kubectl unable to connect to server: x509: certificate signed by unknown authority

问题

i'm getting an error when running kubectl one one machine (windows)

the k8s cluster is running on CentOs 7 kubernetes cluster 1.7 master, worker

Here's my .kube\config

  
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: REDACTED
    server: https://10.10.12.7:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: system:node:localhost.localdomain
  name: system:node:localhost.localdomain@kubernetes
current-context: system:node:localhost.localdomain@kubernetes
kind: Config
preferences: {}
users:
- name: system:node:localhost.localdomain
  user:
    client-certificate-data: REDACTED
    client-key-data: REDACTED

the cluster is built using kubeadm with the default certificates on the pki directory

kubectl unable to connect to server: x509: certificate signed by unknown authority

回答1:

I my case I resolved this issue copying the kubelet configuration to my home kube config

cat /etc/kubernetes/kubelet.conf > ~/.kube/config

回答2:

One more solution in case it helps anyone:

My scenario:

using Windows 10
Kubernetes installed via Docker Desktop ui 2.1.0.1
the installer created config file at ~/.kube/config
the value in ~/.kube/config for server is https://kubernetes.docker.internal:6443
using proxy

Issue: kubectl commands to this endpoint were going through the proxy, I figured it out after running kubectl --insecure-skip-tls-verify cluster-info dump which displayed the proxy html error page.

Fix: just making sure that this URL doesn't go through the proxy, in my case in bash I used export no_proxy=$no_proxy,*.docker.internal

回答3:

I just want to share, sorry I wasn't able to provide this earlier as I just realized this is causing

so on the master node we're running a kubectl proxy

kubectl proxy --address 0.0.0.0 --accept-hosts '.*'

I stopped this and voila the error was gone.

I'm now able to do

    kubectl get nodes
NAME                    STATUS    AGE       VERSION
centos-k8s2             Ready     3d        v1.7.5
localhost.localdomain   Ready     3d        v1.7.5

I hope this helps those who stumbled upon this scenario

回答4:

Run:

gcloud container clusters get-credentials standard-cluster-1 --zone us-central1-a --project devops1-218400

here devops1-218400 is my project name. Replace it with your project name.

回答5:

In case of the error you should export all the kubecfg which contains the certs. kops export kubecfg "your cluster-name and export KOPS_STATE_STORE=s3://"paste your S3 store" .

Now you should be able to access and see the resources of your cluster.

回答6:

On GCP

check: gcloud version

-- localMacOS# gcloud version

Run: --- localMacOS# gcloud container clusters get-credentials 'clusterName' \ --zone=us-'zoneName'

Get clusterName and zoneName from your console -- here: https://console.cloud.google.com/kubernetes/list?

ref: .x509 @market place deployments on GCP #Kubernetes

回答7:

I got the same error while running $ kubectl get nodes as a root user. I fixed it by exporting kubelet.conf to environment variable.

$ export KUBECONFIG=/etc/kubernetes/kubelet.conf
$ kubectl get nodes

来源：https://stackoverflow.com/questions/46234295/kubectl-unable-to-connect-to-server-x509-certificate-signed-by-unknown-authori

标签

ssl

Kubernetes

kubectl