Bug 2124576 - oc login on Mac OS getting: error: x509: “kube-apiserver-lb-signer” certificate is not trusted.
Summary: oc login on Mac OS getting: error: x509: “kube-apiserver-lb-signer” certifica...
Keywords:
Status: NEW
Alias: None
Product: OpenShift Online
Classification: Red Hat
Component: Accounts and Billing
Version: 4.x
Hardware: Unspecified
OS: Mac OS
unspecified
low
Target Milestone: ---
: ---
Assignee: Abhishek Gupta
QA Contact: yasun
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-09-06 14:17 UTC by Randy E. Oyarzabal
Modified: 2023-04-27 08:27 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: ---
Doc Text:
Clone Of:
Environment:
Last Closed:
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description Randy E. Oyarzabal 2022-09-06 14:17:15 UTC
Description of problem:
Unable to `oc login` on a mac with latest oc binary. Getting: "error: x509: “kube-apiserver-lb-signer” certificate is not trusted."  Workaround available.

Version-Release number of selected component (if applicable):
MacOS 12.5.1

> oc version
Client Version: 4.11.1
Kustomize Version: v4.5.4
Server Version: 4.11.1
Kubernetes Version: v1.24.0+4f0dd4d


How reproducible:
Consistently

Steps to Reproduce:
1.Login to Openshift GUI
2.Copy Login Command
3.Using the command:

oc login --token=<redacted> --server=https://<redacted>:6443 
error: x509: “kube-apiserver-lb-signer” certificate is not trusted

Then tried both true and false:

oc login --token=<redacted> --server=https://<redacted>:6443 --insecure-skip-tls-verify=true
error: x509: “kube-apiserver-lb-signer” certificate is not trusted

oc login --token=<redacted> --server=https://<redacted>:6443 --insecure-skip-tls-verify=false
error: x509: “kube-apiserver-lb-signer” certificate is not trusted

Actual results:
error: x509: “kube-apiserver-lb-signer” certificate is not trusted

Expected results:
Should be able to log in.

Additional info:
This is a fresh install of Openshift 4.11 Single Node using default certificates.

Workaround:

1. Use the same login command in Linux using the same binary version

2. Copy contents of ~/.kube/config

3. Paste on Mac in same location

4. Do not login, instead: "kubectl config use-context <context name from config>", and it works!  Able to do all oc commands as usual.

Upon looking at the file, it simply does:

- cluster:
    insecure-skip-tls-verify: true
    server: <redacted>
  name: <redacted>:6443

Comment 1 Ricardo Gerardi 2022-09-06 14:29:25 UTC
I confirm I also have the same issue.

Comment 2 Thomas Marko 2022-11-19 08:37:04 UTC
This seems to be related to https://bugzilla.redhat.com/show_bug.cgi?id=2097830. You'll find further workarounds there as well.


Note You need to log in before you can comment on or make changes to this bug.