kube-apiserver lack --service-cluster-ip-range param

[ermazi]

kube-controller-manager use --service-cluster-ip-range=10.32.0.0/24 param, but svc is allocated with 10.0.0.0/24!!!

to fix:
add --service-cluster-ip-range=10.32.0.0/24 param to kube-apiserver!!!

it works!

[Amderry]

Noticed it, too. But when doing as you said cluster breaks and starts arguing about TLS. For instance kube-controller-manager keeps saying this:

May 28 17:20:43 server kube-controller-manager[868]: E0528 17:20:43.133184 868 leaderelection.go:436] error retrieving resource lock kube-system/kube-controller-manager: Get "https://server.kubernetes.local:6443/apis/coordination.k8s.io/v1/namespaces/kube-system/leases/kube-controller-manager?timeout=5s": tls: failed to verify certificate: x509: certificate is valid for kubernetes.default.svc, kubernetes.default, kubernetes, localhost, not server.kubernetes.local

Any ideas?

[ermazi]

Noticed it, too. But when doing as you said cluster breaks and starts arguing about TLS. For instance kube-controller-manager keeps saying this:

May 28 17:20:43 server kube-controller-manager[868]: E0528 17:20:43.133184 868 leaderelection.go:436] error retrieving resource lock kube-system/kube-controller-manager: Get "https://server.kubernetes.local:6443/apis/coordination.k8s.io/v1/namespaces/kube-system/leases/kube-controller-manager?timeout=5s": tls: failed to verify certificate: x509: certificate is valid for kubernetes.default.svc, kubernetes.default, kubernetes, localhost, not server.kubernetes.local

Any ideas?

just check kube-controlloer-manager kubeconfig file.

[ermazi]

i check file author offered, it's correct!!

so just check ca.conf file on your host:D

[Amderry]

Sorry, my bad, forgot to add backslash for escaping newline after adding --service-cluster-ip-range=10.32.0.0/24 to kube-apiserver.service so TLS options were skipping. Everything works now.

[nkritsky]

Raised #879 to fix this