<p dir="auto">Dear all,<br>
We met this kind of issue when do "KUBERNETES_PROVIDER=ubuntu ./kube-up.sh".<br>
the issue came at the below step,</p>
<ul dir="auto">
<li>/root/kube/reconfDocker.sh i<br>
docker stop/waiting<br>
docker start/running, process 4601<br>
Connection to 192.168.132.4 closed.<br>
Validating master<br>
Validating root@192.168.132.2<br>
Validating root@192.168.132.3<br>
Validating root@192.168.132.4<br>
Using master 192.168.132.2<br>
cluster "ubuntu" set.<br>
user "ubuntu" set.<br>
context "ubuntu" set.<br>
switched to context "ubuntu".<br>
Wrote config for ubuntu to /root/.kube/config<br>
... calling validate-cluster<br>
Error from server: an error on the server has prevented the request from succeeding<br>
(kubectl failed, will retry 2 times)<br>
Error from server: an error on the server has prevented the request from succeeding<br>
(kubectl failed, will retry 1 times)</li>
</ul>
<p dir="auto">... calling validate-cluster<br>
Error from server: an error on the server has prevented the request from succeeding<br>
(kubectl failed, will retry 2 times)<br>
Error from server: an error on the server has prevented the request from succeeding<br>
(kubectl failed, will retry 1 times)<br>
Error from server: an error on the server has prevented the request from succeeding<br>
('kubectl get nodes' failed, giving up)<br>
Error from server: an error on the server has prevented the request from succeeding<br>
(kubectl failed, will retry 2 times)</p>
<p dir="auto"><strong>Is this a request for help?</strong> (If yes, you should use our troubleshooting guide and community support channels, see <a href="http://kubernetes.io/docs/troubleshooting/" rel="nofollow">http://kubernetes.io/docs/troubleshooting/</a>.):<br>
I tried slack, someone else ran in to my issue as well and just used separate CAs</p>
<p dir="auto"><strong>What keywords did you search in Kubernetes issues before filing this one?</strong> (If you have found any duplicates, you should instead reply there.):</p>
<h2 dir="auto">intermediate certificate</h2>
<p dir="auto"><strong>Is this a BUG REPORT or FEATURE REQUEST?</strong> (choose one):<br>
FEATURE REQUEST</p>

<p dir="auto"><strong>Kubernetes version</strong> (use <code class="notranslate">kubectl version</code>):<br>
Client Version: version.Info{Major:"1", Minor:"3", GitVersion:"v1.3.7+a2cba278", GitCommit:"a2cba278cba1f6881bb0a7704d9cac6fca6ed435", GitTreeState:"not a git tree", BuildDate:"2016-09-23T02:19:56Z", GoVersion:"go1.7.1", Compiler:"gc", Platform:"darwin/amd64"}<br>
Server Version: version.Info{Major:"1", Minor:"4+", GitVersion:"v1.4.0-beta.8+coreos.0", GitCommit:"9c19ded313d3b3b86eadf179aed553854138abd7", GitTreeState:"clean", BuildDate:"2016-09-19T18:58:14Z", GoVersion:"go1.6.3", Compiler:"gc", Platform:"linux/amd64"}</p>
<p dir="auto"><strong>Environment</strong>:</p>
<ul dir="auto">
<li><strong>Cloud provider or hardware configuration</strong>:<br>
aws</li>
<li><strong>OS</strong> (e.g. from /etc/os-release):<br>
NAME=CoreOS<br>
ID=coreos<br>
VERSION=1122.2.0<br>
VERSION_ID=1122.2.0<br>
BUILD_ID=2016-09-06-1449<br>
PRETTY_NAME="CoreOS 1122.2.0 (MoreOS)"<br>
ANSI_COLOR="1;32"<br>
HOME_URL="<a href="https://coreos.com/" rel="nofollow">https://coreos.com/</a>"<br>
BUG_REPORT_URL="<a href="https://github.com/coreos/bugs/issues">https://github.com/coreos/bugs/issues</a>"</li>
<li><strong>Kernel</strong> (e.g. <code class="notranslate">uname -a</code>):<br>
Linux ip-10-0-0-50.ec2.internal 4.7.0-coreos <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="35192559" data-permission-text="Title is private" data-url="https://github.com/kubernetes/kubernetes/issues/1" data-hovercard-type="issue" data-hovercard-url="/kubernetes/kubernetes/issues/1/hovercard" href="https://github.com/kubernetes/kubernetes/issues/1">#1</a> SMP Tue Sep 6 14:39:20 UTC 2016 x86_64 Intel(R) Xeon(R) CPU E5-2686 v4 @ 2.30GHz GenuineIntel GNU/Linux</li>
<li><strong>Install tools</strong>:<br>
kube-aws<br>
Manually generated ssl certs</li>
<li><strong>Others</strong>:<br>
I'm using client-cert+ABAC auth and have audit logging enabled.</li>
</ul>
<p dir="auto"><strong>What happened</strong>:<br>
Clients using SSL certs for auth show the subject CN of their intermediate cert not their entity cert.<br>
I set the client-cert to a certificate chain:<br>
<br>
<br>
<br>
ca.pem on all machines is set to the Root Cert</p>
<p dir="auto"><strong>What you expected to happen</strong>:<br>
I expect the client to use the Subject CN of the entity cert.<br>
The key I'm using is for the entity and the connection is secure, My audit logs just show the CN for the intermediate CA.</p>
<p dir="auto"><strong>How to reproduce it</strong> (as minimally and precisely as possible):<br>
Create a root CA cert<br>
Use it to sign an intermediate CA cert.<br>
Use root cert as CA, use certificate chain bundle as client cert, use correct client key</p>
<p dir="auto">I'm seeing this in audit logs when I use the chain:<br>
2016-10-10T23:04:07.466636575Z AUDIT: id="79f6295c-d229-488b-af12-67cca35e6eee" ip="10.0.0.12" method="GET" user="PeriscopeData Key1 Sub-CA" as="" namespace="" uri="/api/v1/nodes?fieldSelector=metadata.name%3Dip-10-0-0-12.ec2.internal&amp;resourceVersion=0"</p>
<p dir="auto">When I set the ca.pem to my sub-ca key and don't use my bundled certs, I see<br>
2016-10-11T00:40:33.367066951Z AUDIT: id="704c267f-e487-4468-b39a-32ca4ef749ec" ip="10.0.0.12" method="GET" user="kube-worker" as="" namespace="" uri="/api/v1/nodes/ip-10-0-0-12.ec2.internal"</p>