Kubeadm: Certificate issues with kubeadm init

[aashish-sheshadri]

Is this a BUG REPORT or FEATURE REQUEST?

BUG REPORT

Versions

kubeadm version (use kubeadm version): "v1.13.2"

Environment:

• Kubernetes version (use kubectl version): "v1.13.2"
• Cloud provider or hardware configuration: None
• OS (e.g. from /etc/os-release): CentOS 7.6
• Kernel (e.g. uname -a): 3.10.0-957.1.3.0.1.el7.x86_64
• Others:

What happened?

Unable to get a kubectl working with the cluster set up with kubeadm init. kubeadm init executes successfully.

I have tried to follow the Troubleshooting guide regarding copying admin.conf to user home as conf but always end up with -- x509: certificate signed by unknown authority.

kubeadm token list
failed to list bootstrap tokens: Get https://10.176.15.137:6443/api/v1/namespaces/kube-failed to list bootstrap tokens: Get https://10.176.15.137:6443/api/v1/namespaces/kube-system/secrets?fieldSelector=type%3Dbootstrap.kubernetes.io%2Ftoken: x509: certificate signed by unknown authority

sudo kubeadm token list works as expected.
TOKEN TTL EXPIRES USAGES DESCRIPTION EXTRA GROUPS
* 19h 2019-01-18T13:45:05-08:00 authentication,signing The default bootstrap token generated by 'kubeadm init'. system:bootstrappers:kubeadm:default-node-token

kubeadm token list as root user fails.

What you expected to happen?

Get the cluster up and running.

How to reproduce it (as minimally and precisely as possible)?

Followed the guide: https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm

Anything else we need to know?

I am trying to get a single master Kubernetes cluster up and running on a few VMs on GCP.

[fabriziopandini]

@aashish-sheshadri
If kubeadm token list doesn't works but sudo kubeadm token list works, it means that the admin.conf file is not available for the current user.

copying admin.conf to user home as conf

The target name should be $HOME/.kube/config as documented

[aashish-sheshadri]

@fabriziopandini Thanks for your response. I have followed the steps to copy over the admin.conf to $HOME/.kube/config.

More info:
After kubeadm init
kubeadm token list

failed to load admin kubeconfig: open /etc/kubernetes/admin.conf: permission denied

sudo kubeadm token list
works as expected

After running:
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

failed to list bootstrap tokens: Get https://10.176.15.137:6443/api/v1/namespaces/kube-system/secrets?fieldSelector=type%3Dbootstrap.kubernetes.io%2Ftoken: x509: certificate signed by unknown authority

[foxyriver]

try kubeadm token list --kubeconfig=$HOME/.kube/config

[aashish-sheshadri]

@foxyriver
kubeadm token list --kubeconfig=$HOME/.kube/config

failed to list bootstrap tokens: Get https://10.176.15.137:6443/api/v1/namespaces/kube-system/secrets?fieldSelector=type%3Dbootstrap.kubernetes.io%2Ftoken: x509: certificate signed by unknown authority

But, sudo kubeadm token list --kubeconfig=$HOME/.kube/config works fine. I also deleted /etc/kubernetes/admin.conf.

[foxyriver]

@aashish-sheshadri
make sure your $HOME/.kube/config file has the read authority by non root user, if not, try this

sudo chmod 777 $HOME/.kube/config
kubeadm token list --kubeconfig=$HOME/.kube/config

[rosti]

Folks, never set your kube config permissions to 777. 0600 should be enough, anything else is a potential security risk (with 777 definitely one).

[foxyriver]

@rosti you are right, the user only need read/write permissions is enough:)

[aashish-sheshadri]

@foxyriver @rosti Any ideas why am unable to list tokens without sudo. I am unable to configure kubectl at all, sudo or not. I get the same error x509: certificate signed by unknown authority.

It seems like its more that being able to read .kube/config. Any pointers will be helpful.

[timothysc]

This isn't a kubeadm issue, but a user permissions issue.