Skip to content

Fix certificate validation when api_endpoint differs from hostname #434

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dereknola merged 6 commits into from
Sep 15, 2025
Merged

Fix certificate validation when api_endpoint differs from hostname #434

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
24ec0ec
Fix certificate validation when api_endpoint differs from hostname
guiand888 Aug 23, 2025
7386fe0
Move tls-san logic to tasks and validate existing flags
guiand888 Aug 26, 2025
8068ce6
Add .ansible/ and PR_DESCRIPTION.md to gitignore
guiand888 Sep 6, 2025
6c0faa0
Merge branch 'master' into fix/tls-san-api-endpoint
guiand888 Sep 6, 2025
201386d
Update roles/k3s_agent/templates/k3s-agent.service.j2
guiand888 Sep 13, 2025
e4612b5
Update roles/k3s_agent/tasks/main.yml
guiand888 Sep 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions roles/k3s_server/defaults/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,3 +9,6 @@
agent_group: agent # noqa var-naming[no-role-prefix]
use_external_database: false # noqa var-naming[no-role-prefix]
extra_server_args: "" # noqa var-naming[no-role-prefix]
# Auto-computed TLS SANs to prevent certificate validation issues
_computed_tls_sans: "{% if api_endpoint is defined and api_endpoint != ansible_hostname %}--tls-san={{ api_endpoint }}{% endif %}"

Check warning on line 13 in roles/k3s_server/defaults/main.yml

View workflow job for this annotation

GitHub Actions / Lint

var-naming[no-role-prefix] 

Variables names from within roles should use k3s_server_ as a prefix. (vars: _computed_tls_sans)
_final_server_args: "{{ extra_server_args }} {{ _computed_tls_sans }}"

Check warning on line 14 in roles/k3s_server/defaults/main.yml

View workflow job for this annotation

GitHub Actions / Lint

var-naming[no-role-prefix] 

Variables names from within roles should use k3s_server_ as a prefix. (vars: _final_server_args)

@dereknola dereknola Aug 26, 2025

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Move the logic out of these files, we specifically want these to be very simple default files.

2 changes: 1 addition & 1 deletion roles/k3s_server/templates/k3s-cluster-init.service.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,4 +25,4 @@ Restart=always
RestartSec=5s
ExecStartPre=-/sbin/modprobe br_netfilter
ExecStartPre=-/sbin/modprobe overlay
ExecStart=/usr/local/bin/k3s server --cluster-init --data-dir {{ k3s_server_location }} {{ extra_server_args }}
ExecStart=/usr/local/bin/k3s server --cluster-init --data-dir {{ k3s_server_location }} {{ _final_server_args }}
2 changes: 1 addition & 1 deletion roles/k3s_server/templates/k3s-ha.service.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,4 +25,4 @@ Restart=always
RestartSec=5s
ExecStartPre=-/sbin/modprobe br_netfilter
ExecStartPre=-/sbin/modprobe overlay
ExecStart=/usr/local/bin/k3s server --data-dir {{ k3s_server_location }} --server https://{{ api_endpoint }}:{{ api_port }} {{ extra_server_args }}
ExecStart=/usr/local/bin/k3s server --data-dir {{ k3s_server_location }} --server https://{{ api_endpoint }}:{{ api_port }} {{ _final_server_args }}
2 changes: 1 addition & 1 deletion roles/k3s_server/templates/k3s-single.service.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,4 +25,4 @@ Restart=always
RestartSec=5s
ExecStartPre=-/sbin/modprobe br_netfilter
ExecStartPre=-/sbin/modprobe overlay
ExecStart=/usr/local/bin/k3s server --data-dir {{ k3s_server_location }} {{ extra_server_args }}
ExecStart=/usr/local/bin/k3s server --data-dir {{ k3s_server_location }} {{ _final_server_args }}
Loading