Unable to setup krustlet on k3d

[deepu105]

While trying to install Krustlet on a k3d cluster I'm facing some issues. I was following the Guide for microK8s and trying to do similar setup in k3d. Here is what I did and the error encountered

Krustlet version used: 1.0.0-alpha.1
k3d version v5.0.1
k3s version latest (default)
OS: Fedora 35

1. Setup a k3d cluster with bootstrap-token-auth enabled

k3d cluster create wasm-test \
--k3s-arg "--kube-apiserver-arg=enable-bootstrap-token-auth@server:0"

2. Create bootstrap config

curl https://raw.githubusercontent.com/krustlet/krustlet/main/scripts/bootstrap.sh | /bin/bash

3. Download Krustlet

curl -O https://krustlet.blob.core.windows.net/releases/krustlet-v1.0.0-alpha.1-linux-amd64.tar.gz
tar -xzf krustlet-v1.0.0-alpha.1-linux-amd64.tar.gz

4. Install Krustlet

KUBECONFIG=~/.krustlet/config/kubeconfig \                           
  ./krustlet-wasi \                     
  --node-ip=127.0.0.1 \ 
  --node-name=krustlet \
  --bootstrap-file=${HOME}/.krustlet/config/bootstrap.conf

But I got User "system:bootstrap:y16pzf" cannot create resource "certificatesigningrequests" in API group "certificates.k8s.io" at the cluster scope

Full error

Error: ApiError: certificatesigningrequests.certificates.k8s.io is forbidden: User "system:bootstrap:y16pzf" cannot create resource "certificatesigningrequests" in API group "certificates.k8s.io" at the cluster scope: Forbidden (ErrorResponse { status: "Failure", message: "certificatesigningrequests.certificates.k8s.io is forbidden: User \"system:bootstrap:y16pzf\" cannot create resource \"certificatesigningrequests\" in API group \"certificates.k8s.io\" at the cluster scope", reason: "Forbidden", code: 403 })

Caused by:
    certificatesigningrequests.certificates.k8s.io is forbidden: User "system:bootstrap:y16pzf" cannot create resource "certificatesigningrequests" in API group "certificates.k8s.io" at the cluster scope: Forbidden

5. Added a ClusterRoleBinding to see if that helps

kubectl apply -f - <<EOF                
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:                                 
  name: kubeadm:node-autoapprove-bootstrap
roleRef:                             
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole                                                     
  name: system:certificates.k8s.io:certificatesigningrequests:nodeclient
subjects:    
- kind: Group                                          
  name: system:bootstrappers:kubeadm:default-node-token
EOF

But its still gives the same error

Did I miss something or is k3d not supported? Will be happy to provide more info if needed