Troubleshooting

This page describes solutions to common errors when accessing the cluster from the console.

Invalid token (access token) #

E1202 11:06:00.839825 3042497 memcache.go:265] 
couldn't get current server API group list: the server has asked for the client to provide credentials
...
error: You must be logged in to the server (the server has asked for the client to provide credentials)

Solution:

• From the platform GUI, re-download the cluster kubeconfig.
• Follow the steps in Authenticate with cluster kubeconfig.

or

• Use the kubectl-shturval-plugin module to reload the cluster kubeconfig.

Incorrect certificate in cluster kubeconfig #

This error can occur if kubeconfig contains a certificate from another cluster.

Unable to connect to the server: tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "kubernetes")

Solution:

• From the platform GUI, re-download the cluster kubeconfig.
• Follow the steps in Authenticate with cluster kubeconfig.

or

• Use the kubectl-shturval-plugin module to reload the cluster kubeconfig.

Error exporting cluster kubeconfig #

E1216 16:19:13.703968    7159 memcache.go:265] couldn't get current server API group list: Get "http://localhost:8080/api?timeout=32s": dial tcp [::1]:8080: connect: connection refused
...
E1216 16:19:13.707804    7159 memcache.go:265] couldn't get current server API group list: Get "http://localhost:8080/api?timeout=32s": dial tcp [::1]:8080: connect: connection refused
The connection to the server localhost:8080 was refused - did you specify the right host or port?

Solution:

• Export kubeconfig to the ~/.kube folder. If the cluster kubeconfig file is not named config, rename it.

# Move to ~/.kube and rename clustername.conf
mv /downloads/clustername.conf ~/.kube/config
# Verify the config location
ls ~/.kube/ | grep config

Time synchronization error #

Unable to connect to the server: tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2023-12-16T16:30:28+03:00 is before 2024-12-16T09:14:38Z

Solution:

• Enable synchronization using the Network Time Protocol (NTP). Follow the time synchronization instructions for your operating system. If the OS has an NTP service installed (timesyncd, ntpd, or Chrony), you can configure time synchronization with the timedatectl command.

# Check whether the NTP service is running
timedatectl timesync-status
# Enable synchronization with the NTP service
timedatectl set-ntp on 
# Check date and time settings
timedatectl

Local time: Tue 2024-12-17 13:07:44 MSK
Universal time: Tue 2024-12-17 10:07:44 UTC
RTC time: Tue 2024-12-17 10:07:43
Time zone: Europe/Moscow (MSK, +0300)
System clock synchronized: yes
NTP service: active
RTC in local TZ: no

OIDC error #

This error can occur when:

1. the CA certificate is invalid;
2. the management cluster is unavailable;
3. the user lacks the required permissions to perform actions in the cluster.

error: You must be logged in to the server (Unauthorized)

Actions:

• Collect kube-apiserver container logs on each Control Plane node to verify the CA certificate.

crictl logs $(crictl ps | awk '/kube-apiserver/ {print $1}')

E1216 14:14:01.209890       1 authentication.go:73] "Unable to authenticate the request" err="[invalid bearer token, oidc: authenticator not initialized]"
E1216 14:14:06.695653       1 oidc.go:304] oidc authenticator: initializing plugin: Get "https://auth.clustername.ip-xx-xx-xx-xx.shturval.link/.well-known/openid-configuration": tls: failed to verify certificate: x509: certificate signed by unknown authority

Solution:

1. If the error is caused by the CA certificate, obtain a valid CA certificate and add the certificate data to Control Plane nodes in /etc/ssl/certs/oidc.crt. The CA certificate is stored in the root-ca ConfigMap in the cert-manager namespace of your cluster. If you do not have access to the root-ca ConfigMap, contact your cluster administrator to obtain a valid CA certificate.
2. If the problem is not related to the CA certificate, contact your platform administrator to verify management cluster availability.
3. If the certificate is valid and the management cluster is available, you do not have sufficient permissions to work in the cluster. Ask your cluster administrator to extend your permissions.

No access to the API server #

This error can occur when the API server is down, restarting, or blocked.

The connection to the server XXX.XXX.XXX.XXX:6443 was refused - did you specify the right host or port?

Actions:

• Contact your platform or cluster administrator to determine why the API server restarted or failed.