0

I have this very well documented issue that others seem to have as well. I am using a GKE cluster and I used to be able to deploy images with any issue using kubectl apply, but earlier this year this started happening. Also, others in my team have no issue using the exact same commands. Furthermore, what's really disturbing is that if I try the exact same command multiple times (5-6) every 6th, 7th time it seems to work. Sometimes it doesn't work for hours.

Problem: I get error message "Unable to connect to the server: x509: certificate signed by unknown authority".

When it happens: When I run any kubectl command. It doesn't have to be apply, even getting version number can cause this.

I have followed all the suggestions in kubectl unable to connect to server: x509: certificate signed by unknown authority including

  • Fetching new credentials using "gcloud container clusters get-credentials my-cluster --region us-east1 "
  • I have verified this updates my .kubeconfig
  • I have tried deleting the entire .kube folder in my user folder and running above command to regen the file
  • I have even uninstalled and re-installed Docker/Kubernetes
  • I have tried changing home network, public network, with or without VPN. No consistent behavior.
  • Tried adding --insecure-skip-tls-verify

Kubectl Version I am running

PS C:\Users\ak\source\repos\foo> kubectl version Client Version: version.Info{Major:"1", Minor:"22", GitVersion:"v1.22.5", GitCommit:"5c99e2ac2ff9a3c549d9ca665e7bc05a3e18f07e", GitTreeState:"clean", BuildDate:"2021-12-16T08:38:33Z", GoVersion:"go1.16.12", Compiler:"gc", Platform:"windows/amd64"} Unable to connect to the server: x509: certificate signed by unknown authority

AIK DO
  • 288
  • 1
  • 4
  • 13
  • You may also see the comment thread summary and additional Posted and answered questions at this [Stack Overflow link](https://stackoverflow.com/questions/56169131/kubectl-cannot-connect-gke-failing-with-x509-certificate-signed-by-unknown-aut?rq=1). – Jeffrey D. Nov 08 '22 at 00:32
  • Thanks but nothing there I haven't already tried as listed above. – AIK DO Nov 09 '22 at 15:33
  • The docker daemon does not trust the self-signed certificate, which is causing the x509 error. This may occur due to the expiration of the current certificate, due to a changed hostname, and other changes. Try to implement a new certificate again, and monitor the behavior if the same problem occurred. – Jeffrey D. Nov 09 '22 at 19:06
  • I have been doing this "gcloud container clusters get-credentials my-cluster --region us-east1". It does create a new entry but I dont know if that creates a new cert. How can I create a new certificate? – AIK DO Nov 09 '22 at 19:50
  • You can follow these guidelines [How to put self-signed certificate to each node of GKE cluster](https://stackoverflow.com/questions/67723381/how-to-put-self-signed-certificate-to-each-node-of-gke-cluster/67724696#67724696) – Jeffrey D. Nov 09 '22 at 23:02

0 Answers0