1

I installed kubernetes (1 controller node and 4 worker nodes).

O.S. Ubuntu 22.04.1 kubernetes v1.26.1 Calico v3.25.0

From a POD I need to get authenticate to an external server.

The request works perfectly when running on the node itself (NOT inside POD), but it doesn't inside a kubernetes POD.

I installed network-tools, this is the yaml file

`apiVersion: apps/v1 kind: Deployment metadata: name: network-tools namespace: tools labels: app: network-tools spec: replicas: 1 selector: matchLabels: app: network-tools template: metadata: labels: app: network-tools spec: containers: - name: network-tools image: praqma/network-multitool

I tried this command: curl -k 'https://xxxxxxxxxxx/RequestSessionToken' -H 'Content-Type: application/json' -d '{"Username": "username", "Password": "password", "TokenLifetime": 3600}'

Response inside NODE (GOOD!): {"Token":"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx","UserStatusCode":0}

Response inside POD network-tools (BAD!): curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number

Adding -vvv at the end (inside POD): `* Trying xx.xx.xx.xx:443...

  • Connected to domainname (xx.xx.xx.xx) port 443 (#0)
  • ALPN, offering h2
  • ALPN, offering http/1.1
  • successfully set certificate verify locations:
  • CAfile: /etc/ssl/certs/ca-certificates.crt
  • CApath: none
  • TLSv1.3 (OUT), TLS handshake, Client hello (1):
  • error:1408F10B:SSL routines:ssl3_get_record:wrong version number
  • Closing connection 0 curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number`

I tried adding several flags like tls-max tls-version insecure etc etc without success.

Thanks in advance for your help

Pentolone
  • 31
  • 2
  • There are multiple reasons for this issue `error:1408F10B:SSL routines:ssl3_get_record:wrong version number` since you are saying that you are using calico. I found that this document might be relevant. Can you confirm whether you are using calico-typha in your configuration, you can find this by using following command `kubectl get services` if there is a service named calico-typho follow this [document](https://projectcalico.docs.tigera.io/getting-started/kubernetes/hardway/install-node) for installing calico/node with a certificate this will resolve the issue. – Kranthiveer Dontineni Feb 07 '23 at 12:14
  • If this didn’t worked we can check and troubleshoot kube-proxy configs. – Kranthiveer Dontineni Feb 07 '23 at 12:15
  • Thanks for the answer. I am using calico-typa. I found the reason why it happens. The DNS resolves different IP address when inside the POD. If I try curl with the IP address resolved in the POD also the NODE returns the same error. – Pentolone Feb 08 '23 at 13:40

0 Answers0