<p>I have a cluster provisioned using KubeSpray on AWS. It has two bastions, one controller, one worker, and one etcd server.</p>
<p>I am seeing endless messages in the APISERVER logs:</p>
<pre><code>http: TLS handshake error from 10.250.227.53:47302: EOF
</code></pre>
<p>They come from two IP addresses, <code>10.250.227.53</code> and <code>10.250.250.158</code>. The port numbers change every time.</p>
<p>None of the cluster nodes correspond to those two IP addresses. The subnet cidr ranges are shown below.</p>
<p><a href="https://i.stack.imgur.com/VlBMs.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/VlBMs.png" alt="Two private and two public cluster subnets" /></a></p>
<p>The cluster seems stable. This behavior does not seem to have any negative affect. But I don't like having random HTTPS requests.</p>
<p>How can I debug this issue?</p>

David Medinets
<p>They're from the health check configured on the AWS ELB; you can stop those messages by <a href="https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-healthchecks.html#update-health-check-config" rel="nofollow noreferrer">changing the health check configuration</a> to be <code>HTTPS:6443/healthz</code> instead of the likely <a href="https://github.com/kubernetes-sigs/kubespray/blob/v2.13.2/contrib/terraform/aws/modules/elb/main.tf#L45" rel="nofollow noreferrer"><code>TCP</code> one it is using now</a></p>
<blockquote>
<p>How can I debug this issue?</p>
</blockquote>
<p>Aside from just generally being cognizant of how your cluster was installed, and then observing that those connections come at regular intervals, I would further bet that those two IP addresses belong to the two ENIs that are allocated to the ELB in each public subnet (they'll show up in the Network Interfaces list on the console as &quot;owner: elasticloadbalancer&quot; or something similar)</p>
