https://rancher.com/ logo
Join Slack
Powered by
This message was deleted.
# harvester
a
This message was deleted.
s
Copy code
025-12-08T09:29:22.840304463Z stdout F time="2025-12-08T09:29:22Z" level=info msg="starting cattle-credential-cleanup goroutine in the background"

2025-12-08T09:29:22.840431991Z stdout F time="2025-12-08T09:29:22Z" level=info msg="Listening on /tmp/log.sock"

2025-12-08T09:29:22.840575249Z stdout F time="2025-12-08T09:29:22Z" level=info msg="Rancher agent version v2.12.2 is starting"

2025-12-08T09:29:22.850891034Z stdout F time="2025-12-08T09:29:22Z" level=info msg="Testing connection to <https://rancher-manager.domain.local> using trusted certificate authorities within: /etc/kubernetes/ssl/certs/serverca"

2025-12-08T09:29:22.855551276Z stdout F time="2025-12-08T09:29:22Z" level=error msg="Could not securely connect to <https://srvk8smrui.dst.local>: Get \"<https://rancher-manager.domain.local>\": tls: failed to verify certificate: x509: certificate signed by unknown authority"
In rancher agent-tls-mode is set to "strict"
Guess my question is really, is there a way to just provide the CA to Rancher and/or Harvester, and have Harvester connect to Rancher through the external LB
a
When we try to join the Harvester nodes, we get an "certificate signed by unknown authority" from cattle-cluster-agent . == Do you men 
import Harvester cluster
to 
Rancher Manager
?
s
Yes, its when importing it in to Rancher Manager
a
what's the generated registraion URL, could you post it
from Rancher manager
or check it from Harvester settings
s
The https://srvk8smrui.dst.local/ is the "outside" address of the extarnal LB
But is also what equal to the server-url setting in Rancher
So we don't do host rewrite in the LB, only load balancing
a
then the 
cattle-cluster-agent
on Harvester, needs to use the CA to connect to above URL, right?
you might check below 
CATTLE_CA_CHECKSUM
of the 
cattle-cluster-agent
pod env
Copy code
Why is this step required?
When Rancher is configured with a certificate signed by a private CA, the CA certificate chain is trusted by Rancher agent containers. Agents compare the checksum of the downloaded certificate against the CATTLE_CA_CHECKSUM environment variable. This means that, when the private CA certificate used by Rancher has changed, the environment variable CATTLE_CA_CHECKSUM must be updated accordingly.
b
Did you add your registration url to the Harvester default ingress?
s
As far as I can see its not the checksum that I'm failing on, its that I don't trust the CA on the registration URL
b
I've had that error before but it was a bit of a misnomer. It turned out that the cert was self signed because let's encrypt didn't issue one via cert manager for the fqdn because I forgot to add it [fqdn] to the default ingress.
s
We created a supportcase and got an and we had already followed the steps they suggested, and have now uploaded a support bundle for them to have a look at.
From support is sounded like adding the CA to the additional CA should make the cattle pods trust the self signed cert, but it doesn't look like its getting mounted into the pod
a
the 
cattle-cluster-agent
deployment is rolled by the 
embedded rancher
on Harvester, the latter should pass the CA to the agent deployment
maybe some steps were missed
check below output on your Harvester cluster: 
kubectl get settings.management cacerts -oyaml
s
Support pointed us to this for adding additional CA trusts to Harvester: https://docs.harvesterhci.io/v1.6/advanced/index/#additional-ca
We already did that, and 
additional-ca
contains our full CA chain
a
check this 
kubectl get settings.management cacerts -oyaml
, we need to figure out if the CA has been passed to internal Rancher as expected
s
No, the cacerts setting only contains the default dynamiclistener-ca@xxxxxxx cert
Not the cert added on the additional-ca setting in the Harvester UI
53 Views
Open in Slack
PreviousNext
Powered by