<p>I deployed a helm chart onto an isolated server and in the self-signed certificate HTTPS post it does to the kube-api it is failing w/ this error: </p>

<p>curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to kubernetes.default.svc:443</p>

<p>Anyone seen it before? This is the “POST”:</p>

<pre><code>echo "Creating a secret for the certificate and keys"
 STATUS=$(curl -ik \
            -o ${TMP_DIR}/output \
            -w "%{http_code}" \
            -X POST \
            -H "Authorization: Bearer $TOKEN" \
            -H 'Accept: application/json' \
            -H 'Content-Type: application/json' \
            -d '{
            "kind": "Secret",
            "apiVersion": "v1",
            "metadata": {
              "name": "spark-webhook-certs",
              "namespace": "'"$NAMESPACE"'"
            },
            "data": {
              "ca-cert.pem": "'"$ca_cert"'",
              "ca-key.pem": "'"$ca_key"'",
              "server-cert.pem": "'"$server_cert"'",
              "server-key.pem": "'"$server_key"'"
            }
           }' \
           https://kubernetes.default.svc/api/v1/namespaces/${NAMESPACE}/secrets 

</code></pre>

<p>The error is occuring due to a self signed certificate whose .sh is being invoked by a docker image command here: <a href="https://github.com/GoogleCloudPlatform/spark-on-k8s-operator/blob/master/hack/gencerts.sh" rel="nofollow noreferrer">https://github.com/GoogleCloudPlatform/spark-on-k8s-operator/blob/master/hack/gencerts.sh</a> </p>

<p>I know it's not getting to the end of this because it's failing to make the secret it's trying to post. Where do y'all think I should look to start troubleshooting? I've posted additional info here including screen shots: <a href="https://github.com/GoogleCloudPlatform/spark-on-k8s-operator/issues/926" rel="nofollow noreferrer">https://github.com/GoogleCloudPlatform/spark-on-k8s-operator/issues/926</a> </p>

A. B. Duran
<p>I would try to update the contents of <code>gencerts.sh</code> to get some more context on the error:</p>

<ol>
<li>Add the <code>-v</code> or <code>--verbose</code> option to the <code>curl</code> command.</li>
<li>Use <code>strace</code> to invoke the <code>curl</code> command</li>
</ol>

<p>Both of those options will send more outputs to <code>stderr</code> so you should be able to inspect in your log and get a better idea of the failure mode. Fair warning: <code>strace</code> will generate a lot of output.</p>

<p>Another source of information would be the kube-apiserver logs. You'll need to <a href="https://learn.microsoft.com/en-us/azure/aks/view-master-logs" rel="nofollow noreferrer">enable collection of master logs</a> by adjusting the configuration of your cluster. You should expect every API request to be logged by <code>kube-apiserver</code>.</p>

<p>The first question here is whether the request is received by the control plane at all. To troubleshoot this, I would get a shell on a container inside the cluster and try to recreate the <code>curl</code> request that <code>gencerts.sh</code> is making. There is some information on <a href="https://kubernetes.io/docs/tasks/administer-cluster/access-cluster-api/#without-kubectl-proxy" rel="nofollow noreferrer">accessing the cluster API without kubectl</a> in the kubernetes docs.</p>
