Admin cluster kubeconfig

Google Cloud Apigee
1

I am working on a GKE on VMware cluster. Whenever I interact with the admin cluster, I receive the following error:

Unable to connect to the server: x509: certificate has expired or is not yet valid

1 Like
2

Hi @shayan ! To address the error you mention, you can try the following:

  • Review certificates: follow the steps provided in the Kubernetes documentation to check certificate expiration or to renew if it has expired.
  • Correct system time: ensure that the system clock is set to the correct time, if it is incorrect it can cause the certificate to appear invalid.

Hope this helps.

2 Likes
3

  1. Since the cluster is on GKE on VMware, kubeadm does not work in this case.

  2. I checked the system time using timedatectl, and it is correct. As the hybrid and the rest of the activities are functioning properly, the system time is not an issue.

2 Likes
4

Hi @shayan , apologies that the previous answer didn’t resolve the issue. We are currently reviewing the issue and will provide an update when we have more details.

Thank you for your patience and for reaching out to the community.

1 Like
5

@shayan If you have SSH access to your gke-admin-master VM, the file /etc/kubernetes/admin.conf is a kubeconfig you can use to interact with the admin cluster locally to help you in troubleshooting.

(I’m just a GKE user, not a Googler)

2 Likes
6

Hi @grsiepka ,

The SSH key for the admin cluster nodes is also not working. When I try to interact with the admin cluster using the admin cluster’s kubeconfig, I receive the following error:

Unable to connect to the server: x509: certificate has expired or is not yet valid.

1 Like
7

You stated you checked system time earlier and it was right (assuming on your local or on your admin-workstation) but you really should check the same on your gke-admin-master node, but if you can’t ssh into admin-master node i’m not sure how else you can do that. Maybe force sync system time on the VM from Vcenter? (just a guess) Might be worth getting a case open with support IMO. Good luck.

1 Like
8

The “x509: certificate has expired or is not yet valid” error indicates that the admin cluster’s certificate is either expired or not yet valid. Here are some steps to fix it:

  1. Check System Time: Ensure the system time on the admin cluster’s nodes is correct.
  2. Renew Certificates: Renew the certificates for the cluster. You can usually do this with a command like gkectl update credentials or a similar command specific to your setup.
2 Likes
9

Hi everyone, thank you so much for engaging in this discussion and sharing your insights :blush:

@shayan , if any of these replies helped, please consider marking one of them as accepted solutions to assist others who might encounter a similar situation.

We appreciate everyone’s participation and look forward to seeing you all engage in the forum.