<p>I am running EKS cluster in the AWS. The version is 1.25.
Today I start to get this message:</p>
<pre><code>Internal error occurred: failed calling webhook &quot;vingress.elbv2.k8s.aws&quot;: failed to call webhook: Post &quot;https://aws-load-balancer-webhook-service.kube-system.svc:443/validate-networking-v1-ingress?timeout=10s&quot;: x509: certificate signed by unknown authority
</code></pre>
<p>How I can fix that?</p>

rholdberh
<p>Below trouble shotting steps will help you to resolve your issue:</p>
<p>1.As per this <a href="https://github.com/kubernetes-sigs/aws-load-balancer-controller/issues/2462" rel="nofollow noreferrer">git issue</a> enabling Port 9443 / TCP in the security group of worker nodes that is attached to the EC2 instances will resolve your issue. You can do it in either <a href="https://github.com/kubernetes-sigs/aws-load-balancer-controller/issues/2039#issuecomment-1189524910" rel="nofollow noreferrer">web via security group in ec2 instance</a> or by adding below terraform code:</p>
<pre><code>node_security_group_additional_rules = {
    ingress_allow_access_from_control_plane = {
      type                          = &quot;ingress&quot;
      protocol                      = &quot;tcp&quot;
      from_port                     = 9443
      to_port                       = 9443
      source_cluster_security_group = true
      description                   = &quot;Allow access from control plane to webhook port of AWS load balancer controller&quot;
    }
  }
</code></pre>
<p>2.Redeploy the service account on the cluster.</p>
<p>3.Check logs for more information.</p>
<p>4.You are also getting <code>x509: certificate signed by unknown authority</code>, check this <a href="https://www.positioniseverything.net/x509-certificate-signed-by-unknown-authority/" rel="nofollow noreferrer">document</a> curated by the site Position is Everything for troubleshooting. Check whether right webhook configuration has been set up and that the correct endpoints are being used. Check if certificates are properly installed and not expired. If certificates expired then renew it to clear this issue.</p>
