Failed to Save Kubernetes certificates about rke

[galal-hussein]

@de13 i am not able to reproduce the issue, i was able to bring a 3 node kubernetes cluster on Rancher os image from aws successfully without any problem, also tried with ubuntu and the cluster came up successfully:

kubectl get pods --all-namespaces
NAMESPACE     NAME                                   READY     STATUS    RESTARTS   AGE
kube-system   kube-dns-778977457c-ght6v              3/3       Running   0          49s
kube-system   kube-dns-autoscaler-5cb4f55974-pmxz6   1/1       Running   0          50s
kube-system   kube-flannel-82g6c                     2/2       Running   0          54s
kube-system   kube-flannel-fsflc                     2/2       Running   0          54s
kube-system   kube-flannel-qslqs                     2/2       Running   0          54s
kube-system   kubernetes-dashboard-747c4f7cf-2tf4t   1/1       Running   0          45s

can you paste your cluster.yml file to check if something is wrong

[de13]

Sure, this is my cluster file:

$ cat cluster.yml
nodes:
- address: "52.56.183.107"
  internal_address: "172.31.100.5"
  role:
  - controlplane
  - etcd
  hostname_override: ""
  user: rancher
  docker_socket: /var/run/docker.sock
- address: "35.177.135.53"
  internal_address: "172.31.100.132"
  role:
  - controlplane
  - etcd
  hostname_override: ""
  user: rancher
  docker_socket: /var/run/docker.sock
- address: "35.177.71.152"
  internal_address: "172.31.100.238"
  role:
  - controlplane
  - etcd
  hostname_override: ""
  user: rancher
  docker_socket: /var/run/docker.sock
- address: "52.56.107.27"
  internal_address: "172.31.100.194"
  role:
  - worker
  hostname_override: ""
  user: rancher
  docker_socket: /var/run/docker.sock
- address: "35.176.154.112"
  internal_address: "172.31.100.203"
  role:
  - worker
  hostname_override: ""
  user: rancher
  docker_socket: /var/run/docker.sock
- address: "35.177.97.118"
  internal_address: "172.31.100.205"
  role:
  - worker
  hostname_override: ""
  user: rancher
  docker_socket: /var/run/docker.sock
services:
  etcd:
    image: quay.io/coreos/etcd:latest
    extra_args: {}
  kube-api:
    image: rancher/k8s:v1.8.3-rancher2
    extra_args: {}
    service_cluster_ip_range: 10.233.0.0/18
  kube-controller:
    image: rancher/k8s:v1.8.3-rancher2
    extra_args: {}
    cluster_cidr: 10.233.64.0/18
    service_cluster_ip_range: 10.233.0.0/18
  scheduler:
    image: rancher/k8s:v1.8.3-rancher2
    extra_args: {}
  kubelet:
    image: rancher/k8s:v1.8.3-rancher2
    extra_args: {}
    cluster_domain: cluster.local
    infra_container_image: gcr.io/google_containers/pause-amd64:3.0
    cluster_dns_server: 10.233.0.3
  kubeproxy:
    image: rancher/k8s:v1.8.3-rancher2
    extra_args: {}
network:
  plugin: flannel
  options: {}
auth:
  strategy: x509
  options: {}
addons: ""
ssh_key_path: ~/.ssh/id_rsa

[de13]

I can guess what my problem is... I should be tired yesterday: internal addresses should be internal for the cluster, not for aws. I suppose I can let this field empty.

[de13]

Unfortunately, same file without internal_address: set gives me the same results.

[de13]

I've "find" the issue: security group. Hosts talking to each other on public ip. I have to find the ports that flannel use.