Closed KlavsKlavsen closed 4 months ago
In our case - it turned out to be the etcd server it was trying to connect to - that had the bad cert.. REALLY would have been helpful if it had shared that info
kubeadm certs check-expiration has the info - and shows this etcd cert being expired.. odd thing is normal k8s upgrades didn't re-issue these - but did re-issue the rest (which last until apr 2024).. seems a bug as well
i don't know if any of the apisever maintainers watch this repository. better close this ticket and open a new one in kubernetes/kubernetes.
kubeadm certs check-expiration has the info - and shows this etcd cert being expired.. odd thing is normal k8s upgrades didn't re-issue these - but did re-issue the rest (which last until apr 2024).. seems a bug as well
if upgrade was done by kubeadm this can happen if the etcd version did not change between minor k8s versions. it is by design because etcd upgrade is skipped and with it certs renewal of etcd. you can open a ticket in kubernetes/kubeadm for discussion if you want. i.e. maybe the maintainers team will agree to change it.
the etcd version does change between patch and minor versions of k8s. so as long as you update more often the etcd certs will renew.
The Kubernetes project currently lacks enough contributors to adequately respond to all issues.
This bot triages un-triaged issues according to the following rules:
lifecycle/stale
is appliedlifecycle/stale
was applied, lifecycle/rotten
is appliedlifecycle/rotten
was applied, the issue is closedYou can:
/remove-lifecycle stale
/close
Please send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale
The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.
This bot triages un-triaged issues according to the following rules:
lifecycle/stale
is appliedlifecycle/stale
was applied, lifecycle/rotten
is appliedlifecycle/rotten
was applied, the issue is closedYou can:
/remove-lifecycle rotten
/close
Please send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle rotten
The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.
This bot triages issues according to the following rules:
lifecycle/stale
is appliedlifecycle/stale
was applied, lifecycle/rotten
is appliedlifecycle/rotten
was applied, the issue is closedYou can:
/reopen
/remove-lifecycle rotten
Please send feedback to sig-contributor-experience at kubernetes/community.
/close not-planned
@k8s-triage-robot: Closing this issue, marking it as "Not Planned".
our kube-apiserver just started failing to start.. The log from containerd only says: 2023-12-16T07:35:01.426019865+01:00 stderr F }. Err: connection error: desc = "transport: authentication handshake failed: x509: certificate has expired or is not yet valid: current time 2023-12-16T06:35:01Z is after 2023-12-03T03:37:19Z"
so the cert appearently should have expired on the 3rd of december (and yet it only fails now) - and also - if I check the cert its using :
its not actually run out..
The errorlog could be much more helpful -if it shared exactly which certificate its checking.. (file path - or whatever its got open) - AND Serial number from cert to uniquely identify the one its looking at.. :(
its k8s 1.26.4