Why do many pods fail to communicate with the master

Question

I have lots of unexplained errors in kubernetes. Often I see errors in logs of pods with the following:

Get https://10.152.183.1:443/api/v1/namespaces/{REDACTED}: x509: certificate is valid for 192.168.1.156, not 10.152.183.1}

I am using Canonical's distribution of Kubernetes deployed with Juju on a MAAS cluster.

Answer 1

Try to remove the easyrsa relation with kubernetes-master in juju.

juju remove-relation easyrsa kubernetes-master

Recreate it afterwards:

juju add-relation easyrsa kubernetes-master

The certificate seems to be recreated for the master, which should now include it's clusterip (10.152.183.1) address as well in the SAN record of the certificate.