helm: x509: certificate signed by unknown authority

Question

I'm using Kube.netes and I recently updated my admin certs used in the kubeconfig . However, after I did that, all the helm commands fail thus:

Error: Get https://cluster.mysite.com/api/v1/namespaces/kube-system/pods?labelSelector=app%3Dhelm%2Cname%3Dtiller: x509: certificate signed by unknown authority

kubectl works as expected:

$ kubectl get nodes
NAME                                           STATUS    ROLES     AGE       VERSION
ip-10-1-0-34.eu-central-1.compute.internal     Ready     master    42d       v1.7.10+coreos.0
ip-10-1-1-51.eu-central-1.compute.internal     Ready     master    42d       v1.7.10+coreos.0
ip-10-1-10-120.eu-central-1.compute.internal   Ready     <none>    42d       v1.7.10+coreos.0
ip-10-1-10-135.eu-central-1.compute.internal   Ready     <none>    27d       v1.7.10+coreos.0
ip-10-1-11-71.eu-central-1.compute.internal    Ready     <none>    42d       v1.7.10+coreos.0
ip-10-1-12-199.eu-central-1.compute.internal   Ready     <none>    8d        v1.7.10+coreos.0
ip-10-1-2-110.eu-central-1.compute.internal    Ready     master    42d       v1.7.10+coreos.0

As far as I've been able to read, helm is supposed to use the same certificates as kubectl , which makes me curious as how how kubectl works, but helm doesn't?

This is a production cluster with internal releases handled through helm charts, so it being solved is imperative.

Any hints would be greatly appreciated.

Answer 1

As a workaround you can try to disable certificate verification. Helm uses the kube config file (by default ~/.kube/config ). You can add insecure-skip-tls-verify: true for the cluster section:

clusters:
- cluster:
    server: https://cluster.mysite.com
    insecure-skip-tls-verify: true
  name: default

Did you already try to reinstall helm/tiller?

kubectl delete deployment tiller-deploy --namespace kube-system
helm init

Also check if you have configured an invalid certificate in the cluster configuration.

Answer 2

Use --insecure-skip-tls-verify to skip tls verification via command line

helm repo add stable --insecure-skip-tls-verify https://charts.helm.sh/stable

Answer 3

In my case the error was caused by an untrusted certificate from the Helm repository. Downloading the certificate and specifying it using the --ca-file option solved the issue (at least in Helm version 3).

helm repo add --ca-file /path/to/certificate.crt repoName https://example/repository

--ca-file string, verify certificates of HTTPS-enabled servers using this CA bundle

Answer 4

In my case, I was running for a single self-manage and the config file was also container ca-file, so the following the above answer was throwing below error

Error: Kubernetes cluster unreachable: Get "https://XX.XX.85.154:6443/version?timeout=32s": x509: certificate is valid for 10.96.0.1, 172.31.25.161, not XX.XX.85.154

And my config was

- cluster:
    certificate-authority-data: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
    server: https://54.176.85.154:6443
    insecure-skip-tls-verify: true

So I had to remove the certificate-authority-data .

- cluster:
    server: https://54.176.85.154:6443
    insecure-skip-tls-verify: true

Answer 5

Adding the line below the -cluster to /home/centos/.kube/config file fixed my issue

 insecure-skip-tls-verify: true

fixed my issue.

my config file now looks like this.

apiVersion: v1
clusters:
- cluster:
    certificate-authority: /home/centos/.minikube/ca.crt
    extensions:
    - extension:
        last-update: Tue, 02 Nov 2021 20:51:44 EDT
        provider: minikube.sigs.k8s.io
        version: v1.23.2
      name: cluster_info
    server: https://192.168.49.2:8443
    insecure-skip-tls-verify: true
  name: minikube
contexts:

Answer 6

For my case, it was an old version of helm (v. 3.6.3 in my case) after I upgraded to helm v.3.9.0 brew upgrade helm everything worked again.

Answer 7

I encountered an edge case for this. You can also get this error if you have multiple kubeconfig files referenced in the KUBECONFIG variable, and more than one file has clusters with the same name.

Answer 8

Although adding repo with --ca-file did the thing, when it tried to download from that repo with the command posted under, I still got the x509: certificate signed by unknown authority

helm dependency update helm/myStuff
Hang tight while we grab the latest from your chart repositories...
...Successfully got an update from the "myRepo" chart repository
Update Complete. ⎈Happy Helming!⎈
Saving 18 charts
Downloading myService from repo https://myCharts.me/
Save error occurred:  could not download https://myCharts.me/stuff.tgz ...
x509: certificate signed by unknown authority
Deleting newly downloaded charts, restoring pre-update state

What I needed to do, apart from adding repo with --ca-file was to download the repository certificate and install it as Current User:

Place all certificates in the following store: Trusted Root Certification Authorities:

After installing the certificate I also needed to restart the computer. After restart, when you open the browser and paste the repo URL it should connect without giving a warning and trusting the site (this way you know you installed the certificate successfully).

You can go ahead and run the command, it should pick the certificate this time.

helm dependency update helm/myStuff
....
Saving 18 charts
Downloading service1 from repo https://myCharts.me/
Downloading service2 from repo https://myCharts.me/
....