Failure to Install Embedded Container Service (ECS) due to Certificate Signing Request (CSR) is still in the "approved" status

[#1]

Hi everyone, I would like some clarification. Thank you.

During the installation of ECS, we encountered some errors that prevented successful installation. One of the issues was as follows: the Certificate Signing Request (CSR) remained in an "approved" state instead of being "certificated," causing it to remain stuck in a loop.

# /var/lib/rancher/rke2/bin/kubectl --kubeconfig /etc/rancher/rke2/rke2.yaml get csr
NAME                          AGE   SIGNERNAME                      REQUESTOR      REQUESTEDDURATION   CONDITION
ecs-tolerations-webhook-csr   55m   kubernetes.io/kubelet-serving   system:admin   <none>              Approved

How should we address this? Should we consider a reinstallation? Or is there an underlying cause behind this issue? Thank you.

Related issue: Failure to Install Embedded Container Service (ECS), encountering "Failed to reconcile with temporar... 

[#2]

Hello @steinsgate 

Thank you for reaching out to the community

Can you please confirm the ECS version you are using along with the CM and CDP versions?

Also, are the Kubernetes core pods running? Have all the prerequisites met as per the documentation

# kubectl get pods -n kube-system

[#3]

Hello @upadhyayk04 

Thank you for your reply.

We are using CM 7.11.3, CDP 7.1.9, ECS 1.5.2.

After reinstalling and deleting the rancher folder, we have successfully passed through this error. But we don’t know the actual reason.

Currently, we are still investigating where the DNS error might be occurring.

[#4 · Accepted solution]

Hello @steinsgate 

Thank you for your update. Glad to know the issue is resolved post-cleanup and reinstallation

Yes for the DNS issue as we are discussing on the other thread please check the pre-reqs document and let us know how it goes

Let us know if we can mark this as resolved now

[#5]

Hello @upadhyayk04 

Thank you, marked as resolved.