question Re: Failure to Install Embedded Container Service (ECS) due to Certificate Signing Request (CSR) is still in the "approved" status in Support Questions

Failure to Install Embedded Container Service (ECS) due to Certificate Signing Request (CSR) is still in the "approved" status

steinsgate — Tue, 21 Apr 2026 06:41:07 GMT

Hi everyone, I would like some clarification. Thank you.

During the installation of ECS, we encountered some errors that prevented successful installation. One of the issues was as follows: the Certificate Signing Request (CSR) remained in an "approved" state instead of being "certificated," causing it to remain stuck in a loop.

# /var/lib/rancher/rke2/bin/kubectl --kubeconfig /etc/rancher/rke2/rke2.yaml get csr NAME AGE SIGNERNAME REQUESTOR REQUESTEDDURATION CONDITION ecs-tolerations-webhook-csr 55m kubernetes.io/kubelet-serving system:admin <none> Approved

How should we address this? Should we consider a reinstallation? Or is there an underlying cause behind this issue? Thank you.

Re: Failure to Install Embedded Container Service (ECS) due to Certificate Signing Request (CSR) is still in the "approved" status

upadhyayk04 — Mon, 08 Apr 2024 04:26:54 GMT

Hello @steinsgate

Thank you for reaching out to the community

Can you please confirm the ECS version you are using along with the CM and CDP versions?

Also, are the Kubernetes core pods running? Have all the prerequisites met as per the documentation

# kubectl get pods -n kube-system

Re: Failure to Install Embedded Container Service (ECS) due to Certificate Signing Request (CSR) is still in the "approved" status

steinsgate — Mon, 08 Apr 2024 09:03:22 GMT

Hello @upadhyayk04

Thank you for your reply.

We are using CM 7.11.3, CDP 7.1.9, ECS 1.5.2.

After reinstalling and deleting the rancher folder, we have successfully passed through this error. But we don’t know the actual reason.

Currently, we are still investigating where the DNS error might be occurring.

Re: Failure to Install Embedded Container Service (ECS) due to Certificate Signing Request (CSR) is still in the "approved" status

upadhyayk04 — Mon, 08 Apr 2024 17:19:00 GMT

Hello @steinsgate

Thank you for your update. Glad to know the issue is resolved post-cleanup and reinstallation

Yes for the DNS issue as we are discussing on the other thread please check the pre-reqs document and let us know how it goes

Let us know if we can mark this as resolved now

Re: Failure to Install Embedded Container Service (ECS) due to Certificate Signing Request (CSR) is still in the "approved" status

steinsgate — Tue, 09 Apr 2024 04:18:28 GMT

Hello @upadhyayk04

Thank you, marked as resolved.