Getting x509: certificate signed by unknown authority Error

[k8s-junkie]

I deployed kube-fledged on my k8s cluster created using kubespray and tried to cache nginx image onto all of my worker nodes and I am getting the below error
kubectl create -f deploy/kubefledged-imagecache.yaml
Error from server (InternalError): error when creating "deploy/kubefledged-imagecache.yaml": Internal error occurred: failed calling webhook "validate-image-cache.kubefledged.k8s.io": Post https://kubefledged-webhook-server.kube-fledged.svc:3443/validate-image-cache?timeout=1s: x509: certificate signed by unknown authority

This is what I see in the logs of webhook-server container
[centos@infra-vm kube-fledged]$ kubectl logs kubefledged-webhook-server-678d8f44d5-fk7kk -n kube-fledged
I1223 15:11:59.201779 1 main.go:282] Wehook server listening on :443
2020/12/23 16:56:49 http: TLS handshake error from 10.233.117.0:38036: remote error: tls: bad certificate
2020/12/23 17:04:49 http: TLS handshake error from 10.233.117.0:41302: remote error: tls: bad certificate
2020/12/23 17:04:59 http: TLS handshake error from 10.233.117.0:41368: remote error: tls: bad certificate
[centos@infra-vm kube-fledged]$

Can anyone please help me out or provide me some pointers on how to resolve this error

[husam17987]

@k8s-junkie i have the same issue after just install it.

kubectl -n kube-fledged logs kubefledged-webhook-server-7477d7b8ff-8jdk5
I1226 16:25:39.745357 1 main.go:282] Wehook server listening on :443
2020/12/26 17:16:50 http: TLS handshake error from 10.246.0.135:54932: remote error: tls: bad certificate
2020/12/26 17:17:56 http: TLS handshake error from 10.246.0.135:55190: remote error: tls: bad certificate
2020/12/27 07:49:45 http: TLS handshake error from 10.246.0.135:35542: remote error: tls: bad certificate

[husam17987]

I deployed kube-fledged on my k8s cluster created using kubespray and tried to cache nginx image onto all of my worker nodes and I am getting the below error
kubectl create -f deploy/kubefledged-imagecache.yaml
Error from server (InternalError): error when creating "deploy/kubefledged-imagecache.yaml": Internal error occurred: failed calling webhook "validate-image-cache.kubefledged.k8s.io": Post https://kubefledged-webhook-server.kube-fledged.svc:3443/validate-image-cache?timeout=1s: x509: certificate signed by unknown authority

This is what I see in the logs of webhook-server container
[centos@infra-vm kube-fledged]$ kubectl logs kubefledged-webhook-server-678d8f44d5-fk7kk -n kube-fledged
I1223 15:11:59.201779 1 main.go:282] Wehook server listening on :443
2020/12/23 16:56:49 http: TLS handshake error from 10.233.117.0:38036: remote error: tls: bad certificate
2020/12/23 17:04:49 http: TLS handshake error from 10.233.117.0:41302: remote error: tls: bad certificate
2020/12/23 17:04:59 http: TLS handshake error from 10.233.117.0:41368: remote error: tls: bad certificate
[centos@infra-vm kube-fledged]$

Can anyone please help me out or provide me some pointers on how to resolve this error

The caBundle not passed to the yaml file because of the bash script, do it manually and it will work with you

[k8s-junkie]

@husam17987 Sorry did not follow this. Can you please elaborate on what is that I should be doing manually for this to work ?

[k8s-junkie]

@husam17987 Finally figured it out.
Looks like I had to remove the previous install and do a fresh install for the caBundle to take into effect.

[k8s-junkie]

Documenting the detailed steps that I followed to make it work. This is a workaround untll the bash script issue is fixed.

1. If you have already installed kubefledged and face the above issue, then remove the install
   make remove-operator-and-kubefledged
2. Run the below command to get the CA_BUNDLE value
   kubectl config view --raw --flatten -o json | jq -r '.clusters[]' | grep certificate
3. Replace {{ CA_BUNDLE }} in the file deploy/kubefledged-validatingwebhook.yaml withe value obtained from the above step
4. Redeploy kubefledge
   make deploy-using-yaml

[senthilrch]

@k8s-junkie

Thanks for posting this issue. I'll have the bash script fixed in v0.8.0. It has issues in identifying the cluster of the current-context, I'll fix it.