle-system
    nginx.org/proxy-read-timeout: 1800s
    nginx.org/proxy-send-timeout: 1800s
    nginx.org/sticky-cookie-services: serviceName=rancher cattle_id
    nginx.org/websocket-services: rancher
  labels:
    app: rancher
    app.kubernetes.io/managed-by: Helm
    chart: rancher-2.14.1
    heritage: Helm
    release: rancher
  name: rancher
  namespace: cattle-system
spec:
  ingressClassName: nginx
  rules:
    - host: rancher.host.name
      http:
        paths:
          - backend:
              service:
                name: rancher
                port:
                  number: 80
            path: /
            pathType: ImplementationSpecific

With these annotations in place, the Rancher UI should be fully functional.

Happy Ranching!