0

i am using kubernetes on mesos v1.0.5 / go 1.5

I am facing an issue where the kubectl command returns an error

'kubectl exec busybox -- nslookup kubernetes ' [ All exec commands have the same error ]

Error from server: tls: handshake did not verify certificate chain ' -

how do i fix this issue , i am looking for the exec result

--- output for the DEBUG=1
I0914 01:27:30.041603    4183 debugging.go:101] curl -k -v -XGET  -H "User-Agent: kubectl/v1.1.0 (linux/amd64) kubernetes/c28b68d" http://10.25.40.221:8888/api
I0914 01:27:30.044219    4183 debugging.go:120] GET http://10.25.40.221:8888/api 200 OK in 2 milliseconds
I0914 01:27:30.044331    4183 debugging.go:126] Response Headers:
I0914 01:27:30.044357    4183 debugging.go:129]     Content-Type: application/json
I0914 01:27:30.044376    4183 debugging.go:129]     Date: Mon, 14 Sep 2015 08:27:30 GMT
I0914 01:27:30.044393    4183 debugging.go:129]     Content-Length: 32
I0914 01:27:30.044649    4183 request.go:755] Response Body: {
  "versions": [
    "v1"
  ]
}
I0914 01:27:30.045514    4183 debugging.go:101] curl -k -v -XGET  -H "User-Agent: kubectl/v1.1.0 (linux/amd64) kubernetes/c28b68d" http://10.25.40.221:8888/api/v1/namespaces/default/pods/busybox
I0914 01:27:30.048836    4183 debugging.go:120] GET http://10.25.40.221:8888/api/v1/namespaces/default/pods/busybox 200 OK in 3 milliseconds
I0914 01:27:30.048915    4183 debugging.go:126] Response Headers:
I0914 01:27:30.048925    4183 debugging.go:129]     Content-Type: application/json
I0914 01:27:30.048935    4183 debugging.go:129]     Date: Mon, 14 Sep 2015 08:27:30 GMT
I0914 01:27:30.048944    4183 debugging.go:129]     Content-Length: 1630
I0914 01:27:30.049197    4183 request.go:755] Response Body: {"kind":"Pod","apiVersion":"v1","metadata":{"name":"busybox","namespace":"default","selfLink":"/api/v1/namespaces/default/pods/busybox","uid":"b716427c-5aa1-11e5-8178-74dbd130ddeb","resourceVersion":"2137","creationTimestamp":"2015-09-14T05:30:31Z","annotations":{"k8s.mesosphere.io/bindingHost":"cisomacompute-5137.ccg21.dev.paypalcorp.com","k8s.mesosphere.io/executorId":"e0a3dec3f59d772c_k8sm-executor","k8s.mesosphere.io/offerId":"20150906-214842-3582466314-5050-22021-33","k8s.mesosphere.io/slaveId":"20150904-000208-3481278730-5050-29023-0","k8s.mesosphere.io/taskId":"pod.b75a4917-5aa1-11e5-ae98-74dbd130ddeb"}},"spec":{"containers":[{"name":"busybox","image":"busybox","command":["sleep","3600"],"resources":{},"terminationMessagePath":"/dev/termination-log","imagePullPolicy":"IfNotPresent"}],"restartPolicy":"Always","terminationGracePeriodSeconds":30,"dnsPolicy":"ClusterFirst","nodeName":"cisomacompute-5137.ccg21.dev.paypalcorp.com"},"status":{"phase":"Running","conditions":[{"type":"Ready","status":"True"}],"hostIP":"10.25.112.243","podIP":"172.17.0.4","startTime":"2015-09-14T05:30:31Z","containerStatuses":[{"name":"busybox","state":{"running":{"startedAt":"2015-09-14T07:30:50Z"}},"lastState":{"terminated":{"exitCode":0,"startedAt":"2015-09-14T06:30:46Z","finishedAt":"2015-09-14T07:30:46Z","containerID":"docker://027ce959e09c9c24af56df3c8c30a70bf878f8fbfe49ac2c998c122b6e90f25a"}},"ready":true,"restartCount":2,"image":"busybox","imageID":"docker://8c2e06607696bd4afb3d03b687e361cc43cf8ec1a4a725bc96e39f05ba97dd55","containerID":"docker://086327d05bf82a5bfa2a3fa3a9e966c3d8628c46e32f850feeddf0d3e1198a94"}]}}
I0914 01:27:30.051189    4183 exec.go:175] defaulting container name to busybox
I0914 01:27:30.132117    4183 helpers.go:117] server response object: [{
  "metadata": {},
  "status": "Failure",`enter code here`
  "message": "tls: handshake did not verify certificate chain",
  "code": 500
}]
F0914 01:27:30.132316    4183 helpers.go:71] Error from server: tls: handshake did not verify certificate chain
5
  • Could you please provide the output when running kubectl like so: DEBUG=1 kubectl exec --v=9 ...?
    – ncdc
    Sep 10, 2015 at 14:55
  • DEBUG=1 kubectl exec --v=9 busybox -- nslookup kubernetes Sep 14, 2015 at 8:29
  • Is your apiserver running http or https/tls?
    – ncdc
    Sep 14, 2015 at 16:27
  • http , i started as per the instructions on the documentation Sep 15, 2015 at 2:27
  • are there any instructions on setting up https/tls explicitly ? Sep 15, 2015 at 2:28

1 Answer 1

0

I haven't seen this exact problem, but I have two suggestions:

  1. Try building with Go 1.4.2, which is what our CI is currently using.
  2. Try upgrading and linking OpenSSL (brew update && brew upgrade openssl && brew link --force openssl) and make sure that Go uses it instead of the system openssl (which is ancient).

Related issues on github:

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.