I also struggled for quite some time with this exact issue, however I think I found the correct way to fix this in k3s.
The naive solution
For a long time i just ran all kubectl commands with --insecure-skip-tls-verify which worked fine, but became annoying after some time (and is insecure).
The correct way
What finally solved my issue with accessing my k3s cluster from another domain/machine was running the k3s server command with the --tls-san <domain name> flag as documented here https://docs.k3s.io/cli/server.
To make this permanent, the domain can either be added to the k3s config file or to the k3s systemd/openrc service depending on what your system is using.
I'm using Alpine Linux and openrc, this means I had to first stop the k3s service with rc-service k3s stop then alter the service file in /etc/init.d/k3s and change command_args="server" to command_args="server --tls-san <domain> before starting the service again with rc-service k3s start.
I yoloed this when I set it up, and did not consider accidentally deleting or breaking services on the node etc. Draining the node or otherwise gracefully shutting down containers is probably ideal before stopping the service.
This is how my k3s openrc service file ended up looking:
#!/sbin/openrc-run
depend() {
after network-online
want cgroups
}
start_pre() {
rm -f /tmp/k3s.*
}
supervisor=supervise-daemon
name=k3s
command="/usr/local/bin/k3s"
This is the line i changed
command_args="server --tls-san <domain>
>>/var/log/k3s.log 2>&1"
output_log=/var/log/k3s.log
error_log=/var/log/k3s.log
pidfile="/var/run/k3s.pid"
respawn_delay=5
respawn_max=0
set -o allexport
if [ -f /etc/environment ]; then . /etc/environment; fi
if [ -f /etc/rancher/k3s/k3s.env ]; then . /etc/rancher/k3s/k3s.env; fi
set +o allexport
Where <domain> is the domain that kubectl complains about when running any kubectl command against the cluster.
The better solution is probably to alter the k3s config file under with default path /etc/rancher/k3s/config.yaml. Example from the documentation:
write-kubeconfig-mode: "0644"
tls-san:
- "foo.local"
node-label:
- "foo=bar"
- "something=amazing"
cluster-init: true
If you are using a system with systemd the default path to the k3s service should be /etc/systemd/system and there should be a line with ExecStart=k3s server under [service] (not validated this). To start and stop the service sudo systemctl stop k3s and sudo systemctl start k3s
Hope this helps!
