# Failed calling webhook (cert-manager)

**URL:** <https://forums.suse.com/t/failed-calling-webhook-cert-manager/19592>\
**Category:** SUSE Rancher Prime\
**Created:** [February 22, 2021, 4:53pm UTC](https://forums.suse.com/t/failed-calling-webhook-cert-manager/19592 "2021-02-22T16:53:12Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bezhan\_Mukhidinov](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/bezhan_mukhidinov/32/7230_2.png) [@Bezhan\_Mukhidinov](https://forums.suse.com/u/Bezhan_Mukhidinov)\
**Post date:** [February 22, 2021, 4:53pm UTC](https://forums.suse.com/t/failed-calling-webhook-cert-manager/19592/1 "2021-02-22T16:53:12Z")

</div>

Hi ranchers !

I’ve started recently setting up my HA RKE cluster, and got stuck in nearly last step ☹ . The issue is related to topic below , but there was no explanation in that topic of how to resolve the problem.

Briefly, when I was installing rancher on RKE cluster, an error popped out  
`Error: Internal error occurred: failed calling webhook "webhook.cert-manager.io": Post https://cert-manager-webhook .cert-manager.svc:443/mutate?timeout=30s: dial tcp 10.43.189.166:443: i/o timeout`

at  
`helm install rancher rancher-latest/rancher \ --namespace cattle-system \ --set hostname=rancher.my.org \ --set ingress.tls.source=letsEncrypt \ --set letsEncrypt.email=me@example.org`  
I tried to resolve the issue, but no luck, can’t understand what did I do wrong. As a note, instead of following outdated cert-manager installation process at rancher docs, I used the one in cert manager itself.

Here is my **cluster.yml** :  
`  
nodes:  
- address: 65.21.7.132  
internal\_address: 10.0.3.2  
hostname\_override: rke-node-1  
user: root  
role:  
- controlplane  
- etcd  
- worker  
- address: 65.21.1.94  
internal\_address: 10.0.3.1  
hostname\_override: rke-node-2  
user: root  
role:  
- controlplane  
- etcd  
- worker  
- address: 95.217.221.160  
internal\_address: 10.0.1.1  
hostname\_override: rke-node-3  
user: root  
role:  
- controlplane  
- etcd  
- worker

# If set to true, RKE will not fail when unsupported Docker version

# are found

ignore\_docker\_version: false

# Cluster level SSH private key

# Used if no ssh information is set for the node

ssh\_key\_path: ~/.ssh/id\_rsa

# Enable use of SSH agent to use SSH private keys with passphrase

# This requires the environment `SSH_AUTH_SOCK` configured pointing

#to your SSH agent which has the private key added

# ssh\_agent\_auth: true

# List of registry credentials

# If you are using a Docker Hub registry, you can omit the `url`

# or set it to `docker.io`

# is\_default set to `true` will override the system default

# registry set in the global settings

private\_registries:  
# - url: [registry.com](http://registry.com)  
# user: Username  
# password: password  
# is\_default: true

# Bastion/Jump host configuration

bastion\_host:  
# address: x.x.x.x  
# user: ubuntu  
# port: 22  
# ssh\_key\_path: /home/user/.ssh/bastion\_rsa

# or

# ssh\_key: |-

# -----BEGIN RSA PRIVATE KEY-----

# 

# -----END RSA PRIVATE KEY-----

# Set the name of the Kubernetes cluster

cluster\_name: octollenge-dev-hel

kubernetes\_version: v1.17.17-rancher1-1

system\_images:  
# kubernetes: rancher/hyperkube:v1.10.3-rancher2  
# etcd: rancher/coreos-etcd:v3.1.12  
# alpine: rancher/rke-tools:v0.1.9  
# nginx\_proxy: rancher/rke-tools:v0.1.9  
# cert\_downloader: rancher/rke-tools:v0.1.9  
# kubernetes\_services\_sidecar: rancher/rke-tools:v0.1.9  
# kubedns: rancher/k8s-dns-kube-dns-amd64:1.14.8  
# dnsmasq: rancher/k8s-dns-dnsmasq-nanny-amd64:1.14.8  
# kubedns\_sidecar: rancher/k8s-dns-sidecar-amd64:1.14.8  
# kubedns\_autoscaler: rancher/cluster-proportional-autoscaler-amd64:1.0.0  
# pod\_infra\_container: rancher/pause-amd64:3.1

services:  
etcd:  
kube\_api:  
# IP range for any services created on Kubernetes  
# This must match the service\_cluster\_ip\_range in kube-controller  
service\_cluster\_ip\_range: 10.43.0.0/16  
# Expose a different port range for NodePort services  
service\_node\_port\_range: 30000-32767  
pod\_security\_policy: false  
# Add additional arguments to the kubernetes API server  
# This WILL OVERRIDE any existing defaults  
extra\_args:  
# Enable audit log to stdout  
audit-log-path: “-”  
# Increase number of delete workers  
delete-collection-workers: 3  
# Set the level of log output to debug-level  
v: 4  
# Note for Rancher 2 users: If you are configuring Cluster Options  
# using a Config File when creating Rancher Launched Kubernetes,  
# the names of services should contain underscores only:  
# `kube_controller`. This only applies to Rancher v2.0.5 and v2.0.6.  
kube\_controller:  
# CIDR pool used to assign IP addresses to pods in the cluster  
cluster\_cidr: 10.42.0.0/16  
# IP range for any services created on Kubernetes  
# This must match the service\_cluster\_ip\_range in kube-api  
service\_cluster\_ip\_range: 10.43.0.0/16  
kubelet:  
# Base domain for the cluster  
cluster\_domain: cluster.local  
# IP address for the DNS service endpoint  
cluster\_dns\_server: 10.43.0.10  
# Fail if swap is on  
fail\_swap\_on: false  
generate\_serving\_certificate: true  
extra\_args:  
max-pods: 150  
enforce-node-allocatable: “pods”  
# as only the pods rule is enforced above, system+kube reservation is zeroed for 8-1=7 allocatable memory  
system-reserved: “cpu=300m,memory=5Mi,ephemeral-storage=1Gi”  
kube-reserved: “cpu=200m,memory=5Mi,ephemeral-storage=1Gi”  
eviction-hard: “memory.available\<1Gi,nodefs.available\<10%”  
# Optionally define additional volume binds to a service  
extra\_binds:  
- “/usr/libexec/kubernetes/kubelet-plugins:/usr/libexec/kubernetes/kubelet-plugins”

# Currently, only authentication strategy supported is x509.

# You can optionally create additional SANs (hostnames or IPs) to

# add to the API server PKI certificate.

# This is useful if you want to use a load balancer for the

# control plane servers.

authentication:  
strategy: x509  
sans:  
- “10.0.0.7”  
- “167.233.14.241”

# Kubernetes Authorization mode

# Use `mode: rbac` to enable RBAC

# Use `mode: none` to disable authorization

authorization:  
mode: rbac

# If you want to set a Kubernetes cloud provider, you specify

# the name and configuration

cloud\_provider:  
# name: aws

# Add-ons are deployed using kubernetes jobs. RKE will give

# up on trying to get the job status after this timeout in seconds…

addon\_job\_timeout: 60

# Specify network plugin-in (canal, calico, flannel, weave, or none)

network:  
plugin: canal

# Specify DNS provider (coredns or kube-dns)

dns:  
provider: coredns

# Currently only nginx ingress provider is supported.

# To disable ingress controller, set `provider: none`

# `node_selector` controls ingress placement and is optional

ingress:  
provider: nginx  
default\_backend: true  
# node\_selector:  
# app: ingress

# All add-on manifests MUST specify a namespace

addons:

# addons: |-

# —

# apiVersion: v1

# kind: Pod

# metadata:

# name: my-nginx

# namespace: default

# spec:

# containers:

# - name: my-nginx

# image: nginx

# ports:

# - containerPort: 80

addons\_include:  
`

---

<div class="post-metadata">

**Author:** ![Jerry\_Li](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/jerry_li/32/7312_2.png) [@Jerry\_Li](https://forums.suse.com/u/Jerry_Li)\
**Post date:** [March 10, 2021, 5:31am UTC](https://forums.suse.com/t/failed-calling-webhook-cert-manager/19592/2 "2021-03-10T05:31:51Z")

</div>

I have the same issue.  
I recreated the RKE cluster and changed network from “canal” to “calico”. Then this issue did not happen again.