Unable to deploy Teleport: tls: failed to verify certificate: x509: certificate is valid for...

[Dentrax]

helm install teleport-cluster teleport/teleport-cluster \
  --set clusterName=teleport-cluster.teleport.svc.my-test-cluster \
  --set=operator.enabled=true \
  --set=global.clusterDomain=my-test-cluster \
  --set=persistence.storageClassName=local-hostpath

(local-hostpath is OpenEBS)

Results:

kubernetes failed to validate token: [invalid bearer token, token audiences ["https://kubernetes.default.svc.my-test-cluster"] is invalid for the target audiences ["https://kubernetes.default.svc" "teleport-cluster.teleport.svc.my-test-cluster"]], pinging proxy to determine signature algorithm suite
	Get "https://teleport-cluster-auth.teleport.svc.my-test-cluster:3025/webapi/find": tls: failed to verify certificate: x509: certificate is valid for teleport-cluster-auth-56fb8b994b-g27hc, *.teleport.cluster.local, teleport.cluster.local, not teleport-cluster-auth.teleport.svc.my-test-cluster] service/connect.go:102

• I've checked the ConfigMaps and ensured those are correctly set
• Restarted all Pods
• I have my-test-cluster in the CoreDNS, I able to resolve teleport-cluster-auth.teleport.svc.my-test-cluster but not cluster.local
• I see the similar discussion here, but it didn't work for me, or its a bit different case

[webvictim]

@hugoShaka I think this might be the same issue as #49756?

There is a PR to fix it: #49796

[hugoShaka]

Yes, this is a 17.0.3 regression I introduced last week. Will ship a fix today and cur new bugfix releases likely tomorrow.

[Dentrax]

Same issue on 16.4.9, but I able to spin up without any issues with version 16.2.2.

[hugoShaka]

16.4.10 and 17.0.4 got released yesterday and should fix the joining issue

[Dentrax]

Thank you for such a prompt action. I just tested and can confirmed that both works well!

[tosih]

Thanks for this. Worked for us too.