Networking error "failed to connect from worker to kubernetes api at xxx:6443" despite firewall port open

[iapicca]

I'd start giving a bit of context, I'm a noob and I'm trying to setup k0s through terraform/opentofu
and I get an error due to networking despite the firewall seems fine (to me at least)

I could use some help

error message

⠀⣿⣿⡇⠀⠀⢀⣴⣾⣿⠟⠁⢸⣿⣿⣿⣿⣿⣿⣿⡿⠛⠁⠀⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠀█████████ █████████ ███
⠀⣿⣿⡇⣠⣶⣿⡿⠋⠀⠀⠀⢸⣿⡇⠀⠀⠀⣠⠀⠀⢀⣠⡆⢸⣿⣿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀███          ███    ███
⠀⣿⣿⣿⣿⣟⠋⠀⠀⠀⠀⠀⢸⣿⡇⠀⢰⣾⣿⠀⠀⣿⣿⡇⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠀███          ███    ███
⠀⣿⣿⡏⠻⣿⣷⣤⡀⠀⠀⠀⠸⠛⠁⠀⠸⠋⠁⠀⠀⣿⣿⡇⠈⠉⠉⠉⠉⠉⠉⠉⠉⢹⣿⣿⠀███          ███    ███
⠀⣿⣿⡇⠀⠀⠙⢿⣿⣦⣀⠀⠀⠀⣠⣶⣶⣶⣶⣶⣶⣿⣿⡇⢰⣶⣶⣶⣶⣶⣶⣶⣶⣾⣿⣿⠀█████████    ███    ██████████
k0sctl v0.18.1 Copyright 2023, k0sctl authors.
Anonymized telemetry of usage will be sent to the authors.
By continuing to use k0sctl you agree to these terms:
https://k0sproject.io/licenses/eula
level=info msg="==> Running phase: Set k0s version"
level=info msg="Looking up latest stable k0s version"
level=info msg="Using k0s version v1.30.4+k0s.0"
level=info msg="==> Running phase: Connect to hosts"
level=info msg="[ssh] 206.81.20.20:22: connected"
level=info msg="[ssh] 206.81.31.231:22: connected"
level=info msg="[ssh] 161.35.218.68:22: connected"
level=info msg="==> Running phase: Detect host operating systems"
level=info msg="[ssh] 206.81.20.20:22: is running Ubuntu 24.04 LTS"
level=info msg="[ssh] 206.81.31.231:22: is running Ubuntu 24.04 LTS"
level=info msg="[ssh] 161.35.218.68:22: is running Ubuntu 24.04 LTS"
level=info msg="==> Running phase: Acquire exclusive host lock"
level=info msg="==> Running phase: Prepare hosts"
level=info msg="==> Running phase: Gather host facts"
level=info msg="[ssh] 206.81.20.20:22: using worker-node-1 as hostname"
level=info msg="[ssh] 161.35.218.68:22: using worker-node-0 as hostname"
level=info msg="[ssh] 206.81.31.231:22: using controller-node-0 as hostname"
level=info msg="[ssh] 206.81.20.20:22: discovered eth0 as private interface"
level=info msg="[ssh] 161.35.218.68:22: discovered eth0 as private interface"
level=info msg="[ssh] 206.81.31.231:22: discovered eth0 as private interface"
level=info msg="[ssh] 161.35.218.68:22: discovered 10.19.0.5 as private address"
level=info msg="[ssh] 206.81.20.20:22: discovered 10.19.0.7 as private address"
level=info msg="[ssh] 206.81.31.231:22: discovered 10.19.0.6 as private address"
level=info msg="==> Running phase: Validate hosts"
level=info msg="==> Running phase: Gather k0s facts"
level=info msg="[ssh] 206.81.31.231:22: found existing configuration"
level=info msg="[ssh] 206.81.31.231:22: is running k0s controller version v1.30.4+k0s.0"
level=info msg="[ssh] 206.81.31.231:22: listing etcd members"
level=info msg="==> Running phase: Validate facts"
level=info msg="[ssh] 206.81.31.231:22: validating configuration"
level=info msg="==> Running phase: Install workers"
level=info msg="[ssh] 206.81.20.20:22: validating api connection to https://10.19.0.6:6443"
level=info msg="[ssh] 161.35.218.68:22: validating api connection to https://10.19.0.6:6443"
level=info msg="* Running clean-up for phase: Acquire exclusive host lock"
level=info msg="* Running clean-up for phase: Install workers"
level=info msg="[ssh] 161.35.218.68:22: cleaning up"
level=info msg="[ssh] 206.81.20.20:22: cleaning up"
level=info msg="==> Apply failed"
level=fatal msg="apply failed - log file saved to /Users/francesco/Library/Caches/k0sctl/k0sctl.log: failed on 2 hosts:\n - [ssh] 161.35.218.68:22: failed to connect from worker to kubernetes api at https://10.19.0.6:6443 - check networking\n - [ssh] 206.81.20.20:22: failed to connect from worker to kubernetes api at https://10.19.0.6:6443 - check networking"

here is my

• firewall configuration what did I miss
• terraform set up
• k0sctl.log

note, k0sctl is installed on my local machine

k0sctl version
version: v0.18.1
commit: 53248d6

possibly related to #716
question on lens forum

[kke]

I think you need to create a VPC for the droplets 🤔

See:

• https://registry.terraform.io/providers/digitalocean/digitalocean/latest/docs/resources/vpc
• https://docs.digitalocean.com/products/kubernetes/how-to/create-clusters/#vpc-network

[iapicca]

@kke
Thank you for pointing me in the right direction,
setting the ip range that k0sctl is using (according to the logs)

167.x.x.x:22: failed to connect from worker to kubernetes api at https://10.19.0.6:6443 - check networking
164.x.x.x:22: failed to connect from worker to kubernetes api at https://10.19.0.6:6443 - check networking"

resource "digitalocean_vpc" "k0s_vpc" {
  name               = "k0s-vpc"
  region             = local.droplet_region
  ip_range           = "10.19.0.6/24"
}

is reserved by digitalocean 10.19.0.0/16
I'm looking for a way to set different values for it through k0sctl
but I cannot find it in the docs

any help is welcome, thanks again

(I apologize if it's a dumb question, I'm new to this)