CODEWITHSUNDEEP
kubernetes
onorua
onorua

Reputation: 399

generated serviceaccount token is rejected by kube-apiserver

I have one successfully working cluster, with out any problems, I've tried to make a copy of it. It's working basically, except one issue - token generated by apiserver is not valid with error message:

6 handlers.go:37] Unable to authenticate the request due to an error: crypto/rsa: verification error

I have api server started up with following parameters:

kube-apiserver --address=0.0.0.0    --admission_control=NamespaceLifecycle,NamespaceExists,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota --service-cluster-ip-range=10.116.0.0/23 --client_ca_file=/srv/kubernetes/ca.crt --basic_auth_file=/srv/kubernetes/basic_auth.csv --authorization-mode=AlwaysAllow  --tls_cert_file=/srv/kubernetes/server.cert --tls_private_key_file=/srv/kubernetes/server.key --secure_port=6443 --token_auth_file=/srv/kubernetes/known_tokens.csv  --v=2 --cors_allowed_origins=.* --etcd-config=/etc/kubernetes/etcd.config --allow_privileged=False

I think I'm missing something but can't find what exactly, any help will be appreciated!

Upvotes: 2

Views: 2162

Answers (2)

onorua
onorua

Reputation: 399

So, apparently it was wrong server.key used by controller manager. According to kubernetes documentation token is generated by controller manager.

While I was doing copy of the all my configuration, I had to change ipaddress and had to change certificate due to this as well. But controller-manager started with "old" certificate and after the change created wrong keys because server.key.

Upvotes: 3

Animesh Kumar Paul
Animesh Kumar Paul

Reputation: 2294

You can see this below flag for api server, it works for me. Check this.

--insecure-bind-address=${OS_PRIVATE_IPV4} 
--bind-address=${OS_PRIVATE_IPV4} 
--tls-cert-file=/srv/kubernetes/server.cert 
--tls-private-key-file=/srv/kubernetes/server.key 
--client-ca-file=/srv/kubernetes/ca.crt 
--admission_control=NamespaceLifecycle,NamespaceExists,LimitRanger,SecurityContextDeny,ResourceQuota 
--token-auth-file=/srv/kubernetes/known_tokens.csv 
--basic-auth-file=/srv/kubernetes/basic_auth.csv 
--etcd_servers=http://${OS_PRIVATE_IPV4}:4001 
--service-cluster-ip-range=10.10.0.0/16 
--logtostderr=true 
--v=5

Upvotes: 0

Related Questions