Kubernetes manifest apiserver not forwarding

0 votes

I am working on building a kubernetes cluster on AWS using terraform.

However when it is created, the kube-apiserver pod does not forward 443 to the host, so the api cannot be reached (it does forward 8080 to 127.0.0.1)

apiVersion: v1
kind: Pod
metadata:
  name: kube-apiserver
  namespace: kube-system
spec:
  hostNetwork: true
  containers:
  - name: kube-apiserver
    image: gcr.io/google_containers/hyperkube:${K8S_VER}
    command:
    - /hyperkube
    - apiserver
    - --bind-address=0.0.0.0
    - --etcd_servers=${ETCD_ENDPOINTS}
    - --allow-privileged=true
    - --service-cluster-ip-range=${SERVICE_IP_RANGE}
    - --secure_port=443
    - --advertise-address=${ADVERTISE_IP}
    - --admission-control=NamespaceLifecycle,NamespaceExists,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota
    - --tls-cert-file=/etc/kubernetes/ssl/apiserver.pem
    - --tls-private-key-file=/etc/kubernetes/ssl/apiserver-key.pem
    - --client-ca-file=/etc/kubernetes/ssl/ca.pem
    - --service-account-key-file=/etc/kubernetes/ssl/apiserver-key.pem
    - --cloud-provider=aws
    ports:
    - containerPort: 443
      hostPort: 443
      name: https
    - containerPort: 8080
      hostPort: 8080
      name: local
    volumeMounts:
    - mountPath: /etc/kubernetes/ssl
      name: ssl-certs-kubernetes
      readOnly: true
    - mountPath: /etc/ssl/certs
      name: ssl-certs-host
     readOnly: true
  volumes:
  - hostPath:
      path: /etc/kubernetes/ssl
    name: ssl-certs-kubernetes
  - hostPath:
      path: /usr/share/ca-certificates
    name: ssl-certs-host

Some output:

ip-10-0-0-50 core # docker ps
CONTAINER ID        IMAGE                                       COMMAND                CREATED             STATUS              PORTS               NAMES
47d36516ada9        gcr.io/google_containers/hyperkube:v1.0.7   "/hyperkube apiserve   18 minutes ago      Up 18 minutes                           k8s_kube-apiserver.daa12bc1_kube-apiserver-ip-10-0-0-50.eu-west-1.compute.internal_kube-system_0ff7c6642d467da6eec9af9d96af0622_b88e9ada                     
48f85774ff5c        gcr.io/google_containers/hyperkube:v1.0.7   "/hyperkube schedule   38 minutes ago      Up 38 minutes                           k8s_kube-scheduler.cca58e1_kube-scheduler-ip-10-0-0-50.eu-west-1.compute.internal_kube-system_8aa2dd5e26e716aa54d97e2691e100e0_d6865ecb                      
1242789081a9        gcr.io/google_containers/hyperkube:v1.0.7   "/hyperkube controll   38 minutes ago      Up 38 minutes                           k8s_kube-controller-manager.9ddfd2a0_kube-controller-manager-ip-10-0-0-50.eu-west-1.compute.internal_kube-system_66bae8c21c0937cc285af054be236103_16b6bfb9   
2ebafb2a3413        gcr.io/google_containers/hyperkube:v1.0.7   "/hyperkube proxy --   38 minutes ago      Up 38 minutes                           k8s_kube-proxy.de5c3084_kube-proxy-ip-10-0-0-50.eu-west-1.compute.internal_kube-system_e6965a2424ca55206c44b02ad95f479e_dacdc559                             
ade9cd54f391        gcr.io/google_containers/pause:0.8.0        "/pause"               38 minutes ago      Up 38 minutes                           k8s_POD.e4cc795_kube-scheduler-ip-10-0-0-50.eu-west-1.compute.internal_kube-system_8aa2dd5e26e716aa54d97e2691e100e0_b72b8dba                                  
78633207462f        gcr.io/google_containers/pause:0.8.0        "/pause"               38 minutes ago      Up 38 minutes                           k8s_POD.e4cc795_kube-controller-manager-ip-10-0-0-50.eu-west-1.compute.internal_kube-system_66bae8c21c0937cc285af054be236103_71057c93                        
b97643a86f51        gcr.io/google_containers/podmaster:1.1      "/podmaster --etcd-s   39 minutes ago      Up 39 minutes                           k8s_controller-manager-elector.663462cc_kube-podmaster-ip-10-0-0-50.eu-west-1.compute.internal_kube-system_8e57c3cada4c03fae8d01352505c25e5_0bb98126         
0859c891679e        gcr.io/google_containers/podmaster:1.1      "/podmaster --etcd-s   39 minutes ago      Up 39 minutes                           k8s_scheduler-elector.468957a0_kube-podmaster-ip-10-0-0-50.eu-west-1.compute.internal_kube-system_8e57c3cada4c03fae8d01352505c25e5_fe401f47                  
e948e718f3d8        gcr.io/google_containers/pause:0.8.0        "/pause"               39 minutes ago      Up 39 minutes                           k8s_POD.e4cc795_kube-apiserver-ip-10-0-0-50.eu-west-1.compute.internal_kube-system_0ff7c6642d467da6eec9af9d96af0622_774d1393                                 
eac6b18c0900        gcr.io/google_containers/pause:0.8.0        "/pause"               39 minutes ago      Up 39 minutes                           k8s_POD.e4cc795_kube-podmaster-ip-10-0-0-50.eu-west-1.compute.internal_kube-system_8e57c3cada4c03fae8d01352505c25e5_949f1945                                 
6411aed07d40        gcr.io/google_containers/pause:0.8.0        "/pause"               39 minutes ago      Up 39 minutes                           k8s_POD.e4cc795_kube-proxy-ip-10-0-0-50.eu-west-1.compute.internal_kube-system_e6965a2424ca55206c44b02ad95f479e_160a3b0f
ip-10-0-0-50 core # netstat -lnp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address             State       PID/Program name    
tcp        0      0 127.0.0.1:10252         0.0.0.0:*               LISTEN      1818/hyperkube      
tcp        0      0 127.0.0.1:8080          0.0.0.0:*               LISTEN      7966/hyperkube      
tcp        0      0 127.0.0.1:10248         0.0.0.0:*               LISTEN      1335/kubelet        
tcp        0      0 127.0.0.1:10249         0.0.0.0:*               LISTEN      1800/hyperkube      
tcp        0      0 127.0.0.1:10251         0.0.0.0:*               LISTEN      1820/hyperkube      
tcp        0      0 0.0.0.0:5355            0.0.0.0:*               LISTEN      610/systemd-resolve 
tcp6       0      0 :::10255                :::*                    LISTEN      1335/kubelet        
tcp6       0      0 :::22                   :::*                    LISTEN      1/systemd           
tcp6       0      0 :::55447                :::*                    LISTEN      1800/hyperkube      
tcp6       0      0 :::42274                :::*                    LISTEN      1800/hyperkube      
tcp6       0      0 :::10250                :::*                    LISTEN      1335/kubelet        
tcp6       0      0 :::5355                 :::*                    LISTEN      610/systemd-resolve 
udp        0      0 10.0.0.50:68            0.0.0.0:*                           576/systemd-network 
udp        0      0 0.0.0.0:8285            0.0.0.0:*                           1456/flanneld       
udp        0      0 0.0.0.0:5355            0.0.0.0:*                           610/systemd-resolve 
udp6       0      0 :::5355                 :::*                                610/systemd-resolve 
udp6       0      0 :::52627                :::*                                1800/
ip-10-0-0-50 core # docker logs 47d36516ada9
Sep 3, 2018 in Kubernetes by Hannah
 • 18,520 points • 795 views

1 answer to this question.

0 votes
Check the certificates that you’re using.

Maybe you’re passing the wrong file to the tls-cert-file= argument.
answered Sep 3, 2018 by Kalgi
 • 52,350 points

Related Questions In Kubernetes

0 votes
2 answers

DNS does not resolve with NGINX in Kubernetes

adding to @kalgi's answer Using just the hostname ...READ MORE

answered Aug 30, 2018 in Kubernetes by Nilesh
 • 7,060 points • 5,620 views
0 votes
1 answer

Error saying "The specified bucket does not exist" in kubernetes

Bucket is created in another region. Looks like ...READ MORE

answered Aug 31, 2018 in Kubernetes by Kalgi
 • 52,350 points • 4,110 views
0 votes
3 answers

Could not get lock /var/lib/dpkg/lock - open (11: Resource temporarily unavailable) while setting up kubernetes

Execute these three commands: sudo rm /var/lib/apt/lists/lock sudo rm ...READ MORE

answered Nov 27, 2018 in Kubernetes by Maverick
 • 10,840 points • 1,822 views
0 votes
1 answer

Pod status not ready always - kubernetes

I was having the same issue. In the ...READ MORE

answered Sep 6, 2018 in Kubernetes by Kalgi
 • 52,350 points • 3,668 views
+6 votes
1 answer

Web UI (Dashboard): https://kubernetes.io/docs/tasks/access-application-cluster/web-ui-dashboard/

Hey @nmentityvibes, you seem to be using ...READ MORE

answered Dec 13, 2018 in Kubernetes by Kalgi
 • 52,350 points • 7,935 views
+1 vote
1 answer

set up kubernetes NGINX ingress in AWS with SSL termination

Try using ingress itself in this manner except ...READ MORE

answered Oct 10, 2018 in Kubernetes by Kalgi
 • 52,350 points • 3,089 views
0 votes
3 answers

Error while joining cluster with node

Hi Kalgi after following above steps it ...READ MORE

answered Jan 17, 2019 in Others by anonymous
 • 15,477 views
+15 votes
2 answers

Git management technique when there are multiple customers and need multiple customization?

Consider this - In 'extended' Git-Flow, (Git-Multi-Flow, ...READ MORE

answered Mar 27, 2018 in DevOps & Agile by DragonLord999
 • 8,450 points • 4,035 views
0 votes
1 answer

Pod not sharing directory - Kubernetes volume Hostpath

he issue was on the volume definition, ...READ MORE

answered Aug 28, 2018 in Kubernetes by Kalgi
 • 52,350 points • 2,253 views
0 votes
1 answer

Not able to access kubernetes api from a pod in azure

Follow these steps Add --bind-address=0.0.0.0 option to the line https://github.com/kubernetes/kubernetes/blob/v1.2.0/docs/getting-started-guides/coreos/azure/cloud_config_templates/kubernetes-cluster-main-nodes-template.yml#L218  Created ...READ MORE

answered Aug 30, 2018 in Kubernetes by Kalgi
 • 52,350 points • 1,015 views
webinar REGISTER FOR FREE WEBINAR X
REGISTER NOW
webinar_success Thank you for registering Join Edureka Meetup community for 100+ Free Webinars each month JOIN MEETUP GROUP
"PMP®","PMI®", "PMI-ACP®" and "PMBOK®" are registered marks of the Project Management Institute, Inc. MongoDB®, Mongo and the leaf logo are the registered trademarks of MongoDB, Inc.