unable to load root certificates: unable to parse bytes as PEM block

[seb-835]

Hi ,
i got some trouble using tridentctl-protect, while tridentctl is working fine.
Can you help checking what i made wrong.

Trident-protect was installed using:

helm install trident-protect netapp-trident-protect/trident-protect --set clusterName=preprod-wkl-01 --version 100.2510.0 --create-namespace --namespace trident-protect

Best.

$ kubectl config get-contexts
CURRENT   NAME             CLUSTER          AUTHINFO         NAMESPACE
*         preprod-wkl-01   preprod-wkl-01   preprod-wkl-01

$ kubectl get nodes
NAME                                STATUS   ROLES                              AGE    VERSION
preprod-wkl-01-pool01-k7snn-8q6mq   Ready    control-plane,etcd,master,worker   403d   v1.30.3+rke2r1
preprod-wkl-01-pool01-k7snn-hccg6   Ready    control-plane,etcd,master,worker   403d   v1.30.3+rke2r1
preprod-wkl-01-pool01-k7snn-sjd5f   Ready    control-plane,etcd,master,worker   403d   v1.30.3+rke2r1

$ kubectl get pods -n trident-protect
NAME                                                  READY   STATUS    RESTARTS   AGE
trident-protect-controller-manager-676d774d5d-qg52x   1/1     Running   0          4h

$ kubectl get sc
NAME              PROVISIONER             RECLAIMPOLICY   VOLUMEBINDINGMODE   ALLOWVOLUMEEXPANSION   AGE
ontap (default)   csi.trident.netapp.io   Delete          Immediate           true                   406d

$tridentctl version -n trident
+----------------+----------------+-------------+
| SERVER VERSION | CLIENT VERSION | ACP VERSION |
+----------------+----------------+-------------+
| 25.10.0        | 25.10.0        | 25.10.0     |
+----------------+----------------+-------------+

$tridentctl get backend -n trident
+---------------+----------------+--------------------------------------+--------+------------+---------+
|     NAME      | STORAGE DRIVER |                 UUID                 | STATE  | USER-STATE | VOLUMES |
+---------------+----------------+--------------------------------------+--------+------------+---------+
| svmrancherhds | ontap-nas      | 089bc3ba-e086-438e-8038-13f9e9d5dd08 | online | normal     |       9 |
+---------------+----------------+--------------------------------------+--------+------------+---------+

$ tridentctl-protect version
25.10.0

$ tridentctl-protect get all -A 
application:
2025/12/02 16:01:43 unable to load root certificates: unable to parse bytes as PEM block


$ tridentctl-protect get all -A --context preprod-wkl-01
application:
2025/12/02 16:01:43 unable to load root certificates: unable to parse bytes as PEM block

[seb-835]

Hi, I can confirm that tridentctl-protect is unable to read the kubeconfig file generated by Rancher Manager.
(while kubectl and tridentctl are able to use it).

The kubeconfig needs to be adjusted to work correctly:

# Set the kubeconfig environment variable
$> export KUBECONFIG=/home/admin/kubeconfig-rancher

# Check tridentctl version, using kubeconfig, it works well
$>  tridentctl version -n trident
+----------------+----------------+-------------+
| SERVER VERSION | CLIENT VERSION | ACP VERSION |
+----------------+----------------+-------------+
| 25.10.0        | 24.06.0        | 25.10.0     |
+----------------+----------------+-------------+

# Try to get tridentctl-protect info (fails)
$> tridentctl-protect info -n trident-protect
2025/12/16 14:04:15 unable to load root certificates: unable to parse bytes as PEM block

# Clean and re-encode the certificate-authority-data
$>  CA=$(kubectl config view --raw -o jsonpath='{.clusters[0].cluster.certificate-authority-data}' \
| base64 -d \
| openssl x509 -outform PEM \
| base64 -w 0)

# Replace the certificate-authority-data in the kubeconfig
$> sed -i "s|^\s*certificate-authority-data:.*|certificate-authority-data: $CA|" $KUBECONFIG

# Retry tridentctl-protect info (works)
$> tridentctl-protect info -n trident-protect
kube-system UID: 9bca0ab6-468c-48fd-8489-1fbb6a4464e0
Trident Protect version: 25.10.0
CLI version: 25.10.0
Scheduled daily autoSupport upload enabled: true

[seb-835]

Hey NetApp team,

I was expecting some feedback on this issue — even a brief comment or a message saying that you are working on a fix.

I noticed that my workaround has been added to your knowledge base:
https://kb.netapp.com/Cloud/Astra/Trident/cli_trindent-protect_doesn't_work_in_a_Rancher_environment

However, there has been no acknowledgment, discussion, or follow-up on the original report.

That’s not really fair, and it’s not aligned with basic community or open-source practices.
If contributions from the community are reused without feedback or interaction, it undermines the whole idea of collaboration.

If the intent is only to consume community input without participating in the discussion, then opening a GitHub repository sends the wrong message.

I would appreciate a proper response, clarification on the status of the issue, or at least an acknowledgment of the contribution.

Best regards,

[wgerlach]

Hi @seb-835 ,
Thank you for your feedback and I apologize for the late reply. From my understanding this knowledge base article was created based on feedback from a customer support ticket, not from this github issue. We have not yet been able to reproduce the issue. If you could provide us more details, e.g. the specific Rancher version you used, that would be helpful. Thanks