I'm experiencing a Harvester/Rancher communication issue. I've followed the procedure
here for replacing an internal Rancher cert with a public one. The new cert is held in a secret generated via a cert-manager letsencrypt clusterissuer. Now, communication between rancher and the harvester cluster isn't functioning properly. When attempting to deploy a new cluster via rancher, for instance, I'm receiving 'cert signed by unknown authority' errors and machine provisioning fails. This is Harvester v1.2.1.
Things I've tried/verified:
1. Confirmed that https://<Rancher URL>/v3/settings/cacerts shows an empty value
2. The Rancher UI works fine (correct public cert) and kubectl functions properly for the rancher cluster and all other downstream clusters
3. I've manually cleared the CATTLE_CA_CHECKSUM env var from Harvester's cattle-cluster-agent deployment.
4. I've cleared and then re-added the registration URL in harvester
5. Verified that Harvester does not have any additional ca-certs added
Harvester still seems to expect that Rancher is using its old internal cert. Any ideas on how I can troubleshoot this further?