tls-san entry in server config is ignored about rke2-aws-tf HOT 3 CLOSED

It's this:

config() {
  mkdir -p "/etc/rancher/rke2"
  cat <<EOF >> "/etc/rancher/rke2/config.yaml"
# Additional user defined configuration
${config}
EOF
}

and this:

  if [ $TYPE = "server" ]; then
    # Initialize server
    identify

    cat <<EOF >> "/etc/rancher/rke2/config.yaml"
tls-san:
  - ${server_url}
EOF

The module allows the user to pass arbitrary config values, which may include tls-san, but then creates it anyway because the ${server_url} refers to the DNS name assigned by AWS to the control plane load balancer, which isn't known until it gets created. I suspect we'll have to expose a variable to set additional SANs for the API server directly and then explain in bold-face font somewhere that this particular key can't be passed as additional config without breaking the setup. The way this script currently works doesn't make it possible to assign your own DNS name to your API server, which isn't a great idea. We got pretty lucky that it took over three years for someone to encounter this.

from rke2-aws-tf.

@adamacosta @joshrwolf - Please take a look at the pull request. Thanks!

from rke2-aws-tf.

Fixed in v2.4.1

from rke2-aws-tf.