Failed to create the client

[kubernetes]

Failed to create the client

[brancz]

It's highly encouraged to use https for inter cluster communication and even more so to access your cluster. It seems that you are not distributing correct certificates for your cluster components (or they might be generating certs on the fly), which is why you are getting those errors.

kube-state-metrics expects a functioning ServiceAccount setup, which means that the Pod gets a bearer token and a ca cert mounted that it validates cluster communication certificates against.

[andyxning]

@lesterwang Seems that you're using https for your apiserver with a self-signed CA which can not be handled by default golang http client.

[andyxning]

BTW, you should format your code and error log according to markdown for readability.

[brancz]

This seems to be a problem with how your cluster is handling ServiceAccounts. kube-state-metrics simply uses the in cluster client configuration which is guaranteed to work.

[lesterwang]

@andyxning @brancz when I create the kube-state-metrics pod, I use
kubectl -s http://{{apiserver}} create -f ...
I don't know why kube-state-metrics still use the https, I will investigate more.
Sometime I restart the kubernetes node, the kube-state-metrics can running well, sometime not. Even it works well, I can see many log like this

E0504 00:59:53.226610       1 reflector.go:199] k8s.io/kube-state-metrics/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1beta1.ReplicaSet: Get https://10.253.0.1:443/apis/extensions/v1beta1/replicasets?resourceVersion=0: x509: certificate signed by unknown authority
E0504 00:59:53.348348       1 reflector.go:199] k8s.io/kube-state-metrics/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1beta1.Deployment: Get https://10.253.0.1:443/apis/extensions/v1beta1/deployments?resourceVersion=0: x509: certificate signed by unknown authority
E0504 00:59:53.872967       1 reflector.go:199] k8s.io/kube-state-metrics/vendor/k8s.io/client-go/tools/cache/reflector.go:94: Failed to list *v1beta1.DaemonSet: Get https://10.253.0.1:443/apis/extensions/v1beta1/daemonsets?resourceVersion=0: x509: certificate signed by unknown authority

I will check my kuberneter cluster configuration

[lesterwang]

I add the --apiserver args to the container, then no error happens, seems the default apiserver argument can't access the kubernetes cluster

[sri-05]

@lesterwang can you share the container yaml where you added the 11apiserver arg

[lesterwang]

@lesterwang can you share the container yaml where you added the 11apiserver arg

sorry, I can't find it.