tektoncd / tektoncd/cli

tkn throwing x509: certificate signed by unknown authority errors

Open
#2,773 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

kind/bug
Dominant language
Go
Stars
461
Forks
277
Avg merge
16h 48m
Merged PRs (30d)
95

Description

Versions and Operating System

  • Kubernetes version:

    Output of kubectl version:

Ubuntu Microk8s
Client Version: v1.32.13
Kustomize Version: v5.5.0
Server Version: v1.32.13
  • Tekton Pipeline version:

    Output of tkn version or kubectl get pods -n tekton-pipelines -l app=tekton-pipelines-controller -o=jsonpath='{.items[0].metadata.labels.version}'

 v1.6.0
  • Operating System:
Ubuntu v24.04.3 LTS

Expected Behavior

Running the 'tkn' command should work.

Actual Behavior

$ tkn pipeline list
Failed to list objects from default namespace 
Error: failed to list Pipelines from namespace default: Get "https://10.67.31.190:16443/api": tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "10.152.183.1")

The 31.190 is the physical interface address and is what is defined in the ~/.kube/cofnig file. the 183.1 is the K8s Service ClusterIP.

Steps to Reproduce the Problem

  1. Install tkn
  2. run any tkn command that queries Tekton.

Additional Info

I have tried adding the ca.crt from the K8s cluster to my node's ca certs directory -- no go. I tried telling k8s to ignore tls verfication -- still no go.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing tkn pipeline list against the reported MicroK8s setup, using the cluster endpoint and credentials in ~/.kube/config. Trace how tkn loads Kubernetes configuration and verifies the API server certificate, including the reported physical interface and Service ClusterIP addresses. Done means tkn can query Tekton without the x509 unknown-authority error in this environment.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
cli, networking, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.