Search code examples
kubernetesrancherrancher-desktop

Kubernetes/Rancher Desktop "certificate signed by unknown authority" macOS


After installing Rancher Desktop on macOS 13.2.1 (Apple M1) I walk through the Hello World documentation. During the "Deploy to Kubernetes" part I run into this problem:

$ kubectl run hello-world --image=nginx-helloworld:latest --image-pull-policy=Never --port=80 
I0306 08:42:03.954011    9988 versioner.go:58] Get "https://127.0.0.1:6443/version?timeout=5s": x509: certificate signed by unknown authority
E0306 08:42:04.038118    9988 memcache.go:238] couldn't get current server API group list: Get "https://127.0.0.1:6443/api?timeout=32s": x509: certificate signed by unknown authority
Unable to connect to the server: x509: certificate signed by unknown authority

I kind of understand the error but I don't know how to fix it properly. I followed all the steps in the documentation.


Solution

  • The error you are getting is "Unable to connect to the server: x509: certificate signed by unknown authority".

    As per this document

    Services that Rancher needs to access are sometimes configured with a certificate from a custom/internal CA root, also known as self signed certificate. If the presented certificate from the service cannot be validated by Rancher, the following error displays: x509: certificate signed by unknown authority.

    To validate the certificate, the CA root certificates need to be added to Rancher. As Rancher is written in Go, we can use the environment variable SSL_CERT_DIR to point to the directory where the CA root certificates are located in the container. The CA root certificates directory can be mounted using the Docker volume option (-v host-source-directory:container-destination-directory) when starting the Rancher container.

    Refer to this official document for more information.