Unable to connect to the server: tls: failed to verify certificate

[dobarx]

Running into weird issue, when I enable create_load_balancer_for_the_kubernetes_api: true with master nodes in different locations.

I'm getting this error when trying to run kubectl:

Unable to connect to the server: tls: failed to verify certificate: x509: certificate is valid for 127.0.0.1, 10.0.0.6, <Public IP of master-k3s-pool-medium-worker1>, not <Public IP of master-k3s-api LB>

This happens randomly, sometimes it doesn't throw error.

Heres is my config.yaml:

---
cluster_name: master-k3s
kubeconfig_path: "kubeconfig" 
k3s_version: v1.32.0+k3s1

local_path_storage_class:
  enabled: true

datastore:
  mode: etcd 

networking:
  ssh:
    port: 22
    use_agent: false
    public_key_path: "~/.ssh/id_ed25519.pub"
    private_key_path: "~/.ssh/id_ed25519"
  allowed_networks:
    ssh:
      - 0.0.0.0/0
    api:
      - 0.0.0.0/0
  public_network:
    ipv4: true
    ipv6: true
  private_network:
    enabled: true
    subnet: 10.0.0.0/16


embedded_registry_mirror:
  enabled: true

masters_pool:
  instance_type: cpx22
  instance_count: 3
  locations:
    - fsn1
    - hel1
    - nbg1

worker_node_pools:
- name: medium
  instance_type: cpx32
  instance_count: 3
  location: fsn1

create_load_balancer_for_the_kubernetes_api: true

[vitobotta]

When it happens are the three targets of the load balancer healthy?

[dobarx]

When it happens are the three targets of the load balancer healthy?

Seems like all of them are healthy. But I see 6, not 3 targets.

[dobarx]

I think this might be the problem with cluster name. Other nodes got automatically included because they contains word master-k3s from the cluster name prefix.

Edit: Changing the cluster name resolved the issue.

[vitobotta]

Hmm, that's odd. It picks the masters by checking the labels, not the node names. Let's leave this open for now so I can double-check it when I get a minute. Thanks for letting me know!

[dobarx]

Hmm, that's odd. It picks the masters by checking the labels, not the node names. Let's leave this open for now so I can double-check it when I get a minute. Thanks for letting me know!

Did a quick check, seems like worker node also got label role:master: