Cluster check in Kubernetes runtime fails with 'Unknown CA' error

[crkent]

OS: macOS 15.3.1
OTP Version: 27
Elixir Version: 1.18.1
Livebook Version: 0.15.2

I was attempting to test the Kubernetes Runtime for Livebook with a local k3s cluster that I run for development (the k3s cluster is run under colima). While the cluster was automatically detected from the ~/.kube/config file, it appears that the :cluster_check operation (executed by the runtime) fails to complete proper TLS authentication.

Specifically, the k3s CA root does not appear to be appropriately configured in the request -- it fails with the error "Fatal - Unknown CA", shown below.

This behavior was somewhat perplexing: given that a :kino_k8s Smart Cell successfully connected to the local cluster when used in a notebook running under the same Livebook instance.

To further characterize the behavior of the issue, I extracted the root certificate for the k3s cluster via the command

  cat ~/.kube/config |
  yq '.clusters[] | select( .name == "colima" ) | .cluster.certificate-authority-data' |
  base64 -d |
  step certificate format > cluster_root.pem

and used LIVEBOOK_CACERTFILE=cluster_root.pem to provide the CA root to the Livebook instance. Unfortunately, this did not fix the issue, nor alter the behavior of the error.

It appears cert errors have been observed before when connecting to local k3s clusters with :kino_k8s. Thus, I'll mention @mruoss in case he can help shed some light on this issue.

Thanks for any help that you can provide!