Skip to content
This repository has been archived by the owner on Jun 29, 2022. It is now read-only.

docs/concepts/aws.md: document TLS handshake errors in kube-apiserver #599

Merged

Conversation

invidian
Copy link
Member

@invidian invidian commented Jun 9, 2020

Closes #438.

Signed-off-by: Mateusz Gozdek mateusz@kinvolk.io

Copy link
Contributor

@iaguis iaguis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A couple of suggestions.

docs/concepts/aws.md Outdated Show resolved Hide resolved
I0408 05:35:22.865279 1 log.go:172] http: TLS handshake error from 127.0.0.1:45516: read tcp 127.53.210.227:7443->127.0.0.1:45516: read: connection reset by peer
```

Those logs are harmless and are caused by AWS ELB probing `kube-apiserver` for availability. Unfortunately, AWS ELB does not support authentication for probe requests, so we must use TCP probes, which causes exactly those errors.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Those logs are harmless and are caused by AWS ELB probing `kube-apiserver` for availability. Unfortunately, AWS ELB does not support authentication for probe requests, so we must use TCP probes, which causes exactly those errors.
These errors are harmless and are caused by an AWS ELB probing `kube-apiserver` for availability. The probe succeeds but AWS ELBs do not support authentication for probe requests so `kube-apiserver` complains with error logs.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This does not seem logical to me to mention authentication if we change it like this.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Rephrased. Is it better now?

@invidian invidian force-pushed the invidian/aws-elb-kube-apiserver-tls-handshake-errors-docs branch from 6b67d4d to d2ea6a7 Compare June 15, 2020 08:18
@invidian invidian requested a review from iaguis June 15, 2020 08:19
surajssd
surajssd previously approved these changes Jun 19, 2020
Copy link
Member

@surajssd surajssd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Closes #438.

Signed-off-by: Mateusz Gozdek <mateusz@kinvolk.io>
@iaguis iaguis force-pushed the invidian/aws-elb-kube-apiserver-tls-handshake-errors-docs branch from d2ea6a7 to 243459f Compare June 19, 2020 08:29
Copy link
Contributor

@iaguis iaguis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changed a couple of small language details. LGTM.

@iaguis iaguis merged commit 1924058 into master Jun 19, 2020
@iaguis iaguis deleted the invidian/aws-elb-kube-apiserver-tls-handshake-errors-docs branch June 19, 2020 08:30
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Document TLS Handshake errors on AWS single master cluster
3 participants