<p>After applying certificates renewal, I have the following issue. Only one master is ready</p>
<pre><code>root@cl9master1:~# kubectl get nodes | grep master
cl9master1    Ready      master   401d   v1.15.0
cl9master2    NotReady   master   401d   v1.15.0
cl9master3    NotReady   master   401d   v1.15.0
</code></pre>
<p>The logs returned by &quot;journalctl -xeu kubelet&quot; :</p>
<pre><code>août 07 09:52:15 cl9master2 kubelet[1101]: E0807 09:52:15.043958    1101 reflector.go:125] k8s.io/client-go/informers/factory.go:133: 
Failed to list *v1beta1.CSIDrriver: csidrivers.storage.k8s.io is forbidden: User &quot;default-auth&quot; cannot list ressource &quot;csidrivers&quot; in API group &quot;storage.k8s.io&quot; 
at the cluster scope

août 07 09:52:15 cl9master2 kubelet[1101]: E0807 09:52:15.088813    1101 kubelet.go:2248] node &quot;cl9master2&quot; not found
août 07 09:52:15 cl9master2 kubelet[1101]: E0807 09:52:15.189120    1101 kubelet.go:2248] node &quot;cl9master2&quot; not found
août 07 09:52:15 cl9master2 kubelet[1101]: E0807 09:52:15.236669    1101 reflector.go:125] k8s.io/kubernetes/pkg/kubelet/kubelet.go:444: 
Failed to list *v1.Service: services is forbidden: User &quot;default-auth&quot; cannot list resource &quot;services&quot; in API group &quot;&quot; at the cluster scope
août 07 09:52:15 cl9master2 kubelet[1101]: E0807 09:52:15.289371    1101 kubelet.go:2248] node &quot;cl9master2&quot; not found
août 07 09:52:15 cl9master2 kubelet[1101]: E0807 09:52:15.389664    1101 kubelet.go:2248] node &quot;cl9master2&quot; not found
</code></pre>
<p>Looking at the kubectl.conf, there are differences between master1 and master2/3</p>
<p>For master1:</p>
<pre><code>root@cl9master1:~# cat /etc/kubernetes/kubelet.conf
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: LS0t...LQo=
    server: https://10.35.104.69:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: system:node:cl9master1
  name: system:node:cl9master1@kubernetes
current-context: system:node:cl9master1@kubernetes
kind: Config
preferences: {}
users:
- name: system:node:cl9master1
  user:
    client-certificate: /var/lib/kubelet/pki/kubelet-client-current.pem
    client-key: /var/lib/kubelet/pki/kubelet-client-current.pem
</code></pre>
<p>For master2</p>
<pre><code>root@cl9master2:~# cat /etc/kubernetes/kubelet.conf
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: LS0t...LQo=
    server: https://10.35.104.75:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: default-auth
  name: default-auth@kubernetes
current-context: default-auth@kubernetes
kind: Config
preferences: {}
users:
- name: default-auth
  user:
    client-certificate: /var/lib/kubelet/pki/kubelet-client-current.pem
    client-key: /var/lib/kubelet/pki/kubelet-client-current.pem
</code></pre>
<p>What can I check and how to fix this?
Thanks a lot!</p>

acs platform
<p>Node users must be in system:nodes (if it is worker node or system:master if it is master node) group, it looks like master2 use default-auth which is out of system:nodes group and doesn't have correct permission to list the services. If your node is outside of system:nodes group then you need to have proper RBAC set for the user default-auth to make it work.</p>
<p>You can fix this is in 2 ways:</p>
<ol>
<li>Change the master2 user group into system:nodes (like user: system:node:cl9master2) note: certificates also need to created with proper Oranisation &amp; CN value</li>
<li>or Create a proper RBAC for default-auth user.</li>
</ol>
<p>Please refer docs page <a href="https://kubernetes.io/docs/reference/access-authn-authz/node/" rel="nofollow noreferrer">enter link description here</a></p>
<p>Thanks,
Kiruba</p>
