Open Issen007 opened 5 months ago
it looks like csr is enabled, so needs to manually approve the CSR
@frezbo
You are maybe right, and when I try to approve the pending CSRs I got No resource found
$ kubectl get csr
NAME AGE SIGNERNAME REQUESTOR REQUESTEDDURATION CONDITION
csr-2zqft 70s kubernetes.io/kubelet-serving system:node:ip-10-0-5-40 <none> Pending
csr-497p4 31m kubernetes.io/kubelet-serving system:node:ip-10-0-4-194 <none> Pending
csr-4ftvr 31m kubernetes.io/kubelet-serving system:node:ip-10-0-5-124 <none> Pending
csr-6q6sd 46m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:0dfxfl <none> Approved,Issued
csr-82kgd 70s kubernetes.io/kubelet-serving system:node:ip-10-0-4-65 <none> Pending
csr-8hdns 46m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:0dfxfl <none> Approved,Issued
csr-b7x77 46m kubernetes.io/kubelet-serving system:node:ip-10-0-6-78 <none> Pending
csr-c9j4n 46m kubernetes.io/kubelet-serving system:node:ip-10-0-4-194 <none> Pending
csr-fwfp8 16m kubernetes.io/kubelet-serving system:node:ip-10-0-6-78 <none> Pending
csr-gbvfs 16m kubernetes.io/kubelet-serving system:node:ip-10-0-5-40 <none> Pending
csr-jsn69 46m kubernetes.io/kubelet-serving system:node:ip-10-0-4-65 <none> Pending
csr-k6xss 16m kubernetes.io/kubelet-serving system:node:ip-10-0-4-194 <none> Pending
csr-l99bw 31m kubernetes.io/kubelet-serving system:node:ip-10-0-6-78 <none> Pending
csr-mfbmf 31m kubernetes.io/kubelet-serving system:node:ip-10-0-5-40 <none> Pending
csr-mwr26 46m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:0dfxfl <none> Approved,Issued
csr-s8wd5 46m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:0dfxfl <none> Approved,Issued
csr-sfpgn 46m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:0dfxfl <none> Approved,Issued
csr-shhdn 16m kubernetes.io/kubelet-serving system:node:ip-10-0-4-65 <none> Pending
csr-t6zst 72s kubernetes.io/kubelet-serving system:node:ip-10-0-4-194 <none> Pending
csr-t7nqd 46m kubernetes.io/kubelet-serving system:node:ip-10-0-5-124 <none> Pending
csr-twcg6 71s kubernetes.io/kubelet-serving system:node:ip-10-0-6-78 <none> Pending
csr-vtnvl 46m kubernetes.io/kubelet-serving system:node:ip-10-0-5-40 <none> Pending
csr-x52sh 73s kubernetes.io/kubelet-serving system:node:ip-10-0-5-124 <none> Pending
csr-xs6xd 31m kubernetes.io/kubelet-serving system:node:ip-10-0-4-65 <none> Pending
csr-xxhwq 16m kubernetes.io/kubelet-serving system:node:ip-10-0-5-124 <none> Pending
$ kubectl certificate approve csr-2zqft
No resources found
error: the server doesn't have a resource type "certificatesigningrequests"
I'm not sure about the csr not being found, the error seems super weird
As far as I'm aware this is a "known" issue when using an alternative CNI: https://www.talos.dev/v1.6/kubernetes-guides/network/deploying-cilium/#method-1-helm-install
After applying the machine config and bootstrapping Talos will appear to hang on phase 18/19 with the message: retrying error: node not ready. This happens because nodes in Kubernetes are only marked as ready once the CNI is up. As there is no CNI defined, the boot process is pending and will reboot the node to retry after 10 minutes, this is expected behavior.
So you have to manually setup a CNI of your choice.
EDIT: Or host the template file and use it in a patch.
Bug Report
I try to deploy a Talos Cluster via Terraform in AWS and as soon I disable Kube-proxy and enable Cilium CNI to be installed as default it get stuck. The only way to install Cilium it create a Talos Cluster with kube-proxy and then install Cilium as a postinstallation.
Description
I'm using following terraform template with some few modification where we create a new VPC. https://github.com/isovalent/terraform-aws-talos
But as soon we deploy the environment it get stuck that Cilium it not get installed. As soon we comment the out
The installation continues and we get a Talos Cluster up and running.
Logs
Environment