<p>I'm trying to add my Azure AKS Kubernetes cluster to my GitLab CI/CD Kubernetes integration.</p>

<p>I can execute <code>kubectl</code> commands on the cluster from my pc, after I ran this command:</p>

<p><code>az aks get-credentials --resource-group &lt;resource-group-name&gt; --name &lt;kubernetes-cluster-name&gt;</code></p>

<p>It created a <code>.kube/config</code> file with a content like this:</p>

<pre><code>apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: &lt;some long base64 string here&gt;
    server: https://&lt;resource-group-name+some-hexadecimal-chars&gt;.hcp.westeurope.azmk8s.io:443
  name: &lt;kubernetes-cluster-name&gt;
contexts:
- context:
    cluster: &lt;kubernetes-cluster-name&gt;
    user: clusterUser_&lt;resource-group-name&gt;_&lt;kubernetes-cluster-name&gt;
  name: &lt;kubernetes-cluster-name&gt;
current-context: &lt;kubernetes-cluster-name&gt;
kind: Config
preferences: {}
users:
- name: clusterUser_&lt;resource-group-name&gt;_&lt;kubernetes-cluster-name&gt;
  user:
    client-certificate-data: &lt;some long base64 string here&gt;
    client-key-data: &lt;some long base64 string here&gt;
    token: &lt;some secret string of hexadecimal chars here&gt;
</code></pre>

<p>In GitLab form, I have to input these fields:</p>

<ol>
<li>Kubernetes cluster name</li>
<li>API URL</li>
<li>CA Certificate - Certificate Authority bundle (PEM format)</li>
<li>Token</li>
<li>Project namespace (optional, unique)</li>
</ol>

<p>I tried these values:</p>

<ol>
<li>I put my <code>&lt;kubernetes-cluster-name&gt;</code> to match the name of the cluster on azure and the cluster name on the <code>.kube/config</code> file.</li>
<li>I put the url <code>https://&lt;resource-group-name+some-hexadecimal-chars&gt;.hcp.westeurope.azmk8s.io:443</code> copied from the <code>.kube/config</code> file.</li>
<li>I tried first the <code>certificate-authority-data</code> from the <code>.kube/config</code> file, but didn't work and I already tried all three base64 strings from the <code>.kube/config</code> file, none worked.</li>
<li>I put the token from the <code>.kube/config</code> file.</li>
<li>Leave this empty, as it is optional.</li>
</ol>

<p>In GitLab, When I try to hit the button <code>Install</code> to install the Helm Tiller, I got this error:</p>

<pre><code>Something went wrong while installing Helm Tiller
Can't start installation process. nested asn1 error
</code></pre>

<p>And sometimes I get this error instead:</p>

<pre><code>Kubernetes error: SSL_connect returned=1 errno=0 state=error: certificate verify failed
</code></pre>

<p>I'm trying to make this to work since yesterday, had google it a lot and doesn't find anything.</p>

<p>I think the problem is with this 3rd field, the CA Certificate, maybe there are some other way to get this content from the command line <code>az</code> or <code>kubectl</code>.</p>

<p>Are there someone here that already got this Kubernetes integration from GitLab to Azure AKS working?</p>

lmcarreiro
<p>I found out later that the base64 string in the <code>certificate-authority-data</code> of the <code>.kube/config</code> file that I was coping its content into the <code>CA Certificate</code> field of GitLab "Add Kubernetes cluster" form, it is the PEM format, but base64 encoded.</p>

<p>The PEM format already is a base64 encoded representation of the certificate bits, but it has some line breaks in the middle. This whole content is base64 encoded again before it goes to the <code>.kube/config</code> so it is turned into a big base64 single-line string.</p>

<p>I just had to base64 decode this big single-line string (I used the javascript <code>atob("....")</code> in the Chrome's Console window), what gave me something like this:</p>

<pre><code>-----BEGIN CERTIFICATE-----
MIIEyDCCArCgAwIBAgIRAOL3N8oMIwWIxcFTZhTkfgMwDQYJKoZIhvcNAQELBQAw
...
...
...
5gP7yoL1peZ+AWjCgcUVZYiItqrBLpWYDgY9g8btYDUIiWlqkmC0+kBaPfwCtckx
cUp3vlwRITrv0mzrxiQjTLTUpEy7EcD+U6IecA==
-----END CERTIFICATE-----
</code></pre>

<p>Then I just copied this content into the GitLab "CA Certificate" field and it worked.</p>
