x509: certificate signed by unknown authority

[ankitcharolia]

-This is a BUG REPORT :

Environment:

• Cloud provider: vSphere (This bug is regardless cloud provider)

• OS (printf "$(uname -srm)\n$(cat /etc/os-release)\n"):
  Linux 4.4.83-1.el7.elrepo.x86_64 x86_64
  NAME="CentOS Linux"
  VERSION="7 (Core)"
  ID="centos"
  ID_LIKE="rhel fedora"
  VERSION_ID="7"
  PRETTY_NAME="CentOS Linux 7 (Core)"

• Version of Ansible (ansible --version):
  Ansible: 2.6.2

Kubespray version (commit) (git rev-parse --short HEAD):
Kubespray: Tag 2.6.0
Kubernetes version: 1.10.4

Network plugin used:
Flannel

Command used to invoke ansible:
ansible-playbook -i inventory/environment.yaml kubespray/upgrade-cluster.yml -b

Output of ansible run: (I face following two errors)

fatal: [etcd-01.m24.stagec.sg-cloud.co.uk]: FAILED! => {"attempts": 4, "changed": false, "cmd": "/usr/local/bin/etcdctl --endpoints=https://10.1.181.X:2379,https://10.1.181.Y:2379,https://10.1.181.Z:2379 cluster-health | grep -q 'cluster is healthy'", "delta": "0:00:00.050945", "end": "2018-10-02 09:01:01.423945", "msg": "non-zero return code", "rc": 1, "start": "2018-10-02 09:01:01.373000", "stderr": "Error: client: etcd cluster is unavailable or misconfigured; error #0: x509: certificate signed by unknown authority\n; error #1: x509: certificate signed by unknown authority\n; error #2: x509: certificate signed by unknown authority\n\nerror #0: x509: certificate signed by unknown authority\nerror #1: x509: certificate signed by unknown authority\nerror #2: x509: certificate signed by unknown authority", "stderr_lines": ["Error: client: etcd cluster is unavailable or misconfigured; error #0: x509: certificate signed by unknown authority", "; error #1: x509: certificate signed by unknown authority", "; error #2: x509: certificate signed by unknown authority", "", "error #0: x509: certificate signed by unknown authority", "error #1: x509: certificate signed by unknown authority", "error #2: x509: certificate signed by unknown authority"], "stdout": "", "stdout_lines": []}
.
.
.
.

RUNNING HANDLER [kubespray/roles/etcd : Backup etcd v3 data] ****************************************
fatal: [etcd-01.m24.stagec.sg-cloud.co.uk]: FAILED! => {"changed": true, "cmd": ["/usr/local/bin/etcdctl", "--endpoints=https://10.1.181.X:2379,https://10.1.181.Y:2379,https://10.1.181.Z:2379", "snapshot", "save", "/var/backups/etcd-2018-10-02_08:19:02/snapshot.db"], "delta": "0:00:02.011522", "end": "2018-10-02 08:19:33.964821", "msg": "non-zero return code", "rc": 2, "start": "2018-10-02 08:19:31.953299", "stderr": "Error: grpc: timed out when dialing", "stderr_lines": ["Error: grpc: timed out when dialing"], "stdout": "", "stdout_lines": []}

[mirwan]

The first reported error could apparently only appear when "Gen_certs | target ca-certificate store file", "Gen_certs | add CA to trusted CA dir" and "Gen_certs | update ca-certificates (RedHat)" tasks fail.
Are they failed in your playbook output?

[ankitcharolia]

nope, That task is not failing.
but this my #3433 pr is fixing it

[mirwan]

PR merged. Closing.

[ashutoshg]

Another flavour of this on the same task is as follows

Error: client: etcd cluster is unavailable or misconfigured; error #0: Tunnel or SSL Forbidden