When you add a new host to a Rancher 1.6 environment, Rancher's web UI gives you a sudo docker... command to run in the host. The command looks like this:
sudo docker run --rm --privileged -v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/rancher:
/var/lib/rancher rancher/agent:v1.2.11 https://rancher.example.com/v1/scripts/xxxxxxxxxxxxxxxxxxxx:yyyyyyyyyyyyy:zzzzzzzzzzzzzzzzzzzzzzzzzzz
The rancher/agent:v1.2.11 image can't connect to Rancher Server's whose HTTPS connection uses a Let's Encrypt certificate (yes, that issue). So we have to change it to our custom build: manastech/rancher-v1.6-agent:v1.2.12. But, even if you can change the image in the above command - it won't do any good.
The rancher-agent connects to the server and asks for a bootstrap script located at https://rancher.example.com/v1/scripts/bootstrap, which overrides which image to use for the rancher-agent container (look for a REQUIRED_IMAGE variable there).
This image specification is configured as a setting internal to Cattle.
There's an Admin -> Settings tab in Rancher's web UI (if you're an admin), but it doesn't include this setting we need.
So you have to connect to Rancher's DB 🤦.
Connect to your Rancher Server via SSH, then get a shell on Rancher Server's container. From there, run mysql to connect to the database server, then use cattle; to select the right database.
The table we're looking for is called setting (singular, yes). Run a select * from setting; to check what values are there. We'll INSERT INTO setting (name, value) VALUES ("bootstrap.required.image", "manastech/rancher-v1.6-agent:v1.2.12"); so there's a new setting there.
After that, exit mysql, exit the container's shell session, and restart the Rancher Server container - that's it. If you download the bootstrap script once again, you should see the new value for the REQUIRED_IMAGE.
This won't only help with the automatically created containers, but should also update the command shown in the web UI (the sudo docker... above) so that you don't even need to manually edit it.
The setting is server-wide - you don't have to do this on a per-environment basis.
Now go learn you some Kubernetes and get rid of this thing. Quick.