x509-certificate-exporter CrashLoopBackOff on RKE2/K3s cluster

[n0where3an]

Environment:

• Kubernetes cluster: RKE2 v1.30.14+rke2r2 (via Rancher)
• Cluster size: 5 nodes (all control-plane+etcd+worker)
• x509-certificate-exporter version: 3.19.1
• Installation method: Helm chart

Problem:
The x509-certificate-exporter pod starts but immediately crashes with CrashLoopBackOff. The container stops right after fetching the Kubernetes API server version, before it can start the HTTP server on port 9793.

Logs show:

time=2025-10-16T19:18:22.998Z level=INFO msg="Starting exporter" version=3.19.1 revision=11d8af41e6dc685344114d10a9cb7c0cdc5adf78 build_time=2025-06-19T19:55:17
time=2025-10-16T19:18:23.029Z level=INFO msg="GOMEMLIMIT is updated" package=[github.com/KimMachineGun/automemlimit/memlimit](https://github.com/KimMachineGun/automemlimit/memlimit) GOMEMLIMIT=141557760 previous=9223372036854775807
time=2025-10-16T19:18:23.029Z level=INFO msg="Attempting to load in-cluster Kubernetes configuration"
time=2025-10-16T19:18:23.029Z level=INFO msg="Loaded Kubernetes configuration" apiserver_host=[https://10.16.0.1:443](https://10.16.0.1/)
time=2025-10-16T19:18:23.029Z level=INFO msg="Fetching Kubernetes API server version"
time=2025-10-16T19:18:23.033Z level=INFO msg="Got Kubernetes API server version" apiserver_version=v1.30.14+rke2r2

Configuration:

args:
  - --watch-kube-secrets
  - --secret-type=kubernetes.io/tls:tls.crt
  - --max-cache-duration=300s
  - --listen-address=:9793
  - --debug

What I've tried:
Increased resources (memory up to 1Gi, CPU up to 1 core)
Extended liveness/readiness probe initial delays (up to 120s)
Verified RBAC permissions - service account can list/get secrets
Used --debug flag but no additional logs appear before crash
Checked for container OOM kills - not occurring
Network connectivity to API server is working

Symptoms:
Container exits with code 2 after ~11 seconds
Liveness/readiness probes fail (connection refused on port 9793)
No errors and debug messages in logs
Multiple pod replicas show same behavior

Questions:

1. Are there known issues with RKE2/K3s clusters?
2. Could this be related to the number of secrets in the cluster?
3. Is there a way to get more verbose logging to see what happens after API version fetch?
4. Are there specific securityContext settings required for RKE2?

The exporter works fine in other clusters, but specifically fails in this RKE2 environment. Any debugging suggestions would be appreciated!