<p>Just installed Kubernetes cluster using <code>kubespray</code>. <code>3 master</code> nodes and <code>3 worker</code> nodes + <code>2 haproxy</code> nodes in front of master nodes with <code>keepalived</code>.</p>
<p>Everything works perfectly except for one thing.
When I try to update packages on <code>alpine</code> or <code>ubuntu</code> inside pods:</p>
<pre><code>Ign:1 https://security.debian.org/debian-security buster/updates InRelease          
Ign:2 https://deb.debian.org/debian buster InRelease                                
Err:4 https://security.debian.org/debian-security buster/updates Release                            
  Certificate verification failed: The certificate is NOT trusted. The certificate issuer is unknown. The name in the certificate does not match the expected.
</code></pre>
<p>Quick debugging revealed that I'm getting self-signed Traefik Default certificate from proxy in K8s</p>
<pre class="lang-sh prettyprint-override"><code>echo | openssl s_client -showcerts -servername gnupg.org -connect gnupg.org:443 2&gt;/dev/null | openssl x509 -inform pem -noout -text
</code></pre>
<p>Output:</p>
<pre><code>       Issuer: CN = TRAEFIK DEFAULT CERT
        Validity
            Not Before: Jun 15 14:08:39 2020 GMT
            Not After : Jun 15 14:08:39 2021 GMT
        Subject: CN = TRAEFIK DEFAULT CERT
</code></pre>
<p>Is there a way to disable SSL termination?</p>
<p>My installation is a completely fresh install of <code>kubespray</code> from <code>master</code> branch</p>
<p>Kubernetes version: <code>v1.18.5</code></p>

Blz
<p>Found an issue in <code>/etc/resolv.conf</code>.
<code>search</code> list had a domain that was pointing to a server with traefik on it.
That domain's DNS zone had <code>*.domain.com</code> record in it. So that was the problem.</p>
