Introduction

In a lot of enterprise environments, servers or VMs running on premises do not have direct Internet access. Instead, the connection to external services is done through a HTTP(S) proxy for security reasons. This tutorial shows you how to set up an Elemental deployment in such an environment.

important note

This guide will not cover the Rancher installation behind a proxy. It's a different use case and you can find the detailed documentation here.

info

For this documentation, we assume you are using a SUSE family system (like Elemental Teal), so proxy settings have to be written in /etc/sysconfig/proxy.

Proxy settings must be configured in the following locations:

• Machine Registration Endpoint
• SeedImage resource
• Elemental cluster configuration

The elemental-system-agent needs proxy settings to reach the Rancher Manager. To achieve that, you need to fill the cloud-init section of the Machine Registration Endpoint.

You can do it either with UI or CLI.

CLI

registration.yaml

apiVersion: elemental.cattle.io/v1beta1
kind: MachineRegistration
metadata:
  name: my-nodes
  namespace: fleet-default
spec:
  config:
    cloud-config:
      write_files:
      - path: /etc/sysconfig/proxy
        append: true
        content: |
          PROXY_ENABLED="yes"
          HTTP_PROXY=http://<MY_PROXY>:<MY_PORT>
          HTTPS_PROXY=https://<MY_PROXY>:<MY_PORT>
          NO_PROXY="localhost, 127.0.0.1"
      users:
        - name: root
          passwd: root
    elemental:
      install:
        reboot: true
        device: /dev/sda
        debug: true
      registration:
        emulate-tpm: true

UI

Elemental-register

Elemental-register is the first communication endpoint between the new host and Rancher Manager, this is the first place where proxy settings need to be set.

warning

At the time of writing, it's only possible to configure proxy settings for the ISO with the CLI. The proxy settings aren't implemented in the UI.

The process happens when you boot your Elemental ISO for the first time, in order to configure the proxy settings you have to include a cloud-init definition in the ISO. To do that, you have to create a SeedImage definition.

seedimage.yaml

apiVersion: elemental.cattle.io/v1beta1
kind: SeedImage
metadata:
  name: ...
  namespace: ...
spec:
  baseImage: https://download.opensuse.org/repositories/isv:/Rancher:/Elemental:/Stable:/Teal53/media/iso/elemental-teal.x86_64.iso
  cloud-config:
    write_files:
    - path: /etc/sysconfig/proxy
      append: true
      content: |
        PROXY_ENABLED="yes"
        HTTP_PROXY=http://<MY_PROXY>:<MY_PORT>
        HTTPS_PROXY=https://<MY_PROXY>:<MY_PORT>
        NO_PROXY="localhost, 127.0.0.1"
  registrationRef:
    apiVersion: elemental.cattle.io/v1beta1
    kind: MachineRegistration
    name: ...
    namespace: ...

Apply the YAML with kubectl and then, print your SeedImage definition to get the URL to download it:

kubectl apply -f <my_seedimage_yaml_file>
kubectl get seedimage <seed_image_name> -n <namespace> -o yaml

Boot the ISO and you should see your new system appears in Machine inventory.

Create Elemental cluster

For this step, you can use either the UI or CLI.

CLI

cluster.yaml

kind: Cluster
apiVersion: provisioning.cattle.io/v1
metadata:
  name: my-cluster
  namespace: fleet-default
spec:
  agentEnvVars:
  - name: HTTP_PROXY
    value: http://<MY_PROXY>:<MY_PORT>
  - name: HTTPS_PROXY
    value: https://<MY_PROXY>:<MY_PORT>
  - name: NO_PROXY
    value: localhost,127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.cluster.local
  rkeConfig:
    machineGlobalConfig:
      etcd-expose-metrics: false
      profile: null
    machinePools:
      - controlPlaneRole: true
        etcdRole: true
        machineConfigRef:
          apiVersion: elemental.cattle.io/v1beta1
          kind: MachineInventorySelectorTemplate
          name: my-machine-selector
        name: pool1
        quantity: 1
        unhealthyNodeTimeout: 0s
        workerRole: true
    machineSelectorConfig:
      - config:
          protect-kernel-defaults: false
    registries: {}
  kubernetesVersion: v1.24.8+k3s1

You can see that proxy settings are added below agentEnvVars.

UI