I am working on deploying a Kubernetes cluster to AWS and I am having a certificate issue. I am using Chrome.
And I get this error message when I try to access it:
I can see what I guess is a Kubernetes dashboard if I go through Firefox though.
k8 yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: project # name of the deployment
labels: # these labels apply to the deployment
app: project
component: project
spec:
strategy:
type: Recreate
selector:
matchLabels:
app: project
template:
metadata:
labels: # these labels apply to our container
app: project
component: project
spec:
containers:
- name: project # name of our container
image: id.dkr.ecr.region.amazonaws.com/project_api:latest # the URI that we got from ECR
env:
- name: DB_URL
value: project.1234.region.rds.amazonaws.com # URL of our database endpoint
- name: DB_USERNAME
valueFrom:
secretKeyRef:
name: db-creds
key: username # use the encoded username from the K8s secret db-creds
- name: DB_PASSWORD
valueFrom:
secretKeyRef:
name: db-creds
key: password # use the encoded password from the K8s secret db-creds
- name: DB_NAME
value: projectDB # our DB is named projectDB
ports:
- containerPort: 3000 # expose the running contianer on port 3000
name: projectloadbalance.yml
apiVersion: v1
kind: Service
metadata:
name: load-balancer
labels:
app: project
spec:
selector:
app: project
type: LoadBalancer
ports:
- nodePort: 31000
port: 3000
targetPort: 3000In Firefox. I was expecting to be able to access it from port 3000. URLENDPOINT:3000 timesout though.
Any idea how I can access the my app ? Any idea what I need to do to get around the ssl cert issue ?
That URL is the API for your EKS control plane, and not the LoadBalancer for the Service of load-balancer; if you run kubectl -n default get -o yaml svc load-balancer it will likely show you the actual DNS name for the Load Balancer that it created, if any (since that Service is a request for a LoadBalancer and your EKS cluster may not have the IAM permissions, or your Account may not have the quota to fulfill the request)
You can tell it's the EKS ELB and not your service's ELB not only from the blatant .eks in the domain name -- something it will for sure not do when it creates your load balancer -- but also from the CN of the SSL certificate it presented:
* subject: CN=kube-apiserver
* start date: May 7 20:52:30 2020 GMT
* expire date: May 7 20:56:46 2021 GMT
* issuer: CN=kubernetes