helm: x509: certificate signed by unknown authority

Question

I'm using Kubernetes and I recently updated my admin certs used in the kubeconfig. However, after I did that, all the helm commands fail thus:

Error: Get https://cluster.mysite.com/api/v1/namespaces/kube-system/pods?labelSelector=app%3Dhelm%2Cname%3Dtiller: x509: certificate signed by unknown authority

kubectl works as expected:

$ kubectl get nodes
NAME                                           STATUS    ROLES     AGE       VERSION
ip-10-1-0-34.eu-central-1.compute.internal     Ready     master    42d       v1.7.10+coreos.0
ip-10-1-1-51.eu-central-1.compute.internal     Ready     master    42d       v1.7.10+coreos.0
ip-10-1-10-120.eu-central-1.compute.internal   Ready     <none>    42d       v1.7.10+coreos.0
ip-10-1-10-135.eu-central-1.compute.internal   Ready     <none>    27d       v1.7.10+coreos.0
ip-10-1-11-71.eu-central-1.compute.internal    Ready     <none>    42d       v1.7.10+coreos.0
ip-10-1-12-199.eu-central-1.compute.internal   Ready     <none>    8d        v1.7.10+coreos.0
ip-10-1-2-110.eu-central-1.compute.internal    Ready     master    42d       v1.7.10+coreos.0

As far as I've been able to read, helm is supposed to use the same certificates as kubectl, which makes me curious as how how kubectl works, but helm doesn't?

This is a production cluster with internal releases handled through helm charts, so it being solved is imperative.

Any hints would be greatly appreciated.

Brighton

I'm not that familiar with Helm, but does the assumption that "helm is supposed to use the same certificates as kubectl" come from the documentation? – Infirmary

But in any case, the the Helm -> Tiller communication fails or Tiller -> Kube API? – Infirmary

Thanks for your comment, Paweł! Yes, reading about this issue om GKE (I'm using AWS), this error means that "your local Kubernetes config file" must have the correct credentials". github.com/kubernetes/helm/blob/master/docs/install_faq.md – Dedans

Helm to Tiller, I'm pretty sure. When I tried to see if the certificates for the SA matched, I just found the CA, and it was the correct one. – Dedans

is it possible that you have two different kubeconfigs and kubectl is using one (e.g. a new one) and helm is using the other (e.g. an old one?) – Infirmary

I doubt it. I've been using the $KUBECONFIG env variable, which is read by both according to the docs. – Dedans

as a workaround you could try insecure-skip-tls-verify: true make helm working again till the root cause is fixed – Hwahwan

Where would I set that, Sebastian? As far as I know, there is no cli flag for it. – Dedans

@HelgeTalvikSöderström I put it in an answer as it is too much text – Hwahwan

Answer 1

As a workaround you can try to disable certificate verification. Helm uses the kube config file (by default ~/.kube/config). You can add insecure-skip-tls-verify: true for the cluster section:

clusters:
- cluster:
    server: https://cluster.mysite.com
    insecure-skip-tls-verify: true
  name: default

Did you already try to reinstall helm/tiller?

kubectl delete deployment tiller-deploy --namespace kube-system
helm init

Also check if you have configured an invalid certificate in the cluster configuration.

Hwahwan

I haven't tried deleting the deployment, but if I do, what will happen to existing helm deployments? – Dedans

After running helm init, I still get x509: certificate signed by unknown authority. – Dedans

I found the issue. I marked your answer as the solution, but I'd like you to make a small edit to be the actual response - in the cluster configuration, I had pointed to a specific certificate for debugging purposes. I'm not sure why it worked with kubectl and not helm, but removing my certificate there and letting the kubeconfig file specified in $KUBECONFIG work instead solved my issue. Thanks for your help! – Dedans

@HelgeTalvikSöderström Great that you solved the issue. I have edited my answer. – Hwahwan

What is the risk of commenting out the .clusters[*].cluster.certificate-authority-data in kube config? – Bowerbird

Should the name: default line be indented as the two lines above it? – Bergess

Answer 2

In my case, I was running for a single self-manage and the config file was also container ca-file, so the following the above answer was throwing below error

Error: Kubernetes cluster unreachable: Get "https://XX.XX.85.154:6443/version?timeout=32s": x509: certificate is valid for 10.96.0.1, 172.31.25.161, not XX.XX.85.154

And my config was

- cluster:
    certificate-authority-data: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
    server: https://54.176.85.154:6443
    insecure-skip-tls-verify: true

So I had to remove the certificate-authority-data.

- cluster:
    server: https://54.176.85.154:6443
    insecure-skip-tls-verify: true

Faun

Answer 3

Use --insecure-skip-tls-verify to skip tls verification via command line

helm repo add stable --insecure-skip-tls-verify https://charts.helm.sh/stable

Starlet

Answer 4

In my case the error was caused by an untrusted certificate from the Helm repository. Downloading the certificate and specifying it using the --ca-file option solved the issue (at least in Helm version 3).

helm repo add --ca-file /path/to/certificate.crt repoName https://example/repository

--ca-file string, verify certificates of HTTPS-enabled servers using this CA bundle

Cheep

how did you download it ? – Liles

Answer 5

Adding the line below the -cluster to /home/centos/.kube/config file fixed my issue

insecure-skip-tls-verify: true

fixed my issue.

my config file now looks like this.

apiVersion: v1
clusters:
- cluster:
    certificate-authority: /home/centos/.minikube/ca.crt
    extensions:
    - extension:
        last-update: Tue, 02 Nov 2021 20:51:44 EDT
        provider: minikube.sigs.k8s.io
        version: v1.23.2
      name: cluster_info
    server: https://192.168.49.2:8443
    insecure-skip-tls-verify: true
  name: minikube
contexts:

Helios

Answer 6

I encountered an edge case for this. You can also get this error if you have multiple kubeconfig files referenced in the KUBECONFIG variable, and more than one file has clusters with the same name.

Greysun

Answer 7

For my case, it was an old version of helm (v. 3.6.3 in my case) after I upgraded to helm v.3.9.0 brew upgrade helm everything worked again.

Bombproof

Answer 8

If you are using minikube, the problem may be related to the problem described here: https://minikube.sigs.k8s.io/docs/handbook/vpn_and_proxy/#x509-certificate-signed-by-unknown-authority

If you are using Rancher Desktop, the solution is to install required certificates on your computer.

Coadjutrix

Answer 9

Although adding repo with --ca-file did the thing, when it tried to download from that repo with the command posted under, I still got the x509: certificate signed by unknown authority

helm dependency update helm/myStuff
Hang tight while we grab the latest from your chart repositories...
...Successfully got an update from the "myRepo" chart repository
Update Complete. ⎈Happy Helming!⎈
Saving 18 charts
Downloading myService from repo https://myCharts.me/
Save error occurred:  could not download https://myCharts.me/stuff.tgz ...
x509: certificate signed by unknown authority
Deleting newly downloaded charts, restoring pre-update state

What I needed to do, apart from adding repo with --ca-file was to download the repository certificate and install it as Current User:

Place all certificates in the following store: Trusted Root Certification Authorities:

After installing the certificate I also needed to restart the computer. After restart, when you open the browser and paste the repo URL it should connect without giving a warning and trusting the site (this way you know you installed the certificate successfully).

You can go ahead and run the command, it should pick the certificate this time.

helm dependency update helm/myStuff
....
Saving 18 charts
Downloading service1 from repo https://myCharts.me/
Downloading service2 from repo https://myCharts.me/
....

Boatswain