# Self-signed certs prevent kubectl from working

**URL:** <https://forums.suse.com/t/self-signed-certs-prevent-kubectl-from-working/43295>\
**Category:** General\
**Created:** [May 29, 2024, 6:33pm UTC](https://forums.suse.com/t/self-signed-certs-prevent-kubectl-from-working/43295 "2024-05-29T18:33:02Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![thezog](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/thezog/32/7202_2.png) [@thezog](https://forums.suse.com/u/thezog)\
**Post date:** [May 29, 2024, 6:33pm UTC](https://forums.suse.com/t/self-signed-certs-prevent-kubectl-from-working/43295/1 "2024-05-29T18:33:02Z")

</div>

I just did a fresh, clean install of rke version v1.28.10+rke2r1 using the install scripts on Ubuntu 20.04.6 LTS. I’m running the command from the master server but it fails on any other system where I install the .kube/config file.

When I run any kubectl command, I see:

```auto
E0529 18:15:36.038865 914067 memcache.go:238] couldn't get current server API group list: Get "https://127.0.0.1:6443/api?timeout=32s": x509: certificate signed by unknown authority
Unable to connect to the server: x509: certificate signed by unknown authority

```

The installer is supposed to generate new certs and keys, right?

Thanks for any help.

---

<div class="post-metadata">

**Author:** ![malcolmlewis1](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/malcolmlewis1/32/10022_2.png) [@malcolmlewis1](https://forums.suse.com/u/malcolmlewis1)\
**Post date:** [May 29, 2024, 9:30pm UTC](https://forums.suse.com/t/self-signed-certs-prevent-kubectl-from-working/43295/2 "2024-05-29T21:30:20Z")

</div>

@thezog did you edit the config file on the other systems to change 127.0.0.1 to the ip address of the RKE2 node…

---

<div class="post-metadata">

**Author:** ![thezog](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/thezog/32/7202_2.png) [@thezog](https://forums.suse.com/u/thezog)\
**Post date:** [May 29, 2024, 9:32pm UTC](https://forums.suse.com/t/self-signed-certs-prevent-kubectl-from-working/43295/3 "2024-05-29T21:32:15Z")

</div>

Are you talking about config.yaml or rke2.yaml?

---

<div class="post-metadata">

**Author:** ![thezog](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/thezog/32/7202_2.png) [@thezog](https://forums.suse.com/u/thezog)\
**Post date:** [May 29, 2024, 9:41pm UTC](https://forums.suse.com/t/self-signed-certs-prevent-kubectl-from-working/43295/4 "2024-05-29T21:41:16Z")

</div>

And BTW, all the nodes are rke2 nodes. Should I assume you mean the IP address of the master node?

---

<div class="post-metadata">

**Author:** ![malcolmlewis1](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/malcolmlewis1/32/10022_2.png) [@malcolmlewis1](https://forums.suse.com/u/malcolmlewis1)\
**Post date:** [May 29, 2024, 10:02pm UTC](https://forums.suse.com/t/self-signed-certs-prevent-kubectl-from-working/43295/5 "2024-05-29T22:02:06Z")

</div>

@thezog rke2.yaml I normally have multiple directories for notes etc, so my SoP is;

```auto
scp -- root@node:/etc/rancher/rke2/rke2.yaml $(pwd)
sed -i 's/127.0.0.1/xxx.xxx.xxx.xxx/g' rke2.yaml
export KUBECONFIG=$(pwd)/rke2.yaml

```

---

<div class="post-metadata">

**Author:** ![thezog](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/thezog/32/7202_2.png) [@thezog](https://forums.suse.com/u/thezog)\
**Post date:** [May 29, 2024, 10:49pm UTC](https://forums.suse.com/t/self-signed-certs-prevent-kubectl-from-working/43295/6 "2024-05-29T22:49:32Z")

</div>

Weird. I sure don’t remember needing to copy the rke2.yaml from master to slave (agent) nodes.

On the agent node I see,  
`May 29 22:44:43 cp2 rke2[49211]: time="2024-05-29T22:44:43Z" level=fatal msg="Failed to reconcile with temporary etcd: bootstrap data already found and encrypted with different token"`

I guess I need to wipe the old etcd database somewhere. Probably the local  
Or something.

---

<div class="post-metadata">

**Author:** ![malcolmlewis1](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/malcolmlewis1/32/10022_2.png) [@malcolmlewis1](https://forums.suse.com/u/malcolmlewis1)\
**Post date:** [May 29, 2024, 11:44pm UTC](https://forums.suse.com/t/self-signed-certs-prevent-kubectl-from-working/43295/7 "2024-05-29T23:44:03Z")

</div>

No that’s for a local machine to contact the cluster nodes/master

---

<div class="post-metadata">

**Author:** ![malcolmlewis1](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/malcolmlewis1/32/10022_2.png) [@malcolmlewis1](https://forums.suse.com/u/malcolmlewis1)\
**Post date:** [May 30, 2024, 12:03am UTC](https://forums.suse.com/t/self-signed-certs-prevent-kubectl-from-working/43295/8 "2024-05-30T00:03:06Z")

</div>

@thezog Did you edit the config.yaml and add tls-san?

---

<div class="post-metadata">

**Author:** ![thezog](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/thezog/32/7202_2.png) [@thezog](https://forums.suse.com/u/thezog)\
**Post date:** [June 4, 2024, 4:17pm UTC](https://forums.suse.com/t/self-signed-certs-prevent-kubectl-from-working/43295/9 "2024-06-04T16:17:40Z")

</div>

Please archive this tread. I had some old config running in this cluster. there was a broken nginx ingress set up. I wiped the entire cluster of VMs.