Configuring Azure Application Gateway (L7)
This guide describes how to configure a third-party Layer 7 (L7) load balancer for the Adeptia Rancher Package deployed on a three-node RKE2 high-availability (HA) cluster.
The load balancer handles all inbound HTTPS traffic and distributes requests across healthy cluster nodes. Each node runs Envoy Gateway as a DaemonSet, exposing HTTPS traffic on port 443.
Traffic flows as follows:
User --> DNS --> Load Balancer Virtual IP (VIP) --> HTTPS (Port 443) --> Backend Pool (RKE2 Node IPs) --> Envoy Gateway (Port 443 on each node) --> Rancher / Application Services
Prerequisites
Before configuring the load balancer, ensure the following requirements are met.
| Item | Description |
|---|---|
| Load Balancer | Any Layer 7 load balancer capable of HTTPS termination and health probing |
| Virtual IP (VIP) | A static IP address assigned to the load balancer and accessible by end users. |
| Backend Nodes | Linux VMs for RKE2 cluster |
| TLS Certificate | Wildcard or SAN certificate covering all required hostnames |
| DNS Records | Hostnames such as rancher.mycompany.org and rancher-ac.mycompany.org |
| Firewall Access | HTTPS connectivity from the load balancer to all cluster nodes on port 443 |
Network Requirements
Ensure that the load balancer can establish HTTPS connections to every cluster node.
The following ports must be allowed between the load balancer and the RKE2 nodes:
| Source | Destination | Port | Protocol |
|---|---|---|---|
| Load Balancer | All RKE2 Nodes | 443 | TCP |
| Load Balancer | All RKE2 Nodes | Health Probe Port (if different) | TCP |
 | Use the private IP addresses of the Rancher nodes. Do not use public IP addresses. |
|---|
Backend Pool Configuration
Create a backend pool containing all RKE2 nodes.
Example:
| Node | IP Address |
|---|---|
| Node 1 | 10.32.4.6 |
| Node 2 | 10.32.4.7 |
| Node 3 | 10.32.4.10 |
All nodes should participate in load balancing.
Health Probe Configuration
Configure an HTTPS health probe with the following settings:
| Setting | Value |
|---|---|
| Protocol | HTTPS |
| Path | /healthz |
| Port | 443 |
| Interval | 30 seconds |
| Timeout | 30 seconds |
| Healthy Response Codes | 200–399 |
| The /healthz endpoint is provided by Envoy Gateway and returns HTTP 200 even when no application workloads are running. This ensures reliable node health monitoring. |
|---|
Backend Service Settings
Configure the backend service with the following recommended settings:
| Setting | Value |
|---|---|
| Protocol | HTTPS |
| Backend Port | 443 |
| Session Persistence | Enabled (recommended) |
| Connection Draining | 30 seconds |
| Request Timeout | 300 seconds |
| Health Probe | /healthz |
| Do not reduce the request timeout below 60 seconds. Rancher operations may require longer-running API requests. |
|---|
TLS Certificate Configuration
Upload and assign a TLS certificate to the load balancer listener.
Example:
*.mycompany.org
The certificate should cover all required hostnames, including:
rancher.mycompany.org rancher-ac.mycompany.org
HTTP Header Configuration
Configure the load balancer to forward the following header to backend services:
X-Forwarded-Proto: https
| Rancher relies on this header to identify the original client protocol. Failure to forward this header may result in redirect loops or incorrect URL generation. |
|---|
Listener Configuration
Create HTTPS listeners for each hostname.
| Hostname | Port | Protocol |
|---|---|---|
| rancher.mycompany.org | 443 | HTTPS |
| rancher-ac.mycompany.org | 443 | HTTPS |
If multiple hostnames share the same VIP and port, configure Server Name Indication (SNI) support on the load balancer.
DNS Configuration
Create DNS records that point to the load balancer VIP.
| Hostname | Type | Value |
|---|---|---|
| rancher.mycompany.org | A | Load Balancer VIP |
| rancher-ac.mycompany.org | A | Load Balancer VIP |
Validation
Verify node health directly:
Code
curl -sk -o /dev/null -w '%{http_code}' https://<IP address of VM1>/healthz
curl -sk -o /dev/null -w '%{http_code}' https://<IP address of VM2>/healthz
curl -sk -o /dev/null -w '%{http_code}' https://<IP address of VM3>/healthz
Expected response: 200
Verify access through the load balancer:
Code
curl -sk -o /dev/null -w '%{http_code}' https://rancher-ac.mycompany.org/healthz
curl -sk -o /dev/null -w '%{http_code}' https://rancher.mycompany.org/healthz
Expected response: 200
Verify Rancher UI access:
Code
curl -sk -o /dev/null -w '%{http_code}' https://rancher-ac.mycompany.org
Expected response: 200 or 302
Finally, open the following URL in a browser:
https://rancher-ac.mycompany.org
The Rancher login page should load successfully. This configuration is vendor-neutral and can be used for Kemp, AGW or any other enterprise load balancer.