Admission Webhook issue when using --disable-agent

[WeaselScience]

Hello everyone! I'm having trouble using cert-manager in a brand new K3s cluster.

My cluster is as follows:
* One internet-accessible server with --disable-agent flag, all ports firewalled besides 6443.

• Three non-internet accessible agents in a LAN.

Everything seems to work fine, but after installing cert-manager with kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.1/cert-manager.yaml, and trying to apply some custom resources, i get the following error:

Error from server (InternalError): error when creating "main-tls.yaml": Internal error occurred: failed calling webhook "webhook.cert-manager.io": failed to call webhook: Post "https://cert-manager-webhook.cert-manager.svc:443/mutate?timeout=10s": context deadline exceeded

Anyone dealt with this? Could it be related that the K3s server does not run CNI, and thus cannot access the validating webhook?

[brandond]

If you look in the logs, you should see a message on startup that explicitly addresses this:

k3s/pkg/cli/server/server.go

Lines 595 to 597 in 2a9e8e6

	if serverConfig.DisableAgent {
	logrus.Warn("Webhooks and apiserver aggregation may not function properly without an agent; please set egress-selector-mode to 'cluster' or 'pod'")
	}

[WeaselScience]

🤦 thanks. Adding the egress-selector-mode to the server and restarting the agents fixed the issue.

I've added a PR to the docs: k3s-io/docs#181