microk8s, DEVOPS: unable to connect to server: x509: certificate valid for <internal IP>, not valid for <external IP>


Daniel

I have a microk8s cluster on an ubuntu laptop. I want to apply deploy yaml file on it from azure devops pipeline.

I've successfully defined a Kubernetes service connection in my devops and it's validated. Although when I try to apply the yaml file I get these lines

/usr/bin/kubectl apply -f /home/vsts/work/1/s/devops/deploymen.yaml -o json


##[error]Unable to connect to the server: x509: certificate is valid for 127.0.0.1, 10.152.183.1, 192.168.50.69, 172.17.0.1, 10.1.80.0, not <my external IP>

192.168.50.69 is the ip of the laptop in my network

Where should I add my external IP?

edit:

I found Authentication and Authorization and edited it /var/snap/microk8s/current/certs/csr.conf.templateso it now contains my IP.

The article says:

After the change, apiserver-kicker will automatically detect the difference, generate a new certificate and restart the apiserver. Your DNS server settings and kubeconfig files must be updated appropriately.

Certificates in the certificate authority data /var/snap/microk8s/current/certs/ca.crtnow look the same as from microk8s config

I also updated the kubeconfig as above

But still no luck!

Mariusz K.

I reproduced your problem and the solution seems to be to add the certificate in the kubeconfig file or skip the tls verification.

You can do it by adding insecure-skip-tls-verify: trueto the kubeconfig file , it looks like this:

- cluster:
    insecure-skip-tls-verify: true
    server: https://<master_ip>:<port>

Or modify kubeconfigyour microk8s cluster and change the server: https://127.0.0.1:16443pair server: https://<master_ip>:16443and copy it to the desired host from the access cluster.

Related


Join x509: Certificate expired or not yet valid

sfgroups When joining a centos 7 node to cluster 1.9.0, the kubeadm joincommand shows this error message. Failed to request cluster info, will try again: [Get https://10.10.10.10:6443/api/v1/namespaces/kube-public/configmaps/cluster-info: x509: certificate has

Join x509: Certificate expired or not yet valid

sfgroups When joining a centos 7 node to cluster 1.9.0, the kubeadm joincommand shows this error message. Failed to request cluster info, will try again: [Get https://10.10.10.10:6443/api/v1/namespaces/kube-public/configmaps/cluster-info: x509: certificate has

Join x509: Certificate expired or not yet valid

sfgroups When joining a centos 7 node to cluster 1.9.0, the kubeadm joincommand shows this error message. Failed to request cluster info, will try again: [Get https://10.10.10.10:6443/api/v1/namespaces/kube-public/configmaps/cluster-info: x509: certificate has

Create a valid external ip in the network interface

Flavio Castro I'm buying a software but the distributor says it needs a valid ip configured in the network interface, is this possible? John Hanley If your software vendor requires a public IP address to be bound to your VM instance, the answer is no. In Googl

Unable to connect to IoT Central using X509 certificate

Lol From this article using the sample code , I've been able to connect using the DPS IoT Center with Group Enrollment based on the X509 certificate. However, using the same code and certificate to connect to Central, the registration fails with: ProvisioningC

"DNS server is not a valid IP address" error

jack_the_beast Today I tried to set google's dns server (8.8.8.8) as my dns, but I can't. When I click OK, the popup says "The dns server 8.8.8.8 is not a valid IP address" and I wonder why, I always use it on other networks. Any ideas? i am on windows 10 Cand

"DNS server is not a valid IP address" error

jack_the_beast Today I tried to set google's dns server (8.8.8.8) as my dns, but I can't. When I click OK, the popup says "The dns server 8.8.8.8 is not a valid IP address" and I wonder why, I always use it on other networks. Any ideas? i am on windows 10 Cand

Could not connect to server: x509: certificate pair

Barra Operating System: Mac OS 10.13.6 Terminal Kubectl for remote access When I execute the command with "--insecure-skip-tls-verify" it works fine. dev-env at balabimac in ~/kthw $ kubectl --insecure-skip-tls-verify --context=kubernetes-me get pods No resour

Could not connect to server: x509: certificate pair

Barra Operating System: Mac OS 10.13.6 Terminal Kubectl for remote access When I execute the command with "--insecure-skip-tls-verify" it works fine. dev-env at balabimac in ~/kthw $ kubectl --insecure-skip-tls-verify --context=kubernetes-me get pods No resour