opened
vvkkhjt
username_0
**RKE version:**
0.2.2
**Docker version: (`docker version`,`docker info` preferred)**
18.03.0-ce
**Operating system and kernel: (`cat /etc/os-release`, `uname -r` preferred)**
NAME="CentOS Linux"
VERSION="7 (Core)"
ID="centos"
ID_LIKE="rhel fedora"
VERSION_ID="7"
PRETTY_NAME="CentOS Linux 7 (Core)"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:centos:centos:7"
HOME_URL="https://www.centos.org/"
BUG_REPORT_URL="https://bugs.centos.org/"

CENTOS_MANTISBT_PROJECT="CentOS-7"
CENTOS_MANTISBT_PROJECT_VERSION="7"
REDHAT_SUPPORT_PRODUCT="centos"
REDHAT_SUPPORT_PRODUCT_VERSION="7"
**Type/provider of hosts: (VirtualBox/Bare-metal/AWS/GCE/DO)**
Bare-metal
**cluster.yml file:**
```yaml
# If you intened to deploy Kubernetes in an air-gapped environment,
# please consult the documentation on how to configure custom RKE images.
nodes:
- address: 192.168.20.121
  port: "22"
  internal_address: 192.168.20.121
  role:
  - controlplane
  - worker
  - etcd
  hostname_override: rancher121
  user: rketest
  docker_socket: /var/run/docker.sock
  ssh_key: ""
  ssh_key_path: ~/.ssh/id_rsa
  labels: {}
- address: 192.168.20.77
  port: "22"
  internal_address: 192.168.20.77
  role:
  - worker
  hostname_override: rancher77
  user: rketest
  docker_socket: /run/docker.sock
  ssh_key: ""
  ssh_key_path: ~/.ssh/id_rsa
  labels: {}
- address: 192.168.2.193
  port: "22"
  internal_address: 192.168.2.193
  role:
  - worker
  hostname_override: rancher193
  user: rketest
  docker_socket: /run/docker.sock
  ssh_key: ""
  ssh_key_path: ~/.ssh/id_rsa
  labels: {}
- address: 192.168.220.50
  port: "22"
  internal_address: 192.168.220.50
  role:
  - worker
  hostname_override: rancher50
  user: rketest
  docker_socket: /run/docker.sock
  ssh_key: ""
  ssh_key_path: ~/.ssh/id_rsa
  labels: {}
services:
  etcd:
    image: ""
    extra_args: {}
    extra_binds: []
    extra_env: []
    external_urls: []
    ca_cert: ""
    cert: ""
    key: ""
    path: ""
    snapshot: false
    retention: ""
    creation: ""
    #backup_config:
    #  interval_hours: 12
    #  retention: 6
    #  s3backupconfig:
    #    access_key: 6227KC1ZC4EUGMM2PLGZ
    #    secret_key: jPS+U6GlV1wY4P9JATACS52T2dIQPEmHZ+WDxIXh
    #    bucket_name: k8setcd
    #    region: ""
    #    endpoint: http://minio.digi-sky.com:9000
  kube-api:
  nginx_proxy: rancher/rke-tools:v0.1.13
  cert_downloader: rancher/rke-tools:v0.1.13
  kubernetes_services_sidecar: rancher/rke-tools:v0.1.13
  kubedns: rancher/k8s-dns-kube-dns-amd64:1.14.10
  dnsmasq: rancher/k8s-dns-dnsmasq-nanny-amd64:1.14.10
  kubedns_sidecar: rancher/k8s-dns-sidecar-amd64:1.14.10
  kubedns_autoscaler: rancher/cluster-proportional-autoscaler-amd64:1.0.0
  kubernetes: rancher/hyperkube:v1.11.1-rancher1
  flannel: rancher/coreos-flannel:v0.9.1
  flannel_cni: rancher/coreos-flannel-cni:v0.2.0
  calico_node: rancher/calico-node:v3.1.1
  calico_cni: rancher/calico-cni:v3.1.1
  calico_controllers: ""
  calico_ctl: rancher/calico-ctl:v2.0.0
  canal_node: rancher/calico-node:v3.1.1
  canal_cni: rancher/calico-cni:v3.1.1
  canal_flannel: rancher/coreos-flannel:v0.9.1
  wave_node: weaveworks/weave-kube:2.1.2
  weave_cni: weaveworks/weave-npc:2.1.2
  pod_infra_container: rancher/pause-amd64:3.1
  ingress: rancher/nginx-ingress-controller:0.16.2-rancher1
  ingress_backend: rancher/nginx-ingress-controller-defaultbackend:1.4
  metrics_server: rancher/metrics-server-amd64:v0.2.1
ssh_key_path: ~/.ssh/id_rsa
ssh_agent_auth: false
authorization:
  mode: rbac
  options: {}
ignore_docker_version: true
kubernetes_version: ""
private_registries: []
ingress:
  provider: ""
  options: {}
  node_selector: {}
  extra_args: {}
cluster_name: ""
cloud_provider:
  name: ""
prefix_path: ""
addon_job_timeout: 0
bastion_host:
  address: ""
  port: ""
  user: ""
  ssh_key: ""
  ssh_key_path: ""
monitoring:
  provider: ""
  options: {}
```
**Steps to Reproduce:**
1,cluster cert is expire
2,use rke0.2.2 rotate cert
3,restart node
4,cluster is fine,but api-server log has those error log
**Results:**
```bash
I1108 04:18:54.522728       1 logs.go:49] http: TLS handshake error from 192.168.20.77:36946: EOF
I1108 04:18:54.975992       1 logs.go:49] http: TLS handshake error from 127.0.0.1:49140: EOF
I1108 04:18:55.688478       1 logs.go:49] http: TLS handshake error from 192.168.2.253:42702: EOF
I1108 04:18:55.881587       1 logs.go:49] http: TLS handshake error from 192.168.20.77:36980: EOF
I1108 04:18:55.893539       1 logs.go:49] http: TLS handshake error from 192.168.2.253:42604: EOF
I1108 04:18:57.358746       1 logs.go:49] http: TLS handshake error from 192.168.220.50:33830: EOF
I1108 04:18:57.579623       1 logs.go:49] http: TLS handshake error from 192.168.220.50:33824: EOF
I1108 04:18:58.701217       1 logs.go:49] http: TLS handshake error from 10.42.0.224:49746: EOF
I1108 04:18:59.061299       1 logs.go:49] http: TLS handshake error from 192.168.2.253:42646: EOF
I1108 04:18:59.934138       1 controller.go:105] OpenAPI AggregationController: Processing item v1beta1.metrics.k8s.io
E1108 04:18:59.971130       1 controller.go:111] loading OpenAPI spec for "v1beta1.metrics.k8s.io" failed with: OpenAPI spec does not exists
I1108 04:18:59.971180       1 controller.go:119] OpenAPI AggregationController: action for item v1beta1.metrics.k8s.io: Rate Limited Requeue.
E1108 04:19:00.086635       1 authentication.go:62] Unable to authenticate the request due to an error: [x509: certificate has expired or is not yet valid, x509: certificate has expired or is not yet valid]
E1108 04:19:00.088799       1 authentication.go:62] Unable to authenticate the request due to an error: [x509: certificate has expired or is not yet valid, x509: certificate has expired or is not yet valid]
E1108 04:19:00.091591       1 authentication.go:62] Unable to authenticate the request due to an error: [x509: certificate has expired or is not yet valid, x509: certificate has expired or is not yet valid]
E1108 04:19:00.093609       1 authentication.go:62] Unable to authenticate the request due to an error: [x509: certificate has expired or is not yet valid, x509: certificate has expired or is not yet valid]
E1108 04:19:00.095432       1 authentication.go:62] Unable to authenticate the request due to an error: [x509: certificate has expired or is not yet valid, x509: certificate has expired or is not yet valid]
E1108 04:19:00.097300       1 authentication.go:62] Unable to authenticate the request due to an error: [x509: certificate has expired or is not yet valid, x509: certificate has expired or is not yet valid]
E1108 04:19:00.103310       1 authentication.go:62] Unable to authenticate the request due to an error: [x509: certificate has expired or is not yet valid, x509: certificate has expired or is not yet valid]
E1108 04:19:00.106256       1 authentication.go:62] Unable to authenticate the request due to an error: [x509: certificate has expired or is not yet valid, x509: certificate has expired or is not yet valid]
E1108 04:19:00.117610       1 authentication.go:62] Unable to authenticate the request due to an error: [x509: certificate has expired or is not yet valid, x509: certificate has expired or is not yet valid]
E1108 04:19:00.118393       1 authentication.go:62] Unable to authenticate the request due to an error: [x509: certificate has expired or is not yet valid, x509: certificate has expired or is not yet valid]
```
Unable to authenticate the request due to an error: [x509: certificate has expired or is not yet valid, x509: certificate has expired or is not yet valid]
issue
closed
vvkkhjt
username_0
issue