Cockroach: Rancher 2.0 - CSR approved, but no certificate in response. Waiting some more

[wzrdtales]

It seems like something is missing in the kubernetes cluster created by rancher 2.0.
Everything works fine except the CSR approval, which ends up with an infinity loop of CSR approved, but no certificate in response. Waiting some more.

[wzrdtales]

Turns out it needs to be indeed configured first. Here is the issue telling how
https://github.com/rancher/rancher/issues/14041

[happyyangyuan]

Could you pease describe how you solved this issue with more details? Thank you very much.

[wzrdtales]

Look at the issue over there rancher/rancher#14041, follow the instructions in this link
https://github.com/JasonvanBrackel/metrics-server-on-rancher-2.0.2

Add this to the config

    "kubeController": { 
        "type": "/v3/schemas/kubeControllerService",
        "extraArgs": {
        "cluster-signing-cert-file": "/etc/kubernetes/ssl/kube-ca.pem",
        "cluster-signing-key-file": "/etc/kubernetes/ssl/kube-ca-key.pem"
        }
    },

[happyyangyuan]

Thanks very much. In rancher v2.0.3 and later version we can edit rancher cluster definition yaml file directly to achieve this. I will try out this.

[happyyangyuan]

The official description:
enable kubenertes controller manager's default certs signer
and
Modify Kubernetes services' default options using RKE

If you are using Kubernetes created by rancher2.0, steps are:

1. Edit your cluster in rancher2.0

2. Click "Edit as YAML" button and edit as the following:
   yaml services: kube-controller: extra_args: cluster-signing-cert-file: "/etc/kubernetes/ssl/kube-ca.pem" cluster-signing-key-file: "/etc/kubernetes/ssl/kube-ca-key.pem"

[smilelikeshit]

@happyyangyuan thanks solved