kube-dns crashes because it can't access Kubernetes API about dcos-kubernetes-quickstart HOT 11 CLOSED

@pires Thanks, I'll have a try and feedback in next Monday.

from dcos-kubernetes-quickstart.

in the case of using this quickstart, options.json gets created in .deploy folder when you e.g. do make gce, then edit that file and add service_cidr there

from dcos-kubernetes-quickstart.

@pires That's OK, wish you success : )

from dcos-kubernetes-quickstart.

@wyfligamo looking at your logs it seems that kube-dns can't connect to the Kubernetes API (10.100.0.1). Does your host network use any of 10.0.0.0/8 or 10.100.0.0/16 CIDRs?

You can reach the API from your browser because the SSH tunnel forwards to the DC/OS VIP apiserver-insecure.kubernetes.l4lb.thisdcos.directory:9000 and not the Kubernetes API (internal to the Kubernetes cluster) Service, kubernetes.default.svc.cluster.local.

from dcos-kubernetes-quickstart.

@pires Thanks for follow my question.
My cluster IP is 10.100.100.11-17, is that a problem? Can I change the k8s service cluster IPs CIDR ?

from dcos-kubernetes-quickstart.

Yes, it's a problem.

Yes, you can change the Kubernetes service cluster CIDR.

• Assuming you're installing with the default options, create a JSON file with the following contents:

  {
    "kubernetes": {
      "service_cidr": "<YOUR_CIDR_HERE>"
    },
  }

  Attention: replace <YOUR_CIDR_HERE> above with a CIDR block that is not assigned anywhere
  else, e.g. 10.90.0.0/16.

• Save the file.

• Uninstall the framework and wait for all tasks to go away.

• Install the framework as follows:

  dcos package install --yes beta-kubernetes --options=<JSON_FILEPATH>

  Attention: replace <JSON_FILEPATH> above with the path to the JSON file you created above.

from dcos-kubernetes-quickstart.

I will add a sub-section describing this in our Advanced Installation package docs.

from dcos-kubernetes-quickstart.

Thank you @rimusz.

from dcos-kubernetes-quickstart.

Hi, @pires
I change my service CIDR to 10.90.0.0/16, and I'm sure that IPs are not in use, but still get the same problem

from dcos-kubernetes-quickstart.

@pires , I make a mistake, the error is not same,

E0205 11:18:05.352816       1 reflector.go:201] k8s.io/dns/pkg/dns/dns.go:150: Failed to list *v1.Service: Get https://10.90.0.1:443/api/v1/services?resourceVersion=0: x509: certificate is valid for 127.0.0.1, 10.100.0.1, not 10.90.0.1
E0205 11:18:05.419043       1 reflector.go:201] k8s.io/dns/pkg/dns/dns.go:147: Failed to list *v1.Endpoints: Get https://10.90.0.1:443/api/v1/endpoints?resourceVersion=0: x509: certificate is valid for 127.0.0.1, 10.100.0.1, not 10.90.0.1

It seems like I need a certificate for new CIDR?

from dcos-kubernetes-quickstart.

@wyfligamo correct. This is a bug on our end and I have no workaround for you at this point. We will be releasing a new beta later this week and a fix will be included. Please, bear with us.

Thank you for your feedback!

from dcos-kubernetes-quickstart.