-
Bug
-
Resolution: Unresolved
-
Major
-
None
-
4.19.z
-
Quality / Stability / Reliability
-
False
-
-
None
-
Important
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
Description of problem:
Reporting this issue as a follow up to OCPBUGS-56896.
When https proxy is configured, nodes can not properly start. The kubelet can't communicate with the KAS and fails:
Jun 03 11:27:43 ip-10-0-129-15 kubenswrapper[2436]: E0603 11:27:43.168986 2436 kubelet_node_status.go:110] "Unable to register node with API server" err="Post \"https://a7ff164001b37429e89c0fdc1432452a-cfabcbf764fb12be.elb.us-east-1.amazonaws.com:6443/api/v1/nodes\": proxyconnect tcp: tls: failed to verify certificate: x509: certificate signed by unknown authority" node="ip-10-0-129-15.ec2.internal"
Version-Release number of selected component (if applicable):
4.19
How reproducible:
Always
Steps to Reproduce:
1. Start a hosted cluster with --enable-secure-proxy option:
hypershift create cluster aws \
--name=${CLUSTER_NAME} \
--namespace=${NAMESPACE} \
--node-pool-replicas=${REPLICAS} \
--base-domain=${BASE_DOMAIN} \
--endpoint-access=${ENDPOINT_ACCESS} \
--region=${REGION} \
--pull-secret=${PULL_SECRET} \
--release-image=${RELEASE_IMAGE} \
--generate-ssh \
--aws-creds=${AWS_CREDS} \
--enable-secure-proxy
Actual results:
The HostedCluster then has this config:
spec: configuration: proxy: httpProxy: http://10.0.132.128:3128 httpsProxy: https://10.0.132.128:3128 trustedCA: name: hc1-proxy-ca
There are no nodes and the NodePool reports this status:
- lastTransitionTime: "2025-06-03T11:21:03Z"
message: Minimum availability requires 5 replicas, current 0 available
observedGeneration: 1
reason: WaitingForAvailableMachines
status: "False"
type: Ready
Expected results:
The hosted cluster properly starts
Additional info:
More information in comments on OCPBUGS-56896
- relates to
-
-
- ASSIGNED
-
-
-
- Closed
-