This message was deleted.

Firstly, you don’t have the node agent daemonset because you’re using RKE2 for your downstream clusters. The node agent is only used with RKE. Second, step 4 looks like it is designed to get the agents to reconnect and get the new deployment from Rancher. That deployment should have the new CA checksum in it, but it sounds like it does not.

Thanks for your answer 🙂 I'll check my secrets in cattle-system namespace. Do you know if secrets

tls-rancher

and

tls-rancher-internal-ca

are relevant ? Otherwise i've already set up

tls-ca

with the new CA certificate and

tls-rancher-ingress

with the new key/cert.