breezy-ram-80329
11/21/2022, 1:29 PMsalmon-portugal-38278
11/21/2022, 4:11 PMlively-zoo-40381
11/21/2022, 4:32 PMrancher-7859df46-c69nz rancher 2022/11/21 16:27:56 [ERROR] error syncing 'cattle-global-data/rke-cis-1.5': handler cisBenchmarkVersionHandler: cisBenchmarkVersionHandler: Sync: error creating namespace: error while creating namespace security-scan: Internal error occurred: failed calling webhook "<http://owner.namespace.capsule.clastix.io|owner.namespace.capsule.clastix.io>": Post "<https://capsule-webhook-service.liqo.svc:443/namespace-owner-reference?timeout=30s>": dial tcp 10.43.6.146:443: connect: connection refused, requeuing
rancher-7859df46-c69nz rancher 2022/11/21 16:27:58 [ERROR] error syncing 'cattle-global-data/rke-cis-1.4': handler cisBenchmarkVersionHandler: cisBenchmarkVersionHandler: Sync: error creating namespace: error while creating namespace security-scan: Internal error occurred: failed calling webhook "<http://owner.namespace.capsule.clastix.io|owner.namespace.capsule.clastix.io>": Post "<https://capsule-webhook-service.liqo.svc:443/namespace-owner-reference?timeout=30s>": dial tcp 10.43.6.146:443: connect: connection refused, requeuing
rancher-7859df46-c69nz rancher 2022/11/21 16:28:01 [ERROR] error syncing 'c-hjrkx/m-1526f20a73c5': handler rke-worker-upgrader: getNodePlan error for node [m-1526f20a73c5]: failed to find plan for 172.18.50.230, requeuing
rancher-7859df46-c69nz rancher 2022/11/21 16:28:01 [ERROR] error syncing 'c-hjrkx/m-1526f20a73c5': handler rke-worker-upgrader: getNodePlan error for node [m-1526f20a73c5]: failed to find plan for 172.18.50.230, requeuing
rancher-7859df46-c69nz rancher 2022/11/21 16:28:01 [ERROR] error syncing 'c-hjrkx/m-1526f20a73c5': handler rke-worker-upgrader: getNodePlan error for node [m-1526f20a73c5]: failed to find plan for 172.18.50.230, requeuing
rancher-7859df46-c69nz rancher 2022/11/21 16:28:01 [ERROR] error syncing 'c-hjrkx/m-1526f20a73c5': handler rke-worker-upgrader: getNodePlan error for node [m-1526f20a73c5]: failed to find plan for 172.18.50.230, requeuing
rancher-7859df46-c69nz rancher 2022/11/21 16:28:02 [ERROR] error syncing 'c-hjrkx/m-1526f20a73c5': handler rke-worker-upgrader: getNodePlan error for node [m-1526f20a73c5]: failed to find plan for 172.18.50.230, requeuing
rancher-7859df46-c69nz rancher 2022/11/21 16:28:02 [ERROR] error syncing 'c-hjrkx/m-1526f20a73c5': handler rke-worker-upgrader: getNodePlan error for node [m-1526f20a73c5]: failed to find plan for 172.18.50.230, requeuing
rancher-7859df46-c69nz rancher 2022/11/21 16:28:02 [ERROR] error syncing 'c-hjrkx/m-1526f20a73c5': handler rke-worker-upgrader: getNodePlan error for node [m-1526f20a73c5]: failed to find plan for 172.18.50.230, requeuing
rancher-7859df46-c69nz rancher 2022/11/21 16:28:04 [ERROR] error syncing 'c-hjrkx/m-1526f20a73c5': handler rke-worker-upgrader: getNodePlan error for node [m-1526f20a73c5]: failed to find plan for 172.18.50.230, requeuing
rancher-7859df46-c69nz rancher 2022/11/21 16:28:06 [ERROR] error syncing 'c-hjrkx/m-1526f20a73c5': handler rke-worker-upgrader: getNodePlan error for node [m-1526f20a73c5]: failed to find plan for 172.18.50.230, requeuing
rancher-7859df46-c69nz rancher 2022/11/21 16:28:11 [ERROR] error syncing 'c-hjrkx/m-1526f20a73c5': handler rke-worker-upgrader: getNodePlan error for node [m-1526f20a73c5]: failed to find plan for 172.18.50.230, requeuing
rancher-7859df46-c69nz rancher 2022/11/21 16:28:22 [ERROR] error syncing 'c-hjrkx/m-1526f20a73c5': handler rke-worker-upgrader: getNodePlan error for node [m-1526f20a73c5]: failed to find plan for 172.18.50.230, requeuing
rancher-7859df46-c69nz rancher 2022/11/21 16:28:42 [ERROR] error syncing 'c-hjrkx/m-1526f20a73c5': handler rke-worker-upgrader: getNodePlan error for node [m-1526f20a73c5]: failed to find plan for 172.18.50.230, requeuing
gorgeous-iron-45755
11/21/2022, 7:09 PMhttps://<FQDN>/v3/settings/_cacerts_
Rancher server was deployed using the following command:
helm install rancher rancher-stable/rancher --namespace cattle-system \
--set hostname=<FQDN> \
--set replicas=3 \
--set ingress.tls.source=secret \
--set privateCA=true
However, when importing an existing generic Kubernetes cluster,gorgeous-iron-45755
11/21/2022, 7:30 PMhelm install rancher rancher-stable/rancher --namespace cattle-system \
--set hostname=<FQDN> \
--set replicas=3 \
--set ingress.tls.source=secret \
--set privateCA=true
The https://<FQDN>/v3/settings/_cacerts_
endpoint returns the same root CA with that contained in the corresponding secret.
However, Rancher server seems not to have taken into account the ingress secret as its certificate has an invalid CN=dynamic, its signing CA certificate having CN=dynamiclistener-ca@1669050359 and being self signed.
Therefore, the CA chain appears to be broken, and as a consequence, the import of an existing generic Kubernetes cluster, results in the infamous x509: certificate signed by unknown authority as shown below:
time="2022-11-21T18:47:26Z" level=error msg="Issuer of last certificate found in chain (CN=dynamiclistener-ca@1669050359,O=dynamiclistener-org) does not match with CA certificate Issuer (CN=...,OU=...,O=...). Please check if the configured server certificate contains all needed intermediate certificates and make sure they are in the correct order (server certificate first, intermediates after)"
time="2022-11-21T18:47:26Z" level=fatal msg="Certificate chain is not complete, please check if all needed intermediate certificates are included in the server certificate (in the correct order) and if the cacerts setting in Rancher either contains the correct CA certificate (in the case of using self signed certificates) or is empty (in the case of using a certificate signed by a recognized CA). Certificate information is displayed above. error: Get \"<https://rancher-demo.mas.local>\": x509: certificate signed by unknown authority"
Can anybody help? Have we missed anything before/during the deployment?thankful-energy-94761
11/21/2022, 9:49 PMenough-balloon-64612
11/21/2022, 10:56 PMbumpy-printer-21267
11/22/2022, 1:07 AMbumpy-printer-21267
11/22/2022, 1:08 AMcareful-table-97595
11/22/2022, 1:15 AMcolossal-monitor-64536
11/22/2022, 3:10 AMpolite-zoo-76778
11/22/2022, 11:09 AM[Syncing error] error for cluster [c-vbbr]: health error for node group [test3] in cluster [c-vbbr]: The Amazon AutoScalingGroup eks-test3-xxxxxxxxxx has subnets ([subnet-xxxxx]) which is not expected by Amazon EKS. Expected subnets : ([subnet-xxxxxx, subnet-xxxxx, subnet-xxxx]): node group cannot be updated, must be deleted and recreated
polite-zoo-76778
11/22/2022, 11:10 AMhappy-train-21560
11/22/2022, 12:46 PMquaint-soccer-60531
11/22/2022, 12:46 PMetcd
from a snapshot of that cluster. But new nodes won't come up and stay in Registering state, probably trying to join any other master nodes that don't exist anymore.jolly-area-75887
11/22/2022, 1:28 PMFATA[0001] Bad response statusCode [403]. Status [403 Forbidden]. Body: [baseType=error, code=Forbidden, message=<http://clusters.management.cattle.io|clusters.management.cattle.io> "test" is forbidden: User "u-v8qr9" cannot get resource "clusters" in API group "<http://management.cattle.io|management.cattle.io>" at the cluster scope: Azure does not have opinion for this non AAD user. If you are an AAD user, please set Extra:oid parameter for impersonated user in the kubeconfig] from [<https://rancher/v3/clusters/test>]
Can someone help with this?microscopic-dentist-14663
11/22/2022, 2:21 PMlimited-eye-27484
11/22/2022, 10:13 PMI1122 14:06:43.519461 42615 helpers.go:264] Connection error: Get <https://my.rancher.dev/k8s/clusters/c-spjq6/api/v1/namespaces/default/pods?limit=500>: net/http: TLS handshake timeout
Unable to connect to the server: net/http: TLS handshake timeout
increasing to --v=9
doesn’t really show any more info on why exactly this call is failing….limited-eye-27484
11/22/2022, 10:14 PMlimited-eye-27484
11/22/2022, 10:16 PMsteep-furniture-72588
11/23/2022, 12:36 AMboundless-intern-84896
11/23/2022, 6:00 AMboundless-intern-84896
11/23/2022, 7:21 AMmost-terabyte-51942
11/23/2022, 8:13 AMlimactl start --name=0 <template://default>
instead
FATA[0000] open /Applications/Rancher Desktop.app/Contents/Resources/resources/darwin/lima/share/lima/examples/default.yaml: no such file or directoryhelpful-beard-54962
11/23/2022, 8:21 AMvictorious-oil-37471
11/23/2022, 8:58 AMbrash-addition-38553
11/23/2022, 9:22 AMbreezy-ram-80329
11/23/2022, 12:02 PMtall-air-15259
11/23/2022, 12:25 PMstocky-article-82001
11/23/2022, 12:55 PM