Repository navigation
Kubeconfig generated by the CKS has ssl issues #11579
Description
problem
Kubeconfig generated by the CKS has SSL issues
versions
ACS 4.21
The steps to reproduce the bug
- Register a kubernetes ISO
https://download.cloudstack.org/cks/setup-v1.33.1-calico-x86_64.iso
-
Deploy a CKS cluster with the above k8s version
-
Get the kube config
-
Connect to the k8s cluster with kubeconfig
[root@ref-trl-9330-k-Mol8-kiran-chavala-mgmt1 ~]# kubectl get nodes
E0826 08:38:22.972280 24772 memcache.go:265] "Unhandled Error" err="couldn't get current server API group list: Get \"https://10.0.54.63:6443/api?timeout=32s\": tls: failed to verify certificate: x509: certificate is valid for 10.96.0.1, 10.1.1.88, not 10.0.54.63"
E0826 08:38:22.983236 24772 memcache.go:265] "Unhandled Error" err="couldn't get current server API group list: Get \"https://10.0.54.63:6443/api?timeout=32s\": tls: failed to verify certificate: x509: certificate is valid for 10.96.0.1, 10.1.1.88, not 10.0.54.63"
E0826 08:38:22.993498 24772 memcache.go:265] "Unhandled Error" err="couldn't get current server API group list: Get \"https://10.0.54.63:6443/api?timeout=32s\": tls: failed to verify certificate: x509: certificate is valid for 10.96.0.1, 10.1.1.88, not 10.0.54.63"
E0826 08:38:23.006959 24772 memcache.go:265] "Unhandled Error" err="couldn't get current server API group list: Get \"https://10.0.54.63:6443/api?timeout=32s\": tls: failed to verify certificate: x509: certificate is valid for 10.96.0.1, 10.1.1.88, not 10.0.54.63"
E0826 08:38:23.017774 24772 memcache.go:265] "Unhandled Error" err="couldn't get current server API group list: Get \"https://10.0.54.63:6443/api?timeout=32s\": tls: failed to verify certificate: x509: certificate is valid for 10.96.0.1, 10.1.1.88, not 10.0.54.63"
Unable to connect to the server: tls: failed to verify certificate: x509: certificate is valid for 10.96.0.1, 10.1.1.88, not 10.0.54.63
kubectl get nodes --v=8
I0904 14:20:46.471420 42826 loader.go:402] Config loaded from file: /Users/kiranchavala/.kube/config
I0904 14:20:46.472904 42826 envvar.go:172] "Feature gate default state" feature="ClientsAllowCBOR" enabled=false
I0904 14:20:46.472922 42826 envvar.go:172] "Feature gate default state" feature="ClientsPreferCBOR" enabled=false
I0904 14:20:46.472927 42826 envvar.go:172] "Feature gate default state" feature="InformerResourceVersion" enabled=false
I0904 14:20:46.472934 42826 envvar.go:172] "Feature gate default state" feature="WatchListClient" enabled=false
I0904 14:20:46.479120 42826 helper.go:113] "Request Body" body=""
I0904 14:20:46.479944 42826 round_trippers.go:470] GET https://10.0.57.147:6443/api/v1/nodes?limit=500
I0904 14:20:46.479950 42826 round_trippers.go:476] Request Headers:
I0904 14:20:46.479956 42826 round_trippers.go:480] Accept: application/json;as=Table;v=v1;g=meta.k8s.io,application/json;as=Table;v=v1beta1;g=meta.k8s.io,application/json
I0904 14:20:46.479959 42826 round_trippers.go:480] User-Agent: kubectl/v1.32.1 (darwin/arm64) kubernetes/e9c9be4
I0904 14:20:46.899083 42826 round_trippers.go:581] Response Status: in 419 milliseconds
I0904 14:20:46.899138 42826 round_trippers.go:584] Response Headers:
I0904 14:20:46.899396 42826 helpers.go:264] Connection error: Get https://10.0.57.147:6443/api/v1/nodes?limit=500: tls: failed to verify certificate: x509: certificate is valid for 10.96.0.1, 10.1.1.93, not 10.0.57.147
Unable to connect to the server: tls: failed to verify certificate: x509: certificate is valid for 10.96.0.1, 10.1.1.93, not 10.0.57.147
Workaround
Pass the following flag
kubectl --insecure-skip-tls-verify=true
What to do about it?
End user should be able to connect to the cluster without passing any flag
This issue was not present earlier
Activity
weizhouapache commentedon Sep 16, 2025
@kiranchavala
can you confirm the ACS version ?
kiranchavala commentedon Sep 16, 2025
@weizhouapache 4.21
weizhouapache commentedon Sep 16, 2025
thanks @kiranchavala
moving to 4.22 milestone
it might be related to CKS improvements in 4.21
cc @nvazquez @Pearl1594
kiranchavala commentedon Sep 16, 2025
@weizhouapache i believe the issue is with 4.20.1 also, let me confirm again
weizhouapache commentedon Sep 16, 2025
ok, thanks @kiranchavala
kiranchavala commentedon Sep 16, 2025
@weizhouapache the issue is only with 4.21 release , working fine on 4.20.1
weizhouapache commentedon Sep 16, 2025
good, thanks for checking @kiranchavala
yadvr commentedon Sep 26, 2025
@weizhouapache @kiranchavala fwiw, I tested by creating a aarch64 CKS cluster on 4.21 using v1.33.0-calico arm64 and it works for me: (though this was on a shared network)
yadvr commentedon Sep 26, 2025
I couldn't test x86 cks cluster on 4.21, was hitting #11734
weizhouapache commentedon Sep 26, 2025
thanks @rohityadavcloud
// Updated:
The issue only happens with Isolated network, as certificate is valid for control node IP, but invalid for CKS public IP
for shared network, the CKS Public IP is same as control node IP, so it works
Jayd603 commentedon Mar 31, 2026
Does anyone know how to resolve this manually? Re-gen certs/kube files enough?