Install Rancher on DigitalOcean Kubernetes with Ingress and TLS

Step 1: Set up a Kubernetes cluster on DigitalOcean#

Create a DOKS cluster#

• Log in to your DigitalOcean Control Panel.
• Click Create → Kubernetes.
• Choose your Kubernetes version, node size, and region.
• Specify at least 2 nodes for redundancy.
• Name your cluster (for example, rancher-cluster) and click Create.

Download your kubeconfig file#

Once your cluster is ready, download the kubeconfig file or use doctl to configure access:

doctl kubernetes cluster kubeconfig save rancher-cluster

Verify cluster access#

Test cluster connectivity with kubectl get nodes. You should see your cluster nodes listed. This confirms that your local environment can reach the cluster and authenticate successfully.

Step 2: Install an NGINX ingress controller#

To expose Rancher externally, you need an Ingress Controller. This step installs ingress-nginx using Helm:

helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update
helm install ingress-nginx ingress-nginx/ingress-nginx \
  --create-namespace --namespace ingress-nginx

Verify the installation#

Check the ingress controller service with kubectl get svc -n ingress-nginx. The output should show a LoadBalancer with an external IP (for example, 167.172.15.201). Take note of this IP address.

Set up your domain's DNS#

Point your domain (for example, rancher.yourdomain.com) to the ingress controller's external IP. Create an A record in your DNS provider to ensure traffic to your domain reaches the ingress controller.

Step 3: Install cert-manager for TLS certificates#

Rancher requires HTTPS to work correctly. cert-manager automatically obtains and renews TLS certificates from Let's Encrypt:

helm repo add jetstack https://charts.jetstack.io
helm repo update
helm install cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --create-namespace \
  --set installCRDs=true

Verify installation#

Check that cert-manager pods are running with kubectl get pods -n cert-manager. You should see pods for cert-manager, cert-manager-cainjector, and cert-manager-webhook in a Running state.

Step 4: Install Rancher#

Now you can install Rancher itself using the Helm chart:

helm repo add rancher-stable https://releases.rancher.com/server-charts/stable
helm repo update
helm install rancher rancher-stable/rancher \
  --namespace cattle-system \
  --set hostname=rancher.yourdomain.com \
  --set ingress.tls.source=letsEncrypt

Monitor Rancher initialization#

Wait for Rancher to initialize with kubectl get pods -n cattle-system. Ensure all pods are in the Running state before proceeding. This can take several minutes on the first run.

Step 5: Fix common issues with ingress#

Issue 1: No CLASS assigned to ingress#

Check your ingress resources with kubectl get ingress -n cattle-system. If you see <none> under the CLASS column, the ingress-nginx controller is not picking up these resources. Patch both the cert-manager challenge ingress and the Rancher ingress:

# For the cert-manager challenge Ingress
kubectl patch ingress cm-acme-http-solver-<hash> \
  -n cattle-system \
  -p '{"spec": {"ingressClassName": "nginx"}}'

# For the Rancher Ingress
kubectl patch ingress rancher \
  -n cattle-system \
  -p '{"spec": {"ingressClassName": "nginx"}}'

Verify with kubectl get ingress -n cattle-system. You should now see nginx in the CLASS column.

Issue 2: HTTP challenge fails#

Check the temporary challenge ingress with kubectl get ingress -n cattle-system and look for the cm-acme-http-solver-<hash> resource. Describe it with kubectl describe ingress cm-acme-http-solver-<hash> -n cattle-system.

Test the HTTP challenge directly:

curl -I http://rancher.yourdomain.com/.well-known/acme-challenge/<challenge-token>

If this fails, check several things. Ensure DNS is pointing correctly to your ingress controller's external IP. Verify that port 80 is open to the public for Let's Encrypt validation. Check that no firewall rules are blocking the ACME challenge endpoint.

Step 6: Verify TLS and Rancher access#

Monitor certificate issuance#

Check the Certificate resource status with kubectl describe certificate tls-rancher-ingress -n cattle-system. When the Status shows Ready: True, the certificate has been successfully issued by Let's Encrypt.

Restart Rancher deployment (optional)#

If needed, restart the Rancher deployment with kubectl rollout restart deployment rancher -n cattle-system.

Access Rancher#

Open https://rancher.yourdomain.com in your browser. You should see the Rancher login page with a valid TLS certificate. If the certificate is invalid or missing, check the cert-manager logs for errors. Verify that all ingress patches were applied correctly.

Conclusion#

You have successfully installed Rancher on a DigitalOcean Kubernetes cluster with automatic TLS provisioning. This setup provides a secure, production-ready Rancher environment for managing multiple Kubernetes clusters from a single interface.

If you encounter issues, check the cert-manager logs and verify your DNS configuration. With Rancher running, you can now discover, import, and manage additional Kubernetes clusters across any infrastructure.