Using the kubeconfig to reach the machine from the outside: certificate error

[johanneskastl]

Dear all,

I am playing around with microshift and found it very nice to use. However, I could not get a connection from the outside using the kubeconfig file from /var/lib/microshift/resources/kubeadmin/kubeconfig.

I copied the file to another machine and made sure to replace localhost with the microshift VM's IP address.

E0607 22:30:36.286397  451581 memcache.go:265] "Unhandled Error" err="couldn't get current server API group list: Get \"https://192.0.2.13:6443/api?timeout=32s\": tls: failed to verify certificate: x509: certificate signed by unknown authority"

Unfortunately I only receive a certificate error, which I guess comes from the node's IP address not being configured in the certificate's SAN (subject alternate name) attribute.

Is there a way to configure this before starting the service?

Kind Regards,
Johannes

[johanneskastl]

OK, looks like this could be configured in /etc/microshift/config.yaml.default or /etc/microshift/config.d/. I'll try this out.

[johanneskastl]

Hmm, I created a file in both of these locations, starting with config.d. I used a *.yaml suffix. The file contained the proper content (as far as I am aware). But still, the kubeconfig copied to the local machine errors out. The file was created after installing microshift, but before starting the service.

Here is the file's content:

apiServer:
  subjectAltNames:
    - my-hostname
    - 192.0.2.13