<p>I am trying to setup a multi-stage ADO pipeline using ADO pipeline Environment feature.</p>
<p>Stage 1: Builds the Spring-boot based Java Micro-service using Maven.</p>
<p>Stage 2: Deploys the above using Helm 3. The HelmDeploy@0 task uses Environment which has a Resource called tools-dev (a kubernetes namespace) where I want this service to be deployed using Helm chart.</p>
<p>It fails at the last step with this error:</p>
<pre><code>/usr/local/bin/helm upgrade --install --values /azp/agent/_work/14/a/values.yaml --wait --set ENV=dev --set-file appProperties=/azp/agent/_work/14/a/properties.yaml --history-max 2 --stderrthreshold 3 java-rest-template k8s-common-helm/rest-template-helm-demo

Error: Kubernetes cluster unreachable: Get &quot;https://rancher.msvcprd.windstream.com/k8s/clusters/c-gkffz/version?timeout=32s&quot;: x509: certificate signed by unknown authority
##[error]Error: Kubernetes cluster unreachable: Get &quot;https://rancher.msvcprd.windstream.com/k8s/clusters/c-gkffz/version?timeout=32s&quot;: x509: certificate signed by unknown authority**
</code></pre>
<p>Finishing: Helm Deploy</p>
<p>I created the Kubernetes resource in the Environment using the kubectl commands specified in the settings section.</p>
<p><strong>Deploy stage pipeline excerpt:</strong></p>
<pre><code>- stage: Deploy
  displayName: kubernetes deployment
  dependsOn: Build
  condition: succeeded('Build')
  jobs:
  - deployment: deploy
    pool: $(POOL_NAME)
    displayName: Deploy
    environment: dev-az-s-central-k8s2.tools-dev
    strategy:
      runOnce:
        deploy: 
          steps:
          - bash: |
              helm repo add \
                k8s-common-helm \
                http://nexus.windstream.com/repository/k8s-helm/
              helm repo update
            displayName: 'Add and Update Helm repo'
            failOnStderr: false
          - task: HelmDeploy@0
            inputs:
              command: 'upgrade'
              releaseName: '$(RELEASE_NAME)'
              chartName: '$(HELM_CHART_NAME)'
              valueFile: '$(Build.ArtifactStagingDirectory)/values.yaml'
              arguments: '--set ENV=$(ENV) --set-file appProperties=$(Build.ArtifactStagingDirectory)/properties.yaml  --history-max 2 --stderrthreshold 3'
            displayName: 'Helm Deploy'
</code></pre>
<p>Environment Settings:
Name: dev-az-s-central-k8s2
Resource: tools-dev   (Note: this is an on-prem k8s cluster that I am trying to connect to).</p>
<p>Can you please let me know what additional configuration is required to resolve this x509 certificate issue?</p>

Priyank Gupta
<p>Check <a href="https://helm.sh/docs/faq/#on-gke-google-container-engine-i-get-no-ssh-tunnels-currently-open" rel="nofollow noreferrer">this</a> documentation:</p>
<blockquote>
<p>The issue is that your local Kubernetes config file must have the
correct credentials.</p>
<p>When you create a cluster on GKE, it will give you credentials,
including SSL certificates and certificate authorities. These need to
be stored in a Kubernetes config file (Default: <code>~/.kube/config</code>) so
that <code>kubectl</code> and <code>helm</code> can access them.</p>
</blockquote>
<p>Also, check answer in case <a href="https://stackoverflow.com/questions/63050980/helm-3-x509-error-when-connecting-to-local-kubernetes">Helm 3: x509 error when connecting to local Kubernetes</a></p>
<blockquote>
<p>Helm looks for kubeconfig at this path $HOME/.kube/config.</p>
<p>Please run this command</p>
<pre><code>microk8s.kubectl config view --raw &gt; $HOME/.kube/config
</code></pre>
<p>This will save the config at required path in your directory and shall
work</p>
</blockquote>
