Skip to content

Commit

Permalink
docs: add logs example for the certificate errors troubleshooting
Browse files Browse the repository at this point in the history
Should simplify the search of this error over the Internet.

Signed-off-by: Artem Chernyshev <artem.chernyshev@talos-systems.com>
  • Loading branch information
Unix4ever committed May 4, 2024
1 parent 8df5b85 commit b7b8a8d
Show file tree
Hide file tree
Showing 2 changed files with 12 additions and 0 deletions.
6 changes: 6 additions & 0 deletions website/content/v1.7/introduction/troubleshooting.md
Original file line number Diff line number Diff line change
Expand Up @@ -226,6 +226,12 @@ Remove the node from Kubernetes with `kubectl delete node <node-name>`.

This error might appear during initial cluster bootstrap, and it will go away once the Kubernetes API server is up and the node is registered.

The example of Talos logs:

```bash
[talos] controller failed {"component": "controller-runtime", "controller": "k8s.KubeletStaticPodController", "error": "error refreshing pod status: error fetching pod status: Get \"https://127.0.0.1:10250/pods/?timeout=30s\": remote error: tls: internal error"}
```

By default configuration, `kubelet` issues a self-signed server certificate, but when `rotate-server-certificates` feature is enabled,
`kubelet` issues its certificate using `kube-apiserver`.
Make sure the `kubelet` CSR is approved by the Kubernetes API server.
Expand Down
6 changes: 6 additions & 0 deletions website/content/v1.8/introduction/troubleshooting.md
Original file line number Diff line number Diff line change
Expand Up @@ -226,6 +226,12 @@ Remove the node from Kubernetes with `kubectl delete node <node-name>`.

This error might appear during initial cluster bootstrap, and it will go away once the Kubernetes API server is up and the node is registered.

The example of Talos logs:

```bash
[talos] controller failed {"component": "controller-runtime", "controller": "k8s.KubeletStaticPodController", "error": "error refreshing pod status: error fetching pod status: Get \"https://127.0.0.1:10250/pods/?timeout=30s\": remote error: tls: internal error"}
```

By default configuration, `kubelet` issues a self-signed server certificate, but when `rotate-server-certificates` feature is enabled,
`kubelet` issues its certificate using `kube-apiserver`.
Make sure the `kubelet` CSR is approved by the Kubernetes API server.
Expand Down

0 comments on commit b7b8a8d

Please sign in to comment.