<p>I search the previews post for this but I can't find the solution, sorry.</p>

<p>I install metrics server on kubeadm v1.12 and I get this error from the logs:</p>

<p>1 master node and 1 slave node, in private network.</p>

<pre><code>Get https://ip-10-0-1-154:10250/stats/summary/: x509: a certificate signed by an unknown authority, unable to fully scrape metrics from source 
</code></pre>

<p>I don't install any certificate.</p>

<p>How can I install a new certificate and where I need to change this without set up a new kubernetes cluster?</p>

<p>Sorry for the noob question, I tried to create a new certificate but I cannot make kubelet to change.</p>

<p>It's a problem with kubeadm in where it generates the <code>kubelet</code> certificates on the nodes under <code>/var/lib/kubelet/pki</code> (<code>kubelet.crt</code>,<code>kubelet.key</code>) signed by a different CA from the one used for the master(s) under <code>/etc/kubernetes/pki</code> (ca.crt). Some background <a href="https://github.com/kubernetes-incubator/metrics-server/issues/130" rel="nofollow noreferrer">here</a>
.
You'll have to regenerate the certificates for your kubelets signed by the CA on the master(s) <code>/etc/kubernetes/pki/ca.crt</code></p>

<p>You can follow something like <a href="https://kubernetes.io/docs/concepts/cluster-administration/certificates/" rel="nofollow noreferrer">this</a>. For example use <a href="https://github.com/cloudflare/cfssl" rel="nofollow noreferrer"><code>cfssl</code></a></p>

<p>Something like this:</p>

<pre><code>$ mkdir ~/mycerts; cd ~/mycerts
$ cp /etc/kubernetes/pki/ca.crt ca.pem
$ cp /etc/kubernetes/pki/ca.key ca-key.pem
</code></pre>

<p>Create a file <code>kubelet-csr.json</code> with something like this:</p>

<pre><code>{
  "CN": "kubernetes",
  "hosts": [
    "127.0.0.1",
    "&lt;your-node-name&gt;",
    "kubernetes",
    "kubernetes.default",
    "kubernetes.default.svc",
    "kubernetes.default.svc.cluster",
    "kubernetes.default.svc.cluster.local"
  ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [{
    "C": "US",
    "ST": "NY",
    "L": "City",
    "O": "Org",
    "OU": "Unit"
  }]
}
</code></pre>

<p>Create a <code>ca-config.json</code> file:</p>

<pre><code>{
  "signing": {
    "default": {
      "expiry": "8760h"
    },
    "profiles": {
      "kubernetes": {
        "usages": [
          "signing",
          "key encipherment",
          "server auth",
          "client auth"
        ],
        "expiry": "8760h"
      }
    }
  }
}
</code></pre>

<p>Create a <code>config.json</code> file:</p>

<pre><code>{
    "signing": {
        "default": {
            "expiry": "168h"
        },
        "profiles": {
            "www": {
                "expiry": "8760h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "server auth"
                ]
            },
            "client": {
                "expiry": "8760h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "client auth"
                ]
            }
        }
    }
}
</code></pre>

<p>Generate the certs:</p>

<pre><code>$ cfssl gencert -ca=ca.pem -ca-key=ca-key.pem \
  --config=ca-config.json -profile=kubernetes \
  kubelet-csr.json | cfssljson -bare kubelet
</code></pre>

<p>Copy the files to your nodes:</p>

<pre><code>$ scp kubelet.pem &lt;node-ip&gt;:/var/lib/kubelet/pki/kubelet.crt
$ scp kubelet-key.pem &lt;node-ip&gt;:/var/lib/kubelet/pki/kubelet.key
</code></pre>

<p>Restart the kubelet on your node:</p>

<pre><code>$ systemctl restart kubelet
</code></pre>

<p>PD. Opened <a href="https://github.com/kubernetes/kubeadm/issues/1223" rel="nofollow noreferrer">this</a> to track the issue.</p>
