Hi there I have deployed a harvester cluster and joined a Ra Rancher Users #harvester

Hi there, I have deployed a harvester cluster and ...

adorable-battery-26182

10/30/2025, 8:49 PM

Hi there, I have deployed a harvester cluster and joined a Rancher instance. I wanted to create an RKE2 cluster from Rancher within the Harvester cluster, but it got stuck in the Reconciling stage with the

Waiting for agent to check in and apply initial plan

message. I presume that the created VMs for the master/worker nodes cannot reach the internet. Rancher couldn't setup its agent in those VMs, the blocker here is that I required a KubeOVN vswitch overlay, and created a subnet in the default

ovn-cluster

vpc (with

natOutgoing: true

), and then after creating the VM, I have to edit the yaml to set the interface `managedtap` binding and restart the VM to get the default routes. Can someone provide me with more insight and possible solutions here? Thank you!

adorable-battery-26182

10/30/2025, 8:59 PM

Moreover, I need to mention that I changed the rancher's CA, so on joining the harvester to it I had to patch the new CA to the cluster agent deployment like:

Copy code

echo | openssl s_client -connect <http://rancher.domain.com:443|rancher.domain.com:443> 2>/dev/null | openssl x509 -outform PEM > /tmp/rancher-ca.crt

kubectl create configmap rancher-ca-cert -n cattle-system \
  --from-file=serverca=/tmp/rancher-ca.crt

kubectl patch deployment cattle-cluster-agent -n cattle-system --type='strategic' -p='
spec:
  template:
    spec:
      containers:
      - name: cluster-register
        volumeMounts:
        - name: ca-cert
          mountPath: /etc/kubernetes/ssl/certs
          readOnly: true
      volumes:
      - name: ca-cert
        configMap:
          name: rancher-ca-cert
'

adorable-battery-26182

10/30/2025, 9:24 PM

Then I guess that's it:

Copy code

[FATAL] Aborting system-agent installation due to requested strict CA verification with no CA checksum provided

Failed to run module scripts_user in /var/lib/rancher/agent/scripts

thousands-advantage-10804

10/31/2025, 1:13 AM

Rancher needs a legit CA.

👍 1

adorable-battery-26182

10/31/2025, 2:17 PM

However, switched the

agent-tls-mode

system-store

and it works fine now (used Let's Encrypt certs).

thousands-advantage-10804

10/31/2025, 2:32 PM

Let’s Encrypt certs are legit. 😄

adorable-battery-26182

10/31/2025, 2:33 PM

Yeah, but I had to switch to

system-store

It had that CA issue even when I re-installed the rancher

thousands-advantage-10804

10/31/2025, 2:36 PM

20 Views

Open in Slack

Previous Next