I have Container Linux by CoreOS alpha (1284.2.0) and I try to install kubernetes 1.5.2 on.
I notice that the kube-proxy
pod fails and I searched and I noticed that the api-server
manifest might not be configured properly.
I configured kubectl
on my mac pro desktop using the documentation at https://coreos.com/kubernetes/docs/latest/configure-kubectl.html
when I execute kubectl get nodes
I get error: You must be logged in to the server (the server has asked for the client to provide credentials)
.
so I try testing with curl. the server's hostname is coreos-2.tux-in.com
.
ufk-osx-music:~ ufk$ curl http://coreos-2.tux-in.com:8080
curl: (7) Failed to connect to coreos-2.tux-in.com port 8080: Connection refused
ufk-osx-music:~ ufk$ curl https://coreos-2.tux-in.com
curl: (60) SSL certificate problem: Invalid certificate chain
More details here: https://curl.haxx.se/docs/sslcerts.html
curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.
ufk-osx-music:~ ufk$ curl --insecure https://coreos-2.tux-in.com
Unauthorized
this is my kube-apiserver.yaml
:
apiVersion: v1
kind: Pod
metadata:
name: kube-apiserver
namespace: kube-system
spec:
hostNetwork: true
containers:
- name: kube-apiserver
image: quay.io/coreos/hyperkube:v1.5.2_coreos.0
command:
- /hyperkube
- apiserver
- --bind-address=0.0.0.0
- --etcd-servers=http://127.0.0.1:4001
- --allow-privileged=true
- --service-cluster-ip-range=10.3.0.0/24
- --secure-port=443
- --advertise-address=10.79.218.2
- --admission-
control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota
- --tls-cert-file=/etc/kubernetes/ssl/apiserver.pem
- --tls-private-key-file=/etc/kubernetes/ssl/apiserver-key.pem
- --client-ca-file=/etc/kubernetes/ssl/ca.pem
- --service-account-key-file=/etc/kubernetes/ssl/apiserver-key.pem
- --runtime-config=extensions/v1beta1/networkpolicies=true
- --anonymous-auth=false
livenessProbe:
httpGet:
host: 127.0.0.1
port: 8080
path: /healthz
initialDelaySeconds: 15
timeoutSeconds: 15
ports:
- containerPort: 443
hostPort: 443
name: https
- containerPort: 8080
hostPort: 8080
name: local
volumeMounts:
- mountPath: /etc/kubernetes/ssl
name: ssl-certs-kubernetes
readOnly: true
- mountPath: /etc/ssl/certs
name: ssl-certs-host
readOnly: true
volumes:
- hostPath:
path: /etc/kubernetes/ssl
name: ssl-certs-kubernetes
- hostPath:
path: /usr/share/ca-certificates
name: ssl-certs-host
and this is my kube-proxy.yaml
:
apiVersion: v1
kind: Pod
metadata:
name: kube-proxy
namespace: kube-system
spec:
hostNetwork: true
containers:
- name: kube-proxy
image: quay.io/coreos/hyperkube:v1.5.2_coreos.0
command:
- /hyperkube
- proxy
- --master=http://127.0.0.1:8080
securityContext:
privileged: true
volumeMounts:
- mountPath: /etc/ssl/certs
name: ssl-certs-host
readOnly: true
volumes:
- hostPath:
path: /usr/share/ca-certificates
name: ssl-certs-host
and this is the controller's kubeconfig file controler-kubeconfig.yaml
:
current-context: tuxin-coreos-context
apiVersion: v1
clusters:
- cluster:
server: http://127.0.0.1:8080
name: tuxin-coreos-cluster
contexts:
- context:
cluster: tuxin-coreos-cluster
name: tuxin-coreos-context
kind: Config
preferences:
colors: true
users:
- name: kubelet
user:
client-certificate: /etc/kubernetes/ssl/apiserver.pem
client-key: /etc/kubernetes/ssl/apiserver-key.pem
any information regarding the issue would be greatly appreciated!
welp in general I wasn't using the proper credentials in .kube/config
file. and I also wasn't using the same name of cluster and context that I typed in the controller's kubeconfig.
this is the working .kube/config
file:
apiVersion: v1
clusters:
- cluster:
certificate-authority: /Users/ufk/Projects/tuxin-coreos/kubernetes/certs/ca.pem
server: https://coreos-2.tux-in.com
name: tuxin-coreos-cluster
contexts:
- context:
cluster: tuxin-coreos-cluster
user: default-admin
name: tuxin-coreos-context
current-context: tuxin-coreos-context
kind: Config
preferences: {}
users:
- name: default-admin
user:
username: kubelet
client-certificate: /Users/ufk/Projects/tuxin-coreos/kubernetes/certs/client.pem
client-key: /Users/ufk/Projects/tuxin-coreos/kubernetes/certs/client-key.pem
my controller's kubeconfig:
current-context: tuxin-coreos-context
apiVersion: v1
clusters:
- cluster:
server: http://127.0.0.1:8080
name: tuxin-coreos-cluster
contexts:
- context:
cluster: tuxin-coreos-cluster
name: tuxin-coreos-context
kind: Config
preferences:
colors: true
users:
- name: kubelet
user:
client-certificate: /etc/kubernetes/ssl/apiserver.pem
client-key: /etc/kubernetes/ssl/apiserver-key.pem