I'm using kubernetes v1.5.2, and have implemented api over tls. Problem is that while deploying kube-dns I'm getting message on minion as:

Mar 23 10:06:27 node01 journal: I0323 09:06:27.007407       1 dns.go:172]   Ignoring error while waiting for service default/kubernetes: Get  https://10.254.0.1:443/api/v1/namespaces/default/services/kubernetes: x509: cannot validate certificate for 10.254.0.1 because it doesn't contain any IP SANs. Sleeping 1s before retrying.

I've tried by using curl, from another pod and it fails without --insecure switch, whit it it is ok.

I understand that 10.254.0.1:443 actually serves certificate from master node (api on port 6443)(192.168.0.200), but how to resolve it, that 10.254.0.1 serves its valid certificate.

Here is description from clusterip api: [root@master01 dns]# kubectl describe service kubernetes Name: kubernetes Namespace: default Labels: component=apiserver provider=kubernetes Selector: Type: ClusterIP IP: 10.254.0.1 Port: https 443/TCP Endpoints: 192.168.2.200:6443 Session Affinity: ClientIP

Thanks Dubravko