Typical access errors
This page describes typical cluster access errors from the command line and steps you can take yourself or delegate to an administrator.
Where to start
First, identify how you connected:
Quick reference
| Problem | What you can do | When you need an administrator |
|---|---|---|
| Token is invalid or expired | Re-download kubeconfig or sign in again via the plugin | If access is not restored after signing in again |
| Certificate error | Re-download kubeconfig or obtain it again via the plugin | If the problem is with the CA or cluster certificates |
localhost:8080 instead of the cluster address | Check where kubeconfig is saved and what the file is named | If kubeconfig is correct but the connection still fails |
| Time synchronization error | Enable NTP synchronization | If you cannot manage OS settings |
Unauthorized / OIDC | Check permissions and login procedure | If the CA, management cluster availability, or cluster permissions need review |
| API server unavailable | Verify the error is not caused by local kubeconfig | If the API server does not respond |
Invalid token
Example error:
E1202 11:06:00.839825 3042497 memcache.go:265]
couldn't get current server API group list: the server has asked for the client to provide credentials
...
error: You must be logged in to the server (the server has asked for the client to provide credentials)
What you can do
- re-download kubeconfig from the GUI;
- follow the steps on Getting cluster kubeconfig again;
- or reload kubeconfig using
kubectl-shturval-plugin.
Incorrect certificate in kubeconfig
This error can occur if kubeconfig contains a certificate from another cluster.
Example error:
Unable to connect to the server: tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "kubernetes")
What you can do
- re-download cluster kubeconfig from the GUI;
- repeat the steps on Getting cluster kubeconfig;
- or obtain kubeconfig again via
kubectl-shturval-plugin.
When you need an administrator
If reloading kubeconfig does not help, the problem may be with the cluster’s trusted CA certificate.
kubectl tries to connect to localhost:8080
Example error:
E1216 16:19:13.703968 7159 memcache.go:265] couldn't get current server API group list: Get "http://localhost:8080/api?timeout=32s": dial tcp [::1]:8080: connect: connection refused
...
The connection to the server localhost:8080 was refused - did you specify the right host or port?
What you can do
Make sure kubeconfig is saved to ~/.kube/config or explicitly set via KUBECONFIG.
# Place in ~/.kube and rename to clustername.conf
mv /downloads/clustername.conf ~/.kube/config
# Verify config location
ls ~/.kube/ | grep config
If you use a separate kubeconfig file, follow the procedure on Getting cluster kubeconfig.
Time synchronization error
Example error:
Unable to connect to the server: tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2023-12-16T16:30:28+03:00 is before 2024-12-16T09:14:38Z
What you can do
Enable time synchronization via NTP. The node documentation includes time synchronization instructions.
If an NTP service is already installed on the OS, you can run:
# Check whether the NTP service is running
timedatectl timesync-status
# Enable synchronization with the NTP service
timedatectl set-ntp on
# Check date and time settings
timedatectl
When you need an administrator
If you cannot change time settings on the OS yourself.
OIDC or Unauthorized error
This error may be caused by:
- an invalid CA certificate;
- an unavailable management cluster;
- insufficient user permissions in the cluster.
Example error:
error: You must be logged in to the server (Unauthorized)
What you can do
- make sure you are using the latest kubeconfig or have signed in again through the plugin;
- verify that you have sufficient cluster or namespace permissions on What to do if you don’t have enough access rights?.
When you need an administrator
If the error is not related to local kubeconfig, the administrator may need to run additional checks.
Example command to get kube-apiserver logs:
crictl logs $(crictl ps | awk '/kube-apiserver/ {print $1}')
An example error that indicates a CA problem:
E1216 14:14:01.209890 1 authentication.go:73] "Unable to authenticate the request" err="[invalid bearer token, oidc: authenticator not initialized]"
E1216 14:14:06.695653 1 oidc.go:304] oidc authenticator: initializing plugin: Get "https://auth.clustername.ip-xx-xx-xx-xx.shturval.link/.well-known/openid-configuration": tls: failed to verify certificate: x509: certificate signed by unknown authority
If the problem is with the CA certificate, the administrator must obtain a valid certificate and add it to Control Plane nodes in /etc/ssl/certs/oidc.crt. The documentation states that the CA certificate is in the root-ca ConfigMap in the cert-manager namespace.
API server unavailable
Example error:
The connection to the server XXX.XXX.XXX.XXX:6443 was refused - did you specify the right host or port?
What you can do
- verify that the correct kubeconfig is in use;
- rule out the
localhost:8080situation described above; - obtain kubeconfig again using your chosen access method.
When you need an administrator
If the API server does not respond, contact the platform or cluster administrator to diagnose the failure or restart the service.