tkn throwing x509: certificate signed by unknown authority errors
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 461
- Forks
- 277
- Avg merge
- 16h 48m
- Merged PRs (30d)
- 95
Description
Versions and Operating System
-
Kubernetes version:
Output of
kubectl version:
Ubuntu Microk8s
Client Version: v1.32.13
Kustomize Version: v5.5.0
Server Version: v1.32.13
-
Tekton Pipeline version:
Output of
tkn versionorkubectl get pods -n tekton-pipelines -l app=tekton-pipelines-controller -o=jsonpath='{.items[0].metadata.labels.version}'
v1.6.0
- Operating System:
Ubuntu v24.04.3 LTS
Expected Behavior
Running the 'tkn' command should work.
Actual Behavior
$ tkn pipeline list
Failed to list objects from default namespace
Error: failed to list Pipelines from namespace default: Get "https://10.67.31.190:16443/api": tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "10.152.183.1")
The 31.190 is the physical interface address and is what is defined in the ~/.kube/cofnig file. the 183.1 is the K8s Service ClusterIP.
Steps to Reproduce the Problem
- Install tkn
- run any tkn command that queries Tekton.
Additional Info
I have tried adding the ca.crt from the K8s cluster to my node's ca certs directory -- no go. I tried telling k8s to ignore tls verfication -- still no go.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing tkn pipeline list against the reported MicroK8s setup, using the cluster endpoint and credentials in ~/.kube/config. Trace how tkn loads Kubernetes configuration and verifies the API server certificate, including the reported physical interface and Service ClusterIP addresses. Done means tkn can query Tekton without the x509 unknown-authority error in this environment.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- cli, networking, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100