<p>I am trying to deploy an application with k3s kubernetes. Currently I have two master nodes behind a load-balancer, and I have some issues connecting worker nodes to them. All nodes and the load-balancer runs in seperate vms.</p>
<p>The load balancer is a nginx server with the following configuration.</p>
<pre><code>load_module /usr/lib/nginx/modules/ngx_stream_module.so;
events {}
stream {
  upstream k3s_servers {
    server {master_node1_ip}:6443;
    server {master_node2_ip}:6443;
  }
  server {
    listen 6443;
    proxy_pass k3s_servers;
  }
}
</code></pre>
<p>the master nodes connects through the load-balancer, and seemingly it works as expected.</p>
<pre><code>ubuntu@ip-172-31-20-78:/$ sudo k3s kubectl get nodes
NAME               STATUS   ROLES                  AGE   VERSION
ip-172-31-33-183   Ready    control-plane,master   81m   v1.20.2+k3s1
ip-172-31-20-78    Ready    control-plane,master   81m   v1.20.2+k3s1
</code></pre>
<p>However the worker nodes yields an error about the SSL certificate?</p>
<pre><code>sudo systemctl status k3s-agent
● k3s-agent.service - Lightweight Kubernetes
     Loaded: loaded (/etc/systemd/system/k3s-agent.service; enabled; vendor preset: enabled)
     Active: active (running) since Sun 2021-01-24 15:54:10 UTC; 19min ago
       Docs: https://k3s.io
    Process: 3065 ExecStartPre=/sbin/modprobe br_netfilter (code=exited, status=0/SUCCESS)
    Process: 3066 ExecStartPre=/sbin/modprobe overlay (code=exited, status=0/SUCCESS)
   Main PID: 3067 (k3s-agent)
      Tasks: 6
     Memory: 167.3M
     CGroup: /system.slice/k3s-agent.service
             └─3067 /usr/local/bin/k3s agent
Jan 24 16:12:23 ip-172-31-27-179 k3s[3311]: time=&quot;2021-01-24T16:34:02.483557102Z&quot; level=info msg=&quot;Running load balancer 127.0.0.1:39357 -&gt; [104.248.34.
Jan 24 16:12:23 ip-172-31-27-179 k3s[3067]: time=&quot;2021-01-24T16:12:23.313819380Z&quot; level=error msg=&quot;failed to get CA certs: Get \&quot;https://127.0.0.1:339
</code></pre>
<blockquote>
<p>level=error msg=&quot;failed to get CA certs: Get &quot;https://127.0.0.1:39357/cacerts&quot;: EOF&quot;</p>
</blockquote>
<p>if I try to change K3S_URL in <code>/etc/systemd/system/k3s-agent.service.env</code> to use <code>http</code>, I get an error saying that only https is accepted.</p>

<p>Using the IP Address instead of the hostname in <code>k3s-agent.service.env</code> works for me. Not really a solution as much as a workaround.</p>
<p><code>/etc/systemd/system/k3s-agent.service.env</code></p>
<pre><code>K3S_TOKEN='&lt;token&gt;'
K3S_URL='192.168.xxx.xxx:6443'
</code></pre>
