x509 Keys used for kube api server are incompatible in Azure kubernetes

Tanul 1,281 Reputation points
2022-05-18T19:37:10.833+00:00

Team,

We have AKS 1.19.13 cluster and trying to deploy this kong helm chart which installs kong ingress controller 2.3 and Proxy 2.8. But while spinning ingress-controller container we are getting this error

Failed to get API Group-Resources" error="Get \"https://<ipaddress>:443/api?timeout=32s\": x509: certificate specifies an incompatible key usage"
Error: unable to start controller manager: Get "https://<ipaddress>:443/api?timeout=32s": x509: certificate specifies an incompatible key usage

As per my understanding, kong ingress is trying to reach out Kube api server where this error is coming. It looks like the certificate used for the API server in kubelet has keys added in the x509 v3 Extended Key Usage section which are problematic with an up to date copy of Golang (and to a lesser extent, client-go / controller-runtime). This may suggest that the certificates originally issued on the server were broken in some way.

I have tried understanding this link as well but unable to understand. Anyways, we can't do anything specified here because kube api server is managed by microsoft. By any chance can microsoft team help as its highly impacting our production environment.

Thank you

Azure Kubernetes Service (AKS)
Azure Kubernetes Service (AKS)
An Azure service that provides serverless Kubernetes, an integrated continuous integration and continuous delivery experience, and enterprise-grade security and governance.
2,146 questions
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.