SSL Cert for the load balancer HAProxy

elamin

Hi,
in the training Lab 16.2. Detailed Steps, I'm getting an error when I try to join the second and third CP to the cluster because the CN of the HA proxy (k8scp) isn't included in the PKI of the cluster.

Retrying due to error: failed to request the cluster-info ConfigMap: Get "https://k8scp:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s": tls: failed to verify certificate: x509: certificate is valid for kubeadm-mst-t-134, kubernetes, kubernetes.default, kubernetes.default.svc, kubernetes.default.svc.cluster.local, not k8scp

How do I change the cluster server certificate to include the CN of the proxy (k8scp)?

Thanks a lot.

chrispokorni

Hi @elamin,

It seems you deviated from the installation and bootstrapping instructions from Ch 3, and the k8scp alias is not recognized as a control plane identity.

The process to manually regenerate the apiserver certificate is outlined in the documentation (https://kubernetes.io/docs/tasks/administer-cluster/certificates/) and there is a github discussion that may help (https://github.com/kubernetes/kubeadm/issues/581)

Regards,
-Chris