<p>I am trying to set up a k8s cluster with couple of ubuntu instances on AWS.</p>
<p>I have successfully installed</p>
<ul>
<li>docker</li>
<li>kubelet</li>
<li>kubeadm</li>
<li>kubectl etc</li>
</ul>
<p>The machines IPs are like this. They are all the in same network. Firewall is fully enabled. I am able to telnet port 6443 etc.</p>
<p>IP and Hostnames</p>
<pre><code>10.0.0.100 (ip-10-0-0-100.ca-central-1.compute.internal)
10.0.0.101 (ip-10-0-0-101.ca-central-1.compute.internal)
10.0.0.102 (ip-10-0-0-102.ca-central-1.compute.internal)
</code></pre>
<p><strong>10.0.0.100</strong>:</p>
<p>I ran this command</p>
<pre><code>kubeadm init --apiserver-advertise-address=10.0.0.100 --pod-network-cidr=192.168.0.0/16
</code></pre>
<p>It issued a token with join command.</p>
<p><strong>10.0.0.101:</strong></p>
<p>I ran the command join command on 10.0.0.101 and It got timed out. (Fresh Token &amp; not yet expired)</p>
<pre><code>Failed to request cluster-info, will try again: Get &quot;https://10.0.0.100:6443/api/v1/namespaces/kube-public/configmaps/cluster-info?timeout=10s&quot;: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers) 
</code></pre>
<p><strong>10.0.0.100:</strong></p>
<p>So i was trying to access on the master node. The api-server was not even accessible on same node. even via localhost:6443 does not work.</p>
<pre><code>curl https://10.0.0.100:6443/api/v1/namespaces/kube-public/configmaps/cluster-info
</code></pre>
<p>Getting below error.</p>
<pre><code>curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
</code></pre>
<p>Interestingly this works.</p>
<pre><code>curl -k https://10.0.0.100:6443/api/v1/namespaces/kube-public/configmaps/cluster-info
</code></pre>
<p>What could be the reason?</p>
<hr />
<p>nslookup ip shows something like this.</p>
<pre><code>nslookup 10.0.0.101
101.0.0.10.in-addr.arpa name = ip-10-0-0-101.ca-central-1.compute.internal.

Authoritative answers can be found from:
</code></pre>

<p>we need to verify two things :</p>
<ol>
<li>whether apiserver is functional or not using curl from master node :</li>
</ol>
<pre class="lang-sh prettyprint-override"><code>sudo curl --cacert /etc/kubernetes/pki/ca.crt --cert /etc/kubernetes/pki/apiserver-kubelet-client.crt --key /etc/kubernetes/pki/apiserver-kubelet-client.key https://10.0.0.100:6443/v1/namespaces/kube-public/configmaps/cluster-info
</code></pre>
<ol start="2">
<li>whether name resolution is working fine among the nodes :</li>
</ol>
<ul>
<li>following commands need to be ran on all nodes to verify  :</li>
</ul>
<pre class="lang-sh prettyprint-override"><code>nslookup 10.0.0.101 
nslookup 10.0.0.100
nslookup 10.0.0.102
</code></pre>
<ul>
<li>if the nslookup is resolving those ip addresses then you need to add following entries in <code>/etc/hosts</code> file on all nodes :</li>
</ul>
<pre><code>10.0.0.100 ip-10-0-0-100.ca-central-1.compute.internal
10.0.0.101 ip-10-0-0-101.ca-central-1.compute.internal
10.0.0.102 ip-10-0-0-102.ca-central-1.compute.internal
</code></pre>
<ul>
<li>after updating /etc/hosts file , re-verify using nslookup commands :</li>
</ul>
<pre class="lang-sh prettyprint-override"><code>nslookup 10.0.0.101 
nslookup 10.0.0.100
nslookup 10.0.0.102
</code></pre>
<ul>
<li>try to re-add the node using join command</li>
</ul>
