Test - View Certificate Details

$ controlplane ~ ✖ kubectl get po The connection to the server controlplane:6443 was refused - did you specify the right host or port?

$ controlplane ~ ➜ crictl ps -a | grep kube-apiserver 8ae9a07114306 604f5db92eaa8 59 seconds ago Exited kube-apiserver 5 a2a0ad40b4e4f kube-apiserver-controlplane $ controlplane ~ ➜ crictl logs 8ae9a07114306 ... W0114 07:50:45.959183 1 logging.go:55] [core] [Channel #2 SubChannel #4]grpc: addrConn.createTransport failed to connect to {Addr: "127.0.0.1:2379", ServerName: "127.0.0.1:2379", }. Err: connection error: desc = "transport: Error while dialing: dial tcp 127.0.0.1:2379: connect: connection refused" W0114 07:50:47.204132 1 logging.go:55] [core] [Channel #1 SubChannel #3]grpc: addrConn.createTransport failed to connect to {Addr: "127.0.0.1:2379", ServerName: "127.0.0.1:2379", }. Err: connection error: desc = "transport: Error while dialing: dial tcp 127.0.0.1:2379: connect: connection refused" F0114 07:50:51.314580 1 instance.go:225] Error creating leases: error creating storage factory: context deadline exceeded

$ controlplane ~ ➜ crictl ps -a | grep etcd 1cf6df5a713ae 2e96e5913fc06 About a minute ago Exited etcd 6 7db3425fb37c6 etcd-controlplane $ controlplane ~ ➜ crictl logs 1cf6df5a713ae ... {"level":"info","ts":"2025-01-14T07:53:05.002032Z","caller":"etcdmain/main.go:50","msg":"successfully notified init daemon"} {"level":"fatal","ts":"2025-01-14T07:53:05.002038Z","caller":"etcdmain/etcd.go:219","msg":"listener failed","error":"open /etc/kubernetes/pki/etcd/server-certificate.crt: no such file or directory","stacktrace":"go.etcd.io/etcd/server/v3/etcdmain.startEtcdOrProxyV2\n\tgo.etcd.io/etcd/server/v3/etcdmain/etcd.go:219\ngo.etcd.io/etcd/server/v3/etcdmain.Main\n\tgo.etcd.io/etcd/server/v3/etcdmain/main.go:40\nmain.main\n\tgo.etcd.io/etcd/server/v3/main.go:31\nruntime.main\n\truntime/proc.go:267"}

$ controlplane ~ ➜ ls /etc/kubernetes/pki/etcd/*.crt /etc/kubernetes/pki/etcd/ca.crt /etc/kubernetes/pki/etcd/peer.crt /etc/kubernetes/pki/etcd/healthcheck-client.crt /etc/kubernetes/pki/etcd/server.crt

vi /etc/kubernetes/manifests/etcd.yaml # 경로 수정 - --cert-file=/etc/kubernetes/pki/etcd/server.crt

# apiserver 컨테이너 상태 확인 crictl ps -a | grep kube-apiserver # etcd 컨테이너 상태 확인 crictl ps -a | grep etcd # kubectl 동작 확인 kubectl get po

$ controlplane ~ ✖ crictl ps -a | grep kube-apiserver 946de2fa8aa97 604f5db92eaa8 48 seconds ago Exited kube-apiserver 2 8dd35b937e301 kube-apiserver-controlplane $ controlplane ~ ➜ crictl logs 946 ... W0114 08:09:41.514449 1 logging.go:55] [core] [Channel #1 SubChannel #3]grpc: addrConn.createTransport failed to connect to {Addr: "127.0.0.1:2379", ServerName: "127.0.0.1:2379", }. Err: connection error: desc = "transport: authentication handshake failed: tls: failed to verify certificate: x509: certificate signed by unknown authority" F0114 08:09:44.072821 1 instance.go:225] Error creating leases: error creating storage factory: context deadline exceeded

$ controlplane ~ ➜ crictl ps -a | grep etcd 581cb851e1e51 2e96e5913fc06 12 minutes ago Running etcd 0 874f426ac7c1d etcd-controlplane $ controlplane ~ ➜ crictl logs 581 ... {"level":"warn","ts":"2025-01-14T08:13:15.994300Z","caller":"embed/config_logging.go:170","msg":"rejected connection on client endpoint","remote-addr":"127.0.0.1:53996","server-name":"","error":"remote error: tls: bad certificate"} {"level":"warn","ts":"2025-01-14T08:13:17.566497Z","caller":"embed/config_logging.go:170","msg":"rejected connection on client endpoint","remote-addr":"127.0.0.1:54012","server-name":"","error":"remote error: tls: bad certificate"}

$ controlplane ~ ➜ cat /etc/kubernetes/manifests/kube-apiserver.yaml | grep etcd - --etcd-cafile=/etc/kubernetes/pki/ca.crt - --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt - --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key - --etcd-servers=https://127.0.0.1:2379 $ controlplane ~ ➜ ls /etc/kubernetes/pki | grep etcd apiserver-etcd-client.crt apiserver-etcd-client.key etcd $ controlplane ~ ➜ ls /etc/kubernetes/pki/etcd ca.crt healthcheck-client.crt peer.crt server.crt ca.key healthcheck-client.key peer.key server.key

vi /etc/kubernetes/manifests/kube-apiserver.yaml # 해당 경로로 수정 - --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt