k3s tls-san: add kai-server.local so fleet-readout.sh can drop skip-tls-verify #303

New issue

Open

opened 2026-06-12 08:40:36 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-06-12 08:40:36 +00:00

Owner

coilysiren/coilysiren scripts/fleet-readout.sh carries a kubectl workaround: the kubeconfig default https://kai-server:6443 answers Bad Gateway, so the script points at kai-server.local and passes --insecure-skip-tls-verify because the k3s API cert has no kai-server.local SAN.

Removal condition, stated in the script comment: add kai-server.local to the k3s tls-san list, then drop the skip-tls-verify flag from the script.

Two parts:

infrastructure - add kai-server.local to the k3s server tls-san config and roll the cert.
coilysiren/coilysiren - remove --insecure-skip-tls-verify (and ideally the --server override) from scripts/fleet-readout.sh once the SAN lands.

Filed so the workaround's removal condition has a tracking ref instead of living only in a script comment.

`coilysiren/coilysiren` `scripts/fleet-readout.sh` carries a kubectl workaround: the kubeconfig default `https://kai-server:6443` answers Bad Gateway, so the script points at `kai-server.local` and passes `--insecure-skip-tls-verify` because the k3s API cert has no `kai-server.local` SAN. Removal condition, stated in the script comment: add `kai-server.local` to the k3s `tls-san` list, then drop the skip-tls-verify flag from the script. Two parts: * infrastructure - add `kai-server.local` to the k3s server `tls-san` config and roll the cert. * coilysiren/coilysiren - remove `--insecure-skip-tls-verify` (and ideally the `--server` override) from `scripts/fleet-readout.sh` once the SAN lands. Filed so the workaround's removal condition has a tracking ref instead of living only in a script comment.

coilysiren referenced this issue from a commit

2026-06-12 08:48:03 +00:00

docs: sweep cross-file drift - canonical owners, hosts, remotes, readout counts

coilysiren referenced this issue from a commit

2026-06-12 12:04:50 +00:00

feat(ser8): break ground on the second k3s control plane

coilysiren referenced this issue

2026-06-17 06:21:05 +00:00

Forgejo daily logout: 7d session TTL not rolled out + kubectl kai-server.local Bad Gateway #350

coilysiren added the

label

2026-06-17 07:06:34 +00:00