FAQ

FAQ

The operator crashloops on EKS with "Missing Authority Key Identifier"

The operator pod cannot reach the Kubernetes API server and crashloops with:

SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate
verify failed: Missing Authority Key Identifier (_ssl.c:1081)')

This affects EKS clusters created before Kubernetes 1.17 (released December 2019) and upgraded since. Their cluster CA certificate is missing an extension that the operator's TLS verification now requires. Clusters created on 1.17 or later are not affected.

Upgrade the operator to 1.3.1 on the v1 line, or to 2.0.1 on v2, and set:

extraEnvVars:
  - name: TWINGATE_DISABLE_API_SERVER_STRICT_X509_VERIFICATION
    value: "true"

Certificate verification stays on: the operator still requires a valid certificate chain and still verifies the API server hostname. Only the RFC 5280 structural checks that Python 3.13 enabled by default are dropped.