Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

log error about cert expired - does not show important info #102

Closed
KlavsKlavsen opened this issue Dec 16, 2023 · 8 comments
Closed

log error about cert expired - does not show important info #102

KlavsKlavsen opened this issue Dec 16, 2023 · 8 comments
Labels
lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed.

Comments

@KlavsKlavsen
Copy link

our kube-apiserver just started failing to start.. The log from containerd only says:
2023-12-16T07:35:01.426019865+01:00 stderr F }. Err: connection error: desc = "transport: authentication handshake failed: x509: certificate has expired or is not yet valid: current time 2023-12-16T06:35:01Z is after 2023-12-03T03:37:19Z"

so the cert appearently should have expired on the 3rd of december (and yet it only fails now) - and also - if I check the cert its using :

# openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text | grep fter
            Not After : Apr 13 14:08:43 2024 GMT
07:34:04 root@htzhel1-ax41na:~

its not actually run out..

The errorlog could be much more helpful -if it shared exactly which certificate its checking.. (file path - or whatever its got open) - AND Serial number from cert to uniquely identify the one its looking at.. :(

its k8s 1.26.4

@KlavsKlavsen
Copy link
Author

In our case - it turned out to be the etcd server it was trying to connect to - that had the bad cert.. REALLY would have been helpful if it had shared that info

@KlavsKlavsen
Copy link
Author

kubeadm certs check-expiration has the info - and shows this etcd cert being expired.. odd thing is normal k8s upgrades didn't re-issue these - but did re-issue the rest (which last until apr 2024).. seems a bug as well

@neolit123
Copy link
Member

i don't know if any of the apisever maintainers watch this repository. better close this ticket and open a new one in kubernetes/kubernetes.

@neolit123
Copy link
Member

neolit123 commented Dec 18, 2023

kubeadm certs check-expiration has the info - and shows this etcd cert being expired.. odd thing is normal k8s upgrades didn't re-issue these - but did re-issue the rest (which last until apr 2024).. seems a bug as well

if upgrade was done by kubeadm this can happen if the etcd version did not change between minor k8s versions. it is by design because etcd upgrade is skipped and with it certs renewal of etcd. you can open a ticket in kubernetes/kubeadm for discussion if you want. i.e. maybe the maintainers team will agree to change it.

the etcd version does change between patch and minor versions of k8s. so as long as you update more often the etcd certs will renew.

@k8s-triage-robot
Copy link

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue as fresh with /remove-lifecycle stale
  • Close this issue with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

@k8s-ci-robot k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Mar 17, 2024
@k8s-triage-robot
Copy link

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue as fresh with /remove-lifecycle rotten
  • Close this issue with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

@k8s-ci-robot k8s-ci-robot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Apr 16, 2024
@k8s-triage-robot
Copy link

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Reopen this issue with /reopen
  • Mark this issue as fresh with /remove-lifecycle rotten
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

@k8s-ci-robot k8s-ci-robot closed this as not planned Won't fix, can't repro, duplicate, stale May 16, 2024
@k8s-ci-robot
Copy link
Contributor

@k8s-triage-robot: Closing this issue, marking it as "Not Planned".

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Reopen this issue with /reopen
  • Mark this issue as fresh with /remove-lifecycle rotten
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed.
Projects
None yet
Development

No branches or pull requests

4 participants