{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/67345","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/67345/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/67345/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/67345/events","html_url":"https://github.com/kubernetes/kubernetes/issues/67345","id":350126459,"node_id":"MDU6SXNzdWUzNTAxMjY0NTk=","number":67345,"title":"Error connecting to cluster when certificate is added to OSX keychain","user":{"login":"dmfenton","id":7832202,"node_id":"MDQ6VXNlcjc4MzIyMDI=","avatar_url":"https://avatars1.githubusercontent.com/u/7832202?v=4","gravatar_id":"","url":"https://api.github.com/users/dmfenton","html_url":"https://github.com/dmfenton","followers_url":"https://api.github.com/users/dmfenton/followers","following_url":"https://api.github.com/users/dmfenton/following{/other_user}","gists_url":"https://api.github.com/users/dmfenton/gists{/gist_id}","starred_url":"https://api.github.com/users/dmfenton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dmfenton/subscriptions","organizations_url":"https://api.github.com/users/dmfenton/orgs","repos_url":"https://api.github.com/users/dmfenton/repos","events_url":"https://api.github.com/users/dmfenton/events{/privacy}","received_events_url":"https://api.github.com/users/dmfenton/received_events","type":"User","site_admin":false},"labels":[{"id":105146071,"node_id":"MDU6TGFiZWwxMDUxNDYwNzE=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/kind/bug","name":"kind/bug","color":"e11d21","default":false},{"id":450823910,"node_id":"MDU6TGFiZWw0NTA4MjM5MTA=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/sig/cli","name":"sig/cli","color":"d2b48c","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-08-13T17:42:29Z","updated_at":"2018-11-27T21:50:42Z","closed_at":null,"author_association":"NONE","body":"/kind bug\r\n\r\n**What happened**:\r\n\r\nAttempting to run `kubectl get pods` against a cluster when the certificate has been added as trusted to the OSX keychain receive the following error:\r\n\r\n`Unable to connect to the server: x509: certificate signed by unknown authority (possibly because of \"crypto/rsa: verification error\" while trying to verify candidate authority certificate \"kubernetes\")`\r\n\r\n**What you expected to happen**:\r\n\r\nI expected to see a list of pods.\r\n\r\n**How to reproduce it (as minimally and precisely as possible)**:\r\n\r\n- add the kubernetes API cert to OSX keychain\r\n- create and use a kube context that **does not** point to certificate authority data\r\n- run `kubectl get pods`\r\n\r\n**Anything else we need to know?**:\r\n\r\nThis problem does not occur on kubectl v1.9.6\r\n\r\n**Environment**:\r\n- Kubernetes version (use `kubectl version`):\r\nClient Version: version.Info{Major:\"1\", Minor:\"11\", GitVersion:\"v1.11.1\", GitCommit:\"b1b29978270dc22fecc592ac55d903350454310a\", GitTreeState:\"clean\", BuildDate:\"2018-07-18T11:37:06Z\", GoVersion:\"go1.10.3\", Compiler:\"gc\", Platform:\"darwin/amd64\"}\r\n- Cloud provider or hardware configuration:\r\nAWS\r\n- OS (e.g. from /etc/os-release):\r\nDarwin\r\n- Kernel (e.g. `uname -a`):\r\nDarwin 17.6.0 Darwin Kernel Version 17.6.0: Tue May  8 15:22:16 PDT 2018; root:xnu-4570.61.1~1/RELEASE_X86_64 x86_64\r\n- Install tools:\r\n- Others:\r\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/442230616","html_url":"https://github.com/kubernetes/kubernetes/issues/67345#issuecomment-442230616","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/67345","id":442230616,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0MjIzMDYxNg==","user":{"login":"structurefall","id":5455112,"node_id":"MDQ6VXNlcjU0NTUxMTI=","avatar_url":"https://avatars1.githubusercontent.com/u/5455112?v=4","gravatar_id":"","url":"https://api.github.com/users/structurefall","html_url":"https://github.com/structurefall","followers_url":"https://api.github.com/users/structurefall/followers","following_url":"https://api.github.com/users/structurefall/following{/other_user}","gists_url":"https://api.github.com/users/structurefall/gists{/gist_id}","starred_url":"https://api.github.com/users/structurefall/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/structurefall/subscriptions","organizations_url":"https://api.github.com/users/structurefall/orgs","repos_url":"https://api.github.com/users/structurefall/repos","events_url":"https://api.github.com/users/structurefall/events{/privacy}","received_events_url":"https://api.github.com/users/structurefall/received_events","type":"User","site_admin":false},"created_at":"2018-11-27T21:50:42Z","updated_at":"2018-11-27T21:50:42Z","author_association":"NONE","body":"I'm having a very similar issue. Due to some complexities of my environment, I need kubectl to hit a proxy with an internally-signed cert whose CA is trusted in the keychain, which was resulting in the following:\r\n\r\n`$ kubectl get pods\r\nUnable to connect to the server: x509: certificate signed by unknown authority`\r\n\r\nI'm getting around it for now by printing the CA with `security find-certificate -p` converted to base64 and then using that as `certificate-authority-data`, but it's very awkward.\r\n\r\nHere's my environment:\r\n\r\n**Environment:**\r\n\r\n- Kubernetes version (use kubectl version):\r\n  Client Version: version.Info{Major:\"1\", Minor:\"12\", GitVersion:\"v1.12.3\", GitCommit:\"435f92c719f279a3a67808c80521ea17d5715c66\", GitTreeState:\"clean\", BuildDate:\"2018-11-27T01:15:02Z\", GoVersion:\"go1.11.2\", Compiler:\"gc\", Platform:\"darwin/amd64\"}\r\n- Cloud provider or hardware configuration:\r\n- GKE\r\n- OS (e.g. from /etc/os-release):\r\n- Darwin\r\n- Kernel (e.g. uname -a):\r\n- Darwin 17.7.0 Darwin Kernel Version 17.7.0: Wed Oct 10 23:06:14 PDT 2018; root:xnu-4570.71.13~1/RELEASE_X86_64 x86_64"}}
{"actor":{"display_login":"structurefall"}}