K
Q

Invalid x509 certificate for kubernetes master

9/22/2017

I am trying reach my k8s master from my workstation. I can access the master from the LAN fine but not from my workstation. The error message is:

% kubectl --context=employee-context get pods
Unable to connect to the server: x509: certificate is valid for 10.96.0.1, 10.161.233.80, not 114.215.201.87

How can I do to add 114.215.201.87 to the certificate? Do I need to remove my old cluster ca.crt, recreate it, restart whole cluster and then resign client certificate? I have deployed my cluster with kubeadm and I am not sure how to do these steps manually.

-- user1208081
kubeadm
kubernetes

Similar Questions

How to make connection with Google Cloud SQL using Google Container Engine?
Advanced home network setup to secure dev. Kubernetes cluster
ASP.NET Core 2.0 Error starting Kestrel in Kubernetes
Permission denied when chown on elasticsearch data directory in kubernetes statefulset

7 Answers

2/13/2019

Use the following command:

kubeadm init phase certs all
-- KlSoft
Source: StackOverflow
9/22/2017

One option is to tell kubectl that you don't want the certificate to be validated. Obviously this brings up security issues but I guess you are only testing so here you go:

kubectl --insecure-skip-tls-verify --context=employee-context get pods

The better option is to fix the certificate. Easiest if you reinitialize the cluster by running kubeadm reset on all nodes including the master and then do

kubeadm init --apiserver-cert-extra-sans=114.215.201.87

It's also possible to fix that certificate without wiping everything, but that's a bit more tricky. Execute something like this on the master as root:

rm /etc/kubernetes/pki/apiserver.*
kubeadm alpha phase certs selfsign --apiserver-advertise-address=0.0.0.0 --cert-altnames=10.161.233.80 --cert-altnames=114.215.201.87
docker rm `docker ps -q -f 'name=k8s_kube-apiserver*'`
systemctl restart kubelet
-- Janos Lenart
Source: StackOverflow
11/14/2017

This command for new kubernetes >=1.8:

rm /etc/kubernetes/pki/apiserver.*
kubeadm alpha phase certs all --apiserver-advertise-address=0.0.0.0 --apiserver-cert-extra-sans=10.161.233.80,114.215.201.87
docker rm -f `docker ps -q -f 'name=k8s_kube-apiserver*'`
systemctl restart kubelet

Also whould be better to add dns name into --apiserver-cert-extra-sans for avoid issues like this in next time.

-- kvaps
Source: StackOverflow
2/20/2019

For kubeadm v1.13.3

rm /etc/kubernetes/pki/apiserver.*
kubeadm init phase certs all --apiserver-advertise-address=0.0.0.0 --apiserver-cert-extra-sans=114.215.201.87
docker rm -f `docker ps -q -f 'name=k8s_kube-apiserver*'`
systemctl restart kubelet
-- Marcin Król
Source: StackOverflow
7/13/2018

Issue cause: Your configs at $HOME/.kube/ are present with your old IP address.

Try running,

rm $HOME/.kube/* -rf
cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
chown $(id -u):$(id -g) $HOME/.kube/config
-- Sarath kumar S
Source: StackOverflow
3/8/2019

If you used kubespray to provision your cluster then you need to add a 'floating ip' (in your case its '114.215.201.87'). This variable is called supplementary_addresses_in_ssl_keys in the group_vars/k8s-cluster/k8s-cluster.yml file. After updating it, just re-run your ansible-playbook -b -v -i inventory/<WHATEVER-YOU-NAMED-IT>/hosts.ini cluster.yml.

NOTE: you still have to remove all the apiserver certs (rm /etc/kubernetes/pki/apiserver.*) from each of your master nodes prior to running!

-- Marc
Source: StackOverflow
11/3/2018

For Kubernetes 1.12.2/CentOS 7.4 the sequence is as follows:

rm /etc/kubernetes/pki/apiserver.*
kubeadm alpha phase certs all --apiserver-advertise-address=0.0.0.0 --apiserver-cert-extra-sans=51.158.75.136
docker rm -f `docker ps -q -f 'name=k8s_kube-apiserver*'`
systemctl restart kubelet
-- zjor
Source: StackOverflow