Search code examples
authorizationkuberneteskubectl

Why does Kubernetes' "kubectl" abort with “Authorization error”?

After having changed the IP configuration of the cluster (all external IPs changed, the internal private IPs remained the same), some kubectl commands do not work anymore for any container. The pods are all up and running, and seem to find themselves without problems. Here is the output:

bronger@penny:~$ time kubectl logs jb-plus--prod-615777041-71s09
Error from server (InternalError): Internal error occurred: Authorization error (user=kube-apiserver-kubelet-client, verb=get, resource=nodes, subresource=proxy)

real    0m30,539s
user    0m0,441s
sys     0m0,021s

Apparently, there is a 30 seconds timeout, and after that the authorisation error.

What may cause this?

I run Kubernetes 1.8 with Weave Net.

Solution

  • Based on the symptom new ip missing from the certificate. use the below command to validate.

     openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text |grep DNS