Certificate not valid for any name when creating PVC
imul-p opened this issue · comments
Describe the bug
When attempting to create a PVC with topoLVM I receive a error message of
"Error from server (InternalError): error when creating "topo-test.yaml": Internal error occurred: failed calling webhook "pvc-hook.topolvm.io": failed to call webhook: Post "https://topolvm-eks02-controller.topolvm.svc:443/pvc/mutate?timeout=10s": x509: certificate is not valid for any names, but wanted to match topolvm-eks02-controller.topolvm.svc"
However checking the certificate generated using our existing cert-manager deployment this has a SAN for topolvm-eks02-controller.topolvm.svc. Also when testing accessing using port forwarding this certificate is being presented without a common name in the subject however has the required name as a SAN. We also use storage capacity tracking as this is deployed to EKS without access to the kube-scheduler.
Environments
- Version: Chart:
11.2.0AppVer:0.18.2 - OS: EKS:
v1.24.13-eks-0a21954 AmazonLinux 2
To Reproduce
Steps to reproduce the behavior:
- Deploy topoLVM to EKS, using storage capacity tracking and an existing cert-manager installation
- Attempt to create a pvc
- Error should be presented when attempting kubectl apply
Expected behavior
PVC is created and internally topolvm is able to communicate with the service without a certificate error.
Additional context
As noted above we are using storage capacity tracking and an existing cert-manager deployment.
Apologies for the false bug report, after further troubleshooting I have been able to determine that this was down to the istio service mesh and it's security settings specifically around mTLS. Thank you for taking your time to review this report and once again apologies for the false flagging.