https://rancher.com/ logo
Title
m

most-sunset-36476

03/23/2023, 3:02 PM
Hi all, We have a Rancher cluster (AKS) as Management cluster with public LoadBalancer and we would like to expose a service internally to the downstream Rancher launched K8s clusters (AKS). Is there a way to achieve that without having to create an extra internal Ingress Controller ? Thanks!
p

polite-piano-74233

03/23/2023, 4:42 PM
afaik youll need another ingress at the downstream cluster, it doesnt need to be public facing though
you could also technically do it with nodeports but id recommend just building the ingress
m

most-sunset-36476

03/23/2023, 4:45 PM
Ok so an extra internal ingress controller on the management cluster (rancher cluster) and exposing the thanos reciever service through an ingress resource using the internal ingress?
What i need is the management cluster to expose internally the thanos receive service for the downstream cluster to remote write on that endpoint
p

polite-piano-74233

03/23/2023, 4:48 PM
im not 100% sure im following what your trying to accomplish, but what we do for all of our aks clusters (including gov ones) is two ingress controllers (two ingressclasses), one called external and one called internal. this way we can explicitly state which class individual ingresses use, as well as defaulting to internal to prevent accidental exposure
m

most-sunset-36476

03/23/2023, 8:32 PM
I have my rancher management cluster running with an external load balancer (external ingress controller load balancer) and this cluster acts as a central monitoring with a thanos receiver for downstream clusters on which to remote-write. I don't want to expose the thanos receiver service externally and would rather expose it internally so that downstream clusters can access and remote-write to that endpoint. Downstream clusters are on the same network as the management cluster but not on the same subnet. Can i use an extra internal ingress controller on the management cluster to expose the thanos receiver service to the downstream clusters ?
p

polite-piano-74233

03/23/2023, 8:47 PM
That would be my recommendation yes
m

most-sunset-36476

03/23/2023, 8:53 PM
Ok thank you 🙂
Why not use a LoadBalancer service without ingress instead?
p

polite-piano-74233

03/24/2023, 1:21 PM
the ingress is more for kubernetes so that you can have multiple services behind the one ip address/aks loadbalancer. Sure you could technically spin up an aks load balancer for each service but that gets sorta pricey and is less under k8s control
m

most-sunset-36476

03/24/2023, 2:11 PM
Yes indeed, i will reuse the internal ingress for other services anyway at a later stage when connecting through teleport only!thanks :)
@polite-piano-74233 Does Rancher AKS Launched cluster support manual AKS k8S version upgrade ?