ccamacho
commented
3 years ago Here it is the registry logs when getting the catalog content:
root@rke-service-01:~# curl -v --silent --user registryusername:registrypassword https://rke-service-01.clustername1.kubeinit.local:5000/v2/_catalog
* Trying 10.0.1.100:5000...
* TCP_NODELAY set
* Connected to rke-service-01.clustername1.kubeinit.local (10.0.1.100) port 5000 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN, server accepted to use h2
* Server certificate:
* subject: C=US; ST=MyState; L=MyCity; O=MyCompany; OU=MyDepartment; CN=rke-service-01.clustername1.kubeinit.local
* start date: Nov 13 11:57:04 2020 GMT
* expire date: Nov 11 11:57:04 2030 GMT
* subjectAltName: host "rke-service-01.clustername1.kubeinit.local" matched cert's "rke-service-01.clustername1.kubeinit.local"
* issuer: C=US; ST=MyState; L=MyCity; O=MyCompany; OU=MyDepartment; CN=rke-service-01.clustername1.kubeinit.local
* SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Server auth using Basic with user 'registryusername'
* Using Stream ID: 1 (easy handle 0x561df46d7db0)
> GET /v2/_catalog HTTP/2
> Host: rke-service-01.clustername1.kubeinit.local:5000
> authorization: Basic cmVnaXN0cnl1c2VybmFtZTpyZWdpc3RyeXBhc3N3b3Jk
> user-agent: curl/7.68.0
> accept: */*
>
* Connection state changed (MAX_CONCURRENT_STREAMS == 250)!
< HTTP/2 200
< content-type: application/json; charset=utf-8
< docker-distribution-api-version: registry/2.0
< x-content-type-options: nosniff
< content-length: 435
< date: Fri, 13 Nov 2020 12:26:18 GMT
<
{"repositories":["calico-cni","calico-ctl","calico-kube-controllers","calico-node","calico-pod2daemon-flexvol","cluster-proportional-autoscaler","coredns-coredns","coreos-etcd","coreos-flannel","flannel-cni","hyperkube","k8s-dns-dnsmasq-nanny","k8s-dns-kube-dns","k8s-dns-node-cache","k8s-dns-sidecar","metrics-server","nginx-ingress-controller","nginx-ingress-controller-defaultbackend","pause","rke-tools","weave-kube","weave-npc"]}
* Connection #0 to host rke-service-01.clustername1.kubeinit.local left intact
superseb
RKE version: rke version v1.2.2
Docker version: (
docker version,docker infopreferred) Server Version: 19.03.8Operating system and kernel: (
cat /etc/os-release,uname -rpreferred) Ubuntu 20.04 5.4.0-53-genericType/provider of hosts: (VirtualBox/Bare-metal/AWS/GCE/DO) Libvirt
cluster.yml file:
Steps to Reproduce:
Results:
The install fails with a certificate issue.
I have my own CA .crt file and the certificates for the local registry.
These are the certs, domainCA.crt (for the ca) and domain.crt, domain.csr, and domain.key (created for the local registry)
How can I add them to the rke install command to avoid this issue? or is it possible to workaround it temporarily by allowing unknown authorities?