Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-5052

kube-apiserver pods crashed when certificate has expired

XMLWordPrintable

    • Important
    • Rejected
    • False
    • Hide

      None

      Show
      None

      Description of problem:

       

      #  oc -n openshift-kube-apiserver get pod | grep -Ev "Completed|Running"
      NAME                                                      READY   STATUS                 RESTARTS      AGE
      kube-apiserver-preserve-jiazha1219-jxqln-master-0         4/5     CreateContainerError   5 (39m ago)   95m
      kube-apiserver-preserve-jiazha1219-jxqln-master-1         4/5     CreateContainerError   5 (36m ago)   93m
      
      
      E1219 02:51:55.871544      15 reflector.go:138] vendor/github.com/openshift/client-go/quota/informers/externalversions/factory.go:101: Failed to watch *v1.ClusterResourceQuota: failed to list *v1.ClusterResourceQuota: Get "https://[::1]:6443/apis/quota.openshift.io/v1/clusterresourcequotas?limit=500&resourceVersion=0": x509: certificate has expired or is not yet valid: current time 2022-12-19T02:51:55Z is before 2022-12-19T09:51:50Z
      F1219 02:51:55.876636      15 controller.go:178] Unable to perform initial IP allocation check: unable to refresh the service IP block: Get "https://[::1]:6443/api/v1/services": x509: certificate has expired or is not yet valid: current time 2022-12-19T02:51:55Z is before 2022-12-19T09:51:50Z
      goroutine 3630 [running]:
      ...
      goroutine 1 [chan receive]:

      Version-Release number of selected component (if applicable):

      4.11.0-0.nightly-2022-12-16-190443

      How reproducible:

       

      Steps to Reproduce:

      1. Install a OCP 4.11 on Alibaba cloud, such as https://mastern-jenkins-csb-openshift-qe.apps.ocp-c1.prod.psi.redhat.com/job/ocp-common/job/Flexy-install/165506/artifact/workdir/install-dir/auth/kubeconfig/*view*/ 
      
      2. Wait 
      x509: certificate has expired or is not yet valid: current time 2022-12-19T02:51:55Z is before 2022-12-19T09:51:50Z
      
      3.
      

      Actual results:

      kube-apiserver pods crashed

      Expected results:

      kube-apiserver can handle x509 certificate expiration, not goroutine panic

      Additional info:

       

       

            Unassigned Unassigned
            rhn-support-jiazha Jian Zhang
            Ke Wang Ke Wang
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: