I just discovered that Rancher Global DNS is including the unschedulable node IPs in the public domains even though nginx-ingress will only be provisioned on schedulable nodes...