teleport cluster failing to start

[Aman1994]

I am using teleport-cluster helm chart version 6. The teleport.yaml file looks like

data:
  teleport.yaml: |
    teleport:
      log:
        severity: INFO
        output: stderr
    auth_service:
      enabled: true
      cluster_name: teleport.example.com
      listen_addr: 0.0.0.0:3025
      authentication:
        type: local
        second_factor: otp
    kubernetes_service:
      enabled: true
      listen_addr: 0.0.0.0:3027
      labels:
    proxy_service:
      enabled: true
      listen_addr: 0.0.0.0:3023
      web_listen_addr: 0.0.0.0:3080
      tunnel_listen_addr: 0.0.0.0:3024
      kube_listen_addr: 0.0.0.0:3026
      public_addr: 'teleport.example.com:3080'      
      acme:
        enabled: true
        email: [email protected]
    ssh_service:
      enabled: true

The chart runs fine but for some reason the cert is not getting created correctly.

When i run

curl https://teleport.example.com/webapi/ping

it gives error

curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

[programmerq]

It looks like you have acme enabled in your teleport config, but acme requires the public_addr to be on port 443. By default, this helm chart does set up your load balancer's port 443 to come into the teleport proxy instance on 3080. Also, make sure that the DNS name you have set up under proxy_service.public_addr resolves to your load balancer in question. It looks like you may have customized that teleport.yaml since version 6 of the teleport/teleport-cluster chart will use 443 by default?

If you still run into trouble after fixing up the public_addr, check the logs of your teleport pod to see if there is info about the acme certificate progressing and what errors it might be encountering.

[Aman1994]

@programmerq Now i have removed the customamized teleport.yaml and now its just getting created by default values , except acme which i have changed it to true. The yaml looks like

  teleport.yaml: |
    teleport:
      log:
        severity: INFO
        output: stderr
    auth_service:
      enabled: true
      cluster_name: teleport.example.com
      authentication:
        type: local
    kubernetes_service:
      enabled: true
      listen_addr: 0.0.0.0:3027
      kube_cluster_name: teleport.example.com
    proxy_service:
      public_addr: 'teleport.example.com:443'
      kube_listen_addr: 0.0.0.0:3026
      enabled: true
      acme:
        enabled: true
        email: [email protected]
    ssh_service:
      enabled: false

And still i see the same issue with cert.

Having looked at the logs i can see

2021-09-20T10:31:56Z INFO [CA]        Generating TLS certificate {0x53f3748 0xc000570020 1.3.9999.1.7=#131474656c65706f72742e6f626d6f6e646f2e636f6d,CN=ea9c2398-21c4-4031-88ab-e52b16ed320c.teleport.example.com,O=Kube,POSTALCODE=null,STREET= 2031-09-18 10:31:56.468044372 +0000 UTC [teleport-cluster-848dcdd95-fv6nh localhost 127.0.0.1 ::1 remote.kube.proxy.teleport.cluster.local *.teleport.cluster.local teleport.cluster.local]}. common_name:ea9c2398-21c4-4031-88ab-e52b16ed320c.teleport.example.com dns_names:[teleport-cluster-848dcdd95-fv6nh localhost 127.0.0.1 ::1 remote.kube.proxy.teleport.cluster.local *.teleport.cluster.local teleport.cluster.local] locality:[] not_after:2031-09-18 10:31:56.468044372 +0000 UTC org:[Kube] org_unit:[] tlsca/ca.go:637

The CN looks a bit weird to me