Cluster CA certificate is not trusted about terraform-module-k3s HOT 7 CLOSED

I'd suggest trying with "'\\--tls-san ${var.my_cluster_domain}'"

I got a similar problem where the first global flag was ignored for some obscure reason ( the first hyphen was not read by the k3s-agent command) and adding the quotes and escaping the first hyphen fixed it.

from terraform-module-k3s.

@xunleii Thanks for the reply

I did try with v1.20.14+k3s2 and v1.21.9+k3s and experienced the same issue. I've been poking at the cert generation code and don't see any glaring issues, will continue to poke as best I can. Thanks for taking a peek!

from terraform-module-k3s.

Hi @rdlaitila, thanks for your question.

I didn't used it with the last release on k3s; if it possible, could you test it with v1.21.x ? Something probably changed since the last time I used it.

EDIT: I didn't have time this week to test it, but I will try to check this issue this weekend

from terraform-module-k3s.

This is a real issue, for me specifying:

  global_flags = [
    "--tls-san ${var.my_cluster_ip}"
  ]

results in the first hyphen to be removed as checking the journalctl -u k3s-agent.service -n 100 results in:

...
Incorrect Usage: flag provided but not defined: -tls-san

This is super weird, I checked the code in the repo, even "logged" out some commands but couldn't find the reason why it would just remove one - just like that.

Super weird, if it wouldn't be for this issue I probably would've gone crazy.

Thank you @Meallia, your workaround works great but this should really get fixed.

from terraform-module-k3s.

This is super weird, I checked the code in the repo, even "logged" out some commands but couldn't find the reason why it would just remove one - just like that.

I also checked the code and I'm rather confident the issue is not related to this repo but comes from some strange interaction between k3s and systemd.

I think this is the issue that made me try this workaround : k3s-io/k3s#1125

from terraform-module-k3s.

Sorry for this long absence, I didn't have much time these last months.

Thanks @Meallia for your workaround. I will create a PR to add it.

EDIT: after reading k3s-io/k3s#1125 (comment), adding \ before the flag seems to ignore the flag. Also, I have tried on my end with an Ubuntu 20.04 but I can't seem to reproduce this issue. What OS are you using to host k3s ?
Another weird thing is that only the first global_flags is ignored, but was not the first flag in the systemd service (--node-ip should be the first one). I will do testing to see if it could be related to Terraform and how this module uses HCL. If you encounter this problem again, can you provide me the OS of the k3s host, the module version and your Terraform version ? Thanks for your help

from terraform-module-k3s.

Further to my last reply, I am closing this file.
Please do not hesitate to reopen it if you encounter this problem again.

from terraform-module-k3s.