search

jupyterhub / zero-to-jupyterhub-k8s

Helm Chart & Documentation for deploying JupyterHub on Kubernetes
https://zero-to-jupyterhub.readthedocs.io
Other
1.55k stars 794 forks source link

TLS connection error between helm and tiller #965

Closed vishal49naik49 closed 6 years ago

vishal49naik49 commented 6 years ago

Hi,

I am getting below error while running helm commands:

$ helm ls --tls Error: forwarding ports: error upgrading connection: unable to upgrade connection: Unauthorized

Please advise!

Thanks!

minrk commented 6 years ago

Does helm ls work? Can you kubectl get pod?

consideRatio commented 6 years ago

Version of k8s and helm is also relevant, and how / where the k8s cluster is setup.

vishal49naik49 commented 6 years ago

Kubectl port-forward command itself gives me same error. I guess it is not related to helm. Any chance I can get feedback on the port-forward error here in this forum?

Thanks, Vishal

consideRatio commented 6 years ago

@vishal49naik49, this is not related to this repo's Helm chart, but I figured I could help out anyhow briefly.

My take on the situation though is depending a lot on the answers to both mine and @minrk's questions above.

vishal49naik49 commented 6 years ago

kubectl get pods, get nodes, get svc - work just fine kubectl port-forward gives me "error: forwarding ports: error upgrading connection: unable to update connection: Unauthorized"

consideRatio commented 6 years ago

About the cluster setup then? You may need to do a step like the one here in step 7: https://zero-to-jupyterhub-with-kubernetes.readthedocs.io/en/latest/google/step-zero-gcp.html

vishal49naik49 commented 6 years ago

Tried binding the User to a role as per the instructions from step7. Still same error. My masters are behind a load balancer (tried connecting bypassing lb as well) and api server connection is over https.

Thanks, Vishal

vishal49naik49 commented 6 years ago

I can see x509: certificate specifies an incompatible key usage in the kubelet logs.

I am trying as an admin user Please advise

Thanks!

vishal49naik49 commented 6 years ago

I was able to fix this issue actually. The kubelet client cert supplied to the api service had ‘server auth’. Changed it to client auth and it worked like charm. Closing!

seamanjiang commented 5 years ago

I was able to fix this issue actually. The kubelet client cert supplied to the api service had ‘server auth’. Changed it to client auth and it worked like charm. Closing!

Hi vishal49naik49, i have met the same problem and change kubectl's config ~/kube/config from server auth -> client auth, but it doesn't work...

Haven u some advice? Thanks!

ca-config.json { "signing": { "default": { "expiry": "87600h" }, "profiles": { "kubernetes": { "usages": [ "signing", "key encipherment", "client auth" ], "expiry": "8760h" } } } }