Fresh install but no internet on the pod due to SSL

[JoaoPPCastelo]

Hi all!

New to K3s and was trying to install it on a Raspberry Pi 5 to play with Kubernetes and deploy some apps, but, for some reason, i cannot get SSL/TLS working from inside the pod to the internet. Any connection not using SSL/TLS works fine. Any idea on what may be causing this? Did i missed some step to get this working?

More technical info:

• Fresh installation of RasperryPI OS (Debian 12.8 bookworm)
• Performed a sudo apt update && sudo apt upgrade -y
• Updated the /boot/firmware/cmdline.txt to add cgroup_memory=1 cgroup_enable=memory and restarted the device
• Installed K3s with the command curl -sfL https://get.k3s.io | sh -
• Deployed a pod using the alpine/openssl and tested the connection from inside of it using kubectl exec command

Output from the pod:

/ # apk update
fetch https://dl-cdn.alpinelinux.org/alpine/v3.21/main/aarch64/APKINDEX.tar.gz
20ED05E8FE7F0000:error:0A000458:SSL routines:ssl3_read_bytes:tlsv1 unrecognized name:ssl/record/rec_layer_s3.c:907:SSL alert number 112
WARNING: updating and opening https://dl-cdn.alpinelinux.org/alpine/v3.21/main: Permission denied
fetch https://dl-cdn.alpinelinux.org/alpine/v3.21/community/aarch64/APKINDEX.tar.gz
20ED05E8FE7F0000:error:0A000458:SSL routines:ssl3_read_bytes:tlsv1 unrecognized name:ssl/record/rec_layer_s3.c:907:SSL alert number 112
WARNING: updating and opening https://dl-cdn.alpinelinux.org/alpine/v3.21/community: Permission denied
4 unavailable, 0 stale; 16 distinct packages available

/ # wget http://www.google.com
Connecting to www.google.com (13.248.169.48:80)
saving to 'index.html'
index.html           100% |********************************************************************************************************************************************************************|   114  0:00:00 ETA
'index.html' saved

/ # wget https://www.google.com
Connecting to www.google.com (13.248.169.48:443)
202D1A60FF7F0000:error:0A000458:SSL routines:ssl3_read_bytes:tlsv1 unrecognized name:ssl/record/rec_layer_s3.c:907:SSL alert number 112
ssl_client: SSL_connect
wget: error getting response: Connection reset by peer

Thank you

[brandond]

/ # wget https://www.google.com
Connecting to www.google.com (13.248.169.48:443)
202D1A60FF7F0000:error:0A000458:SSL routines:ssl3_read_bytes:tlsv1 unrecognized name:ssl/record/rec_layer_s3.c:907:SSL alert number 112

This is not Google:

brandond@dev01:~$ host 13.248.169.48
48.169.248.13.in-addr.arpa domain name pointer a904c694c05102f30.awsglobalaccelerator.com.

Do you have a pihole or something else in your environment that is messing with DNS resolution? Get rid of that, or bypass it for your k3s node.

[JoaoPPCastelo]

Hi Brandon. Thanks for the answer.

Checked by running the wget on the host and on the container and in fact the answer is different. I'm not explicitly defining any DNS server on the host, juts using the defaults (the router).

After your message started to check also more discussions regarding DNS and found one where you also mention using the --resolv-conf flag. My host does not have that file by default but gonna create one and pass it to k3s.

Thanks,
Joao

[JoaoPPCastelo]

Just to confirm that passing the file path using the --resolv-conf fixed the issue. Thank you so much for the help.