<p>I'm setting up a k8s cluster on premise using kubespray.</p>
<p>I'm trying to harden the kubernetes cluster using CIS Benchmark documentation.</p>
<p>For the <code>--kubelet-certificate-authority</code> argument I set up the TLS connection between the apiserver and kubelets. Then, I edited the API server pod specification file <code>/etc/kubernetes/manifests/kube-apiserver.yaml</code> on the master node and set the <code>--kubelet-certificate-authority</code> parameter for the certificate authority like this : <code>--kubelet-certificate-authority=/etc/kubernetes/ssl/apiserver.crt</code></p>
<p>But with that I'm not longer able top deploy pods (using helm), having the known error :</p>
<blockquote>
<p>[centos@infra-vm ~]$ helm list
Error: forwarding ports: error upgrading connection: error dialing backend: x509: cannot validate certificate for 192.168.33.143 because it doesn't contain any IP SANs</p>
</blockquote>
<p>Where <code>192.168.33.143</code> is the master node IP address.</p>
<p>I've checked the above certificate autority and is has IP SANs :
<a href="https://i.stack.imgur.com/G7nKE.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/G7nKE.png" alt="enter image description here" /></a></p>
<p>So I really can't figure out where the issue comes from .</p>
<pre><code>[centos@infra-vm ~]$ kubectl get pod --namespace kube-system
NAME                                        READY   STATUS    RESTARTS   AGE
calico-kube-controllers-7555c9885c-tjz78    1/1     Running   0          3d21h
calico-node-2p4p4                           1/1     Running   0          3d21h
calico-node-4rhzj                           1/1     Running   0          3d21h
coredns-56bc6b976d-wrxsl                    1/1     Running   0          3d21h
coredns-56bc6b976d-zlvxb                    1/1     Running   0          3d21h
dns-autoscaler-5fc5fdbf6-sl6gg              1/1     Running   0          3d21h
kube-apiserver-cpu-node0                    1/1     Running   0          3d21h
kube-controller-manager-cpu-node0           1/1     Running   0          3d21h
nvidia-device-plugin-daemonset-1.12-zj82x   1/1     Running   0          3d20h
tiller-deploy-677fbf76bb-hcgtw              1/1     Running   0          3d21h

[centos@infra-vm ~]$ kubectl logs tiller-deploy-677fbf76bb-hcgtw  --namespace kube-system
Error from server: Get https://192.168.33.143:10250/containerLogs/kube-system/tiller-deploy-677fbf76bb-hcgtw/tiller: x509: cannot validate certificate for 192.168.33.143 because it doesn't contain any IP SANs
[centos@infra-vm ~]$
</code></pre>
<p>Could one try to help figure out what is going on?</p>

<p>First of all <code>/etc/kubernetes/ssl/apiserver.crt</code> is not a valid CA certificate.
CA would have:</p>
<pre><code>    X509v3 extensions:
        X509v3 Key Usage: critical
            Digital Signature, Key Encipherment, Certificate Sign
</code></pre>
<p>Notice <code>Certificate Sign</code> extension that allows for signing certificates.</p>
<hr />
<p>You are seeing this error: <code>cannot validate certificate for 192.168.33.143 because it doesn't contain any IP SANs</code> because kubelet is using self signed certificates to serve https traffic on port 10250 and you are using invalid certificate to validate it.</p>
<hr />
<p>So what should you do to make it work??</p>
<ul>
<li>Use <code>/etc/kubernetes/ssl/ca.crt</code> to sign new certificate for kubelet with valid IP SANs.</li>
<li>Set <code>--kubelet-certificate-authority=/etc/kubernetes/ssl/ca.crt</code> (valid CA).</li>
<li>In <code>/var/lib/kubelet/config.yaml</code> (kubelet config file) set <code>tlsCertFile</code> and <code>tlsPrivateKeyFile</code> to point to newly created kubelet <code>crt</code> and <code>key</code> files.</li>
</ul>
