Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1807473

Summary:	Meet "x509: certificate has expired or is not yet valid" error sometimes
Product:	OpenShift Container Platform	Reporter:	Junqi Zhao <juzhao>
Component:	openshift-apiserver	Assignee:	Stefan Schimanski <sttts>
Status:	CLOSED DUPLICATE	QA Contact:	Xingxing Xia <xxia>
Severity:	high	Docs Contact:
Priority:	high
Version:	4.4	CC:	aos-bugs, mfojtik
Target Milestone:	---	Keywords:	Regression
Target Release:	4.4.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-02-27 14:31:15 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Junqi Zhao 2020-02-26 13:02:24 UTC

Description of problem:
# oc get node
Unable to connect to the server: x509: certificate has expired or is not yet valid

after a few minutes, it is normal
# oc get node
NAME                                         STATUS   ROLES    AGE    VERSION
ip-10-0-131-234.us-east-2.compute.internal   Ready    worker   2d6h   v1.17.1
ip-10-0-134-88.us-east-2.compute.internal    Ready    master   2d6h   v1.17.1
ip-10-0-147-187.us-east-2.compute.internal   Ready    worker   2d6h   v1.17.1
ip-10-0-150-58.us-east-2.compute.internal    Ready    master   2d6h   v1.17.1
ip-10-0-160-242.us-east-2.compute.internal   Ready    worker   2d5h   v1.17.1
ip-10-0-172-100.us-east-2.compute.internal   Ready    master   2d6h   v1.17.1

the following apiservices are False (FailedDiscoveryCheck)
# oc get apiservices | grep False
v1.apps.openshift.io                                 openshift-apiserver/api                                                 False (FailedDiscoveryCheck)   2d5h
v1.authorization.openshift.io                        openshift-apiserver/api                                                 False (FailedDiscoveryCheck)   2d5h
v1.build.openshift.io                                openshift-apiserver/api                                                 False (FailedDiscoveryCheck)   2d5h
v1.image.openshift.io                                openshift-apiserver/api                                                 False (FailedDiscoveryCheck)   2d5h
v1.oauth.openshift.io                                openshift-apiserver/api                                                 False (FailedDiscoveryCheck)   2d5h
v1.packages.operators.coreos.com                     openshift-operator-lifecycle-manager/v1-packages-operators-coreos-com   False (FailedDiscoveryCheck)   2d5h
v1.project.openshift.io                              openshift-apiserver/api                                                 False (FailedDiscoveryCheck)   2d5h
v1.quota.openshift.io                                openshift-apiserver/api                                                 False (FailedDiscoveryCheck)   2d5h
v1.route.openshift.io                                openshift-apiserver/api                                                 False (FailedDiscoveryCheck)   2d5h
v1.security.openshift.io                             openshift-apiserver/api                                                 False (FailedDiscoveryCheck)   2d5h
v1.template.openshift.io                             openshift-apiserver/api                                                 False (FailedDiscoveryCheck)   2d5h
v1.user.openshift.io                                 openshift-apiserver/api                                                 False (FailedDiscoveryCheck)   2d5h
v1beta1.metrics.k8s.io                               openshift-monitoring/prometheus-adapter                                 False (FailedDiscoveryCheck)   2d5h

the following logs see the attached file
# oc adm inspect co kube-apiserver kube-controller-manager openshift-apiserver

Version-Release number of selected component (if applicable):
 oc get clusterversion
NAME      VERSION                             AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.4.0-0.nightly-2020-02-23-191320   True        False         2d11h   Cluster version is 4.4.0-0.nightly-2020-02-23-19

How reproducible:
not frequently

Steps to Reproduce:
1. See the description
2.
3.

Actual results:
x509: certificate has expired or is not yet valid

Expected results:
no error

Additional info:

Comment 2 Stefan Schimanski 2020-02-27 14:31:15 UTC


*** This bug has been marked as a duplicate of bug 1805182 ***