apiserver received an error that is not an metav1.Status: &errors.errorString{s:"error dialing backend: tls: failed to verify certificate: x509: certificate is valid for 127.0.0.1, not xxx"} about k3s

[brandond]

tls: failed to verify certificate: x509: certificate is valid for 127.0.0.1, not 10.1.4.13"

K3s doesn't generate any certificates that are valid for only the loopback address, but not any other IPs. I also see that you've set the egress-selector mode to disabled; why? Do you perhaps have a http proxy configured in your environment? I'm not sure what exactly the apiserver is talking to here that has this invalid certificate but I don't think it's an internal component.

[wang-xiaowu]

tls: failed to verify certificate: x509: certificate is valid for 127.0.0.1, not 10.1.4.13"

K3s doesn't generate any certificates that are valid for only the loopback address, but not any other IPs. I also see that you've set the egress-selector mode to disabled; why? Do you perhaps have a http proxy configured in your environment? I'm not sure what exactly the apiserver is talking to here that has this invalid certificate but I don't think it's an internal component.

the reason of disable egress-selector is from another issue : #5897
and there's not http proxy config in my env
BTW i have deleted that line in my /etc/systemd/system/multi-user.target.wants/k3s.service and reloaded, but not worked

[wang-xiaowu]

i did a testing, use kubernetes-client to operate k3s with config file, like this, and replace 127.0.0.1 to 10.1.4.13, it worked. i was thinking maybe there's something wrong i ignored inside k3s

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: xxx
    server: https://127.0.0.1:6443
  name: default
contexts:
- context:
    cluster: default
    user: default
  name: default
current-context: default
kind: Config
preferences: {}
users:
- name: default
  user:
    client-certificate-data: xxx
    client-key-data: xxx

[wang-xiaowu]

another phenomenon: operation only does not work in the node which metrics-server was deployed
after resinstalling the metrics-server, it has worked