We have an (imported) cluster running behind a firewall that does TLS interception. Is there an env var to tell cattle-cluster-agent to ignore the CA? (We might have the CA somewhere, but not on the Rancher server - we do have it on the nodes in the cluster running the imported cluster (but I'm not aware of a way to add mounts to the manifests that calttle-cluste-agent use) Only the proxy variables seems to be documented. (In this case, the proxy is blocking the URL, but firewall access is open (but it is being intercepted) (I can't find an obvious reference with the env vars that cattle-cluster-agent support in the documentation, using "site:rancher.com inurl:v2.6 https_proxy" (that only fins one page that happens to mention that that is how proxy settings is configured) The agent has a blank CATTLE_CA_CHECkSUM (the rancher server has a Let's encrypt cert) (I'm not sure if that setting can be overwritten from the env var settings for the cluster or how to obtain that checksum)

🧵Questions for the Intro to Kubernetes webinar 🧵 👋 @clever-analyst-23771 & I will be hosting an Intro to Kubernetes webinar at 11 AM EST. Please ask your questions as a reply thread to this message. If you haven't signed up for it, here's the link to do so.

After following this documentation and successfully configuring an ssl certificate chain all of the sudden some of my services like Grafana and Kibana in my cluster force redirection from http to https and therefore not really accessible anymore. What might impact it in that documentation really?

Hi! I would like to implement continuous Kubernetes version updates for my productive cluster, however I have not yet decided how long to wait before switching to the new version. How long should I wait with each new version until its initial bugs appear? Is it a good idea to test the new version in a non-prod environment for 30 days? After that, based on the experiences gained in the test environments and the reported Kubernetes errors (https://github.com/kubernetes/kubernetes/issues) decide to upgrade (GO/NOGO)? Of course, security issues (for example, Kubernetes containing a vulnerability with severity score of 7 or greater) and the apps running (need specific Kubernetes version) on the platform may influence this decision, but I want to set some baseline. Welcome any experience or help.

Will rke support Kubernetes 1.25 or higher?

today Rancher stopped working. I have a 3 (IP1, IP2, IP3) nodes kubernetes setup with a single rancher node (IP1) (run by docker), the rancher container is in a restarting loop trying to connect to kubernetes (refuses connection). I can connect to _IP2_/_IP3_ with

kubectl

but not IP1:

x509: certificate is valid for IP2, IP3, 127.0.0.1, 10.43.0.1, not IP1

, has anybody expierence such a strange behavior ? and can anybody push me in the right direction on how to update the certificate ?

I am trying to create and rke cluster inside a dind docker image , I have reached a point where all cluster Components are created , but the network plugin fails And when i look at the network plugin pod logs , i see a time out when it tries to reach the node ip Any suggestions , is it even possible to create a full working Rke cluster inside a dind docker image

Does anyone know why kubectl auth via kubeconfig would result in an error:

I can reach Rancher via the UI just fine at the hostname & with https

but when I download the kubeconfig for my cluster, I have like a 50% chance of having that net/http: TLS handshake timeout error

when using kubectl

^ This turned out to be caused by a misconfigured RKE cluster load balancer. The ingress-nginx-controller was supposed to be in HostNetwork mode (which defaults to NodePort after kube 1.21), and where the lb was also trying to send https traffic to the rancher ingres, but ingress-nginx-controller wasn’t listening in the correct mode. Setting the ingress controller to HostNetwork mode fixed it 👍

When will rancher UI supporting installation on Kubernetes 1.25+ ?

Hi, i have the issue of importing RKE2 to rancher (both newest versions) level=fatal msg="looking up cattle-system/cattle ca/token: failed to find service account cattle-system/cattle: Get \"https://10.43.0.1:443/api/v1/namespaces/cattle-system/serviceaccounts/cattle\": Service Unavailable"

i can see there i the service account there is a secret credentials

i tried earlier versions of rke2

its all the same

Hi there, how can we select containerd as the runtime on clusters provisioned by rke? I don’t see any option via the console. Thanks

Hello, we are using rancher 2.6.8 to create an rke 1.22 vsphere cluster, within the provision log it shows as cluster successfully created, however the node shows as waiting for API to be available?? Has anyone seen this before thanks 😊

Hi - how can i create a serviceaccount/token for curl to check the /readyz endpoint on api-server?

My rancher stopped working (single node docker). Is there a way I can further debug this (https://github.com/rancher/rancher/issues/39702). The rancher containers stops after:

[INFO] Waiting for server to become available: Get "<https://127.0.0.1:6443/version?timeout=15m0s>": dial tcp 127.0.0.1:6443: connect: connection refused
exit status 1
2022/11/21 14:41:08 [FATAL] k3s exited with: exit status 1

Does anyone know what is expected at

<https://127.0.0.1:6443>

and how I can debug this ? The kubernetes (formerly created by rancher) is still working.

Love K3S

apiVersion: apps/v1
kind: Deployment
metadata:
  name: abc
  labels:
    app: abc
spec:
  replicas: 2
  selector:
    matchlabels:
      app: abc
  template:
    metadata:
      labels:
        app: abc
    spec:
      volumes:
      - name: mydir
        hostPath:
          path: /var/log/abc
          type: DirectoryOrCreate

      containers:

      - name: abc
        image: gcr/abc:xyz
        command: ["/bin/bash","-c"]
        args:
          - cp abc/env_settings/uat2.py abc/settings.py;
            cp wsgi/uat.wsgi abc.py;
            bash gunicorn_docker.sh var abc0.0.0.0:6000 <http://pqr.aaa.com|pqr.aaa.com> UAT-APP;
            bash;
        livenessProbe:
          exec:
            command:
              - /bin/bash
              - -c
              - netstat -atulnp | grep :6000 || exit 1
          initialDelaySeconds: 30
          periodSeconds: 30
          timeoutSeconds: 10
        ports:
        - containerPort: 6000
          name: abc-port
        volumeMounts:
        - mountPath: /var/log/abc
          name: mydir

This is my yaml file but I am not getting error if any of the command is getting failed during deployment. Can someone please help me

Hi I want to deploy k3s on ubuntu , install all cluster resources and then make an iso of that fully deployed cluster, then load that iso on a vm (vmware in my case) Is it possible ? Any tips ?

Hey guys. I have a configuration issue with cattle-cluster-agent and Rancher server deployed on K3s. The cattle-cluster-agent keep failing as it tries to connect to the Rancher server using it's IP.

Of course it fails as rancher server is proxified via Traefik on K3s

INFO: https://rancher.redacted.org/ping is accessible INFO: rancher.redacted.org resolves to 172.25.11.205 INFO: Value from https://rancher.redacted.org/v3/settings/cacerts is an x509 certificate time="2022-12-05T100828Z" level=info msg="Listening on /tmp/log.sock" time="2022-12-05T100828Z" level=info msg="Rancher agent version v2.7.0 is starting" time="2022-12-05T100828Z" level=info msg="Certificate details from https://172.25.11.205" time="2022-12-05T100828Z" level=info msg="Certificate #0 (https://172.25.11.205)" time="2022-12-05T100828Z" level=info msg="Subject: CN=TRAEFIK DEFAULT CERT" time="2022-12-05T100828Z" level=info msg="Issuer: CN=TRAEFIK DEFAULT CERT" time="2022-12-05T100828Z" level=info msg="IsCA: false" time="2022-12-05T100828Z" level=info msg="DNS Names: [813d9dcb9cd6167ed7a689bf1631c6be.41d2f76f48bcad52d0b233fbb376e088.traefik.default]" time="2022-12-05T100828Z" level=info msg="IPAddresses: <none>" time="2022-12-05T100828Z" level=info msg="NotBefore: 2022-12-05 091354 +0000 UTC" time="2022-12-05T100828Z" level=info msg="NotAfter: 2023-12-05 091354 +0000 UTC" time="2022-12-05T100828Z" level=info msg="SignatureAlgorithm: SHA256-RSA" time="2022-12-05T100828Z" level=info msg="PublicKeyAlgorithm: RSA" time="2022-12-05T100828Z" level=info msg="Certificate details for /etc/kubernetes/ssl/certs/serverca" time="2022-12-05T100828Z" level=info msg="Certificate #0 (/etc/kubernetes/ssl/certs/serverca)" time="2022-12-05T100828Z" level=info msg="Subject: CN=dynamiclistener-ca@1669278744,O=dynamiclistener-org" time="2022-12-05T100828Z" level=info msg="Issuer: CN=dynamiclistener-ca@1669278744,O=dynamiclistener-org" time="2022-12-05T100828Z" level=info msg="IsCA: true" time="2022-12-05T100828Z" level=info msg="DNS Names: <none>" time="2022-12-05T100828Z" level=info msg="IPAddresses: <none>" time="2022-12-05T100828Z" level=info msg="NotBefore: 2022-11-24 083224 +0000 UTC" time="2022-12-05T100828Z" level=info msg="NotAfter: 2032-11-21 083224 +0000 UTC" time="2022-12-05T100828Z" level=info msg="SignatureAlgorithm: ECDSA-SHA256" time="2022-12-05T100828Z" level=info msg="PublicKeyAlgorithm: ECDSA" time="2022-12-05T100828Z" level=error msg="Issuer of last certificate found in chain (CN=TRAEFIK DEFAULT CERT) does not match with CA certificate Issuer (CN=dynamiclistener-ca@1669278744,O=dynamiclistener-org). Please check if the configured server certificate contains all needed intermediate certificates and make sure they are in the correct order (server certificate first, intermediates after)" time="2022-12-05T100828Z" level=fatal msg="Server certificate does not contain correct DNS and/or IP address entries in the Subject Alternative Names (SAN). Certificate information is displayed above. error: Get \"https://172.25.11.205\": x509: cannot validate certificate for 172.25.11.205 because it doesn't contain any IP SANs"

Any idea ?

https://github.com/rancher/rke/releases doesn't tell (AFAICS), so I wonder whats the difference between rke v1.3.17 and v1.4.1 ?