<p>I googled and searched for the answer to my dilemma all answers I could find are not applicable, but they say this has been discussed many times.</p>
<p>Below is my actual cluster setup. 4 worker nodes, two masters, and one load balancer.</p>
<p><a href="https://i.stack.imgur.com/NR7P8.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/NR7P8.png" alt="Kubernetes Cluster Setup" /></a></p>
<p>I installed the dashboard</p>
<pre><code>XXXX@master01:~$ kubectl get pods --all-namespaces
NAMESPACE              NAME                                         READY   STATUS    RESTARTS   AGE
default                busybox                                      1/1     Running   30         30h
kube-system            coredns-78cb77577b-lbp87                     1/1     Running   0          30h
kube-system            coredns-78cb77577b-n7rvg                     1/1     Running   0          30h
kube-system            weave-net-d9jb6                              2/2     Running   7          31h
kube-system            weave-net-nsqss                              2/2     Running   0          39h
kube-system            weave-net-wnbq7                              2/2     Running   7          31h
kube-system            weave-net-zfsmn                              2/2     Running   0          39h
kubernetes-dashboard   dashboard-metrics-scraper-7b59f7d4df-dhcpn   1/1     Running   0          28h
kubernetes-dashboard   kubernetes-dashboard-665f4c5ff-6qnzp         1/1     Running   7          28h
</code></pre>
<p>I installed my service accounts and assigned them cluster-admin roles</p>
<pre><code>XXXX@master01:~$ kubectl get sa -n kubernetes-dashboard
NAME                   SECRETS   AGE
default                1         28h
kube-apiserver         1         25h
kubernetes-dashboard   1         28h
</code></pre>
<p>I am using the kube-apiserver user service account because it was easy to just load the certs in the browser I already have them.</p>
<p>Now I try to access the dashboard using the load balancer:
<em><a href="https://loadbalancer.local:6443/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/" rel="nofollow noreferrer">https://loadbalancer.local:6443/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/</a></em></p>
<p>at this point one would think I should get the dashboard and every question I have encountered makes that assumption but I am getting the following error:</p>
<pre><code>{
  &quot;kind&quot;: &quot;Status&quot;,
  &quot;apiVersion&quot;: &quot;v1&quot;,
  &quot;metadata&quot;: {
    
  },
  &quot;status&quot;: &quot;Failure&quot;,
  &quot;message&quot;: &quot;error trying to reach service: dial tcp 10.36.0.1:8443: i/o timeout&quot;,
  &quot;code&quot;: 500
}
</code></pre>
<p>so I decided to pull the logs:</p>
<pre><code>kubectl logs -n kubernetes-dashboard service/kubernetes-dashboard                                                                   

Error from server: Get &quot;https://worker04:10250/containerLogs/kubernetes-dashboard/kubernetes-dashboard-665f4c5ff-6qnzp/kubernetes-dashboard&quot;: x509: certificate signed by unknown
authority
</code></pre>
<p>all I get is this one line and I had an idea of finding out what the issue is with the certification from this worker node: <strong>worker04:10250</strong>
I used OpenSSL to check the certificate and I discovered the following:
worker04 has generated its own certificate alright, but it also generated its own CA as well.</p>
<p>and this is where I am with no idea how to fix this and bring up a dashboard.
I also tried a proxy on <strong>master01</strong>:</p>
<pre><code>kubectl -v=9 proxy --port=8001 --address=192.168.1.24
</code></pre>
<p>and all I got was 403 Forbidden!</p>

tinashe.chipomho
<p>I made some progress with this, I figured out that when a node generate and registers itself to a cluster, it is generating its own certificate CSR signed by its own generated CA, to fix this I generated the certificates for all the nodes signed by the cluster CA and simply replaced the auto generated certificates and restarted the nodes..</p>
