添加新用户提示certificate signed by unknown authority

veuve

hongming

veuve
有改过什么配置吗，贴一下下面两个命令的输出

kubectl get validatingwebhookconfigurations users.iam.kubesphere.io -o jsonpath='{.webhooks[0].clientConfig.caBundle}'
kubectl -n kubesphere-system get secret ks-controller-manager-webhook-cert -o jsonpath='{.data}'

veuve

hongming
kubectl get validatingwebhookconfigurations users.iam.kubesphere.io -o jsonpath=‘{.webhooks[0].clientConfig.caBundle}’

kubectl get validatingwebhookconfigurations users.iam.kubesphere.io -o jsonpath=‘{.webhooks[0].clientConfig.caBundle}’

之前刚装的时候执行过这个操作

hongming

veuve
没重启 ks-controller-manager 吧

kubectl -n kubesphere-system rollout restart deploy ks-controller-manager

veuve

hongming 重启过

hongming

veuve

验证一下证书配置

kubectl get validatingwebhookconfigurations users.iam.kubesphere.io -o jsonpath='{.webhooks[0].clientConfig.caBundle}'  | base64 -d > ca.crt
curl -v --cacert ca.crt https://ks-controller-manager.kubesphere-system.svc

veuve

hongming ks-controller-manager.kubesphere-system.svc 这个host要指向哪里呢

hongming

veuve

上面的命令可以在 web kubectl 里直接执行

veuve

hongming

veuve 是证书不太对，有改过什么配置吗

apk add openssl
openssl x509 -noout -text -in ca.crt
curl -vk https://ks-controller-manager.kubesphere-system.svc
kubectl -n kubesphere-system get deploy ks-controller-manager -o yaml

veuve

hongming 没改过其它的了，就上面发的因TKE版本问题更新过证书

hongming

veuve

问题很好排查，检查一下validatingwebhookconfigurations 里配置的ca ，ks-controller-manager-webhook-cert 配置的证书对不对的上就行了

veuve

hongming 这里的证书保持一致要怎么修改呢

hongming

veuve

重新创建一下 ValidatingWebhookConfiguration重启 ks-controller-manager保证证书是一致的

kubectl apply -f https://raw.githubusercontent.com/kubesphere/ks-installer/2c4b479ec65110f7910f913734b3d069409d72a8/roles/ks-core/prepare/files/ks-init/users.iam.kubesphere.io.yaml
kubectl apply -f https://raw.githubusercontent.com/kubesphere/ks-installer/2c4b479ec65110f7910f913734b3d069409d72a8/roles/ks-core/prepare/files/ks-init/webhook-secret.yaml
kubectl -n kubesphere-system rollout restart deploy ks-controller-manager

veuve

hongming 非常感谢，现在可以了

veuve

hongming 证书更新后上面的问题解决了，但是deployment发布有问题了