Failure to Install Embedded Container Service (ECS) due to Certificate Signing Request (CSR) is still in the "approved" status

Question

Hi everyone, I would like some clarification. Thank you.

During the installation of ECS, we encountered some errors that prevented successful installation. One of the issues was as follows: the Certificate Signing Request (CSR) remained in an "approved" state instead of being "certificated," causing it to remain stuck in a loop.

# /var/lib/rancher/rke2/bin/kubectl --kubeconfig /etc/rancher/rke2/rke2.yaml get csr
NAME                          AGE   SIGNERNAME                      REQUESTOR      REQUESTEDDURATION   CONDITION
ecs-tolerations-webhook-csr   55m   kubernetes.io/kubelet-serving   system:admin   <none>              Approved

How should we address this? Should we consider a reinstallation? Or is there an underlying cause behind this issue? Thank you.

Related issue: Failure to Install Embedded Container Service (ECS), encountering "Failed to reconcile with temporary etcd" after manual uninstallation

upadhyayk04 · Accepted Answer

Hello @steinsgate

Thank you for your update. Glad to know the issue is resolved post-cleanup and reinstallation

Yes for the DNS issue as we are discussing on the other thread please check the pre-reqs document and let us know how it goes

Let us know if we can mark this as resolved now

upadhyayk04 · Answer

Hello @steinsgate

Thank you for reaching out to the community

Can you please confirm the ECS version you are using along with the CM and CDP versions?

Also, are the Kubernetes core pods running? Have all the prerequisites met as per the documentation

# kubectl get pods -n kube-system

Sign up

Please use your Cloudera account.

Login to the community

Please use your Cloudera account.