so 1) install cert-manager to harvester 2) create certificate in cattle-system apiVersion: cert-manager.io/v1 kind: Certificate metadata: name: tls-ingress namespace: cattle-system spec: commonName: harvester.x.x.x dnsNames: - harvester.x.x.x duration: 21600h ipAddresses: - ip issuerRef: kind: ClusterIssuer name: your issuer renewBefore: 360h secretName: tls-ingress

A little more detailed in case you need it would be: • Log into the UI and turn on experimental/developer features in the UI. • Go to > Support and launch the embedded Rancher UI. (This lets you deploy helm, see yaml objects, get kube configs etc) • Under apps, add the jetstack.io repos to add the certmanager charts. • Install certmanager. • Add cluster issuer. • Edit the UI/k8s default ingress called

rancher-expose

in the

cattle-system

namespace to have the FQDN and the cert-manager annotations. It'll look something like this:

apiVersion: <http://networking.k8s.io/v1|networking.k8s.io/v1>  
kind: Ingress  
metadata:  
  annotations:  
    <http://acme.cert-manager.io/http01-edit-in-place|acme.cert-manager.io/http01-edit-in-place>: 'true'  
    <http://cert-manager.io/cluster-issuer|cert-manager.io/cluster-issuer>: letsencrypt-issuer  
    <http://kubectl.kubernetes.io/last-applied-configuration|kubectl.kubernetes.io/last-applied-configuration>: >  
      {"apiVersion":"<http://networking.k8s.io/v1|networking.k8s.io/v1>","kind":"Ingress","metadata":{"annotations":{},"name":"rancher-expose","namespace":"cattle-system"},"spec":{"rules":[{"http":{"paths":[{"backend":{"service":{"name":"rancher","port":{"number":80}}},"path":"/","pathType":"Prefix"}]}}]}}  
spec:  
  rules:  
    - host: <http://myharvester.example.edu|myharvester.example.edu>  
      http:  
        paths:  
          - backend:  
              service:  
                name: rancher  
                port:  
                  number: 80  
            path: /  
            pathType: Prefix  
  tls:  
    - hosts:  
        - <http://myharvester.example.edu|myharvester.example.edu>  
      secretName: harvester-certmanager-tls