3

In a okd cluster installed using https://github.com/openshift/origin/tree/release-3.11

After the okd installation the oc command was working fine but after somedays, I'm facing a weird issue with oc command i.e running any oc command in the cluster is giving

[kubenode@master ~]$ oc status
error: Error loading config file "/home/kubenode/.kube/config": yaml: line 11: could not find expected ':'

The permission of the /home/kubenode/.kube/config is :

[kubenode@master ~]$ ls -al /home/kubenode/.kube/config
-rwx------. 1 kubenode kubenode 6102 Dec 11 00:30 /home/kubenode/.kube/config

While trying to solve this, what I have done is, Empty the file /home/kubenode/.kube/config and copy the content of /etc/origin/master/admin.kubeconfig to /home/kubenode/.kube/config

This has solved the problem but its temporary solution because after some time(few hours) again i get the issue. What could be the root cause for this and what can be the permanent fix?

Rakesh Kotian
  • 175
  • 3
  • 20

1 Answers1

0

This is the intended behaviour, as Access tokens and Authorize codes are supposed to only have a limited lifetime.

You should review the Configuring authentication and user agent documentation to set the following options to your liking (for example much longer timeouts) in your /etc/origin/master/master-config.yaml on your Master Nodes:

oauthConfig:
  ...
  tokenConfig:
    accessTokenMaxAgeSeconds: 86400 
    authorizeTokenMaxAgeSeconds: 300 
  ...
  sessionConfig:
    sessionMaxAgeSeconds: 300

Note that you'll need to apply these settings to all Master Nodes in your cluster. After changing the settings, remember to restart the API and the Controllers using the following commands:

# master-restart api
# master-restart controllers
Simon
  • 4,251
  • 2
  • 24
  • 34
  • Yes oc login session expires after certain duration. Here the issue is not that. If you check the error in the question it says `Error loading config file....` which says the kube/config file is not in proper format, due to this im not able to `oc login` at all. Updating `oauthConfig` will not solve my issue – Rakesh Kotian Dec 15 '20 at 03:17
  • Thanks, I think this should be clarified in your original post as well then. Also, as others have noted, please post the invalid `.kube/config` file so it can be reviewed. – Simon Dec 15 '20 at 18:19
  • Try to execute "oc logs master-api- -n kube-system". You might get some useful information. – Saxon Dec 16 '20 at 21:26